v5.1.1

fix(release): no changes
v5.1.0
2026-02-11 10:16:30 +00:00 · 2026-02-11 10:16:30 +00:00 · 2026-02-11 10:11:43 +00:00 · 2026-02-11 10:11:43 +00:00 · 2026-02-11 07:55:28 +00:00 · 2026-02-11 07:55:28 +00:00
83 changed files with 6114 additions and 11660 deletions
--- a/changelog.md
+++ b/changelog.md
@@ -1,5 +1,74 @@
 # Changelog
 ## 2026-02-11 - 5.1.1 - fix(release)
 no changes
 - No files changed in this commit.
 - Current package version remains 5.1.0 (from package.json).
 ## 2026-02-11 - 5.1.0 - feat(mailer-smtp)
 add SCRAM-SHA-256 auth, Ed25519 DKIM, opportunistic TLS, SNI cert selection, pipelining and delivery/bridge improvements
 - Add server-side SCRAM-SHA-256 implementation in Rust (scram.rs) and wire up SCRAM credential request/response between Rust and TypeScript bridge (ScramCredentialRequest / scramCredentialResult).
 - Support SCRAM-SHA-256 auth mechanism in SMTP command parsing and advertise AUTH PLAIN LOGIN SCRAM-SHA-256 capability.
 - Add opportunistic TLS mode for MTA-to-MTA delivery: configurable tls_opportunistic flag, an OpportunisticVerifier that skips cert verification per RFC 7435, and plumbing into connect/upgrade TLS paths.
 - Add pipelined envelope support for MAIL FROM + multiple RCPT TO (send_pipelined_envelope) and use pipelining when server advertises PIPELINING to improve outbound performance.
 - Add Ed25519 DKIM signing support and auto-dispatch: sign_dkim_ed25519, sign_dkim_auto, dkim_dns_record_value_typed, and TS changes to detect key type and call the auto signing API.
 - Expose additional per-domain TLS certs (additionalTlsCerts) and implement SNI-based certificate resolver on the server to select certs by hostname; parsing helpers and fallback default cert handling included.
 - Install ring crypto provider early in mailer-bin main for rustls operations and add related rust dependencies (sha2, hmac, pbkdf2) and workspace entries.
 - TypeScript delivery and server bridge changes: group recipients by domain, MX resolution fallback to A record, MTA delivery loop over MX hosts, DKIM options propagation, TLS opportunistic option passed to outbound client, SCRAM credential computation in TS using PBKDF2/HMAC/SHA256 and sending results back to Rust.
 - Add new tests and utilities: IPv6 DNSBL support and tests, SCRAM unit tests, DKIM Ed25519 tests, node-level MTA delivery integration test, and various test updates.
 - Public API additions on the Rust <-> TS bridge: signDkim accepts keyType, new scram credential result command, onScramCredentialRequest/onScramCredentialResult helpers and sendScramCredentialResult.
 - Various refactors and safety/feature improvements across mailer-core/smtp/security: envelope handling, stream buffering detection, and error handling for auth flows.
 ## 2026-02-11 - 5.0.0 - BREAKING CHANGE(mail)
 remove DMARC and DKIM verifier implementations and MTA error classes; introduce DkimManager and EmailActionExecutor; simplify SPF verifier and update routing exports and tests
 - Removed ts/mail/security/classes.dmarcverifier.ts and ts/mail/security/classes.dkimverifier.ts — DMARC and DKIM verifier implementations deleted
 - Removed ts/errors/index.ts — MTA-specific error classes removed
 - Added ts/mail/routing/classes.dkim.manager.ts — new DKIM key management and rotation logic
 - Added ts/mail/routing/classes.email.action.executor.ts — centralized email action execution (forward/process/deliver/reject)
 - Updated ts/mail/security/classes.spfverifier.ts to retain SPF parsing but removed verify/verifyAndApply logic delegating to Rust bridge
 - Updated ts/mail/routing/index.ts to export new routing classes and adjusted import paths (e.g. delivery queue import updated)
 - Tests trimmed: DMARC tests and rate limiter tests removed; SPF parsing test retained and simplified
 - This set of changes alters public exports and removes previously available verifier APIs — major version bump recommended
 ## 2026-02-11 - 4.1.1 - fix(readme)
 clarify architecture and IPC, document outbound flow and testing, and update module and crate descriptions in README
 - Changed IPC description to JSON-over-stdin/stdout (clarifies communication format between Rust and TypeScript)
 - Added Rust SMTP client entry and documented outbound mail data flow (TypeScript -> Rust signing/delivery -> result back)
 - Expanded testing instructions with commands for building Rust binary and running unit/E2E tests
 - Updated architecture diagram labels and Rust crate/module descriptions (mailer-smtp now includes client; test counts noted)
 - Documentation-only changes; no source code behavior modified
 ## 2026-02-11 - 4.1.0 - feat(e2e-tests)
 add Node.js end-to-end tests covering server lifecycle, inbound SMTP handling, outbound delivery and routing actions
 - Adds four end-to-end test files: test.e2e.server-lifecycle.node.ts, test.e2e.inbound-smtp.node.ts, test.e2e.outbound-delivery.node.ts, test.e2e.routing-actions.node.ts
 - Tests exercise UnifiedEmailServer start/stop, SMTP handshake and transactions, outbound delivery via a mock SMTP server, routing actions (process, deliver, reject, forward), concurrency, and RSET handling mid-session
 - Introduces a minimal mock SMTP server to avoid IPC deadlock with the Rust SMTP client during outbound delivery tests
 - Tests will skip when the Rust bridge or server cannot start (binary build required)
 ## 2026-02-11 - 4.0.0 - BREAKING CHANGE(smtp-client)
 Replace the legacy TypeScript SMTP client with a new Rust-based SMTP client and IPC bridge for outbound delivery
 - Introduce a Rust SMTP client crate with connection handling, TLS, protocol engine, and connection pooling (new modules: connection, pool, protocol, error, config).
 - Add IPC handlers and management commands in the Rust binary: sendEmail, sendRawEmail, verifySmtpConnection, closeSmtpPool, getSmtpPoolStatus and integrate a SmtpClientManager into the runtime.
 - Update TypeScript bridge (RustSecurityBridge) with new types and methods (ISmtpSendOptions, ISmtpSendResult, verifySmtpConnection, sendOutboundEmail, sendRawEmail, getSmtpPoolStatus, closeSmtpPool) and rework UnifiedEmailServer to use the Rust bridge for outbound delivery and DKIM signing.
 - Remove the previous TypeScript SMTP client implementation and associated tests/utilities (many ts/mail/delivery/smtpclient modules and tests deleted) in favor of the Rust implementation.
 - Bump dependencies and cargo config: @push.rocks/smartrust to ^1.2.0 in package.json and add/require crates (uuid, base64, webpki-roots) in Rust Cargo files.
 ## 2026-02-10 - 3.0.0 - BREAKING CHANGE(security)
 implement resilience and lifecycle management for RustSecurityBridge (auto-restart, health checks, state machine and eventing); remove legacy TS SMTP test helper and DNSManager; remove deliverability IP-warmup/sender-reputation integrations and related types; drop unused dependencies
 - RustSecurityBridge now extends EventEmitter and includes a BridgeState state machine, IBridgeResilienceConfig with DEFAULT_RESILIENCE_CONFIG, auto-restart with exponential backoff, periodic health checks, restart/restore logic, and descriptive ensureRunning() guards on command methods.
 - Added static methods: resetInstance() (test-friendly) and configure(...) to tweak resilience settings at runtime.
 - Added stateChange events and logging for lifecycle transitions; new tests added for resilience: test/test.rustsecuritybridge.resilience.node.ts.
 - Removed the TypeScript SMTP test helper (test/helpers/server.loader.ts), the DNSManager (ts/mail/routing/classes.dnsmanager.ts), and many deliverability-related interfaces/implementations (IP warmup manager and sender reputation monitor) from unified email server.
 - Removed public types ISmtpServerOptions and ISmtpTransactionResult from ts/mail/delivery/interfaces.ts, which is a breaking API change for consumers relying on those types.
 - Removed unused dependencies from package.json: ip and mailauth.
 ## 2026-02-10 - 2.4.0 - feat(docs)
 document Rust-side in-process security pipeline and update README to reflect SMTP server behavior and crate/test counts
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@push.rocks/smartmta",
-  "version": "2.4.0",
+  "version": "5.1.1",
  "description": "A high-performance, enterprise-grade Mail Transfer Agent (MTA) built from scratch in TypeScript with Rust acceleration.",
  "keywords": [
    "mta",
@@ -44,36 +44,14 @@
    "tsx": "^4.21.0"
  },
  "dependencies": {
    "@api.global/typedrequest": "^3.2.5",
    "@api.global/typedserver": "^8.3.0",
    "@api.global/typedsocket": "^4.1.0",
    "@apiclient.xyz/cloudflare": "^7.1.0",
    "@push.rocks/projectinfo": "^5.0.1",
    "@push.rocks/qenv": "^6.1.0",
    "@push.rocks/smartacme": "^8.0.0",
    "@push.rocks/smartdata": "^7.0.15",
    "@push.rocks/smartdns": "^7.5.0",
    "@push.rocks/smartfile": "^13.1.2",
    "@push.rocks/smartfs": "^1.3.1",
    "@push.rocks/smartguard": "^3.1.0",
    "@push.rocks/smartjwt": "^2.2.1",
    "@push.rocks/smartlog": "^3.1.8",
    "@push.rocks/smartmail": "^2.2.0",
    "@push.rocks/smartmetrics": "^2.0.10",
    "@push.rocks/smartnetwork": "^4.0.2",
    "@push.rocks/smartpath": "^6.0.0",
-    "@push.rocks/smartpromise": "^4.0.3",
+    "@push.rocks/smartrust": "^1.2.0",
    "@push.rocks/smartproxy": "^23.1.0",
    "@push.rocks/smartrequest": "^5.0.1",
    "@push.rocks/smartrule": "^2.0.1",
    "@push.rocks/smartrust": "^1.1.1",
    "@push.rocks/smartrx": "^3.0.10",
    "@push.rocks/smartunique": "^3.0.9",
    "@serve.zone/interfaces": "^5.0.4",
    "@tsclass/tsclass": "^9.2.0",
    "ip": "^2.0.1",
    "lru-cache": "^11.2.5",
    "mailauth": "^4.13.0",
    "mailparser": "^3.9.3",
    "uuid": "^13.0.0"
  },
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
--- a/readme.md
+++ b/readme.md
@@ -18,14 +18,14 @@ After installation, run `pnpm build` to compile the Rust binary (`mailer-bin`).
 ## Overview
-`@push.rocks/smartmta` is a **complete mail server solution** — SMTP server, SMTP client, email security, content scanning, and delivery management — all built with a custom SMTP implementation. The SMTP server itself runs as a Rust binary for maximum performance, communicating with the TypeScript orchestration layer via IPC.
+`@push.rocks/smartmta` is a **complete mail server solution** — SMTP server, SMTP client, email security, content scanning, and delivery management — all built with a custom SMTP implementation. The SMTP engine runs as a Rust binary for maximum performance, communicating with the TypeScript orchestration layer via JSON-over-stdin/stdout IPC.
 ### ⚡ What's Inside
 | Module | What It Does |
 |---|---|
-| **Rust SMTP Server** | High-performance SMTP engine written in Rust — TCP/TLS listener, STARTTLS, AUTH, pipelining, per-connection rate limiting |
+| **Rust SMTP Server** | High-performance SMTP engine in Rust — TCP/TLS listener, STARTTLS, AUTH, pipelining, per-connection rate limiting |
-| **SMTP Client** | Outbound delivery with connection pooling, retry logic, TLS negotiation |
+| **Rust SMTP Client** | Outbound delivery with connection pooling, retry logic, TLS negotiation, DKIM signing — all in Rust |
 | **DKIM** | Key generation, signing, and verification — per domain, with automatic rotation |
 | **SPF** | Full SPF record validation via Rust |
 | **DMARC** | Policy enforcement and verification |
@@ -37,8 +37,7 @@ After installation, run `pnpm build` to compile the Rust binary (`mailer-bin`).
 | **Delivery Queue** | Persistent queue with exponential backoff retry |
 | **Template Engine** | Email templates with variable substitution |
 | **Domain Registry** | Multi-domain management with per-domain configuration |
-| **DNS Manager** | Automatic DNS record management with Cloudflare API integration |
+| **DNS Manager** | Automatic DNS record management (MX, SPF, DKIM, DMARC) |
 | **Rust Security Bridge** | All security ops (DKIM+SPF+DMARC+DNSBL+content scanning) run in Rust via IPC |
 ### 🏗️ Architecture
@@ -52,9 +51,9 @@ After installation, run `pnpm build` to compile the Rust binary (`mailer-bin`).
 │  ┌──────┐ │ ┌───────┐ │ ┌──────────┐ │  ┌────────────────┐  │
 │  │Match │ │ │ DKIM  │ │ │ Queue    │ │  │ DomainRegistry │  │
 │  │Route │ │ │ SPF   │ │ │ Rate Lim │ │  │ DnsManager     │  │
-│  │ Act  │ │ │ DMARC │ │ │ SMTP Cli │ │  │ DKIMCreator    │  │
+│  │ Act  │ │ │ DMARC │ │ │ Retry    │ │  │ DKIMCreator    │  │
-│  └──────┘ │ │ IPRep │ │ │ Retry    │ │  │ Templates      │  │
+│  └──────┘ │ │ IPRep │ │ └──────────┘ │  │ Templates      │  │
-│           │ │ Scan  │ │ └──────────┘ │  └────────────────┘  │
+│           │ │ Scan  │ │              │  └────────────────┘  │
 │           │ └───────┘ │              │                       │
 ├───────────┴───────────┴──────────────┴───────────────────────┤
 │              Rust Security Bridge (smartrust IPC)             │
@@ -63,18 +62,25 @@ After installation, run `pnpm build` to compile the Rust binary (`mailer-bin`).
 │  ┌──────────────┐  ┌───────────────┐  ┌──────────────────┐  │
 │  │ mailer-smtp  │  │mailer-security│  │   mailer-core    │  │
 │  │ SMTP Server  │  │DKIM/SPF/DMARC │  │ Types/Validation │  │
-│  │ TLS/AUTH     │  │IP Rep/Content │  │ MIME/Bounce      │  │
+│  │ SMTP Client  │  │IP Rep/Content │  │ MIME/Bounce      │  │
 │  │ TLS/AUTH     │  │   Scanning    │  │   Detection      │  │
 │  └──────────────┘  └───────────────┘  └──────────────────┘  │
 └──────────────────────────────────────────────────────────────┘
 ```
 **Data flow for inbound mail:**
-1. Rust SMTP server accepts the connection and handles the full SMTP protocol
+1. 📨 Rust SMTP server accepts the connection and handles the full SMTP protocol
-2. On `DATA` completion, Rust runs the security pipeline **in-process** (DKIM/SPF/DMARC verification, content scanning, IP reputation check) — zero IPC round-trips
+2. 🔒 On `DATA` completion, Rust runs the security pipeline **in-process** (DKIM/SPF/DMARC verification, content scanning, IP reputation check) — zero IPC round-trips
-3. Rust emits an `emailReceived` event via IPC with pre-computed security results attached
+3. 📤 Rust emits an `emailReceived` event via IPC with pre-computed security results attached
-4. TypeScript processes the email (routing decisions using the pre-computed results, delivery)
+4. 🔀 TypeScript processes the email (routing decisions using the pre-computed results, delivery)
-5. Rust sends the final SMTP response to the client
+5. ✅ Rust sends the final SMTP response to the client
 **Data flow for outbound mail:**
 1. 📝 TypeScript constructs the email and resolves DKIM keys for the sender domain
 2. 🦀 Sends to Rust via IPC — Rust builds the RFC 2822 message, signs with DKIM, and delivers via its SMTP client with connection pooling
 3. 📬 Result (accepted/rejected recipients, server response) returned to TypeScript
 ## Usage
@@ -163,32 +169,19 @@ await emailServer.start();
 > 🔒 **Note:** `start()` will throw if the Rust binary is not compiled. Run `pnpm build` first.
-### 📧 Sending Emails with the SMTP Client
+### 📧 Sending Outbound Emails
-Create and send emails using the built-in SMTP client with connection pooling:
+All outbound email delivery goes through the Rust SMTP client, accessed via `UnifiedEmailServer.sendOutboundEmail()`. The Rust client handles connection pooling, TLS negotiation, and DKIM signing automatically:
 ```typescript
-import { Email, Delivery } from '@push.rocks/smartmta';
+import { Email, UnifiedEmailServer } from '@push.rocks/smartmta';
 // Create a client with connection pooling
 const client = Delivery.smtpClientMod.createSmtpClient({
  host: 'smtp.example.com',
  port: 587,
  secure: false,     // will upgrade via STARTTLS
  pool: true,
  maxConnections: 5,
  auth: {
    user: 'sender@example.com',
    pass: 'your-password',
  },
 });
 // Build an email
 const email = new Email({
  from: 'sender@example.com',
  to: ['recipient@example.com'],
  cc: ['cc@example.com'],
-  subject: 'Hello from smartmta!',
+  subject: 'Hello from smartmta! 🚀',
  text: 'Plain text body',
  html: '<h1>Hello!</h1><p>HTML body with <strong>formatting</strong></p>',
  priority: 'high',
@@ -201,32 +194,32 @@ const email = new Email({
  ],
 });
-// Send it
+// Send via the Rust SMTP client (connection pooling, TLS, DKIM signing)
-const result = await client.sendMail(email);
+const result = await emailServer.sendOutboundEmail('smtp.example.com', 587, email, {
-console.log(`Message sent: ${result.messageId}`);
+  auth: { user: 'sender@example.com', pass: 'your-password' },
  dkimDomain: 'example.com',
  dkimSelector: 'default',
 });
 console.log(`Accepted: ${result.accepted.join(', ')}`);
 console.log(`Response: ${result.response}`);
 // -> Accepted: recipient@example.com
 // -> Response: 2.0.0 Ok: queued
 ```
-Additional client factories are available:
+The `sendOutboundEmail` method:
 - 🔑 Automatically resolves DKIM keys from the `DKIMCreator` for the specified domain
 - 🔗 Uses connection pooling in Rust — reuses TCP/TLS connections across sends
 - ⏱️ Configurable connection and socket timeouts via `outbound` options on the server
-```typescript
+### 🔑 DKIM Signing & Key Management
 // Pooled client for high-throughput scenarios
 const pooled = Delivery.smtpClientMod.createPooledSmtpClient({ /* ... */ });
-// Optimized for bulk sending
+DKIM key management is handled by `DKIMCreator`, which generates, stores, and rotates keys per domain. Signing is performed automatically by the Rust SMTP client during outbound delivery:
 const bulk = Delivery.smtpClientMod.createBulkSmtpClient({ /* ... */ });
 // Optimized for transactional emails
 const transactional = Delivery.smtpClientMod.createTransactionalSmtpClient({ /* ... */ });
 ```
 ### 🔑 DKIM Signing
 DKIM key management is handled by `DKIMCreator`, which generates, stores, and rotates keys per domain. Signing is performed automatically by `UnifiedEmailServer` during outbound delivery:
 ```typescript
 import { DKIMCreator } from '@push.rocks/smartmta';
-const dkimCreator = new DKIMCreator('/path/to/keys');
+const dkimCreator = new DKIMCreator('/path/to/keys', storageManager);
 // Auto-generate keys if they don't exist
 await dkimCreator.handleDKIMKeysForDomain('example.com');
@@ -244,30 +237,34 @@ if (needsRotation) {
 }
 ```
-When `UnifiedEmailServer.start()` is called, DKIM signing is applied to all outbound mail automatically using the Rust security bridge's `signDkim()` method for maximum performance.
+When `UnifiedEmailServer.start()` is called:
 - DKIM keys are generated or loaded for every configured domain
 - Signing is applied to all outbound mail via the Rust security bridge
 - Key rotation is checked automatically based on your `rotationInterval` config
 ### 🛡️ Email Authentication (SPF, DKIM, DMARC)
-Verify incoming emails against all three authentication standards. All verification is powered by the Rust binary:
+All verification is powered by the Rust binary. For inbound mail, `UnifiedEmailServer` runs the full security pipeline **automatically** — DKIM, SPF, DMARC, content scanning, and IP reputation in a single Rust pass. Results are attached as headers (`Received-SPF`, `X-DKIM-Result`, `X-DMARC-Result`).
 You can also use the individual verifiers directly:
 ```typescript
 import { DKIMVerifier, SpfVerifier, DmarcVerifier } from '@push.rocks/smartmta';
-// SPF verification — first arg is an Email object
+// SPF verification
 const spfVerifier = new SpfVerifier();
 const spfResult = await spfVerifier.verify(email, senderIP, heloDomain);
-// -> { result: 'pass' | 'fail' | 'softfail' | 'neutral' | 'none' | 'temperror' | 'permerror',
+// -> { result: 'pass' | 'fail' | 'softfail' | 'neutral' | 'none', domain, ip }
 //      domain: string, ip: string }
-// DKIM verification — takes raw email content
+// DKIM verification
 const dkimVerifier = new DKIMVerifier();
 const dkimResult = await dkimVerifier.verify(rawEmailContent);
 // -> [{ is_valid: true, domain: 'example.com', selector: 'default', status: 'pass' }]
-// DMARC verification — first arg is an Email object
+// DMARC verification
 const dmarcVerifier = new DmarcVerifier();
 const dmarcResult = await dmarcVerifier.verify(email, spfResult, dkimResult);
-// -> { action: 'pass' | 'quarantine' | 'reject', hasDmarc: boolean,
+// -> { action: 'pass' | 'quarantine' | 'reject', policy, spfDomainAligned, dkimDomainAligned }
 //      spfDomainAligned: boolean, dkimDomainAligned: boolean, ... }
 ```
 ### 🔀 Email Routing
@@ -294,7 +291,7 @@ const router = new EmailRouter([
    priority: 50,
    match: {
      recipients: '*@example.com',
-      sizeRange: { max: 10 * 1024 * 1024 },  // under 10MB
+      sizeRange: { max: 10 * 1024 * 1024 }, // under 10MB
    },
    action: {
      type: 'forward',
@@ -326,7 +323,16 @@ const router = new EmailRouter([
 const matchedRoute = await router.evaluateRoutes(emailContext);
 ```
-**Match criteria available:**
+#### Route Action Types
 | Action | Description |
 |---|---|
 | `forward` | Forward the email to another SMTP server via the Rust SMTP client |
 | `deliver` | Queue for local MTA delivery |
 | `process` | Queue for processing (with optional content scanning and DKIM signing) |
 | `reject` | Reject with a configurable SMTP error code and message |
 #### Match Criteria
 | Criterion | Description |
 |---|---|
@@ -339,52 +345,6 @@ const matchedRoute = await router.evaluateRoutes(emailContext);
 | `subject` | Subject line pattern (string or RegExp) |
 | `hasAttachments` | Filter by attachment presence |
 ### 🔍 Content Scanning
 Built-in content scanner for detecting spam, phishing, malware, and other threats. Text pattern scanning runs in Rust for performance; binary attachment scanning (PE headers, VBA macros) runs in TypeScript:
 ```typescript
 import { ContentScanner } from '@push.rocks/smartmta';
 const scanner = new ContentScanner({
  scanSubject: true,
  scanBody: true,
  scanAttachments: true,
  blockExecutables: true,
  blockMacros: true,
  minThreatScore: 30,
  highThreatScore: 70,
  customRules: [
    {
      pattern: /bitcoin.*wallet/i,
      type: 'scam',
      score: 80,
      description: 'Cryptocurrency scam pattern',
    },
  ],
 });
 const result = await scanner.scanEmail(email);
 // -> { isClean: false, threatScore: 85, threatType: 'phishing', scannedElements: [...] }
 ```
 ### 🌐 IP Reputation Checking
 Check sender IP addresses against DNSBL blacklists and classify IP types. DNSBL lookups run in Rust:
 ```typescript
 import { IPReputationChecker } from '@push.rocks/smartmta';
 const ipChecker = IPReputationChecker.getInstance({
  enableDNSBL: true,
  dnsblServers: ['zen.spamhaus.org', 'bl.spamcop.net'],
  cacheTTL: 24 * 60 * 60 * 1000,  // 24 hours
 });
 const reputation = await ipChecker.checkReputation('192.168.1.1');
 // -> { score: 85, isSpam: false, isProxy: false, isTor: false, blacklists: [] }
 ```
 ### ⏱️ Rate Limiting
 Hierarchical rate limiting to protect your server and maintain deliverability:
@@ -445,7 +405,7 @@ const bounce = await bounceManager.processSmtpFailure(
 // Check if an address is suppressed due to bounces
 const suppressed = bounceManager.isEmailSuppressed('recipient@example.com');
-// Manually manage the suppression list
+// Manage the suppression list
 bounceManager.addToSuppressionList('bad@example.com', 'repeated hard bounces');
 bounceManager.removeFromSuppressionList('recovered@example.com');
 ```
@@ -484,7 +444,7 @@ const email = await templates.createEmail('welcome', {
 ### 🌍 DNS Management
-DNS record management for email authentication is handled automatically by `UnifiedEmailServer`. When the server starts, it ensures MX, SPF, DKIM, and DMARC records are in place for all configured domains via the Cloudflare API:
+When `UnifiedEmailServer.start()` is called, it automatically ensures MX, SPF, DKIM, and DMARC records are in place for all configured domains:
 ```typescript
 const emailServer = new UnifiedEmailServer(dcRouterRef, {
@@ -492,7 +452,7 @@ const emailServer = new UnifiedEmailServer(dcRouterRef, {
  domains: [
    {
      domain: 'example.com',
-      dnsMode: 'external-dns',  // managed via Cloudflare API
+      dnsMode: 'external-dns', // managed via Cloudflare API
    },
  ],
  // ... other config
@@ -506,99 +466,43 @@ const emailServer = new UnifiedEmailServer(dcRouterRef, {
 await emailServer.start();
 ```
 ### 🦀 RustSecurityBridge
 The `RustSecurityBridge` is the singleton that manages the Rust binary process. It handles security verification, content scanning, bounce detection, and the SMTP server lifecycle — all via `@push.rocks/smartrust` IPC:
 ```typescript
 import { RustSecurityBridge } from '@push.rocks/smartmta';
 const bridge = RustSecurityBridge.getInstance();
 await bridge.start();
 // Compound verification: DKIM + SPF + DMARC in a single IPC call
 const securityResult = await bridge.verifyEmail({
  rawMessage: rawEmailString,
  ip: '203.0.113.10',
  heloDomain: 'sender.example.com',
  mailFrom: 'user@example.com',
 });
 // -> { dkim: [...], spf: { result, explanation }, dmarc: { result, policy } }
 // Individual security operations
 const dkimResults = await bridge.verifyDkim(rawEmailString);
 const spfResult = await bridge.checkSpf({
  ip: '203.0.113.10',
  heloDomain: 'sender.example.com',
  mailFrom: 'user@example.com',
 });
 const reputationResult = await bridge.checkIpReputation('203.0.113.10');
 // DKIM signing
 const signed = await bridge.signDkim({
  email: rawEmailString,
  domain: 'example.com',
  selector: 'default',
  privateKeyPem: privateKey,
 });
 // Content scanning
 const scanResult = await bridge.scanContent({
  subject: 'Win a free iPhone!!!',
  body: '<a href="http://phishing.example.com">Click here</a>',
  from: 'scammer@evil.com',
 });
 // Bounce detection
 const bounceResult = await bridge.detectBounce({
  subject: 'Delivery Status Notification (Failure)',
  body: '550 5.1.1 User unknown',
  from: 'mailer-daemon@example.com',
 });
 await bridge.stop();
 ```
 > ⚠️ **Important:** The Rust bridge is **mandatory**. There are no TypeScript fallbacks. If the Rust binary is unavailable, `UnifiedEmailServer.start()` will throw an error.
 ## 🦀 Rust Acceleration Layer
-Performance-critical operations are implemented in Rust and communicate with the TypeScript runtime via `@push.rocks/smartrust` (JSON-over-stdin/stdout IPC). The Rust workspace lives at `rust/` with five crates:
+Performance-critical operations are implemented in Rust and communicate with the TypeScript runtime via `@push.rocks/smartrust` (JSON-over-stdin/stdout IPC). The Rust workspace lives at `rust/` with four crates:
 | Crate | Status | Purpose |
 |---|---|---|
 | `mailer-core` | ✅ Complete (26 tests) | Email types, validation, MIME building, bounce detection |
 | `mailer-security` | ✅ Complete (22 tests) | DKIM sign/verify, SPF, DMARC, IP reputation/DNSBL, content scanning |
-| `mailer-smtp` | ✅ Complete (77 tests) | Full SMTP protocol engine — TCP/TLS server, STARTTLS, AUTH, pipelining, in-process security pipeline, rate limiting |
+| `mailer-smtp` | ✅ Complete (106 tests) | Full SMTP protocol engine — TCP/TLS server + client, STARTTLS, AUTH, pipelining, connection pooling, in-process security pipeline |
-| `mailer-bin` | ✅ Complete | CLI + smartrust IPC bridge — security, content scanning, SMTP server lifecycle |
+| `mailer-bin` | ✅ Complete | CLI + smartrust IPC bridge — wires everything together |
 | `mailer-napi` | 🔜 Planned | Native Node.js addon (N-API) |
-### What Runs in Rust
+### What Runs Where
 | Operation | Runs In | Why |
 |---|---|---|
-| SMTP server (port listening, protocol, TLS) | Rust | Performance, memory safety, zero-copy parsing |
+| SMTP server (port listening, protocol, TLS) | 🦀 Rust | Performance, memory safety, zero-copy parsing |
-| DKIM signing & verification | Rust | Crypto-heavy, benefits from native speed |
+| SMTP client (outbound delivery, connection pooling) | 🦀 Rust | Connection management, TLS negotiation |
-| SPF validation | Rust | DNS lookups with async resolver |
+| DKIM signing & verification | 🦀 Rust | Crypto-heavy, benefits from native speed |
-| DMARC policy checking | Rust | Integrates with SPF/DKIM results |
+| SPF validation | 🦀 Rust | DNS lookups with async resolver |
-| IP reputation / DNSBL | Rust | Parallel DNS queries |
+| DMARC policy checking | 🦀 Rust | Integrates with SPF/DKIM results |
-| Content scanning (text patterns) | Rust | Regex engine performance |
+| IP reputation / DNSBL | 🦀 Rust | Parallel DNS queries |
-| Bounce detection (pattern matching) | Rust | Regex engine performance |
+| Content scanning (text patterns) | 🦀 Rust | Regex engine performance |
-| Email validation & MIME building | Rust | Parsing performance |
+| Bounce detection (pattern matching) | 🦀 Rust | Regex engine performance |
-| Binary attachment scanning | TypeScript | Buffer data too large for IPC |
+| Email validation & MIME building | 🦀 Rust | Parsing performance |
-| Email routing & orchestration | TypeScript | Business logic, flexibility |
+| Email routing & orchestration | 🟦 TypeScript | Business logic, flexibility |
-| Delivery queue & retry | TypeScript | State management, persistence |
+| Delivery queue & retry | 🟦 TypeScript | State management, persistence |
-| Template rendering | TypeScript | String interpolation |
+| Template rendering | 🟦 TypeScript | String interpolation |
 | Domain & DNS management | 🟦 TypeScript | API integrations |
-## Project Structure
+## 📁 Project Structure
 ```
 smartmta/
 ├── ts/                              # TypeScript source
 │   ├── mail/
 │   │   ├── core/                    # Email, EmailValidator, BounceManager, TemplateManager
-│   │   ├── delivery/                # DeliverySystem, Queue, RateLimiter
+│   │   ├── delivery/                # DeliveryQueue, DeliverySystem, RateLimiter
 │   │   │   └── smtpclient/          # SMTP client with connection pooling
 │   │   ├── routing/                 # UnifiedEmailServer, EmailRouter, DomainRegistry, DnsManager
 │   │   └── security/                # DKIMCreator, DKIMVerifier, SpfVerifier, DmarcVerifier
 │   └── security/                    # ContentScanner, IPReputationChecker, RustSecurityBridge
@@ -606,14 +510,56 @@ smartmta/
 │   └── crates/
 │       ├── mailer-core/             # Email types, validation, MIME, bounce detection
 │       ├── mailer-security/         # DKIM, SPF, DMARC, IP reputation, content scanning
-│       ├── mailer-smtp/             # Full SMTP server (TCP/TLS, state machine, rate limiting)
+│       ├── mailer-smtp/             # Full SMTP server + client (TCP/TLS, rate limiting, pooling)
-│       ├── mailer-bin/              # CLI + smartrust IPC bridge
+│       └── mailer-bin/              # CLI + smartrust IPC bridge
-│       └── mailer-napi/             # N-API addon (planned)
+├── test/                            # Test suite (116 TypeScript + 154 Rust tests)
 ├── test/                            # Test suite
 ├── dist_ts/                         # Compiled TypeScript output
 └── dist_rust/                       # Compiled Rust binaries
 ```
 ## 🧪 Testing
 The project has comprehensive test coverage with both unit and end-to-end tests:
 ```bash
 # Build Rust binary first
 pnpm build
 # Run all tests
 pnpm test
 # Run specific test files
 tstest test/test.e2e.server-lifecycle.node.ts --verbose --timeout 60
 tstest test/test.e2e.inbound-smtp.node.ts --verbose --timeout 60
 tstest test/test.e2e.routing-actions.node.ts --verbose --timeout 60
 tstest test/test.e2e.outbound-delivery.node.ts --verbose --timeout 60
 ```
 **E2E tests** exercise the full pipeline — starting `UnifiedEmailServer`, connecting via raw TCP sockets, sending SMTP transactions, verifying routing actions, and testing outbound delivery through a mock SMTP receiver.
 ## API Reference
 ### Exported Classes (top-level)
 | Class | Description |
 |---|---|
 | `UnifiedEmailServer` | 🎯 Main entry point — orchestrates SMTP server, routing, security, and delivery |
 | `Email` | Email message class with validation, attachments, headers, and RFC 822 serialization |
 | `EmailRouter` | Pattern-based route matching and evaluation engine |
 | `DomainRegistry` | Multi-domain configuration manager |
 | `DnsManager` | Automatic DNS record management |
 | `DKIMCreator` | DKIM key generation, storage, rotation |
 | `DKIMVerifier` | DKIM signature verification (delegates to Rust) |
 | `SpfVerifier` | SPF record validation (delegates to Rust) |
 | `DmarcVerifier` | DMARC policy enforcement (delegates to Rust) |
 ### Namespaced Exports
 | Namespace | Classes |
 |---|---|
 | `Core` | `Email`, `EmailValidator`, `TemplateManager`, `BounceManager` |
 | `Delivery` | `UnifiedDeliveryQueue`, `MultiModeDeliverySystem`, `DeliveryStatus`, `UnifiedRateLimiter` |
 ## License and Legal Information
 This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [LICENSE](./LICENSE) file.
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -274,15 +274,6 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c74b8349d32d297c9134b8c88677813a227df8f779daa29bfc29c183fe3dca6"
 [[package]]
 name = "convert_case"
 version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec182b0ca2f35d8fc196cf3404988fd8b8c739a4d270ff118a398feb0cbec1ca"
 dependencies = [
 "unicode-segmentation",
 ]
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -356,16 +347,6 @@ dependencies = [
 "typenum",
 ]
 [[package]]
 name = "ctor"
 version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a2785755761f3ddc1492979ce1e48d2c00d09311c39e4466429188f3dd6501"
 dependencies = [
 "quote",
 "syn",
 ]
 [[package]]
 name = "dashmap"
 version = "6.1.0"
@@ -913,16 +894,6 @@ version = "0.2.181"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "459427e2af2b9c839b132acb702a1c654d95e10f8c326bfc2ad11310e458b1c5"
 [[package]]
 name = "libloading"
 version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
 dependencies = [
 "cfg-if",
 "windows-link",
 ]
 [[package]]
 name = "linux-raw-sys"
 version = "0.11.0"
@@ -1004,16 +975,19 @@ dependencies = [
 name = "mailer-bin"
 version = "0.1.0"
 dependencies = [
 "base64",
 "clap",
 "dashmap",
 "hickory-resolver 0.25.2",
 "mailer-core",
 "mailer-security",
 "mailer-smtp",
 "rustls",
 "serde",
 "serde_json",
 "tokio",
 "tracing",
 "uuid",
 ]
 [[package]]
@@ -1021,48 +995,28 @@ name = "mailer-core"
 version = "0.1.0"
 dependencies = [
 "base64",
 "bytes",
 "mailparse",
 "regex",
 "serde",
 "serde_json",
 "thiserror",
 "tracing",
 "uuid",
 ]
 [[package]]
 name = "mailer-napi"
 version = "0.1.0"
 dependencies = [
 "mailer-core",
 "mailer-security",
 "mailer-smtp",
 "napi",
 "napi-build",
 "napi-derive",
 "serde",
 "serde_json",
 "tokio",
 ]
 [[package]]
 name = "mailer-security"
 version = "0.1.0"
 dependencies = [
 "hickory-resolver 0.25.2",
 "ipnet",
 "mail-auth",
 "mailer-core",
 "psl",
 "regex",
 "ring",
 "rustls-pki-types",
 "serde",
 "serde_json",
 "thiserror",
 "tokio",
 "tracing",
 ]
 [[package]]
@@ -1070,23 +1024,26 @@ name = "mailer-smtp"
 version = "0.1.0"
 dependencies = [
 "base64",
 "bytes",
 "dashmap",
 "hickory-resolver 0.25.2",
 "hmac",
 "mailer-core",
 "mailer-security",
 "mailparse",
 "pbkdf2",
 "regex",
 "rustls",
 "rustls-pemfile",
 "rustls-pki-types",
 "serde",
 "serde_json",
 "sha2",
 "thiserror",
 "tokio",
 "tokio-rustls",
 "tracing",
 "uuid",
 "webpki-roots 0.26.11",
 ]
 [[package]]
@@ -1144,66 +1101,6 @@ dependencies = [
 "uuid",
 ]
 [[package]]
 name = "napi"
 version = "2.16.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "55740c4ae1d8696773c78fdafd5d0e5fe9bc9f1b071c7ba493ba5c413a9184f3"
 dependencies = [
 "bitflags",
 "ctor",
 "napi-derive",
 "napi-sys",
 "once_cell",
 "serde",
 "serde_json",
 "tokio",
 ]
 [[package]]
 name = "napi-build"
 version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d376940fd5b723c6893cd1ee3f33abbfd86acb1cd1ec079f3ab04a2a3bc4d3b1"
 [[package]]
 name = "napi-derive"
 version = "2.16.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7cbe2585d8ac223f7d34f13701434b9d5f4eb9c332cccce8dee57ea18ab8ab0c"
 dependencies = [
 "cfg-if",
 "convert_case",
 "napi-derive-backend",
 "proc-macro2",
 "quote",
 "syn",
 ]
 [[package]]
 name = "napi-derive-backend"
 version = "1.0.75"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1639aaa9eeb76e91c6ae66da8ce3e89e921cd3885e99ec85f4abacae72fc91bf"
 dependencies = [
 "convert_case",
 "once_cell",
 "proc-macro2",
 "quote",
 "regex",
 "semver",
 "syn",
 ]
 [[package]]
 name = "napi-sys"
 version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "427802e8ec3a734331fec1035594a210ce1ff4dc5bc1950530920ab717964ea3"
 dependencies = [
 "libloading",
 ]
 [[package]]
 name = "num-conv"
 version = "0.2.0"
@@ -1543,12 +1440,6 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 [[package]]
 name = "semver"
 version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
 [[package]]
 name = "serde"
 version = "1.0.228"
@@ -1859,12 +1750,6 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "537dd038a89878be9b64dd4bd1b260315c1bb94f4d784956b81e27a088d9a09e"
 [[package]]
 name = "unicode-segmentation"
 version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
 [[package]]
 name = "untrusted"
 version = "0.9.0"
@@ -1972,6 +1857,24 @@ dependencies = [
 "unicode-ident",
 ]
 [[package]]
 name = "webpki-roots"
 version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
 dependencies = [
 "webpki-roots 1.0.6",
 ]
 [[package]]
 name = "webpki-roots"
 version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "22cfaf3c063993ff62e73cb4311efde4db1efb31ab78a3e5c457939ad5cc0bed"
 dependencies = [
 "rustls-pki-types",
 ]
 [[package]]
 name = "widestring"
 version = "1.2.1"
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -4,7 +4,6 @@ members = [
  "crates/mailer-core",
  "crates/mailer-smtp",
  "crates/mailer-security",
  "crates/mailer-napi",
  "crates/mailer-bin",
 ]
@@ -19,19 +18,17 @@ tokio-rustls = "0.26"
 hickory-resolver = "0.25"
 mail-auth = "0.7"
 mailparse = "0.16"
 napi = { version = "2", features = ["napi9", "async", "serde-json"] }
 napi-derive = "2"
 ring = "0.17"
 dashmap = "6"
 thiserror = "2"
 tracing = "0.1"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 bytes = "1"
 regex = "1"
 base64 = "0.22"
 uuid = { version = "1", features = ["v4"] }
 ipnet = "2"
 rustls-pki-types = "1"
 psl = "2"
 clap = { version = "4", features = ["derive"] }
 sha2 = "0.10"
 hmac = "0.12"
 pbkdf2 = { version = "0.12", default-features = false }
--- a/rust/crates/mailer-bin/Cargo.toml
+++ b/rust/crates/mailer-bin/Cargo.toml
@@ -19,3 +19,6 @@ serde_json.workspace = true
 clap.workspace = true
 hickory-resolver.workspace = true
 dashmap.workspace = true
 base64.workspace = true
 uuid.workspace = true
 rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
--- a/rust/crates/mailer-bin/src/main.rs
+++ b/rust/crates/mailer-bin/src/main.rs
@@ -14,7 +14,7 @@ use std::sync::Arc;
 use tokio::sync::oneshot;
 use mailer_smtp::connection::{
-    AuthResult, CallbackRegistry, ConnectionEvent, EmailProcessingResult,
+    AuthResult, CallbackRegistry, ConnectionEvent, EmailProcessingResult, ScramCredentialResult,
 };
 /// mailer-bin: Rust-powered email security tools
@@ -114,10 +114,11 @@ struct IpcEvent {
 // --- Pending callbacks for correlation-ID based reverse calls ---
-/// Stores oneshot senders for pending email processing and auth callbacks.
+/// Stores oneshot senders for pending email processing, auth, and SCRAM callbacks.
 struct PendingCallbacks {
    email: DashMap<String, oneshot::Sender<EmailProcessingResult>>,
    auth: DashMap<String, oneshot::Sender<AuthResult>>,
    scram: DashMap<String, oneshot::Sender<ScramCredentialResult>>,
 }
 impl PendingCallbacks {
@@ -125,6 +126,7 @@ impl PendingCallbacks {
        Self {
            email: DashMap::new(),
            auth: DashMap::new(),
            scram: DashMap::new(),
        }
    }
 }
@@ -147,9 +149,22 @@ impl CallbackRegistry for PendingCallbacks {
        self.auth.insert(correlation_id.to_string(), tx);
        rx
    }
    fn register_scram_callback(
        &self,
        correlation_id: &str,
    ) -> oneshot::Receiver<ScramCredentialResult> {
        let (tx, rx) = oneshot::channel();
        self.scram.insert(correlation_id.to_string(), tx);
        rx
    }
 }
 fn main() {
    // Install the ring CryptoProvider for rustls TLS operations (STARTTLS, implicit TLS).
    // This must happen before any TLS connection is attempted.
    let _ = rustls::crypto::ring::default_provider().install_default();
    let cli = Cli::parse();
    if cli.management {
@@ -327,6 +342,7 @@ struct ManagementState {
    callbacks: Arc<PendingCallbacks>,
    smtp_handle: Option<mailer_smtp::server::SmtpServerHandle>,
    smtp_event_rx: Option<tokio::sync::mpsc::Receiver<ConnectionEvent>>,
    smtp_client_manager: Arc<mailer_smtp::client::SmtpClientManager>,
 }
 /// Run in management/IPC mode for smartrust bridge.
@@ -349,10 +365,12 @@ fn run_management_mode() {
    let rt = tokio::runtime::Runtime::new().unwrap();
    let callbacks = Arc::new(PendingCallbacks::new());
    let smtp_client_manager = Arc::new(mailer_smtp::client::SmtpClientManager::new());
    let mut state = ManagementState {
        callbacks: callbacks.clone(),
        smtp_handle: None,
        smtp_event_rx: None,
        smtp_client_manager: smtp_client_manager.clone(),
    };
    // We need to read stdin in a separate thread (blocking I/O)
@@ -491,6 +509,22 @@ fn handle_smtp_event(event: ConnectionEvent) {
                }),
            );
        }
        ConnectionEvent::ScramCredentialRequest {
            correlation_id,
            session_id,
            username,
            remote_addr,
        } => {
            emit_event(
                "scramCredentialRequest",
                serde_json::json!({
                    "correlationId": correlation_id,
                    "sessionId": session_id,
                    "username": username,
                    "remoteAddr": remote_addr,
                }),
            );
        }
    }
 }
@@ -639,8 +673,13 @@ async fn handle_ipc_request(req: &IpcRequest, state: &mut ManagementState) -> Ip
                .get("privateKey")
                .and_then(|v| v.as_str())
                .unwrap_or("");
            let key_type = req
                .params
                .get("keyType")
                .and_then(|v| v.as_str())
                .unwrap_or("rsa");
-            match mailer_security::sign_dkim(raw_message.as_bytes(), domain, selector, private_key) {
+            match mailer_security::sign_dkim_auto(raw_message.as_bytes(), domain, selector, private_key, key_type) {
                Ok(header) => IpcResponse {
                    id: req.id.clone(),
                    success: true,
@@ -822,6 +861,10 @@ async fn handle_ipc_request(req: &IpcRequest, state: &mut ManagementState) -> Ip
            handle_auth_result(req, state)
        }
        "scramCredentialResult" => {
            handle_scram_credential_result(req, state)
        }
        "configureRateLimits" => {
            // Rate limit configuration is set at startSmtpServer time.
            // This command allows runtime updates, but for now we acknowledge it.
@@ -833,6 +876,28 @@ async fn handle_ipc_request(req: &IpcRequest, state: &mut ManagementState) -> Ip
            }
        }
        // --- SMTP Client commands ---
        "sendEmail" => {
            handle_send_email(req, state).await
        }
        "sendRawEmail" => {
            handle_send_raw_email(req, state).await
        }
        "verifySmtpConnection" => {
            handle_verify_smtp_connection(req, state).await
        }
        "closeSmtpPool" => {
            handle_close_smtp_pool(req, state).await
        }
        "getSmtpPoolStatus" => {
            handle_get_smtp_pool_status(req, state)
        }
        _ => IpcResponse {
            id: req.id.clone(),
            success: false,
@@ -985,6 +1050,56 @@ fn handle_auth_result(req: &IpcRequest, state: &ManagementState) -> IpcResponse
    }
 }
 /// Handle scramCredentialResult IPC command — resolves a pending SCRAM credential callback.
 fn handle_scram_credential_result(req: &IpcRequest, state: &ManagementState) -> IpcResponse {
    use base64::Engine;
    use base64::engine::general_purpose::STANDARD as BASE64;
    let correlation_id = req
        .params
        .get("correlationId")
        .and_then(|v| v.as_str())
        .unwrap_or("");
    let found = req.params.get("found").and_then(|v| v.as_bool()).unwrap_or(false);
    let result = ScramCredentialResult {
        found,
        salt: req.params.get("salt")
            .and_then(|v| v.as_str())
            .and_then(|s| BASE64.decode(s.as_bytes()).ok()),
        iterations: req.params.get("iterations")
            .and_then(|v| v.as_u64())
            .map(|n| n as u32),
        stored_key: req.params.get("storedKey")
            .and_then(|v| v.as_str())
            .and_then(|s| BASE64.decode(s.as_bytes()).ok()),
        server_key: req.params.get("serverKey")
            .and_then(|v| v.as_str())
            .and_then(|s| BASE64.decode(s.as_bytes()).ok()),
    };
    if let Some((_, tx)) = state.callbacks.scram.remove(correlation_id) {
        let _ = tx.send(result);
        IpcResponse {
            id: req.id.clone(),
            success: true,
            result: Some(serde_json::json!({"resolved": true})),
            error: None,
        }
    } else {
        IpcResponse {
            id: req.id.clone(),
            success: false,
            result: None,
            error: Some(format!(
                "No pending SCRAM credential callback for correlationId: {}",
                correlation_id
            )),
        }
    }
 }
 /// Parse SmtpServerConfig from IPC params JSON.
 fn parse_smtp_config(
    params: &serde_json::Value,
@@ -1050,5 +1165,321 @@ fn parse_smtp_config(
        config.processing_timeout_secs = timeout;
    }
    // Parse additional TLS certs for SNI
    if let Some(certs_arr) = params.get("additionalTlsCerts").and_then(|v| v.as_array()) {
        for cert_val in certs_arr {
            if let (Some(domains_arr), Some(cert_pem), Some(key_pem)) = (
                cert_val.get("domains").and_then(|v| v.as_array()),
                cert_val.get("certPem").and_then(|v| v.as_str()),
                cert_val.get("keyPem").and_then(|v| v.as_str()),
            ) {
                let domains: Vec<String> = domains_arr
                    .iter()
                    .filter_map(|v| v.as_str().map(String::from))
                    .collect();
                config.additional_tls_certs.push(mailer_smtp::config::TlsDomainCert {
                    domains,
                    cert_pem: cert_pem.to_string(),
                    key_pem: key_pem.to_string(),
                });
            }
        }
    }
    Ok(config)
 }
 // ---------------------------------------------------------------------------
 // SMTP Client IPC handlers
 // ---------------------------------------------------------------------------
 /// Structured email to build a MIME message from.
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct OutboundEmail {
    from: String,
    to: Vec<String>,
    #[serde(default)]
    cc: Vec<String>,
    #[serde(default)]
    bcc: Vec<String>,
    #[serde(default)]
    subject: String,
    #[serde(default)]
    text: String,
    #[serde(default)]
    html: Option<String>,
    #[serde(default)]
    headers: std::collections::HashMap<String, String>,
 }
 impl OutboundEmail {
    /// Convert to `mailer_core::Email` for proper RFC 5322 MIME building.
    fn to_core_email(&self) -> mailer_core::Email {
        let mut email = mailer_core::Email::new(&self.from, &self.subject, &self.text);
        for addr in &self.to {
            email.add_to(addr);
        }
        for addr in &self.cc {
            email.add_cc(addr);
        }
        for addr in &self.bcc {
            email.add_bcc(addr);
        }
        if let Some(html) = &self.html {
            email.set_html(html);
        }
        for (key, value) in &self.headers {
            email.add_header(key, value);
        }
        email
    }
    /// Build an RFC 5322 compliant message using `mailer_core::build_rfc822`.
    fn to_rfc822(&self) -> Vec<u8> {
        let email = self.to_core_email();
        match mailer_core::build_rfc822(&email) {
            Ok(msg) => msg.into_bytes(),
            Err(e) => {
                eprintln!("Failed to build RFC 822 message: {e}");
                // Fallback: minimal message
                format!(
                    "From: {}\r\nTo: {}\r\nSubject: {}\r\n\r\n{}",
                    self.from,
                    self.to.join(", "),
                    self.subject,
                    self.text
                )
                .into_bytes()
            }
        }
    }
    /// Collect all recipients (to + cc + bcc).
    fn all_recipients(&self) -> Vec<String> {
        let mut all = self.to.clone();
        all.extend(self.cc.clone());
        all.extend(self.bcc.clone());
        all
    }
 }
 /// Handle sendEmail IPC command — build MIME, optional DKIM sign, send via pool.
 async fn handle_send_email(req: &IpcRequest, state: &ManagementState) -> IpcResponse {
    // Parse client config from params
    let config: mailer_smtp::client::SmtpClientConfig = match serde_json::from_value(req.params.clone()) {
        Ok(c) => c,
        Err(e) => {
            return IpcResponse {
                id: req.id.clone(),
                success: false,
                result: None,
                error: Some(format!("Invalid config: {}", e)),
            };
        }
    };
    // Parse the email
    let email: OutboundEmail = match req.params.get("email").and_then(|v| serde_json::from_value(v.clone()).ok()) {
        Some(e) => e,
        None => {
            return IpcResponse {
                id: req.id.clone(),
                success: false,
                result: None,
                error: Some("Missing or invalid 'email' field".into()),
            };
        }
    };
    // Build raw message
    let mut raw_message = email.to_rfc822();
    // Optional DKIM signing
    if let Some(dkim_val) = req.params.get("dkim") {
        if let Ok(dkim_config) = serde_json::from_value::<mailer_smtp::client::DkimSignConfig>(dkim_val.clone()) {
            match mailer_security::sign_dkim_auto(
                &raw_message,
                &dkim_config.domain,
                &dkim_config.selector,
                &dkim_config.private_key,
                &dkim_config.key_type,
            ) {
                Ok(header) => {
                    // Prepend DKIM header to the message
                    let mut signed = header.into_bytes();
                    signed.extend_from_slice(&raw_message);
                    raw_message = signed;
                }
                Err(e) => {
                    // Log but don't fail — send unsigned
                    eprintln!("DKIM signing failed: {}", e);
                }
            }
        }
    }
    let all_recipients = email.all_recipients();
    let sender = &email.from;
    match state
        .smtp_client_manager
        .send_message(&config, sender, &all_recipients, &raw_message)
        .await
    {
        Ok(result) => IpcResponse {
            id: req.id.clone(),
            success: true,
            result: Some(serde_json::to_value(&result).unwrap()),
            error: None,
        },
        Err(e) => IpcResponse {
            id: req.id.clone(),
            success: false,
            result: None,
            error: Some(serde_json::to_string(&serde_json::json!({
                "message": e.to_string(),
                "errorType": e.error_type(),
                "retryable": e.is_retryable(),
                "smtpCode": e.smtp_code(),
            }))
            .unwrap()),
        },
    }
 }
 /// Handle sendRawEmail IPC command — send a pre-formatted message.
 async fn handle_send_raw_email(req: &IpcRequest, state: &ManagementState) -> IpcResponse {
    // Parse client config from params
    let config: mailer_smtp::client::SmtpClientConfig = match serde_json::from_value(req.params.clone()) {
        Ok(c) => c,
        Err(e) => {
            return IpcResponse {
                id: req.id.clone(),
                success: false,
                result: None,
                error: Some(format!("Invalid config: {}", e)),
            };
        }
    };
    let envelope_from = req
        .params
        .get("envelopeFrom")
        .and_then(|v| v.as_str())
        .unwrap_or("");
    let envelope_to: Vec<String> = req
        .params
        .get("envelopeTo")
        .and_then(|v| v.as_array())
        .map(|a| {
            a.iter()
                .filter_map(|v| v.as_str().map(String::from))
                .collect()
        })
        .unwrap_or_default();
    let raw_b64 = req
        .params
        .get("rawMessageBase64")
        .and_then(|v| v.as_str())
        .unwrap_or("");
    // Decode base64 message
    use base64::Engine;
    let raw_message = match base64::engine::general_purpose::STANDARD.decode(raw_b64) {
        Ok(data) => data,
        Err(e) => {
            return IpcResponse {
                id: req.id.clone(),
                success: false,
                result: None,
                error: Some(format!("Invalid base64 message: {}", e)),
            };
        }
    };
    match state
        .smtp_client_manager
        .send_message(&config, envelope_from, &envelope_to, &raw_message)
        .await
    {
        Ok(result) => IpcResponse {
            id: req.id.clone(),
            success: true,
            result: Some(serde_json::to_value(&result).unwrap()),
            error: None,
        },
        Err(e) => IpcResponse {
            id: req.id.clone(),
            success: false,
            result: None,
            error: Some(serde_json::to_string(&serde_json::json!({
                "message": e.to_string(),
                "errorType": e.error_type(),
                "retryable": e.is_retryable(),
                "smtpCode": e.smtp_code(),
            }))
            .unwrap()),
        },
    }
 }
 /// Handle verifySmtpConnection IPC command.
 async fn handle_verify_smtp_connection(
    req: &IpcRequest,
    state: &ManagementState,
 ) -> IpcResponse {
    let config: mailer_smtp::client::SmtpClientConfig = match serde_json::from_value(req.params.clone()) {
        Ok(c) => c,
        Err(e) => {
            return IpcResponse {
                id: req.id.clone(),
                success: false,
                result: None,
                error: Some(format!("Invalid config: {}", e)),
            };
        }
    };
    match state.smtp_client_manager.verify_connection(&config).await {
        Ok(result) => IpcResponse {
            id: req.id.clone(),
            success: true,
            result: Some(serde_json::to_value(&result).unwrap()),
            error: None,
        },
        Err(e) => IpcResponse {
            id: req.id.clone(),
            success: false,
            result: None,
            error: Some(e.to_string()),
        },
    }
 }
 /// Handle closeSmtpPool IPC command.
 async fn handle_close_smtp_pool(req: &IpcRequest, state: &ManagementState) -> IpcResponse {
    if let Some(pool_key) = req.params.get("poolKey").and_then(|v| v.as_str()) {
        state.smtp_client_manager.close_pool(pool_key).await;
    } else {
        state.smtp_client_manager.close_all_pools().await;
    }
    IpcResponse {
        id: req.id.clone(),
        success: true,
        result: Some(serde_json::json!({"closed": true})),
        error: None,
    }
 }
 /// Handle getSmtpPoolStatus IPC command.
 fn handle_get_smtp_pool_status(req: &IpcRequest, state: &ManagementState) -> IpcResponse {
    let pools = state.smtp_client_manager.pool_status();
    IpcResponse {
        id: req.id.clone(),
        success: true,
        result: Some(serde_json::json!({"pools": pools})),
        error: None,
    }
 }
--- a/rust/crates/mailer-core/Cargo.toml
+++ b/rust/crates/mailer-core/Cargo.toml
@@ -8,8 +8,6 @@ license.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 thiserror.workspace = true
 tracing.workspace = true
 bytes.workspace = true
 mailparse.workspace = true
 regex.workspace = true
 base64.workspace = true
--- a/rust/crates/mailer-napi/Cargo.toml
+++ b/rust/crates/mailer-napi/Cargo.toml
@@ -1,21 +0,0 @@
 [package]
 name = "mailer-napi"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
 [lib]
 crate-type = ["cdylib"]
 [dependencies]
 mailer-core = { path = "../mailer-core" }
 mailer-smtp = { path = "../mailer-smtp" }
 mailer-security = { path = "../mailer-security" }
 napi.workspace = true
 napi-derive.workspace = true
 tokio.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 [build-dependencies]
 napi-build = "2"
--- a/rust/crates/mailer-napi/build.rs
+++ b/rust/crates/mailer-napi/build.rs
@@ -1,5 +0,0 @@
 extern crate napi_build;
 fn main() {
    napi_build::setup();
 }
--- a/rust/crates/mailer-napi/src/lib.rs
+++ b/rust/crates/mailer-napi/src/lib.rs
@@ -1,15 +0,0 @@
 //! mailer-napi: N-API bindings exposing Rust mailer to Node.js/TypeScript.
 use napi_derive::napi;
 /// Returns the version of the native mailer module.
