@blamejs/core 0.15.12 → 0.15.14

package/lib/mail-send-deliver.js

@@ -441,16 +441,32 @@ function create(opts) {
   validateOpts(opts,
     ["hostname", "resolver", "policy", "retry", "dsn", "timeouts", "audit", "transportFactory", "port"],
     "mail.send.deliver.create");
-  validateOpts.requireNonEmptyString(opts.hostname,
-    "mail.send.deliver.create: hostname (local HELO/EHLO + DSN Reporting-MTA)",
-    DeliverError, "deliver/bad-hostname");
-  // Submission/smarthost relays listen on 587 (RFC 6409) or implicit-TLS
-  // 465 (RFC 8314) rather than the IANA SMTP port 25 (RFC 5321 §2.3.4)
-  // that direct MX delivery uses. Operators routing through such a relay
-  // set opts.port; the value is range-checked here (RFC 6335 §6) so a
-  // typo fails at config time, not on the first connect attempt.
-  validateOpts.optionalPort(opts.port,
-    "mail.send.deliver.create: port", DeliverError, "deliver/bad-port");
+  // hostname is required; opts.port (when present) must be a valid connect
+  // port. Submission/smarthost relays listen on 587 (RFC 6409) or
+  // implicit-TLS 465 (RFC 8314) rather than the IANA SMTP port 25
+  // (RFC 5321 §2.3.4) that direct MX delivery uses. Operators routing
+  // through such a relay set opts.port; the value is range-checked here
+  // (RFC 6335 §6) so a typo fails at config time, not on the first
+  // connect attempt.
+  // The shape is the authoritative, exhaustive opts contract: every key
+  // the factory accepts is declared here. hostname + port carry their
+  // final per-field codes; the sub-object opts (policy / retry / dsn /
+  // timeouts) are shape-checked only for object-ness here, with their
+  // field-level validation (and the distinct per-field codes operators
+  // see) applied below where each sub-object is resolved.
+  validateOpts.shape(opts, {
+    hostname:         { rule: "required-string", code: "deliver/bad-hostname",
+                        label: "mail.send.deliver.create: hostname (local HELO/EHLO + DSN Reporting-MTA)" },
+    port:             { rule: "optional-port", code: "deliver/bad-port" },
+    resolver:         { rule: "optional-plain-object", code: "deliver/bad-resolver",
+                        label: "mail.send.deliver.create: resolver (b.network.dns.resolver handle)" },
+    policy:           { rule: "optional-plain-object", code: "deliver/bad-policy" },
+    retry:            { rule: "optional-plain-object", code: "deliver/bad-retry" },
+    dsn:              { rule: "optional-plain-object", code: "deliver/bad-dsn" },
+    timeouts:         { rule: "optional-plain-object", code: "deliver/bad-timeouts" },
+    audit:            { rule: "optional-boolean", code: "deliver/bad-audit" },
+    transportFactory: { rule: "optional-function", code: "deliver/bad-transport-factory" },
+  }, "mail.send.deliver.create", DeliverError, "deliver/bad-opts");
   var port = opts.port || DEFAULT_PORT_SMTP;
 
   var policy = opts.policy || {};
@@ -480,10 +496,12 @@ function create(opts) {
 
   var timeouts = opts.timeouts || {};
   validateOpts(timeouts, ["mxLookupMs", "perHostMs"], "mail.send.deliver.create.timeouts");
-  validateOpts.optionalPositiveInt(timeouts.mxLookupMs,
-    "mail.send.deliver.create.timeouts.mxLookupMs", DeliverError, "deliver/bad-timeout-mxLookupMs");
-  validateOpts.optionalPositiveInt(timeouts.perHostMs,
-    "mail.send.deliver.create.timeouts.perHostMs", DeliverError, "deliver/bad-timeout-perHostMs");
+  validateOpts.shape(timeouts, {
+    mxLookupMs: { rule: "optional-positive-int", code: "deliver/bad-timeout-mxLookupMs",
+                  label: "mail.send.deliver.create.timeouts.mxLookupMs" },
+    perHostMs:  { rule: "optional-positive-int", code: "deliver/bad-timeout-perHostMs",
+                  label: "mail.send.deliver.create.timeouts.perHostMs" },
+  }, "mail.send.deliver.create.timeouts", DeliverError, "deliver/bad-timeouts");
   var mxLookupTimeoutMs = timeouts.mxLookupMs !== undefined
     ? timeouts.mxLookupMs : DEFAULT_MX_LOOKUP_TIMEOUT_MS;
   var perHostTimeoutMs = timeouts.perHostMs !== undefined
@@ -502,12 +520,7 @@ function create(opts) {
   }
 
