sently 0.4.7 → 0.5.1

package/CHANGELOG.md

@@ -2,6 +2,52 @@
 
 ## [Unreleased]
 
+## [0.5.1] — 2026-05-31
+
+### Breaking
+
+- **Main barrel** — `reactPlugin` and `ReactMailOptions` are no longer exported from
+  `"sently"`. Import them from `"sently/react"` instead.
+
+### Fixed
+
+- **Webhook signatures** — `verifyResendSignature` and `verifyMailgunSignature` now
+  compare decoded signature bytes with constant-time `timingSafeEqual` (Web Crypto only)
+- **SES webhooks** — SNS `Message` field accepted when already parsed as an object
+- **Batch sendBulk** — per-chunk failure isolation, per-message partial batch errors
+  (`SendResult.batchError`), and rate limiting between batch HTTP requests (default 2/s)
+
+### Changed
+
+- `RateLimiter` extracted to `src/core/rate-limiter.ts` (shared by pool and mailer)
+- `Transport.batchMax` on `ResendTransport`; `BulkSendOptions.rateDelta` / `rateLimit`
+- Bundle size budgets updated for expanded mailer and Resend transport
+
+## [0.5.0] — 2026-05-31
+
+### Added
+
+- **`sently/react`** — React Email integration via `reactPlugin()`; optional peers
+  `react` and `@react-email/render`; `options.react` on `MailOptions`
+- **`sently/idempotency`** — `IdempotencyTransport` decorator with
+  `MemoryIdempotencyStore`; dedupe on retry/replay; Resend native
+  `Idempotency-Key` header support
+- **Native batch in `sendBulk`** — optional `Transport.sendBatch()` on Resend
+  (POST `/emails/batch`, `RESEND_BATCH_MAX = 100`) and SendGrid (multi-
+  personalization); attachment messages fall back to single-send
+- **`stopOnError`** option on `BulkSendOptions`
+- **`sently/webhooks`** — normalized `EmailEvent` parsers for Resend, SendGrid,
+  Postmark, Mailgun, SES (SNS envelope + double-encoded Message), and Brevo;
+  optional Mailgun HMAC and Resend Svix signature verification helpers
+- **`deduped`** flag on `SendResult` for idempotency cache hits
+
+### Changed
+
+- `sendBulk` uses native batch endpoints when the transport implements
+  `sendBatch`; concurrent per-message fallback unchanged for other transports
+- SendGrid single-send puts `subject` in personalization (batch-compatible)
+- Bundle size budgets adjusted for expanded `sently/mailer` and main entry
+
 ## [0.4.7] — 2026-05-30
 
 ### Added

package/README.md

@@ -1,7 +1,7 @@
 # sently
 
 > Nodemailer hasn't been updated in years, doesn't run on Bun or Deno, and ships at 220KB.
-> sently is the modern replacement — same familiar API, runs everywhere, HTTP stacks from ~4 KB via `sently/mailer`.
+> sently is the modern replacement — same familiar API, runs everywhere, HTTP stacks from ~5.4 KB via `sently/mailer`.
 
 ```bash
 bun add sently
@@ -20,7 +20,7 @@ bun add sently
 
 | Feature | Nodemailer | sently |
 |---------|-----------|--------|
-| Bundle size | ~220 KB always | ~4 KB HTTP · ~14 KB SMTP |
+| Bundle size | ~220 KB always | ~5.4 KB HTTP · ~14 KB SMTP |
 | Runtimes | Node.js only | Node, Bun, Deno, CF Workers |
 | Module format | CommonJS | ESM only |
 | Dependencies | 3 | 0 |
@@ -31,7 +31,10 @@ bun add sently
 | Retry transport | ✗ | ✓ |
 | Preview transport | ✗ | ✓ |
 | Template engine | ✗ | ✓ |
-| `sendBulk()` | ✗ | ✓ |
+| `sendBulk()` | ✗ | ✓ (native batch on Resend/SendGrid) |
+| React Email | ✗ via plugin | ✓ `sently/react` |
+| Idempotency keys | ✗ | ✓ `sently/idempotency` |
+| Webhook parsing | ✗ | ✓ `sently/webhooks` |
 | TypeScript | via `@types/nodemailer` | ✓ built-in |
 | Last release | 2021 | 2026 |
 
@@ -214,7 +217,7 @@ const mailer = await createMailer({ transport });
 await mailer.verify(); // test connection + auth
 ```
 
-Use `sently/mailer` instead of `sently` when passing `{ transport }` — keeps HTTP-only bundles ~4 KB smaller.
+Use `sently/mailer` instead of `sently` when passing `{ transport }` — keeps HTTP-only bundles ~10 KB smaller.
 
 **AUTH methods:** XOAUTH2, CRAM-MD5, LOGIN, and PLAIN (auto-negotiated from EHLO unless `auth.type` is set).
 
@@ -343,7 +346,7 @@ const mailer = await createMailer({ transport });
 
 ### sendBulk()
 
-Send multiple messages with concurrency control and per-message callbacks:
+Send multiple messages with concurrency control and per-message callbacks. When the transport implements `sendBatch` (Resend, SendGrid), attachment-free messages are sent via native batch endpoints; messages with attachments fall back to individual sends.
 
 ```typescript
 const result = await mailer.sendBulk(
@@ -353,6 +356,7 @@ const result = await mailer.sendBulk(
   ],
   {
     concurrency: 2,
+    stopOnError: false, // halt remaining sends after first failure when true
     onSuccess: (_msg, index) => console.log(`Sent #${index}`),
     onError: (_msg, index, err) => console.error(`Failed #${index}`, err),
   },
@@ -361,6 +365,33 @@ const result = await mailer.sendBulk(
 console.log(result.sent, result.failed);
 ```
 
+Resend batches up to `RESEND_BATCH_MAX` (100) messages per request — export from `sently/transports/resend`.
+
+### IdempotencyTransport
+
+Prevent duplicate sends on retry or replay. Wrap **outside** `RetryTransport` so all retry attempts share one key:
+
+```typescript
+import { IdempotencyTransport } from "sently/idempotency";
+import { RetryTransport } from "sently/transports/retry";
+import { ResendTransport } from "sently/transports/resend";
+
+const transport = new IdempotencyTransport(
+  new RetryTransport(new ResendTransport({ apiKey: process.env.RESEND_API_KEY! })),
+  { ttlMs: 86_400_000 },
+);
+
+await mailer.send({
+  from: "you@example.com",
+  to: "user@example.com",
+  subject: "Hello",
+  text: "Hi",
+  idempotencyKey: "order-123-email", // or derive from messageId
+});
+```
+
+Resend sends the `Idempotency-Key` HTTP header natively. Supply a shared store (Redis, Dragonfly) in production — `MemoryIdempotencyStore` is for single-process use.
+
 ---
 
 ## Plugin system
@@ -428,6 +459,51 @@ await mailer.send({
 
 Use a custom engine by passing any `(template, data) => string` function to `templatePlugin`.
 
+### React Email plugin
+
+Render React Email components to HTML and plain text (optional peers: `react`, `@react-email/render`):
+
+```typescript
+import { reactPlugin } from "sently/react";
+import { createMailer } from "sently/mailer";
+import { ResendTransport } from "sently/transports/resend";
+import { WelcomeEmail } from "./emails/welcome";
+
+const mailer = await createMailer({
+  transport: new ResendTransport({ apiKey: "re_..." }),
+  plugins: [reactPlugin()],
+});
+
+await mailer.send({
+  from: "onboarding@yourdomain.com",
+  to: "user@example.com",
+  subject: "Welcome",
+  react: WelcomeEmail({ name: "Ali" }),
+});
+```
+
+Explicit `html` / `text` always win over rendered output.
+
+### Webhook parsing
+
+Normalize provider webhooks into a single event type — no server framework required:
+
+```typescript
+import { parseResendWebhook, parseSesWebhook } from "sently/webhooks";
+
+// Resend (Svix-style payload)
+const events = parseResendWebhook(await request.json());
+
+// AWS SES via SNS (handles SubscriptionConfirmation + double-encoded Message)
+const sesEvents = parseSesWebhook(await request.json());
+
+for (const event of events) {
+  console.log(event.type, event.messageId, event.recipient);
+}
+```
+
+Parsers: Resend, SendGrid, Postmark, Mailgun, SES, Brevo. Optional HMAC verification helpers for Mailgun and Resend (`verifyMailgunSignature`, `verifyResendSignature`).
+
 ---
 
 ## MailOptions Reference
@@ -445,6 +521,8 @@ Use a custom engine by passing any `(template, data) => string` function to `tem
 | `attachments` | `Attachment[]` | — | File attachments |
 | `headers` | `Record<string, string>` | — | Custom headers |
 | `messageId` | `string` | auto | Message-ID header |
+| `idempotencyKey` | `string` | — | Dedupe key for retry/replay (Resend sends as `Idempotency-Key` header) |
+| `react` | `unknown` | — | React element — use with `reactPlugin()` from `sently/react` |
 | `date` | `Date` | now | Date header |
 | `priority` | `'high' \| 'normal' \| 'low'` | — | X-Priority / Importance |
 | `encoding` | `'utf-8' \| 'ascii'` | `'utf-8'` | Character encoding hint |
@@ -570,17 +648,20 @@ All sizes are **minified + gzip**, measured by bundling each import path in isol
 
 | You send via… | Import | Why |
 |---------------|--------|-----|
-| Resend, SendGrid, Postmark, etc. | `sently/mailer` + `sently/transports/<provider>` | **~4 KB** — no SMTP code in the bundle |
+| Resend, SendGrid, Postmark, etc. | `sently/mailer` + `sently/transports/<provider>` | **~5.4 KB** — no SMTP code in the bundle |
 | SMTP relay (`host` / `port`) | `sently` | **~14 KB** — includes MIME + SMTP stack |
 | Raw transport, no plugins | `sently/transports/<provider>` only | **~4 KB** — skip `createMailer` wrapper |
 | DKIM signing | `sently/dkim` or `dkim` option on send | **~2 KB** add-on, lazy-loaded by MIME |
+| React Email | `sently/react` + peers | **~0.3 KB** plugin shell (+ `@react-email/render` peer) |
+| Webhook parsing | `sently/webhooks` | **~0.5 KB** |
+| Idempotency | `sently/idempotency` | **~1.2 KB** |
 
 ```ts
-// Recommended — HTTP API (~4.3 KB bundled)
+// Recommended — HTTP API (~5.4 KB bundled)
 import { createMailer } from "sently/mailer";
 import { ResendTransport } from "sently/transports/resend";
 
-// Avoid for HTTP-only apps — pulls SMTP into flat bundles (~14 KB)
+// Avoid for HTTP-only apps — pulls SMTP into flat bundles (~15 KB)
 import { createMailer } from "sently";
 ```
 
@@ -588,12 +669,12 @@ import { createMailer } from "sently";
 
 | Use case | What you import | ~gzip |
 |----------|-----------------|-------|
-| HTTP — Resend | `sently/mailer` + `transports/resend` | **4.3 KB** |
-| HTTP — SendGrid | `sently/mailer` + `transports/sendgrid` | **4.3 KB** |
-| HTTP — transport only | `transports/resend` (call `.send()` directly) | **3.9 KB** |
-| SMTP relay | `sently` + `{ host, port, auth }` | **13.6 KB** |
-| SMTP + explicit adapter | `sently` + `adapters/node` | **13.6 KB** |
-| Main entry + HTTP ⚠️ | `sently` + `transports/resend` | **14.1 KB** |
+| HTTP — Resend | `sently/mailer` + `transports/resend` | **5.4 KB** |
+| HTTP — SendGrid | `sently/mailer` + `transports/sendgrid` | **5.2 KB** |
+| HTTP — transport only | `transports/resend` (call `.send()` directly) | **4.5 KB** |
+| SMTP relay | `sently` + `{ host, port, auth }` | **14.2 KB** |
+| SMTP + explicit adapter | `sently` + `adapters/node` | **14.2 KB** |
+| Main entry + HTTP ⚠️ | `sently` + `transports/resend` | **15.0 KB** |
 
 Adapters are **auto-selected at runtime** for SMTP unless you pass `adapter` explicitly. Only the adapter for your runtime is fetched (dynamic import).
 
