@bumail/smtp 0.1.0

package/dist/index.js

@@ -0,0 +1,1319 @@
+// src/errors.ts
+class SmtpError extends Error {
+  name = "SmtpError";
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+}
+// src/protocol/path.ts
+var ATOM = /^[A-Za-z0-9!#$%&'*+\-/=?^_`{|}~\u0080-\u{10ffff}]+$/u;
+var LABEL = /^(?:[A-Za-z0-9\u0080-\u{10ffff}](?:[A-Za-z0-9\-\u0080-\u{10ffff}]*[A-Za-z0-9\u0080-\u{10ffff}])?)$/u;
+var INVISIBLE = /[\u0080-\u009f\u2028\u2029\p{Cf}]/u;
+function isDotString(text) {
+  return text.split(".").every((atom) => ATOM.test(atom));
+}
+function isQuotedString(text) {
+  return /^"(?:[\x20\x21\x23-\x5b\x5d-\x7e\u0080-\u{10ffff}]|\\[\x20-\x7e])*"$/u.test(text);
+}
+function isDomain(domain) {
+  if (/^\[(?:IPv6:[0-9A-Fa-f:.]+|\d{1,3}(?:\.\d{1,3}){3})\]$/.test(domain))
+    return true;
+  return domain.length <= 255 && domain.split(".").every((label) => label.length <= 63 && LABEL.test(label));
+}
+function parsePath(text, allowNull) {
+  if (!text.startsWith("<") || !text.endsWith(">"))
+    return;
+  let inner = text.slice(1, -1);
+  if (INVISIBLE.test(inner))
+    return;
+  if (inner === "")
+    return allowNull ? { address: "", local: "", domain: "" } : undefined;
+  const route = /^@[^:]+:/.exec(inner);
+  if (route)
+    inner = inner.slice(route[0].length);
+  const at = inner.lastIndexOf("@");
+  if (at <= 0)
+    return;
+  const local = inner.slice(0, at);
+  const domain = inner.slice(at + 1);
+  if (local.length > 64 || !(isDotString(local) || isQuotedString(local)))
+    return;
+  if (!isDomain(domain))
+    return;
+  return {
+    address: `${local}@${domain.toLowerCase()}`,
+    local,
+    domain: domain.toLowerCase()
+  };
+}
+
+// src/protocol/command.ts
+function parseCommand(line) {
+  const space = line.indexOf(" ");
+  if (space < 0)
+    return { verb: line.toUpperCase(), argument: "" };
+  return {
+    verb: line.slice(0, space).toUpperCase(),
+    argument: line.slice(space + 1).trim()
+  };
+}
+function parsePathCommand(argument, keyword) {
+  const match = new RegExp(`^${keyword}:\\s*(<[^>]*>)(.*)$`, "i").exec(argument);
+  if (!match)
+    return;
+  const path = parsePath(match[1], keyword === "FROM");
+  if (!path)
+    return;
+  const parameters = {};
+  for (const item of match[2].trim().split(/\s+/)) {
+    if (item === "")
+      continue;
+    const equals = item.indexOf("=");
+    const key = (equals < 0 ? item : item.slice(0, equals)).toUpperCase();
+    if (!/^[A-Z0-9][A-Z0-9-]*$/.test(key))
+      return;
+    parameters[key] = equals < 0 ? "" : item.slice(equals + 1);
+  }
+  return { path, parameters };
+}
+// src/protocol/data.ts
+var CR = 13;
+var LF = 10;
+var DOT = 46;
+
+class DataReader {
+  #lineStart = true;
+  #held = [];
+  #size = 0;
+  bareLineBreaks = 0;
+  get size() {
+    return this.#size;
+  }
+  write(chunk) {
+    const out = new Uint8Array(chunk.length + 2);
+    let n = 0;
+    for (let i = 0;i < chunk.length; i++) {
+      const byte = chunk[i];
+      const held = this.#held;
+      if (held.length > 0) {
+        if (held[0] === DOT && held.length === 1) {
+          if (byte === CR) {
+            held.push(CR);
+            continue;
+          }
+          this.#held = [];
+          this.#lineStart = false;
+          i--;
+          continue;
+        }
+        if (held[0] === DOT && held.length === 2) {
+          this.#held = [];
+          if (byte === LF) {
+            this.#size += n;
+            return {
+              data: out.subarray(0, n),
+              done: true,
+              rest: chunk.slice(i + 1)
+            };
+          }
+          this.bareLineBreaks++;
+          out[n++] = CR;
+          this.#lineStart = false;
+          i--;
+          continue;
+        }
+        this.#held = [];
+        if (byte === LF) {
+          out[n++] = CR;
+          out[n++] = LF;
+          this.#lineStart = true;
+          continue;
+        }
+        this.bareLineBreaks++;
+        out[n++] = CR;
+        this.#lineStart = false;
+        i--;
+        continue;
+      }
+      if (byte === CR) {
+        this.#held = [CR];
+        continue;
+      }
+      if (byte === DOT && this.#lineStart) {
+        this.#held = [DOT];
+        continue;
+      }
+      if (byte === LF)
+        this.bareLineBreaks++;
+      out[n++] = byte;
+      this.#lineStart = false;
+    }
+    this.#size += n;
+    return { data: out.subarray(0, n), done: false, rest: new Uint8Array(0) };
+  }
+}
+// src/protocol/reply.ts
+function formatReply(reply, enhanced = true) {
+  const lines = typeof reply.text === "string" ? [reply.text] : reply.text;
+  const status = enhanced && reply.status ? `${reply.status} ` : "";
+  return lines.map((line, i) => {
+    const clean = line.replace(/[\r\n]+/g, " ");
+    return `${reply.code}${i === lines.length - 1 ? " " : "-"}${status}${clean}\r
+`;
+  }).join("");
+}
+var reply = (code, status, text) => status === undefined ? { code, text } : { code, status, text };
+// src/protocol/sasl.ts
+function base64ToText(text) {
+  if (!/^[A-Za-z0-9+/]*={0,2}$/.test(text) || text.length % 4 !== 0)
+    return;
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(Uint8Array.fromBase64(text));
+  } catch {
+    return;
+  }
+}
+function decodePlain(response) {
