@serve.zone/dcrouter 16.4.1 → 17.0.0

package/ts/email/classes.workapp-mail-manager.ts

@@ -4,6 +4,7 @@ import type {
   IMessageAcceptanceContext,
   IMessageAcceptanceDecision,
   IUnifiedEmailServerOptions,
+  IStorageManagerLike,
 } from '@push.rocks/smartmta';
 import type { Buffer } from 'node:buffer';
 import * as plugins from '../plugins.js';
@@ -158,6 +159,10 @@ export class WorkAppMailManager {
     const smtpPassword = shouldRotateSmtpPassword
       ? this.generateSmtpPassword()
       : existingIdentity.smtpPassword;
+    const requestedSmtpEnabled = request.smtpEnabled ?? existingIdentity?.smtp.enabled ?? true;
+    const outboundReadiness = requestedSmtpEnabled
+      ? await this.dcRouterRef.emailDomainManager?.getOutboundReadiness(domain)
+      : { ready: false, reason: 'outbound identity disabled', edgeIds: [] };
     const identity: IStoredWorkAppMailIdentity = {
       id: existingIdentity?.id || plugins.smartunique.shortId(),
       externalKey,
@@ -170,7 +175,7 @@ export class WorkAppMailManager {
       inboundTarget: this.resolveNextInboundTarget(request, existingIdentity),
       inbound: this.toLegacyInboundRouteIfSmtpForward(this.resolveNextInboundTarget(request, existingIdentity)),
       smtp: {
-        enabled: request.smtpEnabled ?? existingIdentity?.smtp.enabled ?? true,
+        enabled: requestedSmtpEnabled,
         username: existingIdentity?.smtp.username || this.buildSmtpUsername(externalKey),
       },
       createdAt: existingIdentity?.createdAt || now,
@@ -197,9 +202,12 @@ export class WorkAppMailManager {
       identity: this.toPublicIdentity(identity),
     };
 
-    if (existingIndex < 0 || request.resetSmtpPassword) {
+    if ((existingIndex < 0 || request.resetSmtpPassword) && outboundReadiness?.ready) {
       response.smtpCredentials = this.buildSmtpCredentials(identity);
     }
+    if (requestedSmtpEnabled && !outboundReadiness?.ready) {
+      response.message = `Outbound identity is persisted but remains gated: ${outboundReadiness?.reason || 'email domain is not active'}`;
+    }
 
     return response;
   }
@@ -313,6 +321,11 @@ export class WorkAppMailManager {
     if (!identity.enabled || !identity.smtp.enabled) {
       return { success: false, message: 'Mail credential is disabled' };
     }
+    try {
+      await this.assertIdentityOutboundReady(identity);
+    } catch (error: unknown) {
+      return { success: false, message: (error as Error).message };
+    }
 
     const now = Date.now();
     identities[identityIndex] = {
@@ -344,6 +357,11 @@ export class WorkAppMailManager {
     if (!identity || !identity.enabled || !identity.smtp.enabled) {
       return this.rejectSenderAuthorization('Managed SMTP credential is not active');
     }
+    try {
+      await this.assertIdentityOutboundReady(identity);
+    } catch (error: unknown) {
+      return this.rejectSenderAuthorization((error as Error).message);
+    }
 
     const envelopeFrom = this.normalizeMailboxAddress(
       context.session.envelope?.mailFrom?.address || context.session.mailFrom || '',
@@ -373,6 +391,7 @@ export class WorkAppMailManager {
         messageArg.from,
         outboundIdentityIdArg,
       );
+      await this.assertIdentityOutboundReady(identity);
       const rawMessage = this.buildOutboundRawMessage(identity, messageArg);
       const recipients = this.getMessageRecipients(messageArg);
       const session = this.buildAuthenticatedSession(identity, messageArg.from, recipients, rawMessage);
@@ -555,7 +574,8 @@ export class WorkAppMailManager {
     emailConfig: TConfig,
   ): Promise<TConfig> {
     const identities = await this.readStoredIdentities();
-    return this.mergeIdentitiesIntoEmailConfig(emailConfig, identities);
+    const readyDomains = await this.getReadyOutboundDomains(identities);
+    return this.mergeIdentitiesIntoEmailConfig(emailConfig, identities, readyDomains);
   }
 
