ysk-server-core 1.0.0

package/dist/email/mail-policy.js

@@ -0,0 +1,318 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * Apply domain rate-limit + antispam flags to managed Postfix/Rspamd configs.
+ * When applySystem: write real include snippets under /etc and reload.
+ */
+import { mkdirSync, writeFileSync, readdirSync, existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { applySenderRatePolicyService, writeSenderRatePolicyDaemon } from './sender-rate-policy.js';
+import { shellBinExists } from '../hosting/software-probe/index.js';
+export async function applyMailDomainPolicy(input) {
+    const domain = input.domain.trim().toLowerCase();
+    const notes = [];
+    const written = [];
+    const dir = join(input.dataDir, 'email', 'policy', domain);
+    mkdirSync(dir, { recursive: true });
+    const rate = input.rateLimitPerHour;
+    const rateFile = join(dir, 'rate.cf');
+    const rateBody = rate != null && rate > 0
+        ? `# YSK outbound rate for ${domain}\n${domain} ${rate}\n`
+        : `# YSK rate: unlimited for ${domain}\n`;
+    writeFileSync(rateFile, rateBody, 'utf8');
+    written.push(rateFile);
+    const spamFile = join(dir, 'rspamd-domain.map');
+    const spamBody = input.antispam
+        ? `${domain} ysk_antispam_on\n`
+        : `# antispam off for ${domain}\n`;
+    writeFileSync(spamFile, spamBody, 'utf8');
+    written.push(spamFile);
+    // Aggregate maps for all domains under policy/
+    const agg = rebuildAggregatePolicyMaps(input.dataDir);
+    written.push(...agg.written);
+    notes.push(...agg.notes);
+    // Managed postfix/rspamd include snippets (always under dataDir)
+    const snippets = writePolicyIncludeSnippets(input.dataDir);
+    written.push(...snippets.written);
+    notes.push(...snippets.notes);
+    // Per-sender policy daemon files (always written)
+    const senderPol = writeSenderRatePolicyDaemon(input.dataDir);
+    written.push(...senderPol.written);
+    notes.push(...senderPol.notes);
+    if (!input.applySystem) {
+        notes.push(tl('notes.auto.n1229'));
+        return { ok: true, notes, written, apply_status: 'written' };
+    }
+    if (!input.host.executeEnabled() || !input.host.isRoot()) {
+        return {
+            ok: false,
+            notes: [...notes, tl('notes.auto.n0005')],
+            written,
+            blocked: true,
+            blockMessage: tl('notes.auto.n0006'),
+            apply_status: 'blocked'
+        };
+    }
+    const sysPolicy = '/etc/ysk-server/email/policy';
+    const sysPostfix = '/etc/postfix/ysk-server';
+    const sysRspamd = '/etc/rspamd/local.d';
+    // Derive global anvil rate (msgs/hour): min positive rate across domains, default 500
+    const globalRate = computeGlobalMessageRatePerHour(input.dataDir);
+    writeFileSync(join(input.dataDir, 'email', 'policy', 'ysk-anvil.env'), `YSK_MSG_RATE_PER_HOUR=${globalRate}\n`, 'utf8');
+    written.push(join(input.dataDir, 'email', 'policy', 'ysk-anvil.env'));
+    // Rspamd ratelimit module (domain buckets from ysk-rate-values)
+    const rlConf = writeRspamdRatelimitConf(input.dataDir, globalRate);
+    written.push(...rlConf.written);
+    notes.push(...rlConf.notes);
+    // Stepwise system apply — no || true masking on mutate steps
+    const rateMap = join(input.dataDir, 'email', 'policy', 'ysk-rate.map');
+    const spamMap = join(input.dataDir, 'email', 'policy', 'ysk-antispam.map');
+    const multiMap = join(input.dataDir, 'email', 'policy', 'ysk-multimap.conf');
+    const rlMap = join(input.dataDir, 'email', 'policy', 'ysk-ratelimit.conf');
+    let hardFail = false;
+    const run = async (name, argv, hard = false) => {
+        const r = await input.host.runCommand(argv, { timeoutMs: 30_000 });
+        if (r.exitCode !== 0) {
+            notes.push(tl('notes.tpl.actionFailed', { action: name, detail: (r.stderr || r.stdout).slice(0, 200) }));
+            if (hard)
+                hardFail = true;
+        }
+        else {
+            notes.push(`${name} ok`);
+        }
+        return r;
+    };
+    await run('mkdir policy dirs', [
+        'bash',
+        '-c',
+        `mkdir -p ${JSON.stringify(sysPolicy)} ${JSON.stringify(sysPostfix)} ${JSON.stringify(sysRspamd)}`,
+    ], true);
+    await run('cp policy tree', [
+        'bash',
