@bumail/smtp 0.4.0 → 0.6.0

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   decodeLoginStep2,
   LineSplitter,
   Outgoing
-} from "./chunks/index-753q702a.js";
+} from "./chunks/index-n4xwep5m.js";
 // src/protocol/command.ts
 function parseCommand(line) {
   const space = line.indexOf(" ");
@@ -474,6 +474,7 @@ async function runCommand(connection, line) {
 }
 
 // src/server/received.ts
+import { isIPv6 } from "node:net";
 var DAYS = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
 var MONTHS = [
   "Jan",
@@ -498,6 +499,10 @@ function protocolOf(esmtp, secure, authenticated) {
     return "SMTP";
   return `ESMTP${secure ? "S" : ""}${authenticated ? "A" : ""}`;
 }
+function addressLiteral(address) {
+  const bare = address.replace(/%.*$/, "");
+  return isIPv6(bare) ? `IPv6:${bare}` : printable(address);
+}
 function printable(text) {
   let out = "";
   for (const char of text) {
@@ -512,7 +517,7 @@ function plain(address) {
 function receivedField(connection, recipients, id, now = new Date) {
   const { state, transport, settings } = connection;
   const lines = [
-    `Received: from ${printable(state.helo ?? "unknown")} ([${printable(transport.remoteAddress)}])`,
+    `Received: from ${printable(state.helo ?? "unknown")} ([${addressLiteral(transport.remoteAddress)}])`,
     `	by ${settings.options.hostname} with ${protocolOf(state.esmtp, state.secure, state.user !== undefined)} id ${id}`
   ];
   const [recipient] = recipients;
@@ -1124,19 +1129,33 @@ class SocketTransport {
 }
 
 // src/server/listener.ts
+function received(socket, settings, chunk) {
+  socket.data.transport?.received();
+  socket.timeout(settings.timeout);
+  socket.data.connection?.receive(chunk);
+}
 function handlers(settings) {
   const idle = reply(421, "4.4.2", `${settings.options.hostname} Idle too long, closing`);
   return {
     data(socket, chunk) {
-      if (!socket.data || socket.data.upgraded)
+      const state = socket.data;
+      if (!state || state.upgraded)
         return;
-      socket.data.transport?.received();
-      socket.timeout(settings.timeout);
-      socket.data.connection?.receive(chunk);
+      if (state.header)
+        return state.header.receive(chunk);
+      if (!state.tls)
+        return received(socket, settings, chunk);
+      state.transport?.received();
+      state.tls.receive(chunk);
     },
     drain(socket) {
-      if (socket.data && !socket.data.upgraded)
-        socket.data.transport?.drain();
+      const state = socket.data;
+      if (!state || state.upgraded)
+        return;
+      if (state.tls)
+        state.tls.rawDrain();
+      else
+        state.transport?.drain();
     },
     error(socket) {
       socket.data?.connection?.close();
@@ -1154,15 +1173,15 @@ function handlers(settings) {
     }
   };
 }
-function turnAway(socket, secure, line) {
-  const refused = new SocketTransport(socket, secure, () => {});
+function turnAway(socket, raw, secure, line) {
+  const refused = new SocketTransport(raw, secure, () => {});
   socket.data.transport = refused;
   refused.write(line);
   refused.end();
 }
-function transportOf(socket, settings, secure, slots) {
-  const transport = new SocketTransport(socket, secure, () => {
-    const tls = settings.options.tls;
+function transportOf(socket, raw, address, settings, secure, slots) {
+  const transport = new SocketTransport(raw, secure, () => {
+    const tls = settings.tls?.options;
     const connection = socket.data.connection;
     if (!tls || !connection)
       return;
@@ -1180,53 +1199,341 @@ function transportOf(socket, settings, secure, slots) {
       }
     });