   var auditEnabled = opts.audit !== false;
-  function _auditEmit(action, outcome, metadata) {
-    if (!auditEnabled) return;
-    try {
-      audit().safeEmit({ action: action, outcome: outcome, metadata: metadata || {} });
-    } catch (_e) { /* drop-silent — hot-path audit */ }
-  }
+  var _auditEmit = audit().namespaced(null, { audit: auditEnabled });
 
   async function deliver(envelope) {
     if (!envelope || typeof envelope !== "object") {

package/lib/mail-server-imap.js

@@ -117,7 +117,7 @@
  */
 
 var net  = require("node:net");
-var lazyRequire = require("./lazy-require");
+var safeBuffer = require("./safe-buffer");
 var C = require("./constants");
 var bCrypto = require("./crypto");
 var numericBounds = require("./numeric-bounds");
@@ -126,9 +126,10 @@ var guardImapCommand = require("./guard-imap-command");
 var mailServerRateLimit = require("./mail-server-rate-limit");
 var mailServerRegistry = require("./mail-server-registry");
 var mailServerTls = require("./mail-server-tls");
+var mailServerNet = require("./mail-server-net");
 var { defineClass } = require("./framework-error");
 
-var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 
 var MailServerImapError = defineClass("MailServerImapError", { alwaysPermanent: true });
 
@@ -138,6 +139,7 @@ var DEFAULT_IDLE_TIMEOUT_MS  = C.TIME.minutes(30);
 var IDLE_BANDWIDTH_TIMEOUT_MS = C.TIME.minutes(29);  // RFC 2177 §3 — re-issue before 30
 var DEFAULT_GREETING_VENDOR  = "blamejs IMAP4rev2";
 var pkgVersion = require("../package.json").version;
+var codepointClass = require("./codepoint-class");
 
 // Error-message clamp bytes — protocol-string clamp, not a byte count.
 // Centralized so the marker lives in one place
@@ -196,10 +198,7 @@ function _parseImapDateTime(s) {
 function _validateMailboxName(name, opts) {
   if (typeof name !== "string" || name.length === 0) return false;
   if (name.length > 1024) return false;                                                              // mailbox name cap
-  for (var i = 0; i < name.length; i += 1) {
-    var c = name.charCodeAt(i);
-    if (c < 0x20 || c === 0x7F) return false;                                                        // control-byte refusal
-  }
+  if (codepointClass.firstControlCharOffset(name, { forbidTab: true }) !== -1) return false;        // control-byte refusal
   if (name.indexOf("..") !== -1) return false;
   if (name === "/" || name[0] === "/" || name[name.length - 1] === "/") return false;
   // Modified-UTF7 detection — RFC 3501 §5.1.3. Sequences are
@@ -275,40 +274,18 @@ function create(opts) {
   var mailStore         = opts.mailStore;
   var allowLegacyMUtf7  = profile === "permissive";
 
-  var rateLimit;
-  if (opts.rateLimit === false) {
-    rateLimit = mailServerRateLimit.create({ disabled: true });
-  } else if (opts.rateLimit && typeof opts.rateLimit.admitConnection === "function") {
-    rateLimit = opts.rateLimit;
-  } else {
-    rateLimit = mailServerRateLimit.create(opts.rateLimit || {});
-  }
+  var rateLimit = mailServerRateLimit.resolve(opts.rateLimit);
 