+  const text = base64ToText(response);
+  if (text === undefined)
+    return;
+  const parts = text.split("\x00");
+  if (parts.length !== 3)
+    return;
+  const [authorizationId = "", username = "", password = ""] = parts;
+  if (username === "" || password === "")
+    return;
+  return {
+    mechanism: "PLAIN",
+    username,
+    password,
+    ...authorizationId === "" || authorizationId === username ? {} : { authorizationId }
+  };
+}
+function decodeLoginStep(response) {
+  return base64ToText(response);
+}
+// src/server/guard.ts
+var LOCAL_ERROR = reply(451, "4.3.0", "Local error in processing");
+var TIMED_OUT = Symbol("timed out");
+async function within(promise, seconds) {
+  let timer;
+  const deadline = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(TIMED_OUT), seconds * 1000);
+  });
+  try {
+    return await Promise.race([promise, deadline]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function timedOut(value) {
+  return value === TIMED_OUT;
+}
+function hookTimeout(name, seconds) {
+  return new SmtpError("HOOK_TIMEOUT", `${name} did not settle within hookTimeout (${seconds} s)`);
+}
+function refusalOf(name, answer, report) {
+  if (answer === undefined)
+    return;
+  const code = answer?.code;
+  if (typeof code === "number" && code >= 400 && code < 600) {
+    return answer;
+  }
+  report(new SmtpError("INVALID_HOOK_REPLY", `${name} answered ${JSON.stringify(answer)}, which is not a refusal: a hook refuses with a 4xx or 5xx reply, and accepts with undefined`));
+  return LOCAL_ERROR;
+}
+
+// src/server/auth.ts
+var MAX_AUTH_FAILURES = 3;
+async function check(connection, credentials) {
+  const { state, settings } = connection;
+  state.waiting = "command";
+  state.loginUser = undefined;
+  if (credentials === undefined) {
+    return connection.fail(reply(501, "5.5.2", "Cannot decode the response"));
+  }
+  if (credentials.authorizationId !== undefined && credentials.authorizationId !== credentials.username) {
+    return refuse(connection);
+  }
+  const { authenticate } = settings.options;
+  const answer = await connection.check("authenticate", () => authenticate?.(credentials, connection.session));
+  if (answer.failed) {
+    return connection.send(reply(454, "4.7.0", "Temporary authentication failure"));
+  }
+  const ok = answer.value === true;
+  if (ok) {
+    state.user = credentials.username;
+    return connection.send(reply(235, "2.7.0", "Authentication successful"));
+  }
+  refuse(connection);
+}
+function refuse(connection) {
+  const { state, settings } = connection;
+  state.authFailures++;
+  if (state.authFailures >= MAX_AUTH_FAILURES) {
+    const { hostname } = settings.options;
+    connection.close(reply(421, "4.7.0", `${hostname} Too many failed authentications, closing`));
+    return;
+  }
+  connection.fail(reply(535, "5.7.8", "Authentication credentials invalid"));
+}
+async function authenticate(connection, argument) {
+  const { state, settings } = connection;
+  if (!settings.options.authenticate)
+    return connection.fail(reply(502, "5.5.1", "AUTH not available"));
+  if (!state.secure)
+    return connection.fail(reply(538, "5.7.11", "Encryption required for requested authentication mechanism"));
+  if (state.helo === undefined || !state.esmtp)
+    return connection.fail(reply(503, "5.5.1", "Send EHLO first"));
+  if (state.user !== undefined)
+    return connection.fail(reply(503, "5.5.1", "Already authenticated"));
+  if (state.transaction.from !== undefined)
+    return connection.fail(reply(503, "5.5.1", "AUTH not allowed during a transaction"));
+  const [mechanism = "", initial, extra] = argument.split(" ");
+  if (extra !== undefined)
+    return connection.fail(reply(501, "5.5.4", "Syntax: AUTH mechanism [initial-response]"));
+  switch (mechanism.toUpperCase()) {
+    case "PLAIN":
+      if (initial === undefined) {
+        state.waiting = "auth-plain";
+        return connection.send(reply(334, undefined, ""));
+      }
+      return check(connection, decodePlain(initial === "=" ? "" : initial));
+    case "LOGIN":
+      if (initial === undefined) {
+        state.waiting = "auth-login-user";
+        return connection.send(reply(334, undefined, "VXNlcm5hbWU6"));
+      }
+      return loginUser(connection, initial);
+    default:
+      return connection.fail(reply(504, "5.5.4", "Unrecognized authentication type"));
+  }
+}
+function loginUser(connection, response) {
+  const user = decodeLoginStep(response);
+  if (!user)
+    return check(connection, undefined);
+  connection.state.loginUser = user;
+  connection.state.waiting = "auth-login-password";
+  connection.send(reply(334, undefined, "UGFzc3dvcmQ6"));
+}
+async function continueAuth(connection, line) {
+  const { state } = connection;
+  if (line === "*") {
+    state.waiting = "command";
+    state.loginUser = undefined;
+    return connection.fail(reply(501, "5.0.0", "Authentication cancelled"));
+  }
+  switch (state.waiting) {
+    case "auth-plain":
+      return check(connection, decodePlain(line));
+    case "auth-login-user":
+      return loginUser(connection, line);
+    default: {
+      const password = decodeLoginStep(line);
+      const username = state.loginUser ?? "";
