imapkit 5.0.1 → 5.2.0

package/dist/cjs/control.js

@@ -629,7 +629,7 @@ class Control {
             }
             else {
                 this.server.closeListeners(false);
-                this.server.server.close(done);
+                this.server.closeImapListeners(done);
             }
         });
     }

package/dist/cjs/index.d.ts

@@ -6,6 +6,7 @@ export { TAG_REGEX, IMAPServer, IMAPConnection, ImapKitError, quirks, storageSch
 export type { Attribute, ParsedCommand, IMAPResponse, Notification, Callback, CommandHandler, CommandOptions, Plugin, IMAPError, Message, Mailbox, StorageNamespace, UserData, IMAPServerOptions } from './types.js';
 export type { ScriptRule, ScriptContext, ScriptEvent, ScriptBytes, ScriptHandle } from './script.js';
 export type { Quirk } from './quirks.js';
+export type { MemorySocket } from './memory-socket.js';
 export type { Control, MailboxInfo, MessageInfo, SessionInfo, NewMessage, UserOptions, SessionFilter, ControlRoute, RouteRequest } from './control.js';
 export type { FlagMode, UidMode, UidValidityOptions } from './store-operations.js';
 declare const imapkit: typeof createServer & {

package/dist/cjs/memory-socket.d.ts

@@ -0,0 +1,69 @@
+import { EventEmitter } from 'node:events';
+/**
+ * One end of an in-memory connection, see `server.connect()`. It has the parts of `net.Socket` that the server and a
+ * client use: `write(data, [encoding], [callback])`, `end()`, `destroy()`, `pause()`, `resume()`, `setEncoding()`,
+ * the `data`, `end`, `close` and `error` events, and `encrypted`, which makes the server treat the connection like
+ * one over TLS (as `tls.TLSSocket#encrypted` does). Written data reaches the other end on a later event loop turn,
+ * one `data` event per write
+ */
+export declare class MemorySocket extends EventEmitter {
+    /** the other end of the connection */
+    peer: MemorySocket | null;
+    destroyed: boolean;
+    /** true if the connection counts as encrypted (implicit TLS, or after STARTTLS) */
+    encrypted: boolean;
+    _paused: boolean;
+    _ending: boolean;
+    _encoding: BufferEncoding | null;
+    /** received data that waits while the socket is paused */
+    _received: Buffer[];
+    constructor();
+    /**
+     * Sends data to the other end
+     *
+     * @param data Data to send, a string is encoded with `encoding` (utf8 by default)
+     * @param encoding Encoding of a string, or the callback
+     * @param callback Called once the other end received the data
+     * @return true, there is no backpressure
+     */
+    write(data: Buffer | Uint8Array | string, encoding?: BufferEncoding | (() => void), callback?: () => void): boolean;
+    /**
+     * Ends the connection after the data written so far reached the other end, both ends close then
+     *
+     * @param data Data to send before the end
+     */
+    end(data?: Buffer | Uint8Array | string): this;
+    /**
+     * Closes both ends right away, data that did not reach the other end yet is lost
+     *
+     * @param error Error to emit on this end
+     */
+    destroy(error?: Error): this;
+    /**
+     * Closes the connection like a TCP RST: the other end gets an ECONNRESET error (`close: 'reset'` of script rules)
+     */
+    resetAndDestroy(): this;
+    /**
+     * STARTTLS without TLS: both ends count as encrypted from now on (`upgradeConnection` in src/server.ts)
+     *
+     * @param callback Called once the connection counts as encrypted
+     */
+    startTls(callback: () => void): void;
+    pause(): this;
+    resume(): this;
+    /**
+     * Makes the `data` events carry strings instead of Buffers
+     *
+     * @param encoding Encoding of the strings, e.g. "utf8" or "binary"
+     */
+    setEncoding(encoding: BufferEncoding): this;
+    deliver(chunk: Buffer): void;
+    private emitData;
+    close(error?: Error): void;
+}
+/**
+ * Creates the two ends of an in-memory connection
+ *
+ * @return `[serverSocket, clientSocket]`
+ */
+export declare function createSocketPair(): [MemorySocket, MemorySocket];

