@bumail/smtp 0.1.0 → 0.2.1

package/dist/client/index.js

@@ -0,0 +1,948 @@
+import {
+  SmtpError2,
+  isHelloName,
+  parsePath2,
+  encodePlain,
+  encodeLoginStep,
+  MAX_LINE,
+  LineSplitter,
+  Outgoing
+} from "../chunks/index-3423jxf9.js";
+// src/client/mx.ts
+function dnsCode(error) {
+  return error instanceof Error && error.name === "DnsError" ? error.code : undefined;
+}
+function temporary(error) {
+  const code = dnsCode(error);
+  return code === undefined || code === "TEMPORARY" || code === "TIMEOUT";
+}
+var messageOf = (error) => error instanceof Error ? error.message : String(error);
+function byPreference(hosts, random = Math.random) {
+  return hosts.map((host) => ({ host, key: random() })).sort((x, y) => x.host.priority - y.host.priority || x.key - y.key).map(({ host }) => host);
+}
+async function resolveMx(domain, resolver) {
+  const implicit = [
+    { host: domain.toLowerCase(), priority: 0, implicit: true }
+  ];
+  let records;
+  try {
+    records = await resolver.mx(domain);
+  } catch (error) {
+    if (dnsCode(error) === "NOT_FOUND")
+      return implicit;
+    throw new SmtpError2("DNS_FAILED", `Could not look up the MX records of ${domain}: ${messageOf(error)}`, { temporary: temporary(error) });
+  }
+  const hosts = records.filter((record) => record.exchange !== "").map((record) => ({
+    host: record.exchange,
+    priority: record.priority,
+    implicit: false
+  }));
+  if (records.length === 0)
+    return implicit;
+  if (hosts.length === 0) {
+    throw new SmtpError2("NULL_MX", `${domain} accepts no mail: its MX record is the null MX (RFC 7505)`, { temporary: false });
+  }
+  return byPreference(hosts);
+}
+async function addressesOf(host, resolver) {
+  const found = [];
+  let failure;
+  for (const lookup of [resolver.a, resolver.aaaa]) {
+    try {
+      for (const record of await lookup.call(resolver, host)) {
+        found.push(record.address);
+      }
+    } catch (error) {
+      if (failure === undefined || temporary(error))
+        failure = error;
+    }
+  }
+  return found.length > 0 ? found : { error: failure };
+}
+function noAddress(domain, error) {
+  const why = error === undefined ? "no A or AAAA record" : messageOf(error);
+  return new SmtpError2("DNS_FAILED", `No mail host of ${domain} has an address: ${why}`, { temporary: error !== undefined && temporary(error) });
+}
+// src/protocol/data-writer.ts
+var CR = 13;
+var LF = 10;
+var DOT = 46;
+
+class DataWriter {
+  #normalize;
+  #lineStart = true;
+  #heldCr = false;
+  bareLineBreaks = 0;
+  eightBit = false;
+  constructor(normalize = false) {
+    this.#normalize = normalize;
+  }
+  #bare(out, n, byte) {
+    if (this.#normalize) {
+      out[n++] = CR;
+      out[n++] = LF;
+      this.#lineStart = true;
+      return n;
+    }
+    this.bareLineBreaks++;
+    out[n++] = byte;
+    this.#lineStart = false;
+    return n;
+  }
+  write(chunk) {
+    const out = new Uint8Array(chunk.length * 2 + 2);
+    let n = 0;
+    for (let i = 0;i < chunk.length; i++) {
+      const byte = chunk[i];
+      if (this.#heldCr) {
+        this.#heldCr = false;
+        if (byte === LF) {
+          out[n++] = CR;
+          out[n++] = LF;
+          this.#lineStart = true;
+          continue;
+        }
+        n = this.#bare(out, n, CR);
+      }
+      if (byte === CR) {
+        this.#heldCr = true;
+        continue;
+      }
+      if (byte === LF) {
+        n = this.#bare(out, n, LF);
+        continue;
+      }
+      if (byte === DOT && this.#lineStart)
+        out[n++] = DOT;
+      if (byte > 127)
+        this.eightBit = true;
+      out[n++] = byte;
+      this.#lineStart = false;
+    }
+    return out.subarray(0, n);
+  }
+  end() {
+    const out = new Uint8Array(7);
+    let n = 0;
+    if (this.#heldCr) {
+      this.#heldCr = false;
+      n = this.#bare(out, n, CR);
+    }
+    if (!this.#lineStart) {
+      out[n++] = CR;
+      out[n++] = LF;
+    }
+    out[n++] = DOT;
+    out[n++] = CR;
+    out[n++] = LF;
+    return out.subarray(0, n);
+  }
+}
+
+// src/client/content.ts
+var SLICE = 64 * 1024;