 #[napi]
 pub fn get_version() -> String {
    format!(
        "mailer-napi v{} (core: {}, smtp: {}, security: {})",
        env!("CARGO_PKG_VERSION"),
        mailer_core::version(),
        mailer_smtp::version(),
        mailer_security::version(),
    )
 }
--- a/rust/crates/mailer-security/Cargo.toml
+++ b/rust/crates/mailer-security/Cargo.toml
@@ -7,14 +7,11 @@ license.workspace = true
 [dependencies]
 mailer-core = { path = "../mailer-core" }
 mail-auth.workspace = true
 ring.workspace = true
 thiserror.workspace = true
 tracing.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 tokio.workspace = true
 hickory-resolver.workspace = true
 ipnet.workspace = true
 rustls-pki-types.workspace = true
 psl.workspace = true
 regex.workspace = true
--- a/rust/crates/mailer-security/src/content_scanner.rs
+++ b/rust/crates/mailer-security/src/content_scanner.rs
@@ -111,16 +111,18 @@ static MACRO_DOCUMENT_EXTENSIONS: LazyLock<Vec<&'static str>> = LazyLock::new(||
 // HTML helpers
 // ---------------------------------------------------------------------------
 /// Regexes for HTML text extraction (compiled once via LazyLock).
 static HTML_STYLE_RE: LazyLock<Regex> =
    LazyLock::new(|| Regex::new(r"(?is)<style[^>]*>.*?</style>").unwrap());
 static HTML_SCRIPT_RE: LazyLock<Regex> =
    LazyLock::new(|| Regex::new(r"(?is)<script[^>]*>.*?</script>").unwrap());
 static HTML_TAG_RE: LazyLock<Regex> = LazyLock::new(|| Regex::new(r"<[^>]+>").unwrap());
 /// Strip HTML tags and decode common entities to produce plain text.
 fn extract_text_from_html(html: &str) -> String {
-    // Remove style and script blocks first
+    let text = HTML_STYLE_RE.replace_all(html, " ");
-    let no_style = Regex::new(r"(?is)<style[^>]*>.*?</style>").unwrap();
+    let text = HTML_SCRIPT_RE.replace_all(&text, " ");
-    let no_script = Regex::new(r"(?is)<script[^>]*>.*?</script>").unwrap();
+    let text = HTML_TAG_RE.replace_all(&text, " ");
    let no_tags = Regex::new(r"<[^>]+>").unwrap();
    let text = no_style.replace_all(html, " ");
    let text = no_script.replace_all(&text, " ");
    let text = no_tags.replace_all(&text, " ");
    text.replace("&nbsp;", " ")
        .replace("&lt;", "<")
--- a/rust/crates/mailer-security/src/dkim.rs
+++ b/rust/crates/mailer-security/src/dkim.rs
@@ -1,4 +1,4 @@
-use mail_auth::common::crypto::{RsaKey, Sha256};
+use mail_auth::common::crypto::{Ed25519Key, RsaKey, Sha256};
 use mail_auth::common::headers::HeaderWriter;
 use mail_auth::dkim::{Canonicalization, DkimSigner};
 use mail_auth::{AuthenticatedMessage, DkimOutput, DkimResult, MessageAuthenticator};
@@ -118,9 +118,62 @@ pub fn sign_dkim(
    Ok(signature.to_header())
 }
 /// Sign a raw email message with DKIM using Ed25519-SHA256 (RFC 8463).
 ///
 /// * `raw_message` - The raw RFC 5322 message bytes
 /// * `domain` - The signing domain (d= tag)
 /// * `selector` - The DKIM selector (s= tag)
 /// * `private_key_pkcs8_der` - Ed25519 private key in PKCS#8 DER format
 ///
 /// Returns the DKIM-Signature header string to prepend to the message.
 pub fn sign_dkim_ed25519(
    raw_message: &[u8],
    domain: &str,
    selector: &str,
    private_key_pkcs8_der: &[u8],
 ) -> Result<String> {
    let ed_key = Ed25519Key::from_pkcs8_maybe_unchecked_der(private_key_pkcs8_der)
        .map_err(|e| SecurityError::Key(format!("Failed to load Ed25519 key: {}", e)))?;
    let signature = DkimSigner::from_key(ed_key)
        .domain(domain)
        .selector(selector)
        .headers(["From", "To", "Subject", "Date", "Message-ID", "MIME-Version", "Content-Type"])
        .header_canonicalization(Canonicalization::Relaxed)
        .body_canonicalization(Canonicalization::Relaxed)
        .sign(raw_message)
        .map_err(|e| SecurityError::Dkim(format!("Ed25519 DKIM signing failed: {}", e)))?;
    Ok(signature.to_header())
 }
 /// Sign a raw email message with DKIM, auto-selecting RSA or Ed25519 based on `key_type`.
 ///
 /// * `key_type` - `"rsa"` (default) or `"ed25519"`
 /// * For RSA: `private_key_pem` is a PEM-encoded RSA key
 /// * For Ed25519: `private_key_pem` is a PEM-encoded PKCS#8 Ed25519 key
 pub fn sign_dkim_auto(
    raw_message: &[u8],
    domain: &str,
    selector: &str,
    private_key_pem: &str,
    key_type: &str,
 ) -> Result<String> {
    match key_type.to_lowercase().as_str() {
        "ed25519" => {
            // Parse PEM to DER for Ed25519
            let der = rustls_pki_types::PrivatePkcs8KeyDer::from_pem_slice(private_key_pem.as_bytes())
                .map_err(|e| SecurityError::Key(format!("Failed to parse Ed25519 PEM: {}", e)))?;
            sign_dkim_ed25519(raw_message, domain, selector, der.secret_pkcs8_der())
        }
        _ => sign_dkim(raw_message, domain, selector, private_key_pem),
    }
 }
 /// Generate a DKIM DNS TXT record value for a given public key.
 ///
 /// Returns the value for a TXT record at `{selector}._domainkey.{domain}`.
 /// `key_type` should be `"rsa"` or `"ed25519"`.
 pub fn dkim_dns_record_value(public_key_pem: &str) -> String {
    // Extract the base64 content from PEM
    let key_b64: String = public_key_pem
@@ -132,6 +185,24 @@ pub fn dkim_dns_record_value(public_key_pem: &str) -> String {
    format!("v=DKIM1; h=sha256; k=rsa; p={}", key_b64)
 }
 /// Generate a DKIM DNS TXT record value with explicit key type.
 ///
 /// * `key_type` - `"rsa"` or `"ed25519"`
 pub fn dkim_dns_record_value_typed(public_key_pem: &str, key_type: &str) -> String {
    let key_b64: String = public_key_pem
        .lines()
        .filter(|line| !line.starts_with("-----"))
        .collect::<Vec<_>>()
        .join("");
    let k = match key_type.to_lowercase().as_str() {
        "ed25519" => "ed25519",
        _ => "rsa",
    };
    format!("v=DKIM1; h=sha256; k={}; p={}", k, key_b64)
 }
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -149,4 +220,42 @@ mod tests {
        let result = sign_dkim(b"From: test@example.com\r\n\r\nBody", "example.com", "mta", "not a key");
        assert!(result.is_err());
    }
    #[test]
    fn test_sign_dkim_ed25519() {
        // Generate an Ed25519 key pair using mail-auth
        let pkcs8_der = Ed25519Key::generate_pkcs8().expect("generate ed25519 key");
        let ed_key = Ed25519Key::from_pkcs8_der(&pkcs8_der).expect("parse ed25519 key");
        let _pub_key = ed_key.public_key();
        let msg = b"From: test@example.com\r\nTo: rcpt@example.com\r\nSubject: Test\r\n\r\nBody";
        let result = sign_dkim_ed25519(msg, "example.com", "ed25519sel", &pkcs8_der);
        assert!(result.is_ok());
        let header = result.unwrap();
        assert!(header.contains("a=ed25519-sha256"));
        assert!(header.contains("d=example.com"));
        assert!(header.contains("s=ed25519sel"));
    }
    #[test]
    fn test_sign_dkim_auto_dispatches() {
        // RSA with invalid key should error
        let msg = b"From: test@example.com\r\n\r\nBody";
        let result = sign_dkim_auto(msg, "example.com", "mta", "not a key", "rsa");
        assert!(result.is_err());
        // Ed25519 with invalid PEM should error
        let result = sign_dkim_auto(msg, "example.com", "mta", "not a key", "ed25519");
        assert!(result.is_err());
    }
    #[test]
    fn test_dkim_dns_record_value_typed() {
        let pem = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBg==\n-----END PUBLIC KEY-----";
        let rsa_record = dkim_dns_record_value_typed(pem, "rsa");
        assert!(rsa_record.contains("k=rsa"));
        let ed_record = dkim_dns_record_value_typed(pem, "ed25519");
        assert!(ed_record.contains("k=ed25519"));
    }
 }
--- a/rust/crates/mailer-security/src/ip_reputation.rs
+++ b/rust/crates/mailer-security/src/ip_reputation.rs
@@ -1,6 +1,6 @@
 use hickory_resolver::TokioResolver;
 use serde::{Deserialize, Serialize};
-use std::net::{IpAddr, Ipv4Addr};
+use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
 use crate::error::Result;
@@ -83,7 +83,7 @@ pub fn risk_level(score: u8) -> RiskLevel {
 /// Check an IP against DNSBL servers.
 ///
-/// * `ip` - The IP address to check (must be IPv4)
+/// * `ip` - The IP address to check (IPv4 or IPv6)
 /// * `dnsbl_servers` - DNSBL servers to query (use `DEFAULT_DNSBL_SERVERS` for defaults)
 /// * `resolver` - DNS resolver to use
 pub async fn check_dnsbl(
@@ -91,20 +91,10 @@ pub async fn check_dnsbl(
    dnsbl_servers: &[&str],
    resolver: &TokioResolver,
 ) -> Result<DnsblResult> {
-    let ipv4 = match ip {
+    let reversed = match ip {
-        IpAddr::V4(v4) => v4,
+        IpAddr::V4(v4) => reverse_ipv4(v4),
-        IpAddr::V6(_) => {
+        IpAddr::V6(v6) => reverse_ipv6(v6),
            // IPv6 DNSBL is less common; return clean result
            return Ok(DnsblResult {
                ip: ip.to_string(),
                listed_count: 0,
                listed_on: Vec::new(),
                total_checked: 0,
            });
        }
    };
    let reversed = reverse_ipv4(ipv4);
    let total = dnsbl_servers.len();
    // Query all DNSBL servers in parallel
@@ -178,6 +168,21 @@ fn reverse_ipv4(ip: Ipv4Addr) -> String {
    format!("{}.{}.{}.{}", octets[3], octets[2], octets[1], octets[0])
 }
 /// Reverse IPv6 address to nibble format for DNSBL queries.
 ///
 /// Expands to full 32-nibble hex, reverses, and dot-separates each nibble.
 /// E.g. `2001:db8::1` -> `1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2`
 fn reverse_ipv6(ip: Ipv6Addr) -> String {
    let segments = ip.segments();
    let full_hex: String = segments.iter().map(|s| format!("{:04x}", s)).collect();
    full_hex
        .chars()
        .rev()
        .map(|c| c.to_string())
        .collect::<Vec<_>>()
        .join(".")
 }
 /// Heuristic IP type classification based on well-known prefix ranges.
 /// Same heuristics as the TypeScript IPReputationChecker.
 fn classify_ip(ip: IpAddr) -> IpType {
@@ -272,6 +277,38 @@ mod tests {
        assert!(!is_valid_ipv4("not-an-ip"));
    }
    #[test]
    fn test_reverse_ipv6() {
        let ip: Ipv6Addr = "2001:0db8:0000:0000:0000:0000:0000:0001".parse().unwrap();
        assert_eq!(
            reverse_ipv6(ip),
            "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2"
        );
    }
    #[test]
    fn test_reverse_ipv6_loopback() {
        let ip: Ipv6Addr = "::1".parse().unwrap();
        assert_eq!(
            reverse_ipv6(ip),
            "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0"
        );
    }
    #[tokio::test]
    async fn test_check_dnsbl_ipv6_runs() {
        // Verify IPv6 actually goes through DNSBL queries (not skipped)
        let resolver = hickory_resolver::TokioResolver::builder_tokio()
            .map(|b| b.build())
            .unwrap();
        let ip: IpAddr = "::1".parse().unwrap();
        let result = check_dnsbl(ip, DEFAULT_DNSBL_SERVERS, &resolver).await.unwrap();
        // Loopback should not be listed on any DNSBL
        assert_eq!(result.listed_count, 0);
        // But total_checked should be > 0 — proving IPv6 was actually queried
        assert_eq!(result.total_checked, DEFAULT_DNSBL_SERVERS.len());
    }
    #[test]
    fn test_default_dnsbl_servers() {
        assert_eq!(DEFAULT_DNSBL_SERVERS.len(), 10);
--- a/rust/crates/mailer-security/src/lib.rs
+++ b/rust/crates/mailer-security/src/lib.rs
@@ -9,7 +9,7 @@ pub mod spf;
 pub mod verify;
 // Re-exports for convenience
-pub use dkim::{dkim_dns_record_value, dkim_outputs_to_results, sign_dkim, verify_dkim, DkimVerificationResult};
+pub use dkim::{dkim_dns_record_value, dkim_dns_record_value_typed, dkim_outputs_to_results, sign_dkim, sign_dkim_auto, sign_dkim_ed25519, verify_dkim, DkimVerificationResult};
 pub use dmarc::{check_dmarc, DmarcPolicy, DmarcResult};
 pub use verify::{verify_email_security, EmailSecurityResult};
 pub use error::{Result, SecurityError};
--- a/rust/crates/mailer-smtp/Cargo.toml
+++ b/rust/crates/mailer-smtp/Cargo.toml
@@ -13,13 +13,16 @@ hickory-resolver.workspace = true
 dashmap.workspace = true
 thiserror.workspace = true
 tracing.workspace = true
 bytes.workspace = true
 serde.workspace = true
-serde_json = "1"
+serde_json.workspace = true
-regex = "1"
+regex.workspace = true
-uuid = { version = "1", features = ["v4"] }
+uuid.workspace = true
 base64.workspace = true
 rustls-pki-types.workspace = true
 rustls = { version = "0.23", default-features = false, features = ["ring", "logging", "std", "tls12"] }
 rustls-pemfile = "2"
 mailparse.workspace = true
 webpki-roots = "0.26"
 sha2.workspace = true
 hmac.workspace = true
 pbkdf2.workspace = true
--- a/rust/crates/mailer-smtp/src/client/config.rs
+++ b/rust/crates/mailer-smtp/src/client/config.rs
@@ -0,0 +1,170 @@
 //! SMTP client configuration types.
 use serde::Deserialize;
 /// Configuration for connecting to an SMTP server.
 #[derive(Debug, Clone, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct SmtpClientConfig {
    /// Target SMTP server hostname.
    pub host: String,
    /// Target port (25 = SMTP, 465 = implicit TLS, 587 = submission).
    pub port: u16,
    /// Use implicit TLS (port 465). If false, STARTTLS is attempted.
    #[serde(default)]
    pub secure: bool,
    /// Domain to use in EHLO command. Defaults to "localhost".
    #[serde(default = "default_domain")]
    pub domain: String,
    /// Authentication credentials (optional).
    pub auth: Option<SmtpAuthConfig>,
    /// Connection timeout in seconds. Default: 30.
    #[serde(default = "default_connection_timeout")]
    pub connection_timeout_secs: u64,
    /// Socket read/write timeout in seconds. Default: 120.
    #[serde(default = "default_socket_timeout")]
    pub socket_timeout_secs: u64,
    /// Pool key override. Defaults to "host:port".
    pub pool_key: Option<String>,
    /// Maximum connections per pool. Default: 10.
    #[serde(default = "default_max_pool_connections")]
    pub max_pool_connections: usize,
    /// Accept invalid TLS certificates (expired, self-signed, wrong hostname).
    /// Standard for MTA-to-MTA opportunistic TLS per RFC 7435.
    /// Default: false.
    #[serde(default)]
    pub tls_opportunistic: bool,
 }
 /// Authentication configuration.
 #[derive(Debug, Clone, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct SmtpAuthConfig {
    /// Username.
    pub user: String,
    /// Password.
    pub pass: String,
    /// Method: "PLAIN" or "LOGIN". Default: "PLAIN".
    #[serde(default = "default_auth_method")]
    pub method: String,
 }
 /// DKIM signing configuration (applied before sending).
 #[derive(Debug, Clone, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct DkimSignConfig {
    /// Signing domain (e.g. "example.com").
    pub domain: String,
    /// DKIM selector (e.g. "default" or "mta").
    pub selector: String,
    /// PEM-encoded private key (RSA or Ed25519 PKCS#8).
    pub private_key: String,
    /// Key type: "rsa" (default) or "ed25519".
    #[serde(default = "default_key_type")]
    pub key_type: String,
 }
 fn default_key_type() -> String {
    "rsa".to_string()
 }
 impl SmtpClientConfig {
    /// Get the effective pool key for this config.
    pub fn effective_pool_key(&self) -> String {
        self.pool_key
            .clone()
            .unwrap_or_else(|| format!("{}:{}", self.host, self.port))
    }
 }
 fn default_domain() -> String {
    "localhost".to_string()
 }
 fn default_connection_timeout() -> u64 {
    30
 }
 fn default_socket_timeout() -> u64 {
    120
 }
 fn default_max_pool_connections() -> usize {
    10
 }
 fn default_auth_method() -> String {
    "PLAIN".to_string()
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn test_deserialize_minimal_config() {
        let json = r#"{"host":"mail.example.com","port":25}"#;
        let config: SmtpClientConfig = serde_json::from_str(json).unwrap();
        assert_eq!(config.host, "mail.example.com");
        assert_eq!(config.port, 25);
        assert!(!config.secure);
        assert_eq!(config.domain, "localhost");
        assert!(config.auth.is_none());
        assert_eq!(config.connection_timeout_secs, 30);
        assert_eq!(config.socket_timeout_secs, 120);
        assert_eq!(config.max_pool_connections, 10);
    }
    #[test]
    fn test_deserialize_full_config() {
        let json = r#"{
            "host": "smtp.gmail.com",
            "port": 465,
            "secure": true,
            "domain": "myserver.com",
            "auth": { "user": "u", "pass": "p", "method": "LOGIN" },
            "connectionTimeoutSecs": 60,
            "socketTimeoutSecs": 300,
            "poolKey": "gmail",
            "maxPoolConnections": 5
        }"#;
        let config: SmtpClientConfig = serde_json::from_str(json).unwrap();
        assert_eq!(config.host, "smtp.gmail.com");
        assert_eq!(config.port, 465);
        assert!(config.secure);
        assert_eq!(config.domain, "myserver.com");
        assert_eq!(config.connection_timeout_secs, 60);
        assert_eq!(config.socket_timeout_secs, 300);
        assert_eq!(config.effective_pool_key(), "gmail");
        assert_eq!(config.max_pool_connections, 5);
        let auth = config.auth.unwrap();
        assert_eq!(auth.user, "u");
        assert_eq!(auth.pass, "p");
        assert_eq!(auth.method, "LOGIN");
    }
    #[test]
    fn test_effective_pool_key_default() {
        let json = r#"{"host":"mx.example.com","port":587}"#;
        let config: SmtpClientConfig = serde_json::from_str(json).unwrap();
        assert_eq!(config.effective_pool_key(), "mx.example.com:587");
    }
    #[test]
    fn test_dkim_config_deserialize() {
        let json = r#"{"domain":"example.com","selector":"mta","privateKey":"-----BEGIN RSA PRIVATE KEY-----\ntest\n-----END RSA PRIVATE KEY-----"}"#;
        let dkim: DkimSignConfig = serde_json::from_str(json).unwrap();
        assert_eq!(dkim.domain, "example.com");
        assert_eq!(dkim.selector, "mta");
        assert!(dkim.private_key.contains("RSA PRIVATE KEY"));
    }
 }
--- a/rust/crates/mailer-smtp/src/client/connection.rs
+++ b/rust/crates/mailer-smtp/src/client/connection.rs
@@ -0,0 +1,260 @@
 //! TCP/TLS connection management for the SMTP client.
 use super::error::SmtpClientError;
 use std::sync::Arc;
 use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
 use tokio::net::TcpStream;
 use tokio::time::{timeout, Duration};
 use tokio_rustls::client::TlsStream;
 use tracing::debug;
 /// A client-side SMTP stream that may be plain or TLS.
 pub enum ClientSmtpStream {
    Plain(BufReader<TcpStream>),
    Tls(BufReader<TlsStream<TcpStream>>),
 }
 impl std::fmt::Debug for ClientSmtpStream {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            ClientSmtpStream::Plain(_) => write!(f, "ClientSmtpStream::Plain"),
            ClientSmtpStream::Tls(_) => write!(f, "ClientSmtpStream::Tls"),
        }
    }
 }
 impl ClientSmtpStream {
    /// Read a line from the stream (CRLF-terminated).
    pub async fn read_line(&mut self, buf: &mut String) -> Result<usize, SmtpClientError> {
        match self {
            ClientSmtpStream::Plain(reader) => reader.read_line(buf).await.map_err(|e| {
                SmtpClientError::ConnectionError {
                    message: format!("Read error: {e}"),
                }
            }),
            ClientSmtpStream::Tls(reader) => reader.read_line(buf).await.map_err(|e| {
                SmtpClientError::ConnectionError {
                    message: format!("TLS read error: {e}"),
                }
            }),
        }
    }
    /// Write bytes to the stream.
    pub async fn write_all(&mut self, data: &[u8]) -> Result<(), SmtpClientError> {
        match self {
            ClientSmtpStream::Plain(reader) => {
                reader.get_mut().write_all(data).await.map_err(|e| {
                    SmtpClientError::ConnectionError {
                        message: format!("Write error: {e}"),
                    }
                })
            }
            ClientSmtpStream::Tls(reader) => {
                reader.get_mut().write_all(data).await.map_err(|e| {
                    SmtpClientError::ConnectionError {
                        message: format!("TLS write error: {e}"),
                    }
                })
            }
        }
    }
    /// Flush the stream.
    pub async fn flush(&mut self) -> Result<(), SmtpClientError> {
        match self {
            ClientSmtpStream::Plain(reader) => {
                reader.get_mut().flush().await.map_err(|e| {
                    SmtpClientError::ConnectionError {
                        message: format!("Flush error: {e}"),
                    }
                })
            }
            ClientSmtpStream::Tls(reader) => {
                reader.get_mut().flush().await.map_err(|e| {
                    SmtpClientError::ConnectionError {
                        message: format!("TLS flush error: {e}"),
                    }
                })
            }
        }
    }
    /// Consume this stream and return the inner TcpStream (for STARTTLS upgrade).
    /// Only works on Plain streams; returns an error on TLS streams.
    pub fn into_tcp_stream(self) -> Result<TcpStream, SmtpClientError> {
        match self {
            ClientSmtpStream::Plain(reader) => Ok(reader.into_inner()),
            ClientSmtpStream::Tls(_) => Err(SmtpClientError::TlsError {
                message: "Cannot extract TcpStream from an already-TLS stream".into(),
            }),
        }
    }
 }
 /// Connect to an SMTP server via plain TCP.
 pub async fn connect_plain(
    host: &str,
    port: u16,
    timeout_secs: u64,
 ) -> Result<ClientSmtpStream, SmtpClientError> {
    debug!("Connecting to {}:{} (plain)", host, port);
    let addr = format!("{host}:{port}");
    let stream = timeout(Duration::from_secs(timeout_secs), TcpStream::connect(&addr))
        .await
        .map_err(|_| SmtpClientError::TimeoutError {
            message: format!("Connection to {addr} timed out after {timeout_secs}s"),
        })?
        .map_err(|e| SmtpClientError::ConnectionError {
            message: format!("Failed to connect to {addr}: {e}"),
        })?;
    Ok(ClientSmtpStream::Plain(BufReader::new(stream)))
 }
 /// Connect to an SMTP server via implicit TLS (port 465).
 pub async fn connect_tls(
    host: &str,
    port: u16,
    timeout_secs: u64,
    tls_opportunistic: bool,
 ) -> Result<ClientSmtpStream, SmtpClientError> {
    debug!("Connecting to {}:{} (implicit TLS)", host, port);
    let addr = format!("{host}:{port}");
    let tcp_stream = timeout(Duration::from_secs(timeout_secs), TcpStream::connect(&addr))
        .await
        .map_err(|_| SmtpClientError::TimeoutError {
            message: format!("Connection to {addr} timed out after {timeout_secs}s"),
        })?
        .map_err(|e| SmtpClientError::ConnectionError {
            message: format!("Failed to connect to {addr}: {e}"),
        })?;
    let tls_stream = perform_tls_handshake(tcp_stream, host, tls_opportunistic).await?;
    Ok(ClientSmtpStream::Tls(BufReader::new(tls_stream)))
 }
 /// Upgrade a plain TCP connection to TLS (STARTTLS).
 pub async fn upgrade_to_tls(
    stream: ClientSmtpStream,
    hostname: &str,
    tls_opportunistic: bool,
 ) -> Result<ClientSmtpStream, SmtpClientError> {
    debug!("Upgrading connection to TLS (STARTTLS) for {}", hostname);
    let tcp_stream = stream.into_tcp_stream()?;
    let tls_stream = perform_tls_handshake(tcp_stream, hostname, tls_opportunistic).await?;
    Ok(ClientSmtpStream::Tls(BufReader::new(tls_stream)))
 }
 /// A TLS certificate verifier that accepts any certificate.
 /// Used for MTA-to-MTA opportunistic TLS per RFC 7435.
 #[derive(Debug)]
 struct OpportunisticVerifier;
 impl rustls::client::danger::ServerCertVerifier for OpportunisticVerifier {
    fn verify_server_cert(
        &self,
        _end_entity: &rustls_pki_types::CertificateDer<'_>,
        _intermediates: &[rustls_pki_types::CertificateDer<'_>],
        _server_name: &rustls_pki_types::ServerName<'_>,
        _ocsp_response: &[u8],
        _now: rustls_pki_types::UnixTime,
    ) -> Result<rustls::client::danger::ServerCertVerified, rustls::Error> {
        Ok(rustls::client::danger::ServerCertVerified::assertion())
    }
    fn verify_tls12_signature(
        &self,
        _message: &[u8],
        _cert: &rustls_pki_types::CertificateDer<'_>,
        _dss: &rustls::DigitallySignedStruct,
    ) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
        Ok(rustls::client::danger::HandshakeSignatureValid::assertion())
    }
    fn verify_tls13_signature(
        &self,
        _message: &[u8],
        _cert: &rustls_pki_types::CertificateDer<'_>,
        _dss: &rustls::DigitallySignedStruct,
    ) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
        Ok(rustls::client::danger::HandshakeSignatureValid::assertion())
    }
    fn supported_verify_schemes(&self) -> Vec<rustls::SignatureScheme> {
        rustls::crypto::ring::default_provider()
            .signature_verification_algorithms
            .supported_schemes()
    }
 }
 /// Perform the TLS handshake on a TCP stream using webpki-roots.
 /// When `tls_opportunistic` is true, certificate verification is skipped
 /// (standard for MTA-to-MTA delivery per RFC 7435).
 async fn perform_tls_handshake(
    tcp_stream: TcpStream,
    hostname: &str,
    tls_opportunistic: bool,
 ) -> Result<TlsStream<TcpStream>, SmtpClientError> {
    let tls_config = if tls_opportunistic {
        debug!("Using opportunistic TLS (no cert verification) for {}", hostname);
        rustls::ClientConfig::builder()
            .dangerous()
            .with_custom_certificate_verifier(Arc::new(OpportunisticVerifier))
            .with_no_client_auth()
    } else {
        let mut root_store = rustls::RootCertStore::empty();
        root_store.extend(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
        rustls::ClientConfig::builder()
            .with_root_certificates(root_store)
            .with_no_client_auth()
    };
    let connector = tokio_rustls::TlsConnector::from(Arc::new(tls_config));
    let server_name = rustls_pki_types::ServerName::try_from(hostname.to_string()).map_err(|e| {
        SmtpClientError::TlsError {
            message: format!("Invalid server name '{hostname}': {e}"),
        }
    })?;
    let tls_stream = connector
        .connect(server_name, tcp_stream)
        .await
        .map_err(|e| SmtpClientError::TlsError {
            message: format!("TLS handshake with {hostname} failed: {e}"),
        })?;
    Ok(tls_stream)
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[tokio::test]
    async fn test_connect_plain_refused() {
        // Connecting to a port that's not listening should fail
        let result = connect_plain("127.0.0.1", 19999, 2).await;
        assert!(result.is_err());
        let err = result.unwrap_err();
        assert!(matches!(err, SmtpClientError::ConnectionError { .. }));
        assert!(err.is_retryable());
    }
    #[tokio::test]
    async fn test_connect_tls_refused() {
        let result = connect_tls("127.0.0.1", 19998, 2, false).await;
        assert!(result.is_err());
    }
    #[tokio::test]
    async fn test_connect_timeout() {
        // 192.0.2.1 is TEST-NET, should time out
        let result = connect_plain("192.0.2.1", 25, 1).await;
        assert!(result.is_err());
        let err = result.unwrap_err();
        // May be timeout or connection error depending on network
        assert!(err.is_retryable());
    }
 }
--- a/rust/crates/mailer-smtp/src/client/error.rs
+++ b/rust/crates/mailer-smtp/src/client/error.rs
@@ -0,0 +1,160 @@
 //! SMTP client error types.
 use serde::Serialize;
 /// Errors that can occur during SMTP client operations.
 #[derive(Debug, thiserror::Error, Serialize)]
 pub enum SmtpClientError {
    #[error("Connection error: {message}")]
    ConnectionError { message: String },
    #[error("Timeout: {message}")]
    TimeoutError { message: String },
    #[error("TLS error: {message}")]
    TlsError { message: String },
    #[error("Authentication failed: {message}")]
    AuthenticationError { message: String },
    #[error("Protocol error ({code}): {message}")]
    ProtocolError { code: u16, message: String },
    #[error("Pool exhausted: {message}")]
    PoolExhausted { message: String },
    #[error("Invalid configuration: {message}")]
    ConfigError { message: String },
 }
 impl SmtpClientError {
    /// Whether this error is retryable (temporary failure).
    /// Permanent failures (5xx, auth failures) are not retryable.
    pub fn is_retryable(&self) -> bool {
        match self {
            SmtpClientError::ConnectionError { .. } => true,
            SmtpClientError::TimeoutError { .. } => true,
            SmtpClientError::TlsError { .. } => false,
            SmtpClientError::AuthenticationError { .. } => false,
            SmtpClientError::ProtocolError { code, .. } => *code >= 400 && *code < 500,
            SmtpClientError::PoolExhausted { .. } => true,
            SmtpClientError::ConfigError { .. } => false,
        }
    }
    /// The error type as a string for IPC serialization.
    pub fn error_type(&self) -> &'static str {
        match self {
            SmtpClientError::ConnectionError { .. } => "connection",
            SmtpClientError::TimeoutError { .. } => "timeout",
            SmtpClientError::TlsError { .. } => "tls",
            SmtpClientError::AuthenticationError { .. } => "authentication",
            SmtpClientError::ProtocolError { .. } => "protocol",
            SmtpClientError::PoolExhausted { .. } => "pool_exhausted",
            SmtpClientError::ConfigError { .. } => "config",
        }
    }
    /// The SMTP code if this is a protocol error.
    pub fn smtp_code(&self) -> Option<u16> {
        match self {
            SmtpClientError::ProtocolError { code, .. } => Some(*code),
            _ => None,
        }
    }
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn test_retryable_errors() {
        assert!(SmtpClientError::ConnectionError {
            message: "refused".into()
        }
        .is_retryable());
        assert!(SmtpClientError::TimeoutError {
            message: "timed out".into()
        }
        .is_retryable());
        assert!(SmtpClientError::PoolExhausted {
            message: "full".into()
        }
        .is_retryable());
        assert!(SmtpClientError::ProtocolError {
            code: 421,
            message: "try later".into()
        }
        .is_retryable());
        assert!(SmtpClientError::ProtocolError {
            code: 450,
            message: "mailbox busy".into()
        }
        .is_retryable());
    }
    #[test]
    fn test_non_retryable_errors() {
        assert!(!SmtpClientError::AuthenticationError {
            message: "bad creds".into()
        }
        .is_retryable());
        assert!(!SmtpClientError::TlsError {
            message: "cert invalid".into()
        }
        .is_retryable());
        assert!(!SmtpClientError::ProtocolError {
            code: 550,
            message: "no such user".into()
        }
        .is_retryable());
        assert!(!SmtpClientError::ProtocolError {
            code: 554,
            message: "rejected".into()
        }
        .is_retryable());
        assert!(!SmtpClientError::ConfigError {
            message: "bad config".into()
        }
        .is_retryable());
    }
    #[test]
    fn test_error_type_strings() {
        assert_eq!(
            SmtpClientError::ConnectionError {
                message: "x".into()
            }
            .error_type(),
            "connection"
        );
        assert_eq!(
            SmtpClientError::ProtocolError {
                code: 550,
                message: "x".into()
            }
            .error_type(),
            "protocol"
        );
    }
    #[test]
    fn test_smtp_code() {
        assert_eq!(
            SmtpClientError::ProtocolError {
                code: 550,
                message: "x".into()
            }
            .smtp_code(),
            Some(550)
        );
        assert_eq!(
            SmtpClientError::ConnectionError {
                message: "x".into()
            }
            .smtp_code(),
            None
        );
    }
 }
--- a/rust/crates/mailer-smtp/src/client/mod.rs
+++ b/rust/crates/mailer-smtp/src/client/mod.rs
@@ -0,0 +1,16 @@
 //! SMTP client module for outbound email delivery.
 //!
 //! Provides connection pooling, SMTP protocol, TLS, and authentication
 //! for sending outbound emails through remote SMTP servers.
 pub mod config;
 pub mod connection;
 pub mod error;
 pub mod pool;
 pub mod protocol;
 // Re-export key types for convenience.
 pub use config::{DkimSignConfig, SmtpAuthConfig, SmtpClientConfig};
 pub use error::SmtpClientError;
 pub use pool::{SmtpClientManager, SmtpSendResult, SmtpVerifyResult};
 pub use protocol::{dot_stuff, EhloCapabilities, SmtpClientResponse};
--- a/rust/crates/mailer-smtp/src/client/pool.rs
+++ b/rust/crates/mailer-smtp/src/client/pool.rs
@@ -0,0 +1,515 @@
 //! Connection pooling for the SMTP client.
 //!
 //! Manages reusable connections per destination `host:port`.
 use super::config::SmtpClientConfig;
 use super::connection::{connect_plain, connect_tls, ClientSmtpStream};
 use super::error::SmtpClientError;
 use super::protocol::{self, EhloCapabilities};
 use dashmap::DashMap;
 use serde::Serialize;
 use std::sync::Arc;
 use std::time::Instant;
 use tokio::sync::Mutex;
 use tracing::{debug, info};
 /// Maximum age of a pooled connection (5 minutes).
 const MAX_CONNECTION_AGE_SECS: u64 = 300;
 /// Maximum idle time before a connection is reaped (30 seconds).
 const MAX_IDLE_SECS: u64 = 30;
 /// Maximum messages per pooled connection before it's recycled.
 const MAX_MESSAGES_PER_CONNECTION: u32 = 100;
 /// A pooled SMTP connection.
 pub struct PooledConnection {
    pub stream: ClientSmtpStream,
    pub capabilities: EhloCapabilities,
    pub created_at: Instant,
    pub last_used: Instant,
    pub message_count: u32,
    pub idle: bool,
 }
 /// Check if a pooled connection is stale (too old, too many messages, or idle too long).
 fn is_connection_stale(conn: &PooledConnection) -> bool {
    conn.created_at.elapsed().as_secs() > MAX_CONNECTION_AGE_SECS
        || conn.message_count >= MAX_MESSAGES_PER_CONNECTION
        || (conn.idle && conn.last_used.elapsed().as_secs() > MAX_IDLE_SECS)
 }
 /// Per-destination connection pool.
 pub struct ConnectionPool {
    connections: Vec<PooledConnection>,
    max_connections: usize,
    config: SmtpClientConfig,
 }
 impl ConnectionPool {
    fn new(config: SmtpClientConfig) -> Self {
        let max_connections = config.max_pool_connections;
        Self {
            connections: Vec::new(),
            max_connections,
            config,
        }
    }
    /// Get an idle connection or create a new one.
    async fn acquire(&mut self) -> Result<PooledConnection, SmtpClientError> {
        // Remove stale connections first
        self.cleanup_stale();
        // Find an idle connection
        if let Some(idx) = self
            .connections
            .iter()
            .position(|c| c.idle && !is_connection_stale(c))
        {
            let mut conn = self.connections.remove(idx);
            conn.idle = false;
            conn.last_used = Instant::now();
            debug!(
                "Reusing pooled connection (age={}s, msgs={})",
                conn.created_at.elapsed().as_secs(),
                conn.message_count
            );
            return Ok(conn);
        }
        // Check if we can create a new connection
        if self.connections.len() >= self.max_connections {
            return Err(SmtpClientError::PoolExhausted {
                message: format!(
                    "Pool for {} is at max capacity ({})",
                    self.config.effective_pool_key(),
                    self.max_connections
                ),
            });
        }
        // Create a new connection
        self.create_connection().await
    }
    /// Return a connection to the pool (or close it if it's expired).
    fn release(&mut self, mut conn: PooledConnection) {
        conn.message_count += 1;
        conn.last_used = Instant::now();
        conn.idle = true;
        // Don't return if it's stale
        if is_connection_stale(&conn) || self.connections.len() >= self.max_connections {
            debug!("Discarding stale/excess pooled connection");
            // Drop the connection (stream will be closed)
            return;
        }
        self.connections.push(conn);
    }
    /// Create a fresh SMTP connection and complete the handshake.
    async fn create_connection(&self) -> Result<PooledConnection, SmtpClientError> {
        let mut stream = if self.config.secure {
            connect_tls(
                &self.config.host,
                self.config.port,
                self.config.connection_timeout_secs,
                self.config.tls_opportunistic,
            )
            .await?
        } else {
            connect_plain(
                &self.config.host,
                self.config.port,
                self.config.connection_timeout_secs,
            )
            .await?
        };
        // Read greeting
        protocol::read_greeting(&mut stream, self.config.socket_timeout_secs).await?;
        // Send EHLO
        let mut capabilities =
            protocol::send_ehlo(&mut stream, &self.config.domain, self.config.socket_timeout_secs)
                .await?;
        // STARTTLS if available and not already secure
        if !self.config.secure && capabilities.starttls {
            protocol::send_starttls(&mut stream, self.config.socket_timeout_secs).await?;
            stream =
                super::connection::upgrade_to_tls(stream, &self.config.host, self.config.tls_opportunistic).await?;
            // Re-EHLO after STARTTLS — use updated capabilities for auth
            capabilities = protocol::send_ehlo(
                &mut stream,
                &self.config.domain,
                self.config.socket_timeout_secs,
            )
            .await?;
        }
        // Authenticate if credentials provided
        if let Some(auth) = &self.config.auth {
            protocol::authenticate(
                &mut stream,
                auth,
                &capabilities,
                self.config.socket_timeout_secs,
            )
            .await?;
        }
        info!(
            "New SMTP connection to {} established",
            self.config.effective_pool_key()
        );
        Ok(PooledConnection {
            stream,
            capabilities,
            created_at: Instant::now(),
            last_used: Instant::now(),
            message_count: 0,
            idle: false,
        })
    }
    fn cleanup_stale(&mut self) {
        self.connections.retain(|c| !is_connection_stale(c));
    }
    /// Number of connections in the pool.
    fn total(&self) -> usize {
        self.connections.len()
    }
    /// Number of idle connections.
    fn idle_count(&self) -> usize {
        self.connections.iter().filter(|c| c.idle).count()
    }
    /// Close all connections.
    fn close_all(&mut self) {
        self.connections.clear();
    }
 }
 /// Status report for a single pool.
 #[derive(Debug, Clone, Serialize)]
 pub struct PoolStatus {
    pub total: usize,
    pub active: usize,
    pub idle: usize,
 }
 /// Manages connection pools for multiple SMTP destinations.
 pub struct SmtpClientManager {
    pools: DashMap<String, Arc<Mutex<ConnectionPool>>>,
 }
 impl SmtpClientManager {
    pub fn new() -> Self {
        Self {
            pools: DashMap::new(),
        }
    }
    /// Get or create a pool for the given config.
    fn get_pool(&self, config: &SmtpClientConfig) -> Arc<Mutex<ConnectionPool>> {
        let key = config.effective_pool_key();
        self.pools
            .entry(key)
            .or_insert_with(|| Arc::new(Mutex::new(ConnectionPool::new(config.clone()))))
            .clone()
    }
    /// Acquire a connection from the pool, send a message, and release it.
    pub async fn send_message(
        &self,
        config: &SmtpClientConfig,
        sender: &str,
        recipients: &[String],
        message: &[u8],
    ) -> Result<SmtpSendResult, SmtpClientError> {
        let pool_arc = self.get_pool(config);
        let mut pool = pool_arc.lock().await;
        let mut conn = pool.acquire().await?;
        drop(pool); // Release the pool lock while we do network I/O
        // Reset server state if reusing a connection that has already sent messages
        if conn.message_count > 0 {
            protocol::send_rset(&mut conn.stream, config.socket_timeout_secs).await?;
        }
        // Perform the SMTP transaction (use pipelining if server supports it)
        let pipelining = conn.capabilities.pipelining;
        let result =
            Self::perform_send(&mut conn.stream, sender, recipients, message, config, pipelining).await;
        // Re-acquire the pool lock and release the connection
        let mut pool = pool_arc.lock().await;
        match &result {
            Ok(_) => pool.release(conn),
            Err(_) => {
                // Don't return failed connections to the pool
                debug!("Discarding connection after send failure");
            }
        }
        result
    }
    /// Perform the SMTP send transaction on a connected stream.
    async fn perform_send(
        stream: &mut ClientSmtpStream,
        sender: &str,
        recipients: &[String],
        message: &[u8],
        config: &SmtpClientConfig,
        pipelining: bool,
    ) -> Result<SmtpSendResult, SmtpClientError> {
        let timeout_secs = config.socket_timeout_secs;
        let (accepted, rejected) = if pipelining {
            // Use pipelined envelope: MAIL FROM + all RCPT TO in one batch
            let (_mail_ok, acc, rej) = protocol::send_pipelined_envelope(
                stream, sender, recipients, timeout_secs,
            ).await?;
            (acc, rej)
        } else {
            // Sequential: MAIL FROM, then each RCPT TO
            protocol::send_mail_from(stream, sender, timeout_secs).await?;
            let mut accepted = Vec::new();
            let mut rejected = Vec::new();
            for rcpt in recipients {
                match protocol::send_rcpt_to(stream, rcpt, timeout_secs).await {
                    Ok(resp) => {
                        if resp.is_success() {
                            accepted.push(rcpt.clone());
                        } else {
                            rejected.push(rcpt.clone());
                        }
                    }
                    Err(_) => {
                        rejected.push(rcpt.clone());
                    }
                }
            }
            (accepted, rejected)
        };
        // If no recipients were accepted, fail
        if accepted.is_empty() {
            return Err(SmtpClientError::ProtocolError {
                code: 550,
                message: "All recipients were rejected".into(),
            });
        }
        // DATA
        let data_resp = protocol::send_data(stream, message, timeout_secs).await?;
        // Extract message ID from the response if present
        let message_id = data_resp
            .lines
            .iter()
            .find_map(|line| {
                // Look for a pattern like "queued as XXXX" or message-id
                if line.contains("queued") || line.contains("id=") {
                    Some(line.clone())
                } else {
                    None
                }
            });
        Ok(SmtpSendResult {
            accepted,
            rejected,
            message_id,
            response: data_resp.full_message(),
            envelope: SmtpEnvelope {
                from: sender.to_string(),
                to: recipients.to_vec(),
            },
        })
    }
    /// Verify connectivity to an SMTP server (connect, EHLO, QUIT).
    pub async fn verify_connection(
        &self,
        config: &SmtpClientConfig,
    ) -> Result<SmtpVerifyResult, SmtpClientError> {
        let mut stream = if config.secure {
            connect_tls(
                &config.host,
                config.port,
                config.connection_timeout_secs,
                config.tls_opportunistic,
            )
            .await?
        } else {
            connect_plain(
                &config.host,
                config.port,
                config.connection_timeout_secs,
            )
            .await?
        };
        let greeting = protocol::read_greeting(&mut stream, config.socket_timeout_secs).await?;
        let caps =
            protocol::send_ehlo(&mut stream, &config.domain, config.socket_timeout_secs).await?;
        let _ = protocol::send_quit(&mut stream, config.socket_timeout_secs).await;
        Ok(SmtpVerifyResult {
            reachable: true,
            greeting: Some(greeting.full_message()),
            capabilities: Some(caps.extensions),
        })
    }
    /// Get status of all pools.
    pub fn pool_status(&self) -> std::collections::HashMap<String, PoolStatus> {
        let mut result = std::collections::HashMap::new();
        for entry in self.pools.iter() {
            let key = entry.key().clone();
            // Try to get the lock without blocking — if locked, report as active
            match entry.value().try_lock() {
                Ok(pool) => {
                    let total = pool.total();
                    let idle = pool.idle_count();
                    result.insert(
                        key,
                        PoolStatus {
                            total,
                            active: total - idle,
                            idle,
                        },
                    );
                }
                Err(_) => {
                    // Pool is in use; report as busy
                    result.insert(
                        key,
                        PoolStatus {
                            total: 0,
                            active: 1,
                            idle: 0,
                        },
                    );
                }
            }
        }
        result
    }
    /// Close a specific pool.
    pub async fn close_pool(&self, key: &str) {
        if let Some(pool_ref) = self.pools.get(key) {
            let mut pool = pool_ref.lock().await;
            pool.close_all();
        }
        self.pools.remove(key);
    }
    /// Close all pools.
    pub async fn close_all_pools(&self) {
        let keys: Vec<String> = self.pools.iter().map(|e| e.key().clone()).collect();
        for key in keys {
            self.close_pool(&key).await;
        }
    }
 }
 /// Result of sending an email via SMTP.
 #[derive(Debug, Clone, Serialize)]
 pub struct SmtpSendResult {
    pub accepted: Vec<String>,
    pub rejected: Vec<String>,
    #[serde(rename = "messageId")]
    pub message_id: Option<String>,
    pub response: String,
    pub envelope: SmtpEnvelope,
 }
 /// SMTP envelope (sender + recipients).
 #[derive(Debug, Clone, Serialize)]
 pub struct SmtpEnvelope {
    pub from: String,
    pub to: Vec<String>,
 }
 /// Result of verifying an SMTP connection.
 #[derive(Debug, Clone, Serialize)]
 pub struct SmtpVerifyResult {
    pub reachable: bool,
    pub greeting: Option<String>,
    pub capabilities: Option<Vec<String>>,
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn test_pool_status_serialization() {
        let status = PoolStatus {
            total: 5,
            active: 2,
            idle: 3,
        };
        let json = serde_json::to_string(&status).unwrap();
        assert!(json.contains("\"total\":5"));
        assert!(json.contains("\"active\":2"));
        assert!(json.contains("\"idle\":3"));
    }
    #[test]
    fn test_send_result_serialization() {
        let result = SmtpSendResult {
            accepted: vec!["a@b.com".into()],
            rejected: vec![],
            message_id: Some("abc123".into()),
            response: "250 OK".into(),
            envelope: SmtpEnvelope {
                from: "from@test.com".into(),
                to: vec!["a@b.com".into()],
            },
        };
        let json = serde_json::to_string(&result).unwrap();
        assert!(json.contains("\"messageId\":\"abc123\""));
        assert!(json.contains("\"accepted\":[\"a@b.com\"]"));
    }
    #[test]
    fn test_verify_result_serialization() {
        let result = SmtpVerifyResult {
            reachable: true,
            greeting: Some("220 mail.example.com".into()),
            capabilities: Some(vec!["SIZE 10485760".into(), "STARTTLS".into()]),
        };
        let json = serde_json::to_string(&result).unwrap();
        assert!(json.contains("\"reachable\":true"));
    }
    #[test]
    fn test_smtp_client_manager_new() {
        let mgr = SmtpClientManager::new();
        assert!(mgr.pool_status().is_empty());
    }
    #[tokio::test]
    async fn test_close_all_empty() {
        let mgr = SmtpClientManager::new();
        mgr.close_all_pools().await;
        assert!(mgr.pool_status().is_empty());
    }
 }
--- a/rust/crates/mailer-smtp/src/client/protocol.rs
+++ b/rust/crates/mailer-smtp/src/client/protocol.rs
@@ -0,0 +1,568 @@
 //! SMTP client protocol engine.
 //!
 //! Implements the SMTP command/response flow for sending outbound email.
 use super::config::SmtpAuthConfig;
 use super::connection::ClientSmtpStream;
 use super::error::SmtpClientError;
 use base64::engine::general_purpose::STANDARD as BASE64;
 use base64::Engine;
 use serde::{Deserialize, Serialize};
 use tokio::time::{timeout, Duration};
 use tracing::debug;
 /// Parsed SMTP response (from the remote server).
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct SmtpClientResponse {
    pub code: u16,
    pub lines: Vec<String>,
 }
 impl SmtpClientResponse {
    pub fn is_success(&self) -> bool {
        self.code >= 200 && self.code < 300
    }
    pub fn is_positive_intermediate(&self) -> bool {
        self.code >= 300 && self.code < 400
    }
    pub fn is_temp_error(&self) -> bool {
        self.code >= 400 && self.code < 500
    }
    pub fn is_perm_error(&self) -> bool {
        self.code >= 500
    }
    /// Full response text (all lines joined).
    pub fn full_message(&self) -> String {
        self.lines.join(" ")
    }
    /// Convert to a protocol error if this is an error response.
    pub fn to_error(&self) -> SmtpClientError {
        SmtpClientError::ProtocolError {
            code: self.code,
            message: self.full_message(),
        }
    }
 }
 /// Server capabilities parsed from EHLO response.
 #[derive(Debug, Clone, Default)]
 pub struct EhloCapabilities {
    pub extensions: Vec<String>,
    pub max_size: Option<u64>,
    pub starttls: bool,
    pub auth_methods: Vec<String>,
    pub pipelining: bool,
    pub eight_bit_mime: bool,
 }
 /// Read a multi-line SMTP response from the server.
 pub async fn read_response(
    stream: &mut ClientSmtpStream,
    timeout_secs: u64,
 ) -> Result<SmtpClientResponse, SmtpClientError> {
    let mut lines = Vec::new();
    let mut code: u16;
    loop {
        let mut line = String::new();
        let n = timeout(
            Duration::from_secs(timeout_secs),
            stream.read_line(&mut line),
        )
        .await
        .map_err(|_| SmtpClientError::TimeoutError {
            message: format!("Timeout reading SMTP response after {timeout_secs}s"),
        })??;
        if n == 0 {
            return Err(SmtpClientError::ConnectionError {
                message: "Connection closed while reading response".into(),
            });
        }
        // Guard against unbounded lines from malicious servers (RFC 5321 §4.5.3.1.4 says 512 max)
        if line.len() > 4096 {
            return Err(SmtpClientError::ProtocolError {
                code: 0,
                message: format!("Response line too long ({} bytes, max 4096)", line.len()),
            });
        }
        let line = line.trim_end_matches('\n').trim_end_matches('\r');
        if line.len() < 3 {
            return Err(SmtpClientError::ProtocolError {
                code: 0,
                message: format!("Invalid response line: {line}"),
            });
        }
        // Parse the 3-digit code
        let parsed_code: u16 = line[..3].parse().map_err(|_| SmtpClientError::ProtocolError {
            code: 0,
            message: format!("Invalid response code in: {line}"),
        })?;
        code = parsed_code;
        // Text after the code (skip the separator character)
        let text = if line.len() > 4 { &line[4..] } else { "" };
        lines.push(text.to_string());
        // Check for continuation: "250-" means more lines, "250 " means last line
        if line.len() >= 4 && line.as_bytes()[3] == b'-' {
            continue;
        } else {
            break;
        }
    }
    debug!("SMTP response: {} {}", code, lines.join(" | "));
    Ok(SmtpClientResponse { code, lines })
 }
 /// Read the server greeting (first response after connect).
 pub async fn read_greeting(
    stream: &mut ClientSmtpStream,
    timeout_secs: u64,
 ) -> Result<SmtpClientResponse, SmtpClientError> {
    let resp = read_response(stream, timeout_secs).await?;
    if resp.code == 220 {
        Ok(resp)
    } else {
        Err(SmtpClientError::ProtocolError {
            code: resp.code,
            message: format!("Unexpected greeting: {}", resp.full_message()),
        })
    }
 }
 /// Send a raw command and read the response.
 async fn send_command(
    stream: &mut ClientSmtpStream,
    command: &str,
    timeout_secs: u64,
 ) -> Result<SmtpClientResponse, SmtpClientError> {
    debug!("SMTP C: {}", command);
    stream
        .write_all(format!("{command}\r\n").as_bytes())
        .await?;
    stream.flush().await?;
    read_response(stream, timeout_secs).await
 }
 /// Send EHLO and parse capabilities.
 pub async fn send_ehlo(
    stream: &mut ClientSmtpStream,
    domain: &str,
    timeout_secs: u64,
 ) -> Result<EhloCapabilities, SmtpClientError> {
    let resp = send_command(stream, &format!("EHLO {domain}"), timeout_secs).await?;
    if !resp.is_success() {
        // Fall back to HELO
        let helo_resp = send_command(stream, &format!("HELO {domain}"), timeout_secs).await?;
        if !helo_resp.is_success() {
            return Err(helo_resp.to_error());
        }
        return Ok(EhloCapabilities::default());
    }
    let mut caps = EhloCapabilities::default();
    // First line is the greeting, remaining lines are capabilities
    for line in resp.lines.iter().skip(1) {
        let upper = line.to_uppercase();
        if upper.starts_with("SIZE ") {
            caps.max_size = upper[5..].trim().parse().ok();
        } else if upper == "STARTTLS" {
            caps.starttls = true;
        } else if upper.starts_with("AUTH ") {
            caps.auth_methods = upper[5..]