-  var tcpServer    = null;
-  var listening    = false;
   var connections  = new Set();
 
-  function _emit(action, metadata, outcome) {
-    try {
-      audit().safeEmit({
-        action:   action,
-        outcome:  outcome || "success",
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent — audit best-effort */ }
-  }
+  var _emit = auditEmit.emit;
 
   function _handleConnection(rawSocket) {
-    var remoteAddress = rawSocket.remoteAddress || "0.0.0.0";
-    var admit = rateLimit.admitConnection(remoteAddress);
-    if (!admit.ok) {
-      _emit("mail.server.imap.rate_limit_refused",
-        { remoteAddress: remoteAddress, reason: admit.reason }, "denied");
-      try { rawSocket.write("* BAD Too many connections from your IP\r\n"); }
-      catch (_e) { /* socket may be down */ }
-      try { rawSocket.destroy(); } catch (_e2) { /* idempotent */ }
-      return;
-    }
+    var remoteAddress = mailServerNet.admitConnection(rawSocket, rateLimit, _emit, {
+      refusedEvent: "mail.server.imap.rate_limit_refused",
+      refusalLine:  "* BAD Too many connections from your IP\r\n",
+    });
+    if (remoteAddress === null) return;
     rawSocket.once("close", function () { rateLimit.releaseConnection(remoteAddress); });
 
     var connectionId = "imapconn-" + bCrypto.generateToken(8);                                       // connection-id length
@@ -389,7 +366,7 @@ function create(opts) {
       }
       var crlf = state.lineBuffer.indexOf("\r\n");
       if (crlf === -1) {
-        if (state.lineBuffer.length > maxLineBytes) {
+        if (safeBuffer.byteLengthOf(state.lineBuffer) > maxLineBytes) {
           _writeUntagged(socket, "BAD Line too long (cap " + maxLineBytes + ")");
           _close(socket, state);
         }
@@ -932,20 +909,17 @@ function create(opts) {
     //     would let the post-TLS state machine resume an exchange that
     //     started in plaintext, conflating cleartext + TLS-protected
     //     phases of the same SASL run.
-    // Listener-removal + idle-timeout re-arm live in the shared
-    // upgradeSocket helper (b.mail.server.tls.upgradeSocket).
-    state.lineBuffer    = Buffer.alloc(0);
-    state.pendingLiteral = null;
-    state.authPending    = null;
-    mailServerTls.upgradeSocket({
-      plainSocket:   socket,
+    // The pre-handshake state-drain (lineBuffer + pendingLiteral +
+    // authPending), listener-removal, idle-timeout re-arm, and the
+    // post-handshake read-pump live in the shared upgradeLineProtocol
+    // helper (b.mail.server.tls.upgradeLineProtocol).
+    mailServerTls.upgradeLineProtocol({
+      state:         state,
+      socket:        socket,
       secureContext: opts.tlsContext,
       idleTimeoutMs: idleTimeoutMs,
-      onSecure: function (_tlsSocket) { state.tls = true; },
-      onData: function (tlsSocket, chunk) {
-        state.lineBuffer = Buffer.concat([state.lineBuffer, chunk]);
-        _drainBuffer(state, tlsSocket);
-      },
+      clearFields:   ["pendingLiteral", "authPending"],
+      drain:         _drainBuffer,
       onError: function (err) {
         _emit("mail.server.imap.tls_handshake_failed",
           { connectionId: state.id, error: (err && err.message) || String(err) }, "failure");
@@ -1476,7 +1450,7 @@ function create(opts) {
               if (q && typeof q.usedBytes === "number" &&
                   typeof q.capBytes === "number" &&
                   q.capBytes > 0 &&
-                  q.usedBytes + literalBody.length > q.capBytes) {
+                  q.usedBytes + safeBuffer.byteLengthOf(literalBody) > q.capBytes) {
                 var err = new Error("APPEND would exceed quota (used " + q.usedBytes +
                   " + " + literalBody.length + " > cap " + q.capBytes + ")");
                 err.code = "mail-server-imap/overquota";
@@ -1812,44 +1786,15 @@ function create(opts) {
   }
 
