ysk-server-core 1.0.0

package/dist/email/email-bootstrap.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Spec §5 one-click Email Server bootstrap (guided).
+ * Combines: domain DKIM create + MTA configs + passdb + webmail plan.
+ * System package install remains dual-mode (root + YSK_EXECUTE).
+ */
+import type { HostExecutor } from '../host/executor.js';
+import type { YskDatabase } from '../db/database.js';
+import type { AuditRepository } from '../repositories/audit-repo.js';
+import { type WebmailTool } from './webmail-project.js';
+import type { ProjectService } from '../hosting/project-service.js';
+import type { ProjectOpsService } from '../hosting/project-ops.js';
+export interface EmailBootstrapResult {
+    ok: boolean;
+    domainId: string;
+    domain: string;
+    steps: Array<{
+        id: string;
+        ok: boolean;
+        detail: string;
+    }>;
+    notes: string[];
+    written: string[];
+    requiresExecute: boolean;
+    requiresRoot: boolean;
+    externalTodos: Array<{
+        id: string;
+        title: string;
+        description: string;
+    }>;
+    /** Set when webmail project path used */
+    webmailProjectId?: string;
+    webmailUrlHint?: string;
+}
+/**
+ * Bootstrap professional email stack for a domain under dataDir.
+ * Never claims external DNS/PTR/Port25 complete.
+ */
+export declare function bootstrapEmailServer(input: {
+    dataDir: string;
+    db: YskDatabase;
+    host: HostExecutor;
+    domain: string;
+    serverIp: string;
+    mailHostname?: string;
+    actor: string;
+    audit?: AuditRepository;
+    /** Attempt apt/system install of postfix stack */
+    installPackages?: boolean;
+    /** Optional first mailbox local part */
+    adminLocalPart?: string;
+    adminPassword?: string;
+    /** Optional SMTP relay when Port 25 blocked */
+    relay?: {
+        host: string;
+        port?: number;
+        username?: string;
+        password?: string;
+    };
+    /** Also create webmail (PHP project when projects provided) */
+    webmail?: boolean;
+    /** Prefer project lifecycle (Adminer model). Requires projects + projectOps. */
+    projects?: ProjectService;
+    projectOps?: ProjectOpsService;
+    actorUserId?: string;
+    webmailTool?: WebmailTool;
+    /** Download Roundcube/SnappyMail during bootstrap (needs YSK_EXECUTE) */
+    webmailDownload?: boolean;
+}): Promise<EmailBootstrapResult>;
+//# sourceMappingURL=email-bootstrap.d.ts.map

package/dist/email/email-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-bootstrap.d.ts","sourceRoot":"","sources":["../../src/email/email-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAKrE,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzE,yCAAyC;IACzC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,WAAW,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,kDAAkD;IAClD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,wCAAwC;IACxC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+CAA+C;IAC/C,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,+DAA+D;IAC/D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gFAAgF;IAChF,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,yEAAyE;IACzE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiRhC"}

