@upyo/smtp 0.6.0-dev.311 → 0.6.0-dev.314

package/dist/index.cjs

@@ -25,6 +25,7 @@ const __upyo_core = __toESM(require("@upyo/core"));
 const node_buffer = __toESM(require("node:buffer"));
 const node_net = __toESM(require("node:net"));
 const node_tls = __toESM(require("node:tls"));
+const node_crypto = __toESM(require("node:crypto"));
 
 //#region src/delivery-status.ts
 /**
@@ -134,6 +135,40 @@ function assertParameterLength(parameter, maximum, name) {
 	if (parameter.length > maximum) throw new SmtpDsnValidationError(`${name} parameter exceeds the RFC 3461 limit of ${maximum} characters.`);
 }
 
+//#endregion
+//#region src/dkim/types.ts
+/**
+* Validates the runtime body-mode option without changing config identity.
+* @param config Optional signing configuration.
+* @throws {TypeError} If the body mode is unsupported.
+*/
+function validateDkimBodyMode(config) {
+	if (config?.bodyMode !== void 0 && config.bodyMode !== "buffered" && config.bodyMode !== "streaming") throw new TypeError("Expected DKIM bodyMode to be buffered or streaming.");
+}
+/**
+* Default header fields to sign if not specified.
+*
+* @since 0.4.0
+*/
+const DEFAULT_SIGNED_HEADERS = [
+	"from",
+	"to",
+	"subject",
+	"date"
+];
+/**
+* Default DKIM algorithm.
+*
+* @since 0.4.0
+*/
+const DEFAULT_ALGORITHM = "rsa-sha256";
+/**
+* Default canonicalization method.
+*
+* @since 0.4.0
+*/
+const DEFAULT_CANONICALIZATION = "relaxed/relaxed";
+
 //#endregion
 //#region src/config.ts
 /**
@@ -148,6 +183,7 @@ function assertParameterLength(parameter, maximum, name) {
 * @internal
 */
 function createSmtpConfig(config) {
+	validateDkimBodyMode(config.dkim);
 	const port = config.port ?? 587;
 	return {
 		host: config.host,
@@ -327,7 +363,7 @@ function truncateErrorBody(text) {
 * @returns A promise that settles with `promise`, or rejects when `signal`
 *          aborts.
 */
-function abortable(promise, signal) {
+function abortable$1(promise, signal) {
 	if (signal == null) return promise;
 	return new Promise((resolve, reject) => {
 		const abortReason = () => signal.reason ?? new DOMException("The operation was aborted.", "AbortError");
@@ -401,7 +437,7 @@ var OAuth2TokenManager = class {
 		}).finally(() => {
 			this.pending = void 0;
 		});
-		const { accessToken } = await abortable(this.pending, signal);
+		const { accessToken } = await abortable$1(this.pending, signal);
 		return accessToken;
 	}
 	/**
@@ -469,6 +505,561 @@ var OAuth2TokenManager = class {
 	}
 };
 
+//#endregion
+//#region src/dkim/body-hash.ts
+/** Incremental RFC 6376 body hash with bounded whitespace and line state. */
+var BodyHasher = class {
+	hash = (0, node_crypto.createHash)("sha256");
+	buffer = new Uint8Array(65536);
+	used = 0;
+	cr = false;
+	whitespace = false;
+	newlines = 0;
+	nonempty = false;
+	constructor(mode) {
+		this.mode = mode;
+	}
+	update(bytes) {
+		const relaxed = this.mode === "relaxed";
+		for (let offset = 0; offset < bytes.length;) {
+			const byte = bytes[offset++];
+			if (this.cr) {
+				this.cr = false;
+				if (byte === 10) {
+					this.whitespace = false;
+					this.newlines++;
+					continue;
+				}
+				this.content(13);
+			}
+			if (byte === 13) this.cr = true;
+			else if (relaxed && (byte === 32 || byte === 9)) this.whitespace = true;
+			else {
+				this.content(byte);
+				const start = offset;
+				while (offset < bytes.length && bytes[offset] !== 13 && (!relaxed || bytes[offset] !== 32 && bytes[offset] !== 9)) offset++;
+				this.emitSpan(bytes, start, offset);
+			}
+		}
+	}
+	emitSpan(bytes, start, end) {
+		while (start < end) {
+			const length = Math.min(end - start, this.buffer.length - this.used);
+			this.buffer.set(bytes.subarray(start, start + length), this.used);
+			this.used += length;
+			start += length;
+			if (this.used === this.buffer.length) {
+				this.hash.update(this.buffer);
+				this.used = 0;
+			}
+		}
+	}
+	content(byte) {
+		if (this.mode === "relaxed" && (byte === 32 || byte === 9)) {
+			this.whitespace = true;
+			return;
+		}
+		while (this.newlines > 0) {
+			this.emit(13);
+			this.emit(10);
+			this.newlines--;
+		}
+		if (this.whitespace) {
+			this.emit(32);
+			this.whitespace = false;
+		}
+		this.emit(byte);
+		this.nonempty = true;
+	}
+	emit(byte) {
+		this.buffer[this.used++] = byte;
+		if (this.used === this.buffer.length) {
+			this.hash.update(this.buffer);
+			this.used = 0;
+		}
+	}
+	digest() {
+		if (this.cr) this.content(13);
+		if (this.nonempty || this.mode === "simple") {
+			this.emit(13);
+			this.emit(10);
+		}
+		this.hash.update(this.buffer.subarray(0, this.used));
+		return this.hash.digest("base64");
+	}
+};
+
+//#endregion
+//#region src/dkim/canonicalize.ts
+/**
+* DKIM Canonicalization algorithms per RFC 6376 Section 3.4.
+*
+* @see https://www.rfc-editor.org/rfc/rfc6376#section-3.4
+* @since 0.4.0
+*/
+/**
+* Simple header canonicalization.
+*
+* The "simple" header canonicalization algorithm does not change header
+* fields in any way. Header fields are presented to the signing or
+* verification algorithm exactly as they are in the message.
+*
+* @param name - The header field name
+* @param value - The header field value
+* @returns The canonicalized header line (name:value)
+* @see RFC 6376 Section 3.4.1
+* @since 0.4.0
+*/
+function canonicalizeHeaderSimple(name, value) {
+	return `${name}:${value}`;
+}
+/**
+* Relaxed header canonicalization.
+*
+* The "relaxed" header canonicalization algorithm:
+* - Convert header field names to lowercase
+* - Unfold header field continuation lines
+* - Collapse whitespace sequences to a single space
+* - Remove leading and trailing whitespace from header field values
+*
+* @param name - The header field name
+* @param value - The header field value
+* @returns The canonicalized header line (name:value)
+* @see RFC 6376 Section 3.4.2
+* @since 0.4.0
+*/
+function canonicalizeHeaderRelaxed(name, value) {
+	const canonicalName = name.toLowerCase();
+	const canonicalValue = value.replace(/\r\n[\t ]+/g, " ").replace(/[\t ]+/g, " ").trim();
+	return `${canonicalName}:${canonicalValue}`;
+}
+
+//#endregion
+//#region src/dkim/sign.ts
+/**
+* Signs frozen headers using a body hash computed by the MIME reader.
