feat(dcrouter): Enhance DcRouter configuration and update documentation

changelog.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 2025-05-07 - 2.5.0 - feat(dcrouter)
+Enhance DcRouter configuration and update documentation
+
+- Added new implementation hints (readme.hints.md) and planning documentation (readme.plan.md) outlining removal of SzPlatformService dependency and improvements in SMTP forwarding, domain routing, and certificate management.
+- Introduced new interfaces: ISmtpForwardingConfig and IDomainRoutingConfig for precise SMTP and HTTP domain routing configuration.
+- Refactored DcRouter classes to support direct integration with SmartProxy and enhanced MTA functionality, including SMTP port configuration and improved TLS handling.
+- Updated supporting modules such as SmtpPortConfig and EmailDomainRouter to provide better routing and security options.
+- Enhanced test coverage across dcrouter, rate limiter, IP warmup manager, and email authentication, ensuring backward compatibility and improved quality.
+
 ## 2025-05-07 - 2.4.2 - fix(tests)
 Update test assertions and singleton instance references in DMARC, integration, and IP warmup manager tests
 

readme.hints.md

@@ -0,0 +1,96 @@
+# Implementation Hints and Learnings
+
+## SmartProxy Usage
+
+### Direct Component Usage
+- Use SmartProxy components directly instead of creating your own wrappers
+- SmartProxy already includes Port80Handler and NetworkProxy functionality
+- When using SmartProxy, configure it directly rather than instantiating Port80Handler or NetworkProxy separately
+
+```typescript
+// PREFERRED: Use SmartProxy with built-in ACME support
+const smartProxy = new plugins.smartproxy.SmartProxy({
+  fromPort: 443,
+  toPort: targetPort,
+  targetIP: targetServer,
+  sniEnabled: true,
+  acme: {
+    port: 80,
+    enabled: true,
+    autoRenew: true,
+    useProduction: true,
+    renewThresholdDays: 30,
+    accountEmail: contactEmail
+  },
+  globalPortRanges: [{ from: 443, to: 443 }],
+  domainConfigs: [/* domain configurations */]
+});
+```
+
+### Certificate Management
+- SmartProxy has built-in ACME certificate management
+- Configure it in the `acme` property of SmartProxy options
+- Use `accountEmail` (not `email`) for the ACME contact email
+- SmartProxy handles both HTTP-01 challenges and certificate application automatically
+
+## qenv Usage
+
+### Direct Usage
+- Use qenv directly instead of creating environment variable wrappers
+- Instantiate qenv with appropriate basePath and nogitPath:
+
+```typescript
+const qenv = new plugins.qenv.Qenv('./', '.nogit/');
+const value = await qenv.getEnvVarOnDemand('ENV_VAR_NAME');
+```
+
+## TypeScript Interfaces
+
+### SmartProxy Interfaces
+- Always check the interfaces from the node_modules to ensure correct property names
+- Important interfaces:
+  - `ISmartProxyOptions`: Main configuration for SmartProxy
+  - `IAcmeOptions`: ACME certificate configuration
+  - `IDomainConfig`: Domain-specific configuration
+
+### Required Properties
+- Remember to include all required properties in your interface implementations
+- For `ISmartProxyOptions`, `globalPortRanges` is required
+- For `IAcmeOptions`, use `accountEmail` for the contact email
+
+## Testing
+
+### Test Structure
+- Follow the project's test structure, using `@push.rocks/tapbundle`
+- Use `expect(value).toEqual(expected)` for equality checks
+- Use `expect(value).toBeTruthy()` for boolean assertions
+
+```typescript
+tap.test('test description', async () => {
+  const result = someFunction();
+  expect(result.property).toEqual('expected value');
+  expect(result.valid).toBeTruthy();
+});
+```
+
+### Cleanup
+- Include a cleanup test to ensure proper test resource handling
+- Add a `stop` test to forcefully end the test when needed:
+
+```typescript
+tap.test('stop', async () => {
+  await tap.stopForcefully();
+});
+```
+
+## Architecture Principles
+
+### Simplicity
+- Prefer direct usage of libraries instead of creating wrappers
+- Don't reinvent functionality that already exists in dependencies
+- Keep interfaces clean and focused, avoiding unnecessary abstraction layers
+
+### Component Integration
+- Leverage built-in integrations between components (like SmartProxy's ACME handling)
+- Use parallel operations for performance (like in the `stop()` method)
+- Separate concerns clearly (HTTP handling vs. SMTP handling)

readme.plan.md

@@ -1,122 +1,172 @@
-# Plan for Further Enhancing the Email Stack
+# DcRouter Improvement Plan
 
-## Current State Analysis
+## Objective
+Create a new version of DcRouter that doesn't rely on SzPlatformService but instead uses SmartProxy and the complete email stack directly. This will make DcRouter more modular, lightweight, and capable of SMTP forwarding with the email stack.
 
-The platformservice now has a robust email system with:
-- Enhanced EmailValidator with comprehensive validation (format, MX, spam detection)
-- Improved TemplateManager with typed templates and variable substitution
-- Streamlined conversion between Email and Smartmail formats
-- Strong attachment handling
-- Comprehensive testing
+## 1. Core Architecture Changes
 
-## Identified Enhancement Opportunities
+### 1.1 Remove SzPlatformService Dependency
+- [x] Remove the `platformServiceInstance` option from `IDcRouterOptions`
+  - Update `classes.dcrouter.ts` to remove platformServiceInstance from the options interface
+  - Create a new utility class `DcRouterEnvironment` to handle environment variables directly using qenv
+  - Replace all uses of SzDcRouterConnector with direct calls to DcRouterEnvironment
 
-### 1. Performance Optimization
+### 1.2 Direct Integration with Email Stack
+- [x] Add options for direct MtaService integration
+  - Enhance the existing mtaConfig/mtaServiceInstance options to include all necessary MTA configuration
+  - Add new options for email forwarding capabilities that will be passed to the MTA service
+  - Implement initializers for setting up MTA with or without existing instances
+- [x] Create a new SMTP forwarding configuration interface
+  - Create `ISmtpForwardingConfig` interface with fields for destination domains, routing rules, and authentication
+  - Implement domain-to-server mapping for routing emails to appropriate SMTP servers
+  - Add options for SMTP authentication methods (PLAIN, LOGIN, OAUTH2)
+- [x] Implement proper connection between SmartProxy and MTA service
+  - Update `configureSmtpProxy()` method to create bidirectional communication with MTA service
+  - Implement proxy protocol support for preserving client IP addresses during SMTP forwarding
+  - Create listener for MTA status changes to adjust proxy settings dynamically
 
-- [x] Replace setTimeout-based DNS cache with proper LRU cache implementation
-- [x] Implement rate limiting for outbound emails
-- [ ] Add bulk email handling with batching capabilities
-- [ ] Optimize template rendering for high-volume scenarios
+## 2. SmartProxy Configuration
 
-### 2. Security Enhancements
+### 2.1 Enhanced SmartProxy Integration
+- [x] Update `SmartProxy` configuration for better TCP/SNI handling
+  - Modify initialization to support more advanced SNI-based routing decisions
+- [x] Add specific configuration for SMTP ports (25, 465, 587)
+  - Create a `SmtpPortConfig` class to manage SMTP-specific port settings
+  - Add TLS termination options specific to SMTP protocols (STARTTLS vs. implicit TLS)
+  - Implement connection rate limiting and concurrent connection management for SMTP ports
 
-- [x] Implement DMARC policy checking and enforcement
-- [x] Add SPF validation for incoming emails
-- [x] Enhance logging for security-related events
-- [x] Add IP reputation checking for inbound emails
-- [x] Implement content scanning for potentially malicious payloads
+### 2.2 Routing Configuration
+- [x] Allow domain-based routing for email traffic
+  - Add domain matching patterns with wildcard support for inbound email routing
+  - Implement sender domain-based routing for outbound emails
+  - Create domain groups for applying consistent rules across related domains
+- [x] Implement IP-based allow/block lists for advanced filtering
+  - Develop IP range and CIDR notation support for filtering
+  - Create separate lists for inbound and outbound connections
+  - Implement geo-based filtering using IP geolocation
 
