spamscanner 7.0.4 → 7.0.5

package/dist/esm/index.js

@@ -3258,17 +3258,22 @@ function zipEntries(buffer, limit = 2e3) {
       records.push(i);
     }
   }
-  const entries = [];
-  const read = /* @__PURE__ */ new Set();
+  const state = {
+    entries: [],
+    limit,
+    read: /* @__PURE__ */ new Set(),
+    names: MAX_NAME_BYTES
+  };
   for (const eocd of records) {
     const offset = directoryOf(buffer, eocd);
-    if (offset !== -1 && !read.has(offset)) {
-      read.add(offset);
-      readDirectory(buffer, offset, limit - entries.length, entries);
+    if (offset !== -1) {
+      readDirectory(buffer, offset, state);
     }
   }
-  return entries;
+  return state.entries;
 }
+var MAX_NAME_LENGTH = 1024;
+var MAX_NAME_BYTES = 1024 * 1024;
 var DIRECTORY = 33639248;
 var isDirectory = (buffer, offset) => offset >= 0 && offset + 46 <= buffer.length && buffer.readUInt32LE(offset) === DIRECTORY;
 function directoryOf(buffer, eocd) {
@@ -3295,18 +3300,32 @@ function directoryOf(buffer, eocd) {
   }
   return -1;
 }
-function readDirectory(buffer, offset, count, entries) {
-  for (let n = 0; n < count && isDirectory(buffer, offset); n++) {
+function readDirectory(buffer, offset, state) {
+  while (state.entries.length < state.limit && isDirectory(buffer, offset) && !state.read.has(offset)) {
+    state.read.add(offset);
     const flags = buffer.readUInt16LE(offset + 8);
     const size = buffer.readUInt32LE(offset + 24);
     const nameLength = buffer.readUInt16LE(offset + 28);
     const extraLength = buffer.readUInt16LE(offset + 30);
     const commentLength = buffer.readUInt16LE(offset + 32);
-    const name = buffer.subarray(offset + 46, offset + 46 + nameLength).toString(flags & 2048 ? "utf8" : "latin1");
-    entries.push({ name, encrypted: (flags & 1) === 1, size });
+    const encoding = flags & 2048 ? "utf8" : "latin1";
+    const start = offset + 46;
+    const end = Math.min(buffer.length, start + nameLength);
+    const kept = Math.min(end - start, MAX_NAME_LENGTH);
+    state.names -= kept;
+    if (state.names < 0) {
+      return;
+    }
+    const half = MAX_NAME_LENGTH / 2;
+    const name = end - start > MAX_NAME_LENGTH ? `${buffer.toString(encoding, start, start + half)}\u2026${buffer.toString(encoding, end - half, end)}` : buffer.toString(encoding, start, end);
+    state.entries.push({ name, encrypted: (flags & 1) === 1, size });
     offset += 46 + nameLength + extraLength + commentLength;
   }
 }
+function shorten(name, max = 100) {
+  const characters = [...name];
+  return characters.length <= max ? name : `${characters.slice(0, max - 41).join("")}\u2026${characters.slice(-40).join("")}`;
+}
 function extensionOf(name) {
   const base = trimEndOf(String(name).toLowerCase().split(/[/\\]/).pop(), ". ");
   const dot = base.lastIndexOf(".");
@@ -3369,7 +3388,7 @@ function inspectAttachments(attachments = []) {
       }
       const inner = entries.filter((entry) => EXECUTABLE_EXTENSIONS.has(extensionOf(entry.name)) && !(office && OFFICE_EMBEDDED.has(extensionOf(entry.name))));
       const details = { extension: extensionOf(inner[0]?.name ?? ""), extensions: [...new Set(inner.map((entry) => extensionOf(entry.name)))] };
-      const listed = inner.slice(0, 3).map((entry) => entry.name.split("/").pop()).join(", ");
+      const listed = inner.slice(0, 3).map((entry) => shorten(entry.name.split("/").pop())).join(", ");
       if (inner.some((entry) => !SCRIPT_EXTENSIONS.has(extensionOf(entry.name)))) {
         add("executable_in_archive", `Archive "${name}" contains ${inner.length === 1 ? "a program" : `${inner.length} programs`} (${listed})`, details);
       } else if (inner.length > 0) {
@@ -3399,10 +3418,486 @@ function inspectAttachments(attachments = []) {
 }
 
 // src/auth.js
-import { Buffer as Buffer3, File } from "node:buffer";
+import { Buffer as Buffer4, File } from "node:buffer";
 import dns2 from "node:dns";
 import { debuglog } from "node:util";
 
+// src/parse.js
+import { Buffer as Buffer2 } from "node:buffer";
+import { createHash } from "node:crypto";
+import { Readable } from "node:stream";
+import { MailParser, simpleParser } from "mailparser";
+var ADDRESS_FIELDS = /* @__PURE__ */ new Set(["from", "to", "cc", "bcc", "sender", "reply-to", "delivered-to", "return-path", "disposition-notification-to"]);
+var MAX_ADDRESS_FIELD = 16 * 1024;
+var MAX_ADDRESS_SEPARATORS = 2e3;
+var MAX_ADDRESS_GROUPS = 16;
+var MAX_ADDRESS_TOTAL = 64 * 1024;
+var AUTH_ADDRESS_FIELDS = /* @__PURE__ */ new Set(["from", "return-path"]);
+var ADDRESS_OPERATORS = /* @__PURE__ */ new Map([['"', '"'], ["(", ")"], ["<", ">"], [",", ""], [":", ";"], [";", ""]]);
+var SINGLE_FIELDS = /* @__PURE__ */ new Set(["message-id", "content-id", "from", "sender", "in-reply-to", "reply-to", "subject", "date", "content-disposition", "content-type", "content-transfer-encoding", "priority", "mime-version", "content-description", "precedence", "errors-to", "disposition-notification-to"]);
+var PRIORITY_FIELDS = /* @__PURE__ */ new Set(["priority", "x-priority", "x-msmail-priority", "importance"]);
+var BOUNDED2 = /* @__PURE__ */ Symbol("bounded address fields");
+var ROOM = /* @__PURE__ */ Symbol("room left for address fields");
+var PARSER_OPTIONS = {
+  skipHtmlToText: true,
+  skipImageLinks: true,
+  skipTextToHtml: true,
+  skipTextLinks: true,
+  [BOUNDED2]: true
+};
+function boundAddressField(line, room) {
+  const start = line.indexOf(":") + 1;
+  const limit = Math.min(line.length, MAX_ADDRESS_FIELD, room);
+  let end = start;
+  let expecting = "";
+  let escaped = false;
+  let separators = 0;
+  let groups = 0;
+  let index = start;
+  for (; index < limit; index++) {
+    const chr = line[index];
+    if ((chr === "," || chr === ";") && ++separators > MAX_ADDRESS_SEPARATORS) {
+      break;
+    }
+    if (escaped) {
+      escaped = false;
+    } else if (expecting !== "" && chr === expecting) {
+      expecting = "";
+      end = chr === ";" ? index + 1 : end;
+    } else if (expecting === "" && ADDRESS_OPERATORS.has(chr)) {
+      expecting = ADDRESS_OPERATORS.get(chr);
+      end = chr === "," || chr === ";" ? index : end;
+    } else if (expecting === '"' && chr === "\\") {
+      escaped = true;
+    }
+    if (chr === ":" && expecting === ";" && ++groups > MAX_ADDRESS_GROUPS) {
+      break;
+    }
+  }
+  return index === line.length ? line : line.slice(0, end).trimEnd();
+}
+function boundAddressLines(lines2, budget, only = null) {
+  const cut = /* @__PURE__ */ new Set();
+  const bounded = lines2.map((entry) => {
+    if (only ? !only.has(entry.key) : !ADDRESS_FIELDS.has(entry.key) && !entry.key.startsWith("list-")) {
+      return entry;
+    }
+    const line = boundAddressField(entry.line, budget.room);
+    budget.room = Math.max(budget.room - line.length, 0);
+    if (line === entry.line) {
+      return entry;
+    }
+    cut.add(entry.key);
+    return { ...entry, line };
+  });
+  return { lines: bounded, cut };
+}
+var { processHeaders } = MailParser.prototype;
+MailParser.prototype.processHeaders = function(lines2) {
+  if (!this.options[BOUNDED2]) {
+    return processHeaders.call(this, lines2);
+  }
+  this[ROOM] ??= { room: MAX_ADDRESS_TOTAL };
+  const bounded = boundAddressLines(lines2, this[ROOM]);
+  const headers = processHeaders.call(this, bounded.lines);
+  const keyOf = (entry) => PRIORITY_FIELDS.has(entry.key) ? "priority" : entry.key;
+  const counts = /* @__PURE__ */ new Map();
+  for (const key of bounded.lines.map((entry) => keyOf(entry)).filter((key2) => SINGLE_FIELDS.has(key2))) {
+    counts.set(key, (counts.get(key) || 0) + 1);
+  }
+  for (const key of [...counts.keys()].filter((key2) => counts.get(key2) > 1)) {
+    const last = bounded.lines.findLast((entry) => keyOf(entry) === key && processHeaders.call(this, [entry]).has(key));
+    if (last) {
+      headers.set(key, processHeaders.call(this, [last]).get(key));
+    }
+  }
+  for (const value of [...bounded.cut].flatMap((key) => headers.get(key) ?? [])) {
+    value.truncated = true;
+  }
+  return headers;
+};
+function boundedForAuth(raw) {
+  const ends = [raw.indexOf("\n\n"), raw.indexOf("\n\r\n")].filter((index) => index !== -1);