+* @param rawHeaders Frozen wire headers, including earlier signatures.
+* @param config Signature configuration.
+* @param bodyHash Canonical body SHA-256 digest, encoded as base64.
+* @param signal Optional cancellation signal.
+* @returns A DKIM-Signature header value.
+* @throws {Error} If key import, signing, or cancellation fails.
+*/
+async function signWithBodyHash(rawHeaders, config, bodyHash, signal) {
+	signal?.throwIfAborted();
+	const algorithm = config.algorithm ?? DEFAULT_ALGORITHM;
+	const canonicalization = config.canonicalization ?? DEFAULT_CANONICALIZATION;
+	const headerFields = config.headerFields ?? DEFAULT_SIGNED_HEADERS;
+	const { headers } = parseMessage(rawHeaders);
+	const [headerCanon] = canonicalization.split("/");
+	const privateKey = await getPrivateKey(config.privateKey, algorithm);
+	signal?.throwIfAborted();
+	const dkimHeaderValue = buildDkimHeaderValue({
+		algorithm,
+		canonicalization,
+		signingDomain: config.signingDomain,
+		selector: config.selector,
+		headerFields,
+		bodyHash
+	});
+	const signatureData = buildSignatureData(headers, headerFields, headerCanon, dkimHeaderValue);
+	const signature = await signData(signatureData, privateKey, algorithm);
+	signal?.throwIfAborted();
+	return {
+		headerName: "DKIM-Signature",
+		signature: `${dkimHeaderValue} b=${signature}`
+	};
+}
+/**
+* Parses a raw email message into headers and body.
+*/
+function parseMessage(rawMessage) {
+	const separatorIndex = rawMessage.indexOf("\r\n\r\n");
+	if (separatorIndex === -1) return {
+		headers: parseHeaders(rawMessage),
+		body: ""
+	};
+	const headerSection = rawMessage.substring(0, separatorIndex);
+	const body = rawMessage.substring(separatorIndex + 4);
+	return {
+		headers: parseHeaders(headerSection),
+		body
+	};
+}
+/**
+* Parses header section into a map of header name to value.
+* Handles folded headers (continuation lines).
+*/
+function parseHeaders(headerSection) {
+	const headers = /* @__PURE__ */ new Map();
+	const lines = headerSection.split("\r\n");
+	let currentName = "";
+	let currentValue = "";
+	for (const line of lines) if (line.startsWith(" ") || line.startsWith("	")) currentValue += "\r\n" + line;
+	else {
+		if (currentName) headers.set(currentName.toLowerCase(), {
+			name: currentName,
+			value: currentValue
+		});
+		const colonIndex = line.indexOf(":");
+		if (colonIndex > 0) {
+			currentName = line.substring(0, colonIndex);
+			currentValue = line.substring(colonIndex + 1);
+		}
+	}
+	if (currentName) headers.set(currentName.toLowerCase(), {
+		name: currentName,
+		value: currentValue
+	});
+	return headers;
+}
+/**
+* Gets the private key, either using a provided CryptoKey or importing from PEM.
+*/
+function getPrivateKey(key, algorithm) {
+	if (typeof key !== "string") return key;
+	return importPrivateKey(key, algorithm);
+}
+/**
+* Imports a PEM-encoded private key for use with Web Crypto API.
+*/
+async function importPrivateKey(pem, algorithm) {
+	try {
+		const pemContents = pem.replace(/-----BEGIN (?:RSA )?PRIVATE KEY-----/, "").replace(/-----END (?:RSA )?PRIVATE KEY-----/, "").replace(/\s/g, "");
+		const binaryString = atob(pemContents);
+		const bytes = new Uint8Array(binaryString.length);
+		for (let i = 0; i < binaryString.length; i++) bytes[i] = binaryString.charCodeAt(i);
+		const keyAlgorithm = algorithm === "ed25519-sha256" ? { name: "Ed25519" } : {
+			name: "RSASSA-PKCS1-v1_5",
+			hash: "SHA-256"
+		};
+		return await crypto.subtle.importKey("pkcs8", bytes, keyAlgorithm, false, ["sign"]);
+	} catch (error) {
+		throw new Error(`Failed to import private key: ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+/**
+* Builds the DKIM-Signature header value without the b= signature.
+*/
+function buildDkimHeaderValue(params) {
+	const parts = [
+		"v=1",
+		`a=${params.algorithm}`,
+		`c=${params.canonicalization}`,
+		`d=${params.signingDomain}`,
+		`s=${params.selector}`,
+		`h=${params.headerFields.join(":")}`,
+		`bh=${params.bodyHash};`
+	];
+	return parts.join("; ");
+}
+/**
+* Builds the data to be signed (canonicalized headers + DKIM-Signature header).
+*/
+function buildSignatureData(headers, headerFields, canonMethod, dkimHeaderValue) {
+	const lines = [];
+	for (const field of headerFields) {
+		const header = headers.get(field.toLowerCase());
+		if (header !== void 0) {
+			const canonicalized = canonMethod === "relaxed" ? canonicalizeHeaderRelaxed(header.name, header.value) : canonicalizeHeaderSimple(header.name, header.value);
+			lines.push(canonicalized);
+		}
+	}
+	const dkimHeader = canonMethod === "relaxed" ? canonicalizeHeaderRelaxed("DKIM-Signature", " " + dkimHeaderValue + " b=") : canonicalizeHeaderSimple("DKIM-Signature", " " + dkimHeaderValue + " b=");
+	lines.push(dkimHeader);
+	return lines.join("\r\n");
+}
+/**
+* Signs data using the appropriate algorithm.
+*/
+async function signData(data, privateKey, algorithm) {
+	const encoder = new TextEncoder();
+	const dataBuffer = encoder.encode(data);
+	const signAlgorithm = algorithm === "ed25519-sha256" ? "Ed25519" : "RSASSA-PKCS1-v1_5";
+	const signingInput = algorithm === "ed25519-sha256" ? await crypto.subtle.digest("SHA-256", dataBuffer) : dataBuffer;
+	const signature = await crypto.subtle.sign(signAlgorithm, privateKey, signingInput);
+	return arrayBufferToBase64(signature);
+}
+/**
+* Converts an ArrayBuffer to a Base64 string.
+*/
+function arrayBufferToBase64(buffer) {
+	const bytes = new Uint8Array(buffer);
+	let binary = "";
+	for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+	return btoa(binary);
+}
+
+//#endregion
+//#region src/message-stream.ts
+/**
+* A replayable attachment changed between DKIM body reads.