@@ -601,16 +682,19 @@ Adapters are **auto-selected at runtime** for SMTP unless you pass `adapter` exp
 
 | Export | ~gzip | Notes |
 |--------|-------|-------|
-| `sently/mailer` | 0.6 KB | `createMailer({ transport })` — plugins, `sendBulk`, `verify` |
-| `sently` | 13.6 KB | Full `createMailer` — SMTP config + lazy SMTP chunks |
+| `sently/mailer` | 1.4 KB | `createMailer({ transport })` — plugins, `sendBulk`, rate-limited batch |
+| `sently` | 14.1 KB | Full `createMailer` — SMTP config + lazy SMTP chunks |
 | `sently/dkim` | 1.7 KB | `signDKIM`, `importPrivateKey` — loaded when `dkim` option is set |
+| `sently/react` | 0.3 KB | `reactPlugin()` — excludes `@react-email/render` peer |
+| `sently/idempotency` | 1.2 KB | `IdempotencyTransport`, `MemoryIdempotencyStore` |
+| `sently/webhooks` | 0.5 KB | Provider webhook parsers + optional signature verification |
 
 ### Transports
 
 | Export | ~gzip | Protocol |
 |--------|-------|----------|
-| `sently/transports/resend` | 3.9 KB | HTTP |
-| `sently/transports/sendgrid` | 3.9 KB | HTTP |
+| `sently/transports/resend` | 4.5 KB | HTTP (+ batch endpoint, rate limit) |
+| `sently/transports/sendgrid` | 4.0 KB | HTTP (+ batch personalizations) |
 | `sently/transports/postmark` | 3.9 KB | HTTP |
 | `sently/transports/mailgun` | 4.0 KB | HTTP |
 | `sently/transports/brevo` | 3.8 KB | HTTP |
@@ -629,13 +713,13 @@ HTTP transports share MIME/address parsing (~3.8 KB). SES is larger due to SigV4
 | `sently/adapters/deno` | 0.5 KB | Deno |
 | `sently/adapters/cf` | 0.6 KB | Cloudflare Workers |
 
-### What's inside an HTTP stack (~4.3 KB)
+### What's inside an HTTP stack (~5.4 KB)
 
 ```
-sently/mailer          0.6 KB   createMailer wrapper, plugins, sendBulk
-transports/resend      3.9 KB   fetch client + MIME/address parsing
+sently/mailer          1.4 KB   createMailer wrapper, plugins, sendBulk + rate limit
+transports/resend      4.5 KB   fetch client + MIME/address parsing + batch
                        ─────
-total                  4.3 KB   vs Nodemailer ~220 KB
+total                  5.4 KB   vs Nodemailer ~220 KB
 ```
 
 Regenerate tables after changes: `bun run measure:size` (full report) or `bun tools/measure-bundle-size.ts --markdown`.

package/dist/adapters/bun.js

@@ -1,3 +1,3 @@
-import"../chunk-sqn04kae.js";import W from"node:net";import Q from"node:tls";function V(f){if(f.rejectUnauthorized===!1)console.warn("[sently] TLS certificate verification is disabled. Never use rejectUnauthorized: false in production.")}class X{socket=null;_secure;_connected=!1;connectionTimeout;tlsOptions;constructor(f={}){if(typeof Bun>"u")throw Error("BunAdapter requires the Bun runtime");this._secure=f.secure??!1,this.connectionTimeout=f.connectionTimeout??30000,this.tlsOptions=f.tls??{}}get secure(){return this._secure}get connected(){return this._connected}async connect(f,B){if(this._secure)await this.connectTls(f,B);else await this.connectPlain(f,B);this._connected=!0}async startTLS(f){if(!this.socket||this._secure)throw Error("Cannot STARTTLS: no plain socket available");let B=this.socket,y={...this.tlsOptions,...f};V(y),await new Promise((F,A)=>{let G=Q.connect({socket:B,servername:y.servername,rejectUnauthorized:y.rejectUnauthorized??!0,minVersion:y.minVersion});G.once("secureConnect",()=>{this.socket=G,this._secure=!0,F()}),G.once("error",A)})}async write(f){if(!this.socket)throw Error("Socket not connected");await new Promise((B,y)=>{this.socket?.write(Buffer.from(f),(F)=>{if(F)y(F);else B()})})}async*read(){if(!this.socket)throw Error("Socket not connected");let f=this.socket,B=[],y=null,F=!1,A=null,G=(H)=>{let I=new Uint8Array(H);if(y)y({value:I,done:!1}),y=null;else B.push(I)},J=(H)=>{if(A=H,F=!0,y)y({value:void 0,done:!0}),y=null},K=()=>{if(F=!0,y)y({value:void 0,done:!0}),y=null};f.on("data",G),f.on("error",J),f.on("close",K);try{while(!F||B.length>0){if(A)throw A;if(B.length>0){yield B.shift();continue}if(F)break;let H=await new Promise((I)=>{y=I});if(H.done)break;yield H.value}}finally{f.off("data",G),f.off("error",J),f.off("close",K)}}async close(){if(!this.socket)return;await new Promise((f)=>{this.socket?.end(()=>f())}),this.socket=null,this._connected=!1}connectPlain(f,B){return new Promise((y,F)=>{let A=W.connect({host:f,port:B},()=>y());A.setTimeout(this.connectionTimeout),A.once("timeout",()=>{A.destroy(),F(Error("Connection timeout"))}),A.once("error",F),this.socket=A})}connectTls(f,B){return V(this.tlsOptions),new Promise((y,F)=>{let A=Q.connect({host:f,port:B,servername:this.tlsOptions.servername??f,rejectUnauthorized:this.tlsOptions.rejectUnauthorized??!0,minVersion:this.tlsOptions.minVersion},()=>y());A.setTimeout(this.connectionTimeout),A.once("timeout",()=>{A.destroy(),F(Error("Connection timeout"))}),A.once("error",F),this.socket=A})}}export{X as BunAdapter};
+import"../chunk-rhade81v.js";import W from"node:net";import Q from"node:tls";function V(f){if(f.rejectUnauthorized===!1)console.warn("[sently] TLS certificate verification is disabled. Never use rejectUnauthorized: false in production.")}class X{socket=null;_secure;_connected=!1;connectionTimeout;tlsOptions;constructor(f={}){if(typeof Bun>"u")throw Error("BunAdapter requires the Bun runtime");this._secure=f.secure??!1,this.connectionTimeout=f.connectionTimeout??30000,this.tlsOptions=f.tls??{}}get secure(){return this._secure}get connected(){return this._connected}async connect(f,B){if(this._secure)await this.connectTls(f,B);else await this.connectPlain(f,B);this._connected=!0}async startTLS(f){if(!this.socket||this._secure)throw Error("Cannot STARTTLS: no plain socket available");let B=this.socket,y={...this.tlsOptions,...f};V(y),await new Promise((F,A)=>{let G=Q.connect({socket:B,servername:y.servername,rejectUnauthorized:y.rejectUnauthorized??!0,minVersion:y.minVersion});G.once("secureConnect",()=>{this.socket=G,this._secure=!0,F()}),G.once("error",A)})}async write(f){if(!this.socket)throw Error("Socket not connected");await new Promise((B,y)=>{this.socket?.write(Buffer.from(f),(F)=>{if(F)y(F);else B()})})}async*read(){if(!this.socket)throw Error("Socket not connected");let f=this.socket,B=[],y=null,F=!1,A=null,G=(H)=>{let I=new Uint8Array(H);if(y)y({value:I,done:!1}),y=null;else B.push(I)},J=(H)=>{if(A=H,F=!0,y)y({value:void 0,done:!0}),y=null},K=()=>{if(F=!0,y)y({value:void 0,done:!0}),y=null};f.on("data",G),f.on("error",J),f.on("close",K);try{while(!F||B.length>0){if(A)throw A;if(B.length>0){yield B.shift();continue}if(F)break;let H=await new Promise((I)=>{y=I});if(H.done)break;yield H.value}}finally{f.off("data",G),f.off("error",J),f.off("close",K)}}async close(){if(!this.socket)return;await new Promise((f)=>{this.socket?.end(()=>f())}),this.socket=null,this._connected=!1}connectPlain(f,B){return new Promise((y,F)=>{let A=W.connect({host:f,port:B},()=>y());A.setTimeout(this.connectionTimeout),A.once("timeout",()=>{A.destroy(),F(Error("Connection timeout"))}),A.once("error",F),this.socket=A})}connectTls(f,B){return V(this.tlsOptions),new Promise((y,F)=>{let A=Q.connect({host:f,port:B,servername:this.tlsOptions.servername??f,rejectUnauthorized:this.tlsOptions.rejectUnauthorized??!0,minVersion:this.tlsOptions.minVersion},()=>y());A.setTimeout(this.connectionTimeout),A.once("timeout",()=>{A.destroy(),F(Error("Connection timeout"))}),A.once("error",F),this.socket=A})}}export{X as BunAdapter};
 
 //# debugId=94AAFD676203266764756E2164756E21

package/dist/adapters/cf.js

@@ -1,3 +1,3 @@
-import{I as q}from"../chunk-sqn04kae.js";class w{socket=null;writer=null;_secure;_connected=!1;directTls;starttls;constructor(b={}){this._secure=b.secure??!1,this.directTls=b.secure??!1,this.starttls=b.starttls??!this.directTls}get secure(){return this._secure}get connected(){return this._connected}async connect(b,g){let{connect:j}=await import("cloudflare:sockets"),m=this.directTls?"on":this.starttls?"starttls":"off";this.socket=j({hostname:b,port:g},{secureTransport:m}),this.writer=this.socket.writable.getWriter(),this._connected=!0,this._secure=m==="on"}async startTLS(b){if(!this.socket||this._secure)throw Error("Cannot STARTTLS: no plain socket available");await this.writer?.close(),this.socket=this.socket.startTls(),this.writer=this.socket.writable.getWriter(),this._secure=!0}async write(b){if(!this.writer)throw Error("Socket not connected");await this.writer.write(b)}async*read(){if(!this.socket)throw Error("Socket not connected");let b=this.socket.readable.getReader();try{while(!0){let{value:g,done:j}=await b.read();if(j)break;if(g)yield g}}finally{b.releaseLock()}}async close(){await this.writer?.close(),await this.socket?.close(),this.writer=null,this.socket=null,this._connected=!1}}export{w as CloudflareAdapter};
+import{K as q}from"../chunk-rhade81v.js";class w{socket=null;writer=null;_secure;_connected=!1;directTls;starttls;constructor(b={}){this._secure=b.secure??!1,this.directTls=b.secure??!1,this.starttls=b.starttls??!this.directTls}get secure(){return this._secure}get connected(){return this._connected}async connect(b,g){let{connect:j}=await import("cloudflare:sockets"),m=this.directTls?"on":this.starttls?"starttls":"off";this.socket=j({hostname:b,port:g},{secureTransport:m}),this.writer=this.socket.writable.getWriter(),this._connected=!0,this._secure=m==="on"}async startTLS(b){if(!this.socket||this._secure)throw Error("Cannot STARTTLS: no plain socket available");await this.writer?.close(),this.socket=this.socket.startTls(),this.writer=this.socket.writable.getWriter(),this._secure=!0}async write(b){if(!this.writer)throw Error("Socket not connected");await this.writer.write(b)}async*read(){if(!this.socket)throw Error("Socket not connected");let b=this.socket.readable.getReader();try{while(!0){let{value:g,done:j}=await b.read();if(j)break;if(g)yield g}}finally{b.releaseLock()}}async close(){await this.writer?.close(),await this.socket?.close(),this.writer=null,this.socket=null,this._connected=!1}}export{w as CloudflareAdapter};
 
-//# debugId=698255E287F8C83164756E2164756E21
+//# debugId=1AA656504F14311964756E2164756E21

