@serve.zone/dcrouter 15.10.0 → 16.0.0

package/ts/email/classes.mail-dns-sync.ts

@@ -0,0 +1,218 @@
+import { logger } from '../logger.js';
+import { DnsRecordDoc } from '../db/documents/classes.dns-record.doc.js';
+import { DomainDoc } from '../db/documents/classes.domain.doc.js';
+import { EmailDomainDoc } from '../db/documents/classes.email-domain.doc.js';
+import type { DcRouter } from '../classes.dcrouter.js';
+import type { IRemoteIngress } from '../../ts_interfaces/data/remoteingress.js';
+
+export const MAIL_DNS_SYNC_CREATED_BY = 'mail-edge-sync';
+
+interface IDesiredMailDnsRecord {
+  name: string;
+  type: 'A' | 'AAAA';
+  value: string;
+}
+
+/**
+ * Reconciles the mail-facing A/AAAA records that make edges — never the hub —
+ * the public identity of the mail platform:
+ *  (a) shared mail hostname → publicIp/publicIpV6 of every enabled mail edge,
+ *  (b) each edge's mailHostname → that edge's IPs (FCrDNS for outbound EHLO),
+ *  (c) mx.<domain> → the pinned edges' IPs for every pinned email domain.
+ * Records are DB-backed DnsRecordDoc rows owned via createdBy 'mail-edge-sync';
+ * provider-hosted zones (e.g. Cloudflare) are written through DnsManager's
+ * provider path, dcrouter-authoritative zones serve immediately.
+ */
+export class MailDnsSync {
+  private syncInFlight?: Promise<void>;
+  private resyncQueued = false;
+
+  constructor(private dcRouterRef: DcRouter) {}
+
+  /** Fire-and-forget trigger for CRUD hooks; failures are logged, not thrown. */
+  public requestSync(reason: string): void {
+    this.sync(reason).catch((err: unknown) => {
+      logger.log('error', `MailDnsSync failed (${reason}): ${(err as Error).message}`);
+    });
+  }
+
+  /** Coalescing entry point: concurrent triggers fold into one follow-up pass. */
+  public async sync(reason: string): Promise<void> {
+    if (this.syncInFlight) {
+      this.resyncQueued = true;
+      return this.syncInFlight;
+    }
+    this.syncInFlight = this.reconcile(reason).finally(() => {
+      this.syncInFlight = undefined;
+      if (this.resyncQueued) {
+        this.resyncQueued = false;
+        this.requestSync(`${reason} (coalesced)`);
+      }
+    });
+    return this.syncInFlight;
+  }
+
+  private async reconcile(reason: string): Promise<void> {
+    if (this.dcRouterRef.options.dbConfig?.enabled === false) {
+      return;
+    }
+    const dnsManager = this.dcRouterRef.dnsManager;
+    const remoteIngressManager = this.dcRouterRef.remoteIngressManager;
+    if (!dnsManager || !remoteIngressManager) {
+      // Without both managers the edge registry / record store is not
+      // authoritative — skip entirely rather than delete managed records.
+      return;
+    }
+
+    const desired = await this.computeDesiredRecords();
+    const zones = await DomainDoc.findAll();
+
+    // Place each desired record in its zone (longest-suffix match). Records
+    // without a managed zone are reported — the operator must onboard the zone.
+    const placed = new Map<string, { domainId: string; record: IDesiredMailDnsRecord }>();
+    const unplacedNames = new Set<string>();
+    for (const record of desired) {
+      const zone = this.findZoneForName(record.name, zones);
+      if (!zone) {
+        unplacedNames.add(record.name);
+        continue;
+      }
+      placed.set(`${zone.id}|${record.name}|${record.type}|${record.value}`, {
+        domainId: zone.id,
+        record,
+      });
+    }
+    for (const name of unplacedNames) {
+      logger.log('warn', `MailDnsSync: no managed DNS zone covers ${name} — record skipped`);
+    }
+
+    const existing = (await DnsRecordDoc.findAll())
+      .filter((record) => record.createdBy === MAIL_DNS_SYNC_CREATED_BY);
+
+    let created = 0;
+    let deleted = 0;
+
+    for (const record of existing) {
+      const key = `${record.domainId}|${record.name}|${record.type}|${record.value}`;
+      if (placed.has(key)) {
+        placed.delete(key); // already present — nothing to create
+        continue;
+      }
+      const result = await dnsManager.deleteRecord(record.id);
+      if (result.success) {
+        deleted++;
+      } else {
