@bumail/smtp 0.3.0 → 0.5.0

package/dist/index.js

@@ -1,12 +1,13 @@
 import {
   SmtpError2,
+  POSTMASTER,
   isHelloName,
   parsePath2,
   decodePlain2,
   decodeLoginStep2,
   LineSplitter,
   Outgoing
-} from "./chunks/index-3423jxf9.js";
+} from "./chunks/index-n4xwep5m.js";
 // src/protocol/command.ts
 function parseCommand(line) {
   const space = line.indexOf(" ");
@@ -21,7 +22,8 @@ function parsePathCommand(argument, keyword) {
   const match = new RegExp(`^${keyword}:\\s*(<[^>]*>)(.*)$`, "i").exec(argument);
   if (!match)
     return;
-  const path = parsePath2(match[1], keyword === "FROM");
+  const text = match[1];
+  const path = keyword === "TO" && text.toLowerCase() === "<postmaster>" ? POSTMASTER : parsePath2(text, keyword === "FROM");
   if (!path)
     return;
   const parameters = {};
@@ -123,6 +125,40 @@ function formatReply(reply, enhanced = true) {
   }).join("");
 }
 var reply = (code, status, text) => status === undefined ? { code, text } : { code, status, text };
+// src/server/client-key.ts
+import { isIP } from "node:net";
+function groups(ip) {
+  const dotted = /(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(ip);
+  let text = ip;
+  if (dotted !== null) {
+    const [a, b, c, d] = dotted.slice(1).map(Number);
+    text = `${ip.slice(0, dotted.index)}${(a << 8 | b).toString(16)}:${(c << 8 | d).toString(16)}`;
+  }
+  const [head = "", tail] = text.split("::");
+  const left = head === "" ? [] : head.split(":");
+  const right = tail === undefined || tail === "" ? [] : tail.split(":");
+  const all = tail === undefined ? left : [...left, ...Array(8 - left.length - right.length).fill("0"), ...right];
+  return all.map((group) => Number.parseInt(group, 16));
+}
+function ipv4Of(g) {
+  const [high = 0, low = 0] = g.slice(6);
+  return [high >> 8, high & 255, low >> 8, low & 255].join(".");
+}
+function clientKey(ip) {
+  if (typeof ip !== "string")
+    return;
+  const address = ip.replace(/^\[|\]$/g, "").replace(/%.*$/, "");
+  if (isIP(address) === 4)
+    return address;
+  if (isIP(address) !== 6)
+    return;
+  const g = groups(address.toLowerCase());
+  const prefix = g.slice(0, 6).join(":");
+  if (prefix === "0:0:0:0:0:65535" || prefix === "100:65435:0:0:0:0") {
+    return ipv4Of(g);
+  }
+  return `${g.slice(0, 4).map((group) => group.toString(16)).join(":")}::/64`;
+}
 // src/server/guard.ts
 var LOCAL_ERROR = reply(451, "4.3.0", "Local error in processing");
 var TIMED_OUT = Symbol("timed out");
@@ -326,7 +362,7 @@ async function rcpt(connection, argument) {
   if (state.transaction.to.length >= settings.maxRecipients) {
     return connection.send(reply(452, "4.5.3", "Too many recipients"));
   }
-  if (state.user === undefined) {
+  if (state.user === undefined && path.postmaster !== true) {
     const local = await connection.check("localDomains", () => settings.isLocal(path.domain));
     if (local.failed)
       return connection.send(LOCAL_ERROR);
@@ -438,6 +474,7 @@ async function runCommand(connection, line) {
 }
 
 // src/server/received.ts
+import { isIPv6 } from "node:net";
 var DAYS = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
 var MONTHS = [
   "Jan",
@@ -462,6 +499,10 @@ function protocolOf(esmtp, secure, authenticated) {
     return "SMTP";
   return `ESMTP${secure ? "S" : ""}${authenticated ? "A" : ""}`;
 }
+function addressLiteral(address) {
+  const bare = address.replace(/%.*$/, "");
+  return isIPv6(bare) ? `IPv6:${bare}` : printable(address);
+}
 function printable(text) {
   let out = "";
   for (const char of text) {
@@ -476,7 +517,7 @@ function plain(address) {
 function receivedField(connection, recipients, id, now = new Date) {
   const { state, transport, settings } = connection;
   const lines = [
-    `Received: from ${printable(state.helo ?? "unknown")} ([${printable(transport.remoteAddress)}])`,
+    `Received: from ${printable(state.helo ?? "unknown")} ([${addressLiteral(transport.remoteAddress)}])`,
     `	by ${settings.options.hostname} with ${protocolOf(state.esmtp, state.secure, state.user !== undefined)} id ${id}`
   ];
   const [recipient] = recipients;
@@ -952,77 +993,6 @@ class Connection {
   }
 }
 
-// src/server/settings.ts