   public async applyStoredIdentitiesToRuntime(
@@ -564,10 +584,9 @@ export class WorkAppMailManager {
     const emailConfig = this.dcRouterRef.options.emailConfig as IUnifiedEmailServerOptions | undefined;
     if (!emailConfig) return;
 
-    const nextConfig = this.mergeIdentitiesIntoEmailConfig(
-      emailConfig,
-      identities || await this.readStoredIdentities(),
-    );
+    const nextIdentities = identities || await this.readStoredIdentities();
+    const readyDomains = await this.getReadyOutboundDomains(nextIdentities);
+    const nextConfig = this.mergeIdentitiesIntoEmailConfig(emailConfig, nextIdentities, readyDomains);
 
     this.dcRouterRef.options.emailConfig = nextConfig;
     if (this.dcRouterRef.emailServer) {
@@ -593,16 +612,26 @@ export class WorkAppMailManager {
     await storageManager.set(this.storageKey, JSON.stringify(state, null, 2));
   }
 
-  private getRequiredStorageManager() {
-    if (!plugins.smartmta.hasStorageManagerMethods(this.dcRouterRef.storageManager, ['get', 'set'])) {
+  private getRequiredStorageManager(): IStorageManagerLike & Required<
+    Pick<IStorageManagerLike, 'get' | 'set'>
+  > {
+    const storageManager = this.dcRouterRef.storageManager;
+    if (
+      !storageManager
+      || typeof storageManager.get !== 'function'
+      || typeof storageManager.set !== 'function'
+    ) {
       throw new Error('DcRouter storage manager does not support managed mail identity persistence');
     }
-    return this.dcRouterRef.storageManager;
+    return storageManager as IStorageManagerLike & Required<
+      Pick<IStorageManagerLike, 'get' | 'set'>
+    >;
   }
 
   private mergeIdentitiesIntoEmailConfig<TConfig extends IUnifiedEmailServerOptions>(
     emailConfig: TConfig,
     identities: IStoredWorkAppMailIdentity[],
+    readyDomains: Set<string>,
   ): TConfig {
     const generatedRoutes = identities
       .filter((identity) => {
@@ -611,12 +640,12 @@ export class WorkAppMailManager {
       })
       .map((identity) => this.buildInboundRoute(identity));
     const generatedOutboundRoutes = identities
-      .filter((identity) => identity.enabled && identity.smtp.enabled)
-      .map((identity) => this.buildOutboundRoute(identity));
+      .filter((identity) => identity.enabled && identity.smtp.enabled && readyDomains.has(identity.domain))
+      .map((identity) => this.buildOutboundRoute(identity, emailConfig));
     const configuredRoutes = (emailConfig.routes || [])
       .filter((route) => !this.isManagedMailRouteName(route.name));
     const generatedUsers = identities
-      .filter((identity) => identity.enabled && identity.smtp.enabled)
+      .filter((identity) => identity.enabled && identity.smtp.enabled && readyDomains.has(identity.domain))
       .map((identity) => ({
         username: identity.smtp.username,
         password: identity.smtpPassword,
@@ -679,7 +708,10 @@ export class WorkAppMailManager {
     };
   }
 