+* @since 0.6.0
+*/
+var SmtpAttachmentReplayError = class extends TypeError {
+	/** Creates a replay validation failure. */
+	constructor() {
+		super("Attachment content changed between DKIM body reads.");
+		this.name = "SmtpAttachmentReplayError";
+	}
+};
+/** Prepares signatures and sizes without consuming unsigned factory sources. */
+async function prepareMessageStream(plan, checkSize, progress, signal) {
+	const knownSize = await plan.size(signal, checkSize);
+	if (knownSize != null) checkSize(knownSize);
+	const signatures = plan.dkim?.signatures ?? [];
+	if (signatures.length === 0) return {
+		size: knownSize,
+		async *read(signal$1, progress$1) {
+			yield node_buffer.Buffer.from(plan.headers);
+			yield* plan.body(signal$1, progress$1);
+		}
+	};
+	const buffered = plan.dkim?.bodyMode !== "streaming";
+	const chunks = [];
+	const hashes = /* @__PURE__ */ new Map();
+	for (const sig of signatures) {
+		const mode = sig.canonicalization?.endsWith("/simple") ? "simple" : "relaxed";
+		if (!hashes.has(mode)) hashes.set(mode, new BodyHasher(mode));
+	}
+	const rawHash = (0, node_crypto.createHash)("sha256");
+	let length = 0;
+	const headerLength = node_buffer.Buffer.byteLength(plan.headers);
+	for await (const chunk of plan.body(signal, progress)) {
+		length += chunk.length;
+		checkSize(headerLength + length);
+		if (chunk.length > 0) progress();
+		if (buffered) chunks.push(chunk.slice());
+		rawHash.update(chunk);
+		for (const hash of hashes.values()) hash.update(chunk);
+	}
+	const expectedDigest = rawHash.digest("hex");
+	const bodyHashes = new Map(Array.from(hashes, ([mode, hash]) => [mode, hash.digest()]));
+	let headers = plan.headers;
+	try {
+		for (const sig of signatures) {
+			const mode = sig.canonicalization?.endsWith("/simple") ? "simple" : "relaxed";
+			const result = await signWithBodyHash(headers, sig, bodyHashes.get(mode), signal);
+			headers = `${result.headerName}: ${result.signature}\r\n${headers}`;
+		}
+	} catch (error) {
+		signal?.throwIfAborted();
+		if (plan.dkim?.onSigningFailure !== "send-unsigned") throw error;
+		console.warn("DKIM signing failed, sending unsigned:", error);
+	}
+	const size = node_buffer.Buffer.byteLength(headers) + length;
+	checkSize(size);
+	return {
+		size,
+		async *read(signal$1, progress$1) {
+			yield node_buffer.Buffer.from(headers);
+			if (buffered) {
+				for (const chunk of chunks) {
+					signal$1?.throwIfAborted();
+					yield chunk;
+				}
+				return;
+			}
+			const replayHash = (0, node_crypto.createHash)("sha256");
+			let replayLength = 0;
+			for await (const chunk of plan.body(signal$1, progress$1)) {
+				replayLength += chunk.length;
+				if (replayLength > length) throw new SmtpAttachmentReplayError();
+				replayHash.update(chunk);
+				yield chunk;
+			}
+			if (replayLength !== length || replayHash.digest("hex") !== expectedDigest) throw new SmtpAttachmentReplayError();
+		}
+	};
+}
+
+//#endregion
+//#region src/data-stream.ts
+/** Races preparation against source inactivity and remote socket termination. */
+async function prepareOnSocket(socket, timeoutMs, prepare, signal) {
+	const controller = new AbortController();
+	const combined = (0, __upyo_core.combineSignals)(controller.signal, signal);
+	const fail = (error) => controller.abort(error);
+	const closed = () => fail(/* @__PURE__ */ new TypeError("SMTP connection closed during message preparation."));
+	const data = () => fail(/* @__PURE__ */ new TypeError("Unexpected SMTP reply during message preparation."));
+	let timer;
+	const progress = () => {
+		clearTimeout(timer);
+		timer = setTimeout(() => fail(/* @__PURE__ */ new TypeError("SMTP message preparation timeout.")), timeoutMs);
+	};
+	socket.on("error", fail);
+	socket.on("close", closed);
+	socket.on("data", data);
+	progress();
+	try {
+		if (socket.destroyed || !socket.writable) closed();
+		combined.signal.throwIfAborted();
+		return await abortable(prepare(combined.signal, progress), combined.signal);
+	} catch (error) {
+		const interrupted = combined.signal.aborted;
+		controller.abort(error);
+		if (interrupted) socket.destroy();
+		signal?.throwIfAborted();
+		throw error;
+	} finally {
+		clearTimeout(timer);
+		socket.off("error", fail);
+		socket.off("close", closed);
+		socket.off("data", data);
+		combined.cleanup();
+	}
+}
+function abortable(promise, signal) {
+	return new Promise((resolve, reject) => {
+		const abort = () => reject(signal.reason);
+		signal.addEventListener("abort", abort, { once: true });
+		promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+		if (signal.aborted) abort();
+	});
+}
+/** Writes one DATA body with bounded transparency buffers and backpressure. */
+async function writeMessageData(socket, source, timeoutMs, checkSize, signal) {
+	const controller = new AbortController();
+	const combined = (0, __upyo_core.combineSignals)(controller.signal, signal);
+	const owned = combined.signal;
+	let terminated = false;
+	let complete = false;
+	let replyBytes = 0;
+	let buffer = "";
+	const lines = [];
+	let resolveReply;
+	const reply = new Promise((resolve) => resolveReply = resolve);
+	const fail = (error) => {
+		if (!owned.aborted) controller.abort(error);
+		socket.destroy();
+	};
+	const close = () => fail(/* @__PURE__ */ new TypeError("SMTP connection closed during DATA."));
+	const onAbort = () => socket.destroy();
+	let timer;
+	const progress = () => {
+		clearTimeout(timer);
+		timer = setTimeout(() => fail(/* @__PURE__ */ new TypeError("SMTP DATA timeout.")), timeoutMs);
+	};
+	const data = (chunk) => {
+		replyBytes += chunk.length;
+		if (replyBytes > 65536) {
+			fail(/* @__PURE__ */ new RangeError("SMTP DATA reply exceeds 64 KiB."));
+			return;
+		}
+		buffer += node_buffer.Buffer.from(chunk).toString("utf8");
+		let end;
+		while ((end = buffer.indexOf("\r\n")) >= 0) {
+			const line = buffer.slice(0, end);
+			buffer = buffer.slice(end + 2);
+			lines.push(line);
+			if (/^\d{3} /.test(line)) {
+				if (!terminated) fail(/* @__PURE__ */ new TypeError(`Premature SMTP DATA reply: ${line}`));
+				else resolveReply({
+					code: Number(line.slice(0, 3)),
+					message: line.slice(4),
+					raw: lines.join("\r\n")
+				});
+				return;
+			}
+		}
+	};
+	socket.on("error", fail);
+	socket.on("close", close);
+	socket.on("data", data);
+	owned.addEventListener("abort", onAbort, { once: true });
+	progress();
+	let iterator;
+	async function write(bytes) {
+		owned.throwIfAborted();
+		await abortable(new Promise((resolve, reject) => {
+			let written = false;
+			let drained = false;
+			let returned = false;
+			const cleanup = () => {
+				socket.off("drain", drain);
+				owned.removeEventListener("abort", cleanup);
+			};
+			const finish = () => {
+				if (returned && written && drained) {
+					cleanup();
+					progress();
+					resolve();
+				}
+			};
+			const drain = () => {
+				drained = true;
+				finish();
+			};
+			socket.once("drain", drain);
+			owned.addEventListener("abort", cleanup, { once: true });
+			try {
+				const accepted = socket.write(bytes, (error) => {
+					if (error != null) {
+						cleanup();
+						reject(error);
+						return;
+					}
+					written = true;
+					finish();
+				});
+				drained = accepted || drained;
+				returned = true;
+				finish();
+			} catch (error) {
+				cleanup();
+				reject(error);
+			}
+		}), owned);
+	}
+	try {
+		iterator = source(owned, progress)[Symbol.asyncIterator]();
+		if (socket.destroyed || !socket.writable) close();
+		let lineStart = true;
+		let size = 0;
+		while (true) {
+			owned.throwIfAborted();
+			const item = await abortable(Promise.resolve(iterator.next()), owned);
+			if (item.done) break;
+			const chunk = item.value;
+			for (let offset = 0; offset < chunk.length; offset += 32768) {
+				const window = chunk.subarray(offset, offset + 32768);
+				size += window.length;
+				checkSize(size);
+				progress();
+				const output = node_buffer.Buffer.allocUnsafe(window.length * 2);
+				let length = 0;
+				for (const byte of window) {
+					if (lineStart && byte === 46) output[length++] = 46;
+					output[length++] = byte;
+					lineStart = byte === 10;
+				}
+				await write(output.subarray(0, length));
+			}
+		}
+		owned.throwIfAborted();
+		terminated = true;
+		await write(node_buffer.Buffer.from(".\r\n"));
+		const result = await abortable(reply, owned);
+		owned.throwIfAborted();
+		complete = true;
+		return result;
+	} catch (error) {
+		fail(error);
+		signal?.throwIfAborted();
+		throw owned.reason;
+	} finally {
+		if (!complete) try {
+			Promise.resolve(iterator?.return?.()).catch(() => {});
+		} catch {}
+		clearTimeout(timer);
+		socket.off("error", fail);
+		socket.off("close", close);
+		socket.off("data", data);
+		owned.removeEventListener("abort", onAbort);
+		combined.cleanup();
+	}
+}
+
 //#endregion
 //#region src/smtp-status-code.ts
 /**
@@ -503,13 +1094,13 @@ function parseEnhancedSmtpStatusCode(replyCode, response) {
 * Error thrown when a message exceeds the fixed limit advertised through the
 * SMTP SIZE extension.