+var bareLineBreak = () => new SmtpError2("BARE_LINE_BREAK", "sendMail(): the message holds a bare CR or LF, which a server must refuse (SMTP smuggling); end every line with CRLF, or pass normalizeLineEnds: true");
+function sliced(next) {
+  let held;
+  return async () => {
+    if (!held || held.length === 0)
+      held = await next();
+    if (!held)
+      return;
+    const slice = held.subarray(0, SLICE);
+    held = held.subarray(SLICE);
+    return slice;
+  };
+}
+function fromBytes(bytes) {
+  let given = false;
+  const next = sliced(async () => {
+    if (given)
+      return;
+    given = true;
+    return bytes;
+  });
+  return { next, cancel() {} };
+}
+function fromStream(stream) {
+  const reader = stream.getReader();
+  const next = sliced(async () => {
+    const { done, value } = await reader.read();
+    if (done)
+      return;
+    if (!(value instanceof Uint8Array)) {
+      throw new SmtpError2("INVALID_OPTION", "sendMail(): a message stream must give Uint8Array chunks");
+    }
+    return value;
+  });
+  return {
+    next,
+    cancel: () => void reader.cancel().catch(() => {})
+  };
+}
+function contentOf(message, normalize, size) {
+  if (message instanceof ReadableStream) {
+    let read = false;
+    return {
+      ...size === undefined ? {} : { size },
+      eightBit: false,
+      chunks() {
+        if (read) {
+          throw new SmtpError2("INVALID_OPTION", "sendMail(): a message stream can be sent once only");
+        }
+        read = true;
+        return fromStream(message);
+      }
+    };
+  }
+  let bytes;
+  if (typeof message === "string")
+    bytes = new TextEncoder().encode(message);
+  else if (message instanceof Uint8Array)
+    bytes = message;
+  else {
+    throw new SmtpError2("INVALID_OPTION", "sendMail(): the message must be a Uint8Array, a string or a ReadableStream");
+  }
+  const writer = new DataWriter(normalize);
+  let sent = 0;
+  for (let at = 0;at < bytes.length; at += SLICE) {
+    sent += writer.write(bytes.subarray(at, at + SLICE)).length;
+  }
+  writer.end();
+  if (writer.bareLineBreaks > 0)
+    throw bareLineBreak();
+  return {
+    size: sent,
+    eightBit: writer.eightBit,
+    chunks: () => fromBytes(bytes)
+  };
+}
+
+// src/protocol/reply-reader.ts
+var MAX_REPLY_LINES = 100;
+var isDigit = (c) => c >= 48 && c <= 57;
+function parseLine(line) {
+  if (line.length < 3)
+    return;
+  const a = line.charCodeAt(0);
+  if (a < 50 || a > 53)
+    return;
+  if (!isDigit(line.charCodeAt(1)) || !isDigit(line.charCodeAt(2)))
+    return;
+  const code = Number(line.slice(0, 3));
+  if (line.length === 3)
+    return { code, last: true, text: "" };
+  const separator = line[3];
+  if (separator !== " " && separator !== "-")
+    return;
+  return { code, last: separator === " ", text: line.slice(4) };
+}
+function statusOf(code, text) {
+  const space = text.indexOf(" ");
+  const token = space < 0 ? text : text.slice(0, space);
+  if (token.length > 11 || !/^[245]\.\d{1,3}\.\d{1,3}$/.test(token))
+    return;
+  return token[0] === String(code)[0] ? token : undefined;
+}
+function build(code, lines) {
+  const status = statusOf(code, lines[0] ?? "");
+  const text = status ? lines.map((line) => line.startsWith(`${status} `) ? line.slice(status.length + 1) : line === status ? "" : line) : [...lines];
+  const body = text.length === 1 ? text[0] : text;
+  return status === undefined ? { code, text: body } : { code, status, text: body };
+}
+
+class ReplyReader {
+  #lines = [];
+  #code = 0;
+  line(text) {
+    const parsed = parseLine(text);
+    if (!parsed) {
+      const shown = text.length > 40 ? `${text.slice(0, 40)}…` : text;
+      return {
+        error: `a line that is not an SMTP reply: ${JSON.stringify(shown)}`
+      };
+    }
+    if (this.#lines.length > 0 && parsed.code !== this.#code) {
+      return {
+        error: `a reply whose lines change code, from ${this.#code} to ${parsed.code}`
+      };
+    }
+    if (this.#lines.length >= MAX_REPLY_LINES) {
+      return { error: `a reply of more than ${MAX_REPLY_LINES} lines` };
+    }