package/dist/email/email-bootstrap.js

@@ -0,0 +1,294 @@
+/**
+ * Spec §5 one-click Email Server bootstrap (guided).
+ * Combines: domain DKIM create + MTA configs + passdb + webmail plan.
+ * System package install remains dual-mode (root + YSK_EXECUTE).
+ */
+import { EmailService } from './service.js';
+import { applyEmailStack } from '../hosting/system-apply.js';
+import { writeDovecotPassdb } from './dovecot-passdb.js';
+import { applyWebmail } from './webmail-apply.js';
+import { createWebmailProject, defaultWebmailHostname, defaultWebmailProjectName, } from './webmail-project.js';
+import { applySmtpRelay } from './relay.js';
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+/**
+ * Bootstrap professional email stack for a domain under dataDir.
+ * Never claims external DNS/PTR/Port25 complete.
+ */
+export async function bootstrapEmailServer(input) {
+    const domain = input.domain.trim().toLowerCase();
+    if (!domain) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.needDomain'), { httpStatus: 400 });
+    }
+    if (!input.serverIp?.trim()) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.needServerIp'), { httpStatus: 400 });
+    }
+    const email = new EmailService(input.db, input.host, input.audit, input.dataDir);
+    const steps = [];
+    const notes = [];
+    const written = [];
+    let domainId = '';
+    // 1. Domain + DKIM
+    try {
+        const existing = email.list().find((d) => d.domain === domain);
+        if (existing) {
+            domainId = existing.id;
+            steps.push({ id: 'domain', ok: true, detail: `Reusing domain ${domain}` });
+        }
+        else {
+            const created = email.create({
+                domain,
+                serverIp: input.serverIp,
+                mailHostname: input.mailHostname,
+                actor: input.actor
+            });
+            domainId = created.domain.id;
+            steps.push({
+                id: 'domain',
+                ok: true,
+                detail: `Created domain with DKIM selector ${created.domain.dkim_selector ?? 'default'}`
+            });
+        }
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        steps.push({ id: 'domain', ok: false, detail: msg });
+        return {
+            ok: false,
+            domainId,
+            domain,
+            steps,
+            notes: [msg],
+            written,
+            requiresExecute: !input.host.executeEnabled(),
+            requiresRoot: !input.host.isRoot(),
+            externalTodos: []
+        };
+    }
+    // 2. MTA configs under dataDir
+    const mta = await applyEmailStack({
+        dataDir: input.dataDir,
+        domain,
+        mailHostname: input.mailHostname,
+        host: input.host,
+        installPackages: input.installPackages
+    });
+    written.push(...mta.written);
+    notes.push(...mta.notes);
+    steps.push({
+        id: 'mta-configs',
+        ok: mta.ok,
+        detail: mta.ok
+            ? tl('email.bootstrap.mtaOk', { count: mta.written.length })
+            : tl('email.bootstrap.mtaIncomplete', {
+                detail: mta.notes.filter((n) => /skip|YSK_EXECUTE|fail|權限|root/i.test(n)).join('; ') ||
+                    tl('email.bootstrap.seeNotes'),
+            }),
+    });
+    // 3. Optional admin mailbox
+    if (input.adminLocalPart) {
+        try {
+            const mb = await email.createMailbox(domainId, {
+                localPart: input.adminLocalPart,
+                password: input.adminPassword,
+                actor: input.actor
+            });
+            written.push(...mb.written);
+            notes.push(...mb.notes);
+            steps.push({
+                id: 'mailbox',
+                ok: mb.ok,
+                detail: tl('email.bootstrap.mailboxOk', {
+                    address: String(mb.mailbox.address),
+                    status: String(mb.mailbox.status),
+                }),
+            });
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            // already exists is soft-ok
+            const soft = /already exists|已存在/i.test(msg);
+            steps.push({
+                id: 'mailbox',
+                ok: soft,
+                detail: soft ? tl('email.bootstrap.mailboxExists', { detail: msg }) : msg,
+            });
+        }
+    }
+    // 4. Dovecot passdb + install into live Dovecot
+    try {
+        const pd = writeDovecotPassdb({
+            dataDir: input.dataDir,
+            db: input.db,
+            domain,
+            domainId
+        });
+        written.push(...pd.written);
+        notes.push(...pd.notes);
+        steps.push({
+            id: 'dovecot-passdb',
+            ok: pd.ok,
+            detail: tl('email.bootstrap.passdbOk', { count: pd.mailboxCount }),
+        });
+        if (input.host.executeEnabled() && input.host.isRoot()) {
+            const { applyDovecotPassdbToSystem } = await import('./dovecot-passdb.js');
+            const ap = await applyDovecotPassdbToSystem({
+                dataDir: input.dataDir,
+                host: input.host,
+                db: input.db,
+                rewritePassdbs: false,
+            });
+            written.push(...ap.written);
+            notes.push(...ap.notes);
+            steps.push({