package/dist/cjs/memory-socket.js

@@ -0,0 +1,187 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MemorySocket = void 0;
+exports.createSocketPair = createSocketPair;
+const node_events_1 = require("node:events");
+/**
+ * One end of an in-memory connection, see `server.connect()`. It has the parts of `net.Socket` that the server and a
+ * client use: `write(data, [encoding], [callback])`, `end()`, `destroy()`, `pause()`, `resume()`, `setEncoding()`,
+ * the `data`, `end`, `close` and `error` events, and `encrypted`, which makes the server treat the connection like
+ * one over TLS (as `tls.TLSSocket#encrypted` does). Written data reaches the other end on a later event loop turn,
+ * one `data` event per write
+ */
+class MemorySocket extends node_events_1.EventEmitter {
+    constructor() {
+        super();
+        this.peer = null;
+        this.destroyed = false;
+        this.encrypted = false;
+        this._paused = false;
+        this._ending = false;
+        this._encoding = null;
+        this._received = [];
+    }
+    /**
+     * Sends data to the other end
+     *
+     * @param data Data to send, a string is encoded with `encoding` (utf8 by default)
+     * @param encoding Encoding of a string, or the callback
+     * @param callback Called once the other end received the data
+     * @return true, there is no backpressure
+     */
+    write(data, encoding, callback) {
+        if (typeof encoding === 'function') {
+            callback = encoding;
+            encoding = undefined;
+        }
+        if (this.destroyed || this._ending) {
+            return false;
+        }
+        // no copy, like a real socket the data is not changed after it was written
+        const chunk = typeof data === 'string' ? Buffer.from(data, encoding || 'utf8') : Buffer.from(data.buffer, data.byteOffset, data.byteLength);
+        nextTurn(() => {
+            this.peer?.deliver(chunk);
+            callback?.();
+        });
+        return true;
+    }
+    /**
+     * Ends the connection after the data written so far reached the other end, both ends close then
+     *
+     * @param data Data to send before the end
+     */
+    end(data) {
+        if (data !== undefined) {
+            this.write(data);
+        }
+        if (this.destroyed || this._ending) {
+            return this;
+        }
+        this._ending = true;
+        // queued after the writes, so the other end gets all data first
+        nextTurn(() => {
+            const peer = this.peer;
+            if (peer && !peer.destroyed) {
+                peer.emit('end');
+                peer.close();
+            }
+            this.close();
+        });
+        return this;
+    }
+    /**
+     * Closes both ends right away, data that did not reach the other end yet is lost
+     *
+     * @param error Error to emit on this end
+     */
+    destroy(error) {
+        if (this.destroyed) {
+            return this;
+        }
+        const peer = this.peer;
+        this.close(error);
+        if (peer && !peer.destroyed) {
+            peer.close();
+        }
+        return this;
+    }
+    /**
+     * Closes the connection like a TCP RST: the other end gets an ECONNRESET error (`close: 'reset'` of script rules)
+     */
+    resetAndDestroy() {
+        const peer = this.peer;
+        this.destroy();
+        if (peer) {
+            const error = new Error('read ECONNRESET');
+            error.code = 'ECONNRESET';
+            nextTurn(() => peer.emit('error', error));
+        }
+        return this;
+    }
+    /**
+     * STARTTLS without TLS: both ends count as encrypted from now on (`upgradeConnection` in src/server.ts)
+     *
+     * @param callback Called once the connection counts as encrypted
+     */
+    startTls(callback) {
+        this.encrypted = true;
+        if (this.peer) {
+            this.peer.encrypted = true;
+        }
+        callback();
+    }
+    pause() {
+        this._paused = true;
+        return this;
+    }
+    resume() {
+        this._paused = false;
+        while (this._received.length && !this._paused && !this.destroyed) {
+            this.emitData(this._received.shift());
+        }
+        return this;
+    }
+    /**
+     * Makes the `data` events carry strings instead of Buffers
+     *
+     * @param encoding Encoding of the strings, e.g. "utf8" or "binary"
+     */
+    setEncoding(encoding) {
+        this._encoding = encoding;
+        return this;
+    }
+    deliver(chunk) {
+        if (this.destroyed) {
+            return;
+        }
+        if (this._paused) {
+            this._received.push(chunk);
+            return;
+        }
+        this.emitData(chunk);
+    }
+    emitData(chunk) {
+        this.emit('data', this._encoding ? chunk.toString(this._encoding) : chunk);
+    }
+    close(error) {
+        if (this.destroyed) {
+            return;
+        }
+        this.destroyed = true;
+        this._received = [];
+        nextTurn(() => {
+            if (error) {
+                this.emit('error', error);
+            }
+            this.emit('close', !!error);
+        });
+    }
+}
+exports.MemorySocket = MemorySocket;
+/**
+ * Creates the two ends of an in-memory connection
+ *
+ * @return `[serverSocket, clientSocket]`
+ */
+function createSocketPair() {
+    const serverSocket = new MemorySocket();
+    const clientSocket = new MemorySocket();
+    serverSocket.peer = clientSocket;
+    clientSocket.peer = serverSocket;
+    return [serverSocket, clientSocket];
+}
+// one ordered queue for both ends, so the data and events of a connection keep the order they were sent in
+const queue = [];
+function nextTurn(fn) {
+    queue.push(fn);
+    if (queue.length === 1) {
+        setImmediate(runQueue);
+    }
+}
+function runQueue() {
+    // what runs now may queue more, that waits for the next turn
+    const batch = queue.splice(0, queue.length);
+    for (const fn of batch) {
+        fn();
+    }
+}

