spamscanner 7.0.4 → 7.0.5

package/dist/cjs/index.cjs

@@ -3642,16 +3642,19 @@ function zipEntries(buffer, limit = 2e3) {
       records.push(i);
     }
   }
-  const entries = [];
-  const read = /* @__PURE__ */ new Set();
+  const state = {
+    entries: [],
+    limit,
+    read: /* @__PURE__ */ new Set(),
+    names: MAX_NAME_BYTES
+  };
   for (const eocd of records) {
     const offset = directoryOf(buffer, eocd);
-    if (offset !== -1 && !read.has(offset)) {
-      read.add(offset);
-      readDirectory(buffer, offset, limit - entries.length, entries);
+    if (offset !== -1) {
+      readDirectory(buffer, offset, state);
     }
   }
-  return entries;
+  return state.entries;
 }
 function directoryOf(buffer, eocd) {
   let offset = buffer.readUInt32LE(eocd + 16);
@@ -3677,18 +3680,32 @@ function directoryOf(buffer, eocd) {
   }
   return -1;
 }
-function readDirectory(buffer, offset, count, entries) {
-  for (let n = 0; n < count && isDirectory(buffer, offset); n++) {
+function readDirectory(buffer, offset, state) {
+  while (state.entries.length < state.limit && isDirectory(buffer, offset) && !state.read.has(offset)) {
+    state.read.add(offset);
     const flags = buffer.readUInt16LE(offset + 8);
     const size = buffer.readUInt32LE(offset + 24);
     const nameLength = buffer.readUInt16LE(offset + 28);
     const extraLength = buffer.readUInt16LE(offset + 30);
     const commentLength = buffer.readUInt16LE(offset + 32);
-    const name = buffer.subarray(offset + 46, offset + 46 + nameLength).toString(flags & 2048 ? "utf8" : "latin1");
-    entries.push({ name, encrypted: (flags & 1) === 1, size });
+    const encoding = flags & 2048 ? "utf8" : "latin1";
+    const start = offset + 46;
+    const end = Math.min(buffer.length, start + nameLength);
+    const kept = Math.min(end - start, MAX_NAME_LENGTH);
+    state.names -= kept;
+    if (state.names < 0) {
+      return;
+    }
+    const half = MAX_NAME_LENGTH / 2;
+    const name = end - start > MAX_NAME_LENGTH ? `${buffer.toString(encoding, start, start + half)}\u2026${buffer.toString(encoding, end - half, end)}` : buffer.toString(encoding, start, end);
+    state.entries.push({ name, encrypted: (flags & 1) === 1, size });
     offset += 46 + nameLength + extraLength + commentLength;
   }
 }
+function shorten(name, max = 100) {
+  const characters = [...name];
+  return characters.length <= max ? name : `${characters.slice(0, max - 41).join("")}\u2026${characters.slice(-40).join("")}`;
+}
 function extensionOf(name) {
   const base = trimEndOf(String(name).toLowerCase().split(/[/\\]/).pop(), ". ");
   const dot = base.lastIndexOf(".");
@@ -3747,7 +3764,7 @@ function inspectAttachments(attachments = []) {
       }
       const inner = entries.filter((entry) => EXECUTABLE_EXTENSIONS.has(extensionOf(entry.name)) && !(office && OFFICE_EMBEDDED.has(extensionOf(entry.name))));
       const details = { extension: extensionOf(inner[0]?.name ?? ""), extensions: [...new Set(inner.map((entry) => extensionOf(entry.name)))] };
-      const listed = inner.slice(0, 3).map((entry) => entry.name.split("/").pop()).join(", ");
+      const listed = inner.slice(0, 3).map((entry) => shorten(entry.name.split("/").pop())).join(", ");
       if (inner.some((entry) => !SCRIPT_EXTENSIONS.has(extensionOf(entry.name)))) {
         add("executable_in_archive", `Archive "${name}" contains ${inner.length === 1 ? "a program" : `${inner.length} programs`} (${listed})`, details);
       } else if (inner.length > 0) {
@@ -3775,7 +3792,7 @@ function inspectAttachments(attachments = []) {
   }
   return findings;
 }
-var import_node_buffer, EXECUTABLE_EXTENSIONS, RISKY_EXTENSIONS, SCRIPT_EXTENSIONS, MACRO_EXTENSIONS, DOCUMENT_EXTENSIONS, TEMPORARY_EXTENSIONS, BIDI_CONTROLS, ARCHIVE_TYPES, ZIP_FAMILY, OFFICE_TYPES, OFFICE_EMBEDDED, ENTRIES, DIRECTORY, isDirectory, VBA_NAMES, PDF_ACTIVE, PDF_ESCAPED_NAME, decodePdfNames;
+var import_node_buffer, EXECUTABLE_EXTENSIONS, RISKY_EXTENSIONS, SCRIPT_EXTENSIONS, MACRO_EXTENSIONS, DOCUMENT_EXTENSIONS, TEMPORARY_EXTENSIONS, BIDI_CONTROLS, ARCHIVE_TYPES, ZIP_FAMILY, OFFICE_TYPES, OFFICE_EMBEDDED, ENTRIES, MAX_NAME_LENGTH, MAX_NAME_BYTES, DIRECTORY, isDirectory, VBA_NAMES, PDF_ACTIVE, PDF_ESCAPED_NAME, decodePdfNames;
 var init_attachments = __esm({
   "src/attachments.js"() {
     import_node_buffer = require("node:buffer");
@@ -3931,6 +3948,8 @@ var init_attachments = __esm({
     OFFICE_TYPES = /* @__PURE__ */ new Set(["docx", "xlsx", "pptx"]);
     OFFICE_EMBEDDED = MACRO_EXTENSIONS;
     ENTRIES = /* @__PURE__ */ new WeakMap();
+    MAX_NAME_LENGTH = 1024;
+    MAX_NAME_BYTES = 1024 * 1024;
     DIRECTORY = 33639248;
     isDirectory = (buffer, offset) => offset >= 0 && offset + 46 <= buffer.length && buffer.readUInt32LE(offset) === DIRECTORY;
     VBA_NAMES = /* @__PURE__ */ new Set(["vba", "_vba_project", "_vba_project_cur", "macros"]);
@@ -3940,6 +3959,487 @@ var init_attachments = __esm({
   }
 });
 
+// src/parse.js
+function boundAddressField(line, room) {
+  const start = line.indexOf(":") + 1;
+  const limit = Math.min(line.length, MAX_ADDRESS_FIELD, room);
+  let end = start;
+  let expecting = "";
+  let escaped = false;
+  let separators = 0;
+  let groups = 0;
+  let index = start;
+  for (; index < limit; index++) {
+    const chr = line[index];
+    if ((chr === "," || chr === ";") && ++separators > MAX_ADDRESS_SEPARATORS) {
+      break;
+    }
+    if (escaped) {
+      escaped = false;
+    } else if (expecting !== "" && chr === expecting) {
+      expecting = "";
+      end = chr === ";" ? index + 1 : end;
+    } else if (expecting === "" && ADDRESS_OPERATORS.has(chr)) {
+      expecting = ADDRESS_OPERATORS.get(chr);
+      end = chr === "," || chr === ";" ? index : end;
+    } else if (expecting === '"' && chr === "\\") {
+      escaped = true;
+    }
+    if (chr === ":" && expecting === ";" && ++groups > MAX_ADDRESS_GROUPS) {
+      break;
+    }
+  }
+  return index === line.length ? line : line.slice(0, end).trimEnd();
+}
+function boundAddressLines(lines2, budget, only = null) {
+  const cut = /* @__PURE__ */ new Set();
+  const bounded = lines2.map((entry) => {
+    if (only ? !only.has(entry.key) : !ADDRESS_FIELDS.has(entry.key) && !entry.key.startsWith("list-")) {
+      return entry;
+    }
+    const line = boundAddressField(entry.line, budget.room);
+    budget.room = Math.max(budget.room - line.length, 0);
+    if (line === entry.line) {
+      return entry;
+    }
+    cut.add(entry.key);
+    return { ...entry, line };
+  });
+  return { lines: bounded, cut };
+}
+function boundedForAuth(raw) {
+  const ends = [raw.indexOf("\n\n"), raw.indexOf("\n\r\n")].filter((index) => index !== -1);
+  const end = ends.length > 0 ? Math.min(...ends) + 1 : raw.length;
+  const body = raw.subarray(ends.length > 0 ? raw.indexOf(10, end) + 1 : raw.length);
+  const text = raw.subarray(0, end).toString("latin1");
+  let { length } = text;
+  while (length > 0 && (text[length - 1] === "\n" || text[length - 1] === "\r")) {
+    length--;
+  }
+  const fields = [];
+  let folds = 0;
+  let work = 0;
+  for (let start = 0; start <= length; ) {
+    let stop = text.indexOf("\n", start);
+    stop = stop === -1 || stop > length ? length : stop;
+    const lineEnd = stop > start && text[stop - 1] === "\r" ? stop - 1 : stop;
+    const last = fields.at(-1);
+    if (last && /\s/.test(text[start])) {
+      last.end = lineEnd;
+      last.folds++;
+      folds++;
+      work += last.folds;
+    } else {
+      fields.push({ start, end: lineEnd, folds: 0 });
+    }
+    start = stop + 1;
+  }
+  let signatures = 0;
+  let dkim = 0;
+  for (const field of fields) {
+    field.line = text.slice(field.start, field.end);
+    const colon = field.line.indexOf(":");
+    field.key = (colon === -1 ? field.line : field.line.slice(0, colon)).trim().toLowerCase();
+    field.dropped = field.key === "dkim-signature" && ++dkim > MAX_DKIM_SIGNATURES;
+    if (SIGNATURE_FIELDS.has(field.key) && !field.dropped) {
+      signatures += field.line.split(":").length - 1;
+    }
+  }
+  const read = dkim > MAX_DKIM_SIGNATURES ? fields.filter((field) => !field.dropped) : fields;
+  work += (folds + signatures) * read.length;
+  const bounded = boundAddressLines(read, { room: MAX_ADDRESS_TOTAL }, AUTH_ADDRESS_FIELDS);
+  let kept = bounded.lines;
+  let fromCut = bounded.cut.has("from");
+  if (work > MAX_AUTH_WORK) {
+    const counts = /* @__PURE__ */ new Map();
+    kept = kept.filter((field) => {
+      counts.set(field.key, (counts.get(field.key) || 0) + 1);
+      const keep = AUTH_FIELDS.has(field.key) && counts.get(field.key) <= (SIGNATURE_FIELDS.has(field.key) ? MAX_SIGNATURES : MAX_REPEATED);
+      fromCut ||= field.key === "from" && !keep;
+      return keep;
+    }).map((field) => {
+      const line = field.line.replaceAll(/\r?\n(?=\s)/g, "");
+      return { ...field, line: ADDRESS_FIELDS.has(field.key) ? line : line.slice(0, MAX_FIELD) };
+    });