-var MAX_TIMER_SECONDS = Math.floor(2147483647 / 1000);
-var invalid = (message) => new SmtpError2("INVALID_OPTION", `createSmtpServer(): ${message}`);
-function positive(name, value, fallback) {
-  if (value === undefined)
-    return fallback;
-  if (!Number.isSafeInteger(value) || value < 1) {
-    throw invalid(`${name} must be a positive integer, not ${value}`);
-  }
-  return value;
-}
-function timer(name, value, fallback) {
-  const seconds = positive(name, value, fallback);
-  if (seconds > MAX_TIMER_SECONDS) {
-    throw invalid(`${name} must be at most ${MAX_TIMER_SECONDS} seconds, not ${seconds}`);
-  }
-  return seconds;
-}
-function nonNegative(name, value, fallback) {
-  if (value === undefined)
-    return fallback;
-  if (!Number.isFinite(value) || value < 0) {
-    throw invalid(`${name} must be a number of seconds, 0 or more, not ${value}`);
-  }
-  return value;
-}
-function localLookup(local) {
-  if (typeof local === "function")
-    return local;
-  if (Array.isArray(local) && local.every((domain) => typeof domain === "string")) {
-    const domains = new Set(local.map((domain) => domain.toLowerCase()));
-    return (domain) => domains.has(domain);
-  }
-  throw invalid("localDomains must be an array of domains or a function");
-}
-function settingsOf(options) {
-  if (typeof options.hostname !== "string" || !/^[A-Za-z0-9.-]+$/.test(options.hostname)) {
-    throw invalid(`"${options.hostname}" is not a host name`);
-  }
-  if (typeof options.onData !== "function") {
-    throw invalid("onData must be a function: it is where messages go");
-  }
-  if (options.implicitTls && !options.tls) {
-    throw invalid("implicitTls needs tls: { key, cert }");
-  }
-  if (options.mode === "submission" && !options.authenticate) {
-    throw invalid("submission takes mail only from authenticated users, so it needs authenticate");
-  }
-  if (options.authenticate && !options.tls) {
-    throw invalid("authenticate needs tls: { key, cert }, since AUTH is offered only once encrypted");
-  }
-  const isLocal = localLookup(options.localDomains);
-  const timeout = positive("timeout", options.timeout, 300);
-  const greetingDelay = nonNegative("greetingDelay", options.greetingDelay, 0);
-  if (greetingDelay >= timeout) {
-    throw invalid(`greetingDelay (${greetingDelay} s) must be shorter than timeout (${timeout} s), or every client times out before the greeting`);
-  }
-  return {
-    options,
-    mode: options.mode ?? "mx",
-    maxMessageSize: positive("maxMessageSize", options.maxMessageSize, 25 * 1024 * 1024),
-    maxRecipients: positive("maxRecipients", options.maxRecipients, 100),
-    maxConnections: positive("maxConnections", options.maxConnections, 1000),
-    maxErrors: positive("maxErrors", options.maxErrors, 10),
-    timeout,
-    hookTimeout: timer("hookTimeout", options.hookTimeout, 60),
-    greetingDelay,
-    isLocal: (domain) => isLocal(domain.toLowerCase())
-  };
-}
-
 // src/server/transport.ts
 var CLOSE_GRACE_MS = 5000;
 var LINGER_QUIET_MS = 20;
@@ -1158,27 +1128,43 @@ class SocketTransport {
   }
 }
 
-// src/server/server.ts
+// src/server/listener.ts
+function received(socket, settings, chunk) {
+  socket.data.transport?.received();
+  socket.timeout(settings.timeout);
+  socket.data.connection?.receive(chunk);
+}
 function handlers(settings) {
   const idle = reply(421, "4.4.2", `${settings.options.hostname} Idle too long, closing`);
   return {
     data(socket, chunk) {
-      if (socket.data.upgraded)
+      const state = socket.data;
+      if (!state || state.upgraded)
         return;
-      socket.data.transport?.received();
-      socket.timeout(settings.timeout);
-      socket.data.connection?.receive(chunk);
+      if (state.header)
+        return state.header.receive(chunk);
+      if (!state.tls)
+        return received(socket, settings, chunk);
+      state.transport?.received();
+      state.tls.receive(chunk);
     },
     drain(socket) {
-      if (!socket.data.upgraded)
-        socket.data.transport?.drain();
+      const state = socket.data;
+      if (!state || state.upgraded)
+        return;
+      if (state.tls)
+        state.tls.rawDrain();
+      else
+        state.transport?.drain();
     },
     error(socket) {
