@yozz.app/smtp 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Fishball Ltd
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,30 @@
+# @yozz.app/smtp
+
+Transport-agnostic SMTP client core for YOZZ, plus the RFC 5322 message builder.
+
+```bash
+pnpm add @yozz.app/smtp
+```
+
+## The seam
+
+`@yozz.app/smtp` speaks SMTP over any `ByteDuplex` from `@yozz.app/tls`. It knows replies, EHLO
+keywords, AUTH PLAIN / LOGIN, the MAIL / RCPT / DATA sequence and dot-stuffing. It **never knows**
+TLS, certificates or the vault. STARTTLS is not spoken: the transport is already TLS (465).
+
+`buildMessage` turns composer fields into 7-bit bytes: RFC 2047 headers, 7bit or quoted-printable bodies,
+`multipart/alternative` when an HTML rendering is given, `In-Reply-To` + `References` for replies.
+
+## Tests
+
+```bash
+pnpm -F @yozz.app/smtp test
+```
+
+## Live
+
+```bash
+pnpm -F @yozz.app/smtp live                              # banner + EHLO on nine hosts over 465
+YOZZ_SMTP_HOST=smtp.example.com YOZZ_SMTP_USER=me@example.com YOZZ_SMTP_PASSWORD=… \
+  YOZZ_SMTP_TO=me@example.com pnpm -F @yozz.app/smtp live smtp.example.com   # auth + one real send
+```

package/dist/index.d.mts

@@ -0,0 +1,89 @@
+import { ByteDuplex } from "@yozz.app/tls";
+
+//#region src/reply.d.ts
+type SmtpReply = {
+  readonly code: number; /** One entry per line, the `NNN-` / `NNN ` prefix removed. */
+  readonly lines: readonly string[];
+};
+type SmtpFailure = /** The server answered, and the answer was no: 4xx (try later) or 5xx (do not). */{
+  readonly kind: 'reply';
+  readonly code: number;
+  readonly text: string;
+} | {
+  readonly kind: 'closed';
+} | {
+  readonly kind: 'protocol';
+  readonly detail: string;
+} | {
+  readonly kind: 'unsupported';
+  readonly detail: string;
+};
+type SmtpResult<T> = {
+  readonly ok: true;
+  readonly value: T;
+} | {
+  readonly ok: false;
+  readonly reason: SmtpFailure;
+};
+//#endregion
+//#region src/client.d.ts
+type SmtpCapabilities = {
+  /** EHLO keywords, upper-cased, e.g. `SIZE`, `8BITMIME`, `SMTPUTF8`, `PIPELINING`. */readonly keywords: readonly string[]; /** SASL mechanisms from the AUTH line, upper-cased. */
+  readonly auth: readonly string[];
+};
+type SmtpClient = {
+  readonly greeting: () => Promise<SmtpResult<SmtpReply>>;
+  readonly ehlo: (clientName: string) => Promise<SmtpResult<SmtpCapabilities>>; /** PLAIN when offered, else LOGIN; credentials are base64 on the wire, so TLS is assumed. */
+  readonly authenticate: (username: string, password: string) => Promise<SmtpResult<void>>; /** MAIL FROM, one RCPT TO per recipient, DATA, the dot-stuffed message, QUIT is the caller's. */
+  readonly send: (envelope: SmtpEnvelope) => Promise<SmtpResult<SmtpReply>>;
+  readonly quit: () => Promise<SmtpResult<void>>;
+};
+type SmtpEnvelope = {
+  readonly from: string;
+  readonly to: readonly string[]; /** The RFC 5322 message, CRLF line endings, no trailing terminator. */
+  readonly data: Uint8Array;
+};
+/**
+ * RFC 5321 §4.5.2: a line beginning with `.` gets a second `.`; the message ends at `CRLF.CRLF`.
+ * Done on bytes so a body is never decoded and re-encoded on the way out.
+ */
+declare const dotStuff: (data: Uint8Array) => Uint8Array;
+declare const createSmtpClient: (transport: ByteDuplex) => SmtpClient;
+//#endregion
+//#region src/message.d.ts
+/**
+ * An RFC 5322 message as bytes, built from fields the composer owns. Everything non-ASCII is
+ * encoded on the way out (RFC 2047 `=?utf-8?B?…?=` in headers, quoted-printable bodies), so the result is
+ * 7-bit clean and needs nothing from the server. Line endings are CRLF throughout.