+        '-c',
+        `cp -a ${JSON.stringify(join(input.dataDir, 'email', 'policy'))}/. ${JSON.stringify(sysPolicy)}/`,
+    ], true);
+    if (existsSync(rateMap)) {
+        await run('cp ysk-rate.map', ['cp', '-f', rateMap, join(sysPostfix, 'ysk-rate.map')], true);
+        await run('postmap ysk-rate', [
+            'bash',
+            '-c',
+            `if ${shellBinExists('postmap')}; then postmap hash:${sysPostfix}/ysk-rate.map || postmap ${sysPostfix}/ysk-rate.map; fi`,
+        ], false);
+    }
+    if (existsSync(spamMap)) {
+        await run('cp antispam map', ['cp', '-f', spamMap, join(sysPolicy, 'ysk-antispam.map')], false);
+    }
+    if (existsSync(multiMap)) {
+        await run('cp rspamd multimap', ['cp', '-f', multiMap, join(sysRspamd, 'ysk_multimap.conf')], false);
+    }
+    if (existsSync(rlMap)) {
+        await run('cp rspamd ratelimit', ['cp', '-f', rlMap, join(sysRspamd, 'ratelimit.conf')], false);
+    }
+    await run('postconf sender_access', [
+        'bash',
+        '-c',
+        `grep -q 'ysk-server/ysk-rate' /etc/postfix/main.cf 2>/dev/null || postconf -e "smtpd_sender_restrictions=\$smtpd_sender_restrictions, check_sender_access hash:${sysPostfix}/ysk-rate.map"`,
+    ], false);
+    await run('postconf anvil_rate_time_unit', ['postconf', '-e', 'anvil_rate_time_unit=3600s'], true);
+    await run('postconf message_rate_limit', ['postconf', '-e', `smtpd_client_message_rate_limit=${globalRate}`], true);
+    await run('postconf recipient_rate', ['postconf', '-e', `smtpd_client_recipient_rate_limit=${globalRate * 5}`], false);
+    await run('postconf connection_rate', [
+        'postconf',
+        '-e',
+        `smtpd_client_connection_rate_limit=${Math.floor(globalRate / 10) + 20}`,
+    ], false);
+    notes.push(tl('notes.auto.t0094', { v0: (globalRate) }));
+    let reloadsOk = 0;
+    for (const unit of ['postfix', 'rspamd']) {
+        const r = await input.host.runCommand(['systemctl', 'reload', unit], { timeoutMs: 10_000 });
+        if (r.exitCode === 0) {
+            reloadsOk++;
+            notes.push(`${unit} reloaded`);
+        }
+        else {
+            notes.push(`${unit} reload failed: ${(r.stderr || r.stdout).slice(0, 80)}`);
+            if (unit === 'postfix')
+                hardFail = true;
+        }
+    }
+    const check = await input.host.runCommand([
+        'bash',
+        '-c',
+        'postconf smtpd_client_message_rate_limit anvil_rate_time_unit smtpd_sender_restrictions 2>/dev/null | head -5',
+    ], { timeoutMs: 5_000 });
+    const verified = check.stdout.includes('message_rate_limit');
+    if (verified) {
+        notes.push(tl('notes.auto.t0095', { v0: (check.stdout.trim().replace(/\n/g, ' | ').slice(0, 200)) }));
+    }
+    else {
+        notes.push(tl('notes.auto.n0383'));
+        hardFail = true;
+    }
+    // Per-sender check_policy_service
+    const senderApply = await applySenderRatePolicyService({
+        dataDir: input.dataDir,
+        host: input.host
+    });
+    written.push(...senderApply.written);
+    notes.push(...senderApply.notes);
+    if (senderApply.blocked || !senderApply.ok)
+        hardFail = true;
+    const applied = !hardFail && reloadsOk > 0 && verified && senderApply.apply_status === 'applied';
+    notes.push(applied
+        ? tl('notes.auto.n1208')
+        : tl('notes.auto.n1223'));
+    return {
+        ok: applied,
+        notes,
+        written,
+        apply_status: applied ? 'applied' : 'written'
+    };
+}
+/** Min positive per-domain rate; default 500 msgs/hour */
+export function computeGlobalMessageRatePerHour(dataDir) {
+    const root = join(dataDir, 'email', 'policy');
+    let min = Infinity;
+    try {
+        for (const name of readdirSync(root)) {
+            const f = join(root, name, 'rate.cf');
+            if (!existsSync(f))
+                continue;
+            const text = readFileSync(f, 'utf8');
+            for (const line of text.split('\n')) {
+                const t = line.trim();
+                if (!t || t.startsWith('#'))
+                    continue;
+                const n = Number(t.split(/\s+/)[1]);
+                if (Number.isFinite(n) && n > 0 && n < min)
+                    min = n;
+            }
+        }
+    }
+    catch {
+        /* empty */