-      socket.data.connection?.close();
+      socket.data?.connection?.close();
     },
     timeout(socket) {
-      if (socket.data.upgraded)
+      if (!socket.data || socket.data.upgraded)
         return;
+      if (socket.data.handshaking)
+        return socket.terminate();
       const { connection, transport } = socket.data;
       if (connection?.closed)
         transport?.abort();
@@ -1187,8 +1173,14 @@ function handlers(settings) {
     }
   };
 }
-function transportOf(socket, settings, secure) {
-  const transport = new SocketTransport(socket, secure, () => {
+function turnAway(socket, raw, secure, line) {
+  const refused = new SocketTransport(raw, secure, () => {});
+  socket.data.transport = refused;
+  refused.write(line);
+  refused.end();
+}
+function transportOf(socket, raw, address, settings, secure, slots) {
+  const transport = new SocketTransport(raw, secure, () => {
     const tls = settings.options.tls;
     const connection = socket.data.connection;
     if (!tls || !connection)
@@ -1200,78 +1192,684 @@ function transportOf(socket, settings, secure) {
       socket: {
         ...handlers(settings),
         close: (s) => {
+          slots.release(connection);
           s.data.transport?.closed();
           connection.close();
         }
       }
     });
     encrypted.timeout(settings.timeout);
-    const next = new SocketTransport(encrypted, true, () => {}, socket.remoteAddress);
+    const next = new SocketTransport(encrypted, true, () => {}, address);
     encrypted.data.transport = next;
     connection.useTransport(next);
-  });
+  }, address);
   socket.data.transport = transport;
   return transport;
 }
+
+// src/server/proxy/address.ts
+import { isIP as isIP2 } from "node:net";
+function addressBytes(text) {
+  if (text.includes("%"))
+    return;
+  const kind = isIP2(text);
+  if (kind === 4)
+    return new Uint8Array(text.split(".").map(Number));
+  if (kind !== 6)
+    return;
+  return unmapped(ipv6Bytes(text.toLowerCase()));
+}
+function ipv6Bytes(text) {
+  const bytes = new Uint8Array(16);
+  let tail = text;
+  const dotted = /(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(text);
+  if (dotted) {
+    bytes.set(dotted.slice(1).map(Number), 12);
+    tail = `${text.slice(0, dotted.index)}0:0`;
+  }
+  const [head = "", rest] = tail.split("::");
+  const left = head === "" ? [] : head.split(":");
+  const right = rest === undefined || rest === "" ? [] : rest.split(":");
+  const groups = rest === undefined ? left : [...left, ...Array(8 - left.length - right.length).fill("0"), ...right];
+  const view = new DataView(bytes.buffer);
+  groups.forEach((group, at) => {
+    if (!dotted || at < 6)
+      view.setUint16(at * 2, Number.parseInt(group, 16));
+  });
+  return bytes;
+}
+function unmapped(bytes) {
+  if (bytes.length !== 16)
+    return bytes;
+  const mapped = bytes.subarray(0, 10).every((byte) => byte === 0) && bytes[10] === 255 && bytes[11] === 255;
+  return mapped ? bytes.slice(12) : bytes;
+}
+function formatAddress(raw) {
+  const bytes = unmapped(raw);
+  if (bytes.length === 4)
+    return bytes.join(".");
+  const view = new DataView(bytes.buffer, bytes.byteOffset, 16);
+  const groups = Array.from({ length: 8 }, (_, at) => view.getUint16(at * 2));
+  let best = { at: -1, length: 1 };
+  for (let at = 0;at < 8; ) {
+    let end = at;
+    while (end < 8 && groups[end] === 0)
+      end++;
+    if (end - at > best.length)
+      best = { at, length: end - at };
+    at = end === at ? at + 1 : end;
+  }
+  const hex = groups.map((group) => group.toString(16));
+  if (best.at < 0)
+    return hex.join(":");
+  const left = hex.slice(0, best.at).join(":");
+  const right = hex.slice(best.at + best.length).join(":");
+  return `${left}::${right}`;
+}
+
+// src/server/proxy/header.ts
+var MAX_V1_LENGTH = 107;
+var MAX_TLV_BYTES = 2048;
+var MAX_HEADER_LENGTH = 16 + 216 + MAX_TLV_BYTES;
+var V1_PREFIX = new TextEncoder().encode("PROXY ");
+var V2_SIGNATURE = new Uint8Array([
+  13,
+  10,
+  13,
+  10,
+  0,
+  13,
+  10,
+  81,
+  85,
+  73,
+  84,
+  10
+]);
+var ADDRESS_LENGTH = [0, 12, 36, 216];
+var PARTIAL = { status: "partial" };
+var invalid = (reason) => ({ status: "invalid", reason });