+    this.#code = parsed.code;
+    this.#lines.push(parsed.text);
+    if (!parsed.last)
+      return;
+    const lines = this.#lines;
+    this.#lines = [];
+    return build(parsed.code, lines);
+  }
+}
+function replyText(reply) {
+  return typeof reply.text === "string" ? reply.text : reply.text.join(" ");
+}
+
+// src/client/refusal.ts
+function shown(reply) {
+  const text = replyText(reply);
+  const line = `${reply.code}${reply.status ? ` ${reply.status}` : ""} ${text}`;
+  return line.length > 200 ? `${line.slice(0, 200)}…` : line;
+}
+function refused(host, what, reply) {
+  return new SmtpError2("REFUSED", `${host} refused ${what}: ${shown(reply)}`, {
+    reply
+  });
+}
+var badReply = (host, what) => new SmtpError2("BAD_REPLY", `${host} sent ${what}`);
+var lost = (host, what) => new SmtpError2("CONNECTION_LOST", what === undefined ? `The connection to ${host} closed while the message was sent` : `The connection to ${host} closed before ${what}`);
+var timedOut = (host, what, seconds, deadline) => new SmtpError2("TIMEOUT", deadline === undefined ? `Timed out after ${seconds} s waiting for ${what} (${host})` : `The deadline of ${deadline} s passed waiting for ${what} (${host})`);
+var tlsFailed = (host, why) => new SmtpError2("TLS_FAILED", `TLS with ${host} failed: ${why}`);
+
+// src/protocol/ehlo.ts
+function parseEhlo(lines) {
+  const extensions = new Map;
+  for (const line of lines.slice(1)) {
+    const text = line.trim();
+    const space = text.indexOf(" ");
+    const keyword = (space < 0 ? text : text.slice(0, space)).toUpperCase();
+    if (keyword === "")
+      continue;
+    extensions.set(keyword, space < 0 ? "" : text.slice(space + 1).trim());
+  }
+  return extensions;
+}
+
+// src/client/session.ts
+async function hello(socket, settings, allowHelo) {
+  const seconds = settings.timeouts.command;
+  socket.write(`EHLO ${settings.helo}\r
+`);
+  const ehlo = await socket.reply("the reply to EHLO", seconds);
+  if (ehlo.code === 250) {
+    return parseEhlo(typeof ehlo.text === "string" ? [ehlo.text] : ehlo.text);
+  }
+  if (ehlo.code < 500 || !allowHelo)
+    throw refused(socket.host, "EHLO", ehlo);
+  socket.write(`HELO ${settings.helo}\r
+`);
+  const helo = await socket.reply("the reply to HELO", seconds);
+  if (helo.code !== 250)
+    throw refused(socket.host, "HELO", helo);
+  return new Map;
+}
+async function startTls(socket, settings, tls, extensions) {
+  const required = settings.tls === "required";
+  if (!extensions.has("STARTTLS")) {
+    if (!required)
+      return extensions;
+    throw new SmtpError2("TLS_UNAVAILABLE", `${socket.host} does not offer STARTTLS, and tls is 'required'`);
+  }
+  socket.write(`STARTTLS\r
+`);
+  const answer = await socket.reply("the reply to STARTTLS", settings.timeouts.command);
+  if (answer.code !== 220) {
+    if (!required)
+      return extensions;
+    throw new SmtpError2("TLS_UNAVAILABLE", `${socket.host} refused STARTTLS, and tls is 'required': ${shown(answer)}`, { reply: answer, temporary: true });
+  }
+  await socket.startTls(tls, settings.timeouts.connect);
+  return hello(socket, settings, false);
+}
+async function authenticate(socket, settings, extensions) {
+  const { auth } = settings;
+  if (!auth)
+    return;
+  const { host } = socket;
+  if (!socket.secure && !settings.allowPlaintextAuth) {
+    throw new SmtpError2("AUTH_UNAVAILABLE", `Refusing to send credentials to ${host} in clear: it did not start TLS (allowPlaintextAuth is for a local test server only)`);
+  }
+  const offered = (extensions.get("AUTH") ?? "").toUpperCase().split(" ");
+  const mechanism = auth.mechanism ?? (offered.includes("PLAIN") ? "PLAIN" : offered.includes("LOGIN") ? "LOGIN" : undefined);
+  if (!mechanism || !offered.includes(mechanism)) {
+    throw new SmtpError2("AUTH_UNAVAILABLE", `${host} offers no AUTH mechanism this client speaks (${auth.mechanism ?? "PLAIN, LOGIN"}): AUTH ${extensions.get("AUTH") ?? "is not offered"}`);
+  }
+  const seconds = settings.timeouts.command;
+  const steps = mechanism === "PLAIN" ? [`AUTH PLAIN ${encodePlain(auth.username, auth.password)}`] : [
