@bumail/smtp 0.11.1 → 0.12.0

package/dist/client/index.js

@@ -225,6 +225,20 @@ function contentOf(message, normalize, size) {
   };
 }
 
+// src/protocol/ehlo.ts
+function parseEhlo(lines) {
+  const extensions = new Map;
+  for (const line of lines.slice(1)) {
+    const text = line.trim();
+    const space = text.indexOf(" ");
+    const keyword = (space < 0 ? text : text.slice(0, space)).toUpperCase();
+    if (keyword === "")
+      continue;
+    extensions.set(keyword, space < 0 ? "" : text.slice(space + 1).trim());
+  }
+  return extensions;
+}
+
 // src/protocol/reply-reader.ts
 var MAX_REPLY_LINES = 100;
 var isDigit = (c) => c >= 48 && c <= 57;
@@ -316,20 +330,6 @@ function afterDot(error, taken) {
   });
 }
 
-// src/protocol/ehlo.ts
-function parseEhlo(lines) {
-  const extensions = new Map;
-  for (const line of lines.slice(1)) {
-    const text = line.trim();
-    const space = text.indexOf(" ");
-    const keyword = (space < 0 ? text : text.slice(0, space)).toUpperCase();
-    if (keyword === "")
-      continue;
-    extensions.set(keyword, space < 0 ? "" : text.slice(space + 1).trim());
-  }
-  return extensions;
-}
-
 // src/client/session.ts
 async function hello(socket, settings, allowHelo) {
   const seconds = settings.timeouts.command;
@@ -408,206 +408,6 @@ async function open(socket, settings, tls) {
   return { extensions, authenticated: settings.auth !== undefined };
 }
 
-// src/client/settings.ts
-import { hostname as machineName } from "node:os";
-
-// src/client/dsn.ts
-var EVENTS = ["SUCCESS", "FAILURE", "DELAY"];
-function dsnOf(given, to, fail) {
-  const { ret, envid, recipients } = given;
-  if (ret !== undefined && ret !== "FULL" && ret !== "HDRS")
-    throw fail(`ret must be 'FULL' or 'HDRS', not ${String(ret)}`);
-  if (envid !== undefined && (typeof envid !== "string" || !/^[ -~]{1,100}$/.test(envid) || encodeXtext(envid).length > 100))
-    throw fail("envid must be 1 to 100 printable ASCII characters, at most 100 once encoded as xtext");
-  const byAddress = new Map;
-  if (recipients !== undefined) {
-    if (!Array.isArray(recipients))
-      throw fail("recipients must be an array of { address, notify, orcpt }");
-    for (const entry of recipients) {
-      const address = entry?.address;
-      if (typeof address !== "string" || !to.includes(address))
-        throw fail(`recipients names ${JSON.stringify(address)}, which is not in to`);
-      if (byAddress.has(address))
-        throw fail(`recipients names ${address} twice`);
-      checkRecipient(entry, fail);
-      byAddress.set(address, entry);
-    }
-  }
-  return {
-    ...ret ? { ret } : {},
-    ...envid === undefined ? {} : { envid },
-    recipients: byAddress
-  };
-}
-function checkRecipient({ address, notify, orcpt }, fail) {
-  if (notify !== undefined && notify !== "NEVER") {
-    const events = Array.isArray(notify) ? notify : [];
-    if (events.length === 0 || events.some((e, i) => !EVENTS.includes(e) || events.indexOf(e) !== i))
-      throw fail(`notify of ${address} must be 'NEVER' or a list of 'SUCCESS', 'FAILURE', 'DELAY', each once`);
-  }
-  if (orcpt !== undefined) {
-    if (typeof orcpt !== "object" || orcpt === null || typeof orcpt.type !== "string" || !/^[A-Za-z0-9-]+$/.test(orcpt.type))
-      throw fail(`orcpt of ${address} must be { type, address }, the type a token`);
-    if (typeof orcpt.address !== "string" || orcpt.address === "")
-      throw fail(`orcpt.address of ${address} must be a non-empty string`);
-    const encoded = orcpt.type.toLowerCase() === "utf-8" ? utf8OrcptLength(orcpt.address) : encodeXtext(orcpt.address).length;
-    if (orcpt.type.length + 1 + encoded > 500)
-      throw fail(`orcpt of ${address} is over 500 characters once encoded`);
-  }
-}
-function mailDsn(dsn, offered) {
-  if (!offered)
-    return "";
-  let out = "";
-  if (dsn.ret)
-    out += ` RET=${dsn.ret}`;
-  if (dsn.envid !== undefined)
-    out += ` ENVID=${encodeXtext(dsn.envid)}`;
-  return out;
-}
-function orcptParameter({ type, address }, smtputf8) {
-  const kind = type.toLowerCase();
-  if (kind === "rfc822")
-    return /^[\x20-\x7e]+$/.test(address) ? ` ORCPT=${type};${encodeXtext(address)}` : "";
-  if (kind !== "utf-8") {
-    const value = `${type};${encodeXtext(address)}`;
-    return address.isWellFormed() ? ` ORCPT=${value}` : "";
-  }
-  const encoded = encodeUtf8Orcpt(address, smtputf8);
-  if (encoded === undefined)
-    return "";
-  const value = `${type};${encoded}`;
-  return new TextEncoder().encode(value).length > 500 ? "" : ` ORCPT=${value}`;
-}
-function rcptDsn(dsn, address, offered, smtputf8 = false) {
-  const entry = dsn.recipients.get(address);
-  if (!offered || !entry)
-    return "";
-  let out = "";
-  const { notify, orcpt } = entry;
-  if (notify !== undefined)
-    out += ` NOTIFY=${notify === "NEVER" ? "NEVER" : notify.join(",")}`;
-  if (orcpt)
-    out += orcptParameter(orcpt, smtputf8);
-  return out;