 *
-* The check happens before `MAIL FROM`, so the SMTP connection remains usable
-* for another message.
+* Known sizes are checked before `MAIL FROM`. Unknown source sizes are also
+* checked while writing DATA; those failures make the connection unusable.
 *
 * @since 0.6.0
 */
 var SmtpMessageSizeError = class extends RangeError {
-	/** The encoded message size in octets. */
+	/** Exact known size, or the octets counted when an unknown source is stopped. */
 	actualSize;
 	/** The fixed maximum advertised by the SMTP server. */
 	maximumSize;
@@ -518,9 +1109,11 @@ var SmtpMessageSizeError = class extends RangeError {
 	*
 	* @param actualSize The encoded message size in octets.
 	* @param maximumSize The fixed maximum advertised by the SMTP server.
+	* @param phase Whether the failure occurred before or during DATA.
 	*/
-	constructor(actualSize, maximumSize) {
+	constructor(actualSize, maximumSize, phase = "preflight") {
 		super(`Message size ${actualSize} octets exceeds the server's maximum of ${maximumSize} octets.`);
+		this.phase = phase;
 		this.name = "SmtpMessageSizeError";
 		this.actualSize = actualSize;
 		this.maximumSize = maximumSize;
@@ -715,6 +1308,16 @@ var SmtpConnection = class {
 	authenticated = false;
 	capabilities = [];
 	tokenManager;
+	active = false;
+	get usable() {
+		return this.socket != null && !this.socket.destroyed && this.socket.writable;
+	}
+	observeSocket(socket) {
+		socket.on("error", () => socket.destroy());
+		socket.on("timeout", () => {
+			if (!this.active) socket.destroy();
+		});
+	}
 	constructor(config, tokenManager) {
 		this.config = createSmtpConfig(config);
 		this.tokenManager = tokenManager ?? null;
@@ -724,17 +1327,31 @@ var SmtpConnection = class {
 		signal?.throwIfAborted();
 		return new Promise((resolve, reject) => {
 			const timeout = setTimeout(() => {
+				onError(/* @__PURE__ */ new TypeError("Connection timeout."));
 				this.socket?.destroy();
-				reject(/* @__PURE__ */ new Error("Connection timeout"));
 			}, this.config.connectionTimeout);
-			const onConnect = () => {
+			const cleanup = () => {
 				clearTimeout(timeout);
+				this.socket?.off("connect", onConnect);
+				this.socket?.off("error", onError);
+				this.socket?.off("close", onClose);
+				this.socket?.off("timeout", onTimeout);
+			};
+			const onConnect = () => {
+				cleanup();
 				resolve();
 			};
 			const onError = (error) => {
-				clearTimeout(timeout);
+				cleanup();
 				reject(error);
 			};
+			const onClose = () => {
+				onError(/* @__PURE__ */ new TypeError("SMTP connection closed before establishment."));
+			};
+			const onTimeout = () => {
+				onError(/* @__PURE__ */ new TypeError("Socket timeout."));
+				this.socket?.destroy();
+			};
 			if (this.config.secure) this.socket = (0, node_tls.connect)({
 				host: this.config.host,
 				port: this.config.port,
@@ -750,13 +1367,11 @@ var SmtpConnection = class {
 				this.socket.connect(this.config.port, this.config.host);
 			}
 			this.socket.setTimeout(this.config.socketTimeout);
+			this.observeSocket(this.socket);
 			this.socket.once("connect", onConnect);
 			this.socket.once("error", onError);
-			this.socket.once("timeout", () => {
-				clearTimeout(timeout);
-				this.socket?.destroy();
-				reject(/* @__PURE__ */ new Error("Socket timeout"));
-			});
+			this.socket.once("close", onClose);
+			this.socket.once("timeout", onTimeout);
 		});
 	}
 	sendCommand(command, signal) {
@@ -789,7 +1404,7 @@ var SmtpConnection = class {
 				buffer += data.toString();
 				const lines = buffer.split("\r\n");
 				const incompleteLine = lines.pop() || "";
-				for (const line of lines) {
+				for (const [lineIndex, line] of lines.entries()) {
 					responseLines.push(line);
 					if (line.length >= 4 && line[3] === " ") {
 						const code = parseInt(line.substring(0, 3), 10);
@@ -804,6 +1419,11 @@ var SmtpConnection = class {
 						responseLines = [];
 						if (responses.length === commands.length) {
 							cleanup();
+							if (commands[0] === "DATA" && (lineIndex + 1 < lines.length || incompleteLine.length > 0)) {
+								this.socket?.destroy();
+								reject(/* @__PURE__ */ new TypeError("Premature SMTP reply after DATA readiness."));
+								return;
+							}
 							resolve(responses);
 							return;
 						}
@@ -914,6 +1534,7 @@ var SmtpConnection = class {
 				reject(/* @__PURE__ */ new Error("STARTTLS upgrade timeout"));
 			}, this.config.connectionTimeout);
 			const plainSocket = this.socket;
+			plainSocket.setTimeout(0);
 			const tlsSocket = (0, node_tls.connect)({
 				socket: plainSocket,
 				host: this.config.host,
@@ -926,7 +1547,9 @@ var SmtpConnection = class {
 			});
 			const onSecureConnect = () => {
 				clearTimeout(timeout);
+				tlsSocket.off("error", onError);
 				this.socket = tlsSocket;
+				this.observeSocket(tlsSocket);
 				this.socket.setTimeout(this.config.socketTimeout);
 				resolve();
 			};
@@ -937,11 +1560,6 @@ var SmtpConnection = class {
 			};
 			tlsSocket.once("secureConnect", onSecureConnect);
 			tlsSocket.once("error", onError);
-			tlsSocket.once("timeout", () => {
-				clearTimeout(timeout);
-				tlsSocket.destroy();
-				reject(/* @__PURE__ */ new Error("TLS upgrade timeout"));
-			});
 		});
 	}
 	async authenticate(signal) {
@@ -1055,6 +1673,16 @@ var SmtpConnection = class {
 		throw new SmtpAuthResponseError(`${mechanism} authentication failed: ${response.message}`, response.code, `AUTH ${mechanism}`, response.message);