+ */
+type MessageInput = {
+  readonly from: {
+    readonly address: string;
+    readonly name?: string;
+  };
+  readonly to: readonly string[]; /** Carbon copies, named in a `Cc` header. Blind copies are the envelope's business, never a header. */
+  readonly cc?: readonly string[];
+  readonly subject: string;
+  readonly date: Date; /** `<local@domain>`; the caller mints it so it can keep the id for its own Sent copy. */
+  readonly messageId: string;
+  readonly text: string; /** When present the message is `multipart/alternative`, text first. */
+  readonly html?: string;
+  readonly inReplyTo?: string; /** When present the whole message becomes `multipart/mixed`: the body first, then each file. */
+  readonly attachments?: readonly MessageAttachment[];
+};
+type MessageAttachment = {
+  readonly filename: string;
+  readonly mimeType: string;
+  readonly content: Uint8Array;
+};
+declare const encodeHeaderText: (value: string) => string;
+/** `Name <addr>` with the name quoted or encoded as its characters require; a bare address otherwise. */
+declare const formatMailbox: ({
+  address,
+  name
+}: MessageInput["from"]) => string;
+/** RFC 5322 §3.3, in the caller's local zone so the header says when the sender wrote it. */
+declare const formatDate: (date: Date) => string;
+declare const buildMessage: (input: MessageInput) => Uint8Array;
+//#endregion
+export { type MessageAttachment, type MessageInput, type SmtpCapabilities, type SmtpClient, type SmtpEnvelope, type SmtpFailure, type SmtpReply, type SmtpResult, buildMessage, createSmtpClient, dotStuff, encodeHeaderText, formatDate, formatMailbox };

package/dist/index.mjs

@@ -0,0 +1,446 @@
+//#region src/reply.ts
+/** RFC 5321 §4.5.3.1.5 says 512 octets; real servers write longer EHLO lines, so a lenient cap. */
+const MAX_LINE_BYTES = 4096;
+/** A reply is a handful of lines; EHLO is the longest real one. Past this the server is not one. */
+const MAX_REPLY_LINES = 64;
+const asciiDecoder = new TextDecoder("ascii");
+/** Lines out of a byte stream, CRLF-terminated, buffered across reads. */
+const createLineReader = (transport) => {
+	let buffer = /* @__PURE__ */ new Uint8Array(0);
+	let isClosed = false;
+	const readLine = async () => {
+		for (;;) {
+			const lf = buffer.indexOf(10);
+			if (lf > MAX_LINE_BYTES || lf === -1 && buffer.length > MAX_LINE_BYTES) return {
+				ok: false,
+				reason: {
+					kind: "protocol",
+					detail: "reply line too long"
+				}
+			};
+			if (lf !== -1) {
+				if (lf === 0 || buffer[lf - 1] !== 13) return {
+					ok: false,
+					reason: {
+						kind: "protocol",
+						detail: "bare LF in reply"
+					}
+				};
+				const line = asciiDecoder.decode(buffer.subarray(0, lf - 1));
+				buffer = buffer.slice(lf + 1);
+				return {
+					ok: true,
+					value: line
+				};
+			}
+			if (isClosed) return {
+				ok: false,
+				reason: { kind: "closed" }
+			};
+			const chunk = await transport.read();
+			if (chunk === null) {
+				isClosed = true;
+				continue;
+			}
+			const merged = new Uint8Array(buffer.length + chunk.length);
+			merged.set(buffer, 0);
+			merged.set(chunk, buffer.length);
+			buffer = merged;
+		}
+	};
+	return { readLine };
+};
+const REPLY_LINE = /^(\d{3})([ -])(.*)$/;
+const readReply = async (reader) => {
+	const lines = [];
+	let code = null;
