milter 2.0.0 → 3.0.0

package/dist/index.cjs

@@ -0,0 +1,976 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  ACTION_ALL: () => ACTION_ALL,
+  ConsoleLogger: () => ConsoleLogger,
+  DISABLE_ALL_CALLBACKS: () => DISABLE_ALL_CALLBACKS,
+  Decision: () => Decision,
+  Milter: () => Milter,
+  MilterActionError: () => MilterActionError,
+  MilterContext: () => MilterContext,
+  MilterServer: () => MilterServer,
+  SMFIA: () => SMFIA,
+  SMFIC: () => SMFIC,
+  SMFIF: () => SMFIF,
+  SMFIP: () => SMFIP,
+  SMFIR: () => SMFIR,
+  SMFI_VERSION: () => SMFI_VERSION,
+  checkSpf: () => checkSpf,
+  cloneHeaders: () => cloneHeaders,
+  default: () => MilterServer,
+  frame: () => frame,
+  normalizeDecision: () => normalizeDecision,
+  parseConnectInfo: () => parseConnectInfo,
+  readCString: () => readCString,
+  readCStringList: () => readCStringList,
+  readCStringPairs: () => readCStringPairs,
+  send: () => send,
+  signDkim: () => signDkim,
+  spfDecision: () => spfDecision,
+  verifyDkim: () => verifyDkim
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/constants.ts
+var SMFI_VERSION = 6;
+var SMFIA = {
+  UNKNOWN: "U",
+  UNIX: "L",
+  INET: "4",
+  INET6: "6"
+};
+var SMFIC = {
+  CONNECT: "C",
+  OPTNEG: "O",
+  HELO: "H",
+  HEADER: "L",
+  EOH: "N",
+  BODY: "B",
+  BODYEOB: "E",
+  MAIL: "M",
+  RCPT: "R",
+  ABORT: "A",
+  MACRO: "D",
+  QUIT: "Q",
+  DATA: "T",
+  UNKNOWN: "U"
+};
+var SMFIR = {
+  ACCEPT: "a",
+  CONTINUE: "c",
+  DISCARD: "d",
+  REJECT: "r",
+  TEMPFAIL: "t",
+  REPLYCODE: "y",
+  ADDRCPT: "+",
+  DELRCPT: "-",
+  REPLBODY: "b",
+  ADDHEADER: "h",
+  INSHEADER: "i",
+  CHGHEADER: "m",
+  PROGRESS: "p",
+  QUARANTINE: "q",
+  SETSENDER: "s"
+};
+var SMFIF = {
+  ADDHDRS: 1,
+  CHGBODY: 2,
+  ADDRCPT: 4,
+  DELRCPT: 8,
+  CHGHDRS: 16,
+  QUARANTINE: 32,
+  SETSENDER: 64
+};
+var ACTION_ALL = SMFIF.ADDHDRS | SMFIF.CHGBODY | SMFIF.ADDRCPT | SMFIF.DELRCPT | SMFIF.CHGHDRS | SMFIF.QUARANTINE | SMFIF.SETSENDER;
+var SMFIP = {
+  NOCONNECT: 1,
+  NOHELO: 2,
+  NOMAIL: 4,
+  NORCPT: 8,
+  NOBODY: 16,
+  NOHDRS: 32,
+  NOEOH: 64,
+  NONE: 127
+};
+var DISABLE_ALL_CALLBACKS = SMFIP.NOCONNECT | SMFIP.NOHELO | SMFIP.NOMAIL | SMFIP.NORCPT | SMFIP.NOBODY | SMFIP.NOHDRS | SMFIP.NOEOH;
+
+// src/frames.ts
+function frame(command, data = Buffer.alloc(0)) {
+  const len = Buffer.alloc(4);
+  len.writeUInt32BE(data.length + 1, 0);
+  return Buffer.concat([len, Buffer.from(command, "ascii"), data]);
+}
+function send(socket, command, data) {
+  if (!socket) {
+    return;
+  }
+  socket.write(frame(command, data ?? Buffer.alloc(0)));
+}
+
+// src/context.ts
+var MilterActionError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "MilterActionError";
+    this.code = code;
+  }
+};
+var EOM_ONLY_PHASES = /* @__PURE__ */ new Set(["bodyEnd"]);
+var MilterContext = class {
+  id;
+  collectBody;
+  maxBodyBytes;
+  enforceActionStages;
+  chunks = [];
+  bodyBytes = 0;
+  phase = "connect";
+  negotiatedActions = 0;
+  socket;
+  headers = {};
+  headerLines = [];
+  macros = {};
+  connection = null;
+  helo = null;
+  dkim = null;
+  spf = null;
+  from = null;
+  to = null;
+  constructor(id, socket, collectBody, maxBodyBytes, enforceActionStages) {
+    this.id = id;
+    this.socket = socket;
+    this.collectBody = collectBody;
+    this.maxBodyBytes = maxBodyBytes;
+    this.enforceActionStages = enforceActionStages;
