ysk-server-core 1.0.0

package/dist/email/deliverability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliverability.js","sourceRoot":"","sources":["../../src/email/deliverability.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,EAAE,EAA0B,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAwB,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAmB,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AA6CnD,SAAS,YAAY,CACnB,EAAyB,EACzB,KAAa,EACb,KAA6C,EAC7C,KAAkC,EAClC,OAAgB;IAEhB,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;IACpB,IAAI,KAAK,GAAgC,SAAS,CAAC;IACnD,IAAI,EAAE,KAAK,IAAI;QAAE,KAAK,GAAG,OAAO,CAAC;SAC5B,IAAI,EAAE,KAAK,KAAK;QAAE,KAAK,GAAG,KAAK,KAAK,cAAc,IAAI,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;;QACxG,KAAK,GAAG,MAAM,CAAC;IACpB,OAAO;QACL,EAAE;QACF,KAAK;QACL,EAAE;QACF,KAAK;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK;QACL,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAY/C;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,MAAM,YAAY,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,QAAQ,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAEvC,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC;QACpC,MAAM;QACN,QAAQ;QACR,YAAY;QACZ,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,kBAAkB,CAAC;QACvC,MAAM;QACN,YAAY;QACZ,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QAClB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI;QACnC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE;QACrD,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;KAC5B,CAAC,CAAC;IAEH,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC/C,eAAe,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,eAAe,GAAG,KAAK,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC;QAC7B,MAAM;QACN,QAAQ;QACR,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,KAAK;KAClD,CAAC,CAAC;IAEH,MAAM,KAAK,GAAyB;QAClC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAC1F,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC;QAC9F,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC;QAClG,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC;QACtG,YAAY,CACV,KAAK,EACL,EAAE,CAAC,iBAAiB,CAAC,EACrB,IAAI,CAAC,GAAG,EACR,cAAc,EACd,EAAE,CAAC,oBAAoB,CAAC,CACzB;QACD,YAAY,CACV,QAAQ,EACR,EAAE,CAAC,oBAAoB,CAAC,EACxB,IAAI,CAAC,MAAM,EACX,cAAc,EACd,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,uBAAuB,CAAC,CACzD;QACD,YAAY,CACV,OAAO,EACP,EAAE,CAAC,mBAAmB,CAAC,EACvB,IAAI,CAAC,KAAK,EACV,UAAU,EACV,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,CACvD;QACD;YACE,EAAE,EAAE,OAAO;YACX,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC;YAC9B,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe;YACpD,KAAK,EACH,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI;gBACrB,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,eAAe;oBACf,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,MAAM;YACd,MAAM,EACJ,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI;gBACrB,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC;gBACjC,CAAC,CAAC,eAAe;oBACf,CAAC,CAAC,EAAE,CAAC,0BAA0B,CAAC;oBAChC,CAAC,CAAC,EAAE,CAAC,0BAA0B,CAAC;YACtC,KAAK,EAAE,UAAU;YACjB,OAAO,EAAE,EAAE,CAAC,sBAAsB,CAAC;SACpC;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC;YAC/B,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,EAAE,CAAC,0BAA0B,EAAE;gBACrC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;gBAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,iBAAiB,IAAI,GAAG;aACjD,CAAC;YACF,KAAK,EAAE,UAAU;YACjB,OAAO,EAAE,EAAE,CAAC,uBAAuB,CAAC;SACrC;KACF,CAAC;IAEF,MAAM,OAAO,GAAG;QACd,EAAE,CAAC,sBAAsB,CAAC;QAC1B,EAAE,CAAC,sBAAsB,CAAC;QAC1B,EAAE,CAAC,sBAAsB,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,KAAK;YACtB,CAAC,CAAC,EAAE,CAAC,gCAAgC,CAAC;YACtC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC;KACpC,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,EAAE,KAAK,KAAK;QACd,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAC3E,CAAC;IACF,MAAM,UAAU,GACd,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,IAAI,CAAC,EAAE,CAAC,EAAE;QACV,IAAI,CAAC,GAAG,CAAC,EAAE;QACX,IAAI,CAAC,IAAI,CAAC,EAAE;QACZ,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IAEhB,OAAO;QACL,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,MAAM;QACN,QAAQ;QACR,YAAY;QACZ,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;QACxB,OAAO;QACP,KAAK;QACL,aAAa;QACb,MAAM;QACN,IAAI;QACJ,eAAe;QACf,UAAU;QACV,kBAAkB,EAAE,KAAK;KAC1B,CAAC;AACJ,CAAC"}

package/dist/email/dns-records.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Professional Email Server — DNS record generation + external checklist + health scoring.