+    }
+    if (!Number.isFinite(min) || min === Infinity)
+        return 500;
+    return Math.max(10, Math.min(Math.floor(min), 50_000));
+}
+function writeRspamdRatelimitConf(dataDir, globalRate) {
+    const path = join(dataDir, 'email', 'policy', 'ysk-ratelimit.conf');
+    // Rspamd ratelimit: per-IP and soft per-domain buckets (msgs per hour → burst-ish)
+    const perMin = Math.max(1, Math.ceil(globalRate / 60));
+    writeFileSync(path, `# Generated by YSK Server — copied to /etc/rspamd/local.d/ratelimit.conf on apply
+# ~${globalRate} msgs/hour ≈ ${perMin}/min soft bucket
+
+rates {
+  # per authenticated user / IP
+  to = {
+    bucket = [
+      { burst = ${perMin * 2}; rate = "${perMin} / 1m"; },
+      { burst = ${Math.min(globalRate, 200)}; rate = "${globalRate} / 1h"; },
+    ];
+  }
+  # bounce protection
+  bounce_to = {
+    bucket = [
+      { burst = 2; rate = "2 / 1h"; },
+    ];
+  }
+}
+`, 'utf8');
+    return {
+        written: [path],
+        notes: [tl('notes.auto.t0096', { v0: (globalRate) })]
+    };
+}
+/** Rebuild aggregate maps from all per-domain policy dirs */
+export function rebuildAggregatePolicyMaps(dataDir) {
+    const root = join(dataDir, 'email', 'policy');
+    mkdirSync(root, { recursive: true });
+    const rateLines = ['# YSK aggregate outbound rate (domain → msgs/hour hint)'];
+    const spamLines = ['# YSK antispam domain map for rspamd multimap'];
+    let domains = 0;
+    try {
+        for (const name of readdirSync(root)) {
+            const d = join(root, name);
+            if (!existsSync(join(d, 'rate.cf')))
+                continue;
+            domains++;
+            try {
+                const rate = readFileSync(join(d, 'rate.cf'), 'utf8');
+                for (const line of rate.split('\n')) {
+                    const t = line.trim();
+                    if (t && !t.startsWith('#'))
+                        rateLines.push(t);
+                }
+            }
+            catch {
+                /* skip */
+            }
+            try {
+                const spam = readFileSync(join(d, 'rspamd-domain.map'), 'utf8');
+                for (const line of spam.split('\n')) {
+                    const t = line.trim();
+                    if (t && !t.startsWith('#'))
+                        spamLines.push(t);
+                }
+            }
+            catch {
+                /* skip */
+            }
+        }
+    }
+    catch {
+        /* empty */
+    }
+    // Postfix access map: domain OK (presence = allow); rate value is informational in comment
+    // Real per-hour throttle needs policyd; we use domain-level REJECT soft-limit marker
+    const postfixRate = [
+        '# YSK — domain keys for check_sender_access (OK = allow)',
+        '# Numeric rates stored in comments / companion rate.cf per domain',
+    ];
+    for (const line of rateLines) {
+        if (line.startsWith('#'))
+            continue;
+        const parts = line.split(/\s+/);
+        if (parts[0]) {
+            // Format: domain OK  (postfix access map)
+            postfixRate.push(`${parts[0]} OK`);
+        }
+    }
+    const rateAgg = join(root, 'ysk-rate.map');
+    const spamAgg = join(root, 'ysk-antispam.map');
+    writeFileSync(rateAgg, postfixRate.join('\n') + '\n', 'utf8');
+    writeFileSync(spamAgg, spamLines.join('\n') + '\n', 'utf8');
+    // Human-readable rate values
+    writeFileSync(join(root, 'ysk-rate-values.txt'), rateLines.join('\n') + '\n', 'utf8');
+    return {
+        written: [rateAgg, spamAgg, join(root, 'ysk-rate-values.txt')],
+        notes: [tl('notes.auto.t0097', { v0: (domains) })]
+    };
+}
+function writePolicyIncludeSnippets(dataDir) {
+    const root = join(dataDir, 'email', 'policy');
+    mkdirSync(root, { recursive: true });
+    const multimap = join(root, 'ysk-multimap.conf');
+    // Rspamd multimap: score domains flagged ysk_antispam_on
+    writeFileSync(multimap, `# Generated by YSK Server — place in /etc/rspamd/local.d/
+# When applied: copied to local.d/ysk_multimap.conf
+
+ysk_antispam {
+  type = "from";
+  filter = "email:domain";
+  map = "/etc/ysk-server/email/policy/ysk-antispam.map";
+  symbol = "YSK_ANTISPAM_DOMAIN";
+  score = 0.0;
+  description = "YSK panel antispam-enabled domain marker";
+}