+  } else if (bounded.cut.size === 0 && read === fields) {
+    return { raw, fromCut };
+  }
+  const header = kept.map((field) => field.line).join("\r\n");
+  return { raw: import_node_buffer2.Buffer.concat([import_node_buffer2.Buffer.from(`${header}\r
+\r
+`, "latin1"), body]), fromCut };
+}
+async function simpleParse(raw, { timeout = PARSE_TIMEOUT, parser = import_mailparser.simpleParser } = {}) {
+  const input = import_node_stream.Readable.from([finishable(unfoldHeaders(raw))], { objectMode: false, autoDestroy: false });
+  input.on("error", () => {
+  });
+  const { pipe } = input;
+  input.pipe = function(parser2, options) {
+    parser2.splitter?.on("error", (error) => input.destroy(error));
+    return pipe.call(this, parser2, options);
+  };
+  let timer;
+  try {
+    return await Promise.race([
+      parser(input, PARSER_OPTIONS),
+      new Promise((resolve, reject) => {
+        timer = setTimeout(() => {
+          const error = Object.assign(new Error(`Message not parsed within ${timeout} ms`), { code: "ETIMEDOUT" });
+          input.destroy(error);
+          reject(error);
+        }, timeout);
+      })
+    ]);
+  } finally {
+    clearTimeout(timer);
+    input.destroy();
+  }
+}
+async function parseMessage(raw, options = {}) {
+  const buffer = import_node_buffer2.Buffer.isBuffer(raw) ? raw : import_node_buffer2.Buffer.from(raw);
+  const mail = await simpleParse(buffer, options);
+  const added = buffer.at(-1) === 10 ? 2 : 3;
+  for (const key of ["text", "html"]) {
+    if (typeof mail[key] === "string") {
+      mail[key] = mail[key].replace(new RegExp(`\\n{0,${added}}$`), "");
+    }
+  }
+  const tail = import_node_buffer2.Buffer.from("\r\n".repeat(added));
+  const last = mail.attachments?.at(-1);
+  const encoding = String(last?.headers?.get?.("content-transfer-encoding") ?? "7bit").trim().toLowerCase();
+  const own3 = import_node_buffer2.Buffer.isBuffer(last?.content) && last.content.length >= tail.length && last.content.subarray(-tail.length).equals(tail) ? last.content.subarray(0, -tail.length) : null;
+  if (own3 && ["7bit", "8bit", "binary"].includes(encoding) && own3.length <= buffer.length && buffer.subarray(buffer.length - own3.length).equals(own3)) {
+    last.content = own3;
+    last.size = own3.length;
+    last.checksum = (0, import_node_crypto.createHash)("md5").update(own3).digest("hex");
+  }
+  return mail;
+}
+function finishable(raw) {
+  const buffer = import_node_buffer2.Buffer.isBuffer(raw) ? raw : import_node_buffer2.Buffer.from(raw);
+  return import_node_buffer2.Buffer.concat([buffer, import_node_buffer2.Buffer.from(buffer.at(-1) === 10 ? "\r\n\r\n" : "\r\n\r\n\r\n")]);
+}
+function headerValue2(line) {
+  const parameters = /* @__PURE__ */ new Map();
+  let key = null;
+  let inKey = false;
+  let quoted = false;
+  let escaped = false;
+  let value = "";
+  for (const chr of line.slice(line.indexOf(":") + 1).replaceAll(/\r?\n[ \t]*/g, " ")) {
+    if (inKey && chr === "=") {
+      key = value.trim().toLowerCase();
+      inKey = false;
+      value = "";
+    } else if (inKey || escaped) {
+      value += chr;
+      escaped = false;
+    } else if (chr === "\\") {
+      escaped = true;
+    } else if (chr === '"') {
+      quoted = !quoted;
+    } else if (chr === ";" && !quoted) {
+      parameters.set(key, value.trim());
+      inKey = true;
+      value = "";
+    } else {
+      value += chr;
+    }
+  }
+  if (!inKey) {
+    parameters.set(key, value.trim());
+  }
+  return { value: parameters.get(null).toLowerCase(), boundary: parameters.get("boundary") ?? "" };
+}
+function delimiter(raw, start, stop, boundary) {
+  const rest = start + 2 + boundary.length;
+  if (stop - start < boundary.length + 2 || stop - rest > 4 || raw[start] !== 45 || raw[start + 1] !== 45 || !raw.subarray(start + 2, rest).equals(boundary)) {
+    return 0;
+  }
+  if (raw[rest] === 13 || raw[rest] === 10) {
+    return 1;
+  }
+  const tail = raw.subarray(rest, stop).toString("latin1");
+  return /^-{0,2}$|^--\r?\n$|^--\r$/.test(tail) ? 2 : 0;
+}
+function unfoldHeaders(raw) {
+  const boundaries = [];
+  const unfold = [];
+  let head = true;
+  let fields = [];
+  const endHead = (blank) => {
+    unfold.push(...fields.filter((field) => field.folds > MAX_FOLDS));
+    const first = /* @__PURE__ */ new Map();
+    for (const field of fields) {
+      const name = raw.toString("latin1", field.start, Math.min(field.end, field.start + 32));
+      const key = name.slice(0, name.indexOf(":")).trim().toLowerCase();
+      if (["content-type", "content-transfer-encoding", "content-disposition"].includes(key) && !first.has(key)) {
+        first.set(key, headerValue2(raw.toString("latin1", field.start, field.end)));
+      }
+    }
+    fields = [];
+    const type = first.get("content-type") ?? { value: "", boundary: "" };
+    const encoding = (first.get("content-transfer-encoding")?.value ?? "").replaceAll(/\(.*\)/g, "").trim();
+    if (blank && type.boundary) {
+      boundaries.push(import_node_buffer2.Buffer.from(type.boundary));
+    }
+    head = blank && type.value === "message/rfc822" && ["", "7bit", "8bit", "binary"].includes(encoding) && first.get("content-disposition")?.value === "inline";
+  };
+  for (let start = 0; start < raw.length; ) {
+    const lf = raw.indexOf(10, start);
+    const stop = lf === -1 ? raw.length : lf + 1;
+    const end = lf === -1 ? stop : raw[lf - 1] === 13 ? lf - 1 : lf;
+    const kind = boundaries.length > 0 ? delimiter(raw, start, stop, boundaries.at(-1)) : 0;
+    if (kind !== 0) {
+      if (head) {
+        endHead(false);
+      }
+      head = kind === 1;
+      if (kind === 2) {
+        boundaries.pop();
+      }
+    } else if (head && end === start) {
+      endHead(true);
+    } else if (head && fields.length > 0 && (raw[start] === 32 || raw[start] === 9)) {
+      fields.at(-1).end = end;
+      fields.at(-1).folds++;
+    } else if (head) {
+      fields.push({ start, end, folds: 0 });
+    }
+    start = stop;
+  }
+  unfold.push(...fields.filter((field) => field.folds > MAX_FOLDS));
+  if (unfold.length === 0) {
+    return raw;
+  }
+  const chunks = [];
+  let copied = 0;
+  for (const field of unfold) {
+    chunks.push(raw.subarray(copied, field.start), import_node_buffer2.Buffer.from(raw.toString("latin1", field.start, field.end).replaceAll(/\r?\n[ \t]*/g, " "), "latin1"));
+    copied = field.end;
+  }
+  chunks.push(raw.subarray(copied));
+  return import_node_buffer2.Buffer.concat(chunks);
+}
+function upToLine(raw, offset) {
+  return raw.subarray(0, Math.max(raw.lastIndexOf(10, offset - 1) + 1, 0));
+}
+function fewerParts(raw) {
+  let offset = -1;
+  for (let count = 0; count < MAX_PART_LINES; count++) {
+    offset = raw.indexOf("\n--", offset + 1);
+    if (offset === -1) {
+      return upToLine(raw, Math.floor(raw.length / 2));
+    }
+  }
+  return raw.subarray(0, offset + 1);
+}
+function smallerHeader(raw) {
+  const text = raw.toString("latin1");
+  const blank = /\r?\n\r?\n/.exec(text);
+  const end = blank ? blank.index : text.length;
+  const fields = [];
+  let start = 0;
+  while (start < end) {
+    let stop = text.indexOf("\n", start);
+    stop = stop === -1 || stop > end ? end : stop;
+    const last = fields.at(-1);
+    const whole = text.slice(start, stop).replace(/\r$/, "");
+    if (last && (whole.startsWith(" ") || whole.startsWith("	"))) {
+      const line = last.address ? whole : whole.slice(0, MAX_LINE);
+      if (last.address || last.size + line.length <= MAX_FIELD) {
+        last.lines.push(line);
+        last.size += line.length;
+      }
+    } else {
+      const name = whole.slice(0, whole.indexOf(":")).trim().toLowerCase();
+      const address2 = ADDRESS_FIELDS.has(name) || name.startsWith("list-");
+      const line = address2 ? whole : whole.slice(0, MAX_LINE);
+      fields.push({
+        name,
+        address: address2,
+        lines: [line],
+        size: line.length
+      });
+    }
+    start = stop + 1;
+  }
+  let fromCut = false;
+  for (const field of fields.filter((field2) => field2.address)) {
+    const line = field.lines.join("\r\n");
+    const bounded = boundAddressField(line, Number.POSITIVE_INFINITY);
+    fromCut ||= field.name === "from" && bounded !== line;
+    field.lines = [bounded];
+    field.size = bounded.length;
+  }
+  const total = fields.reduce((sum, field) => sum + field.size, 0);
+  const counts = /* @__PURE__ */ new Map();
+  const kept = total > MAX_HEADER ? fields.filter((field) => {
+    counts.set(field.name, (counts.get(field.name) || 0) + 1);
+    const keep = KEPT_FIELDS.has(field.name) && counts.get(field.name) <= MAX_REPEATED;
+    fromCut ||= field.name === "from" && !keep;
+    return keep;
+  }) : fields;
+  const header = kept.flatMap((field) => field.lines).join("\r\n");
+  return { raw: import_node_buffer2.Buffer.concat([import_node_buffer2.Buffer.from(`${header}\r
+\r