     encrypted.timeout(settings.timeout);
-    const next = new SocketTransport(encrypted, true, () => {}, socket.remoteAddress);
+    const next = new SocketTransport(encrypted, true, () => {}, address);
     encrypted.data.transport = next;
     connection.useTransport(next);
-  });
+  }, address);
   socket.data.transport = transport;
   return transport;
 }
-function listenerHandlers(settings, slots, handshaking, secure) {
+
+// src/server/proxy/address.ts
+import { isIP as isIP2 } from "node:net";
+function addressBytes(text) {
+  if (text.includes("%"))
+    return;
+  const kind = isIP2(text);
+  if (kind === 4)
+    return new Uint8Array(text.split(".").map(Number));
+  if (kind !== 6)
+    return;
+  return unmapped(ipv6Bytes(text.toLowerCase()));
+}
+function ipv6Bytes(text) {
+  const bytes = new Uint8Array(16);
+  let tail = text;
+  const dotted = /(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(text);
+  if (dotted) {
+    bytes.set(dotted.slice(1).map(Number), 12);
+    tail = `${text.slice(0, dotted.index)}0:0`;
+  }
+  const [head = "", rest] = tail.split("::");
+  const left = head === "" ? [] : head.split(":");
+  const right = rest === undefined || rest === "" ? [] : rest.split(":");
+  const groups = rest === undefined ? left : [...left, ...Array(8 - left.length - right.length).fill("0"), ...right];
+  const view = new DataView(bytes.buffer);
+  groups.forEach((group, at) => {
+    if (!dotted || at < 6)
+      view.setUint16(at * 2, Number.parseInt(group, 16));
+  });
+  return bytes;
+}
+function unmapped(bytes) {
+  if (bytes.length !== 16)
+    return bytes;
+  const mapped = bytes.subarray(0, 10).every((byte) => byte === 0) && bytes[10] === 255 && bytes[11] === 255;
+  return mapped ? bytes.slice(12) : bytes;
+}
+function formatAddress(raw) {
+  const bytes = unmapped(raw);
+  if (bytes.length === 4)
+    return bytes.join(".");
+  const view = new DataView(bytes.buffer, bytes.byteOffset, 16);
+  const groups = Array.from({ length: 8 }, (_, at) => view.getUint16(at * 2));
+  let best = { at: -1, length: 1 };
+  for (let at = 0;at < 8; ) {
+    let end = at;
+    while (end < 8 && groups[end] === 0)
+      end++;
+    if (end - at > best.length)
+      best = { at, length: end - at };
+    at = end === at ? at + 1 : end;
+  }
+  const hex = groups.map((group) => group.toString(16));
+  if (best.at < 0)
+    return hex.join(":");
+  const left = hex.slice(0, best.at).join(":");
+  const right = hex.slice(best.at + best.length).join(":");
+  return `${left}::${right}`;
+}
+
+// src/server/proxy/header.ts
+var MAX_V1_LENGTH = 107;
+var MAX_TLV_BYTES = 2048;
+var MAX_HEADER_LENGTH = 16 + 216 + MAX_TLV_BYTES;
+var V1_PREFIX = new TextEncoder().encode("PROXY ");
+var V2_SIGNATURE = new Uint8Array([
+  13,
+  10,
+  13,
+  10,
+  0,
+  13,
+  10,
+  81,
+  85,
+  73,
+  84,
+  10
+]);
+var ADDRESS_LENGTH = [0, 12, 36, 216];
+var PARTIAL = { status: "partial" };
+var invalid = (reason) => ({ status: "invalid", reason });
+function startsAs(bytes, prefix) {
+  const length = Math.min(bytes.length, prefix.length);
+  for (let at = 0;at < length; at++) {
+    if (bytes[at] !== prefix[at])
+      return false;
+  }
+  return true;
+}
+function readProxyHeader(bytes) {
+  if (bytes.length === 0)
+    return PARTIAL;
+  if (startsAs(bytes, V2_SIGNATURE))
+    return readV2(bytes);
+  if (startsAs(bytes, V1_PREFIX))
+    return readV1(bytes);
+  return invalid("no PROXY protocol signature");
+}
+function readV2(bytes) {
+  if (bytes.length < 16)
+    return PARTIAL;
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const versionCommand = view.getUint8(12);
