@serve.zone/dcrouter 18.0.2 → 18.1.1

package/ts/email/classes.workapp-mail-manager.ts

@@ -93,6 +93,26 @@ interface IStoredWorkAppMailState {
   identities: IStoredWorkAppMailIdentity[];
 }
 
+/**
+ * WorkApp-generated routes and SMTP users contributed to the composed email
+ * runtime config. Consumed by SmtpAccountManager, the single owner of the
+ * final `auth` block and route-list composition.
+ */
+export interface IWorkAppMailRuntimeContribution {
+  routes: IEmailRoute[];
+  users: Array<{ username: string; password: string }>;
+}
+
+/** Route names generated (and owned wholesale) by WorkAppMailManager. */
+export function isWorkAppManagedMailRouteName(routeName: string): boolean {
+  return routeName.startsWith('workapp-mail-');
+}
+
+/** SMTP usernames generated (and owned wholesale) by WorkAppMailManager. */
+export function isWorkAppManagedSmtpUsername(username: string): boolean {
+  return username.startsWith('workapp-');
+}
+
 export class WorkAppMailManager {
   private readonly storageKey = '/workhosters/mail-identities.json';
   private identityMutationPromise: Promise<unknown> = Promise.resolve();
@@ -659,12 +679,36 @@ export class WorkAppMailManager {
     };
   }
 
-  public async applyStoredIdentitiesToEmailConfig<TConfig extends IUnifiedEmailServerOptions>(
-    emailConfig: TConfig,
-  ): Promise<TConfig> {
-    const identities = await this.readStoredIdentities();
-    const readyDomains = await this.getReadyOutboundDomains(identities);
-    return this.mergeIdentitiesIntoEmailConfig(emailConfig, identities, readyDomains);
+  /**
+   * Compute the workapp-generated routes and SMTP users for the given
+   * candidate email config. Pure contribution — the final composition of
+   * routes and the `auth` block is owned exclusively by SmtpAccountManager.
+   */
+  public async getStoredIdentityContribution(
+    emailConfig: IUnifiedEmailServerOptions,
+    identities = undefined as IStoredWorkAppMailIdentity[] | undefined,
+  ): Promise<IWorkAppMailRuntimeContribution> {
+    const nextIdentities = identities || await this.readStoredIdentities();
+    const readyDomains = await this.getReadyOutboundDomains(nextIdentities);
+    const generatedRoutes = nextIdentities
+      .filter((identity) => {
+        const inboundTarget = this.getCanonicalInboundTarget(identity);
+        return identity.enabled && ['smtpForward', 'typedEndpoint'].includes(inboundTarget?.type || '');
+      })
+      .map((identity) => this.buildInboundRoute(identity));
+    const generatedOutboundRoutes = nextIdentities
+      .filter((identity) => identity.enabled && identity.smtp.enabled && readyDomains.has(identity.domain))
+      .map((identity) => this.buildOutboundRoute(identity, emailConfig));
+    const generatedUsers = nextIdentities
+      .filter((identity) => identity.enabled && identity.smtp.enabled && readyDomains.has(identity.domain))
+      .map((identity) => ({
+        username: identity.smtp.username,
+        password: identity.smtpPassword,
+      }));
+    return {
+      routes: [...generatedRoutes, ...generatedOutboundRoutes],
+      users: generatedUsers,
+    };
   }
 
   public async applyStoredIdentitiesToRuntime(
@@ -673,15 +717,8 @@ export class WorkAppMailManager {
     const emailConfig = this.dcRouterRef.options.emailConfig as IUnifiedEmailServerOptions | undefined;
     if (!emailConfig) return;
 