+  const end = ends.length > 0 ? Math.min(...ends) + 1 : raw.length;
+  const body = raw.subarray(ends.length > 0 ? raw.indexOf(10, end) + 1 : raw.length);
+  const text = raw.subarray(0, end).toString("latin1");
+  let { length } = text;
+  while (length > 0 && (text[length - 1] === "\n" || text[length - 1] === "\r")) {
+    length--;
+  }
+  const fields = [];
+  let folds = 0;
+  let work = 0;
+  for (let start = 0; start <= length; ) {
+    let stop = text.indexOf("\n", start);
+    stop = stop === -1 || stop > length ? length : stop;
+    const lineEnd = stop > start && text[stop - 1] === "\r" ? stop - 1 : stop;
+    const last = fields.at(-1);
+    if (last && /\s/.test(text[start])) {
+      last.end = lineEnd;
+      last.folds++;
+      folds++;
+      work += last.folds;
+    } else {
+      fields.push({ start, end: lineEnd, folds: 0 });
+    }
+    start = stop + 1;
+  }
+  let signatures = 0;
+  let dkim = 0;
+  for (const field of fields) {
+    field.line = text.slice(field.start, field.end);
+    const colon = field.line.indexOf(":");
+    field.key = (colon === -1 ? field.line : field.line.slice(0, colon)).trim().toLowerCase();
+    field.dropped = field.key === "dkim-signature" && ++dkim > MAX_DKIM_SIGNATURES;
+    if (SIGNATURE_FIELDS.has(field.key) && !field.dropped) {
+      signatures += field.line.split(":").length - 1;
+    }
+  }
+  const read = dkim > MAX_DKIM_SIGNATURES ? fields.filter((field) => !field.dropped) : fields;
+  work += (folds + signatures) * read.length;
+  const bounded = boundAddressLines(read, { room: MAX_ADDRESS_TOTAL }, AUTH_ADDRESS_FIELDS);
+  let kept = bounded.lines;
+  let fromCut = bounded.cut.has("from");
+  if (work > MAX_AUTH_WORK) {
+    const counts = /* @__PURE__ */ new Map();
+    kept = kept.filter((field) => {
+      counts.set(field.key, (counts.get(field.key) || 0) + 1);
+      const keep = AUTH_FIELDS.has(field.key) && counts.get(field.key) <= (SIGNATURE_FIELDS.has(field.key) ? MAX_SIGNATURES : MAX_REPEATED);
+      fromCut ||= field.key === "from" && !keep;
+      return keep;
+    }).map((field) => {
+      const line = field.line.replaceAll(/\r?\n(?=\s)/g, "");
+      return { ...field, line: ADDRESS_FIELDS.has(field.key) ? line : line.slice(0, MAX_FIELD) };
+    });
+  } else if (bounded.cut.size === 0 && read === fields) {
+    return { raw, fromCut };
+  }
+  const header = kept.map((field) => field.line).join("\r\n");
+  return { raw: Buffer2.concat([Buffer2.from(`${header}\r
+\r
+`, "latin1"), body]), fromCut };
+}
+var TOO_MANY_PARTS = "Max allowed child nodes exceeded";
+var HEADER_TOO_LARGE = "Max header size for a MIME node exceeded";
+var MAX_PART_LINES = 990;
+var MAX_PREFIX_BYTES = 1e6;
+var MAX_LINE = 998;
+var MAX_FIELD = 8192;
+var MAX_HEADER = 512 * 1024;
+var MAX_REPEATED = 100;
+var KEPT_FIELDS = /* @__PURE__ */ new Set([
+  "from",
+  "sender",
+  "reply-to",
+  "to",
+  "cc",
+  "subject",
+  "date",
+  "message-id",
+  "return-path",
+  "received",
+  "authentication-results",
+  "arc-authentication-results",
+  "dkim-signature",
+  "mime-version",
+  "content-type",
+  "content-transfer-encoding",
+  "list-unsubscribe",
+  "list-id"
+]);
+var MAX_AUTH_WORK = 1e7;
+var SIGNATURE_FIELDS = /* @__PURE__ */ new Set(["dkim-signature", "arc-message-signature"]);
+var AUTH_FIELDS = /* @__PURE__ */ new Set([...KEPT_FIELDS, "arc-seal", "arc-message-signature"]);
+var MAX_SIGNATURES = 10;
+var MAX_DKIM_SIGNATURES = 8;
+var MAX_NESTED_DEPTH = 3;
+var MAX_ATTACHMENTS = 100;
+var MAX_NESTED_BYTES = 25 * 1024 * 1024;
+var PARSE_TIMEOUT = 6e4;
+async function simpleParse(raw, { timeout = PARSE_TIMEOUT, parser = simpleParser } = {}) {
+  const input = Readable.from([finishable(unfoldHeaders(raw))], { objectMode: false, autoDestroy: false });
+  input.on("error", () => {
+  });
+  const { pipe } = input;
+  input.pipe = function(parser2, options) {
+    parser2.splitter?.on("error", (error) => input.destroy(error));
+    return pipe.call(this, parser2, options);
+  };
+  let timer;
+  try {
+    return await Promise.race([
+      parser(input, PARSER_OPTIONS),
+      new Promise((resolve, reject) => {
+        timer = setTimeout(() => {
+          const error = Object.assign(new Error(`Message not parsed within ${timeout} ms`), { code: "ETIMEDOUT" });
+          input.destroy(error);
+          reject(error);
+        }, timeout);
+      })
+    ]);
+  } finally {
+    clearTimeout(timer);
+    input.destroy();
+  }
+}
+async function parseMessage(raw, options = {}) {
+  const buffer = Buffer2.isBuffer(raw) ? raw : Buffer2.from(raw);
+  const mail = await simpleParse(buffer, options);
+  const added = buffer.at(-1) === 10 ? 2 : 3;
+  for (const key of ["text", "html"]) {
+    if (typeof mail[key] === "string") {
+      mail[key] = mail[key].replace(new RegExp(`\\n{0,${added}}$`), "");
+    }
+  }
+  const tail = Buffer2.from("\r\n".repeat(added));
+  const last = mail.attachments?.at(-1);
+  const encoding = String(last?.headers?.get?.("content-transfer-encoding") ?? "7bit").trim().toLowerCase();
+  const own = Buffer2.isBuffer(last?.content) && last.content.length >= tail.length && last.content.subarray(-tail.length).equals(tail) ? last.content.subarray(0, -tail.length) : null;
+  if (own && ["7bit", "8bit", "binary"].includes(encoding) && own.length <= buffer.length && buffer.subarray(buffer.length - own.length).equals(own)) {
+    last.content = own;
+    last.size = own.length;
+    last.checksum = createHash("md5").update(own).digest("hex");
+  }
+  return mail;
+}
+function finishable(raw) {
+  const buffer = Buffer2.isBuffer(raw) ? raw : Buffer2.from(raw);
+  return Buffer2.concat([buffer, Buffer2.from(buffer.at(-1) === 10 ? "\r\n\r\n" : "\r\n\r\n\r\n")]);
+}
+var MAX_FOLDS = 256;
+function headerValue2(line) {
+  const parameters = /* @__PURE__ */ new Map();
+  let key = null;
+  let inKey = false;
+  let quoted = false;
+  let escaped = false;
+  let value = "";
+  for (const chr of line.slice(line.indexOf(":") + 1).replaceAll(/\r?\n[ \t]*/g, " ")) {
+    if (inKey && chr === "=") {
+      key = value.trim().toLowerCase();
+      inKey = false;
+      value = "";
+    } else if (inKey || escaped) {
+      value += chr;
+      escaped = false;
+    } else if (chr === "\\") {
+      escaped = true;
+    } else if (chr === '"') {
+      quoted = !quoted;
+    } else if (chr === ";" && !quoted) {
+      parameters.set(key, value.trim());
+      inKey = true;
+      value = "";
+    } else {
+      value += chr;
+    }
+  }
+  if (!inKey) {
+    parameters.set(key, value.trim());
+  }
+  return { value: parameters.get(null).toLowerCase(), boundary: parameters.get("boundary") ?? "" };
+}
+function delimiter(raw, start, stop, boundary) {
+  const rest = start + 2 + boundary.length;
+  if (stop - start < boundary.length + 2 || stop - rest > 4 || raw[start] !== 45 || raw[start + 1] !== 45 || !raw.subarray(start + 2, rest).equals(boundary)) {
+    return 0;
+  }
+  if (raw[rest] === 13 || raw[rest] === 10) {
+    return 1;
+  }
+  const tail = raw.subarray(rest, stop).toString("latin1");
+  return /^-{0,2}$|^--\r?\n$|^--\r$/.test(tail) ? 2 : 0;
+}
+function unfoldHeaders(raw) {
+  const boundaries = [];
+  const unfold = [];
+  let head = true;
+  let fields = [];
+  const endHead = (blank) => {
+    unfold.push(...fields.filter((field) => field.folds > MAX_FOLDS));
+    const first = /* @__PURE__ */ new Map();
+    for (const field of fields) {
+      const name = raw.toString("latin1", field.start, Math.min(field.end, field.start + 32));
+      const key = name.slice(0, name.indexOf(":")).trim().toLowerCase();
+      if (["content-type", "content-transfer-encoding", "content-disposition"].includes(key) && !first.has(key)) {
+        first.set(key, headerValue2(raw.toString("latin1", field.start, field.end)));
+      }
+    }
+    fields = [];
+    const type = first.get("content-type") ?? { value: "", boundary: "" };
+    const encoding = (first.get("content-transfer-encoding")?.value ?? "").replaceAll(/\(.*\)/g, "").trim();
+    if (blank && type.boundary) {
+      boundaries.push(Buffer2.from(type.boundary));
+    }