+`, "latin1"), raw.subarray(blank ? blank.index + blank[0].length : raw.length)]), fromCut };
+}
+async function parseWithin(raw, parse = parseMessage, deadline = Date.now() + PARSE_TIMEOUT) {
+  let input = raw;
+  let reason = null;
+  let fromCut = false;
+  for (; ; ) {
+    try {
+      const mail = await parse(input, { timeout: Math.max(1, deadline - Date.now()) });
+      if (fromCut && mail.from) {
+        mail.from.truncated = true;
+      }
+      return { mail, error: reason };
+    } catch (error) {
+      const limit = error.code === "EMAXLEN" && [TOO_MANY_PARTS, HEADER_TOO_LARGE].includes(error.message) ? error.message : null;
+      let shorter = input;
+      if (limit === TOO_MANY_PARTS) {
+        shorter = fewerParts(input);
+      } else if (limit === HEADER_TOO_LARGE) {
+        const smaller = smallerHeader(input);
+        shorter = smaller.raw.length < input.length ? smaller.raw : upToLine(input, MAX_PREFIX_BYTES);
+        fromCut ||= smaller.raw === shorter && smaller.fromCut;
+      }
+      if (shorter.length >= input.length) {
+        throw error;
+      }
+      reason ??= limit;
+      input = shorter;
+    }
+  }
+}
+async function expandAttachments(attachments = [], errors = [], parse = parseMessage) {
+  const all = [];
+  const deadline = Date.now() + PARSE_TIMEOUT;
+  let budget = MAX_NESTED_BYTES;
+  let nested = 0;
+  const visit = async (list, prefix, depth) => {
+    for (const attachment of list) {
+      if (prefix) {
+        if (nested >= MAX_ATTACHMENTS) {
+          return;
+        }
+        nested++;
+      }
+      const name = attachment.filename || (prefix ? "unnamed attachment" : "");
+      all.push(prefix ? { ...attachment, filename: `${prefix}/${name}` } : attachment);
+      const { content } = attachment;
+      const attached = attachment.contentType === "message/rfc822" || /\.eml$/i.test(attachment.filename || "");
+      if (attached && depth < MAX_NESTED_DEPTH && import_node_buffer2.Buffer.isBuffer(content) && content.length <= budget) {
+        budget -= content.length;
+        let inner;
+        try {
+          inner = await parseWithin(content, parse, deadline);
+        } catch (error) {
+          errors.push(`${name || "attached message"}: ${error.message}`);
+          continue;
+        }
+        if (inner.error) {
+          errors.push(inner.error);
+        }
+        await visit(inner.mail.attachments, prefix ? `${prefix}/${name}` : name || "attached message", depth + 1);
+      }
+    }
+  };
+  await visit(attachments, "", 0);
+  return all;
+}
+var import_node_buffer2, import_node_crypto, import_node_stream, import_mailparser, ADDRESS_FIELDS, MAX_ADDRESS_FIELD, MAX_ADDRESS_SEPARATORS, MAX_ADDRESS_GROUPS, MAX_ADDRESS_TOTAL, AUTH_ADDRESS_FIELDS, ADDRESS_OPERATORS, SINGLE_FIELDS, PRIORITY_FIELDS, BOUNDED2, ROOM, PARSER_OPTIONS, processHeaders, TOO_MANY_PARTS, HEADER_TOO_LARGE, MAX_PART_LINES, MAX_PREFIX_BYTES, MAX_LINE, MAX_FIELD, MAX_HEADER, MAX_REPEATED, KEPT_FIELDS, MAX_AUTH_WORK, SIGNATURE_FIELDS, AUTH_FIELDS, MAX_SIGNATURES, MAX_DKIM_SIGNATURES, MAX_NESTED_DEPTH, MAX_ATTACHMENTS, MAX_NESTED_BYTES, PARSE_TIMEOUT, MAX_FOLDS;
+var init_parse = __esm({
+  "src/parse.js"() {
+    import_node_buffer2 = require("node:buffer");
+    import_node_crypto = require("node:crypto");
+    import_node_stream = require("node:stream");
+    import_mailparser = require("mailparser");
+    ADDRESS_FIELDS = /* @__PURE__ */ new Set(["from", "to", "cc", "bcc", "sender", "reply-to", "delivered-to", "return-path", "disposition-notification-to"]);
+    MAX_ADDRESS_FIELD = 16 * 1024;
+    MAX_ADDRESS_SEPARATORS = 2e3;
+    MAX_ADDRESS_GROUPS = 16;
+    MAX_ADDRESS_TOTAL = 64 * 1024;
+    AUTH_ADDRESS_FIELDS = /* @__PURE__ */ new Set(["from", "return-path"]);
+    ADDRESS_OPERATORS = /* @__PURE__ */ new Map([['"', '"'], ["(", ")"], ["<", ">"], [",", ""], [":", ";"], [";", ""]]);
+    SINGLE_FIELDS = /* @__PURE__ */ new Set(["message-id", "content-id", "from", "sender", "in-reply-to", "reply-to", "subject", "date", "content-disposition", "content-type", "content-transfer-encoding", "priority", "mime-version", "content-description", "precedence", "errors-to", "disposition-notification-to"]);
+    PRIORITY_FIELDS = /* @__PURE__ */ new Set(["priority", "x-priority", "x-msmail-priority", "importance"]);
+    BOUNDED2 = /* @__PURE__ */ Symbol("bounded address fields");
+    ROOM = /* @__PURE__ */ Symbol("room left for address fields");
+    PARSER_OPTIONS = {
+      skipHtmlToText: true,
+      skipImageLinks: true,
+      skipTextToHtml: true,
+      skipTextLinks: true,
+      [BOUNDED2]: true
+    };
+    ({ processHeaders } = import_mailparser.MailParser.prototype);
+    import_mailparser.MailParser.prototype.processHeaders = function(lines2) {
+      if (!this.options[BOUNDED2]) {
+        return processHeaders.call(this, lines2);
+      }
+      this[ROOM] ??= { room: MAX_ADDRESS_TOTAL };
+      const bounded = boundAddressLines(lines2, this[ROOM]);
+      const headers = processHeaders.call(this, bounded.lines);
+      const keyOf = (entry) => PRIORITY_FIELDS.has(entry.key) ? "priority" : entry.key;
+      const counts = /* @__PURE__ */ new Map();
+      for (const key of bounded.lines.map((entry) => keyOf(entry)).filter((key2) => SINGLE_FIELDS.has(key2))) {
+        counts.set(key, (counts.get(key) || 0) + 1);
+      }
+      for (const key of [...counts.keys()].filter((key2) => counts.get(key2) > 1)) {
+        const last = bounded.lines.findLast((entry) => keyOf(entry) === key && processHeaders.call(this, [entry]).has(key));
+        if (last) {
+          headers.set(key, processHeaders.call(this, [last]).get(key));
+        }
+      }
+      for (const value of [...bounded.cut].flatMap((key) => headers.get(key) ?? [])) {
+        value.truncated = true;
+      }
+      return headers;
+    };
+    TOO_MANY_PARTS = "Max allowed child nodes exceeded";
+    HEADER_TOO_LARGE = "Max header size for a MIME node exceeded";
+    MAX_PART_LINES = 990;
+    MAX_PREFIX_BYTES = 1e6;
+    MAX_LINE = 998;
+    MAX_FIELD = 8192;
+    MAX_HEADER = 512 * 1024;
+    MAX_REPEATED = 100;
+    KEPT_FIELDS = /* @__PURE__ */ new Set([
+      "from",
+      "sender",
+      "reply-to",
+      "to",
+      "cc",
+      "subject",
+      "date",
+      "message-id",
+      "return-path",
+      "received",
+      "authentication-results",
+      "arc-authentication-results",
+      "dkim-signature",
+      "mime-version",
+      "content-type",
+      "content-transfer-encoding",
+      "list-unsubscribe",
+      "list-id"
+    ]);
+    MAX_AUTH_WORK = 1e7;
+    SIGNATURE_FIELDS = /* @__PURE__ */ new Set(["dkim-signature", "arc-message-signature"]);
+    AUTH_FIELDS = /* @__PURE__ */ new Set([...KEPT_FIELDS, "arc-seal", "arc-message-signature"]);
+    MAX_SIGNATURES = 10;
+    MAX_DKIM_SIGNATURES = 8;
+    MAX_NESTED_DEPTH = 3;
+    MAX_ATTACHMENTS = 100;
+    MAX_NESTED_BYTES = 25 * 1024 * 1024;
+    PARSE_TIMEOUT = 6e4;
+    MAX_FOLDS = 256;
+  }
+});
+
 // src/dnsbl.js
 function isLookupName(name) {
   if (typeof name !== "string") {
@@ -4193,7 +4693,7 @@ function requestJson(method, url, body, options = {}) {
   const { headers = {}, timeout = 3e4, maxResponseBytes = 1048576, ca } = options;
   const target = new URL(url);
   const transport = target.protocol === "https:" ? import_node_https.default : import_node_http.default;
-  const payload = body === null || body === void 0 ? null : import_node_buffer2.Buffer.from(JSON.stringify(body));
+  const payload = body === null || body === void 0 ? null : import_node_buffer3.Buffer.from(JSON.stringify(body));
   return new Promise((resolve, reject) => {
     let settled = false;
     const finish = (error, value) => {
@@ -4231,7 +4731,7 @@ function requestJson(method, url, body, options = {}) {
       });
       response.on("error", (error) => finish(error));
       response.on("end", () => {
-        const text = import_node_buffer2.Buffer.concat(chunks).toString("utf8");
+        const text = import_node_buffer3.Buffer.concat(chunks).toString("utf8");
         if (response.statusCode < 200 || response.statusCode >= 300) {
           const error = new Error(`HTTP ${response.statusCode} from ${target.origin}${target.pathname}: ${text.slice(0, 300)}`);
           error.statusCode = response.statusCode;
@@ -4253,10 +4753,10 @@ function requestJson(method, url, body, options = {}) {
     request.end(payload ?? void 0);
   });
 }
-var import_node_buffer2, import_node_http, import_node_https;
+var import_node_buffer3, import_node_http, import_node_https;
 var init_http = __esm({
   "src/http.js"() {
-    import_node_buffer2 = require("node:buffer");
+    import_node_buffer3 = require("node:buffer");
     import_node_http = __toESM(require("node:http"), 1);
     import_node_https = __toESM(require("node:https"), 1);
   }
@@ -4396,7 +4896,7 @@ function trustedReputationValues(mail = {}, session = {}, authentication = null)