+function startsAs(bytes, prefix) {
+  const length = Math.min(bytes.length, prefix.length);
+  for (let at = 0;at < length; at++) {
+    if (bytes[at] !== prefix[at])
+      return false;
+  }
+  return true;
+}
+function readProxyHeader(bytes) {
+  if (bytes.length === 0)
+    return PARTIAL;
+  if (startsAs(bytes, V2_SIGNATURE))
+    return readV2(bytes);
+  if (startsAs(bytes, V1_PREFIX))
+    return readV1(bytes);
+  return invalid("no PROXY protocol signature");
+}
+function readV2(bytes) {
+  if (bytes.length < 16)
+    return PARTIAL;
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const versionCommand = view.getUint8(12);
+  if (versionCommand >> 4 !== 2)
+    return invalid("not version 2");
+  const command = versionCommand & 15;
+  if (command > 1)
+    return invalid(`unknown command ${command}`);
+  const family = view.getUint8(13) >> 4;
+  const transport = view.getUint8(13) & 15;
+  const length = view.getUint16(14);
+  const addresses = command === 0 ? 0 : ADDRESS_LENGTH[family];
+  if (addresses === undefined || transport > 2) {
+    return invalid("unknown address family or transport");
+  }
+  if (length < addresses)
+    return invalid("address block too short");
+  if (length - addresses > MAX_TLV_BYTES)
+    return invalid("TLVs too long");
+  const total = 16 + length;
+  if (bytes.length < total)
+    return PARTIAL;
+  if (command === 0)
+    return { status: "complete", length: total };
+  const tlvs = bytes.subarray(16 + addresses, total);
+  if (!wellFormedTlvs(tlvs))
+    return invalid("malformed TLV");
+  if (transport !== 1 || family !== 1 && family !== 2) {
+    return { status: "complete", length: total };
+  }
+  const size = family === 1 ? 4 : 16;
+  const source = formatAddress(bytes.slice(16, 16 + size));
+  return { status: "complete", length: total, source };
+}
+function wellFormedTlvs(block) {
+  let at = 0;
+  while (at < block.length) {
+    if (at + 3 > block.length)
+      return false;
+    const length = block[at + 1] << 8 | block[at + 2];
+    at += 3 + length;
+  }
+  return at === block.length;
+}
+var PORT = /^(0|[1-9]\d{0,4})$/;
+function readV1(bytes) {
+  const end = bytes.indexOf(10);
+  if (end < 0) {
+    return bytes.length >= MAX_V1_LENGTH ? invalid("v1 line too long") : PARTIAL;
+  }
+  if (end + 1 > MAX_V1_LENGTH)
+    return invalid("v1 line too long");
+  if (bytes[end - 1] !== 13)
+    return invalid("v1 line without CRLF");
+  const line = bytes.subarray(0, end - 1);
+  if (line.some((byte) => byte < 32 || byte > 126)) {
+    return invalid("v1 line not printable");
+  }
+  const [, protocol, ...rest] = new TextDecoder().decode(line).split(" ");
+  if (protocol === "UNKNOWN")
+    return { status: "complete", length: end + 1 };
+  const [source = "", destination = "", sourcePort = "", port = ""] = rest;
+  const size = protocol === "TCP4" ? 4 : protocol === "TCP6" ? 16 : 0;
+  if (size === 0)
+    return invalid("v1 protocol not TCP4, TCP6 or UNKNOWN");
+  const from = rawAddress(source, size);
+  if (rest.length !== 4 || !from || !rawAddress(destination, size) || !validPort(sourcePort) || !validPort(port)) {
+    return invalid("v1 addresses or ports malformed");
+  }
+  return { status: "complete", length: end + 1, source: formatAddress(from) };
+}
+function rawAddress(text, size) {
+  if (size === 4 && text.includes(":"))
+    return;
+  if (size === 16 && !text.includes(":"))
+    return;
+  return addressBytes(text);
+}
+function validPort(text) {
+  return PORT.test(text) && Number(text) <= 65535;
+}
+
+// src/server/proxy/reader.ts
+class HeaderReader {
+  #bytes = new Uint8Array(0);
+  #timer;
+  #settled = false;
+  #done;
+  #refuse;
+  constructor(seconds, done, refuse) {
+    this.#done = done;
+    this.#refuse = refuse;
+    this.#timer = setTimeout(() => this.#settle(refuse), seconds * 1000);
+    this.#timer.unref?.();
+  }
+  receive(chunk) {
+    if (this.#settled)
+      return;
+    const bytes = new Uint8Array(this.#bytes.length + chunk.length);
+    bytes.set(this.#bytes);
+    bytes.set(chunk, this.#bytes.length);
+    this.#bytes = bytes;
+    const header = readProxyHeader(bytes);
+    if (header.status === "complete") {
