sently 0.4.7 → 0.5.2

package/dist/{chunk-va2awz12.js.map → chunk-b0qkndv9.js.map}

@@ -1,11 +1,10 @@
 {
   "version": 3,
-  "sources": ["../src/core/address.ts", "../src/transports/resolve-attachments.ts"],
+  "sources": ["../src/core/address.ts"],
   "sourcesContent": [
-    "// src/core/address.ts\nimport { encodeHeader } from \"./base64.js\";\nimport type { Address, AddressInput } from \"./types.js\";\n\n/**\n * Find the first forbidden control character in a string.\n *\n * Forbidden characters must never appear in an email address or display name,\n * because each enables a distinct attack:\n * - CR (0x0D) / LF (0x0A): email header injection and SMTP command injection\n * - NUL (0x00): C-string truncation / parser confusion in downstream agents\n * - other C0 controls (0x01–0x1F), DEL (0x7F): header/parser confusion\n * - U+2028 / U+2029: line separators that some parsers treat as newlines\n *\n * @returns The char code of the first forbidden character, or -1 if none.\n */\nfunction findForbiddenChar(value: string): number {\n  for (let i = 0; i < value.length; i++) {\n    const code = value.charCodeAt(i);\n    if (code <= 0x1f || code === 0x7f || code === 0x2028 || code === 0x2029) {\n      return code;\n    }\n  }\n  return -1;\n}\n\n/**\n * Assert that a raw address or display-name value contains no forbidden\n * control characters. Throws immediately (fail closed) — the library never\n * attempts to strip or rewrite hostile input into an accepted value.\n *\n * The check is intentionally performed on the RAW input, before any trimming\n * or normalization, so hostile values are rejected rather than repaired.\n *\n * @param value - The raw, untransformed string to validate.\n * @param label - Field label used in the error message (e.g. \"address\").\n * @throws {Error} If the value contains any forbidden control character.\n */\nexport function assertSafeAddress(value: string, label = \"address\"): void {\n  const code = findForbiddenChar(value);\n  if (code !== -1) {\n    const hex = code.toString(16).padStart(2, \"0\");\n    throw new Error(\n      `Email ${label} contains a forbidden control character (0x${hex}). ` +\n        \"CR, LF, NUL, and other control characters are not allowed.\",\n    );\n  }\n}\n\n/**\n * Normalize any AddressInput form into Address[].\n *\n * Every address and display name is validated against control-character\n * injection before any transformation. This is the single chokepoint shared\n * by all transports and address fields (From, To, Cc, Bcc, Reply-To), so the\n * protection is uniform and secure by default.\n *\n * @throws {Error} If any address or name contains a forbidden control character.\n */\nexport function parseAddresses(input: AddressInput): Address[] {\n  if (Array.isArray(input)) {\n    return input.flatMap((item) => parseAddresses(item));\n  }\n\n  if (typeof input === \"object\") {\n    assertSafeAddress(input.address, \"address\");\n    if (input.name !== undefined) {\n      assertSafeAddress(input.name, \"display name\");\n    }\n    return [{ ...input }];\n  }\n\n  // Validate the raw input string before splitting or trimming so injected\n  // newlines cannot hide inside a multi-address list.\n  assertSafeAddress(input, \"address\");\n\n  const trimmed = input.trim();\n  if (!trimmed) {\n    return [];\n  }\n\n  return splitAddressList(trimmed).map(parseSingleAddress);\n}\n\n/**\n * Format an Address for SMTP envelope commands (MAIL FROM / RCPT TO).