+  }
+  setPhase(phase) {
+    this.phase = phase;
+  }
+  getPhase() {
+    return this.phase;
+  }
+  setNegotiatedActions(actions) {
+    this.negotiatedActions = actions >>> 0;
+  }
+  can(action) {
+    return (this.negotiatedActions & action) === action;
+  }
+  appendHeader(name, value) {
+    const key = name.toLowerCase();
+    this.headerLines.push([name, value]);
+    if (!this.headers[key]) {
+      this.headers[key] = [];
+    }
+    this.headers[key].push(value);
+  }
+  appendBody(chunk) {
+    if (!this.collectBody) {
+      return;
+    }
+    this.bodyBytes += chunk.length;
+    if (this.bodyBytes > this.maxBodyBytes) {
+      throw new Error(
+        `Body limit exceeded for connection ${this.id}: ${this.bodyBytes} > ${this.maxBodyBytes}`
+      );
+    }
+    this.chunks.push(Buffer.from(chunk));
+  }
+  getBody() {
+    return Buffer.concat(this.chunks);
+  }
+  resetMessage() {
+    this.headers = {};
+    this.headerLines = [];
+    this.macros = {};
+    this.dkim = null;
+    this.spf = null;
+    this.from = null;
+    this.to = null;
+    this.chunks = [];
+    this.bodyBytes = 0;
+    this.phase = "connect";
+  }
+  requireAction(action, actionName, phases) {
+    if ((this.negotiatedActions & action) !== action) {
+      throw new MilterActionError(
+        "E_MILTER_ACTION_CAPABILITY",
+        `${actionName} not permitted by negotiated action flags`
+      );
+    }
+    if (this.enforceActionStages && phases && !phases.has(this.phase)) {
+      throw new MilterActionError(
+        "E_MILTER_ACTION_STAGE",
+        `${actionName} is not allowed during phase '${this.phase}'`
+      );
+    }
+  }
+  send(command, data) {
+    send(this.socket, command, data);
+  }
+  continue() {
+    this.send(SMFIR.CONTINUE);
+  }
+  accept() {
+    this.send(SMFIR.ACCEPT);
+  }
+  reject() {
+    this.send(SMFIR.REJECT);
+  }
+  discard() {
+    this.send(SMFIR.DISCARD);
+  }
+  tempfail() {
+    this.send(SMFIR.TEMPFAIL);
+  }
+  progress() {
+    this.send(SMFIR.PROGRESS);
+  }
+  addHeader(name, value) {
+    this.requireAction(SMFIF.ADDHDRS, "addHeader", EOM_ONLY_PHASES);
+    this.send(SMFIR.ADDHEADER, Buffer.from(`${name}\0${value}\0`, "utf8"));
+  }
+  insertHeader(index, name, value) {
+    this.requireAction(SMFIF.ADDHDRS, "insertHeader", EOM_ONLY_PHASES);
+    const suffix = Buffer.from(`${name}\0${value}\0`, "utf8");
+    const data = Buffer.alloc(4 + suffix.length);
+    data.writeUInt32BE(index >>> 0, 0);
+    suffix.copy(data, 4);
+    this.send(SMFIR.INSHEADER, data);
+  }
+  changeHeader(name, index, value = "") {
+    this.requireAction(SMFIF.CHGHDRS, "changeHeader", EOM_ONLY_PHASES);
+    const suffix = Buffer.from(`${name}\0${value}\0`, "utf8");
+    const data = Buffer.alloc(4 + suffix.length);
+    data.writeUInt32BE(index >>> 0, 0);
+    suffix.copy(data, 4);
+    this.send(SMFIR.CHGHEADER, data);
+  }
+  addRecipient(address) {
+    this.requireAction(SMFIF.ADDRCPT, "addRecipient", EOM_ONLY_PHASES);
+    this.send(SMFIR.ADDRCPT, Buffer.from(`${address}\0`, "utf8"));
+  }
+  deleteRecipient(address) {
+    this.requireAction(SMFIF.DELRCPT, "deleteRecipient", EOM_ONLY_PHASES);
+    this.send(SMFIR.DELRCPT, Buffer.from(`${address}\0`, "utf8"));
+  }
+  replaceBody(chunk) {
+    this.requireAction(SMFIF.CHGBODY, "replaceBody", EOM_ONLY_PHASES);