-}
-
-// src/client/settings.ts
-var MAX_SECONDS = Math.floor(2147483647 / 1000);
-var TIMEOUTS = {
-  connect: 30,
-  greeting: 300,
-  command: 300,
-  mail: 300,
-  rcpt: 300,
-  dataStart: 120,
-  dataBlock: 180,
-  dataEnd: 600
-};
-var invalid = (message) => new SmtpError2("INVALID_OPTION", `sendMail(): ${message}`);
-function seconds(name, value, fallback) {
-  if (value === undefined)
-    return fallback;
-  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0 || value > MAX_SECONDS) {
-    throw invalid(`${name} must be a number of seconds above 0 and at most ${MAX_SECONDS}, not ${String(value)}`);
-  }
-  return value;
-}
-function timeoutsOf(given = {}) {
-  const out = {};
-  for (const [name, fallback] of Object.entries(TIMEOUTS)) {
-    out[name] = seconds(`timeouts.${name}`, given[name], fallback);
-  }
-  return out;
-}
-function address(value, allowNull) {
-  if (allowNull && value === "")
-    return "";
-  if (isMailbox(value))
-    return value;
-  const text = typeof value === "string" ? value : "";
-  const routed = typeof value === "string" && parsePath2(`<${text}>`, false);
-  if (routed) {
-    throw invalid(`${JSON.stringify(value)} holds a source route (@host:), which RFC 5321 says a client should not send: pass ${JSON.stringify(`${routed.local}@${text.slice(text.lastIndexOf("@") + 1)}`)} alone`);
-  }
-  throw invalid(`${JSON.stringify(value)} is not an address (local@domain${allowNull ? ", or '' for a bounce" : ""})`);
-}
-function heloOf(value, byMx) {
-  if (value !== undefined) {
-    if (!isHelloName(value))
-      throw invalid(`helo "${value}" is not a host name`);
-    return value;
-  }
-  if (byMx)
-    throw invalid("helo is required for delivery by MX: pass your server's public name, such as helo: 'mail.example.com'");
-  const name = machineName();
-  return isHelloName(name) ? name : "localhost";
-}
-function authOf(auth) {
-  if (auth === undefined)
-    return;
-  const { username, password, mechanism } = auth;
-  if (typeof username !== "string" || username === "")
-    throw invalid("auth.username must be a non-empty string");
-  if (typeof password !== "string" || password === "")
-    throw invalid("auth.password must be a non-empty string");
-  if (mechanism !== undefined && mechanism !== "PLAIN" && mechanism !== "LOGIN")
-    throw invalid(`auth.mechanism must be 'PLAIN' or 'LOGIN', not ${mechanism}`);
-  return auth;
-}
-function tlsOf(options, plaintextAuth) {
-  const secure = options.secure === true;
-  const tls = options.tls ?? (secure || options.auth && !plaintextAuth ? "required" : "opportunistic");
-  if (tls !== "opportunistic" && tls !== "required" && tls !== "none")
-    throw invalid(`tls must be 'opportunistic', 'required' or 'none', not ${tls}`);
-  if (tls === "none" && secure)
-    throw invalid("secure is TLS from the first byte: it cannot go with tls: 'none'");
-  if (tls === "none" && options.auth && !plaintextAuth)
-    throw invalid("auth with tls: 'none' would send the password in clear; pass allowPlaintextAuth: true for a local test server");
-  if (tls === "opportunistic" && options.auth && !plaintextAuth)
-    throw invalid("auth with tls: 'opportunistic' would send the password to a server whose certificate is not checked; leave tls out to check it, or pass allowPlaintextAuth: true for a local test server");
-  return tls;
-}
-function settingsOf(options) {
-  if (typeof options !== "object" || options === null)
-    throw invalid("options must be an object");
-  const from = address(options.from, true);
-  const list = typeof options.to === "string" ? [options.to] : options.to;
-  if (!Array.isArray(list) || list.length === 0)
-    throw invalid("to must name one recipient or more");
-  const to = list.map((recipient) => address(recipient, false));
-  const allowPlaintextAuth = options.allowPlaintextAuth === true;
-  const { size } = options;
-  if (size !== undefined && (!Number.isSafeInteger(size) || size < 0))
-    throw invalid(`size must be a number of bytes, not ${size}`);
-  const ca = options.ca === undefined ? undefined : [options.ca].flat();
-  const auth = authOf(options.auth);
-  return {
-    from,
-    to,
-    helo: heloOf(options.helo, byMx(options)),
-    tls: tlsOf(options, allowPlaintextAuth),
-    secure: options.secure === true,
-    ...ca ? { ca } : {},
-    ...auth ? { auth } : {},
-    allowPlaintextAuth,
-    ...size === undefined ? {} : { size },
-    dsn: dsnOf(options, to, invalid),
-    smtputf8: options.smtputf8 === true || [from, ...to].some((text) => /[^ -~]/.test(text)),
-    normalizeLineEnds: options.normalizeLineEnds === true,
-    timeouts: timeoutsOf(options.timeouts),
-    deadline: seconds("deadline", options.deadline, 1800)
-  };
-}
-var byMx = (options) => !(("host" in options) && options.host !== undefined);
-function portOf(port, fallback) {
-  if (port === undefined)
-    return fallback;
-  if (!Number.isInteger(port) || port < 1 || port > 65535)