+ */
+import type { EmailDnsRecord, EmailExternalTodo, EmailHealthReport } from 'ysk-server-shared';
+export interface EmailDomainInput {
+    domain: string;
+    serverIp: string;
+    /** Optional public IPv6 for mail AAAA + SPF ip6: */
+    serverIpv6?: string;
+    mailHostname?: string;
+    dkimPublicKey: string;
+    dmarcPolicy?: 'none' | 'quarantine' | 'reject';
+    dmarcRua?: string;
+    selector?: string;
+}
+/**
+ * Generate the full set of DNS records the user must add at their DNS provider.
+ */
+export declare function generateEmailDnsRecords(input: EmailDomainInput): EmailDnsRecord[];
+/**
+ * Build external todo list (PTR, Port 25, DNS, reputation) — items user must handle outside server.
+ * Shared by email domain health + optional DNS panel checklist (scope=web|mail|full).
+ */
+export declare function buildExternalTodos(input: {
+    domain: string;
+    mailHostname: string;
+    ptrOk?: boolean;
+    port25Open?: boolean | null;
+    dnsApplied?: boolean;
+    dmarcPresent?: boolean;
+    /** mail (default) | web | full */
+    scope?: 'mail' | 'web' | 'full';
+}): EmailExternalTodo[];
+/**
+ * Compute email setup health score (0-100) from checks.
+ */
+export declare function scoreEmailHealth(input: {
+    domain: string;
+    serverIp: string;
+    serverIpv6?: string;
+    dkimPublicKey: string;
+    mailHostname?: string;
+    ptrOk?: boolean;
+    port25Open?: boolean | null;
+    dnsApplied?: boolean;
+    dmarcPresent?: boolean;
+    dmarcPolicy?: 'none' | 'quarantine' | 'reject';
+}): EmailHealthReport;
+/**
+ * Plan local Postfix/Dovecot/OpenDKIM install commands (not executed in unit tests).
+ */
+export declare function planEmailStackInstall(domain: string): {
+    packages: string[];
+    commands: string[];
+    ports: number[];
+    notes: string[];
+};
+/**
+ * Plan a test-send (does not actually send in unit tests / non-root envs).
+ */
+export declare function planTestSend(input: {
+    from: string;
+    to: string;
+    subject?: string;
+}): {
+    command: string;
+    notes: string[];
+    analysisHints: string[];
+};
+//# sourceMappingURL=dns-records.d.ts.map

package/dist/email/dns-records.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns-records.d.ts","sourceRoot":"","sources":["../../src/email/dns-records.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAG9F,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,gBAAgB,GAAG,cAAc,EAAE,CA6DjF;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,kCAAkC;IAClC,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;CACjC,GAAG,iBAAiB,EAAE,CAmEtB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,QAAQ,CAAC;CAChD,GAAG,iBAAiB,CA2DpB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAYA;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,EAAE,MAAM,EAAE,CAAA;CAAE,CAchE"}

package/dist/email/dns-records.js

@@ -0,0 +1,249 @@
+/**
+ * Professional Email Server — DNS record generation + external checklist + health scoring.
+ */
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+/**
+ * Generate the full set of DNS records the user must add at their DNS provider.