+    "AUTH LOGIN",
+    encodeLoginStep(auth.username),
+    encodeLoginStep(auth.password)
+  ];
+  for (const [i, step] of steps.entries()) {
+    socket.write(`${step}\r
+`);
+    const answer = await socket.reply("the reply to AUTH", seconds);
+    const last = i === steps.length - 1;
+    if (answer.code === (last ? 235 : 334))
+      continue;
+    throw refused(host, `AUTH ${mechanism}`, answer);
+  }
+}
+async function open(socket, settings, tls) {
+  const greeting = await socket.reply("the greeting", settings.timeouts.greeting);
+  if (greeting.code !== 220) {
+    throw refused(socket.host, "the connection", greeting);
+  }
+  let extensions = await hello(socket, settings, true);
+  if (!socket.secure && settings.tls !== "none") {
+    extensions = await startTls(socket, settings, tls, extensions);
+  }
+  await authenticate(socket, settings, extensions);
+  return { extensions, authenticated: settings.auth !== undefined };
+}
+
+// src/client/settings.ts
+import { hostname as machineName } from "node:os";
+var MAX_SECONDS = Math.floor(2147483647 / 1000);
+var TIMEOUTS = {
+  connect: 30,
+  greeting: 300,
+  command: 300,
+  mail: 300,
+  rcpt: 300,
+  dataStart: 120,
+  dataBlock: 180,
+  dataEnd: 600
+};
+var invalid = (message) => new SmtpError2("INVALID_OPTION", `sendMail(): ${message}`);
+function seconds(name, value, fallback) {
+  if (value === undefined)
+    return fallback;
+  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0 || value > MAX_SECONDS) {
+    throw invalid(`${name} must be a number of seconds above 0 and at most ${MAX_SECONDS}, not ${String(value)}`);
+  }
+  return value;
+}
+function timeoutsOf(given = {}) {
+  const out = {};
+  for (const [name, fallback] of Object.entries(TIMEOUTS)) {
+    out[name] = seconds(`timeouts.${name}`, given[name], fallback);
+  }
+  return out;
+}
+function address(value, allowNull) {
+  const text = typeof value === "string" ? value : "";
+  if (typeof value === "string" && parsePath2(`<${text}>`, allowNull, "refuse"))
+    return text;
+  const routed = typeof value === "string" && parsePath2(`<${text}>`, false);
+  if (routed) {
+    throw invalid(`${JSON.stringify(value)} holds a source route (@host:), which RFC 5321 says a client should not send: pass ${JSON.stringify(`${routed.local}@${text.slice(text.lastIndexOf("@") + 1)}`)} alone`);
+  }
+  throw invalid(`${JSON.stringify(value)} is not an address (local@domain${allowNull ? ", or '' for a bounce" : ""})`);
+}
+function heloOf(value, byMx) {
+  if (value !== undefined) {
+    if (!isHelloName(value))
+      throw invalid(`helo "${value}" is not a host name`);
+    return value;
+  }
+  if (byMx)
+    throw invalid("helo is required for delivery by MX: pass your server's public name, such as helo: 'mail.example.com'");
+  const name = machineName();
+  return isHelloName(name) ? name : "localhost";
+}
+function authOf(auth) {
+  if (auth === undefined)
+    return;
+  const { username, password, mechanism } = auth;
+  if (typeof username !== "string" || username === "")
+    throw invalid("auth.username must be a non-empty string");
+  if (typeof password !== "string" || password === "")
+    throw invalid("auth.password must be a non-empty string");
+  if (mechanism !== undefined && mechanism !== "PLAIN" && mechanism !== "LOGIN")
+    throw invalid(`auth.mechanism must be 'PLAIN' or 'LOGIN', not ${mechanism}`);
+  return auth;
+}
+function tlsOf(options, plaintextAuth) {
+  const secure = options.secure === true;
+  const tls = options.tls ?? (secure || options.auth && !plaintextAuth ? "required" : "opportunistic");
+  if (tls !== "opportunistic" && tls !== "required" && tls !== "none")
+    throw invalid(`tls must be 'opportunistic', 'required' or 'none', not ${tls}`);
+  if (tls === "none" && secure)
+    throw invalid("secure is TLS from the first byte: it cannot go with tls: 'none'");
+  if (tls === "none" && options.auth && !plaintextAuth)
+    throw invalid("auth with tls: 'none' would send the password in clear; pass allowPlaintextAuth: true for a local test server");
