sently 0.4.6 → 0.5.1

package/dist/chunk-794hc3m4.js

@@ -1,105 +0,0 @@
-// src/core/base64.ts
-var BASE64_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-var BASE64_LINE_LENGTH = 76;
-var encoder = new TextEncoder;
-var decoder = new TextDecoder;
-function encodeBase64(data) {
-  const bytes = typeof data === "string" ? encoder.encode(data) : data;
-  let result = "";
-  let i = 0;
-  while (i < bytes.length) {
-    const b0 = bytes[i] ?? 0;
-    const b1 = bytes[i + 1];
-    const b2 = bytes[i + 2];
-    if (b1 === undefined) {
-      result += BASE64_CHARS[b0 >> 2];
-      result += BASE64_CHARS[(b0 & 3) << 4];
-      result += "==";
-      break;
-    }
-    if (b2 === undefined) {
-      result += BASE64_CHARS[b0 >> 2];
-      result += BASE64_CHARS[(b0 & 3) << 4 | b1 >> 4];
-      result += BASE64_CHARS[(b1 & 15) << 2];
-      result += "=";
-      break;
-    }
-    result += BASE64_CHARS[b0 >> 2];
-    result += BASE64_CHARS[(b0 & 3) << 4 | b1 >> 4];
-    result += BASE64_CHARS[(b1 & 15) << 2 | b2 >> 6];
-    result += BASE64_CHARS[b2 & 63];
-    i += 3;
-  }
-  return wrapBase64Lines(result);
-}
-function decodeBase64(data) {
-  const cleaned = data.replace(/\s/g, "");
-  const len = cleaned.length;
-  if (len === 0) {
-    return new Uint8Array(0);
-  }
-  if (len % 4 !== 0) {
-    throw new Error("Invalid base64 string length");
-  }
-  const padding = cleaned.endsWith("==") ? 2 : cleaned.endsWith("=") ? 1 : 0;
-  const outputLen = len * 3 / 4 - padding;
-  const output = new Uint8Array(outputLen);
-  let outIndex = 0;
-  for (let i = 0;i < len; i += 4) {
-    const c0 = base64CharToValue(cleaned[i] ?? "=");
-    const c1 = base64CharToValue(cleaned[i + 1] ?? "=");
-    const c2 = base64CharToValue(cleaned[i + 2] ?? "=");
-    const c3 = base64CharToValue(cleaned[i + 3] ?? "=");
-    const triple = c0 << 18 | c1 << 12 | c2 << 6 | c3;
-    if (outIndex < outputLen) {
-      output[outIndex++] = triple >> 16 & 255;
-    }
-    if (outIndex < outputLen) {
-      output[outIndex++] = triple >> 8 & 255;
-    }
-    if (outIndex < outputLen) {
-      output[outIndex++] = triple & 255;
-    }
-  }
-  return output;
-}
-function encodeHeader(value) {
-  if (!needsEncoding(value)) {
-    return value;
-  }
-  const encoded = encodeBase64(value).replace(/\r\n/g, "");
-  return `=?UTF-8?B?${encoded}?=`;
-}
-function needsEncoding(text) {
-  for (let i = 0;i < text.length; i++) {
-    if (text.charCodeAt(i) > 127) {
-      return true;
-    }
-  }
-  return false;
-}
-function base64CharToValue(char) {
-  if (char === "=") {
-    return 0;
-  }
-  const index = BASE64_CHARS.indexOf(char);
-  if (index === -1) {
-    throw new Error(`Invalid base64 character: ${char}`);
-  }
-  return index;
-}
-function wrapBase64Lines(base64) {
-  const lines = [];
-  for (let i = 0;i < base64.length; i += BASE64_LINE_LENGTH) {
-    lines.push(base64.slice(i, i + BASE64_LINE_LENGTH));
-  }
-  return lines.join(`\r
-`);
-}
-function encodeUtf8(text) {
-  return encoder.encode(text);
-}
-
-export { encodeBase64, decodeBase64, encodeHeader, encodeUtf8 };
-
-//# debugId=93C9FABDDF825C4864756E2164756E21

package/dist/chunk-7fqv71z1.js

@@ -1,251 +0,0 @@
-import {
-  OAuth2Client
-} from "./chunk-ym3zzv8b.js";
-import {
-  buildMIME
-} from "./chunk-x3szga4k.js";
-import {
-  SMTPError,
-  accumulateResponse,
-  assertResponse,
-  computeCRAMMD5,
-  encodeAuthLoginPass,
-  encodeAuthLoginUser,
-  encodeCommand,
-  encodeLine,
-  parseEHLO,
-  parseResponse,
-  selectAuthMethod
-} from "./chunk-tymfm441.js";
-import {
-  resolveAttachments
-} from "./chunk-f4c9ttmr.js";
-import {
-  __require
-} from "./chunk-v0bahtg2.js";
-
-// src/transports/smtp.ts