-  private buildOutboundRoute(identity: IStoredWorkAppMailIdentity): IEmailRoute {
+  private buildOutboundRoute(
+    identity: IStoredWorkAppMailIdentity,
+    emailConfig: IUnifiedEmailServerOptions,
+  ): IEmailRoute {
     return {
       name: this.buildOutboundRouteName(identity.externalKey),
       priority: 900,
@@ -699,7 +731,7 @@ export class WorkAppMailManager {
             dkimSign: true,
             dkimOptions: {
               domainName: identity.domain,
-              keySelector: 'default',
+              keySelector: this.getActiveDkimSelector(identity.domain, emailConfig),
             },
           },
         },
@@ -726,6 +758,40 @@ export class WorkAppMailManager {
     await emailDomainManager.ensureEmailDomainForDomainName(domain);
   }
 
+  private async getReadyOutboundDomains(
+    identities: IStoredWorkAppMailIdentity[],
+  ): Promise<Set<string>> {
+    const ready = new Set<string>();
+    const requestedDomains = [...new Set(
+      identities
+        .filter((identity) => identity.enabled && identity.smtp.enabled)
+        .map((identity) => identity.domain),
+    )];
+    for (const domain of requestedDomains) {
+      const readiness = await this.dcRouterRef.emailDomainManager?.getOutboundReadiness(domain);
+      if (readiness?.ready) ready.add(domain);
+    }
+    return ready;
+  }
+
+  private getActiveDkimSelector(
+    domain: string,
+    emailConfig: IUnifiedEmailServerOptions = this.dcRouterRef.options.emailConfig as IUnifiedEmailServerOptions,
+  ): string {
+    return emailConfig?.domains
+      ?.find((domainConfig) => domainConfig.domain.toLowerCase() === domain.toLowerCase())
+      ?.dkim?.selector || 'default';
+  }
+
+  private async assertIdentityOutboundReady(identity: IStoredWorkAppMailIdentity): Promise<void> {
+    const readiness = await this.dcRouterRef.emailDomainManager?.getOutboundReadiness(identity.domain);
+    if (!readiness?.ready) {
+      throw new Error(
+        `Outbound mail for ${identity.domain} is gated until DNS and egress identity validation succeeds: ${readiness?.reason || 'EmailDomainManager unavailable'}`,
+      );
+    }
+  }
+
   private normalizeOwnership(
     ownership: interfaces.data.IWorkAppMailOwnership,
   ): interfaces.data.IWorkAppMailOwnership {
@@ -1257,7 +1323,7 @@ export class WorkAppMailManager {
       allowedFromPatterns: [{ type: 'exactAddress', domain: identityArg.domain, localPart: identityArg.localPart }],
       defaultFrom: identityArg.address,
       domain: identityArg.domain,
-      dkimSelector: 'default',
+      dkimSelector: this.getActiveDkimSelector(identityArg.domain),
       credential: this.toMailCredentialPublic(identityArg),
       createdAt: identityArg.createdAt,
       updatedAt: identityArg.updatedAt,

package/ts/email/index.ts

@@ -3,7 +3,10 @@ export * from './classes.email-domain.manager.js';
 export * from './classes.email-route-builder.js';
 export * from './classes.mail-dns-sync.js';
 export * from './classes.mail-egress-coordinator.js';
+export * from './classes.mail-edge-eligibility.js';
 export * from './classes.email-settings.manager.js';
+export * from './classes.smartmta-blob-storage-manager.js';
 export * from './classes.smartmta-storage-manager.js';
+export * from './smartmta-storage-policy.js';
 export * from './classes.workapp-mail-manager.js';
 export * from './email-dns-records.js';