+                id: 'dovecot-apply',
+                ok: ap.ok,
+                detail: ap.ok ? tl('email.bootstrap.dovecotApplyOk') : ap.notes.join('; ').slice(0, 200),
+            });
+        }
+        else {
+            steps.push({
+                id: 'dovecot-apply',
+                ok: false,
+                detail: tl('notes.email.dovecotPassdbWrittenNeedApply'),
+            });
+        }
+    }
+    catch (e) {
+        steps.push({
+            id: 'dovecot-passdb',
+            ok: false,
+            detail: e instanceof Error ? e.message : String(e),
+        });
+    }
+    // 5. Optional relay
+    if (input.relay?.host) {
+        const relay = await applySmtpRelay({
+            dataDir: input.dataDir,
+            host: input.host,
+            relay: {
+                host: input.relay.host,
+                port: input.relay.port ?? 587,
+                username: input.relay.username,
+                password: input.relay.password,
+                security: 'starttls',
+                domain
+            },
+            applySystem: Boolean(input.installPackages),
+            db: input.db,
+            actor: input.actor
+        });
+        written.push(...relay.written);
+        notes.push(...relay.notes);
+        steps.push({
+            id: 'smtp-relay',
+            ok: relay.ok,
+            detail: relay.appliedToSystem
+                ? tl('notes.auto.n0502')
+                : tl('notes.auto.n0503')
+        });
+    }
+    // 6. Webmail — PHP project path when projects available (same as Adminer/PMA)
+    let webmailProjectId;
+    let webmailUrlHint;
+    if (input.webmail !== false) {
+        const wmHost = defaultWebmailHostname(domain);
+        const imapHost = input.mailHostname ?? `mail.${domain}`;
+        if (input.projects && input.projectOps) {
+            const tool = input.webmailTool ?? 'roundcube';
+            const wm = await createWebmailProject({
+                projects: input.projects,
+                projectOps: input.projectOps,
+                host: input.host,
+                actor: input.actor,
+                actorUserId: input.actorUserId,
+                name: defaultWebmailProjectName(tool, domain),
+                domain: wmHost,
+                tool,
+                mailDomain: domain,
+                imapHost,
+                smtpHost: imapHost,
+                download: input.webmailDownload !== false,
+                installSsoPlugin: tool === 'roundcube',
+                forceHttps: false,
+            });
+            written.push(...wm.written);
+            notes.push(...wm.notes);
+            webmailProjectId = wm.projectId;
+            webmailUrlHint = wm.urlHint;
+            steps.push({
+                id: 'webmail',
+                ok: wm.ok || wm.apply_status === 'written',
+                detail: tl('email.bootstrap.webmailProjectOk', {
+                    tool,
+                    host: wmHost,
+                    status: wm.apply_status,
+                }),
+            });
+            if (wm.requiresExecute) {
+                notes.push(tl('notes.webmail.needExecute'));
+            }
+        }
+        else {
+            // Legacy skeleton only (CLI without project service)
+            const wm = await applyWebmail({
+                dataDir: input.dataDir,
+                host: input.host,
+                domain: wmHost,
+                imapHost,
+                smtpHost: imapHost,
+                download: false,
+            });
+            written.push(...wm.written);
+            notes.push(...wm.notes);
+            notes.push(tl('notes.webmail.bootstrapLegacyHint'));
+            steps.push({
+                id: 'webmail',
+                ok: wm.ok,
+                detail: tl('email.bootstrap.webmailOk', {
+                    mode: wm.mode,
+                    host: wmHost,
+                }),
+            });
+        }
+    }
+    // Honesty: mail TLS is separate — cert issue + path apply are operator steps
+    notes.push(tl('email.bootstrap.mailTlsTodo', {
+        mailHost: input.mailHostname ?? `mail.${domain}`,
+    }));
+    const bundle = email.getDnsBundle(domainId);
+    notes.push(tl('email.bootstrap.externalDns'));
+    notes.push(tl('email.bootstrap.healthScore', {
+        score: bundle.health.score,
+        max: bundle.health.maxScore,
+    }));
+    input.audit?.append({
+        actor: input.actor,
+        action: 'email.bootstrap',
+        resource: domain,
+        detail: {
+            domainId,
+            steps,
+            installPackages: Boolean(input.installPackages)
+        },
+        ok: steps.every((s) => s.ok)
+    });
+    const ok = steps.every((s) => s.ok);
+    return {
+        ok,
+        webmailProjectId,
+        webmailUrlHint,
+        domainId,
+        domain,
+        steps,
+        notes,
+        written: [...new Set(written)],
+        requiresExecute: !input.host.executeEnabled(),
+        requiresRoot: !input.host.isRoot(),
+        externalTodos: bundle.externalTodos.map((t) => ({
+            id: t.id,
+            title: t.title,
+            description: t.description
+        }))
+    };
+}
+//# sourceMappingURL=email-bootstrap.js.map