+      const rest = bytes.slice(header.length);
+      this.#settle(() => this.#done(header.source, rest));
+    } else if (header.status === "invalid" || bytes.length >= MAX_HEADER_LENGTH) {
+      this.#settle(this.#refuse);
+    }
+  }
+  cancel() {
+    this.#settled = true;
+    clearTimeout(this.#timer);
+    this.#bytes = new Uint8Array(0);
+  }
+  #settle(then) {
+    if (this.#settled)
+      return;
+    this.cancel();
+    then();
+  }
+}
+
+// src/server/proxy/tls.ts
+import { Duplex } from "node:stream";
+import { TLSSocket } from "node:tls";
+
+class ProxiedTls {
+  #raw;
+  #wire;
+  #tls;
+  #pending;
+  #halfClose = true;
+  constructor(raw, context, events) {
+    this.#raw = raw;
+    this.#wire = new Duplex({
+      read() {},
+      write: (chunk, _encoding, done) => this.#send(chunk, done),
+      final: (done) => {
+        this.#raw.shutdown(this.#halfClose);
+        done();
+      }
+    });
+    this.#tls = new TLSSocket(this.#wire, {
+      isServer: true,
+      secureContext: context
+    });
+    this.#tls.on("secure", () => events.secure());
+    this.#tls.on("data", (bytes) => events.data(bytes));
+    this.#tls.on("drain", () => events.drain());
+    this.#tls.on("error", () => this.terminate());
+  }
+  get remoteAddress() {
+    return this.#raw.remoteAddress;
+  }
+  receive(chunk) {
+    this.#wire.push(Uint8Array.from(chunk));
+  }
+  rawDrain() {
+    const pending = this.#pending;
+    if (!pending)
+      return;
+    const written = Math.max(this.#raw.write(pending.bytes), 0);
+    if (written < pending.bytes.length) {
+      pending.bytes = pending.bytes.subarray(written);
+      return;
+    }
+    this.#pending = undefined;
+    pending.done();
+  }
+  #send(chunk, done) {
+    const written = Math.max(this.#raw.write(chunk), 0);
+    if (written < chunk.length) {
+      this.#pending = { bytes: chunk.subarray(written), done };
+    } else
+      done();
+  }
+  write(bytes) {
+    if (this.#tls.destroyed || this.#tls.writableNeedDrain)
+      return 0;
+    this.#tls.write(bytes);
+    return bytes.length;
+  }
+  shutdown(halfClose = false) {
+    this.#halfClose = halfClose;
+    this.#tls.once("finish", () => this.#wire.end());
+    this.#tls.end();
+  }
+  terminate() {
+    this.#pending = undefined;
+    this.#tls.destroy();
+    this.#raw.terminate();
+  }
+  closed() {
+    this.#pending = undefined;
+    this.#tls.destroy();
+  }
+  pause() {
+    this.#raw.pause();
+  }
+  resume() {
+    this.#raw.resume();
+  }
+  timeout(seconds) {
+    this.#raw.timeout(seconds);
+  }
+}
+
+// src/server/admission.ts
+function listenerHandlers(listening) {
+  const { settings, slots, handshaking, secure } = listening;
+  return {
+    open(socket) {
+      socket.data = { upgraded: false, handshaking: secure };
+      socket.timeout(secure ? settings.handshakeTimeout : settings.timeout);
+      const peer = socket.remoteAddress;
+      if (settings.trusts?.(peer))
+        awaitHeader(listening, socket, peer);
+      else
+        admit(listening, socket, peer);
+    },
+    handshake: (socket, success) => handshake(listening, socket, success),
+    close(socket) {
+      handshaking.delete(socket);
+      socket.data?.header?.cancel();
+      socket.data?.tls?.closed();
+      const connection = socket.data?.connection;
+      if (connection)
+        slots.release(connection);
+      socket.data?.transport?.closed();
+      connection?.close();
+    }
+  };
+}
+function handshake({ settings, handshaking }, socket, success) {
+  const state = socket.data;
+  if (!state?.handshaking)
+    return;
+  handshaking.delete(socket);
+  if (!success)
+    return;
+  state.handshaking = false;
+  socket.timeout(settings.timeout);
+  const start = state.start;
+  delete state.start;
+  start?.();
+}
+function awaitHeader(listening, socket, peer) {
+  const { settings, handshaking, secure } = listening;
+  socket.data.handshaking = true;
+  socket.timeout(settings.handshakeTimeout);
+  handshaking.add(socket);
+  socket.data.header = new HeaderReader(settings.handshakeTimeout, (source, rest) => {
+    delete socket.data.header;
+    handshaking.delete(socket);
+    socket.data.handshaking = secure;
+    if (!secure)