 	}
 	async sendMessage(message, signal) {
+		this.active = true;
+		this.socket?.setTimeout(0);
+		try {
+			return await this.sendPreparedMessage(message, signal);
+		} finally {
+			this.active = false;
+			if (this.usable) this.socket?.setTimeout(this.config.socketTimeout);
+		}
+	}
+	async sendPreparedMessage(message, signal) {
 		signal?.throwIfAborted();
 		let smtpUtf8Parameters = "";
 		if (message.requiresSmtpUtf8 === true) {
@@ -1064,14 +1692,25 @@ var SmtpConnection = class {
 		}
 		const sizeCapability = parseSizeCapability(this.capabilities);
 		let sizeParameter = "";
-		if (sizeCapability != null) {
-			const messageSize = node_buffer.Buffer.byteLength(message.raw, "utf8") + CRLF_LENGTH;
-			if (sizeCapability.maximum != null && BigInt(messageSize) > sizeCapability.maximum) throw new SmtpMessageSizeError(messageSize, sizeCapability.maximum);
-			sizeParameter = ` SIZE=${messageSize}`;
-		}
 		const dsn = message.envelope.dsn;
 		if (dsn != null && !this.capabilities.some((capability) => /^DSN[ \t]*$/i.test(capability))) throw new SmtpDsnUnsupportedError();
 		const mailDsnParameters = dsn == null || dsn.mailParameters.length === 0 ? "" : ` ${dsn.mailParameters.join(" ")}`;
+		const checkSize = (size, phase = "preflight") => {
+			if (!Number.isSafeInteger(size)) throw new RangeError("Message size exceeds the safe integer range.");
+			if (sizeCapability?.maximum != null && BigInt(size) > sizeCapability.maximum) throw new SmtpMessageSizeError(size, sizeCapability.maximum, phase);
+		};
+		if (!this.socket || !this.usable) throw new TypeError("SMTP connection is closed.");
+		const stream = "raw" in message ? {
+			size: node_buffer.Buffer.byteLength(message.raw) + 2,
+			async *read(signal$1) {
+				signal$1?.throwIfAborted();
+				yield node_buffer.Buffer.from(message.raw + "\r\n");
+			}
+		} : await prepareOnSocket(this.socket, this.config.socketTimeout, (signal$1, progress) => prepareMessageStream(message, checkSize, progress, signal$1), signal);
+		if (stream.size != null) {
+			checkSize(stream.size);
+			if (sizeCapability != null) sizeParameter = ` SIZE=${stream.size}`;
+		}
 		const mailCommand = `MAIL FROM:<${message.envelope.from ?? ""}>${sizeParameter}${smtpUtf8Parameters}${mailDsnParameters}`;
 		const recipientCommands = message.envelope.to.map((recipient, index) => {
 			const parameters = dsn?.recipientParameters[index] ?? [];
@@ -1120,8 +1759,7 @@ var SmtpConnection = class {
 		}
 		const dataResponse = await this.sendCommand("DATA", signal);
 		if (dataResponse.code !== 354) throw new SmtpResponseError(`DATA failed: ${dataResponse.message}`, dataResponse.code, "DATA", dataResponse.message);
-		const content = message.raw.replace(/\n\./g, "\n..");
-		const finalResponse = await this.sendCommand(`${content}\r\n.`, signal);
+		const finalResponse = await writeMessageData(this.socket, (signal$1, progress) => stream.read(signal$1, progress), this.config.socketTimeout, (size) => checkSize(size, "data"), signal);
 		if (finalResponse.code !== 250) throw new SmtpResponseError(`Message send failed: ${finalResponse.message}`, finalResponse.code, "DATA_END", finalResponse.message);
 		const messageId = this.extractMessageId(finalResponse.message);
 		return {
@@ -1271,296 +1909,71 @@ function resolveSmtpEnvelope(message, override) {
 }
 
 //#endregion
-//#region src/dkim/canonicalize.ts
-/**
-* DKIM Canonicalization algorithms per RFC 6376 Section 3.4.
-*
-* @see https://www.rfc-editor.org/rfc/rfc6376#section-3.4
-* @since 0.4.0
-*/
-/**
-* Simple header canonicalization.
-*
-* The "simple" header canonicalization algorithm does not change header
-* fields in any way. Header fields are presented to the signing or
-* verification algorithm exactly as they are in the message.
-*
-* @param name - The header field name
-* @param value - The header field value
-* @returns The canonicalized header line (name:value)
-* @see RFC 6376 Section 3.4.1
-* @since 0.4.0
-*/
-function canonicalizeHeaderSimple(name, value) {
-	return `${name}:${value}`;
-}
-/**
-* Relaxed header canonicalization.
-*
-* The "relaxed" header canonicalization algorithm:
-* - Convert header field names to lowercase
-* - Unfold header field continuation lines
-* - Collapse whitespace sequences to a single space
-* - Remove leading and trailing whitespace from header field values
-*
-* @param name - The header field name
-* @param value - The header field value
-* @returns The canonicalized header line (name:value)
-* @see RFC 6376 Section 3.4.2
-* @since 0.4.0
-*/
-function canonicalizeHeaderRelaxed(name, value) {
-	const canonicalName = name.toLowerCase();
-	const canonicalValue = value.replace(/\r\n[\t ]+/g, " ").replace(/[\t ]+/g, " ").trim();
-	return `${canonicalName}:${canonicalValue}`;
-}
-/**
-* Simple body canonicalization.
-*
-* The "simple" body canonicalization algorithm:
-* - Ignores all empty lines at the end of the message body
-* - If the body is empty, a single CRLF is appended
-* - If there is no trailing CRLF on the body, a CRLF is added
-*
-* @param body - The message body
-* @returns The canonicalized body
-* @see RFC 6376 Section 3.4.3
-* @since 0.4.0
-*/
-function canonicalizeBodySimple(body) {
-	if (body === "") return "\r\n";
-	let result = body.replace(/(\r\n)+$/, "");
-	if (!result.endsWith("\r\n")) result += "\r\n";
-	return result;
-}
-/**
-* Relaxed body canonicalization.