     ...[spfAligned].filter((signer) => signer !== null && (alignment?.spf?.strict !== true || signer === domain))
   ])];
   const fromValues = [];
-  for (const { address: address2 } of mail.from?.value || []) {
+  for (const { address: address2 } of mail.from?.truncated ? [] : mail.from?.value || []) {
     const domain = domainOf(address2);
     const values = reputationValues({ from: { value: [{ address: address2 }] } });
     if (domain !== null && dmarcDomain !== null && (domain === dmarcDomain || registrableDomain(domain) === dmarcDomain)) {
@@ -4552,7 +5052,7 @@ var init_reputation = __esm({
 
 // src/auth.js
 async function getMailauth() {
-  globalThis.File ||= import_node_buffer3.File;
+  globalThis.File ||= import_node_buffer4.File;
   mailauth ||= await import("mailauth");
   return mailauth;
 }
@@ -4585,6 +5085,35 @@ function createResolver(timeout = 1e4, servers) {
     }
   };
 }
+function dnsTimeout(message) {
+  const error = new Error(message);
+  error.code = "ETIMEOUT";
+  return error;
+}
+function limitResolver(resolver, { maxQueries = MAX_DNS_QUERIES, deadline = Number.POSITIVE_INFINITY } = {}) {
+  let count = 0;
+  return async (...args) => {
+    count++;
+    if (count > maxQueries) {
+      throw dnsTimeout(`More than ${maxQueries} DNS lookups for one message`);
+    }
+    const left = deadline - Date.now();
+    if (left <= 0) {
+      throw dnsTimeout("Out of time for this message's DNS lookups");
+    }
+    let timer;
+    try {
+      return await Promise.race([
+        resolver(...args),
+        new Promise((_resolve, reject) => {
+          timer = setTimeout(() => reject(dnsTimeout("Out of time for this message's DNS lookups")), Math.min(left, 2147483647));
+        })
+      ]);
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+}
 function emptyResult() {
   return {
     dkim: { status: { result: "none", comment: "not checked" }, results: [], aligned: null },
@@ -4722,9 +5251,14 @@ async function authenticate(message, options = {}) {
   }
   try {
     const { authenticate: run } = await getMailauth();
-    const resolver = options.resolver || createResolver(timeout, options.dnsServers);
-    const raw = import_node_buffer3.Buffer.isBuffer(message) ? message : import_node_buffer3.Buffer.from(String(message));
-    const output = await run(raw, {
+    const resolver = limitResolver(options.resolver || createResolver(timeout, options.dnsServers), {
+      maxQueries: options.maxDnsQueries ?? MAX_DNS_QUERIES,
+      // (a little after `timeout`, so a caller that waits that long for the
+      //  result, as scan() does, has its answer first)
+      deadline: Date.now() + timeout + 100
+    });
+    const bounded = boundedForAuth(import_node_buffer4.Buffer.isBuffer(message) ? message : import_node_buffer4.Buffer.from(String(message)));
+    const output = await run(bounded.raw, {
       ip,
       helo: helo || void 0,
       sender: sender ?? void 0,
@@ -4732,6 +5266,10 @@ async function authenticate(message, options = {}) {
       resolver
     });
     Object.assign(result, normalizeAuthOutput(output, { trustedArcSealers: options.trustedArcSealers }));
+    if (bounded.fromCut) {
+      result.dmarc = { ...result.dmarc, status: { result: "fail", comment: "From field too long to read whole" } };
+      result.headers = "";
+    }
   } catch (error) {
     debug("authentication failed: %s", error.message);
     result.error = error.message;
@@ -4766,11 +5304,24 @@ function calculateAuthScore(auth, weights = {}) {
   }
   return { score: tests.reduce((sum, test) => sum + test.score, 0), tests };
 }
+function limitResults(value) {
+  if (value.length <= MAX_AUTH_RESULTS_LENGTH) {
+    return value;
+  }
+  const [server, ...results] = value.split(/;(?=\s*(?:dkim|spf|dmarc|arc|bimi)=)/i);
+  let kept = server;
+  for (const result of results) {
+    if (kept.length + 1 + result.length <= MAX_AUTH_RESULTS_LENGTH) {
+      kept += `;${result}`;
+    }
+  }
+  return kept;
+}
 function formatAuthResultsHeader(auth, hostname) {
   if (typeof auth?.headers === "string") {
     const match = auth.headers.match(/^authentication-results:[ \t]*([\s\S]*?)(?=\r?\n\S|(?![\s\S]))/im);
     if (match) {
-      const value = match[1].replaceAll(/\r?\n/g, "\r\n").trim();
+      const value = limitResults(match[1].replaceAll(/\r?\n/g, "\r\n").trim());
       return hostname ? value.replace(/^[^;\s]+/, hostname) : value;
     }
   }
@@ -4783,16 +5334,20 @@ function formatAuthResultsHeader(auth, hostname) {
 function summarizeAuth(auth) {
   return ["spf", "dkim", "dmarc", "arc"].map((name) => `${name}=${auth?.[name]?.status?.result || "none"}`).join(" ");
 }
-var import_node_buffer3, import_node_dns2, import_node_util, debug, mailauth, RECORD_TYPES, tagValue, tagText, DEFAULT_AUTH_WEIGHTS;
+var import_node_buffer4, import_node_dns2, import_node_util, debug, mailauth, RECORD_TYPES, MAX_DNS_QUERIES, MAX_AUTH_RESULTS_LENGTH, tagValue, tagText, DEFAULT_AUTH_WEIGHTS;
 var init_auth = __esm({
   "src/auth.js"() {
-    import_node_buffer3 = require("node:buffer");
+    import_node_buffer4 = require("node:buffer");
     import_node_dns2 = __toESM(require("node:dns"), 1);
     import_node_util = require("node:util");
+    init_parse();
     init_reputation();
     init_tokenizer();
+    init_parse();
     debug = (0, import_node_util.debuglog)("spamscanner:auth");
     RECORD_TYPES = /* @__PURE__ */ new Set(["A", "AAAA", "MX", "TXT", "PTR", "CNAME", "NS", "SOA", "SRV"]);
+    MAX_DNS_QUERIES = 300;
+    MAX_AUTH_RESULTS_LENGTH = 8192;
     tagValue = (value) => value && typeof value === "object" ? value.value : value;
     tagText = (value) => typeof value === "string" && value.trim() !== "" ? value.trim().toLowerCase() : null;
     DEFAULT_AUTH_WEIGHTS = {
@@ -4838,10 +5393,10 @@ function exchange(address2, write, timeout) {
         resolve(value);
       }
     };
-    const timer = setTimeout(() => finish(new Error(`clamd did not answer within ${timeout} ms`)), timeout);
+    const timer = setTimeout(() => finish(Object.assign(new Error(`clamd did not answer within ${timeout} ms`), { code: "ETIMEDOUT", timedOut: true })), timeout);
     socket.on("connect", () => write(socket));
     socket.on("data", (chunk2) => chunks.push(chunk2));
-    socket.on("end", () => finish(null, import_node_buffer4.Buffer.concat(chunks).toString("utf8").replaceAll("\0", "").trim()));
+    socket.on("end", () => finish(null, import_node_buffer5.Buffer.concat(chunks).toString("utf8").replaceAll("\0", "").trim()));
     socket.on("error", (error) => finish(error));
   });
 }
@@ -4855,12 +5410,12 @@ async function scanBuffer(buffer, options = {}) {
     socket.write("zINSTREAM\0");
     for (let offset = 0; offset < buffer.length; offset += chunkSize) {
       const chunk2 = buffer.subarray(offset, offset + chunkSize);
-      const size = import_node_buffer4.Buffer.alloc(4);
+      const size = import_node_buffer5.Buffer.alloc(4);
       size.writeUInt32BE(chunk2.length);
       socket.write(size);
       socket.write(chunk2);
     }
-    socket.end(import_node_buffer4.Buffer.alloc(4));
+    socket.end(import_node_buffer5.Buffer.alloc(4));
   }, options.timeout ?? 3e4);
   if (/\bOK$/.test(reply2)) {
     return { infected: false, viruses: [], reply: reply2 };
@@ -4871,10 +5426,10 @@ async function scanBuffer(buffer, options = {}) {
   }
   throw new Error(`clamd: ${reply2 || "no reply"}`);
 }
-var import_node_buffer4, import_node_fs, import_node_net3, SOCKET_PATHS;
+var import_node_buffer5, import_node_fs, import_node_net3, SOCKET_PATHS;
 var init_clamav = __esm({
   "src/clamav.js"() {
-    import_node_buffer4 = require("node:buffer");
+    import_node_buffer5 = require("node:buffer");
     import_node_fs = require("node:fs");
     import_node_net3 = __toESM(require("node:net"), 1);
     SOCKET_PATHS = ["/var/run/clamav/clamd.ctl", "/run/clamav/clamd.ctl", "/run/clamd.scan/clamd.sock", "/var/run/clamd.scan/clamd.sock", "/var/run/clamav/clamd.sock", "/tmp/clamd.socket", "/opt/homebrew/var/run/clamav/clamd.sock", "/usr/local/var/run/clamav/clamd.sock"];
@@ -4884,7 +5439,7 @@ var init_clamav = __esm({
 // src/classifier.js
 function hashFeature(value) {
   let hash = 2166136261;
-  const bytes = import_node_buffer5.Buffer.from(value, "utf8");
+  const bytes = import_node_buffer6.Buffer.from(value, "utf8");
   for (const byte of bytes) {
     hash ^= byte;
     hash = Math.imul(hash, 16777619);
@@ -4920,10 +5475,10 @@ function modelOptions(options, corrupt) {
   }
   return checked;
 }
-var import_node_buffer5, MODEL_VERSION, DEFAULTS, OPTION_CHECKS, NULL_MEANS, isWord, IDENTITY, Classifier;
+var import_node_buffer6, MODEL_VERSION, DEFAULTS, OPTION_CHECKS, NULL_MEANS, isWord, IDENTITY, Classifier;
 var init_classifier = __esm({
   "src/classifier.js"() {
-    import_node_buffer5 = require("node:buffer");
+    import_node_buffer6 = require("node:buffer");
     MODEL_VERSION = 2;
     DEFAULTS = {
       // Robinson's s and x: how much an unseen or rare feature is pulled to 0.5.