-    const nextIdentities = identities || await this.readStoredIdentities();
-    const readyDomains = await this.getReadyOutboundDomains(nextIdentities);
-    const nextConfig = this.mergeIdentitiesIntoEmailConfig(emailConfig, nextIdentities, readyDomains);
-
-    this.dcRouterRef.options.emailConfig = nextConfig;
-    if (this.dcRouterRef.emailServer) {
-      this.dcRouterRef.emailServer.updateOptions({ auth: nextConfig.auth });
-      await this.dcRouterRef.updateEmailRoutes(nextConfig.routes);
-    }
+    const contribution = await this.getStoredIdentityContribution(emailConfig, identities);
+    await this.dcRouterRef.smtpAccountManager.applyToRuntime(contribution);
   }
 
   private async readStoredIdentities(): Promise<IStoredWorkAppMailIdentity[]> {
@@ -717,41 +754,6 @@ export class WorkAppMailManager {
     >;
   }
 
-  private mergeIdentitiesIntoEmailConfig<TConfig extends IUnifiedEmailServerOptions>(
-    emailConfig: TConfig,
-    identities: IStoredWorkAppMailIdentity[],
-    readyDomains: Set<string>,
-  ): TConfig {
-    const generatedRoutes = identities
-      .filter((identity) => {
-        const inboundTarget = this.getCanonicalInboundTarget(identity);
-        return identity.enabled && ['smtpForward', 'typedEndpoint'].includes(inboundTarget?.type || '');
-      })
-      .map((identity) => this.buildInboundRoute(identity));
-    const generatedOutboundRoutes = identities
-      .filter((identity) => identity.enabled && identity.smtp.enabled && readyDomains.has(identity.domain))
-      .map((identity) => this.buildOutboundRoute(identity, emailConfig));
-    const configuredRoutes = (emailConfig.routes || [])
-      .filter((route) => !this.isManagedMailRouteName(route.name));
-    const generatedUsers = identities
-      .filter((identity) => identity.enabled && identity.smtp.enabled && readyDomains.has(identity.domain))
-      .map((identity) => ({
-        username: identity.smtp.username,
-        password: identity.smtpPassword,
-      }));
-    const configuredUsers = (emailConfig.auth?.users || [])
-      .filter((user) => !this.isManagedSmtpUsername(user.username));
-
-    return {
-      ...emailConfig,
-      routes: [...configuredRoutes, ...generatedRoutes, ...generatedOutboundRoutes],
-      auth: {
-        ...(emailConfig.auth || {}),
-        users: [...configuredUsers, ...generatedUsers],
-      },
-    };
-  }
-
   private buildInboundRoute(identity: IStoredWorkAppMailIdentity): IEmailRoute {
     const inboundTarget = this.getCanonicalInboundTarget(identity);
     if (inboundTarget?.type === 'typedEndpoint') {
@@ -1594,12 +1596,8 @@ export class WorkAppMailManager {
     return plugins.crypto.randomBytes(24).toString('base64url');
   }
 
-  private isManagedMailRouteName(routeName: string): boolean {
-    return routeName.startsWith('workapp-mail-');
-  }
-
   private isManagedSmtpUsername(username: string): boolean {
-    return username.startsWith('workapp-');
+    return isWorkAppManagedSmtpUsername(username);
   }
 
   private buildSmtpCredentials(

package/ts/email/index.ts

@@ -11,5 +11,7 @@ export * from './classes.email-settings.manager.js';
 export * from './classes.smartmta-blob-storage-manager.js';
 export * from './classes.smartmta-storage-manager.js';
 export * from './smartmta-storage-policy.js';
+export * from './classes.smtp-account.manager.js';
+export * from './smtp-scram.js';
 export * from './classes.workapp-mail-manager.js';
 export * from './email-dns-records.js';