+	for (;;) {
+		const line = await reader.readLine();
+		if (!line.ok) return line;
+		const match = REPLY_LINE.exec(line.value);
+		if (match === null) return {
+			ok: false,
+			reason: {
+				kind: "protocol",
+				detail: `not a reply line: ${line.value}`
+			}
+		};
+		const [, codeText = "", separator, text = ""] = match;
+		const lineCode = Number(codeText);
+		if (code !== null && lineCode !== code) return {
+			ok: false,
+			reason: {
+				kind: "protocol",
+				detail: `reply code changed from ${code} to ${lineCode}`
+			}
+		};
+		code = lineCode;
+		lines.push(text);
+		if (separator === " ") return {
+			ok: true,
+			value: {
+				code,
+				lines
+			}
+		};
+		if (lines.length >= MAX_REPLY_LINES) return {
+			ok: false,
+			reason: {
+				kind: "protocol",
+				detail: "reply has too many lines"
+			}
+		};
+	}
+};
+//#endregion
+//#region src/client.ts
+const encoder$1 = new TextEncoder();
+const base64$1 = (bytes) => {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary);
+};
+const isSuccess = (code) => code >= 200 && code < 300;
+const refused = (reply) => ({
+	ok: false,
+	reason: {
+		kind: "reply",
+		code: reply.code,
+		text: reply.lines.join(" ")
+	}
+});
+/** A bare address may not contain the characters that would end or alter the command. */
+const isCommandSafe = (address) => /^[^\s<>\r\n]+$/.test(address);
+/**
+* RFC 5321 §4.5.2: a line beginning with `.` gets a second `.`; the message ends at `CRLF.CRLF`.
+* Done on bytes so a body is never decoded and re-encoded on the way out.
+*/
+const dotStuff = (data) => {
+	const out = [];
+	let atLineStart = true;
+	for (const byte of data) {
+		if (atLineStart && byte === 46) out.push(46);
+		out.push(byte);
+		atLineStart = byte === 10;
+	}
+	if (!atLineStart) out.push(13, 10);
+	out.push(46, 13, 10);
+	return Uint8Array.from(out);
+};
+const createSmtpClient = (transport) => {
+	const reader = createLineReader(transport);
+	let inData = false;
+	let capabilities = {
+		keywords: [],
+		auth: []
+	};
+	const command = async (line) => {
+		try {
+			await transport.write(encoder$1.encode(`${line}\r\n`));
+		} catch (error) {
+			return {
+				ok: false,
+				reason: {
+					kind: "protocol",
+					detail: `write failed: ${String(error)}`
+				}
+			};
+		}
+		return readReply(reader);
+	};
+	const expect = async (line, ...codes) => {
+		const reply = await command(line);
+		if (!reply.ok) return reply;
+		return (codes.length === 0 ? isSuccess(reply.value.code) : codes.includes(reply.value.code)) ? reply : refused(reply.value);
+	};
+	const greeting = async () => {
+		const reply = await readReply(reader);
+		if (!reply.ok) return reply;
+		return reply.value.code === 220 ? reply : refused(reply.value);
+	};
+	const ehlo = async (clientName) => {
+		const reply = await expect(`EHLO ${clientName}`, 250);
+		if (!reply.ok) return reply;
+		const keywordLines = reply.value.lines.slice(1).map((line) => line.trim().toUpperCase());
+		const authLine = keywordLines.find((line) => line === "AUTH" || line.startsWith("AUTH "));
+		capabilities = {
+			keywords: keywordLines.map((line) => line.split(" ")[0] ?? line),
+			auth: authLine === void 0 ? [] : authLine.split(" ").slice(1)
+		};
+		return {
+			ok: true,
+			value: capabilities
+		};
+	};
+	const authenticate = async (username, password) => {