+`, 'utf8');
+    const postfixSnippet = join(root, 'postfix-main.cf.snippet');
+    writeFileSync(postfixSnippet, `# YSK — merge into main.cf or use postconf (applySystem does postconf best-effort)
+# smtpd_sender_restrictions = ..., check_sender_access hash:/etc/postfix/ysk-server/ysk-rate.map
+`, 'utf8');
+    return {
+        written: [multimap, postfixSnippet],
+        notes: [tl('notes.auto.n0761')]
+    };
+}
+//# sourceMappingURL=mail-policy.js.map

package/dist/email/mail-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail-policy.js","sourceRoot":"","sources":["../../src/email/mail-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEpE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAO3C;IAQC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3D,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpC,MAAM,IAAI,GAAG,KAAK,CAAC,gBAAgB,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACtC,MAAM,QAAQ,GACZ,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,CAAC;QACtB,CAAC,CAAC,2BAA2B,MAAM,KAAK,MAAM,IAAI,IAAI,IAAI;QAC1D,CAAC,CAAC,6BAA6B,MAAM,IAAI,CAAC;IAC9C,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ;QAC7B,CAAC,CAAC,GAAG,MAAM,oBAAoB;QAC/B,CAAC,CAAC,sBAAsB,MAAM,IAAI,CAAC;IACrC,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEvB,+CAA+C;IAC/C,MAAM,GAAG,GAAG,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtD,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IAEzB,iEAAiE;IACjE,MAAM,QAAQ,GAAG,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE9B,kDAAkD;IAClD,MAAM,SAAS,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7D,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAE/B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACzD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;YACzC,OAAO;YACP,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,EAAE,CAAC,kBAAkB,CAAC;YACpC,YAAY,EAAE,SAAS;SAAE,CAAC;IAC9B,CAAC;IAED,MAAM,SAAS,GAAG,8BAA8B,CAAC;IACjD,MAAM,UAAU,GAAG,yBAAyB,CAAC;IAC7C,MAAM,SAAS,GAAG,qBAAqB,CAAC;IAExC,sFAAsF;IACtF,MAAM,UAAU,GAAG,+BAA+B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClE,aAAa,CACX,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,EACvD,yBAAyB,UAAU,IAAI,EACvC,MAAM,CACP,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;IAEtE,gEAAgE;IAChE,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACnE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAE5B,6DAA6D;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IAE3E,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,MAAM,GAAG,GAAG,KAAK,EAAE,IAAY,EAAE,IAAc,EAAE,IAAI,GAAG,KAAK,EAAE,EAAE;QAC/D,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACzG,IAAI,IAAI;gBAAE,QAAQ,GAAG,IAAI,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,MAAM,GAAG,CACP,mBAAmB,EACnB;QACE,MAAM;QACN,IAAI;QACJ,YAAY,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;KACnG,EACD,IAAI,CACL,CAAC;IACF,MAAM,GAAG,CACP,gBAAgB,EAChB;QACE,MAAM;QACN,IAAI;QACJ,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG;KAClG,EACD,IAAI,CACL,CAAC;IAEF,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5F,MAAM,GAAG,CACP,kBAAkB,EAClB;YACE,MAAM;YACN,IAAI;YACJ,MAAM,cAAc,CAAC,SAAS,CAAC,uBAAuB,UAAU,4BAA4B,UAAU,mBAAmB;SAC1H,EACD,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,CACP,oBAAoB,EACpB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,EAC5D,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,GAAG,CACP,qBAAqB,EACrB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,EACtD,KAAK,CACN,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,CACP,wBAAwB,EACxB;QACE,MAAM;QACN,IAAI;QACJ,kKAAkK,UAAU,gBAAgB;KAC7L,EACD,KAAK,CACN,CAAC;IACF,MAAM,GAAG,CAAC,+BAA+B,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,4BAA4B,CAAC,EAAE,IAAI,CAAC,CAAC;IACnG,MAAM,GAAG,CACP,6BAA6B,EAC7B,CAAC,UAAU,EAAE,IAAI,EAAE,mCAAmC,UAAU,EAAE,CAAC,EACnE,IAAI,CACL,CAAC;IACF,MAAM,GAAG,CACP,yBAAyB,EACzB,CAAC,UAAU,EAAE,IAAI,EAAE,qCAAqC,UAAU,GAAG,CAAC,EAAE,CAAC,EACzE,KAAK,CACN,CAAC;IACF,MAAM,GAAG,CACP,0BAA0B,EAC1B;QACE,UAAU;QACV,IAAI;QACJ,sCAAsC,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;KACzE,EACD,KAAK,CACN,CAAC;IAEF,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAC7C,CAAC;IAEF,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACrB,SAAS,EAAE,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YAC5E,IAAI,IAAI,KAAK,SAAS;gBAAE,QAAQ,GAAG,IAAI,