+        logger.log('warn', `MailDnsSync: failed to delete stale ${record.type} ${record.name} → ${record.value}: ${result.message}`);
+      }
+    }
+
+    for (const { domainId, record } of placed.values()) {
+      const result = await dnsManager.createRecord({
+        domainId,
+        name: record.name,
+        type: record.type,
+        value: record.value,
+        // Short TTL: edge IPs are burnable identities and failover heals via DNS.
+        ttl: 300,
+        createdBy: MAIL_DNS_SYNC_CREATED_BY,
+      });
+      if (result.success) {
+        created++;
+      } else {
+        logger.log('warn', `MailDnsSync: failed to create ${record.type} ${record.name} → ${record.value}: ${result.message}`);
+      }
+    }
+
+    if (created > 0 || deleted > 0) {
+      logger.log('info', `MailDnsSync (${reason}): ${created} record(s) created, ${deleted} deleted`);
+    }
+  }
+
+  private async computeDesiredRecords(): Promise<IDesiredMailDnsRecord[]> {
+    const remoteIngressManager = this.dcRouterRef.remoteIngressManager!;
+    const desired: IDesiredMailDnsRecord[] = [];
+
+    const pushEdgeIps = (name: string | undefined, edge: IRemoteIngress) => {
+      if (!name) return;
+      const normalizedName = name.toLowerCase();
+      if (edge.publicIp) {
+        desired.push({ name: normalizedName, type: 'A', value: edge.publicIp });
+      }
+      if (edge.publicIpV6) {
+        desired.push({ name: normalizedName, type: 'AAAA', value: edge.publicIpV6 });
+      }
+    };
+
+    // (a) shared mail hostname → every enabled mail edge
+    const sharedHostname = this.getSharedMailHostname();
+    const mailEdges = remoteIngressManager.getMailEdges();
+    for (const edge of mailEdges) {
+      pushEdgeIps(sharedHostname, edge);
+    }
+
+    // (b) per-edge FCrDNS hostname → that edge only
+    for (const edge of remoteIngressManager.getAllEdges()) {
+      if (!edge.enabled) continue;
+      pushEdgeIps(edge.mailHostname, edge);
+    }
+
+    // (c) mx.<domain> → pinned edges for every pinned email domain
+    const emailDomainDocs = await EmailDomainDoc.findAll();
+    for (const doc of emailDomainDocs) {
+      const edgeFilter = doc.remoteIngress?.edgeFilter;
+      if (!edgeFilter?.length) continue;
+      const pinnedEdges = remoteIngressManager.resolveEdgesByFilter(edgeFilter);
+      if (pinnedEdges.length === 0) {
+        logger.log('warn', `MailDnsSync: email domain ${doc.domain} pin [${edgeFilter.join(', ')}] matches no enabled edge — mx.${doc.domain} not published`);
+        continue;
+      }
+      for (const edge of pinnedEdges) {
+        pushEdgeIps(`mx.${doc.domain}`, edge);
+      }
+    }
+
+    // Hard hub-hiding guard: a hub IP must never become a mail-facing answer.
+    const hubIps = new Set(
+      [this.dcRouterRef.options.publicIp, this.dcRouterRef.detectedPublicIp].filter(Boolean),
+    );
+    const guarded = desired.filter((record) => {
+      if (hubIps.has(record.value)) {
+        logger.log('error', `MailDnsSync: refusing to publish ${record.type} ${record.name} → ${record.value} — value is the hub public IP`);
+        return false;
+      }
+      return true;
+    });
+
+    // Dedupe (several edges may share a tag and a pin may overlap the mail pool)
+    const seen = new Set<string>();
+    return guarded.filter((record) => {
+      const key = `${record.name}|${record.type}|${record.value}`;
+      if (seen.has(key)) return false;
+      seen.add(key);
+      return true;
+    });
+  }
+
+  private getSharedMailHostname(): string | undefined {
+    const hostname = this.dcRouterRef.options.emailConfig?.hostname
+      || this.dcRouterRef.options.tls?.domain;
+    if (!hostname || hostname === 'localhost') {
+      return undefined;
+    }
+    return hostname;
+  }
+
+  /** Longest-suffix zone match: 'mx.gated.one' → zone 'gated.one'. */
+  private findZoneForName(name: string, zones: DomainDoc[]): DomainDoc | undefined {
+    let best: DomainDoc | undefined;
+    for (const zone of zones) {
+      const zoneName = zone.name.toLowerCase();
+      if (name === zoneName || name.endsWith(`.${zoneName}`)) {
+        if (!best || zoneName.length > best.name.length) {
+          best = zone;
+        }
+      }
+    }
+    return best;
+  }
+}