+    head = blank && type.value === "message/rfc822" && ["", "7bit", "8bit", "binary"].includes(encoding) && first.get("content-disposition")?.value === "inline";
+  };
+  for (let start = 0; start < raw.length; ) {
+    const lf = raw.indexOf(10, start);
+    const stop = lf === -1 ? raw.length : lf + 1;
+    const end = lf === -1 ? stop : raw[lf - 1] === 13 ? lf - 1 : lf;
+    const kind = boundaries.length > 0 ? delimiter(raw, start, stop, boundaries.at(-1)) : 0;
+    if (kind !== 0) {
+      if (head) {
+        endHead(false);
+      }
+      head = kind === 1;
+      if (kind === 2) {
+        boundaries.pop();
+      }
+    } else if (head && end === start) {
+      endHead(true);
+    } else if (head && fields.length > 0 && (raw[start] === 32 || raw[start] === 9)) {
+      fields.at(-1).end = end;
+      fields.at(-1).folds++;
+    } else if (head) {
+      fields.push({ start, end, folds: 0 });
+    }
+    start = stop;
+  }
+  unfold.push(...fields.filter((field) => field.folds > MAX_FOLDS));
+  if (unfold.length === 0) {
+    return raw;
+  }
+  const chunks = [];
+  let copied = 0;
+  for (const field of unfold) {
+    chunks.push(raw.subarray(copied, field.start), Buffer2.from(raw.toString("latin1", field.start, field.end).replaceAll(/\r?\n[ \t]*/g, " "), "latin1"));
+    copied = field.end;
+  }
+  chunks.push(raw.subarray(copied));
+  return Buffer2.concat(chunks);
+}
+function upToLine(raw, offset) {
+  return raw.subarray(0, Math.max(raw.lastIndexOf(10, offset - 1) + 1, 0));
+}
+function fewerParts(raw) {
+  let offset = -1;
+  for (let count = 0; count < MAX_PART_LINES; count++) {
+    offset = raw.indexOf("\n--", offset + 1);
+    if (offset === -1) {
+      return upToLine(raw, Math.floor(raw.length / 2));
+    }
+  }
+  return raw.subarray(0, offset + 1);
+}
+function smallerHeader(raw) {
+  const text = raw.toString("latin1");
+  const blank = /\r?\n\r?\n/.exec(text);
+  const end = blank ? blank.index : text.length;
+  const fields = [];
+  let start = 0;
+  while (start < end) {
+    let stop = text.indexOf("\n", start);
+    stop = stop === -1 || stop > end ? end : stop;
+    const last = fields.at(-1);
+    const whole = text.slice(start, stop).replace(/\r$/, "");
+    if (last && (whole.startsWith(" ") || whole.startsWith("	"))) {
+      const line = last.address ? whole : whole.slice(0, MAX_LINE);
+      if (last.address || last.size + line.length <= MAX_FIELD) {
+        last.lines.push(line);
+        last.size += line.length;
+      }
+    } else {
+      const name = whole.slice(0, whole.indexOf(":")).trim().toLowerCase();
+      const address2 = ADDRESS_FIELDS.has(name) || name.startsWith("list-");
+      const line = address2 ? whole : whole.slice(0, MAX_LINE);
+      fields.push({
+        name,
+        address: address2,
+        lines: [line],
+        size: line.length
+      });
+    }
+    start = stop + 1;
+  }
+  let fromCut = false;
+  for (const field of fields.filter((field2) => field2.address)) {
+    const line = field.lines.join("\r\n");
+    const bounded = boundAddressField(line, Number.POSITIVE_INFINITY);
+    fromCut ||= field.name === "from" && bounded !== line;
+    field.lines = [bounded];
+    field.size = bounded.length;
+  }
+  const total = fields.reduce((sum, field) => sum + field.size, 0);
+  const counts = /* @__PURE__ */ new Map();
+  const kept = total > MAX_HEADER ? fields.filter((field) => {
+    counts.set(field.name, (counts.get(field.name) || 0) + 1);
+    const keep = KEPT_FIELDS.has(field.name) && counts.get(field.name) <= MAX_REPEATED;
+    fromCut ||= field.name === "from" && !keep;
+    return keep;
+  }) : fields;
+  const header = kept.flatMap((field) => field.lines).join("\r\n");
+  return { raw: Buffer2.concat([Buffer2.from(`${header}\r
+\r
+`, "latin1"), raw.subarray(blank ? blank.index + blank[0].length : raw.length)]), fromCut };
+}
+async function parseWithin(raw, parse = parseMessage, deadline = Date.now() + PARSE_TIMEOUT) {
+  let input = raw;
+  let reason = null;
+  let fromCut = false;
+  for (; ; ) {
+    try {
+      const mail = await parse(input, { timeout: Math.max(1, deadline - Date.now()) });
+      if (fromCut && mail.from) {
+        mail.from.truncated = true;
+      }
+      return { mail, error: reason };
+    } catch (error) {
+      const limit = error.code === "EMAXLEN" && [TOO_MANY_PARTS, HEADER_TOO_LARGE].includes(error.message) ? error.message : null;
+      let shorter = input;
+      if (limit === TOO_MANY_PARTS) {
+        shorter = fewerParts(input);
+      } else if (limit === HEADER_TOO_LARGE) {
+        const smaller = smallerHeader(input);
+        shorter = smaller.raw.length < input.length ? smaller.raw : upToLine(input, MAX_PREFIX_BYTES);
+        fromCut ||= smaller.raw === shorter && smaller.fromCut;
+      }
+      if (shorter.length >= input.length) {
+        throw error;
+      }
+      reason ??= limit;
+      input = shorter;
+    }
+  }
+}
+async function expandAttachments(attachments = [], errors = [], parse = parseMessage) {
+  const all = [];
+  const deadline = Date.now() + PARSE_TIMEOUT;
+  let budget = MAX_NESTED_BYTES;
+  let nested = 0;
+  const visit = async (list, prefix, depth) => {
+    for (const attachment of list) {
+      if (prefix) {
+        if (nested >= MAX_ATTACHMENTS) {
+          return;
+        }
+        nested++;
+      }
+      const name = attachment.filename || (prefix ? "unnamed attachment" : "");
+      all.push(prefix ? { ...attachment, filename: `${prefix}/${name}` } : attachment);
+      const { content } = attachment;
+      const attached = attachment.contentType === "message/rfc822" || /\.eml$/i.test(attachment.filename || "");
+      if (attached && depth < MAX_NESTED_DEPTH && Buffer2.isBuffer(content) && content.length <= budget) {
+        budget -= content.length;
+        let inner;
+        try {
+          inner = await parseWithin(content, parse, deadline);
+        } catch (error) {
+          errors.push(`${name || "attached message"}: ${error.message}`);
+          continue;
+        }
+        if (inner.error) {
+          errors.push(inner.error);
+        }
+        await visit(inner.mail.attachments, prefix ? `${prefix}/${name}` : name || "attached message", depth + 1);
+      }
+    }
+  };
+  await visit(attachments, "", 0);
+  return all;
+}
+
 // src/reputation.js
 import { isIP as isIP2 } from "node:net";
 import { domainToASCII } from "node:url";
@@ -3651,14 +4146,14 @@ var DnsChecker = class {
 };
 
 // src/http.js
-import { Buffer as Buffer2 } from "node:buffer";
+import { Buffer as Buffer3 } from "node:buffer";
 import http from "node:http";
 import https from "node:https";
 function requestJson(method, url, body, options = {}) {
   const { headers = {}, timeout = 3e4, maxResponseBytes = 1048576, ca } = options;
   const target = new URL(url);
   const transport = target.protocol === "https:" ? https : http;
-  const payload = body === null || body === void 0 ? null : Buffer2.from(JSON.stringify(body));
+  const payload = body === null || body === void 0 ? null : Buffer3.from(JSON.stringify(body));
   return new Promise((resolve, reject) => {
     let settled = false;
     const finish = (error, value) => {
@@ -3696,7 +4191,7 @@ function requestJson(method, url, body, options = {}) {
       });
       response.on("error", (error) => finish(error));
       response.on("end", () => {
-        const text = Buffer2.concat(chunks).toString("utf8");
+        const text = Buffer3.concat(chunks).toString("utf8");
         if (response.statusCode < 200 || response.statusCode >= 300) {
           const error = new Error(`HTTP ${response.statusCode} from ${target.origin}${target.pathname}: ${text.slice(0, 300)}`);
           error.statusCode = response.statusCode;
@@ -3972,7 +4467,7 @@ function trustedReputationValues(mail = {}, session = {}, authentication = null)
     ...[spfAligned].filter((signer) => signer !== null && (alignment?.spf?.strict !== true || signer === domain))
   ])];
   const fromValues = [];
-  for (const { address: address2 } of mail.from?.value || []) {
+  for (const { address: address2 } of mail.from?.truncated ? [] : mail.from?.value || []) {
     const domain = domainOf(address2);