+      return check(connection, password ? { mechanism: "LOGIN", username, password } : undefined);
+    }
+  }
+}
+
+// src/server/state.ts
+var emptyTransaction = () => ({
+  to: [],
+  smtputf8: false,
+  body: "7BIT"
+});
+
+// src/server/transaction.ts
+function nonAscii(text) {
+  for (let i = 0;i < text.length; i++)
+    if (text.charCodeAt(i) > 127)
+      return true;
+  return false;
+}
+async function mail(connection, argument) {
+  const { state, settings } = connection;
+  if (state.helo === undefined)
+    return connection.fail(reply(503, "5.5.1", "Send EHLO first"));
+  if (state.transaction.from !== undefined) {
+    return connection.fail(reply(503, "5.5.1", "Nested MAIL command"));
+  }
+  if (settings.mode === "submission" && state.user === undefined) {
+    return connection.fail(reply(530, "5.7.0", "Authentication required"));
+  }
+  const command = parsePathCommand(argument, "FROM");
+  if (!command)
+    return connection.fail(reply(501, "5.5.4", "Syntax: MAIL FROM:<address>"));
+  const { path, parameters } = command;
+  let body = "7BIT";
+  let smtputf8 = false;
+  for (const [key, value] of Object.entries(parameters)) {
+    if (!state.esmtp)
+      return connection.fail(reply(555, "5.5.4", `${key} needs EHLO`));
+    if (key === "SIZE") {
+      if (!/^\d+$/.test(value))
+        return connection.fail(reply(501, "5.5.4", "Syntax: SIZE=<bytes>"));
+      if (Number(value) > settings.maxMessageSize) {
+        return connection.fail(reply(552, "5.3.4", "Message too big for system"));
+      }
+    } else if (key === "BODY") {
+      const kind = value.toUpperCase();
+      if (kind !== "7BIT" && kind !== "8BITMIME") {
+        return connection.fail(reply(501, "5.5.4", "BODY is 7BIT or 8BITMIME"));
+      }
+      body = kind;
+    } else if (key === "SMTPUTF8" && value === "") {
+      smtputf8 = true;
+    } else if (key === "AUTH") {} else {
+      return connection.fail(reply(555, "5.5.4", `${key} is not supported`));
+    }
+  }
+  if (!smtputf8 && nonAscii(path.address)) {
+    return connection.fail(reply(553, "5.6.7", "A non-ASCII address needs SMTPUTF8"));
+  }
+  const options = settings.options;
+  const refused = options.onMailFrom ? await connection.hook("onMailFrom", () => options.onMailFrom?.(path, connection.session)) : undefined;
+  if (refused)
+    return connection.send(refused);
+  state.transaction = { from: path.address, to: [], smtputf8, body };
+  connection.send(reply(250, "2.1.0", "OK"));
+}
+async function rcpt(connection, argument) {
+  const { state, settings } = connection;
+  if (state.transaction.from === undefined)
+    return connection.fail(reply(503, "5.5.1", "Send MAIL first"));
+  const command = parsePathCommand(argument, "TO");
+  if (!command)
+    return connection.fail(reply(501, "5.5.4", "Syntax: RCPT TO:<address>"));
+  const { path, parameters } = command;
+  if (Object.keys(parameters).length > 0) {
+    return connection.fail(reply(555, "5.5.4", `${Object.keys(parameters)[0]} is not supported`));
+  }
+  if (!state.transaction.smtputf8 && nonAscii(path.address)) {
+    return connection.fail(reply(553, "5.6.7", "A non-ASCII address needs SMTPUTF8"));
+  }
+  if (state.transaction.to.length >= settings.maxRecipients) {
+    return connection.send(reply(452, "4.5.3", "Too many recipients"));
+  }
+  if (state.user === undefined) {
+    const local = await connection.check("localDomains", () => settings.isLocal(path.domain));
+    if (local.failed)
+      return connection.send(LOCAL_ERROR);
+    if (local.value !== true) {
+      return connection.fail(reply(554, "5.7.1", "Relay access denied"));
+    }
+  }
+  const options = settings.options;
+  const refused = options.onRcptTo ? await connection.hook("onRcptTo", () => options.onRcptTo?.(path, connection.session)) : undefined;
+  if (refused)
+    return connection.send(refused);
+  state.transaction.to.push(path.address);
+  connection.send(reply(250, "2.1.5", "OK"));
+}
+
+// src/server/commands.ts
+function ehloLines(connection) {
+  const { settings, state } = connection;
+  const lines = [
+    `${settings.options.hostname} greets ${state.helo}`,
+    "PIPELINING",
+    `SIZE ${settings.maxMessageSize}`,
+    "8BITMIME",
+    "SMTPUTF8",
+    "ENHANCEDSTATUSCODES"
+  ];
+  if (settings.options.tls && !state.secure)
+    lines.push("STARTTLS");
+  if (settings.options.authenticate && state.secure && state.user === undefined) {
+    lines.push("AUTH PLAIN LOGIN");
+  }
+  return lines;
+}
+async function hello(connection, argument, esmtp) {
+  if (!/^(?:[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*|\[[0-9A-Fa-f:.Iv]+\])$/.test(argument)) {
+    connection.fail(reply(501, "5.5.4", `Syntax: ${esmtp ? "EHLO" : "HELO"} hostname`));
+    return;
+  }
+  const { state } = connection;
+  state.helo = argument;
+  state.esmtp = esmtp;
+  state.transaction = emptyTransaction();
+  connection.send(esmtp ? reply(250, undefined, ehloLines(connection)) : reply(250, undefined, `${connection.settings.options.hostname} greets ${argument}`));
+}
+function data(connection, argument) {
+  const { state } = connection;
+  const refusal = argument !== "" ? reply(501, "5.5.4", "Syntax: DATA") : state.transaction.from === undefined ? reply(503, "5.5.1", "Send MAIL first") : state.transaction.to.length === 0 ? reply(554, "5.5.1", "No valid recipients") : undefined;