package/ts/email/classes.mail-egress-coordinator.ts

@@ -0,0 +1,125 @@
+import type {
+  IOutboundConnectionProxy,
+  IOutboundConnectionProxyContext,
+} from '@push.rocks/smartmta';
+import { logger } from '../logger.js';
+import { REMOTE_INGRESS_MAIL_TAG } from '../../ts_interfaces/data/remoteingress.js';
+import type { IEmailOutboundEgressStatus, TEmailOutboundMode } from '../../ts_interfaces/data/email-settings.js';
+import type { DcRouter } from '../classes.dcrouter.js';
+
+/**
+ * Routes outbound SMTP deliveries over RemoteIngress edges: resolves the
+ * outbound mode per attempt (no silent direct fallback), maps sender-domain
+ * pins to an edgeFilter, opens the per-delivery QUIC egress proxy, and
+ * presents the selected edge's FCrDNS hostname as the EHLO identity.
+ */
+export class MailEgressCoordinator {
+  constructor(private dcRouterRef: DcRouter) {}
+
+  /**
+   * smartmta connectionProxyProvider. Wired unconditionally so the outbound
+   * mode is resolved per delivery attempt: a failed/late settings manager
+   * defers mail loudly instead of silently degrading to direct-from-hub
+   * egress, and mode changes take effect without an email server restart.
+   */
+  public async provideConnectionProxy(
+    context: IOutboundConnectionProxyContext,
+  ): Promise<IOutboundConnectionProxy | null> {
+    const mode = this.resolveOutboundModeStrict();
+    if (mode === 'direct') {
+      return null;
+    }
+    return await this.createRemoteIngressConnectionProxy(context);
+  }
+
+  /**
+   * Resolve the effective email outbound mode for a delivery attempt.
+   * Throws when the settings manager is unavailable — deferring the delivery —
+   * because guessing here is what silently degraded outbound to direct egress.
+   */
+  public resolveOutboundModeStrict(): TEmailOutboundMode {
+    if (this.dcRouterRef.emailSettingsManager) {
+      return this.dcRouterRef.emailSettingsManager.getOutboundMode();
+    }
+    if (this.dcRouterRef.options.emailOutboundMode) {
+      return this.dcRouterRef.options.emailOutboundMode;
+    }
+    throw new Error('EmailSettingsManager unavailable: refusing to resolve email outbound mode implicitly');
+  }
+
+  /**
+   * Readiness of the RemoteIngress outbound mail egress path (mail-tagged edges).
+   */
+  public getOutboundEgressStatus(): IEmailOutboundEgressStatus {
+    const tunnelManager = this.dcRouterRef.tunnelManager;
+    if (!tunnelManager) {
+      return { ready: false, eligibleEdgeCount: 0, reason: 'RemoteIngress hub is not running' };
+    }
+    return tunnelManager.getEgressReadiness([REMOTE_INGRESS_MAIL_TAG]);
+  }
+
+  /**
+   * Post-start preflight: with remoteIngress outbound (the default), mail
+   * defers until a QUIC mail egress edge connects. Surface that loudly
+   * instead of silently queueing.
+   */
+  public logEgressPreflight(): void {
+    try {
+      if (this.resolveOutboundModeStrict() === 'remoteIngress') {
+        const egressStatus = this.getOutboundEgressStatus();
+        if (!egressStatus.ready) {
+          logger.log('warn', `Outbound mail egress is NOT ready (${egressStatus.reason}); outbound mail will defer until a QUIC mail egress edge connects`);
+        }
+      }
+    } catch (error: unknown) {
+      logger.log('error', `Outbound mail mode could not be resolved: ${(error as Error).message}; outbound deliveries will defer until EmailSettingsManager is available`);
+    }
+  }
+
+  private async createRemoteIngressConnectionProxy(
+    context: IOutboundConnectionProxyContext,
+  ): Promise<IOutboundConnectionProxy> {
+    const tunnelManager = this.dcRouterRef.tunnelManager;
+    if (!tunnelManager) {
+      throw new Error('RemoteIngress outbound SMTP egress is enabled, but the hub is not running');
+    }
+
+    // Per-domain pinning: a sender domain with a configured edgeFilter uses only
+    // matching edges; everything else uses the mail-tagged edge pool.
+    let edgeFilter: string[] = [REMOTE_INGRESS_MAIL_TAG];
+    if (context.senderDomain && this.dcRouterRef.emailDomainManager) {
+      const domain = await this.dcRouterRef.emailDomainManager.getByDomain(context.senderDomain);
+      if (domain?.remoteIngress?.edgeFilter?.length) {
+        edgeFilter = domain.remoteIngress.edgeFilter;
+      }
+    }
+
+    const connectionTimeoutMs = this.dcRouterRef.options.emailConfig?.outbound?.connectionTimeout ?? 30_000;
+    const proxy = await tunnelManager.startEgressTcpProxy({
+      logicalHost: context.host,
+      port: context.port,
+      serverFirst: !context.secure,
+      connectTimeoutMs: connectionTimeoutMs,
+      acceptTimeoutMs: connectionTimeoutMs,
+      edgeFilter,
+    });
+    let closed = false;
+    return {
+      connectHost: proxy.listenHost,
+      connectPort: proxy.listenPort,
+      poolKey: `remoteIngress:${proxy.edgeId}:${context.host}:${context.port}`,
+      ehloHostname: this.dcRouterRef.remoteIngressManager?.getEdge(proxy.edgeId)?.mailHostname,
+      close: async () => {
+        if (closed) {
+          return;
+        }
+        closed = true;
+        try {
+          await tunnelManager.stopEgressTcpProxy(proxy.proxyId);
+        } catch (err: unknown) {
+          logger.log('warn', `Failed to stop RemoteIngress egress proxy ${proxy.proxyId}: ${(err as Error).message}`);
+        }
+      },
+    };
+  }
+}

package/ts/email/classes.workapp-mail-manager.ts

@@ -7,7 +7,7 @@ import type {
 } from '@push.rocks/smartmta';
 import type { Buffer } from 'node:buffer';
 import * as plugins from '../plugins.js';
-import type { CachedEmail } from '../db/index.js';
+import { CachedEmail } from '../db/index.js';
 import type { DcRouter } from '../classes.dcrouter.js';
 import type * as interfaces from '../../ts_interfaces/index.js';
 