+  if (tls === "opportunistic" && options.auth && !plaintextAuth)
+    throw invalid("auth with tls: 'opportunistic' would send the password to a server whose certificate is not checked; leave tls out to check it, or pass allowPlaintextAuth: true for a local test server");
+  return tls;
+}
+function settingsOf(options) {
+  if (typeof options !== "object" || options === null)
+    throw invalid("options must be an object");
+  const from = address(options.from, true);
+  const list = typeof options.to === "string" ? [options.to] : options.to;
+  if (!Array.isArray(list) || list.length === 0)
+    throw invalid("to must name one recipient or more");
+  const to = list.map((recipient) => address(recipient, false));
+  const allowPlaintextAuth = options.allowPlaintextAuth === true;
+  const { size } = options;
+  if (size !== undefined && (!Number.isSafeInteger(size) || size < 0))
+    throw invalid(`size must be a number of bytes, not ${size}`);
+  const ca = options.ca === undefined ? undefined : [options.ca].flat();
+  const auth = authOf(options.auth);
+  return {
+    from,
+    to,
+    helo: heloOf(options.helo, byMx(options)),
+    tls: tlsOf(options, allowPlaintextAuth),
+    secure: options.secure === true,
+    ...ca ? { ca } : {},
+    ...auth ? { auth } : {},
+    allowPlaintextAuth,
+    ...size === undefined ? {} : { size },
+    smtputf8: options.smtputf8 === true || [from, ...to].some((text) => /[^ -~]/.test(text)),
+    normalizeLineEnds: options.normalizeLineEnds === true,
+    timeouts: timeoutsOf(options.timeouts),
+    deadline: seconds("deadline", options.deadline, 1800)
+  };
+}
+var byMx = (options) => !(("host" in options) && options.host !== undefined);
+function portOf(port, fallback) {
+  if (port === undefined)
+    return fallback;
+  if (!Number.isInteger(port) || port < 1 || port > 65535)
+    throw invalid(`port must be an integer from 1 to 65535, not ${port}`);
+  return port;
+}
+
+// src/client/inbox.ts
+var MAX_REPLY_BYTES = 1024 * 1024;
+
+class Inbox {
+  #lines = new LineSplitter;
+  #reader = new ReplyReader;
+  #replies = [];
+  #received = 0;
+  push(chunk) {
+    this.#received += chunk.length;
+    if (this.#received > MAX_REPLY_BYTES) {
+      return `more than ${MAX_REPLY_BYTES} bytes of replies`;
+    }
+    this.#lines.push(chunk);
+    for (let event = this.#lines.next();event; event = this.#lines.next()) {
+      if ("tooLong" in event)
+        return `a reply line longer than ${MAX_LINE} bytes`;
+      const result = this.#reader.line(event.line);
+      if (result === undefined)
+        continue;
+      if ("error" in result)
+        return result.error;
+      this.#replies.push(result);
+    }
+    return;
+  }
+  shift() {
+    return this.#replies.shift();
+  }
+  get holding() {
+    return this.#lines.holding || this.#replies.length > 0;
+  }
+}
+
+// src/client/target.ts
+var tlsOptions = (tls) => ({
+  serverName: tls.servername,
+  rejectUnauthorized: tls.verify,
+  ...tls.ca ? { ca: [...tls.ca] } : {}
+});
+var reason = (error) => error?.code ?? error?.message ?? "the handshake failed";
+
+class Clock {
+  seconds;
+  #end;
+  constructor(seconds) {
+    this.seconds = seconds;
+    this.#end = performance.now() + seconds * 1000;
+  }
+  async race(promise, ms, expire) {
+    const left = this.#end - performance.now();
+    const deadline = left < ms;
+    ms = Math.min(ms, left);
+    if (ms <= 0)
+      throw expire(deadline);
+    let timer;
+    const expired = new Promise((_, reject) => {
+      timer = setTimeout(() => reject(expire(deadline)), ms);
+    });
+    try {
+      return await Promise.race([promise, expired]);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+}
+
+// src/client/socket.ts
+class ClientSocket {
+  host;
+  #clock;
+  #socket;
+  #outgoing = new Outgoing(() => 0);
+  #tls = false;
+  #inbox = new Inbox;
+  #failure;
+  #closed = false;
+  #wake;
+  #handshaking;
+  #gone = Promise.withResolvers();
+  secure = false;
+  verified = false;
+  constructor(host, clock) {
+    this.host = host;
+    this.#clock = clock;
+  }