\n */\nexport function toEnvelope(address: Address): string {\n  return address.address;\n}\n\n/**\n * Format an Address for use in a MIME header (From, To, CC, etc.).\n *\n * Re-validates the address and name at render time so a header can never be\n * emitted with an embedded control character, even if the {@link Address} was\n * constructed without going through {@link parseAddresses}.\n *\n * @throws {Error} If the address or name contains a forbidden control character.\n */\nexport function toMIMEHeader(address: Address): string {\n  assertSafeAddress(address.address, \"address\");\n  if (address.name) {\n    assertSafeAddress(address.name, \"display name\");\n    const name = encodeHeader(address.name);\n    return `${name} <${address.address}>`;\n  }\n  return address.address;\n}\n\n/**\n * Extract plain email strings from any AddressInput.\n */\nexport function extractEmails(input: AddressInput): string[] {\n  return parseAddresses(input).map((addr) => addr.address);\n}\n\n/**\n * Basic email format validation (format only, no DNS lookup).\n *\n * Rejects any control character (including CR, LF, tab, and NUL) before\n * applying the structural check, so a \"valid\" result is always safe to place\n * into a header or SMTP command.\n */\nexport function isValidEmail(email: string): boolean {\n  if (findForbiddenChar(email) !== -1) return false;\n  return /^[^\\s@<>]+@[^\\s@<>]+\\.[^\\s@<>]+$/.test(email);\n}\n\nfunction splitAddressList(input: string): string[] {\n  const parts: string[] = [];\n  let current = \"\";\n  let inQuotes = false;\n  let inAngle = false;\n\n  for (let i = 0; i < input.length; i++) {\n    const char = input[i] ?? \"\";\n    if (char === '\"' && input[i - 1] !== \"\\\\\") {\n      inQuotes = !inQuotes;\n      current += char;\n      continue;\n    }\n    if (char === \"<\" && !inQuotes) {\n      inAngle = true;\n      current += char;\n      continue;\n    }\n    if (char === \">\" && !inQuotes) {\n      inAngle = false;\n      current += char;\n      continue;\n    }\n    if (char === \",\" && !inQuotes && !inAngle) {\n      if (current.trim()) {\n        parts.push(current.trim());\n      }\n      current = \"\";\n      continue;\n    }\n    current += char;\n  }\n\n  if (current.trim()) {\n    parts.push(current.trim());\n  }\n\n  return parts;\n}\n\nfunction parseSingleAddress(input: string): Address {\n  const trimmed = input.trim();\n\n  const angleMatch = trimmed.match(/^(?:\"([^\"]*)\"|([^<]*?))\\s*<([^>]+)>$/);\n  if (angleMatch) {\n    const name = (angleMatch[1] ?? angleMatch[2] ?? \"\").trim();\n    const address = (angleMatch[3] ?? \"\").trim();\n    if (name) {\n      return { name, address };\n    }\n    return { address };\n  }\n\n  if (trimmed.startsWith('\"') && trimmed.endsWith('\"')) {\n    return { address: trimmed.slice(1, -1) };\n  }\n\n  return { address: trimmed };\n}\n",