@@ -30,8 +30,38 @@ type TMailAddressBindingSyncResponse = plugins.servezoneInterfaces.requests.mail
 type TMailAddressBindingDeleteResponse = plugins.servezoneInterfaces.requests.mail.IReq_DeleteMailAddressBinding['response'];
 type TMailCredentialRotateResponse = plugins.servezoneInterfaces.requests.mail.IReq_RotateMailCredential['response'];
 type TMailEnqueueResponse = plugins.servezoneInterfaces.requests.mail.IReq_EnqueueMail['response'];
+type TMailDeliveryStatusResponse = plugins.servezoneInterfaces.requests.mail.IReq_GetMailDeliveryStatus['response'];
 type TMailEndpointRegistrationResponse = plugins.servezoneInterfaces.requests.mail.IReq_RegisterServiceMailEndpoint['response'];
 type TWorkAppMailBinding = plugins.servezoneInterfaces.data.IWorkAppMailBinding;
+type TCachedEmailWithTimestamps = CachedEmail & {
+  createdAt?: Date | number | string;
+  updatedAt?: Date | number | string;
+};
+type TSmartMtaStatusQueueItem = {
+  status?: 'pending' | 'processing' | 'queued' | 'delivered' | 'failed' | 'deferred';
+  attempts?: number;
+  nextAttempt?: Date;
+  lastError?: string;
+  processingResult?: {
+    headers?: Record<string, string>;
+    email?: {
+      headers?: Record<string, string>;
+    };
+  };
+};
+type TCachedEmailRouteData = {
+  session?: {
+    user?: {
+      username?: string;
+    };
+  };
+  smartMta?: {
+    status?: 'queued' | 'deferred' | 'delivered' | 'failed';
+    nextAttempt?: string;
+    lastError?: string;
+    updatedAt?: string;
+  };
+};
 
 interface IStoredWorkAppMailIdentity {
   id: string;
@@ -370,6 +400,31 @@ export class WorkAppMailManager {
     }
   }
 
+  public async getMailDeliveryStatus(
+    spoolItemIdArg: string,
+  ): Promise<TMailDeliveryStatusResponse> {
+    const cachedEmail = await this.getCachedEmailById(spoolItemIdArg);
+    if (!cachedEmail) {
+      return { attempts: [] };
+    }
+    return await this.buildMailDeliveryStatus(cachedEmail);
+  }
+
+  public async getMailDeliveryStatusForCredential(
+    authArg: plugins.servezoneInterfaces.requests.mail.IMailSubmissionRequestAuth,
+    spoolItemIdArg: string,
+  ): Promise<TMailDeliveryStatusResponse> {
+    const identity = await this.authenticateMailCredential(authArg);
+    const cachedEmail = await this.getCachedEmailById(spoolItemIdArg);
+    if (!cachedEmail) {
+      return { attempts: [] };
+    }
+    if (!this.cachedEmailBelongsToIdentity(cachedEmail, identity)) {
+      throw new Error('Mail credential is not authorized for this spool item');
+    }
+    return await this.buildMailDeliveryStatus(cachedEmail);
+  }
+
   public async registerServiceMailEndpoint(
     authArg: plugins.servezoneInterfaces.requests.mail.IMailSubmissionRequestAuth,
     peerArg: { tags?: Set<string> },
@@ -889,6 +944,144 @@ export class WorkAppMailManager {
     return this.normalizeInboundTarget(identity.inboundTarget || this.toMailInboundTarget(identity.inbound));
   }
 
