@blamejs/core 0.15.12 → 0.15.14

package/lib/mail-server-mx.js

@@ -150,9 +150,10 @@ var guardSmtpCommand = require("./guard-smtp-command");
 var guardDomain = require("./guard-domain");
 var mailServerRateLimit = require("./mail-server-rate-limit");
 var mailServerTls = require("./mail-server-tls");
+var mailServerNet = require("./mail-server-net");
 var { defineClass } = require("./framework-error");
 
-var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 // Lazy like the sibling host primitives' guard loads — the inbound
 // authentication pipeline (and the DKIM verifier whose range
 // constants the boot validation mirrors) only loads when an operator
@@ -338,14 +339,7 @@ function create(opts) {
   // handle from b.mail.server.rateLimit.create({...}) to share one
   // budget across multiple listeners, or pass an opts object to
   // override defaults.
-  var rateLimit;
-  if (opts.rateLimit === false) {
-    rateLimit = mailServerRateLimit.create({ disabled: true });
-  } else if (opts.rateLimit && typeof opts.rateLimit.admitConnection === "function") {
-    rateLimit = opts.rateLimit;
-  } else {
-    rateLimit = mailServerRateLimit.create(opts.rateLimit || {});
-  }
+  var rateLimit = mailServerRateLimit.resolve(opts.rateLimit);
 
   // DATA-phase message-authentication gate. `guardEnvelope: true`
   // gates with defaults; an object tunes it. Like the sibling gates
@@ -451,16 +445,12 @@ function create(opts) {
     });
   }
   function _validateDomainHardened(d, label) {
-    if (!guardDomainProfile) return { ok: true };
-    var verdict = guardDomain.validate(d, guardDomainProfile);
-    if (!verdict.ok) {
-      _emit("mail.server.mx.domain_refused", {
-        reason: verdict.issues && verdict.issues[0] && verdict.issues[0].kind,
-        domain: d,
-        label:  label,
-      }, "denied");
-    }
-    return verdict;
+    return mailServerNet.validateDomainHardened(d, label, {
+      guardDomainProfile: guardDomainProfile,
+      guardDomain:        guardDomain,
+      emit:               _emit,
+      refusedEvent:       "mail.server.mx.domain_refused",
+    });
   }
 
   // Pre-validate operator-supplied localDomains at boot — the same
@@ -479,35 +469,19 @@ function create(opts) {
     }
   }
 
-  var tcpServer    = null;
-  var listening    = false;
   var connections  = new Set();
 
-  function _emit(action, metadata, outcome) {
-    try {
-      audit().safeEmit({
-        action:   action,
-        outcome:  outcome || "success",
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent — audit best-effort */ }
-  }
+  var _emit = auditEmit.emit;
 
   // ---- Per-connection state machine ---------------------------------------
   function _handleConnection(socket) {
-    var remoteAddress = socket.remoteAddress || "0.0.0.0";
-    var admit = rateLimit.admitConnection(remoteAddress);
-    if (!admit.ok) {
-      // 421 4.7.0 — transient refusal; sender retries elsewhere or later.
-      // RFC 5321 §3.8 + §4.5.4.2 (transient negative completion).
-      _emit("mail.server.mx.rate_limit_refused",
-        { remoteAddress: remoteAddress, reason: admit.reason }, "denied");
-      try {
-        socket.write("421 4.7.0 Too many connections from your IP\r\n");
-      } catch (_e) { /* socket may already be torn down */ }
-      try { socket.destroy(); } catch (_e2) { /* idempotent */ }
-      return;
-    }
+    // 421 4.7.0 — transient refusal; sender retries elsewhere or later.
+    // RFC 5321 §3.8 + §4.5.4.2 (transient negative completion).
+    var remoteAddress = mailServerNet.admitConnection(socket, rateLimit, _emit, {
+      refusedEvent: "mail.server.mx.rate_limit_refused",
+      refusalLine:  "421 4.7.0 Too many connections from your IP\r\n",
+    });
+    if (remoteAddress === null) return;
     socket.once("close", function () { rateLimit.releaseConnection(remoteAddress); });
 
     var connectionId = "mxconn-" + bCrypto.generateToken(8);                                          // connection-id length
@@ -653,7 +627,7 @@ function create(opts) {
 