-    "import type { Attachment } from \"../core/types.js\";\n\n/** Options for {@link resolveAttachments}. */\nexport interface ResolveAttachmentsOptions {\n  /**\n   * If set, attachment paths must resolve within this directory.\n   * Prevents path traversal via `..` segments and sibling-directory\n   * prefix matches. Opt-in only.\n   *\n   * Note: this check uses `node:path` `resolve()`, which does NOT\n   * dereference symlinks. A symlink located inside `basePath` that\n   * points outside of it will pass this check. If symlink traversal is\n   * a concern, resolve paths with `fs.realpath()` before passing them in.\n   */\n  basePath?: string;\n}\n\n/**\n * Resolve attachment.path to in-memory Uint8Array content.\n * @throws When attachment.path is used on runtimes without node:fs/promises\n */\nexport async function resolveAttachments(\n  attachments: Attachment[] | undefined,\n  options?: ResolveAttachmentsOptions,\n): Promise<Attachment[]> {\n  const list = attachments ?? [];\n  const resolved: Attachment[] = [];\n\n  for (const attachment of list) {\n    if (attachment.content instanceof Uint8Array) {\n      resolved.push(attachment);\n      continue;\n    }\n\n    if (attachment.path) {\n      let fs: typeof import(\"node:fs/promises\");\n      try {\n        fs = await import(\"node:fs/promises\");\n      } catch {\n        throw new Error(\n          \"attachment.path is not supported on this runtime — use attachment.content (Uint8Array) instead\",\n        );\n      }\n\n      if (options?.basePath) {\n        const { resolve, sep } = await import(\"node:path\");\n        const resolvedPath = resolve(attachment.path);\n        const resolvedBase = resolve(options.basePath);\n        // startsWith alone is vulnerable: \"/var/data-secret\" passes \"/var/data\".\n        // Require an exact match or a trailing path separator.\n        const isWithin =\n          resolvedPath === resolvedBase || resolvedPath.startsWith(resolvedBase + sep);\n        if (!isWithin) {\n          throw new Error(\n            `[sently] Attachment path \"${resolvedPath}\" escapes basePath \"${resolvedBase}\". ` +\n              \"Use absolute paths within the allowed directory.\",\n          );\n        }\n      }\n\n      const data = await fs.readFile(attachment.path);\n      const { path: _path, ...rest } = attachment;\n      resolved.push({ ...rest, content: new Uint8Array(data) });\n      continue;\n    }\n\n    if (typeof attachment.content === \"string\") {\n      resolved.push(attachment);\n      continue;\n    }\n\n    resolved.push(attachment);\n  }\n\n  return resolved;\n}\n"
+    "// src/core/address.ts\nimport { encodeHeader } from \"./base64.js\";\nimport type { Address, AddressInput } from \"./types.js\";\n\n/**\n * Find the first forbidden control character in a string.\n *\n * Forbidden characters must never appear in an email address or display name,\n * because each enables a distinct attack:\n * - CR (0x0D) / LF (0x0A): email header injection and SMTP command injection\n * - NUL (0x00): C-string truncation / parser confusion in downstream agents\n * - other C0 controls (0x01–0x1F), DEL (0x7F): header/parser confusion\n * - U+2028 / U+2029: line separators that some parsers treat as newlines\n *\n * @returns The char code of the first forbidden character, or -1 if none.\n */\nfunction findForbiddenChar(value: string): number {\n  for (let i = 0; i < value.length; i++) {\n    const code = value.charCodeAt(i);\n    if (code <= 0x1f || code === 0x7f || code === 0x2028 || code === 0x2029) {\n      return code;\n    }\n  }\n  return -1;\n}\n\n/**\n * Assert that a raw address or display-name value contains no forbidden\n * control characters. Throws immediately (fail closed) — the library never\n * attempts to strip or rewrite hostile input into an accepted value.