package/dist/cjs/plugins/idle.js

@@ -23,8 +23,8 @@ function idlePlugin(server) {
                 connection.end();
             }
         }, 30 * 60 * 1000);
-        // An idling client should not keep the process alive
-        idleTimer.unref();
+        // An idling client should not keep the process alive (browsers have no unref)
+        idleTimer.unref?.();
         const clearIdleTimer = () => clearTimeout(idleTimer);
         const socket = connection.socket;
         if (socket) {

package/dist/cjs/rest.js

@@ -69,8 +69,10 @@ function decodeBody(value, encoding) {
     }
     return encoding === 'base64' && typeof value === 'string' ? Buffer.from(value, 'base64') : value;
 }
-// the server events that GET /v1/events streams
-const EVENT_TYPES = ['session', 'command', 'mailbox', 'expunge', 'flags', 'acl', 'script', 'reset'];
+// the server events that GET /v1/events streams by default
+const EVENT_TYPES = ['session', 'command', 'mailbox', 'append', 'expunge', 'flags', 'acl', 'script', 'reset'];
+// event types that are streamed only when ?types= asks for them, the protocol trace of every session is a lot of data
+const OPT_IN_EVENT_TYPES = ['trace'];
 const sessionNumber = (origin) => (origin ? origin.sessionNumber : null);
 /**
  * Turns the arguments of a server event into JSON data: mailboxes become paths, messages UIDs, sessions numbers
@@ -85,8 +87,13 @@ function eventData(type, args) {
             const { type: change, path, oldPath, origin } = args[0];
             return { type: change, path, oldPath, origin: sessionNumber(origin) };
         }
+        case 'append':
         case 'expunge':
             return { path: args[0].path, uids: args[1].map(message => message.uid), origin: sessionNumber(args[2]) };
+        case 'trace': {
+            const { session, direction, data } = args[0];
+            return { session, direction, data: Buffer.from(data).toString('base64'), encoding: 'base64' };
+        }
         case 'flags':
             return {
                 path: args[0].path,
@@ -161,13 +168,16 @@ function getRoutes(server, streams = new Set()) {
         {
             method: 'GET',
             path: '/v1/events',
-            summary: 'Server events as Server-Sent Events (?types=session,command to choose: ' + EVENT_TYPES.join(', ') + ')',
+            summary: 'Server events as Server-Sent Events (?types=session,command to choose: ' +
+                EVENT_TYPES.concat(OPT_IN_EVENT_TYPES).join(', ') +
+                ', trace only when asked for)',
             handler: ({ query }) => {
                 const wanted = query.get('types');
                 const types = wanted === null ? EVENT_TYPES : wanted.split(',');
-                const unknown = types.filter(type => EVENT_TYPES.indexOf(type) < 0);
+                const known = EVENT_TYPES.concat(OPT_IN_EVENT_TYPES);
+                const unknown = types.filter(type => known.indexOf(type) < 0);
                 if (unknown.length) {
-                    throw (0, store_operations_js_1.storeError)('Unknown event type ' + unknown.join(', ') + ', expected ' + EVENT_TYPES.join(', '), 'INVALID');
+                    throw (0, store_operations_js_1.storeError)('Unknown event type ' + unknown.join(', ') + ', expected ' + known.join(', '), 'INVALID');
                 }
                 return { stream: eventStream(server, types, streams) };
             }