+ */
+export function generateEmailDnsRecords(input) {
+    assertDomain(input.domain);
+    if (!input.serverIp) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.needServerIp'), { httpStatus: 400 });
+    }
+    if (!input.dkimPublicKey) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1413'), { httpStatus: 400 });
+    }
+    const mailHost = input.mailHostname ?? `mail.${input.domain}`;
+    const selector = input.selector ?? 'default';
+    const dmarcPolicy = input.dmarcPolicy ?? 'none';
+    const rua = input.dmarcRua ?? `mailto:dmarc@${input.domain}`;
+    const v6 = input.serverIpv6?.trim();
+    const spf = v6
+        ? `v=spf1 mx a ip4:${input.serverIp} ip6:${v6} ~all`
+        : `v=spf1 mx a ip4:${input.serverIp} ~all`;
+    const dkim = `v=DKIM1; k=rsa; p=${input.dkimPublicKey.replace(/\s+/g, '')}`;
+    const dmarc = `v=DMARC1; p=${dmarcPolicy}; rua=${rua}; fo=1`;
+    const records = [
+        {
+            type: 'A',
+            name: mailHost.replace(`.${input.domain}`, '') === mailHost ? mailHost : 'mail',
+            value: input.serverIp,
+            importance: 'required',
+            description: tl('notes.auto.n1505')
+        },
+        {
+            type: 'MX',
+            name: '@',
+            value: mailHost,
+            priority: 10,
+            importance: 'required',
+            description: tl('notes.auto.n0131')
+        },
+        {
+            type: 'TXT',
+            name: '@',
+            value: spf,
+            importance: 'required',
+            description: tl('notes.auto.n0183')
+        },
+        {
+            type: 'TXT',
+            name: `${selector}._domainkey`,
+            value: dkim,
+            importance: 'required',
+            description: tl('notes.auto.n0096')
+        },
+        {
+            type: 'TXT',
+            name: '_dmarc',
+            value: dmarc,
+            importance: 'recommended',
+            description: tl('notes.auto.n0097')
+        },
+    ];
+    if (v6) {
+        records.splice(1, 0, {
+            type: 'AAAA',
+            name: mailHost.replace(`.${input.domain}`, '') === mailHost ? mailHost : 'mail',
+            value: v6,
+            importance: 'recommended',
+            description: tl('notes.auto.n1506')
+        });
+    }
+    return records;
+}
+/**
+ * Build external todo list (PTR, Port 25, DNS, reputation) — items user must handle outside server.
+ * Shared by email domain health + optional DNS panel checklist (scope=web|mail|full).
+ */
+export function buildExternalTodos(input) {
+    const scope = input.scope ?? 'mail';
+    const todos = [];
+    if (scope === 'web' || scope === 'full') {
+        todos.push({
+            id: 'dns-a-www',
+            category: 'dns',
+            title: tl('notes.auto.n0902'),
+            description: tl('notes.auto.t0077', { v0: (input.domain), v1: (input.domain) }),
+            required: true,
+            completed: Boolean(input.dnsApplied)
+        }, {
+            id: 'dns-ssl-http01',
+            category: 'dns',
+            title: tl('notes.auto.n1288'),
+            description: tl('notes.auto.n0128'),
+            required: true,
+            completed: false
+        });
+    }
+    if (scope === 'mail' || scope === 'full') {
+        todos.push({
+            id: 'dns-mx-spf-dkim',
+            category: 'dns',
+            title: tl('notes.auto.n0904'),
+            description: tl('notes.auto.n0907'),
+            required: true,
+            completed: Boolean(input.dnsApplied)
+        }, {
+            id: 'dns-dmarc',
+            category: 'dns',
+            title: tl('notes.auto.n0903'),
+            description: tl('notes.auto.n0905'),
+            required: false,
+            completed: Boolean(input.dmarcPresent)
+        }, {
+            id: 'ptr',
+            category: 'ptr',
+            title: tl('notes.auto.n1366'),
+            description: tl('notes.auto.t0078', { v0: (input.mailHostname) }),
+            required: true,
+            completed: Boolean(input.ptrOk)
+        }, {
+            id: 'port25',
+            category: 'port25',
+            title: tl('notes.auto.n1290'),
+            description: tl('notes.auto.n1374'),
+            required: true,
+            completed: input.port25Open === true
+        }, {
+            id: 'reputation',
+            category: 'reputation',
+            title: tl('notes.auto.n1265'),
+            description: tl('notes.auto.n0901'),
+            required: false,
+            completed: false
+        });
+    }
+    return todos;
+}
+/**
+ * Compute email setup health score (0-100) from checks.