   // ---- Lifecycle ----------------------------------------------------------
-  async function listen(listenOpts) {
-    listenOpts = listenOpts || {};
-    if (listening) {
-      throw new MailServerImapError("mail-server-imap/already-listening",
-        "listen: already listening");
-    }
-    var port    = listenOpts.port    === undefined ? 143 : listenOpts.port;                           // RFC 9051 IMAP port (IANA)
-    var address = listenOpts.address || "0.0.0.0";
-    tcpServer = net.createServer(function (socket) { _handleConnection(socket); });
-    return new Promise(function (resolve, reject) {
-      tcpServer.once("error", reject);
-      tcpServer.listen(port, address, function () {
-        listening = true;
-        tcpServer.removeListener("error", reject);
-        _emit("mail.server.imap.listening",
-          { port: port, address: address });
-        resolve({ port: tcpServer.address().port, address: address });
-      });
-    });
-  }
-
-  async function close() {
-    if (!listening) return;
-    listening = false;
-    for (var s of connections) { try { s.destroy(); } catch (_e) { /* idempotent */ } }
-    connections.clear();
-    return new Promise(function (resolve) {
-      tcpServer.close(function () {
-        _emit("mail.server.imap.closed", {});
-        resolve();
-      });
-    });
-  }
-
-  return {
-    listen:               listen,
-    close:                close,
-  };
+  return mailServerNet.createStoreServer(net, {
+    defaultPort:      143,                                                                              // RFC 9051 IMAP port (IANA)
+    handleConnection: _handleConnection,
+    errorClass:       MailServerImapError,
+    errorCodePrefix:  "mail-server-imap/",
+    emit:             _emit,
+    connections:      connections,
+    eventBase:        "mail.server.imap",
+  });
 }
 
 module.exports = {

package/lib/mail-server-jmap.js

@@ -129,6 +129,7 @@ var mailServerRegistry = require("./mail-server-registry");
 var { defineClass } = require("./framework-error");
 
 var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 
 var MailServerJmapError = defineClass("MailServerJmapError", { alwaysPermanent: true });
 
@@ -232,15 +233,7 @@ function create(opts) {
   });
   var sessionState = bCrypto.generateToken(16);                                                       // opaque session-state token length
 
-  function _emit(action, metadata, outcome) {
-    try {
-      audit().safeEmit({
-        action:   action,
-        outcome:  outcome || "success",
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent — audit best-effort */ }
-  }
+  var _emit = auditEmit.emit;
 
   // ---- Back-reference resolution (RFC 8620 §3.7) -------------------------
   //
@@ -520,7 +513,10 @@ function create(opts) {
     });
   }
 