package/dist/adapters/cf.js.map

@@ -5,6 +5,6 @@
     "/**\n * @module\n * Cloudflare Workers socket adapter for SMTP via cloudflare:sockets.\n *\n * @example\n * ```ts\n * import { CloudflareAdapter } from \"sently/adapters/cf\";\n * import { createMailer } from \"sently\";\n *\n * const mailer = await createMailer({\n *   host: \"smtp.example.com\",\n *   adapter: new CloudflareAdapter(),\n *   auth: { user: \"relay@example.com\", pass: \"secret\" },\n * });\n * ```\n */\nimport type { SocketAdapter, TLSOptions } from \"../core/types.js\";\n\ninterface CFSocket {\n  readonly readable: ReadableStream<Uint8Array>;\n  readonly writable: WritableStream<Uint8Array>;\n  readonly closed: Promise<void>;\n  close(): Promise<void>;\n  startTls(): CFSocket;\n}\n\ntype CFConnect = (\n  address: { hostname: string; port: number },\n  options?: { secureTransport?: \"off\" | \"on\" | \"starttls\"; allowHalfOpen?: boolean },\n) => CFSocket;\n\n/** Configuration options for {@link CloudflareAdapter}. */\nexport interface CloudflareAdapterOptions {\n  /** Use implicit TLS on connect (secureTransport: \"on\"). Default: false. */\n  secure?: boolean;\n  /** Enable STARTTLS upgrade after plain connect. Default: true when not secure. */\n  starttls?: boolean;\n  /** Reserved for future TLS tuning (Workers sockets API). */\n  tls?: TLSOptions;\n}\n\n/**\n * Cloudflare Workers socket adapter via cloudflare:sockets.\n *\n * Limitations:\n * - No connection pooling (isolate lifecycle)\n * - No file system access for attachment.path\n * - No DNS MX lookup — explicit SMTP relay host required\n */\nexport class CloudflareAdapter implements SocketAdapter {\n  /** Underlying Cloudflare Workers socket. */\n  private socket: CFSocket | null = null;\n  /** Writable stream writer for outbound bytes. */\n  private writer: WritableStreamDefaultWriter<Uint8Array> | null = null;\n  /** Whether the connection is currently encrypted. */\n  private _secure: boolean;\n  /** Whether the socket is connected. */\n  private _connected = false;\n  /** Whether implicit TLS is used on connect (port 465 style). */\n  private readonly directTls: boolean;\n  /** Whether STARTTLS upgrade is enabled after plain connect. */\n  private readonly starttls: boolean;\n\n  /** Creates a Cloudflare Workers socket adapter. */\n  constructor(options: CloudflareAdapterOptions = {}) {\n    this._secure = options.secure ?? false;\n    this.directTls = options.secure ?? false;\n    this.starttls = options.starttls ?? !this.directTls;\n  }\n\n  /** Whether the connection uses TLS. */\n  get secure(): boolean {\n    return this._secure;\n  }\n\n  /** Whether the socket is currently connected. */\n  get connected(): boolean {\n    return this._connected;\n  }\n\n  /** Opens a TCP or TLS connection to the given host and port. */\n  async connect(host: string, port: number): Promise<void> {\n    const { connect } = (await import(\"cloudflare:sockets\")) as { connect: CFConnect };\n\n    const secureTransport = this.directTls ? \"on\" : this.starttls ? \"starttls\" : \"off\";\n    this.socket = connect({ hostname: host, port }, { secureTransport });\n    this.writer = this.socket.writable.getWriter();\n    this._connected = true;\n    this._secure = secureTransport === \"on\";\n  }\n\n  /** Upgrades a plain connection to TLS via STARTTLS. */\n  async startTLS(_options?: TLSOptions): Promise<void> {\n    if (!this.socket || this._secure) {\n      throw new Error(\"Cannot STARTTLS: no plain socket available\");\n    }\n\n    await this.writer?.close();\n    this.socket = this.socket.startTls();\n    this.writer = this.socket.writable.getWriter();\n    this._secure = true;\n  }\n\n  /** Writes raw bytes to the socket. */\n  async write(data: Uint8Array): Promise<void> {\n    if (!this.writer) {\n      throw new Error(\"Socket not connected\");\n    }\n    await this.writer.write(data);\n  }\n\n  /** Reads incoming socket data as an async iterable of byte chunks. */\n  async *read(): AsyncGenerator<Uint8Array, void, unknown> {\n    if (!this.socket) {\n      throw new Error(\"Socket not connected\");\n    }\n\n    const reader = this.socket.readable.getReader();\n    try {\n      while (true) {\n        const { value, done } = await reader.read();\n        if (done) {\n          break;\n        }\n        if (value) {\n          yield value;\n        }\n      }\n    } finally {\n      reader.releaseLock();\n    }\n  }\n\n  /** Closes the socket connection. */\n  async close(): Promise<void> {\n    await this.writer?.close();\n    await this.socket?.close();\n    this.writer = null;\n    this.socket = null;\n    this._connected = false;\n  }\n}\n"
   ],
   "mappings": "yCAiDO,MAAM,CAA2C,CAE9C,OAA0B,KAE1B,OAAyD,KAEzD,QAEA,WAAa,GAEJ,UAEA,SAGjB,WAAW,CAAC,EAAoC,CAAC,EAAG,CAClD,KAAK,QAAU,EAAQ,QAAU,GACjC,KAAK,UAAY,EAAQ,QAAU,GACnC,KAAK,SAAW,EAAQ,UAAY,CAAC,KAAK,aAIxC,OAAM,EAAY,CACpB,OAAO,KAAK,WAIV,UAAS,EAAY,CACvB,OAAO,KAAK,gBAIR,QAAO,CAAC,EAAc,EAA6B,CACvD,IAAQ,WAAa,KAAa,8BAE5B,EAAkB,KAAK,UAAY,KAAO,KAAK,SAAW,WAAa,MAC7E,KAAK,OAAS,EAAQ,CAAE,SAAU,EAAM,MAAK,EAAG,CAAE,iBAAgB,CAAC,EACnE,KAAK,OAAS,KAAK,OAAO,SAAS,UAAU,EAC7C,KAAK,WAAa,GAClB,KAAK,QAAU,IAAoB,UAI/B,SAAQ,CAAC,EAAsC,CACnD,GAAI,CAAC,KAAK,QAAU,KAAK,QACvB,MAAU,MAAM,4CAA4C,EAG9D,MAAM,KAAK,QAAQ,MAAM,EACzB,KAAK,OAAS,KAAK,OAAO,SAAS,EACnC,KAAK,OAAS,KAAK,OAAO,SAAS,UAAU,EAC7C,KAAK,QAAU,QAIX,MAAK,CAAC,EAAiC,CAC3C,GAAI,CAAC,KAAK,OACR,MAAU,MAAM,sBAAsB,EAExC,MAAM,KAAK,OAAO,MAAM,CAAI,QAIvB,IAAI,EAA8C,CACvD,GAAI,CAAC,KAAK,OACR,MAAU,MAAM,sBAAsB,EAGxC,IAAM,EAAS,KAAK,OAAO,SAAS,UAAU,EAC9C,GAAI,CACF,MAAO,GAAM,CACX,IAAQ,QAAO,QAAS,MAAM,EAAO,KAAK,EAC1C,GAAI,EACF,MAEF,GAAI,EACF,MAAM,UAGV,CACA,EAAO,YAAY,QAKjB,MAAK,EAAkB,CAC3B,MAAM,KAAK,QAAQ,MAAM,EACzB,MAAM,KAAK,QAAQ,MAAM,EACzB,KAAK,OAAS,KACd,KAAK,OAAS,KACd,KAAK,WAAa,GAEtB",
-  "debugId": "698255E287F8C83164756E2164756E21",
+  "debugId": "1AA656504F14311964756E2164756E21",
   "names": []
 }

package/dist/adapters/deno.js

@@ -1,3 +1,3 @@
-import"../chunk-sqn04kae.js";class v{conn=null;_secure;_connected=!1;tlsOptions;constructor(j={}){if(typeof Deno>"u")throw Error("DenoAdapter requires the Deno runtime");this._secure=j.secure??!1,this.tlsOptions=j.tls??{}}get secure(){return this._secure}get connected(){return this._connected}async connect(j,q){if(this._secure)this.conn=await Deno.connectTls({hostname:j,port:q,...this.tlsOptions.servername?{servername:this.tlsOptions.servername}:{}});else this.conn=await Deno.connect({hostname:j,port:q});this._connected=!0}async startTLS(j){if(!this.conn||this._secure)throw Error("Cannot STARTTLS: no plain connection available");let q={...this.tlsOptions,...j};this.conn=await Deno.startTls(this.conn,{...q.servername?{hostname:q.servername}:{}}),this._secure=!0}async write(j){if(!this.conn)throw Error("Socket not connected");await this.conn.write(j)}async*read(){if(!this.conn)throw Error("Socket not connected");let j=new Uint8Array(8192);while(!0){let q=await this.conn.read(j);if(q===null)break;yield j.slice(0,q)}}async close(){this.conn?.close(),this.conn=null,this._connected=!1}}export{v as DenoAdapter};
+import"../chunk-rhade81v.js";class v{conn=null;_secure;_connected=!1;tlsOptions;constructor(j={}){if(typeof Deno>"u")throw Error("DenoAdapter requires the Deno runtime");this._secure=j.secure??!1,this.tlsOptions=j.tls??{}}get secure(){return this._secure}get connected(){return this._connected}async connect(j,q){if(this._secure)this.conn=await Deno.connectTls({hostname:j,port:q,...this.tlsOptions.servername?{servername:this.tlsOptions.servername}:{}});else this.conn=await Deno.connect({hostname:j,port:q});this._connected=!0}async startTLS(j){if(!this.conn||this._secure)throw Error("Cannot STARTTLS: no plain connection available");let q={...this.tlsOptions,...j};this.conn=await Deno.startTls(this.conn,{...q.servername?{hostname:q.servername}:{}}),this._secure=!0}async write(j){if(!this.conn)throw Error("Socket not connected");await this.conn.write(j)}async*read(){if(!this.conn)throw Error("Socket not connected");let j=new Uint8Array(8192);while(!0){let q=await this.conn.read(j);if(q===null)break;yield j.slice(0,q)}}async close(){this.conn?.close(),this.conn=null,this._connected=!1}}export{v as DenoAdapter};
 
 //# debugId=433F0358DDA6910C64756E2164756E21

package/dist/adapters/node.js

@@ -1,3 +1,3 @@
-import"../chunk-sqn04kae.js";import W from"node:net";import Q from"node:tls";function V(f){if(f.rejectUnauthorized===!1)console.warn("[sently] TLS certificate verification is disabled. Never use rejectUnauthorized: false in production.")}class X{socket=null;_secure;_connected=!1;connectionTimeout;tlsOptions;constructor(f={}){this._secure=f.secure??!1,this.connectionTimeout=f.connectionTimeout??30000,this.tlsOptions=f.tls??{}}get secure(){return this._secure}get connected(){return this._connected}async connect(f,B){if(this._secure)await this.connectTls(f,B);else await this.connectPlain(f,B);this._connected=!0}async startTLS(f){if(!this.socket||this._secure)throw Error("Cannot STARTTLS: no plain socket available");let B=this.socket,y={...this.tlsOptions,...f};V(y),await new Promise((F,A)=>{let G=Q.connect({socket:B,servername:y.servername,rejectUnauthorized:y.rejectUnauthorized??!0,minVersion:y.minVersion});G.once("secureConnect",()=>{this.socket=G,this._secure=!0,F()}),G.once("error",A)})}async write(f){if(!this.socket)throw Error("Socket not connected");await new Promise((B,y)=>{this.socket?.write(Buffer.from(f),(F)=>{if(F)y(F);else B()})})}async*read(){if(!this.socket)throw Error("Socket not connected");let f=this.socket,B=[],y=null,F=!1,A=null,G=(H)=>{let I=new Uint8Array(H);if(y)y({value:I,done:!1}),y=null;else B.push(I)},J=(H)=>{if(A=H,y)y({value:void 0,done:!0}),y=null;F=!0},K=()=>{if(F=!0,y)y({value:void 0,done:!0}),y=null};f.on("data",G),f.on("error",J),f.on("close",K);try{while(!F||B.length>0){if(A)throw A;if(B.length>0){yield B.shift();continue}if(F)break;let H=await new Promise((I)=>{y=I});if(H.done)break;yield H.value}}finally{f.off("data",G),f.off("error",J),f.off("close",K)}}async close(){if(!this.socket)return;await new Promise((f)=>{this.socket?.end(()=>f())}),this.socket=null,this._connected=!1}connectPlain(f,B){return new Promise((y,F)=>{let A=W.connect({host:f,port:B},()=>y());A.setTimeout(this.connectionTimeout),A.once("timeout",()=>{A.destroy(),F(Error("Connection timeout"))}),A.once("error",F),this.socket=A})}connectTls(f,B){return V(this.tlsOptions),new Promise((y,F)=>{let A=Q.connect({host:f,port:B,servername:this.tlsOptions.servername??f,rejectUnauthorized:this.tlsOptions.rejectUnauthorized??!0,minVersion:this.tlsOptions.minVersion},()=>y());A.setTimeout(this.connectionTimeout),A.once("timeout",()=>{A.destroy(),F(Error("Connection timeout"))}),A.once("error",F),this.socket=A})}}export{X as NodeAdapter};
+import"../chunk-rhade81v.js";import W from"node:net";import Q from"node:tls";function V(f){if(f.rejectUnauthorized===!1)console.warn("[sently] TLS certificate verification is disabled. Never use rejectUnauthorized: false in production.")}class X{socket=null;_secure;_connected=!1;connectionTimeout;tlsOptions;constructor(f={}){this._secure=f.secure??!1,this.connectionTimeout=f.connectionTimeout??30000,this.tlsOptions=f.tls??{}}get secure(){return this._secure}get connected(){return this._connected}async connect(f,B){if(this._secure)await this.connectTls(f,B);else await this.connectPlain(f,B);this._connected=!0}async startTLS(f){if(!this.socket||this._secure)throw Error("Cannot STARTTLS: no plain socket available");let B=this.socket,y={...this.tlsOptions,...f};V(y),await new Promise((F,A)=>{let G=Q.connect({socket:B,servername:y.servername,rejectUnauthorized:y.rejectUnauthorized??!0,minVersion:y.minVersion});G.once("secureConnect",()=>{this.socket=G,this._secure=!0,F()}),G.once("error",A)})}async write(f){if(!this.socket)throw Error("Socket not connected");await new Promise((B,y)=>{this.socket?.write(Buffer.from(f),(F)=>{if(F)y(F);else B()})})}async*read(){if(!this.socket)throw Error("Socket not connected");let f=this.socket,B=[],y=null,F=!1,A=null,G=(H)=>{let I=new Uint8Array(H);if(y)y({value:I,done:!1}),y=null;else B.push(I)},J=(H)=>{if(A=H,y)y({value:void 0,done:!0}),y=null;F=!0},K=()=>{if(F=!0,y)y({value:void 0,done:!0}),y=null};f.on("data",G),f.on("error",J),f.on("close",K);try{while(!F||B.length>0){if(A)throw A;if(B.length>0){yield B.shift();continue}if(F)break;let H=await new Promise((I)=>{y=I});if(H.done)break;yield H.value}}finally{f.off("data",G),f.off("error",J),f.off("close",K)}}async close(){if(!this.socket)return;await new Promise((f)=>{this.socket?.end(()=>f())}),this.socket=null,this._connected=!1}connectPlain(f,B){return new Promise((y,F)=>{let A=W.connect({host:f,port:B},()=>y());A.setTimeout(this.connectionTimeout),A.once("timeout",()=>{A.destroy(),F(Error("Connection timeout"))}),A.once("error",F),this.socket=A})}connectTls(f,B){return V(this.tlsOptions),new Promise((y,F)=>{let A=Q.connect({host:f,port:B,servername:this.tlsOptions.servername??f,rejectUnauthorized:this.tlsOptions.rejectUnauthorized??!0,minVersion:this.tlsOptions.minVersion},()=>y());A.setTimeout(this.connectionTimeout),A.once("timeout",()=>{A.destroy(),F(Error("Connection timeout"))}),A.once("error",F),this.socket=A})}}export{X as NodeAdapter};
 