+  if (refusal) {
+    connection.fail(refusal);
+    connection.input.drop();
+    return;
+  }
+  connection.send(reply(354, undefined, "End data with <CR><LF>.<CR><LF>"));
+  connection.input.beginData();
+}
+async function startTls(connection, argument) {
+  const { state, settings } = connection;
+  const refusal = !settings.options.tls ? reply(454, "4.7.0", "TLS not available") : state.secure ? reply(503, "5.5.1", "TLS already active") : argument !== "" ? reply(501, "5.5.4", "Syntax: STARTTLS") : undefined;
+  if (refusal) {
+    connection.fail(refusal);
+    return;
+  }
+  connection.send(reply(220, "2.0.0", "Ready to start TLS"));
+  connection.input.ignore();
+  await connection.transport.drained();
+  if (connection.closed)
+    return;
+  connection.transport.startTls();
+  connection.input.accept();
+  state.secure = true;
+  state.helo = undefined;
+  state.esmtp = false;
+  state.transaction = emptyTransaction();
+}
+async function runCommand(connection, line) {
+  const { state } = connection;
+  if (state.waiting !== "command")
+    return continueAuth(connection, line);
+  const { verb, argument } = parseCommand(line);
+  switch (verb) {
+    case "EHLO":
+      return hello(connection, argument, true);
+    case "HELO":
+      return hello(connection, argument, false);
+    case "MAIL":
+      return mail(connection, argument);
+    case "RCPT":
+      return rcpt(connection, argument);
+    case "DATA":
+      return data(connection, argument);
+    case "RSET":
+      state.transaction = emptyTransaction();
+      return connection.send(reply(250, "2.0.0", "OK"));
+    case "NOOP":
+      return connection.send(reply(250, "2.0.0", "OK"));
+    case "VRFY":
+      return connection.send(reply(252, "2.5.0", "Cannot VRFY user; send the message and it will be tried"));
+    case "HELP":
+      return connection.send(reply(214, "2.0.0", "See RFC 5321"));
+    case "QUIT":
+      return connection.close(reply(221, "2.0.0", `${connection.settings.options.hostname} closing connection`));
+    case "STARTTLS":
+      return startTls(connection, argument);
+    case "AUTH":
+      return authenticate(connection, argument);
+    default:
+      return connection.fail(reply(500, "5.5.2", "Command unrecognized"));
+  }
+}
+
+// src/server/received.ts
+var DAYS = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
+var MONTHS = [
+  "Jan",
+  "Feb",
+  "Mar",
+  "Apr",
+  "May",
+  "Jun",
+  "Jul",
+  "Aug",
+  "Sep",
+  "Oct",
+  "Nov",
+  "Dec"
+];
+var two = (n) => String(n).padStart(2, "0");
+function dateTime(date) {
+  return `${DAYS[date.getUTCDay()]}, ${date.getUTCDate()} ${MONTHS[date.getUTCMonth()]} ${date.getUTCFullYear()} ${two(date.getUTCHours())}:${two(date.getUTCMinutes())}:${two(date.getUTCSeconds())} +0000`;
+}
+function protocolOf(esmtp, secure, authenticated) {
+  if (!esmtp)
+    return "SMTP";
+  return `ESMTP${secure ? "S" : ""}${authenticated ? "A" : ""}`;
+}
+function printable(text) {
+  let out = "";
+  for (const char of text) {
+    const code = char.charCodeAt(0);
+    out += code > 32 && code < 127 ? char : "?";
+  }
+  return out;
+}
+function plain(address) {
+  return printable(address) === address && !address.includes(";");
+}
+function receivedField(connection, recipients, id, now = new Date) {
+  const { state, transport, settings } = connection;
+  const lines = [
+    `Received: from ${printable(state.helo ?? "unknown")} ([${printable(transport.remoteAddress)}])`,
+    `	by ${settings.options.hostname} with ${protocolOf(state.esmtp, state.secure, state.user !== undefined)} id ${id}`
+  ];
+  const [recipient] = recipients;
+  if (recipients.length === 1 && recipient !== undefined && plain(recipient)) {
+    lines.push(`	for <${recipient}>`);
+  }
+  lines[lines.length - 1] += `; ${dateTime(now)}`;
+  return `${lines.join(`\r
+`)}\r
+`;
+}
+
+// src/server/refusals.ts
+var TOO_BIG = reply(552, "5.3.4", "Message too big for system");
+var BARE_LINE_BREAK = reply(550, "5.6.11", "Bare CR or LF is not allowed in a message");
+function tooBig(maxMessageSize) {
+  return new SmtpError("MESSAGE_TOO_BIG", `The message is larger than maxMessageSize (${maxMessageSize} bytes); do not deliver it`);
+}
+function bareLineBreak() {
+  return new SmtpError("BARE_LINE_BREAK", "The message holds a bare CR or LF (SMTP smuggling); do not deliver it");
+}
+function connectionLost(ended) {
+  return new SmtpError("CONNECTION_LOST", ended ? "The connection closed before the reply to the message; do not deliver it" : "The connection closed before the end of the message; do not deliver it");
+}
+function notAnswered(seconds) {
+  return new SmtpError("HOOK_TIMEOUT", `onData did not answer within hookTimeout (${seconds} s); do not deliver it`);
+}
+function notReadInTime(seconds) {
+  return new SmtpError("HOOK_TIMEOUT", `onData did not read the message within hookTimeout (${seconds} s); do not deliver it`);
+}
+function notRead() {
+  return new SmtpError("MESSAGE_NOT_READ", "onData answered without reading the message to its end; it was not taken");
+}
+
+// src/server/intake.ts
+var HIGH_WATER_MARK = 64 * 1024;
+
+class Intake {