                .split_whitespace()
                .map(|s| s.to_string())
                .collect();
        } else if upper == "PIPELINING" {
            caps.pipelining = true;
        } else if upper == "8BITMIME" {
            caps.eight_bit_mime = true;
        }
        caps.extensions.push(line.clone());
    }
    Ok(caps)
 }
 /// Send STARTTLS command (does not perform the TLS handshake itself).
 pub async fn send_starttls(
    stream: &mut ClientSmtpStream,
    timeout_secs: u64,
 ) -> Result<(), SmtpClientError> {
    let resp = send_command(stream, "STARTTLS", timeout_secs).await?;
    if resp.code != 220 {
        return Err(SmtpClientError::ProtocolError {
            code: resp.code,
            message: format!("STARTTLS rejected: {}", resp.full_message()),
        });
    }
    Ok(())
 }
 /// Authenticate using AUTH PLAIN.
 pub async fn send_auth_plain(
    stream: &mut ClientSmtpStream,
    user: &str,
    pass: &str,
    timeout_secs: u64,
 ) -> Result<(), SmtpClientError> {
    // AUTH PLAIN sends \0user\0pass in base64
    let credentials = format!("\x00{user}\x00{pass}");
    let encoded = BASE64.encode(credentials.as_bytes());
    let resp = send_command(stream, &format!("AUTH PLAIN {encoded}"), timeout_secs).await?;
    if resp.code != 235 {
        return Err(SmtpClientError::AuthenticationError {
            message: format!("AUTH PLAIN failed ({}): {}", resp.code, resp.full_message()),
        });
    }
    Ok(())
 }
 /// Authenticate using AUTH LOGIN.
 pub async fn send_auth_login(
    stream: &mut ClientSmtpStream,
    user: &str,
    pass: &str,
    timeout_secs: u64,
 ) -> Result<(), SmtpClientError> {
    // Step 1: Send AUTH LOGIN
    let resp = send_command(stream, "AUTH LOGIN", timeout_secs).await?;
    if resp.code != 334 {
        return Err(SmtpClientError::AuthenticationError {
            message: format!(
                "AUTH LOGIN challenge failed ({}): {}",
                resp.code,
                resp.full_message()
            ),
        });
    }
    // Step 2: Send base64 username
    let user_b64 = BASE64.encode(user.as_bytes());
    let resp = send_command(stream, &user_b64, timeout_secs).await?;
    if resp.code != 334 {
        return Err(SmtpClientError::AuthenticationError {
            message: format!(
                "AUTH LOGIN username rejected ({}): {}",
                resp.code,
                resp.full_message()
            ),
        });
    }
    // Step 3: Send base64 password
    let pass_b64 = BASE64.encode(pass.as_bytes());
    let resp = send_command(stream, &pass_b64, timeout_secs).await?;
    if resp.code != 235 {
        return Err(SmtpClientError::AuthenticationError {
            message: format!(
                "AUTH LOGIN password rejected ({}): {}",
                resp.code,
                resp.full_message()
            ),
        });
    }
    Ok(())
 }
 /// Authenticate using the configured method.
 pub async fn authenticate(
    stream: &mut ClientSmtpStream,
    auth: &SmtpAuthConfig,
    _caps: &EhloCapabilities,
    timeout_secs: u64,
 ) -> Result<(), SmtpClientError> {
    match auth.method.to_uppercase().as_str() {
        "LOGIN" => send_auth_login(stream, &auth.user, &auth.pass, timeout_secs).await,
        _ => send_auth_plain(stream, &auth.user, &auth.pass, timeout_secs).await,
    }
 }
 /// Send MAIL FROM.
 pub async fn send_mail_from(
    stream: &mut ClientSmtpStream,
    sender: &str,
    timeout_secs: u64,
 ) -> Result<SmtpClientResponse, SmtpClientError> {
    let resp = send_command(stream, &format!("MAIL FROM:<{sender}>"), timeout_secs).await?;
    if !resp.is_success() {
        return Err(resp.to_error());
    }
    Ok(resp)
 }
 /// Send RCPT TO. Returns per-recipient success/failure.
 pub async fn send_rcpt_to(
    stream: &mut ClientSmtpStream,
    recipient: &str,
    timeout_secs: u64,
 ) -> Result<SmtpClientResponse, SmtpClientError> {
    let resp = send_command(stream, &format!("RCPT TO:<{recipient}>"), timeout_secs).await?;
    // We don't fail the entire send on per-recipient errors;
    // the caller decides based on the response code.
    Ok(resp)
 }
 /// Send MAIL FROM + RCPT TO commands in a single pipelined batch.
 ///
 /// Writes all envelope commands at once, then reads responses in order.
 /// Returns `(mail_from_ok, accepted_recipients, rejected_recipients)`.
 pub async fn send_pipelined_envelope(
    stream: &mut ClientSmtpStream,
    sender: &str,
    recipients: &[String],
    timeout_secs: u64,
 ) -> Result<(bool, Vec<String>, Vec<String>), SmtpClientError> {
    // Build the full pipelined command batch
    let mut batch = format!("MAIL FROM:<{sender}>\r\n");
    for rcpt in recipients {
        batch.push_str(&format!("RCPT TO:<{rcpt}>\r\n"));
    }
    // Send all commands at once
    debug!("SMTP C (pipelined): MAIL FROM + {} RCPT TO", recipients.len());
    stream.write_all(batch.as_bytes()).await?;
    stream.flush().await?;
    // Read MAIL FROM response
    let mail_resp = read_response(stream, timeout_secs).await?;
    if !mail_resp.is_success() {
        return Err(mail_resp.to_error());
    }
    // Read RCPT TO responses
    let mut accepted = Vec::new();
    let mut rejected = Vec::new();
    for rcpt in recipients {
        match read_response(stream, timeout_secs).await {
            Ok(resp) => {
                if resp.is_success() {
                    accepted.push(rcpt.clone());
                } else {
                    rejected.push(rcpt.clone());
                }
            }
            Err(_) => {
                rejected.push(rcpt.clone());
            }
        }
    }
    Ok((true, accepted, rejected))
 }
 /// Send DATA command, followed by the message body with dot-stuffing.
 pub async fn send_data(
    stream: &mut ClientSmtpStream,
    message: &[u8],
    timeout_secs: u64,
 ) -> Result<SmtpClientResponse, SmtpClientError> {
    // Send DATA command
    let resp = send_command(stream, "DATA", timeout_secs).await?;
    if !resp.is_positive_intermediate() {
        return Err(resp.to_error());
    }
    // Send the message body with dot-stuffing
    let stuffed = dot_stuff(message);
    stream.write_all(&stuffed).await?;
    // Send terminator: CRLF.CRLF
    // If the message doesn't end with CRLF, add one
    if !stuffed.ends_with(b"\r\n") {
        stream.write_all(b"\r\n").await?;
    }
    stream.write_all(b".\r\n").await?;
    stream.flush().await?;
    // Read final response
    let final_resp = read_response(stream, timeout_secs).await?;
    if !final_resp.is_success() {
        return Err(final_resp.to_error());
    }
    Ok(final_resp)
 }
 /// Send RSET command to reset the server state between messages on a reused connection.
 pub async fn send_rset(
    stream: &mut ClientSmtpStream,
    timeout_secs: u64,
 ) -> Result<(), SmtpClientError> {
    let resp = send_command(stream, "RSET", timeout_secs).await?;
    if !resp.is_success() {
        return Err(resp.to_error());
    }
    Ok(())
 }
 /// Send QUIT command.
 pub async fn send_quit(
    stream: &mut ClientSmtpStream,
    timeout_secs: u64,
 ) -> Result<(), SmtpClientError> {
    // Best-effort QUIT — ignore errors since we're closing anyway
    let _ = send_command(stream, "QUIT", timeout_secs).await;
    Ok(())
 }
 /// Apply SMTP dot-stuffing to a message body.
 ///
 /// Any line starting with a period gets an extra period prepended.
 /// Also normalizes bare LF to CRLF.
 pub fn dot_stuff(data: &[u8]) -> Vec<u8> {
    let mut result = Vec::with_capacity(data.len() + data.len() / 40);
    let mut at_line_start = true;
    for i in 0..data.len() {
        let byte = data[i];
        // Normalize bare LF to CRLF
        if byte == b'\n' && (i == 0 || data[i - 1] != b'\r') {
            result.push(b'\r');
            result.push(b'\n');
            at_line_start = true;
            continue;
        }
        // Dot-stuff: add extra dot at start of line
        if at_line_start && byte == b'.' {
            result.push(b'.');
        }
        result.push(byte);
        at_line_start = byte == b'\n';
    }
    result
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn test_dot_stuffing_basic() {
        assert_eq!(
            dot_stuff(b"Hello\r\n.World\r\n"),
            b"Hello\r\n..World\r\n"
        );
    }
    #[test]
    fn test_dot_stuffing_leading_dot() {
        assert_eq!(dot_stuff(b".starts with dot\r\n"), b"..starts with dot\r\n");
    }
    #[test]
    fn test_dot_stuffing_multiple_dots() {
        assert_eq!(
            dot_stuff(b"ok\r\n.line1\r\n..line2\r\n"),
            b"ok\r\n..line1\r\n...line2\r\n"
        );
    }
    #[test]
    fn test_dot_stuffing_bare_lf() {
        assert_eq!(
            dot_stuff(b"line1\nline2\n"),
            b"line1\r\nline2\r\n"
        );
    }
    #[test]
    fn test_dot_stuffing_bare_lf_with_dot() {
        assert_eq!(
            dot_stuff(b"ok\n.dotline\n"),
            b"ok\r\n..dotline\r\n"
        );
    }
    #[test]
    fn test_dot_stuffing_no_change() {
        assert_eq!(
            dot_stuff(b"Hello World\r\nNo dots here\r\n"),
            b"Hello World\r\nNo dots here\r\n"
        );
    }
    #[test]
    fn test_dot_stuffing_empty() {
        assert_eq!(dot_stuff(b""), b"");
    }
    #[test]
    fn test_response_is_success() {
        let resp = SmtpClientResponse {
            code: 250,
            lines: vec!["OK".into()],
        };
        assert!(resp.is_success());
        assert!(!resp.is_temp_error());
        assert!(!resp.is_perm_error());
    }
    #[test]
    fn test_response_temp_error() {
        let resp = SmtpClientResponse {
            code: 450,
            lines: vec!["Mailbox busy".into()],
        };
        assert!(!resp.is_success());
        assert!(resp.is_temp_error());
    }
    #[test]
    fn test_response_perm_error() {
        let resp = SmtpClientResponse {
            code: 550,
            lines: vec!["No such user".into()],
        };
        assert!(!resp.is_success());
        assert!(resp.is_perm_error());
    }
    #[test]
    fn test_response_positive_intermediate() {
        let resp = SmtpClientResponse {
            code: 354,
            lines: vec!["Start mail input".into()],
        };
        assert!(resp.is_positive_intermediate());
        assert!(!resp.is_success());
    }
    #[test]
    fn test_response_full_message() {
        let resp = SmtpClientResponse {
            code: 250,
            lines: vec!["OK".into(), "SIZE 10485760".into()],
        };
        assert_eq!(resp.full_message(), "OK SIZE 10485760");
    }
    #[test]
    fn test_ehlo_capabilities_default() {
        let caps = EhloCapabilities::default();
        assert!(!caps.starttls);
        assert!(!caps.pipelining);
        assert!(!caps.eight_bit_mime);
        assert!(caps.auth_methods.is_empty());
        assert!(caps.max_size.is_none());
    }
 }
--- a/rust/crates/mailer-smtp/src/command.rs
+++ b/rust/crates/mailer-smtp/src/command.rs
@@ -50,6 +50,7 @@ pub enum SmtpCommand {
 pub enum AuthMechanism {
    Plain,
    Login,
    ScramSha256,
 }
 /// Errors that can occur during command parsing.
@@ -218,6 +219,7 @@ fn parse_auth(rest: &str) -> Result<SmtpCommand, ParseError> {
    let mechanism = match mech_str.to_ascii_uppercase().as_str() {
        "PLAIN" => AuthMechanism::Plain,
        "LOGIN" => AuthMechanism::Login,
        "SCRAM-SHA-256" => AuthMechanism::ScramSha256,
        other => {
            return Err(ParseError::SyntaxError(format!(
                "unsupported AUTH mechanism: {other}"
--- a/rust/crates/mailer-smtp/src/config.rs
+++ b/rust/crates/mailer-smtp/src/config.rs
@@ -2,6 +2,17 @@
 use serde::{Deserialize, Serialize};
 /// Per-domain TLS certificate for SNI-based cert selection.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct TlsDomainCert {
    /// Domain names this certificate covers (matched against SNI hostname).
    pub domains: Vec<String>,
    /// Certificate chain in PEM format.
    pub cert_pem: String,
    /// Private key in PEM format.
    pub key_pem: String,
 }
 /// Configuration for an SMTP server instance.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct SmtpServerConfig {
@@ -11,10 +22,13 @@ pub struct SmtpServerConfig {
    pub ports: Vec<u16>,
    /// Port for implicit TLS (e.g. 465). None = no implicit TLS port.
    pub secure_port: Option<u16>,
-    /// TLS certificate chain in PEM format.
+    /// TLS certificate chain in PEM format (default cert).
    pub tls_cert_pem: Option<String>,
-    /// TLS private key in PEM format.
+    /// TLS private key in PEM format (default key).
    pub tls_key_pem: Option<String>,
    /// Additional per-domain TLS certificates for SNI-based selection.
    #[serde(default)]
    pub additional_tls_certs: Vec<TlsDomainCert>,
    /// Maximum message size in bytes.
    pub max_message_size: u64,
    /// Maximum number of concurrent connections.
@@ -43,6 +57,7 @@ impl Default for SmtpServerConfig {
            secure_port: None,
            tls_cert_pem: None,
            tls_key_pem: None,
            additional_tls_certs: Vec::new(),
            max_message_size: 10 * 1024 * 1024, // 10 MB
            max_connections: 100,
            max_recipients: 100,
--- a/rust/crates/mailer-smtp/src/connection.rs
+++ b/rust/crates/mailer-smtp/src/connection.rs
@@ -9,6 +9,7 @@ use crate::config::SmtpServerConfig;
 use crate::data::{DataAccumulator, DataAction};
 use crate::rate_limiter::RateLimiter;
 use crate::response::{build_capabilities, SmtpResponse};
 use crate::scram::{ScramCredentials, ScramServer};
 use crate::session::{AuthState, SmtpSession};
 use crate::validation;
@@ -52,6 +53,13 @@ pub enum ConnectionEvent {
        password: String,
        remote_addr: String,
    },
    /// A SCRAM credential request — Rust needs stored credentials from TS.
    ScramCredentialRequest {
        correlation_id: String,
        session_id: String,
        username: String,
        remote_addr: String,
    },
 }
 /// How email data is transported from Rust to TS.
@@ -81,6 +89,16 @@ pub struct AuthResult {
    pub message: Option<String>,
 }
 /// Result of TS returning SCRAM credentials for a user.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ScramCredentialResult {
    pub found: bool,
    pub salt: Option<Vec<u8>>,
    pub iterations: Option<u32>,
    pub stored_key: Option<Vec<u8>>,
    pub server_key: Option<Vec<u8>>,
 }
 /// Abstraction over plain and TLS streams.
 pub enum SmtpStream {
    Plain(BufReader<TcpStream>),
@@ -133,6 +151,14 @@ impl SmtpStream {
        }
    }
    /// Check if the internal buffer has unread data (pipelined commands).
    pub fn has_buffered_data(&self) -> bool {
        match self {
            SmtpStream::Plain(reader) => !reader.buffer().is_empty(),
            SmtpStream::Tls(reader) => !reader.buffer().is_empty(),
        }
    }
    /// Unwrap to get the raw TcpStream for STARTTLS upgrade.
    /// Only works on Plain streams.
    pub fn into_tcp_stream(self) -> Option<TcpStream> {
@@ -212,7 +238,7 @@ pub async fn handle_connection(
                break;
            }
            Ok(Ok(_)) => {
-                // Process command
+                // Process the first command
                let response = process_line(
                    &line,
                    &mut session,
@@ -227,59 +253,123 @@ pub async fn handle_connection(
                )
                .await;
                // Check for pipelined commands in the buffer.
                // Collect pipelinable responses into a batch for single write.
                let mut response_batch: Vec<u8> = Vec::new();
                let mut should_break = false;
                let mut starttls_signal = false;
                match response {
                    LineResult::Response(resp) => {
-                        if stream.write_all(&resp.to_bytes()).await.is_err() {
+                        response_batch.extend_from_slice(&resp.to_bytes());
                            break;
                        }
                        if stream.flush().await.is_err() {
                            break;
                        }
                    }
                    LineResult::Quit(resp) => {
                        let _ = stream.write_all(&resp.to_bytes()).await;
                        let _ = stream.flush().await;
-                        break;
+                        should_break = true;
                    }
                    LineResult::StartTlsSignal => {
-                        // Send 220 Ready response
+                        starttls_signal = true;
                        let resp = SmtpResponse::new(220, "Ready to start TLS");
                        if stream.write_all(&resp.to_bytes()).await.is_err() {
                            break;
                        }
                        if stream.flush().await.is_err() {
                            break;
                        }
                        // Extract TCP stream and upgrade
                        if let Some(tcp_stream) = stream.into_tcp_stream() {
                            if let Some(acceptor) = &tls_acceptor {
                                match acceptor.accept(tcp_stream).await {
                                    Ok(tls_stream) => {
                                        stream = SmtpStream::Tls(BufReader::new(tls_stream));
                                        session.secure = true;
                                        // Client must re-EHLO after STARTTLS
                                        session.state = crate::state::SmtpState::Connected;
                                        session.client_hostname = None;
                                        session.esmtp = false;
                                        session.auth_state = AuthState::None;
                                        session.envelope = Default::default();
                                        debug!(session_id = %session.id, "TLS upgrade successful");
                                    }
                                    Err(e) => {
                                        warn!(session_id = %session.id, error = %e, "TLS handshake failed");
                                        break;
                                    }
                                }
                            } else {
                                break;
                            }
                        } else {
                            // Already TLS — shouldn't happen
                            break;
                        }
                    }
                    LineResult::NoResponse => {}
                    LineResult::Disconnect => {
                        should_break = true;
                    }
                }
                if should_break {
                    break;
                }
                // Process additional pipelined commands from the buffer
                if !starttls_signal {
                    while stream.has_buffered_data() {
                        let mut next_line = String::new();
                        match stream.read_line(&mut next_line, 4096).await {
                            Ok(0) | Err(_) => break,
                            Ok(_) => {
                                let next_response = process_line(
                                    &next_line,
                                    &mut session,
                                    &mut stream,
                                    &config,
                                    &rate_limiter,
                                    &event_tx,
                                    callback_register.as_ref(),
                                    &tls_acceptor,
                                    &authenticator,
                                    &resolver,
                                )
                                .await;
                                match next_response {
                                    LineResult::Response(resp) => {
                                        response_batch.extend_from_slice(&resp.to_bytes());
                                    }
                                    LineResult::Quit(resp) => {
                                        response_batch.extend_from_slice(&resp.to_bytes());
                                        should_break = true;
                                        break;
                                    }
                                    LineResult::StartTlsSignal | LineResult::Disconnect => {
                                        // Non-pipelinable: flush batch and handle
                                        starttls_signal = matches!(next_response, LineResult::StartTlsSignal);
                                        should_break = matches!(next_response, LineResult::Disconnect);
                                        break;
                                    }
                                    LineResult::NoResponse => {}
                                }
                            }
                        }
                    }
                }
                // Flush the accumulated response batch in one write
                if !response_batch.is_empty() {
                    if stream.write_all(&response_batch).await.is_err() {
                        break;
                    }
                    if stream.flush().await.is_err() {
                        break;
                    }
                }
                if should_break {
                    break;
                }
                if starttls_signal {
                    // Send 220 Ready response
                    let resp = SmtpResponse::new(220, "Ready to start TLS");
                    if stream.write_all(&resp.to_bytes()).await.is_err() {
                        break;
                    }
                    if stream.flush().await.is_err() {
                        break;
                    }
                    // Extract TCP stream and upgrade
                    if let Some(tcp_stream) = stream.into_tcp_stream() {
                        if let Some(acceptor) = &tls_acceptor {
                            match acceptor.accept(tcp_stream).await {
                                Ok(tls_stream) => {
                                    stream = SmtpStream::Tls(BufReader::new(tls_stream));
                                    session.secure = true;
                                    session.state = crate::state::SmtpState::Connected;
                                    session.client_hostname = None;
                                    session.esmtp = false;
                                    session.auth_state = AuthState::None;
                                    session.envelope = Default::default();
                                    debug!(session_id = %session.id, "TLS upgrade successful");
                                }
                                Err(e) => {
                                    warn!(session_id = %session.id, error = %e, "TLS handshake failed");
                                    break;
                                }
                            }
                        } else {
                            break;
                        }
                    } else {
                        break;
                    }
                }
@@ -322,6 +412,12 @@ pub trait CallbackRegistry: Send + Sync {
        &self,
        correlation_id: &str,
    ) -> oneshot::Receiver<AuthResult>;
    /// Register a callback for SCRAM credential lookup and return a receiver.
    fn register_scram_callback(
        &self,
        correlation_id: &str,
    ) -> oneshot::Receiver<ScramCredentialResult>;
 }
 /// Process a single input line from the client.
@@ -406,16 +502,29 @@ async fn process_line(
            mechanism,
            initial_response,
        } => {
-            handle_auth(
+            if matches!(mechanism, AuthMechanism::ScramSha256) {
-                mechanism,
+                handle_auth_scram(
-                initial_response,
+                    initial_response,
-                session,
+                    session,
-                config,
+                    stream,
-                rate_limiter,
+                    config,
-                event_tx,
+                    rate_limiter,
-                callback_registry,
+                    event_tx,
-            )
+                    callback_registry,
-            .await
+                )
                .await
            } else {
                handle_auth(
                    mechanism,
                    initial_response,
                    session,
                    config,
                    rate_limiter,
                    event_tx,
                    callback_registry,
                )
                .await
            }
        }
        SmtpCommand::Help(_) => {
@@ -832,6 +941,217 @@ async fn handle_auth(
                ))
            }
        }
        AuthMechanism::ScramSha256 => {
            // SCRAM is handled separately in process_line; this should not be reached.
            LineResult::Response(SmtpResponse::not_implemented())
        }
    }
 }
 /// Handle AUTH SCRAM-SHA-256 — full exchange in a single async function.
 ///
 /// SCRAM is a multi-step challenge-response protocol:
 /// 1. Client sends client-first-message (in initial_response or after 334)
 /// 2. Server requests SCRAM credentials from TS
 /// 3. Server sends server-first-message (334 challenge)
 /// 4. Client sends client-final-message (proof)
 /// 5. Server verifies proof and responds with 235 or 535
 async fn handle_auth_scram(
    initial_response: Option<String>,
    session: &mut SmtpSession,
    stream: &mut SmtpStream,
    config: &SmtpServerConfig,
    rate_limiter: &RateLimiter,
    event_tx: &mpsc::Sender<ConnectionEvent>,
    callback_registry: &dyn CallbackRegistry,
 ) -> LineResult {
    if !config.auth_enabled {
        return LineResult::Response(SmtpResponse::not_implemented());
    }
    if session.is_authenticated() {
        return LineResult::Response(SmtpResponse::bad_sequence("Already authenticated"));
    }
    if !session.state.can_auth() {
        return LineResult::Response(SmtpResponse::bad_sequence("Send EHLO first"));
    }
    // Step 1: Get client-first-message
    let client_first_b64 = match initial_response {
        Some(s) if !s.is_empty() => s,
        _ => {
            // No initial response — send empty 334 challenge
            let resp = SmtpResponse::auth_challenge("");
            if stream.write_all(&resp.to_bytes()).await.is_err() {
                return LineResult::Disconnect;
            }
            if stream.flush().await.is_err() {
                return LineResult::Disconnect;
            }
            // Read client-first-message
            let mut line = String::new();
            let socket_timeout = Duration::from_secs(config.socket_timeout_secs);
            match timeout(socket_timeout, stream.read_line(&mut line, 4096)).await {
                Err(_) | Ok(Err(_)) | Ok(Ok(0)) => return LineResult::Disconnect,
                Ok(Ok(_)) => {}
            }
            let trimmed = line.trim().to_string();
            if trimmed == "*" {
                return LineResult::Response(SmtpResponse::new(501, "Authentication cancelled"));
            }
            trimmed
        }
    };
    // Decode base64 client-first-message
    let client_first_bytes = match BASE64.decode(client_first_b64.as_bytes()) {
        Ok(b) => b,
        Err(_) => {
            return LineResult::Response(SmtpResponse::param_error("Invalid base64 encoding"));
        }
    };
    let client_first = match String::from_utf8(client_first_bytes) {
        Ok(s) => s,
        Err(_) => {
            return LineResult::Response(SmtpResponse::param_error("Invalid UTF-8 in SCRAM message"));
        }
    };
    // Parse client-first-message
    let mut scram = match ScramServer::from_client_first(&client_first) {
        Ok(s) => s,
        Err(e) => {
            debug!(error = %e, "SCRAM client-first-message parse error");
            return LineResult::Response(SmtpResponse::param_error(
                "Invalid SCRAM client-first-message",
            ));
        }
    };
    // Step 2: Request SCRAM credentials from TS
    let correlation_id = uuid::Uuid::new_v4().to_string();
    let rx = callback_registry.register_scram_callback(&correlation_id);
    let event = ConnectionEvent::ScramCredentialRequest {
        correlation_id: correlation_id.clone(),
        session_id: session.id.clone(),
        username: scram.username.clone(),
        remote_addr: session.remote_addr.clone(),
    };
    if event_tx.send(event).await.is_err() {
        return LineResult::Response(SmtpResponse::local_error("Internal processing error"));
    }
    // Wait for credentials from TS
    let cred_timeout = Duration::from_secs(5);
    let cred_result = match timeout(cred_timeout, rx).await {
        Ok(Ok(result)) => result,
        Ok(Err(_)) => {
            warn!(correlation_id = %correlation_id, "SCRAM credential callback dropped");
            return LineResult::Response(SmtpResponse::local_error("Internal processing error"));
        }
        Err(_) => {
            warn!(correlation_id = %correlation_id, "SCRAM credential request timed out");
            return LineResult::Response(SmtpResponse::local_error("Internal processing error"));
        }
    };
    if !cred_result.found {
        // User not found — fail auth (don't reveal that user doesn't exist)
        session.auth_state = AuthState::None;
        let exceeded = session.record_auth_failure(config.max_auth_failures);
        if exceeded {
            return LineResult::Quit(SmtpResponse::service_unavailable(
                &config.hostname,
                "Too many authentication failures",
            ));
        }
        return LineResult::Response(SmtpResponse::auth_failed());
    }
    let creds = ScramCredentials {
        salt: cred_result.salt.unwrap_or_default(),
        iterations: cred_result.iterations.unwrap_or(4096),
        stored_key: cred_result.stored_key.unwrap_or_default(),
        server_key: cred_result.server_key.unwrap_or_default(),
    };
    // Step 3: Generate and send server-first-message
    let server_first = scram.server_first_message(creds);
    let server_first_b64 = BASE64.encode(server_first.as_bytes());
    let challenge = SmtpResponse::auth_challenge(&server_first_b64);
    if stream.write_all(&challenge.to_bytes()).await.is_err() {
        return LineResult::Disconnect;
    }
    if stream.flush().await.is_err() {
        return LineResult::Disconnect;
    }
    // Step 4: Read client-final-message
    let mut client_final_line = String::new();
    let socket_timeout = Duration::from_secs(config.socket_timeout_secs);
    match timeout(socket_timeout, stream.read_line(&mut client_final_line, 4096)).await {
        Err(_) | Ok(Err(_)) | Ok(Ok(0)) => return LineResult::Disconnect,
        Ok(Ok(_)) => {}
    }
    let client_final_b64 = client_final_line.trim();
    // Cancel if *
    if client_final_b64 == "*" {
        session.auth_state = AuthState::None;
        return LineResult::Response(SmtpResponse::new(501, "Authentication cancelled"));
    }
    // Decode base64 client-final-message
    let client_final_bytes = match BASE64.decode(client_final_b64.as_bytes()) {
        Ok(b) => b,
        Err(_) => {
            session.auth_state = AuthState::None;
            return LineResult::Response(SmtpResponse::param_error("Invalid base64 encoding"));
        }
    };
    let client_final = match String::from_utf8(client_final_bytes) {
        Ok(s) => s,
        Err(_) => {
            session.auth_state = AuthState::None;
            return LineResult::Response(SmtpResponse::param_error("Invalid UTF-8 in SCRAM message"));
        }
    };
    // Step 5: Verify proof
    match scram.process_client_final(&client_final) {
        Ok(server_final) => {
            let server_final_b64 = BASE64.encode(server_final.as_bytes());
            session.auth_state = AuthState::Authenticated {
                username: scram.username.clone(),
            };
            LineResult::Response(SmtpResponse::new(
                235,
                format!("2.7.0 Authentication successful {}", server_final_b64),
            ))
        }
        Err(e) => {
            debug!(error = %e, "SCRAM proof verification failed");
            session.auth_state = AuthState::None;
            let exceeded = session.record_auth_failure(config.max_auth_failures);
            if exceeded {
                if !rate_limiter.check_auth_failure(&session.remote_addr) {
                    return LineResult::Quit(SmtpResponse::service_unavailable(
                        &config.hostname,
                        "Too many authentication failures",
                    ));
                }
                return LineResult::Quit(SmtpResponse::service_unavailable(
                    &config.hostname,
                    "Too many authentication failures",
                ));
            }
            LineResult::Response(SmtpResponse::auth_failed())
        }
    }
 }
--- a/rust/crates/mailer-smtp/src/lib.rs
+++ b/rust/crates/mailer-smtp/src/lib.rs
@@ -12,12 +12,14 @@
 //! - TCP/TLS server (`server`)
 //! - Connection handling (`connection`)
 pub mod client;
 pub mod command;
 pub mod config;
 pub mod connection;
 pub mod data;
 pub mod rate_limiter;
 pub mod response;
 pub mod scram;
 pub mod server;
 pub mod session;
 pub mod state;
--- a/rust/crates/mailer-smtp/src/response.rs
+++ b/rust/crates/mailer-smtp/src/response.rs
@@ -196,7 +196,7 @@ pub fn build_capabilities(
        caps.push("STARTTLS".to_string());
    }
    if auth_available {
-        caps.push("AUTH PLAIN LOGIN".to_string());
+        caps.push("AUTH PLAIN LOGIN SCRAM-SHA-256".to_string());
    }
    caps
 }
@@ -253,7 +253,7 @@ mod tests {
        let caps = build_capabilities(10485760, true, false, true);
        assert!(caps.contains(&"SIZE 10485760".to_string()));
        assert!(caps.contains(&"STARTTLS".to_string()));
-        assert!(caps.contains(&"AUTH PLAIN LOGIN".to_string()));
+        assert!(caps.contains(&"AUTH PLAIN LOGIN SCRAM-SHA-256".to_string()));
        assert!(caps.contains(&"PIPELINING".to_string()));
    }
@@ -262,7 +262,7 @@ mod tests {
        // When already secure, STARTTLS should NOT be advertised
        let caps = build_capabilities(10485760, true, true, false);
        assert!(!caps.contains(&"STARTTLS".to_string()));
-        assert!(!caps.contains(&"AUTH PLAIN LOGIN".to_string()));
+        assert!(!caps.contains(&"AUTH PLAIN LOGIN SCRAM-SHA-256".to_string()));
    }
    #[test]
--- a/rust/crates/mailer-smtp/src/scram.rs
+++ b/rust/crates/mailer-smtp/src/scram.rs
@@ -0,0 +1,342 @@
 //! SCRAM-SHA-256 server-side implementation (RFC 5802 + RFC 7677).
 //!
 //! Implements the server side of the SCRAM-SHA-256 SASL mechanism,
 //! a challenge-response protocol that avoids transmitting cleartext passwords.
 use base64::engine::general_purpose::STANDARD as BASE64;
 use base64::Engine;
 use hmac::{Hmac, Mac};
 use sha2::{Digest, Sha256};
 type HmacSha256 = Hmac<Sha256>;
 /// Pre-computed SCRAM credentials for a user (derived from password).
 #[derive(Debug, Clone)]
 pub struct ScramCredentials {
    pub salt: Vec<u8>,
    pub iterations: u32,
    pub stored_key: Vec<u8>,
    pub server_key: Vec<u8>,
 }
 /// Server-side SCRAM state machine.
 pub struct ScramServer {
    /// Username extracted from client-first-message.
    pub username: String,
    /// Full combined nonce (client + server).
    combined_nonce: String,
    /// Server nonce portion (used in tests for verification).
    #[allow(dead_code)]
    server_nonce: String,
    /// Stored credentials (set after TS responds).
    credentials: Option<ScramCredentials>,
    /// The server-first-message (for auth message construction).
    server_first: String,
    /// The client-first-message-bare (for auth message construction).
    client_first_bare: String,
 }
 impl ScramServer {
    /// Process the client-first-message.
    ///
    /// Parses the client nonce and username, generates a server nonce,
    /// and returns a partial state that needs credentials to produce the
    /// server-first-message.
    pub fn from_client_first(client_first: &str) -> Result<Self, String> {
        // client-first-message = gs2-header client-first-message-bare
        // gs2-header = "n,," (no channel binding)
        // client-first-message-bare = "n=username,r=nonce"
        let bare = if let Some(rest) = client_first.strip_prefix("n,,") {
            rest
        } else if let Some(rest) = client_first.strip_prefix("y,,") {
            rest
        } else {
            return Err("Invalid SCRAM gs2-header".into());
        };
        let mut username = String::new();
        let mut client_nonce = String::new();
        for part in bare.split(',') {
            if let Some(val) = part.strip_prefix("n=") {
                username = val.to_string();
            } else if let Some(val) = part.strip_prefix("r=") {
                client_nonce = val.to_string();
            }
        }
        if username.is_empty() || client_nonce.is_empty() {
            return Err("Missing username or nonce in client-first-message".into());
        }
        // Generate server nonce
        let server_nonce: String = (0..24)
            .map(|_| {
                let idx = (rand_byte() as usize) % 62;
                b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"[idx] as char
            })
            .collect();
        let combined_nonce = format!("{}{}", client_nonce, server_nonce);
        Ok(ScramServer {
            username,
            combined_nonce,
            server_nonce,
            credentials: None,
            server_first: String::new(),
            client_first_bare: bare.to_string(),
        })
    }
    /// Set the credentials and produce the server-first-message.
    pub fn server_first_message(&mut self, creds: ScramCredentials) -> String {
        let salt_b64 = BASE64.encode(&creds.salt);
        let server_first = format!(
            "r={},s={},i={}",
            self.combined_nonce, salt_b64, creds.iterations
        );
        self.server_first = server_first.clone();
        self.credentials = Some(creds);
        server_first
    }
    /// Process the client-final-message and verify the proof.
    ///
    /// Returns the server-final-message (containing ServerSignature) on success,
    /// or an error string on failure.
    pub fn process_client_final(&mut self, client_final: &str) -> Result<String, String> {
        let creds = self.credentials.as_ref().ok_or("No credentials set")?;
        // Parse client-final-message
        // Format: c=biws,r=<combined_nonce>,p=<client_proof>
        let mut channel_binding = String::new();
        let mut nonce = String::new();
        let mut proof_b64 = String::new();
        for part in client_final.split(',') {
            if let Some(val) = part.strip_prefix("c=") {
                channel_binding = val.to_string();
            } else if let Some(val) = part.strip_prefix("r=") {
                nonce = val.to_string();
            } else if let Some(val) = part.strip_prefix("p=") {
                proof_b64 = val.to_string();
            }
        }
        // Verify nonce matches
        if nonce != self.combined_nonce {
            return Err("Nonce mismatch".into());
        }
        // Build the client-final-message-without-proof
        let client_final_without_proof = format!("c={},r={}", channel_binding, nonce);
        // Complete the auth message
        let auth_message = format!(
            "{},{},{}",
            self.client_first_bare, self.server_first, client_final_without_proof
        );
        // Verify client proof
        let client_proof = BASE64.decode(proof_b64.as_bytes())
            .map_err(|_| "Invalid base64 in client proof")?;
        // ClientSignature = HMAC(StoredKey, AuthMessage)
        let client_signature = hmac_sha256(&creds.stored_key, auth_message.as_bytes());
        // ClientKey = ClientProof XOR ClientSignature
        if client_proof.len() != client_signature.len() {
            return Err("Client proof length mismatch".into());
        }
        let client_key: Vec<u8> = client_proof
            .iter()
            .zip(client_signature.iter())
            .map(|(a, b)| a ^ b)
            .collect();
        // StoredKey = H(ClientKey)
        let computed_stored_key = sha256(&client_key);
        // Verify: computed StoredKey must match the stored StoredKey
        if computed_stored_key != creds.stored_key {
            return Err("Authentication failed".into());
        }
        // Generate ServerSignature for mutual authentication
        let server_signature = hmac_sha256(&creds.server_key, auth_message.as_bytes());
        let server_sig_b64 = BASE64.encode(&server_signature);
        Ok(format!("v={}", server_sig_b64))
    }
 }
 /// Compute SCRAM credentials from a plaintext password (for TS to pre-compute).
 pub fn compute_scram_credentials(password: &str, salt: &[u8], iterations: u32) -> ScramCredentials {
    // SaltedPassword = PBKDF2-HMAC-SHA256(password, salt, iterations)
    let mut salted_password = [0u8; 32];
    pbkdf2::pbkdf2_hmac::<Sha256>(
        password.as_bytes(),
        salt,
        iterations,
        &mut salted_password,
    );
    // ClientKey = HMAC(SaltedPassword, "Client Key")
    let client_key = hmac_sha256(&salted_password, b"Client Key");
    // StoredKey = H(ClientKey)
    let stored_key = sha256(&client_key);
    // ServerKey = HMAC(SaltedPassword, "Server Key")
    let server_key = hmac_sha256(&salted_password, b"Server Key");
    ScramCredentials {
        salt: salt.to_vec(),
        iterations,
        stored_key,
        server_key,
    }
 }
 fn hmac_sha256(key: &[u8], data: &[u8]) -> Vec<u8> {
    let mut mac = HmacSha256::new_from_slice(key).expect("HMAC accepts any key length");
    mac.update(data);
    mac.finalize().into_bytes().to_vec()
 }
 fn sha256(data: &[u8]) -> Vec<u8> {
    let mut hasher = Sha256::new();
    hasher.update(data);
    hasher.finalize().to_vec()
 }
 /// Simple random byte using system randomness.
 fn rand_byte() -> u8 {
    use std::collections::hash_map::RandomState;
    use std::hash::{BuildHasher, Hasher};
    let state = RandomState::new();
    let mut hasher = state.build_hasher();
    hasher.write_u64(std::time::SystemTime::now()
        .duration_since(std::time::UNIX_EPOCH)
        .unwrap_or_default()
        .as_nanos() as u64);
    hasher.finish() as u8
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn test_scram_full_exchange() {
        let password = "pencil";
        let salt = b"test-salt-1234";
        let iterations = 4096;
        // Pre-compute server-side credentials from password
        let creds = compute_scram_credentials(password, salt, iterations);
        // 1. Client sends client-first-message
        let client_first = "n,,n=user,r=rOprNGfwEbeRWgbNEkqO";
        let mut server = ScramServer::from_client_first(client_first).unwrap();
        assert_eq!(server.username, "user");
        // 2. Server responds with server-first-message
        let server_first = server.server_first_message(creds.clone());
        assert!(server_first.starts_with(&format!("r=rOprNGfwEbeRWgbNEkqO{}", server.server_nonce)));
        assert!(server_first.contains("s="));
        assert!(server_first.contains("i=4096"));
        // 3. Client computes proof
        // SaltedPassword
        let mut salted_password = [0u8; 32];
        pbkdf2::pbkdf2_hmac::<Sha256>(
            password.as_bytes(),
            salt,
            iterations,
            &mut salted_password,
        );
        let client_key = hmac_sha256(&salted_password, b"Client Key");
        let stored_key = sha256(&client_key);
        let client_first_bare = "n=user,r=rOprNGfwEbeRWgbNEkqO";
        let client_final_without_proof = format!("c=biws,r={}", server.combined_nonce);
        let auth_message = format!("{},{},{}", client_first_bare, server_first, client_final_without_proof);
        let client_signature = hmac_sha256(&stored_key, auth_message.as_bytes());
        let client_proof: Vec<u8> = client_key
            .iter()
            .zip(client_signature.iter())
            .map(|(a, b)| a ^ b)
            .collect();
        let proof_b64 = BASE64.encode(&client_proof);
        let client_final = format!("c=biws,r={},p={}", server.combined_nonce, proof_b64);
        // 4. Server verifies proof
        let result = server.process_client_final(&client_final);
        assert!(result.is_ok(), "SCRAM verification failed: {:?}", result.err());
        let server_final = result.unwrap();
        assert!(server_final.starts_with("v="));
    }
    #[test]
    fn test_scram_wrong_password() {
        let password = "pencil";
        let wrong_password = "wrong";
        let salt = b"test-salt";
        let iterations = 4096;
        let creds = compute_scram_credentials(password, salt, iterations);
        let client_first = "n,,n=user,r=clientnonce123";
        let mut server = ScramServer::from_client_first(client_first).unwrap();
        let server_first = server.server_first_message(creds);
        // Client computes proof with wrong password
        let mut salted_password = [0u8; 32];
        pbkdf2::pbkdf2_hmac::<Sha256>(
            wrong_password.as_bytes(),
            salt,
            iterations,
            &mut salted_password,
        );
        let client_key = hmac_sha256(&salted_password, b"Client Key");
        let stored_key = sha256(&client_key);
        let client_first_bare = "n=user,r=clientnonce123";
        let client_final_without_proof = format!("c=biws,r={}", server.combined_nonce);
        let auth_message = format!("{},{},{}", client_first_bare, server_first, client_final_without_proof);
        let client_signature = hmac_sha256(&stored_key, auth_message.as_bytes());
        let client_proof: Vec<u8> = client_key
            .iter()
            .zip(client_signature.iter())
            .map(|(a, b)| a ^ b)
            .collect();
        let proof_b64 = BASE64.encode(&client_proof);
        let client_final = format!("c=biws,r={},p={}", server.combined_nonce, proof_b64);
        let result = server.process_client_final(&client_final);
        assert!(result.is_err());
    }
    #[test]
    fn test_compute_scram_credentials() {
        let creds = compute_scram_credentials("password", b"salt", 4096);
        assert_eq!(creds.salt, b"salt");
        assert_eq!(creds.iterations, 4096);
        assert_eq!(creds.stored_key.len(), 32);
        assert_eq!(creds.server_key.len(), 32);
    }
    #[test]
    fn test_invalid_client_first() {
        assert!(ScramServer::from_client_first("invalid").is_err());
        assert!(ScramServer::from_client_first("n,,").is_err());
    }
 }
--- a/rust/crates/mailer-smtp/src/server.rs
+++ b/rust/crates/mailer-smtp/src/server.rs
@@ -12,6 +12,7 @@ use crate::rate_limiter::{RateLimitConfig, RateLimiter};
 use hickory_resolver::TokioResolver;
 use mailer_security::MessageAuthenticator;
 use rustls_pki_types::{CertificateDer, PrivateKeyDer};
 use std::collections::HashMap;
 use std::io::BufReader;
 use std::sync::atomic::{AtomicBool, AtomicU32, Ordering};
 use std::sync::Arc;
@@ -263,6 +264,69 @@ async fn accept_loop(
    }
 }
 /// SNI-based certificate resolver that selects the appropriate TLS certificate
 /// based on the client's requested hostname.
 struct SniCertResolver {
    /// Domain -> certified key mapping.
    certs: HashMap<String, Arc<rustls::sign::CertifiedKey>>,
    /// Default certificate for non-matching SNI or missing SNI.
    default: Arc<rustls::sign::CertifiedKey>,
 }
 impl std::fmt::Debug for SniCertResolver {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.debug_struct("SniCertResolver")
            .field("domains", &self.certs.keys().collect::<Vec<_>>())
            .finish()
    }
 }
 impl rustls::server::ResolvesServerCert for SniCertResolver {
    fn resolve(
        &self,
        client_hello: rustls::server::ClientHello<'_>,
    ) -> Option<Arc<rustls::sign::CertifiedKey>> {
        if let Some(sni) = client_hello.server_name() {
            let sni_lower = sni.to_lowercase();
            if let Some(key) = self.certs.get(&sni_lower) {
                return Some(key.clone());
            }
        }
        Some(self.default.clone())
    }
 }
 /// Parse a PEM cert+key pair into a `CertifiedKey`.
 fn parse_certified_key(
    cert_pem: &str,
    key_pem: &str,
 ) -> Result<rustls::sign::CertifiedKey, Box<dyn std::error::Error + Send + Sync>> {
    let certs: Vec<CertificateDer<'static>> = {
        let mut reader = BufReader::new(cert_pem.as_bytes());
        rustls_pemfile::certs(&mut reader).collect::<Result<Vec<_>, _>>()?
    };
    if certs.is_empty() {
        return Err("No certificates found in PEM".into());
    }
    let key: PrivateKeyDer<'static> = {
        let mut reader = BufReader::new(key_pem.as_bytes());
        let mut keys = Vec::new();
        for item in rustls_pemfile::read_all(&mut reader) {
            match item? {
                rustls_pemfile::Item::Pkcs8Key(key) => keys.push(PrivateKeyDer::Pkcs8(key)),
                rustls_pemfile::Item::Pkcs1Key(key) => keys.push(PrivateKeyDer::Pkcs1(key)),
                rustls_pemfile::Item::Sec1Key(key) => keys.push(PrivateKeyDer::Sec1(key)),
                _ => {}
            }
        }
        keys.into_iter().next().ok_or("No private key found in PEM")?
    };
    let signing_key = rustls::crypto::ring::sign::any_supported_type(&key)?;
    Ok(rustls::sign::CertifiedKey::new(certs, signing_key))
 }
 /// Build a TLS acceptor from PEM cert/key strings.
 fn build_tls_acceptor(
    config: &SmtpServerConfig,
@@ -311,9 +375,42 @@ fn build_tls_acceptor(
            .ok_or("No private key found in PEM")?
    };
-    let tls_config = rustls::ServerConfig::builder()
+    // If additional TLS certs are configured, use SNI-based resolution
-        .with_no_client_auth()
+    let tls_config = if config.additional_tls_certs.is_empty() {
-        .with_single_cert(certs, key)?;
+        rustls::ServerConfig::builder()
            .with_no_client_auth()
            .with_single_cert(certs, key)?
    } else {
        // Build default certified key
        let signing_key = rustls::crypto::ring::sign::any_supported_type(&key)?;
        let default_ck = Arc::new(rustls::sign::CertifiedKey::new(certs, signing_key));
        // Build per-domain certs
        let mut domain_certs = HashMap::new();
        for domain_cert in &config.additional_tls_certs {
            match parse_certified_key(&domain_cert.cert_pem, &domain_cert.key_pem) {
                Ok(ck) => {
                    let ck = Arc::new(ck);
                    for domain in &domain_cert.domains {
                        domain_certs.insert(domain.to_lowercase(), ck.clone());
                    }
                    info!("SNI cert loaded for domains: {:?}", domain_cert.domains);
                }
                Err(e) => {
                    warn!("Failed to load SNI cert for domains {:?}: {}", domain_cert.domains, e);
                }
            }
        }
        let resolver = SniCertResolver {
            certs: domain_certs,
            default: default_ck,
        };
        rustls::ServerConfig::builder()
            .with_no_client_auth()
            .with_cert_resolver(Arc::new(resolver))
    };
    Ok(tokio_rustls::TlsAcceptor::from(Arc::new(tls_config)))
 }
--- a/scripts/compile-all.sh
+++ b/scripts/compile-all.sh
@@ -1,66 +0,0 @@
 #!/bin/bash
 set -e
 # Get version from deno.json
 VERSION=$(cat deno.json | grep -o '"version": *"[^"]*"' | cut -d'"' -f4)
 BINARY_DIR="dist/binaries"
 echo "================================================"
 echo "  MAILER Compilation Script"
 echo "  Version: ${VERSION}"
 echo "================================================"
 echo ""
 echo "Compiling for all supported platforms..."
 echo ""
 # Clean up old binaries and create fresh directory
 rm -rf "$BINARY_DIR"
 mkdir -p "$BINARY_DIR"
 echo "→ Cleaned old binaries from $BINARY_DIR"
 echo ""
 # Linux x86_64
 echo "→ Compiling for Linux x86_64..."
 deno compile --allow-all --no-check --output "$BINARY_DIR/mailer-linux-x64" \
  --target x86_64-unknown-linux-gnu mod.ts
 echo "  ✓ Linux x86_64 complete"
 echo ""
 # Linux ARM64
 echo "→ Compiling for Linux ARM64..."
 deno compile --allow-all --no-check --output "$BINARY_DIR/mailer-linux-arm64" \
  --target aarch64-unknown-linux-gnu mod.ts
 echo "  ✓ Linux ARM64 complete"
 echo ""
 # macOS x86_64
 echo "→ Compiling for macOS x86_64..."
 deno compile --allow-all --no-check --output "$BINARY_DIR/mailer-macos-x64" \
  --target x86_64-apple-darwin mod.ts
 echo "  ✓ macOS x86_64 complete"
 echo ""
 # macOS ARM64
 echo "→ Compiling for macOS ARM64..."
 deno compile --allow-all --no-check --output "$BINARY_DIR/mailer-macos-arm64" \
  --target aarch64-apple-darwin mod.ts
 echo "  ✓ macOS ARM64 complete"
 echo ""
 # Windows x86_64
 echo "→ Compiling for Windows x86_64..."
 deno compile --allow-all --no-check --output "$BINARY_DIR/mailer-windows-x64.exe" \
  --target x86_64-pc-windows-msvc mod.ts
 echo "  ✓ Windows x86_64 complete"
 echo ""
 echo "================================================"
 echo "  Compilation Summary"
 echo "================================================"
 echo ""
 ls -lh "$BINARY_DIR/" | tail -n +2
 echo ""
 echo "✓ All binaries compiled successfully!"
 echo ""
 echo "Binary location: $BINARY_DIR/"
 echo ""
--- a/test/helpers/server.loader.ts
+++ b/test/helpers/server.loader.ts
@@ -1,148 +0,0 @@
 import * as plugins from '../../ts/plugins.js';
 export interface ITestServerConfig {
  port: number;
  hostname?: string;
  tlsEnabled?: boolean;
  authRequired?: boolean;
  timeout?: number;
  testCertPath?: string;
  testKeyPath?: string;
  maxConnections?: number;
  size?: number;
  maxRecipients?: number;
 }
 export interface ITestServer {
  server: any;
  smtpServer: any;
  port: number;
  hostname: string;
  config: ITestServerConfig;
  startTime: number;
 }
 /**
 * Starts a test SMTP server with the given configuration.
 *
 * NOTE: The TS SMTP server implementation was removed in Phase 7B
 * (replaced by the Rust SMTP server). This stub preserves the interface
 * for smtpclient tests that import it, but those tests require `node-forge`
 * which is not installed (pre-existing issue).
 */
 export async function startTestServer(_config: ITestServerConfig): Promise<ITestServer> {
  throw new Error(
    'startTestServer is no longer available — the TS SMTP server was removed in Phase 7B. ' +
    'Use the Rust SMTP server (via UnifiedEmailServer) for integration testing.'