       // Command phase — byte-buffered (8BITMIME-safe).
       lineBuffer = lineBuffer.length === 0 ? chunk : Buffer.concat([lineBuffer, chunk]);
-      if (lineBuffer.length > maxLineBytes * 4) {
+      if (safeBuffer.byteLengthOf(lineBuffer) > maxLineBytes * 4) {
         _writeReply(socket, REPLY_500_SYNTAX,
           "5.5.6 Line too long (>" + maxLineBytes + " bytes)");
         _closeConnection(socket);
@@ -1229,38 +1203,23 @@ function create(opts) {
   }
 
   // ---- Lifecycle ----------------------------------------------------------
-  async function listen(listenOpts) {
-    listenOpts = listenOpts || {};
-    if (listening) {
-      throw new MailServerMxError("mail-server-mx/already-listening",
-        "listen: already listening");
-    }
-    // Port 0 (ephemeral, test mode) must NOT fall back to 25 — the
-    // `|| 25` short-circuit was a footgun on the test path.
-    var port    = listenOpts.port    === undefined ? 25 : listenOpts.port;                           // SMTP MX port (IANA)
-    var address = listenOpts.address || "0.0.0.0";
-    tcpServer = net.createServer(function (socket) {
-      _handleConnection(socket);
-    });
-    return new Promise(function (resolve, reject) {
-      tcpServer.once("error", reject);
-      tcpServer.listen(port, address, function () {
-        listening = true;
-        tcpServer.removeListener("error", reject);
-        _emit("mail.server.mx.listening", {
-          port: port, address: address,
-        });
-        resolve({ port: tcpServer.address().port, address: address });
-      });
-    });
-  }
+  // Port 0 (ephemeral, test mode) must NOT fall back to 25 — the `|| 25`
+  // short-circuit was a footgun on the test path; createTcpListener honors an
+  // explicit 0 (only an OMITTED port falls back to the default).
+  var _tcpListener = mailServerNet.createTcpListener(net, {
+    defaultPort:      25,                                                                             // SMTP MX port (IANA)
+    handleConnection: _handleConnection,
+    errorFactory:     function (code, message) { return new MailServerMxError("mail-server-mx/" + code, message); },
+    emit:             _emit,
+    listeningEvent:   "mail.server.mx.listening",
+  });
 
   async function close(closeOpts) {
     closeOpts = closeOpts || {};
-    if (!listening) return;
+    if (!_tcpListener.isListening()) return;
     var timeoutMs = closeOpts.timeoutMs || C.TIME.seconds(30);
-    listening = false;
-    tcpServer.close();
+    _tcpListener.markClosed();
+    _tcpListener.getServer().close();
     connections.forEach(function (sock) {
       try { _writeReply(sock, REPLY_421_SERVICE_NOT_AVAIL, "4.3.0 Server shutting down"); }
       catch (_e) { /* socket already gone */ }
@@ -1279,10 +1238,10 @@ function create(opts) {
   function connectionCount() { return connections.size; }
 
   return {
-    listen:           listen,
+    listen:           _tcpListener.listen,
     close:            close,
     connectionCount:  connectionCount,
-    _portForTest:     function () { return tcpServer ? tcpServer.address().port : null; },
+    _portForTest:     function () { var s = _tcpListener.getServer(); return s ? s.address().port : null; },
   };
 }
 