+ */
+export function scoreEmailHealth(input) {
+    const mailHostname = input.mailHostname ?? `mail.${input.domain}`;
+    const records = generateEmailDnsRecords({
+        domain: input.domain,
+        serverIp: input.serverIp,
+        serverIpv6: input.serverIpv6,
+        mailHostname,
+        dkimPublicKey: input.dkimPublicKey,
+        dmarcPolicy: input.dmarcPolicy
+    });
+    const externalTodos = buildExternalTodos({
+        domain: input.domain,
+        mailHostname,
+        ptrOk: input.ptrOk,
+        port25Open: input.port25Open,
+        dnsApplied: input.dnsApplied,
+        dmarcPresent: input.dmarcPresent
+    });
+    let score = 0;
+    const maxScore = 100;
+    const messages = [];
+    // DNS base 40
+    if (input.dnsApplied) {
+        score += 40;
+    }
+    else {
+        messages.push(tl('email.health.dnsUnconfirmed'));
+    }
+    // DMARC 15
+    if (input.dmarcPresent) {
+        score += 15;
+    }
+    else {
+        messages.push(tl('email.health.dmarcMissing'));
+    }
+    // PTR 25
+    if (input.ptrOk) {
+        score += 25;
+    }
+    else {
+        messages.push(tl('email.health.ptrBad'));
+    }
+    // Port 25 15
+    if (input.port25Open === true) {
+        score += 15;
+    }
+    else if (input.port25Open === false) {
+        messages.push(tl('email.health.port25Blocked'));
+    }
+    else {
+        messages.push(tl('email.health.port25Unknown'));
+        score += 5;
+    }
+    // Warm-up awareness 5 (always partial credit for showing checklist)
+    score += 5;
+    return {
+        score: Math.min(score, maxScore),
+        maxScore,
+        records,
+        externalTodos,
+        ptrOk: Boolean(input.ptrOk),
+        port25Open: input.port25Open ?? null,
+        messages
+    };
+}
+/**
+ * Plan local Postfix/Dovecot/OpenDKIM install commands (not executed in unit tests).
+ */
+export function planEmailStackInstall(domain) {
+    assertDomain(domain);
+    return {
+        packages: ['postfix', 'dovecot-core', 'dovecot-imapd', 'opendkim', 'opendkim-tools', 'rspamd'],
+        commands: [
+            'DEBIAN_FRONTEND=noninteractive apt-get install -y postfix dovecot-core dovecot-imapd opendkim opendkim-tools rspamd',
+            `postconf -e "myhostname = mail.${domain}"`,
+            `postconf -e "myorigin = ${domain}"`,
+            'postconf -e "smtpd_tls_security_level = may"',
+        ],
+        ports: [25, 465, 587, 993, 995],
+        notes: [tl('email.stack.tlsNote'), tl('email.stack.externalNote')]
+    };
+}
+/**
+ * Plan a test-send (does not actually send in unit tests / non-root envs).
+ */
+export function planTestSend(input) {
+    if (!input.from || !input.to) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1054'), {
+            httpStatus: 400
+        });
+    }
+    const subject = input.subject ?? tl('email.test.defaultSubject');
+    return {
+        command: `printf 'Subject: ${subject}\\n\\nYSK Server deliverability test\\n' | sendmail -f ${input.from} ${input.to}`,
+        notes: [tl('email.test.needMta'), tl('email.test.checkSpam')],
+        analysisHints: [
+            tl('email.test.hintDeferred'),
+            tl('email.test.hintSpam'),
+            tl('email.test.hintLogs'),
+        ]
+    };
+}
+function assertDomain(domain) {
+    if (!domain || !/^[a-z0-9.-]+\.[a-z]{2,}$/i.test(domain)) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.tpl.domainInvalid', { domain: domain }), { httpStatus: 400 });
+    }
+}
+//# sourceMappingURL=dns-records.js.map

package/dist/email/dns-records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns-records.js","sourceRoot":"","sources":["../../src/email/dns-records.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAC,MAAM,mBAAmB,CAAC;AAc5D;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAuB;IAC7D,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,oBAAoB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,IAAI,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;IAC9D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC;IAC7C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC;IAChD,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,gBAAgB,KAAK,CAAC,MAAM,EAAE,CAAC;IAC7D,MAAM,EAAE,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,EAAE;QACZ,CAAC,CAAC,mBAAmB,KAAK,CAAC,QAAQ,QAAQ,EAAE,OAAO;QACpD,CAAC,CAAC,mBAAmB,KAAK,CAAC,QAAQ,OAAO,CAAC;IAC7C,MAAM,IAAI,GAAG,qBAAqB,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;IAC5E,MAAM,KAAK,GAAG,eAAe,WAAW,SAAS,GAAG,QAAQ,CAAC;IAE7D,MAAM,OAAO,GAAqB;QAChC;YACE,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;YAC/E,KAAK,EAAE,KAAK,CAAC,QAAQ;YACrB,UAAU,EAAE,UAAU;YACtB,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC;SAAE;QACvC;YACE,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,GAAG;YACT,KAAK,EAAE,QAAQ;YACf,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,UAAU;YACtB,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC;SAAE;QACvC;YACE,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,GAAG;YACT,KAAK,EAAE,GAAG;YACV,UAAU,EAAE,UAAU;YACtB,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC;SAAE;QACvC;YACE,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,GAAG,QAAQ,aAAa;YAC9B,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,UAAU;YACtB,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC;SAAE;QACvC;YACE,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,KAAK;YACZ,UAAU,EAAE,aAAa;YACzB,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC;SAAE;KACxC,CAAC;IACF,IAAI,EAAE,EAAE,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE;YACnB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;YAC/E,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,aAAa;YACzB,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC;SAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KASlC;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC;IACpC,MAAM,KAAK,GAAwB,EAAE,CAAC;IAEtC,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CACR;YACE,EAAE,EAAE,WAAW;YACf,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC7B,WAAW,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/E,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;SAAE,EACxC;YACE,EAAE,EAAE,gBAAgB;YACpB,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC7B,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC;YACnC,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,KAAK;SAAE,CACrB,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CACR;YACE,EAAE,EAAE,iBAAiB;YACrB,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC7B,WAAW,EACT,EAAE,CAAC,kBAAkB,CAAC;YACxB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;SAAE,EACxC;YACE,EAAE,EAAE,WAAW;YACf,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC7B,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC;YACnC,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;SAAE,EAC1C;YACE,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC7B,WAAW,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YACjE,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;SAAE,EACnC;YACE,EAAE,EAAE,QAAQ;YACZ,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC7B,WAAW,EACT,EAAE,CAAC,kBAAkB,CAAC;YACxB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,KAAK,CAAC,UAAU,KAAK,IAAI;SAAE,EACxC;YACE,EAAE,EAAE,YAAY;YAChB,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC7B,WAAW,EACT,EAAE,CAAC,kBAAkB,CAAC;YACxB,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,KAAK;SAAE,CACrB,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAWhC;IACC,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,uBAAuB,CAAC;QACtC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY;QACZ,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;KAAE,CAAC,CAAC;IACpC,MAAM,aAAa,GAAG,kBAAkB,CAAC;QACvC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;KAAE,CAAC,CAAC;IAEtC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,QAAQ,GAAG,GAAG,CAAC;IACrB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,cAAc;IACd,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,WAAW;IACX,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,SAAS;IACT,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,aAAa;IACb,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC9B,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;SAAM,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,CAAC;QAChD,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,oEAAoE;IACpE,KAAK,IAAI,CAAC,CAAC;IAEX,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC;QAChC,QAAQ;QACR,OAAO;QACP,aAAa;QACb,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAC3B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,QAAQ;KAAE,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAMlD,YAAY,CAAC,MAAM,CAAC,CAAC;IACrB,OAAO;QACL,QAAQ,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,eAAe,EAAE,UAAU,EAAE,gBAAgB,EAAE,QAAQ,CAAC;QAC9F,QAAQ,EAAE;YACR,qHAAqH;YACrH,kCAAkC,MAAM,GAAG;YAC3C,2BAA2B,MAAM,GAAG;YACpC,8CAA8C;SAC/C;QACD,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;QAC/B,KAAK,EAAE,CAAC,EAAE,CAAC,qBAAqB,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,CAAC;KAAE,CAAC;AACzE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,KAI5B;IACC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAAE,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,2BAA2B,CAAC,CAAC;IACjE,OAAO;QACL,OAAO,EAAE,oBAAoB,OAAO,0DAA0D,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,EAAE;QACtH,KAAK,EAAE,CAAC,EAAE,CAAC,oBAAoB,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC;QAC7D,aAAa,EAAE;YACb,EAAE,CAAC,yBAAyB,CAAC;YAC7B,EAAE,CAAC,qBAAqB,CAAC;YACzB,EAAE,CAAC,qBAAqB,CAAC;SAC1B;KAAE,CAAC;AACR,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACpH,CAAC;AACH,CAAC"}

package/dist/email/dnsbl.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Multi-list DNSBL (blacklist) checks for outbound mail IP reputation (Spec §5.4 D).