     const values = reputationValues({ from: { value: [{ address: address2 }] } });
     if (domain !== null && dmarcDomain !== null && (domain === dmarcDomain || registrableDomain(domain) === dmarcDomain)) {
@@ -4035,6 +4530,37 @@ function createResolver(timeout = 1e4, servers) {
     }
   };
 }
+var MAX_DNS_QUERIES = 300;
+var MAX_AUTH_RESULTS_LENGTH = 8192;
+function dnsTimeout(message) {
+  const error = new Error(message);
+  error.code = "ETIMEOUT";
+  return error;
+}
+function limitResolver(resolver, { maxQueries = MAX_DNS_QUERIES, deadline = Number.POSITIVE_INFINITY } = {}) {
+  let count = 0;
+  return async (...args) => {
+    count++;
+    if (count > maxQueries) {
+      throw dnsTimeout(`More than ${maxQueries} DNS lookups for one message`);
+    }
+    const left = deadline - Date.now();
+    if (left <= 0) {
+      throw dnsTimeout("Out of time for this message's DNS lookups");
+    }
+    let timer;
+    try {
+      return await Promise.race([
+        resolver(...args),
+        new Promise((_resolve, reject) => {
+          timer = setTimeout(() => reject(dnsTimeout("Out of time for this message's DNS lookups")), Math.min(left, 2147483647));
+        })
+      ]);
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+}
 function emptyResult() {
   return {
     dkim: { status: { result: "none", comment: "not checked" }, results: [], aligned: null },
@@ -4174,9 +4700,14 @@ async function authenticate(message, options = {}) {
   }
   try {
     const { authenticate: run } = await getMailauth();
-    const resolver = options.resolver || createResolver(timeout, options.dnsServers);
-    const raw = Buffer3.isBuffer(message) ? message : Buffer3.from(String(message));
-    const output = await run(raw, {
+    const resolver = limitResolver(options.resolver || createResolver(timeout, options.dnsServers), {
+      maxQueries: options.maxDnsQueries ?? MAX_DNS_QUERIES,
+      // (a little after `timeout`, so a caller that waits that long for the
+      //  result, as scan() does, has its answer first)
+      deadline: Date.now() + timeout + 100
+    });
+    const bounded = boundedForAuth(Buffer4.isBuffer(message) ? message : Buffer4.from(String(message)));
+    const output = await run(bounded.raw, {
       ip,
       helo: helo || void 0,
       sender: sender ?? void 0,
@@ -4184,6 +4715,10 @@ async function authenticate(message, options = {}) {
       resolver
     });
     Object.assign(result, normalizeAuthOutput(output, { trustedArcSealers: options.trustedArcSealers }));
+    if (bounded.fromCut) {
+      result.dmarc = { ...result.dmarc, status: { result: "fail", comment: "From field too long to read whole" } };
+      result.headers = "";
+    }
   } catch (error) {
     debug("authentication failed: %s", error.message);
     result.error = error.message;
@@ -4234,11 +4769,24 @@ function calculateAuthScore(auth, weights = {}) {
   }
   return { score: tests.reduce((sum, test) => sum + test.score, 0), tests };
 }
+function limitResults(value) {
+  if (value.length <= MAX_AUTH_RESULTS_LENGTH) {
+    return value;
+  }
+  const [server, ...results] = value.split(/;(?=\s*(?:dkim|spf|dmarc|arc|bimi)=)/i);
+  let kept = server;
+  for (const result of results) {
+    if (kept.length + 1 + result.length <= MAX_AUTH_RESULTS_LENGTH) {
+      kept += `;${result}`;
+    }
+  }
+  return kept;
+}
 function formatAuthResultsHeader(auth, hostname) {
   if (typeof auth?.headers === "string") {
     const match = auth.headers.match(/^authentication-results:[ \t]*([\s\S]*?)(?=\r?\n\S|(?![\s\S]))/im);
     if (match) {
-      const value = match[1].replaceAll(/\r?\n/g, "\r\n").trim();
+      const value = limitResults(match[1].replaceAll(/\r?\n/g, "\r\n").trim());
       return hostname ? value.replace(/^[^;\s]+/, hostname) : value;
     }
   }
@@ -4253,7 +4801,7 @@ function summarizeAuth(auth) {
 }
 
 // src/clamav.js
-import { Buffer as Buffer4 } from "node:buffer";
+import { Buffer as Buffer5 } from "node:buffer";
 import { existsSync } from "node:fs";
 import net from "node:net";
 var SOCKET_PATHS = ["/var/run/clamav/clamd.ctl", "/run/clamav/clamd.ctl", "/run/clamd.scan/clamd.sock", "/var/run/clamd.scan/clamd.sock", "/var/run/clamav/clamd.sock", "/tmp/clamd.socket", "/opt/homebrew/var/run/clamav/clamd.sock", "/usr/local/var/run/clamav/clamd.sock"];
@@ -4280,10 +4828,10 @@ function exchange(address2, write, timeout) {
         resolve(value);
       }
     };
-    const timer = setTimeout(() => finish(new Error(`clamd did not answer within ${timeout} ms`)), timeout);
+    const timer = setTimeout(() => finish(Object.assign(new Error(`clamd did not answer within ${timeout} ms`), { code: "ETIMEDOUT", timedOut: true })), timeout);
     socket.on("connect", () => write(socket));
     socket.on("data", (chunk2) => chunks.push(chunk2));
-    socket.on("end", () => finish(null, Buffer4.concat(chunks).toString("utf8").replaceAll("\0", "").trim()));
+    socket.on("end", () => finish(null, Buffer5.concat(chunks).toString("utf8").replaceAll("\0", "").trim()));
     socket.on("error", (error) => finish(error));
   });
 }
@@ -4297,12 +4845,12 @@ async function scanBuffer(buffer, options = {}) {
     socket.write("zINSTREAM\0");
     for (let offset = 0; offset < buffer.length; offset += chunkSize) {
       const chunk2 = buffer.subarray(offset, offset + chunkSize);
-      const size = Buffer4.alloc(4);
+      const size = Buffer5.alloc(4);
       size.writeUInt32BE(chunk2.length);
       socket.write(size);
       socket.write(chunk2);
     }
-    socket.end(Buffer4.alloc(4));
+    socket.end(Buffer5.alloc(4));
   }, options.timeout ?? 3e4);
   if (/\bOK$/.test(reply2)) {
     return { infected: false, viruses: [], reply: reply2 };
@@ -4315,11 +4863,11 @@ async function scanBuffer(buffer, options = {}) {
 }
 
 // src/classifier.js
-import { Buffer as Buffer5 } from "node:buffer";
+import { Buffer as Buffer6 } from "node:buffer";
 var MODEL_VERSION = 2;
 function hashFeature(value) {
   let hash = 2166136261;
-  const bytes = Buffer5.from(value, "utf8");
+  const bytes = Buffer6.from(value, "utf8");
   for (const byte of bytes) {
     hash ^= byte;
     hash = Math.imul(hash, 16777619);
@@ -4645,7 +5193,7 @@ var Classifier = class _Classifier {
       spam[i] = s;
       ham[i] = h;
     }
-    const encode = (array) => Buffer5.from(array.buffer, array.byteOffset, array.byteLength).toString("base64");
+    const encode = (array) => Buffer6.from(array.buffer, array.byteOffset, array.byteLength).toString("base64");
     return {
       type: "spamscanner-classifier",
       version: MODEL_VERSION,
@@ -4696,7 +5244,7 @@ var Classifier = class _Classifier {
       throw new TypeError(`Unsupported classifier model version ${data.version}; this release reads version ${MODEL_VERSION}`);
     }
     const decode = (value, name) => {
-      const buffer = typeof value === "string" ? Buffer5.from(value, "base64") : null;
+      const buffer = typeof value === "string" ? Buffer6.from(value, "base64") : null;
       if (!buffer || buffer.byteLength % 4 !== 0) {
         throw corrupt(`${name} is not a list of 32-bit numbers`);
       }
@@ -5061,8 +5609,8 @@ ${withoutHelp(markup)}`) || attributeText(markup).some(({ text: text2, start, en
 }
 
 // src/llm.js
-import { Buffer as Buffer6 } from "node:buffer";
-import { createHash, randomBytes } from "node:crypto";
+import { Buffer as Buffer7 } from "node:buffer";
+import { createHash as createHash2, randomBytes } from "node:crypto";
 import os from "node:os";
 import process from "node:process";
 var PROVIDERS = {
@@ -5422,7 +5970,7 @@ function authHeaders(config) {
     case "basic": {
       const user = config.username ?? "";
       const pass = config.password ?? config.apiKey ?? "";
-      headers.authorization = `Basic ${Buffer6.from(`${user}:${pass}`).toString("base64")}`;
+      headers.authorization = `Basic ${Buffer7.from(`${user}:${pass}`).toString("base64")}`;
       break;
     }
     case "x-api-key": {
@@ -5989,7 +6537,7 @@ var LLMClassifier = class {
    * @returns {Promise<{verdict: string, confidence: number, language: string|null, reasons: string[], provider: string, model: string, cached: boolean, time: number}>}