+  if (versionCommand >> 4 !== 2)
+    return invalid("not version 2");
+  const command = versionCommand & 15;
+  if (command > 1)
+    return invalid(`unknown command ${command}`);
+  const family = view.getUint8(13) >> 4;
+  const transport = view.getUint8(13) & 15;
+  const length = view.getUint16(14);
+  const addresses = command === 0 ? 0 : ADDRESS_LENGTH[family];
+  if (addresses === undefined || transport > 2) {
+    return invalid("unknown address family or transport");
+  }
+  if (length < addresses)
+    return invalid("address block too short");
+  if (length - addresses > MAX_TLV_BYTES)
+    return invalid("TLVs too long");
+  const total = 16 + length;
+  if (bytes.length < total)
+    return PARTIAL;
+  if (command === 0)
+    return { status: "complete", length: total };
+  const tlvs = bytes.subarray(16 + addresses, total);
+  if (!wellFormedTlvs(tlvs))
+    return invalid("malformed TLV");
+  if (transport !== 1 || family !== 1 && family !== 2) {
+    return { status: "complete", length: total };
+  }
+  const size = family === 1 ? 4 : 16;
+  const source = formatAddress(bytes.slice(16, 16 + size));
+  return { status: "complete", length: total, source };
+}
+function wellFormedTlvs(block) {
+  let at = 0;
+  while (at < block.length) {
+    if (at + 3 > block.length)
+      return false;
+    const length = block[at + 1] << 8 | block[at + 2];
+    at += 3 + length;
+  }
+  return at === block.length;
+}
+var PORT = /^(0|[1-9]\d{0,4})$/;
+function readV1(bytes) {
+  const end = bytes.indexOf(10);
+  if (end < 0) {
+    return bytes.length >= MAX_V1_LENGTH ? invalid("v1 line too long") : PARTIAL;
+  }
+  if (end + 1 > MAX_V1_LENGTH)
+    return invalid("v1 line too long");
+  if (bytes[end - 1] !== 13)
+    return invalid("v1 line without CRLF");
+  const line = bytes.subarray(0, end - 1);
+  if (line.some((byte) => byte < 32 || byte > 126)) {
+    return invalid("v1 line not printable");
+  }
+  const [, protocol, ...rest] = new TextDecoder().decode(line).split(" ");
+  if (protocol === "UNKNOWN")
+    return { status: "complete", length: end + 1 };
+  const [source = "", destination = "", sourcePort = "", port = ""] = rest;
+  const size = protocol === "TCP4" ? 4 : protocol === "TCP6" ? 16 : 0;
+  if (size === 0)
+    return invalid("v1 protocol not TCP4, TCP6 or UNKNOWN");
+  const from = rawAddress(source, size);
+  if (rest.length !== 4 || !from || !rawAddress(destination, size) || !validPort(sourcePort) || !validPort(port)) {
+    return invalid("v1 addresses or ports malformed");
+  }
+  return { status: "complete", length: end + 1, source: formatAddress(from) };
+}
+function rawAddress(text, size) {
+  if (size === 4 && text.includes(":"))
+    return;
+  if (size === 16 && !text.includes(":"))
+    return;
+  return addressBytes(text);
+}
+function validPort(text) {
+  return PORT.test(text) && Number(text) <= 65535;
+}
+
+// src/server/proxy/reader.ts
+class HeaderReader {
+  #bytes = new Uint8Array(0);
+  #timer;
+  #settled = false;
+  #done;
+  #refuse;
+  constructor(seconds, done, refuse) {
+    this.#done = done;
+    this.#refuse = refuse;
+    this.#timer = setTimeout(() => this.#settle(refuse), seconds * 1000);
+    this.#timer.unref?.();
+  }
+  receive(chunk) {
+    if (this.#settled)
+      return;
+    const bytes = new Uint8Array(this.#bytes.length + chunk.length);
+    bytes.set(this.#bytes);
+    bytes.set(chunk, this.#bytes.length);
+    this.#bytes = bytes;
+    const header = readProxyHeader(bytes);
+    if (header.status === "complete") {
+      const rest = bytes.slice(header.length);
+      this.#settle(() => this.#done(header.source, rest));