-*
-* The "relaxed" body canonicalization algorithm:
-* - Reduce all sequences of WSP within a line to a single SP
-* - Remove all trailing WSP at the end of each line (before CRLF)
-* - Ignore all empty lines at the end of the message body
-* - If the body is non-empty and doesn't end with CRLF, add CRLF
-*
-* @param body - The message body
-* @returns The canonicalized body
-* @see RFC 6376 Section 3.4.4
-* @since 0.4.0
-*/
-function canonicalizeBodyRelaxed(body) {
-	if (body === "") return "";
-	let processedBody = body;
-	if (!processedBody.endsWith("\r\n")) processedBody += "\r\n";
-	const lines = processedBody.split("\r\n");
-	const canonicalizedLines = [];
-	for (let i = 0; i < lines.length - 1; i++) {
-		let line = lines[i];
-		line = line.replace(/[\t ]+/g, " ");
-		line = line.replace(/[\t ]+$/, "");
-		canonicalizedLines.push(line);
-	}
-	while (canonicalizedLines.length > 0 && canonicalizedLines[canonicalizedLines.length - 1] === "") canonicalizedLines.pop();
-	if (canonicalizedLines.length === 0) return "";
-	return canonicalizedLines.join("\r\n") + "\r\n";
-}
-
-//#endregion
-//#region src/dkim/types.ts
-/**
-* Default header fields to sign if not specified.
-*
-* @since 0.4.0
-*/
-const DEFAULT_SIGNED_HEADERS = [
-	"from",
-	"to",
-	"subject",
-	"date"
-];
-/**
-* Default DKIM algorithm.
-*
-* @since 0.4.0
-*/
-const DEFAULT_ALGORITHM = "rsa-sha256";
-/**
-* Default canonicalization method.
-*
-* @since 0.4.0
-*/
-const DEFAULT_CANONICALIZATION = "relaxed/relaxed";
-
-//#endregion
-//#region src/dkim/sign.ts
-/**
-* Signs a raw email message with DKIM.
-*
-* @param rawMessage - The complete raw email message (headers + body)
-* @param config - DKIM signature configuration
-* @returns The DKIM-Signature header result
-* @throws Error if signing fails (e.g., invalid private key)
-* @since 0.4.0
-*/
-async function signMessage(rawMessage, config) {
-	const algorithm = config.algorithm ?? DEFAULT_ALGORITHM;
-	const canonicalization = config.canonicalization ?? DEFAULT_CANONICALIZATION;
-	const headerFields = config.headerFields ?? DEFAULT_SIGNED_HEADERS;
-	const { headers, body } = parseMessage(rawMessage);
-	const [headerCanon, bodyCanon] = canonicalization.split("/");
-	const privateKey = await getPrivateKey(config.privateKey, algorithm);
-	const bodyHash = await computeBodyHash(body, bodyCanon);
-	const dkimHeaderValue = buildDkimHeaderValue({
-		algorithm,
-		canonicalization,
-		signingDomain: config.signingDomain,
-		selector: config.selector,
-		headerFields,
-		bodyHash
-	});
-	const signatureData = buildSignatureData(headers, headerFields, headerCanon, dkimHeaderValue);
-	const signature = await signData(signatureData, privateKey, algorithm);
-	return {
-		headerName: "DKIM-Signature",
-		signature: `${dkimHeaderValue} b=${signature}`
-	};
-}
-/**
-* Parses a raw email message into headers and body.
-*/
-function parseMessage(rawMessage) {
-	const separatorIndex = rawMessage.indexOf("\r\n\r\n");
-	if (separatorIndex === -1) return {
-		headers: parseHeaders(rawMessage),
-		body: ""
-	};
-	const headerSection = rawMessage.substring(0, separatorIndex);
-	const body = rawMessage.substring(separatorIndex + 4);
-	return {
-		headers: parseHeaders(headerSection),
-		body
-	};
-}
-/**
-* Parses header section into a map of header name to value.
-* Handles folded headers (continuation lines).
-*/
-function parseHeaders(headerSection) {
-	const headers = /* @__PURE__ */ new Map();
-	const lines = headerSection.split("\r\n");
-	let currentName = "";
-	let currentValue = "";
-	for (const line of lines) if (line.startsWith(" ") || line.startsWith("	")) currentValue += "\r\n" + line;
-	else {
-		if (currentName) headers.set(currentName.toLowerCase(), currentValue);
-		const colonIndex = line.indexOf(":");
-		if (colonIndex > 0) {
-			currentName = line.substring(0, colonIndex);
-			currentValue = line.substring(colonIndex + 1);
+//#region src/mime-stream.ts
+/** Encodes base64 without retaining producer-owned carry bytes. */
+async function* encodeAttachment(content, signal, progress) {
+	const carry = new Uint8Array(3);
+	let carried = 0;
+	let column = 0;
+	function wrap(encoded) {
+		const parts = [];
+		let offset = 0;
+		while (offset < encoded.length) {
+			if (column === 76) {
+				parts.push("\r\n");
+				column = 0;
+			}
+			const take = Math.min(76 - column, encoded.length - offset);
+			parts.push(encoded.slice(offset, offset + take));
+			offset += take;
+			column += take;
 		}
+		return node_buffer.Buffer.from(parts.join(""));
 	}
-	if (currentName) headers.set(currentName.toLowerCase(), currentValue);
-	return headers;
-}
-/**
-* Gets the private key, either using a provided CryptoKey or importing from PEM.
-*/
-function getPrivateKey(key, algorithm) {
-	if (typeof key !== "string") return key;
-	return importPrivateKey(key, algorithm);
-}
-/**
-* Imports a PEM-encoded private key for use with Web Crypto API.
-*/
-async function importPrivateKey(pem, algorithm) {
-	try {
-		const pemContents = pem.replace(/-----BEGIN (?:RSA )?PRIVATE KEY-----/, "").replace(/-----END (?:RSA )?PRIVATE KEY-----/, "").replace(/\s/g, "");
-		const binaryString = atob(pemContents);
-		const bytes = new Uint8Array(binaryString.length);
-		for (let i = 0; i < binaryString.length; i++) bytes[i] = binaryString.charCodeAt(i);
-		const keyAlgorithm = algorithm === "ed25519-sha256" ? { name: "Ed25519" } : {
-			name: "RSASSA-PKCS1-v1_5",
-			hash: "SHA-256"
-		};
-		return await crypto.subtle.importKey("pkcs8", bytes, keyAlgorithm, false, ["sign"]);
-	} catch (error) {
-		throw new Error(`Failed to import private key: ${error instanceof Error ? error.message : String(error)}`);
-	}
-}
-/**
-* Computes the body hash (bh= tag value).
-*/
-async function computeBodyHash(body, canonMethod) {
-	const canonicalBody = canonMethod === "relaxed" ? canonicalizeBodyRelaxed(body) : canonicalizeBodySimple(body);
-	const encoder = new TextEncoder();
-	const data = encoder.encode(canonicalBody);
-	const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-	return arrayBufferToBase64(hashBuffer);
-}
-/**
-* Builds the DKIM-Signature header value without the b= signature.
-*/
-function buildDkimHeaderValue(params) {
-	const parts = [
-		"v=1",
-		`a=${params.algorithm}`,
-		`c=${params.canonicalization}`,
-		`d=${params.signingDomain}`,
-		`s=${params.selector}`,
-		`h=${params.headerFields.join(":")}`,
-		`bh=${params.bodyHash};`
-	];
-	return parts.join("; ");
-}
-/**
-* Builds the data to be signed (canonicalized headers + DKIM-Signature header).