    */
   async classifyText(text) {
-    const key = createHash("sha256").update(text).digest("hex");
+    const key = createHash2("sha256").update(text).digest("hex");
     if (this.cache.has(key)) {
       const hit = this.cache.get(key);
       this.cache.delete(key);
@@ -6051,7 +6599,11 @@ var LLMClassifier = class {
 
 // src/model.js
 import {
+  closeSync,
   existsSync as existsSync2,
+  fchmodSync,
+  fsyncSync,
+  openSync,
   readFileSync,
   writeFileSync,
   mkdirSync,
@@ -6127,9 +6679,19 @@ function saveModel(classifier, file, options = {}) {
   const resolved = path.resolve(file);
   mkdirSync(path.dirname(resolved), { recursive: true });
   const temporary = `${resolved}.${process2.pid}.${randomBytes2(6).toString("hex")}.tmp`;
+  const mode = statSync(resolved, { throwIfNoEntry: false })?.mode;
+  const fd = openSync(temporary, "wx");
   try {
-    writeFileSync(temporary, `${JSON.stringify(classifier.toJSON(options))}
+    try {
+      if (mode !== void 0) {
+        fchmodSync(fd, mode % 512);
+      }
+      writeFileSync(fd, `${JSON.stringify(classifier.toJSON(options))}
 `);
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
     renameSync(temporary, resolved);
   } catch (error) {
     rmSync(temporary, { force: true });
@@ -6138,175 +6700,6 @@ function saveModel(classifier, file, options = {}) {
   loaded.delete(resolved);
 }
 
-// src/parse.js
-import { Buffer as Buffer7 } from "node:buffer";
-import { createHash as createHash2 } from "node:crypto";
-import { simpleParser } from "mailparser";
-var PARSER_OPTIONS = {
-  skipHtmlToText: true,
-  skipImageLinks: true,
-  skipTextToHtml: true,
-  skipTextLinks: true
-};
-var TOO_MANY_PARTS = "Max allowed child nodes exceeded";
-var HEADER_TOO_LARGE = "Max header size for a MIME node exceeded";
-var MAX_PART_LINES = 990;
-var MAX_PREFIX_BYTES = 1e6;
-var MAX_LINE = 998;
-var MAX_FIELD = 8192;
-var MAX_HEADER = 512 * 1024;
-var MAX_REPEATED = 100;
-var KEPT_FIELDS = /* @__PURE__ */ new Set([
-  "from",
-  "sender",
-  "reply-to",
-  "to",
-  "cc",
-  "subject",
-  "date",
-  "message-id",
-  "return-path",
-  "received",
-  "authentication-results",
-  "arc-authentication-results",
-  "dkim-signature",
-  "mime-version",
-  "content-type",
-  "content-transfer-encoding",
-  "list-unsubscribe",
-  "list-id"
-]);
-var MAX_NESTED_DEPTH = 3;
-var MAX_ATTACHMENTS = 100;
-var MAX_NESTED_BYTES = 25 * 1024 * 1024;
-async function parseMessage(raw) {
-  const buffer = Buffer7.isBuffer(raw) ? raw : Buffer7.from(raw);
-  const mail = await simpleParser(finishable(buffer), PARSER_OPTIONS);
-  const added = buffer.at(-1) === 10 ? 2 : 3;
-  for (const key of ["text", "html"]) {
-    if (typeof mail[key] === "string") {
-      mail[key] = mail[key].replace(new RegExp(`\\n{0,${added}}$`), "");
-    }
-  }
-  const tail = Buffer7.from("\r\n".repeat(added));
-  const last = mail.attachments?.at(-1);
-  const encoding = String(last?.headers?.get?.("content-transfer-encoding") ?? "7bit").trim().toLowerCase();
-  const own = Buffer7.isBuffer(last?.content) && last.content.length >= tail.length && last.content.subarray(-tail.length).equals(tail) ? last.content.subarray(0, -tail.length) : null;
-  if (own && ["7bit", "8bit", "binary"].includes(encoding) && own.length <= buffer.length && buffer.subarray(buffer.length - own.length).equals(own)) {
-    last.content = own;
-    last.size = own.length;
-    last.checksum = createHash2("md5").update(own).digest("hex");
-  }
-  return mail;
-}
-function finishable(raw) {
-  const buffer = Buffer7.isBuffer(raw) ? raw : Buffer7.from(raw);
-  return Buffer7.concat([buffer, Buffer7.from(buffer.at(-1) === 10 ? "\r\n\r\n" : "\r\n\r\n\r\n")]);
-}
-function upToLine(raw, offset) {
-  return raw.subarray(0, Math.max(raw.lastIndexOf(10, offset - 1) + 1, 0));
-}
-function fewerParts(raw) {
-  let offset = -1;
-  for (let count = 0; count < MAX_PART_LINES; count++) {
-    offset = raw.indexOf("\n--", offset + 1);
-    if (offset === -1) {
-      return upToLine(raw, Math.floor(raw.length / 2));
-    }
-  }
-  return raw.subarray(0, offset + 1);
-}
-function smallerHeader(raw) {
-  const text = raw.toString("latin1");
-  const blank = /\r?\n\r?\n/.exec(text);
-  const end = blank ? blank.index : text.length;
-  const fields = [];
-  let start = 0;
-  while (start < end) {
-    let stop = text.indexOf("\n", start);
-    stop = stop === -1 || stop > end ? end : stop;
-    const line = text.slice(start, Math.min(stop, start + MAX_LINE)).replace(/\r$/, "");
-    const last = fields.at(-1);
-    if (last && (line.startsWith(" ") || line.startsWith("	"))) {
-      if (last.size + line.length <= MAX_FIELD) {
-        last.lines.push(line);
-        last.size += line.length;
-      }
-    } else {
-      fields.push({ name: line.slice(0, line.indexOf(":")).trim().toLowerCase(), lines: [line], size: line.length });
-    }
-    start = stop + 1;
-  }
-  const total = fields.reduce((sum, field) => sum + field.size, 0);
-  const counts = /* @__PURE__ */ new Map();
-  const kept = total > MAX_HEADER ? fields.filter((field) => {
-    counts.set(field.name, (counts.get(field.name) || 0) + 1);
-    return KEPT_FIELDS.has(field.name) && counts.get(field.name) <= MAX_REPEATED;
-  }) : fields;
-  const header = kept.flatMap((field) => field.lines).join("\r\n");
-  return Buffer7.concat([Buffer7.from(`${header}\r
-\r
-`, "latin1"), raw.subarray(blank ? blank.index + blank[0].length : raw.length)]);
-}
-async function parseWithin(raw, parse = parseMessage) {
-  let input = raw;
-  let reason = null;
-  for (; ; ) {
-    try {
-      return { mail: await parse(input), error: reason };
-    } catch (error) {
-      const limit = error.code === "EMAXLEN" && [TOO_MANY_PARTS, HEADER_TOO_LARGE].includes(error.message) ? error.message : null;
-      let shorter = input;
-      if (limit === TOO_MANY_PARTS) {
-        shorter = fewerParts(input);
-      } else if (limit === HEADER_TOO_LARGE) {
-        shorter = smallerHeader(input);
-        shorter = shorter.length < input.length ? shorter : upToLine(input, MAX_PREFIX_BYTES);
-      }
-      if (shorter.length >= input.length) {
-        throw error;
-      }
-      reason ??= limit;
-      input = shorter;
-    }
-  }
-}
-async function expandAttachments(attachments = [], errors = [], parse = parseMessage) {
-  const all = [];
-  let budget = MAX_NESTED_BYTES;
-  let nested = 0;
-  const visit = async (list, prefix, depth) => {
-    for (const attachment of list) {
-      if (prefix) {
-        if (nested >= MAX_ATTACHMENTS) {
-          return;
-        }
-        nested++;
-      }
-      const name = attachment.filename || (prefix ? "unnamed attachment" : "");
-      all.push(prefix ? { ...attachment, filename: `${prefix}/${name}` } : attachment);
-      const { content } = attachment;
-      const attached = attachment.contentType === "message/rfc822" || /\.eml$/i.test(attachment.filename || "");
-      if (attached && depth < MAX_NESTED_DEPTH && Buffer7.isBuffer(content) && content.length <= budget) {
-        budget -= content.length;
-        let inner;
-        try {
-          inner = await parseWithin(content, parse);
-        } catch (error) {
-          errors.push(`${name || "attached message"}: ${error.message}`);
-          continue;
-        }
-        if (inner.error) {
-          errors.push(inner.error);
-        }
-        await visit(inner.mail.attachments, prefix ? `${prefix}/${name}` : name || "attached message", depth + 1);
-      }
-    }
-  };
-  await visit(attachments, "", 0);
-  return all;
-}
-
 // src/score.js
 var BAYES_SCALE = Math.log10(99) / 0.8;
 var DEFAULT_SCORES = {
@@ -6523,7 +6916,7 @@ function scoreResults(results, options) {
 var package_default = {
   name: "spamscanner",
   description: "Spam, phishing and malware filter for email in any language: a trainable classifier, link and attachment checks, SPF/DKIM/DMARC, and an optional AI second opinion from any LLM, including local Ollama models. Works as a library, CLI, Postfix milter or HTTP API.",
-  version: "7.0.4",
+  version: "7.0.5",
   author: "Forward Email (https://forwardemail.net)",
   bin: {
     spamscanner: "./dist/esm/cli.js"