+      socket.timeout(settings.timeout);
+    admit(listening, socket, source ?? peer, rest);
+  }, () => socket.terminate());
+}
+function admit(listening, socket, address, first) {
+  const { settings, slots, handshaking, secure, proxied } = listening;
+  let raw = socket;
+  if (proxied) {
+    raw = startTls2(listening, socket, proxied);
+    if (first && first.length > 0)
+      socket.data.tls?.receive(first);
+  }
+  const begin = (start) => {
+    if (!secure)
+      return start();
+    handshaking.add(socket);
+    socket.data.start = start;
+  };
+  const { hostname } = settings.options;
+  const refuse = (line) => begin(() => turnAway(socket, raw, secure, `${line}\r
+`));
+  if (slots.size >= settings.maxConnections) {
+    refuse(`421 4.3.2 ${hostname} Too many connections, try later`);
+    return;
+  }
+  const key = clientKey(address);
+  if (slots.of(key) >= settings.maxConnectionsPerClient) {
+    refuse(`421 4.7.0 ${hostname} Too many connections from your address, try later`);
+    return;
+  }
+  const transport = transportOf(socket, raw, address, settings, secure, slots);
+  const connection = new Connection(settings, transport);
+  slots.take(connection, key);
+  socket.data.connection = connection;
+  if (first && first.length > 0 && !proxied) {
+    received(socket, settings, first);
+  }
+  begin(() => void connection.open());
+}
+function startTls2(listening, socket, context) {
+  const { settings } = listening;
+  socket.data.handshaking = true;
+  socket.timeout(settings.handshakeTimeout);
+  const tls = new ProxiedTls(socket, context, {
+    secure: () => handshake(listening, socket, true),
+    data: (bytes) => received(socket, settings, bytes),
+    drain: () => socket.data.transport?.drain()
+  });
+  socket.data.tls = tls;
+  return tls;
+}
+
+// src/server/proxy/trusted.ts
+function networkOf(entry) {
+  if (typeof entry !== "string")
+    return `${String(entry)} is not a string`;
+  const [address = "", prefix, extra] = entry.split("/");
+  const raw = addressBytes(address);
+  if (!raw || extra !== undefined) {
+    return `"${entry}" is neither an IP address nor a CIDR`;
+  }
+  const mapped = raw.length === 4 && address.includes(":");
+  const width = raw.length * 8;
+  if (prefix === undefined)
+    return { bytes: raw, bits: width };
+  let bits = /^\d{1,3}$/.test(prefix) ? Number(prefix) : -1;
+  if (mapped)
+    bits -= 96;
+  if (bits < 0 || bits > width) {
+    return `"${entry}" has a prefix length out of range`;
+  }
+  if (bits === 0) {
+    return `"${entry}" has a prefix length of 0, which trusts every peer`;
+  }
+  return { bytes: raw, bits };
+}
+function contains(network, address) {
+  if (network.bytes.length !== address.length)
+    return false;
+  const whole = network.bits >> 3;
+  for (let at = 0;at < whole; at++) {
+    if (network.bytes[at] !== address[at])
+      return false;
+  }
+  const rest = network.bits & 7;
+  if (rest === 0)
+    return true;
+  const mask = 255 << 8 - rest & 255;
+  return (network.bytes[whole] & mask) === (address[whole] & mask);
+}
+function trustedPeers(entries, invalid) {
+  if (!Array.isArray(entries) || entries.length === 0) {
+    throw invalid("proxyProtocol.trusted must list the addresses or CIDRs of the proxies, at least one");
+  }
+  const networks = entries.map((entry) => {
+    const network = networkOf(entry);
+    if (typeof network === "string") {
+      throw invalid(`proxyProtocol.trusted: ${network}`);
+    }
+    return network;
+  });
+  return (peer) => {
+    const address = addressBytes(peer);
+    return address !== undefined && networks.some((network) => contains(network, address));
+  };
+}
+
+// src/server/settings.ts
+var MAX_TIMER_SECONDS = Math.floor(2147483647 / 1000);
+var invalid2 = (message) => new SmtpError2("INVALID_OPTION", `createSmtpServer(): ${message}`);
+function positive(name, value, fallback) {
+  if (value === undefined)
+    return fallback;
+  if (!Number.isSafeInteger(value) || value < 1) {
+    throw invalid2(`${name} must be a positive integer, not ${value}`);
+  }
+  return value;
+}
+function timer(name, value, fallback) {
+  const seconds = positive(name, value, fallback);
+  if (seconds > MAX_TIMER_SECONDS) {