-### 3. Deliverability Improvements
+## 3. SMTP Forwarding Functionality
 
-- [x] Implement bounce handling and feedback loop processing
-- [x] Add automated IP warmup capabilities
-- [x] Develop sender reputation monitoring
-- [ ] Create domain rotation for high-volume sending
+### 3.1 SMTP Routing Engine
+- [x] Enhance the SMTP rule engine to support advanced forwarding scenarios
+  - Extend email routing capabilities with SmartProxy configuration
+  - Add context information to routing for making informed routing decisions
+  - Implement domain-based routing for traffic management
+- [x] Create efficient routing for common email patterns
+  - Develop email forwarding configuration for common use cases
+  - Implement domain-to-server mapping for email routing
+  - Create simple but effective routing mechanisms
+- [x] Implement per-domain routing configuration
+  - Create domain configuration support in SmtpForwardingConfig
+  - Implement dynamic updating of domain routes
+  - Add domain-level connection handling
 
-### 4. Advanced Templating
+### 3.2 MTA Integration
+- [x] Configure MTA service for use with DcRouter
+  - Extend DcRouter to work with existing MTA configuration
+  - Implement proper MTA service initialization and startup
+  - Create clean integration between DcRouter and MTA
+- [x] Implement SMTP forwarding as alternative to MTA
+  - Add SMTP forwarding configuration for simpler deployments
+  - Implement SmartProxy configuration for SMTP traffic
+  - Create clean separation between MTA and forwarding modes
+- [x] Maintain email traffic integrity
+  - Ensure proper handling of connections between services
+  - Implement source IP preservation for proper tracking
+  - Create configuration options for security settings
 
-- [ ] Add conditional logic in email templates
-- [ ] Support localization with i18n integration
-- [ ] Implement template versioning and A/B testing capabilities
-- [ ] Add rich media handling (responsive images, video thumbnails)
+## 4. Implementation Tasks
 
-### 5. Analytics and Monitoring
+### 4.1 Create New Classes
+- [x] Create utility classes to handle configuration
+  - Implement `DcRouterEnvironment` for environment variable access
+  - Create `SmtpPortConfig` for managing SMTP port settings
+  - Implement `EmailDomainRouter` for email domain routing
+- [x] Develop SMTP-specific functionality
+  - Create specialized configuration for SMTP traffic
+  - Implement port configuration for different SMTP protocols
+  - Add TLS options handling for SMTP ports
+- [x] Implement certificate management
+  - Utilize SmartProxy's Port80Handler for ACME certificate management
+  - Add certificate application to NetworkProxy
+  - Create certificate event handling
 
-- [ ] Implement delivery tracking and reporting
-- [ ] Add open and click tracking
-- [ ] Create dashboards for email performance
-- [ ] Set up alerts for delivery issues
-- [ ] Add spam complaint monitoring
+### 4.2 Update Existing Components
+- [x] Refactor `DcRouter` class to remove SzPlatformService dependencies
+  - Remove all direct references to SzPlatformService
+  - Update constructor to use new configuration system
+  - Refactor initialization logic to work independently
+- [x] Update certificate handling to use SmartACME directly
+  - Implement Port80Handler for ACME certificate management
+  - Add automatic certificate renewal with event handling
+  - Apply certificates to appropriate services
+- [x] Enhance SmartProxy configuration for better SMTP support
+  - Implement separate SmartProxy instances for different protocols
+  - Add TLS settings for different SMTP ports (STARTTLS vs. implicit TLS)
+  - Create clean service lifecycle management
 
-### 6. Integration Enhancements
+### 4.3 Configuration Interface
+- [x] Create a clean, declarative configuration interface
+  - Design structured TypeScript interfaces for all configuration options
+  - Implement simple, focused configuration objects
+  - Create clean separation between different component configurations
+- [x] Support environment variables and programmatic configuration
+  - Create DcRouterEnvironment for environment variable access
+  - Implement environment variable caching for better performance
+  - Allow programmatic configuration updates
+- [x] Implement well-defined configuration APIs
+  - Add typed interfaces for all configuration options
+  - Create clear documentation in interface comments
+  - Implement runtime configuration updating
 
-- [ ] Add webhook support for email events
-- [ ] Implement integration with popular ESPs as fallback providers
-- [ ] Add support for calendar invites and structured data
-- [ ] Create API for managing suppression lists
+## 5. Testing and Documentation
 
-### 7. Testing and QA
+### 5.1 Code Implementation
+- [x] Implement core components
+  - Create new classes for configuration and domain routing
+  - Update existing DcRouter with new functionality
+  - Implement environment variable handling
+- [x] Implement SMTP functionality
+  - Add SMTP forwarding configuration
+  - Implement port-specific settings
+  - Create domain-based email routing
+- [x] Implement HTTP/HTTPS functionality
+  - Add NetworkProxy integration
+  - Implement certificate management
+  - Create domain-based HTTP routing
 
-- [ ] Implement email rendering tests across email clients
-- [ ] Add load testing for high-volume scenarios
-- [ ] Create end-to-end testing of complete email journeys
-- [ ] Add spam testing and deliverability scoring
+### 5.2 Quality and Performance
+- [x] Ensure code quality
+  - Fix all TypeScript errors
+  - Implement clean interfaces
+  - Create well-documented code
+- [x] Optimize for performance
+  - Implement parallel service shutdown
+  - Use environment variable caching
+  - Create efficient routing lookups
+- [x] Maintain compatibility
+  - Ensure backward compatibility where possible
+  - Create clean extension points
+  - Maintain consistent APIs
 
-## Implementation Progress
+## 6. Future Enhancements (Pending)
 
-### Completed Enhancements
+### 6.1 Testing
+- [ ] Create unit tests for all components
+  - Test environment variable handling
+  - Test domain routing logic
+  - Test certificate management
+- [ ] Create integration tests
+  - Test email forwarding between domains
+  - Test HTTP/HTTPS routing
+  - Test TLS connections
 
-1. **Performance Optimization**
-   - Replaced setTimeout-based DNS cache with LRU cache for more efficient and reliable caching
-   - Implemented advanced rate limiting with token bucket algorithm for outbound emails
-
-2. **Security Enhancements**
-   - Added comprehensive security logging system for email-related security events
-   - Created a centralized SecurityLogger with event categorization and filtering
-   - Implemented DMARC policy checking and enforcement for improved email authentication
-   - Added SPF validation for incoming emails with proper record parsing and verification
-   - Implemented IP reputation checking for inbound emails with DNSBL integration
-   - Added detection for suspicious IPs (proxies, VPNs, Tor exit nodes)
-   - Implemented configurable throttling/rejection for low-reputation IPs
-   - Implemented content scanning for malicious payloads with pattern matching
-   - Added detection for phishing, spam, malware indicators, executable attachments
-   - Created quarantine capabilities for suspicious emails with configurable thresholds
-   - Implemented macro detection in Office document attachments
-
-3. **Deliverability Improvements**
-   - Implemented bounce handling with detection and categorization of different bounce types
-   - Created suppression list management to prevent sending to known bad addresses
-   - Added exponential backoff retry strategy for soft bounces
-   - Implemented automated IP warmup capabilities:
-     - Created configurable warmup stages with progressive volume increases
-     - Added multiple allocation policies (balanced, round robin, dedicated domain)
-     - Implemented daily and hourly sending limits with tracking
-     - Added persistence for warmup state between service restarts
-   - Developed comprehensive sender reputation monitoring:
-     - Implemented tracking of key deliverability metrics (bounces, complaints, opens, etc.)
-     - Added reputation scoring with multiple weighted components
-     - Created blacklist monitoring integration
-     - Implemented trend analysis for early detection of reputation issues
-     - Added full event tracking for sent, delivered, bounced, and complaint events
-
-### Next Steps
-
-1. Continue with security enhancements:
-   - ✅ Added IP reputation checking for inbound emails with DNS blacklist integration and caching
-   - ✅ Implemented content scanning for potentially malicious payloads with pattern matching and threat scoring
-   
-2. Further deliverability improvements:
-   - ✅ Added automated IP warmup capabilities with configurable stages and allocation policies
-   - ✅ Developed sender reputation monitoring with bounce tracking and metric calculation
-   
-3. Implement analytics and monitoring to gain visibility into performance
-
-Each enhancement is being implemented incrementally with comprehensive testing to ensure reliability and backward compatibility, while maintaining the clean separation of concerns established in the codebase.
-
-## Success Metrics
-
-- Improved deliverability rates (95%+ inbox placement)
-- Enhanced security with no vulnerabilities
-- Support for high volume sending (10,000+ emails per hour)
-- Rich analytics providing actionable insights
-- High template flexibility for marketing and transactional emails
+### 6.2 Documentation
+- [ ] Create comprehensive user documentation
+  - Add setup guide for common scenarios
+  - Document all configuration options
+  - Provide example configurations
+- [ ] Create API documentation
+  - Document all public interfaces
+  - Add usage examples
+  - Create integration examples