package/ts/email/smartmta-storage-policy.ts

@@ -0,0 +1,73 @@
+import * as plugins from '../plugins.js';
+
+export interface ISmartMtaTextNamespace {
+  prefix: string;
+  maxBytes: number;
+}
+
+export const smartMtaTextNamespaces: readonly ISmartMtaTextNamespace[] = Object.freeze([
+  { prefix: '/email/dkim/', maxBytes: 128 * 1024 },
+  { prefix: '/email/dns/', maxBytes: 1024 * 1024 },
+  { prefix: '/email/bounces/', maxBytes: 8 * 1024 * 1024 },
+  { prefix: '/email/templates/', maxBytes: 4 * 1024 * 1024 },
+  { prefix: '/email/routes/config.json', maxBytes: 4 * 1024 * 1024 },
+  { prefix: '/security/ip-reputation-cache.json', maxBytes: 8 * 1024 * 1024 },
+  { prefix: '/workhosters/mail-identities.json', maxBytes: 4 * 1024 * 1024 },
+]);
+
+export function normalizeSmartMtaStorageKey(key: string): string {
+  if (typeof key !== 'string' || key.length === 0) {
+    throw new Error('SmartMTA storage key must be a non-empty string');
+  }
+  if (key.includes('\\') || key.includes('\0')) {
+    throw new Error(`Invalid SmartMTA storage key: ${key}`);
+  }
+
+  const withLeadingSlash = key.startsWith('/') ? key : `/${key}`;
+  const segments = withLeadingSlash.split('/').slice(1);
+  if (
+    segments.length === 0
+    || segments.some((segment, index) => segment === '.' || segment === '..' || (segment === '' && index < segments.length - 1))
+  ) {
+    throw new Error(`Invalid SmartMTA storage key: ${key}`);
+  }
+
+  const normalized = `/${segments.filter(Boolean).join('/')}`;
+  if (normalized.length > 1024) {
+    throw new Error('SmartMTA storage key exceeds 1024 characters');
+  }
+  return normalized;
+}
+
+export function getSmartMtaTextNamespace(key: string): ISmartMtaTextNamespace {
+  const normalizedKey = normalizeSmartMtaStorageKey(key);
+  const namespace = smartMtaTextNamespaces.find((candidate) => {
+    return candidate.prefix.endsWith('/')
+      ? normalizedKey.startsWith(candidate.prefix)
+      : normalizedKey === candidate.prefix;
+  });
+  if (!namespace) {
+    throw new Error(`Unsupported SmartMTA text storage namespace: ${normalizedKey}`);
+  }
+  return namespace;
+}
+
+export function validateSmartMtaTextValue(key: string, value: string): void {
+  if (typeof value !== 'string') {
+    throw new Error('SmartMTA text storage only accepts string values');
+  }
+  const namespace = getSmartMtaTextNamespace(key);
+  const size = Buffer.byteLength(value, 'utf8');
+  if (size > namespace.maxBytes) {
+    throw new Error(
+      `SmartMTA storage value for ${normalizeSmartMtaStorageKey(key)} exceeds ${namespace.maxBytes} bytes`,
+    );
+  }
+}
+
+export function hashSmartMtaStorageKey(key: string): string {
+  return plugins.crypto
+    .createHash('sha256')
+    .update(normalizeSmartMtaStorageKey(key))
+    .digest('hex');
+}

package/ts/opsserver/handlers/email-domain.handler.ts

@@ -3,6 +3,91 @@ import type { OpsServer } from '../classes.opsserver.js';
 import * as interfaces from '../../../ts_interfaces/index.js';
 import { requireOpsAuth } from '../helpers/auth.js';
 