+  id = crypto.getRandomValues(new Uint8Array(10)).toHex();
+  #connection;
+  #reader = new DataReader;
+  #controller;
+  #queue = [];
+  #queued = 0;
+  #ended = false;
+  #read = false;
+  #state = "open";
+  #failure;
+  #wakers = [];
+  #delivery;
+  #readWhenAnswered = false;
+  #refusal = new AbortController;
+  constructor(connection, transaction) {
+    this.#connection = connection;
+    const content = new ReadableStream({
+      start: (controller) => {
+        this.#controller = controller;
+      },
+      pull: (controller) => this.#pull(controller),
+      cancel: () => {
+        if (this.#state === "open")
+          this.#state = "cancelled";
+        this.#queue = [];
+        this.#queued = 0;
+        this.#wake();
+      }
+    }, { highWaterMark: 0 });
+    this.#push(new TextEncoder().encode(receivedField(connection, transaction.to, this.id)));
+    const message = {
+      id: this.id,
+      envelope: {
+        from: transaction.from ?? "",
+        to: [...transaction.to],
+        smtputf8: transaction.smtputf8,
+        body: transaction.body
+      },
+      content,
+      signal: this.#refusal.signal
+    };
+    this.#delivery = this.#deliver(message);
+  }
+  async#deliver(message) {
+    const connection = this.#connection;
+    let ownRefusal = false;
+    const refuse = (error) => {
+      this.#refusal.abort(error);
+      connection.report(error);
+    };
+    try {
+      await Promise.resolve();
+      const answer = await connection.settings.options.onData(message, connection.session);
+      const refusal = refusalOf("onData", answer, refuse);
+      ownRefusal = refusal !== undefined && refusal === answer;
+      return refusal;
+    } catch (error) {
+      refuse(error);
+      return LOCAL_ERROR;
+    } finally {
+      this.#readWhenAnswered = this.#read;
+      if (!this.#read)
+        this.#stop(!ownRefusal);
+      this.#wake();
+    }
+  }
+  async write(chunk) {
+    const { data, done, rest } = this.#reader.write(chunk);
+    const { maxMessageSize } = this.#connection.settings;
+    if (this.#failure)
+      return { done, rest };
+    if (this.#reader.size > maxMessageSize) {
+      this.#fail(TOO_BIG, tooBig(maxMessageSize));
+    } else if (this.#reader.bareLineBreaks > 0) {
+      this.#fail(BARE_LINE_BREAK, bareLineBreak());
+    } else if (this.#state === "open" && data.length > 0) {
+      this.#push(data);
+      await this.#room();
+    }
+    return { done, rest };
+  }
+  async finish() {
+    if (this.#failure)
+      return this.#failure;
+    this.#ended = true;
+    this.#wake();
+    const { hookTimeout: seconds } = this.#connection.settings;
+    const answer = await within(this.#delivery, seconds);
+    if (timedOut(answer)) {
+      this.#connection.report(hookTimeout("onData", seconds));
+      this.#fail(LOCAL_ERROR, notAnswered(seconds));
+      return LOCAL_ERROR;
+    }
+    if (answer)
+      return answer;
+    if (!this.#readWhenAnswered) {
+      const error = notRead();
+      this.#refusal.abort(error);
+      this.#connection.report(error);
+      return LOCAL_ERROR;
+    }
+    return reply(250, "2.0.0", `OK queued as ${this.id}`);
+  }
+  abort() {
+    this.#fail(LOCAL_ERROR, connectionLost(this.#ended));
+  }
+  #push(bytes) {
+    this.#queue.push(bytes);
+    this.#queued += bytes.length;
+    this.#wake();
+  }
+  async#pull(controller) {
+    for (;; ) {
+      if (this.#state !== "open")
+        return;
+      const next = this.#queue.shift();
+      if (next) {
+        this.#queued -= next.length;
+        controller.enqueue(next);
+        this.#wake();
+        return;
+      }
+      if (this.#ended) {
+        this.#read = true;
+        this.#state = "closed";
+        controller.close();
+        return;
+      }
+      await new Promise((wake) => this.#wakers.push(wake));
+    }
+  }
+  #stop(abortSignal) {
+    if (this.#state !== "open")
+      return;
+    const error = notRead();
+    if (abortSignal)
+      this.#refusal.abort(error);
+    this.#controller.error(error);
+    this.#state = "cancelled";
+    this.#queue = [];
+    this.#queued = 0;
+  }
+  #fail(answer, error) {
+    this.#failure ??= answer;
+    this.#refusal.abort(error);
+    if (this.#state === "open")
+      this.#controller.error(error);
+    this.#state = "errored";
+    this.#queue = [];
+    this.#queued = 0;
+    this.#wake();
+  }
+  async#room() {
+    const { hookTimeout: seconds } = this.#connection.settings;
+    while (this.#state === "open" && this.#queued > HIGH_WATER_MARK) {
+      const woken = await within(new Promise((wake) => this.#wakers.push(wake)), seconds);
+      if (timedOut(woken)) {
+        this.#connection.report(hookTimeout("onData", seconds));
+        this.#fail(LOCAL_ERROR, notReadInTime(seconds));
+      }
+    }
+  }
+  #wake() {
+    for (const wake of this.#wakers.splice(0))
+      wake();
+  }
+}
+
+// src/server/lines.ts
+var MAX_LINE = 2048;
+
+class LineSplitter {
+  #held = new Uint8Array(0);
+  #skipping = false;
+  #rest = new Uint8Array(0);
+  push(chunk) {
+    this.#rest = this.#held.length > 0 ? concat(this.#held, chunk) : chunk;
+    this.#held = new Uint8Array(0);
+  }
+  next() {
+    for (;; ) {
+      const data = this.#rest;