+  static async open(endpoint, tls, seconds, clock) {
+    const client = new ClientSocket(endpoint.host, clock);
+    client.#tls = tls !== undefined;
+    const handshake = tls ? client.#expectHandshake(tls) : undefined;
+    handshake?.catch(() => {});
+    const { address, port } = endpoint;
+    const connecting = Bun.connect({
+      hostname: address,
+      port,
+      ...tls ? { tls: tlsOptions(tls) } : {},
+      socket: client.#handlers(tls !== undefined)
+    });
+    try {
+      client.#use(await client.#race(connecting, seconds, "the connection"));
+    } catch (error) {
+      connecting.then((socket) => socket.terminate(), () => {});
+      if (error instanceof SmtpError2)
+        throw error;
+      throw new SmtpError2("CONNECTION_FAILED", `Could not connect to ${endpoint.host} (${address}:${port}): ${reason(error)}`);
+    }
+    if (handshake) {
+      await client.#race(handshake, seconds, "the TLS handshake").catch((e) => {
+        client.close(true);
+        throw e;
+      });
+    }
+    return client;
+  }
+  #use(socket) {
+    this.#socket = socket;
+    this.#outgoing = new Outgoing((bytes) => socket.write(bytes));
+  }
+  #handlers(tls) {
+    const live = (run) => (...args) => {
+      if (this.#tls === tls)
+        run(...args);
+    };
+    return {
+      data: live((_, chunk) => this.#receive(chunk)),
+      drain: live(() => this.#outgoing.drain()),
+      close: live(() => this.#lost()),
+      error: live(() => this.#lost()),
+      handshake: live((_, ok, error) => this.#handshaking?.(ok, error))
+    };
+  }
+  #expectHandshake(tls) {
+    return new Promise((resolve, reject) => {
+      this.#handshaking = (ok, error) => {
+        this.#handshaking = undefined;
+        if (this.#closed || tls.verify && !ok) {
+          const why = this.#closed ? "the connection closed" : reason(error);
+          return reject(this.#fail(tlsFailed(this.host, why)));
+        }
+        this.secure = true;
+        this.verified = ok && error === null;
+        resolve();
+      };
+    });
+  }
+  #receive(chunk) {
+    if (this.#failure || this.#closed)
+      return;
+    const wrong = this.#inbox.push(chunk);
+    if (wrong)
+      this.#fail(badReply(this.host, wrong));
+    else
+      this.#wakeUp();
+  }
+  #wakeUp() {
+    const wake = this.#wake;
+    this.#wake = undefined;
+    wake?.();
+  }
+  #lost() {
+    this.#closed = true;
+    this.#gone.resolve();
+    this.#outgoing.clear();
+    this.#handshaking?.(false, null);
+    this.#wakeUp();
+  }
+  #fail(error) {
+    this.#failure ??= error;
+    this.#socket?.terminate();
+    this.#lost();
+    return this.#failure;
+  }
+  #race(promise, seconds, what, start = performance.now()) {
+    const ms = start + seconds * 1000 - performance.now();
+    const { host } = this;
+    const deadline = this.#clock.seconds;
+    return this.#clock.race(promise, ms, (passed) => this.#fail(timedOut(host, what, seconds, passed ? deadline : undefined)));
+  }
+  async reply(what, seconds) {
+    const start = performance.now();
+    for (;; ) {
+      const next = this.#inbox.shift();
+      if (next)
+        return next;
+      if (this.#failure)
+        throw this.#failure;
+      if (this.#closed)
+        throw this.#fail(lost(this.host, what));
+      await this.#race(new Promise((wake) => {
+        this.#wake = wake;
+      }), seconds, what, start);
+    }
+  }
+  within(promise, seconds, what) {
+    const gone = this.#gone.promise.then(() => {
+      throw this.#hungUp(lost(this.host, what));
+    });
+    return this.#race(Promise.race([promise, gone]), seconds, what);
+  }
+  write(data) {
+    if (this.#failure || this.#closed)
+      return;
+    this.#outgoing.write(typeof data === "string" ? new TextEncoder().encode(data) : data);
+  }
+  async drained(seconds) {
+    await this.#race(this.#outgoing.drained(), seconds, "the server to take the message");
+    if (this.#failure || this.#closed)
+      throw this.#hungUp(lost(this.host));
+  }
+  #hungUp(otherwise) {
+    if (this.#failure)
+      return this.#failure;
+    const said = this.#inbox.shift();