package/ts/email/smtp-scram.ts

@@ -0,0 +1,24 @@
+import * as plugins from '../plugins.js';
+import { deriveScramVerifier } from '@push.rocks/smartmta';
+import type { ISmtpScramVerifier } from '@push.rocks/smartmta';
+
+/**
+ * Derive an RFC 5802 SCRAM-SHA-256 verifier from a plaintext password using
+ * smartmta's canonical exported derivation (fresh random salt, OWASP-aligned
+ * default iteration count) — the exact algorithm the server verifies at AUTH
+ * time. Only the verifier is ever persisted; the plaintext is shown once at
+ * create/rotate time and then discarded.
+ */
+export function deriveSmtpScramVerifier(
+  password: string,
+  iterations?: number,
+): ISmtpScramVerifier {
+  return deriveScramVerifier(password, iterations);
+}
+
+/**
+ * Machine-generated SMTP account password (~192 bits of entropy). Shown once.
+ */
+export function generateSmtpAccountPassword(): string {
+  return plugins.crypto.randomBytes(24).toString('base64url');
+}

package/ts/monitoring/classes.metricsmanager.ts

@@ -4,7 +4,15 @@ import { MetricsCache } from './classes.metricscache.js';
 import { SecurityLogger, SecurityEventType } from '../security/classes.securitylogger.js';
 import { logger } from '../logger.js';
 import type { IAsnActivity, IProtocolConnectionHistoryPoint } from '../../ts_interfaces/data/stats.js';
-
+import {
+  EmailTrafficBucketDoc,
+  type IEmailTrafficBucketSnapshot,
+} from '../db/documents/classes.email-traffic-bucket.doc.js';
+
+const EMAIL_TRAFFIC_WINDOW_MINUTES = 24 * 60;
+const EMAIL_TRAFFIC_FLUSH_INTERVAL_MS = 5_000;
+const EMAIL_TRAFFIC_PRUNE_INTERVAL_MS = 60 * 60 * 1000;
+const AUTHENTICATION_EVENT_RETENTION_MS = 90 * 24 * 60 * 60 * 1000;
 const NETWORK_STATS_CACHE_TTL_MS = 3_000;
 const ASN_INTELLIGENCE_CACHE_TTL_MS = 60_000;
 const ACTIVE_CONNECTION_SNAPSHOT_CACHE_TTL_MS = 3_000;
@@ -20,6 +28,12 @@ export class MetricsManager {
   private dcRouter: DcRouter;
   private resetInterval?: NodeJS.Timeout;
   private observedIpSamplerInterval?: NodeJS.Timeout;
+  private emailTrafficFlushInterval?: NodeJS.Timeout;
+  private persistedMetricsPruneInterval?: NodeJS.Timeout;
+  private emailTrafficFlushChain: Promise<void> = Promise.resolve();
+  private persistedMetricsFlushInFlight?: Promise<void>;
+  private persistedMetricsPruneInFlight?: Promise<void>;
+  private emailDirtyBuckets = new Map<number, number>();
   private metricsCache: MetricsCache;
   
   // Constants
@@ -32,7 +46,7 @@ export class MetricsManager {
     failedToday: 0,
     bouncedToday: 0,
     queueSize: 0,
-    lastResetDate: new Date().toDateString(),
+    lastResetDate: new Date().toISOString().slice(0, 10),
     deliveryTimes: [] as number[], // Track delivery times in ms
     recipients: new Map<string, number>(), // Track email count by recipient
     recentActivity: [] as Array<{ timestamp: number; type: string; details: string }>,
@@ -54,7 +68,9 @@ export class MetricsManager {
   };
   
   // Per-minute time-series buckets for charts
-  private emailMinuteBuckets = new Map<number, { sent: number; received: number; failed: number }>();
+  private emailMinuteBuckets = new Map<number, {
+    sent: number; received: number; failed: number; revision: number;
+  }>();
   private dnsMinuteBuckets = new Map<number, { queries: number }>();
 
   // Track security-specific metrics
@@ -84,23 +100,18 @@ export class MetricsManager {
   }
   
   public async start(): Promise<void> {
+    if (this.canPersistEmailTraffic()) {
+      await this.loadEmailTrafficBuckets();
+      await this.prunePersistedMetrics();
+    }
+
     // Start SmartMetrics collection
     this.smartMetrics.start();
     