-class SMTPTransport {
-  config;
-  adapter = null;
-  constructor(config) {
-    this.config = resolveSMTPConfig(config);
-  }
-  async send(options) {
-    const resolvedOptions = {
-      ...options,
-      attachments: await resolveAttachments(options.attachments)
-    };
-    const mime = await buildMIME(resolvedOptions, this.config.dkim);
-    const adapter = await this.getAdapter();
-    const host = this.config.direct ? await resolveMX(mime.envelope.from.split("@")[1] ?? this.config.host) : this.config.host;
-    await adapter.connect(host, this.config.port);
-    this.adapter = adapter;
-    try {
-      await openSMTPSession(adapter, this.config);
-      return await deliverSMTPMessage(adapter, mime);
-    } finally {
-      await closeSMTPSession(adapter);
-      this.adapter = null;
-    }
-  }
-  async verify() {
-    try {
-      const adapter = await this.getAdapter();
-      await adapter.connect(this.config.host, this.config.port);
-      try {
-        await openSMTPSession(adapter, this.config);
-        return { ok: true, provider: "smtp" };
-      } finally {
-        await closeSMTPSession(adapter);
-      }
-    } catch (err) {
-      return {
-        ok: false,
-        provider: "smtp",
-        message: err instanceof Error ? err.message : String(err)
-      };
-    }
-  }
-  async close() {
-    if (this.adapter) {
-      await this.adapter.close();
-      this.adapter = null;
-    }
-  }
-  async getAdapter() {
-    if (!this.config.adapter) {
-      throw new SMTPError("No socket adapter configured", 0, "CONNECT", "");
-    }
-    return this.config.adapter;
-  }
-}
-function resolveSMTPConfig(config) {
-  const secure = config.secure ?? false;
-  return {
-    host: config.host,
-    port: config.port ?? (secure ? 465 : 587),
-    secure,
-    ...config.auth !== undefined ? { auth: config.auth } : {},
-    ...config.requireTLS !== undefined ? { requireTLS: config.requireTLS } : {},
-    ...config.dkim !== undefined ? { dkim: config.dkim } : {},
-    ...config.tls !== undefined ? { tls: config.tls } : {},
-    ...config.connectionTimeout !== undefined ? { connectionTimeout: config.connectionTimeout } : {},
-    ...config.greetingTimeout !== undefined ? { greetingTimeout: config.greetingTimeout } : {},
-    ...config.socketTimeout !== undefined ? { socketTimeout: config.socketTimeout } : {},
-    ...config.direct !== undefined ? { direct: config.direct } : {},
-    ...config.adapter !== undefined ? { adapter: config.adapter } : {}
-  };
-}
-async function openSMTPSession(adapter, config) {
-  const greeting = await readSMTPResponse(adapter);
-  assertResponse(greeting, [220], "greeting");
-  let capabilities = await ehlo(adapter, config.host);
-  const supportsStartTls = capabilities.some((cap) => cap.toUpperCase() === "STARTTLS");
-  if (!config.secure && !adapter.secure && supportsStartTls) {
-    await sendRaw(adapter, encodeCommand({ type: "STARTTLS" }));
-    const starttlsResp = await readSMTPResponse(adapter);
-    assertResponse(starttlsResp, [220], "STARTTLS");
-    await adapter.startTLS(config.tls);
-    capabilities = await ehlo(adapter, config.host);
-  }
-  if (config.auth) {
-    const tlsRequired = config.requireTLS ?? true;
-    const encrypted = adapter.secure || config.secure;
-    if (tlsRequired && !encrypted) {
-      throw new SMTPError("Refusing to authenticate over unencrypted connection. " + "Set requireTLS: false to disable this check (not recommended).", 0, "AUTH", "");
-    }
-    await authenticate(adapter, config.auth, capabilities);
-  }
-}
-async function deliverSMTPMessage(adapter, mime) {
-  await sendCommand(adapter, { type: "MAIL_FROM", address: mime.envelope.from });
