@serve.zone/dcrouter 18.1.0 → 18.2.0

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/dcrouter',
-    version: '18.1.0',
+    version: '18.2.0',
     description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxzQkFBc0I7SUFDNUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLDBFQUEwRTtDQUN4RixDQUFBIn0=

package/dist_ts/classes.dcrouter.d.ts

@@ -9,7 +9,7 @@ import { RadiusServer, type IRadiusServerConfig } from './radius/index.js';
 import { RemoteIngressHubLifecycle, RemoteIngressManager, TunnelManager } from './remoteingress/index.js';
 import { VpnAccessResolver, VpnManager } from './vpn/index.js';
 import { RouteConfigManager, ApiTokenManager, GatewayClientManager, ReferenceResolver, TargetProfileManager } from './config/index.js';
-import { SecurityPolicyManager, RoutePolicyAugmenter } from './security/index.js';
+import { SecurityPolicyManager, RoutePolicyAugmenter, AuthenticationEventManager } from './security/index.js';
 import { type IHttp3Config } from './http3/index.js';
 import { DnsManager } from './dns/manager.dns.js';
 import { DnsAuthorityManager } from './dns/manager.dns-authority.js';
@@ -21,6 +21,24 @@ import { AcceptedEmailSpool, EmailDomainManager, EmailRouteBuilder, EmailSetting
 import { WebPushManager } from './webpush/index.js';
 import type { IEmailOutboundEgressStatus, IEmailPortConfig, IEmailServerSettings, TEmailOutboundMode, TEmailServerSettingsUpdate } from '../dist_ts_interfaces/data/email-settings.js';
 import type { IDcRouterRouteConfig, IRemoteIngressHubSettings, TRemoteIngressHubSettingsUpdate } from '../dist_ts_interfaces/data/remoteingress.js';
+/**
+ * dcrouter's superset of SmartMTA's SMTP TLS options.
+ *
+ * SmartMTA consumes PEM content (`certPem`/`keyPem`). Deployments configure
+ * certificate FILES, so dcrouter accepts the path form too and loads it eagerly
+ * at startup — a path that cannot be read fails startup rather than silently
+ * leaving the listener without TLS.
+ */
+export interface IDcRouterEmailTlsConfig extends NonNullable<IUnifiedEmailServerOptions['tls']> {
+    /** Path to the certificate chain PEM file. Requires keyPath. */
+    certPath?: string;
+    /** Path to the private key PEM file. Requires certPath. */
+    keyPath?: string;
+}
+/** dcrouter's email server options: SmartMTA's, with the path-shaped tls block. */
+export type IDcRouterEmailConfig = Omit<IUnifiedEmailServerOptions, 'tls'> & {
+    tls?: IDcRouterEmailTlsConfig;
+};
 export interface IDcRouterOptions {
     /** Base directory for all dcrouter data. Defaults to ~/.serve.zone/dcrouter */
     baseDir?: string;
@@ -35,7 +53,7 @@ export interface IDcRouterOptions {
      * Email server configuration
      * This enables all email handling with pattern-based routing
      */
-    emailConfig?: IUnifiedEmailServerOptions;
+    emailConfig?: IDcRouterEmailConfig;
     /** SmartBucket configuration for durable SmartMTA queue and attachment blobs. */
     emailBlobStorage?: ISmartMtaBlobStorageConfig;
     /** Outbound SMTP connection mode. Defaults to direct unless DB settings override it. */
@@ -226,6 +244,7 @@ export declare class DcRouter {
     emailServer?: UnifiedEmailServer;
     radiusServer?: RadiusServer;
     opsServer: OpsServer;
+    private opsServerStopped;
     metricsManager?: MetricsManager;
     private emailEventSubscriptions;
     storageManager: IStorageManagerLike;
@@ -260,6 +279,7 @@ export declare class DcRouter {
     mailDnsSync: MailDnsSync;
     mailEdgeEligibility: MailEdgeEligibility;
     securityPolicyManager?: SecurityPolicyManager;
+    authenticationEventManager: AuthenticationEventManager;
     detectedPublicIp: string | null;
     certificateStatusMap: Map<string, {
         status: "valid" | "failed";
@@ -328,6 +348,7 @@ export declare class DcRouter {
      * Find ALL route names that match a given domain
      */
     findRouteNamesForDomain(domain: string): string[];
+    private stopOpsServer;
     stop(): Promise<void>;
     /**
      * Update SmartProxy configuration
@@ -339,6 +360,47 @@ export declare class DcRouter {
      * This implements the consolidated emailConfig approach
      */
     private setupUnifiedEmailHandling;
+    /**
+     * Resolve the PEM material for the SMTP listener.
+     *
+     * SmartMTA consumes `tls.certPem`/`tls.keyPem`; a path-shaped `tls` block is
+     * ignored, which leaves the Rust listener with no TLS material at all — no
+     * STARTTLS on the plain submission ports. Resolution order matches the
+     * RemoteIngress tunnel precedent: explicit paths, then the ACME cert store.
+     *
+     * Explicitly configured paths that cannot be read FAIL STARTUP. Silently
+     * continuing without TLS is what produced a cleartext submission port in
+     * production, so a broken explicit configuration must be impossible to miss.
+     */
+    private resolveEmailTlsMaterial;
+    /**
+     * Push renewed TLS material to the running SMTP listener.
+     *
+     * Only reacts to the mail hostname, and only when explicit paths are NOT
+     * configured — an operator-managed file pair is not superseded by an ACME
+     * renewal for the same name. SmartMTA restarts just the Rust listener when
+     * the PEM material actually changes.
+     */
+    private reapplyEmailTlsMaterial;
+    /**
+     * Internal SMTP ports whose public leg is TLS-terminated by CoreTraffic.
+     *
+     * Those backend legs arrive as plaintext even though the client's channel was
+     * encrypted, so without declaring them the AUTH-requires-encryption gate would
+     * refuse authentication on the only encrypted submission port. Derived from
+     * the generated route set rather than hardcoding 465, so it stays true when
+     * emailPortConfig changes.
+     */
+    private resolveEdgeTerminatedEmailPorts;
+    /**
+     * State the transport posture of every SMTP listener port at startup.
+     *
+     * AUTH is only offered on an encrypted transport, so an operator has to be
+     * able to see at a glance which submission ports can actually authenticate —
+     * missing certificate material silently disabling AUTH on 587 would otherwise
+     * look like a client problem.
+     */
+    private logEmailAuthTransportPosture;
     /**
      * Readiness of the RemoteIngress outbound mail egress path (mail-tagged edges).
      */