package/dist/email/email-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-bootstrap.js","sourceRoot":"","sources":["../../src/email/email-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,GAE1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAmB7D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KA8B1C;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,oBAAoB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACjF,MAAM,KAAK,GAAkC,EAAE,CAAC;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,QAAQ,GAAG,EAAE,CAAC;IAElB,mBAAmB;IACnB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC/D,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC;gBAC3B,MAAM;gBACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,KAAK,EAAE,KAAK,CAAC,KAAK;aAAE,CAAC,CAAC;YACxB,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,QAAQ;gBACZ,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,qCAAqC,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,EAAE;aAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACrD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ;YACR,MAAM;YACN,KAAK;YACL,KAAK,EAAE,CAAC,GAAG,CAAC;YACZ,OAAO;YACP,eAAe,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE;YAC7C,YAAY,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE;YAClC,aAAa,EAAE,EAAE;SAAE,CAAC;IACxB,CAAC;IAED,+BAA+B;IAC/B,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM;QACN,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,eAAe,EAAE,KAAK,CAAC,eAAe;KAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC;QACT,EAAE,EAAE,aAAa;QACjB,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,EAAE;YACZ,CAAC,CAAC,EAAE,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC5D,CAAC,CAAC,EAAE,CAAC,+BAA+B,EAAE;gBAClC,MAAM,EACJ,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC5E,EAAE,CAAC,0BAA0B,CAAC;aACjC,CAAC;KACP,CAAC,CAAC;IAEH,4BAA4B;IAC5B,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;gBAC7C,SAAS,EAAE,KAAK,CAAC,cAAc;gBAC/B,QAAQ,EAAE,KAAK,CAAC,aAAa;gBAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;aAAE,CAAC,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,SAAS;gBACb,EAAE,EAAE,EAAE,CAAC,EAAE;gBACT,MAAM,EAAE,EAAE,CAAC,2BAA2B,EAAE;oBACtC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;oBACnC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;iBAClC,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,4BAA4B;YAC5B,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,SAAS;gBACb,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG;aAC1E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,kBAAkB,CAAC;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,MAAM;YACN,QAAQ;SAAE,CAAC,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,gBAAgB;YACpB,EAAE,EAAE,EAAE,CAAC,EAAE;YACT,MAAM,EAAE,EAAE,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC;SACnE,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACvD,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAC3E,MAAM,EAAE,GAAG,MAAM,0BAA0B,CAAC;gBAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,cAAc,EAAE,KAAK;aACtB,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,eAAe;gBACnB,EAAE,EAAE,EAAE,CAAC,EAAE;gBACT,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aACzF,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,eAAe;gBACnB,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,EAAE,CAAC,2CAA2C,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,gBAAgB;YACpB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SACnD,CAAC,CAAC;IACL,CAAC;IAED,oBAAoB;IACpB,IAAI,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC;YACjC