+    const payload = typeof chunk === "string" ? Buffer.from(chunk, "utf8") : chunk;
+    this.send(SMFIR.REPLBODY, payload);
+  }
+  quarantine(reason = "") {
+    this.requireAction(SMFIF.QUARANTINE, "quarantine", EOM_ONLY_PHASES);
+    this.send(SMFIR.QUARANTINE, Buffer.from(`${reason}\0`, "utf8"));
+  }
+  setSender(sender) {
+    this.requireAction(SMFIF.SETSENDER, "setSender", EOM_ONLY_PHASES);
+    this.send(SMFIR.SETSENDER, Buffer.from(`${sender}\0`, "utf8"));
+  }
+  replyCode(code, message, enhancedCode = "5.7.1") {
+    this.send(SMFIR.REPLYCODE, Buffer.from(`${code} ${enhancedCode} ${message}\0`, "utf8"));
+  }
+};
+
+// src/decisions.ts
+var DECISION_TO_COMMAND = {
+  continue: SMFIR.CONTINUE,
+  accept: SMFIR.ACCEPT,
+  reject: SMFIR.REJECT,
+  discard: SMFIR.DISCARD,
+  tempfail: SMFIR.TEMPFAIL
+};
+var Decision = {
+  continue() {
+    return { command: SMFIR.CONTINUE };
+  },
+  accept() {
+    return { command: SMFIR.ACCEPT };
+  },
+  reject() {
+    return { command: SMFIR.REJECT };
+  },
+  discard() {
+    return { command: SMFIR.DISCARD };
+  },
+  tempfail() {
+    return { command: SMFIR.TEMPFAIL };
+  },
+  replyCode(code, message, enhancedCode = "5.7.1") {
+    const payload = Buffer.from(`${code} ${enhancedCode} ${message}\0`, "utf8");
+    return {
+      command: SMFIR.REPLYCODE,
+      data: payload
+    };
+  }
+};
+function normalizeDecision(decision, fallback) {
+  if (decision === null) {
+    return null;
+  }
+  if (decision === void 0) {
+    return { command: DECISION_TO_COMMAND[fallback] };
+  }
+  if (typeof decision === "string") {
+    return { command: DECISION_TO_COMMAND[decision] };
+  }
+  if (decision.data === void 0) {
+    return { command: decision.command };
+  }
+  return {
+    command: decision.command,
+    data: decision.data
+  };
+}
+
+// src/dkim.ts
+var import_sign = require("mailauth/lib/dkim/sign.js");
+var import_verify = require("mailauth/lib/dkim/verify.js");
+function normalizeSender(from) {
+  const value = from?.[0]?.trim();
+  if (!value || value === "<>") {
+    return void 0;
+  }
+  if (value.startsWith("<") && value.endsWith(">")) {
+    return value.slice(1, -1).trim() || void 0;
+  }
+  return value;
+}
+function buildMessage(ctx, body) {
+  const headers = ctx.headerLines.map(([name, value]) => `${name}: ${value}`).join("\r\n");
+  return Buffer.concat([
+    Buffer.from(`${headers}\r
+\r
+`, "utf8"),
+    body
+  ]);
+}
+async function verifyDkim(body, ctx, options = {}) {
+  const sender = options.sender ?? normalizeSender(ctx.from);
+  const result = await (0, import_verify.dkimVerify)(buildMessage(ctx, body), {
+    ...options,
+    ...sender === void 0 ? {} : { sender }
+  });
+  ctx.dkim = result;
+  return result;
+}
+async function signDkim(message, options) {
+  const signatureData = options.signatureData?.length ? options.signatureData.map((entry) => ({ ...entry })) : [{
+    signingDomain: options.signingDomain,
+    selector: options.selector,
+    privateKey: options.privateKey,
+    ...options.canonicalization === void 0 ? {} : { canonicalization: options.canonicalization },
+    ...options.algorithm === void 0 ? {} : { algorithm: options.algorithm },
+    ...options.maxBodyLength === void 0 ? {} : { maxBodyLength: options.maxBodyLength },
+    ...options.identity === void 0 ? {} : { identity: options.identity }
+  }];