  );
 }
 /**
 * Stops a test SMTP server
 */
 export async function stopTestServer(testServer: ITestServer): Promise<void> {
  if (!testServer || !testServer.smtpServer) {
    return;
  }
  try {
    if (testServer.smtpServer.close && typeof testServer.smtpServer.close === 'function') {
      await testServer.smtpServer.close();
    }
  } catch (error) {
    console.error('Error stopping test server:', error);
    throw error;
  }
 }
 /**
 * Get an available port for testing
 */
 export async function getAvailablePort(startPort: number = 25000): Promise<number> {
  for (let port = startPort; port < startPort + 1000; port++) {
    if (await isPortFree(port)) {
      return port;
    }
  }
  throw new Error(`No available ports found starting from ${startPort}`);
 }
 /**
 * Check if a port is free
 */
 async function isPortFree(port: number): Promise<boolean> {
  return new Promise((resolve) => {
    const server = plugins.net.createServer();
    server.listen(port, () => {
      server.close(() => resolve(true));
    });
    server.on('error', () => resolve(false));
  });
 }
 /**
 * Create test email data
 */
 export function createTestEmail(options: {
  from?: string;
  to?: string | string[];
  subject?: string;
  text?: string;
  html?: string;
  attachments?: any[];
 } = {}): any {
  return {
    from: options.from || 'test@example.com',
    to: options.to || 'recipient@example.com',
    subject: options.subject || 'Test Email',
    text: options.text || 'This is a test email',
    html: options.html || '<p>This is a test email</p>',
    attachments: options.attachments || [],
    date: new Date(),
    messageId: `<${Date.now()}@test.example.com>`
  };
 }
 /**
 * Simple test server for custom protocol testing
 */
 export interface ISimpleTestServer {
  server: any;
  hostname: string;
  port: number;
 }
 export async function createTestServer(options: {
  onConnection?: (socket: any) => void | Promise<void>;
  port?: number;
  hostname?: string;
 }): Promise<ISimpleTestServer> {
  const hostname = options.hostname || 'localhost';
  const port = options.port || await getAvailablePort();
  const server = plugins.net.createServer((socket) => {
    if (options.onConnection) {
      const result = options.onConnection(socket);
      if (result && typeof result.then === 'function') {
        result.catch(error => {
          console.error('Error in onConnection handler:', error);
          socket.destroy();
        });
      }
    }
  });
  return new Promise((resolve, reject) => {
    server.listen(port, hostname, () => {
      resolve({
        server,
        hostname,
        port
      });
    });
    server.on('error', reject);
  });
 }
--- a/test/helpers/smtp.client.ts
+++ b/test/helpers/smtp.client.ts
@@ -1,209 +0,0 @@
 import { smtpClientMod } from '../../ts/mail/delivery/index.js';
 import type { ISmtpClientOptions, SmtpClient } from '../../ts/mail/delivery/smtpclient/index.js';
 import { Email } from '../../ts/mail/core/classes.email.js';
 /**
 * Create a test SMTP client
 */
 export function createTestSmtpClient(options: Partial<ISmtpClientOptions> = {}): SmtpClient {
  const defaultOptions: ISmtpClientOptions = {
    host: options.host || 'localhost',
    port: options.port || 2525,
    secure: options.secure || false,
    auth: options.auth,
    connectionTimeout: options.connectionTimeout || 5000,
    socketTimeout: options.socketTimeout || 5000,
    maxConnections: options.maxConnections || 5,
    maxMessages: options.maxMessages || 100,
    debug: options.debug || false,
    tls: options.tls || {
      rejectUnauthorized: false
    }
  };
  return smtpClientMod.createSmtpClient(defaultOptions);
 }
 /**
 * Send test email using SMTP client
 */
 export async function sendTestEmail(
  client: SmtpClient,
  options: {
    from?: string;
    to?: string | string[];
    subject?: string;
    text?: string;
    html?: string;
  } = {}
 ): Promise<any> {
  const mailOptions = {
    from: options.from || 'test@example.com',
    to: options.to || 'recipient@example.com',
    subject: options.subject || 'Test Email',
    text: options.text || 'This is a test email',
    html: options.html
  };
  const email = new Email({
    from: mailOptions.from,
    to: mailOptions.to,
    subject: mailOptions.subject,
    text: mailOptions.text,
    html: mailOptions.html
  });
  return client.sendMail(email);
 }
 /**
 * Test SMTP client connection
 */
 export async function testClientConnection(
  host: string,
  port: number,
  timeout: number = 5000
 ): Promise<boolean> {
  const client = createTestSmtpClient({
    host,
    port,
    connectionTimeout: timeout
  });
  try {
    const result = await client.verify();
    return result;
  } catch (error) {
    throw error;
  } finally {
    if (client.close) {
      await client.close();
    }
  }
 }
 /**
 * Create authenticated SMTP client
 */
 export function createAuthenticatedClient(
  host: string,
  port: number,
  username: string,
  password: string,
  authMethod: 'PLAIN' | 'LOGIN' = 'PLAIN'
 ): SmtpClient {
  return createTestSmtpClient({
    host,
    port,
    auth: {
      user: username,
      pass: password,
      method: authMethod
    },
    secure: false
  });
 }
 /**
 * Create TLS-enabled SMTP client
 */
 export function createTlsClient(
  host: string,
  port: number,
  options: {
    secure?: boolean;
    rejectUnauthorized?: boolean;
  } = {}
 ): SmtpClient {
  return createTestSmtpClient({
    host,
    port,
    secure: options.secure || false,
    tls: {
      rejectUnauthorized: options.rejectUnauthorized || false
    }
  });
 }
 /**
 * Test client pool status
 */
 export async function testClientPoolStatus(client: SmtpClient): Promise<any> {
  if (typeof client.getPoolStatus === 'function') {
    return client.getPoolStatus();
  }
  // Fallback for clients without pool status
  return {
    size: 1,
    available: 1,
    pending: 0,
    connecting: 0,
    active: 0
  };
 }
 /**
 * Send multiple emails concurrently
 */
 export async function sendConcurrentEmails(
  client: SmtpClient,
  count: number,
  emailOptions: {
    from?: string;
    to?: string;
    subject?: string;
    text?: string;
  } = {}
 ): Promise<any[]> {
  const promises = [];
  for (let i = 0; i < count; i++) {
    promises.push(
      sendTestEmail(client, {
        ...emailOptions,
        subject: `${emailOptions.subject || 'Test Email'} ${i + 1}`
      })
    );
  }
  return Promise.all(promises);
 }
 /**
 * Measure client throughput
 */
 export async function measureClientThroughput(
  client: SmtpClient,
  duration: number = 10000,
  emailOptions: {
    from?: string;
    to?: string;
    subject?: string;
    text?: string;
  } = {}
 ): Promise<{ totalSent: number; successCount: number; errorCount: number; throughput: number }> {
  const startTime = Date.now();
  let totalSent = 0;
  let successCount = 0;
  let errorCount = 0;
  while (Date.now() - startTime < duration) {
    try {
      await sendTestEmail(client, emailOptions);
      successCount++;
    } catch (error) {
      errorCount++;
    }
    totalSent++;
  }
  const actualDuration = (Date.now() - startTime) / 1000; // in seconds
  const throughput = totalSent / actualDuration;
  return {
    totalSent,
    successCount,
    errorCount,
    throughput
  };
 }
--- a/test/test.e2e.inbound-smtp.node.ts
+++ b/test/test.e2e.inbound-smtp.node.ts
@@ -0,0 +1,239 @@
 import { tap, expect } from '@git.zone/tstest/tapbundle';
 import { UnifiedEmailServer } from '../ts/mail/routing/classes.unified.email.server.js';
 import { RustSecurityBridge } from '../ts/security/classes.rustsecuritybridge.js';
 import {
  connectToSmtp,
  waitForGreeting,
  sendSmtpCommand,
  performSmtpHandshake,
  createConcurrentConnections,
  createMimeMessage,
 } from './helpers/utils.js';
 const storageMap = new Map<string, string>();
 const mockDcRouter = {
  storageManager: {
    get: async (key: string) => storageMap.get(key) || null,
    set: async (key: string, value: string) => { storageMap.set(key, value); },
  },
 };
 let server: UnifiedEmailServer;
 let bridge: RustSecurityBridge;
 let bridgeAvailable = false;
 tap.test('setup - start server on port 10125', async () => {
  RustSecurityBridge.resetInstance();
  bridge = RustSecurityBridge.getInstance();
  server = new UnifiedEmailServer(mockDcRouter, {
    ports: [10125],
    hostname: 'test.inbound.local',
    domains: [
      {
        domain: 'testdomain.com',
        dnsMode: 'forward',
      },
    ],
    routes: [
      {
        name: 'catch-all',
        priority: 0,
        match: {
          recipients: '*@testdomain.com',
        },
        action: {
          type: 'process',
        },
      },
    ],
  });
  try {
    await server.start();
    bridgeAvailable = true;
  } catch (err) {
    console.log(`SKIP: Server failed to start — ${(err as Error).message}`);
    console.log('Build the Rust binary with: cd rust && cargo build --release');
  }
 });
 tap.test('EHLO and capability discovery', async () => {
  if (!bridgeAvailable) {
    console.log('SKIP: bridge not running');
    return;
  }
  const socket = await connectToSmtp('127.0.0.1', 10125, 10000);
  const capabilities = await performSmtpHandshake(socket, 'test-client.local');
  // Verify we received capabilities from the EHLO response
  expect(capabilities.length).toBeGreaterThan(0);
  // The server hostname should be in the first capability line
  const firstLine = capabilities[0];
  expect(firstLine).toBeTruthy();
  socket.destroy();
 });
 tap.test('send valid email - full SMTP transaction', async () => {
  if (!bridgeAvailable) {
    console.log('SKIP: bridge not running');
    return;
  }
  const socket = await connectToSmtp('127.0.0.1', 10125, 10000);
  await waitForGreeting(socket, 10000);
  // EHLO
  await sendSmtpCommand(socket, 'EHLO test-client.local', '250', 10000);
  // MAIL FROM
  await sendSmtpCommand(socket, 'MAIL FROM:<sender@example.com>', '250', 10000);
  // RCPT TO
  await sendSmtpCommand(socket, 'RCPT TO:<user@testdomain.com>', '250', 10000);
  // DATA
  await sendSmtpCommand(socket, 'DATA', '354', 10000);
  // Send MIME message
  const mimeMessage = createMimeMessage({
    from: 'sender@example.com',
    to: 'user@testdomain.com',
    subject: 'E2E Test Email',
    text: 'This is an end-to-end test email.',
  });
  // Send the message data followed by the terminator
  await new Promise<void>((resolve, reject) => {
    let buffer = '';
    const timer = setTimeout(() => {
      socket.removeAllListeners('data');
      reject(new Error('DATA response timeout'));
    }, 10000);
    const onData = (data: Buffer) => {
      buffer += data.toString();
      if (buffer.includes('250')) {
        clearTimeout(timer);
        socket.removeListener('data', onData);
        resolve();
      }
    };
    socket.on('data', onData);
    socket.write(mimeMessage + '\r\n.\r\n');
  });
  // QUIT
  try {
    await sendSmtpCommand(socket, 'QUIT', '221', 5000);
  } catch {
    // Ignore QUIT errors
  }
  socket.destroy();
  // Verify the email was queued for processing
  const stats = server.deliveryQueue.getStats();
  expect(stats.queueSize).toBeGreaterThan(0);
 });
 tap.test('multiple recipients', async () => {
  if (!bridgeAvailable) {
    console.log('SKIP: bridge not running');
    return;
  }
  const socket = await connectToSmtp('127.0.0.1', 10125, 10000);
  await waitForGreeting(socket, 10000);
  await sendSmtpCommand(socket, 'EHLO test-client.local', '250', 10000);
  await sendSmtpCommand(socket, 'MAIL FROM:<sender@example.com>', '250', 10000);
  await sendSmtpCommand(socket, 'RCPT TO:<user1@testdomain.com>', '250', 10000);
  await sendSmtpCommand(socket, 'RCPT TO:<user2@testdomain.com>', '250', 10000);
  await sendSmtpCommand(socket, 'DATA', '354', 10000);
  const mimeMessage = createMimeMessage({
    from: 'sender@example.com',
    to: 'user1@testdomain.com',
    subject: 'Multi-recipient Test',
    text: 'Testing multiple recipients.',
  });
  await new Promise<void>((resolve, reject) => {
    let buffer = '';
    const timer = setTimeout(() => {
      socket.removeAllListeners('data');
      reject(new Error('DATA response timeout'));
    }, 10000);
    const onData = (data: Buffer) => {
      buffer += data.toString();
      if (buffer.includes('250')) {
        clearTimeout(timer);
        socket.removeListener('data', onData);
        resolve();
      }
    };
    socket.on('data', onData);
    socket.write(mimeMessage + '\r\n.\r\n');
  });
  socket.destroy();
 });
 tap.test('concurrent connections', async () => {
  if (!bridgeAvailable) {
    console.log('SKIP: bridge not running');
    return;
  }
  const sockets = await createConcurrentConnections('127.0.0.1', 10125, 3, 10000);
  expect(sockets.length).toEqual(3);
  // Perform EHLO on each connection
  for (const socket of sockets) {
    await waitForGreeting(socket, 10000);
    await sendSmtpCommand(socket, 'EHLO concurrent-client.local', '250', 10000);
  }
  // Close all connections
  for (const socket of sockets) {
    socket.destroy();
  }
 });
 tap.test('RSET mid-session', async () => {
  if (!bridgeAvailable) {
    console.log('SKIP: bridge not running');
    return;
  }
  const socket = await connectToSmtp('127.0.0.1', 10125, 10000);
  await waitForGreeting(socket, 10000);
  await sendSmtpCommand(socket, 'EHLO test-client.local', '250', 10000);
  // Start a transaction
  await sendSmtpCommand(socket, 'MAIL FROM:<sender@example.com>', '250', 10000);
  // Reset the transaction
  await sendSmtpCommand(socket, 'RSET', '250', 10000);
  // Start a new transaction after RSET
  await sendSmtpCommand(socket, 'MAIL FROM:<other@example.com>', '250', 10000);
  socket.destroy();
 });
 tap.test('cleanup - stop server', async () => {
  if (bridgeAvailable) {
    await server.stop();
  }
  await tap.stopForcefully();
 });
 export default tap.start();
--- a/test/test.e2e.outbound-delivery.node.ts
+++ b/test/test.e2e.outbound-delivery.node.ts
@@ -0,0 +1,196 @@
 import { tap, expect } from '@git.zone/tstest/tapbundle';
 import { UnifiedEmailServer } from '../ts/mail/routing/classes.unified.email.server.js';
 import { RustSecurityBridge, BridgeState } from '../ts/security/classes.rustsecuritybridge.js';
 import type { ISmtpPoolStatus } from '../ts/security/classes.rustsecuritybridge.js';
 import { Email } from '../ts/mail/core/classes.email.js';
 import * as net from 'net';
 const storageMap = new Map<string, string>();
 const mockDcRouter = {
  storageManager: {
    get: async (key: string) => storageMap.get(key) || null,
    set: async (key: string, value: string) => { storageMap.set(key, value); },
  },
 };
 let server: UnifiedEmailServer;
 let bridge: RustSecurityBridge;
 let bridgeAvailable = false;
 let mockSmtpServer: net.Server;
 /**
 * Create a minimal mock SMTP server that accepts any email.
 * This avoids the IPC deadlock that occurs when the Rust SMTP client
 * sends to the same Rust process's SMTP server (the IPC stdin reader
 * blocks on the sendEmail command and can't process emailProcessingResult).
 */
 function createMockSmtpServer(port: number): Promise<net.Server> {
  return new Promise((resolve, reject) => {
    const srv = net.createServer((socket) => {
      socket.write('220 mock-smtp.local ESMTP MockServer\r\n');
      let inData = false;
      let dataBuffer = '';
      socket.on('data', (chunk) => {
        const input = chunk.toString();
        if (inData) {
          dataBuffer += input;
          if (dataBuffer.includes('\r\n.\r\n')) {
            inData = false;
            dataBuffer = '';
            socket.write('250 2.0.0 Ok: queued\r\n');
          }
          return;
        }
        // Process SMTP commands line by line
        const lines = input.split('\r\n').filter((l: string) => l.length > 0);
        for (const line of lines) {
          const cmd = line.toUpperCase();
          if (cmd.startsWith('EHLO') || cmd.startsWith('HELO')) {
            socket.write(`250-mock-smtp.local\r\n250-SIZE 10485760\r\n250 OK\r\n`);
          } else if (cmd.startsWith('MAIL FROM')) {
            socket.write('250 2.1.0 Ok\r\n');
          } else if (cmd.startsWith('RCPT TO')) {
            socket.write('250 2.1.5 Ok\r\n');
          } else if (cmd === 'DATA') {
            inData = true;
            dataBuffer = '';
            socket.write('354 End data with <CR><LF>.<CR><LF>\r\n');
          } else if (cmd === 'QUIT') {
            socket.write('221 2.0.0 Bye\r\n');
            socket.end();
          } else if (cmd === 'RSET') {
            socket.write('250 2.0.0 Ok\r\n');
          }
        }
      });
    });
    srv.listen(port, '127.0.0.1', () => {
      resolve(srv);
    });
    srv.on('error', reject);
  });
 }
 tap.test('setup - start bridge and mock SMTP server', async () => {
  RustSecurityBridge.resetInstance();
  bridge = RustSecurityBridge.getInstance();
  server = new UnifiedEmailServer(mockDcRouter, {
    ports: [10325],
    hostname: 'test.outbound.local',
    domains: [
      {
        domain: 'outbound-test.com',
        dnsMode: 'forward',
      },
    ],
    routes: [
      {
        name: 'catch-all',
        priority: 0,
        match: {
          recipients: '*',
        },
        action: {
          type: 'process',
        },
      },
    ],
  });
  try {
    await server.start();
    bridgeAvailable = true;
  } catch (err) {
    console.log(`SKIP: Server failed to start — ${(err as Error).message}`);
    console.log('Build the Rust binary with: cd rust && cargo build --release');
    return;
  }
  // Start a mock SMTP server on a separate port for outbound delivery tests
  mockSmtpServer = await createMockSmtpServer(10326);
 });
 tap.test('send email to mock SMTP receiver', async () => {
  if (!bridgeAvailable) {
    console.log('SKIP: bridge not running');
    return;
  }
  const email = new Email({
    from: 'sender@outbound-test.com',
    to: 'recipient@outbound-test.com',
    subject: 'Outbound E2E Test',
    text: 'Testing outbound delivery to the mock SMTP server.',
  });
  // Send to the mock SMTP server (port 10326), not the Rust SMTP server (port 10325)
  const result = await server.sendOutboundEmail('127.0.0.1', 10326, email);
  expect(result).toBeTruthy();
  expect(result.accepted).toBeTruthy();
  expect(result.accepted.length).toBeGreaterThan(0);
  expect(result.response).toBeTruthy();
  // Rust SMTP client returns enhanced status code without the 250 prefix
  expect(result.response).toInclude('2.0.0');
 });
 tap.test('send email - connection refused', async () => {
  if (!bridgeAvailable) {
    console.log('SKIP: bridge not running');
    return;
  }
  const email = new Email({
    from: 'sender@outbound-test.com',
    to: 'recipient@outbound-test.com',
    subject: 'Connection Refused Test',
    text: 'This should fail — no server at port 59888.',
  });
  try {
    await server.sendOutboundEmail('127.0.0.1', 59888, email);
    throw new Error('Expected sendOutboundEmail to fail on connection refused');
  } catch (err: any) {
    expect(err).toBeTruthy();
    expect(err.message.length).toBeGreaterThan(0);
  }
 });
 tap.test('SMTP pool status and cleanup', async () => {
  if (!bridgeAvailable) {
    console.log('SKIP: bridge not running');
    return;
  }
  const status: ISmtpPoolStatus = await bridge.getSmtpPoolStatus();
  expect(status).toBeTruthy();
  expect(status.pools).toBeTruthy();
  expect(typeof status.pools).toEqual('object');
  // Close all pools
  await bridge.closeSmtpPool();
  // Verify pools are empty
  const statusAfter = await bridge.getSmtpPoolStatus();
  const poolKeys = Object.keys(statusAfter.pools);
  expect(poolKeys.length).toEqual(0);
 });
 tap.test('cleanup - stop server and mock', async () => {
  if (mockSmtpServer) {
    await new Promise<void>((resolve) => mockSmtpServer.close(() => resolve()));
  }
  if (bridgeAvailable) {
    await server.stop();
  }
  await tap.stopForcefully();
 });
 export default tap.start();
--- a/test/test.e2e.routing-actions.node.ts
+++ b/test/test.e2e.routing-actions.node.ts
@@ -0,0 +1,239 @@
 import { tap, expect } from '@git.zone/tstest/tapbundle';
 import { UnifiedEmailServer } from '../ts/mail/routing/classes.unified.email.server.js';
 import { RustSecurityBridge } from '../ts/security/classes.rustsecuritybridge.js';
 import { Email } from '../ts/mail/core/classes.email.js';
 import { SmtpState } from '../ts/mail/delivery/interfaces.js';
 const storageMap = new Map<string, string>();
 const mockDcRouter = {
  storageManager: {
    get: async (key: string) => storageMap.get(key) || null,
    set: async (key: string, value: string) => { storageMap.set(key, value); },
  },
 };
 let server: UnifiedEmailServer;
 let bridge: RustSecurityBridge;
 let bridgeAvailable = false;
 /**
 * Build a minimal SMTP session object for processEmailByMode().
 */
 function buildSession(email: Email): any {
  return {
    id: `test-${Date.now()}-${Math.random().toString(36).substring(2)}`,
    state: SmtpState.FINISHED,
    mailFrom: email.from,
    rcptTo: email.to,
    emailData: '',
    useTLS: false,
    connectionEnded: false,
    remoteAddress: '127.0.0.1',
    clientHostname: 'test-client.local',
    secure: false,
    authenticated: false,
    envelope: {
      mailFrom: { address: email.from, args: {} },
      rcptTo: email.to.map((addr: string) => ({ address: addr, args: {} })),
    },
  };
 }
 tap.test('setup - start server with routing rules on port 10225', async () => {
  RustSecurityBridge.resetInstance();
  bridge = RustSecurityBridge.getInstance();
  server = new UnifiedEmailServer(mockDcRouter, {
    ports: [10225],
    hostname: 'test.routing.local',
    domains: [
      { domain: 'process.com', dnsMode: 'forward' },
      { domain: 'local.com', dnsMode: 'forward' },
      { domain: 'external.com', dnsMode: 'forward' },
    ],
    routes: [
      {
        name: 'reject-route',
        priority: 40,
        match: {
          senders: '*@spammer.com',
        },
        action: {
          type: 'reject',
          reject: {
            code: 550,
            message: 'Spam rejected',
          },
        },
      },
      {
        name: 'process-route',
        priority: 30,
        match: {
          recipients: '*@process.com',
        },
        action: {
          type: 'process',
          process: {
            scan: true,
          },
        },
      },
      {
        name: 'deliver-route',
        priority: 20,
        match: {
          recipients: '*@local.com',
        },
        action: {
          type: 'deliver',
        },
      },
      {
        name: 'forward-route',
        priority: 10,
        match: {
          recipients: '*@external.com',
        },
        action: {
          type: 'forward',
          forward: {
            host: '127.0.0.1',
            port: 59999, // No server listening — expected failure
          },
        },
      },
    ],
  });
  try {
    await server.start();
    bridgeAvailable = true;
  } catch (err) {
    console.log(`SKIP: Server failed to start — ${(err as Error).message}`);
    console.log('Build the Rust binary with: cd rust && cargo build --release');
  }
 });
 tap.test('process action - queues email for processing', async () => {
  if (!bridgeAvailable) {
    console.log('SKIP: bridge not running');
    return;
  }
  const email = new Email({
    from: 'sender@example.com',
    to: 'user@process.com',
    subject: 'Process test',
    text: 'This email should be queued for processing.',
  });
  const session = buildSession(email);
  const result = await server.processEmailByMode(email, session);
  expect(result).toBeTruthy();
  const stats = server.deliveryQueue.getStats();
  expect(stats.modes.process).toBeGreaterThan(0);
 });
 tap.test('deliver action - queues email for MTA delivery', async () => {
  if (!bridgeAvailable) {
    console.log('SKIP: bridge not running');
    return;
  }
  const email = new Email({
    from: 'sender@example.com',
    to: 'user@local.com',
    subject: 'Deliver test',
    text: 'This email should be queued for local delivery.',
  });
  const session = buildSession(email);
  const result = await server.processEmailByMode(email, session);
  expect(result).toBeTruthy();
  const stats = server.deliveryQueue.getStats();
  expect(stats.modes.mta).toBeGreaterThan(0);
 });
 tap.test('reject action - throws with correct code', async () => {
  if (!bridgeAvailable) {
    console.log('SKIP: bridge not running');
    return;
  }
  const email = new Email({
    from: 'bad@spammer.com',
    to: 'user@process.com',
    subject: 'Spam attempt',
    text: 'This should be rejected.',
  });
  const session = buildSession(email);
  try {
    await server.processEmailByMode(email, session);
    throw new Error('Expected processEmailByMode to throw for rejected email');
  } catch (err: any) {
    expect(err.responseCode).toEqual(550);
    expect(err.message).toInclude('Spam rejected');
  }
 });
 tap.test('forward action - fails to unreachable host', async () => {
  if (!bridgeAvailable) {
    console.log('SKIP: bridge not running');
    return;
  }
  const email = new Email({
    from: 'sender@example.com',
    to: 'user@external.com',
    subject: 'Forward test',
    text: 'This forward should fail — no server at port 59999.',
  });
  const session = buildSession(email);
  try {
    await server.processEmailByMode(email, session);
    throw new Error('Expected processEmailByMode to throw for unreachable forward host');
  } catch (err: any) {
    // We expect an error from the failed SMTP connection
    expect(err).toBeTruthy();
    expect(err.message).toBeTruthy();
  }
 });
 tap.test('no matching route - throws error', async () => {
  if (!bridgeAvailable) {
    console.log('SKIP: bridge not running');
    return;
  }
  const email = new Email({
    from: 'sender@example.com',
    to: 'nobody@unmatched.com',
    subject: 'Unmatched route test',
    text: 'No route matches this recipient.',
  });
  const session = buildSession(email);
  try {
    await server.processEmailByMode(email, session);
    throw new Error('Expected processEmailByMode to throw for no matching route');
  } catch (err: any) {
    expect(err.message).toInclude('No matching route');
  }
 });
 tap.test('cleanup - stop server', async () => {
  if (bridgeAvailable) {
    await server.stop();
  }
  await tap.stopForcefully();
 });
 export default tap.start();
--- a/test/test.e2e.server-lifecycle.node.ts
+++ b/test/test.e2e.server-lifecycle.node.ts
@@ -0,0 +1,118 @@
 import { tap, expect } from '@git.zone/tstest/tapbundle';
 import { UnifiedEmailServer } from '../ts/mail/routing/classes.unified.email.server.js';
 import { RustSecurityBridge, BridgeState } from '../ts/security/classes.rustsecuritybridge.js';
 import { connectToSmtp, waitForGreeting } from './helpers/utils.js';
 import * as net from 'net';
 // Common mock pattern for dcRouter dependency
 const storageMap = new Map<string, string>();
 const mockDcRouter = {
  storageManager: {
    get: async (key: string) => storageMap.get(key) || null,
    set: async (key: string, value: string) => { storageMap.set(key, value); },
  },
 };
 let server: UnifiedEmailServer;
 let bridge: RustSecurityBridge;
 tap.test('setup - reset bridge singleton', async () => {
  RustSecurityBridge.resetInstance();
  bridge = RustSecurityBridge.getInstance();
 });
 tap.test('construct server - should create UnifiedEmailServer', async () => {
  server = new UnifiedEmailServer(mockDcRouter, {
    ports: [10025, 10587],
    hostname: 'test.e2e.local',
    domains: [
      {
        domain: 'e2e-test.com',
        dnsMode: 'forward',
      },
    ],
    routes: [
      {
        name: 'catch-all',
        priority: 0,
        match: {
          recipients: '*@e2e-test.com',
        },
        action: {
          type: 'process',
        },
      },
    ],
  });
  expect(server).toBeTruthy();
  expect(server).toBeInstanceOf(UnifiedEmailServer);
 });
 tap.test('start server - should start and accept SMTP connections', async () => {
  try {
    await server.start();
  } catch (err) {
    console.log(`SKIP: Server failed to start — ${(err as Error).message}`);
    console.log('Build the Rust binary with: cd rust && cargo build --release');
    return;
  }
  expect(bridge.running).toBeTrue();
  // Connect to port 10025 and verify we get a 220 greeting
  const socket = await connectToSmtp('127.0.0.1', 10025, 10000);
  const greeting = await waitForGreeting(socket, 10000);
  expect(greeting).toInclude('220');
  socket.destroy();
 });
 tap.test('get stats - should return server statistics', async () => {
  if (!bridge.running) {
    console.log('SKIP: bridge not running');
    return;
  }
  const stats = server.getStats();
  expect(stats).toBeTruthy();
  expect(stats.startTime).toBeInstanceOf(Date);
  expect(stats.connections).toBeTruthy();
  expect(typeof stats.connections.current).toEqual('number');
  expect(typeof stats.connections.total).toEqual('number');
  expect(stats.messages).toBeTruthy();
  expect(typeof stats.messages.processed).toEqual('number');
 });
 tap.test('stop server - should stop and refuse connections', async () => {
  if (!bridge.running) {
    console.log('SKIP: bridge not running');
    return;
  }
  await server.stop();
  // Verify connection is refused after stop
  try {
    const socket = await connectToSmtp('127.0.0.1', 10025, 3000);
    socket.destroy();
    // If we get here, the connection was accepted — that's unexpected
    throw new Error('Expected connection to be refused after server stop');
  } catch (err) {
    // Connection refused or timeout is expected
    const msg = (err as Error).message;
    expect(
      msg.includes('ECONNREFUSED') || msg.includes('timeout') || msg.includes('refused')
    ).toBeTrue();
  }
  expect(bridge.state).toEqual(BridgeState.Stopped);
 });
 tap.test('stop', async () => {
  // Clean up if not already stopped
  if (bridge.running) {
    await server.stop();
  }
  await tap.stopForcefully();
 });
 export default tap.start();
--- a/test/test.emailauth.ts
+++ b/test/test.emailauth.ts
@@ -1,195 +1,46 @@
 import { tap, expect } from '@git.zone/tstest/tapbundle';
 import { SpfVerifier, SpfQualifier, SpfMechanismType } from '../ts/mail/security/classes.spfverifier.js';
 import { DmarcVerifier, DmarcPolicy, DmarcAlignment } from '../ts/mail/security/classes.dmarcverifier.js';
 import { Email } from '../ts/mail/core/classes.email.js';
 /**
- * Test email authentication systems: SPF and DMARC
+ * Test email authentication systems: SPF parsing
 */
 // SPF Verifier Tests
 tap.test('SPF Verifier - should parse SPF record', async () => {
  const spfVerifier = new SpfVerifier();
-  
+
  // Test valid SPF record parsing
  const record = 'v=spf1 a mx ip4:192.168.0.1/24 include:example.org ~all';
  const parsedRecord = spfVerifier.parseSpfRecord(record);
-  
+
  expect(parsedRecord).toBeTruthy();
  expect(parsedRecord.version).toEqual('spf1');
  expect(parsedRecord.mechanisms.length).toEqual(5);
-  
+
  // Check specific mechanisms
  expect(parsedRecord.mechanisms[0].type).toEqual(SpfMechanismType.A);
  expect(parsedRecord.mechanisms[0].qualifier).toEqual(SpfQualifier.PASS);
-  
+
  expect(parsedRecord.mechanisms[1].type).toEqual(SpfMechanismType.MX);
  expect(parsedRecord.mechanisms[1].qualifier).toEqual(SpfQualifier.PASS);
-  
+
  expect(parsedRecord.mechanisms[2].type).toEqual(SpfMechanismType.IP4);
  expect(parsedRecord.mechanisms[2].value).toEqual('192.168.0.1/24');
-  
+
  expect(parsedRecord.mechanisms[3].type).toEqual(SpfMechanismType.INCLUDE);
  expect(parsedRecord.mechanisms[3].value).toEqual('example.org');
-  
+
  expect(parsedRecord.mechanisms[4].type).toEqual(SpfMechanismType.ALL);
  expect(parsedRecord.mechanisms[4].qualifier).toEqual(SpfQualifier.SOFTFAIL);
-  
+
  // Test invalid record
  const invalidRecord = 'not-a-spf-record';
  const invalidParsed = spfVerifier.parseSpfRecord(invalidRecord);
  expect(invalidParsed).toBeNull();
 });
 // DMARC Verifier Tests
 tap.test('DMARC Verifier - should parse DMARC record', async () => {
  const dmarcVerifier = new DmarcVerifier();
  // Test valid DMARC record parsing
  const record = 'v=DMARC1; p=reject; sp=quarantine; pct=50; adkim=s; aspf=r; rua=mailto:dmarc@example.com';
  const parsedRecord = dmarcVerifier.parseDmarcRecord(record);
  expect(parsedRecord).toBeTruthy();
  expect(parsedRecord.version).toEqual('DMARC1');
  expect(parsedRecord.policy).toEqual(DmarcPolicy.REJECT);
  expect(parsedRecord.subdomainPolicy).toEqual(DmarcPolicy.QUARANTINE);
  expect(parsedRecord.pct).toEqual(50);
  expect(parsedRecord.adkim).toEqual(DmarcAlignment.STRICT);
  expect(parsedRecord.aspf).toEqual(DmarcAlignment.RELAXED);
  expect(parsedRecord.reportUriAggregate).toContain('dmarc@example.com');
  // Test invalid record
  const invalidRecord = 'not-a-dmarc-record';
  const invalidParsed = dmarcVerifier.parseDmarcRecord(invalidRecord);
  expect(invalidParsed).toBeNull();
 });
 tap.test('DMARC Verifier - should verify DMARC alignment', async () => {
  const dmarcVerifier = new DmarcVerifier();
  // Test email domains with DMARC alignment
  const email = new Email({
    from: 'sender@example.com',
    to: 'recipient@example.net',
    subject: 'Test DMARC alignment',
    text: 'This is a test email'
  });
  // Test when both SPF and DKIM pass with alignment
  const dmarcResult = await dmarcVerifier.verify(
    email,
    { domain: 'example.com', result: true },  // SPF - aligned and passed
    { domain: 'example.com', result: true }   // DKIM - aligned and passed
  );
  expect(dmarcResult).toBeTruthy();
  expect(dmarcResult.spfPassed).toEqual(true);
  expect(dmarcResult.dkimPassed).toEqual(true);
  expect(dmarcResult.spfDomainAligned).toEqual(true);
  expect(dmarcResult.dkimDomainAligned).toEqual(true);
  expect(dmarcResult.action).toEqual('pass');
  // Test when neither SPF nor DKIM is aligned
  const dmarcResult2 = await dmarcVerifier.verify(
    email,
    { domain: 'differentdomain.com', result: true },  // SPF - passed but not aligned
    { domain: 'anotherdomain.com', result: true }     // DKIM - passed but not aligned
  );
  // Without a DNS manager, no DMARC record will be found
  expect(dmarcResult2).toBeTruthy();
  expect(dmarcResult2.spfPassed).toEqual(true);
  expect(dmarcResult2.dkimPassed).toEqual(true);
  expect(dmarcResult2.spfDomainAligned).toEqual(false);
  expect(dmarcResult2.dkimDomainAligned).toEqual(false);
  // Without a DMARC record, the default action is 'pass'
  expect(dmarcResult2.hasDmarc).toEqual(false);
  expect(dmarcResult2.policyEvaluated).toEqual(DmarcPolicy.NONE);
  expect(dmarcResult2.actualPolicy).toEqual(DmarcPolicy.NONE);
  expect(dmarcResult2.action).toEqual('pass');
 });
 tap.test('DMARC Verifier - should apply policy correctly', async () => {
  const dmarcVerifier = new DmarcVerifier();
  // Create test email
  const email = new Email({
    from: 'sender@example.com',
    to: 'recipient@example.net',
    subject: 'Test DMARC policy application',
    text: 'This is a test email'
  });
  // Test pass action
  const passResult: any = {
    hasDmarc: true,
    spfDomainAligned: true,
    dkimDomainAligned: true,
    spfPassed: true,
    dkimPassed: true,
    policyEvaluated: DmarcPolicy.NONE,
    actualPolicy: DmarcPolicy.NONE,
    appliedPercentage: 100,
    action: 'pass',
    details: 'DMARC passed'
  };
  const passApplied = dmarcVerifier.applyPolicy(email, passResult);
  expect(passApplied).toEqual(true);
  expect(email.mightBeSpam).toEqual(false);
  expect(email.headers['X-DMARC-Result']).toEqual('DMARC passed');
  // Test quarantine action
  const quarantineResult: any = {
    hasDmarc: true,
    spfDomainAligned: false,
    dkimDomainAligned: false,
    spfPassed: false,
    dkimPassed: false,
    policyEvaluated: DmarcPolicy.QUARANTINE,
    actualPolicy: DmarcPolicy.QUARANTINE,
    appliedPercentage: 100,
    action: 'quarantine',
    details: 'DMARC failed, policy=quarantine'
  };
  // Reset email spam flag
  email.mightBeSpam = false;
  email.headers = {};
  const quarantineApplied = dmarcVerifier.applyPolicy(email, quarantineResult);
  expect(quarantineApplied).toEqual(true);
  expect(email.mightBeSpam).toEqual(true);
  expect(email.headers['X-Spam-Flag']).toEqual('YES');
  expect(email.headers['X-DMARC-Result']).toEqual('DMARC failed, policy=quarantine');
  // Test reject action
  const rejectResult: any = {
    hasDmarc: true,
    spfDomainAligned: false,
    dkimDomainAligned: false,
    spfPassed: false,
    dkimPassed: false,
    policyEvaluated: DmarcPolicy.REJECT,
    actualPolicy: DmarcPolicy.REJECT,
    appliedPercentage: 100,
    action: 'reject',
    details: 'DMARC failed, policy=reject'
  };
  // Reset email spam flag
  email.mightBeSpam = false;
  email.headers = {};
  const rejectApplied = dmarcVerifier.applyPolicy(email, rejectResult);
  expect(rejectApplied).toEqual(false);
  expect(email.mightBeSpam).toEqual(true);
 });
 tap.test('stop', async () => {
  await tap.stopForcefully();
 });
-export default tap.start();
+export default tap.start();
--- a/test/test.mta.delivery.node.ts
+++ b/test/test.mta.delivery.node.ts
@@ -0,0 +1,295 @@
 import { tap, expect } from '@git.zone/tstest/tapbundle';
 import { UnifiedEmailServer } from '../ts/mail/routing/classes.unified.email.server.js';
 import { RustSecurityBridge } from '../ts/security/classes.rustsecuritybridge.js';
 import { Email } from '../ts/mail/core/classes.email.js';
 import * as net from 'net';
 import * as dns from 'dns';
 const storageMap = new Map<string, string>();
 const mockDcRouter = {
  storageManager: {
    get: async (key: string) => storageMap.get(key) || null,
    set: async (key: string, value: string) => { storageMap.set(key, value); },
  },
 };
 let server: UnifiedEmailServer;
 let bridgeAvailable = false;
 let mockSmtpServer: net.Server;
 /**
 * Create a minimal mock SMTP server that accepts any email.
 */
 function createMockSmtpServer(port: number): Promise<net.Server> {
  return new Promise((resolve, reject) => {
    const srv = net.createServer((socket) => {
      socket.write('220 mock-smtp.local ESMTP MockServer\r\n');
      let inData = false;
      let dataBuffer = '';
      socket.on('data', (chunk) => {
        const input = chunk.toString();
        if (inData) {
          dataBuffer += input;
          if (dataBuffer.includes('\r\n.\r\n')) {
            inData = false;
            dataBuffer = '';
            socket.write('250 2.0.0 Ok: queued\r\n');
          }
          return;
        }
        const lines = input.split('\r\n').filter((l: string) => l.length > 0);
        for (const line of lines) {
          const cmd = line.toUpperCase();
          if (cmd.startsWith('EHLO') || cmd.startsWith('HELO')) {
            socket.write(`250-mock-smtp.local\r\n250-SIZE 10485760\r\n250 OK\r\n`);
          } else if (cmd.startsWith('MAIL FROM')) {
            socket.write('250 2.1.0 Ok\r\n');
          } else if (cmd.startsWith('RCPT TO')) {
            socket.write('250 2.1.5 Ok\r\n');
          } else if (cmd === 'DATA') {
            inData = true;
            dataBuffer = '';
            socket.write('354 End data with <CR><LF>.<CR><LF>\r\n');
          } else if (cmd === 'QUIT') {
            socket.write('221 2.0.0 Bye\r\n');
            socket.end();
          } else if (cmd === 'RSET') {
            socket.write('250 2.0.0 Ok\r\n');
          }
        }
      });
    });
    srv.listen(port, '127.0.0.1', () => {
      resolve(srv);
    });
    srv.on('error', reject);
  });
 }
 // Store original resolveMx so we can restore it
 const originalResolveMx = dns.promises.Resolver.prototype.resolveMx;
 tap.test('setup - start server and mock SMTP', async () => {
  RustSecurityBridge.resetInstance();
  server = new UnifiedEmailServer(mockDcRouter, {
    ports: [10425],
    hostname: 'test.mta.local',
    domains: [
      { domain: 'mta-test.com', dnsMode: 'forward' },
    ],
    routes: [
      {
        name: 'mta-route',
        priority: 10,
        match: { recipients: '*@mta-test.com' },
        action: { type: 'deliver' },
      },
      {
        name: 'process-route',
        priority: 20,
        match: { recipients: '*@process-test.com' },
        action: {
          type: 'process',
          options: {
            contentScanning: true,
            scanners: [{ type: 'spam' }],
          },
        },
      },
    ],
  });
  try {
    await server.start();
    bridgeAvailable = true;
  } catch (err) {
    console.log(`SKIP: Server failed to start — ${(err as Error).message}`);
    console.log('Build the Rust binary with: cd rust && cargo build --release');
    return;
  }
  mockSmtpServer = await createMockSmtpServer(10426);
 });
 tap.test('MX resolution for a public domain', async () => {
  if (!bridgeAvailable) { console.log('SKIP'); return; }
  // Use the delivery system's resolveMxForDomain via a quick DNS lookup
  const resolver = new dns.promises.Resolver();
  try {
    const records = await resolver.resolveMx('gmail.com');
    expect(records).toBeTruthy();
    expect(records.length).toBeGreaterThan(0);
    // Each record should have exchange and priority
    for (const rec of records) {
      expect(typeof rec.exchange).toEqual('string');
      expect(typeof rec.priority).toEqual('number');
    }
    console.log(`Resolved ${records.length} MX records for gmail.com`);
  } catch (err) {
    console.log(`SKIP: DNS resolution failed (network may be unavailable): ${(err as Error).message}`);
  }
 });
 tap.test('group recipients by domain', async () => {
  if (!bridgeAvailable) { console.log('SKIP'); return; }
  // Test the grouping logic directly
  const recipients = [
    'alice@example.com',
    'bob@example.com',
    'carol@other.org',
    'dave@example.com',
    'eve@other.org',
  ];
  const groups = new Map<string, string[]>();
  for (const rcpt of recipients) {
    const domain = rcpt.split('@')[1]?.toLowerCase();
    if (!domain) continue;
    const list = groups.get(domain) || [];
    list.push(rcpt);
    groups.set(domain, list);
  }
  expect(groups.size).toEqual(2);
  expect(groups.get('example.com')!.length).toEqual(3);
  expect(groups.get('other.org')!.length).toEqual(2);
 });
 tap.test('MTA delivery to mock SMTP server via mocked MX', async () => {
  if (!bridgeAvailable) { console.log('SKIP'); return; }
  // Mock dns.promises.Resolver.resolveMx to return 127.0.0.1
  dns.promises.Resolver.prototype.resolveMx = async function (_hostname: string) {
    return [{ exchange: '127.0.0.1', priority: 10 }];
  };
  const email = new Email({
    from: 'sender@mta-test.com',
    to: 'recipient@target-domain.com',
    subject: 'MTA Delivery Test',
    text: 'Testing MTA delivery with MX resolution.',
  });
  // Use sendOutboundEmail at the resolved MX host (which is mocked to 127.0.0.1)
  // But the real test is the delivery system's handleMtaDelivery, which we test
  // by sending through the server's outbound path with the mock MX.
  // Direct test: resolve MX then send
  const resolver = new dns.promises.Resolver();
  const mxRecords = await resolver.resolveMx('target-domain.com');
  expect(mxRecords[0].exchange).toEqual('127.0.0.1');
  // Send via the resolved MX host to the mock SMTP server on port 10425
  // Note: MTA delivery uses port 25 by default, but our mock is on 10425.
  // We test the sendOutboundEmail path directly with the mock MX host.
  const result = await server.sendOutboundEmail('127.0.0.1', 10426, email);
  expect(result).toBeTruthy();
  expect(result.accepted.length).toBeGreaterThan(0);
  expect(result.response).toInclude('2.0.0');
  // Restore original resolveMx
  dns.promises.Resolver.prototype.resolveMx = originalResolveMx;
 });
 tap.test('MTA delivery - connection refused to unreachable MX', async () => {
  if (!bridgeAvailable) { console.log('SKIP'); return; }
  const email = new Email({
    from: 'sender@mta-test.com',
    to: 'recipient@unreachable-domain.com',
    subject: 'Connection Refused MX Test',
    text: 'This should fail — no server at the target.',
  });
  // Send to a port that nothing is listening on
  try {
    await server.sendOutboundEmail('127.0.0.1', 59789, email);
    throw new Error('Expected sendOutboundEmail to fail');
  } catch (err: any) {
    expect(err).toBeTruthy();
    expect(err.message.length).toBeGreaterThan(0);
    console.log(`Got expected error: ${err.message}`);
  }
 });
 tap.test('MTA delivery with multiple recipients across domains', async () => {
  if (!bridgeAvailable) { console.log('SKIP'); return; }
  // Mock MX to return 127.0.0.1 for all domains
  dns.promises.Resolver.prototype.resolveMx = async function (_hostname: string) {
    return [{ exchange: '127.0.0.1', priority: 10 }];
  };
  const email = new Email({
    from: 'sender@mta-test.com',
    to: ['alice@domain-a.com', 'bob@domain-b.com'],
    subject: 'Multi-Domain MTA Test',
    text: 'Testing delivery to multiple domains.',
  });
  // Send to each recipient's domain individually (simulating MTA behavior)
  for (const recipient of email.to) {
    const singleEmail = new Email({
      from: email.from,
      to: recipient,
      subject: email.subject,
      text: email.text,
    });
    const result = await server.sendOutboundEmail('127.0.0.1', 10426, singleEmail);
    expect(result.accepted.length).toEqual(1);
  }
  // Restore original resolveMx
  dns.promises.Resolver.prototype.resolveMx = originalResolveMx;
 });
 tap.test('E2E: send real email to hello@task.vc via MX resolution', async () => {
  if (!bridgeAvailable) { console.log('SKIP'); return; }
  // Resolve real MX records for task.vc
  const resolver = new dns.promises.Resolver();
  const mxRecords = await resolver.resolveMx('task.vc');
  expect(mxRecords.length).toBeGreaterThan(0);
  const mxHost = mxRecords.sort((a, b) => a.priority - b.priority)[0].exchange;
  console.log(`Resolved MX for task.vc: ${mxHost} (priority ${mxRecords[0].priority})`);
  const email = new Email({
    from: 'test@mta-test.com',
    to: 'hello@task.vc',
    subject: `MTA E2E Test — ${new Date().toISOString()}`,
    text: 'This is an automated E2E test from @serve.zone/mailer verifying real MX resolution and outbound SMTP delivery.',
  });
  const result = await server.sendOutboundEmail(mxHost, 25, email);
  expect(result).toBeTruthy();
  expect(result.accepted).toBeTruthy();
  expect(result.accepted.length).toEqual(1);
  expect(result.accepted[0]).toEqual('hello@task.vc');
  expect(result.response).toInclude('2.0.0');
  console.log(`Email delivered to hello@task.vc via ${mxHost}: ${result.response}`);
 });
 tap.test('cleanup - stop server and mock SMTP', async () => {
  // Restore MX resolver in case it wasn't restored
  dns.promises.Resolver.prototype.resolveMx = originalResolveMx;
  // Force-close mock server (destroy all open sockets)
  if (mockSmtpServer) {
    mockSmtpServer.close();
  }
  if (bridgeAvailable) {
    await server.stop();
  }
  await tap.stopForcefully();
 });
 export default tap.start();
--- a/test/test.ratelimiter.ts
+++ b/test/test.ratelimiter.ts
@@ -1,141 +0,0 @@
 import { tap, expect } from '@git.zone/tstest/tapbundle';
 import { RateLimiter } from '../ts/mail/delivery/classes.ratelimiter.js';
 tap.test('RateLimiter - should be instantiable', async () => {
  const limiter = new RateLimiter({
    maxPerPeriod: 10,
    periodMs: 1000,
    perKey: true
  });
  expect(limiter).toBeTruthy();
 });
 tap.test('RateLimiter - should allow requests within rate limit', async () => {
  const limiter = new RateLimiter({
    maxPerPeriod: 5,
    periodMs: 1000,
    perKey: true
  });
  // Should allow 5 requests
  for (let i = 0; i < 5; i++) {
    expect(limiter.isAllowed('test')).toEqual(true);
  }
  // 6th request should be denied
  expect(limiter.isAllowed('test')).toEqual(false);
 });
 tap.test('RateLimiter - should enforce per-key limits', async () => {
  const limiter = new RateLimiter({
    maxPerPeriod: 3,
    periodMs: 1000,
    perKey: true
  });
  // Should allow 3 requests for key1
  for (let i = 0; i < 3; i++) {
    expect(limiter.isAllowed('key1')).toEqual(true);
  }
  // 4th request for key1 should be denied
  expect(limiter.isAllowed('key1')).toEqual(false);
  // But key2 should still be allowed
  expect(limiter.isAllowed('key2')).toEqual(true);
 });
 tap.test('RateLimiter - should refill tokens over time', async () => {
  const limiter = new RateLimiter({
    maxPerPeriod: 2,
    periodMs: 100, // Short period for testing
    perKey: true
  });
  // Use all tokens
  expect(limiter.isAllowed('test')).toEqual(true);
  expect(limiter.isAllowed('test')).toEqual(true);
  expect(limiter.isAllowed('test')).toEqual(false);
  // Wait for refill
  await new Promise(resolve => setTimeout(resolve, 150));
  // Should have tokens again
  expect(limiter.isAllowed('test')).toEqual(true);
 });
 tap.test('RateLimiter - should support burst allowance', async () => {
  const limiter = new RateLimiter({
    maxPerPeriod: 2,
    periodMs: 100,
    perKey: true,
    burstTokens: 2, // Allow 2 extra tokens for bursts
    initialTokens: 4  // Start with max + burst tokens
  });
  // Should allow 4 requests (2 regular + 2 burst)
  for (let i = 0; i < 4; i++) {
    expect(limiter.isAllowed('test')).toEqual(true);
  }
  // 5th request should be denied
  expect(limiter.isAllowed('test')).toEqual(false);
  // Wait for refill
  await new Promise(resolve => setTimeout(resolve, 150));
  // Should have 2 tokens again (rate-limited to normal max, not burst)
  expect(limiter.isAllowed('test')).toEqual(true);
  expect(limiter.isAllowed('test')).toEqual(true);
  // 3rd request after refill should fail (only normal max is refilled, not burst)
  expect(limiter.isAllowed('test')).toEqual(false);
 });
 tap.test('RateLimiter - should return correct stats', async () => {
  const limiter = new RateLimiter({
    maxPerPeriod: 10,
    periodMs: 1000,
    perKey: true
  });
  // Make some requests
  limiter.isAllowed('test');
  limiter.isAllowed('test');
  limiter.isAllowed('test');
  // Get stats
  const stats = limiter.getStats('test');
  expect(stats.remaining).toEqual(7);
  expect(stats.limit).toEqual(10);
  expect(stats.allowed).toEqual(3);
  expect(stats.denied).toEqual(0);
 });
 tap.test('RateLimiter - should reset limits', async () => {
  const limiter = new RateLimiter({
    maxPerPeriod: 3,
    periodMs: 1000,
    perKey: true
  });
  // Use all tokens
  expect(limiter.isAllowed('test')).toEqual(true);
  expect(limiter.isAllowed('test')).toEqual(true);
  expect(limiter.isAllowed('test')).toEqual(true);
  expect(limiter.isAllowed('test')).toEqual(false);
  // Reset
  limiter.reset('test');
  // Should have tokens again
  expect(limiter.isAllowed('test')).toEqual(true);
 });
 tap.test('stop', async () => {
  await tap.stopForcefully();
 });
 export default tap.start();
--- a/test/test.rustsecuritybridge.resilience.node.ts
+++ b/test/test.rustsecuritybridge.resilience.node.ts
@@ -0,0 +1,177 @@
 import { tap, expect } from '@git.zone/tstest/tapbundle';
 import { RustSecurityBridge, BridgeState } from '../ts/security/classes.rustsecuritybridge.js';
 import type { IBridgeResilienceConfig } from '../ts/security/classes.rustsecuritybridge.js';
 // Use fast backoff settings for testing
 const TEST_CONFIG: Partial<IBridgeResilienceConfig> = {
  maxRestartAttempts: 3,
  healthCheckIntervalMs: 60_000, // long interval so health checks don't interfere
  restartBackoffBaseMs: 100,
  restartBackoffMaxMs: 500,
  healthCheckTimeoutMs: 2_000,
 };
 tap.test('Resilience - should start in Idle state', async () => {
  RustSecurityBridge.resetInstance();
  RustSecurityBridge.configure(TEST_CONFIG);
  const bridge = RustSecurityBridge.getInstance();
  expect(bridge.state).toEqual(BridgeState.Idle);
 });
 tap.test('Resilience - state transitions: Idle -> Starting -> Running', async () => {
  RustSecurityBridge.resetInstance();
  RustSecurityBridge.configure(TEST_CONFIG);
  const bridge = RustSecurityBridge.getInstance();
  const transitions: Array<{ oldState: string; newState: string }> = [];
  bridge.on('stateChange', (evt: { oldState: string; newState: string }) => {
    transitions.push(evt);
  });
  const ok = await bridge.start();
  if (!ok) {
    console.log('WARNING: Rust binary not available — skipping resilience start tests');
    return;
  }
  // We should have seen Idle -> Starting -> Running
  expect(transitions.length).toBeGreaterThanOrEqual(2);
  expect(transitions[0].oldState).toEqual(BridgeState.Idle);
  expect(transitions[0].newState).toEqual(BridgeState.Starting);
  expect(transitions[1].oldState).toEqual(BridgeState.Starting);
  expect(transitions[1].newState).toEqual(BridgeState.Running);
  expect(bridge.state).toEqual(BridgeState.Running);
 });
 tap.test('Resilience - deliberate stop transitions to Stopped', async () => {
  const bridge = RustSecurityBridge.getInstance();
  if (!bridge.running) {
    console.log('SKIP: bridge not running');
    return;
  }
  const transitions: Array<{ oldState: string; newState: string }> = [];
  bridge.on('stateChange', (evt: { oldState: string; newState: string }) => {
    transitions.push(evt);
  });
  await bridge.stop();
  expect(bridge.state).toEqual(BridgeState.Stopped);
  // Deliberate stop should NOT trigger restart
  // Wait a bit to ensure no restart happens
  await new Promise(resolve => setTimeout(resolve, 300));
  expect(bridge.state).toEqual(BridgeState.Stopped);
  bridge.removeAllListeners('stateChange');
 });
 tap.test('Resilience - commands throw descriptive errors when not running', async () => {
  RustSecurityBridge.resetInstance();
  RustSecurityBridge.configure(TEST_CONFIG);
  const bridge = RustSecurityBridge.getInstance();
  // Idle state
  try {
    await bridge.ping();
    expect(true).toBeFalse(); // Should not reach
  } catch (err) {
    expect((err as Error).message).toInclude('not been started');
  }
  // Stopped state
  const ok = await bridge.start();
  if (ok) {
    await bridge.stop();
    try {
      await bridge.ping();
      expect(true).toBeFalse();
    } catch (err) {
      expect((err as Error).message).toInclude('stopped');
    }
  }
 });
 tap.test('Resilience - restart after stop and fresh start', async () => {
  RustSecurityBridge.resetInstance();
  RustSecurityBridge.configure(TEST_CONFIG);
  const bridge = RustSecurityBridge.getInstance();
  const ok = await bridge.start();
  if (!ok) {
    console.log('SKIP: Rust binary not available');
    return;
  }
  expect(bridge.state).toEqual(BridgeState.Running);
  // Stop
  await bridge.stop();
  expect(bridge.state).toEqual(BridgeState.Stopped);
  // Start again
  const ok2 = await bridge.start();
  expect(ok2).toBeTrue();
  expect(bridge.state).toEqual(BridgeState.Running);
  // Commands should work
  const pong = await bridge.ping();
  expect(pong).toBeTrue();
  await bridge.stop();
 });
 tap.test('Resilience - stateChange events emitted correctly', async () => {
  RustSecurityBridge.resetInstance();
  RustSecurityBridge.configure(TEST_CONFIG);
  const bridge = RustSecurityBridge.getInstance();
  const events: Array<{ oldState: string; newState: string }> = [];
  bridge.on('stateChange', (evt: { oldState: string; newState: string }) => {
    events.push(evt);
  });
  const ok = await bridge.start();
  if (!ok) {
    console.log('SKIP: Rust binary not available');
    return;
  }
  await bridge.stop();
  // Verify the full lifecycle: Idle->Starting->Running->Stopped
  const stateSequence = events.map(e => e.newState);
  expect(stateSequence).toContain(BridgeState.Starting);
  expect(stateSequence).toContain(BridgeState.Running);
  expect(stateSequence).toContain(BridgeState.Stopped);
  bridge.removeAllListeners('stateChange');
 });
 tap.test('Resilience - configure sets resilience parameters', async () => {
  RustSecurityBridge.resetInstance();
  RustSecurityBridge.configure({
    maxRestartAttempts: 10,
    healthCheckIntervalMs: 60_000,
  });
  // Just verify no errors — config is private, but we can verify
  // by the behavior in other tests
  const bridge = RustSecurityBridge.getInstance();
  expect(bridge).toBeTruthy();
 });
 tap.test('Resilience - resetInstance creates fresh singleton', async () => {
  RustSecurityBridge.resetInstance();
  const bridge1 = RustSecurityBridge.getInstance();
  RustSecurityBridge.resetInstance();
  const bridge2 = RustSecurityBridge.getInstance();
  // They should be different instances (we can't compare directly since
  // resetInstance nulls the static, and getInstance creates new)
  expect(bridge2.state).toEqual(BridgeState.Idle);
 });
 tap.test('Resilience - cleanup', async () => {
  RustSecurityBridge.resetInstance();
  RustSecurityBridge.configure(TEST_CONFIG);
 });
 export default tap.start();
--- a/test/test.smtp.client.compatibility.ts
+++ b/test/test.smtp.client.compatibility.ts
@@ -1,154 +0,0 @@
 import { tap, expect } from '@git.zone/tstest/tapbundle';
 import { smtpClientMod } from '../ts/mail/delivery/index.js';
 import type { ISmtpClientOptions, SmtpClient } from '../ts/mail/delivery/smtpclient/index.js';
 import { Email } from '../ts/mail/core/classes.email.js';
 /**
 * Compatibility tests for the legacy SMTP client facade
 */
 tap.test('verify backward compatibility - client creation', async () => {
  // Create test configuration
  const options: ISmtpClientOptions = {
    host: 'smtp.example.com',
    port: 587,
    secure: false,
    connectionTimeout: 10000,
    domain: 'test.example.com'
  };
  // Create SMTP client instance using legacy constructor
  const smtpClient = smtpClientMod.createSmtpClient(options);
  // Verify instance was created correctly
  expect(smtpClient).toBeTruthy();
  expect(smtpClient.isConnected()).toBeFalsy(); // Should start disconnected
 });
 tap.test('verify backward compatibility - methods exist', async () => {
  const options: ISmtpClientOptions = {
    host: 'smtp.example.com',
    port: 587,
    secure: false
  };
  const smtpClient = smtpClientMod.createSmtpClient(options);
  // Verify all expected methods exist
  expect(typeof smtpClient.sendMail === 'function').toBeTruthy();
  expect(typeof smtpClient.verify === 'function').toBeTruthy();
  expect(typeof smtpClient.isConnected === 'function').toBeTruthy();
  expect(typeof smtpClient.getPoolStatus === 'function').toBeTruthy();
  expect(typeof smtpClient.updateOptions === 'function').toBeTruthy();
  expect(typeof smtpClient.close === 'function').toBeTruthy();
  expect(typeof smtpClient.on === 'function').toBeTruthy();
  expect(typeof smtpClient.off === 'function').toBeTruthy();
  expect(typeof smtpClient.emit === 'function').toBeTruthy();
 });
 tap.test('verify backward compatibility - options update', async () => {
  const options: ISmtpClientOptions = {
    host: 'smtp.example.com',
    port: 587,
    secure: false
  };
  const smtpClient = smtpClientMod.createSmtpClient(options);
  // Test option updates don't throw
  expect(() => smtpClient.updateOptions({
    host: 'new-smtp.example.com',
    port: 465,
    secure: true
  })).not.toThrow();
  expect(() => smtpClient.updateOptions({
    debug: true,
    connectionTimeout: 5000
  })).not.toThrow();
 });
 tap.test('verify backward compatibility - connection failure handling', async () => {
  const options: ISmtpClientOptions = {
    host: 'nonexistent.invalid.domain',
    port: 587,
    secure: false,
    connectionTimeout: 1000 // Short timeout for faster test
  };
  const smtpClient = smtpClientMod.createSmtpClient(options);
  // verify() should return false for invalid hosts
  const isValid = await smtpClient.verify();
  expect(isValid).toBeFalsy();
  // sendMail should fail gracefully for invalid hosts
  const email = new Email({
    from: 'test@example.com',
    to: 'recipient@example.com',
    subject: 'Test Email',
    text: 'This is a test email'
  });
  try {
    const result = await smtpClient.sendMail(email);
    expect(result.success).toBeFalsy();
    expect(result.error).toBeTruthy();
  } catch (error) {
    // Connection errors are expected for invalid domains
    expect(error).toBeTruthy();
  }
 });
 tap.test('verify backward compatibility - pool status', async () => {
  const options: ISmtpClientOptions = {
    host: 'smtp.example.com',
    port: 587,
    secure: false,
    pool: true,
    maxConnections: 5
  };
  const smtpClient = smtpClientMod.createSmtpClient(options);
  // Get pool status
  const status = smtpClient.getPoolStatus();
  expect(status).toBeTruthy();
  expect(typeof status.total === 'number').toBeTruthy();
  expect(typeof status.active === 'number').toBeTruthy();
  expect(typeof status.idle === 'number').toBeTruthy();
  expect(typeof status.pending === 'number').toBeTruthy();
  // Initially should have no connections
  expect(status.total).toEqual(0);
  expect(status.active).toEqual(0);
  expect(status.idle).toEqual(0);
  expect(status.pending).toEqual(0);
 });
 tap.test('verify backward compatibility - event handling', async () => {
  const options: ISmtpClientOptions = {
    host: 'smtp.example.com',
    port: 587,
    secure: false
  };
  const smtpClient = smtpClientMod.createSmtpClient(options);
  // Test event listener methods don't throw
  const testListener = () => {};
  expect(() => smtpClient.on('test', testListener)).not.toThrow();
  expect(() => smtpClient.off('test', testListener)).not.toThrow();
  expect(() => smtpClient.emit('test')).not.toThrow();
 });
 tap.test('clean up after compatibility tests', async () => {
  // No-op - just to make sure everything is cleaned up properly
 });
 tap.test('stop', async () => {
  await tap.stopForcefully();
 });
 export default tap.start();
--- a/test/test.smtp.client.rust.node.ts
+++ b/test/test.smtp.client.rust.node.ts
@@ -0,0 +1,107 @@
 import { tap, expect } from '@git.zone/tstest/tapbundle';
 import { RustSecurityBridge, BridgeState } from '../ts/security/classes.rustsecuritybridge.js';
 import type { ISmtpSendOptions, ISmtpPoolStatus } from '../ts/security/classes.rustsecuritybridge.js';
 let bridge: RustSecurityBridge;
 tap.test('Rust SMTP Client - should start bridge', async () => {
  RustSecurityBridge.resetInstance();
  bridge = RustSecurityBridge.getInstance();
  const ok = await bridge.start();
  if (!ok) {
    console.log('WARNING: Rust binary not available — skipping Rust SMTP client tests');
    console.log('Build it with: cd rust && cargo build --release');
  }
  expect(typeof ok).toEqual('boolean');
 });
 tap.test('Rust SMTP Client - getSmtpPoolStatus returns valid structure', async () => {
  if (!bridge.running) {
    console.log('SKIP: bridge not running');
    return;
  }
  const status: ISmtpPoolStatus = await bridge.getSmtpPoolStatus();
  expect(status).toBeTruthy();
  expect(status.pools).toBeTruthy();
  expect(typeof status.pools).toEqual('object');
 });
 tap.test('Rust SMTP Client - verifySmtpConnection with unreachable host', async () => {
  if (!bridge.running) {
    console.log('SKIP: bridge not running');
    return;
  }
  try {
    // Use a non-routable IP to test connection failure handling
    const result = await bridge.verifySmtpConnection({
      host: '192.0.2.1', // TEST-NET-1 (RFC 5737) - guaranteed unreachable
      port: 25,
      secure: false,
      domain: 'test.example.com',
    });
    // If it returns rather than throwing, reachable should be false
    expect(result.reachable).toBeFalse();
  } catch (err) {
    // Connection errors are expected for unreachable hosts
    expect(err).toBeTruthy();
    expect(err.message || String(err)).toBeTruthy();
  }
 });
 tap.test('Rust SMTP Client - sendEmail with connection refused error', async () => {
  if (!bridge.running) {
    console.log('SKIP: bridge not running');
    return;
  }
  const opts: ISmtpSendOptions = {
    host: '127.0.0.1',
    port: 52599, // random high port - should be refused
    secure: false,
    domain: 'test.example.com',
    email: {
      from: 'sender@example.com',
      to: ['recipient@example.com'],
      subject: 'Test email',
      text: 'This is a test.',
    },
    connectionTimeoutSecs: 5,
    socketTimeoutSecs: 5,
  };
  try {
    await bridge.sendOutboundEmail(opts);
    // Should not succeed — no server is listening
    throw new Error('Expected sendEmail to fail on connection refused');
  } catch (err) {
    // We expect a connection error
    expect(err).toBeTruthy();
    const msg = err.message || String(err);
    expect(msg.length).toBeGreaterThan(0);
  }
 });
 tap.test('Rust SMTP Client - closeSmtpPool cleans up', async () => {
  if (!bridge.running) {
    console.log('SKIP: bridge not running');
    return;
  }
  // Should not throw, even when no pools exist
  await bridge.closeSmtpPool();
  // Verify pool status is empty after close
  const status = await bridge.getSmtpPoolStatus();
  expect(status.pools).toBeTruthy();
  const poolKeys = Object.keys(status.pools);
  expect(poolKeys.length).toEqual(0);
 });
 tap.test('Rust SMTP Client - stop bridge', async () => {
  if (!bridge.running) {
    console.log('SKIP: bridge not running');
    return;
  }
  await bridge.stop();
  expect(bridge.state).toEqual(BridgeState.Stopped);
 });
 export default tap.start();
--- a/test/test.smtp.client.ts
+++ b/test/test.smtp.client.ts
@@ -1,191 +0,0 @@
 import { tap, expect } from '@git.zone/tstest/tapbundle';
 import * as plugins from '../ts/plugins.js';
 import * as paths from '../ts/paths.js';
 import { smtpClientMod } from '../ts/mail/delivery/index.js';
 import type { ISmtpClientOptions, SmtpClient } from '../ts/mail/delivery/smtpclient/index.js';
 import { Email } from '../ts/mail/core/classes.email.js';
 /**
 * Tests for the SMTP client class
 */
 tap.test('verify SMTP client initialization', async () => {
  // Create test configuration
  const options: ISmtpClientOptions = {
    host: 'smtp.example.com',
    port: 587,
    secure: false,
    connectionTimeout: 10000,
    domain: 'test.example.com'
  };
  // Create SMTP client instance
  const smtpClient = smtpClientMod.createSmtpClient(options);
  // Verify instance was created correctly
  expect(smtpClient).toBeTruthy();
  expect(smtpClient.isConnected()).toBeFalsy(); // Should start disconnected
 });
 tap.test('test SMTP client configuration update', async () => {
  // Create test configuration
  const options: ISmtpClientOptions = {
    host: 'smtp.example.com',
    port: 587,
    secure: false
  };
  // Create SMTP client instance
  const smtpClient = smtpClientMod.createSmtpClient(options);
  // Update configuration
  smtpClient.updateOptions({
    host: 'new-smtp.example.com',
    port: 465,
    secure: true
  });
  // Can't directly test private fields, but we can verify it doesn't throw
  expect(() => smtpClient.updateOptions({
    tls: {
      rejectUnauthorized: false
    }
  })).not.toThrow();
 });
 // Mocked SMTP server for testing
 class MockSmtpServer {
  private responses: Map<string, string>;
  constructor() {
    this.responses = new Map();
    // Default responses
    this.responses.set('connect', '220 smtp.example.com ESMTP ready');
    this.responses.set('EHLO', '250-smtp.example.com\r\n250-PIPELINING\r\n250-SIZE 10240000\r\n250-STARTTLS\r\n250-AUTH PLAIN LOGIN\r\n250 HELP');
    this.responses.set('MAIL FROM', '250 OK');
    this.responses.set('RCPT TO', '250 OK');
    this.responses.set('DATA', '354 Start mail input; end with <CRLF>.<CRLF>');
    this.responses.set('data content', '250 OK: message accepted');
    this.responses.set('QUIT', '221 Bye');
  }
  public setResponse(command: string, response: string): void {
    this.responses.set(command, response);
  }
  public getResponse(command: string): string {
    if (command.startsWith('MAIL FROM')) {
      return this.responses.get('MAIL FROM') || '250 OK';
    } else if (command.startsWith('RCPT TO')) {
      return this.responses.get('RCPT TO') || '250 OK';
    } else if (command.startsWith('EHLO') || command.startsWith('HELO')) {
      return this.responses.get('EHLO') || '250 OK';
    } else if (command === 'DATA') {
      return this.responses.get('DATA') || '354 Start mail input; end with <CRLF>.<CRLF>';
    } else if (command.includes('Content-Type')) {
      return this.responses.get('data content') || '250 OK: message accepted';
    } else if (command === 'QUIT') {
      return this.responses.get('QUIT') || '221 Bye';
    }
    return this.responses.get(command) || '250 OK';
  }
 }
 /**
 * This test validates the SMTP client public interface
 */
 tap.test('verify SMTP client email delivery functionality with mock', async () => {
  // Create a test email
  const testEmail = new Email({
    from: 'sender@example.com',
    to: ['recipient@example.com'],
    subject: 'Test Email',
    text: 'This is a test email'
  });
  // Create SMTP client options
  const options: ISmtpClientOptions = {
    host: 'smtp.example.com',
    port: 587,
    secure: false,
    domain: 'test.example.com',
    auth: {
      user: 'testuser',
      pass: 'testpass'
    }
  };
  // Create SMTP client instance
  const smtpClient = smtpClientMod.createSmtpClient(options);
  // Test public methods exist and have correct signatures
  expect(typeof smtpClient.sendMail).toEqual('function');
  expect(typeof smtpClient.verify).toEqual('function');
  expect(typeof smtpClient.isConnected).toEqual('function');
  expect(typeof smtpClient.getPoolStatus).toEqual('function');
  expect(typeof smtpClient.updateOptions).toEqual('function');
  expect(typeof smtpClient.close).toEqual('function');
  // Test connection status before any operation
  expect(smtpClient.isConnected()).toBeFalsy();
  // Test pool status
  const poolStatus = smtpClient.getPoolStatus();
  expect(poolStatus).toBeTruthy();
  expect(typeof poolStatus.active).toEqual('number');
  expect(typeof poolStatus.idle).toEqual('number');
  expect(typeof poolStatus.total).toEqual('number');
  // Since we can't connect to a real server, we'll skip the actual send test
  // and just verify the client was created correctly
  expect(smtpClient).toBeTruthy();
 });
 tap.test('test SMTP client error handling with mock', async () => {
  // Create SMTP client instance
  const smtpClient = smtpClientMod.createSmtpClient({
    host: 'smtp.example.com',
    port: 587,
    secure: false
  });
  // Test with valid email (Email class might allow any string)
  const testEmail = new Email({
    from: 'sender@example.com',
    to: ['recipient@example.com'],
    subject: 'Test Email',
    text: 'This is a test email'
  });
  // Test event listener methods
  const mockListener = () => {};
  smtpClient.on('test-event', mockListener);
  smtpClient.off('test-event', mockListener);
  // Test update options
  smtpClient.updateOptions({
    auth: {
      user: 'newuser',
      pass: 'newpass'
    }
  });
  // Verify client is still functional
  expect(smtpClient.isConnected()).toBeFalsy();
  // Test close on a non-connected client
  await smtpClient.close();
  expect(smtpClient.isConnected()).toBeFalsy();
 });
 // Final clean-up test
 tap.test('clean up after tests', async () => {
  // No-op - just to make sure everything is cleaned up properly
 });
 tap.test('stop', async () => {
  await tap.stopForcefully();
 });
 export default tap.start();
--- a/ts/00_commitinfo_data.ts
+++ b/ts/00_commitinfo_data.ts
@@ -3,6 +3,6 @@
 */
 export const commitinfo = {
  name: '@push.rocks/smartmta',
-  version: '2.4.0',
+  version: '5.1.1',
  description: 'A high-performance, enterprise-grade Mail Transfer Agent (MTA) built from scratch in TypeScript with Rust acceleration.'