package/lib/mail-server-net.js

@@ -0,0 +1,177 @@
+"use strict";
+
+// mail-server-net — the TCP-listener lifecycle shared by the mailbox / transfer
+// servers (b.mail.server.imap / pop3 / mx / managesieve / submission). Each of
+// those keeps its OWN connection set and close() drain because those diverge:
+// the store servers (IMAP/POP3/ManageSieve) await a Promise-wrapped
+// tcpServer.close(), while the transfer servers (MX/Submission) send an SMTP
+// 421 to every live socket and drain with a timeout. What every server shares
+// verbatim is the bind: refuse a double-listen, resolve the default port (never
+// falling back off an explicit port 0 — the ephemeral test-bind path), create
+// the listener, and arm a one-shot "error"→reject so a bind failure (EADDRINUSE,
+// EACCES) rejects the listen promise instead of crashing the process. That, plus
+// the listening/server state, is what createTcpListener owns.
+
+// createTcpListener(net, cfg) — build a listener lifecycle.
+//   cfg.defaultPort      port used when listenOpts.port is omitted (an explicit
+//                        0 is honored, for an ephemeral test bind).
+//   cfg.handleConnection (socket) => void — the server's per-connection handler.
+//   cfg.errorFactory     (code, message) => Error — builds the typed
+//                        "<prefix>/already-listening" double-listen error.
+//   cfg.emit             (action, metadata) => void — the server's audit emitter.
+//   cfg.listeningEvent   the "...listening" audit action.
+//   cfg.listeningExtra   optional () => object merged onto the listening event
+//                        payload (Submission reports implicitTls).
+// Returns { listen, getServer, isListening, markClosed } — the server wires its
+// own close() through getServer()/isListening()/markClosed().
+function createTcpListener(net, cfg) {
+  var server = null;
+  var listening = false;
+
+  function listen(listenOpts) {
+    listenOpts = listenOpts || {};
+    if (listening) {
+      throw cfg.errorFactory("already-listening", "listen: already listening");
+    }
+    var port = listenOpts.port === undefined ? cfg.defaultPort : listenOpts.port;
+    var address = listenOpts.address || "0.0.0.0";
+    server = net.createServer(function (socket) { cfg.handleConnection(socket); });
+    return new Promise(function (resolve, reject) {
+      server.once("error", reject);
+      server.listen(port, address, function () {
+        listening = true;
+        server.removeListener("error", reject);
+        var payload = { port: port, address: address };
+        if (cfg.listeningExtra) {
+          var extra = cfg.listeningExtra();
+          for (var k in extra) {
+            if (Object.prototype.hasOwnProperty.call(extra, k)) payload[k] = extra[k];
+          }
+        }
+        cfg.emit(cfg.listeningEvent, payload);
+        resolve({ port: server.address().port, address: address });
+      });
+    });
+  }
+
+  // closeSimple(closeCfg) — the store-server shutdown (IMAP / POP3 / ManageSieve):
+  // mark closed, destroy every live socket immediately, then await the listener's
+  // own close before emitting the "...closed" audit. The transfer servers
+  // (MX / Submission) do NOT use this — they run a graceful SMTP-421 drain with a
+  // timeout, so they own their close() and drive it through markClosed()/getServer().
+  //   closeCfg.connections  the server's live-socket Set (destroyed + cleared).
+  //   closeCfg.emit         the server's audit emitter.
+  //   closeCfg.closedEvent  the "...closed" audit action.
+  function closeSimple(closeCfg) {
+    if (!listening) return Promise.resolve();
+    listening = false;
+    for (var s of closeCfg.connections) { try { s.destroy(); } catch (_e) { /* idempotent */ } }
+    closeCfg.connections.clear();
+    return new Promise(function (resolve) {
+      server.close(function () {
+        closeCfg.emit(closeCfg.closedEvent, {});
+        resolve();
+      });
+    });
+  }
+
+  return {
+    listen:      listen,
+    closeSimple: closeSimple,
+    getServer:   function () { return server; },
+    isListening: function () { return listening; },
+    markClosed:  function () { listening = false; },
+  };
+}
+
+// createStoreServer(net, cfg) — the COMPLETE lifecycle of a mailbox store server
+// (b.mail.server.imap / pop3 / managesieve): compose createTcpListener with the
+// destroy-then-await closeSimple shutdown and return the { listen, close } a
+// store server exposes. The three store servers are byte-identical here, varying