-    throw invalid(`port must be an integer from 1 to 65535, not ${port}`);
-  return port;
-}
-
 // src/client/inbox.ts
 var MAX_REPLY_BYTES = 1024 * 1024;
 
@@ -634,6 +434,9 @@ class Inbox {
     }
     return;
   }
+  reset() {
+    this.#received = 0;
+  }
   shift() {
     return this.#replies.shift();
   }
@@ -675,10 +478,26 @@ class Clock {
   }
 }
 
+// src/client/socket-events.ts
+function socketHandlers(live, hooks) {
+  const when = (run) => (...args) => {
+    if (live())
+      run(...args);
+  };
+  return {
+    data: when((_, chunk) => hooks.receive(chunk)),
+    drain: when(() => hooks.drain()),
+    close: when(() => hooks.lost()),
+    error: when(() => hooks.lost()),
+    handshake: when((_, ok, error) => hooks.handshake(ok, error))
+  };
+}
+var connectFailure = (endpoint, error) => error instanceof SmtpError2 ? error : new SmtpError2("CONNECTION_FAILED", `Could not connect to ${endpoint.host} (${endpoint.address}:${endpoint.port}): ${reason(error)}`);
+
 // src/client/socket.ts
 class ClientSocket {
   host;
-  #clock;
+  clock;
   #socket;
   #outgoing = new Outgoing(() => 0);
   #tls = false;
@@ -687,12 +506,13 @@ class ClientSocket {
   #closed = false;
   #wake;
   #handshaking;
-  #gone = Promise.withResolvers();
+  #watchers = new Set;
   secure = false;
+  replies = 0;
   verified = false;
   constructor(host, clock) {
     this.host = host;
-    this.#clock = clock;
+    this.clock = clock;
   }
   static async open(endpoint, tls, seconds, clock) {
     const client = new ClientSocket(endpoint.host, clock);
@@ -710,9 +530,7 @@ class ClientSocket {
       client.#use(await client.#race(connecting, seconds, "the connection"));
     } catch (error) {
       connecting.then((socket) => socket.terminate(), () => {});
-      if (error instanceof SmtpError2)
-        throw error;
-      throw new SmtpError2("CONNECTION_FAILED", `Could not connect to ${endpoint.host} (${address}:${port}): ${reason(error)}`);
+      throw connectFailure(endpoint, error);
     }
     if (handshake) {
       await client.#race(handshake, seconds, "the TLS handshake").catch((e) => {
@@ -727,17 +545,12 @@ class ClientSocket {
     this.#outgoing = new Outgoing((bytes) => socket.write(bytes));
   }
   #handlers(tls) {
-    const live = (run) => (...args) => {
-      if (this.#tls === tls)
-        run(...args);
-    };
-    return {
-      data: live((_, chunk) => this.#receive(chunk)),
-      drain: live(() => this.#outgoing.drain()),
-      close: live(() => this.#lost()),
-      error: live(() => this.#lost()),
-      handshake: live((_, ok, error) => this.#handshaking?.(ok, error))
-    };
+    return socketHandlers(() => this.#tls === tls, {
+      receive: (chunk) => this.#receive(chunk),
+      drain: () => this.#outgoing.drain(),
+      lost: () => this.#lost(),
+      handshake: (ok, error) => this.#handshaking?.(ok, error)
+    });
   }
   #expectHandshake(tls) {
     return new Promise((resolve, reject) => {
@@ -769,7 +582,8 @@ class ClientSocket {
   }
   #lost() {
     this.#closed = true;
-    this.#gone.resolve();
+    for (const watcher of this.#watchers)
+      watcher();
     this.#outgoing.clear();
     this.#handshaking?.(false, null);
     this.#wakeUp();
@@ -782,16 +596,17 @@ class ClientSocket {
   }
   #race(promise, seconds, what, start = performance.now()) {
     const ms = start + seconds * 1000 - performance.now();
-    const { host } = this;
-    const deadline = this.#clock.seconds;
-    return this.#clock.race(promise, ms, (passed) => this.#fail(timedOut(host, what, seconds, passed ? deadline : undefined)));
+    const { host, clock } = this;
+    return clock.race(promise, ms, (passed) => this.#fail(timedOut(host, what, seconds, passed ? clock.seconds : undefined)));
   }
   async reply(what, seconds) {
     const start = performance.now();
     for (;; ) {
       const next = this.#inbox.shift();
-      if (next)
+      if (next) {
+        this.replies++;
         return next;
+      }
       if (this.#failure)
         throw this.#failure;
       if (this.#closed)
@@ -802,16 +617,28 @@ class ClientSocket {
     }
   }
   within(promise, seconds, what) {
-    const over = new AbortController;
-    const gone = this.#gone.promise.then(() => {
-      if (!over.signal.aborted)
+    const watcher = Promise.withResolvers();
+    if (this.#closed)
+      watcher.resolve();
+    else
+      this.#watchers.add(watcher.resolve);
+    const gone = watcher.promise;
+    let over = false;
+    const hung = gone.then(() => {
+      if (!over)
         throw this.#hungUp(lost(this.host, what));
     });
-    const race = Promise.race([promise, gone]);
+    const race = Promise.race([promise, hung]);
     race.catch(() => {
       return;
     });
-    return this.#race(race, seconds, what).finally(() => over.abort());
+    hung.catch(() => {
+      return;
+    });
+    return this.#race(race, seconds, what).finally(() => {