-  const mailResp = await readSMTPResponse(adapter);
-  assertResponse(mailResp, [250], "MAIL FROM");
-  const accepted = [];
-  const rejected = [];
-  for (const recipient of mime.envelope.to) {
-    await sendRaw(adapter, encodeCommand({ type: "RCPT_TO", address: recipient }));
-    const rcptResp = await readSMTPResponse(adapter);
-    if (rcptResp.isSuccess) {
-      accepted.push(recipient);
-    } else {
-      rejected.push(recipient);
-    }
-  }
-  await sendCommand(adapter, { type: "DATA" });
-  const dataResp = await readSMTPResponse(adapter);
-  assertResponse(dataResp, [354], "DATA");
-  let finalResp;
-  try {
-    await sendRaw(adapter, encodeCommand({ type: "DATA_BODY", content: mime.raw }));
-    finalResp = await readSMTPResponse(adapter);
-  } catch (err) {
-    await sendRaw(adapter, encodeCommand({ type: "DATA_BODY", content: mime.raw }));
-    finalResp = await readSMTPResponse(adapter);
-    if (finalResp.isError) {
-      throw err;
-    }
-  }
-  assertResponse(finalResp, [250], "DATA end");
-  return {
-    messageId: mime.messageId,
-    accepted,
-    rejected,
-    response: finalResp.message,
-    envelope: mime.envelope
-  };
-}
-async function closeSMTPSession(adapter) {
-  try {
-    await sendCommand(adapter, { type: "QUIT" });
-    await readSMTPResponse(adapter);
-  } catch {} finally {
-    await adapter.close();
-  }
-}
-async function ehlo(adapter, host) {
-  await sendCommand(adapter, { type: "EHLO", domain: host });
-  const response = await readSMTPResponse(adapter);
-  assertResponse(response, [250], "EHLO");
-  return parseEHLO(response);
-}
-async function authenticate(adapter, auth, capabilities) {
-  if (auth.type === "OAUTH2" && auth.oauth2) {
-    const client = new OAuth2Client(auth.oauth2);
-    const xoauth2 = await client.buildXOAUTH2();
-    await sendCommand(adapter, { type: "AUTH_XOAUTH2", xoauth2String: xoauth2 });
-    let resp2 = await readSMTPResponse(adapter);
-    if (resp2.code === 334) {
-      await sendRaw(adapter, encodeLine(""));
-      resp2 = await readSMTPResponse(adapter);
-    }
-    assertResponse(resp2, [235], "AUTH XOAUTH2");
-    return;
-  }
-  const method = auth.type ?? selectAuthMethod(capabilities);
-  if (method === "CRAM-MD5") {
-    const pass2 = requirePassword(auth, "CRAM-MD5");
-    await sendCommand(adapter, { type: "AUTH_CRAM_MD5_INIT" });
-    let resp2 = await readSMTPResponse(adapter);
-    assertResponse(resp2, [334], "AUTH CRAM-MD5");
-    const challenge = resp2.message.trim();
-    const response = await computeCRAMMD5(challenge, auth.user, pass2);
-    await sendCommand(adapter, { type: "AUTH_CRAM_MD5_RESPONSE", response });
-    resp2 = await readSMTPResponse(adapter);
-    assertResponse(resp2, [235], "AUTH CRAM-MD5 response");
-    return;
-  }
-  if (method === "PLAIN") {
-    const pass2 = requirePassword(auth, "PLAIN");
-    await sendRaw(adapter, encodeCommand({ type: "AUTH_PLAIN", user: auth.user, pass: pass2 }));
-    const resp2 = await readSMTPResponse(adapter);
-    assertResponse(resp2, [235], "AUTH PLAIN");
-    return;
-  }
-  const pass = requirePassword(auth, "LOGIN");
-  await sendRaw(adapter, encodeCommand({ type: "AUTH_LOGIN", user: auth.user, pass }));
-  let resp = await readSMTPResponse(adapter);
-  assertResponse(resp, [334], "AUTH LOGIN");
-  await sendRaw(adapter, encodeAuthLoginUser(auth.user));
-  resp = await readSMTPResponse(adapter);
-  assertResponse(resp, [334], "AUTH LOGIN user");
-  await sendRaw(adapter, encodeAuthLoginPass(pass));
-  resp = await readSMTPResponse(adapter);
-  assertResponse(resp, [235], "AUTH LOGIN pass");
-}
-function requirePassword(auth, method) {
-  if (!auth.pass) {