+		const mechanisms = capabilities.auth;
+		if (mechanisms.includes("PLAIN")) {
+			const reply = await expect(`AUTH PLAIN ${base64$1(encoder$1.encode(`\0${username}\0${password}`))}`, 235);
+			return reply.ok ? {
+				ok: true,
+				value: void 0
+			} : reply;
+		}
+		if (mechanisms.includes("LOGIN")) {
+			const challenge = await expect("AUTH LOGIN", 334);
+			if (!challenge.ok) return challenge;
+			const user = await expect(base64$1(encoder$1.encode(username)), 334);
+			if (!user.ok) return user;
+			const done = await expect(base64$1(encoder$1.encode(password)), 235);
+			return done.ok ? {
+				ok: true,
+				value: void 0
+			} : done;
+		}
+		return {
+			ok: false,
+			reason: {
+				kind: "unsupported",
+				detail: mechanisms.length === 0 ? "Server offers no AUTH (was EHLO sent?)" : `Server offers only ${mechanisms.join(", ")}`
+			}
+		};
+	};
+	const send = async (envelope) => {
+		for (const address of [envelope.from, ...envelope.to]) if (!isCommandSafe(address)) return {
+			ok: false,
+			reason: {
+				kind: "protocol",
+				detail: `unsafe address: ${address}`
+			}
+		};
+		if (envelope.to.length === 0) return {
+			ok: false,
+			reason: {
+				kind: "protocol",
+				detail: "no recipients"
+			}
+		};
+		const bodyParam = capabilities.keywords.includes("8BITMIME") ? " BODY=8BITMIME" : "";
+		const mailFrom = await expect(`MAIL FROM:<${envelope.from}>${bodyParam}`, 250);
+		if (!mailFrom.ok) return mailFrom;
+		for (const recipient of envelope.to) {
+			const rcpt = await expect(`RCPT TO:<${recipient}>`, 250, 251, 252);
+			if (!rcpt.ok) return rcpt;
+		}
+		const data = await expect("DATA", 354);
+		if (!data.ok) return data;
+		try {
+			await transport.write(dotStuff(envelope.data));
+		} catch (error) {
+			inData = true;
+			return {
+				ok: false,
+				reason: {
+					kind: "protocol",
+					detail: `write failed: ${String(error)}`
+				}
+			};
+		}
+		const accepted = await readReply(reader);
+		if (!accepted.ok) return accepted;
+		return accepted.value.code === 250 ? accepted : refused(accepted.value);
+	};
+	const quit = async () => {
+		if (inData) return {
+			ok: false,
+			reason: {
+				kind: "protocol",
+				detail: "connection abandoned inside DATA"
+			}
+		};
+		const reply = await expect("QUIT", 221);
+		return reply.ok ? {
+			ok: true,
+			value: void 0
+		} : reply;
+	};
+	return {
+		greeting,
+		ehlo,
+		authenticate,
+		send,
+		quit
+	};
+};
+//#endregion
+//#region src/message.ts
+const encoder = new TextEncoder();
+const isAscii = (value) => [...value].every((ch) => ch.charCodeAt(0) >= 32 && ch.charCodeAt(0) <= 126);
+const BASE64_CHUNK = 32768;
+const base64 = (bytes) => {
+	let binary = "";
+	for (let offset = 0; offset < bytes.length; offset += BASE64_CHUNK) binary += String.fromCharCode(...bytes.subarray(offset, offset + BASE64_CHUNK));
+	return btoa(binary);
+};
+/** RFC 2045 §6.8: base64 in lines of 76. */
+const base64Lines = (bytes) => base64(bytes).replace(/.{76}/g, "$&\r\n");
+const toCrlf = (text) => text.replace(/\r?\n/g, "\r\n");
+/**
+* RFC 2045 §6.7 quoted-printable: bytes outside printable ASCII become `=XX`, trailing
+* whitespace is protected, and lines are soft-wrapped with `=` before 76 characters. Chosen over
+* base64 because filters treat a base64 text part as text that is hiding something.