+  return (0, import_sign.dkimSign)(message, {
+    ...options,
+    signatureData
+  });
+}
+
+// src/logger.ts
+var ConsoleLogger = class {
+  prefix;
+  constructor(prefix = "[MILTER]") {
+    this.prefix = prefix;
+  }
+  debug(...args) {
+    console.debug(this.prefix, ...args);
+  }
+  info(...args) {
+    console.info(this.prefix, ...args);
+  }
+  warn(...args) {
+    console.warn(this.prefix, ...args);
+  }
+  error(...args) {
+    console.error(this.prefix, ...args);
+  }
+};
+
+// src/server.ts
+var import_node_fs = __toESM(require("fs"), 1);
+var import_node_net = __toESM(require("net"), 1);
+
+// src/spf.ts
+var import_spf = require("mailauth/lib/spf/index.js");
+var DEFAULT_POLICY = {
+  pass: "continue",
+  fail: "reject",
+  softfail: "continue",
+  neutral: "continue",
+  none: "continue",
+  temperror: "tempfail",
+  permerror: "continue"
+};
+function normalizeSender2(from) {
+  const value = (typeof from === "string" ? from : from[0])?.trim();
+  if (!value || value === "<>") {
+    return void 0;
+  }
+  if (value.startsWith("<") && value.endsWith(">")) {
+    return value.slice(1, -1).trim() || void 0;
+  }
+  return value;
+}
+async function checkSpf(from, ctx, options = {}) {
+  const ip = ctx.connection?.address;
+  if (!ip) {
+    throw new Error("SPF requires the client IP from the Milter CONNECT event.");
+  }
+  const sender = normalizeSender2(from);
+  const helo = ctx.helo ?? ctx.connection?.hostname;
+  const result = await (0, import_spf.spf)({
+    ip,
+    ...sender === void 0 ? {} : { sender },
+    ...helo === void 0 ? {} : { helo },
+    ...options.mta === void 0 ? {} : { mta: options.mta },
+    ...options.maxResolveCount === void 0 ? {} : { maxResolveCount: options.maxResolveCount },
+    ...options.maxVoidCount === void 0 ? {} : { maxVoidCount: options.maxVoidCount },
+    ...options.resolver === void 0 ? {} : { resolver: options.resolver }
+  });
+  ctx.spf = result;
+  return result;
+}
+function spfDecision(result, policy = {}) {
+  const code = result.status.result;
+  return policy[code] ?? DEFAULT_POLICY[code] ?? "continue";
+}
+
+// src/utils.ts
+function readCString(buf, start = 0) {
+  if (start >= buf.length) {
+    return {
+      value: "",
+      next: buf.length
+    };
+  }
+  const end = buf.indexOf(0, start);
+  if (end === -1) {
+    return {
+      value: buf.toString("utf8", start),
+      next: buf.length
+    };
+  }
+  return {
+    value: buf.toString("utf8", start, end),
+    next: end + 1
+  };
+}
+function readCStringList(buf, start = 0) {
+  const out = [];
+  let offset = start;
+  while (offset < buf.length) {
+    const { value, next } = readCString(buf, offset);
+    if (next === offset) {
+      break;
+    }
+    offset = next;
+    if (value.length === 0) {
+      if (offset >= buf.length) {
+        break;
+      }
+      continue;
+    }
+    out.push(value);
+  }
+  return out;
+}
+function readCStringPairs(buf, start = 0) {
+  const list = readCStringList(buf, start);
+  const map = {};
+  for (let i = 0; i + 1 < list.length; i += 2) {
+    const key = list[i];
+    const value = list[i + 1];
+    if (key && value) {
+      map[key] = value;
+    }
+  }
+  return map;
+}
+function parseConnectInfo(payload) {
+  const host = readCString(payload, 0);
+  const familyByte = payload.toString("ascii", host.next, host.next + 1);
+  if (familyByte === SMFIA.UNKNOWN || host.next >= payload.length) {