+    } else if (header.status === "invalid" || bytes.length >= MAX_HEADER_LENGTH) {
+      this.#settle(this.#refuse);
+    }
+  }
+  cancel() {
+    this.#settled = true;
+    clearTimeout(this.#timer);
+    this.#bytes = new Uint8Array(0);
+  }
+  #settle(then) {
+    if (this.#settled)
+      return;
+    this.cancel();
+    then();
+  }
+}
+
+// src/server/proxy/tls.ts
+import { Duplex } from "node:stream";
+import { TLSSocket } from "node:tls";
+
+class ProxiedTls {
+  #raw;
+  #wire;
+  #tls;
+  #pending;
+  #halfClose = true;
+  constructor(raw, context, events) {
+    this.#raw = raw;
+    this.#wire = new Duplex({
+      read() {},
+      write: (chunk, _encoding, done) => this.#send(chunk, done),
+      final: (done) => {
+        this.#raw.shutdown(this.#halfClose);
+        done();
+      }
+    });
+    this.#tls = new TLSSocket(this.#wire, {
+      isServer: true,
+      secureContext: context
+    });
+    this.#tls.on("secure", () => events.secure());
+    this.#tls.on("data", (bytes) => events.data(bytes));
+    this.#tls.on("drain", () => events.drain());
+    this.#tls.on("error", () => this.terminate());
+  }
+  get remoteAddress() {
+    return this.#raw.remoteAddress;
+  }
+  receive(chunk) {
+    this.#wire.push(Uint8Array.from(chunk));
+  }
+  rawDrain() {
+    const pending = this.#pending;
+    if (!pending)
+      return;
+    const written = Math.max(this.#raw.write(pending.bytes), 0);
+    if (written < pending.bytes.length) {
+      pending.bytes = pending.bytes.subarray(written);
+      return;
+    }
+    this.#pending = undefined;
+    pending.done();
+  }
+  #send(chunk, done) {
+    const written = Math.max(this.#raw.write(chunk), 0);
+    if (written < chunk.length) {
+      this.#pending = { bytes: chunk.subarray(written), done };
+    } else
+      done();
+  }
+  write(bytes) {
+    if (this.#tls.destroyed || this.#tls.writableNeedDrain)
+      return 0;
+    this.#tls.write(bytes);
+    return bytes.length;
+  }
+  shutdown(halfClose = false) {
+    this.#halfClose = halfClose;
+    this.#tls.once("finish", () => this.#wire.end());
+    this.#tls.end();
+  }
+  terminate() {
+    this.#pending = undefined;
+    this.#tls.destroy();
+    this.#raw.terminate();
+  }
+  closed() {
+    this.#pending = undefined;
+    this.#tls.destroy();
+  }
+  pause() {
+    this.#raw.pause();
+  }
+  resume() {
+    this.#raw.resume();
+  }
+  timeout(seconds) {
+    this.#raw.timeout(seconds);
+  }
+}
+
+// src/server/admission.ts
+function listenerHandlers(listening) {
+  const { settings, slots, handshaking, secure } = listening;
   return {
     open(socket) {
       socket.data = { upgraded: false, handshaking: secure };
       socket.timeout(secure ? settings.handshakeTimeout : settings.timeout);
-      const begin = (start) => {
-        if (!secure)
-          return start();
-        handshaking.add(socket);
-        socket.data.start = start;
-      };
-      if (slots.size >= settings.maxConnections) {
-        return begin(() => turnAway(socket, secure, `421 4.3.2 ${settings.options.hostname} Too many connections, try later\r
-`));
-      }
-      const key = clientKey(socket.remoteAddress);
-      if (slots.of(key) >= settings.maxConnectionsPerClient) {
-        return begin(() => turnAway(socket, secure, `421 4.7.0 ${settings.options.hostname} Too many connections from your address, try later\r
-`));
-      }
-      const connection = new Connection(settings, transportOf(socket, settings, secure, slots));
-      slots.take(connection, key);
-      socket.data.connection = connection;
-      begin(() => void connection.open());
-    },