-    // Reset daily counters at midnight
+    // Maintain UTC daily ancillary counters and bounded in-memory windows.
     this.resetInterval = setInterval(() => {
       const currentDate = new Date().toDateString();
-      
-      if (currentDate !== this.emailMetrics.lastResetDate) {
-        this.emailMetrics.sentToday = 0;
-        this.emailMetrics.receivedToday = 0;
-        this.emailMetrics.failedToday = 0;
-        this.emailMetrics.bouncedToday = 0;
-        this.emailMetrics.deliveryTimes = [];
-        this.emailMetrics.recipients.clear();
-        this.emailMetrics.recentActivity = [];
-        this.emailMetrics.lastResetDate = currentDate;
-      }
+      this.ensureEmailDailyState();
       
       if (currentDate !== this.dnsMetrics.lastResetDate) {
         this.dnsMetrics.totalQueries = 0;
@@ -128,17 +139,33 @@ export class MetricsManager {
       // Prune old time-series buckets every minute (don't wait for lazy query)
       this.pruneOldBuckets();
     }, 60000); // Check every minute
+    this.resetInterval.unref();
 
     this.observedIpSamplerInterval = setInterval(() => {
       this.sampleObservedIps();
     }, OBSERVED_IP_SAMPLE_INTERVAL_MS);
     this.observedIpSamplerInterval.unref();
+
+    if (this.canPersistEmailTraffic()) {
+      this.emailTrafficFlushInterval = setInterval(() => {
+        void this.flushPersistedMetrics().catch((error) => {
+          logger.log('warn', `Metrics persistence flush failed: ${(error as Error).message}`);
+        });
+      }, EMAIL_TRAFFIC_FLUSH_INTERVAL_MS);
+      this.emailTrafficFlushInterval.unref();
+
+      this.persistedMetricsPruneInterval = setInterval(() => {
+        void this.prunePersistedMetrics().catch((error) => {
+          logger.log('warn', `Metrics persistence pruning failed: ${(error as Error).message}`);
+        });
+      }, EMAIL_TRAFFIC_PRUNE_INTERVAL_MS);
+      this.persistedMetricsPruneInterval.unref();
+    }
     
     logger.log('info', 'MetricsManager started');
   }
 
   public async stop(): Promise<void> {
-    // Clear the reset interval
     if (this.resetInterval) {
       clearInterval(this.resetInterval);
       this.resetInterval = undefined;
@@ -147,12 +174,60 @@ export class MetricsManager {
       clearInterval(this.observedIpSamplerInterval);
       this.observedIpSamplerInterval = undefined;
     }
+    if (this.emailTrafficFlushInterval) {
+      clearInterval(this.emailTrafficFlushInterval);
+      this.emailTrafficFlushInterval = undefined;
+    }
+    if (this.persistedMetricsPruneInterval) {
+      clearInterval(this.persistedMetricsPruneInterval);
+      this.persistedMetricsPruneInterval = undefined;
+    }
+
+    if (this.persistedMetricsPruneInFlight) {
+      try {
+        await this.persistedMetricsPruneInFlight;
+      } catch (error) {
+        logger.log('warn', `Final metrics pruning wait failed: ${(error as Error).message}`);
+      }
+    }
+
+    let finalFlushError: Error | undefined;
+    if (this.canPersistEmailTraffic()) {
+      const activeFlush = this.persistedMetricsFlushInFlight;
+      if (activeFlush) {
+        try {
+          await activeFlush;
+        } catch (error) {
+          logger.log(
+            'warn',
+            `Active metrics persistence flush failed before final drain: ${(error as Error).message}`,
+          );
+        }
+      }
+
+      // OpsServer and EmailServer have stopped by this point. Run a fresh,
+      // non-coalesced pass so events added after an earlier flush snapshot are
+      // included in the final durable drain.
+      for (let attempt = 0; attempt < 3; attempt++) {
+        try {
+          await this.flushPersistedMetricsUnlocked();
+          finalFlushError = undefined;
+          break;
+        } catch (error) {
+          finalFlushError = error as Error;
+        }
+      }
+    }
 
     this.smartMetrics.stop();
 