@@ -7127,9 +7520,198 @@ async function evaluate(classifier, examples) {
 }
 
 // src/milter.js
-import { Buffer as Buffer10 } from "node:buffer";
+import { Buffer as Buffer11 } from "node:buffer";
 import { EventEmitter } from "node:events";
+import net3 from "node:net";
+
+// src/server.js
+import { Buffer as Buffer10 } from "node:buffer";
+import { timingSafeEqual } from "node:crypto";
+import http2 from "node:http";
 import net2 from "node:net";
+var MAX_MESSAGE_SIZE = 25 * 1024 * 1024;
+var MAX_CONNECTIONS = 200;
+function serializeResult(result, options = {}) {
+  const { mail, tokens, ...rest } = result;
+  const output = {
+    ...rest,
+    results: { ...result.results }
+  };
+  if (output.results.authentication) {
+    const { receivedChain, ...auth } = output.results.authentication;
+    output.results.authentication = auth;
+  }
+  if (options.verbose) {
+    output.tokens = tokens;
+    output.subject = mail?.subject ?? null;
+  }
+  return output;
+}
+function sessionFromQuery(query) {
+  const session = {};
+  if (query.get("ip")) {
+    session.remoteAddress = query.get("ip");
+  }
+  if (query.get("hostname")) {
+    session.resolvedClientHostname = query.get("hostname");
+  }
+  if (query.get("helo")) {
+    session.helo = query.get("helo");
+  }
+  const recipients = query.getAll("to").flatMap((value) => value.split(",")).map((value) => value.trim()).filter(Boolean);
+  if (query.has("from") || recipients.length > 0) {
+    session.envelope = { mailFrom: { address: query.get("from") || "" }, rcptTo: recipients.map((address2) => ({ address: address2 })) };
+  }
+  return session;
+}
+function sameToken(given, expected) {
+  const a = Buffer10.from(String(given));
+  const b = Buffer10.from(String(expected));
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+function readBody(request, limit) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    request.on("data", (chunk2) => {
+      size += chunk2.length;
+      if (size <= limit) {
+        chunks.push(chunk2);
+      }
+    });
+    request.on("end", () => {
+      if (size > limit) {
+        const error = new Error(`Message larger than ${limit} bytes`);
+        error.statusCode = 413;
+        reject(error);
+        return;
+      }
+      resolve(Buffer10.concat(chunks));
+    });
+    request.on("error", reject);
+  });
+}
+function createHttpServer(scanner, options = {}) {
+  const {
+    token = null,
+    maxSize = MAX_MESSAGE_SIZE,
+    modelPath = null,
+    maxConnections = MAX_CONNECTIONS
+  } = options;
+  let active = 0;
+  const server = http2.createServer(async (request, response) => {
+    const send = (status, body, headers = {}) => {
+      const isBuffer = Buffer10.isBuffer(body);
+      response.writeHead(status, { "content-type": isBuffer ? "message/rfc822" : "application/json; charset=utf-8", "cache-control": "no-store", ...headers });
+      response.end(isBuffer ? body : `${JSON.stringify(body)}
+`);
+    };
+    try {
+      const url = new URL(request.url, "http://localhost");
+      if (request.method === "GET" && url.pathname === "/health") {
+        send(200, { ok: true, version: VERSION });
+        return;
+      }
+      if (token && !sameToken((request.headers.authorization || "").replace(/^bearer\s+/i, ""), token)) {
+        send(401, { error: "Unauthorized" }, { "www-authenticate": "Bearer" });
+        return;
+      }
+      if (request.method !== "POST") {
+        send(405, { error: "Method not allowed" }, { allow: "POST" });
+        return;
+      }
+      const learn = /^\/learn\/(spam|ham)$/.exec(url.pathname);
+      if (!["/scan", "/check"].includes(url.pathname) && !learn) {
+        send(404, { error: "Not found" });
+        return;
+      }
+      if (learn && !token) {
+        send(403, { error: "Learning needs the server to be started with a token" });
+        return;
+      }
+      const length = request.headers["content-length"];
+      if (length !== void 0 && Number(length) > maxSize) {
+        send(413, { error: `Message larger than ${maxSize} bytes` }, { connection: "close" });
+        return;
+      }
+      if (active >= maxConnections) {
+        send(503, { error: "Too many requests at once" }, { connection: "close", "retry-after": "1" });
+        return;
+      }
+      active++;
+      try {
+        const raw = await readBody(request, maxSize);
+        if (learn) {
+          await scanner.learn(raw, learn[1]);
+          if (modelPath) {
+            scanner.saveModel(modelPath);
+          }
+          send(200, { ok: true, learned: learn[1] });
+          return;
+        }
+        const result = await scanner.scan(raw, { session: sessionFromQuery(url.searchParams) });
+        if (url.pathname === "/scan") {
+          send(200, serializeResult(result, { verbose: url.searchParams.get("verbose") === "1" }));
+          return;
+        }
+        const tag = url.searchParams.get("subjectTag");
+        const rewritten = rewriteMessage(raw, spamHeaders(result, { version: VERSION }), { subjectTag: result.isSpam && tag ? tag : null });
+        send(200, rewritten, { "x-spam-flag": result.isSpam ? "YES" : "NO", "x-spam-score": result.score.toFixed(1), "x-spam-action": result.action });
+      } finally {
+        active--;
+      }
+    } catch (error) {
+      send(error.statusCode || 500, { error: error.message });
+    }
+  });
+  server.maxConnections = maxConnections;
+  return server;
+}
+function createTcpServer(scanner, options = {}) {
+  const {
+    json = true,
+    maxSize = MAX_MESSAGE_SIZE,
+    timeout = 6e4,
+    maxConnections = MAX_CONNECTIONS
+  } = options;
+  const server = net2.createServer({ allowHalfOpen: true }, (socket) => {
+    const chunks = [];
+    let size = 0;
+    socket.setTimeout(timeout, () => socket.destroy());
+    const onEnd = async () => {
+      socket.setTimeout(0);
+      try {
+        const result = await scanner.scan(Buffer10.concat(chunks));
+        socket.end(json ? `${JSON.stringify(serializeResult(result))}
+` : `${result.isSpam ? "SPAM" : "HAM"} ${result.score.toFixed(1)}/${result.threshold.toFixed(1)} ${result.tests.map((test) => test.name).join(",")}
+`);
+      } catch (error) {
+        socket.end(json ? `${JSON.stringify({ error: error.message })}
+` : `ERROR ${error.message}
+`);
+      }
+    };
+    const onData = (chunk2) => {
+      size += chunk2.length;
+      if (size > maxSize) {
+        socket.off("data", onData);
+        socket.off("end", onEnd);
+        socket.end(`${JSON.stringify({ error: `Message larger than ${maxSize} bytes` })}
+`, () => socket.destroy());
+        return;
+      }
+      chunks.push(chunk2);
+    };
+    socket.on("data", onData);
+    socket.on("end", onEnd);
+    socket.on("error", () => {
+    });
+  });
+  server.maxConnections = maxConnections;
+  return server;
+}
+
+// src/milter.js
 var COMMANDS = {
   ABORT: "A",
   BODY: "B",
@@ -7193,12 +7775,12 @@ var PROTOCOL = {
   HDR_LEADSPC: 1048576
 };
 var MAX_PACKET = 1024 * 1024;
-function packet(command, data = Buffer10.alloc(0)) {
-  const payload = Buffer10.isBuffer(data) ? data : Buffer10.from(data, "latin1");
-  const header = Buffer10.alloc(5);
+function packet(command, data = Buffer11.alloc(0)) {
+  const payload = Buffer11.isBuffer(data) ? data : Buffer11.from(data, "latin1");
+  const header = Buffer11.alloc(5);
   header.writeUInt32BE(payload.length + 1);
   header.write(command, 4, "latin1");
-  return Buffer10.concat([header, payload]);
+  return Buffer11.concat([header, payload]);
 }
 function cstrings(data) {
   const parts = data.toString("latin1").split("\0");
@@ -7208,7 +7790,7 @@ function cstrings(data) {
   return parts;
 }
 function cstring(value) {
-  return Buffer10.from(`${value}\0`, "latin1");
+  return Buffer11.from(`${value}\0`, "latin1");
 }
 function address(value) {
   const text = String(value ?? "").trim();
@@ -7244,6 +7826,15 @@ var MilterSession = class {
     this.body = [];
     this.size = 0;
     this.truncated = false;
+    this.headerSize = 0;
+  }
+  // The envelope and headers are kept whole for the scan, so beyond the
+  // message size limit the message is not scanned (see onError).