+  private async getCachedEmailById(spoolItemIdArg: string): Promise<CachedEmail | null> {
+    const spoolItemId = String(spoolItemIdArg || '').trim();
+    if (!spoolItemId || !this.dcRouterRef.dcRouterDb?.isReady()) {
+      return null;
+    }
+    return await CachedEmail.findById(spoolItemId);
+  }
+
+  private async buildMailDeliveryStatus(
+    cachedEmailArg: CachedEmail,
+  ): Promise<TMailDeliveryStatusResponse> {
+    const queueItem = this.findQueueItemForCachedEmail(cachedEmailArg.id);
+    const routeData = this.parseCachedEmailRouteData(cachedEmailArg);
+    const owner = await this.resolveCachedEmailOwner(cachedEmailArg);
+    const status = this.mapMailSpoolStatus(cachedEmailArg, queueItem);
+    const cachedEmailWithTimestamps = cachedEmailArg as TCachedEmailWithTimestamps;
+    const createdAt = this.toTimestamp(cachedEmailWithTimestamps.createdAt) || Date.now();
+    const updatedAt = this.toTimestamp(cachedEmailWithTimestamps.updatedAt) || createdAt;
+    const nextAttemptAt = status === 'delivered' || status === 'failed'
+      ? undefined
+      : this.toTimestamp(queueItem?.nextAttempt) || this.toTimestamp(routeData.smartMta?.nextAttempt) || this.toTimestamp(cachedEmailArg.nextAttempt);
+    const lastError = queueItem?.lastError || cachedEmailArg.lastError || routeData.smartMta?.lastError || undefined;
+
+    return {
+      spoolItem: {
+        id: cachedEmailArg.id,
+        owner,
+        direction: this.getCachedEmailSessionUsername(cachedEmailArg) ? 'outbound' : 'inbound',
+        status,
+        envelope: {
+          mailFrom: cachedEmailArg.from,
+          rcptTo: cachedEmailArg.to || [],
+        },
+        messageId: cachedEmailArg.messageId,
+        subject: cachedEmailArg.subject,
+        target: this.getCachedEmailSessionUsername(cachedEmailArg)
+          ? { type: 'mtaRelay', label: 'SmartMTA outbound relay' }
+          : undefined,
+        attempts: Math.max(cachedEmailArg.attempts || 0, queueItem?.attempts || 0),
+        nextAttemptAt,
+        lastError,
+        createdAt,
+        updatedAt,
+      },
+      attempts: [],
+    };
+  }
+
+  private findQueueItemForCachedEmail(cachedEmailIdArg: string): TSmartMtaStatusQueueItem | undefined {
+    const emailServer = this.dcRouterRef.emailServer;
+    if (!emailServer?.getQueueItems) {
+      return undefined;
+    }
+    return (emailServer.getQueueItems() as TSmartMtaStatusQueueItem[]).find((itemArg) => {
+      return this.getQueueItemCachedEmailId(itemArg) === cachedEmailIdArg;
+    });
+  }
+
+  private getQueueItemCachedEmailId(itemArg: TSmartMtaStatusQueueItem): string | undefined {
+    const headerName = 'x-dcrouter-cached-email-id';
+    const headers = itemArg?.processingResult?.headers || itemArg?.processingResult?.email?.headers;
+    if (!headers) {