+const isRecord = (valueArg: unknown): valueArg is Record<string, unknown> => {
+  return typeof valueArg === 'object' && valueArg !== null;
+};
+
+const normalizeActionErrors = (
+  valueArg: unknown,
+): interfaces.requests.IEmailDomainActionError[] | undefined => {
+  if (!Array.isArray(valueArg)) return undefined;
+
+  const errors: interfaces.requests.IEmailDomainActionError[] = [];
+  for (const entry of valueArg) {
+    if (!isRecord(entry) || typeof entry.message !== 'string') continue;
+    errors.push({
+      code: typeof entry.code === 'string' ? entry.code : 'EMAIL_DOMAIN_ACTION_FAILED',
+      message: entry.message,
+      recordKey: typeof entry.recordKey === 'string' ? entry.recordKey : undefined,
+      retryable: typeof entry.retryable === 'boolean' ? entry.retryable : undefined,
+    });
+  }
+  return errors.length > 0 ? errors : undefined;
+};
+
+const normalizeEmailDomainActionResult = (
+  valueArg: unknown,
+  defaultSuccess = true,
+): interfaces.requests.IEmailDomainActionResult => {
+  const value = isRecord(valueArg) ? valueArg : {};
+  const directDomain = isRecord(value.domain)
+    ? value.domain
+    : typeof value.id === 'string' && typeof value.domain === 'string'
+      ? value
+      : undefined;
+  const reconciliation = isRecord(directDomain?.reconciliation)
+    ? directDomain.reconciliation
+    : undefined;
+  const rawLifecycle = value.lifecycleStatus ?? reconciliation?.lifecycleStatus;
+  const lifecycleStatus =
+    rawLifecycle === 'active' ||
+    rawLifecycle === 'pending' ||
+    rawLifecycle === 'failed' ||
+    rawLifecycle === 'deleting'
+      ? rawLifecycle
+      : undefined;
+  const reconciliationCapability = isRecord(reconciliation?.capability)
+    ? reconciliation.capability.egressIdentityProof
+    : undefined;
+  const rawCapability = value.capability ?? reconciliationCapability;
+  const capability =
+    rawCapability === 'supported' || rawCapability === 'unsupported'
+      ? rawCapability
+      : undefined;
+  const errors = normalizeActionErrors(value.errors ?? reconciliation?.errors);
+
+  return {
+    success: typeof value.success === 'boolean'
+      ? value.success
+      : lifecycleStatus === 'failed'
+        ? false
+        : defaultSuccess,
+    message: typeof value.message === 'string' ? value.message : errors?.[0]?.message,
+    lifecycleStatus,
+    code: typeof value.code === 'string' ? value.code : errors?.[0]?.code,
+    errors,
+    retryAt: typeof value.retryAt === 'string'
+      ? value.retryAt
+      : typeof reconciliation?.retryAt === 'string'
+        ? reconciliation.retryAt
+        : undefined,
+    capability,
+  };
+};
+
+const normalizeEmailDomainActionFailure = (
+  errorArg: unknown,
+  fallbackMessageArg: string,
+): interfaces.requests.IEmailDomainActionResult => {
+  const result = normalizeEmailDomainActionResult(errorArg, false);
+  const errorMessage = errorArg instanceof Error ? errorArg.message : undefined;
+  return {
+    ...result,
+    success: false,
+    message: result.message || errorMessage || result.errors?.[0]?.message || fallbackMessageArg,
+  };
+};
+
 /**
  * CRUD + DNS provisioning handler for email domains.
  *
@@ -31,6 +116,23 @@ export class EmailDomainHandler {
     return this.opsServerRef.dcRouterRef.emailDomainManager;
   }
 