+      over = true;
+      this.#watchers.delete(watcher.resolve);
+    });
   }
   write(data) {
     if (this.#failure || this.#closed)
@@ -845,6 +672,18 @@ class ClientSocket {
     this.#use(encrypted);
     await this.#race(handshake, seconds, "the TLS handshake");
   }
+  get quiet() {
+    return !this.#failure && !this.#closed && !this.#inbox.holding;
+  }
+  ref(keep) {
+    if (keep)
+      this.#socket?.ref();
+    else
+      this.#socket?.unref();
+  }
+  newMessage() {
+    this.#inbox.reset();
+  }
   close(now = false) {
     this.#closed = true;
     if (now)
@@ -854,14 +693,253 @@ class ClientSocket {
   }
 }
 
-// src/client/transaction.ts
-var missing = (host, extension, why) => new SmtpError2("EXTENSION_MISSING", `${host} does not offer ${extension}, which ${why}`);
-function mailParameters(host, settings, content, extensions) {
-  let parameters = "";
-  const size = extensions.get("SIZE");
-  if (size !== undefined && content.size !== undefined) {
-    const max = Number(size);
-    if (Number.isSafeInteger(max) && max > 0 && content.size > max) {
+// src/client/connect.ts
+var early = new WeakSet;
+async function connect(endpoint, settings, clock) {
+  const tls = {
+    servername: endpoint.host,
+    verify: settings.tls === "required",
+    ...settings.ca ? { ca: settings.ca } : {}
+  };
+  let socket;
+  try {
+    socket = await ClientSocket.open(endpoint, settings.secure ? tls : undefined, settings.timeouts.connect, clock);
+  } catch (error) {
+    early.add(error);
+    throw error;
+  }
+  try {
+    const ready = await open(socket, settings, tls);
+    return { socket, ready };
+  } catch (error) {
+    early.add(error);
+    socket.write(`QUIT\r
+`);
+    socket.close();
+    throw error;
+  }
+}
+function resultOf(delivered, { socket, ready }, endpoint) {
+  return {
+    ...delivered,
+    host: endpoint.host,
+    port: endpoint.port,
+    tls: socket.secure ? { verified: socket.verified } : false,
+    authenticated: ready.authenticated
+  };
+}
+
+// src/client/settings.ts
+import { hostname as machineName } from "node:os";
+
+// src/client/dsn.ts
+var EVENTS = ["SUCCESS", "FAILURE", "DELAY"];
+function dsnOf(given, to, fail) {
+  const { ret, envid, recipients } = given;
+  if (ret !== undefined && ret !== "FULL" && ret !== "HDRS")
+    throw fail(`ret must be 'FULL' or 'HDRS', not ${String(ret)}`);
+  if (envid !== undefined && (typeof envid !== "string" || !/^[ -~]{1,100}$/.test(envid) || encodeXtext(envid).length > 100))
+    throw fail("envid must be 1 to 100 printable ASCII characters, at most 100 once encoded as xtext");
+  const byAddress = new Map;
+  if (recipients !== undefined) {
+    if (!Array.isArray(recipients))
+      throw fail("recipients must be an array of { address, notify, orcpt }");
+    for (const entry of recipients) {
+      const address = entry?.address;
+      if (typeof address !== "string" || !to.includes(address))
+        throw fail(`recipients names ${JSON.stringify(address)}, which is not in to`);
+      if (byAddress.has(address))
+        throw fail(`recipients names ${address} twice`);
+      checkRecipient(entry, fail);
+      byAddress.set(address, entry);
+    }
+  }
+  return {
+    ...ret ? { ret } : {},
+    ...envid === undefined ? {} : { envid },
+    recipients: byAddress
+  };
+}
+function checkRecipient({ address, notify, orcpt }, fail) {
+  if (notify !== undefined && notify !== "NEVER") {
+    const events = Array.isArray(notify) ? notify : [];
+    if (events.length === 0 || events.some((e, i) => !EVENTS.includes(e) || events.indexOf(e) !== i))
+      throw fail(`notify of ${address} must be 'NEVER' or a list of 'SUCCESS', 'FAILURE', 'DELAY', each once`);
+  }
+  if (orcpt !== undefined) {
+    if (typeof orcpt !== "object" || orcpt === null || typeof orcpt.type !== "string" || !/^[A-Za-z0-9-]+$/.test(orcpt.type))
+      throw fail(`orcpt of ${address} must be { type, address }, the type a token`);
+    if (typeof orcpt.address !== "string" || orcpt.address === "")
+      throw fail(`orcpt.address of ${address} must be a non-empty string`);
+    const encoded = orcpt.type.toLowerCase() === "utf-8" ? utf8OrcptLength(orcpt.address) : encodeXtext(orcpt.address).length;
+    if (orcpt.type.length + 1 + encoded > 500)
+      throw fail(`orcpt of ${address} is over 500 characters once encoded`);
+  }
+}
+function mailDsn(dsn, offered) {
+  if (!offered)
+    return "";
+  let out = "";
+  if (dsn.ret)
+    out += ` RET=${dsn.ret}`;
+  if (dsn.envid !== undefined)
+    out += ` ENVID=${encodeXtext(dsn.envid)}`;
+  return out;
+}
+function orcptParameter({ type, address }, smtputf8) {
+  const kind = type.toLowerCase();
+  if (kind === "rfc822")
+    return /^[\x20-\x7e]+$/.test(address) ? ` ORCPT=${type};${encodeXtext(address)}` : "";
+  if (kind !== "utf-8") {
+    const value = `${type};${encodeXtext(address)}`;
+    return address.isWellFormed() ? ` ORCPT=${value}` : "";
+  }