\n *\n * The check is intentionally performed on the RAW input, before any trimming\n * or normalization, so hostile values are rejected rather than repaired.\n *\n * @param value - The raw, untransformed string to validate.\n * @param label - Field label used in the error message (e.g. \"address\").\n * @throws {Error} If the value contains any forbidden control character.\n */\nexport function assertSafeAddress(value: string, label = \"address\"): void {\n  const code = findForbiddenChar(value);\n  if (code !== -1) {\n    const hex = code.toString(16).padStart(2, \"0\");\n    throw new Error(\n      `Email ${label} contains a forbidden control character (0x${hex}). ` +\n        \"CR, LF, NUL, and other control characters are not allowed.\",\n    );\n  }\n}\n\n/**\n * Normalize any AddressInput form into Address[].\n *\n * Every address and display name is validated against control-character\n * injection before any transformation. This is the single chokepoint shared\n * by all transports and address fields (From, To, Cc, Bcc, Reply-To), so the\n * protection is uniform and secure by default.\n *\n * @throws {Error} If any address or name contains a forbidden control character.\n */\nexport function parseAddresses(input: AddressInput): Address[] {\n  if (Array.isArray(input)) {\n    return input.flatMap((item) => parseAddresses(item));\n  }\n\n  if (typeof input === \"object\") {\n    assertSafeAddress(input.address, \"address\");\n    if (input.name !== undefined) {\n      assertSafeAddress(input.name, \"display name\");\n    }\n    return [{ ...input }];\n  }\n\n  // Validate the raw input string before splitting or trimming so injected\n  // newlines cannot hide inside a multi-address list.\n  assertSafeAddress(input, \"address\");\n\n  const trimmed = input.trim();\n  if (!trimmed) {\n    return [];\n  }\n\n  return splitAddressList(trimmed).map(parseSingleAddress);\n}\n\n/**\n * Format an Address for SMTP envelope commands (MAIL FROM / RCPT TO).\n */\nexport function toEnvelope(address: Address): string {\n  return address.address;\n}\n\n/**\n * Format an Address for use in a MIME header (From, To, CC, etc.).\n *\n * Re-validates the address and name at render time so a header can never be\n * emitted with an embedded control character, even if the {@link Address} was\n * constructed without going through {@link parseAddresses}.\n *\n * @throws {Error} If the address or name contains a forbidden control character.\n */\nexport function toMIMEHeader(address: Address): string {\n  assertSafeAddress(address.address, \"address\");\n  if (address.name) {\n    assertSafeAddress(address.name, \"display name\");\n    const name = encodeHeader(address.name);\n    return `${name} <${address.address}>`;\n  }\n  return address.address;\n}\n\n/**\n * Extract plain email strings from any AddressInput.\n */\nexport function extractEmails(input: AddressInput): string[] {\n  return parseAddresses(input).map((addr) => addr.address);\n}\n\n/**\n * Basic email format validation (format only, no DNS lookup).\n *\n * Rejects any control character (including CR, LF, tab, and NUL) before\n * applying the structural check, so a \"valid\" result is always safe to place\n * into a header or SMTP command.