-    throw new SMTPError(`Password required for ${method} authentication`, 0, `AUTH ${method}`, "");
-  }
-  return auth.pass;
-}
-async function sendCommand(adapter, command) {
-  await sendRaw(adapter, encodeCommand(command));
-}
-async function sendRaw(adapter, data) {
-  await adapter.write(data);
-}
-async function readSMTPResponse(adapter) {
-  const chunks = [];
-  for await (const chunk of adapter.read()) {
-    chunks.push(chunk);
-    const complete = accumulateResponse(chunks);
-    if (complete) {
-      return parseResponse(complete);
-    }
-  }
-  throw new SMTPError("Connection closed while reading SMTP response", 0, "READ", "");
-}
-async function resolveMX(domain) {
-  const dns = await import("node:dns/promises");
-  const records = await dns.resolveMx(domain);
-  if (records.length === 0) {
-    throw new SMTPError(`No MX records for ${domain}`, 0, "MX", "");
-  }
-  records.sort((a, b) => a.priority - b.priority);
-  return records[0]?.exchange ?? domain;
-}
-export { SMTPTransport, resolveSMTPConfig, openSMTPSession, deliverSMTPMessage, closeSMTPSession, readSMTPResponse };
-
-//# debugId=736A9106E3164FC464756E2164756E21

package/dist/chunk-f4c9ttmr.js

@@ -1,154 +0,0 @@
-import {
-  encodeHeader
-} from "./chunk-794hc3m4.js";
-import {
-  __require
-} from "./chunk-v0bahtg2.js";
-
-// src/core/address.ts
-function findForbiddenChar(value) {
-  for (let i = 0;i < value.length; i++) {
-    const code = value.charCodeAt(i);
-    if (code <= 31 || code === 127 || code === 8232 || code === 8233) {
-      return code;
-    }
-  }
-  return -1;
-}
-function assertSafeAddress(value, label = "address") {
-  const code = findForbiddenChar(value);
-  if (code !== -1) {
-    const hex = code.toString(16).padStart(2, "0");
-    throw new Error(`Email ${label} contains a forbidden control character (0x${hex}). ` + "CR, LF, NUL, and other control characters are not allowed.");
-  }
-}
-function parseAddresses(input) {
-  if (Array.isArray(input)) {
-    return input.flatMap((item) => parseAddresses(item));
-  }
-  if (typeof input === "object") {
-    assertSafeAddress(input.address, "address");
-    if (input.name !== undefined) {
-      assertSafeAddress(input.name, "display name");
-    }
-    return [{ ...input }];
-  }
-  assertSafeAddress(input, "address");
-  const trimmed = input.trim();
-  if (!trimmed) {
-    return [];
-  }
-  return splitAddressList(trimmed).map(parseSingleAddress);
-}
-function toMIMEHeader(address) {
-  assertSafeAddress(address.address, "address");
-  if (address.name) {
-    assertSafeAddress(address.name, "display name");
-    const name = encodeHeader(address.name);
-    return `${name} <${address.address}>`;
-  }
-  return address.address;
-}
-function extractEmails(input) {
-  return parseAddresses(input).map((addr) => addr.address);
-}
-function isValidEmail(email) {
-  if (findForbiddenChar(email) !== -1)
-    return false;
-  return /^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/.test(email);
-}
-function splitAddressList(input) {
-  const parts = [];
-  let current = "";
-  let inQuotes = false;
-  let inAngle = false;
-  for (let i = 0;i < input.length; i++) {
-    const char = input[i] ?? "";
-    if (char === '"' && input[i - 1] !== "\\") {
-      inQuotes = !inQuotes;
-      current += char;
-      continue;
-    }
-    if (char === "<" && !inQuotes) {
-      inAngle = true;
-      current += char;
-      continue;
-    }
-    if (char === ">" && !inQuotes) {
-      inAngle = false;
-      current += char;
-      continue;
-    }
-    if (char === "," && !inQuotes && !inAngle) {
-      if (current.trim()) {
-        parts.push(current.trim());
-      }
-      current = "";