+    return {
+      hostname: host.value,
+      family: "UNKNOWN"
+    };
+  }
+  if (host.next + 3 > payload.length) {
+    return {
+      hostname: host.value,
+      family: "UNKNOWN"
+    };
+  }
+  const port = payload.readUInt16BE(host.next + 1);
+  const addr = readCString(payload, host.next + 3).value;
+  const family = familyByte === SMFIA.UNIX ? "UNIX" : familyByte === SMFIA.INET ? "INET" : familyByte === SMFIA.INET6 ? "INET6" : "UNKNOWN";
+  return {
+    hostname: host.value,
+    family,
+    address: addr,
+    port
+  };
+}
+function cloneHeaders(headers) {
+  const out = {};
+  for (const [name, values] of Object.entries(headers)) {
+    out[name] = [...values];
+  }
+  return out;
+}
+
+// src/server.ts
+var DEFAULT_OPTIONS = {
+  socketPath: void 0,
+  host: "127.0.0.1",
+  port: void 0,
+  actions: SMFIF.ADDHDRS | SMFIF.CHGBODY | SMFIF.ADDRCPT,
+  unlinkOnStart: true,
+  chmod: 511,
+  collectBody: true,
+  maxBodyBytes: 32 * 1024 * 1024,
+  enforceActionStages: true,
+  defaultDecision: "continue",
+  logger: new ConsoleLogger("[MILTER]")
+};
+function createHandlerMap() {
+  return {
+    connect: /* @__PURE__ */ new Set(),
+    helo: /* @__PURE__ */ new Set(),
+    mail: /* @__PURE__ */ new Set(),
+    rcpt: /* @__PURE__ */ new Set(),
+    headerLine: /* @__PURE__ */ new Set(),
+    headers: /* @__PURE__ */ new Set(),
+    header: /* @__PURE__ */ new Set(),
+    bodyChunk: /* @__PURE__ */ new Set(),
+    bodyEnd: /* @__PURE__ */ new Set(),
+    data: /* @__PURE__ */ new Set(),
+    macro: /* @__PURE__ */ new Set(),
+    abort: /* @__PURE__ */ new Set(),
+    close: /* @__PURE__ */ new Set(),
+    unknown: /* @__PURE__ */ new Set(),
+    error: /* @__PURE__ */ new Set()
+  };
+}
+var MilterServer = class {
+  server;
+  handlers;
+  options;
+  nextConnectionId = 1;
+  dkimOptions = null;
+  spfOptions = null;
+  constructor(options = {}) {
+    this.options = {
+      ...DEFAULT_OPTIONS,
+      ...options,
+      logger: options.logger ?? DEFAULT_OPTIONS.logger
+    };
+    if (!this.options.socketPath && this.options.port === void 0) {
+      throw new Error("Either socketPath or port must be provided.");
+    }
+    this.handlers = createHandlerMap();
+    this.server = import_node_net.default.createServer((socket) => {
+      this.handleConnection(socket);
+    });
+    this.server.on("error", (err) => {
+      this.options.logger.error("Server error", err);
+      this.emitInternalError(void 0, err);
+    });
+  }
+  on(event, handler) {
+    this.handlers[event].add(handler);
+    return this;
+  }
+  off(event, handler) {
+    this.handlers[event].delete(handler);
+    return this;
+  }
+  once(event, handler) {
+    const wrap = (async (...args) => {
+      this.off(event, wrap);
+      return handler(...args);
+    });
+    this.on(event, wrap);
+    return this;
+  }
+  useSpf(options = {}) {
+    this.spfOptions = options;
+    return this;
+  }
+  useDkim(options = {}) {
+    if (!this.options.collectBody) {
+      throw new Error("DKIM verification requires collectBody to be enabled.");
+    }
+    this.dkimOptions = options;
+    return this;
+  }
+  async listen(socketPathOverride) {
+    if (socketPathOverride) {
+      this.options.socketPath = socketPathOverride;
+    }
+    if (this.options.socketPath) {