-    handshake(socket, success) {
-      const state = socket.data;
-      if (!state?.handshaking)
-        return;
-      handshaking.delete(socket);
-      if (!success)
-        return;
-      state.handshaking = false;
-      socket.timeout(settings.timeout);
-      const start = state.start;
-      delete state.start;
-      start?.();
+      const peer = socket.remoteAddress;
+      if (settings.trusts?.(peer))
+        awaitHeader(listening, socket, peer);
+      else
+        admit(listening, socket, peer);
     },
+    handshake: (socket, success) => handshake(listening, socket, success),
     close(socket) {
       handshaking.delete(socket);
+      socket.data?.header?.cancel();
+      socket.data?.tls?.closed();
       const connection = socket.data?.connection;
       if (connection)
         slots.release(connection);
@@ -1235,22 +1542,223 @@ function listenerHandlers(settings, slots, handshaking, secure) {
     }
   };
 }
+function handshake({ settings, handshaking }, socket, success) {
+  const state = socket.data;
+  if (!state?.handshaking)
+    return;
+  handshaking.delete(socket);
+  if (!success)
+    return;
+  state.handshaking = false;
+  socket.timeout(settings.timeout);
+  const start = state.start;
+  delete state.start;
+  start?.();
+}
+function awaitHeader(listening, socket, peer) {
+  const { settings, handshaking, secure } = listening;
+  socket.data.handshaking = true;
+  socket.timeout(settings.handshakeTimeout);
+  handshaking.add(socket);
+  socket.data.header = new HeaderReader(settings.handshakeTimeout, (source, rest) => {
+    delete socket.data.header;
+    handshaking.delete(socket);
+    socket.data.handshaking = secure;
+    if (!secure)
+      socket.timeout(settings.timeout);
+    admit(listening, socket, source ?? peer, rest);
+  }, () => socket.terminate());
+}
+function admit(listening, socket, address, first) {
+  const { settings, slots, handshaking, secure, proxied } = listening;
+  let raw = socket;
+  if (proxied) {
+    raw = startTls2(listening, socket, proxied);
+    if (first && first.length > 0)
+      socket.data.tls?.receive(first);
+  }
+  const begin = (start) => {
+    if (!secure)
+      return start();
+    handshaking.add(socket);
+    socket.data.start = start;
+  };
+  const { hostname } = settings.options;
+  const refuse = (line) => begin(() => turnAway(socket, raw, secure, `${line}\r
+`));
+  if (slots.size >= settings.maxConnections) {
+    refuse(`421 4.3.2 ${hostname} Too many connections, try later`);
+    return;
+  }
+  const key = clientKey(address);
+  if (slots.of(key) >= settings.maxConnectionsPerClient) {
+    refuse(`421 4.7.0 ${hostname} Too many connections from your address, try later`);
+    return;
+  }
+  const transport = transportOf(socket, raw, address, settings, secure, slots);
+  const connection = new Connection(settings, transport);
+  slots.take(connection, key);
+  socket.data.connection = connection;
+  if (first && first.length > 0 && !proxied) {
+    received(socket, settings, first);
+  }
+  begin(() => void connection.open());
+}
+function startTls2(listening, socket, tls) {
+  const { settings } = listening;
+  socket.data.handshaking = true;
+  socket.timeout(settings.handshakeTimeout);
+  const proxied = new ProxiedTls(socket, tls.context, {
+    secure: () => handshake(listening, socket, true),
+    data: (bytes) => received(socket, settings, bytes),
+    drain: () => socket.data.transport?.drain()
+  });
+  socket.data.tls = proxied;
+  return proxied;
+}
+function upgradingHandlers(encrypted, settings) {
+  const ignore = () => {};
+  return {
+    open(raw) {