+      const lf = data.indexOf(10);
+      if (lf < 0) {
+        this.#rest = new Uint8Array(0);
+        if (this.#skipping)
+          return;
+        if (data.length > MAX_LINE) {
+          this.#skipping = true;
+          return { tooLong: true };
+        }
+        this.#held = data.slice();
+        return;
+      }
+      const end = lf > 0 && data[lf - 1] === 13 ? lf - 1 : lf;
+      this.#rest = data.subarray(lf + 1);
+      if (this.#skipping) {
+        this.#skipping = false;
+        continue;
+      }
+      if (end > MAX_LINE)
+        return { tooLong: true };
+      return { line: new TextDecoder().decode(data.subarray(0, end)) };
+    }
+  }
+  takeRest() {
+    const rest = this.#rest;
+    this.#rest = new Uint8Array(0);
+    return rest;
+  }
+  clear() {
+    this.#held = new Uint8Array(0);
+    this.#rest = new Uint8Array(0);
+    this.#skipping = false;
+  }
+}
+function concat(a, b) {
+  const out = new Uint8Array(a.length + b.length);
+  out.set(a, 0);
+  out.set(b, a.length);
+  return out;
+}
+
+// src/server/input.ts
+var INPUT_LIMIT = 64 * 1024;
+
+class Input {
+  #connection;
+  #input = [];
+  #queued = 0;
+  #paused = false;
+  #lines = new LineSplitter;
+  #intake;
+  #answering;
+  #pumping;
+  #greeted = false;
+  early = false;
+  #ignoring = false;
+  #dropped = false;
+  constructor(connection) {
+    this.#connection = connection;
+  }
+  greeted() {
+    this.#greeted = true;
+  }
+  receive(chunk) {
+    if (this.#ignoring)
+      return;
+    if (!this.#greeted) {
+      this.early = true;
+      return;
+    }
+    this.#input.push(chunk.slice());
+    this.#queued += chunk.length;
+    if (this.#queued > INPUT_LIMIT && !this.#paused) {
+      this.#paused = true;
+      this.#connection.transport.pause();
+    }
+    this.#kick();
+  }
+  abort() {
+    this.#intake?.abort();
+    this.#intake = undefined;
+    this.#answering?.abort();
+    this.#answering = undefined;
+  }
+  ignore() {
+    this.drop();
+    this.#input = [];
+    this.#queued = 0;
+    this.#ignoring = true;
+    this.#resume();
+  }
+  accept() {
+    this.#ignoring = false;
+  }
+  drop() {
+    this.#lines.clear();
+    this.#dropped = true;
+  }
+  beginData() {
+    const connection = this.#connection;
+    this.#intake = new Intake(connection, connection.state.transaction);
+    connection.state.waiting = "data";
+  }
+  async idle() {
+    while (this.#pumping)
+      await this.#pumping;
+  }
+  #kick() {
+    if (this.#pumping)
+      return;
+    const connection = this.#connection;
+    this.#pumping = this.#pump().catch((error) => {
+      connection.report(error);
+      connection.close(reply(421, "4.3.0", "Local error, closing"));
+    }).finally(() => {
+      this.#pumping = undefined;
+      if (!connection.closed && this.#input.length > 0)
+        this.#kick();
+    });
+  }
+  #resume() {
+    if (this.#paused && this.#queued <= INPUT_LIMIT / 2) {
+      this.#paused = false;
+      this.#connection.transport.resume();
+    }
+  }
+  async#pump() {
+    while (!this.#connection.closed && this.#input.length > 0) {
+      const chunk = this.#input.shift();
+      this.#queued -= chunk.length;
+      this.#resume();
+      if (this.#connection.state.waiting === "data")
+        await this.#data(chunk);
+      else
+        await this.#commands(chunk);
+    }
+  }
+  async#commands(chunk) {
+    this.#lines.push(chunk);
+    while (!this.#connection.closed) {
+      await this.#connection.transport.drained();
+      const event = this.#lines.next();
+      if (!event)
+        return;
+      if (!("line" in event)) {
+        this.#connection.fail(reply(500, "5.5.6", "Line too long"));
+        continue;
+      }
+      this.#dropped = false;
+      await runCommand(this.#connection, event.line);
+      if (this.#dropped)
+        return;
+      if (this.#connection.state.waiting === "data") {
+        const rest = this.#lines.takeRest();
+        if (rest.length > 0)
+          this.#unshift(rest.slice());
+        return;
+      }
+    }
+  }
+  async#data(chunk) {
+    const intake = this.#intake;
+    const { done, rest } = await intake.write(chunk);
+    if (!done || this.#connection.closed)
+      return;
+    this.#intake = undefined;
+    this.#answering = intake;
+    this.#connection.state.waiting = "command";
+    this.#connection.state.transaction = emptyTransaction();
+    const answer = await intake.finish();
+    this.#answering = undefined;
+    this.#connection.send(answer);
+    if (rest.length > 0)
+      this.#unshift(rest);
+  }
+  #unshift(bytes) {
+    this.#input.unshift(bytes);
+    this.#queued += bytes.length;
+    if (this.#queued > INPUT_LIMIT && !this.#paused) {
+      this.#paused = true;
+      this.#connection.transport.pause();
+    }
+  }
+}
+
+// src/server/connection.ts
+class Connection {
+  settings;
+  #transport;
+  id = crypto.getRandomValues(new Uint8Array(8)).toHex();
+  data = {};
+  state;
+  input = new Input(this);
+  #closed = false;
+  constructor(settings, transport) {
+    this.settings = settings;
+    this.#transport = transport;
+    this.state = {
+      esmtp: false,
+      secure: transport.secure,
+      transaction: emptyTransaction(),
+      waiting: "command",