+      if (this.options.unlinkOnStart && import_node_fs.default.existsSync(this.options.socketPath)) {
+        import_node_fs.default.unlinkSync(this.options.socketPath);
+      }
+      await new Promise((resolve, reject) => {
+        this.server.listen(this.options.socketPath, (err) => {
+          if (err) {
+            reject(err);
+            return;
+          }
+          if (this.options.chmod !== false) {
+            import_node_fs.default.chmodSync(this.options.socketPath, this.options.chmod);
+          }
+          this.options.logger.info("Listening on", this.options.socketPath);
+          resolve();
+        });
+      });
+      return;
+    }
+    await new Promise((resolve, reject) => {
+      this.server.listen(this.options.port, this.options.host, (err) => {
+        if (err) {
+          reject(err);
+          return;
+        }
+        this.options.logger.info("Listening on", `${this.options.host}:${this.options.port}`);
+        resolve();
+      });
+    });
+  }
+  async close() {
+    await new Promise((resolve, reject) => {
+      this.server.close((err) => {
+        if (err) {
+          reject(err);
+          return;
+        }
+        resolve();
+      });
+    });
+  }
+  handleConnection(socket) {
+    const ctx = new MilterContext(
+      this.nextConnectionId++,
+      socket,
+      this.options.collectBody,
+      this.options.maxBodyBytes,
+      this.options.enforceActionStages
+    );
+    this.options.logger.info("MTA connected", ctx.id);
+    let closed = false;
+    let buffer = Buffer.alloc(0);
+    let pipeline = Promise.resolve();
+    const emitClose = () => {
+      if (closed) {
+        return;
+      }
+      closed = true;
+      void this.emit("close", ctx);
+    };
+    socket.on("error", (err) => {
+      this.options.logger.error("Socket error", ctx.id, err);
+      this.emitInternalError(ctx, err);
+    });
+    socket.on("close", () => {
+      ctx.socket = null;
+      emitClose();
+    });
+    socket.on("end", () => {
+      this.options.logger.info("MTA disconnected", ctx.id);
+      ctx.socket = null;
+      emitClose();
+    });
+    socket.on("data", (chunk) => {
+      buffer = Buffer.concat([buffer, chunk]);
+      while (buffer.length >= 5) {
+        const len = buffer.readUInt32BE(0);
+        if (len < 1) {
+          this.options.logger.warn("Invalid frame length", len, "connection", ctx.id);
+          socket.destroy();
+          return;
+        }
+        const total = 4 + len;
+        if (buffer.length < total) {
+          break;
+        }
+        const command = buffer.toString("ascii", 4, 5);
+        const data = buffer.subarray(5, total);
+        buffer = buffer.subarray(total);
+        pipeline = pipeline.then(() => this.parsePacket(ctx, command, data)).catch((err) => {
+          this.options.logger.error("Packet handling error", ctx.id, err);
+          this.emitInternalError(ctx, err);
+          send(ctx.socket, "t");
+        });
+      }
+    });
+  }
+  async parsePacket(ctx, command, data) {
+    switch (command) {
+      case SMFIC.OPTNEG: {
+        if (data.length < 12) {
+          this.options.logger.warn("Invalid OPTNEG payload length", data.length, "connection", ctx.id);
+          return;
+        }
+        const mtaVersion = data.readUInt32BE(0);
+        const mtaActions = data.readUInt32BE(4);
+        const mtaProtocol = data.readUInt32BE(8);