+  keep(data) {
+    this.headerSize += data.length;
+    if (this.headerSize > this.server.options.maxSize) {
+      throw new Error(`Message headers larger than ${this.server.options.maxSize} bytes`);
+    }
   }
   send(command, data) {
     if (!this.socket.destroyed) {
@@ -7256,7 +7847,7 @@ var MilterSession = class {
     if (this.buffered < this.needed) {
       return;
     }
-    let buffer = this.chunks.length === 1 ? this.chunks[0] : Buffer10.concat(this.chunks);
+    let buffer = this.chunks.length === 1 ? this.chunks[0] : Buffer11.concat(this.chunks);
     this.needed = 4;
     while (buffer.length >= 4) {
       const length = buffer.readUInt32BE(0);
@@ -7301,7 +7892,7 @@ var MilterSession = class {
         const protocol = data.readUInt32BE(8);
         const wanted = ACTIONS.ADDHDRS | ACTIONS.CHGHDRS | ACTIONS.QUARANTINE;
         this.leadingSpace = Boolean(protocol & PROTOCOL.HDR_LEADSPC);
-        const reply2 = Buffer10.alloc(12);
+        const reply2 = Buffer11.alloc(12);
         reply2.writeUInt32BE(Math.min(version, 6), 0);
         reply2.writeUInt32BE(actions & wanted, 4);
         reply2.writeUInt32BE(protocol & (PROTOCOL.HDR_LEADSPC | PROTOCOL.NOUNKNOWN), 8);
@@ -7344,16 +7935,19 @@ var MilterSession = class {
       }
       case COMMANDS.MAIL: {
         this.resetMessage();
+        this.keep(data);
         this.envelope.mailFrom = { address: address(cstrings(data)[0]) };
         this.send(RESPONSES.CONTINUE);
         break;
       }
       case COMMANDS.RCPT: {
+        this.keep(data);
         this.envelope.rcptTo.push({ address: address(cstrings(data)[0]) });
         this.send(RESPONSES.CONTINUE);
         break;
       }
       case COMMANDS.HEADER: {
+        this.keep(data);
         const [name, value = ""] = cstrings(data);
         this.headers.push([name, value]);
         this.send(RESPONSES.CONTINUE);
@@ -7363,14 +7957,19 @@ var MilterSession = class {
         if (this.truncated || this.size + data.length > options.maxSize) {
           this.truncated = true;
         } else {
-          this.body.push(Buffer10.from(data));
+          this.body.push(Buffer11.from(data));
           this.size += data.length;
         }
         this.send(RESPONSES.CONTINUE);
         break;
       }
       case COMMANDS.BODYEOB: {
-        await this.endOfMessage();
+        this.socket.pause();
+        try {
+          await this.endOfMessage();
+        } finally {
+          this.socket.resume();
+        }
         break;
       }
       case COMMANDS.ABORT: {
@@ -7393,7 +7992,7 @@ var MilterSession = class {
   /** @returns {Buffer} */
   rawMessage() {
     const head = this.headers.map(([name, value]) => `${name}:${this.leadingSpace || value.startsWith(" ") || value.startsWith("	") ? "" : " "}${value}`).join("\r\n");
-    return Buffer10.concat([Buffer10.from(this.headers.length > 0 ? `${head}\r
+    return Buffer11.concat([Buffer11.from(this.headers.length > 0 ? `${head}\r
 \r
 ` : "\r\n", "latin1"), ...this.body]);
   }
@@ -7404,9 +8003,9 @@ var MilterSession = class {
       const key = name.toLowerCase();
       counts.set(key, (counts.get(key) || 0) + 1);
       if (key.startsWith("x-spam-")) {
-        const index = Buffer10.alloc(4);
+        const index = Buffer11.alloc(4);
         index.writeUInt32BE(counts.get(key));
-        this.send(RESPONSES.CHGHEADER, Buffer10.concat([index, cstring(name), cstring("")]));
+        this.send(RESPONSES.CHGHEADER, Buffer11.concat([index, cstring(name), cstring("")]));
       }
     }
   }
@@ -7429,7 +8028,7 @@ var MilterSession = class {
       }
       this.server.report(error);
       this.removeForgedHeaders();
-      this.send(RESPONSES.ADDHEADER, Buffer10.concat([cstring("X-Spam-Virus-Scan"), cstring(`${this.leadingSpace ? " " : ""}failed`)]));
+      this.send(RESPONSES.ADDHEADER, Buffer11.concat([cstring("X-Spam-Virus-Scan"), cstring(`${this.leadingSpace ? " " : ""}failed`)]));
       this.send(RESPONSES.CONTINUE);
       this.resetMessage();
       return;
@@ -7450,15 +8049,15 @@ var MilterSession = class {
       headers.unshift(["Authentication-Results", formatAuthResultsHeader(result.results.authentication, options.hostname)]);
     }
     for (const [name, value] of headers) {
-      this.send(RESPONSES.ADDHEADER, Buffer10.concat([cstring(name), cstring(`${this.leadingSpace ? " " : ""}${value}`.replaceAll("\r\n", "\n"))]));
+      this.send(RESPONSES.ADDHEADER, Buffer11.concat([cstring(name), cstring(`${this.leadingSpace ? " " : ""}${value}`.replaceAll("\r\n", "\n"))]));
     }
     if (result.isSpam && options.subjectTag) {
       const subject = this.headers.find(([name]) => name.toLowerCase() === "subject");
       const value = taggedSubject(options.subjectTag, subject ? subject[1].trim() : "", "\n");
       if (value !== null) {
-        const index = Buffer10.alloc(4);
+        const index = Buffer11.alloc(4);
         index.writeUInt32BE(1);
-        this.send(RESPONSES.CHGHEADER, Buffer10.concat([index, cstring("Subject"), cstring(`${this.leadingSpace ? " " : ""}${value}`.replaceAll("\r\n", "\n"))]));
+        this.send(RESPONSES.CHGHEADER, Buffer11.concat([index, cstring("Subject"), cstring(`${this.leadingSpace ? " " : ""}${value}`.replaceAll("\r\n", "\n"))]));
       }
     }
     if (result.action === "reject" && options.reject) {
@@ -7485,8 +8084,10 @@ var MilterServer = class extends EventEmitter {
    * @param {boolean} [options.quarantine] - hold spam in the MTA's quarantine
    * @param {string|null} [options.subjectTag] - e.g. "[SPAM]"
    * @param {string} [options.hostname] - this server's name, for Authentication-Results
-   * @param {number} [options.maxSize] - body bytes kept for scanning
+   * @param {number} [options.maxSize] - body bytes kept for scanning (and the
+   *   most bytes of envelope and headers: beyond them a message is not scanned)
    * @param {'tempfail'|'accept'} [options.onError] - answer when a scan fails
+   * @param {number} [options.maxConnections] - connections kept open at once; more are closed at once
    */
   constructor(scanner, options = {}) {
     super();
@@ -7498,19 +8099,21 @@ var MilterServer = class extends EventEmitter {
       quarantine: false,
       subjectTag: null,
       hostname: "spamscanner",
-      maxSize: 25 * 1024 * 1024,
+      maxSize: MAX_MESSAGE_SIZE,
       onError: "tempfail",
+      maxConnections: MAX_CONNECTIONS,
       ...options
     };
     if (!/^[45]\d\d$/.test(String(this.options.rejectCode))) {
       throw new RangeError(`rejectCode must be a 4xx or 5xx SMTP code, not ${this.options.rejectCode}`);
     }
     this.sockets = /* @__PURE__ */ new Set();
-    this.server = net2.createServer((socket) => {
+    this.server = net3.createServer((socket) => {
       this.sockets.add(socket);
       socket.on("close", () => this.sockets.delete(socket));
       return new MilterSession(socket, this);
     });
+    this.server.maxConnections = this.options.maxConnections;
     this.server.on("error", (error) => this.report(error));
   }
   // Errors go to "error" listeners; with none, a broken connection or failed
@@ -7556,162 +8159,6 @@ var MilterServer = class extends EventEmitter {
   }
 };
 
-// src/server.js
-import { Buffer as Buffer11 } from "node:buffer";
-import { timingSafeEqual } from "node:crypto";
-import http2 from "node:http";
-import net3 from "node:net";
-function serializeResult(result, options = {}) {
-  const { mail, tokens, ...rest } = result;