-      continue;
-    }
-    current += char;
-  }
-  if (current.trim()) {
-    parts.push(current.trim());
-  }
-  return parts;
-}
-function parseSingleAddress(input) {
-  const trimmed = input.trim();
-  const angleMatch = trimmed.match(/^(?:"([^"]*)"|([^<]*?))\s*<([^>]+)>$/);
-  if (angleMatch) {
-    const name = (angleMatch[1] ?? angleMatch[2] ?? "").trim();
-    const address = (angleMatch[3] ?? "").trim();
-    if (name) {
-      return { name, address };
-    }
-    return { address };
-  }
-  if (trimmed.startsWith('"') && trimmed.endsWith('"')) {
-    return { address: trimmed.slice(1, -1) };
-  }
-  return { address: trimmed };
-}
-
-// src/transports/resolve-attachments.ts
-async function resolveAttachments(attachments, options) {
-  const list = attachments ?? [];
-  const resolved = [];
-  for (const attachment of list) {
-    if (attachment.content instanceof Uint8Array) {
-      resolved.push(attachment);
-      continue;
-    }
-    if (attachment.path) {
-      let fs;
-      try {
-        fs = await import("node:fs/promises");
-      } catch {
-        throw new Error("attachment.path is not supported on this runtime — use attachment.content (Uint8Array) instead");
-      }
-      if (options?.basePath) {
-        const { resolve, sep } = await import("node:path");
-        const resolvedPath = resolve(attachment.path);
-        const resolvedBase = resolve(options.basePath);
-        const isWithin = resolvedPath === resolvedBase || resolvedPath.startsWith(resolvedBase + sep);
-        if (!isWithin) {
-          throw new Error(`[sently] Attachment path "${resolvedPath}" escapes basePath "${resolvedBase}". Use absolute paths within the allowed directory.`);
-        }
-      }
-      const data = await fs.readFile(attachment.path);
-      const { path: _path, ...rest } = attachment;
-      resolved.push({ ...rest, content: new Uint8Array(data) });
-      continue;
-    }
-    if (typeof attachment.content === "string") {
-      resolved.push(attachment);
-      continue;
-    }
-    resolved.push(attachment);
-  }
-  return resolved;
-}
-
-export { assertSafeAddress, parseAddresses, toMIMEHeader, extractEmails, isValidEmail, resolveAttachments };
-
-//# debugId=419CD2BE8A029CA164756E2164756E21

package/dist/chunk-f4c9ttmr.js.map

@@ -1,11 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/core/address.ts", "../src/transports/resolve-attachments.ts"],
-  "sourcesContent": [
-    "// src/core/address.ts\nimport { encodeHeader } from \"./base64.js\";\nimport type { Address, AddressInput } from \"./types.js\";\n\n/**\n * Find the first forbidden control character in a string.\n *\n * Forbidden characters must never appear in an email address or display name,\n * because each enables a distinct attack:\n * - CR (0x0D) / LF (0x0A): email header injection and SMTP command injection\n * - NUL (0x00): C-string truncation / parser confusion in downstream agents\n * - other C0 controls (0x01–0x1F), DEL (0x7F): header/parser confusion\n * - U+2028 / U+2029: line separators that some parsers treat as newlines\n *\n * @returns The char code of the first forbidden character, or -1 if none.\n */\nfunction findForbiddenChar(value: string): number {\n  for (let i = 0; i < value.length; i++) {\n    const code = value.charCodeAt(i);\n    if (code <= 0x1f || code === 0x7f || code === 0x2028 || code === 0x2029) {\n      return code;\n    }\n  }\n  return -1;\n}\n\n/**\n * Assert that a raw address or display-name value contains no forbidden\n * control characters. Throws immediately (fail closed) — the library never\n * attempts to strip or rewrite hostile input into an accepted value.