 //# debugId=81CB75805F76C9AC64756E2164756E21

package/dist/auth/oauth2.js

@@ -1,3 +1,3 @@
-import{g as a,h as b,i as c}from"../chunk-dgkh77yp.js";import"../chunk-6yggz45h.js";import"../chunk-sqn04kae.js";export{c as OAuth2Client,b as MICROSOFT_TOKEN_URL,a as GOOGLE_TOKEN_URL};
+import{g as a,h as b,i as c}from"../chunk-j5m37k1c.js";import"../chunk-32dj0v9g.js";import"../chunk-rhade81v.js";export{c as OAuth2Client,b as MICROSOFT_TOKEN_URL,a as GOOGLE_TOKEN_URL};
 
 //# debugId=8B34C4BC825539BC64756E2164756E21

package/dist/{chunk-6yggz45h.js → chunk-32dj0v9g.js}

@@ -1,5 +1,5 @@
 var J=new TextEncoder;function P(k){let f=typeof k==="string"?J.encode(k):k,j="",A=0;while(A<f.length){let m=f[A]??0,q=f[A+1],z=f[A+2];if(q===void 0){j+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[m>>2],j+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[(m&3)<<4],j+="==";break}if(z===void 0){j+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[m>>2],j+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[(m&3)<<4|q>>4],j+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[(q&15)<<2],j+="=";break}j+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[m>>2],j+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[(m&3)<<4|q>>4],j+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[(q&15)<<2|z>>6],j+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[z&63],A+=3}return R(j)}function S(k){let f=k.replace(/\s/g,""),j=f.length;if(j===0)return new Uint8Array(0);if(j%4!==0)throw Error("Invalid base64 string length");let A=f.endsWith("==")?2:f.endsWith("=")?1:0,m=j*3/4-A,q=new Uint8Array(m),z=0;for(let D=0;D<j;D+=4){let K=G(f[D]??"="),M=G(f[D+1]??"="),N=G(f[D+2]??"="),O=G(f[D+3]??"="),H=K<<18|M<<12|N<<6|O;if(z<m)q[z++]=H>>16&255;if(z<m)q[z++]=H>>8&255;if(z<m)q[z++]=H&255}return q}function W(k){if(!Q(k))return k;return`=?UTF-8?B?${P(k).replace(/\r\n/g,"")}?=`}function Q(k){for(let f=0;f<k.length;f++)if(k.charCodeAt(f)>127)return!0;return!1}function G(k){if(k==="=")return 0;let f="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".indexOf(k);if(f===-1)throw Error(`Invalid base64 character: ${k}`);return f}function R(k){let f=[];for(let j=0;j<k.length;j+=76)f.push(k.slice(j,j+76));return f.join(`\r
 `)}function X(k){return J.encode(k)}
-export{P as E,S as F,W as G,X as H};
+export{P as G,S as H,W as I,X as J};
 
-//# debugId=CA1328BCB199FC6564756E2164756E21
+//# debugId=34038839FA03CAE564756E2164756E21

package/dist/{chunk-6yggz45h.js.map → chunk-32dj0v9g.js.map}

@@ -5,6 +5,6 @@
     "// src/core/base64.ts\n\nconst BASE64_CHARS = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\nconst BASE64_LINE_LENGTH = 76;\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\n/**\n * Encode a Uint8Array or string to Base64.\n * Uses TextEncoder + manual base64 to support binary data correctly.\n */\nexport function encodeBase64(data: Uint8Array | string): string {\n  const bytes = typeof data === \"string\" ? encoder.encode(data) : data;\n  let result = \"\";\n  let i = 0;\n\n  while (i < bytes.length) {\n    const b0 = bytes[i] ?? 0;\n    const b1 = bytes[i + 1];\n    const b2 = bytes[i + 2];\n\n    if (b1 === undefined) {\n      result += BASE64_CHARS[b0 >> 2];\n      result += BASE64_CHARS[(b0 & 0x03) << 4];\n      result += \"==\";\n      break;\n    }\n\n    if (b2 === undefined) {\n      result += BASE64_CHARS[b0 >> 2];\n      result += BASE64_CHARS[((b0 & 0x03) << 4) | (b1 >> 4)];\n      result += BASE64_CHARS[(b1 & 0x0f) << 2];\n      result += \"=\";\n      break;\n    }\n\n    result += BASE64_CHARS[b0 >> 2];\n    result += BASE64_CHARS[((b0 & 0x03) << 4) | (b1 >> 4)];\n    result += BASE64_CHARS[((b1 & 0x0f) << 2) | (b2 >> 6)];\n    result += BASE64_CHARS[b2 & 0x3f];\n    i += 3;\n  }\n\n  return wrapBase64Lines(result);\n}\n\n/**\n * Decode a Base64 string to Uint8Array.\n */\nexport function decodeBase64(data: string): Uint8Array {\n  const cleaned = data.replace(/\\s/g, \"\");\n  const len = cleaned.length;\n\n  if (len === 0) {\n    return new Uint8Array(0);\n  }\n\n  if (len % 4 !== 0) {\n    throw new Error(\"Invalid base64 string length\");\n  }\n\n  const padding = cleaned.endsWith(\"==\") ? 2 : cleaned.endsWith(\"=\") ? 1 : 0;\n  const outputLen = (len * 3) / 4 - padding;\n  const output = new Uint8Array(outputLen);\n\n  let outIndex = 0;\n  for (let i = 0; i < len; i += 4) {\n    const c0 = base64CharToValue(cleaned[i] ?? \"=\");\n    const c1 = base64CharToValue(cleaned[i + 1] ?? \"=\");\n    const c2 = base64CharToValue(cleaned[i + 2] ?? \"=\");\n    const c3 = base64CharToValue(cleaned[i + 3] ?? \"=\");\n    const triple = (c0 << 18) | (c1 << 12) | (c2 << 6) | c3;\n\n    if (outIndex < outputLen) {\n      output[outIndex++] = (triple >> 16) & 0xff;\n    }\n    if (outIndex < outputLen) {\n      output[outIndex++] = (triple >> 8) & 0xff;\n    }\n    if (outIndex < outputLen) {\n      output[outIndex++] = triple & 0xff;\n    }\n  }\n\n  return output;\n}\n\n/**\n * Encode text using Quoted-Printable (RFC 2045).\n */\nexport function encodeQP(text: string): string {\n  const bytes = encoder.encode(text);\n  const lines: string[] = [];\n  let line = \"\";\n\n  for (let i = 0; i < bytes.length; i++) {\n    const byte = bytes[i] ?? 0;\n\n    if (byte === 0x0a) {\n      lines.push(line);\n      line = \"\";\n      continue;\n    }\n\n    if (byte === 0x0d) {\n      continue;\n    }\n\n    let encoded: string;\n    if (\n      (byte >= 33 && byte <= 60) ||\n      (byte >= 62 && byte <= 126) ||\n      byte === 0x09 ||\n      byte === 0x20\n    ) {\n      encoded = String.fromCharCode(byte);\n    } else {\n      encoded = `=${byte.toString(16).toUpperCase().padStart(2, \"0\")}`;\n    }\n\n    if (line.length + encoded.length > 75) {\n      lines.push(`${line}=`);\n      line = encoded;\n    } else {\n      line += encoded;\n    }\n  }\n\n  if (line.length > 0) {\n    lines.push(line);\n  }\n\n  return lines.join(\"\\r\\n\");\n}\n\n/**\n * Encode an email header value per RFC 2047.\n * Non-ASCII values become: =?UTF-8?B?<base64>?=\n */\nexport function encodeHeader(value: string): string {\n  if (!needsEncoding(value)) {\n    return value;\n  }\n\n  const encoded = encodeBase64(value).replace(/\\r\\n/g, \"\");\n  return `=?UTF-8?B?${encoded}?=`;\n}\n\n/**\n * Returns true if the string contains non-ASCII characters\n * and therefore requires RFC 2047 encoding in headers.\n */\nexport function needsEncoding(text: string): boolean {\n  for (let i = 0; i < text.length; i++) {\n    if (text.charCodeAt(i) > 127) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction base64CharToValue(char: string): number {\n  if (char === \"=\") {\n    return 0;\n  }\n  const index = BASE64_CHARS.indexOf(char);\n  if (index === -1) {\n    throw new Error(`Invalid base64 character: ${char}`);\n  }\n  return index;\n}\n\nfunction wrapBase64Lines(base64: string): string {\n  const lines: string[] = [];\n  for (let i = 0; i < base64.length; i += BASE64_LINE_LENGTH) {\n    lines.push(base64.slice(i, i + BASE64_LINE_LENGTH));\n  }\n  return lines.join(\"\\r\\n\");\n}\n\n/** Decode bytes to UTF-8 string. */\nexport function decodeUtf8(bytes: Uint8Array): string {\n  return decoder.decode(bytes);\n}\n\n/** Encode string to UTF-8 bytes. */\nexport function encodeUtf8(text: string): Uint8Array {\n  return encoder.encode(text);\n}\n"
   ],
   "mappings": "AAKA,IAAM,EAAU,IAAI,YAOb,SAAS,CAAY,CAAC,EAAmC,CAC9D,IAAM,EAAQ,OAAO,IAAS,SAAW,EAAQ,OAAO,CAAI,EAAI,EAC5D,EAAS,GACT,EAAI,EAER,MAAO,EAAI,EAAM,OAAQ,CACvB,IAAM,EAAK,EAAM,IAAM,EACjB,EAAK,EAAM,EAAI,GACf,EAAK,EAAM,EAAI,GAErB,GAAI,IAAO,OAAW,CACpB,GArBe,mEAqBQ,GAAM,GAC7B,GAtBe,mEAsBS,GAAK,IAAS,GACtC,GAAU,KACV,MAGF,GAAI,IAAO,OAAW,CACpB,GA5Be,mEA4BQ,GAAM,GAC7B,GA7Be,mEA6BU,GAAK,IAAS,EAAM,GAAM,GACnD,GA9Be,mEA8BS,GAAK,KAAS,GACtC,GAAU,IACV,MAGF,GAnCiB,mEAmCM,GAAM,GAC7B,GApCiB,mEAoCQ,GAAK,IAAS,EAAM,GAAM,GACnD,GArCiB,mEAqCQ,GAAK,KAAS,EAAM,GAAM,GACnD,GAtCiB,mEAsCM,EAAK,IAC5B,GAAK,EAGP,OAAO,EAAgB,CAAM,EAMxB,SAAS,CAAY,CAAC,EAA0B,CACrD,IAAM,EAAU,EAAK,QAAQ,MAAO,EAAE,EAChC,EAAM,EAAQ,OAEpB,GAAI,IAAQ,EACV,OAAO,IAAI,WAAW,CAAC,EAGzB,GAAI,EAAM,IAAM,EACd,MAAU,MAAM,8BAA8B,EAGhD,IAAM,EAAU,EAAQ,SAAS,IAAI,EAAI,EAAI,EAAQ,SAAS,GAAG,EAAI,EAAI,EACnE,EAAa,EAAM,EAAK,EAAI,EAC5B,EAAS,IAAI,WAAW,CAAS,EAEnC,EAAW,EACf,QAAS,EAAI,EAAG,EAAI,EAAK,GAAK,EAAG,CAC/B,IAAM,EAAK,EAAkB,EAAQ,IAAM,GAAG,EACxC,EAAK,EAAkB,EAAQ,EAAI,IAAM,GAAG,EAC5C,EAAK,EAAkB,EAAQ,EAAI,IAAM,GAAG,EAC5C,EAAK,EAAkB,EAAQ,EAAI,IAAM,GAAG,EAC5C,EAAU,GAAM,GAAO,GAAM,GAAO,GAAM,EAAK,EAErD,GAAI,EAAW,EACb,EAAO,KAAe,GAAU,GAAM,IAExC,GAAI,EAAW,EACb,EAAO,KAAe,GAAU,EAAK,IAEvC,GAAI,EAAW,EACb,EAAO,KAAc,EAAS,IAIlC,OAAO,EAuDF,SAAS,CAAY,CAAC,EAAuB,CAClD,GAAI,CAAC,EAAc,CAAK,EACtB,OAAO,EAIT,MAAO,aADS,EAAa,CAAK,EAAE,QAAQ,QAAS,EAAE,MAQlD,SAAS,CAAa,CAAC,EAAuB,CACnD,QAAS,EAAI,EAAG,EAAI,EAAK,OAAQ,IAC/B,GAAI,EAAK,WAAW,CAAC,EAAI,IACvB,MAAO,GAGX,MAAO,GAGT,SAAS,CAAiB,CAAC,EAAsB,CAC/C,GAAI,IAAS,IACX,MAAO,GAET,IAAM,EApKa,mEAoKQ,QAAQ,CAAI,EACvC,GAAI,IAAU,GACZ,MAAU,MAAM,6BAA6B,GAAM,EAErD,OAAO,EAGT,SAAS,CAAe,CAAC,EAAwB,CAC/C,IAAM,EAAkB,CAAC,EACzB,QAAS,EAAI,EAAG,EAAI,EAAO,OAAQ,GA5KV,GA6KvB,EAAM,KAAK,EAAO,MAAM,EAAG,EA7KJ,EA6K0B,CAAC,EAEpD,OAAO,EAAM,KAAK;AAAA,CAAM,EASnB,SAAS,CAAU,CAAC,EAA0B,CACnD,OAAO,EAAQ,OAAO,CAAI",
-  "debugId": "CA1328BCB199FC6564756E2164756E21",
+  "debugId": "34038839FA03CAE564756E2164756E21",
   "names": []
 }