+// only in port, error class, error-code prefix, and audit-event base — so the
+// wiring lives here once. The transfer servers (MX / Submission) do NOT use this:
+// they run a graceful SMTP-421 drain close + a richer return ({ connectionCount,
+// _portForTest, ... }), so they call createTcpListener directly.
+//   cfg.defaultPort      port used when listen() omits one (explicit 0 honored).
+//   cfg.handleConnection (socket) => void — the per-connection handler.
+//   cfg.errorClass       the server's typed error constructor (code, message).
+//   cfg.errorCodePrefix  prepended to the double-listen error code
+//                        (e.g. "mail-server-imap/").
+//   cfg.emit             (action, metadata) => void — the server's audit emitter.
+//   cfg.connections      the live-socket Set (destroyed + cleared on close).
+//   cfg.eventBase        the audit-action base; listeningEvent = eventBase +
+//                        ".listening", closedEvent = eventBase + ".closed".
+// Returns { listen, close }.
+function createStoreServer(net, cfg) {
+  var ErrorClass = cfg.errorClass;
+  var listener = createTcpListener(net, {
+    defaultPort:      cfg.defaultPort,
+    handleConnection: cfg.handleConnection,
+    errorFactory:     function (code, message) { return new ErrorClass(cfg.errorCodePrefix + code, message); },
+    emit:             cfg.emit,
+    listeningEvent:   cfg.eventBase + ".listening",
+  });
+  function close() {
+    return listener.closeSimple({
+      connections: cfg.connections,
+      emit:        cfg.emit,
+      closedEvent: cfg.eventBase + ".closed",
+    });
+  }
+  return { listen: listener.listen, close: close };
+}
+
+// admitConnection(socket, rateLimit, emit, cfg) — the per-connection rate-limit
+// gate every mail listener's _handleConnection opens with: resolve the remote
+// IP, admit it via the shared b.mail.server.rateLimit, or refuse it with a
+// protocol-specific line + a "<...>.rate_limit_refused" audit (outcome "denied")
+// and tear the socket down. Returns the remote address on admit, or null when
+// refused — the caller does `if (addr === null) return;` then runs its own
+// (protocol-specific) close handler, connection-id, tracking-set insert, and
+// state machine, none of which this touches.
+//   cfg.refusedEvent  the "<...>.rate_limit_refused" audit action.
+//   cfg.refusalLine   the wire bytes written before destroy (IMAP "* BAD …",
+//                     POP3 "-ERR …", SMTP "421 4.7.0 …", ManageSieve 'NO "…"').
+function admitConnection(socket, rateLimit, emit, cfg) {
+  var remoteAddress = socket.remoteAddress || "0.0.0.0";
+  var admit = rateLimit.admitConnection(remoteAddress);
+  if (!admit.ok) {
+    emit(cfg.refusedEvent, { remoteAddress: remoteAddress, reason: admit.reason }, "denied");
+    try { socket.write(cfg.refusalLine); } catch (_e) { /* socket may be down */ }
+    try { socket.destroy(); } catch (_e2) { /* idempotent */ }
+    return null;
+  }
+  return remoteAddress;
+}
+
+// validateDomainHardened(d, label, cfg) — the hardened-domain check the MX and
+// Submission transfer servers run on every HELO / MAIL FROM / RCPT TO domain.
+// When a guardDomain profile is configured it validates the domain and, on
+// refusal, emits a "<refusedEvent>" audit (the only per-server difference — MX
+// vs Submission) before returning the verdict; with no profile it passes
+// through { ok: true }. Sharing it keeps the two servers' domain-validation
+// posture identical (a divergence would be a silent spoofing / IDN-homograph
+// gap on one server).
+//   cfg.guardDomainProfile  the b.guardDomain profile (falsy = validation off).
+//   cfg.guardDomain         the b.guardDomain module (its validate(d, profile)).
+//   cfg.emit                (action, metadata, outcome) => void audit emitter.
+//   cfg.refusedEvent        the "<...>.domain_refused" audit action.
+function validateDomainHardened(d, label, cfg) {
+  if (!cfg.guardDomainProfile) return { ok: true };
+  var verdict = cfg.guardDomain.validate(d, cfg.guardDomainProfile);
+  if (!verdict.ok) {
+    cfg.emit(cfg.refusedEvent, {
+      reason: verdict.issues && verdict.issues[0] && verdict.issues[0].kind,
+      domain: d,
+      label:  label,
+    }, "denied");
+  }
+  return verdict;
+}
+
+module.exports = {
+  createTcpListener: createTcpListener,
+  createStoreServer: createStoreServer,
+  admitConnection:   admitConnection,
+  validateDomainHardened: validateDomainHardened,
+};