+  const encoded = encodeUtf8Orcpt(address, smtputf8);
+  if (encoded === undefined)
+    return "";
+  const value = `${type};${encoded}`;
+  return new TextEncoder().encode(value).length > 500 ? "" : ` ORCPT=${value}`;
+}
+function rcptDsn(dsn, address, offered, smtputf8 = false) {
+  const entry = dsn.recipients.get(address);
+  if (!offered || !entry)
+    return "";
+  let out = "";
+  const { notify, orcpt } = entry;
+  if (notify !== undefined)
+    out += ` NOTIFY=${notify === "NEVER" ? "NEVER" : notify.join(",")}`;
+  if (orcpt)
+    out += orcptParameter(orcpt, smtputf8);
+  return out;
+}
+
+// src/client/settings.ts
+var MAX_SECONDS = Math.floor(2147483647 / 1000);
+var TIMEOUTS = {
+  connect: 30,
+  greeting: 300,
+  command: 300,
+  mail: 300,
+  rcpt: 300,
+  dataStart: 120,
+  dataBlock: 180,
+  dataEnd: 600
+};
+var invalid = (message) => new SmtpError2("INVALID_OPTION", `sendMail(): ${message}`);
+function seconds(name, value, fallback) {
+  if (value === undefined)
+    return fallback;
+  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0 || value > MAX_SECONDS) {
+    throw invalid(`${name} must be a number of seconds above 0 and at most ${MAX_SECONDS}, not ${String(value)}`);
+  }
+  return value;
+}
+function timeoutsOf(given = {}) {
+  const out = {};
+  for (const [name, fallback] of Object.entries(TIMEOUTS)) {
+    out[name] = seconds(`timeouts.${name}`, given[name], fallback);
+  }
+  return out;
+}
+function address(value, allowNull) {
+  if (allowNull && value === "")
+    return "";
+  if (isMailbox(value))
+    return value;
+  const text = typeof value === "string" ? value : "";
+  const routed = typeof value === "string" && parsePath2(`<${text}>`, false);
+  if (routed) {
+    throw invalid(`${JSON.stringify(value)} holds a source route (@host:), which RFC 5321 says a client should not send: pass ${JSON.stringify(`${routed.local}@${text.slice(text.lastIndexOf("@") + 1)}`)} alone`);
+  }
+  throw invalid(`${JSON.stringify(value)} is not an address (local@domain${allowNull ? ", or '' for a bounce" : ""})`);
+}
+function heloOf(value, byMx) {
+  if (value !== undefined) {
+    if (!isHelloName(value))
+      throw invalid(`helo "${value}" is not a host name`);
+    return value;
+  }
+  if (byMx)
+    throw invalid("helo is required for delivery by MX: pass your server's public name, such as helo: 'mail.example.com'");
+  const name = machineName();
+  return isHelloName(name) ? name : "localhost";
+}
+function authOf(auth) {
+  if (auth === undefined)
+    return;
+  const { username, password, mechanism } = auth;
+  if (typeof username !== "string" || username === "")
+    throw invalid("auth.username must be a non-empty string");
+  if (typeof password !== "string" || password === "")
+    throw invalid("auth.password must be a non-empty string");
+  if (mechanism !== undefined && mechanism !== "PLAIN" && mechanism !== "LOGIN")
+    throw invalid(`auth.mechanism must be 'PLAIN' or 'LOGIN', not ${mechanism}`);
+  return auth;
+}
+function tlsOf(options, plaintextAuth) {
+  const secure = options.secure === true;
+  const tls = options.tls ?? (secure || options.auth && !plaintextAuth ? "required" : "opportunistic");
+  if (tls !== "opportunistic" && tls !== "required" && tls !== "none")
+    throw invalid(`tls must be 'opportunistic', 'required' or 'none', not ${tls}`);
+  if (tls === "none" && secure)
+    throw invalid("secure is TLS from the first byte: it cannot go with tls: 'none'");
+  if (tls === "none" && options.auth && !plaintextAuth)
+    throw invalid("auth with tls: 'none' would send the password in clear; pass allowPlaintextAuth: true for a local test server");
+  if (tls === "opportunistic" && options.auth && !plaintextAuth)
+    throw invalid("auth with tls: 'opportunistic' would send the password to a server whose certificate is not checked; leave tls out to check it, or pass allowPlaintextAuth: true for a local test server");
+  return tls;
+}
+function settingsOf(options) {
+  if (typeof options !== "object" || options === null)
+    throw invalid("options must be an object");
+  const from = address(options.from, true);
+  const list = typeof options.to === "string" ? [options.to] : options.to;
+  if (!Array.isArray(list) || list.length === 0)
+    throw invalid("to must name one recipient or more");
+  const to = list.map((recipient) => address(recipient, false));
+  const allowPlaintextAuth = options.allowPlaintextAuth === true;
+  const { size } = options;
+  if (size !== undefined && (!Number.isSafeInteger(size) || size < 0))
+    throw invalid(`size must be a number of bytes, not ${size}`);
+  const ca = options.ca === undefined ? undefined : [options.ca].flat();
+  const auth = authOf(options.auth);
+  return {
+    from,
+    to,
+    helo: heloOf(options.helo, byMx(options)),
+    tls: tlsOf(options, allowPlaintextAuth),
+    secure: options.secure === true,
+    ...ca ? { ca } : {},
+    ...auth ? { auth } : {},