-    // Clear caches and time-series buckets on shutdown
+    if (finalFlushError) {
+      throw new Error(`Final metrics persistence flush failed: ${finalFlushError.message}`);
+    }
+
     this.metricsCache.clear();
     this.emailMinuteBuckets.clear();
+    this.emailDirtyBuckets.clear();
     this.dnsMinuteBuckets.clear();
 
     logger.log('info', 'MetricsManager stopped');
@@ -199,30 +274,31 @@ export class MetricsManager {
   // Get email metrics
   public async getEmailStats() {
     return this.metricsCache.get('emailStats', () => {
-      // Calculate average delivery time
+      this.ensureEmailDailyState();
+      const totals = this.getUtcTodayEmailTotals();
+      const deliveryAttempts = totals.sent + totals.failed;
       const avgDeliveryTime = this.emailMetrics.deliveryTimes.length > 0
         ? this.emailMetrics.deliveryTimes.reduce((a, b) => a + b, 0) / this.emailMetrics.deliveryTimes.length
         : 0;
-      
-      // Get top recipients
+
       const topRecipients = Array.from(this.emailMetrics.recipients.entries())
         .sort((a, b) => b[1] - a[1])
         .slice(0, 10)
         .map(([email, count]) => ({ email, count }));
-      
-      // Get recent activity (last 50 entries)
+
       const recentActivity = this.emailMetrics.recentActivity.slice(-50);
-      
+
       return {
-        sentToday: this.emailMetrics.sentToday,
-        receivedToday: this.emailMetrics.receivedToday,
-        failedToday: this.emailMetrics.failedToday,
-        bounceRate: this.emailMetrics.bouncedToday > 0 
-          ? (this.emailMetrics.bouncedToday / this.emailMetrics.sentToday) * 100 
+        sentToday: totals.sent,
+        receivedToday: totals.received,
+        failedToday: totals.failed,
+        bouncedToday: this.emailMetrics.bouncedToday,
+        bounceRate: deliveryAttempts > 0
+          ? Math.min(1, Math.max(0, this.emailMetrics.bouncedToday / deliveryAttempts))
           : 0,
-        deliveryRate: this.emailMetrics.sentToday > 0 
-          ? ((this.emailMetrics.sentToday - this.emailMetrics.failedToday) / this.emailMetrics.sentToday) * 100 
-          : 100,
+        deliveryRate: deliveryAttempts > 0
+          ? Math.min(1, Math.max(0, totals.sent / deliveryAttempts))
+          : 1,
         queueSize: this.emailMetrics.queueSize,
         averageDeliveryTime: Math.round(avgDeliveryTime),
         topRecipients,
@@ -278,8 +354,13 @@ export class MetricsManager {
       this.securityMetrics.spamDetected = summary.byType[SecurityEventType.SPAM] || 0;
       this.securityMetrics.malwareDetected = summary.byType[SecurityEventType.MALWARE] || 0;
       this.securityMetrics.phishingDetected = summary.byType[SecurityEventType.DMARC] || 0; // phishing via DMARC
-      this.securityMetrics.authFailures =
-        summary.byType[SecurityEventType.AUTHENTICATION] || 0;
+      this.securityMetrics.authFailures = securityLogger
+        .getRecentEvents(10_000, {
+          type: SecurityEventType.AUTHENTICATION,
+          fromTimestamp: Date.now() - 86_400_000,
+        })
+        .filter((event) => event.success === false)
+        .length;
       this.securityMetrics.blockedIPs =
         (summary.byType[SecurityEventType.IP_REPUTATION] || 0) +
         (summary.byType[SecurityEventType.REJECTED_CONNECTION] || 0);
@@ -377,7 +458,7 @@ export class MetricsManager {
   