+    return this.#fail(said ? refused(this.host, "the message", said) : otherwise);
+  }
+  async startTls(tls, seconds) {
+    const socket = this.#socket;
+    if (this.#inbox.holding || !socket) {
+      throw this.#fail(badReply(this.host, "more after its 220 to STARTTLS"));
+    }
+    const handshake = this.#expectHandshake(tls);
+    handshake.catch(() => {});
+    this.#tls = true;
+    const [, encrypted] = socket.upgradeTLS({
+      tls: tlsOptions(tls),
+      socket: this.#handlers(true)
+    });
+    this.#use(encrypted);
+    await this.#race(handshake, seconds, "the TLS handshake");
+  }
+  close(now = false) {
+    this.#closed = true;
+    if (now)
+      this.#socket?.terminate();
+    else
+      this.#socket?.end();
+  }
+}
+
+// src/client/transaction.ts
+var missing = (host, extension, why) => new SmtpError2("EXTENSION_MISSING", `${host} does not offer ${extension}, which ${why}`);
+function mailParameters(host, settings, content, extensions) {
+  let parameters = "";
+  const size = extensions.get("SIZE");
+  if (size !== undefined && content.size !== undefined) {
+    const max = Number(size);
+    if (Number.isSafeInteger(max) && max > 0 && content.size > max) {
+      throw new SmtpError2("MESSAGE_TOO_BIG", `The message (${content.size} bytes) is larger than the ${max} bytes ${host} takes (SIZE)`, { temporary: false });
+    }
+    parameters += ` SIZE=${content.size}`;
+  }
+  if (extensions.has("8BITMIME"))
+    parameters += " BODY=8BITMIME";
+  else if (content.eightBit) {
+    throw missing(host, "8BITMIME", "the message needs: it has 8-bit bytes");
+  }
+  if (settings.smtputf8) {
+    if (!extensions.has("SMTPUTF8")) {
+      throw missing(host, "SMTPUTF8", "an address that is not ASCII needs (or smtputf8 asked for)");
+    }
+    parameters += " SMTPUTF8";
+  }
+  return parameters;
+}
+async function envelope(socket, settings, content, ready) {
+  const { host } = socket;
+  const { timeouts } = settings;
+  const mail = `MAIL FROM:<${settings.from}>${mailParameters(host, settings, content, ready.extensions)}\r
+`;
+  const rcpts = settings.to.map((to) => `RCPT TO:<${to}>\r
+`);
+  const pipelining = ready.extensions.has("PIPELINING");
+  socket.write(pipelining ? mail + rcpts.join("") : mail);
+  const from = await socket.reply("the reply to MAIL FROM", timeouts.mail);
+  if (from.code !== 250)
+    throw refused(host, "the sender", from);
+  const accepted = [];
+  const rejected = [];
+  for (const [i, recipient] of settings.to.entries()) {
+    if (!pipelining)
+      socket.write(rcpts[i]);
+    const reply = await socket.reply("the reply to RCPT TO", timeouts.rcpt);
+    const into = reply.code === 250 || reply.code === 251 ? accepted : rejected;
+    into.push({ recipient, reply });
+  }
+  if (accepted.length === 0) {
+    const first = rejected[0];
+    throw new SmtpError2("RECIPIENTS_REFUSED", `${host} refused every recipient, ${first.recipient} with ${shown(first.reply)}`, {
+      reply: first.reply,
+      rejected,
+      temporary: rejected.some(({ reply }) => reply.code < 500)
+    });
+  }
+  return { accepted, rejected };
+}
+async function data(socket, settings, content, ready) {
+  const { host } = socket;
+  const { timeouts } = settings;
+  socket.write(`DATA\r
+`);
+  const start = await socket.reply("the reply to DATA", timeouts.dataStart);
+  if (start.code !== 354)
+    throw refused(host, "DATA", start);
+  const writer = new DataWriter(settings.normalizeLineEnds);
+  const eightBitOk = ready.extensions.has("8BITMIME");
+  const chunks = content.chunks();
+  let tail;
+  try {
+    for (;; ) {
+      const chunk = await socket.within(chunks.next(), timeouts.dataBlock, "the next part of the message");
+      if (!chunk)
+        break;
+      const bytes = writer.write(chunk);
+      if (writer.bareLineBreaks > 0)
+        throw bareLineBreak();
+      if (writer.eightBit && !eightBitOk) {
+        throw missing(host, "8BITMIME", "the message needs: it has 8-bit bytes");
+      }
+      socket.write(bytes);
+      await socket.drained(timeouts.dataBlock);
+    }