@@ -5215,7 +5770,7 @@ var init_classifier = __esm({
           spam[i] = s;
           ham[i] = h;
         }
-        const encode = (array) => import_node_buffer5.Buffer.from(array.buffer, array.byteOffset, array.byteLength).toString("base64");
+        const encode = (array) => import_node_buffer6.Buffer.from(array.buffer, array.byteOffset, array.byteLength).toString("base64");
         return {
           type: "spamscanner-classifier",
           version: MODEL_VERSION,
@@ -5266,7 +5821,7 @@ var init_classifier = __esm({
           throw new TypeError(`Unsupported classifier model version ${data2.version}; this release reads version ${MODEL_VERSION}`);
         }
         const decode = (value, name) => {
-          const buffer = typeof value === "string" ? import_node_buffer5.Buffer.from(value, "base64") : null;
+          const buffer = typeof value === "string" ? import_node_buffer6.Buffer.from(value, "base64") : null;
           if (!buffer || buffer.byteLength % 4 !== 0) {
             throw corrupt(`${name} is not a list of 32-bit numbers`);
           }
@@ -5757,7 +6312,7 @@ function authHeaders(config) {
     case "basic": {
       const user = config.username ?? "";
       const pass = config.password ?? config.apiKey ?? "";
-      headers.authorization = `Basic ${import_node_buffer6.Buffer.from(`${user}:${pass}`).toString("base64")}`;
+      headers.authorization = `Basic ${import_node_buffer7.Buffer.from(`${user}:${pass}`).toString("base64")}`;
       break;
     }
     case "x-api-key": {
@@ -6108,7 +6663,7 @@ function endpoint(config, suffix) {
   return url.href;
 }
 function buildRequest(config, text) {
-  const nonce = (0, import_node_crypto.randomBytes)(6).toString("hex");
+  const nonce = (0, import_node_crypto2.randomBytes)(6).toString("hex");
   const policy = config.policy ? `
 
 Additional policy from the mail server's operator:
@@ -6204,11 +6759,11 @@ function replyText(api, reply2) {
   }
   return reply2?.choices?.[0]?.message?.content || null;
 }
-var import_node_buffer6, import_node_crypto, import_node_os, import_node_process, PROVIDERS, DECISION_APIS, TOP_LOGPROBS, VERDICTS, VERDICT_CRITERIA, SIGNS, GUIDE, DEFAULT_SYSTEM_PROMPT, DECISION_SYSTEM_PROMPT, DECISION_INSTRUCTIONS, LOCALHOST, PRIVATE_HOST, REDACTIONS, THINK_OPEN, THINK_CLOSE, ANSWER_FIRST, LOCAL_CHARACTER, BREAKS2, VERDICT_WORD2, NOT, DENIED, JOINED, SPAM_LABEL, HAM_WORDS, HAM_LABEL, NOT_HAM_LABEL, UNWANTED, MIN_VERDICT_MASS, percent, MODES, LLMClassifier;
+var import_node_buffer7, import_node_crypto2, import_node_os, import_node_process, PROVIDERS, DECISION_APIS, TOP_LOGPROBS, VERDICTS, VERDICT_CRITERIA, SIGNS, GUIDE, DEFAULT_SYSTEM_PROMPT, DECISION_SYSTEM_PROMPT, DECISION_INSTRUCTIONS, LOCALHOST, PRIVATE_HOST, REDACTIONS, THINK_OPEN, THINK_CLOSE, ANSWER_FIRST, LOCAL_CHARACTER, BREAKS2, VERDICT_WORD2, NOT, DENIED, JOINED, SPAM_LABEL, HAM_WORDS, HAM_LABEL, NOT_HAM_LABEL, UNWANTED, MIN_VERDICT_MASS, percent, MODES, LLMClassifier;
 var init_llm = __esm({
   "src/llm.js"() {
-    import_node_buffer6 = require("node:buffer");
-    import_node_crypto = require("node:crypto");
+    import_node_buffer7 = require("node:buffer");
+    import_node_crypto2 = require("node:crypto");
     import_node_os = __toESM(require("node:os"), 1);
     import_node_process = __toESM(require("node:process"), 1);
     init_http();
@@ -6576,7 +7131,7 @@ Answer with exactly one word: ham, spam, phishing, scam or malware.`;
        * @returns {Promise<{verdict: string, confidence: number, language: string|null, reasons: string[], provider: string, model: string, cached: boolean, time: number}>}
        */
       async classifyText(text) {
-        const key = (0, import_node_crypto.createHash)("sha256").update(text).digest("hex");
+        const key = (0, import_node_crypto2.createHash)("sha256").update(text).digest("hex");
         if (this.cache.has(key)) {
           const hit = this.cache.get(key);
           this.cache.delete(key);
@@ -6700,10 +7255,20 @@ function loadModel(file, options = {}) {
 function saveModel(classifier, file, options = {}) {
   const resolved = import_node_path.default.resolve(file);
   (0, import_node_fs2.mkdirSync)(import_node_path.default.dirname(resolved), { recursive: true });
-  const temporary = `${resolved}.${import_node_process2.default.pid}.${(0, import_node_crypto2.randomBytes)(6).toString("hex")}.tmp`;
+  const temporary = `${resolved}.${import_node_process2.default.pid}.${(0, import_node_crypto3.randomBytes)(6).toString("hex")}.tmp`;
+  const mode = (0, import_node_fs2.statSync)(resolved, { throwIfNoEntry: false })?.mode;
+  const fd = (0, import_node_fs2.openSync)(temporary, "wx");
   try {
-    (0, import_node_fs2.writeFileSync)(temporary, `${JSON.stringify(classifier.toJSON(options))}
+    try {
+      if (mode !== void 0) {
+        (0, import_node_fs2.fchmodSync)(fd, mode % 512);
+      }
+      (0, import_node_fs2.writeFileSync)(fd, `${JSON.stringify(classifier.toJSON(options))}
 `);
+      (0, import_node_fs2.fsyncSync)(fd);
+    } finally {
+      (0, import_node_fs2.closeSync)(fd);
+    }
     (0, import_node_fs2.renameSync)(temporary, resolved);
   } catch (error) {
     (0, import_node_fs2.rmSync)(temporary, { force: true });
@@ -6711,11 +7276,11 @@ function saveModel(classifier, file, options = {}) {
   }
   loaded.delete(resolved);
 }
-var import_node_fs2, import_node_crypto2, import_node_module2, import_node_path, import_node_process2, import_node_url3, loaded;
+var import_node_fs2, import_node_crypto3, import_node_module2, import_node_path, import_node_process2, import_node_url3, loaded;
 var init_model = __esm({
   "src/model.js"() {
     import_node_fs2 = require("node:fs");
-    import_node_crypto2 = require("node:crypto");
+    import_node_crypto3 = require("node:crypto");
     import_node_module2 = require("node:module");
     import_node_path = __toESM(require("node:path"), 1);
     import_node_process2 = __toESM(require("node:process"), 1);
@@ -6725,180 +7290,6 @@ var init_model = __esm({
   }
 });
 
-// src/parse.js
-async function parseMessage(raw) {
-  const buffer = import_node_buffer7.Buffer.isBuffer(raw) ? raw : import_node_buffer7.Buffer.from(raw);
-  const mail = await (0, import_mailparser.simpleParser)(finishable(buffer), PARSER_OPTIONS);
-  const added = buffer.at(-1) === 10 ? 2 : 3;
-  for (const key of ["text", "html"]) {
-    if (typeof mail[key] === "string") {
-      mail[key] = mail[key].replace(new RegExp(`\\n{0,${added}}$`), "");
-    }
-  }
-  const tail = import_node_buffer7.Buffer.from("\r\n".repeat(added));
-  const last = mail.attachments?.at(-1);
-  const encoding = String(last?.headers?.get?.("content-transfer-encoding") ?? "7bit").trim().toLowerCase();
-  const own3 = import_node_buffer7.Buffer.isBuffer(last?.content) && last.content.length >= tail.length && last.content.subarray(-tail.length).equals(tail) ? last.content.subarray(0, -tail.length) : null;
-  if (own3 && ["7bit", "8bit", "binary"].includes(encoding) && own3.length <= buffer.length && buffer.subarray(buffer.length - own3.length).equals(own3)) {
-    last.content = own3;
-    last.size = own3.length;
-    last.checksum = (0, import_node_crypto3.createHash)("md5").update(own3).digest("hex");
-  }
-  return mail;
-}
-function finishable(raw) {
-  const buffer = import_node_buffer7.Buffer.isBuffer(raw) ? raw : import_node_buffer7.Buffer.from(raw);
-  return import_node_buffer7.Buffer.concat([buffer, import_node_buffer7.Buffer.from(buffer.at(-1) === 10 ? "\r\n\r\n" : "\r\n\r\n\r\n")]);
-}
-function upToLine(raw, offset) {
-  return raw.subarray(0, Math.max(raw.lastIndexOf(10, offset - 1) + 1, 0));
-}
-function fewerParts(raw) {
-  let offset = -1;
-  for (let count = 0; count < MAX_PART_LINES; count++) {
-    offset = raw.indexOf("\n--", offset + 1);
-    if (offset === -1) {
-      return upToLine(raw, Math.floor(raw.length / 2));
-    }
-  }
-  return raw.subarray(0, offset + 1);
-}
-function smallerHeader(raw) {
-  const text = raw.toString("latin1");
-  const blank = /\r?\n\r?\n/.exec(text);
-  const end = blank ? blank.index : text.length;
-  const fields = [];
-  let start = 0;
-  while (start < end) {
-    let stop = text.indexOf("\n", start);
-    stop = stop === -1 || stop > end ? end : stop;
-    const line = text.slice(start, Math.min(stop, start + MAX_LINE)).replace(/\r$/, "");
-    const last = fields.at(-1);
-    if (last && (line.startsWith(" ") || line.startsWith("	"))) {
-      if (last.size + line.length <= MAX_FIELD) {
-        last.lines.push(line);
-        last.size += line.length;
-      }
-    } else {
-      fields.push({ name: line.slice(0, line.indexOf(":")).trim().toLowerCase(), lines: [line], size: line.length });
-    }
-    start = stop + 1;
-  }
-  const total = fields.reduce((sum, field) => sum + field.size, 0);
-  const counts = /* @__PURE__ */ new Map();
-  const kept = total > MAX_HEADER ? fields.filter((field) => {
-    counts.set(field.name, (counts.get(field.name) || 0) + 1);
-    return KEPT_FIELDS.has(field.name) && counts.get(field.name) <= MAX_REPEATED;
-  }) : fields;
-  const header = kept.flatMap((field) => field.lines).join("\r\n");
-  return import_node_buffer7.Buffer.concat([import_node_buffer7.Buffer.from(`${header}\r
-\r
-`, "latin1"), raw.subarray(blank ? blank.index + blank[0].length : raw.length)]);
-}
-async function parseWithin(raw, parse = parseMessage) {
-  let input = raw;
-  let reason = null;
-  for (; ; ) {
-    try {
-      return { mail: await parse(input), error: reason };
-    } catch (error) {
-      const limit = error.code === "EMAXLEN" && [TOO_MANY_PARTS, HEADER_TOO_LARGE].includes(error.message) ? error.message : null;
-      let shorter = input;
-      if (limit === TOO_MANY_PARTS) {
-        shorter = fewerParts(input);
-      } else if (limit === HEADER_TOO_LARGE) {
-        shorter = smallerHeader(input);
-        shorter = shorter.length < input.length ? shorter : upToLine(input, MAX_PREFIX_BYTES);