   // Email event tracking methods
   public trackEmailSent(recipient?: string, deliveryTimeMs?: number): void {
-    this.emailMetrics.sentToday++;
+    this.ensureEmailDailyState();
     this.incrementEmailBucket('sent');
     
     if (recipient) {
@@ -414,7 +495,7 @@ export class MetricsManager {
   }
   
   public trackEmailReceived(sender?: string): void {
-    this.emailMetrics.receivedToday++;
+    this.ensureEmailDailyState();
     this.incrementEmailBucket('received');
     
     this.emailMetrics.recentActivity.push({
@@ -430,7 +511,7 @@ export class MetricsManager {
   }
   
   public trackEmailFailed(recipient?: string, reason?: string): void {
-    this.emailMetrics.failedToday++;
+    this.ensureEmailDailyState();
     this.incrementEmailBucket('failed');
     
     this.emailMetrics.recentActivity.push({
@@ -446,6 +527,7 @@ export class MetricsManager {
   }
   
   public trackEmailBounced(recipient?: string): void {
+    this.ensureEmailDailyState();
     this.emailMetrics.bouncedToday++;
     
     this.emailMetrics.recentActivity.push({
@@ -1087,14 +1169,164 @@ export class MetricsManager {
     return Math.floor(ts / 60000) * 60000;
   }
 