package/dist/cjs/server.d.ts

@@ -6,6 +6,7 @@ import type { ResolvedCommandOptions } from './command-states.js';
 import { Control } from './control.js';
 import type { RestServer } from './rest.js';
 import type { SessionInfo } from './control.js';
+import type { MemorySocket } from './memory-socket.js';
 import { ServerScript } from './script.js';
 import type { DeferredOutput, OutputOperation, ScriptContext, ScriptEvent, ScriptRule } from './script.js';
 import type { AppendCheck, AppendCheckOptions, AppendDataHandler, AppendMessage, CapabilityCheck, CheckResult, ClosedCheck, CommandCheck, CommandContext, CommandOptions, CommandHandler, ConnectionHandler, ConnectionState, CopyHandler, FetchHandler, IMAPResponse, IMAPServerOptions, ListedMailbox, LiteralFilter, Mailbox, MailboxHandler, MailboxStatus, Message, MessageFilter, MessageHandler, MessageRange, Namespace, Notification, NotifyEvent, NotifyFilter, OutputHandler, ParsedCommand, RangeLimit, Refusal, SearchAccessCheck, SearchHandler, SearchLimit, ServerStorage, StatusHandler, StorageMailbox, StorageMessage, StoreHandler, SubscriptionStandIn, Transport, UrlAccessCheck, UserData } from './types.js';
@@ -82,6 +83,8 @@ declare class IMAPServer extends Stream {
     sessionCounter: number;
     /** the control API, see src/control.ts */
     control: Control;
+    /** the implicit TLS listener that `start()` runs for the `tls` option */
+    tlsServer: tls.Server | null;
     /** the SMTP server that `start()` runs for the `smtp` option */
     smtpServer: SMTPListener | null;
     /** the HTTP server of the REST API that `start()` runs for the `rest` option */
@@ -106,6 +109,14 @@ declare class IMAPServer extends Stream {
      * @return {Promise<Number>} resolves with the port the server listens on
      */
     start(port?: number, host?: string): Promise<number>;
+    /**
+     * Starts the implicit TLS listener of the `tls` option. Its sessions are sessions of this server like the ones of
+     * the main listener, they share the storage and count as encrypted
+     *
+     * @param {String} [defaultHost] Address to listen on when the `tls` option has no host
+     * @return {Promise<Number>} resolves with the port of the TLS listener
+     */
+    startTlsListener(defaultHost?: string): Promise<number>;
     /**
      * Starts the REST API of the `rest` option, see src/rest.ts
      *
@@ -139,6 +150,13 @@ declare class IMAPServer extends Stream {
     listen(port: number, hostname: string, listeningListener?: () => void): void;
     listen(options: net.ListenOptions, listeningListener?: () => void): void;
     close(callback?: (err?: Error) => void): void;
+    /**
+     * Stops accepting IMAP connections, on the main listener and on the TLS listener of the `tls` option
+     *
+     * @param {Function} [callback] Called once both listeners are closed, which is after their last connection is
+     *   gone, with the first error
+     */
+    closeImapListeners(callback?: (err?: Error) => void): void;
     /**
      * Stops the SMTP and REST listeners of `start()`
      *
@@ -158,6 +176,18 @@ declare class IMAPServer extends Stream {
     };
     address(): ReturnType<net.Server['address']>;
     createClient(socket: net.Socket): void;
+    /**
+     * Opens a connection to the server in memory, without a network socket (no `listen()` needed). This is how the
+     * server runs in a browser, see the README "Run in a browser"
+     *
+     * @param {Object} [options] `{ secure }`: false makes the connection a plaintext one, where STARTTLS turns on the
+     *   encryption (nothing is encrypted, the session only counts as encrypted). By default the connection counts as
+     *   one over TLS
+     * @return {MemorySocket} the client end, write commands to it and read the responses from its `data` events
+     */
+    connect(options?: {
+        secure?: boolean | undefined;
+    }): MemorySocket;
     registerCapability(keyword: string, handler?: CapabilityCheck | null): void;
     /**
      * Sets the handler of a command
@@ -664,6 +694,13 @@ declare class IMAPConnection {
      * @param {Function} [callback] Called once the data was handed to the system (a transport: on the next turn)
      */
     writeLayer(data: Buffer, transport: Transport | null, callback?: () => void): void;
+    /**
+     * Emits the protocol traffic of the session as `trace` events, as the IMAP layer sees it: above TLS and COMPRESS
+     *
+     * @param {String} direction "in" for client input, "out" for server output
+     * @param {Buffer} data The octets
+     */
+    trace(direction: 'in' | 'out', data: Buffer): void;
     /**
      * Sends output through the script rule that handles its event, if there is one
      *