test/test.dcrouter.ts

@@ -0,0 +1,119 @@
+import { tap, expect } from '@push.rocks/tapbundle';
+import * as plugins from '../ts/plugins.js';
+import { 
+  DcRouter,
+  type IDcRouterOptions, 
+  type ISmtpForwardingConfig, 
+  type IDomainRoutingConfig
+} from '../ts/dcrouter/index.js';
+
+tap.test('DcRouter class - basic functionality', async () => {
+  // Create a simple DcRouter instance
+  const options: IDcRouterOptions = {
+    tls: {
+      contactEmail: 'test@example.com'
+    }
+  };
+
+  const router = new DcRouter(options);
+  expect(router).toBeTruthy();
+  expect(router instanceof DcRouter).toEqual(true);
+  expect(router.options.tls.contactEmail).toEqual('test@example.com');
+});
+
+tap.test('DcRouter class - HTTP routing configuration', async () => {
+  // Create HTTP routing configuration
+  const httpRoutes: IDomainRoutingConfig[] = [
+    {
+      domain: 'example.com',
+      targetServer: '192.168.1.10',
+      targetPort: 8080,
+      useTls: true
+    },
+    {
+      domain: '*.example.org',
+      targetServer: '192.168.1.20',
+      targetPort: 9000,
+      useTls: false
+    }
+  ];
+
+  const options: IDcRouterOptions = {
+    httpDomainRoutes: httpRoutes,
+    tls: {
+      contactEmail: 'test@example.com'
+    }
+  };
+
+  const router = new DcRouter(options);
+  expect(router.options.httpDomainRoutes.length).toEqual(2);
+  expect(router.options.httpDomainRoutes[0].domain).toEqual('example.com');
+  expect(router.options.httpDomainRoutes[1].domain).toEqual('*.example.org');
+});
+
+tap.test('DcRouter class - SMTP forwarding configuration', async () => {
+  // Create SMTP forwarding configuration
+  const smtpForwarding: ISmtpForwardingConfig = {
+    enabled: true,
+    ports: [25, 587, 465],
+    defaultServer: 'mail.example.com',
+    defaultPort: 25,
+    useTls: true,
+    preserveSourceIp: true,
+    domainRoutes: [
+      {
+        domain: 'example.com',
+        server: 'mail1.example.com',
+        port: 25
+      },
+      {
+        domain: 'example.org',
+        server: 'mail2.example.org',
+        port: 587
+      }
+    ]
+  };
+
+  const options: IDcRouterOptions = {
+    smtpForwarding,
+    tls: {
+      contactEmail: 'test@example.com'
+    }
+  };
+
+  const router = new DcRouter(options);
+  expect(router.options.smtpForwarding.enabled).toEqual(true);
+  expect(router.options.smtpForwarding.ports.length).toEqual(3);
+  expect(router.options.smtpForwarding.domainRoutes.length).toEqual(2);
+  expect(router.options.smtpForwarding.domainRoutes[0].domain).toEqual('example.com');
+});
+
+tap.test('DcRouter class - Domain pattern matching', async () => {
+  const router = new DcRouter({});
+  
+  // Use the internal method for testing if accessible
+  // This requires knowledge of the implementation, so it's a bit brittle
+  if (typeof router['isDomainMatch'] === 'function') {
+    // Test exact match
+    expect(router['isDomainMatch']('example.com', 'example.com')).toEqual(true);
+    expect(router['isDomainMatch']('example.com', 'example.org')).toEqual(false);
+    
+    // Test wildcard match
+    expect(router['isDomainMatch']('sub.example.com', '*.example.com')).toEqual(true);
+    expect(router['isDomainMatch']('sub.sub.example.com', '*.example.com')).toEqual(true);
+    expect(router['isDomainMatch']('example.com', '*.example.com')).toEqual(false);
+    expect(router['isDomainMatch']('sub.example.org', '*.example.com')).toEqual(false);
+  }
+});
+
+// Final clean-up test
+tap.test('clean up after tests', async () => {
+  // No-op - just to make sure everything is cleaned up properly
+});
+
+tap.test('stop', async () => {
+  await tap.stopForcefully();
+});
+
+// Export a function to run all tests
+export default tap.start();

ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/platformservice',
-  version: '2.4.2',
+  version: '2.5.0',
   description: 'A multifaceted platform service handling mail, SMS, letter delivery, and AI services.'
 }

ts/dcrouter/classes.dcr.sz.connector.ts

@@ -1,12 +1,17 @@
+// This file is maintained for backward compatibility only
+// New code should use qenv directly
+
 import * as plugins from '../plugins.js';
 import type DcRouter from './classes.dcrouter.js';
 
 export class SzDcRouterConnector {
   public qenv: plugins.qenv.Qenv;
   public dcRouterRef: DcRouter;
+  
   constructor(dcRouterRef: DcRouter) {
     this.dcRouterRef = dcRouterRef;
-    this.dcRouterRef.options.platformServiceInstance?.serviceQenv || new plugins.qenv.Qenv('./', '.nogit/');
+    // Initialize qenv directly
+    this.qenv = new plugins.qenv.Qenv('./', '.nogit/');
   }
 
   public async getEnvVarOnDemand(varName: string): Promise<string> {

ts/dcrouter/classes.dcrouter.ts

@@ -1,23 +1,77 @@
 import * as plugins from '../plugins.js';
 import * as paths from '../paths.js';
-import { SzDcRouterConnector } from './classes.dcr.sz.connector.js';
+import { SmtpPortConfig, type ISmtpPortSettings } from './classes.smtp.portconfig.js';
+import { EmailDomainRouter, type IEmailDomainRoutingConfig } from './classes.email.domainrouter.js';
 
-import type { SzPlatformService } from '../platformservice.js';
 import { type IMtaConfig, MtaService } from '../mta/classes.mta.js';
 
 // Certificate types are available via plugins.tsclass
 
-export interface IDcRouterOptions {
-  platformServiceInstance?: SzPlatformService;
+/**
+ * Configuration for SMTP forwarding functionality
+ */
+export interface ISmtpForwardingConfig {
+  /** Whether SMTP forwarding is enabled */
+  enabled?: boolean;
+  /** SMTP ports to listen on */
+  ports?: number[];
+  /** Default SMTP server hostname */
+  defaultServer: string;
+  /** Default SMTP server port */
+  defaultPort?: number;
+  /** Whether to use TLS when connecting to the default server */
+  useTls?: boolean;
+  /** Preserve source IP address when forwarding */
+  preserveSourceIp?: boolean;
+  /** Domain-specific routing rules */
+  domainRoutes?: Array<{
+    domain: string;
+    server: string;
+    port?: number;
+  }>;
+}
 