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CACvC;QACE,MAAM;QACN,IAAI;QACJ,+GAA+G;KAChH,EACD,EAAE,SAAS,EAAE,KAAK,EAAE,CACrB,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAC7D,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxG,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnC,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,kCAAkC;IAClC,MAAM,WAAW,GAAG,MAAM,4BAA4B,CAAC;QACrD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;KAAE,CAAC,CAAC;IACtB,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACrC,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,WAAW,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,EAAE;QAAE,QAAQ,GAAG,IAAI,CAAC;IAE5D,MAAM,OAAO,GACX,CAAC,QAAQ,IAAI,SAAS,GAAG,CAAC,IAAI,QAAQ,IAAI,WAAW,CAAC,YAAY,KAAK,SAAS,CAAC;IACnF,KAAK,CAAC,IAAI,CACR,OAAO;QACL,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC;QACxB,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAC3B,CAAC;IACF,OAAO;QACL,EAAE,EAAE,OAAO;QACX,KAAK;QACL,OAAO;QACP,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KAAE,CAAC;AACpD,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,+BAA+B,CAAC,OAAe;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YACtC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACrC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBACtB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACtC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;oBAAE,GAAG,GAAG,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,WAAW;IACb,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAC1D,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAAe,EACf,UAAkB;IAElB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IACpE,mFAAmF;IACnF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC;IACvD,aAAa,CACX,IAAI,EACJ;KACC,UAAU,gBAAgB,MAAM;;;;;;kBAMnB,MAAM,GAAG,CAAC,aAAa,MAAM;kBAC7B,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,aAAa,UAAU;;;;;;;;;;CAUjE,EACG,MAAM,CACP,CAAC;IACF,OAAO;QACL,OAAO,EAAE,CAAC,IAAI,CAAC;QACf,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;KAAE,CAAC;AAC5D,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,0BAA0B,CAAC,OAAe;IAIxD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9C,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,MAAM,SAAS,GAAa,CAAC,yDAAyD,CAAC,CAAC;IACxF,MAAM,SAAS,GAAa,CAAC,+CAA+C,CAAC,CAAC;IAC9E,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC3B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBAAE,SAAS;YAC9C,OAAO,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;gBACtD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;oBACtB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;wBAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU;YACZ,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAC;gBAChE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;oBACtB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;wBAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU;YACZ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,WAAW;IACb,CAAC;IAED,2FAA2F;IAC3F,qFAAqF;IACrF,MAAM,WAAW,GAAa;QAC5B,0DAA0D;QAC1D,mEAAmE;KACpE,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACb,0CAA0C;YAC1C,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAC/C,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9D,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAE5D,6BAA6B;IAC7B,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAEtF,OAAO;QACL,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QAC9D,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;KAAE,CAAC;AACzD,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAe;IAIjD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9C,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACjD,yDAAyD;IACzD,aAAa,CACX,QAAQ,EACR;;;;;;;;;;;CAWH,EACG,MAAM,CACP,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;IAC7D,aAAa,CACX,cAAc,EACd;;CAEH,EACG,MAAM,CACP,CAAC;IACF,OAAO;QACL,OAAO,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC;QACnC,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;KAAE,CAAC;AACtC,CAAC"}

package/dist/email/mail-queue.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Mail queue list / flush via postqueue/postsuper when available.
+ * Honest: blocked without execute; never fakes success.
+ * Auto-heals common Postfix install gaps when execute is on.