-  function sessionHandler(req, res) {
+  // _requireActor(req, res) — resolve the authenticated actor; on absence,
+  // write the RFC 8620 401 forbidden Problem-Details body and return null so
+  // the caller returns. Shared by every JMAP handler that gates on actor.
+  function _requireActor(req, res) {
     var actor = req.user || (req.actor || null);
     if (!actor) {
       res.statusCode = 401;
@@ -529,8 +525,28 @@ function create(opts) {
         type:        "urn:ietf:params:jmap:error:forbidden",
         description: "Authentication required",
       }));
-      return;
+      return null;
     }
+    return actor;
+  }
+
+  // _forEachQueryParam(query, fn) — split a raw URL query string on "&" and
+  // hand each non-empty pair to fn(rawKey, rawValue): the key is the text
+  // before the first "=", the value the remainder (both still
+  // percent-encoded — the caller decodes the slices it keeps).
+  function _forEachQueryParam(query, fn) {
+    query.split("&").forEach(function (pair) {
+      if (!pair) return;
+      var eq = pair.indexOf("=");
+      var k = eq === -1 ? pair : pair.slice(0, eq);
+      var v = eq === -1 ? "" : pair.slice(eq + 1);
+      fn(k, v);
+    });
+  }
+
+  function sessionHandler(req, res) {
+    var actor = _requireActor(req, res);
+    if (!actor) return;
     Promise.resolve().then(function () { return opts.accountsFor(actor); })
       .then(function (accountInfo) {
         var info = accountInfo || { primaryAccounts: {}, accounts: {} };
@@ -592,16 +608,8 @@ function create(opts) {
   // closeafter=no (default) — keep open until disconnect.
   // ping=<seconds> — keepalive interval (default 30s, min 5s, max 900s).
   function eventSourceHandler(req, res) {
-    var actor = req.user || (req.actor || null);
-    if (!actor) {
-      res.statusCode = 401;
-      res.setHeader("Content-Type", "application/json; charset=utf-8");
-      res.end(JSON.stringify({
-        type:        "urn:ietf:params:jmap:error:forbidden",
-        description: "Authentication required",
-      }));
-      return;
-    }
+    var actor = _requireActor(req, res);
+    if (!actor) return;
     if (typeof opts.mailStore.subscribePush !== "function") {
       res.statusCode = 503;
       res.setHeader("Content-Type", "application/json; charset=utf-8");
@@ -618,11 +626,7 @@ function create(opts) {
     var qIdx = url.indexOf("?");
     var query = qIdx === -1 ? "" : url.slice(qIdx + 1);
     var params = Object.create(null);
-    query.split("&").forEach(function (pair) {
-      if (!pair) return;
-      var eq = pair.indexOf("=");
-      var k = eq === -1 ? pair : pair.slice(0, eq);
-      var v = eq === -1 ? "" : pair.slice(eq + 1);
+    _forEachQueryParam(query, function (k, v) {
       try { params[decodeURIComponent(k)] = decodeURIComponent(v); }
       catch (_e) { /* drop-silent — malformed % encoding */ }
     });
@@ -797,16 +801,8 @@ function create(opts) {
   }
 
   function uploadHandler(req, res) {
-    var actor = req.user || (req.actor || null);
-    if (!actor) {
-      res.statusCode = 401;
-      res.setHeader("Content-Type", "application/json; charset=utf-8");
-      res.end(JSON.stringify({
-        type:        "urn:ietf:params:jmap:error:forbidden",
-        description: "Authentication required",
-      }));
-      return;
-    }
+    var actor = _requireActor(req, res);
+    if (!actor) return;
     if (typeof opts.mailStore.uploadBlob !== "function") {
       res.statusCode = 503;
       res.setHeader("Content-Type", "application/json; charset=utf-8");
@@ -938,16 +934,8 @@ function create(opts) {
   // shaped buffer (Buffer or async-iterable) + the canonical MIME
   // type; the handler pipes it to the response.
   function downloadHandler(req, res) {
-    var actor = req.user || (req.actor || null);
-    if (!actor) {
-      res.statusCode = 401;
-      res.setHeader("Content-Type", "application/json; charset=utf-8");
-      res.end(JSON.stringify({
-        type:        "urn:ietf:params:jmap:error:forbidden",
-        description: "Authentication required",
-      }));
-      return;
-    }
+    var actor = _requireActor(req, res);
+    if (!actor) return;
     if (typeof opts.mailStore.downloadBlob !== "function") {
       res.statusCode = 503;
       res.setHeader("Content-Type", "application/json; charset=utf-8");
@@ -970,11 +958,7 @@ function create(opts) {
     var qIdx2 = rawUrl.indexOf("?");
     var query = qIdx2 === -1 ? "" : rawUrl.slice(qIdx2 + 1);
     var acceptType = "";
-    query.split("&").forEach(function (pair) {
-      if (!pair) return;
-      var eq = pair.indexOf("=");
-      var k = eq === -1 ? pair : pair.slice(0, eq);
-      var v = eq === -1 ? "" : pair.slice(eq + 1);
+    _forEachQueryParam(query, function (k, v) {
       if (k === "accept") {
         try { acceptType = decodeURIComponent(v); } catch (_e) { /* silent-catch: malformed % encoding */ }
       }
@@ -1154,7 +1138,10 @@ function create(opts) {
         return;
       }
       var text = data.toString("utf8");
-      if (text.length > (opts.webSocketMaxMessageBytes || (10 * 1024 * 1024))) {                       // allow:raw-byte-literal — mirrors handleUpgrade cap
+      // Byte cap measured on the raw frame buffer, not text.length (UTF-16
+      // code units) — a multibyte payload is 2-4x larger in bytes than chars,
+      // so a char-length check under-enforces the limit.
+      if (data.length > (opts.webSocketMaxMessageBytes || (10 * 1024 * 1024))) {                       // allow:raw-byte-literal — mirrors handleUpgrade cap
         _sendRequestError(null,
           "urn:ietf:params:jmap:error:limit",
           "WebSocket message exceeds maxSizeRequest");

