@serve.zone/dcrouter 16.4.0 → 16.5.0

package/dist_ts/email/classes.mail-edge-eligibility.d.ts

@@ -0,0 +1,55 @@
+import type { IRemoteIngress } from '../../dist_ts_interfaces/data/remoteingress.js';
+import type { EmailDomainDoc } from '../db/documents/classes.email-domain.doc.js';
+import type { DcRouter } from '../classes.dcrouter.js';
+export declare const MAIL_EGRESS_IDENTITY_MAX_AGE_MS = 45000;
+export interface IMailEgressIdentity {
+    edgeId: string;
+    family: 4 | 6;
+    address: string;
+    heloHostname: string;
+    proof: 'sourceBound';
+    /** Edge-side time at which the configured source address was successfully bound. */
+    observedAt: number;
+    /** Hub-side heartbeat receipt time. */
+    hubReceivedAt: number;
+}
+export interface IMailEgressIdentitySnapshot {
+    supported: boolean;
+    reason?: string;
+    identities: IMailEgressIdentity[];
+}
+/** Boundary implemented against a released RemoteIngress identity-proof API. */
+export interface IEgressIdentitySource {
+    getSnapshot(): Promise<IMailEgressIdentitySnapshot>;
+}
+/**
+ * Reads the versioned RemoteIngress identity capability through TunnelManager.
+ * Older hubs do not expose `egressIdentityV1`; they remain explicitly
+ * unsupported instead of falling back to configured or peer addresses.
+ */
+export declare class ReleasedRemoteIngressEgressIdentitySource implements IEgressIdentitySource {
+    private dcRouterRef;
+    constructor(dcRouterRef: DcRouter);
+    getSnapshot(): Promise<IMailEgressIdentitySnapshot>;
+}
+export interface IEligibleMailEdge {
+    edge: IRemoteIngress;
+    hostname: string;
+    identities: IMailEgressIdentity[];
+}
+export interface IMailEdgeEligibilityResult {
+    supported: boolean;
+    reason?: string;
+    edges: IEligibleMailEdge[];
+}
+/** Shared topology predicate used by DNS publication and outbound selection. */
+export declare class MailEdgeEligibility {
+    private dcRouterRef;
+    private identitySource;
+    private lastUnscopedResult;
+    constructor(dcRouterRef: DcRouter, identitySource: IEgressIdentitySource);
+    resolveForDomain(doc?: EmailDomainDoc): Promise<IMailEdgeEligibilityResult>;
+    getLastUnscopedResult(): IMailEdgeEligibilityResult;
+    private recordUnscoped;
+    resolveActiveForDomain(doc: EmailDomainDoc): Promise<IMailEdgeEligibilityResult>;
+}

package/dist_ts/email/classes.mail-edge-eligibility.js

@@ -0,0 +1,168 @@
+import { REMOTE_INGRESS_MAIL_TAG } from '../../dist_ts_interfaces/data/remoteingress.js';
+export const MAIL_EGRESS_IDENTITY_MAX_AGE_MS = 45_000;
+/**
+ * Reads the versioned RemoteIngress identity capability through TunnelManager.
+ * Older hubs do not expose `egressIdentityV1`; they remain explicitly
+ * unsupported instead of falling back to configured or peer addresses.
+ */
+export class ReleasedRemoteIngressEgressIdentitySource {
+    dcRouterRef;
+    constructor(dcRouterRef) {
+        this.dcRouterRef = dcRouterRef;
+    }
+    async getSnapshot() {
+        const status = await this.dcRouterRef.tunnelManager?.getAuthoritativeHubStatus();
+        const connectedEdges = status?.connectedEdges ?? [];
+        const capableEdges = connectedEdges.filter((edge) => (Array.isArray(edge.capabilities) && edge.capabilities.includes('egressIdentityV1')));
+        if (capableEdges.length > 0) {
+            const identities = [];
+            for (const edge of capableEdges) {
+                const report = edge.egressIdentity;
+                if (!report || report.proofMethod !== 'localSocketBind')
+                    continue;
+                for (const [family, observation] of [[4, report.ipv4], [6, report.ipv6]]) {
+                    if (!observation || observation.stale === true)
+                        continue;
+                    if (typeof observation.address !== 'string'
+                        || !Number.isFinite(observation.edgeObservedAtUnixMs)
+                        || !Number.isFinite(observation.hubReceivedAtUnixMs))
+                        continue;
+                    const configured = this.dcRouterRef.remoteIngressManager?.getEdge(String(edge.edgeId));
+                    const heloHostname = configured?.mailHostname?.trim();
+                    if (!heloHostname)
+                        continue;
+                    identities.push({
+                        edgeId: String(edge.edgeId),
+                        family,
+                        address: observation.address,
+                        heloHostname,
+                        proof: 'sourceBound',
+                        observedAt: observation.edgeObservedAtUnixMs,
+                        hubReceivedAt: observation.hubReceivedAtUnixMs,
+                    });
+                }
+            }
+            return { supported: true, identities };
+        }
+        return {
+            supported: false,
+            reason: 'RemoteIngress egress identity proof is unavailable until the capability release is consumed',
+            identities: [],
+        };
+    }
+}
+/** Shared topology predicate used by DNS publication and outbound selection. */
+export class MailEdgeEligibility {
+    dcRouterRef;
+    identitySource;
+    lastUnscopedResult = {
+        supported: false,
+        reason: 'mail edge eligibility has not been evaluated yet',
+        edges: [],
+    };
+    constructor(dcRouterRef, identitySource) {
+        this.dcRouterRef = dcRouterRef;
+        this.identitySource = identitySource;
+    }
+    async resolveForDomain(doc) {
+        const snapshot = await this.identitySource.getSnapshot();
+        if (!snapshot.supported) {
+            return this.recordUnscoped(doc, { supported: false, reason: snapshot.reason, edges: [] });
+        }
+        const manager = this.dcRouterRef.remoteIngressManager;
+        const tunnelManager = this.dcRouterRef.tunnelManager;
+        if (!manager || !tunnelManager) {
+            return this.recordUnscoped(doc, { supported: true, reason: 'RemoteIngress hub is not running', edges: [] });
+        }
+        const pin = doc?.remoteIngress?.edgeFilter || [];
+        const pinIds = pin.length > 0
+            ? new Set(manager.resolveEdgesByFilter(pin).map((edge) => edge.id))
+            : undefined;
+        const identitiesByEdge = new Map();
+        const now = Date.now();
+        for (const identity of snapshot.identities) {
+            if (identity.proof !== 'sourceBound')
+                continue;
+            if (now - identity.observedAt > MAIL_EGRESS_IDENTITY_MAX_AGE_MS)
+                continue;
+            if (now - identity.hubReceivedAt > MAIL_EGRESS_IDENTITY_MAX_AGE_MS)
+                continue;
+            const entries = identitiesByEdge.get(identity.edgeId) || [];
+            entries.push(identity);
+            identitiesByEdge.set(identity.edgeId, entries);
+        }
+        const edges = [];
+        for (const edge of manager.getAllEdges()) {
+            if (!edge.enabled || !edge.tags?.includes(REMOTE_INGRESS_MAIL_TAG))
+                continue;
+            // A domain pin narrows the mail-tagged pool; it never replaces the mail tag.