package/dist/chunk-cvmk9h1r.js

@@ -0,0 +1,4 @@
+import{K as C}from"./chunk-rhade81v.js";async function K(D,y){let E=D??[],j=[];for(let b of E){if(b.content instanceof Uint8Array){j.push(b);continue}if(b.path){let z;try{z=await import("node:fs/promises")}catch{throw Error("attachment.path is not supported on this runtime — use attachment.content (Uint8Array) instead")}if(y?.basePath){let{resolve:A,sep:H}=await import("node:path"),k=A(b.path),w=A(y.basePath);if(!(k===w||k.startsWith(w+H)))throw Error(`[sently] Attachment path "${k}" escapes basePath "${w}". Use absolute paths within the allowed directory.`)}let F=await z.readFile(b.path),{path:I,...G}=b;j.push({...G,content:new Uint8Array(F)});continue}if(typeof b.content==="string"){j.push(b);continue}j.push(b)}return j}
+export{K as l};
+
+//# debugId=FC32A4B8D9F426A964756E2164756E21

package/dist/chunk-cvmk9h1r.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/transports/resolve-attachments.ts"],
+  "sourcesContent": [
+    "import type { Attachment } from \"../core/types.js\";\n\n/** Options for {@link resolveAttachments}. */\nexport interface ResolveAttachmentsOptions {\n  /**\n   * If set, attachment paths must resolve within this directory.\n   * Prevents path traversal via `..` segments and sibling-directory\n   * prefix matches. Opt-in only.\n   *\n   * Note: this check uses `node:path` `resolve()`, which does NOT\n   * dereference symlinks. A symlink located inside `basePath` that\n   * points outside of it will pass this check. If symlink traversal is\n   * a concern, resolve paths with `fs.realpath()` before passing them in.\n   */\n  basePath?: string;\n}\n\n/**\n * Resolve attachment.path to in-memory Uint8Array content.\n * @throws When attachment.path is used on runtimes without node:fs/promises\n */\nexport async function resolveAttachments(\n  attachments: Attachment[] | undefined,\n  options?: ResolveAttachmentsOptions,\n): Promise<Attachment[]> {\n  const list = attachments ?? [];\n  const resolved: Attachment[] = [];\n\n  for (const attachment of list) {\n    if (attachment.content instanceof Uint8Array) {\n      resolved.push(attachment);\n      continue;\n    }\n\n    if (attachment.path) {\n      let fs: typeof import(\"node:fs/promises\");\n      try {\n        fs = await import(\"node:fs/promises\");\n      } catch {\n        throw new Error(\n          \"attachment.path is not supported on this runtime — use attachment.content (Uint8Array) instead\",\n        );\n      }\n\n      if (options?.basePath) {\n        const { resolve, sep } = await import(\"node:path\");\n        const resolvedPath = resolve(attachment.path);\n        const resolvedBase = resolve(options.basePath);\n        // startsWith alone is vulnerable: \"/var/data-secret\" passes \"/var/data\".\n        // Require an exact match or a trailing path separator.\n        const isWithin =\n          resolvedPath === resolvedBase || resolvedPath.startsWith(resolvedBase + sep);\n        if (!isWithin) {\n          throw new Error(\n            `[sently] Attachment path \"${resolvedPath}\" escapes basePath \"${resolvedBase}\". ` +\n              \"Use absolute paths within the allowed directory.\",\n          );\n        }\n      }\n\n      const data = await fs.readFile(attachment.path);\n      const { path: _path, ...rest } = attachment;\n      resolved.push({ ...rest, content: new Uint8Array(data) });\n      continue;\n    }\n\n    if (typeof attachment.content === \"string\") {\n      resolved.push(attachment);\n      continue;\n    }\n\n    resolved.push(attachment);\n  }\n\n  return resolved;\n}\n"
+  ],
+  "mappings": "wCAqBA,eAAsB,CAAkB,CACtC,EACA,EACuB,CACvB,IAAM,EAAO,GAAe,CAAC,EACvB,EAAyB,CAAC,EAEhC,QAAW,KAAc,EAAM,CAC7B,GAAI,EAAW,mBAAmB,WAAY,CAC5C,EAAS,KAAK,CAAU,EACxB,SAGF,GAAI,EAAW,KAAM,CACnB,IAAI,EACJ,GAAI,CACF,EAAK,KAAa,4BAClB,KAAM,CACN,MAAU,MACR,gGACF,EAGF,GAAI,GAAS,SAAU,CACrB,IAAQ,UAAS,OAAQ,KAAa,qBAChC,EAAe,EAAQ,EAAW,IAAI,EACtC,EAAe,EAAQ,EAAQ,QAAQ,EAK7C,GAAI,EADF,IAAiB,GAAgB,EAAa,WAAW,EAAe,CAAG,GAE3E,MAAU,MACR,6BAA6B,wBAAmC,sDAElE,EAIJ,IAAM,EAAO,MAAM,EAAG,SAAS,EAAW,IAAI,GACtC,KAAM,KAAU,GAAS,EACjC,EAAS,KAAK,IAAK,EAAM,QAAS,IAAI,WAAW,CAAI,CAAE,CAAC,EACxD,SAGF,GAAI,OAAO,EAAW,UAAY,SAAU,CAC1C,EAAS,KAAK,CAAU,EACxB,SAGF,EAAS,KAAK,CAAU,EAG1B,OAAO",
+  "debugId": "FC32A4B8D9F426A964756E2164756E21",
+  "names": []
+}

package/dist/chunk-j5m37k1c.js

@@ -0,0 +1,4 @@
+import{G as D,J}from"./chunk-32dj0v9g.js";var Q="https://oauth2.googleapis.com/token",$="https://login.microsoftonline.com/common/oauth2/v2.0/token",V=30000;class W{config;cachedToken=null;expiresAt=0;refreshPromise=null;constructor(m){if(this.config=m,m.accessToken)this.cachedToken=m.accessToken,this.expiresAt=Date.now()+3600000}async getAccessToken(){if(this.config.getToken)return this.config.getToken();if(this.cachedToken&&Date.now()<this.expiresAt-V)return this.cachedToken;if(!this.refreshPromise)this.refreshPromise=this.refreshAccessToken().finally(()=>{this.refreshPromise=null});return this.refreshPromise}async refreshAccessToken(){if(this.config.getToken){let v=await this.config.getToken();return this.cachedToken=v,this.expiresAt=Date.now()+3600000,v}let m=this.config.tokenUrl??Q,z=new URLSearchParams({client_id:this.config.clientId,client_secret:this.config.clientSecret,refresh_token:this.config.refreshToken,grant_type:"refresh_token"}),q=await fetch(m,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:z.toString()});if(!q.ok){let v=await q.text();throw Error(`OAuth2 token refresh failed (${q.status}): ${v}`)}let C=await q.json();return this.cachedToken=C.access_token,this.expiresAt=Date.now()+C.expires_in*1000,C.access_token}async buildXOAUTH2(){let m=await this.getAccessToken(),z=`user=${this.config.user}\x01auth=Bearer ${m}\x01\x01`;return D(J(z)).replace(/\r\n/g,"")}}
+export{Q as g,$ as h,W as i};
+
+//# debugId=92611D4BB94BFF7B64756E2164756E21

package/dist/{chunk-dgkh77yp.js.map → chunk-j5m37k1c.js.map}

@@ -4,7 +4,7 @@
   "sourcesContent": [
     "/**\n * @module\n * OAuth2 / XOAUTH2 authentication for SMTP.\n * Supports Gmail, Microsoft 365, and custom OAuth2 providers.\n *\n * @example\n * ```ts\n * import { OAuth2Client } from \"sently/auth/oauth2\";\n * const client = new OAuth2Client({\n *   user: \"me@gmail.com\",\n *   clientId: \"...\",\n *   clientSecret: \"...\",\n *   refreshToken: \"...\",\n * });\n * const token = await client.getAccessToken();\n * ```\n */\nimport { encodeBase64, encodeUtf8 } from \"../core/base64.js\";\nimport type { OAuth2Config } from \"../core/types.js\";\n\n/** Default Google OAuth2 token endpoint. */\nexport const GOOGLE_TOKEN_URL = \"https://oauth2.googleapis.com/token\";\n\n/** Microsoft OAuth2 token endpoint (common tenant). */\nexport const MICROSOFT_TOKEN_URL = \"https://login.microsoftonline.com/common/oauth2/v2.0/token\";\n\n/** OAuth2 token endpoint response shape. */\nexport interface TokenResponse {\n  /** Bearer access token for API or SMTP XOAUTH2. */\n  access_token: string;\n  /** Token lifetime in seconds. */\n  expires_in: number;\n  /** Token type (typically `\"Bearer\"`). */\n  token_type: string;\n}\n\nconst EXPIRY_BUFFER_MS = 30_000;\n\n/**\n * OAuth2 client with in-memory token cache and automatic refresh.\n */\nexport class OAuth2Client {\n  /** OAuth2 configuration supplied at construction. */\n  private readonly config: OAuth2Config;\n  /** Cached access token, or null before the first fetch. */\n  private cachedToken: string | null = null;\n  /** Expiry timestamp (ms) for the cached access token. */\n  private expiresAt = 0;\n  /** In-flight refresh promise used to deduplicate concurrent refreshes. */\n  private refreshPromise: Promise<string> | null = null;\n\n  /** Creates an OAuth2 client from configuration. */\n  constructor(config: OAuth2Config) {\n    this.config = config;\n    if (config.accessToken) {\n      this.cachedToken = config.accessToken;\n      this.expiresAt = Date.now() + 3_600_000;\n    }\n  }\n\n  /**\n   * Get a valid access token (cached when still valid, refreshed otherwise).\n   */\n  async getAccessToken(): Promise<string> {\n    if (this.config.getToken) {\n      return this.config.getToken();\n    }\n\n    if (this.cachedToken && Date.now() < this.expiresAt - EXPIRY_BUFFER_MS) {\n      return this.cachedToken;\n    }\n\n    if (!this.refreshPromise) {\n      this.refreshPromise = this.refreshAccessToken().finally(() => {\n        this.refreshPromise = null;\n      });\n    }\n    return this.refreshPromise;\n  }\n\n  /**\n   * Force-refresh the access token regardless of expiry.\n   */\n  async refreshAccessToken(): Promise<string> {\n    if (this.config.getToken) {\n      const token = await this.config.getToken();\n      this.cachedToken = token;\n      this.expiresAt = Date.now() + 3_600_000;\n      return token;\n    }\n\n    const tokenUrl = this.config.tokenUrl ?? GOOGLE_TOKEN_URL;\n    const body = new URLSearchParams({\n      client_id: this.config.clientId,\n      client_secret: this.config.clientSecret,\n      refresh_token: this.config.refreshToken,\n      grant_type: \"refresh_token\",\n    });\n\n    const response = await fetch(tokenUrl, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body: body.toString(),\n    });\n\n    if (!response.ok) {\n      const text = await response.text();\n      throw new Error(`OAuth2 token refresh failed (${response.status}): ${text}`);\n    }\n\n    const data = (await response.json()) as TokenResponse;\n    this.cachedToken = data.access_token;\n    this.expiresAt = Date.now() + data.expires_in * 1000;\n    return data.access_token;\n  }\n\n  /**\n   * Build the XOAUTH2 SASL string for SMTP AUTH (base64-encoded).\n   */\n  async buildXOAUTH2(): Promise<string> {\n    const token = await this.getAccessToken();\n    const raw = `user=${this.config.user}\\x01auth=Bearer ${token}\\x01\\x01`;\n    return encodeBase64(encodeUtf8(raw)).replace(/\\r\\n/g, \"\");\n  }\n}\n"
   ],
-  "mappings": "+CAqBO,IAAM,EAAmB,sCAGnB,EAAsB,6DAY7B,EAAmB,MAKlB,MAAM,CAAa,CAEP,OAET,YAA6B,KAE7B,UAAY,EAEZ,eAAyC,KAGjD,WAAW,CAAC,EAAsB,CAEhC,GADA,KAAK,OAAS,EACV,EAAO,YACT,KAAK,YAAc,EAAO,YAC1B,KAAK,UAAY,KAAK,IAAI,EAAI,aAO5B,eAAc,EAAoB,CACtC,GAAI,KAAK,OAAO,SACd,OAAO,KAAK,OAAO,SAAS,EAG9B,GAAI,KAAK,aAAe,KAAK,IAAI,EAAI,KAAK,UAAY,EACpD,OAAO,KAAK,YAGd,GAAI,CAAC,KAAK,eACR,KAAK,eAAiB,KAAK,mBAAmB,EAAE,QAAQ,IAAM,CAC5D,KAAK,eAAiB,KACvB,EAEH,OAAO,KAAK,oBAMR,mBAAkB,EAAoB,CAC1C,GAAI,KAAK,OAAO,SAAU,CACxB,IAAM,EAAQ,MAAM,KAAK,OAAO,SAAS,EAGzC,OAFA,KAAK,YAAc,EACnB,KAAK,UAAY,KAAK,IAAI,EAAI,QACvB,EAGT,IAAM,EAAW,KAAK,OAAO,UAAY,EACnC,EAAO,IAAI,gBAAgB,CAC/B,UAAW,KAAK,OAAO,SACvB,cAAe,KAAK,OAAO,aAC3B,cAAe,KAAK,OAAO,aAC3B,WAAY,eACd,CAAC,EAEK,EAAW,MAAM,MAAM,EAAU,CACrC,OAAQ,OACR,QAAS,CAAE,eAAgB,mCAAoC,EAC/D,KAAM,EAAK,SAAS,CACtB,CAAC,EAED,GAAI,CAAC,EAAS,GAAI,CAChB,IAAM,EAAO,MAAM,EAAS,KAAK,EACjC,MAAU,MAAM,gCAAgC,EAAS,YAAY,GAAM,EAG7E,IAAM,EAAQ,MAAM,EAAS,KAAK,EAGlC,OAFA,KAAK,YAAc,EAAK,aACxB,KAAK,UAAY,KAAK,IAAI,EAAI,EAAK,WAAa,KACzC,EAAK,kBAMR,aAAY,EAAoB,CACpC,IAAM,EAAQ,MAAM,KAAK,eAAe,EAClC,EAAM,QAAQ,KAAK,OAAO,uBAAuB,YACvD,OAAO,EAAa,EAAW,CAAG,CAAC,EAAE,QAAQ,QAAS,EAAE,EAE5D",
-  "debugId": "B98629F8950EE32E64756E2164756E21",
+  "mappings": "0CAqBO,IAAM,EAAmB,sCAGnB,EAAsB,6DAY7B,EAAmB,MAKlB,MAAM,CAAa,CAEP,OAET,YAA6B,KAE7B,UAAY,EAEZ,eAAyC,KAGjD,WAAW,CAAC,EAAsB,CAEhC,GADA,KAAK,OAAS,EACV,EAAO,YACT,KAAK,YAAc,EAAO,YAC1B,KAAK,UAAY,KAAK,IAAI,EAAI,aAO5B,eAAc,EAAoB,CACtC,GAAI,KAAK,OAAO,SACd,OAAO,KAAK,OAAO,SAAS,EAG9B,GAAI,KAAK,aAAe,KAAK,IAAI,EAAI,KAAK,UAAY,EACpD,OAAO,KAAK,YAGd,GAAI,CAAC,KAAK,eACR,KAAK,eAAiB,KAAK,mBAAmB,EAAE,QAAQ,IAAM,CAC5D,KAAK,eAAiB,KACvB,EAEH,OAAO,KAAK,oBAMR,mBAAkB,EAAoB,CAC1C,GAAI,KAAK,OAAO,SAAU,CACxB,IAAM,EAAQ,MAAM,KAAK,OAAO,SAAS,EAGzC,OAFA,KAAK,YAAc,EACnB,KAAK,UAAY,KAAK,IAAI,EAAI,QACvB,EAGT,IAAM,EAAW,KAAK,OAAO,UAAY,EACnC,EAAO,IAAI,gBAAgB,CAC/B,UAAW,KAAK,OAAO,SACvB,cAAe,KAAK,OAAO,aAC3B,cAAe,KAAK,OAAO,aAC3B,WAAY,eACd,CAAC,EAEK,EAAW,MAAM,MAAM,EAAU,CACrC,OAAQ,OACR,QAAS,CAAE,eAAgB,mCAAoC,EAC/D,KAAM,EAAK,SAAS,CACtB,CAAC,EAED,GAAI,CAAC,EAAS,GAAI,CAChB,IAAM,EAAO,MAAM,EAAS,KAAK,EACjC,MAAU,MAAM,gCAAgC,EAAS,YAAY,GAAM,EAG7E,IAAM,EAAQ,MAAM,EAAS,KAAK,EAGlC,OAFA,KAAK,YAAc,EAAK,aACxB,KAAK,UAAY,KAAK,IAAI,EAAI,EAAK,WAAa,KACzC,EAAK,kBAMR,aAAY,EAAoB,CACpC,IAAM,EAAQ,MAAM,KAAK,eAAe,EAClC,EAAM,QAAQ,KAAK,OAAO,uBAAuB,YACvD,OAAO,EAAa,EAAW,CAAG,CAAC,EAAE,QAAQ,QAAS,EAAE,EAE5D",
+  "debugId": "92611D4BB94BFF7B64756E2164756E21",
   "names": []
 }