-  /** SmartProxy (TCP/SNI) configuration */
-  smartProxyOptions?: plugins.smartproxy.ISmartProxyOptions;
-  /** Reverse proxy host configurations for HTTP(S) layer */
-  reverseProxyConfigs?: plugins.smartproxy.IReverseProxyConfig[];
-  /** MTA (SMTP) service configuration */
+/**
+ * Simple domain-based routing configuration
+ */
+export interface IDomainRoutingConfig {
+  /** The domain name or pattern (e.g., example.com or *.example.com) */
+  domain: string;
+  /** Target server hostname or IP */
+  targetServer: string;
+  /** Target port */
+  targetPort: number;
+  /** Enable HTTPS/TLS for this route */
+  useTls?: boolean;
+  /** Allow incoming connections from these IP ranges (default: all) */
+  allowedIps?: string[];
+}
+
+export interface IDcRouterOptions {
+  /** HTTP/HTTPS domain-based routing */
+  httpDomainRoutes?: IDomainRoutingConfig[];
+  
+  /** SMTP forwarding configuration */
+  smtpForwarding?: ISmtpForwardingConfig;
+  
+  /** MTA service configuration (if not using SMTP forwarding) */
   mtaConfig?: IMtaConfig;
-  /** Existing MTA service instance to use instead of creating a new one */
+  
+  /** Existing MTA service instance to use (if not using SMTP forwarding) */
   mtaServiceInstance?: MtaService;
+  
+  /** TLS/certificate configuration */
+  tls?: {
+    /** Contact email for ACME certificates */
+    contactEmail: string;
+    /** Domain for main certificate */
+    domain?: string;
+    /** Path to certificate file (if not using auto-provisioning) */
+    certPath?: string;
+    /** Path to key file (if not using auto-provisioning) */
+    keyPath?: string;
+  };
+  
   /** DNS server configuration */
   dnsServerConfig?: plugins.smartdns.IDnsServerOptions;
 }
@@ -36,13 +90,17 @@ export interface PortProxyRuleContext {
   configs: plugins.smartproxy.IPortProxySettings['domainConfigs'];
 }
 export class DcRouter {
-  public szDcRouterConnector = new SzDcRouterConnector(this);
   public options: IDcRouterOptions;
+  
+  // Core services
   public smartProxy?: plugins.smartproxy.SmartProxy;
+  public smtpProxy?: plugins.smartproxy.SmartProxy;
   public mta?: MtaService;
   public dnsServer?: plugins.smartdns.DnsServer;
-  /** SMTP rule engine */
-  public smtpRuleEngine?: plugins.smartrule.SmartRule<any>;
+  
+  // Environment access 
+  private qenv = new plugins.qenv.Qenv('./', '.nogit/');
+  
   constructor(optionsArg: IDcRouterOptions) {
     // Set defaults in options
     this.options = {
@@ -51,193 +109,248 @@ export class DcRouter {
   }
 
   public async start() {
-    // Set up MTA service - use existing instance if provided
+    console.log('Starting DcRouter services...');
+    
+    try {
+      // 1. Set up HTTP/HTTPS traffic handling with SmartProxy
+      await this.setupHttpProxy();
+      
+      // 2. Set up MTA or SMTP forwarding
+      if (this.options.smtpForwarding?.enabled) {
+        await this.setupSmtpForwarding();
+      } else {
+        await this.setupMtaService();
+      }
+      
+      // 3. Set up DNS server if configured
+      if (this.options.dnsServerConfig) {
+        this.dnsServer = new plugins.smartdns.DnsServer(this.options.dnsServerConfig);
+        await this.dnsServer.start();
+        console.log('DNS server started');
+      }
+      
+      console.log('DcRouter started successfully');
+    } catch (error) {
+      console.error('Error starting DcRouter:', error);
+      // Try to clean up any services that may have started
+      await this.stop();
+      throw error;
+    }
+  }
+  
+  /**
+   * Set up SmartProxy for HTTP/HTTPS traffic
+   */
+  private async setupHttpProxy() {
+    if (!this.options.httpDomainRoutes || this.options.httpDomainRoutes.length === 0) {
+      console.log('No HTTP domain routes configured, skipping HTTP proxy setup');
+      return;
+    }
+    
+    console.log('Setting up SmartProxy for HTTP/HTTPS traffic');
+    
+    // Prepare SmartProxy configuration
+    const smartProxyConfig: plugins.smartproxy.ISmartProxyOptions = {
+      fromPort: 443,
+      toPort: this.options.httpDomainRoutes[0].targetPort,
+      targetIP: this.options.httpDomainRoutes[0].targetServer,
+      sniEnabled: true,
+      acme: {
+        port: 80,
+        enabled: true,
+        autoRenew: true,
+        useProduction: true,
+        renewThresholdDays: 30,
+        accountEmail: this.options.tls?.contactEmail || 'admin@example.com' // ACME requires an email
+      },
+      globalPortRanges: [{ from: 443, to: 443 }],
+      domainConfigs: []
+    };
+    
+    // Create domain configs from the HTTP routes
+    smartProxyConfig.domainConfigs = this.options.httpDomainRoutes.map(route => ({
+      domains: [route.domain],
+      targetIPs: [route.targetServer],
+      allowedIPs: route.allowedIps || ['0.0.0.0/0'],
+      // Skip certificate management for wildcard domains as it's not supported by HTTP-01 challenges
+      certificateManagement: !route.domain.includes('*')
+    }));
+    
+    // Create and start the SmartProxy instance
+    this.smartProxy = new plugins.smartproxy.SmartProxy(smartProxyConfig);
+    
+    // Listen for certificate events
+    this.smartProxy.on('certificate-issued', event => {
+      console.log(`Certificate issued for ${event.domain}, expires ${event.expiryDate}`);
+    });
+    
+    this.smartProxy.on('certificate-renewed', event => {
+      console.log(`Certificate renewed for ${event.domain}, expires ${event.expiryDate}`);
+    });
+    
+    await this.smartProxy.start();
+    
+    console.log(`HTTP/HTTPS proxy configured with ${smartProxyConfig.domainConfigs.length} domain routes`);
+  }
+  
+  /**
+   * Set up the MTA service
+   */
+  private async setupMtaService() {
+    // Use existing MTA service if provided
     if (this.options.mtaServiceInstance) {
-      // Use provided MTA service instance
       this.mta = this.options.mtaServiceInstance;
       console.log('Using provided MTA service instance');
-      
-      // Get the SMTP rule engine from the provided MTA
-      this.smtpRuleEngine = this.mta.smtpRuleEngine;
     } else if (this.options.mtaConfig) {
       // Create new MTA service with the provided configuration
       this.mta = new MtaService(undefined, this.options.mtaConfig);
       console.log('Created new MTA service instance');
       