+            if (pinIds && !pinIds.has(edge.id))
+                continue;
+            if (!edge.egress?.enabled || !edge.egress.allowedPorts?.includes(25))
+                continue;
+            const status = tunnelManager.getEdgeStatus(edge.id);
+            if (!status?.connected || !status.lastHeartbeat)
+                continue;
+            if (now - status.lastHeartbeat > MAIL_EGRESS_IDENTITY_MAX_AGE_MS)
+                continue;
+            if (status.egressEnabled !== true || !status.capabilities?.includes('egressTcpV1'))
+                continue;
+            const nativeQuic = status.transportMode === 'quic'
+                || (status.transportMode === 'quicWithFallback' && status.fallbackUsed === false);
+            if (!nativeQuic)
+                continue;
+            const hostname = edge.mailHostname?.toLowerCase().replace(/\.$/, '');
+            if (!hostname)
+                continue;
+            const identities = (identitiesByEdge.get(edge.id) || []).filter((identity) => {
+                if (identity.heloHostname.toLowerCase().replace(/\.$/, '') !== hostname)
+                    return false;
+                return identity.family === 4
+                    ? Boolean(edge.publicIp && edge.publicIp === identity.address)
+                    : Boolean(edge.publicIpV6 && edge.publicIpV6 === identity.address);
+            });
+            if (identities.length > 0) {
+                edges.push({ edge, hostname, identities });
+            }
+        }
+        edges.sort((left, right) => left.edge.id.localeCompare(right.edge.id));
+        return this.recordUnscoped(doc, {
+            supported: true,
+            ...(edges.length === 0 ? { reason: 'no live mail-tagged edge has a fresh source-bound identity' } : {}),
+            edges,
+        });
+    }
+    getLastUnscopedResult() {
+        return this.lastUnscopedResult;
+    }
+    recordUnscoped(doc, result) {
+        if (!doc)
+            this.lastUnscopedResult = result;
+        return result;
+    }
+    async resolveActiveForDomain(doc) {
+        const live = await this.resolveForDomain(doc);
+        const active = doc.reconciliation?.activeRevision;
+        if (!live.supported || !active) {
+            return {
+                supported: live.supported,
+                reason: live.reason || 'email domain has no validated active DNS revision',
+                edges: [],
+            };
+        }
+        const activeByEdge = new Map(active.edgeIdentities.map((identity) => [identity.edgeId, identity]));
+        const edges = live.edges.filter((candidate) => {
+            const activeIdentity = activeByEdge.get(candidate.edge.id);
+            if (!activeIdentity || activeIdentity.hostname !== candidate.hostname)
+                return false;
+            return candidate.identities.length > 0 && candidate.identities.every((identity) => ((identity.family === 4 && identity.address === activeIdentity.ipv4)
+                || (identity.family === 6 && identity.address === activeIdentity.ipv6)));
+        });
+        return {
+            supported: live.supported,
+            ...(edges.length === 0 ? { reason: 'no live edge is present in the validated active DNS revision' } : {}),
+            edges,
+        };
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5tYWlsLWVkZ2UtZWxpZ2liaWxpdHkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi90cy9lbWFpbC9jbGFzc2VzLm1haWwtZWRnZS1lbGlnaWJpbGl0eS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsdUJBQXVCLEVBQUUsTUFBTSwyQ0FBMkMsQ0FBQztBQUtwRixNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxNQUFNLENBQUM7QUF5QnREOzs7O0dBSUc7QUFDSCxNQUFNLE9BQU8seUNBQXlDO0lBQ2hDO0lBQXBCLFlBQW9CLFdBQXFCO1FBQXJCLGdCQUFXLEdBQVgsV0FBVyxDQUFVO0lBQUcsQ0FBQztJQUV0QyxLQUFLLENBQUMsV0FBVztRQUN0QixNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxXQUFXLENBQUMsYUFBYSxFQUFFLHlCQUF5QixFQUFFLENBQUM7UUFDakYsTUFBTSxjQUFjLEdBQUcsTUFBTSxFQUFFLGNBQWMsSUFBSSxFQUFFLENBQUM7UUFDcEQsTUFBTSxZQUFZLEdBQUcsY0FBYyxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FDbkQsS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLElBQUksSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsa0JBQWtCLENBQUMsQ0FDbkYsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxZQUFZLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQzVCLE1BQU0sVUFBVSxHQUEwQixFQUFFLENBQUM7WUFDN0MsS0FBSyxNQUFNLElBQUksSUFBSSxZQUFZLEVBQUUsQ0FBQztnQkFDaEMsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLGNBQWMsQ0FBQztnQkFDbkMsSUFBSSxDQUFDLE1BQU0sSUFBSSxNQUFNLENBQUMsV0FBVyxLQUFLLGlCQUFpQjtvQkFBRSxTQUFTO2dCQUNsRSxLQUFLLE1BQU0sQ0FBQyxNQUFNLEVBQUUsV0FBVyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFVLEVBQUUsQ0FBQztvQkFDbEYsSUFBSSxDQUFDLFdBQVcsSUFBSSxXQUFXLENBQUMsS0FBSyxLQUFLLElBQUk7d0JBQUUsU0FBUztvQkFDekQsSUFDRSxPQUFPLFdBQVcsQ0FBQyxPQUFPLEtBQUssUUFBUTsyQkFDcEMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxvQkFBb0IsQ0FBQzsyQkFDbEQsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxtQkFBbUIsQ0FBQzt3QkFDcEQsU0FBUztvQkFDWCxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDLG9CQUFvQixFQUFFLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7b0JBQ3ZGLE1BQU0sWUFBWSxHQUFHLFVBQVUsRUFBRSxZQUFZLEVBQUUsSUFBSSxFQUFFLENBQUM7b0JBQ3RELElBQUksQ0FBQyxZQUFZO3dCQUFFLFNBQVM7b0JBQzVCLFVBQVUsQ0FBQyxJQUFJLENBQUM7d0JBQ2QsTUFBTSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDO3dCQUMzQixNQUFNO3dCQUNOLE9BQU8sRUFBRSxXQUFXLENBQUMsT0FBTzt3QkFDNUIsWUFBWTt3QkFDWixLQUFLLEVBQUUsYUFBYTt3QkFDcEIsVUFBVSxFQUFFLFdBQVcsQ0FBQyxvQkFBb0I7d0JBQzVDLGFBQWEsRUFBRSxXQUFXLENBQUMsbUJBQW1CO3FCQUMvQyxDQUFDLENBQUM7Z0JBQ0wsQ0FBQztZQUNILENBQUM7WUFDRCxPQUFPLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsQ0FBQztRQUN6QyxDQUFDO1FBQ0QsT0FBTztZQUNMLFNBQVMsRUFBRSxLQUFLO1lBQ2hCLE1BQU0sRUFBRSw2RkFBNkY7WUFDckcsVUFBVSxFQUFFLEVBQUU7U0FDZixDQUFDO0lBQ0osQ0FBQztDQUNGO0FBY0QsZ0ZBQWdGO0FBQ2hGLE1BQU0sT0FBTyxtQkFBbUI7SUFRcEI7SUFDQTtJQVJGLGtCQUFrQixHQUErQjtRQUN2RCxTQUFTLEVBQUUsS0FBSztRQUNoQixNQUFNLEVBQUUsa0RBQWtEO1FBQzFELEtBQUssRUFBRSxFQUFFO0tBQ1YsQ0FBQztJQUVGLFlBQ1UsV0FBcUIsRUFDckIsY0FBcUM7UUFEckMsZ0JBQVcsR0FBWCxXQUFXLENBQVU7UUFDckIsbUJBQWMsR0FBZCxjQUFjLENBQXVCO0lBQzVDLENBQUM7SUFFRyxLQUFLLENBQUMsZ0JBQWdCLENBQUMsR0FBb0I7UUFDaEQsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsY0FBYyxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQ3pELElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDeEIsT0FBTyxJQUFJLENBQUMsY0FBYyxDQUFDLEdBQUcsRUFBRSxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLFFBQVEsQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDNUYsQ0FBQztRQUVELE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxXQUFXLENBQUMsb0JBQW9CLENBQUM7UUFDdEQsTUFBTSxhQUFhLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQyxhQUFhLENBQUM7UUFDckQsSUFBSSxDQUFDLE9BQU8sSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQy9CLE9BQU8sSUFBSSxDQUFDLGNBQWMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxrQ0FBa0MsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUM5RyxDQUFDO1FBRUQsTUFBTSxHQUFHLEdBQUcsR0FBRyxFQUFFLGFBQWEsRUFBRSxVQUFVLElBQUksRUFBRSxDQUFDO1FBQ2pELE1BQU0sTUFBTSxHQUFHLEdBQUcsQ0FBQyxNQUFNLEdBQUcsQ0FBQztZQUMzQixDQUFDLENBQUMsSUFBSSxHQUFHLENBQUMsT0FBTyxDQUFDLG9CQUFvQixDQUFDLEdBQUcsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQ25FLENBQUMsQ0FBQyxTQUFTLENBQUM7UUFDZCxNQUFNLGdCQUFnQixHQUFHLElBQUksR0FBRyxFQUFpQyxDQUFDO1FBQ2xFLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUN2QixLQUFLLE1BQU0sUUFBUSxJQUFJLFFBQVEsQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUMzQyxJQUFJLFFBQVEsQ0FBQyxLQUFLLEtBQUssYUFBYTtnQkFBRSxTQUFTO1lBQy9DLElBQUksR0FBRyxHQUFHLFFBQVEsQ0FBQyxVQUFVLEdBQUcsK0JBQStCO2dCQUFFLFNBQVM7WUFDMUUsSUFBSSxHQUFHLEdBQUcsUUFBUSxDQUFDLGFBQWEsR0FBRywrQkFBK0I7Z0JBQUUsU0FBUztZQUM3RSxNQUFNLE9BQU8sR0FBRyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUM1RCxPQUFPLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBQ3ZCLGdCQUFnQixDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQ2pELENBQUM7UUFFRCxNQUFNLEtBQUssR0FBd0IsRUFBRSxDQUFDO1FBQ3RDLEtBQUssTUFBTSxJQUFJLElBQUksT0FBTyxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUM7WUFDekMsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLFFBQVEsQ0FBQyx1QkFBdUIsQ0FBQztnQkFBRSxTQUFTO1lBQzdFLDZFQUE2RTtZQUM3RSxJQUFJLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztnQkFBRSxTQUFTO1lBQzdDLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLE9BQU8sSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxFQUFFLFFBQVEsQ0FBQyxFQUFFLENBQUM7Z0JBQUUsU0FBUztZQUMvRSxNQUFNLE1BQU0sR0FBRyxhQUFhLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUNwRCxJQUFJLENBQUMsTUFBTSxFQUFFLFNBQVMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhO2dCQUFFLFNBQVM7WUFDMUQsSUFBSSxHQUFHLEdBQUcsTUFBTSxDQUFDLGFBQWEsR0FBRywrQkFBK0I7Z0JBQUUsU0FBUztZQUMzRSxJQUFJLE1BQU0sQ0FBQyxhQUFhLEtBQUssSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLFlBQVksRUFBRSxRQUFRLENBQUMsYUFBYSxDQUFDO2dCQUFFLFNBQVM7WUFDN0YsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLGFBQWEsS0FBSyxNQUFNO21CQUM3QyxDQUFDLE1BQU0sQ0FBQyxhQUFhLEtBQUssa0JBQWtCLElBQUksTUFBTSxDQUFDLFlBQVksS0FBSyxLQUFLLENBQUMsQ0FBQztZQUNwRixJQUFJLENBQUMsVUFBVTtnQkFBRSxTQUFTO1lBQzFCLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxZQUFZLEVBQUUsV0FBVyxFQUFFLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztZQUNyRSxJQUFJLENBQUMsUUFBUTtnQkFBRSxTQUFTO1lBRXhCLE1BQU0sVUFBVSxHQUFHLENBQUMsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRTtnQkFDM0UsSUFBSSxRQUFRLENBQUMsWUFBWSxDQUFDLFdBQVcsRUFBRSxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssUUFBUTtvQkFBRSxPQUFPLEtBQUssQ0FBQztnQkFDdEYsT0FBTyxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUM7b0JBQzFCLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLFFBQVEsSUFBSSxJQUFJLENBQUMsUUFBUSxLQUFLLFFBQVEsQ0FBQyxPQUFPLENBQUM7b0JBQzlELENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLFVBQVUsSUFBSSxJQUFJLENBQUMsVUFBVSxLQUFLLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUN2RSxDQUFDLENBQUMsQ0FBQztZQUNILElBQUksVUFBVSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztnQkFDMUIsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLENBQUMsQ0FBQztZQUM3QyxDQUFDO1FBQ0gsQ0FBQztRQUVELEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFJLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ3ZFLE9BQU8sSUFBSSxDQUFDLGNBQWMsQ0FBQyxHQUFHLEVBQUU7WUFDOUIsU0FBUyxFQUFFLElBQUk7WUFDZixHQUFHLENBQUMsS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLDREQUE0RCxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN2RyxLQUFLO1NBQ04sQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVNLHFCQUFxQjtRQUMxQixPQUFPLElBQUksQ0FBQyxrQkFBa0IsQ0FBQztJQUNqQyxDQUFDO0lBRU8sY0FBYyxDQUNwQixHQUErQixFQUMvQixNQUFrQztRQUVsQyxJQUFJLENBQUMsR0FBRztZQUFFLElBQUksQ0FBQyxrQkFBa0IsR0FBRyxNQUFNLENBQUM7UUFDM0MsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUVNLEtBQUssQ0FBQyxzQkFBc0IsQ0FBQyxHQUFtQjtRQUNyRCxNQUFNLElBQUksR0FBRyxNQUFNLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUM5QyxNQUFNLE1BQU0sR0FBRyxHQUFHLENBQUMsY0FBYyxFQUFFLGNBQWMsQ0FBQztRQUNsRCxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQy9CLE9BQU87Z0JBQ0wsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTO2dCQUN6QixNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU0sSUFBSSxtREFBbUQ7Z0JBQzFFLEtBQUssRUFBRSxFQUFFO2FBQ1YsQ0FBQztRQUNKLENBQUM7UUFDRCxNQUFNLFlBQVksR0FBRyxJQUFJLEdBQUcsQ0FBQyxNQUFNLENBQUMsY0FBYyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNuRyxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLFNBQVMsRUFBRSxFQUFFO1lBQzVDLE1BQU0sY0FBYyxHQUFHLFlBQVksQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUMzRCxJQUFJLENBQUMsY0FBYyxJQUFJLGNBQWMsQ0FBQyxRQUFRLEtBQUssU0FBUyxDQUFDLFFBQVE7Z0JBQUUsT0FBTyxLQUFLLENBQUM7WUFDcEYsT0FBTyxTQUFTLENBQUMsVUFBVSxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksU0FBUyxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQ2pGLENBQUMsUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksUUFBUSxDQUFDLE9BQU8sS0FBSyxjQUFjLENBQUMsSUFBSSxDQUFDO21CQUNoRSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLFFBQVEsQ0FBQyxPQUFPLEtBQUssY0FBYyxDQUFDLElBQUksQ0FBQyxDQUN2RSxDQUFDLENBQUM7UUFDTCxDQUFDLENBQUMsQ0FBQztRQUNILE9BQU87WUFDTCxTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVM7WUFDekIsR0FBRyxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSw4REFBOEQsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDekcsS0FBSztTQUNOLENBQUM7SUFDSixDQUFDO0NBQ0YifQ==

package/dist_ts/email/classes.mail-egress-coordinator.d.ts

@@ -1,6 +1,7 @@
 import type { IOutboundConnectionProxy, IOutboundConnectionProxyContext } from '@push.rocks/smartmta';
 import type { IEmailOutboundEgressStatus, TEmailOutboundMode } from '../../dist_ts_interfaces/data/email-settings.js';
 import type { DcRouter } from '../classes.dcrouter.js';
+import type { MailEdgeEligibility } from './classes.mail-edge-eligibility.js';
 /**
  * Routes outbound SMTP deliveries over RemoteIngress edges: resolves the
  * outbound mode per attempt (no silent direct fallback), maps sender-domain
@@ -9,8 +10,9 @@ import type { DcRouter } from '../classes.dcrouter.js';
  */
 export declare class MailEgressCoordinator {
     private dcRouterRef;
+    private edgeEligibility;
     private dnsClient?;
-    constructor(dcRouterRef: DcRouter);
+    constructor(dcRouterRef: DcRouter, edgeEligibility: MailEdgeEligibility);
     /**
      * smartmta connectionProxyProvider. Wired unconditionally so the outbound
      * mode is resolved per delivery attempt: a failed/late settings manager

package/dist_ts/email/classes.mail-egress-coordinator.js

@@ -1,6 +1,5 @@
 import * as plugins from '../plugins.js';
 import { logger } from '../logger.js';
-import { REMOTE_INGRESS_MAIL_TAG } from '../../dist_ts_interfaces/data/remoteingress.js';
 /**
  * Routes outbound SMTP deliveries over RemoteIngress edges: resolves the
  * outbound mode per attempt (no silent direct fallback), maps sender-domain
@@ -9,9 +8,11 @@ import { REMOTE_INGRESS_MAIL_TAG } from '../../dist_ts_interfaces/data/remoteing
  */
 export class MailEgressCoordinator {
     dcRouterRef;
+    edgeEligibility;
     dnsClient;
-    constructor(dcRouterRef) {
+    constructor(dcRouterRef, edgeEligibility) {
         this.dcRouterRef = dcRouterRef;
+        this.edgeEligibility = edgeEligibility;
     }
     /**
      * smartmta connectionProxyProvider. Wired unconditionally so the outbound
@@ -22,6 +23,9 @@ export class MailEgressCoordinator {
     async provideConnectionProxy(context) {
         const mode = this.resolveOutboundModeStrict();
         if (mode === 'direct') {
+            if (context.senderDomain && await this.dcRouterRef.emailDomainManager?.getByDomain(context.senderDomain)) {
+                throw new Error(`Managed sender domain ${context.senderDomain} has no validated direct-egress identity policy; refusing direct hub delivery`);
+            }
             return null;
         }
         return await this.createRemoteIngressConnectionProxy(context);
@@ -44,11 +48,14 @@ export class MailEgressCoordinator {
      * Readiness of the RemoteIngress outbound mail egress path (mail-tagged edges).
      */
     getOutboundEgressStatus() {
-        const tunnelManager = this.dcRouterRef.tunnelManager;
-        if (!tunnelManager) {
-            return { ready: false, eligibleEdgeCount: 0, reason: 'RemoteIngress hub is not running' };
-        }
-        return tunnelManager.getEgressReadiness([REMOTE_INGRESS_MAIL_TAG]);
+        const eligibility = this.edgeEligibility.getLastUnscopedResult();
+        return {
+            ready: eligibility.supported && eligibility.edges.length > 0,
+            eligibleEdgeCount: eligibility.edges.length,
+            ...(eligibility.edges.length === 0
+                ? { reason: eligibility.reason || 'no validated RemoteIngress mail edge is available' }
+                : {}),
+        };
     }
     /**
      * Post-start preflight: with remoteIngress outbound (the default), mail
@@ -74,15 +81,17 @@ export class MailEgressCoordinator {
             throw new Error('RemoteIngress outbound SMTP egress is enabled, but the hub is not running');
         }
         await this.assertTargetIsNotOwnMailEdge(context);
-        // Per-domain pinning: a sender domain with a configured edgeFilter uses only
-        // matching edges; everything else uses the mail-tagged edge pool.