package/dist/chunk-kdqxhybf.js

@@ -0,0 +1,4 @@
+import{I as V}from"./chunk-32dj0v9g.js";function W(q){for(let E=0;E<q.length;E++){let z=q.charCodeAt(E);if(z<=31||z===127||z===8232||z===8233)return z}return-1}function K(q,E="address"){let z=W(q);if(z!==-1){let G=z.toString(16).padStart(2,"0");throw Error(`Email ${E} contains a forbidden control character (0x${G}). CR, LF, NUL, and other control characters are not allowed.`)}}function X(q){if(Array.isArray(q))return q.flatMap((z)=>X(z));if(typeof q==="object"){if(K(q.address,"address"),q.name!==void 0)K(q.name,"display name");return[{...q}]}K(q,"address");let E=q.trim();if(!E)return[];return Y(E).map(Z)}function $(q){if(K(q.address,"address"),q.name)return K(q.name,"display name"),`${V(q.name)} <${q.address}>`;return q.address}function w(q){return X(q).map((E)=>E.address)}function x(q){if(W(q)!==-1)return!1;return/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/.test(q)}function Y(q){let E=[],z="",G=!1,J=!1;for(let O=0;O<q.length;O++){let I=q[O]??"";if(I==='"'&&q[O-1]!=="\\"){G=!G,z+=I;continue}if(I==="<"&&!G){J=!0,z+=I;continue}if(I===">"&&!G){J=!1,z+=I;continue}if(I===","&&!G&&!J){if(z.trim())E.push(z.trim());z="";continue}z+=I}if(z.trim())E.push(z.trim());return E}function Z(q){let E=q.trim(),z=E.match(/^(?:"([^"]*)"|([^<]*?))\s*<([^>]+)>$/);if(z){let G=(z[1]??z[2]??"").trim(),J=(z[3]??"").trim();if(G)return{name:G,address:J};return{address:J}}if(E.startsWith('"')&&E.endsWith('"'))return{address:E.slice(1,-1)};return{address:E}}
+export{K as m,X as n,$ as o,w as p,x as q};
+
+//# debugId=B1EB4F6BACF1B86964756E2164756E21