+        const version = Math.min(mtaVersion, SMFI_VERSION);
+        const actions = (this.options.actions & mtaActions) >>> 0;
+        const protocol = (this.computeProtocolMask() & mtaProtocol) >>> 0;
+        ctx.setNegotiatedActions(actions);
+        const payload = Buffer.alloc(12);
+        payload.writeUInt32BE(version, 0);
+        payload.writeUInt32BE(actions, 4);
+        payload.writeUInt32BE(protocol, 8);
+        send(ctx.socket, SMFIC.OPTNEG, payload);
+        return;
+      }
+      case SMFIC.CONNECT: {
+        ctx.setPhase("connect");
+        const info = parseConnectInfo(data);
+        ctx.connection = info;
+        const decision = await this.emit("connect", info, ctx);
+        this.respond(ctx, decision);
+        return;
+      }
+      case SMFIC.HELO: {
+        ctx.setPhase("helo");
+        const helo = readCString(data, 0).value;
+        ctx.helo = helo;
+        const decision = await this.emit("helo", helo, ctx);
+        this.respond(ctx, decision);
+        return;
+      }
+      case SMFIC.MAIL: {
+        ctx.setPhase("mail");
+        const from = readCStringList(data);
+        ctx.from = from;
+        if (this.spfOptions) {
+          await checkSpf(from, ctx, this.spfOptions);
+        }
+        const decision = await this.emit("mail", from, ctx);
+        this.respond(ctx, decision);
+        return;
+      }
+      case SMFIC.RCPT: {
+        ctx.setPhase("rcpt");
+        const to = readCStringList(data);
+        ctx.to = to;
+        const decision = await this.emit("rcpt", to, ctx);
+        this.respond(ctx, decision);
+        return;
+      }
+      case SMFIC.HEADER: {
+        ctx.setPhase("headerLine");
+        const p = readCString(data, 0);
+        const q = readCString(data, p.next);
+        if (p.value.length > 0) {
+          ctx.appendHeader(p.value, q.value);
+          const decision = await this.emit("headerLine", p.value, q.value, ctx);
+          this.respond(ctx, decision);
+          return;
+        }
+        this.respond(ctx, void 0);
+        return;
+      }
+      case SMFIC.EOH: {
+        ctx.setPhase("eoh");
+        const headers = cloneHeaders(ctx.headers);
+        const legacy = await this.emit("header", headers, ctx);
+        const modern = await this.emit("headers", headers, ctx);
+        this.respond(ctx, modern ?? legacy);
+        return;
+      }
+      case SMFIC.BODY: {
+        ctx.setPhase("bodyChunk");
+        try {
+          ctx.appendBody(data);
+        } catch (err) {
+          this.emitInternalError(ctx, err);
+          this.respond(ctx, "tempfail");
+          return;
+        }
+        const decision = await this.emit("bodyChunk", Buffer.from(data), ctx);
+        this.respond(ctx, decision);
+        return;
+      }
+      case SMFIC.BODYEOB: {
+        ctx.setPhase("bodyEnd");
+        const body = ctx.getBody();
+        if (this.dkimOptions) {
+          await verifyDkim(body, ctx, this.dkimOptions);
+        }
+        const decision = await this.emit("bodyEnd", body, ctx);
+        this.respond(ctx, decision);
+        return;
+      }
+      case SMFIC.DATA: {
+        ctx.setPhase("data");
+        const decision = await this.emit("data", data.toString("utf8"), ctx);
+        this.respond(ctx, decision);
+        return;
+      }
+      case SMFIC.MACRO: {
+        ctx.setPhase("macro");