+    throw invalid2(`${name} must be at most ${MAX_TIMER_SECONDS} seconds, not ${seconds}`);
+  }
+  return seconds;
+}
+function nonNegative(name, value, fallback) {
+  if (value === undefined)
+    return fallback;
+  if (!Number.isFinite(value) || value < 0) {
+    throw invalid2(`${name} must be a number of seconds, 0 or more, not ${value}`);
+  }
+  return value;
+}
+function localLookup(local) {
+  if (typeof local === "function")
+    return local;
+  if (Array.isArray(local) && local.every((domain) => typeof domain === "string")) {
+    const domains = new Set(local.map((domain) => domain.toLowerCase()));
+    return (domain) => domains.has(domain);
+  }
+  throw invalid2("localDomains must be an array of domains or a function");
+}
+function settingsOf(options) {
+  if (typeof options.hostname !== "string" || !/^[A-Za-z0-9.-]+$/.test(options.hostname)) {
+    throw invalid2(`"${options.hostname}" is not a host name`);
+  }
+  if (typeof options.onData !== "function") {
+    throw invalid2("onData must be a function: it is where messages go");
+  }
+  if (options.implicitTls && !options.tls) {
+    throw invalid2("implicitTls needs tls: { key, cert }");
+  }
+  if (options.mode === "submission" && !options.authenticate) {
+    throw invalid2("submission takes mail only from authenticated users, so it needs authenticate");
+  }
+  if (options.authenticate && !options.tls) {
+    throw invalid2("authenticate needs tls: { key, cert }, since AUTH is offered only once encrypted");
+  }
+  const isLocal = localLookup(options.localDomains);
+  const timeout = positive("timeout", options.timeout, 300);
+  const greetingDelay = nonNegative("greetingDelay", options.greetingDelay, 0);
+  if (greetingDelay >= timeout) {
+    throw invalid2(`greetingDelay (${greetingDelay} s) must be shorter than timeout (${timeout} s), or every client times out before the greeting`);
+  }
+  return {
+    options,
+    mode: options.mode ?? "mx",
+    maxMessageSize: positive("maxMessageSize", options.maxMessageSize, 25 * 1024 * 1024),
+    maxRecipients: positive("maxRecipients", options.maxRecipients, 100),
+    maxConnections: positive("maxConnections", options.maxConnections, 1000),
+    maxConnectionsPerClient: positive("maxConnectionsPerClient", options.maxConnectionsPerClient, 10),
+    maxErrors: positive("maxErrors", options.maxErrors, 10),
+    timeout,
+    hookTimeout: timer("hookTimeout", options.hookTimeout, 60),
+    handshakeTimeout: positive("handshakeTimeout", options.handshakeTimeout, 10),
+    greetingDelay,
+    ...options.proxyProtocol === undefined ? {} : { trusts: trustedPeers(options.proxyProtocol?.trusted, invalid2) },
+    isLocal: (domain) => isLocal(domain.toLowerCase())
+  };
+}
+
+// src/server/slots.ts
+class Slots {
+  #open = new Map;
+  #perClient = new Map;
+  get size() {
+    return this.#open.size;
+  }
+  of(key) {
+    return key === undefined ? 0 : this.#perClient.get(key) ?? 0;
+  }
+  take(connection, key) {
+    this.#open.set(connection, key);
+    if (key !== undefined)
+      this.#perClient.set(key, this.of(key) + 1);
+  }
+  release(connection) {
+    if (!this.#open.has(connection))
+      return;
+    const key = this.#open.get(connection);
+    this.#open.delete(connection);
+    if (key === undefined)
+      return;
+    const left = this.of(key) - 1;
+    if (left > 0)
+      this.#perClient.set(key, left);
+    else
+      this.#perClient.delete(key);
+  }
+  connections() {
+    return [...this.#open.keys()];
+  }
+}
+
+// src/server/tls-context.ts
+import { createSecureContext } from "node:tls";
+async function tlsContext(tls, fail) {
+  const read = async (value) => typeof value === "string" ? value : Buffer.from(value instanceof Uint8Array ? value : await value.bytes());
+  try {
+    return createSecureContext({
+      key: await read(tls.key),
+      cert: await read(tls.cert)
+    });
+  } catch (cause) {
+    const reason = cause instanceof Error ? cause.message : String(cause);
+    throw fail(`listen(): tls: { key, cert } cannot be used: ${reason}`, cause);
+  }
+}
+
+// src/server/server.ts
+var invalidTls = (message, cause) => new SmtpError2("INVALID_OPTION", message, { cause });