package/dist/{chunk-va2awz12.js.map → chunk-kdqxhybf.js.map}

@@ -1,11 +1,10 @@
 {
   "version": 3,
-  "sources": ["../src/core/address.ts", "../src/transports/resolve-attachments.ts"],
+  "sources": ["../src/core/address.ts"],
   "sourcesContent": [
-    "// src/core/address.ts\nimport { encodeHeader } from \"./base64.js\";\nimport type { Address, AddressInput } from \"./types.js\";\n\n/**\n * Find the first forbidden control character in a string.\n *\n * Forbidden characters must never appear in an email address or display name,\n * because each enables a distinct attack:\n * - CR (0x0D) / LF (0x0A): email header injection and SMTP command injection\n * - NUL (0x00): C-string truncation / parser confusion in downstream agents\n * - other C0 controls (0x01–0x1F), DEL (0x7F): header/parser confusion\n * - U+2028 / U+2029: line separators that some parsers treat as newlines\n *\n * @returns The char code of the first forbidden character, or -1 if none.\n */\nfunction findForbiddenChar(value: string): number {\n  for (let i = 0; i < value.length; i++) {\n    const code = value.charCodeAt(i);\n    if (code <= 0x1f || code === 0x7f || code === 0x2028 || code === 0x2029) {\n      return code;\n    }\n  }\n  return -1;\n}\n\n/**\n * Assert that a raw address or display-name value contains no forbidden\n * control characters. Throws immediately (fail closed) — the library never\n * attempts to strip or rewrite hostile input into an accepted value.\n *\n * The check is intentionally performed on the RAW input, before any trimming\n * or normalization, so hostile values are rejected rather than repaired.\n *\n * @param value - The raw, untransformed string to validate.\n * @param label - Field label used in the error message (e.g. \"address\").\n * @throws {Error} If the value contains any forbidden control character.\n */\nexport function assertSafeAddress(value: string, label = \"address\"): void {\n  const code = findForbiddenChar(value);\n  if (code !== -1) {\n    const hex = code.toString(16).padStart(2, \"0\");\n    throw new Error(\n      `Email ${label} contains a forbidden control character (0x${hex}). ` +\n        \"CR, LF, NUL, and other control characters are not allowed.\",\n    );\n  }\n}\n\n/**\n * Normalize any AddressInput form into Address[].\n *\n * Every address and display name is validated against control-character\n * injection before any transformation. This is the single chokepoint shared\n * by all transports and address fields (From, To, Cc, Bcc, Reply-To), so the\n * protection is uniform and secure by default.\n *\n * @throws {Error} If any address or name contains a forbidden control character.\n */\nexport function parseAddresses(input: AddressInput): Address[] {\n  if (Array.isArray(input)) {\n    return input.flatMap((item) => parseAddresses(item));\n  }\n\n  if (typeof input === \"object\") {\n    assertSafeAddress(input.address, \"address\");\n    if (input.name !== undefined) {\n      assertSafeAddress(input.name, \"display name\");\n    }\n    return [{ ...input }];\n  }\n\n  // Validate the raw input string before splitting or trimming so injected\n  // newlines cannot hide inside a multi-address list.\n  assertSafeAddress(input, \"address\");\n\n  const trimmed = input.trim();\n  if (!trimmed) {\n    return [];\n  }\n\n  return splitAddressList(trimmed).map(parseSingleAddress);\n}\n\n/**\n * Format an Address for SMTP envelope commands (MAIL FROM / RCPT TO).\n */\nexport function toEnvelope(address: Address): string {\n  return address.address;\n}\n\n/**\n * Format an Address for use in a MIME header (From, To, CC, etc.).\n *\n * Re-validates the address and name at render time so a header can never be\n * emitted with an embedded control character, even if the {@link Address} was\n * constructed without going through {@link parseAddresses}.\n *\n * @throws {Error} If the address or name contains a forbidden control character.\n */\nexport function toMIMEHeader(address: Address): string {\n  assertSafeAddress(address.address, \"address\");\n  if (address.name) {\n    assertSafeAddress(address.name, \"display name\");\n    const name = encodeHeader(address.name);\n    return `${name} <${address.address}>`;\n  }\n  return address.address;\n}\n\n/**\n * Extract plain email strings from any AddressInput.\n */\nexport function extractEmails(input: AddressInput): string[] {\n  return parseAddresses(input).map((addr) => addr.address);\n}\n\n/**\n * Basic email format validation (format only, no DNS lookup).\n *\n * Rejects any control character (including CR, LF, tab, and NUL) before\n * applying the structural check, so a \"valid\" result is always safe to place\n * into a header or SMTP command.\n */\nexport function isValidEmail(email: string): boolean {\n  if (findForbiddenChar(email) !== -1) return false;\n  return /^[^\\s@<>]+@[^\\s@<>]+\\.[^\\s@<>]+$/.test(email);\n}\n\nfunction splitAddressList(input: string): string[] {\n  const parts: string[] = [];\n  let current = \"\";\n  let inQuotes = false;\n  let inAngle = false;\n\n  for (let i = 0; i < input.length; i++) {\n    const char = input[i] ?? \"\";\n    if (char === '\"' && input[i - 1] !== \"\\\\\") {\n      inQuotes = !inQuotes;\n      current += char;\n      continue;\n    }\n    if (char === \"<\" && !inQuotes) {\n      inAngle = true;\n      current += char;\n      continue;\n    }\n    if (char === \">\" && !inQuotes) {\n      inAngle = false;\n      current += char;\n      continue;\n    }\n    if (char === \",\" && !inQuotes && !inAngle) {\n      if (current.trim()) {\n        parts.push(current.trim());\n      }\n      current = \"\";\n      continue;\n    }\n    current += char;\n  }\n\n  if (current.trim()) {\n    parts.push(current.trim());\n  }\n\n  return parts;\n}\n\nfunction parseSingleAddress(input: string): Address {\n  const trimmed = input.trim();\n\n  const angleMatch = trimmed.match(/^(?:\"([^\"]*)\"|([^<]*?))\\s*<([^>]+)>$/);\n  if (angleMatch) {\n    const name = (angleMatch[1] ?? angleMatch[2] ?? \"\").trim();\n    const address = (angleMatch[3] ?? \"\").trim();\n    if (name) {\n      return { name, address };\n    }\n    return { address };\n  }\n\n  if (trimmed.startsWith('\"') && trimmed.endsWith('\"')) {\n    return { address: trimmed.slice(1, -1) };\n  }\n\n  return { address: trimmed };\n}\n",
-    "import type { Attachment } from \"../core/types.js\";\n\n/** Options for {@link resolveAttachments}. */\nexport interface ResolveAttachmentsOptions {\n  /**\n   * If set, attachment paths must resolve within this directory.\n   * Prevents path traversal via `..` segments and sibling-directory\n   * prefix matches. Opt-in only.\n   *\n   * Note: this check uses `node:path` `resolve()`, which does NOT\n   * dereference symlinks. A symlink located inside `basePath` that\n   * points outside of it will pass this check. If symlink traversal is\n   * a concern, resolve paths with `fs.realpath()` before passing them in.\n   */\n  basePath?: string;\n}\n\n/**\n * Resolve attachment.path to in-memory Uint8Array content.\n * @throws When attachment.path is used on runtimes without node:fs/promises\n */\nexport async function resolveAttachments(\n  attachments: Attachment[] | undefined,\n  options?: ResolveAttachmentsOptions,\n): Promise<Attachment[]> {\n  const list = attachments ?? [];\n  const resolved: Attachment[] = [];\n\n  for (const attachment of list) {\n    if (attachment.content instanceof Uint8Array) {\n      resolved.push(attachment);\n      continue;\n    }\n\n    if (attachment.path) {\n      let fs: typeof import(\"node:fs/promises\");\n      try {\n        fs = await import(\"node:fs/promises\");\n      } catch {\n        throw new Error(\n          \"attachment.path is not supported on this runtime — use attachment.content (Uint8Array) instead\",\n        );\n      }\n\n      if (options?.basePath) {\n        const { resolve, sep } = await import(\"node:path\");\n        const resolvedPath = resolve(attachment.path);\n        const resolvedBase = resolve(options.basePath);\n        // startsWith alone is vulnerable: \"/var/data-secret\" passes \"/var/data\".\n        // Require an exact match or a trailing path separator.\n        const isWithin =\n          resolvedPath === resolvedBase || resolvedPath.startsWith(resolvedBase + sep);\n        if (!isWithin) {\n          throw new Error(\n            `[sently] Attachment path \"${resolvedPath}\" escapes basePath \"${resolvedBase}\". ` +\n              \"Use absolute paths within the allowed directory.\",\n          );\n        }\n      }\n\n      const data = await fs.readFile(attachment.path);\n      const { path: _path, ...rest } = attachment;\n      resolved.push({ ...rest, content: new Uint8Array(data) });\n      continue;\n    }\n\n    if (typeof attachment.content === \"string\") {\n      resolved.push(attachment);\n      continue;\n    }\n\n    resolved.push(attachment);\n  }\n\n  return resolved;\n}\n"
+    "// src/core/address.ts\nimport { encodeHeader } from \"./base64.js\";\nimport type { Address, AddressInput } from \"./types.js\";\n\n/**\n * Find the first forbidden control character in a string.\n *\n * Forbidden characters must never appear in an email address or display name,\n * because each enables a distinct attack:\n * - CR (0x0D) / LF (0x0A): email header injection and SMTP command injection\n * - NUL (0x00): C-string truncation / parser confusion in downstream agents\n * - other C0 controls (0x01–0x1F), DEL (0x7F): header/parser confusion\n * - U+2028 / U+2029: line separators that some parsers treat as newlines\n *\n * @returns The char code of the first forbidden character, or -1 if none.\n */\nfunction findForbiddenChar(value: string): number {\n  for (let i = 0; i < value.length; i++) {\n    const code = value.charCodeAt(i);\n    if (code <= 0x1f || code === 0x7f || code === 0x2028 || code === 0x2029) {\n      return code;\n    }\n  }\n  return -1;\n}\n\n/**\n * Assert that a raw address or display-name value contains no forbidden\n * control characters. Throws immediately (fail closed) — the library never\n * attempts to strip or rewrite hostile input into an accepted value.\n *\n * The check is intentionally performed on the RAW input, before any trimming\n * or normalization, so hostile values are rejected rather than repaired.\n *\n * @param value - The raw, untransformed string to validate.\n * @param label - Field label used in the error message (e.g. \"address\").\n * @throws {Error} If the value contains any forbidden control character.\n */\nexport function assertSafeAddress(value: string, label = \"address\"): void {\n  const code = findForbiddenChar(value);\n  if (code !== -1) {\n    const hex = code.toString(16).padStart(2, \"0\");\n    throw new Error(\n      `Email ${label} contains a forbidden control character (0x${hex}). ` +\n        \"CR, LF, NUL, and other control characters are not allowed.\",\n    );\n  }\n}\n\n/**\n * Normalize any AddressInput form into Address[].\n *\n * Every address and display name is validated against control-character\n * injection before any transformation. This is the single chokepoint shared\n * by all transports and address fields (From, To, Cc, Bcc, Reply-To), so the\n * protection is uniform and secure by default.\n *\n * @throws {Error} If any address or name contains a forbidden control character.\n */\nexport function parseAddresses(input: AddressInput): Address[] {\n  if (Array.isArray(input)) {\n    return input.flatMap((item) => parseAddresses(item));\n  }\n\n  if (typeof input === \"object\") {\n    assertSafeAddress(input.address, \"address\");\n    if (input.name !== undefined) {\n      assertSafeAddress(input.name, \"display name\");\n    }\n    return [{ ...input }];\n  }\n\n  // Validate the raw input string before splitting or trimming so injected\n  // newlines cannot hide inside a multi-address list.\n  assertSafeAddress(input, \"address\");\n\n  const trimmed = input.trim();\n  if (!trimmed) {\n    return [];\n  }\n\n  return splitAddressList(trimmed).map(parseSingleAddress);\n}\n\n/**\n * Format an Address for SMTP envelope commands (MAIL FROM / RCPT TO).\n */\nexport function toEnvelope(address: Address): string {\n  return address.address;\n}\n\n/**\n * Format an Address for use in a MIME header (From, To, CC, etc.).\n *\n * Re-validates the address and name at render time so a header can never be\n * emitted with an embedded control character, even if the {@link Address} was\n * constructed without going through {@link parseAddresses}.\n *\n * @throws {Error} If the address or name contains a forbidden control character.\n */\nexport function toMIMEHeader(address: Address): string {\n  assertSafeAddress(address.address, \"address\");\n  if (address.name) {\n    assertSafeAddress(address.name, \"display name\");\n    const name = encodeHeader(address.name);\n    return `${name} <${address.address}>`;\n  }\n  return address.address;\n}\n\n/**\n * Extract plain email strings from any AddressInput.\n */\nexport function extractEmails(input: AddressInput): string[] {\n  return parseAddresses(input).map((addr) => addr.address);\n}\n\n/**\n * Basic email format validation (format only, no DNS lookup).\n *\n * Rejects any control character (including CR, LF, tab, and NUL) before\n * applying the structural check, so a \"valid\" result is always safe to place\n * into a header or SMTP command.\n */\nexport function isValidEmail(email: string): boolean {\n  if (findForbiddenChar(email) !== -1) return false;\n  return /^[^\\s@<>]+@[^\\s@<>]+\\.[^\\s@<>]+$/.test(email);\n}\n\nfunction splitAddressList(input: string): string[] {\n  const parts: string[] = [];\n  let current = \"\";\n  let inQuotes = false;\n  let inAngle = false;\n\n  for (let i = 0; i < input.length; i++) {\n    const char = input[i] ?? \"\";\n    if (char === '\"' && input[i - 1] !== \"\\\\\") {\n      inQuotes = !inQuotes;\n      current += char;\n      continue;\n    }\n    if (char === \"<\" && !inQuotes) {\n      inAngle = true;\n      current += char;\n      continue;\n    }\n    if (char === \">\" && !inQuotes) {\n      inAngle = false;\n      current += char;\n      continue;\n    }\n    if (char === \",\" && !inQuotes && !inAngle) {\n      if (current.trim()) {\n        parts.push(current.trim());\n      }\n      current = \"\";\n      continue;\n    }\n    current += char;\n  }\n\n  if (current.trim()) {\n    parts.push(current.trim());\n  }\n\n  return parts;\n}\n\nfunction parseSingleAddress(input: string): Address {\n  const trimmed = input.trim();\n\n  const angleMatch = trimmed.match(/^(?:\"([^\"]*)\"|([^<]*?))\\s*<([^>]+)>$/);\n  if (angleMatch) {\n    const name = (angleMatch[1] ?? angleMatch[2] ?? \"\").trim();\n    const address = (angleMatch[3] ?? \"\").trim();\n    if (name) {\n      return { name, address };\n    }\n    return { address };\n  }\n\n  if (trimmed.startsWith('\"') && trimmed.endsWith('\"')) {\n    return { address: trimmed.slice(1, -1) };\n  }\n\n  return { address: trimmed };\n}\n"
   ],
-  "mappings": "sFAgBA,GAAS,CAAiB,CAAC,EAAuB,CAChD,QAAS,EAAI,EAAG,EAAI,EAAM,OAAQ,IAAK,CACrC,IAAM,EAAO,EAAM,WAAW,CAAC,EAC/B,GAAI,GAAQ,IAAQ,IAAS,KAAQ,IAAS,MAAU,IAAS,KAC/D,OAAO,EAGX,MAAO,GAeF,SAAS,CAAiB,CAAC,EAAe,EAAQ,UAAiB,CACxE,IAAM,EAAO,EAAkB,CAAK,EACpC,GAAI,IAAS,GAAI,CACf,IAAM,EAAM,EAAK,SAAS,EAAE,EAAE,SAAS,EAAG,GAAG,EAC7C,MAAU,MACR,SAAS,+CAAmD,gEAE9D,GAcG,SAAS,CAAc,CAAC,EAAgC,CAC7D,GAAI,MAAM,QAAQ,CAAK,EACrB,OAAO,EAAM,QAAQ,CAAC,IAAS,EAAe,CAAI,CAAC,EAGrD,GAAI,OAAO,IAAU,SAAU,CAE7B,GADA,EAAkB,EAAM,QAAS,SAAS,EACtC,EAAM,OAAS,OACjB,EAAkB,EAAM,KAAM,cAAc,EAE9C,MAAO,CAAC,IAAK,CAAM,CAAC,EAKtB,EAAkB,EAAO,SAAS,EAElC,IAAM,EAAU,EAAM,KAAK,EAC3B,GAAI,CAAC,EACH,MAAO,CAAC,EAGV,OAAO,EAAiB,CAAO,EAAE,IAAI,CAAkB,EAmBlD,SAAS,CAAY,CAAC,EAA0B,CAErD,GADA,EAAkB,EAAQ,QAAS,SAAS,EACxC,EAAQ,KAGV,OAFA,EAAkB,EAAQ,KAAM,cAAc,EAEvC,GADM,EAAa,EAAQ,IAAI,MACnB,EAAQ,WAE7B,OAAO,EAAQ,QAMV,SAAS,CAAa,CAAC,EAA+B,CAC3D,OAAO,EAAe,CAAK,EAAE,IAAI,CAAC,IAAS,EAAK,OAAO,EAUlD,SAAS,CAAY,CAAC,EAAwB,CACnD,GAAI,EAAkB,CAAK,IAAM,GAAI,MAAO,GAC5C,MAAO,mCAAmC,KAAK,CAAK,EAGtD,SAAS,CAAgB,CAAC,EAAyB,CACjD,IAAM,EAAkB,CAAC,EACrB,EAAU,GACV,EAAW,GACX,EAAU,GAEd,QAAS,EAAI,EAAG,EAAI,EAAM,OAAQ,IAAK,CACrC,IAAM,EAAO,EAAM,IAAM,GACzB,GAAI,IAAS,KAAO,EAAM,EAAI,KAAO,KAAM,CACzC,EAAW,CAAC,EACZ,GAAW,EACX,SAEF,GAAI,IAAS,KAAO,CAAC,EAAU,CAC7B,EAAU,GACV,GAAW,EACX,SAEF,GAAI,IAAS,KAAO,CAAC,EAAU,CAC7B,EAAU,GACV,GAAW,EACX,SAEF,GAAI,IAAS,KAAO,CAAC,GAAY,CAAC,EAAS,CACzC,GAAI,EAAQ,KAAK,EACf,EAAM,KAAK,EAAQ,KAAK,CAAC,EAE3B,EAAU,GACV,SAEF,GAAW,EAGb,GAAI,EAAQ,KAAK,EACf,EAAM,KAAK,EAAQ,KAAK,CAAC,EAG3B,OAAO,EAGT,SAAS,CAAkB,CAAC,EAAwB,CAClD,IAAM,EAAU,EAAM,KAAK,EAErB,EAAa,EAAQ,MAAM,sCAAsC,EACvE,GAAI,EAAY,CACd,IAAM,GAAQ,EAAW,IAAM,EAAW,IAAM,IAAI,KAAK,EACnD,GAAW,EAAW,IAAM,IAAI,KAAK,EAC3C,GAAI,EACF,MAAO,CAAE,OAAM,SAAQ,EAEzB,MAAO,CAAE,SAAQ,EAGnB,GAAI,EAAQ,WAAW,GAAG,GAAK,EAAQ,SAAS,GAAG,EACjD,MAAO,CAAE,QAAS,EAAQ,MAAM,EAAG,EAAE,CAAE,EAGzC,MAAO,CAAE,QAAS,CAAQ,ECrK5B,eAAsB,CAAkB,CACtC,EACA,EACuB,CACvB,IAAM,EAAO,GAAe,CAAC,EACvB,EAAyB,CAAC,EAEhC,QAAW,KAAc,EAAM,CAC7B,GAAI,EAAW,mBAAmB,WAAY,CAC5C,EAAS,KAAK,CAAU,EACxB,SAGF,GAAI,EAAW,KAAM,CACnB,IAAI,EACJ,GAAI,CACF,EAAK,KAAa,4BAClB,KAAM,CACN,MAAU,MACR,gGACF,EAGF,GAAI,GAAS,SAAU,CACrB,IAAQ,UAAS,OAAQ,KAAa,qBAChC,EAAe,EAAQ,EAAW,IAAI,EACtC,EAAe,EAAQ,EAAQ,QAAQ,EAK7C,GAAI,EADF,IAAiB,GAAgB,EAAa,WAAW,EAAe,CAAG,GAE3E,MAAU,MACR,6BAA6B,wBAAmC,sDAElE,EAIJ,IAAM,EAAO,MAAM,EAAG,SAAS,EAAW,IAAI,GACtC,KAAM,KAAU,GAAS,EACjC,EAAS,KAAK,IAAK,EAAM,QAAS,IAAI,WAAW,CAAI,CAAE,CAAC,EACxD,SAGF,GAAI,OAAO,EAAW,UAAY,SAAU,CAC1C,EAAS,KAAK,CAAU,EACxB,SAGF,EAAS,KAAK,CAAU,EAG1B,OAAO",
-  "debugId": "67ECE72AE508464F64756E2164756E21",
+  "mappings": "wCAgBA,SAAS,CAAiB,CAAC,EAAuB,CAChD,QAAS,EAAI,EAAG,EAAI,EAAM,OAAQ,IAAK,CACrC,IAAM,EAAO,EAAM,WAAW,CAAC,EAC/B,GAAI,GAAQ,IAAQ,IAAS,KAAQ,IAAS,MAAU,IAAS,KAC/D,OAAO,EAGX,MAAO,GAeF,SAAS,CAAiB,CAAC,EAAe,EAAQ,UAAiB,CACxE,IAAM,EAAO,EAAkB,CAAK,EACpC,GAAI,IAAS,GAAI,CACf,IAAM,EAAM,EAAK,SAAS,EAAE,EAAE,SAAS,EAAG,GAAG,EAC7C,MAAU,MACR,SAAS,+CAAmD,gEAE9D,GAcG,SAAS,CAAc,CAAC,EAAgC,CAC7D,GAAI,MAAM,QAAQ,CAAK,EACrB,OAAO,EAAM,QAAQ,CAAC,IAAS,EAAe,CAAI,CAAC,EAGrD,GAAI,OAAO,IAAU,SAAU,CAE7B,GADA,EAAkB,EAAM,QAAS,SAAS,EACtC,EAAM,OAAS,OACjB,EAAkB,EAAM,KAAM,cAAc,EAE9C,MAAO,CAAC,IAAK,CAAM,CAAC,EAKtB,EAAkB,EAAO,SAAS,EAElC,IAAM,EAAU,EAAM,KAAK,EAC3B,GAAI,CAAC,EACH,MAAO,CAAC,EAGV,OAAO,EAAiB,CAAO,EAAE,IAAI,CAAkB,EAmBlD,SAAS,CAAY,CAAC,EAA0B,CAErD,GADA,EAAkB,EAAQ,QAAS,SAAS,EACxC,EAAQ,KAGV,OAFA,EAAkB,EAAQ,KAAM,cAAc,EAEvC,GADM,EAAa,EAAQ,IAAI,MACnB,EAAQ,WAE7B,OAAO,EAAQ,QAMV,SAAS,CAAa,CAAC,EAA+B,CAC3D,OAAO,EAAe,CAAK,EAAE,IAAI,CAAC,IAAS,EAAK,OAAO,EAUlD,SAAS,CAAY,CAAC,EAAwB,CACnD,GAAI,EAAkB,CAAK,IAAM,GAAI,MAAO,GAC5C,MAAO,mCAAmC,KAAK,CAAK,EAGtD,SAAS,CAAgB,CAAC,EAAyB,CACjD,IAAM,EAAkB,CAAC,EACrB,EAAU,GACV,EAAW,GACX,EAAU,GAEd,QAAS,EAAI,EAAG,EAAI,EAAM,OAAQ,IAAK,CACrC,IAAM,EAAO,EAAM,IAAM,GACzB,GAAI,IAAS,KAAO,EAAM,EAAI,KAAO,KAAM,CACzC,EAAW,CAAC,EACZ,GAAW,EACX,SAEF,GAAI,IAAS,KAAO,CAAC,EAAU,CAC7B,EAAU,GACV,GAAW,EACX,SAEF,GAAI,IAAS,KAAO,CAAC,EAAU,CAC7B,EAAU,GACV,GAAW,EACX,SAEF,GAAI,IAAS,KAAO,CAAC,GAAY,CAAC,EAAS,CACzC,GAAI,EAAQ,KAAK,EACf,EAAM,KAAK,EAAQ,KAAK,CAAC,EAE3B,EAAU,GACV,SAEF,GAAW,EAGb,GAAI,EAAQ,KAAK,EACf,EAAM,KAAK,EAAQ,KAAK,CAAC,EAG3B,OAAO,EAGT,SAAS,CAAkB,CAAC,EAAwB,CAClD,IAAM,EAAU,EAAM,KAAK,EAErB,EAAa,EAAQ,MAAM,sCAAsC,EACvE,GAAI,EAAY,CACd,IAAM,GAAQ,EAAW,IAAM,EAAW,IAAM,IAAI,KAAK,EACnD,GAAW,EAAW,IAAM,IAAI,KAAK,EAC3C,GAAI,EACF,MAAO,CAAE,OAAM,SAAQ,EAEzB,MAAO,CAAE,SAAQ,EAGnB,GAAI,EAAQ,WAAW,GAAG,GAAK,EAAQ,SAAS,GAAG,EACjD,MAAO,CAAE,QAAS,EAAQ,MAAM,EAAG,EAAE,CAAE,EAGzC,MAAO,CAAE,QAAS,CAAQ",
+  "debugId": "B1EB4F6BACF1B86964756E2164756E21",
   "names": []
 }