+ */
+import { resolve4 } from 'node:dns/promises';
+export interface DnsblListResult {
+    list: string;
+    listed: boolean;
+    detail: string;
+    query: string;
+}
+export interface DnsblReport {
+    ok: boolean;
+    ip: string;
+    listedOn: string[];
+    cleanOn: string[];
+    results: DnsblListResult[];
+    notes: string[];
+}
+/** Common public DNSBL zones used for outbound IP reputation. */
+export declare const DEFAULT_DNSBL_ZONES: readonly ["zen.spamhaus.org", "bl.spamcop.net", "b.barracudacentral.org", "dnsbl.sorbs.net", "psbl.surriel.com", "ubl.unsubscore.com"];
+/**
+ * Reverse IPv4 for DNSBL query (e.g. 1.2.3.4 → 4.3.2.1).
+ * @deprecated prefer reverseDnsblName (dual-stack)
+ */
+export declare function reverseIpv4(ip: string): string | null;
+/**
+ * Check a single DNSBL zone. A successful A record usually means listed
+ * (or policy response). NXDOMAIN / errors → treat as not listed.
+ * IPv6 uses nibble reverse (RFC 5782); some lists may not support IPv6.
+ */
+export declare function checkDnsblZone(ip: string, zone: string, resolve?: typeof resolve4): Promise<DnsblListResult>;
+/**
+ * Run multi-list DNSBL checks for an IP (IPv4 or IPv6).
+ */
+export declare function checkIpDnsbl(ip: string, zones?: readonly string[], resolve?: typeof resolve4): Promise<DnsblReport>;
+/**
+ * Check multiple IPs against DNSBL zones (RBL depth for multi-homed hosts).
+ */
+export declare function checkMultipleIpsDnsbl(ips: string[], zones?: readonly string[], resolve?: typeof resolve4): Promise<{
+    ok: boolean;
+    reports: DnsblReport[];
+    listedIps: string[];
+    notes: string[];
+}>;
+//# sourceMappingURL=dnsbl.d.ts.map

package/dist/email/dnsbl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dnsbl.d.ts","sourceRoot":"","sources":["../../src/email/dnsbl.ts"],"names":[],"mappings":"AACA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAG7C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,wIAOtB,CAAC;AAEX;;;GAGG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIrD;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,OAAO,QAAmB,GAClC,OAAO,CAAC,eAAe,CAAC,CAyC1B;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,MAAM,EACV,KAAK,GAAE,SAAS,MAAM,EAAwB,EAC9C,OAAO,GAAE,OAAO,QAAmB,GAClC,OAAO,CAAC,WAAW,CAAC,CA6BtB;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,EAAE,EACb,KAAK,GAAE,SAAS,MAAM,EAAwB,EAC9C,OAAO,GAAE,OAAO,QAAmB,GAClC,OAAO,CAAC;IACT,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC,CAkBD"}

package/dist/email/dnsbl.js

@@ -0,0 +1,127 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * Multi-list DNSBL (blacklist) checks for outbound mail IP reputation (Spec §5.4 D).
+ */
+import { resolve4 } from 'node:dns/promises';
+import { ipFamily, normalizeIp, reverseDnsblName } from '../net/ip.js';
+/** Common public DNSBL zones used for outbound IP reputation. */
+export const DEFAULT_DNSBL_ZONES = [
+    'zen.spamhaus.org',
+    'bl.spamcop.net',
+    'b.barracudacentral.org',
+    'dnsbl.sorbs.net',
+    'psbl.surriel.com',
+    'ubl.unsubscore.com',
+];
+/**
+ * Reverse IPv4 for DNSBL query (e.g. 1.2.3.4 → 4.3.2.1).
+ * @deprecated prefer reverseDnsblName (dual-stack)
+ */
+export function reverseIpv4(ip) {
+    const n = normalizeIp(ip);
+    if (!n || ipFamily(n) !== 4)
+        return null;
+    return reverseDnsblName(n);
+}
+/**
+ * Check a single DNSBL zone. A successful A record usually means listed
+ * (or policy response). NXDOMAIN / errors → treat as not listed.
+ * IPv6 uses nibble reverse (RFC 5782); some lists may not support IPv6.