+ */
+import type { HostExecutor } from '../host/executor.js';
+export interface MailQueueResult {
+    ok: boolean;
+    notes: string[];
+    items: Array<{
+        id: string;
+        raw: string;
+    }>;
+    requiresExecute: boolean;
+    blocked?: boolean;
+    flushed?: number;
+}
+export declare function listMailQueue(host: HostExecutor): Promise<MailQueueResult>;
+export declare function flushMailQueue(host: HostExecutor, opts?: {
+    id?: string;
+    all?: boolean;
+}): Promise<MailQueueResult>;
+//# sourceMappingURL=mail-queue.d.ts.map

package/dist/email/mail-queue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail-queue.d.ts","sourceRoot":"","sources":["../../src/email/mail-queue.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1C,eAAe,EAAE,OAAO,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA8CD,wBAAsB,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAqFhF;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,YAAY,EAClB,IAAI,CAAC,EAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GACpC,OAAO,CAAC,eAAe,CAAC,CAkF1B"}

package/dist/email/mail-queue.js

@@ -0,0 +1,188 @@
+import { tl } from 'ysk-server-shared';
+function needsPostfixQueueHeal(out) {
+    return (/setgid_group/i.test(out) ||
+        /Mail system is down/i.test(out) ||
+        /showq/i.test(out) ||
+        /malformed showq/i.test(out) ||
+        /open directory hold/i.test(out) ||
+        /scan_dir_push/i.test(out) ||
+        /No such file or directory/i.test(out));
+}
+function classifyQueueError(out) {
+    if (/setgid_group/i.test(out))
+        return tl('notes.email.postqueueSetgidBroken');
+    if (/Mail system is down|showq|malformed showq/i.test(out)) {
+        return tl('notes.email.postqueueMailDown');
+    }
+    if (/open directory hold|scan_dir_push/i.test(out)) {
+        return tl('notes.email.postqueueSpoolMissing');
+    }
+    return tl('notes.auto.n0386');
+}
+async function tryHealPostfixQueue(host, out) {
+    if (!host.executeEnabled() || !needsPostfixQueueHeal(out)) {
+        return { notes: [], healed: false };
+    }
+    try {
+        const { ensurePostfixRuntimeForQueue } = await import('../hosting/postfix-bootstrap.js');
+        const heal = await ensurePostfixRuntimeForQueue(host);
+        return { notes: heal.notes.slice(0, 6), healed: true };
+    }
+    catch (e) {
+        return {
+            notes: [e instanceof Error ? e.message : String(e)],
+            healed: false,
+        };
+    }
+}
+export async function listMailQueue(host) {
+    if (!host.executeEnabled()) {
+        return {
+            ok: false,
+            blocked: true,
+            requiresExecute: true,
+            items: [],
+            notes: [tl('notes.auto.n1186')],
+        };
+    }
+    const { shellBinExists, binPresent } = await import('../hosting/software-probe/index.js');
+    if (!(await binPresent(host, 'postqueue'))) {
+        return {
+            ok: false,
+            requiresExecute: false,
+            items: [],
+            notes: [tl('notes.auto.n0386'), 'NO_POSTQUEUE'],
+        };
+    }
+    const runPostqueue = async () => host.runCommand([
+        'bash',
+        '-c',
+        `if ${shellBinExists('postqueue')}; then postqueue -p 2>&1; else echo NO_POSTQUEUE; fi`,
+    ], { timeoutMs: 15_000 });
+    let r = await runPostqueue();
+    let out = (r.stdout || r.stderr || '').trim();
+    const healNotes = [];
+    if ((out.includes('NO_POSTQUEUE') || r.exitCode !== 0 || needsPostfixQueueHeal(out)) &&
+        needsPostfixQueueHeal(out)) {
+        const heal = await tryHealPostfixQueue(host, out);
+        healNotes.push(...heal.notes);
+        if (heal.healed) {
+            r = await runPostqueue();
+            out = (r.stdout || r.stderr || '').trim();
+        }
+    }
+    if (out.includes('NO_POSTQUEUE') || r.exitCode !== 0) {
+        // After heal still down — empty queue while mail is down is still not "ok"
+        // unless postqueue truly succeeds with empty message
+        if (/Mail queue is empty|queue is empty/i.test(out) && r.exitCode === 0) {
+            return {
+                ok: true,
+                requiresExecute: false,
+                items: [],
+                notes: [tl('notes.auto.n0535'), ...healNotes.slice(0, 2)],
+            };
+        }
+        return {
+            ok: false,
+            requiresExecute: false,
+            items: [],
+            notes: [classifyQueueError(out), ...healNotes.slice(0, 3), out.slice(0, 500)],
+        };
+    }
+    if (/Mail queue is empty|queue is empty/i.test(out)) {
+        return {
+            ok: true,
+            requiresExecute: false,
+            items: [],
+            notes: [tl('notes.auto.n0535'), ...healNotes.slice(0, 2)],
+        };
+    }
+    const items = [];
+    for (const line of out.split('\n')) {