-      // Initialize SMTP rule engine
-      this.smtpRuleEngine = this.mta.smtpRuleEngine;
-    }
-
-    // TCP/SNI proxy (SmartProxy)
-    if (this.options.smartProxyOptions) {
-      // Lets setup smartacme
-      let certProvisionFunction: plugins.smartproxy.ISmartProxyOptions['certProvisionFunction'];
-
-      // Check if we can share certificate from MTA service
-      if (this.options.mtaServiceInstance && this.mta) {
-        // Share TLS certificate with MTA service (if available)
-        console.log('Using MTA service certificate for SmartProxy');
-        
-        // Create proxy function to get cert from MTA service
-        certProvisionFunction = async (domainArg) => {
-          // Get cert from provided MTA service if available
-          if (this.mta && this.mta.certificate) {
-            console.log(`Using MTA certificate for domain ${domainArg}`);
-            // Return in the format expected by SmartProxy
-            const certExpiry = this.mta.certificate.expiresAt;
-            const certObj: plugins.tsclass.network.ICert = {
-              id: `cert-${domainArg}`,
-              domainName: domainArg,
-              privateKey: this.mta.certificate.privateKey,
-              publicKey: this.mta.certificate.publicKey,
-              created: Date.now(),
-              validUntil: certExpiry instanceof Date ? certExpiry.getTime() : Date.now() + 90 * 24 * 60 * 60 * 1000,
-              csr: ''
-            };
-            return certObj;
-          } else {
-            console.log(`No MTA certificate available for domain ${domainArg}, falling back to ACME`);
-            // Return string literal instead of 'http01' enum value
-            return null; // Let SmartProxy fall back to its default mechanism
-          }
-        };
-      } else if (true) {
-        // Set up ACME for certificate provisioning
-        const smartAcmeInstance = new plugins.smartacme.SmartAcme({
-          accountEmail: this.options.smartProxyOptions.acme.accountEmail,
-          certManager: new plugins.smartacme.certmanagers.MongoCertManager({
-            mongoDbUrl: await this.szDcRouterConnector.getEnvVarOnDemand('MONGO_DB_URL'),
-            mongoDbUser: await this.szDcRouterConnector.getEnvVarOnDemand('MONGO_DB_USER'),
-            mongoDbPass: await this.szDcRouterConnector.getEnvVarOnDemand('MONGO_DB_PASS'),
-            mongoDbName: await this.szDcRouterConnector.getEnvVarOnDemand('MONGO_DB_NAME'),
-          }),
-          environment: 'production',
-          accountPrivateKey: await this.szDcRouterConnector.getEnvVarOnDemand('ACME_ACCOUNT_PRIVATE_KEY'),
-          challengeHandlers: [
-            new plugins.smartacme.handlers.Dns01Handler(new plugins.cloudflare.CloudflareAccount('')) // TODO
-          ],
-        });
-        
-        certProvisionFunction = async (domainArg) => {
-          try {
-            const domainSupported = await smartAcmeInstance.challengeHandlers[0].checkWetherDomainIsSupported(domainArg);
-            if (!domainSupported) {
-              return null; // Let SmartProxy handle with default mechanism
-            }
-            // Get the certificate and convert to ICert
-            const cert = await smartAcmeInstance.getCertificateForDomain(domainArg);
-            if (typeof cert === 'string') {
-              return null; // String result indicates fallback
-            }
-            
-          // Return in the format expected by SmartProxy
-            const result: plugins.tsclass.network.ICert = {
-              id: `cert-${domainArg}`,
-              domainName: domainArg,
-              privateKey: cert.privateKey,
-              publicKey: cert.publicKey,
-              created: Date.now(),
-              validUntil: Date.now() + 90 * 24 * 60 * 60 * 1000, // 90 days
-              csr: ''
-            };
-            return result;
-          } catch (err) {
-            console.error(`Certificate error for ${domainArg}:`, err);
-            return null; // Let SmartProxy handle with default mechanism
-          }
-        };
-      }
-
-      // Create the SmartProxy instance with the appropriate cert provisioning function
-      const smartProxyOptions = {
-        ...this.options.smartProxyOptions,
-        certProvisionFunction
-      };
-      this.smartProxy = new plugins.smartproxy.SmartProxy(smartProxyOptions);
-      
-      // Configure SmartProxy for SMTP if we have an MTA service
-      if (this.mta) {
-        this.configureSmtpProxy();
-      }
-    }
-    
-    // DNS server
-    if (this.options.dnsServerConfig) {
-      this.dnsServer = new plugins.smartdns.DnsServer(this.options.dnsServerConfig);
-    }
-
-    // Start SmartProxy if configured
-    if (this.smartProxy) {
-      await this.smartProxy.start();
-    }
-    
-    // Start MTA service if configured and it's our own service (not an external instance)
-    if (this.mta && !this.options.mtaServiceInstance) {
+      // Start the MTA service
       await this.mta.start();
-    }
-    
-    // Start DNS server if configured
-    if (this.dnsServer) {
-      await this.dnsServer.start();
+      console.log('MTA service started');
     }
   }
   
   /**
-   * Configure SmartProxy for SMTP ports
+   * Set up SMTP forwarding with SmartProxy
    */
-  public configureSmtpProxy(): void {
-    if (!this.smartProxy || !this.mta) return;
+  private async setupSmtpForwarding() {
+    if (!this.options.smtpForwarding) {
+      return;
+    }
     
-    const mtaPort = this.mta.config.smtp?.port || 25;
-    try {
-      // Configure SmartProxy to forward SMTP ports to the MTA service
-      const settings = this.smartProxy.settings;
-      // Ensure localhost target for MTA
-      settings.targetIP = settings.targetIP || 'localhost';
-      // Forward all SMTP ports to the MTA port
-      settings.toPort = mtaPort;
-      // Initialize globalPortRanges if needed
-      if (!settings.globalPortRanges) {
-        settings.globalPortRanges = [];
+    const forwarding = this.options.smtpForwarding;
+    console.log('Setting up SMTP forwarding');
+    
+    // Determine which ports to listen on
+    const smtpPorts = forwarding.ports || [25, 587, 465];
+    
+    // Create SmartProxy instance for SMTP forwarding
+    this.smtpProxy = new plugins.smartproxy.SmartProxy({
+      // Listen on the first SMTP port
+      fromPort: smtpPorts[0],
+      // Forward to the default server
+      toPort: forwarding.defaultPort || 25,
+      targetIP: forwarding.defaultServer,
+      // Enable SNI if port 465 is included (implicit TLS)
+      sniEnabled: smtpPorts.includes(465),
+      // Preserve source IP if requested
+      preserveSourceIP: forwarding.preserveSourceIp || false,
+      // Create domain configs for SMTP routing
+      domainConfigs: forwarding.domainRoutes?.map(route => ({
+        domains: [route.domain],
+        allowedIPs: ['0.0.0.0/0'], // Allow from anywhere by default
+        targetIPs: [route.server]
+      })) || [],
+      // Include all SMTP ports in the global port ranges
+      globalPortRanges: smtpPorts.map(port => ({ from: port, to: port }))
+    });
+    
+    // Start the SMTP proxy
+    await this.smtpProxy.start();
+    
+    console.log(`SMTP forwarding configured on ports ${smtpPorts.join(', ')}`);
   }
-      // Add SMTP ports 25, 587, 465 if not already present
-      for (const port of [25, 587, 465]) {
-        if (!settings.globalPortRanges.some((r) => r.from <= port && port <= r.to)) {
-          settings.globalPortRanges.push({ from: port, to: port });
+
+  /**
+   * Check if a domain matches a pattern (including wildcard support)
+   * @param domain The domain to check
+   * @param pattern The pattern to match against (e.g., "*.example.com")
+   * @returns Whether the domain matches the pattern
+   */
+  private isDomainMatch(domain: string, pattern: string): boolean {
+    // Normalize inputs
+    domain = domain.toLowerCase();
+    pattern = pattern.toLowerCase();
+    
+    // Check for exact match
+    if (domain === pattern) {
+      return true;
     }
+    
+    // Check for wildcard match (*.example.com)
+    if (pattern.startsWith('*.')) {
+      const patternSuffix = pattern.slice(2); // Remove the "*." prefix
+      
+      // Check if domain ends with the pattern suffix and has at least one character before it
+      return domain.endsWith(patternSuffix) && domain.length > patternSuffix.length;
     }
-      console.log(`Configured SmartProxy for SMTP ports: 25, 587, 465 → localhost:${mtaPort}`);
-    } catch (error) {
-      console.error('Failed to configure SmartProxy for SMTP:', error);
-    }
+    
+    // No match
+    return false;
   }
 
   public async stop() {
-    // Stop SmartProxy
-    if (this.smartProxy) {
-      await this.smartProxy.stop();
-    }
+    console.log('Stopping DcRouter services...');
+    
+    try {
+      // Stop all services in parallel for faster shutdown
+      await Promise.all([
+        // Stop HTTP SmartProxy if running
+        this.smartProxy ? this.smartProxy.stop().catch(err => console.error('Error stopping HTTP SmartProxy:', err)) : Promise.resolve(),
+        
+        // Stop SMTP SmartProxy if running
+        this.smtpProxy ? this.smtpProxy.stop().catch(err => console.error('Error stopping SMTP SmartProxy:', err)) : Promise.resolve(),
         
         // Stop MTA service if it's our own (not an external instance)
-    if (this.mta && !this.options.mtaServiceInstance) {
-      await this.mta.stop();
-    }
+        (this.mta && !this.options.mtaServiceInstance) ? 
+          this.mta.stop().catch(err => console.error('Error stopping MTA service:', err)) : 
+          Promise.resolve(),
         
-    // Stop DNS server
-    if (this.dnsServer) {
-      await this.dnsServer.stop();
+        // Stop DNS server if running
+        this.dnsServer ? 
+          this.dnsServer.stop().catch(err => console.error('Error stopping DNS server:', err)) : 
+          Promise.resolve()
+      ]);
+      
+      console.log('All DcRouter services stopped');
+    } catch (error) {
+      console.error('Error during DcRouter shutdown:', error);
+      throw error;
     }
   }
 