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE;gBACL,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBACtB,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG;gBAC7B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;gBAC9B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;gBAC9B,QAAQ,EAAE,UAAU;gBACpB,MAAM;aAAE;YACV,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;YAC3C,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,KAAK,EAAE,KAAK,CAAC,KAAK;SAAE,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,YAAY;YAChB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,MAAM,EAAE,KAAK,CAAC,eAAe;gBAC3B,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC;gBACxB,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC;SAAE,CAAC,CAAC;IAClC,CAAC;IAED,8EAA8E;IAC9E,IAAI,gBAAoC,CAAC;IACzC,IAAI,cAAkC,CAAC;IACvC,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,IAAI,QAAQ,MAAM,EAAE,CAAC;QACxD,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,IAAI,WAAW,CAAC;YAC9C,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC;gBACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,IAAI,EAAE,yBAAyB,CAAC,IAAI,EAAE,MAAM,CAAC;gBAC7C,MAAM,EAAE,MAAM;gBACd,IAAI;gBACJ,UAAU,EAAE,MAAM;gBAClB,QAAQ;gBACR,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,KAAK,CAAC,eAAe,KAAK,KAAK;gBACzC,gBAAgB,EAAE,IAAI,KAAK,WAAW;gBACtC,UAAU,EAAE,KAAK;aAClB,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YACxB,gBAAgB,GAAG,EAAE,CAAC,SAAS,CAAC;YAChC,cAAc,GAAG,EAAE,CAAC,OAAO,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,SAAS;gBACb,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,YAAY,KAAK,SAAS;gBAC1C,MAAM,EAAE,EAAE,CAAC,kCAAkC,EAAE;oBAC7C,IAAI;oBACJ,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,EAAE,CAAC,YAAY;iBACxB,CAAC;aACH,CAAC,CAAC;YACH,IAAI,EAAE,CAAC,eAAe,EAAE,CAAC;gBACvB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,2BAA2B,CAAC,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,qDAAqD;YACrD,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC;gBAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,MAAM;gBACd,QAAQ;gBACR,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,mCAAmC,CAAC,CAAC,CAAC;YACpD,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,SAAS;gBACb,EAAE,EAAE,EAAE,CAAC,EAAE;gBACT,MAAM,EAAE,EAAE,CAAC,2BAA2B,EAAE;oBACtC,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,IAAI,EAAE,MAAM;iBACb,CAAC;aACH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,6BAA6B,EAAE;QAChC,QAAQ,EAAE,KAAK,CAAC,YAAY,IAAI,QAAQ,MAAM,EAAE;KACjD,CAAC,CACH,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAC9C,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,6BAA6B,EAAE;QAChC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;QAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;KAC5B,CAAC,CACH,CAAC;IAEF,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,iBAAiB;QACzB,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE;YACN,QAAQ;YACR,KAAK;YACL,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;SAAE;QACnD,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAAE,CAAC,CAAC;IAElC,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpC,OAAO;QACL,EAAE;QACF,gBAAgB;QAChB,cAAc;QACd,QAAQ;QACR,MAAM;QACN,KAAK;QACL,KAAK;QACL,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9B,eAAe,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE;QAC7C,YAAY,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE;QAClC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9C,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,WAAW,EAAE,CAAC,CAAC,WAAW;SAAE,CAAC,CAAC;KAAE,CAAC;AACvC,CAAC"}