\n *\n * The check is intentionally performed on the RAW input, before any trimming\n * or normalization, so hostile values are rejected rather than repaired.\n *\n * @param value - The raw, untransformed string to validate.\n * @param label - Field label used in the error message (e.g. \"address\").\n * @throws {Error} If the value contains any forbidden control character.\n */\nexport function assertSafeAddress(value: string, label = \"address\"): void {\n  const code = findForbiddenChar(value);\n  if (code !== -1) {\n    const hex = code.toString(16).padStart(2, \"0\");\n    throw new Error(\n      `Email ${label} contains a forbidden control character (0x${hex}). ` +\n        \"CR, LF, NUL, and other control characters are not allowed.\",\n    );\n  }\n}\n\n/**\n * Normalize any AddressInput form into Address[].\n *\n * Every address and display name is validated against control-character\n * injection before any transformation. This is the single chokepoint shared\n * by all transports and address fields (From, To, Cc, Bcc, Reply-To), so the\n * protection is uniform and secure by default.\n *\n * @throws {Error} If any address or name contains a forbidden control character.\n */\nexport function parseAddresses(input: AddressInput): Address[] {\n  if (Array.isArray(input)) {\n    return input.flatMap((item) => parseAddresses(item));\n  }\n\n  if (typeof input === \"object\") {\n    assertSafeAddress(input.address, \"address\");\n    if (input.name !== undefined) {\n      assertSafeAddress(input.name, \"display name\");\n    }\n    return [{ ...input }];\n  }\n\n  // Validate the raw input string before splitting or trimming so injected\n  // newlines cannot hide inside a multi-address list.\n  assertSafeAddress(input, \"address\");\n\n  const trimmed = input.trim();\n  if (!trimmed) {\n    return [];\n  }\n\n  return splitAddressList(trimmed).map(parseSingleAddress);\n}\n\n/**\n * Format an Address for SMTP envelope commands (MAIL FROM / RCPT TO).\n */\nexport function toEnvelope(address: Address): string {\n  return address.address;\n}\n\n/**\n * Format an Address for use in a MIME header (From, To, CC, etc.).\n *\n * Re-validates the address and name at render time so a header can never be\n * emitted with an embedded control character, even if the {@link Address} was\n * constructed without going through {@link parseAddresses}.\n *\n * @throws {Error} If the address or name contains a forbidden control character.\n */\nexport function toMIMEHeader(address: Address): string {\n  assertSafeAddress(address.address, \"address\");\n  if (address.name) {\n    assertSafeAddress(address.name, \"display name\");\n    const name = encodeHeader(address.name);\n    return `${name} <${address.address}>`;\n  }\n  return address.address;\n}\n\n/**\n * Extract plain email strings from any AddressInput.\n */\nexport function extractEmails(input: AddressInput): string[] {\n  return parseAddresses(input).map((addr) => addr.address);\n}\n\n/**\n * Basic email format validation (format only, no DNS lookup).\n *\n * Rejects any control character (including CR, LF, tab, and NUL) before\n * applying the structural check, so a \"valid\" result is always safe to place\n * into a header or SMTP command.\n */\nexport function isValidEmail(email: string): boolean {\n  if (findForbiddenChar(email) !== -1) return false;\n  return /^[^\\s@<>]+@[^\\s@<>]+\\.[^\\s@<>]+$/.test(email);\n}\n\nfunction splitAddressList(input: string): string[] {\n  const parts: string[] = [];\n  let current = \"\";\n  let inQuotes = false;\n  let inAngle = false;\n\n  for (let i = 0; i < input.length; i++) {\n    const char = input[i] ?? \"\";\n    if (char === '\"' && input[i - 1] !