+        const cmd = data.toString("ascii", 0, 1);
+        const map = readCStringPairs(data, 1);
+        ctx.macros[cmd] = map;
+        await this.emit("macro", cmd, map, ctx);
+        return;
+      }
+      case SMFIC.ABORT: {
+        ctx.setPhase("abort");
+        ctx.resetMessage();
+        await this.emit("abort", ctx);
+        return;
+      }
+      case SMFIC.QUIT: {
+        ctx.setPhase("close");
+        await this.emit("close", ctx);
+        if (ctx.socket) {
+          ctx.socket.end();
+          ctx.socket = null;
+        }
+        return;
+      }
+      case SMFIC.UNKNOWN: {
+        ctx.setPhase("unknown");
+        const decision = await this.emit("unknown", command, data, ctx);
+        this.respond(ctx, decision);
+        return;
+      }
+      default: {
+        ctx.setPhase("unknown");
+        this.options.logger.warn("Unknown command", command, "connection", ctx.id);
+        const decision = await this.emit("unknown", command, data, ctx);
+        this.respond(ctx, decision);
+      }
+    }
+  }
+  computeProtocolMask() {
+    let flags = DISABLE_ALL_CALLBACKS;
+    if (this.handlers.connect.size > 0) {
+      flags &= ~SMFIP.NOCONNECT;
+    }
+    if (this.handlers.helo.size > 0) {
+      flags &= ~SMFIP.NOHELO;
+    }
+    if (this.handlers.mail.size > 0 || this.spfOptions) {
+      flags &= ~SMFIP.NOMAIL;
+    }
+    if (this.handlers.rcpt.size > 0) {
+      flags &= ~SMFIP.NORCPT;
+    }
+    if (this.handlers.bodyChunk.size > 0 || this.handlers.bodyEnd.size > 0 || this.dkimOptions) {
+      flags &= ~SMFIP.NOBODY;
+    }
+    if (this.handlers.headerLine.size > 0 || this.handlers.headers.size > 0 || this.handlers.header.size > 0 || this.dkimOptions) {
+      flags &= ~SMFIP.NOHDRS;
+    }
+    if (this.handlers.headers.size > 0 || this.handlers.header.size > 0) {
+      flags &= ~SMFIP.NOEOH;
+    }
+    return flags >>> 0;
+  }
+  respond(ctx, decision) {
+    const normalized = normalizeDecision(decision, this.options.defaultDecision);
+    if (!normalized) {
+      return;
+    }
+    send(ctx.socket, normalized.command, normalized.data);
+  }
+  async emit(event, ...args) {
+    const callbacks = this.handlers[event];
+    if (!callbacks || callbacks.size === 0) {
+      return void 0;
+    }
+    let result;
+    for (const fn of callbacks) {
+      result = await fn(...args);
+    }
+    return result;
+  }
+  emitInternalError(ctx, err) {
+    const callbacks = this.handlers.error;
+    if (callbacks.size === 0) {
+      return;
+    }
+    for (const fn of callbacks) {
+      Promise.resolve(fn(err, ctx)).catch(() => {
+        this.options.logger.error("Error handler failed", err);
+      });
+    }
+  }
+};
+var Milter = class extends MilterServer {
+  constructor(options = {}) {
+    const resolved = {
+      actions: ACTION_ALL,
+      ...options
+    };
+    super(resolved);
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ACTION_ALL,
+  ConsoleLogger,
+  DISABLE_ALL_CALLBACKS,
+  Decision,
+  Milter,
+  MilterActionError,
+  MilterContext,
+  MilterServer,
+  SMFIA,
+  SMFIC,
+  SMFIF,
+  SMFIP,
+  SMFIR,
+  SMFI_VERSION,
+  checkSpf,
+  cloneHeaders,
+  frame,
+  normalizeDecision,
+  parseConnectInfo,
+  readCString,
+  readCStringList,
+  readCStringPairs,
+  send,
+  signDkim,
+  spfDecision,
+  verifyDkim
+});
+//# sourceMappingURL=index.cjs.map