 }
--- a/ts/errors/index.ts
+++ b/ts/errors/index.ts
@@ -1,119 +0,0 @@
 /**
 * MTA error classes for SMTP client operations
 */
 export class MtaConnectionError extends Error {
  public code: string;
  public details?: any;
  constructor(message: string, detailsOrCode?: any) {
    super(message);
    this.name = 'MtaConnectionError';
    if (typeof detailsOrCode === 'string') {
      this.code = detailsOrCode;
    } else {
      this.code = 'CONNECTION_ERROR';
      this.details = detailsOrCode;
    }
  }
  static timeout(host: string, port: number, timeoutMs?: number): MtaConnectionError {
    return new MtaConnectionError(`Connection to ${host}:${port} timed out${timeoutMs ? ` after ${timeoutMs}ms` : ''}`, 'TIMEOUT');
  }
  static refused(host: string, port: number): MtaConnectionError {
    return new MtaConnectionError(`Connection to ${host}:${port} refused`, 'REFUSED');
  }
  static dnsError(host: string, err?: any): MtaConnectionError {
    const errMsg = typeof err === 'string' ? err : err?.message || '';
    return new MtaConnectionError(`DNS resolution failed for ${host}${errMsg ? `: ${errMsg}` : ''}`, 'DNS_ERROR');
  }
 }
 export class MtaAuthenticationError extends Error {
  public code: string;
  public details?: any;
  constructor(message: string, detailsOrCode?: any) {
    super(message);
    this.name = 'MtaAuthenticationError';
    if (typeof detailsOrCode === 'string') {
      this.code = detailsOrCode;
    } else {
      this.code = 'AUTH_ERROR';
      this.details = detailsOrCode;
    }
  }
  static invalidCredentials(host?: string, user?: string): MtaAuthenticationError {
    const detail = host && user ? `${user}@${host}` : host || user || '';
    return new MtaAuthenticationError(`Authentication failed${detail ? `: ${detail}` : ''}`, 'INVALID_CREDENTIALS');
  }
 }
 export class MtaDeliveryError extends Error {
  public code: string;
  public responseCode?: number;
  public details?: any;
  constructor(message: string, detailsOrCode?: any, responseCode?: number) {
    super(message);
    this.name = 'MtaDeliveryError';
    if (typeof detailsOrCode === 'string') {
      this.code = detailsOrCode;
      this.responseCode = responseCode;
    } else {
      this.code = 'DELIVERY_ERROR';
      this.details = detailsOrCode;
    }
  }
  static temporary(message: string, ...args: any[]): MtaDeliveryError {
    return new MtaDeliveryError(message, 'TEMPORARY');
  }
  static permanent(message: string, ...args: any[]): MtaDeliveryError {
    return new MtaDeliveryError(message, 'PERMANENT');
  }
 }
 export class MtaConfigurationError extends Error {
  public code: string;
  public details?: any;
  constructor(message: string, detailsOrCode?: any) {
    super(message);
    this.name = 'MtaConfigurationError';
    if (typeof detailsOrCode === 'string') {
      this.code = detailsOrCode;
    } else {
      this.code = 'CONFIG_ERROR';
      this.details = detailsOrCode;
    }
  }
 }
 export class MtaTimeoutError extends Error {
  public code: string;
  public details?: any;
  constructor(message: string, detailsOrCode?: any) {
    super(message);
    this.name = 'MtaTimeoutError';
    if (typeof detailsOrCode === 'string') {
      this.code = detailsOrCode;
    } else {
      this.code = 'TIMEOUT';
      this.details = detailsOrCode;
    }
  }
  static commandTimeout(command: string, hostOrTimeout?: any, timeoutMs?: number): MtaTimeoutError {
    const timeout = typeof hostOrTimeout === 'number' ? hostOrTimeout : timeoutMs;
    return new MtaTimeoutError(`Command '${command}' timed out${timeout ? ` after ${timeout}ms` : ''}`, 'COMMAND_TIMEOUT');
  }
 }
 export class MtaProtocolError extends Error {
  public code: string;
  public details?: any;
  constructor(message: string, detailsOrCode?: any) {
    super(message);
    this.name = 'MtaProtocolError';
    if (typeof detailsOrCode === 'string') {
      this.code = detailsOrCode;
    } else {
      this.code = 'PROTOCOL_ERROR';
      this.details = detailsOrCode;
    }
  }
 }
--- a/ts/mail/delivery/classes.delivery.queue.ts
+++ b/ts/mail/delivery/classes.delivery.queue.ts
@@ -3,7 +3,7 @@ import { EventEmitter } from 'node:events';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { logger } from '../../logger.js';
-import { type EmailProcessingMode } from '../routing/classes.email.config.js';
+import { type EmailProcessingMode } from './interfaces.js';
 import type { IEmailRoute } from '../routing/interfaces.js';
 /**
--- a/ts/mail/delivery/classes.delivery.system.ts
+++ b/ts/mail/delivery/classes.delivery.system.ts
@@ -1,19 +1,18 @@
 import * as plugins from '../../plugins.js';
 import { EventEmitter } from 'node:events';
 import * as net from 'node:net';
 import * as tls from 'node:tls';
 import { logger } from '../../logger.js';
-import { 
+import {
-  SecurityLogger, 
+  SecurityLogger,
-  SecurityLogLevel, 
+  SecurityLogLevel,
-  SecurityEventType 
+  SecurityEventType
 } from '../../security/index.js';
 import { UnifiedDeliveryQueue, type IQueueItem } from './classes.delivery.queue.js';
-import type { Email } from '../core/classes.email.js';
+import { Email } from '../core/classes.email.js';
 import type { UnifiedEmailServer } from '../routing/classes.unified.email.server.js';
 import type { SmtpClient } from './smtpclient/smtp-client.js';
 import { RustSecurityBridge } from '../../security/classes.rustsecuritybridge.js';
 const dns = plugins.dns;
 /**
 * Delivery status enumeration
 */
@@ -117,7 +116,7 @@ export class MultiModeDeliverySystem extends EventEmitter {
   * Create a new multi-mode delivery system
   * @param queue Unified delivery queue
   * @param options Delivery options
-   * @param emailServer Optional reference to unified email server for SmtpClient access
+   * @param emailServer Optional reference to unified email server for outbound delivery
   */
  constructor(queue: UnifiedDeliveryQueue, options: IMultiModeDeliveryOptions, emailServer?: UnifiedEmailServer) {
    super();
@@ -433,228 +432,169 @@ export class MultiModeDeliverySystem extends EventEmitter {
   */
  private async handleForwardDelivery(item: IQueueItem): Promise<any> {
    logger.log('info', `Forward delivery for item ${item.id}`);
-    
+
    const email = item.processingResult as Email;
    const route = item.route;
-    
+
    // Get target server information
    const targetServer = route?.action.forward?.host;
    const targetPort = route?.action.forward?.port || 25;
-    const useTls = false; // TLS configuration can be enhanced later
+
    if (!targetServer) {
      throw new Error('No target server configured for forward mode');
    }
-    
+
-    logger.log('info', `Forwarding email to ${targetServer}:${targetPort}, TLS: ${useTls}`);
+    logger.log('info', `Forwarding email to ${targetServer}:${targetPort}`);
-    
+
    try {
      // Get SMTP client from email server if available
      if (!this.emailServer) {
-        // Fall back to raw socket implementation if no email server
+        throw new Error('No email server available for forward delivery');
        logger.log('warn', 'No email server available, falling back to raw socket implementation');
        return this.handleForwardDeliveryLegacy(item);
      }
-      
+
-      // Get SMTP client from UnifiedEmailServer
+      // Build DKIM options from route config
-      const smtpClient = this.emailServer.getSmtpClient(targetServer, targetPort);
+      const dkimDomain = item.route?.action.options?.mtaOptions?.dkimSign
-      
+        ? (item.route.action.options.mtaOptions.dkimOptions?.domainName || email.from.split('@')[1])
-      // Apply DKIM signing if configured in the route
+        : undefined;
-      if (item.route?.action.options?.mtaOptions?.dkimSign) {
+      const dkimSelector = item.route?.action.options?.mtaOptions?.dkimOptions?.keySelector || 'default';
-        await this.applyDkimSigning(email, item.route.action.options.mtaOptions);
+
-      }
+      // Build auth options from route forward config
-      
+      const auth = route?.action.forward?.auth as { user: string; pass: string } | undefined;
-      // Send the email using SmtpClient
+
-      const result = await smtpClient.sendMail(email);
+      // Send via Rust SMTP client
-      
+      const result = await this.emailServer.sendOutboundEmail(targetServer, targetPort, email, {
-      if (result.success) {
+        auth,
-        logger.log('info', `Email forwarded successfully to ${targetServer}:${targetPort}`);
+        dkimDomain,
-        
+        dkimSelector,
        return {
          targetServer: targetServer,
          targetPort: targetPort,
          recipients: result.acceptedRecipients.length,
          messageId: result.messageId,
          rejectedRecipients: result.rejectedRecipients
        };
      } else {
        throw new Error(result.error?.message || 'Failed to forward email');
      }
    } catch (error: any) {
      logger.log('error', `Failed to forward email: ${error.message}`);
      throw error;
    }
  }
  /**
   * Legacy forward delivery using raw sockets (fallback)
   * @param item Queue item
   */
  private async handleForwardDeliveryLegacy(item: IQueueItem): Promise<any> {
    const email = item.processingResult as Email;
    const route = item.route;
    // Get target server information
    const targetServer = route?.action.forward?.host;
    const targetPort = route?.action.forward?.port || 25;
    const useTls = false; // TLS configuration can be enhanced later
    if (!targetServer) {
      throw new Error('No target server configured for forward mode');
    }
    // Create a socket connection to the target server
    const socket = new net.Socket();
    // Set timeout
    socket.setTimeout(this.options.socketTimeout);
    try {
      // Connect to the target server
      await new Promise<void>((resolve, reject) => {
        // Handle connection events
        socket.on('connect', () => {
          logger.log('debug', `Connected to ${targetServer}:${targetPort}`);
          resolve();
        });
        socket.on('timeout', () => {
          reject(new Error(`Connection timeout to ${targetServer}:${targetPort}`));
        });
        socket.on('error', (err) => {
          reject(new Error(`Connection error to ${targetServer}:${targetPort}: ${err.message}`));
        });
        // Connect to the server
        socket.connect({
          host: targetServer,
          port: targetPort
        });
      });
-      
+
-      // Send EHLO
+      logger.log('info', `Email forwarded successfully to ${targetServer}:${targetPort}`);
-      await this.smtpCommand(socket, `EHLO ${route?.action.options?.mtaOptions?.domain || 'localhost'}`);
+
      // Start TLS if required
      if (useTls) {
        await this.smtpCommand(socket, 'STARTTLS');
        // Upgrade to TLS
        const tlsSocket = await this.upgradeTls(socket, targetServer);
        // Send EHLO again after STARTTLS
        await this.smtpCommand(tlsSocket, `EHLO ${route?.action.options?.mtaOptions?.domain || 'localhost'}`);
        // Use tlsSocket for remaining commands
        return this.completeSMTPExchange(tlsSocket, email, route);
      }
      // Complete the SMTP exchange
      return this.completeSMTPExchange(socket, email, route);
    } catch (error: any) {
      logger.log('error', `Failed to forward email: ${error.message}`);
      // Close the connection
      socket.destroy();
      throw error;
    }
  }
  /**
   * Complete the SMTP exchange after connection and initial setup
   * @param socket Network socket
   * @param email Email to send
   * @param rule Domain rule
   */
  private async completeSMTPExchange(socket: net.Socket | tls.TLSSocket, email: Email, route: any): Promise<any> {
    try {
      // Authenticate if credentials provided
      if (route?.action?.forward?.auth?.user && route?.action?.forward?.auth?.pass) {
        // Send AUTH LOGIN
        await this.smtpCommand(socket, 'AUTH LOGIN');
        // Send username (base64)
        const username = Buffer.from(route.action.forward.auth.user).toString('base64');
        await this.smtpCommand(socket, username);
        // Send password (base64)
        const password = Buffer.from(route.action.forward.auth.pass).toString('base64');
        await this.smtpCommand(socket, password);
      }
      // Send MAIL FROM
      await this.smtpCommand(socket, `MAIL FROM:<${email.from}>`);
      // Send RCPT TO for each recipient
      for (const recipient of email.getAllRecipients()) {
        await this.smtpCommand(socket, `RCPT TO:<${recipient}>`);
      }
      // Send DATA
      await this.smtpCommand(socket, 'DATA');
      // Send email content (simplified)
      const emailContent = await this.getFormattedEmail(email);
      await this.smtpData(socket, emailContent);
      // Send QUIT
      await this.smtpCommand(socket, 'QUIT');
      // Close the connection
      socket.end();
      logger.log('info', `Email forwarded successfully to ${route?.action?.forward?.host}:${route?.action?.forward?.port || 25}`);
      return {
-        targetServer: route?.action?.forward?.host,
+        targetServer,
-        targetPort: route?.action?.forward?.port || 25,
+        targetPort,
-        recipients: email.getAllRecipients().length
+        recipients: result.accepted.length,
        messageId: result.messageId,
        rejectedRecipients: result.rejected,
      };
    } catch (error: any) {
      logger.log('error', `Failed to forward email: ${error.message}`);
      // Close the connection
      socket.destroy();
      throw error;
    }
  }
  /**
   * Resolve MX records for a domain, sorted by priority (lowest first).
   * Falls back to the domain itself as an A record per RFC 5321.
   */
  private async resolveMxForDomain(domain: string): Promise<Array<{ exchange: string; priority: number }>> {
    const resolver = new dns.promises.Resolver();
    try {
      const mxRecords = await resolver.resolveMx(domain);
      return mxRecords.sort((a, b) => a.priority - b.priority);
    } catch (err) {
      logger.log('warn', `No MX records for ${domain}, falling back to A record`);
      return [{ exchange: domain, priority: 0 }];
    }
  }
  /**
   * Group recipient addresses by their domain part.
   */
  private groupRecipientsByDomain(recipients: string[]): Map<string, string[]> {
    const groups = new Map<string, string[]>();
    for (const rcpt of recipients) {
      const domain = rcpt.split('@')[1]?.toLowerCase();
      if (!domain) continue;
      const list = groups.get(domain) || [];
      list.push(rcpt);
      groups.set(domain, list);
    }
    return groups;
  }
  /**
   * Default handler for MTA mode delivery
   * @param item Queue item
   */
  private async handleMtaDelivery(item: IQueueItem): Promise<any> {
    logger.log('info', `MTA delivery for item ${item.id}`);
-    
+
    const email = item.processingResult as Email;
-    const route = item.route;
+
-    
+    if (!this.emailServer) {
-    try {
+      throw new Error('No email server available for MTA delivery');
      // Apply DKIM signing if configured in the route
      if (item.route?.action.options?.mtaOptions?.dkimSign) {
        await this.applyDkimSigning(email, item.route.action.options.mtaOptions);
      }
      // In a full implementation, this would use the MTA service
      // For now, we'll simulate a successful delivery
      logger.log('info', `Email processed by MTA: ${email.subject} to ${email.getAllRecipients().join(', ')}`);
      // Note: The MTA implementation would handle actual local delivery
      // Simulate successful delivery
      return {
        recipients: email.getAllRecipients().length,
        subject: email.subject,
        dkimSigned: !!item.route?.action.options?.mtaOptions?.dkimSign
      };
    } catch (error: any) {
      logger.log('error', `Failed to process email in MTA mode: ${error.message}`);
      throw error;
    }
    // Build DKIM options from route config
    const dkimDomain = item.route?.action.options?.mtaOptions?.dkimSign
      ? (item.route.action.options.mtaOptions.dkimOptions?.domainName || email.from.split('@')[1])
      : undefined;
    const dkimSelector = item.route?.action.options?.mtaOptions?.dkimOptions?.keySelector || 'default';
    const allRecipients = email.getAllRecipients();
    if (allRecipients.length === 0) {
      throw new Error('No recipients specified for MTA delivery');
    }
    const domainGroups = this.groupRecipientsByDomain(allRecipients);
    const results: Array<{ domain: string; success: boolean; error?: string; accepted?: string[]; rejected?: string[] }> = [];
    for (const [domain, recipients] of domainGroups) {
      const mxHosts = await this.resolveMxForDomain(domain);
      let delivered = false;
      let lastError: string | undefined;
      for (const mx of mxHosts) {
        try {
          logger.log('info', `MTA: trying MX ${mx.exchange}:25 for domain ${domain} (priority ${mx.priority})`);
          // Create a temporary Email scoped to this domain's recipients
          const domainEmail = new Email({
            from: email.from,
            to: recipients.filter(r => email.to.includes(r)),
            cc: recipients.filter(r => (email.cc || []).includes(r)),
            bcc: recipients.filter(r => (email.bcc || []).includes(r)),
            subject: email.subject,
            text: email.text,
            html: email.html,
          });
          const result = await this.emailServer.sendOutboundEmail(mx.exchange, 25, domainEmail, {
            dkimDomain,
            dkimSelector,
          });
          results.push({
            domain,
            success: true,
            accepted: result.accepted,
            rejected: result.rejected,
          });
          delivered = true;
          logger.log('info', `MTA: delivered to ${domain} via ${mx.exchange}`);
          break;
        } catch (err: any) {
          lastError = err.message;
          logger.log('warn', `MTA: MX ${mx.exchange} failed for ${domain}: ${err.message}`);
        }
      }
      if (!delivered) {
        results.push({ domain, success: false, error: lastError });
        logger.log('error', `MTA: all MX hosts failed for ${domain}`);
      }
    }
    const allFailed = results.every(r => !r.success);
    if (allFailed) {
      const summary = results.map(r => `${r.domain}: ${r.error}`).join('; ');
      throw new Error(`MTA delivery failed for all domains: ${summary}`);
    }
    return {
      recipients: allRecipients.length,
      domainResults: results,
    };
  }
  /**
@@ -726,16 +666,10 @@ export class MultiModeDeliverySystem extends EventEmitter {
        await this.applyDkimSigning(email, item.route.action.options?.mtaOptions || {});
      }
-      logger.log('info', `Email successfully processed in store-and-forward mode`);
+      logger.log('info', `Email successfully processed in store-and-forward mode, delivering via MTA`);
-      
+
-      // Simulate successful delivery
+      // After scanning + transformations, deliver via MTA
-      return {
+      return await this.handleMtaDelivery(item);
        recipients: email.getAllRecipients().length,
        subject: email.subject,
        scanned: !!route?.action.options?.contentScanning,
        transformed: !!(route?.action.options?.transformations && route?.action.options?.transformations.length > 0),
        dkimSigned: !!(item.route?.action.options?.mtaOptions?.dkimSign || item.route?.action.process?.dkim)
      };
    } catch (error: any) {
      logger.log('error', `Failed to process email: ${error.message}`);
      throw error;
@@ -790,210 +724,6 @@ export class MultiModeDeliverySystem extends EventEmitter {
    }
  }
  /**
   * Format email for SMTP transmission
   * @param email Email to format
   */
  private async getFormattedEmail(email: Email): Promise<string> {
    // This is a simplified implementation
    // In a full implementation, this would use proper MIME formatting
    let content = '';
    // Add headers
    content += `From: ${email.from}\r\n`;
    content += `To: ${email.to.join(', ')}\r\n`;
    content += `Subject: ${email.subject}\r\n`;
    // Add additional headers
    for (const [name, value] of Object.entries(email.headers || {})) {
      content += `${name}: ${value}\r\n`;
    }
    // Add content type for multipart
    if (email.attachments && email.attachments.length > 0) {
      const boundary = `----_=_NextPart_${Math.random().toString(36).substr(2)}`;
      content += `MIME-Version: 1.0\r\n`;
      content += `Content-Type: multipart/mixed; boundary="${boundary}"\r\n`;
      content += `\r\n`;
      // Add text part
      content += `--${boundary}\r\n`;
      content += `Content-Type: text/plain; charset="UTF-8"\r\n`;
      content += `\r\n`;
      content += `${email.text}\r\n`;
      // Add HTML part if present
      if (email.html) {
        content += `--${boundary}\r\n`;
        content += `Content-Type: text/html; charset="UTF-8"\r\n`;
        content += `\r\n`;
        content += `${email.html}\r\n`;
      }
      // Add attachments
      for (const attachment of email.attachments) {
        content += `--${boundary}\r\n`;
        content += `Content-Type: ${attachment.contentType || 'application/octet-stream'}; name="${attachment.filename}"\r\n`;
        content += `Content-Disposition: attachment; filename="${attachment.filename}"\r\n`;
        content += `Content-Transfer-Encoding: base64\r\n`;
        content += `\r\n`;
        // Add base64 encoded content
        const base64Content = attachment.content.toString('base64');
        // Split into lines of 76 characters
        for (let i = 0; i < base64Content.length; i += 76) {
          content += base64Content.substring(i, i + 76) + '\r\n';
        }
      }
      // End boundary
      content += `--${boundary}--\r\n`;
    } else {
      // Simple email with just text
      content += `Content-Type: text/plain; charset="UTF-8"\r\n`;
      content += `\r\n`;
      content += `${email.text}\r\n`;
    }
    return content;
  }
  /**
   * Send SMTP command and wait for response
   * @param socket Socket connection
   * @param command SMTP command to send
   */
  private async smtpCommand(socket: net.Socket, command: string): Promise<string> {
    return new Promise<string>((resolve, reject) => {
      const onData = (data: Buffer) => {
        const response = data.toString().trim();
        // Clean up listeners
        socket.removeListener('data', onData);
        socket.removeListener('error', onError);
        socket.removeListener('timeout', onTimeout);
        // Check response code
        if (response.charAt(0) === '2' || response.charAt(0) === '3') {
          resolve(response);
        } else {
          reject(new Error(`SMTP error: ${response}`));
        }
      };
      const onError = (err: Error) => {
        // Clean up listeners
        socket.removeListener('data', onData);
        socket.removeListener('error', onError);
        socket.removeListener('timeout', onTimeout);
        reject(err);
      };
      const onTimeout = () => {
        // Clean up listeners
        socket.removeListener('data', onData);
        socket.removeListener('error', onError);
        socket.removeListener('timeout', onTimeout);
        reject(new Error('SMTP command timeout'));
      };
      // Set up listeners
      socket.once('data', onData);
      socket.once('error', onError);
      socket.once('timeout', onTimeout);
      // Send command
      socket.write(command + '\r\n');
    });
  }
  /**
   * Send SMTP DATA command with content
   * @param socket Socket connection
   * @param data Email content to send
   */
  private async smtpData(socket: net.Socket, data: string): Promise<string> {
    return new Promise<string>((resolve, reject) => {
      const onData = (responseData: Buffer) => {
        const response = responseData.toString().trim();
        // Clean up listeners
        socket.removeListener('data', onData);
        socket.removeListener('error', onError);
        socket.removeListener('timeout', onTimeout);
        // Check response code
        if (response.charAt(0) === '2') {
          resolve(response);
        } else {
          reject(new Error(`SMTP error: ${response}`));
        }
      };
      const onError = (err: Error) => {
        // Clean up listeners
        socket.removeListener('data', onData);
        socket.removeListener('error', onError);
        socket.removeListener('timeout', onTimeout);
        reject(err);
      };
      const onTimeout = () => {
        // Clean up listeners
        socket.removeListener('data', onData);
        socket.removeListener('error', onError);
        socket.removeListener('timeout', onTimeout);
        reject(new Error('SMTP data timeout'));
      };
      // Set up listeners
      socket.once('data', onData);
      socket.once('error', onError);
      socket.once('timeout', onTimeout);
      // Send data and end with CRLF.CRLF
      socket.write(data + '\r\n.\r\n');
    });
  }
  /**
   * Upgrade socket to TLS
   * @param socket Socket connection
   * @param hostname Target hostname for TLS
   */
  private async upgradeTls(socket: net.Socket, hostname: string): Promise<tls.TLSSocket> {
    return new Promise<tls.TLSSocket>((resolve, reject) => {
      const tlsOptions: tls.ConnectionOptions = {
        socket,
        servername: hostname,
        rejectUnauthorized: this.options.verifyCertificates,
        minVersion: this.options.tlsMinVersion as tls.SecureVersion
      };
      const tlsSocket = tls.connect(tlsOptions);
      tlsSocket.once('secureConnect', () => {
        resolve(tlsSocket);
      });
      tlsSocket.once('error', (err) => {
        reject(new Error(`TLS error: ${err.message}`));
      });
      tlsSocket.setTimeout(this.options.socketTimeout);
      tlsSocket.once('timeout', () => {
        reject(new Error('TLS connection timeout'));
      });
    });
  }
  /**
   * Update delivery time statistics
   */
--- a/ts/mail/delivery/classes.emailsendjob.ts
+++ b/ts/mail/delivery/classes.emailsendjob.ts
@@ -1,447 +0,0 @@
 import * as plugins from '../../plugins.js';
 import * as paths from '../../paths.js';
 import { Email } from '../core/classes.email.js';
 import { EmailSignJob } from './classes.emailsignjob.js';
 import type { UnifiedEmailServer } from '../routing/classes.unified.email.server.js';
 import type { SmtpClient } from './smtpclient/smtp-client.js';
 import type { ISmtpSendResult } from './smtpclient/interfaces.js';
 // Configuration options for email sending
 export interface IEmailSendOptions {
  maxRetries?: number;
  retryDelay?: number; // in milliseconds
  connectionTimeout?: number; // in milliseconds
  tlsOptions?: plugins.tls.ConnectionOptions;
  debugMode?: boolean;
 }
 // Email delivery status
 export enum DeliveryStatus {
  PENDING = 'pending',
  SENDING = 'sending',
  DELIVERED = 'delivered',
  FAILED = 'failed',
  DEFERRED = 'deferred' // Temporary failure, will retry
 }
 // Detailed information about delivery attempts
 export interface DeliveryInfo {
  status: DeliveryStatus;
  attempts: number;
  error?: Error;
  lastAttempt?: Date;
  nextAttempt?: Date;
  mxServer?: string;
  deliveryTime?: Date;
  logs: string[];
 }
 export class EmailSendJob {
  emailServerRef: UnifiedEmailServer;
  private email: Email;
  private mxServers: string[] = [];
  private currentMxIndex = 0;
  private options: IEmailSendOptions;
  public deliveryInfo: DeliveryInfo;
  constructor(emailServerRef: UnifiedEmailServer, emailArg: Email, options: IEmailSendOptions = {}) {
    this.email = emailArg;
    this.emailServerRef = emailServerRef;
    // Set default options
    this.options = {
      maxRetries: options.maxRetries || 3,
      retryDelay: options.retryDelay || 30000, // 30 seconds
      connectionTimeout: options.connectionTimeout || 60000, // 60 seconds
      tlsOptions: options.tlsOptions || {},
      debugMode: options.debugMode || false
    };
    // Initialize delivery info
    this.deliveryInfo = {
      status: DeliveryStatus.PENDING,
      attempts: 0,
      logs: []
    };
  }
  /**
   * Send the email to its recipients
   */
  async send(): Promise<DeliveryStatus> {
    try {
      // Check if the email is valid before attempting to send
      this.validateEmail();
      // Resolve MX records for the recipient domain
      await this.resolveMxRecords();
      // Try to send the email
      return await this.attemptDelivery();
    } catch (error) {
      this.log(`Critical error in send process: ${error.message}`);
      this.deliveryInfo.status = DeliveryStatus.FAILED;
      this.deliveryInfo.error = error;
      // Save failed email for potential future retry or analysis
      await this.saveFailed();
      return DeliveryStatus.FAILED;
    }
  }
  /**
   * Validate the email before sending
   */
  private validateEmail(): void {
    if (!this.email.to || this.email.to.length === 0) {
      throw new Error('No recipients specified');
    }
    if (!this.email.from) {
      throw new Error('No sender specified');
    }
    const fromDomain = this.email.getFromDomain();
    if (!fromDomain) {
      throw new Error('Invalid sender domain');
    }
  }
  /**
   * Resolve MX records for the recipient domain
   */
  private async resolveMxRecords(): Promise<void> {
    const domain = this.email.getPrimaryRecipient()?.split('@')[1];
    if (!domain) {
      throw new Error('Invalid recipient domain');
    }
    this.log(`Resolving MX records for domain: ${domain}`);
    try {
      const addresses = await this.resolveMx(domain);
      // Sort by priority (lowest number = highest priority)
      addresses.sort((a, b) => a.priority - b.priority);
      this.mxServers = addresses.map(mx => mx.exchange);
      this.log(`Found ${this.mxServers.length} MX servers: ${this.mxServers.join(', ')}`);
      if (this.mxServers.length === 0) {
        throw new Error(`No MX records found for domain: ${domain}`);
      }
    } catch (error) {
      this.log(`Failed to resolve MX records: ${error.message}`);
      throw new Error(`MX lookup failed for ${domain}: ${error.message}`);
    }
  }
  /**
   * Attempt to deliver the email with retries
   */
  private async attemptDelivery(): Promise<DeliveryStatus> {
    while (this.deliveryInfo.attempts < this.options.maxRetries) {
      this.deliveryInfo.attempts++;
      this.deliveryInfo.lastAttempt = new Date();
      this.deliveryInfo.status = DeliveryStatus.SENDING;
      try {
        this.log(`Delivery attempt ${this.deliveryInfo.attempts} of ${this.options.maxRetries}`);
        // Try each MX server in order of priority
        while (this.currentMxIndex < this.mxServers.length) {
          const currentMx = this.mxServers[this.currentMxIndex];
          this.deliveryInfo.mxServer = currentMx;
          try {
            this.log(`Attempting delivery to MX server: ${currentMx}`);
            await this.connectAndSend(currentMx);
            // If we get here, email was sent successfully
            this.deliveryInfo.status = DeliveryStatus.DELIVERED;
            this.deliveryInfo.deliveryTime = new Date();
            this.log(`Email delivered successfully to ${currentMx}`);
            // Record delivery for sender reputation monitoring
            this.recordDeliveryEvent('delivered');
            // Save successful email record
            await this.saveSuccess();
            return DeliveryStatus.DELIVERED;
          } catch (error) {
            this.log(`Failed to deliver to ${currentMx}: ${error.message}`);
            this.currentMxIndex++;
            // If this MX server failed, try the next one
            if (this.currentMxIndex >= this.mxServers.length) {
              throw error; // No more MX servers to try
            }
          }
        }
        throw new Error('All MX servers failed');
      } catch (error) {
        this.deliveryInfo.error = error;
        // Check if this is a permanent failure
        if (this.isPermanentFailure(error)) {
          this.log('Permanent failure detected, not retrying');
          this.deliveryInfo.status = DeliveryStatus.FAILED;
          // Record permanent failure for bounce management
          this.recordDeliveryEvent('bounced', true);
          await this.saveFailed();
          return DeliveryStatus.FAILED;
        }
        // This is a temporary failure
        if (this.deliveryInfo.attempts < this.options.maxRetries) {
          this.log(`Temporary failure, will retry in ${this.options.retryDelay}ms`);
          this.deliveryInfo.status = DeliveryStatus.DEFERRED;
          this.deliveryInfo.nextAttempt = new Date(Date.now() + this.options.retryDelay);
          // Record temporary failure for monitoring
          this.recordDeliveryEvent('deferred');
          // Reset MX server index for next retry
          this.currentMxIndex = 0;
          // Wait before retrying
          await this.delay(this.options.retryDelay);
        }
      }
    }
    // If we get here, all retries failed
    this.deliveryInfo.status = DeliveryStatus.FAILED;
    await this.saveFailed();
    return DeliveryStatus.FAILED;
  }
  /**
   * Connect to a specific MX server and send the email using SmtpClient
   */
  private async connectAndSend(mxServer: string): Promise<void> {
    this.log(`Connecting to ${mxServer}:25`);
    try {
      // Check if IP warmup is enabled and get an IP to use
      let localAddress: string | undefined = undefined;
      try {
        const fromDomain = this.email.getFromDomain();
        const bestIP = this.emailServerRef.getBestIPForSending({
          from: this.email.from,
          to: this.email.getAllRecipients(),
          domain: fromDomain,
          isTransactional: this.email.priority === 'high'
        });
        if (bestIP) {
          this.log(`Using warmed-up IP ${bestIP} for sending`);
          localAddress = bestIP;
          // Record the send for warm-up tracking
          this.emailServerRef.recordIPSend(bestIP);
        }
      } catch (error) {
        this.log(`Error selecting IP address: ${error.message}`);
      }
      // Get SMTP client from UnifiedEmailServer
      const smtpClient = this.emailServerRef.getSmtpClient(mxServer, 25);
      // Sign the email with DKIM if available
      let signedEmail = this.email;
      try {
        const fromDomain = this.email.getFromDomain();
        if (fromDomain && this.emailServerRef.hasDkimKey(fromDomain)) {
          // Convert email to RFC822 format for signing
          const emailMessage = this.email.toRFC822String();
          // Create sign job with proper options
          const emailSignJob = new EmailSignJob(this.emailServerRef, {
            domain: fromDomain,
            selector: 'default', // Using default selector
            headers: {}, // Headers will be extracted from emailMessage
            body: emailMessage
          });
          // Get the DKIM signature header
          const signatureHeader = await emailSignJob.getSignatureHeader(emailMessage);
          // Add the signature to the email
          if (signatureHeader) {
            // For now, we'll use the email as-is since SmtpClient will handle DKIM
            this.log(`Email ready for DKIM signing for domain: ${fromDomain}`);
          }
        }
      } catch (error) {
        this.log(`Failed to prepare DKIM: ${error.message}`);
      }
      // Send the email using SmtpClient
      const result: ISmtpSendResult = await smtpClient.sendMail(signedEmail);
      if (result.success) {
        this.log(`Email sent successfully: ${result.response}`);
        // Record the send for reputation monitoring
        this.recordDeliveryEvent('delivered');
      } else {
        throw new Error(result.error?.message || 'Failed to send email');
      }
    } catch (error) {
      this.log(`Failed to send email via ${mxServer}: ${error.message}`);
      throw error;
    }
  }
  /**
   * Record delivery event for monitoring
   */
  private recordDeliveryEvent(
    eventType: 'delivered' | 'bounced' | 'deferred',
    isHardBounce: boolean = false
  ): void {
    try {
      const domain = this.email.getFromDomain();
      if (domain) {
        if (eventType === 'delivered') {
          this.emailServerRef.recordDelivery(domain);
        } else if (eventType === 'bounced') {
          // Get the receiving domain for bounce recording
          let receivingDomain = null;
          const primaryRecipient = this.email.getPrimaryRecipient();
          if (primaryRecipient) {
            receivingDomain = primaryRecipient.split('@')[1];
          }
          if (receivingDomain) {
            this.emailServerRef.recordBounce(
              domain,
              receivingDomain,
              isHardBounce ? 'hard' : 'soft',
              this.deliveryInfo.error?.message || 'Unknown error'
            );
          }
        }
      }
    } catch (error) {
      this.log(`Failed to record delivery event: ${error.message}`);
    }
  }
  /**
   * Check if an error represents a permanent failure
   */
  private isPermanentFailure(error: Error): boolean {
    const permanentFailurePatterns = [
      'User unknown',
      'No such user',
      'Mailbox not found',
      'Invalid recipient',
      'Account disabled',
      'Account suspended',
      'Domain not found',
      'No such domain',
      'Invalid domain',
      'Relay access denied',
      'Access denied',
      'Blacklisted',
      'Blocked',
      '550', // Permanent failure SMTP code
      '551',
      '552',
      '553',
      '554'
    ];
    const errorMessage = error.message.toLowerCase();
    return permanentFailurePatterns.some(pattern => 
      errorMessage.includes(pattern.toLowerCase())
    );
  }
  /**
   * Resolve MX records for a domain
   */
  private resolveMx(domain: string): Promise<plugins.dns.MxRecord[]> {
    return new Promise((resolve, reject) => {
      plugins.dns.resolveMx(domain, (err, addresses) => {
        if (err) {
          reject(err);
        } else {
          resolve(addresses || []);
        }
      });
    });
  }
  /**
   * Log a message with timestamp
   */
  private log(message: string): void {
    const timestamp = new Date().toISOString();
    const logEntry = `[${timestamp}] ${message}`;
    this.deliveryInfo.logs.push(logEntry);
    if (this.options.debugMode) {
      console.log(`[EmailSendJob] ${logEntry}`);
    }
  }
  /**
   * Save successful email to storage
   */
  private async saveSuccess(): Promise<void> {
    try {
      // Use the existing email storage path
      const emailContent = this.email.toRFC822String();
      const fileName = `${Date.now()}_${this.email.from}_to_${this.email.to[0]}_success.eml`;
      const filePath = plugins.path.join(paths.sentEmailsDir, fileName);
      await plugins.smartfs.directory(paths.sentEmailsDir).recursive().create();
      await plugins.smartfs.file(filePath).write(emailContent);
      // Also save delivery info
      const infoFileName = `${Date.now()}_${this.email.from}_to_${this.email.to[0]}_info.json`;
      const infoPath = plugins.path.join(paths.sentEmailsDir, infoFileName);
      await plugins.smartfs.file(infoPath).write(JSON.stringify(this.deliveryInfo, null, 2));
      this.log(`Email saved to ${fileName}`);
    } catch (error) {
      this.log(`Failed to save email: ${error.message}`);
    }
  }
  /**
   * Save failed email to storage
   */
  private async saveFailed(): Promise<void> {
    try {
      // Use the existing email storage path
      const emailContent = this.email.toRFC822String();
      const fileName = `${Date.now()}_${this.email.from}_to_${this.email.to[0]}_failed.eml`;
      const filePath = plugins.path.join(paths.failedEmailsDir, fileName);
      await plugins.smartfs.directory(paths.failedEmailsDir).recursive().create();
      await plugins.smartfs.file(filePath).write(emailContent);
      // Also save delivery info with error details
      const infoFileName = `${Date.now()}_${this.email.from}_to_${this.email.to[0]}_error.json`;
      const infoPath = plugins.path.join(paths.failedEmailsDir, infoFileName);
      await plugins.smartfs.file(infoPath).write(JSON.stringify(this.deliveryInfo, null, 2));
      this.log(`Failed email saved to ${fileName}`);
    } catch (error) {
      this.log(`Failed to save failed email: ${error.message}`);
    }
  }
  /**
   * Delay for specified milliseconds
   */
  private delay(ms: number): Promise<void> {
    return new Promise(resolve => setTimeout(resolve, ms));
  }
 }
--- a/ts/mail/delivery/classes.emailsignjob.ts
+++ b/ts/mail/delivery/classes.emailsignjob.ts
@@ -1,41 +0,0 @@
 import * as plugins from '../../plugins.js';
 import type { UnifiedEmailServer } from '../routing/classes.unified.email.server.js';
 import { RustSecurityBridge } from '../../security/classes.rustsecuritybridge.js';
 interface Headers {
  [key: string]: string;
 }
 interface IEmailSignJobOptions {
  domain: string;
  selector: string;
  headers: Headers;
  body: string;
 }
 export class EmailSignJob {
  emailServerRef: UnifiedEmailServer;
  jobOptions: IEmailSignJobOptions;
  constructor(emailServerRef: UnifiedEmailServer, options: IEmailSignJobOptions) {
    this.emailServerRef = emailServerRef;
    this.jobOptions = options;
  }
  async loadPrivateKey(): Promise<string> {
    const keyInfo = await this.emailServerRef.dkimCreator.readDKIMKeys(this.jobOptions.domain);
    return keyInfo.privateKey;
  }
  public async getSignatureHeader(emailMessage: string): Promise<string> {
    const privateKey = await this.loadPrivateKey();
    const bridge = RustSecurityBridge.getInstance();
    const signResult = await bridge.signDkim({
      rawMessage: emailMessage,
      domain: this.jobOptions.domain,
      selector: this.jobOptions.selector,
      privateKey,
    });
    return signResult.header;
  }
 }
--- a/ts/mail/delivery/classes.mta.config.ts
+++ b/ts/mail/delivery/classes.mta.config.ts
@@ -1,73 +0,0 @@
 import * as plugins from '../../plugins.js';
 import * as paths from '../../paths.js';
 import type { UnifiedEmailServer } from '../routing/classes.unified.email.server.js';
 /**
 * Configures email server storage settings 
 * @param emailServer Reference to the unified email server
 * @param options Configuration options containing storage paths
 */
 export async function configureEmailStorage(emailServer: UnifiedEmailServer, options: any): Promise<void> {
  // Extract the receivedEmailsPath if available
  if (options?.emailPortConfig?.receivedEmailsPath) {
    const receivedEmailsPath = options.emailPortConfig.receivedEmailsPath;
    // Ensure the directory exists
    await plugins.smartfs.directory(receivedEmailsPath).recursive().create();
    // Set path for received emails
    if (emailServer) {
      // Storage paths are now handled by the unified email server system
      await plugins.smartfs.directory(paths.receivedEmailsDir).recursive().create();
      console.log(`Configured email server to store received emails to: ${receivedEmailsPath}`);
    }
  }
 }
 /**
 * Configure email server with port and storage settings
 * @param emailServer Reference to the unified email server
 * @param config Configuration settings for email server
 */
 export async function configureEmailServer(
  emailServer: UnifiedEmailServer,
  config: {
    ports?: number[];
    hostname?: string;
    tls?: {
      certPath?: string;
      keyPath?: string;
      caPath?: string;
    };
    storagePath?: string;
  }
 ): Promise<boolean> {
  if (!emailServer) {
    console.error('Email server not available');
    return false;
  }
  // Configure the email server with updated options
  const serverOptions = {
    ports: config.ports || [25, 587, 465],
    hostname: config.hostname || 'localhost',
    tls: config.tls
  };
  // Update the email server options
  emailServer.updateOptions(serverOptions);
  console.log(`Configured email server on ports ${serverOptions.ports.join(', ')}`);
  // Set up storage path if provided
  if (config.storagePath) {
    await configureEmailStorage(emailServer, {
      emailPortConfig: {
        receivedEmailsPath: config.storagePath
      }
    });
  }
  return true;
 }
--- a/ts/mail/delivery/classes.ratelimiter.ts
+++ b/ts/mail/delivery/classes.ratelimiter.ts
@@ -1,325 +0,0 @@
 import { logger } from '../../logger.js';
 /**
 * Configuration options for rate limiter
 */
 export interface IRateLimitConfig {
  /** Maximum tokens per period */
  maxPerPeriod: number;
  /** Time period in milliseconds */
  periodMs: number;
  /** Whether to apply per domain/key (vs globally) */
  perKey: boolean;
  /** Initial token count (defaults to max) */
  initialTokens?: number;
  /** Grace tokens to allow occasional bursts */
  burstTokens?: number;
  /** Apply global limit in addition to per-key limits */
  useGlobalLimit?: boolean;
 }
 /**
 * Token bucket for an individual key
 */
 interface TokenBucket {
  /** Current number of tokens */
  tokens: number;
  /** Last time tokens were refilled */
  lastRefill: number;
  /** Total allowed requests */
  allowed: number;
  /** Total denied requests */
  denied: number;
  /** Error count for blocking decisions */
  errors: number;
  /** Timestamp of first error in current window */
  firstErrorTime: number;
 }
 /**
 * Rate limiter using token bucket algorithm
 * Provides more sophisticated rate limiting with burst handling
 */
 export class RateLimiter {
  /** Rate limit configuration */
  private config: IRateLimitConfig;
  /** Token buckets per key */
  private buckets: Map<string, TokenBucket> = new Map();
  /** Global bucket for non-keyed rate limiting */
  private globalBucket: TokenBucket;
  /**
   * Create a new rate limiter
   * @param config Rate limiter configuration
   */
  constructor(config: IRateLimitConfig) {
    // Set defaults
    this.config = {
      maxPerPeriod: config.maxPerPeriod,
      periodMs: config.periodMs,
      perKey: config.perKey ?? true,
      initialTokens: config.initialTokens ?? config.maxPerPeriod,
      burstTokens: config.burstTokens ?? 0,
      useGlobalLimit: config.useGlobalLimit ?? false
    };
    // Initialize global bucket
    this.globalBucket = {
      tokens: this.config.initialTokens,
      lastRefill: Date.now(),
      allowed: 0,
      denied: 0,
      errors: 0,
      firstErrorTime: 0
    };
    // Log initialization
    logger.log('info', `Rate limiter initialized: ${this.config.maxPerPeriod} per ${this.config.periodMs}ms${this.config.perKey ? ' per key' : ''}`);
  }
  /**
   * Check if a request is allowed under rate limits
   * @param key Key to check rate limit for (e.g. domain, user, IP)
   * @param cost Token cost (defaults to 1)
   * @returns Whether the request is allowed
   */
  public isAllowed(key: string = 'global', cost: number = 1): boolean {
    // If using global bucket directly, just check that
    if (key === 'global' || !this.config.perKey) {
      return this.checkBucket(this.globalBucket, cost);
    }
    // Get the key-specific bucket
    const bucket = this.getBucket(key);
    // If we also need to check global limit
    if (this.config.useGlobalLimit) {
      // Both key bucket and global bucket must have tokens
      return this.checkBucket(bucket, cost) && this.checkBucket(this.globalBucket, cost);
    } else {
      // Only need to check the key-specific bucket
      return this.checkBucket(bucket, cost);
    }
  }
  /**
   * Check if a bucket has enough tokens and consume them
   * @param bucket The token bucket to check
   * @param cost Token cost
   * @returns Whether tokens were consumed
   */
  private checkBucket(bucket: TokenBucket, cost: number): boolean {
    // Refill tokens based on elapsed time
    this.refillBucket(bucket);
    // Check if we have enough tokens
    if (bucket.tokens >= cost) {
      // Use tokens
      bucket.tokens -= cost;
      bucket.allowed++;
      return true;
    } else {
      // Rate limit exceeded
      bucket.denied++;
      return false;
    }
  }
  /**
   * Consume tokens for a request (if available)
   * @param key Key to consume tokens for
   * @param cost Token cost (defaults to 1)
   * @returns Whether tokens were consumed
   */
  public consume(key: string = 'global', cost: number = 1): boolean {
    const isAllowed = this.isAllowed(key, cost);
    return isAllowed;
  }
  /**
   * Get the remaining tokens for a key
   * @param key Key to check
   * @returns Number of remaining tokens
   */
  public getRemainingTokens(key: string = 'global'): number {
    const bucket = this.getBucket(key);
    this.refillBucket(bucket);
    return bucket.tokens;
  }
  /**
   * Get stats for a specific key
   * @param key Key to get stats for
   * @returns Rate limit statistics
   */
  public getStats(key: string = 'global'): {
    remaining: number;
    limit: number;
    resetIn: number;
    allowed: number;
    denied: number;
  } {
    const bucket = this.getBucket(key);
    this.refillBucket(bucket);
    // Calculate time until next token
    const resetIn = bucket.tokens < this.config.maxPerPeriod ?
