@serve.zone/dcrouter 32.6.3 → 32.7.0

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/dcrouter",
-  "version": "32.6.3",
+  "version": "32.7.0",
   "exports": "./binary/dcrouter.ts",
   "compile": {
     "include": [

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/dcrouter',
-    version: '32.6.3',
+    version: '32.7.0',
     description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxzQkFBc0I7SUFDNUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLDBFQUEwRTtDQUN4RixDQUFBIn0=

package/dist_ts/classes.dcrouter.d.ts

@@ -23,9 +23,9 @@ import { TestingAccessManager } from './testing/classes.testing-access-manager.j
 import { TestingDnsManager } from './testing/classes.testing-dns-manager.js';
 import { TestingCertificateManager } from './testing/classes.testing-certificate-manager.js';
 import { TestingOperationWorker } from './testing/classes.testing-operation-worker.js';
-import { AcceptedEmailSpool, CoreMailGatewayManager, EmailDomainManager, EmailRouteBuilder, EmailSettingsManager, GatewayMailDomainStore, MailDnsSync, MailEdgeEligibility, MailEgressCoordinator, SmartMtaBlobStorageManager, SmtpAccountManager, WorkAppMailManager, type ISmartMtaBlobStorageConfig } from './email/index.js';
+import { AcceptedEmailSpool, CoreMailGatewayManager, EmailDomainManager, EmailRouteBuilder, EmailSettingsManager, EmailTlsManager, GatewayMailDomainStore, MailDnsSync, MailEdgeEligibility, MailEgressCoordinator, SmartMtaBlobStorageManager, SmtpAccountManager, WorkAppMailManager, type ISmartMtaBlobStorageConfig } from './email/index.js';
 import { WebPushManager } from './webpush/index.js';
-import type { IEmailOutboundEgressStatus, IEmailPortConfig, IEmailServerSettings, TEmailOutboundMode, TEmailServerSettingsUpdate } from '../dist_ts_interfaces/data/email-settings.js';
+import type { IEmailOutboundEgressStatus, IEmailPortConfig, IEmailServerSettings, IEmailTlsCertificateStatus, TEmailOutboundMode, TEmailServerSettingsUpdate, TEmailTlsSource } from '../dist_ts_interfaces/data/email-settings.js';
 import type { IDcRouterRouteConfig, IRemoteIngressHubSettings, TRemoteIngressHubSettingsUpdate } from '../dist_ts_interfaces/data/remoteingress.js';
 /**
  * dcrouter's superset of SmartMTA's SMTP TLS options.
@@ -250,6 +250,8 @@ export declare class DcRouter {
     smartAcme?: plugins.smartacme.SmartAcme;
     dnsServer?: plugins.smartdns.dnsServerMod.DnsServer;
     emailServer?: UnifiedEmailServer;
+    /** Owns the SMTP listener certificate: source resolution, renewal relevance, served status. */
+    readonly emailTlsManager: EmailTlsManager;
     radiusServer?: RadiusServer;
     opsServer: OpsServer;
     private opsServerStopped;
@@ -394,26 +396,18 @@ export declare class DcRouter {
      * This implements the consolidated emailConfig approach
      */
     private setupUnifiedEmailHandling;
+    /** Effective SMTP certificate source: the DB-backed setting, or the documented default. */
+    getEmailTlsSource(): TEmailTlsSource;
+    /** The certificate the running SMTP listener serves, checked now; undefined while it is stopped. */
+    getEmailTlsCertificateStatus(): IEmailTlsCertificateStatus | undefined;
     /**
-     * Resolve the PEM material for the SMTP listener.
+     * Push an issued or renewed certificate to the running SMTP listener.
      *
-     * SmartMTA consumes `tls.certPem`/`tls.keyPem`; a path-shaped `tls` block is
-     * ignored, which leaves the Rust listener with no TLS material at all — no
-     * STARTTLS on the plain submission ports. Resolution order matches the
-     * RemoteIngress tunnel precedent: explicit paths, then the ACME cert store.
-     *
-     * Explicitly configured paths that cannot be read FAIL STARTUP. Silently
-     * continuing without TLS is what produced a cleartext submission port in
-     * production, so a broken explicit configuration must be impossible to miss.
-     */
-    private resolveEmailTlsMaterial;
-    /**
-     * Push renewed TLS material to the running SMTP listener.
-     *
-     * Only reacts to the mail hostname, and only when explicit paths are NOT
-     * configured — an operator-managed file pair is not superseded by an ACME
-     * renewal for the same name. SmartMTA restarts just the Rust listener when
-     * the PEM material actually changes.
+     * Material is resolved from the source of truth on every call and is never
+     * written back into the email configuration, so every renewal applies, not
+     * just the first one per process. Configured material is never superseded
+     * by an ACME issuance. SmartMTA restarts just the Rust listener when the PEM
+     * material actually changes.
      */
     private reapplyEmailTlsMaterial;
     /**