package/dist/email/index.d.ts

@@ -0,0 +1,22 @@
+export * from './dns-records.js';
+export * from './service.js';
+export * from './live-checks.js';
+export * from './dnsbl.js';
+export * from './warmup.js';
+export * from './relay.js';
+export * from './deliverability.js';
+export * from './dovecot-passdb.js';
+export * from './password-hash.js';
+export * from './webmail-apply.js';
+export * from './webmail-project.js';
+export * from './email-bootstrap.js';
+export * from './autodiscover.js';
+export * from './mail-queue.js';
+export * from './webmail-sso.js';
+export * from './sieve.js';
+export * from './mail-policy.js';
+export * from './sender-rate-policy.js';
+export * from './roundcube-sso-plugin.js';
+export * from './domain-flags-apply.js';
+export * from './mail-tls-apply.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/email/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/email/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AACxC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC"}

package/dist/email/index.js

@@ -0,0 +1,22 @@
+export * from './dns-records.js';
+export * from './service.js';
+export * from './live-checks.js';
+export * from './dnsbl.js';
+export * from './warmup.js';
+export * from './relay.js';
+export * from './deliverability.js';
+export * from './dovecot-passdb.js';
+export * from './password-hash.js';
+export * from './webmail-apply.js';
+export * from './webmail-project.js';
+export * from './email-bootstrap.js';
+export * from './autodiscover.js';
+export * from './mail-queue.js';
+export * from './webmail-sso.js';
+export * from './sieve.js';
+export * from './mail-policy.js';
+export * from './sender-rate-policy.js';
+export * from './roundcube-sso-plugin.js';
+export * from './domain-flags-apply.js';
+export * from './mail-tls-apply.js';
+//# sourceMappingURL=index.js.map

package/dist/email/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/email/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AACxC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC"}

package/dist/email/live-checks.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Live email deliverability checks (DNS / PTR / Port 25 / DNSBL).
+ */
+import { type EmailHealthReport } from 'ysk-server-shared';
+import { type DnsblReport } from './dnsbl.js';
+export interface LiveCheckResult {
+    mx: {
+        ok: boolean;
+        detail: string;
+    };
+    spf: {
+        ok: boolean;
+        detail: string;
+    };
+    dkim: {
+        ok: boolean;
+        detail: string;
+    };
+    dmarc: {
+        ok: boolean;
+        detail: string;
+    };
+    ptr: {
+        ok: boolean;
+        detail: string;
+    };
+    port25: {
+        ok: boolean | null;
+        detail: string;
+    };
+    dnsbl: {
+        ok: boolean;
+        detail: string;
+        report?: DnsblReport;
+    };
+    health: EmailHealthReport;
+}
+/**
+ * Probe outbound TCP connectivity to host:port with timeout.
+ */
+export declare function probeTcp(host: string, port: number, timeoutMs?: number): Promise<boolean>;
+/**
+ * Run live DNS + network checks for an email domain.
+ */
+export declare function runLiveEmailChecks(input: {
+    domain: string;
+    serverIp: string;
+    mailHostname: string;
+    dkimPublicKey: string;
+    dkimSelector?: string;
+}): Promise<LiveCheckResult>;
+//# sourceMappingURL=live-checks.d.ts.map

package/dist/email/live-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-checks.d.ts","sourceRoot":"","sources":["../../src/email/live-checks.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAM,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE/D,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAE5D,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC,GAAG,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,IAAI,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,KAAK,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,GAAG,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,MAAM,EAAE;QAAE,EAAE,EAAE,OAAO,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,KAAK,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,CAAC;IAC7D,MAAM,EAAE,iBAAiB,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,SAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAYvF;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,eAAe,CAAC,CAuG3B"}