-      }
-      if (shorter.length >= input.length) {
-        throw error;
-      }
-      reason ??= limit;
-      input = shorter;
-    }
-  }
-}
-async function expandAttachments(attachments = [], errors = [], parse = parseMessage) {
-  const all = [];
-  let budget = MAX_NESTED_BYTES;
-  let nested = 0;
-  const visit = async (list, prefix, depth) => {
-    for (const attachment of list) {
-      if (prefix) {
-        if (nested >= MAX_ATTACHMENTS) {
-          return;
-        }
-        nested++;
-      }
-      const name = attachment.filename || (prefix ? "unnamed attachment" : "");
-      all.push(prefix ? { ...attachment, filename: `${prefix}/${name}` } : attachment);
-      const { content } = attachment;
-      const attached = attachment.contentType === "message/rfc822" || /\.eml$/i.test(attachment.filename || "");
-      if (attached && depth < MAX_NESTED_DEPTH && import_node_buffer7.Buffer.isBuffer(content) && content.length <= budget) {
-        budget -= content.length;
-        let inner;
-        try {
-          inner = await parseWithin(content, parse);
-        } catch (error) {
-          errors.push(`${name || "attached message"}: ${error.message}`);
-          continue;
-        }
-        if (inner.error) {
-          errors.push(inner.error);
-        }
-        await visit(inner.mail.attachments, prefix ? `${prefix}/${name}` : name || "attached message", depth + 1);
-      }
-    }
-  };
-  await visit(attachments, "", 0);
-  return all;
-}
-var import_node_buffer7, import_node_crypto3, import_mailparser, PARSER_OPTIONS, TOO_MANY_PARTS, HEADER_TOO_LARGE, MAX_PART_LINES, MAX_PREFIX_BYTES, MAX_LINE, MAX_FIELD, MAX_HEADER, MAX_REPEATED, KEPT_FIELDS, MAX_NESTED_DEPTH, MAX_ATTACHMENTS, MAX_NESTED_BYTES;
-var init_parse = __esm({
-  "src/parse.js"() {
-    import_node_buffer7 = require("node:buffer");
-    import_node_crypto3 = require("node:crypto");
-    import_mailparser = require("mailparser");
-    PARSER_OPTIONS = {
-      skipHtmlToText: true,
-      skipImageLinks: true,
-      skipTextToHtml: true,
-      skipTextLinks: true
-    };
-    TOO_MANY_PARTS = "Max allowed child nodes exceeded";
-    HEADER_TOO_LARGE = "Max header size for a MIME node exceeded";
-    MAX_PART_LINES = 990;
-    MAX_PREFIX_BYTES = 1e6;
-    MAX_LINE = 998;
-    MAX_FIELD = 8192;
-    MAX_HEADER = 512 * 1024;
-    MAX_REPEATED = 100;
-    KEPT_FIELDS = /* @__PURE__ */ new Set([
-      "from",
-      "sender",
-      "reply-to",
-      "to",
-      "cc",
-      "subject",
-      "date",
-      "message-id",
-      "return-path",
-      "received",
-      "authentication-results",
-      "arc-authentication-results",
-      "dkim-signature",
-      "mime-version",
-      "content-type",
-      "content-transfer-encoding",
-      "list-unsubscribe",
-      "list-id"
-    ]);
-    MAX_NESTED_DEPTH = 3;
-    MAX_ATTACHMENTS = 100;
-    MAX_NESTED_BYTES = 25 * 1024 * 1024;
-  }
-});
-
 // src/score.js
 function bayesTestName(probability) {
   const steps = [[0.999, "999"], [0.99, "99"], [0.95, "95"], [0.8, "80"], [0.6, "60"], [0.4, "50"], [0.2, "40"], [0.05, "20"], [0.01, "05"]];
@@ -7123,7 +7514,7 @@ var init_package = __esm({
     package_default = {
       name: "spamscanner",
       description: "Spam, phishing and malware filter for email in any language: a trainable classifier, link and attachment checks, SPF/DKIM/DMARC, and an optional AI second opinion from any LLM, including local Ollama models. Works as a library, CLI, Postfix milter or HTTP API.",
-      version: "7.0.4",
+      version: "7.0.5",
       author: "Forward Email (https://forwardemail.net)",
       bin: {
         spamscanner: "./dist/esm/cli.js"
@@ -7751,13 +8142,207 @@ var init_train = __esm({
   }
 });
 
+// src/server.js
+function serializeResult(result, options = {}) {
+  const { mail, tokens, ...rest } = result;
+  const output = {
+    ...rest,
+    results: { ...result.results }
+  };
+  if (output.results.authentication) {
+    const { receivedChain, ...auth } = output.results.authentication;
+    output.results.authentication = auth;
+  }
+  if (options.verbose) {
+    output.tokens = tokens;
+    output.subject = mail?.subject ?? null;
+  }
+  return output;
+}
+function sessionFromQuery(query) {
+  const session = {};
+  if (query.get("ip")) {
+    session.remoteAddress = query.get("ip");
+  }
+  if (query.get("hostname")) {
+    session.resolvedClientHostname = query.get("hostname");
+  }
+  if (query.get("helo")) {
+    session.helo = query.get("helo");
+  }
+  const recipients = query.getAll("to").flatMap((value) => value.split(",")).map((value) => value.trim()).filter(Boolean);
+  if (query.has("from") || recipients.length > 0) {
+    session.envelope = { mailFrom: { address: query.get("from") || "" }, rcptTo: recipients.map((address2) => ({ address: address2 })) };
+  }
+  return session;
+}
+function sameToken(given, expected) {
+  const a = import_node_buffer10.Buffer.from(String(given));
+  const b = import_node_buffer10.Buffer.from(String(expected));
+  return a.length === b.length && (0, import_node_crypto5.timingSafeEqual)(a, b);
+}
+function readBody(request, limit) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    request.on("data", (chunk2) => {
+      size += chunk2.length;
+      if (size <= limit) {
+        chunks.push(chunk2);
+      }
+    });
+    request.on("end", () => {
+      if (size > limit) {
+        const error = new Error(`Message larger than ${limit} bytes`);
+        error.statusCode = 413;
+        reject(error);
+        return;
+      }
+      resolve(import_node_buffer10.Buffer.concat(chunks));
+    });
+    request.on("error", reject);
+  });
+}
+function createHttpServer(scanner, options = {}) {
+  const {
+    token = null,
+    maxSize = MAX_MESSAGE_SIZE,
+    modelPath = null,
+    maxConnections = MAX_CONNECTIONS
+  } = options;
+  let active = 0;
+  const server = import_node_http2.default.createServer(async (request, response) => {
+    const send = (status, body, headers = {}) => {
+      const isBuffer = import_node_buffer10.Buffer.isBuffer(body);
+      response.writeHead(status, { "content-type": isBuffer ? "message/rfc822" : "application/json; charset=utf-8", "cache-control": "no-store", ...headers });
+      response.end(isBuffer ? body : `${JSON.stringify(body)}
+`);
+    };
+    try {
+      const url = new URL(request.url, "http://localhost");
+      if (request.method === "GET" && url.pathname === "/health") {
+        send(200, { ok: true, version: VERSION });
+        return;
+      }
+      if (token && !sameToken((request.headers.authorization || "").replace(/^bearer\s+/i, ""), token)) {
+        send(401, { error: "Unauthorized" }, { "www-authenticate": "Bearer" });
+        return;
+      }
+      if (request.method !== "POST") {
+        send(405, { error: "Method not allowed" }, { allow: "POST" });
+        return;
+      }
+      const learn = /^\/learn\/(spam|ham)$/.exec(url.pathname);
+      if (!["/scan", "/check"].includes(url.pathname) && !learn) {
+        send(404, { error: "Not found" });
+        return;
+      }
+      if (learn && !token) {
+        send(403, { error: "Learning needs the server to be started with a token" });
+        return;
+      }
+      const length = request.headers["content-length"];
+      if (length !== void 0 && Number(length) > maxSize) {
+        send(413, { error: `Message larger than ${maxSize} bytes` }, { connection: "close" });
+        return;
+      }
+      if (active >= maxConnections) {
+        send(503, { error: "Too many requests at once" }, { connection: "close", "retry-after": "1" });
+        return;
+      }
+      active++;
+      try {
+        const raw = await readBody(request, maxSize);
+        if (learn) {
+          await scanner.learn(raw, learn[1]);
+          if (modelPath) {
+            scanner.saveModel(modelPath);
+          }
+          send(200, { ok: true, learned: learn[1] });
+          return;
+        }
+        const result = await scanner.scan(raw, { session: sessionFromQuery(url.searchParams) });
+        if (url.pathname === "/scan") {
+          send(200, serializeResult(result, { verbose: url.searchParams.get("verbose") === "1" }));
+          return;
+        }
+        const tag = url.searchParams.get("subjectTag");
+        const rewritten = rewriteMessage(raw, spamHeaders(result, { version: VERSION }), { subjectTag: result.isSpam && tag ? tag : null });
+        send(200, rewritten, { "x-spam-flag": result.isSpam ? "YES" : "NO", "x-spam-score": result.score.toFixed(1), "x-spam-action": result.action });
+      } finally {
+        active--;
+      }
+    } catch (error) {
+      send(error.statusCode || 500, { error: error.message });
+    }
+  });
+  server.maxConnections = maxConnections;
+  return server;
+}
+function createTcpServer(scanner, options = {}) {
+  const {
+    json = true,
+    maxSize = MAX_MESSAGE_SIZE,
+    timeout = 6e4,
+    maxConnections = MAX_CONNECTIONS
+  } = options;
+  const server = import_node_net4.default.createServer({ allowHalfOpen: true }, (socket) => {
+    const chunks = [];
+    let size = 0;
+    socket.setTimeout(timeout, () => socket.destroy());
+    const onEnd = async () => {
+      socket.setTimeout(0);
+      try {
+        const result = await scanner.scan(import_node_buffer10.Buffer.concat(chunks));
+        socket.end(json ? `${JSON.stringify(serializeResult(result))}
+` : `${result.isSpam ? "SPAM" : "HAM"} ${result.score.toFixed(1)}/${result.threshold.toFixed(1)} ${result.tests.map((test) => test.name).join(",")}
+`);
+      } catch (error) {
+        socket.end(json ? `${JSON.stringify({ error: error.message })}
+` : `ERROR ${error.message}
+`);
+      }
+    };
+    const onData = (chunk2) => {
+      size += chunk2.length;
+      if (size > maxSize) {
+        socket.off("data", onData);
+        socket.off("end", onEnd);