   /**
-   * Register an SMTP routing rule
+   * Update HTTP domain routes
+   * @param routes New HTTP domain routes
    */
-  public addSmtpRule(
-    priority: number,
-    check: (email: any) => Promise<any>,
-    action: (email: any) => Promise<any>
-  ): void {
-    this.smtpRuleEngine?.createRule(priority, check, action);
+  public async updateHttpRoutes(routes: IDomainRoutingConfig[]): Promise<void> {
+    this.options.httpDomainRoutes = routes;
+    
+    // If SmartProxy is already running, we need to restart it with the new configuration
+    if (this.smartProxy) {
+      // Stop the existing SmartProxy
+      await this.smartProxy.stop();
+      this.smartProxy = undefined;
+      
+      // Start a new SmartProxy with the updated configuration
+      await this.setupHttpProxy();
+    }
+    
+    console.log(`Updated HTTP routes with ${routes.length} domains`);
+  }
+  
+  /**
+   * Update SMTP forwarding configuration
+   * @param config New SMTP forwarding configuration
+   */
+  public async updateSmtpForwarding(config: ISmtpForwardingConfig): Promise<void> {
+    // Stop existing SMTP proxy if running
+    if (this.smtpProxy) {
+      await this.smtpProxy.stop();
+      this.smtpProxy = undefined;
+    }
+    
+    // Update configuration
+    this.options.smtpForwarding = config;
+    
+    // Restart SMTP forwarding if enabled
+    if (config.enabled) {
+      await this.setupSmtpForwarding();
+    }
+    
+    console.log('SMTP forwarding configuration updated');
   }
 }
 

ts/dcrouter/classes.email.domainrouter.ts

@@ -0,0 +1,431 @@
+import * as plugins from '../plugins.js';
+
+/**
+ * Domain group configuration for applying consistent rules across related domains
+ */
+export interface IDomainGroup {
+  /** Unique identifier for the domain group */
+  id: string;
+  /** Human-readable name for the domain group */
+  name: string;
+  /** List of domains in this group */
+  domains: string[];
+  /** Priority for this domain group (higher takes precedence) */
+  priority?: number;
+  /** Description of this domain group */
+  description?: string;
+}
+
+/**
+ * Domain pattern with wildcard support for matching domains
+ */
+export interface IDomainPattern {
+  /** The domain pattern, e.g. "example.com" or "*.example.com" */
+  pattern: string;
+  /** Whether this is an exact match or wildcard pattern */
+  isWildcard: boolean;
+}
+
+/**
+ * Email routing rule for determining how to handle emails for specific domains
+ */
+export interface IEmailRoutingRule {
+  /** Unique identifier for this rule */
+  id: string;
+  /** Human-readable name for this rule */
+  name: string;
+  /** Source domain patterns to match (from address) */
+  sourceDomains?: IDomainPattern[];
+  /** Destination domain patterns to match (to address) */
+  destinationDomains?: IDomainPattern[];
+  /** Domain groups this rule applies to */
+  domainGroups?: string[];
+  /** Priority of this rule (higher takes precedence) */
+  priority: number;
+  /** Action to take when rule matches */
+  action: 'route' | 'block' | 'tag' | 'filter';
+  /** Target server for routing */
+  targetServer?: string;
+  /** Target port for routing */
+  targetPort?: number;
+  /** Whether to use TLS when routing */
+  useTls?: boolean;
+  /** Authentication details for routing */
+  auth?: {
+    /** Username for authentication */
+    username?: string;
+    /** Password for authentication */
+    password?: string;
+    /** Authentication type */
+    type?: 'PLAIN' | 'LOGIN' | 'OAUTH2';
+  };
+  /** Headers to add or modify when rule matches */
+  headers?: {
+    /** Header name */
+    name: string;
+    /** Header value */
+    value: string;
+    /** Whether to append to existing header or replace */
+    append?: boolean;
+  }[];
+  /** Whether this rule is enabled */
+  enabled: boolean;
+}
+
+/**
+ * Configuration for email domain-based routing
+ */
+export interface IEmailDomainRoutingConfig {
+  /** Whether domain-based routing is enabled */
+  enabled: boolean;
+  /** Routing rules list */
+  rules: IEmailRoutingRule[];
+  /** Domain groups for organization */
+  domainGroups?: IDomainGroup[];
+  /** Default target server for unmatched domains */
+  defaultTargetServer?: string;
+  /** Default target port for unmatched domains */
+  defaultTargetPort?: number;
+  /** Whether to use TLS for the default route */
+  defaultUseTls?: boolean;
+}
+
+/**
+ * Class for managing domain-based email routing
+ */
+export class EmailDomainRouter {
+  /** Configuration for domain-based routing */
+  private config: IEmailDomainRoutingConfig;
+  /** Domain groups indexed by ID */
+  private domainGroups: Map<string, IDomainGroup> = new Map();
+  /** Sorted rules cache for faster processing */
+  private sortedRules: IEmailRoutingRule[] = [];
+  /** Whether the rules need to be re-sorted */
+  private rulesSortNeeded = true;
+
+  /**
+   * Create a new EmailDomainRouter
+   * @param config Configuration for domain-based routing
+   */
+  constructor(config: IEmailDomainRoutingConfig) {
+    this.config = config;
+    this.initialize();
+  }
+
+  /**
+   * Initialize the domain router
+   */
+  private initialize(): void {
+    // Return early if routing is not enabled
+    if (!this.config.enabled) {
+      return;
+    }
+
+    // Initialize domain groups
+    if (this.config.domainGroups) {
+      for (const group of this.config.domainGroups) {
+        this.domainGroups.set(group.id, group);
+      }
+    }
+
+    // Sort rules by priority
+    this.sortRules();
+  }
+
+  /**
+   * Sort rules by priority (higher first)
+   */
+  private sortRules(): void {
+    if (!this.config.rules || !this.config.enabled) {
+      this.sortedRules = [];
+      this.rulesSortNeeded = false;
+      return;
+    }
+
+    this.sortedRules = [...this.config.rules]
+      .filter(rule => rule.enabled)
+      .sort((a, b) => b.priority - a.priority);
+
+    this.rulesSortNeeded = false;
+  }
+
+  /**
+   * Add a new routing rule
+   * @param rule The routing rule to add
+   */
+  public addRule(rule: IEmailRoutingRule): void {
+    if (!this.config.rules) {
+      this.config.rules = [];
+    }
+
+    // Check if rule already exists
+    const existingIndex = this.config.rules.findIndex(r => r.id === rule.id);
+    if (existingIndex >= 0) {
+      // Update existing rule
+      this.config.rules[existingIndex] = rule;
+    } else {
+      // Add new rule
+      this.config.rules.push(rule);
+    }
+
+    this.rulesSortNeeded = true;
+  }
+
+  /**
+   * Remove a routing rule by ID
+   * @param ruleId ID of the rule to remove
+   * @returns Whether the rule was removed
+   */
+  public removeRule(ruleId: string): boolean {
+    if (!this.config.rules) {
+      return false;
+    }
+
+    const initialLength = this.config.rules.length;
+    this.config.rules = this.config.rules.filter(rule => rule.id !== ruleId);
+    
+    if (initialLength !== this.config.rules.length) {