+    tail = writer.end();
+    if (writer.bareLineBreaks > 0)
+      throw bareLineBreak();
+  } catch (error) {
+    chunks.cancel();
+    socket.close(true);
+    throw error;
+  }
+  socket.write(tail);
+  const end = await socket.reply("the reply to the final dot", timeouts.dataEnd);
+  if (end.code !== 250)
+    throw refused(host, "the message", end);
+  return end;
+}
+async function transact(socket, settings, content, ready) {
+  const { accepted, rejected } = await envelope(socket, settings, content, ready);
+  const reply = await data(socket, settings, content, ready);
+  return { accepted, rejected, reply };
+}
+
+// src/client/send.ts
+var MAX_ADDRESSES = 10;
+var QUIT_WAIT = 5;
+var early = new WeakSet;
+async function attempt(endpoint, settings, content, clock) {
+  const tls = {
+    servername: endpoint.host,
+    verify: settings.tls === "required",
+    ...settings.ca ? { ca: settings.ca } : {}
+  };
+  let socket;
+  try {
+    socket = await ClientSocket.open(endpoint, settings.secure ? tls : undefined, settings.timeouts.connect, clock);
+  } catch (error) {
+    early.add(error);
+    throw error;
+  }
+  let quit = false;
+  try {
+    const ready = await open(socket, settings, tls).catch((error) => {
+      early.add(error);
+      throw error;
+    });
+    const delivered = await transact(socket, settings, content, ready);
+    socket.write(`QUIT\r
+`);
+    quit = true;
+    await socket.reply("the reply to QUIT", Math.min(QUIT_WAIT, settings.timeouts.command)).catch(() => {});
+    return {
+      ...delivered,
+      host: endpoint.host,
+      port: endpoint.port,
+      tls: socket.secure ? { verified: socket.verified } : false,
+      authenticated: ready.authenticated
+    };
+  } finally {
+    if (!quit)
+      socket.write(`QUIT\r
+`);
+    socket.close();
+  }
+}
+var withinDeadline = (lookup, clock, name, what) => clock.race(lookup, Number.POSITIVE_INFINITY, () => timedOut(name, what, clock.seconds, clock.seconds));
+async function viaMx(options, settings, content, clock) {
+  const { domain, resolver } = options;
+  if (typeof domain !== "string" || domain === "")
+    throw invalid("domain must be a domain name");
+  if (typeof resolver?.mx !== "function")
+    throw invalid("resolver must be a Resolver, such as @bumail/dns gives");
+  const port = portOf(options.port, 25);
+  let last;
+  let dnsError;
+  let tried = 0;
+  let looked = 0;
+  const mailHosts = await withinDeadline(resolveMx(domain, resolver), clock, domain, "the MX lookup");
+  hosts:
+    for (const mx of mailHosts) {
+      if (tried >= MAX_ADDRESSES || looked++ >= MAX_ADDRESSES)
+        break;
+      const addresses = await withinDeadline(addressesOf(mx.host, resolver), clock, mx.host, "the address lookup");
+      if (!Array.isArray(addresses)) {
+        dnsError = addresses.error;
+        continue;
+      }
+      for (const address of addresses) {
+        if (tried++ >= MAX_ADDRESSES)
+          break hosts;
+        try {
+          return await attempt({ host: mx.host, address, port }, settings, content, clock);
+        } catch (error) {
+          const next = error instanceof SmtpError2 && error.temporary && early.has(error);
+          if (!next)
+            throw error;
+          last = error;
+        }
+      }
+    }
+  throw last ?? noAddress(domain, dnsError);
+}
+async function sendMail(message, options) {
+  const settings = settingsOf(options);
+  const content = contentOf(message, settings.normalizeLineEnds, settings.size);
+  const clock = new Clock(settings.deadline);
+  if (!byMx(options)) {
+    const { host } = options;
+    if (typeof host !== "string" || !/^[^\s/]+$/.test(host))
+      throw invalid(`host must be a host name or an address, not ${host}`);
+    const port = portOf(options.port, settings.secure ? 465 : 25);
+    return attempt({ host, address: host, port }, settings, content, clock);
+  }
+  return viaMx(options, settings, content, clock);
+}
+export {
+  SmtpError2 as SmtpError,
+  resolveMx,
+  sendMail
+};
+
+//# debugId=A7806B344FA2670664756E2164756E21
+//# sourceMappingURL=index.js.map