\n */\nexport function isValidEmail(email: string): boolean {\n  if (findForbiddenChar(email) !== -1) return false;\n  return /^[^\\s@<>]+@[^\\s@<>]+\\.[^\\s@<>]+$/.test(email);\n}\n\nfunction splitAddressList(input: string): string[] {\n  const parts: string[] = [];\n  let current = \"\";\n  let inQuotes = false;\n  let inAngle = false;\n\n  for (let i = 0; i < input.length; i++) {\n    const char = input[i] ?? \"\";\n    if (char === '\"' && input[i - 1] !== \"\\\\\") {\n      inQuotes = !inQuotes;\n      current += char;\n      continue;\n    }\n    if (char === \"<\" && !inQuotes) {\n      inAngle = true;\n      current += char;\n      continue;\n    }\n    if (char === \">\" && !inQuotes) {\n      inAngle = false;\n      current += char;\n      continue;\n    }\n    if (char === \",\" && !inQuotes && !inAngle) {\n      if (current.trim()) {\n        parts.push(current.trim());\n      }\n      current = \"\";\n      continue;\n    }\n    current += char;\n  }\n\n  if (current.trim()) {\n    parts.push(current.trim());\n  }\n\n  return parts;\n}\n\nfunction parseSingleAddress(input: string): Address {\n  const trimmed = input.trim();\n\n  const angleMatch = trimmed.match(/^(?:\"([^\"]*)\"|([^<]*?))\\s*<([^>]+)>$/);\n  if (angleMatch) {\n    const name = (angleMatch[1] ?? angleMatch[2] ?? \"\").trim();\n    const address = (angleMatch[3] ?? \"\").trim();\n    if (name) {\n      return { name, address };\n    }\n    return { address };\n  }\n\n  if (trimmed.startsWith('\"') && trimmed.endsWith('\"')) {\n    return { address: trimmed.slice(1, -1) };\n  }\n\n  return { address: trimmed };\n}\n"
   ],
-  "mappings": "sFAgBA,GAAS,CAAiB,CAAC,EAAuB,CAChD,QAAS,EAAI,EAAG,EAAI,EAAM,OAAQ,IAAK,CACrC,IAAM,EAAO,EAAM,WAAW,CAAC,EAC/B,GAAI,GAAQ,IAAQ,IAAS,KAAQ,IAAS,MAAU,IAAS,KAC/D,OAAO,EAGX,MAAO,GAeF,SAAS,CAAiB,CAAC,EAAe,EAAQ,UAAiB,CACxE,IAAM,EAAO,EAAkB,CAAK,EACpC,GAAI,IAAS,GAAI,CACf,IAAM,EAAM,EAAK,SAAS,EAAE,EAAE,SAAS,EAAG,GAAG,EAC7C,MAAU,MACR,SAAS,+CAAmD,gEAE9D,GAcG,SAAS,CAAc,CAAC,EAAgC,CAC7D,GAAI,MAAM,QAAQ,CAAK,EACrB,OAAO,EAAM,QAAQ,CAAC,IAAS,EAAe,CAAI,CAAC,EAGrD,GAAI,OAAO,IAAU,SAAU,CAE7B,GADA,EAAkB,EAAM,QAAS,SAAS,EACtC,EAAM,OAAS,OACjB,EAAkB,EAAM,KAAM,cAAc,EAE9C,MAAO,CAAC,IAAK,CAAM,CAAC,EAKtB,EAAkB,EAAO,SAAS,EAElC,IAAM,EAAU,EAAM,KAAK,EAC3B,GAAI,CAAC,EACH,MAAO,CAAC,EAGV,OAAO,EAAiB,CAAO,EAAE,IAAI,CAAkB,EAmBlD,SAAS,CAAY,CAAC,EAA0B,CAErD,GADA,EAAkB,EAAQ,QAAS,SAAS,EACxC,EAAQ,KAGV,OAFA,EAAkB,EAAQ,KAAM,cAAc,EAEvC,GADM,EAAa,EAAQ,IAAI,MACnB,EAAQ,WAE7B,OAAO,EAAQ,QAMV,SAAS,CAAa,CAAC,EAA+B,CAC3D,OAAO,EAAe,CAAK,EAAE,IAAI,CAAC,IAAS,EAAK,OAAO,EAUlD,SAAS,CAAY,CAAC,EAAwB,CACnD,GAAI,EAAkB,CAAK,IAAM,GAAI,MAAO,GAC5C,MAAO,mCAAmC,KAAK,CAAK,EAGtD,SAAS,CAAgB,CAAC,EAAyB,CACjD,IAAM,EAAkB,CAAC,EACrB,EAAU,GACV,EAAW,GACX,EAAU,GAEd,QAAS,EAAI,EAAG,EAAI,EAAM,OAAQ,IAAK,CACrC,IAAM,EAAO,EAAM,IAAM,GACzB,GAAI,IAAS,KAAO,EAAM,EAAI,KAAO,KAAM,CACzC,EAAW,CAAC,EACZ,GAAW,EACX,SAEF,GAAI,IAAS,KAAO,CAAC,EAAU,CAC7B,EAAU,GACV,GAAW,EACX,SAEF,GAAI,IAAS,KAAO,CAAC,EAAU,CAC7B,EAAU,GACV,GAAW,EACX,SAEF,GAAI,IAAS,KAAO,CAAC,GAAY,CAAC,EAAS,CACzC,GAAI,EAAQ,KAAK,EACf,EAAM,KAAK,EAAQ,KAAK,CAAC,EAE3B,EAAU,GACV,SAEF,GAAW,EAGb,GAAI,EAAQ,KAAK,EACf,EAAM,KAAK,EAAQ,KAAK,CAAC,EAG3B,OAAO,EAGT,SAAS,CAAkB,CAAC,EAAwB,CAClD,IAAM,EAAU,EAAM,KAAK,EAErB,EAAa,EAAQ,MAAM,sCAAsC,EACvE,GAAI,EAAY,CACd,IAAM,GAAQ,EAAW,IAAM,EAAW,IAAM,IAAI,KAAK,EACnD,GAAW,EAAW,IAAM,IAAI,KAAK,EAC3C,GAAI,EACF,MAAO,CAAE,OAAM,SAAQ,EAEzB,MAAO,CAAE,SAAQ,EAGnB,GAAI,EAAQ,WAAW,GAAG,GAAK,EAAQ,SAAS,GAAG,EACjD,MAAO,CAAE,QAAS,EAAQ,MAAM,EAAG,EAAE,CAAE,EAGzC,MAAO,CAAE,QAAS,CAAQ,ECrK5B,eAAsB,CAAkB,CACtC,EACA,EACuB,CACvB,IAAM,EAAO,GAAe,CAAC,EACvB,EAAyB,CAAC,EAEhC,QAAW,KAAc,EAAM,CAC7B,GAAI,EAAW,mBAAmB,WAAY,CAC5C,EAAS,KAAK,CAAU,EACxB,SAGF,GAAI,EAAW,KAAM,CACnB,IAAI,EACJ,GAAI,CACF,EAAK,KAAa,4BAClB,KAAM,CACN,MAAU,MACR,gGACF,EAGF,GAAI,GAAS,SAAU,CACrB,IAAQ,UAAS,OAAQ,KAAa,qBAChC,EAAe,EAAQ,EAAW,IAAI,EACtC,EAAe,EAAQ,EAAQ,QAAQ,EAK7C,GAAI,EADF,IAAiB,GAAgB,EAAa,WAAW,EAAe,CAAG,GAE3E,MAAU,MACR,6BAA6B,wBAAmC,sDAElE,EAIJ,IAAM,EAAO,MAAM,EAAG,SAAS,EAAW,IAAI,GACtC,KAAM,KAAU,GAAS,EACjC,EAAS,KAAK,IAAK,EAAM,QAAS,IAAI,WAAW,CAAI,CAAE,CAAC,EACxD,SAGF,GAAI,OAAO,EAAW,UAAY,SAAU,CAC1C,EAAS,KAAK,CAAU,EACxB,SAGF,EAAS,KAAK,CAAU,EAG1B,OAAO",
-  "debugId": "67ECE72AE508464F64756E2164756E21",
+  "mappings": "wCAgBA,SAAS,CAAiB,CAAC,EAAuB,CAChD,QAAS,EAAI,EAAG,EAAI,EAAM,OAAQ,IAAK,CACrC,IAAM,EAAO,EAAM,WAAW,CAAC,EAC/B,GAAI,GAAQ,IAAQ,IAAS,KAAQ,IAAS,MAAU,IAAS,KAC/D,OAAO,EAGX,MAAO,GAeF,SAAS,CAAiB,CAAC,EAAe,EAAQ,UAAiB,CACxE,IAAM,EAAO,EAAkB,CAAK,EACpC,GAAI,IAAS,GAAI,CACf,IAAM,EAAM,EAAK,SAAS,EAAE,EAAE,SAAS,EAAG,GAAG,EAC7C,MAAU,MACR,SAAS,+CAAmD,gEAE9D,GAcG,SAAS,CAAc,CAAC,EAAgC,CAC7D,GAAI,MAAM,QAAQ,CAAK,EACrB,OAAO,EAAM,QAAQ,CAAC,IAAS,EAAe,CAAI,CAAC,EAGrD,GAAI,OAAO,IAAU,SAAU,CAE7B,GADA,EAAkB,EAAM,QAAS,SAAS,EACtC,EAAM,OAAS,OACjB,EAAkB,EAAM,KAAM,cAAc,EAE9C,MAAO,CAAC,IAAK,CAAM,CAAC,EAKtB,EAAkB,EAAO,SAAS,EAElC,IAAM,EAAU,EAAM,KAAK,EAC3B,GAAI,CAAC,EACH,MAAO,CAAC,EAGV,OAAO,EAAiB,CAAO,EAAE,IAAI,CAAkB,EAmBlD,SAAS,CAAY,CAAC,EAA0B,CAErD,GADA,EAAkB,EAAQ,QAAS,SAAS,EACxC,EAAQ,KAGV,OAFA,EAAkB,EAAQ,KAAM,cAAc,EAEvC,GADM,EAAa,EAAQ,IAAI,MACnB,EAAQ,WAE7B,OAAO,EAAQ,QAMV,SAAS,CAAa,CAAC,EAA+B,CAC3D,OAAO,EAAe,CAAK,EAAE,IAAI,CAAC,IAAS,EAAK,OAAO,EAUlD,SAAS,CAAY,CAAC,EAAwB,CACnD,GAAI,EAAkB,CAAK,IAAM,GAAI,MAAO,GAC5C,MAAO,mCAAmC,KAAK,CAAK,EAGtD,SAAS,CAAgB,CAAC,EAAyB,CACjD,IAAM,EAAkB,CAAC,EACrB,EAAU,GACV,EAAW,GACX,EAAU,GAEd,QAAS,EAAI,EAAG,EAAI,EAAM,OAAQ,IAAK,CACrC,IAAM,EAAO,EAAM,IAAM,GACzB,GAAI,IAAS,KAAO,EAAM,EAAI,KAAO,KAAM,CACzC,EAAW,CAAC,EACZ,GAAW,EACX,SAEF,GAAI,IAAS,KAAO,CAAC,EAAU,CAC7B,EAAU,GACV,GAAW,EACX,SAEF,GAAI,IAAS,KAAO,CAAC,EAAU,CAC7B,EAAU,GACV,GAAW,EACX,SAEF,GAAI,IAAS,KAAO,CAAC,GAAY,CAAC,EAAS,CACzC,GAAI,EAAQ,KAAK,EACf,EAAM,KAAK,EAAQ,KAAK,CAAC,EAE3B,EAAU,GACV,SAEF,GAAW,EAGb,GAAI,EAAQ,KAAK,EACf,EAAM,KAAK,EAAQ,KAAK,CAAC,EAG3B,OAAO,EAGT,SAAS,CAAkB,CAAC,EAAwB,CAClD,IAAM,EAAU,EAAM,KAAK,EAErB,EAAa,EAAQ,MAAM,sCAAsC,EACvE,GAAI,EAAY,CACd,IAAM,GAAQ,EAAW,IAAM,EAAW,IAAM,IAAI,KAAK,EACnD,GAAW,EAAW,IAAM,IAAI,KAAK,EAC3C,GAAI,EACF,MAAO,CAAE,OAAM,SAAQ,EAEzB,MAAO,CAAE,SAAQ,EAGnB,GAAI,EAAQ,WAAW,GAAG,GAAK,EAAQ,SAAS,GAAG,EACjD,MAAO,CAAE,QAAS,EAAQ,MAAM,EAAG,EAAE,CAAE,EAGzC,MAAO,CAAE,QAAS,CAAQ",
+  "debugId": "B28F759D0BA1665264756E2164756E21",
   "names": []
 }

package/dist/{chunk-jfs80vhp.js → chunk-c8ya9em0.js}

@@ -1,3 +1,3 @@
-import{i as U}from"./chunk-dgkh77yp.js";import{j as X}from"./chunk-2t6hjer3.js";import{p as b}from"./chunk-va2awz12.js";import{A as v,B as A,D as E,s as k,t as x,u as Z,v as O,w as q,x as L,y as j,z as N}from"./chunk-wgtbr6ge.js";import{I as C}from"./chunk-sqn04kae.js";class T{config;adapter=null;constructor(z){this.config=P(z)}async send(z){let B={...z,attachments:await b(z.attachments)},G=await X(B,this.config.dkim),F=await this.getAdapter(),W=this.config.direct?await M(G.envelope.from.split("@")[1]??this.config.host):this.config.host;await