package/lib/mail-server-pop3.js

@@ -103,7 +103,7 @@
  */
 
 var net = require("node:net");
-var lazyRequire = require("./lazy-require");
+var safeBuffer = require("./safe-buffer");
 var C = require("./constants");
 var bCrypto = require("./crypto");
 var numericBounds = require("./numeric-bounds");
@@ -111,11 +111,12 @@ var validateOpts = require("./validate-opts");
 var guardPop3Command = require("./guard-pop3-command");
 var mailServerRateLimit = require("./mail-server-rate-limit");
 var mailServerTls = require("./mail-server-tls");
+var mailServerNet = require("./mail-server-net");
 var safeSmtp = require("./safe-smtp");
 var safeAsync = require("./safe-async");
 var { defineClass } = require("./framework-error");
 
-var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 
 var MailServerPop3Error = defineClass("MailServerPop3Error", { alwaysPermanent: true });
 
@@ -229,40 +230,18 @@ function create(opts) {
     }
   }
 
-  var rateLimit;
-  if (opts.rateLimit === false) {
-    rateLimit = mailServerRateLimit.create({ disabled: true });
-  } else if (opts.rateLimit && typeof opts.rateLimit.admitConnection === "function") {
-    rateLimit = opts.rateLimit;
-  } else {
-    rateLimit = mailServerRateLimit.create(opts.rateLimit || {});
-  }
+  var rateLimit = mailServerRateLimit.resolve(opts.rateLimit);
 
-  var tcpServer = null;
-  var listening = false;
   var connections = new Set();
 
-  function _emit(action, metadata, outcome) {
-    try {
-      audit().safeEmit({
-        action: action,
-        outcome: outcome || "success",
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent */ }
-  }
+  var _emit = auditEmit.emit;
 