+ */
+export async function checkDnsblZone(ip, zone, resolve = resolve4) {
+    const n = normalizeIp(ip);
+    const rev = n ? reverseDnsblName(n) : null;
+    if (!rev) {
+        return {
+            list: zone,
+            listed: false,
+            detail: 'invalid IPv4／IPv6',
+            query: '',
+        };
+    }
+    const fam = n ? ipFamily(n) : 0;
+    const query = `${rev}.${zone}`;
+    try {
+        const addrs = await resolve(query);
+        return {
+            list: zone,
+            listed: true,
+            detail: `LISTED (A ${addrs.join(', ')})${fam === 6 ? ' · IPv6' : ''}`,
+            query,
+        };
+    }
+    catch (e) {
+        const code = e.code;
+        if (code === 'ENOTFOUND' || code === 'ENODATA') {
+            return {
+                list: zone,
+                listed: false,
+                detail: fam === 6
+                    ? 'not listed (or list may not support IPv6)'
+                    : 'not listed',
+                query,
+            };
+        }
+        return {
+            list: zone,
+            listed: false,
+            detail: `query error: ${e instanceof Error ? e.message : String(e)}`,
+            query,
+        };
+    }
+}
+/**
+ * Run multi-list DNSBL checks for an IP (IPv4 or IPv6).
+ */
+export async function checkIpDnsbl(ip, zones = DEFAULT_DNSBL_ZONES, resolve = resolve4) {
+    const n = normalizeIp(ip) ?? ip.trim();
+    const results = [];
+    for (const zone of zones) {
+        results.push(await checkDnsblZone(n, zone, resolve));
+    }
+    const listedOn = results.filter((r) => r.listed).map((r) => r.list);
+    const cleanOn = results.filter((r) => !r.listed).map((r) => r.list);
+    const fam = ipFamily(n);
+    const notes = listedOn.length > 0
+        ? [
+            `IP ${n} appears listed on: ${listedOn.join(', ')}`,
+            'Request delisting at the DNSBL operator; avoid bulk mail until clean',
+        ]
+        : [
+            `IP ${n} not listed on ${zones.length} checked DNSBLs`,
+            ...(fam === 6
+                ? [tl('notes.auto.n1489')]
+                : []),
+        ];
+    return {
+        ok: listedOn.length === 0,
+        ip: n,
+        listedOn,
+        cleanOn,
+        results,
+        notes,
+    };
+}
+/**
+ * Check multiple IPs against DNSBL zones (RBL depth for multi-homed hosts).
+ */
+export async function checkMultipleIpsDnsbl(ips, zones = DEFAULT_DNSBL_ZONES, resolve = resolve4) {
+    const unique = [...new Set(ips.map((i) => i.trim()).filter(Boolean))].slice(0, 10);
+    const reports = [];
+    for (const ip of unique) {
+        reports.push(await checkIpDnsbl(ip, zones, resolve));
+    }
+    const listedIps = reports.filter((r) => !r.ok).map((r) => r.ip);
+    return {
+        ok: listedIps.length === 0,
+        reports,
+        listedIps,
+        notes: [
+            `Checked ${unique.length} IP(s) × ${zones.length} lists`,
+            listedIps.length
+                ? `Listed: ${listedIps.join(', ')}`
+                : 'All checked IPs clean on configured lists',
+        ],
+    };
+}
+//# sourceMappingURL=dnsbl.js.map

package/dist/email/dnsbl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dnsbl.js","sourceRoot":"","sources":["../../src/email/dnsbl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAkBvE,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,kBAAkB;IAClB,gBAAgB;IAChB,wBAAwB;IACxB,iBAAiB;IACjB,kBAAkB;IAClB,oBAAoB;CACZ,CAAC;AAEX;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAU,EACV,IAAY,EACZ,UAA2B,QAAQ;IAEnC,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,mBAAmB;YAC3B,KAAK,EAAE,EAAE;SACV,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,aAAa,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;YACrE,KAAK;SACN,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,GAAI,CAAuB,CAAC,IAAI,CAAC;QAC3C,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/C,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,KAAK;gBACb,MAAM,EACJ,GAAG,KAAK,CAAC;oBACP,CAAC,CAAC,2CAA2C;oBAC7C,CAAC,CAAC,YAAY;gBAClB,KAAK;aACN,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,gBAAgB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YACpE,KAAK;SACN,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAU,EACV,QAA2B,mBAAmB,EAC9C,UAA2B,QAAQ;IAEnC,