F.connect(W,this.config.port),this.adapter=F;try{return await D(F,this.config),await S(F,G)}finally{await H(F),this.adapter=null}}async verify(){try{let z=await this.getAdapter();await z.connect(this.config.host,this.config.port);try{return await D(z,this.config),{ok:!0,provider:"smtp"}}finally{await H(z)}}catch(z){return{ok:!1,provider:"smtp",message:z instanceof Error?z.message:String(z)}}}async close(){if(this.adapter)await this.adapter.close(),this.adapter=null}async getAdapter(){if(!this.config.adapter)throw new x("No socket adapter configured",0,"CONNECT","");return this.config.adapter}}function P(z){let B=z.secure??!1;return{host:z.host,port:z.port??(B?465:587),secure:B,...z.auth!==void 0?{auth:z.auth}:{},...z.requireTLS!==void 0?{requireTLS:z.requireTLS}:{},...z.dkim!==void 0?{dkim:z.dkim}:{},...z.tls!==void 0?{tls:z.tls}:{},...z.connectionTimeout!==void 0?{connectionTimeout:z.connectionTimeout}:{},...z.greetingTimeout!==void 0?{greetingTimeout:z.greetingTimeout}:{},...z.socketTimeout!==void 0?{socketTimeout:z.socketTimeout}:{},...z.direct!==void 0?{direct:z.direct}:{},...z.adapter!==void 0?{adapter:z.adapter}:{}}}async function D(z,B){let G=await J(z);N(G,[220],"greeting");let F=await I(z,B.host),W=F.some((Q)=>Q.toUpperCase()==="STARTTLS");if(!B.secure&&!z.secure&&W){await Y(z,Z({type:"STARTTLS"}));let Q=await J(z);N(Q,[220],"STARTTLS"),await z.startTLS(B.tls),F=await I(z,B.host)}if(B.auth){let Q=B.requireTLS??!0,V=z.secure||B.secure;if(Q&&!V)throw new x("Refusing to authenticate over unencrypted connection. Set requireTLS: false to disable this check (not recommended).",0,"AUTH","");await l(z,B.auth,F)}}async function S(z,B){await _(z,{type:"MAIL_FROM",address:B.envelope.from});let G=await J(z);N(G,[250],"MAIL FROM");let F=[],W=[];for(let K of B.envelope.to)if(await Y(z,Z({type:"RCPT_TO",address:K})),(await J(z)).isSuccess)F.push(K);else W.push(K);await _(z,{type:"DATA"});let Q=await J(z);N(Q,[354],"DATA");let V;try{await Y(z,Z({type:"DATA_BODY",content:B.raw})),V=await J(z)}catch(K){if(await Y(z,Z({type:"DATA_BODY",content:B.raw})),V=await J(z),V.isError)throw K}return N(V,[250],"DATA end"),{messageId:B.messageId,accepted:F,rejected:W,response:V.message,envelope:B.envelope}}async function H(z){try{await _(z,{type:"QUIT"}),await J(z)}catch{}finally{await z.close()}}async function I(z,B){await _(z,{type:"EHLO",domain:B});let G=await J(z);return N(G,[250],"EHLO"),j(G)}async function l(z,B,G){if(B.type==="OAUTH2"&&B.oauth2){let K=await new U(B.oauth2).buildXOAUTH2();await _(z,{type:"AUTH_XOAUTH2",xoauth2String:K});let $=await J(z);if($.code===334)await Y(z,E("")),$=await J(z);N($,[235],"AUTH XOAUTH2");return}let F=B.type??L(G);if(F==="CRAM-MD5"){let V=y(B,"CRAM-MD5");await _(z,{type:"AUTH_CRAM_MD5_INIT"});let K=await J(z);N(K,[334],"AUTH CRAM-MD5");let $=K.message.trim(),w=await k($,B.user,V);await _(z,{type:"AUTH_CRAM_MD5_RESPONSE",response:w}),K=await J(z),N(K,[235],"AUTH CRAM-MD5 response");return}if(F==="PLAIN"){let V=y(B,"PLAIN");await Y(z,Z({type:"AUTH_PLAIN",user:B.user,pass:V}));let K=await J(z);N(K,[235],"AUTH PLAIN");return}let W=y(B,"LOGIN");await Y(z,Z({type:"AUTH_LOGIN",user:B.user,pass:W}));let Q=await J(z);N(Q,[334],"AUTH LOGIN"),await Y(z,A(B.user)),Q=await J(z),N(Q,[334],"AUTH LOGIN user"),await Y(z,v(W)),Q=await J(z),N(Q,[235],"AUTH LOGIN pass")}function