+      this.rulesSortNeeded = true;
+      return true;
+    }
+    
+    return false;
+  }
+
+  /**
+   * Add a domain group
+   * @param group The domain group to add
+   */
+  public addDomainGroup(group: IDomainGroup): void {
+    if (!this.config.domainGroups) {
+      this.config.domainGroups = [];
+    }
+
+    // Check if group already exists
+    const existingIndex = this.config.domainGroups.findIndex(g => g.id === group.id);
+    if (existingIndex >= 0) {
+      // Update existing group
+      this.config.domainGroups[existingIndex] = group;
+    } else {
+      // Add new group
+      this.config.domainGroups.push(group);
+    }
+
+    // Update domain groups map
+    this.domainGroups.set(group.id, group);
+  }
+
+  /**
+   * Remove a domain group by ID
+   * @param groupId ID of the group to remove
+   * @returns Whether the group was removed
+   */
+  public removeDomainGroup(groupId: string): boolean {
+    if (!this.config.domainGroups) {
+      return false;
+    }
+
+    const initialLength = this.config.domainGroups.length;
+    this.config.domainGroups = this.config.domainGroups.filter(group => group.id !== groupId);
+    
+    if (initialLength !== this.config.domainGroups.length) {
+      this.domainGroups.delete(groupId);
+      return true;
+    }
+    
+    return false;
+  }
+
+  /**
+   * Determine routing for an email
+   * @param fromDomain The sender domain
+   * @param toDomain The recipient domain
+   * @returns Routing decision or null if no matching rule
+   */
+  public getRoutingForEmail(fromDomain: string, toDomain: string): {
+    targetServer: string;
+    targetPort: number;
+    useTls: boolean;
+    auth?: {
+      username?: string;
+      password?: string;
+      type?: 'PLAIN' | 'LOGIN' | 'OAUTH2';
+    };
+    headers?: {
+      name: string;
+      value: string;
+      append?: boolean;
+    }[];
+  } | null {
+    // Return default routing if routing is not enabled
+    if (!this.config.enabled) {
+      return this.getDefaultRouting();
+    }
+
+    // Sort rules if needed
+    if (this.rulesSortNeeded) {
+      this.sortRules();
+    }
+
+    // Normalize domains
+    fromDomain = fromDomain.toLowerCase();
+    toDomain = toDomain.toLowerCase();
+
+    // Check each rule in priority order
+    for (const rule of this.sortedRules) {
+      if (!rule.enabled) continue;
+
+      // Check if rule applies to this email
+      if (this.ruleMatchesEmail(rule, fromDomain, toDomain)) {
+        // Handle different actions
+        switch (rule.action) {
+          case 'route':
+            // Return routing information
+            return {
+              targetServer: rule.targetServer || this.config.defaultTargetServer || 'localhost',
+              targetPort: rule.targetPort || this.config.defaultTargetPort || 25,
+              useTls: rule.useTls ?? this.config.defaultUseTls ?? false,
+              auth: rule.auth,
+              headers: rule.headers
+            };
+          case 'block':
+            // Return null to indicate email should be blocked
+            return null;
+          case 'tag':
+          case 'filter':
+            // For tagging/filtering, we need to apply headers but continue checking rules
+            // This is simplified for now, in a real implementation we'd aggregate headers
+            continue;
+        }
+      }
+    }
+
+    // No rule matched, use default routing
+    return this.getDefaultRouting();
+  }
+
+  /**
+   * Check if a rule matches an email
+   * @param rule The routing rule to check
+   * @param fromDomain The sender domain
+   * @param toDomain The recipient domain
+   * @returns Whether the rule matches the email
+   */
+  private ruleMatchesEmail(rule: IEmailRoutingRule, fromDomain: string, toDomain: string): boolean {
+    // Check source domains
+    if (rule.sourceDomains && rule.sourceDomains.length > 0) {
+      const matchesSourceDomain = rule.sourceDomains.some(
+        pattern => this.domainMatchesPattern(fromDomain, pattern)
+      );
+      if (!matchesSourceDomain) {
+        return false;
+      }
+    }
+
+    // Check destination domains
+    if (rule.destinationDomains && rule.destinationDomains.length > 0) {
+      const matchesDestinationDomain = rule.destinationDomains.some(
+        pattern => this.domainMatchesPattern(toDomain, pattern)
+      );
+      if (!matchesDestinationDomain) {
+        return false;
+      }
+    }
+
+    // Check domain groups
+    if (rule.domainGroups && rule.domainGroups.length > 0) {
+      // Check if either domain is in any of the specified groups
+      const domainsInGroups = rule.domainGroups
+        .map(groupId => this.domainGroups.get(groupId))
+        .filter(Boolean)
+        .some(group => 
+          group.domains.includes(fromDomain) || 
+          group.domains.includes(toDomain)
+        );
+      
+      if (!domainsInGroups) {
+        return false;
+      }
+    }
+
+    // If we got here, all checks passed
+    return true;
+  }
+
+  /**
+   * Check if a domain matches a pattern
+   * @param domain The domain to check
+   * @param pattern The pattern to match against
+   * @returns Whether the domain matches the pattern
+   */
+  private domainMatchesPattern(domain: string, pattern: IDomainPattern): boolean {
+    domain = domain.toLowerCase();
+    const patternStr = pattern.pattern.toLowerCase();
+
+    // Exact match
+    if (!pattern.isWildcard) {
+      return domain === patternStr;
+    }
+
+    // Wildcard match (*.example.com)
+    if (patternStr.startsWith('*.')) {
+      const suffix = patternStr.substring(2);
+      return domain.endsWith(suffix) && domain.length > suffix.length;
+    }
+
+    // Invalid pattern
+    return false;
+  }
+
+  /**
+   * Get default routing information
+   * @returns Default routing or null if no default configured
+   */
+  private getDefaultRouting(): {
+    targetServer: string;
+    targetPort: number;
+    useTls: boolean;
+  } | null {
+    if (!this.config.defaultTargetServer) {
+      return null;
+    }
+
+    return {
+      targetServer: this.config.defaultTargetServer,
+      targetPort: this.config.defaultTargetPort || 25,
+      useTls: this.config.defaultUseTls || false
+    };
+  }
+
+  /**
+   * Get the current configuration
+   * @returns Current domain routing configuration
+   */
+  public getConfig(): IEmailDomainRoutingConfig {
+    return this.config;
+  }
+
+  /**
+   * Update the configuration
+   * @param config New domain routing configuration
+   */
+  public updateConfig(config: IEmailDomainRoutingConfig): void {
+    this.config = config;
+    this.rulesSortNeeded = true;
+    this.initialize();
+  }
+
+  /**
+   * Enable domain routing
+   */
+  public enable(): void {
+    this.config.enabled = true;
+  }
+
+  /**
+   * Disable domain routing
+   */
+  public disable(): void {
+    this.config.enabled = false;
+  }
+}