package/lib/mail-server-managesieve.js

@@ -127,8 +127,9 @@
  */
 
 var net = require("node:net");
+var safeBuffer = require("./safe-buffer");
 var mailServerTls = require("./mail-server-tls");
-var lazyRequire = require("./lazy-require");
+var mailServerNet = require("./mail-server-net");
 var C = require("./constants");
 var bCrypto = require("./crypto");
 var numericBounds = require("./numeric-bounds");
@@ -139,7 +140,7 @@ var mailServerRateLimit = require("./mail-server-rate-limit");
 var mailServerRegistry = require("./mail-server-registry");
 var { defineClass } = require("./framework-error");
 
-var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 
 var MailServerManageSieveError = defineClass("MailServerManageSieveError",
   { alwaysPermanent: true });
@@ -226,40 +227,18 @@ function create(opts) {
   // the actual script bytes — same cap on both sides).
   var safeSieveProfile = profile;
 
-  var rateLimit;
-  if (opts.rateLimit === false) {
-    rateLimit = mailServerRateLimit.create({ disabled: true });
-  } else if (opts.rateLimit && typeof opts.rateLimit.admitConnection === "function") {
-    rateLimit = opts.rateLimit;
-  } else {
-    rateLimit = mailServerRateLimit.create(opts.rateLimit || {});
-  }
+  var rateLimit = mailServerRateLimit.resolve(opts.rateLimit);
 
-  var tcpServer   = null;
-  var listening   = false;
   var connections = new Set();
 
-  function _emit(action, metadata, outcome) {
-    try {
-      audit().safeEmit({
-        action:   action,
-        outcome:  outcome || "success",
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent — audit best-effort */ }
-  }
+  var _emit = auditEmit.emit;
 