-  const output = {
-    ...rest,
-    results: { ...result.results }
-  };
-  if (output.results.authentication) {
-    const { receivedChain, ...auth } = output.results.authentication;
-    output.results.authentication = auth;
-  }
-  if (options.verbose) {
-    output.tokens = tokens;
-    output.subject = mail?.subject ?? null;
-  }
-  return output;
-}
-function sessionFromQuery(query) {
-  const session = {};
-  if (query.get("ip")) {
-    session.remoteAddress = query.get("ip");
-  }
-  if (query.get("hostname")) {
-    session.resolvedClientHostname = query.get("hostname");
-  }
-  if (query.get("helo")) {
-    session.helo = query.get("helo");
-  }
-  const recipients = query.getAll("to").flatMap((value) => value.split(",")).map((value) => value.trim()).filter(Boolean);
-  if (query.has("from") || recipients.length > 0) {
-    session.envelope = { mailFrom: { address: query.get("from") || "" }, rcptTo: recipients.map((address2) => ({ address: address2 })) };
-  }
-  return session;
-}
-function sameToken(given, expected) {
-  const a = Buffer11.from(String(given));
-  const b = Buffer11.from(String(expected));
-  return a.length === b.length && timingSafeEqual(a, b);
-}
-function readBody(request, limit) {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    let size = 0;
-    request.on("data", (chunk2) => {
-      size += chunk2.length;
-      if (size <= limit) {
-        chunks.push(chunk2);
-      }
-    });
-    request.on("end", () => {
-      if (size > limit) {
-        const error = new Error(`Message larger than ${limit} bytes`);
-        error.statusCode = 413;
-        reject(error);
-        return;
-      }
-      resolve(Buffer11.concat(chunks));
-    });
-    request.on("error", reject);
-  });
-}
-function createHttpServer(scanner, options = {}) {
-  const { token = null, maxSize = 25 * 1024 * 1024, modelPath = null } = options;
-  return http2.createServer(async (request, response) => {
-    const send = (status, body, headers = {}) => {
-      const isBuffer = Buffer11.isBuffer(body);
-      response.writeHead(status, { "content-type": isBuffer ? "message/rfc822" : "application/json; charset=utf-8", "cache-control": "no-store", ...headers });
-      response.end(isBuffer ? body : `${JSON.stringify(body)}
-`);
-    };
-    try {
-      const url = new URL(request.url, "http://localhost");
-      if (request.method === "GET" && url.pathname === "/health") {
-        send(200, { ok: true, version: VERSION });
-        return;
-      }
-      if (token && !sameToken((request.headers.authorization || "").replace(/^bearer\s+/i, ""), token)) {
-        send(401, { error: "Unauthorized" }, { "www-authenticate": "Bearer" });
-        return;
-      }
-      if (request.method !== "POST") {
-        send(405, { error: "Method not allowed" }, { allow: "POST" });
-        return;
-      }
-      const learn = /^\/learn\/(spam|ham)$/.exec(url.pathname);
-      if (!["/scan", "/check"].includes(url.pathname) && !learn) {
-        send(404, { error: "Not found" });
-        return;
-      }
-      if (learn && !token) {
-        send(403, { error: "Learning needs the server to be started with a token" });
-        return;
-      }
-      const raw = await readBody(request, maxSize);
-      if (learn) {
-        await scanner.learn(raw, learn[1]);
-        if (modelPath) {
-          scanner.saveModel(modelPath);
-        }
-        send(200, { ok: true, learned: learn[1] });
-        return;
-      }
-      const result = await scanner.scan(raw, { session: sessionFromQuery(url.searchParams) });
-      if (url.pathname === "/scan") {
-        send(200, serializeResult(result, { verbose: url.searchParams.get("verbose") === "1" }));
-        return;
-      }
-      const tag = url.searchParams.get("subjectTag");
-      const rewritten = rewriteMessage(raw, spamHeaders(result, { version: VERSION }), { subjectTag: result.isSpam && tag ? tag : null });
-      send(200, rewritten, { "x-spam-flag": result.isSpam ? "YES" : "NO", "x-spam-score": result.score.toFixed(1), "x-spam-action": result.action });
-    } catch (error) {
-      send(error.statusCode || 500, { error: error.message });
-    }
-  });
-}
-function createTcpServer(scanner, options = {}) {
-  const { json = true, maxSize = 25 * 1024 * 1024, timeout = 6e4 } = options;
-  return net3.createServer({ allowHalfOpen: true }, (socket) => {
-    const chunks = [];
-    let size = 0;
-    socket.setTimeout(timeout, () => socket.destroy());
-    const onEnd = async () => {
-      socket.setTimeout(0);
-      try {
-        const result = await scanner.scan(Buffer11.concat(chunks));
-        socket.end(json ? `${JSON.stringify(serializeResult(result))}
-` : `${result.isSpam ? "SPAM" : "HAM"} ${result.score.toFixed(1)}/${result.threshold.toFixed(1)} ${result.tests.map((test) => test.name).join(",")}
-`);
-      } catch (error) {
-        socket.end(json ? `${JSON.stringify({ error: error.message })}
-` : `ERROR ${error.message}
-`);
-      }
-    };
-    const onData = (chunk2) => {
-      size += chunk2.length;
-      if (size > maxSize) {
-        socket.off("data", onData);
-        socket.off("end", onEnd);
-        socket.end(`${JSON.stringify({ error: `Message larger than ${maxSize} bytes` })}
-`, () => socket.destroy());
-        return;
-      }
-      chunks.push(chunk2);
-    };
-    socket.on("data", onData);
-    socket.on("end", onEnd);
-    socket.on("error", () => {
-    });
-  });
-}
-
 // src/spamd.js
 import { Buffer as Buffer12 } from "node:buffer";
 import net4 from "node:net";
@@ -7807,14 +8254,15 @@ async function answer(scanner, request, message, options) {
 }
 function createSpamdServer(scanner, options = {}) {
   const settings = {
-    maxSize: 25 * 1024 * 1024,
+    maxSize: MAX_MESSAGE_SIZE,
     allowTell: false,
     modelPath: null,
     subjectTag: null,
     timeout: 6e4,
+    maxConnections: MAX_CONNECTIONS,
     ...options
   };
-  return net4.createServer({ allowHalfOpen: true }, (socket) => {
+  const server = net4.createServer({ allowHalfOpen: true }, (socket) => {
     let head = Buffer12.alloc(0);
     const chunks = [];
     let size = 0;
@@ -7896,6 +8344,8 @@ function createSpamdServer(scanner, options = {}) {
     socket.on("error", () => {
     });
   });
+  server.maxConnections = settings.maxConnections;
+  return server;
 }
 
 // src/models.js
@@ -8472,6 +8922,7 @@ var SpamScanner = class {
     const settings = config.clamav === true ? {} : config.clamav;
     const budget = settings.timeout ?? CLAMAV_TIMEOUT;
     const deadline = Date.now() + budget;
+    let expired = false;
     const viruses = [];
     const errors = [];
     const skipped = [];
@@ -8491,7 +8942,7 @@ var SpamScanner = class {
       while (queue.length > 0) {
         const attachment = queue.shift();
         const filename = attachment.filename || "unnamed attachment";
-        if (deadline <= Date.now()) {
+        if (expired || deadline <= Date.now()) {
           errors.push({ filename, error: `not scanned within ${budget} ms` });
           continue;
         }
@@ -8511,6 +8962,7 @@ var SpamScanner = class {
           }
         } catch (error) {
           debug2("virus scan failed: %s", error.message);
+          expired ||= Boolean(error.timedOut);
           if (CLAMAV_LIMITS.test(error.message)) {
             skipped.push({ filename, reason: error.message.replace(/^clamd: (?:stream: )?/, "") });
           } else {