+        socket.end(`${JSON.stringify({ error: `Message larger than ${maxSize} bytes` })}
+`, () => socket.destroy());
+        return;
+      }
+      chunks.push(chunk2);
+    };
+    socket.on("data", onData);
+    socket.on("end", onEnd);
+    socket.on("error", () => {
+    });
+  });
+  server.maxConnections = maxConnections;
+  return server;
+}
+var import_node_buffer10, import_node_crypto5, import_node_http2, import_node_net4, MAX_MESSAGE_SIZE, MAX_CONNECTIONS;
+var init_server = __esm({
+  "src/server.js"() {
+    import_node_buffer10 = require("node:buffer");
+    import_node_crypto5 = require("node:crypto");
+    import_node_http2 = __toESM(require("node:http"), 1);
+    import_node_net4 = __toESM(require("node:net"), 1);
+    init_headers();
+    init_version();
+    MAX_MESSAGE_SIZE = 25 * 1024 * 1024;
+    MAX_CONNECTIONS = 200;
+  }
+});
+
 // src/milter.js
-function packet(command, data2 = import_node_buffer10.Buffer.alloc(0)) {
-  const payload = import_node_buffer10.Buffer.isBuffer(data2) ? data2 : import_node_buffer10.Buffer.from(data2, "latin1");
-  const header = import_node_buffer10.Buffer.alloc(5);
+function packet(command, data2 = import_node_buffer11.Buffer.alloc(0)) {
+  const payload = import_node_buffer11.Buffer.isBuffer(data2) ? data2 : import_node_buffer11.Buffer.from(data2, "latin1");
+  const header = import_node_buffer11.Buffer.alloc(5);
   header.writeUInt32BE(payload.length + 1);
   header.write(command, 4, "latin1");
-  return import_node_buffer10.Buffer.concat([header, payload]);
+  return import_node_buffer11.Buffer.concat([header, payload]);
 }
 function cstrings(data2) {
   const parts = data2.toString("latin1").split("\0");
@@ -7767,21 +8352,22 @@ function cstrings(data2) {
   return parts;
 }
 function cstring(value) {
-  return import_node_buffer10.Buffer.from(`${value}\0`, "latin1");
+  return import_node_buffer11.Buffer.from(`${value}\0`, "latin1");
 }
 function address(value) {
   const text = String(value ?? "").trim();
   const match = /^<?([^<>]*)>?$/.exec(text);
   return match ? match[1] : text;
 }
-var import_node_buffer10, import_node_events, import_node_net4, COMMANDS, RESPONSES, ACTIONS, PROTOCOL, MAX_PACKET, MilterSession, MilterServer;
+var import_node_buffer11, import_node_events, import_node_net5, COMMANDS, RESPONSES, ACTIONS, PROTOCOL, MAX_PACKET, MilterSession, MilterServer;
 var init_milter = __esm({
   "src/milter.js"() {
-    import_node_buffer10 = require("node:buffer");
+    import_node_buffer11 = require("node:buffer");
     import_node_events = require("node:events");
-    import_node_net4 = __toESM(require("node:net"), 1);
+    import_node_net5 = __toESM(require("node:net"), 1);
     init_headers();
     init_auth();
+    init_server();
     init_version();
     COMMANDS = {
       ABORT: "A",
@@ -7875,6 +8461,15 @@ var init_milter = __esm({
         this.body = [];
         this.size = 0;
         this.truncated = false;
+        this.headerSize = 0;
+      }
+      // The envelope and headers are kept whole for the scan, so beyond the
+      // message size limit the message is not scanned (see onError).
+      keep(data2) {
+        this.headerSize += data2.length;
+        if (this.headerSize > this.server.options.maxSize) {
+          throw new Error(`Message headers larger than ${this.server.options.maxSize} bytes`);
+        }
       }
       send(command, data2) {
         if (!this.socket.destroyed) {
@@ -7887,7 +8482,7 @@ var init_milter = __esm({
         if (this.buffered < this.needed) {
           return;
         }
-        let buffer = this.chunks.length === 1 ? this.chunks[0] : import_node_buffer10.Buffer.concat(this.chunks);
+        let buffer = this.chunks.length === 1 ? this.chunks[0] : import_node_buffer11.Buffer.concat(this.chunks);
         this.needed = 4;
         while (buffer.length >= 4) {
           const length = buffer.readUInt32BE(0);
@@ -7932,7 +8527,7 @@ var init_milter = __esm({
             const protocol = data2.readUInt32BE(8);
             const wanted = ACTIONS.ADDHDRS | ACTIONS.CHGHDRS | ACTIONS.QUARANTINE;
             this.leadingSpace = Boolean(protocol & PROTOCOL.HDR_LEADSPC);
-            const reply2 = import_node_buffer10.Buffer.alloc(12);
+            const reply2 = import_node_buffer11.Buffer.alloc(12);
             reply2.writeUInt32BE(Math.min(version, 6), 0);
             reply2.writeUInt32BE(actions & wanted, 4);
             reply2.writeUInt32BE(protocol & (PROTOCOL.HDR_LEADSPC | PROTOCOL.NOUNKNOWN), 8);
@@ -7975,16 +8570,19 @@ var init_milter = __esm({
           }
           case COMMANDS.MAIL: {
             this.resetMessage();
+            this.keep(data2);
             this.envelope.mailFrom = { address: address(cstrings(data2)[0]) };
             this.send(RESPONSES.CONTINUE);
             break;
           }
           case COMMANDS.RCPT: {
+            this.keep(data2);
             this.envelope.rcptTo.push({ address: address(cstrings(data2)[0]) });
             this.send(RESPONSES.CONTINUE);
             break;
           }
           case COMMANDS.HEADER: {
+            this.keep(data2);
             const [name, value = ""] = cstrings(data2);
             this.headers.push([name, value]);
             this.send(RESPONSES.CONTINUE);
@@ -7994,14 +8592,19 @@ var init_milter = __esm({
             if (this.truncated || this.size + data2.length > options.maxSize) {
               this.truncated = true;
             } else {
-              this.body.push(import_node_buffer10.Buffer.from(data2));
+              this.body.push(import_node_buffer11.Buffer.from(data2));
               this.size += data2.length;
             }
             this.send(RESPONSES.CONTINUE);
             break;
           }
           case COMMANDS.BODYEOB: {
-            await this.endOfMessage();
+            this.socket.pause();
+            try {
+              await this.endOfMessage();
+            } finally {
+              this.socket.resume();
+            }
             break;
           }
           case COMMANDS.ABORT: {
@@ -8024,7 +8627,7 @@ var init_milter = __esm({
       /** @returns {Buffer} */
       rawMessage() {
         const head = this.headers.map(([name, value]) => `${name}:${this.leadingSpace || value.startsWith(" ") || value.startsWith("	") ? "" : " "}${value}`).join("\r\n");
-        return import_node_buffer10.Buffer.concat([import_node_buffer10.Buffer.from(this.headers.length > 0 ? `${head}\r
+        return import_node_buffer11.Buffer.concat([import_node_buffer11.Buffer.from(this.headers.length > 0 ? `${head}\r
 \r
 ` : "\r\n", "latin1"), ...this.body]);
       }
@@ -8035,9 +8638,9 @@ var init_milter = __esm({
           const key = name.toLowerCase();
           counts.set(key, (counts.get(key) || 0) + 1);
           if (key.startsWith("x-spam-")) {
-            const index = import_node_buffer10.Buffer.alloc(4);
+            const index = import_node_buffer11.Buffer.alloc(4);
             index.writeUInt32BE(counts.get(key));
-            this.send(RESPONSES.CHGHEADER, import_node_buffer10.Buffer.concat([index, cstring(name), cstring("")]));
+            this.send(RESPONSES.CHGHEADER, import_node_buffer11.Buffer.concat([index, cstring(name), cstring("")]));
           }
         }
       }
@@ -8060,7 +8663,7 @@ var init_milter = __esm({
           }
           this.server.report(error);
           this.removeForgedHeaders();
-          this.send(RESPONSES.ADDHEADER, import_node_buffer10.Buffer.concat([cstring("X-Spam-Virus-Scan"), cstring(`${this.leadingSpace ? " " : ""}failed`)]));
+          this.send(RESPONSES.ADDHEADER, import_node_buffer11.Buffer.concat([cstring("X-Spam-Virus-Scan"), cstring(`${this.leadingSpace ? " " : ""}failed`)]));
           this.send(RESPONSES.CONTINUE);
           this.resetMessage();
           return;
@@ -8081,15 +8684,15 @@ var init_milter = __esm({
           headers.unshift(["Authentication-Results", formatAuthResultsHeader(result.results.authentication, options.hostname)]);
         }
         for (const [name, value] of headers) {
-          this.send(RESPONSES.ADDHEADER, import_node_buffer10.Buffer.concat([cstring(name), cstring(`${this.leadingSpace ? " " : ""}${value}`.replaceAll("\r\n", "\n"))]));
+          this.send(RESPONSES.ADDHEADER, import_node_buffer11.Buffer.concat([cstring(name), cstring(`${this.leadingSpace ? " " : ""}${value}`.replaceAll("\r\n", "\n"))]));
         }
         if (result.isSpam && options.subjectTag) {
           const subject = this.headers.find(([name]) => name.toLowerCase() === "subject");
           const value = taggedSubject(options.subjectTag, subject ? subject[1].trim() : "", "\n");
           if (value !== null) {
-            const index = import_node_buffer10.Buffer.alloc(4);
+            const index = import_node_buffer11.Buffer.alloc(4);
             index.writeUInt32BE(1);
-            this.send(RESPONSES.CHGHEADER, import_node_buffer10.Buffer.concat([index, cstring("Subject"), cstring(`${this.leadingSpace ? " " : ""}${value}`.replaceAll("\r\n", "\n"))]));
+            this.send(RESPONSES.CHGHEADER, import_node_buffer11.Buffer.concat([index, cstring("Subject"), cstring(`${this.leadingSpace ? " " : ""}${value}`.replaceAll("\r\n", "\n"))]));
           }
         }
         if (result.action === "reject" && options.reject) {
@@ -8116,8 +8719,10 @@ var init_milter = __esm({
        * @param {boolean} [options.quarantine] - hold spam in the MTA's quarantine
        * @param {string|null} [options.subjectTag] - e.g. "[SPAM]"
        * @param {string} [options.hostname] - this server's name, for Authentication-Results
-       * @param {number} [options.maxSize] - body bytes kept for scanning
+       * @param {number} [options.maxSize] - body bytes kept for scanning (and the
+       *   most bytes of envelope and headers: beyond them a message is not scanned)
        * @param {'tempfail'|'accept'} [options.onError] - answer when a scan fails