+  private static firstMinuteForHours(hoursArg: number, nowArg = Date.now()): number {
+    const pointCount = Math.max(1, Math.floor(hoursArg * 60));
+    return MetricsManager.minuteKey(nowArg) - (pointCount - 1) * 60_000;
+  }
+
+  private isEmailTrafficPersistenceConfigured(): boolean {
+    return this.dcRouter.options.dbConfig?.enabled !== false;
+  }
+
+  private canPersistEmailTraffic(): boolean {
+    return this.isEmailTrafficPersistenceConfigured()
+      && Boolean(this.dcRouter.dcRouterDb?.isReady());
+  }
+
+  private ensureEmailDailyState(nowArg = Date.now()): void {
+    const currentUtcDate = new Date(nowArg).toISOString().slice(0, 10);
+    if (currentUtcDate === this.emailMetrics.lastResetDate) return;
+
+    this.emailMetrics.sentToday = 0;
+    this.emailMetrics.receivedToday = 0;
+    this.emailMetrics.failedToday = 0;
+    this.emailMetrics.bouncedToday = 0;
+    this.emailMetrics.deliveryTimes = [];
+    this.emailMetrics.recipients.clear();
+    this.emailMetrics.recentActivity = [];
+    this.emailMetrics.lastResetDate = currentUtcDate;
+  }
+
+  private getUtcTodayEmailTotals(nowArg = Date.now()): {
+    sent: number;
+    received: number;
+    failed: number;
+  } {
+    const now = new Date(nowArg);
+    const utcMidnight = Date.UTC(
+      now.getUTCFullYear(),
+      now.getUTCMonth(),
+      now.getUTCDate(),
+    );
+    const totals = { sent: 0, received: 0, failed: 0 };
+    for (const [bucketStart, bucket] of this.emailMinuteBuckets) {
+      if (bucketStart < utcMidnight || bucketStart > nowArg) continue;
+      totals.sent += bucket.sent;
+      totals.received += bucket.received;
+      totals.failed += bucket.failed;
+    }
+    return totals;
+  }
+
+  private async loadEmailTrafficBuckets(): Promise<void> {
+    const snapshots = await EmailTrafficBucketDoc.loadSince(
+      MetricsManager.firstMinuteForHours(24),
+    );
+    for (const snapshot of snapshots) {
+      this.emailMinuteBuckets.set(snapshot.bucketStart, {
+        sent: snapshot.sent,
+        received: snapshot.received,
+        failed: snapshot.failed,
+        revision: 0,
+      });
+    }
+  }
+
+  private flushPersistedMetrics(): Promise<void> {
+    if (this.persistedMetricsFlushInFlight) return this.persistedMetricsFlushInFlight;
+    const run = this.flushPersistedMetricsUnlocked();
+    this.persistedMetricsFlushInFlight = run;
+    run.then(
+      () => { if (this.persistedMetricsFlushInFlight === run) this.persistedMetricsFlushInFlight = undefined; },
+      () => { if (this.persistedMetricsFlushInFlight === run) this.persistedMetricsFlushInFlight = undefined; },
+    );
+    return run;
+  }
+
+  private async flushPersistedMetricsUnlocked(): Promise<void> {
+    const results = await Promise.allSettled([
+      this.flushEmailTrafficBuckets(),
+      this.dcRouter.authenticationEventManager.flushBuffered(),
+    ]);
+    const failure = results.find((result) => result.status === 'rejected');
+    if (failure?.status === 'rejected') {
+      throw failure.reason;
+    }
+  }
+
+  private flushEmailTrafficBuckets(): Promise<void> {
+    const run = this.emailTrafficFlushChain.then(
+      () => this.flushEmailTrafficBucketsUnlocked(),
+      () => this.flushEmailTrafficBucketsUnlocked(),
+    );
+    this.emailTrafficFlushChain = run.then(() => undefined, () => undefined);
+    return run;
+  }
+
+  private async flushEmailTrafficBucketsUnlocked(): Promise<void> {
+    if (!this.canPersistEmailTraffic() || this.emailDirtyBuckets.size === 0) return;
+
+    const snapshots: Array<IEmailTrafficBucketSnapshot & { revision: number }> = [];
+    for (const [bucketStart, revision] of this.emailDirtyBuckets) {
+      const bucket = this.emailMinuteBuckets.get(bucketStart);
+      if (!bucket) continue;
+      snapshots.push({
+        bucketStart,
+        sent: bucket.sent,
+        received: bucket.received,
+        failed: bucket.failed,
+        revision,
+      });
+    }
+
+    for (let offset = 0; offset < snapshots.length; offset += 500) {
+      const batch = snapshots.slice(offset, offset + 500);
+      await EmailTrafficBucketDoc.persistAbsolute(batch);
+      for (const snapshot of batch) {
+        const current = this.emailMinuteBuckets.get(snapshot.bucketStart);
+        if (
+          current?.revision === snapshot.revision
+          && this.emailDirtyBuckets.get(snapshot.bucketStart) === snapshot.revision
+        ) {
+          this.emailDirtyBuckets.delete(snapshot.bucketStart);
+        }
+      }
+    }
+  }
+
+  private prunePersistedMetrics(): Promise<void> {
+    if (this.persistedMetricsPruneInFlight) return this.persistedMetricsPruneInFlight;
+    const run = this.prunePersistedMetricsUnlocked();
+    this.persistedMetricsPruneInFlight = run;
+    run.then(
+      () => { if (this.persistedMetricsPruneInFlight === run) this.persistedMetricsPruneInFlight = undefined; },
+      () => { if (this.persistedMetricsPruneInFlight === run) this.persistedMetricsPruneInFlight = undefined; },
+    );
+    return run;
+  }
+
+  private async prunePersistedMetricsUnlocked(): Promise<void> {
+    if (!this.canPersistEmailTraffic()) return;
+    await Promise.all([
+      EmailTrafficBucketDoc.pruneBefore(MetricsManager.firstMinuteForHours(24)),
+      this.dcRouter.authenticationEventManager.pruneBefore(
+        Date.now() - AUTHENTICATION_EVENT_RETENTION_MS,
+      ),
+    ]);
+  }
+
   private incrementEmailBucket(field: 'sent' | 'received' | 'failed'): void {
     const key = MetricsManager.minuteKey();
     let bucket = this.emailMinuteBuckets.get(key);
     if (!bucket) {
-      bucket = { sent: 0, received: 0, failed: 0 };
+      bucket = { sent: 0, received: 0, failed: 0, revision: 0 };
       this.emailMinuteBuckets.set(key, bucket);
     }
     bucket[field]++;
+    bucket.revision++;
+    if (this.isEmailTrafficPersistenceConfigured()) {
+      this.emailDirtyBuckets.set(key, bucket.revision);
+    }
   }
 