      Math.ceil(this.config.periodMs / this.config.maxPerPeriod) :
      0;
    return {
      remaining: bucket.tokens,
      limit: this.config.maxPerPeriod,
      resetIn,
      allowed: bucket.allowed,
      denied: bucket.denied
    };
  }
  /**
   * Get or create a token bucket for a key
   * @param key The rate limit key
   * @returns Token bucket
   */
  private getBucket(key: string): TokenBucket {
    if (!this.config.perKey || key === 'global') {
      return this.globalBucket;
    }
    if (!this.buckets.has(key)) {
      // Create new bucket
      this.buckets.set(key, {
        tokens: this.config.initialTokens,
        lastRefill: Date.now(),
        allowed: 0,
        denied: 0,
        errors: 0,
        firstErrorTime: 0
      });
    }
    return this.buckets.get(key);
  }
  /**
   * Refill tokens in a bucket based on elapsed time
   * @param bucket Token bucket to refill
   */
  private refillBucket(bucket: TokenBucket): void {
    const now = Date.now();
    const elapsedMs = now - bucket.lastRefill;
    // Calculate how many tokens to add
    const rate = this.config.maxPerPeriod / this.config.periodMs;
    const tokensToAdd = elapsedMs * rate;
    if (tokensToAdd >= 0.1) { // Allow for partial token refills
      // Add tokens, but don't exceed the normal maximum (without burst)
      // This ensures burst tokens are only used for bursts and don't refill
      const normalMax = this.config.maxPerPeriod;
      bucket.tokens = Math.min(
        // Don't exceed max + burst
        this.config.maxPerPeriod + (this.config.burstTokens || 0), 
        // Don't exceed normal max when refilling
        Math.min(normalMax, bucket.tokens + tokensToAdd)
      );
      // Update last refill time
      bucket.lastRefill = now;
    }
  }
  /**
   * Reset rate limits for a specific key
   * @param key Key to reset
   */
  public reset(key: string = 'global'): void {
    if (key === 'global' || !this.config.perKey) {
      this.globalBucket.tokens = this.config.initialTokens;
      this.globalBucket.lastRefill = Date.now();
    } else if (this.buckets.has(key)) {
      const bucket = this.buckets.get(key);
      bucket.tokens = this.config.initialTokens;
      bucket.lastRefill = Date.now();
    }
  }
  /**
   * Reset all rate limiters
   */
  public resetAll(): void {
    this.globalBucket.tokens = this.config.initialTokens;
    this.globalBucket.lastRefill = Date.now();
    for (const bucket of this.buckets.values()) {
      bucket.tokens = this.config.initialTokens;
      bucket.lastRefill = Date.now();
    }
  }
  /**
   * Cleanup old buckets to prevent memory leaks
   * @param maxAge Maximum age in milliseconds
   */
  public cleanup(maxAge: number = 24 * 60 * 60 * 1000): void {
    const now = Date.now();
    let removed = 0;
    for (const [key, bucket] of this.buckets.entries()) {
      if (now - bucket.lastRefill > maxAge) {
        this.buckets.delete(key);
        removed++;
      }
    }
    if (removed > 0) {
      logger.log('debug', `Cleaned up ${removed} stale rate limit buckets`);
    }
  }
  /**
   * Record an error for a key (e.g., IP address) and determine if blocking is needed
   * RFC 5321 Section 4.5.4.1 suggests limiting errors to prevent abuse
   *
   * @param key Key to record error for (typically an IP address)
   * @param errorWindow Time window for error tracking in ms (default: 5 minutes)
   * @param errorThreshold Maximum errors before blocking (default: 10)
   * @returns true if the key should be blocked due to excessive errors
   */
  public recordError(key: string, errorWindow: number = 5 * 60 * 1000, errorThreshold: number = 10): boolean {
    const bucket = this.getBucket(key);
    const now = Date.now();
    // Reset error count if the time window has expired
    if (bucket.firstErrorTime === 0 || now - bucket.firstErrorTime > errorWindow) {
      bucket.errors = 0;
      bucket.firstErrorTime = now;
    }
    // Increment error count
    bucket.errors++;
    // Log error tracking
    logger.log('debug', `Error recorded for ${key}: ${bucket.errors}/${errorThreshold} in window`);
    // Check if threshold exceeded
    if (bucket.errors >= errorThreshold) {
      logger.log('warn', `Error threshold exceeded for ${key}: ${bucket.errors} errors`);
      return true; // Should block
    }
    return false; // Continue allowing
  }
 }
--- a/ts/mail/delivery/classes.smtp.client.legacy.ts
+++ b/ts/mail/delivery/classes.smtp.client.legacy.ts
--- a/ts/mail/delivery/index.ts
+++ b/ts/mail/delivery/index.ts
@@ -1,23 +1,5 @@
 // Email delivery components
 export * from './classes.emailsignjob.js';
 export * from './classes.delivery.queue.js';
 export * from './classes.delivery.system.js';
 // Handle exports with naming conflicts
 export { EmailSendJob } from './classes.emailsendjob.js';
 export { DeliveryStatus } from './classes.delivery.system.js';
 // Rate limiter exports - fix naming conflict
 export { RateLimiter } from './classes.ratelimiter.js';
 export type { IRateLimitConfig } from './classes.ratelimiter.js';
 // Unified rate limiter
 export * from './classes.unified.rate.limiter.js';
 // SMTP client and configuration
 export * from './classes.mta.config.js';
 // Import and export SMTP modules as namespaces to avoid conflicts
 import * as smtpClientMod from './smtpclient/index.js';
 export { smtpClientMod };
--- a/ts/mail/delivery/interfaces.ts
+++ b/ts/mail/delivery/interfaces.ts
@@ -2,8 +2,6 @@
 * SMTP and email delivery interface definitions
 */
 import type { Email } from '../core/classes.email.js';
 /**
 * SMTP session state enumeration
 */
@@ -167,125 +165,3 @@ export interface ISmtpAuth {
  password: string;
 }
 /**
 * SMTP server options
 */
 export interface ISmtpServerOptions {
  /**
   * Port to listen on
   */
  port: number;
  /**
   * TLS private key (PEM format)
   */
  key: string;
  /**
   * TLS certificate (PEM format)
   */
  cert: string;
  /**
   * Server hostname for SMTP banner
   */
  hostname?: string;
  /**
   * Host address to bind to (defaults to all interfaces)
   */
  host?: string;
  /**
   * Secure port for dedicated TLS connections
   */
  securePort?: number;
  /**
   * CA certificates for TLS (PEM format)
   */
  ca?: string;
  /**
   * Maximum size of messages in bytes
   */
  maxSize?: number;
  /**
   * Maximum number of concurrent connections
   */
  maxConnections?: number;
  /**
   * Authentication options
   */
  auth?: {
    /**
     * Whether authentication is required
     */
    required: boolean;
    /**
     * Allowed authentication methods
     */
    methods: ('PLAIN' | 'LOGIN' | 'OAUTH2')[];
  };
  /**
   * Socket timeout in milliseconds (default: 5 minutes / 300000ms)
   */
  socketTimeout?: number;
  /**
   * Initial connection timeout in milliseconds (default: 30 seconds / 30000ms)
   */
  connectionTimeout?: number;
  /**
   * Interval for checking idle sessions in milliseconds (default: 5 seconds / 5000ms)
   * For testing, can be set lower (e.g. 1000ms) to detect timeouts more quickly
   */
  cleanupInterval?: number;
  /**
   * Maximum number of recipients allowed per message (default: 100)
   */
  maxRecipients?: number;
  /**
   * Maximum message size in bytes (default: 10MB / 10485760 bytes)
   * This is advertised in the EHLO SIZE extension
   */
  size?: number;
  /**
   * Timeout for the DATA command in milliseconds (default: 60000ms / 1 minute)
   * This controls how long to wait for the complete email data
   */
  dataTimeout?: number;
 }
 /**
 * Result of SMTP transaction
 */
 export interface ISmtpTransactionResult {
  /**
   * Whether the transaction was successful
   */
  success: boolean;
  /**
   * Error message if failed
   */
  error?: string;
  /**
   * Message ID if successful
   */
  messageId?: string;
  /**
   * Resulting email if successful
   */
  email?: Email;
 }
--- a/ts/mail/delivery/smtpclient/auth-handler.ts
+++ b/ts/mail/delivery/smtpclient/auth-handler.ts
@@ -1,232 +0,0 @@
 /**
 * SMTP Client Authentication Handler
 * Authentication mechanisms implementation
 */
 import { AUTH_METHODS } from './constants.js';
 import type { 
  ISmtpConnection, 
  ISmtpAuthOptions, 
  ISmtpClientOptions,
  ISmtpResponse,
  IOAuth2Options
 } from './interfaces.js';
 import { 
  encodeAuthPlain, 
  encodeAuthLogin, 
  generateOAuth2String,
  isSuccessCode 
 } from './utils/helpers.js';
 import { logAuthentication, logDebug } from './utils/logging.js';
 import type { CommandHandler } from './command-handler.js';
 export class AuthHandler {
  private options: ISmtpClientOptions;
  private commandHandler: CommandHandler;
  constructor(options: ISmtpClientOptions, commandHandler: CommandHandler) {
    this.options = options;
    this.commandHandler = commandHandler;
  }
  /**
   * Authenticate using the configured method
   */
  public async authenticate(connection: ISmtpConnection): Promise<void> {
    if (!this.options.auth) {
      logDebug('No authentication configured', this.options);
      return;
    }
    const authOptions = this.options.auth;
    const capabilities = connection.capabilities;
    if (!capabilities || capabilities.authMethods.size === 0) {
      throw new Error('Server does not support authentication');
    }
    // Determine authentication method
    const method = this.selectAuthMethod(authOptions, capabilities.authMethods);
    logAuthentication('start', method, this.options);
    try {
      switch (method) {
        case AUTH_METHODS.PLAIN:
          await this.authenticatePlain(connection, authOptions);
          break;
        case AUTH_METHODS.LOGIN:
          await this.authenticateLogin(connection, authOptions);
          break;
        case AUTH_METHODS.OAUTH2:
          await this.authenticateOAuth2(connection, authOptions);
          break;
        default:
          throw new Error(`Unsupported authentication method: ${method}`);
      }
      logAuthentication('success', method, this.options);
    } catch (error) {
      logAuthentication('failure', method, this.options, { error });
      throw error;
    }
  }
  /**
   * Authenticate using AUTH PLAIN
   */
  private async authenticatePlain(connection: ISmtpConnection, auth: ISmtpAuthOptions): Promise<void> {
    if (!auth.user || !auth.pass) {
      throw new Error('Username and password required for PLAIN authentication');
    }
    const credentials = encodeAuthPlain(auth.user, auth.pass);
    const response = await this.commandHandler.sendAuth(connection, AUTH_METHODS.PLAIN, credentials);
    if (!isSuccessCode(response.code)) {
      throw new Error(`PLAIN authentication failed: ${response.message}`);
    }
  }
  /**
   * Authenticate using AUTH LOGIN
   */
  private async authenticateLogin(connection: ISmtpConnection, auth: ISmtpAuthOptions): Promise<void> {
    if (!auth.user || !auth.pass) {
      throw new Error('Username and password required for LOGIN authentication');
    }
    // Step 1: Send AUTH LOGIN
    let response = await this.commandHandler.sendAuth(connection, AUTH_METHODS.LOGIN);
    if (response.code !== 334) {
      throw new Error(`LOGIN authentication initiation failed: ${response.message}`);
    }
    // Step 2: Send username
    const encodedUser = encodeAuthLogin(auth.user);
    response = await this.commandHandler.sendCommand(connection, encodedUser);
    if (response.code !== 334) {
      throw new Error(`LOGIN username failed: ${response.message}`);
    }
    // Step 3: Send password
    const encodedPass = encodeAuthLogin(auth.pass);
    response = await this.commandHandler.sendCommand(connection, encodedPass);
    if (!isSuccessCode(response.code)) {
      throw new Error(`LOGIN password failed: ${response.message}`);
    }
  }
  /**
   * Authenticate using OAuth2
   */
  private async authenticateOAuth2(connection: ISmtpConnection, auth: ISmtpAuthOptions): Promise<void> {
    if (!auth.oauth2) {
      throw new Error('OAuth2 configuration required for OAUTH2 authentication');
    }
    let accessToken = auth.oauth2.accessToken;
    // Refresh token if needed
    if (!accessToken || this.isTokenExpired(auth.oauth2)) {
      accessToken = await this.refreshOAuth2Token(auth.oauth2);
    }
    const authString = generateOAuth2String(auth.oauth2.user, accessToken);
    const response = await this.commandHandler.sendAuth(connection, AUTH_METHODS.OAUTH2, authString);
    if (!isSuccessCode(response.code)) {
      throw new Error(`OAUTH2 authentication failed: ${response.message}`);
    }
  }
  /**
   * Select appropriate authentication method
   */
  private selectAuthMethod(auth: ISmtpAuthOptions, serverMethods: Set<string>): string {
    // If method is explicitly specified, use it
    if (auth.method && auth.method !== 'AUTO') {
      const method = auth.method === 'OAUTH2' ? AUTH_METHODS.OAUTH2 : auth.method;
      if (serverMethods.has(method)) {
        return method;
      }
      throw new Error(`Requested authentication method ${auth.method} not supported by server`);
    }
    // Auto-select based on available credentials and server support
    if (auth.oauth2 && serverMethods.has(AUTH_METHODS.OAUTH2)) {
      return AUTH_METHODS.OAUTH2;
    }
    if (auth.user && auth.pass) {
      // Prefer PLAIN over LOGIN for simplicity
      if (serverMethods.has(AUTH_METHODS.PLAIN)) {
        return AUTH_METHODS.PLAIN;
      }
      if (serverMethods.has(AUTH_METHODS.LOGIN)) {
        return AUTH_METHODS.LOGIN;
      }
    }
    throw new Error('No compatible authentication method found');
  }
  /**
   * Check if OAuth2 token is expired
   */
  private isTokenExpired(oauth2: IOAuth2Options): boolean {
    if (!oauth2.expires) {
      return false; // No expiry information, assume valid
    }
    const now = Date.now();
    const buffer = 300000; // 5 minutes buffer
    return oauth2.expires < (now + buffer);
  }
  /**
   * Refresh OAuth2 access token
   */
  private async refreshOAuth2Token(oauth2: IOAuth2Options): Promise<string> {
    // This is a simplified implementation
    // In a real implementation, you would make an HTTP request to the OAuth2 provider
    logDebug('OAuth2 token refresh required', this.options);
    if (!oauth2.refreshToken) {
      throw new Error('Refresh token required for OAuth2 token refresh');
    }
    // TODO: Implement actual OAuth2 token refresh
    // For now, throw an error to indicate this needs to be implemented
    throw new Error('OAuth2 token refresh not implemented. Please provide a valid access token.');
  }
  /**
   * Validate authentication configuration
   */
  public validateAuthConfig(auth: ISmtpAuthOptions): string[] {
    const errors: string[] = [];
    if (auth.method === 'OAUTH2' || auth.oauth2) {
      if (!auth.oauth2) {
        errors.push('OAuth2 configuration required when using OAUTH2 method');
      } else {
        if (!auth.oauth2.user) errors.push('OAuth2 user required');
        if (!auth.oauth2.clientId) errors.push('OAuth2 clientId required');
        if (!auth.oauth2.clientSecret) errors.push('OAuth2 clientSecret required');
        if (!auth.oauth2.refreshToken && !auth.oauth2.accessToken) {
          errors.push('OAuth2 refreshToken or accessToken required');
        }
      }
    } else if (auth.method === 'PLAIN' || auth.method === 'LOGIN' || (!auth.method && (auth.user || auth.pass))) {
      if (!auth.user) errors.push('Username required for basic authentication');
      if (!auth.pass) errors.push('Password required for basic authentication');
    }
    return errors;
  }
 }
--- a/ts/mail/delivery/smtpclient/command-handler.ts
+++ b/ts/mail/delivery/smtpclient/command-handler.ts
@@ -1,343 +0,0 @@
 /**
 * SMTP Client Command Handler
 * SMTP command sending and response parsing
 */
 import { EventEmitter } from 'node:events';
 import { SMTP_COMMANDS, SMTP_CODES, LINE_ENDINGS } from './constants.js';
 import type { 
  ISmtpConnection, 
  ISmtpResponse, 
  ISmtpClientOptions,
  ISmtpCapabilities 
 } from './interfaces.js';
 import { 
  parseSmtpResponse, 
  parseEhloResponse, 
  formatCommand,
  isSuccessCode 
 } from './utils/helpers.js';
 import { logCommand, logDebug } from './utils/logging.js';
 export class CommandHandler extends EventEmitter {
  private options: ISmtpClientOptions;
  private responseBuffer: string = '';
  private pendingCommand: { resolve: Function; reject: Function; command: string } | null = null;
  private commandTimeout: NodeJS.Timeout | null = null;
  constructor(options: ISmtpClientOptions) {
    super();
    this.options = options;
  }
  /**
   * Send EHLO command and parse capabilities
   */
  public async sendEhlo(connection: ISmtpConnection, domain?: string): Promise<ISmtpCapabilities> {
    const hostname = domain || this.options.domain || 'localhost';
    const command = `${SMTP_COMMANDS.EHLO} ${hostname}`;
    const response = await this.sendCommand(connection, command);
    if (!isSuccessCode(response.code)) {
      throw new Error(`EHLO failed: ${response.message}`);
    }
    const capabilities = parseEhloResponse(response.raw);
    connection.capabilities = capabilities;
    logDebug('EHLO capabilities parsed', this.options, { capabilities });
    return capabilities;
  }
  /**
   * Send MAIL FROM command
   */
  public async sendMailFrom(connection: ISmtpConnection, fromAddress: string): Promise<ISmtpResponse> {
    // Handle empty return path for bounce messages
    const command = fromAddress === '' 
      ? `${SMTP_COMMANDS.MAIL_FROM}:<>` 
      : `${SMTP_COMMANDS.MAIL_FROM}:<${fromAddress}>`;
    return this.sendCommand(connection, command);
  }
  /**
   * Send RCPT TO command
   */
  public async sendRcptTo(connection: ISmtpConnection, toAddress: string): Promise<ISmtpResponse> {
    const command = `${SMTP_COMMANDS.RCPT_TO}:<${toAddress}>`;
    return this.sendCommand(connection, command);
  }
  /**
   * Send DATA command
   */
  public async sendData(connection: ISmtpConnection): Promise<ISmtpResponse> {
    return this.sendCommand(connection, SMTP_COMMANDS.DATA);
  }
  /**
   * Send email data content
   */
  public async sendDataContent(connection: ISmtpConnection, emailData: string): Promise<ISmtpResponse> {
    // Normalize line endings to CRLF
    let data = emailData.replace(/\r\n/g, '\n').replace(/\r/g, '\n').replace(/\n/g, '\r\n');
    // Ensure email data ends with CRLF
    if (!data.endsWith(LINE_ENDINGS.CRLF)) {
      data += LINE_ENDINGS.CRLF;
    }
    // Perform dot stuffing (escape lines starting with a dot)
    data = data.replace(/\r\n\./g, '\r\n..');
    // Add termination sequence
    data += '.' + LINE_ENDINGS.CRLF;
    return this.sendRawData(connection, data);
  }
  /**
   * Send RSET command
   */
  public async sendRset(connection: ISmtpConnection): Promise<ISmtpResponse> {
    return this.sendCommand(connection, SMTP_COMMANDS.RSET);
  }
  /**
   * Send NOOP command
   */
  public async sendNoop(connection: ISmtpConnection): Promise<ISmtpResponse> {
    return this.sendCommand(connection, SMTP_COMMANDS.NOOP);
  }
  /**
   * Send QUIT command
   */
  public async sendQuit(connection: ISmtpConnection): Promise<ISmtpResponse> {
    return this.sendCommand(connection, SMTP_COMMANDS.QUIT);
  }
  /**
   * Send STARTTLS command
   */
  public async sendStartTls(connection: ISmtpConnection): Promise<ISmtpResponse> {
    return this.sendCommand(connection, SMTP_COMMANDS.STARTTLS);
  }
  /**
   * Send AUTH command
   */
  public async sendAuth(connection: ISmtpConnection, method: string, credentials?: string): Promise<ISmtpResponse> {
    const command = credentials ? 
      `${SMTP_COMMANDS.AUTH} ${method} ${credentials}` : 
      `${SMTP_COMMANDS.AUTH} ${method}`;
    return this.sendCommand(connection, command);
  }
  /**
   * Send a generic SMTP command
   */
  public async sendCommand(connection: ISmtpConnection, command: string): Promise<ISmtpResponse> {
    return new Promise((resolve, reject) => {
      if (this.pendingCommand) {
        reject(new Error('Another command is already pending'));
        return;
      }
      this.pendingCommand = { resolve, reject, command };
      // Set command timeout
      const timeout = 30000; // 30 seconds
      this.commandTimeout = setTimeout(() => {
        this.pendingCommand = null;
        this.commandTimeout = null;
        reject(new Error(`Command timeout: ${command}`));
      }, timeout);
      // Set up data handler
      const dataHandler = (data: Buffer) => {
        this.handleIncomingData(data.toString());
      };
      connection.socket.on('data', dataHandler);
      // Clean up function
      const cleanup = () => {
        connection.socket.removeListener('data', dataHandler);
        if (this.commandTimeout) {
          clearTimeout(this.commandTimeout);
          this.commandTimeout = null;
        }
      };
      // Send command
      const formattedCommand = command.endsWith(LINE_ENDINGS.CRLF) ? command : formatCommand(command);
      logCommand(command, undefined, this.options);
      logDebug(`Sending command: ${command}`, this.options);
      connection.socket.write(formattedCommand, (error) => {
        if (error) {
          cleanup();
          this.pendingCommand = null;
          reject(error);
        }
      });
      // Override resolve/reject to include cleanup
      const originalResolve = resolve;
      const originalReject = reject;
      this.pendingCommand.resolve = (response: ISmtpResponse) => {
        cleanup();
        this.pendingCommand = null;
        logCommand(command, response, this.options);
        originalResolve(response);
      };
      this.pendingCommand.reject = (error: Error) => {
        cleanup();
        this.pendingCommand = null;
        originalReject(error);
      };
    });
  }
  /**
   * Send raw data without command formatting
   */
  public async sendRawData(connection: ISmtpConnection, data: string): Promise<ISmtpResponse> {
    return new Promise((resolve, reject) => {
      if (this.pendingCommand) {
        reject(new Error('Another command is already pending'));
        return;
      }
      this.pendingCommand = { resolve, reject, command: 'DATA_CONTENT' };
      // Set data timeout
      const timeout = 60000; // 60 seconds for data
      this.commandTimeout = setTimeout(() => {
        this.pendingCommand = null;
        this.commandTimeout = null;
        reject(new Error('Data transmission timeout'));
      }, timeout);
      // Set up data handler
      const dataHandler = (chunk: Buffer) => {
        this.handleIncomingData(chunk.toString());
      };
      connection.socket.on('data', dataHandler);
      // Clean up function
      const cleanup = () => {
        connection.socket.removeListener('data', dataHandler);
        if (this.commandTimeout) {
          clearTimeout(this.commandTimeout);
          this.commandTimeout = null;
        }
      };
      // Override resolve/reject to include cleanup
      const originalResolve = resolve;
      const originalReject = reject;
      this.pendingCommand.resolve = (response: ISmtpResponse) => {
        cleanup();
        this.pendingCommand = null;
        originalResolve(response);
      };
      this.pendingCommand.reject = (error: Error) => {
        cleanup();
        this.pendingCommand = null;
        originalReject(error);
      };
      // Send data
      connection.socket.write(data, (error) => {
        if (error) {
          cleanup();
          this.pendingCommand = null;
          reject(error);
        }
      });
    });
  }
  /**
   * Wait for server greeting
   */
  public async waitForGreeting(connection: ISmtpConnection): Promise<ISmtpResponse> {
    return new Promise((resolve, reject) => {
      const timeout = 30000; // 30 seconds
      let timeoutHandler: NodeJS.Timeout;
      const dataHandler = (data: Buffer) => {
        this.responseBuffer += data.toString();
        if (this.isCompleteResponse(this.responseBuffer)) {
          clearTimeout(timeoutHandler);
          connection.socket.removeListener('data', dataHandler);
          const response = parseSmtpResponse(this.responseBuffer);
          this.responseBuffer = '';
          if (isSuccessCode(response.code)) {
            resolve(response);
          } else {
            reject(new Error(`Server greeting failed: ${response.message}`));
          }
        }
      };
      timeoutHandler = setTimeout(() => {
        connection.socket.removeListener('data', dataHandler);
        reject(new Error('Greeting timeout'));
      }, timeout);
      connection.socket.on('data', dataHandler);
    });
  }
  private handleIncomingData(data: string): void {
    if (!this.pendingCommand) {
      return;
    }
    this.responseBuffer += data;
    if (this.isCompleteResponse(this.responseBuffer)) {
      const response = parseSmtpResponse(this.responseBuffer);
      this.responseBuffer = '';
      if (isSuccessCode(response.code) || (response.code >= 300 && response.code < 400) || response.code >= 400) {
        this.pendingCommand.resolve(response);
      } else {
        this.pendingCommand.reject(new Error(`Command failed: ${response.message}`));
      }
    }
  }
  private isCompleteResponse(buffer: string): boolean {
    // Check if we have a complete response
    const lines = buffer.split(/\r?\n/);
    if (lines.length < 1) {
      return false;
    }
    // Check the last non-empty line
    for (let i = lines.length - 1; i >= 0; i--) {
      const line = lines[i].trim();
      if (line.length > 0) {
        // Response is complete if line starts with "XXX " (space after code)
        return /^\d{3} /.test(line);
      }
    }
    return false;
  }
 }
--- a/ts/mail/delivery/smtpclient/connection-manager.ts
+++ b/ts/mail/delivery/smtpclient/connection-manager.ts
@@ -1,289 +0,0 @@
 /**
 * SMTP Client Connection Manager
 * Connection pooling and lifecycle management
 */
 import * as net from 'node:net';
 import * as tls from 'node:tls';
 import { EventEmitter } from 'node:events';
 import { DEFAULTS, CONNECTION_STATES } from './constants.js';
 import type { 
  ISmtpClientOptions, 
  ISmtpConnection, 
  IConnectionPoolStatus,
  ConnectionState 
 } from './interfaces.js';
 import { logConnection, logDebug } from './utils/logging.js';
 import { generateConnectionId } from './utils/helpers.js';
 export class ConnectionManager extends EventEmitter {
  private options: ISmtpClientOptions;
  private connections: Map<string, ISmtpConnection> = new Map();
  private pendingConnections: Set<string> = new Set();
  private idleTimeout: NodeJS.Timeout | null = null;
  constructor(options: ISmtpClientOptions) {
    super();
    this.options = options;
    this.setupIdleCleanup();
  }
  /**
   * Get or create a connection
   */
  public async getConnection(): Promise<ISmtpConnection> {
    // Try to reuse an idle connection if pooling is enabled
    if (this.options.pool) {
      const idleConnection = this.findIdleConnection();
      if (idleConnection) {
        const connectionId = this.getConnectionId(idleConnection) || 'unknown';
        logDebug('Reusing idle connection', this.options, { connectionId });
        return idleConnection;
      }
      // Check if we can create a new connection
      if (this.getActiveConnectionCount() >= (this.options.maxConnections || DEFAULTS.MAX_CONNECTIONS)) {
        throw new Error('Maximum number of connections reached');
      }
    }
    return this.createConnection();
  }
  /**
   * Create a new connection
   */
  public async createConnection(): Promise<ISmtpConnection> {
    const connectionId = generateConnectionId();
    try {
      this.pendingConnections.add(connectionId);
      logConnection('connecting', this.options, { connectionId });
      const socket = await this.establishSocket();
      const connection: ISmtpConnection = {
        socket,
        state: CONNECTION_STATES.CONNECTED as ConnectionState,
        options: this.options,
        secure: this.options.secure || false,
        createdAt: new Date(),
        lastActivity: new Date(),
        messageCount: 0
      };
      this.setupSocketHandlers(socket, connectionId);
      this.connections.set(connectionId, connection);
      this.pendingConnections.delete(connectionId);
      logConnection('connected', this.options, { connectionId });
      this.emit('connection', connection);
      return connection;
    } catch (error) {
      this.pendingConnections.delete(connectionId);
      logConnection('error', this.options, { connectionId, error });
      throw error;
    }
  }
  /**
   * Release a connection back to the pool or close it
   */
  public releaseConnection(connection: ISmtpConnection): void {
    const connectionId = this.getConnectionId(connection);
    if (!connectionId || !this.connections.has(connectionId)) {
      return;
    }
    if (this.options.pool && this.shouldReuseConnection(connection)) {
      // Return to pool
      connection.state = CONNECTION_STATES.READY as ConnectionState;
      connection.lastActivity = new Date();
      logDebug('Connection returned to pool', this.options, { connectionId });
    } else {
      // Close connection
      this.closeConnection(connection);
    }
  }
  /**
   * Close a specific connection
   */
  public closeConnection(connection: ISmtpConnection): void {
    const connectionId = this.getConnectionId(connection);
    if (connectionId) {
      this.connections.delete(connectionId);
    }
    connection.state = CONNECTION_STATES.CLOSING as ConnectionState;
    try {
      if (!connection.socket.destroyed) {
        connection.socket.destroy();
      }
    } catch (error) {
      logDebug('Error closing connection', this.options, { error });
    }
    logConnection('disconnected', this.options, { connectionId });
    this.emit('disconnect', connection);
  }
  /**
   * Close all connections
   */
  public closeAllConnections(): void {
    logDebug('Closing all connections', this.options);
    for (const connection of this.connections.values()) {
      this.closeConnection(connection);
    }
    this.connections.clear();
    this.pendingConnections.clear();
    if (this.idleTimeout) {
      clearInterval(this.idleTimeout);
      this.idleTimeout = null;
    }
  }
  /**
   * Get connection pool status
   */
  public getPoolStatus(): IConnectionPoolStatus {
    const total = this.connections.size;
    const active = Array.from(this.connections.values())
      .filter(conn => conn.state === CONNECTION_STATES.BUSY).length;
    const idle = total - active;
    const pending = this.pendingConnections.size;
    return { total, active, idle, pending };
  }
  /**
   * Update connection activity timestamp
   */
  public updateActivity(connection: ISmtpConnection): void {
    connection.lastActivity = new Date();
  }
  private async establishSocket(): Promise<net.Socket | tls.TLSSocket> {
    return new Promise((resolve, reject) => {
      const timeout = this.options.connectionTimeout || DEFAULTS.CONNECTION_TIMEOUT;
      let socket: net.Socket | tls.TLSSocket;
      if (this.options.secure) {
        // Direct TLS connection
        socket = tls.connect({
          host: this.options.host,
          port: this.options.port,
          ...this.options.tls
        });
      } else {
        // Plain connection
        socket = new net.Socket();
        socket.connect(this.options.port, this.options.host);
      }
      const timeoutHandler = setTimeout(() => {
        socket.destroy();
        reject(new Error(`Connection timeout after ${timeout}ms`));
      }, timeout);
      // For TLS connections, we need to wait for 'secureConnect' instead of 'connect'
      const successEvent = this.options.secure ? 'secureConnect' : 'connect';
      socket.once(successEvent, () => {
        clearTimeout(timeoutHandler);
        resolve(socket);
      });
      socket.once('error', (error) => {
        clearTimeout(timeoutHandler);
        reject(error);
      });
    });
  }
  private setupSocketHandlers(socket: net.Socket | tls.TLSSocket, connectionId: string): void {
    const socketTimeout = this.options.socketTimeout || DEFAULTS.SOCKET_TIMEOUT;
    socket.setTimeout(socketTimeout);
    socket.on('timeout', () => {
      logDebug('Socket timeout', this.options, { connectionId });
      socket.destroy();
    });
    socket.on('error', (error) => {
      logConnection('error', this.options, { connectionId, error });
      this.connections.delete(connectionId);
    });
    socket.on('close', () => {
      this.connections.delete(connectionId);
      logDebug('Socket closed', this.options, { connectionId });
    });
  }
  private findIdleConnection(): ISmtpConnection | null {
    for (const connection of this.connections.values()) {
      if (connection.state === CONNECTION_STATES.READY) {
        return connection;
      }
    }
    return null;
  }
  private shouldReuseConnection(connection: ISmtpConnection): boolean {
    const maxMessages = this.options.maxMessages || DEFAULTS.MAX_MESSAGES;
    const maxAge = 300000; // 5 minutes
    const age = Date.now() - connection.createdAt.getTime();
    return connection.messageCount < maxMessages && 
           age < maxAge && 
           !connection.socket.destroyed;
  }
  private getActiveConnectionCount(): number {
    return this.connections.size + this.pendingConnections.size;
  }
  private getConnectionId(connection: ISmtpConnection): string | null {
    for (const [id, conn] of this.connections.entries()) {
      if (conn === connection) {
        return id;
      }
    }
    return null;
  }
  private setupIdleCleanup(): void {
    if (!this.options.pool) {
      return;
    }
    const cleanupInterval = DEFAULTS.POOL_IDLE_TIMEOUT;
    this.idleTimeout = setInterval(() => {
      const now = Date.now();
      const connectionsToClose: ISmtpConnection[] = [];
      for (const connection of this.connections.values()) {
        const idleTime = now - connection.lastActivity.getTime();
        if (connection.state === CONNECTION_STATES.READY && idleTime > cleanupInterval) {
          connectionsToClose.push(connection);
        }
      }
      for (const connection of connectionsToClose) {
        logDebug('Closing idle connection', this.options);
        this.closeConnection(connection);
      }
    }, cleanupInterval);
  }
 }
--- a/ts/mail/delivery/smtpclient/constants.ts
+++ b/ts/mail/delivery/smtpclient/constants.ts
@@ -1,145 +0,0 @@
 /**
 * SMTP Client Constants and Error Codes
 * All constants, error codes, and enums for SMTP client operations
 */
 /**
 * SMTP response codes
 */
 export const SMTP_CODES = {
  // Positive completion replies
  SERVICE_READY: 220,
  SERVICE_CLOSING: 221,
  AUTHENTICATION_SUCCESSFUL: 235,
  REQUESTED_ACTION_OK: 250,
  USER_NOT_LOCAL: 251,
  CANNOT_VERIFY_USER: 252,
  // Positive intermediate replies
  START_MAIL_INPUT: 354,
  // Transient negative completion replies
  SERVICE_NOT_AVAILABLE: 421,
  MAILBOX_BUSY: 450,
  LOCAL_ERROR: 451,
  INSUFFICIENT_STORAGE: 452,
  UNABLE_TO_ACCOMMODATE: 455,
  // Permanent negative completion replies
  SYNTAX_ERROR: 500,
  SYNTAX_ERROR_PARAMETERS: 501,
  COMMAND_NOT_IMPLEMENTED: 502,
  BAD_SEQUENCE: 503,
  PARAMETER_NOT_IMPLEMENTED: 504,
  MAILBOX_UNAVAILABLE: 550,
  USER_NOT_LOCAL_TRY_FORWARD: 551,
  EXCEEDED_STORAGE: 552,
  MAILBOX_NAME_NOT_ALLOWED: 553,
  TRANSACTION_FAILED: 554
 } as const;
 /**
 * SMTP command names
 */
 export const SMTP_COMMANDS = {
  HELO: 'HELO',
  EHLO: 'EHLO',
  MAIL_FROM: 'MAIL FROM',
  RCPT_TO: 'RCPT TO',
  DATA: 'DATA',
  RSET: 'RSET',
  NOOP: 'NOOP',
  QUIT: 'QUIT',
  STARTTLS: 'STARTTLS',
  AUTH: 'AUTH'
 } as const;
 /**
 * Authentication methods
 */
 export const AUTH_METHODS = {
  PLAIN: 'PLAIN',
  LOGIN: 'LOGIN',
  OAUTH2: 'XOAUTH2',
  CRAM_MD5: 'CRAM-MD5'
 } as const;
 /**
 * Common SMTP extensions
 */
 export const SMTP_EXTENSIONS = {
  PIPELINING: 'PIPELINING',
  SIZE: 'SIZE',
  STARTTLS: 'STARTTLS',
  AUTH: 'AUTH',
  EIGHT_BIT_MIME: '8BITMIME',
  CHUNKING: 'CHUNKING',
  ENHANCED_STATUS_CODES: 'ENHANCEDSTATUSCODES',
  DSN: 'DSN'
 } as const;
 /**
 * Default configuration values
 */
 export const DEFAULTS = {
  CONNECTION_TIMEOUT: 60000, // 60 seconds
  SOCKET_TIMEOUT: 300000,    // 5 minutes
  COMMAND_TIMEOUT: 30000,    // 30 seconds
  MAX_CONNECTIONS: 5,
  MAX_MESSAGES: 100,
  PORT_SMTP: 25,
  PORT_SUBMISSION: 587,
  PORT_SMTPS: 465,
  RETRY_ATTEMPTS: 3,
  RETRY_DELAY: 1000,
  POOL_IDLE_TIMEOUT: 30000   // 30 seconds
 } as const;
 /**
 * Error types for classification
 */
 export enum SmtpErrorType {
  CONNECTION_ERROR = 'CONNECTION_ERROR',
  AUTHENTICATION_ERROR = 'AUTHENTICATION_ERROR',
  PROTOCOL_ERROR = 'PROTOCOL_ERROR',
  TIMEOUT_ERROR = 'TIMEOUT_ERROR',
  TLS_ERROR = 'TLS_ERROR',
  SYNTAX_ERROR = 'SYNTAX_ERROR',
  MAILBOX_ERROR = 'MAILBOX_ERROR',
  QUOTA_ERROR = 'QUOTA_ERROR',
  UNKNOWN_ERROR = 'UNKNOWN_ERROR'
 }
 /**
 * Regular expressions for parsing
 */
 export const REGEX_PATTERNS = {
  EMAIL_ADDRESS: /^[^\s@]+@[^\s@]+\.[^\s@]+$/,
  RESPONSE_CODE: /^(\d{3})([ -])(.*)/,
  ENHANCED_STATUS: /^(\d\.\d\.\d)\s/,
  AUTH_CAPABILITIES: /AUTH\s+(.+)/i,
  SIZE_EXTENSION: /SIZE\s+(\d+)/i
 } as const;
 /**
 * Line endings and separators
 */
 export const LINE_ENDINGS = {
  CRLF: '\r\n',
  LF: '\n',
  CR: '\r'
 } as const;
 /**
 * Connection states for internal use
 */
 export const CONNECTION_STATES = {
  DISCONNECTED: 'disconnected',
  CONNECTING: 'connecting',
  CONNECTED: 'connected',
  AUTHENTICATED: 'authenticated',
  READY: 'ready',
  BUSY: 'busy',
  CLOSING: 'closing',
  ERROR: 'error'
 } as const;
--- a/ts/mail/delivery/smtpclient/create-client.ts
+++ b/ts/mail/delivery/smtpclient/create-client.ts
@@ -1,94 +0,0 @@
 /**
 * SMTP Client Factory
 * Factory function for client creation and dependency injection
 */
 import { SmtpClient } from './smtp-client.js';
 import { ConnectionManager } from './connection-manager.js';
 import { CommandHandler } from './command-handler.js';
 import { AuthHandler } from './auth-handler.js';
 import { TlsHandler } from './tls-handler.js';
 import { SmtpErrorHandler } from './error-handler.js';
 import type { ISmtpClientOptions } from './interfaces.js';
 import { validateClientOptions } from './utils/validation.js';
 import { DEFAULTS } from './constants.js';
 /**
 * Create a complete SMTP client with all components
 */
 export function createSmtpClient(options: ISmtpClientOptions): SmtpClient {
  // Validate options
  const errors = validateClientOptions(options);
  if (errors.length > 0) {
    throw new Error(`Invalid client options: ${errors.join(', ')}`);
  }
  // Apply defaults
  const clientOptions: ISmtpClientOptions = {
    connectionTimeout: DEFAULTS.CONNECTION_TIMEOUT,
    socketTimeout: DEFAULTS.SOCKET_TIMEOUT,
    maxConnections: DEFAULTS.MAX_CONNECTIONS,
    maxMessages: DEFAULTS.MAX_MESSAGES,
    pool: false,
    secure: false,
    debug: false,
    ...options
  };
  // Create handlers
  const errorHandler = new SmtpErrorHandler(clientOptions);
  const connectionManager = new ConnectionManager(clientOptions);
  const commandHandler = new CommandHandler(clientOptions);
  const authHandler = new AuthHandler(clientOptions, commandHandler);
  const tlsHandler = new TlsHandler(clientOptions, commandHandler);
  // Create and return SMTP client
  return new SmtpClient({
    options: clientOptions,
    connectionManager,
    commandHandler,
    authHandler,
    tlsHandler,
    errorHandler
  });
 }
 /**
 * Create SMTP client with connection pooling enabled
 */
 export function createPooledSmtpClient(options: ISmtpClientOptions): SmtpClient {
  return createSmtpClient({
    ...options,
    pool: true,
    maxConnections: options.maxConnections || DEFAULTS.MAX_CONNECTIONS,
    maxMessages: options.maxMessages || DEFAULTS.MAX_MESSAGES
  });
 }
 /**
 * Create SMTP client for high-volume sending
 */
 export function createBulkSmtpClient(options: ISmtpClientOptions): SmtpClient {
  return createSmtpClient({
    ...options,
    pool: true,
    maxConnections: Math.max(options.maxConnections || 10, 10),
    maxMessages: Math.max(options.maxMessages || 1000, 1000),
    connectionTimeout: options.connectionTimeout || 30000,
    socketTimeout: options.socketTimeout || 120000
  });
 }
 /**
 * Create SMTP client for transactional emails
 */
 export function createTransactionalSmtpClient(options: ISmtpClientOptions): SmtpClient {
  return createSmtpClient({
    ...options,
    pool: false, // Use fresh connections for transactional emails
    maxConnections: 1,
    maxMessages: 1,
    connectionTimeout: options.connectionTimeout || 10000,
    socketTimeout: options.socketTimeout || 30000
  });
 }
--- a/ts/mail/delivery/smtpclient/error-handler.ts
+++ b/ts/mail/delivery/smtpclient/error-handler.ts
@@ -1,141 +0,0 @@
 /**
 * SMTP Client Error Handler
 * Error classification and recovery strategies
 */
 import { SmtpErrorType } from './constants.js';
 import type { ISmtpResponse, ISmtpErrorContext, ISmtpClientOptions } from './interfaces.js';
 import { logDebug } from './utils/logging.js';
 export class SmtpErrorHandler {
  private options: ISmtpClientOptions;
  constructor(options: ISmtpClientOptions) {
    this.options = options;
  }
  /**
   * Classify error type based on response or error
   */
  public classifyError(error: Error | ISmtpResponse, context?: ISmtpErrorContext): SmtpErrorType {
    logDebug('Classifying error', this.options, { errorMessage: error instanceof Error ? error.message : String(error), context });
    // Handle Error objects
    if (error instanceof Error) {
      return this.classifyErrorByMessage(error);
    }
    // Handle SMTP response codes
    if (typeof error === 'object' && 'code' in error) {
      return this.classifyErrorByCode(error.code);
    }
    return SmtpErrorType.UNKNOWN_ERROR;
  }
  /**
   * Determine if error is retryable
   */
  public isRetryable(errorType: SmtpErrorType, response?: ISmtpResponse): boolean {
    switch (errorType) {
      case SmtpErrorType.CONNECTION_ERROR:
      case SmtpErrorType.TIMEOUT_ERROR:
        return true;
      case SmtpErrorType.PROTOCOL_ERROR:
        // Only retry on temporary failures (4xx codes)
        return response ? response.code >= 400 && response.code < 500 : false;
      case SmtpErrorType.AUTHENTICATION_ERROR:
      case SmtpErrorType.TLS_ERROR:
      case SmtpErrorType.SYNTAX_ERROR:
      case SmtpErrorType.MAILBOX_ERROR:
      case SmtpErrorType.QUOTA_ERROR:
        return false;
      default:
        return false;
    }
  }
  /**
   * Get retry delay for error type
   */
  public getRetryDelay(attempt: number, errorType: SmtpErrorType): number {
    const baseDelay = 1000; // 1 second
    const maxDelay = 30000;  // 30 seconds
    // Exponential backoff with jitter
    const delay = Math.min(baseDelay * Math.pow(2, attempt - 1), maxDelay);
    const jitter = Math.random() * 0.1 * delay; // 10% jitter
    return Math.floor(delay + jitter);
  }
  /**
   * Create enhanced error with context
   */
  public createError(
    message: string,
    errorType: SmtpErrorType,
    context?: ISmtpErrorContext,
    originalError?: Error
  ): Error {
    const error = new Error(message);
    (error as any).type = errorType;
    (error as any).context = context;
    (error as any).originalError = originalError;
    return error;
  }
  private classifyErrorByMessage(error: Error): SmtpErrorType {
    const message = error.message.toLowerCase();
    if (message.includes('timeout') || message.includes('etimedout')) {
      return SmtpErrorType.TIMEOUT_ERROR;
    }
    if (message.includes('connect') || message.includes('econnrefused') || 
        message.includes('enotfound') || message.includes('enetunreach')) {
      return SmtpErrorType.CONNECTION_ERROR;
    }
    if (message.includes('tls') || message.includes('ssl') || 
        message.includes('certificate') || message.includes('handshake')) {
      return SmtpErrorType.TLS_ERROR;
    }
    if (message.includes('auth')) {
      return SmtpErrorType.AUTHENTICATION_ERROR;
    }
    return SmtpErrorType.UNKNOWN_ERROR;
  }
  private classifyErrorByCode(code: number): SmtpErrorType {
    if (code >= 500) {
      // Permanent failures
      if (code === 550 || code === 551 || code === 553) {
        return SmtpErrorType.MAILBOX_ERROR;
      }
      if (code === 552) {
        return SmtpErrorType.QUOTA_ERROR;
      }
      if (code === 500 || code === 501 || code === 502 || code === 504) {
        return SmtpErrorType.SYNTAX_ERROR;
      }
      return SmtpErrorType.PROTOCOL_ERROR;
    }
    if (code >= 400) {
      // Temporary failures
      if (code === 450 || code === 451 || code === 452) {
        return SmtpErrorType.QUOTA_ERROR;
      }
      return SmtpErrorType.PROTOCOL_ERROR;
    }
    return SmtpErrorType.UNKNOWN_ERROR;
  }
 }
--- a/ts/mail/delivery/smtpclient/index.ts
+++ b/ts/mail/delivery/smtpclient/index.ts
@@ -1,24 +0,0 @@
 /**
 * SMTP Client Module Exports
 * Modular SMTP client implementation for robust email delivery
 */
 // Main client class and factory
 export * from './smtp-client.js';
 export * from './create-client.js';
 // Core handlers
 export * from './connection-manager.js';
 export * from './command-handler.js';
 export * from './auth-handler.js';
 export * from './tls-handler.js';
 export * from './error-handler.js';
 // Interfaces and types
 export * from './interfaces.js';
 export * from './constants.js';
 // Utilities
 export * from './utils/validation.js';
 export * from './utils/logging.js';
 export * from './utils/helpers.js';
--- a/ts/mail/delivery/smtpclient/interfaces.ts
+++ b/ts/mail/delivery/smtpclient/interfaces.ts
@@ -1,242 +0,0 @@
 /**
 * SMTP Client Interfaces and Types
 * All interface definitions for the modular SMTP client
 */
 import type * as tls from 'node:tls';
 import type * as net from 'node:net';
 import type { Email } from '../../core/classes.email.js';
 /**
 * SMTP client connection options
 */
 export interface ISmtpClientOptions {
  /** Hostname of the SMTP server */
  host: string;
  /** Port to connect to */
  port: number;
  /** Whether to use TLS for the connection */
  secure?: boolean;
  /** Connection timeout in milliseconds */
  connectionTimeout?: number;
  /** Socket timeout in milliseconds */
  socketTimeout?: number;
  /** Domain name for EHLO command */
  domain?: string;
  /** Authentication options */
  auth?: ISmtpAuthOptions;
  /** TLS options */
  tls?: tls.ConnectionOptions;
  /** Maximum number of connections in pool */
  pool?: boolean;
  maxConnections?: number;
  maxMessages?: number;
  /** Enable debug logging */
  debug?: boolean;
  /** Proxy settings */
  proxy?: string;
 }
 /**
 * Authentication options for SMTP
 */
 export interface ISmtpAuthOptions {
  /** Username */
  user?: string;
  /** Password */
  pass?: string;
  /** OAuth2 settings */
  oauth2?: IOAuth2Options;
  /** Authentication method preference */
  method?: 'PLAIN' | 'LOGIN' | 'OAUTH2' | 'AUTO';
 }
 /**
 * OAuth2 authentication options
 */
 export interface IOAuth2Options {
  /** OAuth2 user identifier */
  user: string;
  /** OAuth2 client ID */
  clientId: string;
  /** OAuth2 client secret */
  clientSecret: string;
  /** OAuth2 refresh token */
  refreshToken: string;
  /** OAuth2 access token */
  accessToken?: string;
  /** Token expiry time */
  expires?: number;
 }
 /**
 * Result of an email send operation
 */
 export interface ISmtpSendResult {
  /** Whether the send was successful */
  success: boolean;
  /** Message ID from server */
  messageId?: string;
  /** List of accepted recipients */
  acceptedRecipients: string[];
  /** List of rejected recipients */
  rejectedRecipients: string[];
  /** Error information if failed */
  error?: Error;
  /** Server response */
  response?: string;
  /** Envelope information */
  envelope?: ISmtpEnvelope;
 }
 /**
 * SMTP envelope information
 */
 export interface ISmtpEnvelope {
  /** Sender address */
  from: string;
  /** Recipient addresses */
  to: string[];
 }
 /**
 * Connection pool status
 */
 export interface IConnectionPoolStatus {
  /** Total connections in pool */
  total: number;
  /** Active connections */
  active: number;
  /** Idle connections */
  idle: number;
  /** Pending connection requests */
  pending: number;
 }
 /**
 * SMTP command response
 */
 export interface ISmtpResponse {
  /** Response code */
  code: number;
  /** Response message */
  message: string;
  /** Enhanced status code */
  enhancedCode?: string;
  /** Raw response */
  raw: string;
 }
 /**
 * Connection state
 */
 export enum ConnectionState {
  DISCONNECTED = 'disconnected',
  CONNECTING = 'connecting',
  CONNECTED = 'connected',
  AUTHENTICATED = 'authenticated',
  READY = 'ready',
  BUSY = 'busy',
  CLOSING = 'closing',
  ERROR = 'error'
 }
 /**
 * SMTP capabilities
 */
 export interface ISmtpCapabilities {
  /** Supported extensions */
  extensions: Set<string>;
  /** Maximum message size */
  maxSize?: number;
  /** Supported authentication methods */
  authMethods: Set<string>;
  /** Support for pipelining */
  pipelining: boolean;
  /** Support for STARTTLS */
  starttls: boolean;
  /** Support for 8BITMIME */
  eightBitMime: boolean;
 }
 /**
 * Internal connection interface
 */
 export interface ISmtpConnection {
  /** Socket connection */
  socket: net.Socket | tls.TLSSocket;
  /** Connection state */
  state: ConnectionState;
  /** Server capabilities */
  capabilities?: ISmtpCapabilities;
  /** Connection options */
  options: ISmtpClientOptions;
  /** Whether connection is secure */
  secure: boolean;
  /** Connection creation time */
  createdAt: Date;
  /** Last activity time */
  lastActivity: Date;
  /** Number of messages sent */
  messageCount: number;
 }
 /**
 * Error context for detailed error reporting
 */
 export interface ISmtpErrorContext {
  /** Command that caused the error */
  command?: string;
  /** Server response */
  response?: ISmtpResponse;
  /** Connection state */
  connectionState?: ConnectionState;
  /** Additional context data */
  data?: Record<string, any>;
 }
--- a/ts/mail/delivery/smtpclient/smtp-client.ts
+++ b/ts/mail/delivery/smtpclient/smtp-client.ts
@@ -1,357 +0,0 @@
 /**
 * SMTP Client Core Implementation
 * Main client class with delegation to handlers
 */
 import { EventEmitter } from 'node:events';
 import type { Email } from '../../core/classes.email.js';
 import type { 
  ISmtpClientOptions,
  ISmtpSendResult,
  ISmtpConnection,
  IConnectionPoolStatus,
  ConnectionState
 } from './interfaces.js';
 import { CONNECTION_STATES, SmtpErrorType } from './constants.js';
 import type { ConnectionManager } from './connection-manager.js';
 import type { CommandHandler } from './command-handler.js';
 import type { AuthHandler } from './auth-handler.js';
 import type { TlsHandler } from './tls-handler.js';
 import type { SmtpErrorHandler } from './error-handler.js';
 import { validateSender, validateRecipients } from './utils/validation.js';
 import { logEmailSend, logPerformance, logDebug } from './utils/logging.js';
 interface ISmtpClientDependencies {
  options: ISmtpClientOptions;
  connectionManager: ConnectionManager;
  commandHandler: CommandHandler;
  authHandler: AuthHandler;
  tlsHandler: TlsHandler;
  errorHandler: SmtpErrorHandler;
 }
 export class SmtpClient extends EventEmitter {
  private options: ISmtpClientOptions;
  private connectionManager: ConnectionManager;
  private commandHandler: CommandHandler;
  private authHandler: AuthHandler;
  private tlsHandler: TlsHandler;
  private errorHandler: SmtpErrorHandler;
  private isShuttingDown: boolean = false;
  constructor(dependencies: ISmtpClientDependencies) {
    super();
    this.options = dependencies.options;
    this.connectionManager = dependencies.connectionManager;
    this.commandHandler = dependencies.commandHandler;
    this.authHandler = dependencies.authHandler;
    this.tlsHandler = dependencies.tlsHandler;
    this.errorHandler = dependencies.errorHandler;
    this.setupEventForwarding();
  }
  /**
   * Send an email
   */
  public async sendMail(email: Email): Promise<ISmtpSendResult> {
    const startTime = Date.now();
    // Extract clean email addresses without display names for SMTP operations
    const fromAddress = email.getFromAddress();
    const recipients = email.getToAddresses();
    const ccRecipients = email.getCcAddresses();
    const bccRecipients = email.getBccAddresses();
    // Combine all recipients for SMTP operations
    const allRecipients = [...recipients, ...ccRecipients, ...bccRecipients];
    // Validate email addresses
    if (!validateSender(fromAddress)) {
      throw new Error(`Invalid sender address: ${fromAddress}`);
    }
    const recipientErrors = validateRecipients(allRecipients);
    if (recipientErrors.length > 0) {
      throw new Error(`Invalid recipients: ${recipientErrors.join(', ')}`);
    }
    logEmailSend('start', allRecipients, this.options);
    let connection: ISmtpConnection | null = null;
    const result: ISmtpSendResult = {
      success: false,
      acceptedRecipients: [],
      rejectedRecipients: [],
      envelope: {
        from: fromAddress,
        to: allRecipients
      }
    };
    try {
      // Get connection
      connection = await this.connectionManager.getConnection();
      connection.state = CONNECTION_STATES.BUSY as ConnectionState;
      // Wait for greeting if new connection
      if (!connection.capabilities) {
        await this.commandHandler.waitForGreeting(connection);
      }
      // Perform EHLO
      await this.commandHandler.sendEhlo(connection, this.options.domain);
      // Upgrade to TLS if needed
      if (this.tlsHandler.shouldUseTLS(connection)) {
        await this.tlsHandler.upgradeToTLS(connection);
        // Re-send EHLO after TLS upgrade
        await this.commandHandler.sendEhlo(connection, this.options.domain);
      }
      // Authenticate if needed
      if (this.options.auth) {
        await this.authHandler.authenticate(connection);
      }
      // Send MAIL FROM
      const mailFromResponse = await this.commandHandler.sendMailFrom(connection, fromAddress);
      if (mailFromResponse.code >= 400) {
        throw new Error(`MAIL FROM failed: ${mailFromResponse.message}`);
      }
      // Send RCPT TO for each recipient (includes TO, CC, and BCC)
      for (const recipient of allRecipients) {
        try {
          const rcptResponse = await this.commandHandler.sendRcptTo(connection, recipient);
          if (rcptResponse.code >= 400) {
            result.rejectedRecipients.push(recipient);
            logDebug(`Recipient rejected: ${recipient}`, this.options, { response: rcptResponse });
          } else {
            result.acceptedRecipients.push(recipient);
          }
        } catch (error) {
          result.rejectedRecipients.push(recipient);
          logDebug(`Recipient error: ${recipient}`, this.options, { error });
        }
      }
      // Check if we have any accepted recipients
      if (result.acceptedRecipients.length === 0) {
        throw new Error('All recipients were rejected');
      }
      // Send DATA command
      const dataResponse = await this.commandHandler.sendData(connection);
      if (dataResponse.code !== 354) {
        throw new Error(`DATA command failed: ${dataResponse.message}`);
      }
      // Send email content
      const emailData = await this.formatEmailData(email);
      const sendResponse = await this.commandHandler.sendDataContent(connection, emailData);
      if (sendResponse.code >= 400) {
        throw new Error(`Email data rejected: ${sendResponse.message}`);
      }
      // Success
      result.success = true;
      result.messageId = this.extractMessageId(sendResponse.message);
      result.response = sendResponse.message;
      connection.messageCount++;
      logEmailSend('success', recipients, this.options, { 
        messageId: result.messageId,
        duration: Date.now() - startTime
      });
    } catch (error) {
      result.success = false;
      result.error = error instanceof Error ? error : new Error(String(error));
      // Classify error and determine if we should retry
      const errorType = this.errorHandler.classifyError(result.error);
      result.error = this.errorHandler.createError(
        result.error.message,
        errorType,
        { command: 'SEND_MAIL' },
        result.error
      );
      logEmailSend('failure', recipients, this.options, { 
        error: result.error,
        duration: Date.now() - startTime
      });
    } finally {
      // Release connection
      if (connection) {
        connection.state = CONNECTION_STATES.READY as ConnectionState;
        this.connectionManager.updateActivity(connection);
        this.connectionManager.releaseConnection(connection);
      }
      logPerformance('sendMail', Date.now() - startTime, this.options);
    }
    return result;
  }
  /**
   * Test connection to SMTP server
   */
  public async verify(): Promise<boolean> {
    let connection: ISmtpConnection | null = null;
    try {
      connection = await this.connectionManager.createConnection();
      await this.commandHandler.waitForGreeting(connection);
      await this.commandHandler.sendEhlo(connection, this.options.domain);
      if (this.tlsHandler.shouldUseTLS(connection)) {
        await this.tlsHandler.upgradeToTLS(connection);
        await this.commandHandler.sendEhlo(connection, this.options.domain);
      }
      if (this.options.auth) {
        await this.authHandler.authenticate(connection);
      }
      await this.commandHandler.sendQuit(connection);
      return true;
    } catch (error) {
      logDebug('Connection verification failed', this.options, { error });
      return false;
    } finally {
      if (connection) {
        this.connectionManager.closeConnection(connection);
      }
    }
  }
  /**
   * Check if client is connected
   */
  public isConnected(): boolean {
    const status = this.connectionManager.getPoolStatus();
    return status.total > 0;
  }
  /**
   * Get connection pool status
   */
  public getPoolStatus(): IConnectionPoolStatus {
    return this.connectionManager.getPoolStatus();
  }
  /**
   * Update client options
   */
  public updateOptions(newOptions: Partial<ISmtpClientOptions>): void {
    this.options = { ...this.options, ...newOptions };
    logDebug('Client options updated', this.options);