+  private managerUnavailable(): interfaces.requests.IEmailDomainActionResult {
+    const message = 'EmailDomainManager not initialized';
+    return {
+      success: false,
+      message,
+      code: 'EMAIL_DOMAIN_MANAGER_UNAVAILABLE',
+      capability: 'unsupported',
+      errors: [
+        {
+          code: 'EMAIL_DOMAIN_MANAGER_UNAVAILABLE',
+          message,
+          retryable: true,
+        },
+      ],
+    };
+  }
+
   private registerHandlers(): void {
     // List all email domains
     this.typedrouter.addTypedHandler(
@@ -63,10 +165,10 @@ export class EmailDomainHandler {
         async (dataArg) => {
           await this.requireAuth(dataArg, 'email-domains:write' as any);
           if (!this.manager) {
-            return { success: false, message: 'EmailDomainManager not initialized' };
+            return this.managerUnavailable();
           }
           try {
-            const domain = await this.manager.createEmailDomain({
+            const rawResult: unknown = await this.manager.createEmailDomain({
               linkedDomainId: dataArg.linkedDomainId,
               subdomain: dataArg.subdomain,
               dkimSelector: dataArg.dkimSelector,
@@ -75,9 +177,18 @@ export class EmailDomainHandler {
               rotationIntervalDays: dataArg.rotationIntervalDays,
               remoteIngress: dataArg.remoteIngress,
             });
-            return { success: true, domain };
+            const result = normalizeEmailDomainActionResult(rawResult);
+            if (!result.success) return result;
+
+            const resultRecord = isRecord(rawResult) ? rawResult : undefined;
+            const domain = isRecord(resultRecord?.domain)
+              ? resultRecord.domain as unknown as interfaces.data.IEmailDomain
+              : typeof resultRecord?.id === 'string'
+                ? rawResult as interfaces.data.IEmailDomain
+                : undefined;
+            return { ...result, domain };
           } catch (err: unknown) {
-            return { success: false, message: (err as Error).message };
+            return normalizeEmailDomainActionFailure(err, 'Failed to create email domain');
           }
         },
       ),
@@ -90,18 +201,18 @@ export class EmailDomainHandler {
         async (dataArg) => {
           await this.requireAuth(dataArg, 'email-domains:write' as any);
           if (!this.manager) {
-            return { success: false, message: 'EmailDomainManager not initialized' };
+            return this.managerUnavailable();
           }
           try {
-            await this.manager.updateEmailDomain(dataArg.id, {
+            const rawResult: unknown = await this.manager.updateEmailDomain(dataArg.id, {
               rotateKeys: dataArg.rotateKeys,
               rotationIntervalDays: dataArg.rotationIntervalDays,
               rateLimits: dataArg.rateLimits,
               remoteIngress: dataArg.remoteIngress,
             });
-            return { success: true };
+            return normalizeEmailDomainActionResult(rawResult);
           } catch (err: unknown) {
-            return { success: false, message: (err as Error).message };
+            return normalizeEmailDomainActionFailure(err, 'Failed to update email domain');
           }
         },
       ),
@@ -114,13 +225,13 @@ export class EmailDomainHandler {
         async (dataArg) => {
           await this.requireAuth(dataArg, 'email-domains:write' as any);
           if (!this.manager) {
-            return { success: false, message: 'EmailDomainManager not initialized' };
+            return this.managerUnavailable();
           }
           try {
-            await this.manager.deleteEmailDomain(dataArg.id);
-            return { success: true };
+            const rawResult: unknown = await this.manager.deleteEmailDomain(dataArg.id);
+            return normalizeEmailDomainActionResult(rawResult);
           } catch (err: unknown) {
-            return { success: false, message: (err as Error).message };
+            return normalizeEmailDomainActionFailure(err, 'Failed to delete email domain');
           }
         },
       ),
@@ -133,14 +244,27 @@ export class EmailDomainHandler {
         async (dataArg) => {
           await this.requireAuth(dataArg, 'email-domains:read' as any);
           if (!this.manager) {
-            return { success: false, message: 'EmailDomainManager not initialized' };
+            return this.managerUnavailable();
           }
           try {
-            const records = await this.manager.validateDns(dataArg.id);
-            const domain = await this.manager.getById(dataArg.id);
-            return { success: true, domain: domain ?? undefined, records };
+            const rawResult: unknown = await this.manager.validateDns(dataArg.id);
+            const result = normalizeEmailDomainActionResult(rawResult);
+            if (!result.success) return result;
+
+            const resultRecord = isRecord(rawResult) ? rawResult : undefined;
+            const records = (
+              Array.isArray(rawResult)
+                ? rawResult
+                : Array.isArray(resultRecord?.records)
+                  ? resultRecord.records
+                  : undefined
+            ) as interfaces.data.IEmailDnsRecord[] | undefined;
+            const domain = isRecord(resultRecord?.domain)
+              ? resultRecord.domain as unknown as interfaces.data.IEmailDomain
+              : await this.manager.getById(dataArg.id) ?? undefined;
+            return { ...result, domain, records };
           } catch (err: unknown) {
-            return { success: false, message: (err as Error).message };
+            return normalizeEmailDomainActionFailure(err, 'Failed to validate email domain DNS');
           }
         },
       ),
@@ -165,13 +289,22 @@ export class EmailDomainHandler {
         async (dataArg) => {
           await this.requireAuth(dataArg, 'email-domains:write' as any);
           if (!this.manager) {
-            return { success: false, message: 'EmailDomainManager not initialized' };
+            return this.managerUnavailable();
           }
           try {
-            const provisioned = await this.manager.provisionDnsRecords(dataArg.id);
-            return { success: true, provisioned };
+            const rawResult: unknown = await this.manager.provisionDnsRecords(dataArg.id);
+            const result = normalizeEmailDomainActionResult(rawResult);
+            if (!result.success) return result;
+
+            const resultRecord = isRecord(rawResult) ? rawResult : undefined;
+            const provisioned = typeof rawResult === 'number'
+              ? rawResult
+              : typeof resultRecord?.provisioned === 'number'
+                ? resultRecord.provisioned
+                : undefined;
+            return { ...result, provisioned };
           } catch (err: unknown) {
-            return { success: false, message: (err as Error).message };
+            return normalizeEmailDomainActionFailure(err, 'Failed to provision email domain DNS');
           }
         },
       ),