+*/
+const quotedPrintable = (text) => {
+	return toCrlf(text).split("\r\n").map((line) => {
+		let encoded = "";
+		const bytes = encoder.encode(line);
+		bytes.forEach((byte, index) => {
+			const isLast = index === bytes.length - 1;
+			encoded += byte >= 33 && byte <= 126 && byte !== 61 || (byte === 32 || byte === 9) && !isLast ? String.fromCharCode(byte) : `=${byte.toString(16).toUpperCase().padStart(2, "0")}`;
+		});
+		const out = [];
+		let rest = encoded;
+		while (rest.length > 76) {
+			let cut = 75;
+			if (rest[cut - 1] === "=") cut -= 1;
+			else if (rest[cut - 2] === "=") cut -= 2;
+			out.push(`${rest.slice(0, cut)}=`);
+			rest = rest.slice(cut);
+		}
+		out.push(rest);
+		return out.join("\r\n");
+	}).join("\r\n");
+};
+/** 7bit when the text already is (ASCII, lines under 998), quoted-printable otherwise. */
+const encodeBody = (text) => {
+	const crlf = toCrlf(text);
+	return [...crlf].every((ch) => {
+		const code = ch.charCodeAt(0);
+		return code === 13 || code === 10 || code === 9 || code >= 32 && code <= 126;
+	}) && crlf.split("\r\n").every((line) => line.length <= 998) ? {
+		encoding: "7bit",
+		body: crlf
+	} : {
+		encoding: "quoted-printable",
+		body: quotedPrintable(text)
+	};
+};
+const textPartOf = (contentType, text) => {
+	const { encoding, body } = encodeBody(text);
+	return [
+		`Content-Type: ${contentType}; charset=utf-8`,
+		`Content-Transfer-Encoding: ${encoding}`,
+		"",
+		body,
+		""
+	].join("\r\n");
+};
+/**
+* RFC 2231 for a filename: plain ASCII is a quoted-string, anything else goes as
+* `filename*=utf-8''` with the bytes percent-encoded. Both forms name the same file.
+*/
+const filenameParameter = (filename) => isAscii(filename) ? `filename="${filename.replace(/["\\]/g, "\\$&")}"` : `filename*=utf-8''${encodeURIComponent(filename).replace(/[*'()]/g, (ch) => `%${ch.charCodeAt(0).toString(16).toUpperCase()}`)}`;
+const attachmentPartOf = ({ filename, mimeType, content }) => [
+	`Content-Type: ${mimeType}`,
+	`Content-Disposition: attachment; ${filenameParameter(filename)}`,
+	"Content-Transfer-Encoding: base64",
+	"",
+	base64Lines(content),
+	""
+].join("\r\n");
+const multipartOf = (subtype, parts) => {
+	const boundary = `=_yozz_${crypto.randomUUID()}`;
+	return [
+		`Content-Type: multipart/${subtype}; boundary="${boundary}"`,
+		"",
+		...parts.flatMap((part) => [`--${boundary}`, part]),
+		`--${boundary}--`,
+		""
+	].join("\r\n");
+};
+/**
+* RFC 2047 B-encoding. One encoded-word may be at most 75 characters: `=?utf-8?B?` + `?=` is 12,
+* so 63 of base64, which is 45 bytes of UTF-8. Split on code points so no character straddles
+* two words; the words are folded onto continuation lines, which a reader joins back together.
+*/
+const ENCODED_WORD_BYTES = 45;
+const encodedWords = (value) => {
+	const words = [];
+	let chunk = "";
+	for (const ch of value) {
+		if (encoder.encode(chunk + ch).length > ENCODED_WORD_BYTES) {
+			words.push(chunk);
+			chunk = "";
+		}
+		chunk += ch;
+	}
+	words.push(chunk);
+	return words.map((word) => `=?utf-8?B?${base64(encoder.encode(word))}?=`).join("\r\n ");
+};
+/** RFC 5322 §2.2.3 folding for plain ASCII: break at spaces so no line passes 78 characters. */
+const foldAscii = (value) => {
+	const lines = [];
+	let line = "";
+	for (const word of value.split(" ")) if (line !== "" && line.length + 1 + word.length > 76) {
+		lines.push(line);
+		line = word;
+	} else line = line === "" ? word : `${line} ${word}`;
+	lines.push(line);
+	return lines.join("\r\n ");
+};
+const encodeHeaderText = (value) => isAscii(value) ? foldAscii(value) : encodedWords(value);
+/** `Name <addr>` with the name quoted or encoded as its characters require; a bare address otherwise. */
+const formatMailbox = ({ address, name }) => {