+        const m = line.match(/^([A-F0-9]+)\s+/i);
+        if (m)
+            items.push({ id: m[1], raw: line.trim() });
+    }
+    return {
+        ok: true,
+        requiresExecute: false,
+        items,
+        notes: [
+            tl('notes.auto.t0079', { v0: items.length }),
+            ...healNotes.slice(0, 2),
+        ],
+    };
+}
+export async function flushMailQueue(host, opts) {
+    if (!host.executeEnabled()) {
+        return {
+            ok: false,
+            blocked: true,
+            requiresExecute: true,
+            items: [],
+            notes: [tl('notes.auto.n1175')],
+        };
+    }
+    const runFlush = async () => {
+        if (opts?.all) {
+            const r = await host.runCommand(['bash', '-c', 'postsuper -d ALL 2>&1'], {
+                timeoutMs: 30_000,
+            });
+            return {
+                exitCode: r.exitCode,
+                out: (r.stdout || r.stderr || '').trim(),
+            };
+        }
+        if (opts?.id) {
+            const id = opts.id.replace(/[^A-Za-z0-9]/g, '');
+            const r = await host.runCommand(['bash', '-c', `postsuper -d ${JSON.stringify(id)} 2>&1`], { timeoutMs: 15_000 });
+            return {
+                exitCode: r.exitCode,
+                out: (r.stdout || r.stderr || '').trim(),
+            };
+        }
+        return { exitCode: 1, out: '' };
+    };
+    if (!opts?.all && !opts?.id) {
+        return { ok: false, requiresExecute: false, items: [], notes: [tl('notes.auto.n1561')] };
+    }
+    let { exitCode, out } = await runFlush();
+    const healNotes = [];
+    if (exitCode !== 0 && needsPostfixQueueHeal(out)) {
+        const heal = await tryHealPostfixQueue(host, out);
+        healNotes.push(...heal.notes);
+        if (heal.healed) {
+            ({ exitCode, out } = await runFlush());
+        }
+    }
+    if (opts?.all) {
+        return {
+            ok: exitCode === 0,
+            requiresExecute: false,
+            items: [],
+            flushed: exitCode === 0 ? -1 : 0,
+            notes: exitCode === 0
+                ? [tl('notes.auto.n0786'), ...healNotes.slice(0, 2)]
+                : [
+                    tl('notes.auto.t0080', { v0: out || 'postsuper failed' }),
+                    ...healNotes.slice(0, 3),
+                    classifyQueueError(out),
+                ],
+        };
+    }
+    const id = String(opts?.id ?? '').replace(/[^A-Za-z0-9]/g, '');
+    return {
+        ok: exitCode === 0,
+        requiresExecute: false,
+        items: [],
+        flushed: exitCode === 0 ? 1 : 0,
+        notes: exitCode === 0
+            ? [tl('notes.tpl.deleted', { name: id }), ...healNotes.slice(0, 2)]
+            : [
+                tl('notes.tpl.failedColon', { detail: out || 'postsuper failed' }),
+                ...healNotes.slice(0, 3),
+                classifyQueueError(out),
+            ],
+    };
+}
+//# sourceMappingURL=mail-queue.js.map

package/dist/email/mail-queue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail-queue.js","sourceRoot":"","sources":["../../src/email/mail-queue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAkBvC,SAAS,qBAAqB,CAAC,GAAW;IACxC,OAAO,CACL,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QACzB,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAClB,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC5B,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;QAChC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC1B,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,CACvC,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC,mCAAmC,CAAC,CAAC;IAC9E,IAAI,4CAA4C,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,CAAC,+BAA+B,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,CAAC,mCAAmC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,CAAC,kBAAkB,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,IAAkB,EAClB,GAAW;IAEX,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,4BAA4B,EAAE,GAAG,MAAM,MAAM,CACnD,iCAAiC,CAClC,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,4BAA4B,CAAC,IAAI,CAAC,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACzD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,KAAK,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACnD,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAkB;IACpD,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,IAAI;YACrB,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;SAChC,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAC;IAC1F,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,eAAe,EAAE,KAAK;YACtB,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,cAAc,CAAC;SAChD,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,IAAI,EAAE,CAC9B,IAAI,CAAC,UAAU,CACb;QACE,MAAM;QACN,IAAI;QACJ,MAAM,cAAc,CAAC,WAAW,CAAC