+var STOPPED = "listen(): stop() was called before the server bound its port";
+async function bind(options, listening, port, hostname, stopped) {
+  const context = listening.secure && options.tls ? await tlsContext(options.tls, invalidTls) : undefined;
+  if (stopped()) {
+    throw new SmtpError2("STOPPED", STOPPED);
+  }
+  const proxied = listening.settings.trusts ? context : undefined;
+  return Bun.listen({
+    hostname,
+    port,
+    ...listening.secure && options.tls && !proxied ? { tls: { key: options.tls.key, cert: options.tls.cert } } : {},
+    socket: {
+      ...handlers(listening.settings),
+      ...listenerHandlers({
+        ...listening,
+        ...proxied ? { proxied } : {}
+      })
+    }
+  });
+}
 function createSmtpServer(options) {
   const settings = settingsOf(options);
   let listener;
-  const open = new Set;
+  const slots = new Slots;
+  const handshaking = new Set;
   const secure = options.implicitTls === true;
+  let starting = false;
+  let stopRequested = false;
   return {
     get connections() {
-      return open.size;
+      return slots.size;
     },
     async listen({ port, hostname = "0.0.0.0" }) {
-      if (listener) {
-        throw new SmtpError2("ALREADY_LISTENING", `listen(): the server is already listening on ${listener.hostname}:${listener.port}`);
+      if (listener || starting) {
+        throw new SmtpError2("ALREADY_LISTENING", listener ? `listen(): the server is already listening on ${listener.hostname}:${listener.port}` : "listen(): the server is already starting to listen");
       }
-      listener = Bun.listen({
-        hostname,
-        port,
-        ...secure && options.tls ? { tls: { key: options.tls.key, cert: options.tls.cert } } : {},
-        socket: {
-          ...handlers(settings),
-          open(socket) {
-            socket.data = { upgraded: false };
-            socket.timeout(settings.timeout);
-            if (open.size >= settings.maxConnections) {
-              const refused = new SocketTransport(socket, secure, () => {});
-              socket.data.transport = refused;
-              refused.write(`421 4.3.2 ${options.hostname} Too many connections, try later\r
-`);
-              refused.end();
-              return;
-            }
-            const connection = new Connection(settings, transportOf(socket, settings, secure));
-            open.add(connection);
-            socket.data.connection = connection;
-            connection.open();
-          },
-          close(socket) {
-            const connection = socket.data.connection;
-            if (connection)
-              open.delete(connection);
-            socket.data.transport?.closed();
-            socket.data.connection?.close();
-          }
+      starting = true;
+      stopRequested = false;
+      try {
+        const bound = await bind(options, { settings, slots, handshaking, secure }, port, hostname, () => stopRequested);
+        if (stopRequested) {
+          bound.stop(true);
+          throw new SmtpError2("STOPPED", STOPPED);
         }
-      });
-      return { port: listener.port, hostname: listener.hostname };
+        listener = bound;
+        return { port: listener.port, hostname: listener.hostname };
+      } finally {
+        starting = false;
+      }
     },
     stop(closeConnections = false) {
+      if (starting)
+        stopRequested = true;
       listener?.stop(closeConnections);
       listener = undefined;
       if (!closeConnections)
         return;
-      for (const connection of [...open])
-        connection.close();
+      const stuck = new Set;
+      for (const socket of [...handshaking]) {
+        stuck.add(socket.data?.connection);
+        handshaking.delete(socket);
+        socket.terminate();
+      }
+      for (const connection of slots.connections()) {
+        if (!stuck.has(connection))
+          connection.close();
+      }
     }
   };
 }
 export {
   DataReader,
   SmtpError2 as SmtpError,
+  clientKey,
   createSmtpServer,
   decodeLoginStep2 as decodeLoginStep,
   decodePlain2 as decodePlain,
@@ -1282,5 +1880,5 @@ export {
   reply
 };
 
-//# debugId=04EE37708209636464756E2164756E21
+//# debugId=C3E2F4573FDEF0E964756E2164756E21
 //# sourceMappingURL=index.js.map