package/dist/email/live-checks.js

@@ -0,0 +1,124 @@
+/**
+ * Live email deliverability checks (DNS / PTR / Port 25 / DNSBL).
+ */
+import { resolveMx, resolveTxt, reverse } from 'node:dns/promises';
+import { createConnection } from 'node:net';
+import { tl } from 'ysk-server-shared';
+import { scoreEmailHealth } from './dns-records.js';
+import { checkIpDnsbl } from './dnsbl.js';
+/**
+ * Probe outbound TCP connectivity to host:port with timeout.
+ */
+export function probeTcp(host, port, timeoutMs = 4000) {
+    return new Promise((resolve) => {
+        const socket = createConnection({ host, port });
+        const done = (ok) => {
+            socket.destroy();
+            resolve(ok);
+        };
+        socket.setTimeout(timeoutMs);
+        socket.on('connect', () => done(true));
+        socket.on('timeout', () => done(false));
+        socket.on('error', () => done(false));
+    });
+}
+/**
+ * Run live DNS + network checks for an email domain.
+ */
+export async function runLiveEmailChecks(input) {
+    const selector = input.dkimSelector ?? 'default';
+    let mxOk = false;
+    let mxDetail = '';
+    try {
+        const mx = await resolveMx(input.domain);
+        mxOk = mx.length > 0;
+        mxDetail = mx.map((m) => `${m.priority} ${m.exchange}`).join(', ') || tl('email.live.noMx');
+    }
+    catch (e) {
+        mxDetail = e instanceof Error ? e.message : tl('email.live.mxLookupFailed');
+    }
+    let spfOk = false;
+    let spfDetail = '';
+    try {
+        const txts = await resolveTxt(input.domain);
+        const flat = txts.map((t) => t.join(''));
+        const spf = flat.find((t) => t.startsWith('v=spf1'));
+        spfOk = Boolean(spf);
+        spfDetail = spf ?? tl('email.live.noSpf');
+    }
+    catch (e) {
+        spfDetail = e instanceof Error ? e.message : tl('email.live.spfLookupFailed');
+    }
+    let dkimOk = false;
+    let dkimDetail = '';
+    try {
+        const name = `${selector}._domainkey.${input.domain}`;
+        const txts = await resolveTxt(name);
+        const flat = txts.map((t) => t.join(''));
+        const dkim = flat.find((t) => /v=DKIM1/i.test(t));
+        dkimOk = Boolean(dkim);
+        dkimDetail = dkim ? dkim.slice(0, 80) + '…' : tl('email.live.noDkim');
+    }
+    catch (e) {
+        dkimDetail = e instanceof Error ? e.message : tl('email.live.dkimLookupFailed');
+    }
+    let dmarcOk = false;
+    let dmarcDetail = '';
+    try {
+        const txts = await resolveTxt(`_dmarc.${input.domain}`);
+        const flat = txts.map((t) => t.join(''));
+        const dmarc = flat.find((t) => /v=DMARC1/i.test(t));
+        dmarcOk = Boolean(dmarc);
+        dmarcDetail = dmarc ?? tl('email.live.noDmarc');
+    }
+    catch (e) {
+        dmarcDetail = e instanceof Error ? e.message : tl('email.live.dmarcLookupFailed');
+    }
+    let ptrOk = false;
+    let ptrDetail = '';
+    try {
+        const names = await reverse(input.serverIp);
+        ptrDetail = names.join(', ') || tl('email.live.noPtr');
+        ptrOk = names.some((n) => n.replace(/\.$/, '').toLowerCase() === input.mailHostname.toLowerCase() ||
+            n.toLowerCase().includes(input.domain.toLowerCase()));
+    }
+    catch (e) {
+        ptrDetail = e instanceof Error ? e.message : tl('email.live.ptrLookupFailed');
+    }
+    // Port 25: try connecting to a public SMTP (gmail) — may be blocked by cloud
+    const port25Open = await probeTcp('gmail-smtp-in.l.google.com', 25, 4000);
+    const port25Detail = port25Open
+        ? tl('email.live.port25Open')
+        : tl('email.live.port25Blocked');
+    // Multi-list DNSBL (Spamhaus / SpamCop / Barracuda)
+    const dnsblReport = await checkIpDnsbl(input.serverIp);
+    const dnsblOk = dnsblReport.ok;
+    const dnsblDetail = dnsblReport.listedOn.length > 0
+        ? tl('email.live.dnsblListed', { list: dnsblReport.listedOn.join(', ') })
+        : tl('email.live.dnsblClean', { list: dnsblReport.cleanOn.join(', ') });
+    const health = scoreEmailHealth({
+        domain: input.domain,
+        serverIp: input.serverIp,
+        dkimPublicKey: input.dkimPublicKey,
+        mailHostname: input.mailHostname,
+        ptrOk,
+        port25Open,
+        dnsApplied: mxOk && spfOk && dkimOk,
+        dmarcPresent: dmarcOk,
+    });
+    if (!dnsblOk) {
+        health.messages.push(`DNSBL: ${dnsblDetail}`);
+        health.score = Math.max(0, health.score - 15);
+    }
+    return {
+        mx: { ok: mxOk, detail: mxDetail },
+        spf: { ok: spfOk, detail: spfDetail },
+        dkim: { ok: dkimOk, detail: dkimDetail },
+        dmarc: { ok: dmarcOk, detail: dmarcDetail },
+        ptr: { ok: ptrOk, detail: ptrDetail },
+        port25: { ok: port25Open, detail: port25Detail },
+        dnsbl: { ok: dnsblOk, detail: dnsblDetail, report: dnsblReport },
+        health,
+    };
+}
+//# sourceMappingURL=live-checks.js.map