package/dist/cjs/server.js

@@ -59,6 +59,7 @@ const quirks_js_1 = require("./quirks.js");
 const storage_schema_js_1 = require("./storage-schema.js");
 const rest_js_1 = require("./rest.js");
 const bundledCert = __importStar(require("./cert.js"));
+const memory_socket_js_1 = require("./memory-socket.js");
 const script_js_1 = require("./script.js");
 // longest command line (not counting literals) accepted from a client
 const MAX_LINE_LENGTH = 1024 * 1024;
@@ -241,6 +242,7 @@ class IMAPServer extends node_stream_1.Stream {
         }
         this.systemFlags = [].concat(this.options.systemFlags || ['\\Answered', '\\Flagged', '\\Draft', '\\Deleted', '\\Seen']);
         this.loadStorage();
+        this.tlsServer = null;
         this.smtpServer = null;
         this.restServer = null;
     }
@@ -291,9 +293,25 @@ class IMAPServer extends node_stream_1.Stream {
      */
     async start(port, host) {
         const imapPort = await listenOn(this.server, port, host);
-        await Promise.all([this.options.smtp ? this.startSmtp() : null, this.options.rest ? this.startRest() : null]);
+        await Promise.all([
+            this.options.tls ? this.startTlsListener(host) : null,
+            this.options.smtp ? this.startSmtp() : null,
+            this.options.rest ? this.startRest() : null
+        ]);
         return imapPort;
     }
+    /**
+     * Starts the implicit TLS listener of the `tls` option. Its sessions are sessions of this server like the ones of
+     * the main listener, they share the storage and count as encrypted
+     *
+     * @param {String} [defaultHost] Address to listen on when the `tls` option has no host
+     * @return {Promise<Number>} resolves with the port of the TLS listener
+     */
+    startTlsListener(defaultHost) {
+        const { port, host } = this.options.tls || {};
+        this.tlsServer = node_tls_1.default.createServer(this.getCredentials(), this.createClient.bind(this));
+        return listenOn(this.tlsServer, port, host || defaultHost);
+    }
     /**
      * Starts the REST API of the `rest` option, see src/rest.ts
      *
@@ -343,7 +361,7 @@ class IMAPServer extends node_stream_1.Stream {
     }
     close(callback) {
         this.closeListeners(true);
-        this.server.close(callback);
+        this.closeImapListeners(callback);
         // close() only completes once all connections are gone
         this.connections.forEach((connection) => {
             if (connection.socket) {
@@ -351,6 +369,24 @@ class IMAPServer extends node_stream_1.Stream {
             }
         });
     }
+    /**
+     * Stops accepting IMAP connections, on the main listener and on the TLS listener of the `tls` option
+     *
+     * @param {Function} [callback] Called once both listeners are closed, which is after their last connection is
+     *   gone, with the first error
+     */
+    closeImapListeners(callback) {
+        const listeners = this.tlsServer ? [this.server, this.tlsServer] : [this.server];
+        this.tlsServer = null;
+        let pending = listeners.length;
+        let error;
+        listeners.forEach(listener => listener.close(err => {
+            error = error || err;
+            if (--pending === 0) {
+                callback?.(error);
+            }
+        }));
+    }
     /**
      * Stops the SMTP and REST listeners of `start()`
      *
@@ -400,6 +436,21 @@ class IMAPServer extends node_stream_1.Stream {
             handler(connection);
         });
     }
+    /**
+     * Opens a connection to the server in memory, without a network socket (no `listen()` needed). This is how the
+     * server runs in a browser, see the README "Run in a browser"
+     *
+     * @param {Object} [options] `{ secure }`: false makes the connection a plaintext one, where STARTTLS turns on the
+     *   encryption (nothing is encrypted, the session only counts as encrypted). By default the connection counts as
+     *   one over TLS
+     * @return {MemorySocket} the client end, write commands to it and read the responses from its `data` events
+     */
+    connect(options) {
+        const [serverSocket, clientSocket] = (0, memory_socket_js_1.createSocketPair)();
+        serverSocket.encrypted = clientSocket.encrypted = !options || options.secure !== false;
+        this.createClient(serverSocket);
+        return clientSocket;
+    }
