@serve.zone/dcrouter 18.1.1 → 18.2.0

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/dcrouter',
-    version: '18.1.1',
+    version: '18.2.0',
     description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxzQkFBc0I7SUFDNUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLDBFQUEwRTtDQUN4RixDQUFBIn0=

package/dist_ts/classes.dcrouter.d.ts

@@ -21,6 +21,24 @@ import { AcceptedEmailSpool, EmailDomainManager, EmailRouteBuilder, EmailSetting
 import { WebPushManager } from './webpush/index.js';
 import type { IEmailOutboundEgressStatus, IEmailPortConfig, IEmailServerSettings, TEmailOutboundMode, TEmailServerSettingsUpdate } from '../dist_ts_interfaces/data/email-settings.js';
 import type { IDcRouterRouteConfig, IRemoteIngressHubSettings, TRemoteIngressHubSettingsUpdate } from '../dist_ts_interfaces/data/remoteingress.js';
+/**
+ * dcrouter's superset of SmartMTA's SMTP TLS options.
+ *
+ * SmartMTA consumes PEM content (`certPem`/`keyPem`). Deployments configure
+ * certificate FILES, so dcrouter accepts the path form too and loads it eagerly
+ * at startup — a path that cannot be read fails startup rather than silently
+ * leaving the listener without TLS.
+ */
+export interface IDcRouterEmailTlsConfig extends NonNullable<IUnifiedEmailServerOptions['tls']> {
+    /** Path to the certificate chain PEM file. Requires keyPath. */
+    certPath?: string;
+    /** Path to the private key PEM file. Requires certPath. */
+    keyPath?: string;
+}
+/** dcrouter's email server options: SmartMTA's, with the path-shaped tls block. */
+export type IDcRouterEmailConfig = Omit<IUnifiedEmailServerOptions, 'tls'> & {
+    tls?: IDcRouterEmailTlsConfig;
+};
 export interface IDcRouterOptions {
     /** Base directory for all dcrouter data. Defaults to ~/.serve.zone/dcrouter */
     baseDir?: string;
@@ -35,7 +53,7 @@ export interface IDcRouterOptions {
      * Email server configuration
      * This enables all email handling with pattern-based routing
      */
-    emailConfig?: IUnifiedEmailServerOptions;
+    emailConfig?: IDcRouterEmailConfig;
     /** SmartBucket configuration for durable SmartMTA queue and attachment blobs. */
     emailBlobStorage?: ISmartMtaBlobStorageConfig;
     /** Outbound SMTP connection mode. Defaults to direct unless DB settings override it. */
@@ -342,6 +360,47 @@ export declare class DcRouter {
      * This implements the consolidated emailConfig approach
      */
     private setupUnifiedEmailHandling;
+    /**
+     * Resolve the PEM material for the SMTP listener.
+     *
+     * SmartMTA consumes `tls.certPem`/`tls.keyPem`; a path-shaped `tls` block is
+     * ignored, which leaves the Rust listener with no TLS material at all — no
+     * STARTTLS on the plain submission ports. Resolution order matches the
+     * RemoteIngress tunnel precedent: explicit paths, then the ACME cert store.
+     *
+     * Explicitly configured paths that cannot be read FAIL STARTUP. Silently
+     * continuing without TLS is what produced a cleartext submission port in
+     * production, so a broken explicit configuration must be impossible to miss.
+     */
+    private resolveEmailTlsMaterial;
+    /**
+     * Push renewed TLS material to the running SMTP listener.
+     *
+     * Only reacts to the mail hostname, and only when explicit paths are NOT
+     * configured — an operator-managed file pair is not superseded by an ACME
+     * renewal for the same name. SmartMTA restarts just the Rust listener when
+     * the PEM material actually changes.
+     */
+    private reapplyEmailTlsMaterial;
+    /**
+     * Internal SMTP ports whose public leg is TLS-terminated by CoreTraffic.
+     *
+     * Those backend legs arrive as plaintext even though the client's channel was
+     * encrypted, so without declaring them the AUTH-requires-encryption gate would
+     * refuse authentication on the only encrypted submission port. Derived from
+     * the generated route set rather than hardcoding 465, so it stays true when
+     * emailPortConfig changes.
+     */
+    private resolveEdgeTerminatedEmailPorts;
+    /**
+     * State the transport posture of every SMTP listener port at startup.
+     *
+     * AUTH is only offered on an encrypted transport, so an operator has to be
+     * able to see at a glance which submission ports can actually authenticate —
+     * missing certificate material silently disabling AUTH on 587 would otherwise
+     * look like a client problem.
+     */
+    private logEmailAuthTransportPosture;
     /**
      * Readiness of the RemoteIngress outbound mail egress path (mail-tagged edges).
      */