package/dist/email/live-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-checks.js","sourceRoot":"","sources":["../../src/email/live-checks.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,EAAE,EAA0B,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAoB,MAAM,YAAY,CAAC;AAa5D;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,IAAY,EAAE,SAAS,GAAG,IAAI;IACnE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,CAAC,EAAW,EAAE,EAAE;YAC3B,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,EAAE,CAAC,CAAC;QACd,CAAC,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC7B,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACvC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAMxC;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,IAAI,SAAS,CAAC;IAEjD,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,GAAG,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QACrB,QAAQ,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAAC,CAAC;IAC9F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrD,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACrB,SAAS,GAAG,GAAG,IAAI,EAAE,CAAC,kBAAkB,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,SAAS,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,QAAQ,eAAe,KAAK,CAAC,MAAM,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,UAAU,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,UAAU,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QACzB,WAAW,GAAG,KAAK,IAAI,EAAE,CAAC,oBAAoB,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,WAAW,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,8BAA8B,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5C,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,kBAAkB,CAAC,CAAC;QACvD,KAAK,GAAG,KAAK,CAAC,IAAI,CAChB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE;YACvE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CACvD,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,SAAS,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC;IAChF,CAAC;IAED,6EAA6E;IAC7E,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,4BAA4B,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1E,MAAM,YAAY,GAAG,UAAU;QAC7B,CAAC,CAAC,EAAE,CAAC,uBAAuB,CAAC;QAC7B,CAAC,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC;IAEnC,oDAAoD;IACpD,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC;IAC/B,MAAM,WAAW,GACf,WAAW,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAC7B,CAAC,CAAC,EAAE,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,CAAC,CAAC,EAAE,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE5E,MAAM,MAAM,GAAG,gBAAgB,CAAC;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,KAAK;QACL,UAAU;QACV,UAAU,EAAE,IAAI,IAAI,KAAK,IAAI,MAAM;QACnC,YAAY,EAAE,OAAO;KACtB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,WAAW,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,OAAO;QACL,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE;QAClC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE;QACrC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;QACxC,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE;QAC3C,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE;QACrC,MAAM,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE;QAChD,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE;QAChE,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/email/mail-policy.d.ts

@@ -0,0 +1,24 @@
+import type { HostExecutor } from '../host/executor.js';
+export declare function applyMailDomainPolicy(input: {
+    dataDir: string;
+    host: HostExecutor;
+    domain: string;
+    rateLimitPerHour?: number | null;
+    antispam?: boolean;
+    applySystem?: boolean;
+}): Promise<{
+    ok: boolean;
+    notes: string[];
+    written: string[];
+    blocked?: boolean;
+    blockMessage?: string;
+    apply_status: 'written' | 'applied' | 'blocked';
+}>;
+/** Min positive per-domain rate; default 500 msgs/hour */
+export declare function computeGlobalMessageRatePerHour(dataDir: string): number;
+/** Rebuild aggregate maps from all per-domain policy dirs */
+export declare function rebuildAggregatePolicyMaps(dataDir: string): {
+    written: string[];
+    notes: string[];
+};
+//# sourceMappingURL=mail-policy.d.ts.map

package/dist/email/mail-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail-policy.d.ts","sourceRoot":"","sources":["../../src/email/mail-policy.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAIxD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;CACjD,CAAC,CA6ND;AAED,0DAA0D;AAC1D,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAoBvE;AAqCD,6DAA6D;AAC7D,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG;IAC3D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CA4DA"}