+      return undefined;
+    }
+    const matchingHeaderName = Object.keys(headers).find((keyArg) => keyArg.toLowerCase() === headerName);
+    return matchingHeaderName ? headers[matchingHeaderName] : undefined;
+  }
+
+  private async resolveCachedEmailOwner(
+    cachedEmailArg: CachedEmail,
+  ): Promise<plugins.servezoneInterfaces.data.IMailResourceOwner | undefined> {
+    const username = this.getCachedEmailSessionUsername(cachedEmailArg);
+    if (!username) {
+      return undefined;
+    }
+    const identity = (await this.readStoredIdentities()).find((identityArg) => identityArg.smtp.username === username);
+    return identity ? this.toMailOwner(identity.ownership) : undefined;
+  }
+
+  private cachedEmailBelongsToIdentity(
+    cachedEmailArg: CachedEmail,
+    identityArg: IStoredWorkAppMailIdentity,
+  ): boolean {
+    return this.normalizeAddress(cachedEmailArg.from || '') === identityArg.address
+      && this.getCachedEmailSessionUsername(cachedEmailArg) === identityArg.smtp.username;
+  }
+
+  private getCachedEmailSessionUsername(cachedEmailArg: CachedEmail): string | undefined {
+    const routeData = this.parseCachedEmailRouteData(cachedEmailArg);
+    const username = routeData.session?.user?.username;
+    return typeof username === 'string' && username ? username : undefined;
+  }
+
+  private parseCachedEmailRouteData(cachedEmailArg: CachedEmail): TCachedEmailRouteData {
+    try {
+      return cachedEmailArg.routeData ? JSON.parse(cachedEmailArg.routeData) : {};
+    } catch {
+      return {};
+    }
+  }
+
+  private mapMailSpoolStatus(
+    cachedEmailArg: CachedEmail,
+    queueItemArg?: TSmartMtaStatusQueueItem,
+  ): plugins.servezoneInterfaces.data.TMailSpoolStatus {
+    if (!queueItemArg && cachedEmailArg.status === 'pending') {
+      return 'accepted';
+    }
+    const status = queueItemArg?.status || cachedEmailArg.status;
+    switch (status) {
+      case 'processing':
+        return 'delivering';
+      case 'delivered':
+        return 'delivered';
+      case 'deferred':
+        return 'deferred';
+      case 'failed':
+        return 'failed';
+      case 'pending':
+      case 'queued':
+      default:
+        return 'queued';
+    }
+  }
+
+  private toTimestamp(valueArg: unknown): number | undefined {
+    if (!valueArg) {
+      return undefined;
+    }
+    if (typeof valueArg === 'number' && Number.isFinite(valueArg)) {
+      return valueArg;
+    }
+    const timestamp = valueArg instanceof Date
+      ? valueArg.getTime()
+      : new Date(String(valueArg)).getTime();
+    return Number.isFinite(timestamp) ? timestamp : undefined;
+  }
+
   private async authenticateMailCredential(
     authArg: plugins.servezoneInterfaces.requests.mail.IMailSubmissionRequestAuth,
     addressArg?: string,