   function _handleConnection(rawSocket) {
-    var remoteAddress = rawSocket.remoteAddress || "0.0.0.0";
-    var admit = rateLimit.admitConnection(remoteAddress);
-    if (!admit.ok) {
-      _emit("mail.server.pop3.rate_limit_refused",
-        { remoteAddress: remoteAddress, reason: admit.reason }, "denied");
-      try { rawSocket.write("-ERR Too many connections from your IP\r\n"); }
-      catch (_e) { /* socket may be down */ }
-      try { rawSocket.destroy(); } catch (_e2) { /* idempotent */ }
-      return;
-    }
+    var remoteAddress = mailServerNet.admitConnection(rawSocket, rateLimit, _emit, {
+      refusedEvent: "mail.server.pop3.rate_limit_refused",
+      refusalLine:  "-ERR Too many connections from your IP\r\n",
+    });
+    if (remoteAddress === null) return;
     var connectionId = "pop3conn-" + bCrypto.generateToken(8);                                       // connection-id length
     var socket = rawSocket;
     connections.add(socket);
@@ -312,7 +291,7 @@ function create(opts) {
     while (true) {
       var crlf = state.lineBuffer.indexOf("\r\n");
       if (crlf === -1) {
-        if (state.lineBuffer.length > maxLineBytes) {
+        if (safeBuffer.byteLengthOf(state.lineBuffer) > maxLineBytes) {
           _writeErr(socket, "Line too long (cap " + maxLineBytes + ")");
           _close(socket);
         }
@@ -398,22 +377,18 @@ function create(opts) {
     // Drain pre-handshake buffer (RFC 2595 §4 + CVE-2021-33515 class
     // STLS-injection defense — any pipelined commands the client
     // queued before the upgrade are discarded; post-TLS reads fresh).
-    // Listener-removal + idle-timeout re-arm live in the shared
-    // upgradeSocket helper (b.mail.server.tls.upgradeSocket).
-    state.lineBuffer = Buffer.alloc(0);
-    // POP3 doesn't have an authPending shape (the SASL state is local
-    // to _handleAuth), but reset tentativeUser so a USER pipelined
-    // pre-handshake cannot bind a post-handshake PASS.
-    state.tentativeUser = null;
-    mailServerTls.upgradeSocket({
-      plainSocket:   socket,
+    // POP3 has no authPending shape (SASL state is local to
+    // _handleAuth), but tentativeUser is reset so a USER pipelined
+    // pre-handshake cannot bind a post-handshake PASS. The shared
+    // upgradeLineProtocol helper owns the lineBuffer drain + listener-
+    // strip + idle re-arm + read-pump.
+    mailServerTls.upgradeLineProtocol({
+      state:         state,
+      socket:        socket,
       secureContext: opts.tlsContext,
       idleTimeoutMs: idleTimeoutMs,
-      onSecure: function (_tlsSocket) { state.tls = true; },
-      onData: function (tlsSocket, chunk) {
-        state.lineBuffer = Buffer.concat([state.lineBuffer, chunk]);
-        _drainBuffer(state, tlsSocket);
-      },
+      clearFields:   ["tentativeUser"],
+      drain:         _drainBuffer,
       onError: function (err) {
         _emit("mail.server.pop3.tls_handshake_failed",
           { connectionId: state.id, error: (err && err.message) || String(err) }, "failure");
@@ -870,43 +845,15 @@ function create(opts) {
   }
 
   // ---- Lifecycle ----------------------------------------------------------
-  async function listen(listenOpts) {
-    listenOpts = listenOpts || {};
-    if (listening) {
-      throw new MailServerPop3Error("mail-server-pop3/already-listening",
-        "listen: already listening");
-    }
-    var port    = listenOpts.port    === undefined ? 110 : listenOpts.port;                          // RFC 1939 POP3 port (IANA)
-    var address = listenOpts.address || "0.0.0.0";
-    tcpServer = net.createServer(function (socket) { _handleConnection(socket); });
-    return new Promise(function (resolve, reject) {
-      tcpServer.once("error", reject);
-      tcpServer.listen(port, address, function () {
-        listening = true;
-        tcpServer.removeListener("error", reject);
-        _emit("mail.server.pop3.listening", { port: port, address: address });
-        resolve({ port: tcpServer.address().port, address: address });
-      });
-    });
-  }
-
-  async function close() {
-    if (!listening) return;
-    listening = false;
-    for (var s of connections) { try { s.destroy(); } catch (_e) { /* idempotent */ } }
-    connections.clear();
-    return new Promise(function (resolve) {
-      tcpServer.close(function () {
-        _emit("mail.server.pop3.closed", {});
-        resolve();
-      });
-    });
-  }
-
-  return {
-    listen:               listen,
-    close:                close,
-  };
+  return mailServerNet.createStoreServer(net, {
+    defaultPort:      110,                                                                            // RFC 1939 POP3 port (IANA)
+    handleConnection: _handleConnection,
+    errorClass:       MailServerPop3Error,
+    errorCodePrefix:  "mail-server-pop3/",
+    emit:             _emit,
+    connections:      connections,
+    eventBase:        "mail.server.pop3",
+  });
 }
 