+    allowPlaintextAuth,
+    ...size === undefined ? {} : { size },
+    dsn: dsnOf(options, to, invalid),
+    smtputf8: options.smtputf8 === true || [from, ...to].some((text) => /[^ -~]/.test(text)),
+    normalizeLineEnds: options.normalizeLineEnds === true,
+    timeouts: timeoutsOf(options.timeouts),
+    deadline: seconds("deadline", options.deadline, 1800)
+  };
+}
+var byMx = (options) => !(("host" in options) && options.host !== undefined);
+function portOf(port, fallback) {
+  if (port === undefined)
+    return fallback;
+  if (!Number.isInteger(port) || port < 1 || port > 65535)
+    throw invalid(`port must be an integer from 1 to 65535, not ${port}`);
+  return port;
+}
+
+// src/client/transaction.ts
+var stepped = new WeakSet;
+var broken = new WeakSet;
+var inStep = (error) => typeof error === "object" && error !== null && stepped.has(error);
+var missing = (host, extension, why) => new SmtpError2("EXTENSION_MISSING", `${host} does not offer ${extension}, which ${why}`);
+function mailParameters(host, settings, content, extensions) {
+  let parameters = "";
+  const size = extensions.get("SIZE");
+  if (size !== undefined && content.size !== undefined) {
+    const max = Number(size);
+    if (Number.isSafeInteger(max) && max > 0 && content.size > max) {
       throw new SmtpError2("MESSAGE_TOO_BIG", `The message (${content.size} bytes) is larger than the ${max} bytes ${host} takes (SIZE)`, { temporary: false });
     }
     parameters += ` SIZE=${content.size}`;
@@ -883,15 +961,34 @@ async function envelope(socket, settings, content, ready) {
   const { host } = socket;
   const { timeouts } = settings;
   const dsn = ready.extensions.has("DSN");
-  const mail = `MAIL FROM:<${settings.from}>${mailParameters(host, settings, content, ready.extensions)}${mailDsn(settings.dsn, dsn)}\r
+  let parameters;
+  try {
+    parameters = mailParameters(host, settings, content, ready.extensions);
+  } catch (error) {
+    stepped.add(error);
+    throw error;
+  }
+  const mail = `MAIL FROM:<${settings.from}>${parameters}${mailDsn(settings.dsn, dsn)}\r
 `;
   const rcpts = settings.to.map((to) => `RCPT TO:<${to}>${rcptDsn(settings.dsn, to, dsn, settings.smtputf8)}\r
 `);
   const pipelining = ready.extensions.has("PIPELINING");
   socket.write(pipelining ? mail + rcpts.join("") : mail);
   const from = await socket.reply("the reply to MAIL FROM", timeouts.mail);
-  if (from.code !== 250)
-    throw refused(host, "the sender", from);
+  if (from.code !== 250) {
+    const refusal = refused(host, "the sender", from);
+    if (pipelining) {
+      for (const _ of rcpts) {
+        try {
+          await socket.reply("the reply to RCPT TO", timeouts.rcpt);
+        } catch {
+          broken.add(refusal);
+          break;
+        }
+      }
+    }
+    throw refusal;
+  }
   const accepted = [];
   const rejected = [];
   for (const [i, recipient] of settings.to.entries()) {
@@ -954,63 +1051,49 @@ async function data(socket, settings, content, ready, taken) {
   return end;
 }
 async function transact(socket, settings, content, ready) {
-  const { accepted, rejected } = await envelope(socket, settings, content, ready);
-  const reply = await data(socket, settings, content, ready, {
-    accepted,
-    rejected
-  });
-  return {
-    accepted,
-    rejected,
-    reply,
-    dsnOffered: ready.extensions.has("DSN")
-  };
+  try {
+    const { accepted, rejected } = await envelope(socket, settings, content, ready);
+    const reply = await data(socket, settings, content, ready, {
+      accepted,
+      rejected
+    });
+    const delivered = {
+      accepted,
+      rejected,
+      reply,
+      dsnOffered: ready.extensions.has("DSN")
+    };
+    return { delivered };
+  } catch (error) {
+    const code = error instanceof SmtpError2 ? error.reply?.code : undefined;
+    if (code !== undefined && code >= 400 && code < 600 && code !== 421 && !broken.has(error))
+      stepped.add(error);
+    throw error;
+  }
 }
 
 // src/client/send.ts
 var MAX_ADDRESSES = 10;
 var QUIT_WAIT = 5;
-var early = new WeakSet;
-async function attempt(endpoint, settings, content, clock) {
-  const tls = {
-    servername: endpoint.host,
-    verify: settings.tls === "required",
-    ...settings.ca ? { ca: settings.ca } : {}
-  };
-  let socket;
-  try {
-    socket = await ClientSocket.open(endpoint, settings.secure ? tls : undefined, settings.timeouts.connect, clock);
-  } catch (error) {
-    early.add(error);
-    throw error;
-  }
+var attempt = async (endpoint, settings, content, clock) => {
+  const { socket, ready } = await connect(endpoint, settings, clock);
   let quit = false;
   try {
-    const ready = await open(socket, settings, tls).catch((error) => {
-      early.add(error);
-      throw error;
-    });
-    const delivered = await transact(socket, settings, content, ready);
+    const { delivered } = await transact(socket, settings, content, ready);