package/ts/email/index.ts

@@ -1,6 +1,8 @@
 export * from './classes.accepted-email-spool.js';
 export * from './classes.email-domain.manager.js';
 export * from './classes.email-route-builder.js';
+export * from './classes.mail-dns-sync.js';
+export * from './classes.mail-egress-coordinator.js';
 export * from './classes.email-settings.manager.js';
 export * from './classes.smartmta-storage-manager.js';
 export * from './classes.workapp-mail-manager.js';

package/ts/opsserver/handlers/config.handler.ts

@@ -107,7 +107,9 @@ export class ConfigHandler {
       ports: emailSettings?.ports || opts.emailConfig?.ports || [],
       portMapping,
       hostname: emailSettings?.hostname || opts.emailConfig?.hostname || null,
-      outboundMode: emailSettings?.outboundMode || opts.emailOutboundMode || 'direct',
+      // Absent everywhere means the 'remoteIngress' default applies — never
+      // silently claim 'direct' (that masking was the outbound activation bug).
+      outboundMode: emailSettings?.outboundMode || opts.emailOutboundMode || 'remoteIngress',
       domains: emailDomains,
       emailRouteCount: emailSettings?.routeCount ?? opts.emailConfig?.routes?.length ?? 0,
       receivedEmailsPath: emailSettings?.receivedEmailsPath || opts.emailPortConfig?.receivedEmailsPath || null,

package/ts/opsserver/handlers/email-domain.handler.ts

@@ -73,6 +73,7 @@ export class EmailDomainHandler {
               dkimKeySize: dataArg.dkimKeySize,
               rotateKeys: dataArg.rotateKeys,
               rotationIntervalDays: dataArg.rotationIntervalDays,
+              remoteIngress: dataArg.remoteIngress,
             });
             return { success: true, domain };
           } catch (err: unknown) {
@@ -96,6 +97,7 @@ export class EmailDomainHandler {
               rotateKeys: dataArg.rotateKeys,
               rotationIntervalDays: dataArg.rotationIntervalDays,
               rateLimits: dataArg.rateLimits,
+              remoteIngress: dataArg.remoteIngress,
             });
             return { success: true };
           } catch (err: unknown) {