+      const tls = settings.tls?.options;
+      if (!tls)
+        return raw.terminate();
+      try {
+        raw.upgradeTLS({
+          tls: { key: tls.key, cert: tls.cert },
+          data: { upgraded: false },
+          socket: encrypted
+        });
+      } catch {
+        raw.terminate();
+      }
+    },
+    data: ignore,
+    drain: ignore,
+    close: ignore,
+    error: ignore,
+    timeout: ignore
+  };
+}
+
+// src/server/proxy/trusted.ts
+function networkOf(entry) {
+  if (typeof entry !== "string")
+    return `${String(entry)} is not a string`;
+  const [address = "", prefix, extra] = entry.split("/");
+  const raw = addressBytes(address);
+  if (!raw || extra !== undefined) {
+    return `"${entry}" is neither an IP address nor a CIDR`;
+  }
+  const mapped = raw.length === 4 && address.includes(":");
+  const width = raw.length * 8;
+  if (prefix === undefined)
+    return { bytes: raw, bits: width };
+  let bits = /^\d{1,3}$/.test(prefix) ? Number(prefix) : -1;
+  if (mapped)
+    bits -= 96;
+  if (bits < 0 || bits > width) {
+    return `"${entry}" has a prefix length out of range`;
+  }
+  if (bits === 0) {
+    return `"${entry}" has a prefix length of 0, which trusts every peer`;
+  }
+  return { bytes: raw, bits };
+}
+function contains(network, address) {
+  if (network.bytes.length !== address.length)
+    return false;
+  const whole = network.bits >> 3;
+  for (let at = 0;at < whole; at++) {
+    if (network.bytes[at] !== address[at])
+      return false;
+  }
+  const rest = network.bits & 7;
+  if (rest === 0)
+    return true;
+  const mask = 255 << 8 - rest & 255;
+  return (network.bytes[whole] & mask) === (address[whole] & mask);
+}
+function trustedPeers(entries, invalid) {
+  if (!Array.isArray(entries) || entries.length === 0) {
+    throw invalid("proxyProtocol.trusted must list the addresses or CIDRs of the proxies, at least one");
+  }
+  const networks = entries.map((entry) => {
+    const network = networkOf(entry);
+    if (typeof network === "string") {
+      throw invalid(`proxyProtocol.trusted: ${network}`);
+    }
+    return network;
+  });
+  return (peer) => {
+    const address = addressBytes(peer);
+    return address !== undefined && networks.some((network) => contains(network, address));
+  };
+}
+
+// src/server/tls-context.ts
+import { createSecureContext } from "node:tls";
+async function readTls(tls, fail, caller) {
+  const read = async (value) => typeof value === "string" ? value : Buffer.from(value instanceof Uint8Array ? value : await value.bytes());
+  try {
+    const key = await read(tls.key);
+    const cert = await read(tls.cert);
+    if (key.length === 0 || cert.length === 0) {
+      throw new Error(`the ${key.length === 0 ? "key" : "cert"} is empty`);
+    }
+    return { key, cert, context: createSecureContext({ key, cert }) };
+  } catch (cause) {
+    const reason = cause instanceof Error ? cause.message : String(cause);
+    throw fail(`${caller}: tls: { key, cert } cannot be used: ${reason}`, cause);
+  }
+}
+
+class TlsHolder {
+  #current;
+  #tail = Promise.resolve();
+  #given;
+  constructor(given) {
+    this.#given = given;
+  }
+  get options() {
+    return this.#current ?? this.#given;
+  }
+  get context() {
+    if (!this.#current)
+      throw new Error("the TLS pair was never read");
+    return this.#current.context;
+  }
+  async load(fail, caller) {
+    if (this.#current)
+      return this.#current.context;
+    const read = await readTls(this.#given, fail, caller);
+    this.#current ??= read;
+    return this.#current.context;
+  }
+  replace(tls, fail, caller) {
+    const run = this.#tail.then(async () => {