   private incrementDnsBucket(): void {
@@ -1165,12 +1397,16 @@ export class MetricsManager {
   }
 
   private pruneOldBuckets(): void {
-    const cutoff = Date.now() - 86400000; // 24h
+    const emailCutoff = MetricsManager.firstMinuteForHours(24);
     for (const key of this.emailMinuteBuckets.keys()) {
-      if (key < cutoff) this.emailMinuteBuckets.delete(key);
+      if (key < emailCutoff) {
+        this.emailMinuteBuckets.delete(key);
+        this.emailDirtyBuckets.delete(key);
+      }
     }
+    const dnsCutoff = Date.now() - 86400000;
     for (const key of this.dnsMinuteBuckets.keys()) {
-      if (key < cutoff) this.dnsMinuteBuckets.delete(key);
+      if (key < dnsCutoff) this.dnsMinuteBuckets.delete(key);
     }
   }
 
@@ -1183,20 +1419,21 @@ export class MetricsManager {
     failed: Array<{ timestamp: number; value: number }>;
   } {
     this.pruneOldBuckets();
-    const cutoff = Date.now() - hours * 3600000;
+    const pointCount = Math.max(
+      1,
+      Math.min(EMAIL_TRAFFIC_WINDOW_MINUTES, Math.floor(hours * 60)),
+    );
+    const end = MetricsManager.minuteKey();
+    const start = end - (pointCount - 1) * 60_000;
     const sent: Array<{ timestamp: number; value: number }> = [];
     const received: Array<{ timestamp: number; value: number }> = [];
     const failed: Array<{ timestamp: number; value: number }> = [];
 
-    const sortedKeys = Array.from(this.emailMinuteBuckets.keys())
-      .filter((k) => k >= cutoff)
-      .sort((a, b) => a - b);
-
-    for (const key of sortedKeys) {
-      const bucket = this.emailMinuteBuckets.get(key)!;
-      sent.push({ timestamp: key, value: bucket.sent });
-      received.push({ timestamp: key, value: bucket.received });
-      failed.push({ timestamp: key, value: bucket.failed });
+    for (let timestamp = start; timestamp <= end; timestamp += 60_000) {
+      const bucket = this.emailMinuteBuckets.get(timestamp);
+      sent.push({ timestamp, value: bucket?.sent || 0 });
+      received.push({ timestamp, value: bucket?.received || 0 });
+      failed.push({ timestamp, value: bucket?.failed || 0 });
     }
 
     return { sent, received, failed };

package/ts/opsserver/classes.opsserver.ts

@@ -41,6 +41,7 @@ export class OpsServer {
   private dnsRecordHandler!: handlers.DnsRecordHandler;
   private acmeConfigHandler!: handlers.AcmeConfigHandler;
   private emailDomainHandler!: handlers.EmailDomainHandler;
+  private smtpAccountHandler!: handlers.SmtpAccountHandler;
   private gatewayClientHandler!: handlers.GatewayClientHandler;
   private webPushControlHandler!: handlers.WebPushControlHandler;
   private webPushAppHandler!: handlers.WebPushAppHandler;
@@ -109,6 +110,7 @@ export class OpsServer {
     this.dnsRecordHandler = new handlers.DnsRecordHandler(this);
     this.acmeConfigHandler = new handlers.AcmeConfigHandler(this);
     this.emailDomainHandler = new handlers.EmailDomainHandler(this);
+    this.smtpAccountHandler = new handlers.SmtpAccountHandler(this);
     this.gatewayClientHandler = new handlers.GatewayClientHandler(this);
     this.webPushControlHandler = new handlers.WebPushControlHandler(this);
     this.webPushAppHandler = new handlers.WebPushAppHandler(this);