 module.exports = {

package/lib/mail-server-rate-limit.js

@@ -88,6 +88,7 @@ var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var numericBounds = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
+var boundedMap = require("./bounded-map");
 var { defineClass } = require("./framework-error");
 
 var audit = lazyRequire(function () { return require("./audit"); });
@@ -206,8 +207,7 @@ function create(opts) {
         { reason: "concurrent-per-ip", ip: ip, cap: cfg.maxConcurrentConnectionsPerIp });
       return { ok: false, reason: "concurrent-per-ip" };
     }
-    var times = connectionTimes.get(ip);
-    if (!times) { times = []; connectionTimes.set(ip, times); }
+    var times = boundedMap.getOrInsert(connectionTimes, ip, function () { return []; });
     _pruneWindow(times, CONNECTION_RATE_WINDOW_MS);
     if (times.length >= cfg.connectionsPerIpPerMinute) {
       _audit("mail.server.rate_limit.refused", "denied",
@@ -258,8 +258,7 @@ function create(opts) {
 
   function noteAuthFailure(ip) {
     if (cfg.disabled) return;
-    var times = authFailureTimes.get(ip);
-    if (!times) { times = []; authFailureTimes.set(ip, times); }
+    var times = boundedMap.getOrInsert(authFailureTimes, ip, function () { return []; });
     times.push(Date.now());
   }
 
@@ -288,8 +287,7 @@ function create(opts) {
 
   function noteRcptFailure(ip) {
     if (cfg.disabled) return;
-    var times = rcptFailureTimes.get(ip);
-    if (!times) { times = []; rcptFailureTimes.set(ip, times); }
+    var times = boundedMap.getOrInsert(rcptFailureTimes, ip, function () { return []; });
     times.push(Date.now());
   }
 
@@ -308,8 +306,34 @@ function create(opts) {
   };
 }
 
+/**
+ * @primitive b.mail.server.rateLimit.resolve
+ * @signature b.mail.server.rateLimit.resolve(spec)
+ * @since     0.15.13
+ * @status    stable
+ * @related   b.mail.server.rateLimit.create
+ *
+ * Resolve a rate-limit `spec` into a limiter. `false` disables limiting
+ * (a disabled limiter that always admits), an already-built limiter — one
+ * exposing `admitConnection` — passes through unchanged, and anything else
+ * is treated as `create()` options. Every mail server (IMAP / POP3 / SMTP
+ * MX / Submission / ManageSieve) composes this at the top of its `create()`
+ * so the spec contract is identical across protocols.
+ *
+ * @example
+ *   var b = require("blamejs");
+ *   var rl = b.mail.server.rateLimit.resolve(false);   // disabled
+ *   // → a limiter whose admitConnection always admits
+ */
+function resolve(spec) {
+  if (spec === false) return create({ disabled: true });
+  if (spec && typeof spec.admitConnection === "function") return spec;
+  return create(spec || {});
+}
+
 module.exports = {
   create:                       create,
+  resolve:                      resolve,
   MailServerRateLimitError:     MailServerRateLimitError,
   DEFAULTS:                     DEFAULTS,
 };

package/lib/mail-server-registry.js

@@ -142,7 +142,7 @@ function create(opts) {
   validateOpts.requireNonEmptyString(opts.protocol,
     "b.mail.serverRegistry.create: protocol", MailServerRegistryError,
     "mail-server-registry/bad-protocol");
-  if (!CATALOGUE[opts.protocol]) {
+  if (!Object.prototype.hasOwnProperty.call(CATALOGUE, opts.protocol)) {
     throw new MailServerRegistryError("mail-server-registry/unknown-protocol",
       "create: protocol must be 'imap', 'jmap', or 'managesieve' (got '" + opts.protocol + "')");
   }