     socket.write(`QUIT\r
 `);
     quit = true;
     await socket.reply("the reply to QUIT", Math.min(QUIT_WAIT, settings.timeouts.command)).catch(() => {});
-    return {
-      ...delivered,
-      host: endpoint.host,
-      port: endpoint.port,
-      tls: socket.secure ? { verified: socket.verified } : false,
-      authenticated: ready.authenticated
-    };
+    return resultOf(delivered, { socket, ready }, endpoint);
   } finally {
     if (!quit)
       socket.write(`QUIT\r
 `);
     socket.close();
   }
-}
+};
 var withinDeadline = (lookup, clock, name, what) => clock.race(lookup, Number.POSITIVE_INFINITY, () => timedOut(name, what, clock.seconds, clock.seconds));
-async function viaMx(options, settings, content, clock) {
+async function viaMx(try_, options, settings, content, clock) {
   const { domain, resolver } = options;
   if (typeof domain !== "string" || domain === "")
     throw invalid("domain must be a domain name");
@@ -1035,7 +1118,7 @@ async function viaMx(options, settings, content, clock) {
         if (tried++ >= MAX_ADDRESSES)
           break hosts;
         try {
-          return await attempt({ host: mx.host, address, port }, settings, content, clock);
+          return await try_({ host: mx.host, address, port }, settings, content, clock);
         } catch (error) {
           const next = error instanceof SmtpError2 && error.temporary && early.has(error);
           if (!next)
@@ -1046,25 +1129,237 @@ async function viaMx(options, settings, content, clock) {
     }
   throw last ?? noAddress(domain, dnsError);
 }
-async function sendMail(message, options) {
-  const settings = settingsOf(options);
-  const content = contentOf(message, settings.normalizeLineEnds, settings.size);
-  const clock = new Clock(settings.deadline);
+function deliver(try_, options, settings, content, clock) {
   if (!byMx(options)) {
     const { host } = options;
     if (typeof host !== "string" || !/^[^\s/]+$/.test(host))
       throw invalid(`host must be a host name or an address, not ${host}`);
     const port = portOf(options.port, settings.secure ? 465 : 25);
-    return attempt({ host, address: host, port }, settings, content, clock);
+    return try_({ host, address: host, port }, settings, content, clock);
+  }
+  return viaMx(try_, options, settings, content, clock);
+}
+async function sendMail(message, options) {
+  const settings = settingsOf(options);
+  const content = contentOf(message, settings.normalizeLineEnds, settings.size);
+  return deliver(attempt, options, settings, content, new Clock(settings.deadline));
+}
+
+// src/client/pool/options.ts
+var invalid2 = (message) => new SmtpError2("INVALID_OPTION", `createSmtpPool(): ${message}`);
+function count(name, value, fallback) {
+  if (value === undefined)
+    return fallback;
+  if (!Number.isSafeInteger(value) || value < 1)
+    throw invalid2(`${name} must be an integer of at least 1, not ${String(value)}`);
+  return value;
+}
+function seconds2(name, value, fallback) {
+  if (value === undefined)
+    return fallback;
+  if (!Number.isFinite(value) || value <= 0 || value > MAX_SECONDS)
+    throw invalid2(`${name} must be a number of seconds above 0 and at most ${MAX_SECONDS}, not ${String(value)}`);
+  return value;
+}
+function limitsOf(options = {}) {
+  if (typeof options !== "object" || options === null)
+    throw invalid2("options must be an object");
+  return {
+    maxMessages: count("maxMessages", options.maxMessages, 100),
+    idleSeconds: seconds2("idleSeconds", options.idleSeconds, 5),
+    maxAgeSeconds: seconds2("maxAgeSeconds", options.maxAgeSeconds, 300),
+    maxIdlePerHost: count("maxIdlePerHost", options.maxIdlePerHost, 4)
+  };
+}
+var sameList = (a, b) => a === b || a !== undefined && b !== undefined && a.length === b.length && a.every((item, i) => item === b[i]);
+var sameAuth = (a, b) => a === b || a !== undefined && b !== undefined && a.username === b.username && a.password === b.password && a.mechanism === b.mechanism;
+function sameIdentity(a, b) {
+  const x = a.connection;
+  const y = b.connection;
+  return a.host === b.host && a.address === b.address && a.port === b.port && x.helo === y.helo && x.tls === y.tls && x.secure === y.secure && x.allowPlaintextAuth === y.allowPlaintextAuth && sameList(x.ca, y.ca) && sameAuth(x.auth, y.auth);
+}
+var identityOf = (endpoint, settings) => ({
+  host: endpoint.host,
+  address: endpoint.address,
+  port: endpoint.port,
+  connection: {
+    helo: settings.helo,
+    tls: settings.tls,
+    secure: settings.secure,
+    allowPlaintextAuth: settings.allowPlaintextAuth,
+    ...settings.ca ? { ca: [...settings.ca] } : {},
+    ...settings.auth ? { auth: { ...settings.auth } } : {}
   }
-  return viaMx(options, settings, content, clock);
+});
+
+// src/client/pool/reset.ts
+var RESET_WAIT = 5;
+async function reset(entry, clock, seconds) {
+  const { socket } = entry;
+  if (!socket.quiet)
+    return false;