     registerCapability(keyword, handler) {
         this.capabilities[keyword] =
             handler ||
@@ -1136,6 +1187,8 @@ class IMAPServer extends node_stream_1.Stream {
                 break;
             }
         }
+        // like expunge, before the sessions are told: APPEND, COPY, MOVE, REPLACE, SMTP and the control API all add here
+        this.emit('append', mailbox, [message], this.activeConnection);
         this.notify({
             tag: '*',
             attributes: [
@@ -1438,7 +1491,8 @@ class IMAPConnection {
         this._outputQueue = null;
         this._outputTimer = null;
         this._deferredOutput = null;
-        this.secureConnection = !!this.options.secureConnection;
+        // a TLS socket is encrypted, and so can be an in-memory connection of server.connect()
+        this.secureConnection = !!this.options.secureConnection || socket.encrypted === true;
         this._remainder = '';
         this._command = '';
         this._literalRemaining = 0;
@@ -1456,7 +1510,7 @@ class IMAPConnection {
         this.messageGlobal = false;
         this._commandQueue = [];
         this._processing = false;
-        if (this.options.debug) {
+        if (this.options.debug && typeof this.socket.pipe === 'function') {
             this.socket.pipe(process.stdout);
         }
         this.socket.on('data', this.receive.bind(this));
@@ -1579,6 +1633,7 @@ class IMAPConnection {
      * @param {Function} [callback] Called once the data was handed to the system (a transport: on the next turn)
      */
     writeLayer(data, transport, callback) {
+        this.trace('out', data);
         if (transport) {
             transport.write(data);
             if (callback) {
@@ -1589,6 +1644,17 @@ class IMAPConnection {
             this.writeRaw(data, callback);
         }
     }
+    /**
+     * Emits the protocol traffic of the session as `trace` events, as the IMAP layer sees it: above TLS and COMPRESS
+     *
+     * @param {String} direction "in" for client input, "out" for server output
+     * @param {Buffer} data The octets
+     */
+    trace(direction, data) {
+        if (this.server.listenerCount('trace')) {
+            this.server.emit('trace', { session: this.sessionNumber, direction, data });
+        }
+    }
     /**
      * Sends output through the script rule that handles its event, if there is one
      *
@@ -1695,7 +1761,8 @@ class IMAPConnection {
                 this.watchQuiet(quiet);
             }
         }, Math.max(0, next - (Date.now() - last)));
-        this._quietTimer.unref();
+        // browsers have no unref
+        this._quietTimer.unref?.();
     }
     /**
      * Handles data from the socket, through the transport layer if there is one
@@ -1898,6 +1965,9 @@ class IMAPConnection {
         if (this._resetting) {
             return;
         }
+        if (chunk && chunk.length) {
+            this.trace('in', chunk);
+        }
         // everything in one read arrived before anything this read causes to be sent
         this._readCount = (this._readCount || 0) + 1;
         str = (chunk || '').toString('binary');
@@ -2365,6 +2435,16 @@ class IMAPConnection {
         // section 6.2.1). STARTTLS is refused when input is waiting (the noPipelining command option), this only
         // guards against plugins that upgrade the connection otherwise
         this.discardInput();
+        // STARTTLS runs on a live connection
+        const socket = this.socket;
+        if (typeof socket.startTls === 'function') {
+            // a socket without a TLS layer that can count as encrypted (MemorySocket of server.connect())
+            return socket.startTls(() => {
+                this.secureConnection = true;
+                this.upgrading = false;
+                callback();
+            });
+        }
         const secureContext = node_tls_1.default.createSecureContext(this.server.getCredentials());
         const socketOptions = {
             secureContext: secureContext,
@@ -2375,8 +2455,6 @@ class IMAPConnection {
                 cb(null, secureContext);
             }
         };
-        // STARTTLS runs on a live connection
-        const socket = this.socket;
         // the RST of a script rule goes to the TCP socket under the TLS layer, see resetSocket. Node also has it as the
         // _parent of the TLS socket, Bun does not
         this.tcpSocket = socket;