+      errors: 0,
+      authFailures: 0
+    };
+  }
+  get transport() {
+    return this.#transport;
+  }
+  useTransport(transport) {
+    this.#transport = transport;
+  }
+  get session() {
+    const { helo, user } = this.state;
+    return {
+      id: this.id,
+      remoteAddress: this.transport.remoteAddress,
+      secure: this.state.secure,
+      esmtp: this.state.esmtp,
+      ...helo === undefined ? {} : { helo },
+      ...user === undefined ? {} : { user },
+      data: this.data
+    };
+  }
+  get closed() {
+    return this.#closed;
+  }
+  send(answer) {
+    if (this.#closed)
+      return;
+    this.transport.write(formatReply(answer, this.state.esmtp));
+  }
+  close(answer) {
+    if (this.#closed)
+      return;
+    if (answer)
+      this.send(answer);
+    this.#closed = true;
+    this.input.abort();
+    this.transport.end();
+  }
+  fail(answer) {
+    this.state.errors++;
+    if (this.state.errors >= this.settings.maxErrors) {
+      const { hostname } = this.settings.options;
+      this.close(reply(421, "4.7.0", `${hostname} Too many errors, closing`));
+    } else {
+      this.send(answer);
+    }
+  }
+  report(error) {
+    try {
+      this.settings.options.onError?.(error, this.session);
+    } catch {}
+  }
+  async hook(name, run, deadline = true) {
+    const answer = await this.check(name, run, deadline);
+    if (answer.failed)
+      return LOCAL_ERROR;
+    return refusalOf(name, answer.value, (error) => this.report(error));
+  }
+  async check(name, run, deadline = true) {
+    const seconds = this.settings.hookTimeout;
+    try {
+      const running = Promise.resolve().then(run);
+      const value = deadline ? await within(running, seconds) : await running;
+      if (timedOut(value)) {
+        this.report(hookTimeout(name, seconds));
+        return { failed: true };
+      }
+      return { failed: false, value };
+    } catch (error) {
+      this.report(error);
+      return { failed: true };
+    }
+  }
+  async open() {
+    const { options } = this.settings;
+    const refused = options.onConnect ? await this.hook("onConnect", () => options.onConnect?.(this.session)) : undefined;
+    if (refused)
+      return this.close(refused);
+    const { greetingDelay } = this.settings;
+    if (greetingDelay > 0)
+      await Bun.sleep(greetingDelay * 1000);
+    if (this.#closed)
+      return;
+    if (this.input.early) {
+      return this.close(reply(554, "5.5.0", `${options.hostname} Talked before the greeting`));
+    }
+    this.send(reply(220, undefined, `${options.hostname} ESMTP ready`));
+    this.transport.restartIdle(this.settings.timeout);
+    this.input.greeted();
+  }
+  receive(chunk) {
+    if (!this.#closed)
+      this.input.receive(chunk);
+  }
+  idle() {
+    return this.input.idle();
+  }
+}
+
+// src/server/settings.ts
+var invalid = (message) => new SmtpError("INVALID_OPTION", `createSmtpServer(): ${message}`);
+function positive(name, value, fallback) {
+  if (value === undefined)
+    return fallback;
+  if (!Number.isSafeInteger(value) || value < 1) {
+    throw invalid(`${name} must be a positive integer, not ${value}`);
+  }
+  return value;
+}
+function nonNegative(name, value, fallback) {
+  if (value === undefined)
+    return fallback;
+  if (!Number.isFinite(value) || value < 0) {
+    throw invalid(`${name} must be a number of seconds, 0 or more, not ${value}`);
+  }
+  return value;
+}
+function localLookup(local) {
+  if (typeof local === "function")
+    return local;
+  if (Array.isArray(local) && local.every((domain) => typeof domain === "string")) {
+    const domains = new Set(local.map((domain) => domain.toLowerCase()));
+    return (domain) => domains.has(domain);
+  }
+  throw invalid("localDomains must be an array of domains or a function");
+}
+function settingsOf(options) {
+  if (typeof options.hostname !== "string" || !/^[A-Za-z0-9.-]+$/.test(options.hostname)) {
+    throw invalid(`"${options.hostname}" is not a host name`);
+  }
+  if (typeof options.onData !== "function") {
+    throw invalid("onData must be a function: it is where messages go");
+  }
+  if (options.implicitTls && !options.tls) {
+    throw invalid("implicitTls needs tls: { key, cert }");
+  }
+  if (options.mode === "submission" && !options.authenticate) {
+    throw invalid("submission takes mail only from authenticated users, so it needs authenticate");
+  }
+  if (options.authenticate && !options.tls) {
+    throw invalid("authenticate needs tls: { key, cert }, since AUTH is offered only once encrypted");
+  }
+  const isLocal = localLookup(options.localDomains);
+  const timeout = positive("timeout", options.timeout, 300);
+  const greetingDelay = nonNegative("greetingDelay", options.greetingDelay, 0);
+  if (greetingDelay >= timeout) {
+    throw invalid(`greetingDelay (${greetingDelay} s) must be shorter than timeout (${timeout} s), or every client times out before the greeting`);
+  }
+  return {
+    options,
+    mode: options.mode ?? "mx",
+    maxMessageSize: positive("maxMessageSize", options.maxMessageSize, 25 * 1024 * 1024),
+    maxRecipients: positive("maxRecipients", options.maxRecipients, 100),
+    maxConnections: positive("maxConnections", options.maxConnections, 1000),