== \"\\\\\") {\n      inQuotes = !inQuotes;\n      current += char;\n      continue;\n    }\n    if (char === \"<\" && !inQuotes) {\n      inAngle = true;\n      current += char;\n      continue;\n    }\n    if (char === \">\" && !inQuotes) {\n      inAngle = false;\n      current += char;\n      continue;\n    }\n    if (char === \",\" && !inQuotes && !inAngle) {\n      if (current.trim()) {\n        parts.push(current.trim());\n      }\n      current = \"\";\n      continue;\n    }\n    current += char;\n  }\n\n  if (current.trim()) {\n    parts.push(current.trim());\n  }\n\n  return parts;\n}\n\nfunction parseSingleAddress(input: string): Address {\n  const trimmed = input.trim();\n\n  const angleMatch = trimmed.match(/^(?:\"([^\"]*)\"|([^<]*?))\\s*<([^>]+)>$/);\n  if (angleMatch) {\n    const name = (angleMatch[1] ?? angleMatch[2] ?? \"\").trim();\n    const address = (angleMatch[3] ?? \"\").trim();\n    if (name) {\n      return { name, address };\n    }\n    return { address };\n  }\n\n  if (trimmed.startsWith('\"') && trimmed.endsWith('\"')) {\n    return { address: trimmed.slice(1, -1) };\n  }\n\n  return { address: trimmed };\n}\n",
-    "import type { Attachment } from \"../core/types.js\";\n\n/** Options for {@link resolveAttachments}. */\nexport interface ResolveAttachmentsOptions {\n  /**\n   * If set, attachment paths must resolve within this directory.\n   * Prevents path traversal via `..` segments and sibling-directory\n   * prefix matches. Opt-in only.\n   *\n   * Note: this check uses `node:path` `resolve()`, which does NOT\n   * dereference symlinks. A symlink located inside `basePath` that\n   * points outside of it will pass this check. If symlink traversal is\n   * a concern, resolve paths with `fs.realpath()` before passing them in.\n   */\n  basePath?: string;\n}\n\n/**\n * Resolve attachment.path to in-memory Uint8Array content.\n * @throws When attachment.path is used on runtimes without node:fs/promises\n */\nexport async function resolveAttachments(\n  attachments: Attachment[] | undefined,\n  options?: ResolveAttachmentsOptions,\n): Promise<Attachment[]> {\n  const list = attachments ?? [];\n  const resolved: Attachment[] = [];\n\n  for (const attachment of list) {\n    if (attachment.content instanceof Uint8Array) {\n      resolved.push(attachment);\n      continue;\n    }\n\n    if (attachment.path) {\n      let fs: typeof import(\"node:fs/promises\");\n      try {\n        fs = await import(\"node:fs/promises\");\n      } catch {\n        throw new Error(\n          \"attachment.path is not supported on this runtime — use attachment.content (Uint8Array) instead\",\n        );\n      }\n\n      if (options?.basePath) {\n        const { resolve, sep } = await import(\"node:path\");\n        const resolvedPath = resolve(attachment.path);\n        const resolvedBase = resolve(options.basePath);\n        // startsWith alone is vulnerable: \"/var/data-secret\" passes \"/var/data\".\n        // Require an exact match or a trailing path separator.\n        const isWithin =\n          resolvedPath === resolvedBase || resolvedPath.startsWith(resolvedBase + sep);\n        if (!isWithin) {\n          throw new Error(\n            `[sently] Attachment path \"${resolvedPath}\" escapes basePath \"${resolvedBase}\". ` +\n              \"Use absolute paths within the allowed directory.\",\n          );\n        }\n      }\n\n      const data = await fs.readFile(attachment.path);\n      const { path: _path, ...rest } = attachment;\n      resolved.push({ ...rest, content: new Uint8Array(data) });\n      continue;\n    }\n\n    if (typeof attachment.content === \"string\") {\n      resolved.push(attachment);\n      continue;\n    }\n\n    resolved.push(attachment);\n  }\n\n  return resolved;\n}\n"