-*/
-function buildSignatureData(headers, headerFields, canonMethod, dkimHeaderValue) {
-	const lines = [];
-	for (const field of headerFields) {
-		const value = headers.get(field.toLowerCase());
-		if (value !== void 0) {
-			const canonicalized = canonMethod === "relaxed" ? canonicalizeHeaderRelaxed(field, value) : canonicalizeHeaderSimple(field, value);
-			lines.push(canonicalized);
+	let processed = 0;
+	for await (const chunk of (0, __upyo_core.iterateAttachmentContent)(content, signal)) {
+		if (chunk.length > 0) progress?.();
+		let offset = 0;
+		if (carried > 0) {
+			while (carried < 3 && offset < chunk.length) carry[carried++] = chunk[offset++];
+			if (carried === 3) {
+				yield wrap(node_buffer.Buffer.from(carry).toString("base64"));
+				carried = 0;
+			}
 		}
+		while (offset + 3 <= chunk.length) {
+			signal?.throwIfAborted();
+			const length = Math.min(45 * 1024, Math.floor((chunk.length - offset) / 3) * 3);
+			yield wrap(node_buffer.Buffer.from(chunk.buffer, chunk.byteOffset + offset, length).toString("base64"));
+			offset += length;
+			processed += length;
+			if (processed >= 1024 * 1024) {
+				await new Promise((resolve) => setTimeout(resolve, 0));
+				processed = 0;
+			}
+		}
+		while (offset < chunk.length) carry[carried++] = chunk[offset++];
 	}
-	const dkimHeader = canonMethod === "relaxed" ? canonicalizeHeaderRelaxed("DKIM-Signature", " " + dkimHeaderValue + " b=") : canonicalizeHeaderSimple("DKIM-Signature", " " + dkimHeaderValue + " b=");
-	lines.push(dkimHeader);
-	return lines.join("\r\n");
-}
-/**
-* Signs data using the appropriate algorithm.
-*/
-async function signData(data, privateKey, algorithm) {
-	const encoder = new TextEncoder();
-	const dataBuffer = encoder.encode(data);
-	const signAlgorithm = algorithm === "ed25519-sha256" ? "Ed25519" : "RSASSA-PKCS1-v1_5";
-	const signature = await crypto.subtle.sign(signAlgorithm, privateKey, dataBuffer);
-	return arrayBufferToBase64(signature);
+	if (carried > 0) yield wrap(node_buffer.Buffer.from(carry.subarray(0, carried)).toString("base64"));
 }
-/**
-* Converts an ArrayBuffer to a Base64 string.
-*/
-function arrayBufferToBase64(buffer) {
-	const bytes = new Uint8Array(buffer);
-	let binary = "";
-	for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
-	return btoa(binary);
+/** Encoded payload length, excluding MIME framing and a trailing CRLF. */
+function attachmentEncodedSize(length) {
+	const encoded = 4 * Math.ceil(length / 3);
+	return encoded + (encoded === 0 ? 0 : 2 * Math.floor((encoded - 1) / 76));
 }
 
 //#endregion
 //#region src/message-converter.ts
 /**
-* Converts a message to its SMTP envelope and wire representation.
-*
-* @param message The message to convert.
-* @param dkimConfig Optional DKIM signing configuration.
-* @param dsn Optional validated SMTP delivery status notification parameters.
-* @param resolvedEnvelope The validated effective SMTP envelope.
-* @returns The converted SMTP message.
-* @throws {RangeError} If a header contains a token that cannot be folded
-* within the RFC 5322 hard line-length limit.
+* Freezes message metadata without reading attachment content.
+* @param message Message whose metadata will be frozen.
+* @param dkimConfig Optional signing configuration.
+* @param dsn Validated delivery-status parameters.
+* @param resolvedEnvelope Validated effective SMTP envelope.
+* @returns A deterministic MIME plan for one send attempt.
+* @throws {RangeError} If a header cannot fit the RFC 5322 line limit.
 */
-async function convertMessage(message, dkimConfig, dsn, resolvedEnvelope = resolveSmtpEnvelope(message)) {
+function prepareMessage(message, dkimConfig, dsn, resolvedEnvelope = resolveSmtpEnvelope(message)) {
 	const envelope = {
 		...resolvedEnvelope,
 		dsn
@@ -1573,23 +1986,45 @@ async function convertMessage(message, dkimConfig, dsn, resolvedEnvelope = resol
 	];
 	const envelopeAddresses = [...envelope.from == null ? [] : [envelope.from], ...envelope.to];
 	const requiresSmtpUtf8 = [...headerAddresses, ...envelopeAddresses].some((address) => Array.from(address).some((character) => (character.codePointAt(0) ?? 0) > 127));
-	let raw = await buildRawMessage(message);
-	if (dkimConfig) try {
-		for (const sig of dkimConfig.signatures) {
-			const result = await signMessage(raw, sig);
-			raw = `${result.headerName}: ${result.signature}\r\n${raw}`;
-		}
-	} catch (error) {
-		if (dkimConfig.onSigningFailure === "send-unsigned") console.warn("DKIM signing failed, sending unsigned:", error);
-		else throw error;
-	}
+	const parts = buildMimeParts(message);
+	const first = parts[0];
+	if (typeof first !== "string") throw new TypeError("Missing MIME headers.");
+	const separator = first.indexOf("\r\n\r\n") + 4;
+	const headers = first.slice(0, separator);
+	parts[0] = first.slice(separator);
 	return {
 		envelope,
-		raw,
-		requiresSmtpUtf8
+		requiresSmtpUtf8,
+		dkim: dkimConfig,
+		headers,
+		async *body(signal, progress) {
+			for (const part of parts) {
+				signal?.throwIfAborted();
+				if (typeof part === "string") {
+					const bytes = node_buffer.Buffer.from(part);
+					for (let offset = 0; offset < bytes.length; offset += 65536) yield bytes.subarray(offset, offset + 65536);
+				} else yield* encodeAttachment(part.content, signal, progress);
+			}
+		},
+		async size(signal, checkSize) {
+			let size = node_buffer.Buffer.byteLength(headers);
+			let unknown = false;
+			for (const part of parts) {
+				signal?.throwIfAborted();
+				if (typeof part === "string") size += node_buffer.Buffer.byteLength(part);
+				else {
+					if (part.content instanceof Promise) part.content = await (0, __upyo_core.readAttachmentContent)(part.content, signal);
+					if (typeof part.content === "function") unknown = true;
+					else size += attachmentEncodedSize(part.content instanceof Uint8Array ? part.content.byteLength : part.content.size);
+				}
+				if (!Number.isSafeInteger(size)) throw new RangeError("Message size exceeds the safe integer range.");
+			}
+			checkSize?.(size);
+			return unknown ? void 0 : size;
+		}
 	};
 }
-async function buildRawMessage(message) {
+function buildMimeParts(message) {
 	const lines = [];
 	const boundary = generateBoundary();
 	const hasAttachments = message.attachments.length > 0;
@@ -1654,7 +2089,7 @@ async function buildRawMessage(message) {
 				lines.push(`Content-ID: <${attachment.contentId}>`);
 			} else lines.push(foldHeader("Content-Disposition", `attachment; ${encodeMimeParameter("filename", attachment.filename)}`));
 			lines.push("");
-			lines.push(encodeBase64(await attachment.content));
+			lines.push({ content: attachment.content });
 		}
 		lines.push("");
 		lines.push(`--${boundary}--`);
@@ -1669,7 +2104,18 @@ async function buildRawMessage(message) {
 		lines.push("");
 		lines.push(encodeQuotedPrintable(message.content.text));
 	}
-	return lines.join("\r\n");
+	const parts = [];
+	let text = "";
+	for (const line of lines) {
+		if (typeof line === "string") text += line;
+		else {
+			parts.push(text, line);
+			text = "";
+		}
+		text += "\r\n";
+	}
+	parts.push(text);
+	return parts;
 }
 function generateBoundary() {
 	return `boundary-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
@@ -1784,10 +2230,6 @@ function encodeQuotedPrintable(text) {
 	}
 	return result;
 }
-function encodeBase64(data) {
-	const base64 = node_buffer.Buffer.from(data).toString("base64");
-	return base64.replace(/(.{76})/g, "$1\r\n").trim();
-}
 
 //#endregion
 //#region src/smtp-transport.ts
@@ -1849,6 +2291,7 @@ var SmtpTransport = class {
 	*               and options.