+    maxErrors: positive("maxErrors", options.maxErrors, 10),
+    timeout,
+    hookTimeout: positive("hookTimeout", options.hookTimeout, 60),
+    greetingDelay,
+    isLocal: (domain) => isLocal(domain.toLowerCase())
+  };
+}
+
+// src/server/transport.ts
+class SocketTransport {
+  #socket;
+  remoteAddress;
+  secure;
+  #startTls;
+  #queue = [];
+  #waiters = [];
+  #ending = false;
+  constructor(socket, secure, startTls, remoteAddress = socket.remoteAddress) {
+    this.#socket = socket;
+    this.secure = secure;
+    this.#startTls = startTls;
+    this.remoteAddress = remoteAddress;
+  }
+  write(text) {
+    const bytes = new TextEncoder().encode(text);
+    if (this.#queue.length > 0) {
+      this.#queue.push(bytes);
+      return;
+    }
+    const written = this.#socket.write(bytes);
+    if (written < bytes.length)
+      this.#queue.push(bytes.subarray(written));
+  }
+  drain() {
+    while (this.#queue.length > 0) {
+      const bytes = this.#queue[0];
+      const written = this.#socket.write(bytes);
+      if (written < bytes.length) {
+        this.#queue[0] = bytes.subarray(written);
+        return;
+      }
+      this.#queue.shift();
+    }
+    for (const wake of this.#waiters.splice(0))
+      wake();
+    if (this.#ending)
+      this.#socket.end();
+  }
+  drained() {
+    if (this.#queue.length === 0)
+      return Promise.resolve();
+    return new Promise((wake) => this.#waiters.push(wake));
+  }
+  closed() {
+    this.#queue = [];
+    for (const wake of this.#waiters.splice(0))
+      wake();
+  }
+  end() {
+    if (this.#queue.length === 0)
+      this.#socket.end();
+    else
+      this.#ending = true;
+  }
+  pause() {
+    this.#socket.pause();
+  }
+  resume() {
+    this.#socket.resume();
+  }
+  startTls() {
+    this.#startTls();
+  }
+  restartIdle(seconds) {
+    this.#socket.timeout(seconds);
+  }
+}
+
+// src/server/server.ts
+function handlers(settings) {
+  const idle = reply(421, "4.4.2", `${settings.options.hostname} Idle too long, closing`);
+  return {
+    data(socket, chunk) {
+      if (socket.data.upgraded)
+        return;
+      socket.timeout(settings.timeout);
+      socket.data.connection?.receive(chunk);
+    },
+    drain(socket) {
+      if (!socket.data.upgraded)
+        socket.data.transport?.drain();
+    },
+    error(socket) {
+      socket.data.connection?.close();
+    },
+    timeout(socket) {
+      if (socket.data.upgraded)
+        return;
+      socket.data.connection?.close(idle);
+    }
+  };
+}
+function transportOf(socket, settings, secure) {
+  const transport = new SocketTransport(socket, secure, () => {
+    const tls = settings.options.tls;
+    const connection = socket.data.connection;
+    if (!tls || !connection)
+      return;
+    socket.data.upgraded = true;
+    const [, encrypted] = socket.upgradeTLS({
+      tls: { key: tls.key, cert: tls.cert },
+      data: { connection, upgraded: false },
+      socket: {
+        ...handlers(settings),
+        close: (s) => {
+          s.data.transport?.closed();
+          connection.close();
+        }
+      }
+    });
+    encrypted.timeout(settings.timeout);
+    const next = new SocketTransport(encrypted, true, () => {}, socket.remoteAddress);
+    encrypted.data.transport = next;
+    connection.useTransport(next);
+  });
+  socket.data.transport = transport;
+  return transport;
+}
+function createSmtpServer(options) {
+  const settings = settingsOf(options);
+  let listener;
+  let open = 0;
+  const secure = options.implicitTls === true;
+  return {
+    get connections() {
+      return open;
+    },
+    async listen({ port, hostname = "0.0.0.0" }) {
+      if (listener) {
+        throw new SmtpError("ALREADY_LISTENING", `listen(): the server is already listening on ${listener.hostname}:${listener.port}`);
+      }
+      listener = Bun.listen({
+        hostname,
+        port,
+        ...secure && options.tls ? { tls: { key: options.tls.key, cert: options.tls.cert } } : {},
+        socket: {
+          ...handlers(settings),
+          open(socket) {
+            socket.data = { upgraded: false };
+            socket.timeout(settings.timeout);
+            if (open >= settings.maxConnections) {
+              socket.end(`421 4.3.2 ${options.hostname} Too many connections, try later\r
+`);
+              return;
+            }
+            open++;
+            const connection = new Connection(settings, transportOf(socket, settings, secure));
+            socket.data.connection = connection;
+            connection.open();
+          },
+          close(socket) {
+            if (socket.data.connection)
+              open--;
+            socket.data.transport?.closed();
+            socket.data.connection?.close();
+          }
+        }
+      });
+      return { port: listener.port, hostname: listener.hostname };
+    },
+    stop(closeConnections = false) {
+      listener?.stop(closeConnections);
+      listener = undefined;
+    }
+  };
+}
+export {
+  DataReader,
+  SmtpError,
+  createSmtpServer,
+  decodeLoginStep,
+  decodePlain,
+  formatReply,
+  parseCommand,
+  parsePath,
+  parsePathCommand,
+  reply
+};
+
+//# debugId=DE4D9903D05BDADC64756E2164756E21
+//# sourceMappingURL=index.js.map