-  ],
-  "mappings": ";;;;;;;;AAgBA,SAAS,iBAAiB,CAAC,OAAuB;AAAA,EAChD,SAAS,IAAI,EAAG,IAAI,MAAM,QAAQ,KAAK;AAAA,IACrC,MAAM,OAAO,MAAM,WAAW,CAAC;AAAA,IAC/B,IAAI,QAAQ,MAAQ,SAAS,OAAQ,SAAS,QAAU,SAAS,MAAQ;AAAA,MACvE,OAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAeF,SAAS,iBAAiB,CAAC,OAAe,QAAQ,WAAiB;AAAA,EACxE,MAAM,OAAO,kBAAkB,KAAK;AAAA,EACpC,IAAI,SAAS,IAAI;AAAA,IACf,MAAM,MAAM,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAAA,IAC7C,MAAM,IAAI,MACR,SAAS,mDAAmD,WAC1D,4DACJ;AAAA,EACF;AAAA;AAaK,SAAS,cAAc,CAAC,OAAgC;AAAA,EAC7D,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,OAAO,MAAM,QAAQ,CAAC,SAAS,eAAe,IAAI,CAAC;AAAA,EACrD;AAAA,EAEA,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,kBAAkB,MAAM,SAAS,SAAS;AAAA,IAC1C,IAAI,MAAM,SAAS,WAAW;AAAA,MAC5B,kBAAkB,MAAM,MAAM,cAAc;AAAA,IAC9C;AAAA,IACA,OAAO,CAAC,KAAK,MAAM,CAAC;AAAA,EACtB;AAAA,EAIA,kBAAkB,OAAO,SAAS;AAAA,EAElC,MAAM,UAAU,MAAM,KAAK;AAAA,EAC3B,IAAI,CAAC,SAAS;AAAA,IACZ,OAAO,CAAC;AAAA,EACV;AAAA,EAEA,OAAO,iBAAiB,OAAO,EAAE,IAAI,kBAAkB;AAAA;AAmBlD,SAAS,YAAY,CAAC,SAA0B;AAAA,EACrD,kBAAkB,QAAQ,SAAS,SAAS;AAAA,EAC5C,IAAI,QAAQ,MAAM;AAAA,IAChB,kBAAkB,QAAQ,MAAM,cAAc;AAAA,IAC9C,MAAM,OAAO,aAAa,QAAQ,IAAI;AAAA,IACtC,OAAO,GAAG,SAAS,QAAQ;AAAA,EAC7B;AAAA,EACA,OAAO,QAAQ;AAAA;AAMV,SAAS,aAAa,CAAC,OAA+B;AAAA,EAC3D,OAAO,eAAe,KAAK,EAAE,IAAI,CAAC,SAAS,KAAK,OAAO;AAAA;AAUlD,SAAS,YAAY,CAAC,OAAwB;AAAA,EACnD,IAAI,kBAAkB,KAAK,MAAM;AAAA,IAAI,OAAO;AAAA,EAC5C,OAAO,mCAAmC,KAAK,KAAK;AAAA;AAGtD,SAAS,gBAAgB,CAAC,OAAyB;AAAA,EACjD,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,UAAU;AAAA,EACd,IAAI,WAAW;AAAA,EACf,IAAI,UAAU;AAAA,EAEd,SAAS,IAAI,EAAG,IAAI,MAAM,QAAQ,KAAK;AAAA,IACrC,MAAM,OAAO,MAAM,MAAM;AAAA,IACzB,IAAI,SAAS,OAAO,MAAM,IAAI,OAAO,MAAM;AAAA,MACzC,WAAW,CAAC;AAAA,MACZ,WAAW;AAAA,MACX;AAAA,IACF;AAAA,IACA,IAAI,SAAS,OAAO,CAAC,UAAU;AAAA,MAC7B,UAAU;AAAA,MACV,WAAW;AAAA,MACX;AAAA,IACF;AAAA,IACA,IAAI,SAAS,OAAO,CAAC,UAAU;AAAA,MAC7B,UAAU;AAAA,MACV,WAAW;AAAA,MACX;AAAA,IACF;AAAA,IACA,IAAI,SAAS,OAAO,CAAC,YAAY,CAAC,SAAS;AAAA,MACzC,IAAI,QAAQ,KAAK,GAAG;AAAA,QAClB,MAAM,KAAK,QAAQ,KAAK,CAAC;AAAA,MAC3B;AAAA,MACA,UAAU;AAAA,MACV;AAAA,IACF;AAAA,IACA,WAAW;AAAA,EACb;AAAA,EAEA,IAAI,QAAQ,KAAK,GAAG;AAAA,IAClB,MAAM,KAAK,QAAQ,KAAK,CAAC;AAAA,EAC3B;AAAA,EAEA,OAAO;AAAA;AAGT,SAAS,kBAAkB,CAAC,OAAwB;AAAA,EAClD,MAAM,UAAU,MAAM,KAAK;AAAA,EAE3B,MAAM,aAAa,QAAQ,MAAM,sCAAsC;AAAA,EACvE,IAAI,YAAY;AAAA,IACd,MAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,IAAI,KAAK;AAAA,IACzD,MAAM,WAAW,WAAW,MAAM,IAAI,KAAK;AAAA,IAC3C,IAAI,MAAM;AAAA,MACR,OAAO,EAAE,MAAM,QAAQ;AAAA,IACzB;AAAA,IACA,OAAO,EAAE,QAAQ;AAAA,EACnB;AAAA,EAEA,IAAI,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AAAA,IACpD,OAAO,EAAE,SAAS,QAAQ,MAAM,GAAG,EAAE,EAAE;AAAA,EACzC;AAAA,EAEA,OAAO,EAAE,SAAS,QAAQ;AAAA;;;ACrK5B,eAAsB,kBAAkB,CACtC,aACA,SACuB;AAAA,EACvB,MAAM,OAAO,eAAe,CAAC;AAAA,EAC7B,MAAM,WAAyB,CAAC;AAAA,EAEhC,WAAW,cAAc,MAAM;AAAA,IAC7B,IAAI,WAAW,mBAAmB,YAAY;AAAA,MAC5C,SAAS,KAAK,UAAU;AAAA,MACxB;AAAA,IACF;AAAA,IAEA,IAAI,WAAW,MAAM;AAAA,MACnB,IAAI;AAAA,MACJ,IAAI;AAAA,QACF,KAAK,MAAa;AAAA,QAClB,MAAM;AAAA,QACN,MAAM,IAAI,MACR,gGACF;AAAA;AAAA,MAGF,IAAI,SAAS,UAAU;AAAA,QACrB,QAAQ,SAAS,QAAQ,MAAa;AAAA,QACtC,MAAM,eAAe,QAAQ,WAAW,IAAI;AAAA,QAC5C,MAAM,eAAe,QAAQ,QAAQ,QAAQ;AAAA,QAG7C,MAAM,WACJ,iBAAiB,gBAAgB,aAAa,WAAW,eAAe,GAAG;AAAA,QAC7E,IAAI,CAAC,UAAU;AAAA,UACb,MAAM,IAAI,MACR,6BAA6B,mCAAmC,iEAElE;AAAA,QACF;AAAA,MACF;AAAA,MAEA,MAAM,OAAO,MAAM,GAAG,SAAS,WAAW,IAAI;AAAA,MAC9C,QAAQ,MAAM,UAAU,SAAS;AAAA,MACjC,SAAS,KAAK,KAAK,MAAM,SAAS,IAAI,WAAW,IAAI,EAAE,CAAC;AAAA,MACxD;AAAA,IACF;AAAA,IAEA,IAAI,OAAO,WAAW,YAAY,UAAU;AAAA,MAC1C,SAAS,KAAK,UAAU;AAAA,MACxB;AAAA,IACF;AAAA,IAEA,SAAS,KAAK,UAAU;AAAA,EAC1B;AAAA,EAEA,OAAO;AAAA;",
-  "debugId": "419CD2BE8A029CA164756E2164756E21",
-  "names": []
-}