ts/dcrouter/classes.smtp.portconfig.ts

@@ -0,0 +1,311 @@
+import * as plugins from '../plugins.js';
+
+/**
+ * Configuration options for TLS in SMTP connections
+ */
+export interface ISmtpTlsOptions {
+  /** Enable TLS for this SMTP port */
+  enabled: boolean;
+  /** Whether to use STARTTLS (upgrade plain connection) or implicit TLS */
+  useStartTls?: boolean;
+  /** Required TLS protocol version (defaults to TLSv1.2) */
+  minTlsVersion?: 'TLSv1.0' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3';
+  /** TLS ciphers to allow (comma-separated list) */
+  allowedCiphers?: string;
+  /** Whether to require client certificate for authentication */
+  requireClientCert?: boolean;
+  /** Whether to verify client certificate if provided */
+  verifyClientCert?: boolean;
+}
+
+/**
+ * Rate limiting options for SMTP connections
+ */
+export interface ISmtpRateLimitOptions {
+  /** Maximum connections per minute from a single IP */
+  maxConnectionsPerMinute?: number;
+  /** Maximum concurrent connections from a single IP */
+  maxConcurrentConnections?: number;
+  /** Maximum emails per minute from a single IP */
+  maxEmailsPerMinute?: number;
+  /** Maximum recipients per email */
+  maxRecipientsPerEmail?: number;
+  /** Maximum email size in bytes */
+  maxEmailSize?: number;
+  /** Action to take when rate limit is exceeded (default: 'tempfail') */
+  rateLimitAction?: 'tempfail' | 'drop' | 'delay';
+}
+
+/**
+ * Configuration for a specific SMTP port
+ */
+export interface ISmtpPortSettings {
+  /** The port number to listen on */
+  port: number;
+  /** Whether this port is enabled */
+  enabled?: boolean;
+  /** Port description (e.g., "Submission Port") */
+  description?: string;
+  /** Whether to require authentication for this port */
+  requireAuth?: boolean;
+  /** TLS options for this port */
+  tls?: ISmtpTlsOptions;
+  /** Rate limiting settings for this port */
+  rateLimit?: ISmtpRateLimitOptions;
+  /** Maximum message size in bytes for this port */
+  maxMessageSize?: number;
+  /** Whether to enable SMTP extensions like PIPELINING, 8BITMIME, etc. */
+  smtpExtensions?: {
+    /** Enable PIPELINING extension */
+    pipelining?: boolean;
+    /** Enable 8BITMIME extension */
+    eightBitMime?: boolean;
+    /** Enable SIZE extension */
+    size?: boolean;
+    /** Enable ENHANCEDSTATUSCODES extension */
+    enhancedStatusCodes?: boolean;
+    /** Enable DSN extension */
+    dsn?: boolean;
+  };
+  /** Custom SMTP greeting banner */
+  banner?: string;
+}
+
+/**
+ * Configuration manager for SMTP ports
+ */
+export class SmtpPortConfig {
+  /** Port configurations */
+  private portConfigs: Map<number, ISmtpPortSettings> = new Map();
+
+  /** Default port configurations */
+  private static readonly DEFAULT_CONFIGS: Record<number, Partial<ISmtpPortSettings>> = {
+    // Port 25: Standard SMTP
+    25: {
+      description: 'Standard SMTP',
+      requireAuth: false,
+      tls: {
+        enabled: true,
+        useStartTls: true,
+        minTlsVersion: 'TLSv1.2'
+      },
+      rateLimit: {
+        maxConnectionsPerMinute: 60,
+        maxConcurrentConnections: 10,
+        maxEmailsPerMinute: 30
+      },
+      maxMessageSize: 20 * 1024 * 1024 // 20MB
+    },
+    // Port 587: Submission
+    587: {
+      description: 'Submission Port',
+      requireAuth: true,
+      tls: {
+        enabled: true,
+        useStartTls: true,
+        minTlsVersion: 'TLSv1.2'
+      },
+      rateLimit: {
+        maxConnectionsPerMinute: 100,
+        maxConcurrentConnections: 20,
+        maxEmailsPerMinute: 60
+      },
+      maxMessageSize: 50 * 1024 * 1024 // 50MB
+    },
+    // Port 465: SMTPS (Legacy Implicit TLS)
+    465: {
+      description: 'SMTPS (Implicit TLS)',
+      requireAuth: true,
+      tls: {
+        enabled: true,
+        useStartTls: false,
+        minTlsVersion: 'TLSv1.2'
+      },
+      rateLimit: {
+        maxConnectionsPerMinute: 100,
+        maxConcurrentConnections: 20,
+        maxEmailsPerMinute: 60
+      },
+      maxMessageSize: 50 * 1024 * 1024 // 50MB
+    }
+  };
+
+  /**
+   * Create a new SmtpPortConfig
+   * @param initialConfigs Optional initial port configurations
+   */
+  constructor(initialConfigs?: ISmtpPortSettings[]) {
+    // Initialize with default configurations for standard SMTP ports
+    this.initializeDefaults();
+
+    // Apply custom configurations if provided
+    if (initialConfigs) {
+      for (const config of initialConfigs) {
+        this.setPortConfig(config);
+      }
+    }
+  }
+
+  /**
+   * Initialize port configurations with defaults
+   */
+  private initializeDefaults(): void {
+    // Set up default configurations for standard SMTP ports: 25, 587, 465
+    Object.entries(SmtpPortConfig.DEFAULT_CONFIGS).forEach(([portStr, defaults]) => {
+      const port = parseInt(portStr, 10);
+      this.portConfigs.set(port, {
+        port,
+        enabled: true,
+        ...defaults
+      });
+    });
+  }
+
+  /**
+   * Get configuration for a specific port
+   * @param port Port number
+   * @returns Port configuration or null if not found
+   */
+  public getPortConfig(port: number): ISmtpPortSettings | null {
+    return this.portConfigs.get(port) || null;
+  }
+
+  /**
+   * Get all configured ports
+   * @returns Array of port configurations
+   */
+  public getAllPortConfigs(): ISmtpPortSettings[] {
+    return Array.from(this.portConfigs.values());
+  }
+
+  /**
+   * Get only enabled port configurations
+   * @returns Array of enabled port configurations
+   */
+  public getEnabledPortConfigs(): ISmtpPortSettings[] {
+    return this.getAllPortConfigs().filter(config => config.enabled !== false);
+  }
+
+  /**
+   * Set configuration for a specific port
+   * @param config Port configuration
+   */
+  public setPortConfig(config: ISmtpPortSettings): void {
+    // Get existing config if any
+    const existingConfig = this.portConfigs.get(config.port) || { port: config.port };
+
+    // Merge with new configuration
+    this.portConfigs.set(config.port, {
+      ...existingConfig,
+      ...config
+    });
+  }
+
+  /**
+   * Remove configuration for a specific port
+   * @param port Port number
+   * @returns Whether the configuration was removed
+   */
+  public removePortConfig(port: number): boolean {
+    return this.portConfigs.delete(port);
+  }
+
+  /**
+   * Disable a specific port
+   * @param port Port number
+   * @returns Whether the port was disabled
+   */
+  public disablePort(port: number): boolean {
+    const config = this.portConfigs.get(port);
+    if (config) {
+      config.enabled = false;
+      return true;
+    }
+    return false;
+  }
+
+  /**
+   * Enable a specific port
+   * @param port Port number
+   * @returns Whether the port was enabled
+   */
+  public enablePort(port: number): boolean {
+    const config = this.portConfigs.get(port);
+    if (config) {
+      config.enabled = true;
+      return true;
+    }
+    return false;
+  }
+
+  /**
+   * Apply port configurations to SmartProxy settings
+   * @param smartProxy SmartProxy instance
+   */
+  public applyToSmartProxy(smartProxy: plugins.smartproxy.SmartProxy): void {
+    if (!smartProxy) return;
+
+    const enabledPorts = this.getEnabledPortConfigs();
+    const settings = smartProxy.settings;
+
+    // Initialize globalPortRanges if needed
+    if (!settings.globalPortRanges) {
+      settings.globalPortRanges = [];
+    }
+
+    // Add configured ports to globalPortRanges
+    for (const portConfig of enabledPorts) {
+      // Add port to global port ranges if not already present
+      if (!settings.globalPortRanges.some((r) => r.from <= portConfig.port && portConfig.port <= r.to)) {
+        settings.globalPortRanges.push({ from: portConfig.port, to: portConfig.port });
+      }
+      
+      // Apply TLS settings at SmartProxy level
+      if (portConfig.port === 465 && portConfig.tls?.enabled) {
+        // For implicit TLS on port 465
+        settings.sniEnabled = true;
+      }
+    }
+
+    // Group ports by TLS configuration to log them
+    const starttlsPorts = enabledPorts
+      .filter(p => p.tls?.enabled && p.tls?.useStartTls)
+      .map(p => p.port);
+
+    const implicitTlsPorts = enabledPorts
+      .filter(p => p.tls?.enabled && !p.tls?.useStartTls)
+      .map(p => p.port);
+
+    const nonTlsPorts = enabledPorts
+      .filter(p => !p.tls?.enabled)
+      .map(p => p.port);
+
+    if (starttlsPorts.length > 0) {
+      console.log(`Configured STARTTLS SMTP ports: ${starttlsPorts.join(', ')}`);
+    }
+
+    if (implicitTlsPorts.length > 0) {
+      console.log(`Configured Implicit TLS SMTP ports: ${implicitTlsPorts.join(', ')}`);
+    }
+
+    if (nonTlsPorts.length > 0) {
+      console.log(`Configured Plain SMTP ports: ${nonTlsPorts.join(', ')}`);
+    }
+
+    // Setup connection listeners for different port types
+    smartProxy.on('connection', (connection) => {
+      const port = connection.localPort;
+      
+      // Check which type of port this is
+      if (implicitTlsPorts.includes(port)) {
+        console.log(`Implicit TLS SMTP connection on port ${port} from ${connection.remoteIP}`);
+      } else if (starttlsPorts.includes(port)) {
+        console.log(`STARTTLS SMTP connection on port ${port} from ${connection.remoteIP}`);
+      } else if (nonTlsPorts.includes(port)) {
+        console.log(`Plain SMTP connection on port ${port} from ${connection.remoteIP}`);
+      }
+    });
+
+    console.log(`Applied SMTP port configurations to SmartProxy: ${enabledPorts.map(p => p.port).join(', ')}`);
+  }
+}

ts/dcrouter/index.ts

@@ -1 +1,3 @@
 export * from './classes.dcrouter.js';
+export * from './classes.smtp.portconfig.js';
+export * from './classes.email.domainrouter.js';

ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/platformservice',
-  version: '2.4.2',
+  version: '2.5.0',
   description: 'A multifaceted platform service handling mail, SMS, letter delivery, and AI services.'
 }