package/ts/opsserver/handlers/stats.handler.ts

@@ -562,10 +562,8 @@ export class StatsHandler {
         const emailLike = item.processingResult;
         const recipients = Array.isArray(emailLike?.to)
           ? emailLike.to
-          : Array.isArray(emailLike?.email?.to)
-            ? emailLike.email.to
-            : [];
-        const subject = emailLike?.subject || emailLike?.email?.subject || '';
+          : [];
+        const subject = emailLike?.subject || '';
         return {
           id: item.id,
           recipient: recipients[0] || '',

package/ts/plugins.ts

@@ -54,6 +54,7 @@ export {
 import * as projectinfo from '@push.rocks/projectinfo';
 import * as qenv from '@push.rocks/qenv';
 import * as smartacme from '@push.rocks/smartacme';
+import * as smartbucket from '@push.rocks/smartbucket';
 import * as smartchallenge from '@push.rocks/smartchallenge';
 import * as smartdata from '@push.rocks/smartdata';
 import * as smartdns from '@push.rocks/smartdns';
@@ -76,7 +77,7 @@ import * as smartrx from '@push.rocks/smartrx';
 import * as smartunique from '@push.rocks/smartunique';
 import * as taskbuffer from '@push.rocks/taskbuffer';
 
-export { projectinfo, qenv, smartacme, smartchallenge, smartdata, smartdns, smartfs, smartguard, smartjwt, smartlog, smartmetrics, smartmcp, smartdb, smartmta, smartnetwork, smartpath, smartproxy, smartpromise, smartradius, smartrequest, smartrx, smartunique, smartvpn, taskbuffer };
+export { projectinfo, qenv, smartacme, smartbucket, smartchallenge, smartdata, smartdns, smartfs, smartguard, smartjwt, smartlog, smartmetrics, smartmcp, smartdb, smartmta, smartnetwork, smartpath, smartproxy, smartpromise, smartradius, smartrequest, smartrx, smartunique, smartvpn, taskbuffer };
 
 // Define SmartLog types for use in error handling
 export type TLogLevel = 'error' | 'warn' | 'info' | 'success' | 'debug';

package/ts/remoteingress/classes.hub-lifecycle.ts

@@ -223,6 +223,7 @@ export class RemoteIngressHubLifecycle {
       tls: tlsConfig,
       performance: manager.getHubPerformanceConfig(),
     });
+    tunnelManager.setOnTopologyChanged((reason) => this.dcRouterRef.mailDnsSync.requestSync(reason));
     try {
       await tunnelManager.start();
     } catch (err) {