+	if (name === void 0 || name.trim() === "") return address;
+	if (!isAscii(name)) return `${encodedWords(name)} <${address}>`;
+	return `${/[()<>[\]:;@\\,."]/.test(name) ? `"${name.replace(/["\\]/g, "\\$&")}"` : name} <${address}>`;
+};
+const DAYS = [
+	"Sun",
+	"Mon",
+	"Tue",
+	"Wed",
+	"Thu",
+	"Fri",
+	"Sat"
+];
+const MONTHS = [
+	"Jan",
+	"Feb",
+	"Mar",
+	"Apr",
+	"May",
+	"Jun",
+	"Jul",
+	"Aug",
+	"Sep",
+	"Oct",
+	"Nov",
+	"Dec"
+];
+const two = (n) => String(n).padStart(2, "0");
+/** RFC 5322 §3.3, in the caller's local zone so the header says when the sender wrote it. */
+const formatDate = (date) => {
+	const offset = -date.getTimezoneOffset();
+	const zone = `${offset < 0 ? "-" : "+"}${two(Math.floor(Math.abs(offset) / 60))}${two(Math.abs(offset) % 60)}`;
+	return `${DAYS[date.getDay()]}, ${date.getDate()} ${MONTHS[date.getMonth()]} ${date.getFullYear()} ${two(date.getHours())}:${two(date.getMinutes())}:${two(date.getSeconds())} ${zone}`;
+};
+/** A header value may not contain CR or LF: a field that could end the header block is refused. */
+const assertNoLineBreak = (field, value) => {
+	if (/[\r\n]/.test(value)) throw new Error(`${field} contains a line break`);
+};
+const buildMessage = (input) => {
+	for (const recipient of input.to) assertNoLineBreak("To", recipient);
+	for (const recipient of input.cc ?? []) assertNoLineBreak("Cc", recipient);
+	assertNoLineBreak("From", input.from.address);
+	assertNoLineBreak("From", input.from.name ?? "");
+	assertNoLineBreak("Message-ID", input.messageId);
+	assertNoLineBreak("In-Reply-To", input.inReplyTo ?? "");
+	const headers = [["From", formatMailbox(input.from)], ...input.to.length === 0 ? [] : [["To", input.to.join(", ")]]];
+	const cc = input.cc ?? [];
+	if (cc.length > 0) headers.push(["Cc", cc.join(", ")]);
+	headers.push(["Subject", encodeHeaderText(input.subject)], ["Date", formatDate(input.date)], ["Message-ID", input.messageId], ["MIME-Version", "1.0"]);
+	if (input.inReplyTo !== void 0) headers.push(["In-Reply-To", input.inReplyTo], ["References", input.inReplyTo]);
+	for (const { filename, mimeType } of input.attachments ?? []) {
+		assertNoLineBreak("filename", filename);
+		assertNoLineBreak("Content-Type", mimeType);
+	}
+	const textPart = textPartOf("text/plain", input.text);
+	const bodyPart = input.html === void 0 ? textPart : multipartOf("alternative", [textPart, textPartOf("text/html", input.html)]);
+	const attachments = input.attachments ?? [];
+	const body = attachments.length === 0 ? bodyPart : multipartOf("mixed", [bodyPart, ...attachments.map(attachmentPartOf)]);
+	const headerBlock = headers.map(([name, value]) => `${name}: ${value}`).join("\r\n");
+	return encoder.encode(`${headerBlock}\r\n${body}`);
+};
+//#endregion
+export { buildMessage, createSmtpClient, dotStuff, encodeHeaderText, formatDate, formatMailbox };

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@yozz.app/smtp",
+  "version": "0.1.0",
+  "description": "Transport-agnostic SMTP client core plus an RFC 5322 message builder.",
+  "license": "MIT",
+  "homepage": "https://github.com/fishballapp/yozz",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/fishballapp/yozz.git",
+    "directory": "packages/smtp"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=24"
+  },
+  "type": "module",
+  "main": "./dist/index.mjs",
+  "types": "./dist/index.d.mts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.mts",
+      "default": "./dist/index.mjs"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@yozz.app/tls": "0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "tsdown": "^0.22.3",
+    "@yozz.app/x509": "0.1.0"
+  },
+  "scripts": {
+    "build": "tsdown src/index.ts --format esm --dts",
+    "test": "vitest run",
+    "live": "node harness/live.ts"
+  }
+}