  }
  /**
   * Close all connections and shutdown client
   */
  public async close(): Promise<void> {
    if (this.isShuttingDown) {
      return;
    }
    this.isShuttingDown = true;
    logDebug('Shutting down SMTP client', this.options);
    try {
      this.connectionManager.closeAllConnections();
      this.emit('close');
    } catch (error) {
      logDebug('Error during client shutdown', this.options, { error });
    }
  }
  private async formatEmailData(email: Email): Promise<string> {
    // Convert Email object to raw SMTP data
    const headers: string[] = [];
    // Required headers
    headers.push(`From: ${email.from}`);
    headers.push(`To: ${Array.isArray(email.to) ? email.to.join(', ') : email.to}`);
    headers.push(`Subject: ${email.subject || ''}`);
    headers.push(`Date: ${new Date().toUTCString()}`);
    headers.push(`Message-ID: <${Date.now()}.${Math.random().toString(36)}@${this.options.host}>`);
    // Optional headers
    if (email.cc) {
      const cc = Array.isArray(email.cc) ? email.cc.join(', ') : email.cc;
      headers.push(`Cc: ${cc}`);
    }
    if (email.bcc) {
      const bcc = Array.isArray(email.bcc) ? email.bcc.join(', ') : email.bcc;
      headers.push(`Bcc: ${bcc}`);
    }
    // Content headers
    if (email.html && email.text) {
      // Multipart message
      const boundary = `boundary_${Date.now()}_${Math.random().toString(36)}`;
      headers.push(`Content-Type: multipart/alternative; boundary="${boundary}"`);
      headers.push('MIME-Version: 1.0');
      const body = [
        `--${boundary}`,
        'Content-Type: text/plain; charset=utf-8',
        'Content-Transfer-Encoding: quoted-printable',
        '',
        email.text,
        '',
        `--${boundary}`,
        'Content-Type: text/html; charset=utf-8',
        'Content-Transfer-Encoding: quoted-printable',
        '',
        email.html,
        '',
        `--${boundary}--`
      ].join('\r\n');
      return headers.join('\r\n') + '\r\n\r\n' + body;
    } else if (email.html) {
      headers.push('Content-Type: text/html; charset=utf-8');
      headers.push('MIME-Version: 1.0');
      return headers.join('\r\n') + '\r\n\r\n' + email.html;
    } else {
      headers.push('Content-Type: text/plain; charset=utf-8');
      headers.push('MIME-Version: 1.0');
      return headers.join('\r\n') + '\r\n\r\n' + (email.text || '');
    }
  }
  private extractMessageId(response: string): string | undefined {
    // Try to extract message ID from server response
    const match = response.match(/queued as ([^\s]+)/i) || 
                  response.match(/id=([^\s]+)/i) ||
                  response.match(/Message-ID: <([^>]+)>/i);
    return match ? match[1] : undefined;
  }
  private setupEventForwarding(): void {
    // Forward events from connection manager
    this.connectionManager.on('connection', (connection) => {
      this.emit('connection', connection);
    });
    this.connectionManager.on('disconnect', (connection) => {
      this.emit('disconnect', connection);
    });
    this.connectionManager.on('error', (error) => {
      this.emit('error', error);
    });
  }
 }
--- a/ts/mail/delivery/smtpclient/tls-handler.ts
+++ b/ts/mail/delivery/smtpclient/tls-handler.ts
@@ -1,254 +0,0 @@
 /**
 * SMTP Client TLS Handler
 * TLS and STARTTLS client functionality
 */
 import * as tls from 'node:tls';
 import * as net from 'node:net';
 import { DEFAULTS } from './constants.js';
 import type { 
  ISmtpConnection, 
  ISmtpClientOptions,
  ConnectionState 
 } from './interfaces.js';
 import { CONNECTION_STATES } from './constants.js';
 import { logTLS, logDebug } from './utils/logging.js';
 import { isSuccessCode } from './utils/helpers.js';
 import type { CommandHandler } from './command-handler.js';
 export class TlsHandler {
  private options: ISmtpClientOptions;
  private commandHandler: CommandHandler;
  constructor(options: ISmtpClientOptions, commandHandler: CommandHandler) {
    this.options = options;
    this.commandHandler = commandHandler;
  }
  /**
   * Upgrade connection to TLS using STARTTLS
   */
  public async upgradeToTLS(connection: ISmtpConnection): Promise<void> {
    if (connection.secure) {
      logDebug('Connection already secure', this.options);
      return;
    }
    // Check if STARTTLS is supported
    if (!connection.capabilities?.starttls) {
      throw new Error('Server does not support STARTTLS');
    }
    logTLS('starttls_start', this.options);
    try {
      // Send STARTTLS command
      const response = await this.commandHandler.sendStartTls(connection);
      if (!isSuccessCode(response.code)) {
        throw new Error(`STARTTLS command failed: ${response.message}`);
      }
      // Upgrade the socket to TLS
      await this.performTLSUpgrade(connection);
      // Clear capabilities as they may have changed after TLS
      connection.capabilities = undefined;
      connection.secure = true;
      logTLS('starttls_success', this.options);
    } catch (error) {
      logTLS('starttls_failure', this.options, { error });
      throw error;
    }
  }
  /**
   * Create a direct TLS connection
   */
  public async createTLSConnection(host: string, port: number): Promise<tls.TLSSocket> {
    return new Promise((resolve, reject) => {
      const timeout = this.options.connectionTimeout || DEFAULTS.CONNECTION_TIMEOUT;
      const tlsOptions: tls.ConnectionOptions = {
        host,
        port,
        ...this.options.tls,
        // Default TLS options for email
        secureProtocol: 'TLS_method',
        ciphers: 'HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!SRP:!CAMELLIA',
        rejectUnauthorized: this.options.tls?.rejectUnauthorized !== false
      };
      logTLS('tls_connected', this.options, { host, port });
      const socket = tls.connect(tlsOptions);
      const timeoutHandler = setTimeout(() => {
        socket.destroy();
        reject(new Error(`TLS connection timeout after ${timeout}ms`));
      }, timeout);
      socket.once('secureConnect', () => {
        clearTimeout(timeoutHandler);
        if (!socket.authorized && this.options.tls?.rejectUnauthorized !== false) {
          socket.destroy();
          reject(new Error(`TLS certificate verification failed: ${socket.authorizationError}`));
          return;
        }
        logDebug('TLS connection established', this.options, {
          authorized: socket.authorized,
          protocol: socket.getProtocol(),
          cipher: socket.getCipher()
        });
        resolve(socket);
      });
      socket.once('error', (error) => {
        clearTimeout(timeoutHandler);
        reject(error);
      });
    });
  }
  /**
   * Validate TLS certificate
   */
  public validateCertificate(socket: tls.TLSSocket): boolean {
    if (!socket.authorized) {
      logDebug('TLS certificate not authorized', this.options, {
        error: socket.authorizationError
      });
      // Allow self-signed certificates if explicitly configured
      if (this.options.tls?.rejectUnauthorized === false) {
        logDebug('Accepting unauthorized certificate (rejectUnauthorized: false)', this.options);
        return true;
      }
      return false;
    }
    const cert = socket.getPeerCertificate();
    if (!cert) {
      logDebug('No peer certificate available', this.options);
      return false;
    }
    // Additional certificate validation
    const now = new Date();
    if (cert.valid_from && new Date(cert.valid_from) > now) {
      logDebug('Certificate not yet valid', this.options, { validFrom: cert.valid_from });
      return false;
    }
    if (cert.valid_to && new Date(cert.valid_to) < now) {
      logDebug('Certificate expired', this.options, { validTo: cert.valid_to });
      return false;
    }
    logDebug('TLS certificate validated', this.options, {
      subject: cert.subject,
      issuer: cert.issuer,
      validFrom: cert.valid_from,
      validTo: cert.valid_to
    });
    return true;
  }
  /**
   * Get TLS connection information
   */
  public getTLSInfo(socket: tls.TLSSocket): any {
    if (!(socket instanceof tls.TLSSocket)) {
      return null;
    }
    return {
      authorized: socket.authorized,
      authorizationError: socket.authorizationError,
      protocol: socket.getProtocol(),
      cipher: socket.getCipher(),
      peerCertificate: socket.getPeerCertificate(),
      alpnProtocol: socket.alpnProtocol
    };
  }
  /**
   * Check if TLS upgrade is required or recommended
   */
  public shouldUseTLS(connection: ISmtpConnection): boolean {
    // Already secure
    if (connection.secure) {
      return false;
    }
    // Direct TLS connection configured
    if (this.options.secure) {
      return false; // Already handled in connection establishment
    }
    // STARTTLS available and not explicitly disabled
    if (connection.capabilities?.starttls) {
      return this.options.tls !== null && this.options.tls !== undefined; // Use TLS if configured
    }
    return false;
  }
  private async performTLSUpgrade(connection: ISmtpConnection): Promise<void> {
    return new Promise((resolve, reject) => {
      const plainSocket = connection.socket as net.Socket;
      const timeout = this.options.connectionTimeout || DEFAULTS.CONNECTION_TIMEOUT;
      const tlsOptions: tls.ConnectionOptions = {
        socket: plainSocket,
        host: this.options.host,
        ...this.options.tls,
        // Default TLS options for STARTTLS
        secureProtocol: 'TLS_method',
        ciphers: 'HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!SRP:!CAMELLIA',
        rejectUnauthorized: this.options.tls?.rejectUnauthorized !== false
      };
      const timeoutHandler = setTimeout(() => {
        reject(new Error(`TLS upgrade timeout after ${timeout}ms`));
      }, timeout);
      // Create TLS socket from existing connection
      const tlsSocket = tls.connect(tlsOptions);
      tlsSocket.once('secureConnect', () => {
        clearTimeout(timeoutHandler);
        // Validate certificate if required
        if (!this.validateCertificate(tlsSocket)) {
          tlsSocket.destroy();
          reject(new Error('TLS certificate validation failed'));
          return;
        }
        // Replace the socket in the connection
        connection.socket = tlsSocket;
        connection.secure = true;
        logDebug('STARTTLS upgrade completed', this.options, {
          protocol: tlsSocket.getProtocol(),
          cipher: tlsSocket.getCipher()
        });
        resolve();
      });
      tlsSocket.once('error', (error) => {
        clearTimeout(timeoutHandler);
        reject(error);
      });
    });
  }
 }
--- a/ts/mail/delivery/smtpclient/utils/helpers.ts
+++ b/ts/mail/delivery/smtpclient/utils/helpers.ts
@@ -1,224 +0,0 @@
 /**
 * SMTP Client Helper Functions
 * Protocol helper functions and utilities
 */
 import { SMTP_CODES, REGEX_PATTERNS, LINE_ENDINGS } from '../constants.js';
 import type { ISmtpResponse, ISmtpCapabilities } from '../interfaces.js';
 /**
 * Parse SMTP server response
 */
 export function parseSmtpResponse(data: string): ISmtpResponse {
  const lines = data.trim().split(/\r?\n/);
  const firstLine = lines[0];
  const match = firstLine.match(REGEX_PATTERNS.RESPONSE_CODE);
  if (!match) {
    return {
      code: 500,
      message: 'Invalid server response',
      raw: data
    };
  }
  const code = parseInt(match[1], 10);
  const separator = match[2];
  const message = lines.map(line => line.substring(4)).join(' ');
  // Check for enhanced status code
  const enhancedMatch = message.match(REGEX_PATTERNS.ENHANCED_STATUS);
  const enhancedCode = enhancedMatch ? enhancedMatch[1] : undefined;
  return {
    code,
    message: enhancedCode ? message.substring(enhancedCode.length + 1) : message,
    enhancedCode,
    raw: data
  };
 }
 /**
 * Parse EHLO response and extract capabilities
 */
 export function parseEhloResponse(response: string): ISmtpCapabilities {
  const lines = response.trim().split(/\r?\n/);
  const capabilities: ISmtpCapabilities = {
    extensions: new Set(),
    authMethods: new Set(),
    pipelining: false,
    starttls: false,
    eightBitMime: false
  };
  for (const line of lines.slice(1)) { // Skip first line (greeting)
    const extensionLine = line.substring(4); // Remove "250-" or "250 "
    const parts = extensionLine.split(/\s+/);
    const extension = parts[0].toUpperCase();
    capabilities.extensions.add(extension);
    switch (extension) {
      case 'PIPELINING':
        capabilities.pipelining = true;
        break;
      case 'STARTTLS':
        capabilities.starttls = true;
        break;
      case '8BITMIME':
        capabilities.eightBitMime = true;
        break;
      case 'SIZE':
        if (parts[1]) {
          capabilities.maxSize = parseInt(parts[1], 10);
        }
        break;
      case 'AUTH':
        // Parse authentication methods
        for (let i = 1; i < parts.length; i++) {
          capabilities.authMethods.add(parts[i].toUpperCase());
        }
        break;
    }
  }
  return capabilities;
 }
 /**
 * Format SMTP command with proper line ending
 */
 export function formatCommand(command: string, ...args: string[]): string {
  const fullCommand = args.length > 0 ? `${command} ${args.join(' ')}` : command;
  return fullCommand + LINE_ENDINGS.CRLF;
 }
 /**
 * Encode authentication string for AUTH PLAIN
 */
 export function encodeAuthPlain(username: string, password: string): string {
  const authString = `\0${username}\0${password}`;
  return Buffer.from(authString, 'utf8').toString('base64');
 }
 /**
 * Encode authentication string for AUTH LOGIN
 */
 export function encodeAuthLogin(value: string): string {
  return Buffer.from(value, 'utf8').toString('base64');
 }
 /**
 * Generate OAuth2 authentication string
 */
 export function generateOAuth2String(username: string, accessToken: string): string {
  const authString = `user=${username}\x01auth=Bearer ${accessToken}\x01\x01`;
  return Buffer.from(authString, 'utf8').toString('base64');
 }
 /**
 * Check if response code indicates success
 */
 export function isSuccessCode(code: number): boolean {
  return code >= 200 && code < 300;
 }
 /**
 * Check if response code indicates temporary failure
 */
 export function isTemporaryFailure(code: number): boolean {
  return code >= 400 && code < 500;
 }
 /**
 * Check if response code indicates permanent failure
 */
 export function isPermanentFailure(code: number): boolean {
  return code >= 500;
 }
 /**
 * Escape email address for SMTP commands
 */
 export function escapeEmailAddress(email: string): string {
  return `<${email.trim()}>`;
 }
 /**
 * Extract email address from angle brackets
 */
 export function extractEmailAddress(email: string): string {
  const match = email.match(/^<(.+)>$/);
  return match ? match[1] : email.trim();
 }
 /**
 * Generate unique connection ID
 */
 export function generateConnectionId(): string {
  return `smtp-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
 }
 /**
 * Format timeout duration for human readability
 */
 export function formatTimeout(milliseconds: number): string {
  if (milliseconds < 1000) {
    return `${milliseconds}ms`;
  } else if (milliseconds < 60000) {
    return `${Math.round(milliseconds / 1000)}s`;
  } else {
    return `${Math.round(milliseconds / 60000)}m`;
  }
 }
 /**
 * Validate and normalize email data size
 */
 export function validateEmailSize(emailData: string, maxSize?: number): boolean {
  const size = Buffer.byteLength(emailData, 'utf8');
  return !maxSize || size <= maxSize;
 }
 /**
 * Clean sensitive data from logs
 */
 export function sanitizeForLogging(data: any): any {
  if (typeof data !== 'object' || data === null) {
    return data;
  }
  const sanitized = { ...data };
  const sensitiveFields = ['password', 'pass', 'accessToken', 'refreshToken', 'clientSecret'];
  for (const field of sensitiveFields) {
    if (field in sanitized) {
      sanitized[field] = '[REDACTED]';
    }
  }
  return sanitized;
 }
 /**
 * Calculate exponential backoff delay
 */
 export function calculateBackoffDelay(attempt: number, baseDelay: number = 1000): number {
  return Math.min(baseDelay * Math.pow(2, attempt - 1), 30000); // Max 30 seconds
 }
 /**
 * Parse enhanced status code
 */
 export function parseEnhancedStatusCode(code: string): { class: number; subject: number; detail: number } | null {
  const match = code.match(/^(\d)\.(\d)\.(\d)$/);
  if (!match) {
    return null;
  }
  return {
    class: parseInt(match[1], 10),
    subject: parseInt(match[2], 10),
    detail: parseInt(match[3], 10)
  };
 }
--- a/ts/mail/delivery/smtpclient/utils/logging.ts
+++ b/ts/mail/delivery/smtpclient/utils/logging.ts
@@ -1,212 +0,0 @@
 /**
 * SMTP Client Logging Utilities
 * Client-side logging utilities for SMTP operations
 */
 import { logger } from '../../../../logger.js';
 import type { ISmtpResponse, ISmtpClientOptions } from '../interfaces.js';
 export interface ISmtpClientLogData {
  component: string;
  host?: string;
  port?: number;
  secure?: boolean;
  command?: string;
  response?: ISmtpResponse;
  error?: Error;
  connectionId?: string;
  messageId?: string;
  duration?: number;
  [key: string]: any;
 }
 /**
 * Log SMTP client connection events
 */
 export function logConnection(
  event: 'connecting' | 'connected' | 'disconnected' | 'error',
  options: ISmtpClientOptions,
  data?: Partial<ISmtpClientLogData>
 ): void {
  const logData: ISmtpClientLogData = {
    component: 'smtp-client',
    event,
    host: options.host,
    port: options.port,
    secure: options.secure,
    ...data
  };
  switch (event) {
    case 'connecting':
      logger.info('SMTP client connecting', logData);
      break;
    case 'connected':
      logger.info('SMTP client connected', logData);
      break;
    case 'disconnected':
      logger.info('SMTP client disconnected', logData);
      break;
    case 'error':
      logger.error('SMTP client connection error', logData);
      break;
  }
 }
 /**
 * Log SMTP command execution
 */
 export function logCommand(
  command: string,
  response?: ISmtpResponse,
  options?: ISmtpClientOptions,
  data?: Partial<ISmtpClientLogData>
 ): void {
  const logData: ISmtpClientLogData = {
    component: 'smtp-client',
    command,
    response,
    host: options?.host,
    port: options?.port,
    ...data
  };
  if (response && response.code >= 400) {
    logger.warn('SMTP command failed', logData);
  } else {
    logger.debug('SMTP command executed', logData);
  }
 }
 /**
 * Log authentication events
 */
 export function logAuthentication(
  event: 'start' | 'success' | 'failure',
  method: string,
  options: ISmtpClientOptions,
  data?: Partial<ISmtpClientLogData>
 ): void {
  const logData: ISmtpClientLogData = {
    component: 'smtp-client',
    event: `auth_${event}`,
    authMethod: method,
    host: options.host,
    port: options.port,
    ...data
  };
  switch (event) {
    case 'start':
      logger.debug('SMTP authentication started', logData);
      break;
    case 'success':
      logger.info('SMTP authentication successful', logData);
      break;
    case 'failure':
      logger.error('SMTP authentication failed', logData);
      break;
  }
 }
 /**
 * Log TLS/STARTTLS events
 */
 export function logTLS(
  event: 'starttls_start' | 'starttls_success' | 'starttls_failure' | 'tls_connected',
  options: ISmtpClientOptions,
  data?: Partial<ISmtpClientLogData>
 ): void {
  const logData: ISmtpClientLogData = {
    component: 'smtp-client',
    event,
    host: options.host,
    port: options.port,
    ...data
  };
  if (event.includes('failure')) {
    logger.error('SMTP TLS operation failed', logData);
  } else {
    logger.info('SMTP TLS operation', logData);
  }
 }
 /**
 * Log email sending events
 */
 export function logEmailSend(
  event: 'start' | 'success' | 'failure',
  recipients: string[],
  options: ISmtpClientOptions,
  data?: Partial<ISmtpClientLogData>
 ): void {
  const logData: ISmtpClientLogData = {
    component: 'smtp-client',
    event: `send_${event}`,
    recipientCount: recipients.length,
    recipients: recipients.slice(0, 5), // Only log first 5 recipients for privacy
    host: options.host,
    port: options.port,
    ...data
  };
  switch (event) {
    case 'start':
      logger.info('SMTP email send started', logData);
      break;
    case 'success':
      logger.info('SMTP email send successful', logData);
      break;
    case 'failure':
      logger.error('SMTP email send failed', logData);
      break;
  }
 }
 /**
 * Log performance metrics
 */
 export function logPerformance(
  operation: string,
  duration: number,
  options: ISmtpClientOptions,
  data?: Partial<ISmtpClientLogData>
 ): void {
  const logData: ISmtpClientLogData = {
    component: 'smtp-client',
    operation,
    duration,
    host: options.host,
    port: options.port,
    ...data
  };
  if (duration > 10000) { // Log slow operations (>10s)
    logger.warn('SMTP slow operation detected', logData);
  } else {
    logger.debug('SMTP operation performance', logData);
  }
 }
 /**
 * Log debug information (only when debug is enabled)
 */
 export function logDebug(
  message: string,
  options: ISmtpClientOptions,
  data?: Partial<ISmtpClientLogData>
 ): void {
  if (!options.debug) {
    return;
  }
  const logData: ISmtpClientLogData = {
    component: 'smtp-client-debug',
    host: options.host,
    port: options.port,
    ...data
  };
  logger.debug(`[SMTP Client Debug] ${message}`, logData);
 }
--- a/ts/mail/delivery/smtpclient/utils/validation.ts
+++ b/ts/mail/delivery/smtpclient/utils/validation.ts
@@ -1,170 +0,0 @@
 /**
 * SMTP Client Validation Utilities
 * Input validation functions for SMTP client operations
 */
 import { REGEX_PATTERNS } from '../constants.js';
 import type { ISmtpClientOptions, ISmtpAuthOptions } from '../interfaces.js';
 /**
 * Validate email address format
 * Supports RFC-compliant addresses including empty return paths for bounces
 */
 export function validateEmailAddress(email: string): boolean {
  if (typeof email !== 'string') {
    return false;
  }
  const trimmed = email.trim();
  // Handle empty return path for bounce messages (RFC 5321)
  if (trimmed === '' || trimmed === '<>') {
    return true;
  }
  // Handle display name formats
  const angleMatch = trimmed.match(/<([^>]+)>/);
  if (angleMatch) {
    return REGEX_PATTERNS.EMAIL_ADDRESS.test(angleMatch[1]);
  }
  // Regular email validation
  return REGEX_PATTERNS.EMAIL_ADDRESS.test(trimmed);
 }
 /**
 * Validate SMTP client options
 */
 export function validateClientOptions(options: ISmtpClientOptions): string[] {
  const errors: string[] = [];
  // Required fields
  if (!options.host || typeof options.host !== 'string') {
    errors.push('Host is required and must be a string');
  }
  if (!options.port || typeof options.port !== 'number' || options.port < 1 || options.port > 65535) {
    errors.push('Port must be a number between 1 and 65535');
  }
  // Optional field validation
  if (options.connectionTimeout !== undefined) {
    if (typeof options.connectionTimeout !== 'number' || options.connectionTimeout < 1000) {
      errors.push('Connection timeout must be a number >= 1000ms');
    }
  }
  if (options.socketTimeout !== undefined) {
    if (typeof options.socketTimeout !== 'number' || options.socketTimeout < 1000) {
      errors.push('Socket timeout must be a number >= 1000ms');
    }
  }
  if (options.maxConnections !== undefined) {
    if (typeof options.maxConnections !== 'number' || options.maxConnections < 1) {
      errors.push('Max connections must be a positive number');
    }
  }
  if (options.maxMessages !== undefined) {
    if (typeof options.maxMessages !== 'number' || options.maxMessages < 1) {
      errors.push('Max messages must be a positive number');
    }
  }
  // Validate authentication options
  if (options.auth) {
    errors.push(...validateAuthOptions(options.auth));
  }
  return errors;
 }
 /**
 * Validate authentication options
 */
 export function validateAuthOptions(auth: ISmtpAuthOptions): string[] {
  const errors: string[] = [];
  if (auth.method && !['PLAIN', 'LOGIN', 'OAUTH2', 'AUTO'].includes(auth.method)) {
    errors.push('Invalid authentication method');
  }
  // For basic auth, require user and pass
  if ((auth.user || auth.pass) && (!auth.user || !auth.pass)) {
    errors.push('Both user and pass are required for basic authentication');
  }
  // For OAuth2, validate required fields
  if (auth.oauth2) {
    const oauth = auth.oauth2;
    if (!oauth.user || !oauth.clientId || !oauth.clientSecret || !oauth.refreshToken) {
      errors.push('OAuth2 requires user, clientId, clientSecret, and refreshToken');
    }
    if (oauth.user && !validateEmailAddress(oauth.user)) {
      errors.push('OAuth2 user must be a valid email address');
    }
  }
  return errors;
 }
 /**
 * Validate hostname format
 */
 export function validateHostname(hostname: string): boolean {
  if (!hostname || typeof hostname !== 'string') {
    return false;
  }
  // Basic hostname validation (allow IP addresses and domain names)
  const hostnameRegex = /^(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)*[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$|^(?:\d{1,3}\.){3}\d{1,3}$|^\[(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\]$/;
  return hostnameRegex.test(hostname);
 }
 /**
 * Validate port number
 */
 export function validatePort(port: number): boolean {
  return typeof port === 'number' && port >= 1 && port <= 65535;
 }
 /**
 * Sanitize and validate domain name for EHLO
 */
 export function validateAndSanitizeDomain(domain: string): string {
  if (!domain || typeof domain !== 'string') {
    return 'localhost';
  }
  const sanitized = domain.trim().toLowerCase();
  if (validateHostname(sanitized)) {
    return sanitized;
  }
  return 'localhost';
 }
 /**
 * Validate recipient list
 */
 export function validateRecipients(recipients: string | string[]): string[] {
  const errors: string[] = [];
  const recipientList = Array.isArray(recipients) ? recipients : [recipients];
  for (const recipient of recipientList) {
    if (!validateEmailAddress(recipient)) {
      errors.push(`Invalid email address: ${recipient}`);
    }
  }
  return errors;
 }
 /**
 * Validate sender address
 */
 export function validateSender(sender: string): boolean {
  return validateEmailAddress(sender);
 }
--- a/ts/mail/routing/classes.dkim.manager.ts
+++ b/ts/mail/routing/classes.dkim.manager.ts
@@ -0,0 +1,157 @@
 import { logger } from '../../logger.js';
 import { DKIMCreator } from '../security/classes.dkimcreator.js';
 import { DomainRegistry } from './classes.domain.registry.js';
 import { RustSecurityBridge } from '../../security/classes.rustsecuritybridge.js';
 import { Email } from '../core/classes.email.js';
 /** External DcRouter interface shape used by DkimManager */
 interface DcRouter {
  storageManager: any;
  dnsServer?: any;
 }
 /**
 * Manages DKIM key setup, rotation, and signing for all configured domains
 */
 export class DkimManager {
  private dkimKeys: Map<string, string> = new Map();
  constructor(
    private dkimCreator: DKIMCreator,
    private domainRegistry: DomainRegistry,
    private dcRouter: DcRouter,
    private rustBridge: RustSecurityBridge,
  ) {}
  async setupDkimForDomains(): Promise<void> {
    const domainConfigs = this.domainRegistry.getAllConfigs();
    if (domainConfigs.length === 0) {
      logger.log('warn', 'No domains configured for DKIM');
      return;
    }
    for (const domainConfig of domainConfigs) {
      const domain = domainConfig.domain;
      const selector = domainConfig.dkim?.selector || 'default';
      try {
        let keyPair: { privateKey: string; publicKey: string };
        try {
          keyPair = await this.dkimCreator.readDKIMKeys(domain);
          logger.log('info', `Using existing DKIM keys for domain: ${domain}`);
        } catch (error) {
          keyPair = await this.dkimCreator.createDKIMKeys();
          await this.dkimCreator.createAndStoreDKIMKeys(domain);
          logger.log('info', `Generated new DKIM keys for domain: ${domain}`);
        }
        this.dkimKeys.set(domain, keyPair.privateKey);
        logger.log('info', `DKIM keys loaded for domain: ${domain} with selector: ${selector}`);
      } catch (error) {
        logger.log('error', `Failed to set up DKIM for domain ${domain}: ${error.message}`);
      }
    }
  }
  async checkAndRotateDkimKeys(): Promise<void> {
    const domainConfigs = this.domainRegistry.getAllConfigs();
    for (const domainConfig of domainConfigs) {
      const domain = domainConfig.domain;
      const selector = domainConfig.dkim?.selector || 'default';
      const rotateKeys = domainConfig.dkim?.rotateKeys || false;
      const rotationInterval = domainConfig.dkim?.rotationInterval || 90;
      const keySize = domainConfig.dkim?.keySize || 2048;
      if (!rotateKeys) {
        logger.log('debug', `DKIM key rotation disabled for ${domain}`);
        continue;
      }
      try {
        const needsRotation = await this.dkimCreator.needsRotation(domain, selector, rotationInterval);
        if (needsRotation) {
          logger.log('info', `DKIM keys need rotation for ${domain} (selector: ${selector})`);
          const newSelector = await this.dkimCreator.rotateDkimKeys(domain, selector, keySize);
          domainConfig.dkim = {
            ...domainConfig.dkim,
            selector: newSelector
          };
          if (domainConfig.dnsMode === 'internal-dns' && this.dcRouter.dnsServer) {
            const keyPair = await this.dkimCreator.readDKIMKeysForSelector(domain, newSelector);
            const publicKeyBase64 = keyPair.publicKey
              .replace(/-----BEGIN PUBLIC KEY-----/g, '')
              .replace(/-----END PUBLIC KEY-----/g, '')
              .replace(/\s/g, '');
            const ttl = domainConfig.dns?.internal?.ttl || 3600;
            this.dcRouter.dnsServer.registerHandler(
              `${newSelector}._domainkey.${domain}`,
              ['TXT'],
              () => ({
                name: `${newSelector}._domainkey.${domain}`,
                type: 'TXT',
                class: 'IN',
                ttl: ttl,
                data: `v=DKIM1; k=rsa; p=${publicKeyBase64}`
              })
            );
            logger.log('info', `DKIM DNS handler registered for new selector: ${newSelector}._domainkey.${domain}`);
            await this.dcRouter.storageManager.set(
              `/email/dkim/${domain}/public.key`,
              keyPair.publicKey
            );
          }
          this.dkimCreator.cleanupOldKeys(domain, 30).catch(error => {
            logger.log('warn', `Failed to cleanup old DKIM keys for ${domain}: ${error.message}`);
          });
        } else {
          logger.log('debug', `DKIM keys for ${domain} are up to date`);
        }
      } catch (error) {
        logger.log('error', `Failed to check/rotate DKIM keys for ${domain}: ${error.message}`);
      }
    }
  }
  async handleDkimSigning(email: Email, domain: string, selector: string): Promise<void> {
    try {
      await this.dkimCreator.handleDKIMKeysForDomain(domain);
      const { privateKey } = await this.dkimCreator.readDKIMKeys(domain);
      const rawEmail = email.toRFC822String();
      // Detect key type from PEM header
      const keyType = privateKey.includes('ED25519') ? 'ed25519' : 'rsa';
      const signResult = await this.rustBridge.signDkim({
        rawMessage: rawEmail,
        domain,
        selector,
        privateKey,
        keyType,
      });
      if (signResult.header) {
        email.addHeader('DKIM-Signature', signResult.header);
        logger.log('info', `Successfully added DKIM signature for ${domain}`);
      }
    } catch (error) {
      logger.log('error', `Failed to sign email with DKIM: ${error.message}`);
    }
  }
  getDkimKey(domain: string): string | undefined {
    return this.dkimKeys.get(domain);
  }
 }
--- a/ts/mail/routing/classes.dnsmanager.ts
+++ b/ts/mail/routing/classes.dnsmanager.ts
@@ -1,559 +0,0 @@
 import * as plugins from '../../plugins.js';
 import * as paths from '../../paths.js';
 import { DKIMCreator } from '../security/classes.dkimcreator.js';
 /**
 * Interface for DNS record information
 */
 export interface IDnsRecord {
  name: string;
  type: string;
  value: string;
  ttl?: number;
  dnsSecEnabled?: boolean;
 }
 /**
 * Interface for DNS lookup options
 */
 export interface IDnsLookupOptions {
  /** Cache time to live in milliseconds, 0 to disable caching */
  cacheTtl?: number;
  /** Timeout for DNS queries in milliseconds */
  timeout?: number;
 }
 /**
 * Interface for DNS verification result
 */
 export interface IDnsVerificationResult {
  record: string;
  found: boolean;
  valid: boolean;
  value?: string;
  expectedValue?: string;
  error?: string;
 }
 /**
 * Manager for DNS-related operations, including record lookups, verification, and generation
 */
 export class DNSManager {
  public dkimCreator: DKIMCreator;
  private cache: Map<string, { data: any; expires: number }> = new Map();
  private defaultOptions: IDnsLookupOptions = {
    cacheTtl: 300000, // 5 minutes
    timeout: 5000 // 5 seconds
  };
  constructor(dkimCreatorArg: DKIMCreator, options?: IDnsLookupOptions) {
    this.dkimCreator = dkimCreatorArg;
    if (options) {
      this.defaultOptions = {
        ...this.defaultOptions,
        ...options
      };
    }
    // Ensure the DNS records directory exists
    plugins.fs.mkdirSync(paths.dnsRecordsDir, { recursive: true });
  }
  /**
   * Lookup MX records for a domain
   * @param domain Domain to look up
   * @param options Lookup options
   * @returns Array of MX records sorted by priority
   */
  public async lookupMx(domain: string, options?: IDnsLookupOptions): Promise<plugins.dns.MxRecord[]> {
    const lookupOptions = { ...this.defaultOptions, ...options };
    const cacheKey = `mx:${domain}`;
    // Check cache first
    const cached = this.getFromCache<plugins.dns.MxRecord[]>(cacheKey);
    if (cached) {
      return cached;
    }
    try {
      const records = await this.dnsResolveMx(domain, lookupOptions.timeout);
      // Sort by priority
      records.sort((a, b) => a.priority - b.priority);
      // Cache the result
      this.setInCache(cacheKey, records, lookupOptions.cacheTtl);
      return records;
    } catch (error) {
      console.error(`Error looking up MX records for ${domain}:`, error);
      throw new Error(`Failed to lookup MX records for ${domain}: ${error.message}`);
    }
  }
  /**
   * Lookup TXT records for a domain
   * @param domain Domain to look up
   * @param options Lookup options
   * @returns Array of TXT records
   */
  public async lookupTxt(domain: string, options?: IDnsLookupOptions): Promise<string[][]> {
    const lookupOptions = { ...this.defaultOptions, ...options };
    const cacheKey = `txt:${domain}`;
    // Check cache first
    const cached = this.getFromCache<string[][]>(cacheKey);
    if (cached) {
      return cached;
    }
    try {
      const records = await this.dnsResolveTxt(domain, lookupOptions.timeout);
      // Cache the result
      this.setInCache(cacheKey, records, lookupOptions.cacheTtl);
      return records;
    } catch (error) {
      console.error(`Error looking up TXT records for ${domain}:`, error);
      throw new Error(`Failed to lookup TXT records for ${domain}: ${error.message}`);
    }
  }
  /**
   * Find specific TXT record by subdomain and prefix
   * @param domain Base domain
   * @param subdomain Subdomain prefix (e.g., "dkim._domainkey")
   * @param prefix Record prefix to match (e.g., "v=DKIM1")
   * @param options Lookup options
   * @returns Matching TXT record or null if not found
   */
  public async findTxtRecord(
    domain: string,
    subdomain: string = '',
    prefix: string = '',
    options?: IDnsLookupOptions
  ): Promise<string | null> {
    const fullDomain = subdomain ? `${subdomain}.${domain}` : domain;
    try {
      const records = await this.lookupTxt(fullDomain, options);
      for (const recordArray of records) {
        // TXT records can be split into chunks, join them
        const record = recordArray.join('');
        if (!prefix || record.startsWith(prefix)) {
          return record;
        }
      }
      return null;
    } catch (error) {
      // Domain might not exist or no TXT records
      console.log(`No matching TXT record found for ${fullDomain} with prefix ${prefix}`);
      return null;
    }
  }
  /**
   * Verify if a domain has a valid SPF record
   * @param domain Domain to verify
   * @returns Verification result
   */
  public async verifySpfRecord(domain: string): Promise<IDnsVerificationResult> {
    const result: IDnsVerificationResult = {
      record: 'SPF',
      found: false,
      valid: false
    };
    try {
      const spfRecord = await this.findTxtRecord(domain, '', 'v=spf1');
      if (spfRecord) {
        result.found = true;
        result.value = spfRecord;
        // Basic validation - check if it contains all, include, ip4, ip6, or mx mechanisms
        const isValid = /v=spf1\s+([-~?+]?(all|include:|ip4:|ip6:|mx|a|exists:))/.test(spfRecord);
        result.valid = isValid;
        if (!isValid) {
          result.error = 'SPF record format is invalid';
        }
      } else {
        result.error = 'No SPF record found';
      }
    } catch (error) {
      result.error = `Error verifying SPF: ${error.message}`;
    }
    return result;
  }
  /**
   * Verify if a domain has a valid DKIM record
   * @param domain Domain to verify
   * @param selector DKIM selector (usually "mta" in our case)
   * @returns Verification result
   */
  public async verifyDkimRecord(domain: string, selector: string = 'mta'): Promise<IDnsVerificationResult> {
    const result: IDnsVerificationResult = {
      record: 'DKIM',
      found: false,
      valid: false
    };
    try {
      const dkimSelector = `${selector}._domainkey`;
      const dkimRecord = await this.findTxtRecord(domain, dkimSelector, 'v=DKIM1');
      if (dkimRecord) {
        result.found = true;
        result.value = dkimRecord;
        // Basic validation - check for required fields
        const hasP = dkimRecord.includes('p=');
        result.valid = dkimRecord.includes('v=DKIM1') && hasP;
        if (!result.valid) {
          result.error = 'DKIM record is missing required fields';
        } else if (dkimRecord.includes('p=') && !dkimRecord.match(/p=[a-zA-Z0-9+/]+/)) {
          result.valid = false;
          result.error = 'DKIM record has invalid public key format';
        }
      } else {
        result.error = `No DKIM record found for selector ${selector}`;
      }
    } catch (error) {
      result.error = `Error verifying DKIM: ${error.message}`;
    }
    return result;
  }
  /**
   * Verify if a domain has a valid DMARC record
   * @param domain Domain to verify
   * @returns Verification result
   */
  public async verifyDmarcRecord(domain: string): Promise<IDnsVerificationResult> {
    const result: IDnsVerificationResult = {
      record: 'DMARC',
      found: false,
      valid: false
    };
    try {
      const dmarcDomain = `_dmarc.${domain}`;
      const dmarcRecord = await this.findTxtRecord(dmarcDomain, '', 'v=DMARC1');
      if (dmarcRecord) {
        result.found = true;
        result.value = dmarcRecord;
        // Basic validation - check for required fields
        const hasPolicy = dmarcRecord.includes('p=');
        result.valid = dmarcRecord.includes('v=DMARC1') && hasPolicy;
        if (!result.valid) {
          result.error = 'DMARC record is missing required fields';
        }
      } else {
        result.error = 'No DMARC record found';
      }
    } catch (error) {
      result.error = `Error verifying DMARC: ${error.message}`;
    }
    return result;
  }
  /**
   * Check all email authentication records (SPF, DKIM, DMARC) for a domain
   * @param domain Domain to check
   * @param dkimSelector DKIM selector
   * @returns Object with verification results for each record type
   */
  public async verifyEmailAuthRecords(domain: string, dkimSelector: string = 'mta'): Promise<{
    spf: IDnsVerificationResult;
    dkim: IDnsVerificationResult;
    dmarc: IDnsVerificationResult;
  }> {
    const [spf, dkim, dmarc] = await Promise.all([
      this.verifySpfRecord(domain),
      this.verifyDkimRecord(domain, dkimSelector),
      this.verifyDmarcRecord(domain)
    ]);
    return { spf, dkim, dmarc };
  }
  /**
   * Generate a recommended SPF record for a domain
   * @param domain Domain name
   * @param options Configuration options for the SPF record
   * @returns Generated SPF record
   */
  public generateSpfRecord(domain: string, options: {
    includeMx?: boolean;
    includeA?: boolean;
    includeIps?: string[];
    includeSpf?: string[];
    policy?: 'none' | 'neutral' | 'softfail' | 'fail' | 'reject';
  } = {}): IDnsRecord {
    const {
      includeMx = true,
      includeA = true,
      includeIps = [],
      includeSpf = [],
      policy = 'softfail'
    } = options;
    let value = 'v=spf1';
    if (includeMx) {
      value += ' mx';
    }
    if (includeA) {
      value += ' a';
    }
    // Add IP addresses
    for (const ip of includeIps) {
      if (ip.includes(':')) {
        value += ` ip6:${ip}`;
      } else {
        value += ` ip4:${ip}`;
      }
    }
    // Add includes
    for (const include of includeSpf) {
      value += ` include:${include}`;
    }
    // Add policy
    const policyMap = {
      'none': '?all',
      'neutral': '~all',
      'softfail': '~all',
      'fail': '-all',
      'reject': '-all'
    };
    value += ` ${policyMap[policy]}`;
    return {
      name: domain,
      type: 'TXT',
      value: value
    };
  }
  /**
   * Generate a recommended DMARC record for a domain
   * @param domain Domain name
   * @param options Configuration options for the DMARC record
   * @returns Generated DMARC record
   */
  public generateDmarcRecord(domain: string, options: {
    policy?: 'none' | 'quarantine' | 'reject';
    subdomainPolicy?: 'none' | 'quarantine' | 'reject';
    pct?: number;
    rua?: string;
    ruf?: string;
    daysInterval?: number;
  } = {}): IDnsRecord {
    const {
      policy = 'none',
      subdomainPolicy,
      pct = 100,
      rua,
      ruf,
      daysInterval = 1
    } = options;
    let value = 'v=DMARC1; p=' + policy;
    if (subdomainPolicy) {
      value += `; sp=${subdomainPolicy}`;
    }
    if (pct !== 100) {
      value += `; pct=${pct}`;
    }
    if (rua) {
      value += `; rua=mailto:${rua}`;
    }
    if (ruf) {
      value += `; ruf=mailto:${ruf}`;
    }
    if (daysInterval !== 1) {
      value += `; ri=${daysInterval * 86400}`;
    }
    // Add reporting format and ADKIM/ASPF alignment
    value += '; fo=1; adkim=r; aspf=r';
    return {
      name: `_dmarc.${domain}`,
      type: 'TXT',
      value: value
    };
  }
  /**
   * Save DNS record recommendations to a file
   * @param domain Domain name
   * @param records DNS records to save
   */
  public async saveDnsRecommendations(domain: string, records: IDnsRecord[]): Promise<void> {
    try {
      const filePath = plugins.path.join(paths.dnsRecordsDir, `${domain}.recommendations.json`);
      await plugins.smartfs.file(filePath).write(JSON.stringify(records, null, 2));
      console.log(`DNS recommendations for ${domain} saved to ${filePath}`);
    } catch (error) {
      console.error(`Error saving DNS recommendations for ${domain}:`, error);
    }
  }
  /**
   * Get cache key value
   * @param key Cache key
   * @returns Cached value or undefined if not found or expired
   */
  private getFromCache<T>(key: string): T | undefined {
    const cached = this.cache.get(key);
    if (cached && cached.expires > Date.now()) {
      return cached.data as T;
    }
    // Remove expired entry
    if (cached) {
      this.cache.delete(key);
    }
    return undefined;
  }
  /**
   * Set cache key value
   * @param key Cache key
   * @param data Data to cache
   * @param ttl TTL in milliseconds
   */
  private setInCache<T>(key: string, data: T, ttl: number = this.defaultOptions.cacheTtl): void {
    if (ttl <= 0) return; // Don't cache if TTL is disabled
    this.cache.set(key, {
      data,
      expires: Date.now() + ttl
    });
  }
  /**
   * Clear the DNS cache
   * @param key Optional specific key to clear, or all cache if not provided
   */
  public clearCache(key?: string): void {
    if (key) {
      this.cache.delete(key);
    } else {
      this.cache.clear();
    }
  }
  /**
   * Promise-based wrapper for dns.resolveMx
   * @param domain Domain to resolve
   * @param timeout Timeout in milliseconds
   * @returns Promise resolving to MX records
   */
  private dnsResolveMx(domain: string, timeout: number = 5000): Promise<plugins.dns.MxRecord[]> {
    return new Promise((resolve, reject) => {
      const timeoutId = setTimeout(() => {
        reject(new Error(`DNS MX lookup timeout for ${domain}`));
      }, timeout);
      plugins.dns.resolveMx(domain, (err, addresses) => {
        clearTimeout(timeoutId);
        if (err) {
          reject(err);
        } else {
          resolve(addresses);
        }
      });
    });
  }
  /**
   * Promise-based wrapper for dns.resolveTxt
   * @param domain Domain to resolve
   * @param timeout Timeout in milliseconds
   * @returns Promise resolving to TXT records
   */
  private dnsResolveTxt(domain: string, timeout: number = 5000): Promise<string[][]> {
    return new Promise((resolve, reject) => {
      const timeoutId = setTimeout(() => {
        reject(new Error(`DNS TXT lookup timeout for ${domain}`));
      }, timeout);
      plugins.dns.resolveTxt(domain, (err, records) => {
        clearTimeout(timeoutId);
        if (err) {
          reject(err);
        } else {
          resolve(records);
        }
      });
    });
  }
  /**
   * Generate all recommended DNS records for proper email authentication
   * @param domain Domain to generate records for
   * @returns Array of recommended DNS records
   */
  public async generateAllRecommendedRecords(domain: string): Promise<IDnsRecord[]> {
    const records: IDnsRecord[] = [];
    // Get DKIM record (already created by DKIMCreator)
    try {
      // Call the DKIM creator directly
      const dkimRecord = await this.dkimCreator.getDNSRecordForDomain(domain);
      records.push(dkimRecord);
    } catch (error) {
      console.error(`Error getting DKIM record for ${domain}:`, error);
    }
    // Generate SPF record
    const spfRecord = this.generateSpfRecord(domain, {
      includeMx: true,
      includeA: true,
      policy: 'softfail'
    });
    records.push(spfRecord);
    // Generate DMARC record
    const dmarcRecord = this.generateDmarcRecord(domain, {
      policy: 'none', // Start with monitoring mode
      rua: `dmarc@${domain}` // Replace with appropriate report address
    });
    records.push(dmarcRecord);
    // Save recommendations
    await this.saveDnsRecommendations(domain, records);
    return records;
  }
 }
--- a/ts/mail/routing/classes.email.action.executor.ts
+++ b/ts/mail/routing/classes.email.action.executor.ts
@@ -0,0 +1,175 @@
 import { logger } from '../../logger.js';
 import {
  SecurityLogger,
  SecurityLogLevel,
  SecurityEventType
 } from '../../security/index.js';
 import type { IEmailAction, IEmailContext } from './interfaces.js';
 import { Email } from '../core/classes.email.js';
 import { BounceManager } from '../core/classes.bouncemanager.js';
 import { UnifiedDeliveryQueue } from '../delivery/classes.delivery.queue.js';
 import type { ISmtpSendResult } from '../../security/classes.rustsecuritybridge.js';
 /**
 * Dependencies injected from UnifiedEmailServer to avoid circular imports
 */
 export interface IActionExecutorDeps {
  sendOutboundEmail: (host: string, port: number, email: Email, options?: {
    auth?: { user: string; pass: string };
    dkimDomain?: string;
    dkimSelector?: string;
    tlsOpportunistic?: boolean;
  }) => Promise<ISmtpSendResult>;
  bounceManager: BounceManager;
  deliveryQueue: UnifiedDeliveryQueue;
 }
 /**
 * Executes email routing actions (forward, process, deliver, reject)
 */
 export class EmailActionExecutor {
  constructor(private deps: IActionExecutorDeps) {}
  async executeAction(action: IEmailAction, email: Email, context: IEmailContext): Promise<void> {
    switch (action.type) {
      case 'forward':
        await this.handleForwardAction(action, email, context);
        break;
      case 'process':
        await this.handleProcessAction(action, email, context);
        break;
      case 'deliver':
        await this.handleDeliverAction(action, email, context);
        break;
      case 'reject':
        await this.handleRejectAction(action, email, context);
        break;
      default:
        throw new Error(`Unknown action type: ${(action as any).type}`);
    }
  }
  private async handleForwardAction(action: IEmailAction, email: Email, context: IEmailContext): Promise<void> {
    if (!action.forward) {
      throw new Error('Forward action requires forward configuration');
    }
    const { host, port = 25, auth, addHeaders } = action.forward;
    logger.log('info', `Forwarding email to ${host}:${port}`);
    // Add forwarding headers
    if (addHeaders) {
      for (const [key, value] of Object.entries(addHeaders)) {
        email.headers[key] = value;
      }
    }
    // Add standard forwarding headers
    email.headers['X-Forwarded-For'] = context.session.remoteAddress || 'unknown';
    email.headers['X-Forwarded-To'] = email.to.join(', ');
    email.headers['X-Forwarded-Date'] = new Date().toISOString();
    try {
      // Send email via Rust SMTP client
      await this.deps.sendOutboundEmail(host, port, email, {
        auth: auth as { user: string; pass: string } | undefined,
      });
      logger.log('info', `Successfully forwarded email to ${host}:${port}`);
      SecurityLogger.getInstance().logEvent({
        level: SecurityLogLevel.INFO,
        type: SecurityEventType.EMAIL_FORWARDING,
        message: 'Email forwarded successfully',
        ipAddress: context.session.remoteAddress,
        details: {
          sessionId: context.session.id,
          routeName: context.session.matchedRoute?.name,
          targetHost: host,
          targetPort: port,
          recipients: email.to
        },
        success: true
      });
    } catch (error) {
      logger.log('error', `Failed to forward email: ${error.message}`);
      SecurityLogger.getInstance().logEvent({
        level: SecurityLogLevel.ERROR,
        type: SecurityEventType.EMAIL_FORWARDING,
        message: 'Email forwarding failed',
        ipAddress: context.session.remoteAddress,
        details: {
          sessionId: context.session.id,
          routeName: context.session.matchedRoute?.name,
          targetHost: host,
          targetPort: port,
          error: error.message
        },
        success: false
      });
      // Handle as bounce
      for (const recipient of email.getAllRecipients()) {
        await this.deps.bounceManager.processSmtpFailure(recipient, error.message, {
          sender: email.from,
          originalEmailId: email.headers['Message-ID'] as string
        });
      }
      throw error;
    }
  }
  private async handleProcessAction(action: IEmailAction, email: Email, context: IEmailContext): Promise<void> {
    logger.log('info', `Processing email with action options`);
    // Apply scanning if requested
    if (action.process?.scan) {
      logger.log('info', 'Content scanning requested');
    }
    // Queue for delivery
    const queue = action.process?.queue || 'normal';
    await this.deps.deliveryQueue.enqueue(email, 'process', context.session.matchedRoute!);
    logger.log('info', `Email queued for delivery in ${queue} queue`);
  }
  private async handleDeliverAction(_action: IEmailAction, email: Email, context: IEmailContext): Promise<void> {
    logger.log('info', `Delivering email locally`);
    // Queue for local delivery
    await this.deps.deliveryQueue.enqueue(email, 'mta', context.session.matchedRoute!);
    logger.log('info', 'Email queued for local delivery');
  }
  private async handleRejectAction(action: IEmailAction, _email: Email, context: IEmailContext): Promise<void> {
    const code = action.reject?.code || 550;
    const message = action.reject?.message || 'Message rejected';
    logger.log('info', `Rejecting email with code ${code}: ${message}`);
    SecurityLogger.getInstance().logEvent({
      level: SecurityLogLevel.WARN,
      type: SecurityEventType.EMAIL_PROCESSING,
      message: 'Email rejected by routing rule',
      ipAddress: context.session.remoteAddress,
      details: {
        sessionId: context.session.id,
        routeName: context.session.matchedRoute?.name,
        rejectCode: code,
        rejectMessage: message,
        from: _email.from,
        to: _email.to
      },
      success: false
    });
    // Throw error with SMTP code and message
    const error = new Error(message);
    (error as any).responseCode = code;
    throw error;
  }
 }
--- a/ts/mail/routing/classes.email.config.ts
+++ b/ts/mail/routing/classes.email.config.ts
@@ -1,82 +0,0 @@
 import type { EmailProcessingMode } from '../delivery/interfaces.js';
 // Re-export EmailProcessingMode type
 export type { EmailProcessingMode };
 /**
 * Domain rule interface for pattern-based routing
 */
 export interface IDomainRule {
  // Domain pattern (e.g., "*@example.com", "*@*.example.net")
  pattern: string;
  // Handling mode for this pattern
  mode: EmailProcessingMode;
  // Forward mode configuration
  target?: {
    server: string;
    port?: number;
    useTls?: boolean;
    authentication?: {
      user?: string;
      pass?: string;
    };
  };
  // MTA mode configuration
  mtaOptions?: IMtaOptions;
  // Process mode configuration
  contentScanning?: boolean;
  scanners?: IContentScanner[];
  transformations?: ITransformation[];
  // Rate limits for this domain
  rateLimits?: {
    maxMessagesPerMinute?: number;
    maxRecipientsPerMessage?: number;
  };
 }
 /**
 * MTA options interface
 */
 export interface IMtaOptions {
  domain?: string;
  allowLocalDelivery?: boolean;
  localDeliveryPath?: string;
  dkimSign?: boolean;
  dkimOptions?: {
    domainName: string;
    keySelector: string;
    privateKey?: string;
  };
  smtpBanner?: string;
  maxConnections?: number;
  connTimeout?: number;
  spoolDir?: string;
 }
 /**
 * Content scanner interface
 */
 export interface IContentScanner {
  type: 'spam' | 'virus' | 'attachment';
  threshold?: number;
  action: 'tag' | 'reject';
  blockedExtensions?: string[];
 }
 /**
 * Transformation interface
 */
 export interface ITransformation {
  type: string;
  header?: string;
  value?: string;
  domains?: string[];
  append?: boolean;
  [key: string]: any;
 }
--- a/ts/mail/routing/classes.unified.email.server.ts
+++ b/ts/mail/routing/classes.unified.email.server.ts
--- a/ts/mail/routing/index.ts
+++ b/ts/mail/routing/index.ts
@@ -3,4 +3,7 @@ export * from './classes.email.router.js';
 export * from './classes.unified.email.server.js';
 export * from './classes.dns.manager.js';
 export * from './interfaces.js';
-export * from './classes.domain.registry.js';
+export * from './classes.domain.registry.js';
 export * from './classes.email.action.executor.js';
 export * from './classes.dkim.manager.js';
--- a/ts/mail/security/classes.dkimcreator.ts
+++ b/ts/mail/security/classes.dkimcreator.ts
@@ -115,7 +115,7 @@ export class DKIMCreator {
    }
  }
-  // Create a DKIM key pair - changed to public for API access
+  // Create an RSA DKIM key pair - changed to public for API access
  public async createDKIMKeys(): Promise<{ privateKey: string; publicKey: string }> {
    const { privateKey, publicKey } = await generateKeyPair('rsa', {
      modulusLength: 2048,
@@ -126,6 +126,16 @@ export class DKIMCreator {
    return { privateKey, publicKey };
  }
  // Create an Ed25519 DKIM key pair (RFC 8463)
  public async createEd25519Keys(): Promise<{ privateKey: string; publicKey: string }> {
    const { privateKey, publicKey } = await generateKeyPair('ed25519', {
      publicKeyEncoding: { type: 'spki', format: 'pem' },
      privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
    });
    return { privateKey, publicKey };
  }
  // Store a DKIM key pair - uses storage manager if available, else disk
  public async storeDKIMKeys(
    privateKey: string,
@@ -176,8 +186,11 @@ export class DKIMCreator {
      .replace(pemFooter, '')
      .replace(/\n/g, '');
    // Detect key type from PEM header
    const keyAlgo = keys.privateKey.includes('ED25519') || keys.publicKey.length < 200 ? 'ed25519' : 'rsa';
    // Now generate the DKIM DNS TXT record
-    const dnsRecordValue = `v=DKIM1; h=sha256; k=rsa; p=${keyContents}`;
+    const dnsRecordValue = `v=DKIM1; h=sha256; k=${keyAlgo}; p=${keyContents}`;
    return {
      name: `mta._domainkey.${domainArg}`,
@@ -375,8 +388,11 @@ export class DKIMCreator {
      .replace(pemFooter, '')
      .replace(/\n/g, '');
    // Detect key type from PEM header
    const keyAlgo = keys.privateKey.includes('ED25519') || keys.publicKey.length < 200 ? 'ed25519' : 'rsa';
    // Generate the DKIM DNS TXT record
-    const dnsRecordValue = `v=DKIM1; h=sha256; k=rsa; p=${keyContents}`;
+    const dnsRecordValue = `v=DKIM1; h=sha256; k=${keyAlgo}; p=${keyContents}`;
    return {
      name: `${selector}._domainkey.${domain}`,
--- a/ts/mail/security/classes.dkimverifier.ts
+++ b/ts/mail/security/classes.dkimverifier.ts
@@ -1,86 +0,0 @@
 import { logger } from '../../logger.js';
 import { SecurityLogger, SecurityLogLevel, SecurityEventType } from '../../security/index.js';
 import { RustSecurityBridge } from '../../security/classes.rustsecuritybridge.js';
 /**
 * Result of a DKIM verification
 */
 export interface IDkimVerificationResult {
  isValid: boolean;
  domain?: string;
  selector?: string;
  status?: string;
  details?: any;
  errorMessage?: string;
  signatureFields?: Record<string, string>;
 }
 /**
 * DKIM verifier — delegates to the Rust security bridge.