+  socket.clock = clock;
+  socket.write(`RSET\r
+`);
+  try {
+    return (await socket.reply("the reply to RSET", seconds)).code === 250;
+  } catch {
+    return false;
+  }
+}
+var stale = (entry, before, error) => error instanceof SmtpError2 && error.code === "CONNECTION_LOST" && error.reply === undefined && !error.afterData && entry.socket.replies === before;
+
+// src/client/pool/state.ts
+var newState = (limits) => ({
+  limits,
+  idle: [],
+  busy: new Set,
+  resetting: new Set,
+  closed: false
+});
+function hangUp(entry, polite = true) {
+  clearTimeout(entry.timer);
+  if (polite)
+    entry.socket.write(`QUIT\r
+`);
+  entry.socket.close();
+}
+var aged = (state, entry) => performance.now() - entry.born >= state.limits.maxAgeSeconds * 1000;
+
+// src/client/pool/idle.ts
+function forget(state, entry) {
+  const at = state.idle.indexOf(entry);
+  if (at >= 0)
+    state.idle.splice(at, 1);
+  clearTimeout(entry.timer);
+}
+function release(state, entry) {
+  const { limits, idle } = state;
+  const spent = state.closed || entry.messages >= limits.maxMessages || aged(state, entry) || !entry.socket.quiet;
+  for (const other of idle.filter((e) => !e.socket.quiet)) {
+    forget(state, other);
+    hangUp(other, false);
+  }
+  const same = idle.filter((e) => e.identity.host === entry.identity.host);
+  if (spent || same.length >= limits.maxIdlePerHost) {
+    hangUp(entry);
+    return;
+  }
+  entry.timer = setTimeout(() => {
+    forget(state, entry);
+    hangUp(entry);
+  }, limits.idleSeconds * 1000);
+  entry.timer.unref();
+  entry.socket.ref(false);
+  idle.push(entry);
+}
+async function borrow(state, identity, seconds, clock) {
+  for (;; ) {
+    const entry = state.idle.find((e) => sameIdentity(e.identity, identity));
+    if (!entry)
+      return;
+    forget(state, entry);
+    entry.socket.ref(true);
+    if (aged(state, entry)) {
+      hangUp(entry, true);
+      continue;
+    }
+    if (await reset(entry, clock, seconds))
+      return entry;
+    hangUp(entry, false);
+  }
+}
+
+// src/client/pool/send.ts
+class Stale extends Error {
+}
+function recover(state, entry) {
+  const job = reset(entry, new Clock(RESET_WAIT), RESET_WAIT).then((ok) => ok ? release(state, entry) : hangUp(entry, false)).catch(() => hangUp(entry, false));
+  state.resetting.add(job);
+  job.finally(() => state.resetting.delete(job));
+}
+async function send(state, entry, settings, content, clock, reused) {
+  const { socket, ready } = entry;
+  socket.clock = clock;
+  socket.newMessage();
+  const before = socket.replies;
+  let result;
+  try {
+    const { delivered } = await transact(socket, settings, content, ready);
+    result = {
+      ...resultOf(delivered, entry, entry.identity),
+      reused
+    };
+  } catch (error) {
+    if (inStep(error)) {
+      entry.messages++;
+      recover(state, entry);
+    } else
+      hangUp(entry);
+    if (reused && stale(entry, before, error))
+      throw new Stale;
+    throw error;
+  }
+  entry.messages++;
+  release(state, entry);
+  return result;
+}
+async function attempt2(state, endpoint, settings, content, clock) {
+  const identity = identityOf(endpoint, settings);
+  const wait = Math.min(RESET_WAIT, settings.timeouts.command);
+  const entry = await borrow(state, identity, wait, clock);
+  if (entry) {
+    try {
+      return await send(state, entry, settings, content, clock, true);
+    } catch (error) {
+      if (!(error instanceof Stale))
+        throw error;
+    }
+  }
+  const { socket, ready } = await connect(endpoint, settings, clock);
+  const fresh = {
+    socket,
+    ready,
+    identity,
+    born: performance.now(),
+    messages: 0
+  };
+  return send(state, fresh, settings, content, clock, false);
+}
+
+// src/client/pool/index.ts
+function createSmtpPool(options) {
+  const state = newState(limitsOf(options));
+  return {
+    sendMail(message, sendOptions) {
+      const job = (async () => {
+        if (state.closed)
+          throw new SmtpError2("STOPPED", "The SMTP pool is closed");
+        const settings = settingsOf(sendOptions);
+        const content = contentOf(message, settings.normalizeLineEnds, settings.size);
+        return deliver((endpoint, s, c, clock) => attempt2(state, endpoint, s, c, clock), sendOptions, settings, content, new Clock(settings.deadline));
+      })();
+      state.busy.add(job);
+      const done = () => state.busy.delete(job);
+      job.then(done, done);
+      return job;
+    },
+    async close() {
+      state.closed = true;
+      for (const entry of state.idle.splice(0))
+        hangUp(entry);
+      await Promise.allSettled([...state.busy]);
+      await Promise.allSettled([...state.resetting]);
+    }
+  };
 }
 export {
   SmtpError2 as SmtpError,
+  createSmtpPool,
   isMailbox,
   resolveMx,
   sendMail
 };
 
-//# debugId=3C3AEF3D2B40447E64756E2164756E21
+//# debugId=CDDCD67CAFC1023D64756E2164756E21
 //# sourceMappingURL=index.js.map