+      this.#current = await readTls(tls, fail, caller);
+    });
+    this.#tail = run.catch(() => {});
+    return run;
+  }
+}
 
 // src/server/settings.ts
 var MAX_TIMER_SECONDS = Math.floor(2147483647 / 1000);
-var invalid = (message) => new SmtpError2("INVALID_OPTION", `createSmtpServer(): ${message}`);
+var invalid2 = (message) => new SmtpError2("INVALID_OPTION", `createSmtpServer(): ${message}`);
 function positive(name, value, fallback) {
   if (value === undefined)
     return fallback;
   if (!Number.isSafeInteger(value) || value < 1) {
-    throw invalid(`${name} must be a positive integer, not ${value}`);
+    throw invalid2(`${name} must be a positive integer, not ${value}`);
   }
   return value;
 }
 function timer(name, value, fallback) {
   const seconds = positive(name, value, fallback);
   if (seconds > MAX_TIMER_SECONDS) {
-    throw invalid(`${name} must be at most ${MAX_TIMER_SECONDS} seconds, not ${seconds}`);
+    throw invalid2(`${name} must be at most ${MAX_TIMER_SECONDS} seconds, not ${seconds}`);
   }
   return seconds;
 }
@@ -1258,7 +1766,7 @@ function nonNegative(name, value, fallback) {
   if (value === undefined)
     return fallback;
   if (!Number.isFinite(value) || value < 0) {
-    throw invalid(`${name} must be a number of seconds, 0 or more, not ${value}`);
+    throw invalid2(`${name} must be a number of seconds, 0 or more, not ${value}`);
   }
   return value;
 }
@@ -1269,32 +1777,33 @@ function localLookup(local) {
     const domains = new Set(local.map((domain) => domain.toLowerCase()));
     return (domain) => domains.has(domain);
   }
-  throw invalid("localDomains must be an array of domains or a function");
+  throw invalid2("localDomains must be an array of domains or a function");
 }
 function settingsOf(options) {
   if (typeof options.hostname !== "string" || !/^[A-Za-z0-9.-]+$/.test(options.hostname)) {
-    throw invalid(`"${options.hostname}" is not a host name`);
+    throw invalid2(`"${options.hostname}" is not a host name`);
   }
   if (typeof options.onData !== "function") {
-    throw invalid("onData must be a function: it is where messages go");
+    throw invalid2("onData must be a function: it is where messages go");
   }
   if (options.implicitTls && !options.tls) {
-    throw invalid("implicitTls needs tls: { key, cert }");
+    throw invalid2("implicitTls needs tls: { key, cert }");
   }
   if (options.mode === "submission" && !options.authenticate) {
-    throw invalid("submission takes mail only from authenticated users, so it needs authenticate");
+    throw invalid2("submission takes mail only from authenticated users, so it needs authenticate");
   }
   if (options.authenticate && !options.tls) {
-    throw invalid("authenticate needs tls: { key, cert }, since AUTH is offered only once encrypted");
+    throw invalid2("authenticate needs tls: { key, cert }, since AUTH is offered only once encrypted");
   }
   const isLocal = localLookup(options.localDomains);
   const timeout = positive("timeout", options.timeout, 300);
   const greetingDelay = nonNegative("greetingDelay", options.greetingDelay, 0);
   if (greetingDelay >= timeout) {
-    throw invalid(`greetingDelay (${greetingDelay} s) must be shorter than timeout (${timeout} s), or every client times out before the greeting`);
+    throw invalid2(`greetingDelay (${greetingDelay} s) must be shorter than timeout (${timeout} s), or every client times out before the greeting`);
   }
   return {
     options,
+    ...options.tls ? { tls: new TlsHolder(options.tls) } : {},
     mode: options.mode ?? "mx",