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,MAAM,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,KAAK,GACT,QAAQ,CAAC,MAAM,GAAG,CAAC;QACjB,CAAC,CAAC;YACE,MAAM,CAAC,uBAAuB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACnD,sEAAsE;SACvE;QACH,CAAC,CAAC;YACE,MAAM,CAAC,kBAAkB,KAAK,CAAC,MAAM,iBAAiB;YACtD,GAAG,CAAC,GAAG,KAAK,CAAC;gBACX,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;gBAC1B,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACR,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACzB,EAAE,EAAE,CAAC;QACL,QAAQ;QACR,OAAO;QACP,OAAO;QACP,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAa,EACb,QAA2B,mBAAmB,EAC9C,UAA2B,QAAQ;IAOnC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnF,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChE,OAAO;QACL,EAAE,EAAE,SAAS,CAAC,MAAM,KAAK,CAAC;QAC1B,OAAO;QACP,SAAS;QACT,KAAK,EAAE;YACL,WAAW,MAAM,CAAC,MAAM,YAAY,KAAK,CAAC,MAAM,QAAQ;YACxD,SAAS,CAAC,MAAM;gBACd,CAAC,CAAC,WAAW,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACnC,CAAC,CAAC,2CAA2C;SAChD;KACF,CAAC;AACJ,CAAC"}

package/dist/email/domain-flags-apply.d.ts

@@ -0,0 +1,78 @@
+import type { HostExecutor } from '../host/executor.js';
+export type DomainFlagsApplyResult = {
+    ok: boolean;
+    blocked?: boolean;
+    blockMessage?: string;
+    apply_status: 'written' | 'applied' | 'partial' | 'blocked';
+    notes: string[];
+    written: string[];
+    commandResults: Array<{
+        argv: string[];
+        exitCode: number;
+        stderr: string;
+    }>;
+};
+/**
+ * Rebuild aggregate suspend map from all domain SUSPENDED.flag files.
+ */
+export declare function rebuildSuspendDomainMap(dataDir: string): {
+    path: string;
+    domains: string[];
+    notes: string[];
+};
+/**
+ * Write per-mailbox vacation sieve copies under dataDir (from domain vacation.sieve).
+ */
+export declare function writeMailboxVacationCopies(input: {
+    dataDir: string;
+    domain: string;
+    mailboxes: string[];
+    enabled: boolean;
+}): {
+    written: string[];
+    notes: string[];
+};
+/**
+ * Install suspend map into Postfix + postmap + ensure recipient restriction + reload.
+ */
+export declare function applySuspendMapToPostfix(input: {
+    host: HostExecutor;
+    mapPath: string;
+}): Promise<{
+    ok: boolean;
+    notes: string[];
+    commandResults: DomainFlagsApplyResult['commandResults'];
+}>;
+/**
+ * Deploy vacation sieve to system vmail paths when present.
+ * Looks for /var/vmail, /var/mail/vhosts, or dataDir maildir parents.
+ */
+export declare function applyVacationSieveToSystem(input: {
+    host: HostExecutor;
+    dataDir: string;
+    domain: string;
+    mailboxes: string[];
+    enabled: boolean;
+}): Promise<{
+    ok: boolean;
+    notes: string[];
+    written: string[];
+    commandResults: DomainFlagsApplyResult['commandResults'];
+}>;
+/**
+ * Full system apply for suspend map + vacation, after control-plane files exist.
+ */
+export declare function applyDomainFlagsToSystem(input: {
+    host: HostExecutor;
+    dataDir: string;
+    domain: string;
+    mailboxes: string[];
+    /** Whether suspend was just toggled or domain is suspended */
+    suspended: boolean;
+    /** Whether vacation should be active */
+    vacationEnabled: boolean;
+    /** Which parts to apply */
+    applySuspend?: boolean;
+    applyVacation?: boolean;
+}): Promise<DomainFlagsApplyResult>;
+//# sourceMappingURL=domain-flags-apply.d.ts.map

package/dist/email/domain-flags-apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-flags-apply.d.ts","sourceRoot":"","sources":["../../src/email/domain-flags-apply.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IAC5D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7E,CAAC;AAEF;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CA6BA;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;CAClB,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAyBzC;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,cAAc,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;CAC1D,CAAC,CA4DD;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;CAC1D,CAAC,CAkGD;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,8DAA8D;IAC9D,SAAS,EAAE,OAAO,CAAC;IACnB,wCAAwC;IACxC,eAAe,EAAE,OAAO,CAAC;IACzB,2BAA2B;IAC3B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAmFlC"}