package/dist/chunk-m2njnxre.js

@@ -0,0 +1,13 @@
+import{G as O,H as K,J as H}from"./chunk-32dj0v9g.js";var j=64;function X(q){return q>>>0}function U(q){let z=L(q),G=1732584193,Q=4023233417,N=2562383102,J=271733878;for(let F=0;F<z.length;F+=64){let $=z.subarray(F,F+64),w=new Uint32Array(16);for(let W=0;W<16;W++){let A=W*4;w[W]=X(($[A]??0)|($[A+1]??0)<<8|($[A+2]??0)<<16|($[A+3]??0)<<24)}let x=G,D=Q,I=N,R=J;for(let W=0;W<64;W++){let A,_;if(W<16)A=X(D&I|~D&R),_=W;else if(W<32)A=X(D&R|I&~R),_=X((5*W+1)%16);else if(W<48)A=X(D^I^R),_=X((3*W+5)%16);else A=X(I^(D|~R)),_=X(7*W%16);let v=R;R=I,I=D,D=X(D+B(X(x+A+X((C[W]??0)+(w[_]??0))),y[W]??0)),x=v}G=X(G+x),Q=X(Q+D),N=X(N+I),J=X(J+R)}let Y=new Uint8Array(16),V=new DataView(Y.buffer);return V.setUint32(0,G,!0),V.setUint32(4,Q,!0),V.setUint32(8,N,!0),V.setUint32(12,J,!0),Y}var y=[7,12,17,22,7,12,17,22,7,12,17,22,7,12,17,22,5,9,14,20,5,9,14,20,5,9,14,20,5,9,14,20,4,11,16,23,4,11,16,23,4,11,16,23,4,11,16,23,6,10,15,21,6,10,15,21,6,10,15,21,6,10,15,21],C=new Uint32Array([3614090360,3905402710,606105819,3250441966,4118548399,1200080426,2821735955,4249261313,1770035416,2336552879,4294925233,2304563134,1804603682,4254626195,2792965006,1236535329,4129170786,3225465664,643717713,3921069994,3593408605,38016083,3634488961,3889429448,568446438,3275163606,4107603335,1163531501,2850285829,4243563512,1735328473,2368359562,4294588738,2272392833,1839030562,4259657740,2763975236,1272893353,4139469664,3200236656,681279174,3936430074,3572445317,76029189,3654602809,3873151461,530742520,3299628645,4096336452,1126891415,2878612391,4237533241,1700485571,2399980690,4293915773,2240044497,1873313359,4264355552,2734768916,1309151649,4149444226,3174756917,718787259,3951481745]);function B(q,z){return X(q<<z|q>>>32-z)}function L(q){let z=q.length*8,G=(56-(q.length+1)%64+64)%64,Q=q.length+1+G+8,N=new Uint8Array(Q);N.set(q),N[q.length]=128;let J=new DataView(N.buffer);return J.setUint32(Q-8,z>>>0,!0),J.setUint32(Q-4,Math.floor(z/4294967296),!0),N}function P(q,z){let G=q;if(G.length>j)G=U(G);let Q=new Uint8Array(j);Q.set(G);let N=new Uint8Array(j),J=new Uint8Array(j);for(let $=0;$<j;$++)N[$]=(Q[$]??0)^54,J[$]=(Q[$]??0)^92;let Y=new Uint8Array(N.length+z.length);Y.set(N),Y.set(z,N.length);let V=U(Y),F=new Uint8Array(J.length+V.length);return F.set(J),F.set(V,J.length),U(F)}function T(q){return Array.from(q,(z)=>z.toString(16).padStart(2,"0")).join("")}async function E(q,z,G){let Q=K(q.trim()),N=H(G),J=P(N,Q),Y=T(J);return O(`${z} ${Y}`).replace(/\r\n/g,"")}class Z extends Error{code;command;response;constructor(q,z,G,Q){super(q);this.code=z;this.command=G;this.response=Q;this.name="SMTPError"}}function h(q){let z;switch(q.type){case"EHLO":{z=`EHLO ${q.domain.replace(/[\r\n]/g,"")}`;break}case"STARTTLS":z="STARTTLS";break;case"AUTH_LOGIN":z="AUTH LOGIN";break;case"AUTH_PLAIN":z=`AUTH PLAIN ${O(`\x00${q.user}\x00${q.pass}`).replace(/\r\n/g,"")}`;break;case"AUTH_CRAM_MD5_INIT":z="AUTH CRAM-MD5";break;case"AUTH_CRAM_MD5_RESPONSE":return H(`${q.response}\r
+`);case"AUTH_XOAUTH2":z=`AUTH XOAUTH2 ${q.xoauth2String}`;break;case"MAIL_FROM":if(/[\r\n]/.test(q.address))throw new Z("Invalid address: contains CRLF",0,"MAIL FROM",q.address);z=`MAIL FROM:<${q.address}>`;break;case"RCPT_TO":if(/[\r\n]/.test(q.address))throw new Z("Invalid address: contains CRLF",0,"RCPT TO",q.address);z=`RCPT TO:<${q.address}>`;break;case"DATA":z="DATA";break;case"DATA_BODY":return H(g(q.content));case"QUIT":z="QUIT";break;case"RSET":z="RSET";break;case"NOOP":z="NOOP";break}return H(`${z}\r
+`)}function k(q){let z=new TextDecoder().decode(q).trim(),G=z.split(/\r?\n/),N=(G[G.length-1]??"").match(/^(\d{3})([\s-])(.*)$/);if(!N)throw new Z("Invalid SMTP response",0,"PARSE",z);let J=Number.parseInt(N[1]??"0",10),Y=G.map((V)=>V.replace(/^\d{3}[\s-]/,"")).join(" ");return{code:J,message:Y,isSuccess:J>=200&&J<300,isReady:J>=300&&J<400,isError:J>=400}}function b(q){if(q.length===0)return null;let z=q.reduce((V,F)=>V+F.length,0),G=new Uint8Array(z),Q=0;for(let V of q)G.set(V,Q),Q+=V.length;let J=new TextDecoder().decode(G).split(/\r?\n/).filter((V)=>V.length>0);if(J.length===0)return null;let Y=J[J.length-1]??"";if(/^\d{3} /.test(Y))return G;return null}function u(q){let z=q.map((G)=>G.toUpperCase());if(z.some((G)=>G.includes("AUTH")&&G.includes("XOAUTH2")))return"OAUTH2";if(z.some((G)=>G.includes("AUTH")&&G.includes("CRAM-MD5")))return"CRAM-MD5";if(z.some((G)=>G.includes("AUTH")&&G.includes("LOGIN")))return"LOGIN";if(z.some((G)=>G.includes("AUTH")&&G.includes("PLAIN")))return"PLAIN";throw new Z("No supported AUTH method",0,"EHLO",q.join(" "))}function m(q){return q.message.split(/\s+/).flatMap((z)=>z.split(/\r?\n/)).filter(Boolean)}function l(q,z,G){if(!z.includes(q.code))throw new Z(`Unexpected SMTP response for ${G}`,q.code,G,q.message)}function g(q){return`${new TextDecoder().decode(q).split(/\r?\n/).map((N)=>N.startsWith(".")?`.${N}`:N).join(`\r
+`)}\r
+.\r
+`}function p(q){return H(`${O(q).replace(/\r\n/g,"")}\r
+`)}function r(q){return H(`${O(q).replace(/\r\n/g,"")}\r
+`)}function i(q){return H(`${q}\r
+`)}function o(q){return H(`${q}\r
+`)}
+export{E as u,Z as v,h as w,k as x,b as y,u as z,m as A,l as B,p as C,r as D,i as E,o as F};
+
+//# debugId=6467A846B1E9E00764756E2164756E21