   function _handleConnection(rawSocket) {
-    var remoteAddress = rawSocket.remoteAddress || "0.0.0.0";
-    var admit = rateLimit.admitConnection(remoteAddress);
-    if (!admit.ok) {
-      _emit("mail.server.managesieve.rate_limit_refused",
-        { remoteAddress: remoteAddress, reason: admit.reason }, "denied");
-      try { rawSocket.write('NO "Too many connections from your IP"\r\n'); }
-      catch (_e) { /* socket may be down */ }
-      try { rawSocket.destroy(); } catch (_e2) { /* idempotent */ }
-      return;
-    }
+    var remoteAddress = mailServerNet.admitConnection(rawSocket, rateLimit, _emit, {
+      refusedEvent: "mail.server.managesieve.rate_limit_refused",
+      refusalLine:  'NO "Too many connections from your IP"\r\n',
+    });
+    if (remoteAddress === null) return;
     var connectionId = "msvconn-" + bCrypto.generateToken(8);                                            // connection-id length
     var socket = rawSocket;
     connections.add(socket);
@@ -354,7 +333,7 @@ function create(opts) {
       }
       var crlf = state.lineBuffer.indexOf("\r\n");
       if (crlf === -1) {
-        if (state.lineBuffer.length > maxLineBytes) {
+        if (safeBuffer.byteLengthOf(state.lineBuffer) > maxLineBytes) {
           _writeNo(socket, "Line too long (cap " + maxLineBytes + ")");
           _close(socket);
         }
@@ -525,19 +504,18 @@ function create(opts) {
     }
     _writeOk(socket, "Begin TLS negotiation now");
     // RFC 5804 §2.2 — discard any bytes the client queued before the
-    // upgrade so pre-handshake injection can't survive into the post-
-    // TLS session. The shared upgradeSocket helper handles the
-    // CVE-2021-33515 / CVE-2021-38371 listener-strip + pause; the
-    // pending-protocol state still belongs to managesieve.
-    state.lineBuffer = Buffer.alloc(0);
-    state.pendingLiteral = null;
-    state.pendingAuth    = null;
-    mailServerTls.upgradeSocket({
-      plainSocket:   socket,
+    // upgrade (lineBuffer + pendingLiteral + pendingAuth) so pre-
+    // handshake injection can't survive into the post-TLS session.
+    // The shared upgradeLineProtocol helper owns that drain plus the
+    // CVE-2021-33515 / CVE-2021-38371 listener-strip + pause + read-pump.
+    mailServerTls.upgradeLineProtocol({
+      state:         state,
+      socket:        socket,
       secureContext: tlsContext,
       idleTimeoutMs: idleTimeoutMs,
+      clearFields:   ["pendingLiteral", "pendingAuth"],
+      drain:         _drainBuffer,
       onSecure: function (tlsSocket) {
-        state.tls = true;
         _emit("mail.server.managesieve.starttls_upgraded",
           { connectionId: state.id });
         // RFC 5804 §2.2 — server MUST re-emit capabilities on the
@@ -546,10 +524,6 @@ function create(opts) {
         _emitCapabilityBanner(state, tlsSocket);
         _writeOk(tlsSocket, "TLS negotiation successful");
       },
-      onData: function (tlsSocket, chunk) {
-        state.lineBuffer = Buffer.concat([state.lineBuffer, chunk]);
-        _drainBuffer(state, tlsSocket);
-      },
       onError: function (err) {
         _emit("mail.server.managesieve.starttls_handshake_failed",
           { connectionId: state.id, error: (err && err.message) || String(err) }, "failure");
@@ -863,43 +837,15 @@ function create(opts) {
   }
 
   // ---- Lifecycle ----------------------------------------------------------
-  async function listen(listenOpts) {
-    listenOpts = listenOpts || {};
-    if (listening) {
-      throw new MailServerManageSieveError("mail-server-managesieve/already-listening",
-        "listen: already listening");
-    }
-    var port    = listenOpts.port    === undefined ? DEFAULT_PORT : listenOpts.port;
-    var address = listenOpts.address || "0.0.0.0";
-    tcpServer = net.createServer(function (socket) { _handleConnection(socket); });
-    return new Promise(function (resolve, reject) {
-      tcpServer.once("error", reject);
-      tcpServer.listen(port, address, function () {
-        listening = true;
-        tcpServer.removeListener("error", reject);
-        _emit("mail.server.managesieve.listening", { port: port, address: address });
-        resolve({ port: tcpServer.address().port, address: address });
-      });
-    });
-  }
-
-  async function close() {
-    if (!listening) return;
-    listening = false;
-    for (var s of connections) { try { s.destroy(); } catch (_e) { /* idempotent */ } }
-    connections.clear();
-    return new Promise(function (resolve) {
-      tcpServer.close(function () {
-        _emit("mail.server.managesieve.closed", {});
-        resolve();
-      });
-    });
-  }
-
-  return {
-    listen: listen,
-    close:  close,
-  };
+  return mailServerNet.createStoreServer(net, {
+    defaultPort:      DEFAULT_PORT,
+    handleConnection: _handleConnection,
+    errorClass:       MailServerManageSieveError,
+    errorCodePrefix:  "mail-server-managesieve/",
+    emit:             _emit,
+    connections:      connections,
+    eventBase:        "mail.server.managesieve",
+  });
 }
 
 module.exports = {