package/dist/cjs/types.d.ts

@@ -228,6 +228,12 @@ export interface IMAPServerOptions {
     plugins?: (string | Plugin)[] | string | Plugin | undefined;
     users?: Record<string, UserData> | undefined;
     secureConnection?: boolean | undefined;
+    /** starts a second IMAP listener for implicit TLS (IMAPS) with `server.start()`, its sessions share the storage
+     * with the main listener. Without a host it listens on the host given to `start()` */
+    tls?: {
+        port?: number | undefined;
+        host?: string | undefined;
+    } | undefined;
     /** starts an SMTP server with `server.start()` that appends every received message to INBOX, needs the optional
      * smtp-server package */
     smtp?: {

package/dist/esm/control.js

@@ -622,7 +622,7 @@ class Control {
             }
             else {
                 this.server.closeListeners(false);
-                this.server.server.close(done);
+                this.server.closeImapListeners(done);
             }
         });
     }

package/dist/esm/index.d.ts

@@ -6,6 +6,7 @@ export { TAG_REGEX, IMAPServer, IMAPConnection, ImapKitError, quirks, storageSch
 export type { Attribute, ParsedCommand, IMAPResponse, Notification, Callback, CommandHandler, CommandOptions, Plugin, IMAPError, Message, Mailbox, StorageNamespace, UserData, IMAPServerOptions } from './types.js';
 export type { ScriptRule, ScriptContext, ScriptEvent, ScriptBytes, ScriptHandle } from './script.js';
 export type { Quirk } from './quirks.js';
+export type { MemorySocket } from './memory-socket.js';
 export type { Control, MailboxInfo, MessageInfo, SessionInfo, NewMessage, UserOptions, SessionFilter, ControlRoute, RouteRequest } from './control.js';
 export type { FlagMode, UidMode, UidValidityOptions } from './store-operations.js';
 declare const imapkit: typeof createServer & {