-        let edgeFilter = [REMOTE_INGRESS_MAIL_TAG];
-        if (context.senderDomain && this.dcRouterRef.emailDomainManager) {
-            const domain = await this.dcRouterRef.emailDomainManager.getByDomain(context.senderDomain);
-            if (domain?.remoteIngress?.edgeFilter?.length) {
-                edgeFilter = domain.remoteIngress.edgeFilter;
-            }
+        const managedDoc = context.senderDomain
+            ? await (await import('../db/documents/classes.email-domain.doc.js')).EmailDomainDoc.findByDomain(context.senderDomain)
+            : null;
+        const eligible = managedDoc
+            ? await this.edgeEligibility.resolveActiveForDomain(managedDoc)
+            : await this.edgeEligibility.resolveForDomain();
+        if (!eligible.supported || eligible.edges.length === 0) {
+            throw new Error(`Outbound SMTP is not eligible${context.senderDomain ? ` for ${context.senderDomain}` : ''}: ${eligible.reason || 'no validated mail edge'}`);
         }
+        const eligibleById = new Map(eligible.edges.map((candidate) => [candidate.edge.id, candidate]));
+        const edgeFilter = [...eligibleById.keys()];
         const connectionTimeoutMs = this.dcRouterRef.options.emailConfig?.outbound?.connectionTimeout ?? 30_000;
         const proxy = await tunnelManager.startEgressTcpProxy({
             logicalHost: context.host,
@@ -92,12 +101,17 @@ export class MailEgressCoordinator {
             acceptTimeoutMs: connectionTimeoutMs,
             edgeFilter,
         });
+        const selected = eligibleById.get(proxy.edgeId);
+        if (!selected) {
+            await tunnelManager.stopEgressTcpProxy(proxy.proxyId).catch(() => undefined);
+            throw new Error(`RemoteIngress selected edge ${proxy.edgeId} outside the validated mail pool`);
+        }
         let closed = false;
         return {
             connectHost: proxy.listenHost,
             connectPort: proxy.listenPort,
             poolKey: `remoteIngress:${proxy.edgeId}:${context.host}:${context.port}`,
-            ehloHostname: this.dcRouterRef.remoteIngressManager?.getEdge(proxy.edgeId)?.mailHostname,
+            ehloHostname: selected.hostname,
             close: async () => {
                 if (closed) {
                     return;
@@ -122,9 +136,13 @@ export class MailEgressCoordinator {
      * allowed to become an availability hazard.
      */
     async assertTargetIsNotOwnMailEdge(context) {
-        const edgeIps = new Set((this.dcRouterRef.remoteIngressManager?.getAllEdges?.() || [])
-            .map((edge) => edge.publicIp)
-            .filter((ip) => Boolean(ip)));
+        const edgeIps = new Set();
+        for (const edge of this.dcRouterRef.remoteIngressManager?.getAllEdges?.() || []) {
+            if (edge.publicIp)
+                edgeIps.add(edge.publicIp);
+            if (edge.publicIpV6)
+                edgeIps.add(edge.publicIpV6);
+        }
         if (edgeIps.size === 0) {
             return;
         }
@@ -137,8 +155,11 @@ export class MailEgressCoordinator {
                 if (!this.dnsClient) {
                     this.dnsClient = new plugins.smartdns.dnsClientMod.Smartdns({});
                 }
-                const records = await this.dnsClient.getRecordsA(context.host);
-                targetIps = (records || []).map((record) => record.value);
+                const [aRecords, aaaaRecords] = await Promise.all([
+                    this.dnsClient.getRecordsA(context.host),
+                    this.dnsClient.getRecordsAAAA(context.host),
+                ]);
+                targetIps = [...(aRecords || []), ...(aaaaRecords || [])].map((record) => record.value);
             }
             catch {
                 return;
@@ -150,4 +171,4 @@ export class MailEgressCoordinator {
         }
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5tYWlsLWVncmVzcy1jb29yZGluYXRvci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3RzL2VtYWlsL2NsYXNzZXMubWFpbC1lZ3Jlc3MtY29vcmRpbmF0b3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBSUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxlQUFlLENBQUM7QUFDekMsT0FBTyxFQUFFLE1BQU0sRUFBRSxNQUFNLGNBQWMsQ0FBQztBQUN0QyxPQUFPLEVBQUUsdUJBQXVCLEVBQUUsTUFBTSwyQ0FBMkMsQ0FBQztBQUlwRjs7Ozs7R0FLRztBQUNILE1BQU0sT0FBTyxxQkFBcUI7SUFHWjtJQUZaLFNBQVMsQ0FBMEM7SUFFM0QsWUFBb0IsV0FBcUI7UUFBckIsZ0JBQVcsR0FBWCxXQUFXLENBQVU7SUFBRyxDQUFDO0lBRTdDOzs7OztPQUtHO0lBQ0ksS0FBSyxDQUFDLHNCQUFzQixDQUNqQyxPQUF3QztRQUV4QyxNQUFNLElBQUksR0FBRyxJQUFJLENBQUMseUJBQXlCLEVBQUUsQ0FBQztRQUM5QyxJQUFJLElBQUksS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUN0QixPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFDRCxPQUFPLE1BQU0sSUFBSSxDQUFDLGtDQUFrQyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ2hFLENBQUM7SUFFRDs7OztPQUlHO0lBQ0kseUJBQXlCO1FBQzlCLElBQUksSUFBSSxDQUFDLFdBQVcsQ0FBQyxvQkFBb0IsRUFBRSxDQUFDO1lBQzFDLE9BQU8sSUFBSSxDQUFDLFdBQVcsQ0FBQyxvQkFBb0IsQ0FBQyxlQUFlLEVBQUUsQ0FBQztRQUNqRSxDQUFDO1FBQ0QsSUFBSSxJQUFJLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1lBQy9DLE9BQU8sSUFBSSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsaUJBQWlCLENBQUM7UUFDcEQsQ0FBQztRQUNELE1BQU0sSUFBSSxLQUFLLENBQUMsc0ZBQXNGLENBQUMsQ0FBQztJQUMxRyxDQUFDO0lBRUQ7O09BRUc7SUFDSSx1QkFBdUI7UUFDNUIsTUFBTSxhQUFhLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQyxhQUFhLENBQUM7UUFDckQsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQ25CLE9BQU8sRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLGlCQUFpQixFQUFFLENBQUMsRUFBRSxNQUFNLEVBQUUsa0NBQWtDLEVBQUUsQ0FBQztRQUM1RixDQUFDO1FBQ0QsT0FBTyxhQUFhLENBQUMsa0JBQWtCLENBQUMsQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDLENBQUM7SUFDckUsQ0FBQztJQUVEOzs7O09BSUc7SUFDSSxrQkFBa0I7UUFDdkIsSUFBSSxDQUFDO1lBQ0gsSUFBSSxJQUFJLENBQUMseUJBQXlCLEVBQUUsS0FBSyxlQUFlLEVBQUUsQ0FBQztnQkFDekQsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLHVCQUF1QixFQUFFLENBQUM7Z0JBQ3BELElBQUksQ0FBQyxZQUFZLENBQUMsS0FBSyxFQUFFLENBQUM7b0JBQ3hCLE1BQU0sQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLHNDQUFzQyxZQUFZLENBQUMsTUFBTSxvRUFBb0UsQ0FBQyxDQUFDO2dCQUNwSixDQUFDO1lBQ0gsQ0FBQztRQUNILENBQUM7UUFBQyxPQUFPLEtBQWMsRUFBRSxDQUFDO1lBQ3hCLE1BQU0sQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFLDZDQUE4QyxLQUFlLENBQUMsT0FBTywwRUFBMEUsQ0FBQyxDQUFDO1FBQ3ZLLENBQUM7SUFDSCxDQUFDO0lBRU8sS0FBSyxDQUFDLGtDQUFrQyxDQUM5QyxPQUF3QztRQUV4QyxNQUFNLGFBQWEsR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDLGFBQWEsQ0FBQztRQUNyRCxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7WUFDbkIsTUFBTSxJQUFJLEtBQUssQ0FBQywyRUFBMkUsQ0FBQyxDQUFDO1FBQy9GLENBQUM7UUFFRCxNQUFNLElBQUksQ0FBQyw0QkFBNEIsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUVqRCw2RUFBNkU7UUFDN0Usa0VBQWtFO1FBQ2xFLElBQUksVUFBVSxHQUFhLENBQUMsdUJBQXVCLENBQUMsQ0FBQztRQUNyRCxJQUFJLE9BQU8sQ0FBQyxZQUFZLElBQUksSUFBSSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsRUFBRSxDQUFDO1lBQ2hFLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxDQUFDO1lBQzNGLElBQUksTUFBTSxFQUFFLGFBQWEsRUFBRSxVQUFVLEVBQUUsTUFBTSxFQUFFLENBQUM7Z0JBQzlDLFVBQVUsR0FBRyxNQUFNLENBQUMsYUFBYSxDQUFDLFVBQVUsQ0FBQztZQUMvQyxDQUFDO1FBQ0gsQ0FBQztRQUVELE1BQU0sbUJBQW1CLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsV0FBVyxFQUFFLFFBQVEsRUFBRSxpQkFBaUIsSUFBSSxNQUFNLENBQUM7UUFDeEcsTUFBTSxLQUFLLEdBQUcsTUFBTSxhQUFhLENBQUMsbUJBQW1CLENBQUM7WUFDcEQsV0FBVyxFQUFFLE9BQU8sQ0FBQyxJQUFJO1lBQ3pCLElBQUksRUFBRSxPQUFPLENBQUMsSUFBSTtZQUNsQixXQUFXLEVBQUUsQ0FBQyxPQUFPLENBQUMsTUFBTTtZQUM1QixnQkFBZ0IsRUFBRSxtQkFBbUI7WUFDckMsZUFBZSxFQUFFLG1CQUFtQjtZQUNwQyxVQUFVO1NBQ1gsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxNQUFNLEdBQUcsS0FBSyxDQUFDO1FBQ25CLE9BQU87WUFDTCxXQUFXLEVBQUUsS0FBSyxDQUFDLFVBQVU7WUFDN0IsV0FBVyxFQUFFLEtBQUssQ0FBQyxVQUFVO1lBQzdCLE9BQU8sRUFBRSxpQkFBaUIsS0FBSyxDQUFDLE1BQU0sSUFBSSxPQUFPLENBQUMsSUFBSSxJQUFJLE9BQU8sQ0FBQyxJQUFJLEVBQUU7WUFDeEUsWUFBWSxFQUFFLElBQUksQ0FBQyxXQUFXLENBQUMsb0JBQW9CLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsRUFBRSxZQUFZO1lBQ3hGLEtBQUssRUFBRSxLQUFLLElBQUksRUFBRTtnQkFDaEIsSUFBSSxNQUFNLEVBQUUsQ0FBQztvQkFDWCxPQUFPO2dCQUNULENBQUM7Z0JBQ0QsTUFBTSxHQUFHLElBQUksQ0FBQztnQkFDZCxJQUFJLENBQUM7b0JBQ0gsTUFBTSxhQUFhLENBQUMsa0JBQWtCLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO2dCQUN4RCxDQUFDO2dCQUFDLE9BQU8sR0FBWSxFQUFFLENBQUM7b0JBQ3RCLE1BQU0sQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLDZDQUE2QyxLQUFLLENBQUMsT0FBTyxLQUFNLEdBQWEsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO2dCQUM5RyxDQUFDO1lBQ0gsQ0FBQztTQUNGLENBQUM7SUFDSixDQUFDO0lBRUQ7Ozs7Ozs7O09BUUc7SUFDSyxLQUFLLENBQUMsNEJBQTRCLENBQUMsT0FBd0M7UUFDakYsTUFBTSxPQUFPLEdBQUcsSUFBSSxHQUFHLENBQ3JCLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxvQkFBb0IsRUFBRSxXQUFXLEVBQUUsRUFBRSxJQUFJLEVBQUUsQ0FBQzthQUMzRCxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUM7YUFDNUIsTUFBTSxDQUFDLENBQUMsRUFBRSxFQUFnQixFQUFFLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQzdDLENBQUM7UUFDRixJQUFJLE9BQU8sQ0FBQyxJQUFJLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDdkIsT0FBTztRQUNULENBQUM7UUFFRCxJQUFJLFNBQVMsR0FBYSxFQUFFLENBQUM7UUFDN0IsSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUNwRCxTQUFTLEdBQUcsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDN0IsQ0FBQzthQUFNLENBQUM7WUFDTixJQUFJLENBQUM7Z0JBQ0gsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztvQkFDcEIsSUFBSSxDQUFDLFNBQVMsR0FBRyxJQUFJLE9BQU8sQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsQ0FBQztnQkFDbEUsQ0FBQztnQkFDRCxNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUksQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztnQkFDL0QsU0FBUyxHQUFHLENBQUMsT0FBTyxJQUFJLEVBQUUsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQzVELENBQUM7WUFBQyxNQUFNLENBQUM7Z0JBQ1AsT0FBTztZQUNULENBQUM7UUFDSCxDQUFDO1FBRUQsTUFBTSxNQUFNLEdBQUcsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ3ZELElBQUksTUFBTSxFQUFFLENBQUM7WUFDWCxNQUFNLElBQUksS0FBSyxDQUNiLG9DQUFvQyxPQUFPLENBQUMsSUFBSSxJQUFJLE9BQU8sQ0FBQyxJQUFJLHdDQUF3QyxNQUFNLHFFQUFxRSxDQUNwTCxDQUFDO1FBQ0osQ0FBQztJQUNILENBQUM7Q0FDRiJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5tYWlsLWVncmVzcy1jb29yZGluYXRvci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3RzL2VtYWlsL2NsYXNzZXMubWFpbC1lZ3Jlc3MtY29vcmRpbmF0b3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBSUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxlQUFlLENBQUM7QUFDekMsT0FBTyxFQUFFLE1BQU0sRUFBRSxNQUFNLGNBQWMsQ0FBQztBQUt0Qzs7Ozs7R0FLRztBQUNILE1BQU0sT0FBTyxxQkFBcUI7SUFJdEI7SUFDQTtJQUpGLFNBQVMsQ0FBMEM7SUFFM0QsWUFDVSxXQUFxQixFQUNyQixlQUFvQztRQURwQyxnQkFBVyxHQUFYLFdBQVcsQ0FBVTtRQUNyQixvQkFBZSxHQUFmLGVBQWUsQ0FBcUI7SUFDM0MsQ0FBQztJQUVKOzs7OztPQUtHO0lBQ0ksS0FBSyxDQUFDLHNCQUFzQixDQUNqQyxPQUF3QztRQUV4QyxNQUFNLElBQUksR0FBRyxJQUFJLENBQUMseUJBQXlCLEVBQUUsQ0FBQztRQUM5QyxJQUFJLElBQUksS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUN0QixJQUFJLE9BQU8sQ0FBQyxZQUFZLElBQUksTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLGtCQUFrQixFQUFFLFdBQVcsQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztnQkFDekcsTUFBTSxJQUFJLEtBQUssQ0FDYix5QkFBeUIsT0FBTyxDQUFDLFlBQVksK0VBQStFLENBQzdILENBQUM7WUFDSixDQUFDO1lBQ0QsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBQ0QsT0FBTyxNQUFNLElBQUksQ0FBQyxrQ0FBa0MsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUNoRSxDQUFDO0lBRUQ7Ozs7T0FJRztJQUNJLHlCQUF5QjtRQUM5QixJQUFJLElBQUksQ0FBQyxXQUFXLENBQUMsb0JBQW9CLEVBQUUsQ0FBQztZQUMxQyxPQUFPLElBQUksQ0FBQyxXQUFXLENBQUMsb0JBQW9CLENBQUMsZUFBZSxFQUFFLENBQUM7UUFDakUsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztZQUMvQyxPQUFPLElBQUksQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLGlCQUFpQixDQUFDO1FBQ3BELENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLHNGQUFzRixDQUFDLENBQUM7SUFDMUcsQ0FBQztJQUVEOztPQUVHO0lBQ0ksdUJBQXVCO1FBQzVCLE1BQU0sV0FBVyxHQUFHLElBQUksQ0FBQyxlQUFlLENBQUMscUJBQXFCLEVBQUUsQ0FBQztRQUNqRSxPQUFPO1lBQ0wsS0FBSyxFQUFFLFdBQVcsQ0FBQyxTQUFTLElBQUksV0FBVyxDQUFDLEtBQUssQ0FBQyxNQUFNLEdBQUcsQ0FBQztZQUM1RCxpQkFBaUIsRUFBRSxXQUFXLENBQUMsS0FBSyxDQUFDLE1BQU07WUFDM0MsR0FBRyxDQUFDLFdBQVcsQ0FBQyxLQUFLLENBQUMsTUFBTSxLQUFLLENBQUM7Z0JBQ2hDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxXQUFXLENBQUMsTUFBTSxJQUFJLG1EQUFtRCxFQUFFO2dCQUN2RixDQUFDLENBQUMsRUFBRSxDQUFDO1NBQ1IsQ0FBQztJQUNKLENBQUM7SUFFRDs7OztPQUlHO0lBQ0ksa0JBQWtCO1FBQ3ZCLElBQUksQ0FBQztZQUNILElBQUksSUFBSSxDQUFDLHlCQUF5QixFQUFFLEtBQUssZUFBZSxFQUFFLENBQUM7Z0JBQ3pELE1BQU0sWUFBWSxHQUFHLElBQUksQ0FBQyx1QkFBdUIsRUFBRSxDQUFDO2dCQUNwRCxJQUFJLENBQUMsWUFBWSxDQUFDLEtBQUssRUFBRSxDQUFDO29CQUN4QixNQUFNLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxzQ0FBc0MsWUFBWSxDQUFDLE1BQU0sb0VBQW9FLENBQUMsQ0FBQztnQkFDcEosQ0FBQztZQUNILENBQUM7UUFDSCxDQUFDO1FBQUMsT0FBTyxLQUFjLEVBQUUsQ0FBQztZQUN4QixNQUFNLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRSw2Q0FBOEMsS0FBZSxDQUFDLE9BQU8sMEVBQTBFLENBQUMsQ0FBQztRQUN2SyxDQUFDO0lBQ0gsQ0FBQztJQUVPLEtBQUssQ0FBQyxrQ0FBa0MsQ0FDOUMsT0FBd0M7UUFFeEMsTUFBTSxhQUFhLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQyxhQUFhLENBQUM7UUFDckQsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQ25CLE1BQU0sSUFBSSxLQUFLLENBQUMsMkVBQTJFLENBQUMsQ0FBQztRQUMvRixDQUFDO1FBRUQsTUFBTSxJQUFJLENBQUMsNEJBQTRCLENBQUMsT0FBTyxDQUFDLENBQUM7UUFFakQsTUFBTSxVQUFVLEdBQUcsT0FBTyxDQUFDLFlBQVk7WUFDckMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxNQUFNLE1BQU0sQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDLENBQUMsY0FBYyxDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDO1lBQ3ZILENBQUMsQ0FBQyxJQUFJLENBQUM7UUFDVCxNQUFNLFFBQVEsR0FBRyxVQUFVO1lBQ3pCLENBQUMsQ0FBQyxNQUFNLElBQUksQ0FBQyxlQUFlLENBQUMsc0JBQXNCLENBQUMsVUFBVSxDQUFDO1lBQy9ELENBQUMsQ0FBQyxNQUFNLElBQUksQ0FBQyxlQUFlLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztRQUNsRCxJQUFJLENBQUMsUUFBUSxDQUFDLFNBQVMsSUFBSSxRQUFRLENBQUMsS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUN2RCxNQUFNLElBQUksS0FBSyxDQUNiLGdDQUFnQyxPQUFPLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxRQUFRLE9BQU8sQ0FBQyxZQUFZLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLFFBQVEsQ0FBQyxNQUFNLElBQUksd0JBQXdCLEVBQUUsQ0FDN0ksQ0FBQztRQUNKLENBQUM7UUFDRCxNQUFNLFlBQVksR0FBRyxJQUFJLEdBQUcsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFNBQVMsRUFBRSxFQUFFLENBQUMsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDaEcsTUFBTSxVQUFVLEdBQUcsQ0FBQyxHQUFHLFlBQVksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBRTVDLE1BQU0sbUJBQW1CLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsV0FBVyxFQUFFLFFBQVEsRUFBRSxpQkFBaUIsSUFBSSxNQUFNLENBQUM7UUFDeEcsTUFBTSxLQUFLLEdBQUcsTUFBTSxhQUFhLENBQUMsbUJBQW1CLENBQUM7WUFDcEQsV0FBVyxFQUFFLE9BQU8sQ0FBQyxJQUFJO1lBQ3pCLElBQUksRUFBRSxPQUFPLENBQUMsSUFBSTtZQUNsQixXQUFXLEVBQUUsQ0FBQyxPQUFPLENBQUMsTUFBTTtZQUM1QixnQkFBZ0IsRUFBRSxtQkFBbUI7WUFDckMsZUFBZSxFQUFFLG1CQUFtQjtZQUNwQyxVQUFVO1NBQ1gsQ0FBQyxDQUFDO1FBQ0gsTUFBTSxRQUFRLEdBQUcsWUFBWSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDaEQsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBQ2QsTUFBTSxhQUFhLENBQUMsa0JBQWtCLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUM3RSxNQUFNLElBQUksS0FBSyxDQUFDLCtCQUErQixLQUFLLENBQUMsTUFBTSxrQ0FBa0MsQ0FBQyxDQUFDO1FBQ2pHLENBQUM7UUFDRCxJQUFJLE1BQU0sR0FBRyxLQUFLLENBQUM7UUFDbkIsT0FBTztZQUNMLFdBQVcsRUFBRSxLQUFLLENBQUMsVUFBVTtZQUM3QixXQUFXLEVBQUUsS0FBSyxDQUFDLFVBQVU7WUFDN0IsT0FBTyxFQUFFLGlCQUFpQixLQUFLLENBQUMsTUFBTSxJQUFJLE9BQU8sQ0FBQyxJQUFJLElBQUksT0FBTyxDQUFDLElBQUksRUFBRTtZQUN4RSxZQUFZLEVBQUUsUUFBUSxDQUFDLFFBQVE7WUFDL0IsS0FBSyxFQUFFLEtBQUssSUFBSSxFQUFFO2dCQUNoQixJQUFJLE1BQU0sRUFBRSxDQUFDO29CQUNYLE9BQU87Z0JBQ1QsQ0FBQztnQkFDRCxNQUFNLEdBQUcsSUFBSSxDQUFDO2dCQUNkLElBQUksQ0FBQztvQkFDSCxNQUFNLGFBQWEsQ0FBQyxrQkFBa0IsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7Z0JBQ3hELENBQUM7Z0JBQUMsT0FBTyxHQUFZLEVBQUUsQ0FBQztvQkFDdEIsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsNkNBQTZDLEtBQUssQ0FBQyxPQUFPLEtBQU0sR0FBYSxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUM7Z0JBQzlHLENBQUM7WUFDSCxDQUFDO1NBQ0YsQ0FBQztJQUNKLENBQUM7SUFFRDs7Ozs7Ozs7T0FRRztJQUNLLEtBQUssQ0FBQyw0QkFBNEIsQ0FBQyxPQUF3QztRQUNqRixNQUFNLE9BQU8sR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO1FBQ2xDLEtBQUssTUFBTSxJQUFJLElBQUksSUFBSSxDQUFDLFdBQVcsQ0FBQyxvQkFBb0IsRUFBRSxXQUFXLEVBQUUsRUFBRSxJQUFJLEVBQUUsRUFBRSxDQUFDO1lBQ2hGLElBQUksSUFBSSxDQUFDLFFBQVE7Z0JBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDOUMsSUFBSSxJQUFJLENBQUMsVUFBVTtnQkFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUNwRCxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsSUFBSSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3ZCLE9BQU87UUFDVCxDQUFDO1FBRUQsSUFBSSxTQUFTLEdBQWEsRUFBRSxDQUFDO1FBQzdCLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7WUFDcEQsU0FBUyxHQUFHLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQzdCLENBQUM7YUFBTSxDQUFDO1lBQ04sSUFBSSxDQUFDO2dCQUNILElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7b0JBQ3BCLElBQUksQ0FBQyxTQUFTLEdBQUcsSUFBSSxPQUFPLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUM7Z0JBQ2xFLENBQUM7Z0JBQ0QsTUFBTSxDQUFDLFFBQVEsRUFBRSxXQUFXLENBQUMsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUM7b0JBQ2hELElBQUksQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUM7b0JBQ3hDLElBQUksQ0FBQyxTQUFTLENBQUMsY0FBYyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUM7aUJBQzVDLENBQUMsQ0FBQztnQkFDSCxTQUFTLEdBQUcsQ0FBQyxHQUFHLENBQUMsUUFBUSxJQUFJLEVBQUUsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxXQUFXLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUMxRixDQUFDO1lBQUMsTUFBTSxDQUFDO2dCQUNQLE9BQU87WUFDVCxDQUFDO1FBQ0gsQ0FBQztRQUVELE1BQU0sTUFBTSxHQUFHLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxFQUFFLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUN2RCxJQUFJLE1BQU0sRUFBRSxDQUFDO1lBQ1gsTUFBTSxJQUFJLEtBQUssQ0FDYixvQ0FBb0MsT0FBTyxDQUFDLElBQUksSUFBSSxPQUFPLENBQUMsSUFBSSx3Q0FBd0MsTUFBTSxxRUFBcUUsQ0FDcEwsQ0FBQztRQUNKLENBQUM7SUFDSCxDQUFDO0NBQ0YifQ==

package/dist_ts/email/classes.workapp-mail-manager.d.ts

@@ -84,6 +84,9 @@ export declare class WorkAppMailManager {
     private buildInboundRoute;
     private buildOutboundRoute;
     private ensureEmailDomainConfigured;
+    private getReadyOutboundDomains;
+    private getActiveDkimSelector;
+    private assertIdentityOutboundReady;
     private normalizeOwnership;
     private normalizeDomain;
     private normalizeLocalPart;