+       * @param {number} [options.maxConnections] - connections kept open at once; more are closed at once
        */
       constructor(scanner, options = {}) {
         super();
@@ -8129,19 +8734,21 @@ var init_milter = __esm({
           quarantine: false,
           subjectTag: null,
           hostname: "spamscanner",
-          maxSize: 25 * 1024 * 1024,
+          maxSize: MAX_MESSAGE_SIZE,
           onError: "tempfail",
+          maxConnections: MAX_CONNECTIONS,
           ...options
         };
         if (!/^[45]\d\d$/.test(String(this.options.rejectCode))) {
           throw new RangeError(`rejectCode must be a 4xx or 5xx SMTP code, not ${this.options.rejectCode}`);
         }
         this.sockets = /* @__PURE__ */ new Set();
-        this.server = import_node_net4.default.createServer((socket) => {
+        this.server = import_node_net5.default.createServer((socket) => {
           this.sockets.add(socket);
           socket.on("close", () => this.sockets.delete(socket));
           return new MilterSession(socket, this);
         });
+        this.server.maxConnections = this.options.maxConnections;
         this.server.on("error", (error) => this.report(error));
       }
       // Errors go to "error" listeners; with none, a broken connection or failed
@@ -8189,169 +8796,6 @@ var init_milter = __esm({
   }
 });
 
-// src/server.js
-function serializeResult(result, options = {}) {
-  const { mail, tokens, ...rest } = result;
-  const output = {
-    ...rest,
-    results: { ...result.results }
-  };
-  if (output.results.authentication) {
-    const { receivedChain, ...auth } = output.results.authentication;
-    output.results.authentication = auth;
-  }
-  if (options.verbose) {
-    output.tokens = tokens;
-    output.subject = mail?.subject ?? null;
-  }
-  return output;
-}
-function sessionFromQuery(query) {
-  const session = {};
-  if (query.get("ip")) {
-    session.remoteAddress = query.get("ip");
-  }
-  if (query.get("hostname")) {
-    session.resolvedClientHostname = query.get("hostname");
-  }
-  if (query.get("helo")) {
-    session.helo = query.get("helo");
-  }
-  const recipients = query.getAll("to").flatMap((value) => value.split(",")).map((value) => value.trim()).filter(Boolean);
-  if (query.has("from") || recipients.length > 0) {
-    session.envelope = { mailFrom: { address: query.get("from") || "" }, rcptTo: recipients.map((address2) => ({ address: address2 })) };
-  }
-  return session;
-}
-function sameToken(given, expected) {
-  const a = import_node_buffer11.Buffer.from(String(given));
-  const b = import_node_buffer11.Buffer.from(String(expected));
-  return a.length === b.length && (0, import_node_crypto5.timingSafeEqual)(a, b);
-}
-function readBody(request, limit) {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    let size = 0;
-    request.on("data", (chunk2) => {
-      size += chunk2.length;
-      if (size <= limit) {
-        chunks.push(chunk2);
-      }
-    });
-    request.on("end", () => {
-      if (size > limit) {
-        const error = new Error(`Message larger than ${limit} bytes`);
-        error.statusCode = 413;
-        reject(error);
-        return;
-      }
-      resolve(import_node_buffer11.Buffer.concat(chunks));
-    });
-    request.on("error", reject);
-  });
-}
-function createHttpServer(scanner, options = {}) {
-  const { token = null, maxSize = 25 * 1024 * 1024, modelPath = null } = options;
-  return import_node_http2.default.createServer(async (request, response) => {
-    const send = (status, body, headers = {}) => {
-      const isBuffer = import_node_buffer11.Buffer.isBuffer(body);
-      response.writeHead(status, { "content-type": isBuffer ? "message/rfc822" : "application/json; charset=utf-8", "cache-control": "no-store", ...headers });
-      response.end(isBuffer ? body : `${JSON.stringify(body)}
-`);
-    };
-    try {
-      const url = new URL(request.url, "http://localhost");
-      if (request.method === "GET" && url.pathname === "/health") {
-        send(200, { ok: true, version: VERSION });
-        return;
-      }
-      if (token && !sameToken((request.headers.authorization || "").replace(/^bearer\s+/i, ""), token)) {
-        send(401, { error: "Unauthorized" }, { "www-authenticate": "Bearer" });
-        return;
-      }
-      if (request.method !== "POST") {
-        send(405, { error: "Method not allowed" }, { allow: "POST" });
-        return;
-      }
-      const learn = /^\/learn\/(spam|ham)$/.exec(url.pathname);
-      if (!["/scan", "/check"].includes(url.pathname) && !learn) {
-        send(404, { error: "Not found" });
-        return;
-      }
-      if (learn && !token) {
-        send(403, { error: "Learning needs the server to be started with a token" });
-        return;
-      }
-      const raw = await readBody(request, maxSize);
-      if (learn) {
-        await scanner.learn(raw, learn[1]);
-        if (modelPath) {
-          scanner.saveModel(modelPath);
-        }
-        send(200, { ok: true, learned: learn[1] });
-        return;
-      }
-      const result = await scanner.scan(raw, { session: sessionFromQuery(url.searchParams) });
-      if (url.pathname === "/scan") {
-        send(200, serializeResult(result, { verbose: url.searchParams.get("verbose") === "1" }));
-        return;
-      }
-      const tag = url.searchParams.get("subjectTag");
-      const rewritten = rewriteMessage(raw, spamHeaders(result, { version: VERSION }), { subjectTag: result.isSpam && tag ? tag : null });
-      send(200, rewritten, { "x-spam-flag": result.isSpam ? "YES" : "NO", "x-spam-score": result.score.toFixed(1), "x-spam-action": result.action });
-    } catch (error) {
-      send(error.statusCode || 500, { error: error.message });
-    }
-  });
-}
-function createTcpServer(scanner, options = {}) {
-  const { json = true, maxSize = 25 * 1024 * 1024, timeout = 6e4 } = options;
-  return import_node_net5.default.createServer({ allowHalfOpen: true }, (socket) => {
-    const chunks = [];
-    let size = 0;
-    socket.setTimeout(timeout, () => socket.destroy());
-    const onEnd = async () => {
-      socket.setTimeout(0);
-      try {
-        const result = await scanner.scan(import_node_buffer11.Buffer.concat(chunks));
-        socket.end(json ? `${JSON.stringify(serializeResult(result))}
-` : `${result.isSpam ? "SPAM" : "HAM"} ${result.score.toFixed(1)}/${result.threshold.toFixed(1)} ${result.tests.map((test) => test.name).join(",")}
-`);
-      } catch (error) {
-        socket.end(json ? `${JSON.stringify({ error: error.message })}
-` : `ERROR ${error.message}
-`);
-      }
-    };
-    const onData = (chunk2) => {
-      size += chunk2.length;
-      if (size > maxSize) {
-        socket.off("data", onData);
-        socket.off("end", onEnd);
-        socket.end(`${JSON.stringify({ error: `Message larger than ${maxSize} bytes` })}
-`, () => socket.destroy());
-        return;
-      }
-      chunks.push(chunk2);
-    };
-    socket.on("data", onData);
-    socket.on("end", onEnd);
-    socket.on("error", () => {
-    });
-  });
-}
-var import_node_buffer11, import_node_crypto5, import_node_http2, import_node_net5;
-var init_server = __esm({
-  "src/server.js"() {
-    import_node_buffer11 = require("node:buffer");
-    import_node_crypto5 = require("node:crypto");
-    import_node_http2 = __toESM(require("node:http"), 1);
-    import_node_net5 = __toESM(require("node:net"), 1);
-    init_headers();
-    init_version();
-  }
-});
-
 // src/spamd.js
 function parseRequest(head) {
   const [line, ...rest] = head.split("\r\n");
@@ -8438,14 +8882,15 @@ async function answer(scanner, request, message, options) {
 }
 function createSpamdServer(scanner, options = {}) {
   const settings = {
-    maxSize: 25 * 1024 * 1024,
+    maxSize: MAX_MESSAGE_SIZE,
     allowTell: false,
     modelPath: null,
     subjectTag: null,
     timeout: 6e4,
+    maxConnections: MAX_CONNECTIONS,
     ...options
   };
-  return import_node_net6.default.createServer({ allowHalfOpen: true }, (socket) => {
+  const server = import_node_net6.default.createServer({ allowHalfOpen: true }, (socket) => {
     let head = import_node_buffer12.Buffer.alloc(0);
     const chunks = [];
     let size = 0;
@@ -8527,6 +8972,8 @@ function createSpamdServer(scanner, options = {}) {
     socket.on("error", () => {
     });
   });
+  server.maxConnections = settings.maxConnections;
+  return server;
 }
 var import_node_buffer12, import_node_net6, EX_OK, EX_USAGE, EX_DATAERR, EX_SOFTWARE, EX_PROTOCOL, EX_NOPERM, COMMANDS2;
 var init_spamd = __esm({
@@ -8534,6 +8981,7 @@ var init_spamd = __esm({
     import_node_buffer12 = require("node:buffer");
     import_node_net6 = __toESM(require("node:net"), 1);
     init_headers();
+    init_server();
     init_version();
     EX_OK = 0;
     EX_USAGE = 64;
@@ -9190,6 +9638,7 @@ var init_src = __esm({
         const settings = config.clamav === true ? {} : config.clamav;
         const budget = settings.timeout ?? CLAMAV_TIMEOUT;
         const deadline = Date.now() + budget;
+        let expired = false;
         const viruses = [];
         const errors = [];
         const skipped = [];
@@ -9209,7 +9658,7 @@ var init_src = __esm({
           while (queue.length > 0) {
             const attachment = queue.shift();
             const filename = attachment.filename || "unnamed attachment";
-            if (deadline <= Date.now()) {
+            if (expired || deadline <= Date.now()) {
               errors.push({ filename, error: `not scanned within ${budget} ms` });
               continue;
             }
@@ -9229,6 +9678,7 @@ var init_src = __esm({
               }
             } catch (error) {
               debug2("virus scan failed: %s", error.message);
+              expired ||= Boolean(error.timedOut);
               if (CLAMAV_LIMITS.test(error.message)) {
                 skipped.push({ filename, reason: error.message.replace(/^clamd: (?:stream: )?/, "") });
               } else {