 */
 export class DKIMVerifier {
  constructor() {}
  /**
   * Verify DKIM signature for an email via Rust bridge
   */
  public async verify(
    emailData: string,
    options: {
      useCache?: boolean;
      returnDetails?: boolean;
    } = {}
  ): Promise<IDkimVerificationResult> {
    try {
      const bridge = RustSecurityBridge.getInstance();
      const results = await bridge.verifyDkim(emailData);
      const first = results[0];
      const result: IDkimVerificationResult = {
        isValid: first?.is_valid ?? false,
        domain: first?.domain ?? undefined,
        selector: first?.selector ?? undefined,
        status: first?.status ?? 'none',
        details: options.returnDetails ? results : undefined,
      };
      SecurityLogger.getInstance().logEvent({
        level: result.isValid ? SecurityLogLevel.INFO : SecurityLogLevel.WARN,
        type: SecurityEventType.DKIM,
        message: `DKIM verification ${result.isValid ? 'passed' : 'failed'} for domain ${result.domain || 'unknown'}`,
        details: { selector: result.selector, status: result.status },
        domain: result.domain || 'unknown',
        success: result.isValid
      });
      logger.log(result.isValid ? 'info' : 'warn',
        `DKIM verification: ${result.status} for domain ${result.domain || 'unknown'}`);
      return result;
    } catch (error) {
      logger.log('error', `DKIM verification failed: ${error.message}`);
      SecurityLogger.getInstance().logEvent({
        level: SecurityLogLevel.ERROR,
        type: SecurityEventType.DKIM,
        message: `DKIM verification error`,
        details: { error: error.message },
        success: false
      });
      return {
        isValid: false,
        status: 'temperror',
        errorMessage: `Verification error: ${error.message}`
      };
    }
  }
  /** No-op — Rust bridge handles its own caching */
  public clearCache(): void {}
  /** Always 0 — cache is managed by the Rust side */
  public getCacheSize(): number {
    return 0;
  }
 }
--- a/ts/mail/security/classes.dmarcverifier.ts
+++ b/ts/mail/security/classes.dmarcverifier.ts
@@ -1,475 +0,0 @@
 import { logger } from '../../logger.js';
 import { SecurityLogger, SecurityLogLevel, SecurityEventType } from '../../security/index.js';
 import type { Email } from '../core/classes.email.js';
 /**
 * DMARC policy types
 */
 export enum DmarcPolicy {
  NONE = 'none',
  QUARANTINE = 'quarantine',
  REJECT = 'reject'
 }
 /**
 * DMARC alignment modes
 */
 export enum DmarcAlignment {
  RELAXED = 'r',
  STRICT = 's'
 }
 /**
 * DMARC record fields
 */
 export interface DmarcRecord {
  // Required fields
  version: string;
  policy: DmarcPolicy;
  // Optional fields
  subdomainPolicy?: DmarcPolicy;
  pct?: number;
  adkim?: DmarcAlignment;
  aspf?: DmarcAlignment;
  reportInterval?: number;
  failureOptions?: string;
  reportUriAggregate?: string[];
  reportUriForensic?: string[];
 }
 /**
 * DMARC verification result
 */
 export interface DmarcResult {
  hasDmarc: boolean;
  record?: DmarcRecord;
  spfDomainAligned: boolean;
  dkimDomainAligned: boolean;
  spfPassed: boolean;
  dkimPassed: boolean;
  policyEvaluated: DmarcPolicy;
  actualPolicy: DmarcPolicy;
  appliedPercentage: number;
  action: 'pass' | 'quarantine' | 'reject';
  details: string;
  error?: string;
 }
 /**
 * Class for verifying and enforcing DMARC policies
 */
 export class DmarcVerifier {
  // DNS Manager reference for verifying records
  private dnsManager?: any;
  constructor(dnsManager?: any) {
    this.dnsManager = dnsManager;
  }
  /**
   * Parse a DMARC record from a TXT record string
   * @param record DMARC TXT record string
   * @returns Parsed DMARC record or null if invalid
   */
  public parseDmarcRecord(record: string): DmarcRecord | null {
    if (!record.startsWith('v=DMARC1')) {
      return null;
    }
    try {
      // Initialize record with default values
      const dmarcRecord: DmarcRecord = {
        version: 'DMARC1',
        policy: DmarcPolicy.NONE,
        pct: 100,
        adkim: DmarcAlignment.RELAXED,
        aspf: DmarcAlignment.RELAXED
      };
      // Split the record into tag/value pairs
      const parts = record.split(';').map(part => part.trim());
      for (const part of parts) {
        if (!part || !part.includes('=')) continue;
        const [tag, value] = part.split('=').map(p => p.trim());
        // Process based on tag
        switch (tag.toLowerCase()) {
          case 'v':
            dmarcRecord.version = value;
            break;
          case 'p':
            dmarcRecord.policy = value as DmarcPolicy;
            break;
          case 'sp':
            dmarcRecord.subdomainPolicy = value as DmarcPolicy;
            break;
          case 'pct':
            const pctValue = parseInt(value, 10);
            if (!isNaN(pctValue) && pctValue >= 0 && pctValue <= 100) {
              dmarcRecord.pct = pctValue;
            }
            break;
          case 'adkim':
            dmarcRecord.adkim = value as DmarcAlignment;
            break;
          case 'aspf':
            dmarcRecord.aspf = value as DmarcAlignment;
            break;
          case 'ri':
            const interval = parseInt(value, 10);
            if (!isNaN(interval) && interval > 0) {
              dmarcRecord.reportInterval = interval;
            }
            break;
          case 'fo':
            dmarcRecord.failureOptions = value;
            break;
          case 'rua':
            dmarcRecord.reportUriAggregate = value.split(',').map(uri => {
              if (uri.startsWith('mailto:')) {
                return uri.substring(7).trim();
              }
              return uri.trim();
            });
            break;
          case 'ruf':
            dmarcRecord.reportUriForensic = value.split(',').map(uri => {
              if (uri.startsWith('mailto:')) {
                return uri.substring(7).trim();
              }
              return uri.trim();
            });
            break;
        }
      }
      // Ensure subdomain policy is set if not explicitly provided
      if (!dmarcRecord.subdomainPolicy) {
        dmarcRecord.subdomainPolicy = dmarcRecord.policy;
      }
      return dmarcRecord;
    } catch (error) {
      logger.log('error', `Error parsing DMARC record: ${error.message}`, {
        record,
        error: error.message
      });
      return null;
    }
  }
  /**
   * Check if domains are aligned according to DMARC policy
   * @param headerDomain Domain from header (From)
   * @param authDomain Domain from authentication (SPF, DKIM)
   * @param alignment Alignment mode
   * @returns Whether the domains are aligned
   */
  private isDomainAligned(
    headerDomain: string,
    authDomain: string,
    alignment: DmarcAlignment
  ): boolean {
    if (!headerDomain || !authDomain) {
      return false;
    }
    // For strict alignment, domains must match exactly
    if (alignment === DmarcAlignment.STRICT) {
      return headerDomain.toLowerCase() === authDomain.toLowerCase();
    }
    // For relaxed alignment, the authenticated domain must be a subdomain of the header domain
    // or the same as the header domain
    const headerParts = headerDomain.toLowerCase().split('.');
    const authParts = authDomain.toLowerCase().split('.');
    // Ensures we have at least two parts (domain and TLD)
    if (headerParts.length < 2 || authParts.length < 2) {
      return false;
    }
    // Get organizational domain (last two parts)
    const headerOrgDomain = headerParts.slice(-2).join('.');
    const authOrgDomain = authParts.slice(-2).join('.');
    return headerOrgDomain === authOrgDomain;
  }
  /**
   * Extract domain from an email address
   * @param email Email address
   * @returns Domain part of the email
   */
  private getDomainFromEmail(email: string): string {
    if (!email) return '';
    // Handle name + email format: "John Doe <john@example.com>"
    const matches = email.match(/<([^>]+)>/);
    const address = matches ? matches[1] : email;
    const parts = address.split('@');
    return parts.length > 1 ? parts[1] : '';
  }
  /**
   * Check if DMARC verification should be applied based on percentage
   * @param record DMARC record
   * @returns Whether DMARC verification should be applied
   */
  private shouldApplyDmarc(record: DmarcRecord): boolean {
    if (record.pct === undefined || record.pct === 100) {
      return true;
    }
    // Apply DMARC randomly based on percentage
    const random = Math.floor(Math.random() * 100) + 1;
    return random <= record.pct;
  }
  /**
   * Determine the action to take based on DMARC policy
   * @param policy DMARC policy
   * @returns Action to take
   */
  private determineAction(policy: DmarcPolicy): 'pass' | 'quarantine' | 'reject' {
    switch (policy) {
      case DmarcPolicy.REJECT:
        return 'reject';
      case DmarcPolicy.QUARANTINE:
        return 'quarantine';
      case DmarcPolicy.NONE:
      default:
        return 'pass';
    }
  }
  /**
   * Verify DMARC for an incoming email
   * @param email Email to verify
   * @param spfResult SPF verification result
   * @param dkimResult DKIM verification result
   * @returns DMARC verification result
   */
  public async verify(
    email: Email,
    spfResult: { domain: string; result: boolean },
    dkimResult: { domain: string; result: boolean }
  ): Promise<DmarcResult> {
    const securityLogger = SecurityLogger.getInstance();
    // Initialize result
    const result: DmarcResult = {
      hasDmarc: false,
      spfDomainAligned: false,
      dkimDomainAligned: false,
      spfPassed: spfResult.result,
      dkimPassed: dkimResult.result,
      policyEvaluated: DmarcPolicy.NONE,
      actualPolicy: DmarcPolicy.NONE,
      appliedPercentage: 100,
      action: 'pass',
      details: 'DMARC not configured'
    };
    try {
      // Extract From domain
      const fromHeader = email.getFromEmail();
      const fromDomain = this.getDomainFromEmail(fromHeader);
      if (!fromDomain) {
        result.error = 'Invalid From domain';
        return result;
      }
      // Check alignment
      result.spfDomainAligned = this.isDomainAligned(
        fromDomain,
        spfResult.domain,
        DmarcAlignment.RELAXED
      );
      result.dkimDomainAligned = this.isDomainAligned(
        fromDomain,
        dkimResult.domain,
        DmarcAlignment.RELAXED
      );
      // Lookup DMARC record
      const dmarcVerificationResult = this.dnsManager ? 
        await this.dnsManager.verifyDmarcRecord(fromDomain) :
        { found: false, valid: false, error: 'DNS Manager not available' };
      // If DMARC record exists and is valid
      if (dmarcVerificationResult.found && dmarcVerificationResult.valid) {
        result.hasDmarc = true;
        // Parse DMARC record
        const parsedRecord = this.parseDmarcRecord(dmarcVerificationResult.value);
        if (parsedRecord) {
          result.record = parsedRecord;
          result.actualPolicy = parsedRecord.policy;
          result.appliedPercentage = parsedRecord.pct || 100;
          // Override alignment modes if specified in record
          if (parsedRecord.adkim) {
            result.dkimDomainAligned = this.isDomainAligned(
              fromDomain,
              dkimResult.domain,
              parsedRecord.adkim
            );
          }
          if (parsedRecord.aspf) {
            result.spfDomainAligned = this.isDomainAligned(
              fromDomain,
              spfResult.domain,
              parsedRecord.aspf
            );
          }
          // Determine DMARC compliance
          const spfAligned = result.spfPassed && result.spfDomainAligned;
          const dkimAligned = result.dkimPassed && result.dkimDomainAligned;
          // Email passes DMARC if either SPF or DKIM passes with alignment
          const dmarcPass = spfAligned || dkimAligned;
          // Use record percentage to determine if policy should be applied
          const applyPolicy = this.shouldApplyDmarc(parsedRecord);
          if (!dmarcPass) {
            // DMARC failed, apply policy
            result.policyEvaluated = applyPolicy ? parsedRecord.policy : DmarcPolicy.NONE;
            result.action = this.determineAction(result.policyEvaluated);
            result.details = `DMARC failed: SPF aligned=${spfAligned}, DKIM aligned=${dkimAligned}, policy=${result.policyEvaluated}`;
          } else {
            result.policyEvaluated = DmarcPolicy.NONE;
            result.action = 'pass';
            result.details = `DMARC passed: SPF aligned=${spfAligned}, DKIM aligned=${dkimAligned}`;
          }
        } else {
          result.error = 'Invalid DMARC record format';
          result.details = 'DMARC record invalid';
        }
      } else {
        // No DMARC record found or invalid
        result.details = dmarcVerificationResult.error || 'No DMARC record found';
      }
      // Log the DMARC verification
      securityLogger.logEvent({
        level: result.action === 'pass' ? SecurityLogLevel.INFO : SecurityLogLevel.WARN,
        type: SecurityEventType.DMARC,
        message: result.details,
        domain: fromDomain,
        details: {
          fromDomain,
          spfDomain: spfResult.domain,
          dkimDomain: dkimResult.domain,
          spfPassed: result.spfPassed,
          dkimPassed: result.dkimPassed,
          spfAligned: result.spfDomainAligned,
          dkimAligned: result.dkimDomainAligned,
          dmarcPolicy: result.policyEvaluated,
          action: result.action
        },
        success: result.action === 'pass'
      });
      return result;
    } catch (error) {
      logger.log('error', `Error verifying DMARC: ${error.message}`, {
        error: error.message,
        emailId: email.getMessageId()
      });
      result.error = `DMARC verification error: ${error.message}`;
      // Log error
      securityLogger.logEvent({
        level: SecurityLogLevel.ERROR,
        type: SecurityEventType.DMARC,
        message: `DMARC verification failed with error`,
        details: {
          error: error.message,
          emailId: email.getMessageId()
        },
        success: false
      });
      return result;
    }
  }
  /**
   * Apply DMARC policy to an email
   * @param email Email to apply policy to
   * @param dmarcResult DMARC verification result
   * @returns Whether the email should be accepted
   */
  public applyPolicy(email: Email, dmarcResult: DmarcResult): boolean {
    // Apply action based on DMARC verification result
    switch (dmarcResult.action) {
      case 'reject':
        // Reject the email
        email.mightBeSpam = true;
        logger.log('warn', `Email rejected due to DMARC policy: ${dmarcResult.details}`, {
          emailId: email.getMessageId(),
          from: email.getFromEmail(),
          subject: email.subject
        });
        return false;
      case 'quarantine':
        // Quarantine the email (mark as spam)
        email.mightBeSpam = true;
        // Add spam header
        if (!email.headers['X-Spam-Flag']) {
          email.headers['X-Spam-Flag'] = 'YES';
        }
        // Add DMARC reason header
        email.headers['X-DMARC-Result'] = dmarcResult.details;
        logger.log('warn', `Email quarantined due to DMARC policy: ${dmarcResult.details}`, {
          emailId: email.getMessageId(),
          from: email.getFromEmail(),
          subject: email.subject
        });
        return true;
      case 'pass':
      default:
        // Accept the email
        // Add DMARC result header for information
        email.headers['X-DMARC-Result'] = dmarcResult.details;
        return true;
    }
  }
  /**
   * End-to-end DMARC verification and policy application
   * This method should be called after SPF and DKIM verification
   * @param email Email to verify
   * @param spfResult SPF verification result
   * @param dkimResult DKIM verification result
   * @returns Whether the email should be accepted
   */
  public async verifyAndApply(
    email: Email,
    spfResult: { domain: string; result: boolean },
    dkimResult: { domain: string; result: boolean }
  ): Promise<boolean> {
    // Verify DMARC
    const dmarcResult = await this.verify(email, spfResult, dkimResult);
    // Apply DMARC policy
    return this.applyPolicy(email, dmarcResult);
  }
 }
--- a/ts/mail/security/classes.spfverifier.ts
+++ b/ts/mail/security/classes.spfverifier.ts
@@ -1,8 +1,4 @@
 import * as plugins from '../../plugins.js';
 import { logger } from '../../logger.js';
 import { SecurityLogger, SecurityLogLevel, SecurityEventType } from '../../security/index.js';
 import { RustSecurityBridge } from '../../security/classes.rustsecuritybridge.js';
 import type { Email } from '../core/classes.email.js';
 /**
 * SPF result qualifiers
@@ -127,107 +123,4 @@ export class SpfVerifier {
      return null;
    }
  }
  /**
   * Verify SPF for a given email — delegates to Rust bridge
   */
  public async verify(
    email: Email,
    ip: string,
    heloDomain: string
  ): Promise<SpfResult> {
    const securityLogger = SecurityLogger.getInstance();
    const mailFrom = email.from || '';
    const domain = mailFrom.split('@')[1] || '';
    try {
      const bridge = RustSecurityBridge.getInstance();
      const result = await bridge.checkSpf({
        ip,
        heloDomain,
        hostname: plugins.os.hostname(),
        mailFrom,
      });
      const spfResult: SpfResult = {
        result: result.result as SpfResult['result'],
        domain: result.domain,
        ip: result.ip,
        explanation: result.explanation ?? undefined,
      };
      securityLogger.logEvent({
        level: spfResult.result === 'pass' ? SecurityLogLevel.INFO :
               (spfResult.result === 'fail' ? SecurityLogLevel.WARN : SecurityLogLevel.INFO),
        type: SecurityEventType.SPF,
        message: `SPF ${spfResult.result} for ${spfResult.domain} from IP ${ip}`,
        domain: spfResult.domain,
        details: { ip, heloDomain, result: spfResult.result, explanation: spfResult.explanation },
        success: spfResult.result === 'pass'
      });
      return spfResult;
    } catch (error) {
      logger.log('error', `SPF verification error: ${error.message}`, { domain, ip, error: error.message });
      securityLogger.logEvent({
        level: SecurityLogLevel.ERROR,
        type: SecurityEventType.SPF,
        message: `SPF verification error for ${domain}`,
        domain,
        details: { ip, error: error.message },
        success: false
      });
      return {
        result: 'temperror',
        explanation: `Error verifying SPF: ${error.message}`,
        domain,
        ip,
        error: error.message
      };
    }
  }
  /**
   * Check if email passes SPF verification and apply headers
   */
  public async verifyAndApply(
    email: Email,
    ip: string,
    heloDomain: string
  ): Promise<boolean> {
    const result = await this.verify(email, ip, heloDomain);
    email.headers['Received-SPF'] = `${result.result} (${result.domain}: ${result.explanation || ''}) client-ip=${ip}; envelope-from=${email.getEnvelopeFrom()}; helo=${heloDomain};`;
    switch (result.result) {
      case 'fail':
        email.mightBeSpam = true;
        logger.log('warn', `SPF failed for ${result.domain} from ${ip}: ${result.explanation}`);
        return false;
      case 'softfail':
        email.mightBeSpam = true;
        logger.log('info', `SPF softfailed for ${result.domain} from ${ip}: ${result.explanation}`);
        return true;
      case 'neutral':
      case 'none':
        logger.log('info', `SPF ${result.result} for ${result.domain} from ${ip}: ${result.explanation}`);
        return true;
      case 'pass':
        logger.log('info', `SPF passed for ${result.domain} from ${ip}: ${result.explanation}`);
        return true;
      case 'temperror':
      case 'permerror':
        logger.log('error', `SPF error for ${result.domain} from ${ip}: ${result.explanation}`);
        return true;
      default:
        return true;
    }
  }
 }
--- a/ts/mail/security/index.ts
+++ b/ts/mail/security/index.ts
@@ -1,5 +1,3 @@
 // Email security components
 export * from './classes.dkimcreator.js';
 export * from './classes.dkimverifier.js';
 export * from './classes.dmarcverifier.js';
 export * from './classes.spfverifier.js';
--- a/ts/plugins.ts
+++ b/ts/plugins.ts
@@ -21,61 +21,21 @@ export {
  util,
 }
 // @serve.zone scope
 import * as servezoneInterfaces from '@serve.zone/interfaces';
 export {
  servezoneInterfaces
 }
 // @api.global scope
 import * as typedrequest from '@api.global/typedrequest';
 import * as typedserver from '@api.global/typedserver';
 import * as typedsocket from '@api.global/typedsocket';
 export {
  typedrequest,
  typedserver,
  typedsocket,
 }
 // @push.rocks scope
 import * as projectinfo from '@push.rocks/projectinfo';
 import * as qenv from '@push.rocks/qenv';
 import * as smartacme from '@push.rocks/smartacme';
 import * as smartdata from '@push.rocks/smartdata';
 import * as smartdns from '@push.rocks/smartdns';
 import * as smartfile from '@push.rocks/smartfile';
 import { SmartFs, SmartFsProviderNode } from '@push.rocks/smartfs';
 import * as smartguard from '@push.rocks/smartguard';
 import * as smartjwt from '@push.rocks/smartjwt';
 import * as smartlog from '@push.rocks/smartlog';
 import * as smartmail from '@push.rocks/smartmail';
 import * as smartmetrics from '@push.rocks/smartmetrics';
 import * as smartnetwork from '@push.rocks/smartnetwork';
 import * as smartpath from '@push.rocks/smartpath';
 import * as smartproxy from '@push.rocks/smartproxy';
 import * as smartpromise from '@push.rocks/smartpromise';
 import * as smartrequest from '@push.rocks/smartrequest';
 import * as smartrule from '@push.rocks/smartrule';
 import * as smartrust from '@push.rocks/smartrust';
 import * as smartrx from '@push.rocks/smartrx';
 import * as smartunique from '@push.rocks/smartunique';
 export const smartfs = new SmartFs(new SmartFsProviderNode());
-export { projectinfo, qenv, smartacme, smartdata, smartdns, smartfile, SmartFs, smartguard, smartjwt, smartlog, smartmail, smartmetrics, smartnetwork, smartpath, smartproxy, smartpromise, smartrequest, smartrule, smartrust, smartrx, smartunique };
+export { smartfile, SmartFs, smartlog, smartmail, smartpath, smartrust };
 // Define SmartLog types for use in error handling
 export type TLogLevel = 'error' | 'warn' | 'info' | 'success' | 'debug';
 // apiclient.xyz scope
 import * as cloudflare from '@apiclient.xyz/cloudflare';
 export {
  cloudflare,
 }
 // tsclass scope
 import * as tsclass from '@tsclass/tsclass';
--- a/ts/security/classes.rustsecuritybridge.ts
+++ b/ts/security/classes.rustsecuritybridge.ts
@@ -1,6 +1,7 @@
 import * as plugins from '../plugins.js';
 import * as paths from '../paths.js';
 import { logger } from '../logger.js';
 import { EventEmitter } from 'events';
 // ---------------------------------------------------------------------------
 // IPC command type map — mirrors the methods in mailer-bin's management mode
@@ -66,6 +67,72 @@ interface IContentScanResult {
  scannedElements: string[];
 }
 // --- SMTP Client types ---
 interface IOutboundEmail {
  from: string;
  to: string[];
  cc?: string[];
  bcc?: string[];
  subject?: string;
  text?: string;
  html?: string;
  headers?: Record<string, string>;
 }
 interface ISmtpSendResult {
  accepted: string[];
  rejected: string[];
  messageId?: string;
  response: string;
  envelope: { from: string; to: string[] };
 }
 interface ISmtpSendOptions {
  host: string;
  port: number;
  secure?: boolean;
  domain?: string;
  auth?: { user: string; pass: string; method?: string };
  email: IOutboundEmail;
  dkim?: { domain: string; selector: string; privateKey: string; keyType?: string };
  connectionTimeoutSecs?: number;
  socketTimeoutSecs?: number;
  poolKey?: string;
  maxPoolConnections?: number;
  tlsOpportunistic?: boolean;
 }
 interface ISmtpSendRawOptions {
  host: string;
  port: number;
  secure?: boolean;
  domain?: string;
  auth?: { user: string; pass: string; method?: string };
  envelopeFrom: string;
  envelopeTo: string[];
  rawMessageBase64: string;
  poolKey?: string;
 }
 interface ISmtpVerifyOptions {
  host: string;
  port: number;
  secure?: boolean;
  domain?: string;
  auth?: { user: string; pass: string; method?: string };
 }
 interface ISmtpVerifyResult {
  reachable: boolean;
  greeting?: string;
  capabilities?: string[];
 }
 interface ISmtpPoolStatus {
  pools: Record<string, { total: number; active: number; idle: number }>;
 }
 interface IVersionInfo {
  bin: string;
  core: string;
@@ -81,6 +148,7 @@ interface ISmtpServerConfig {
  securePort?: number;
  tlsCertPem?: string;
  tlsKeyPem?: string;
  additionalTlsCerts?: Array<{ domains: string[]; certPem: string; keyPem: string }>;
  maxMessageSize?: number;
  maxConnections?: number;
  maxRecipients?: number;
@@ -127,6 +195,13 @@ interface IAuthRequestEvent {
  remoteAddr: string;
 }
 interface IScramCredentialRequestEvent {
  correlationId: string;
  sessionId: string;
  username: string;
  remoteAddr: string;
 }
 /**
 * Type-safe command map for the mailer-bin IPC bridge.
 */
@@ -156,7 +231,7 @@ type TMailerCommands = {
    result: IDkimVerificationResult[];
  };
  signDkim: {
-    params: { rawMessage: string; domain: string; selector?: string; privateKey: string };
+    params: { rawMessage: string; domain: string; selector?: string; privateKey: string; keyType?: string };
    result: { header: string; signedMessage: string };
  };
  checkSpf: {
@@ -207,10 +282,70 @@ type TMailerCommands = {
    };
    result: { resolved: boolean };
  };
  scramCredentialResult: {
    params: {
      correlationId: string;
      found: boolean;
      salt?: string;
      iterations?: number;
      storedKey?: string;
      serverKey?: string;
    };
    result: { resolved: boolean };
  };
  configureRateLimits: {
    params: IRateLimitConfig;
    result: { configured: boolean };
  };
  sendEmail: {
    params: ISmtpSendOptions;
    result: ISmtpSendResult;
  };
  sendRawEmail: {
    params: ISmtpSendRawOptions;
    result: ISmtpSendResult;
  };
  verifySmtpConnection: {
    params: ISmtpVerifyOptions;
    result: ISmtpVerifyResult;
  };
  closeSmtpPool: {
    params: { poolKey?: string };
    result: { closed: boolean };
  };
  getSmtpPoolStatus: {
    params: Record<string, never>;
    result: ISmtpPoolStatus;
  };
 };
 // ---------------------------------------------------------------------------
 // Bridge state machine
 // ---------------------------------------------------------------------------
 export enum BridgeState {
  Idle = 'idle',
  Starting = 'starting',
  Running = 'running',
  Restarting = 'restarting',
  Failed = 'failed',
  Stopped = 'stopped',
 }
 export interface IBridgeResilienceConfig {
  maxRestartAttempts: number;
  healthCheckIntervalMs: number;
  restartBackoffBaseMs: number;
  restartBackoffMaxMs: number;
  healthCheckTimeoutMs: number;
 }
 const DEFAULT_RESILIENCE_CONFIG: IBridgeResilienceConfig = {
  maxRestartAttempts: 5,
  healthCheckIntervalMs: 30_000,
  restartBackoffBaseMs: 1_000,
  restartBackoffMaxMs: 30_000,
  healthCheckTimeoutMs: 5_000,
 };
 // ---------------------------------------------------------------------------
@@ -222,14 +357,26 @@ type TMailerCommands = {
 *
 * Uses `@push.rocks/smartrust` for JSON-over-stdin/stdout IPC.
 * Singleton — access via `RustSecurityBridge.getInstance()`.
 *
 * Features resilience via auto-restart with exponential backoff,
 * periodic health checks, and a state machine that tracks the
 * bridge lifecycle.
 */
-export class RustSecurityBridge {
+export class RustSecurityBridge extends EventEmitter {
  private static instance: RustSecurityBridge | null = null;
  private static _resilienceConfig: IBridgeResilienceConfig = { ...DEFAULT_RESILIENCE_CONFIG };
  private bridge: InstanceType<typeof plugins.smartrust.RustBridge<TMailerCommands>>;
  private _running = false;
  private _state: BridgeState = BridgeState.Idle;
  private _restartAttempts = 0;
  private _restartTimer: ReturnType<typeof setTimeout> | null = null;
  private _healthCheckTimer: ReturnType<typeof setInterval> | null = null;
  private _deliberateStop = false;
  private _smtpServerConfig: ISmtpServerConfig | null = null;
  private constructor() {
    super();
    this.bridge = new plugins.smartrust.RustBridge<TMailerCommands>({
      binaryName: 'mailer-bin',
      cliArgs: ['--management'],
@@ -252,6 +399,13 @@ export class RustSecurityBridge {
    this.bridge.on('exit', (code: number | null, signal: string | null) => {
      this._running = false;
      logger.log('warn', `Rust security bridge exited (code=${code}, signal=${signal})`);
      if (this._deliberateStop) {
        this.setState(BridgeState.Stopped);
      } else if (this._state === BridgeState.Running) {
        // Unexpected exit — attempt restart
        this.attemptRestart();
      }
    });
    this.bridge.on('stderr', (line: string) => {
@@ -259,6 +413,10 @@ export class RustSecurityBridge {
    });
  }
  // -----------------------------------------------------------------------
  // Static configuration & singleton
  // -----------------------------------------------------------------------
  /** Get or create the singleton instance. */
  public static getInstance(): RustSecurityBridge {
    if (!RustSecurityBridge.instance) {
@@ -267,11 +425,73 @@ export class RustSecurityBridge {
    return RustSecurityBridge.instance;
  }
  /** Reset the singleton instance (for testing). */
  public static resetInstance(): void {
    if (RustSecurityBridge.instance) {
      RustSecurityBridge.instance.stopHealthCheck();
      if (RustSecurityBridge.instance._restartTimer) {
        clearTimeout(RustSecurityBridge.instance._restartTimer);
        RustSecurityBridge.instance._restartTimer = null;
      }
      RustSecurityBridge.instance.removeAllListeners();
    }
    RustSecurityBridge.instance = null;
  }
  /** Configure resilience parameters. Can be called before or after getInstance(). */
  public static configure(config: Partial<IBridgeResilienceConfig>): void {
    RustSecurityBridge._resilienceConfig = {
      ...RustSecurityBridge._resilienceConfig,
      ...config,
    };
  }
  // -----------------------------------------------------------------------
  // State management
  // -----------------------------------------------------------------------
  /** Current bridge state. */
  public get state(): BridgeState {
    return this._state;
  }
  /** Whether the Rust process is currently running and accepting commands. */
  public get running(): boolean {
    return this._running;
  }
  private setState(newState: BridgeState): void {
    const oldState = this._state;
    if (oldState === newState) return;
    this._state = newState;
    logger.log('info', `Rust bridge state: ${oldState} -> ${newState}`);
    this.emit('stateChange', { oldState, newState });
  }
  /**
   * Throws a descriptive error if the bridge is not in Running state.
   * Called at the top of every command method.
   */
  private ensureRunning(): void {
    if (this._state === BridgeState.Running && this._running) {
      return;
    }
    switch (this._state) {
      case BridgeState.Idle:
        throw new Error('Rust bridge has not been started yet. Call start() first.');
      case BridgeState.Starting:
        throw new Error('Rust bridge is still starting. Wait for start() to resolve.');
      case BridgeState.Restarting:
        throw new Error('Rust bridge is restarting after a crash. Commands will resume once it recovers.');
      case BridgeState.Failed:
        throw new Error('Rust bridge has failed after exhausting all restart attempts.');
      case BridgeState.Stopped:
        throw new Error('Rust bridge has been stopped. Call start() to restart it.');
      default:
        throw new Error(`Rust bridge is not running (state=${this._state}).`);
    }
  }
  // -----------------------------------------------------------------------
  // Lifecycle
  // -----------------------------------------------------------------------
@@ -281,55 +501,195 @@ export class RustSecurityBridge {
   * @returns `true` if the binary started successfully, `false` otherwise.
   */
  public async start(): Promise<boolean> {
-    if (this._running) {
+    if (this._running && this._state === BridgeState.Running) {
      return true;
    }
    this._deliberateStop = false;
    this._restartAttempts = 0;
    this.setState(BridgeState.Starting);
    try {
      const ok = await this.bridge.spawn();
      this._running = ok;
      if (ok) {
        this.setState(BridgeState.Running);
        this.startHealthCheck();
        logger.log('info', 'Rust security bridge started');
      } else {
        this.setState(BridgeState.Failed);
        logger.log('warn', 'Rust security bridge failed to start (binary not found or timeout)');
      }
      return ok;
    } catch (err) {
      this.setState(BridgeState.Failed);
      logger.log('error', `Failed to start Rust security bridge: ${(err as Error).message}`);
      return false;
    }
  }
-  /** Kill the Rust process. */
+  /** Kill the Rust process deliberately. */
  public async stop(): Promise<void> {
    this._deliberateStop = true;
    // Cancel any pending restart
    if (this._restartTimer) {
      clearTimeout(this._restartTimer);
      this._restartTimer = null;
    }
    this.stopHealthCheck();
    this._smtpServerConfig = null;
    if (!this._running) {
      this.setState(BridgeState.Stopped);
      return;
    }
    try {
      this.bridge.kill();
      this._running = false;
      this.setState(BridgeState.Stopped);
      logger.log('info', 'Rust security bridge stopped');
    } catch (err) {
      logger.log('error', `Error stopping Rust security bridge: ${(err as Error).message}`);
    }
  }
  // -----------------------------------------------------------------------
  // Auto-restart with exponential backoff
  // -----------------------------------------------------------------------
  private attemptRestart(): void {
    const config = RustSecurityBridge._resilienceConfig;
    this._restartAttempts++;
    if (this._restartAttempts > config.maxRestartAttempts) {
      logger.log('error', `Rust bridge exceeded max restart attempts (${config.maxRestartAttempts}). Giving up.`);
      this.setState(BridgeState.Failed);
      return;
    }
    this.setState(BridgeState.Restarting);
    this.stopHealthCheck();
    const delay = Math.min(
      config.restartBackoffBaseMs * Math.pow(2, this._restartAttempts - 1),
      config.restartBackoffMaxMs,
    );
    logger.log('info', `Rust bridge restart attempt ${this._restartAttempts}/${config.maxRestartAttempts} in ${delay}ms`);
    this._restartTimer = setTimeout(async () => {
      this._restartTimer = null;
      // Guard: if stop() was called while we were waiting, don't restart
      if (this._deliberateStop) {
        this.setState(BridgeState.Stopped);
        return;
      }
      try {
        const ok = await this.bridge.spawn();
        this._running = ok;
        if (ok) {
          logger.log('info', 'Rust bridge restarted successfully');
          this._restartAttempts = 0;
          this.setState(BridgeState.Running);
          this.startHealthCheck();
          await this.restoreAfterRestart();
        } else {
          logger.log('warn', 'Rust bridge restart failed (spawn returned false)');
          this.attemptRestart();
        }
      } catch (err) {
        logger.log('error', `Rust bridge restart failed: ${(err as Error).message}`);
        this.attemptRestart();
      }
    }, delay);
  }
  /**
   * Restore state after a successful restart:
   * - Re-send startSmtpServer command if the SMTP server was running
   */
  private async restoreAfterRestart(): Promise<void> {
    if (this._smtpServerConfig) {
      try {
        logger.log('info', 'Restoring SMTP server after bridge restart');
        const result = await this.bridge.sendCommand('startSmtpServer', this._smtpServerConfig);
        if (result?.started) {
          logger.log('info', 'SMTP server restored after bridge restart');
        } else {
          logger.log('warn', 'SMTP server failed to restore after bridge restart');
        }
      } catch (err) {
        logger.log('error', `Failed to restore SMTP server after restart: ${(err as Error).message}`);
      }
    }
  }
  // -----------------------------------------------------------------------
  // Health check
  // -----------------------------------------------------------------------
  private startHealthCheck(): void {
    this.stopHealthCheck();
    const config = RustSecurityBridge._resilienceConfig;
    this._healthCheckTimer = setInterval(async () => {
      if (this._state !== BridgeState.Running || !this._running) {
        return;
      }
      try {
        const pongPromise = this.bridge.sendCommand('ping', {} as any);
        const timeoutPromise = new Promise<never>((_, reject) =>
          setTimeout(() => reject(new Error('Health check timeout')), config.healthCheckTimeoutMs),
        );
        const res = await Promise.race([pongPromise, timeoutPromise]);
        if (!(res as any)?.pong) {
          throw new Error('Health check: unexpected ping response');
        }
      } catch (err) {
        logger.log('warn', `Rust bridge health check failed: ${(err as Error).message}. Killing process to trigger restart.`);
        try {
          this.bridge.kill();
        } catch {
          // Already dead
        }
        // The exit handler will trigger attemptRestart()
      }
    }, config.healthCheckIntervalMs);
  }
  private stopHealthCheck(): void {
    if (this._healthCheckTimer) {
      clearInterval(this._healthCheckTimer);
      this._healthCheckTimer = null;
    }
  }
  // -----------------------------------------------------------------------
  // Commands — thin typed wrappers over sendCommand
  // -----------------------------------------------------------------------
  /** Ping the Rust process. */
  public async ping(): Promise<boolean> {
    this.ensureRunning();
    const res = await this.bridge.sendCommand('ping', {} as any);
    return res?.pong === true;
  }
  /** Get version information for all Rust crates. */
  public async getVersion(): Promise<IVersionInfo> {
    this.ensureRunning();
    return this.bridge.sendCommand('version', {} as any);
  }
  /** Validate an email address. */
  public async validateEmail(email: string): Promise<IValidationResult> {
    this.ensureRunning();
    return this.bridge.sendCommand('validateEmail', { email });
  }
@@ -339,6 +699,7 @@ export class RustSecurityBridge {
    diagnosticCode?: string;
    statusCode?: string;
  }): Promise<IBounceDetection> {
    this.ensureRunning();
    return this.bridge.sendCommand('detectBounce', opts);
  }
@@ -349,26 +710,31 @@ export class RustSecurityBridge {
    htmlBody?: string;
    attachmentNames?: string[];
  }): Promise<IContentScanResult> {
    this.ensureRunning();
    return this.bridge.sendCommand('scanContent', opts);
  }
  /** Check IP reputation via DNSBL. */
  public async checkIpReputation(ip: string): Promise<IReputationResult> {
    this.ensureRunning();
    return this.bridge.sendCommand('checkIpReputation', { ip });
  }
  /** Verify DKIM signatures on a raw email message. */
  public async verifyDkim(rawMessage: string): Promise<IDkimVerificationResult[]> {
    this.ensureRunning();
    return this.bridge.sendCommand('verifyDkim', { rawMessage });
  }
-  /** Sign an email with DKIM. */
+  /** Sign an email with DKIM (RSA or Ed25519). */
  public async signDkim(opts: {
    rawMessage: string;
    domain: string;
    selector?: string;
    privateKey: string;
    keyType?: string;
  }): Promise<{ header: string; signedMessage: string }> {
    this.ensureRunning();
    return this.bridge.sendCommand('signDkim', opts);
  }
@@ -379,6 +745,7 @@ export class RustSecurityBridge {
    hostname?: string;
    mailFrom: string;
  }): Promise<ISpfResult> {
    this.ensureRunning();
    return this.bridge.sendCommand('checkSpf', opts);
  }
@@ -395,9 +762,44 @@ export class RustSecurityBridge {
    hostname?: string;
    mailFrom: string;
  }): Promise<IEmailSecurityResult> {
    this.ensureRunning();
    return this.bridge.sendCommand('verifyEmail', opts);
  }
  // -----------------------------------------------------------------------
  // SMTP Client — outbound email delivery via Rust
  // -----------------------------------------------------------------------
  /** Send a structured email via the Rust SMTP client. */
  public async sendOutboundEmail(opts: ISmtpSendOptions): Promise<ISmtpSendResult> {
    this.ensureRunning();
    return this.bridge.sendCommand('sendEmail', opts);
  }
  /** Send a pre-formatted raw email via the Rust SMTP client. */
  public async sendRawEmail(opts: ISmtpSendRawOptions): Promise<ISmtpSendResult> {
    this.ensureRunning();
    return this.bridge.sendCommand('sendRawEmail', opts);
  }
  /** Verify connectivity to an SMTP server. */
  public async verifySmtpConnection(opts: ISmtpVerifyOptions): Promise<ISmtpVerifyResult> {
    this.ensureRunning();
    return this.bridge.sendCommand('verifySmtpConnection', opts);
  }
  /** Close a specific connection pool (or all pools if no key is given). */
  public async closeSmtpPool(poolKey?: string): Promise<void> {
    this.ensureRunning();
    await this.bridge.sendCommand('closeSmtpPool', poolKey ? { poolKey } : ({} as any));
  }
  /** Get status of all SMTP client connection pools. */
  public async getSmtpPoolStatus(): Promise<ISmtpPoolStatus> {
    this.ensureRunning();
    return this.bridge.sendCommand('getSmtpPoolStatus', {} as any);
  }
  // -----------------------------------------------------------------------
  // SMTP Server lifecycle
  // -----------------------------------------------------------------------
@@ -408,12 +810,16 @@ export class RustSecurityBridge {
   * emailReceived and authRequest that must be handled by the caller.
   */
  public async startSmtpServer(config: ISmtpServerConfig): Promise<boolean> {
    this.ensureRunning();
    this._smtpServerConfig = config;
    const result = await this.bridge.sendCommand('startSmtpServer', config);
    return result?.started === true;
  }
  /** Stop the Rust SMTP server. */
  public async stopSmtpServer(): Promise<void> {
    this.ensureRunning();
    this._smtpServerConfig = null;
    await this.bridge.sendCommand('stopSmtpServer', {} as any);
  }
@@ -428,6 +834,7 @@ export class RustSecurityBridge {
    smtpCode?: number;
    smtpMessage?: string;
  }): Promise<void> {
    this.ensureRunning();
    await this.bridge.sendCommand('emailProcessingResult', opts);
  }
@@ -439,11 +846,29 @@ export class RustSecurityBridge {
    success: boolean;
    message?: string;
  }): Promise<void> {
    this.ensureRunning();
    await this.bridge.sendCommand('authResult', opts);
  }
  /**
   * Send SCRAM credentials back to the Rust SMTP server.
   * Values (salt, storedKey, serverKey) must be base64-encoded.
   */
  public async sendScramCredentialResult(opts: {
    correlationId: string;
    found: boolean;
    salt?: string;
    iterations?: number;
    storedKey?: string;
    serverKey?: string;
  }): Promise<void> {
    this.ensureRunning();
    await this.bridge.sendCommand('scramCredentialResult', opts);
  }
  /** Update rate limit configuration at runtime. */
  public async configureRateLimits(config: IRateLimitConfig): Promise<void> {
    this.ensureRunning();
    await this.bridge.sendCommand('configureRateLimits', config);
  }
@@ -467,6 +892,14 @@ export class RustSecurityBridge {
    this.bridge.on('management:authRequest', handler);
  }
  /**
   * Register a handler for scramCredentialRequest events from the Rust SMTP server.
   * The handler must call sendScramCredentialResult() with the correlationId.
   */
  public onScramCredentialRequest(handler: (data: IScramCredentialRequestEvent) => void): void {
    this.bridge.on('management:scramCredentialRequest', handler);
  }
  /** Remove an emailReceived event handler. */
  public offEmailReceived(handler: (data: IEmailReceivedEvent) => void): void {
    this.bridge.off('management:emailReceived', handler);
@@ -476,6 +909,11 @@ export class RustSecurityBridge {
  public offAuthRequest(handler: (data: IAuthRequestEvent) => void): void {
    this.bridge.off('management:authRequest', handler);
  }
  /** Remove a scramCredentialRequest event handler. */
  public offScramCredentialRequest(handler: (data: IScramCredentialRequestEvent) => void): void {
    this.bridge.off('management:scramCredentialRequest', handler);
  }
 }
 // Re-export interfaces for consumers
@@ -494,4 +932,12 @@ export type {
  IEmailData,
  IEmailReceivedEvent,
  IAuthRequestEvent,
  IScramCredentialRequestEvent,
  IOutboundEmail,
  ISmtpSendResult,
  ISmtpSendOptions,
  ISmtpSendRawOptions,
  ISmtpVerifyOptions,
  ISmtpVerifyResult,
  ISmtpPoolStatus,
 };
--- a/ts/security/index.ts
+++ b/ts/security/index.ts
@@ -22,6 +22,8 @@ export {
 export {
  RustSecurityBridge,
  BridgeState,
  type IBridgeResilienceConfig,
  type IDkimVerificationResult,
  type ISpfResult,
  type IDmarcResult,
@@ -30,4 +32,9 @@ export {
  type IBounceDetection,
  type IRustReputationResult,
  type IVersionInfo,
  type IOutboundEmail,
  type ISmtpSendResult,
  type ISmtpSendOptions,
  type ISmtpVerifyResult,
  type ISmtpPoolStatus,
 } from './classes.rustsecuritybridge.js';
Author	SHA1	Message	Date
Juergen Kunz	76d898b648	v5.1.1 Some checks failed CI / Type Check & Lint (push) Failing after 4s Details CI / Build Test (Current Platform) (push) Failing after 4s Details CI / Build All Platforms (push) Failing after 4s Details Publish to npm / npm-publish (push) Failing after 5s Details Release / build-and-release (push) Failing after 4s Details	2026-02-11 10:16:30 +00:00
Juergen Kunz	b422639c34	fix(release): no changes	2026-02-11 10:16:30 +00:00
Juergen Kunz	c45ba2a7b4	v5.1.0 Some checks failed CI / Type Check & Lint (push) Failing after 4s Details CI / Build Test (Current Platform) (push) Failing after 4s Details CI / Build All Platforms (push) Failing after 7s Details Publish to npm / npm-publish (push) Failing after 6s Details Release / build-and-release (push) Failing after 4s Details	2026-02-11 10:11:43 +00:00
Juergen Kunz	b10597fd5e	feat(mailer-smtp): add SCRAM-SHA-256 auth, Ed25519 DKIM, opportunistic TLS, SNI cert selection, pipelining and delivery/bridge improvements	2026-02-11 10:11:43 +00:00
Juergen Kunz	7908cbaefa	v5.0.0 Some checks failed CI / Type Check & Lint (push) Failing after 4s Details CI / Build Test (Current Platform) (push) Failing after 4s Details CI / Build All Platforms (push) Failing after 4s Details Publish to npm / npm-publish (push) Failing after 5s Details Release / build-and-release (push) Failing after 4s Details	2026-02-11 07:55:28 +00:00
Juergen Kunz	526dcb4dac	BREAKING CHANGE(mail): remove DMARC and DKIM verifier implementations and MTA error classes; introduce DkimManager and EmailActionExecutor; simplify SPF verifier and update routing exports and tests	2026-02-11 07:55:28 +00:00
Juergen Kunz	cf8fcb6efa	v4.1.1 Some checks failed CI / Type Check & Lint (push) Failing after 4s Details CI / Build Test (Current Platform) (push) Failing after 4s Details CI / Build All Platforms (push) Failing after 4s Details Publish to npm / npm-publish (push) Failing after 5s Details Release / build-and-release (push) Failing after 5s Details	2026-02-11 07:36:54 +00:00
Juergen Kunz	2088c9f76e	fix(readme): clarify architecture and IPC, document outbound flow and testing, and update module and crate descriptions in README	2026-02-11 07:36:54 +00:00
Juergen Kunz	7853ef67b6	v4.1.0 Some checks failed CI / Type Check & Lint (push) Failing after 4s Details CI / Build Test (Current Platform) (push) Failing after 4s Details CI / Build All Platforms (push) Failing after 4s Details Publish to npm / npm-publish (push) Failing after 5s Details Release / build-and-release (push) Failing after 4s Details	2026-02-11 07:31:08 +00:00
Juergen Kunz	f7af8c4534	feat(e2e-tests): add Node.js end-to-end tests covering server lifecycle, inbound SMTP handling, outbound delivery and routing actions	2026-02-11 07:31:08 +00:00
Juergen Kunz	a7ea1d86cb	v4.0.0 Some checks failed CI / Type Check & Lint (push) Failing after 4s Details CI / Build Test (Current Platform) (push) Failing after 4s Details CI / Build All Platforms (push) Failing after 4s Details Publish to npm / npm-publish (push) Failing after 6s Details Release / build-and-release (push) Failing after 5s Details	2026-02-11 07:17:05 +00:00
Juergen Kunz	27bab5f345	BREAKING CHANGE(smtp-client): Replace the legacy TypeScript SMTP client with a new Rust-based SMTP client and IPC bridge for outbound delivery	2026-02-11 07:17:05 +00:00
Juergen Kunz	fc4877e06b	v3.0.0 Some checks failed CI / Type Check & Lint (push) Failing after 4s Details CI / Build Test (Current Platform) (push) Failing after 4s Details CI / Build All Platforms (push) Failing after 4s Details Publish to npm / npm-publish (push) Failing after 5s Details Release / build-and-release (push) Failing after 4s Details	2026-02-10 23:23:00 +00:00
Juergen Kunz	36006191fc	BREAKING CHANGE(security): implement resilience and lifecycle management for RustSecurityBridge (auto-restart, health checks, state machine and eventing); remove legacy TS SMTP test helper and DNSManager; remove deliverability IP-warmup/sender-reputation integrations and related types; drop unused dependencies	2026-02-10 23:23:00 +00:00