 	*/
 	constructor(config) {
+		validateDkimBodyMode(config.dkim);
 		this.config = config;
 		this.poolSize = config.poolSize ?? 5;
 		const auth = config.auth;
@@ -1890,7 +2333,7 @@ var SmtpTransport = class {
 			const dsn = resolveSmtpDsn(envelope, options?.dsn);
 			connection = await this.getConnection(options?.signal);
 			options?.signal?.throwIfAborted();
-			const smtpMessage = await convertMessage(message, this.config.dkim, dsn, envelope);
+			const smtpMessage = prepareMessage(message, this.config.dkim, dsn, envelope);
 			options?.signal?.throwIfAborted();
 			const result = await connection.sendMessage(smtpMessage, options?.signal);
 			await this.returnConnection(connection);
@@ -1901,7 +2344,7 @@ var SmtpTransport = class {
 				rejectedRecipients: result.rejectedRecipients
 			};
 		} catch (error) {
-			if (connection != null) if (isReusableLocalFailure(error)) await this.returnConnection(connection);
+			if (connection != null) if (connection.usable && isReusableLocalFailure(error)) await this.returnConnection(connection);
 			else await this.discardConnection(connection);
 			options?.signal?.throwIfAborted();
 			return createSmtpFailure(error instanceof Error ? error.message : String(error), error);
@@ -1965,7 +2408,7 @@ var SmtpTransport = class {
 					try {
 						const envelope = resolveEnvelopeOption(message, options?.envelope, index++);
 						const dsn = resolveSmtpDsn(envelope, options?.dsn);
-						const smtpMessage = await convertMessage(message, this.config.dkim, dsn, envelope);
+						const smtpMessage = prepareMessage(message, this.config.dkim, dsn, envelope);
 						options?.signal?.throwIfAborted();
 						const result = await connection.sendMessage(smtpMessage, options?.signal);
 						yield {
@@ -1976,7 +2419,7 @@ var SmtpTransport = class {
 						};
 					} catch (error) {
 						options?.signal?.throwIfAborted();
-						if (!isReusableLocalFailure(error)) connectionValid = false;
+						if (!connection.usable || !isReusableLocalFailure(error)) connectionValid = false;
 						yield createSmtpFailure(error instanceof Error ? error.message : String(error), error);
 					}
 				}
@@ -1991,7 +2434,7 @@ var SmtpTransport = class {
 					try {
 						const envelope = resolveEnvelopeOption(message, options?.envelope, index++);
 						const dsn = resolveSmtpDsn(envelope, options?.dsn);
-						const smtpMessage = await convertMessage(message, this.config.dkim, dsn, envelope);
+						const smtpMessage = prepareMessage(message, this.config.dkim, dsn, envelope);
 						options?.signal?.throwIfAborted();
 						const result = await connection.sendMessage(smtpMessage, options?.signal);
 						yield {
@@ -2002,7 +2445,7 @@ var SmtpTransport = class {
 						};
 					} catch (error) {
 						options?.signal?.throwIfAborted();
-						if (!isReusableLocalFailure(error)) connectionValid = false;
+						if (!connection.usable || !isReusableLocalFailure(error)) connectionValid = false;
 						yield createSmtpFailure(error instanceof Error ? error.message : String(error), error);
 					}
 				}
@@ -2016,7 +2459,11 @@ var SmtpTransport = class {
 	}
 	async getConnection(signal) {
 		signal?.throwIfAborted();
-		if (this.connectionPool.length > 0) return this.connectionPool.pop();
+		while (this.connectionPool.length > 0) {
+			const connection$1 = this.connectionPool.pop();
+			if (connection$1.usable) return connection$1;
+			await this.discardConnection(connection$1);
+		}
 		const connection = new SmtpConnection(this.config, this.tokenManager);
 		try {
 			await this.connectAndSetup(connection, signal);
@@ -2044,7 +2491,7 @@ var SmtpTransport = class {
 		await connection.authenticate(signal);
 	}
 	async returnConnection(connection) {
-		if (!connection.config.pool) {
+		if (!connection.usable || !connection.config.pool) {
 			await connection.quit();
 			return;
 		}
@@ -2119,6 +2566,13 @@ function createSmtpFailure(message, error) {
 		retryable: false,
 		attempts: 1
 	});
+	if (error instanceof SmtpAttachmentReplayError) return (0, __upyo_core.createFailedReceipt)(message, {
+		provider: "smtp",
+		code: "smtp.attachment-replay-mismatch",
+		category: "validation",
+		retryable: false,
+		attempts: 1
+	});
 	if (error instanceof SmtpMessageSizeError) return (0, __upyo_core.createFailedReceipt)(message, {
 		provider: "smtp",
 		code: "smtp.message-size-exceeded",
@@ -2161,7 +2615,7 @@ function createSmtpFailure(message, error) {
 	});
 }
 function isReusableLocalFailure(error) {
-	return error instanceof SmtpMessageSizeError || error instanceof SmtpUtf8UnsupportedError || error instanceof SmtpEnvelopeValidationError || error instanceof SmtpDsnValidationError || error instanceof SmtpDsnUnsupportedError;
+	return error instanceof SmtpMessageSizeError && error.phase === "preflight" || error instanceof SmtpUtf8UnsupportedError || error instanceof SmtpEnvelopeValidationError || error instanceof SmtpDsnValidationError || error instanceof SmtpDsnUnsupportedError;
 }
 function resolveEnvelopeOption(message, option, index) {
 	let override;
@@ -2213,6 +2667,7 @@ function isSmtpResponseProviderDetails(value) {
 }
 
 //#endregion
+exports.SmtpAttachmentReplayError = SmtpAttachmentReplayError;
 exports.SmtpAuthError = SmtpAuthError;
 exports.SmtpDsnUnsupportedError = SmtpDsnUnsupportedError;
 exports.SmtpDsnValidationError = SmtpDsnValidationError;