     maxMessageSize: positive("maxMessageSize", options.maxMessageSize, 25 * 1024 * 1024),
     maxRecipients: positive("maxRecipients", options.maxRecipients, 100),
@@ -1305,6 +1814,7 @@ function settingsOf(options) {
     hookTimeout: timer("hookTimeout", options.hookTimeout, 60),
     handshakeTimeout: positive("handshakeTimeout", options.handshakeTimeout, 10),
     greetingDelay,
+    ...options.proxyProtocol === undefined ? {} : { trusts: trustedPeers(options.proxyProtocol?.trusted, invalid2) },
     isLocal: (domain) => isLocal(domain.toLowerCase())
   };
 }
@@ -1343,32 +1853,68 @@ class Slots {
 }
 
 // src/server/server.ts
+var invalidTls = (message, cause) => new SmtpError2("INVALID_OPTION", message, { cause });
+var STOPPED = "listen(): stop() was called before the server bound its port";
+async function bind(listening, port, hostname, stopped) {
+  const { tls } = listening.settings;
+  if (listening.secure && tls)
+    await tls.load(invalidTls, "listen()");
+  if (stopped()) {
+    throw new SmtpError2("STOPPED", STOPPED);
+  }
+  const proxied = listening.secure && listening.settings.trusts ? tls : undefined;
+  const full = {
+    ...handlers(listening.settings),
+    ...listenerHandlers({
+      ...listening,
+      ...proxied ? { proxied } : {}
+    })
+  };
+  return Bun.listen({
+    hostname,
+    port,
+    socket: listening.secure && !proxied ? upgradingHandlers(full, listening.settings) : full
+  });
+}
 function createSmtpServer(options) {
   const settings = settingsOf(options);
   let listener;
   const slots = new Slots;
   const handshaking = new Set;
   const secure = options.implicitTls === true;
+  let starting = false;
+  let stopRequested = false;
   return {
     get connections() {
       return slots.size;
     },
+    async setTls(tls) {
+      if (!settings.tls) {
+        throw new SmtpError2("INVALID_OPTION", "setTls(): the server was made without tls, so it has none to replace");
+      }
+      await settings.tls.replace(tls, invalidTls, "setTls()");
+    },
     async listen({ port, hostname = "0.0.0.0" }) {
-      if (listener) {
-        throw new SmtpError2("ALREADY_LISTENING", `listen(): the server is already listening on ${listener.hostname}:${listener.port}`);
+      if (listener || starting) {
+        throw new SmtpError2("ALREADY_LISTENING", listener ? `listen(): the server is already listening on ${listener.hostname}:${listener.port}` : "listen(): the server is already starting to listen");
       }
-      listener = Bun.listen({
-        hostname,
-        port,
-        ...secure && options.tls ? { tls: { key: options.tls.key, cert: options.tls.cert } } : {},
-        socket: {
-          ...handlers(settings),
-          ...listenerHandlers(settings, slots, handshaking, secure)
+      starting = true;
+      stopRequested = false;
+      try {
+        const bound = await bind({ settings, slots, handshaking, secure }, port, hostname, () => stopRequested);
+        if (stopRequested) {
+          bound.stop(true);
+          throw new SmtpError2("STOPPED", STOPPED);
         }
-      });
-      return { port: listener.port, hostname: listener.hostname };
+        listener = bound;
+        return { port: listener.port, hostname: listener.hostname };
+      } finally {
+        starting = false;
+      }
     },
     stop(closeConnections = false) {
+      if (starting)
+        stopRequested = true;
       listener?.stop(closeConnections);
       listener = undefined;
       if (!closeConnections)
@@ -1400,5 +1946,5 @@ export {
   reply
 };
 
-//# debugId=388406E838895A3964756E2164756E21
+//# debugId=2DE3A3E5E10EAC4A64756E2164756E21
 //# sourceMappingURL=index.js.map