,sDAAsD;KACxF,EACD,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;IAEJ,IAAI,CAAC,GAAG,MAAM,YAAY,EAAE,CAAC;IAC7B,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,IACE,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAChF,qBAAqB,CAAC,GAAG,CAAC,EAC1B,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClD,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,CAAC,GAAG,MAAM,YAAY,EAAE,CAAC;YACzB,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACrD,2EAA2E;QAC3E,qDAAqD;QACrD,IAAI,qCAAqC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,eAAe,EAAE,KAAK;gBACtB,KAAK,EAAE,EAAE;gBACT,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;aAC1D,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,eAAe,EAAE,KAAK;YACtB,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC9E,CAAC;IACJ,CAAC;IACD,IAAI,qCAAqC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,eAAe,EAAE,KAAK;YACtB,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;SAC1D,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAuC,EAAE,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACzC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,eAAe,EAAE,KAAK;QACtB,KAAK;QACL,KAAK,EAAE;YACL,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5C,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACzB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAkB,EAClB,IAAqC;IAErC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,IAAI;YACrB,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,IAAgD,EAAE;QACtE,IAAI,IAAI,EAAE,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,uBAAuB,CAAC,EAAE;gBACvE,SAAS,EAAE,MAAM;aAClB,CAAC,CAAC;YACH,OAAO;gBACL,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;aACzC,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC;YACb,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;YAChD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAC7B,CAAC,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,EACzD,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;YACF,OAAO;gBACL,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;aACzC,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IAClC,CAAC,CAAC;IAEF,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;IAC3F,CAAC;IAED,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;IACzC,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,IAAI,QAAQ,KAAK,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClD,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,IAAI,IAAI,EAAE,GAAG,EAAE,CAAC;QACd,OAAO;YACL,EAAE,EAAE,QAAQ,KAAK,CAAC;YAClB,eAAe,EAAE,KAAK;YACtB,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAChC,KAAK,EACH,QAAQ,KAAK,CAAC;gBACZ,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACpD,CAAC,CAAC;oBACE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,GAAG,IAAI,kBAAkB,EAAE,CAAC;oBACzD,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;oBACxB,kBAAkB,CAAC,GAAG,CAAC;iBACxB;SACR,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAC/D,OAAO;QACL,EAAE,EAAE,QAAQ,KAAK,CAAC;QAClB,eAAe,EAAE,KAAK;QACtB,KAAK,EAAE,EAAE;QACT,OAAO,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,KAAK,EACH,QAAQ,KAAK,CAAC;YACZ,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnE,CAAC,CAAC;gBACE,EAAE,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,kBAAkB,EAAE,CAAC;gBAClE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxB,kBAAkB,CAAC,GAAG,CAAC;aACxB;KACR,CAAC;AACJ,CAAC"}

package/dist/email/mail-tls-apply.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Bind Let's Encrypt (or existing) cert paths into Postfix/Dovecot for mail hostnames.
+ * Does not run certbot — only applies paths when files already exist (D7 polish).
+ */
+import type { HostExecutor } from '../host/executor.js';
+export type MailTlsApplyResult = {
+    ok: boolean;
+    blocked?: boolean;
+    blockMessage?: string;
+    notes: string[];
+    certBase?: string;
+    mailHost: string;
+    applied: boolean;
+    steps: Array<{
+        name: string;
+        status: 'ok' | 'skipped' | 'failed';
+        detail?: string;
+    }>;
+};
+/**
+ * Apply TLS paths for mail.<domain> (default) or explicit hostname.
+ */
+export declare function applyMailTlsPaths(input: {
+    host: HostExecutor;
+    domain: string;
+    /** Defaults to mail.<domain> */
+    mailHost?: string;
+    /** Also set Dovecot ssl_cert/ssl_key via doveconf if possible */
+    applyDovecot?: boolean;
+}): Promise<MailTlsApplyResult>;
+//# sourceMappingURL=mail-tls-apply.d.ts.map

package/dist/email/mail-tls-apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail-tls-apply.d.ts","sourceRoot":"","sources":["../../src/email/mail-tls-apply.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,IAAI,GAAG,SAAS,GAAG,QAAQ,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtF,CAAC;AAcF;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAgI9B"}