y(z,B){if(!z.pass)throw new x(`Password required for ${B} authentication`,0,`AUTH ${B}`,"");return z.pass}async function _(z,B){await Y(z,Z(B))}async function Y(z,B){await z.write(B)}async function J(z){let B=[];for await(let G of z.read()){B.push(G);let F=q(B);if(F)return O(F)}throw new x("Connection closed while reading SMTP response",0,"READ","")}async function M(z){let G=await(await import("node:dns/promises")).resolveMx(z);if(G.length===0)throw new x(`No MX records for ${z}`,0,"MX","");return G.sort((F,W)=>F.priority-W.priority),G[0]?.exchange??z}export{T as a,P as b,D as c,S as d,H as e,J as f};
+import{p as U}from"./chunk-zkczgj2c.js";import{r as X}from"./chunk-aeqxkeh3.js";import{s as b}from"./chunk-k0gw3qmb.js";import{B as k,C as x,D as Z,E as O,F as q,G as L,H as j,I as N,J as v,K as A,M as E}from"./chunk-9p4vev6j.js";import{R as C}from"./chunk-mg8m26nr.js";class T{config;adapter=null;constructor(z){this.config=P(z)}async send(z){let B={...z,attachments:await b(z.attachments)},G=await X(B,this.config.dkim),F=await this.getAdapter(),W=this.config.direct?await M(G.envelope.from.split("@")[1]??this.config.host):this.config.host;await F.connect(W,this.config.port),this.adapter=F;try{return await D(F,this.config),await S(F,G)}finally{await H(F),this.adapter=null}}async verify(){try{let z=await this.getAdapter();await z.connect(this.config.host,this.config.port);try{return await D(z,this.config),{ok:!0,provider:"smtp"}}finally{await H(z)}}catch(z){return{ok:!1,provider:"smtp",message:z instanceof Error?z.message:String(z)}}}async close(){if(this.adapter)await this.adapter.close(),this.adapter=null}async getAdapter(){if(!this.config.adapter)throw new x("No socket adapter configured",0,"CONNECT","");return this.config.adapter}}function P(z){let B=z.secure??!1;return{host:z.host,port:z.port??(B?465:587),secure:B,...z.auth!==void 0?{auth:z.auth}:{},...z.requireTLS!==void 0?{requireTLS:z.requireTLS}:{},...z.dkim!==void 0?{dkim:z.dkim}:{},...z.tls!==void 0?{tls:z.tls}:{},...z.connectionTimeout!==void 0?{connectionTimeout:z.connectionTimeout}:{},...z.greetingTimeout!==void 0?{greetingTimeout:z.greetingTimeout}:{},...z.socketTimeout!==void 0?{socketTimeout:z.socketTimeout}:{},...z.direct!==void 0?{direct:z.direct}:{},...z.adapter!==void 0?{adapter:z.adapter}:{}}}async function D(z,B){let G=await J(z);N(G,[220],"greeting");let F=await I(z,B.host),W=F.some((Q)=>Q.toUpperCase()==="STARTTLS");if(!B.secure&&!z.secure&&W){await Y(z,Z({type:"STARTTLS"}));let Q=await J(z);N(Q,[220],"STARTTLS"),await z.startTLS(B.tls),F=await I(z,B.host)}if(B.auth){let Q=B.requireTLS??!0,V=z.secure||B.secure;if(Q&&!V)throw new x("Refusing to authenticate over unencrypted connection. Set requireTLS: false to disable this check (not recommended).",0,"AUTH","");await l(z,B.auth,F)}}async function S(z,B){await _(z,{type:"MAIL_FROM",address:B.envelope.from});let G=await J(z);N(G,[250],"MAIL FROM");let F=[],W=[];for(let K of B.envelope.to)if(await Y(z,Z({type:"RCPT_TO",address:K})),(await J(z)).isSuccess)F.push(K);else W.push(K);await _(z,{type:"DATA"});let Q=await J(z);N(Q,[354],"DATA");let V;try{await Y(z,Z({type:"DATA_BODY",content:B.raw})),V=await J(z)}catch(K){if(await Y(z,Z({type:"DATA_BODY",content:B.raw})),V=await J(z),V.isError)throw K}return N(V,[250],"DATA end"),{messageId:B.messageId,accepted:F,rejected:W,response:V.message,envelope:B.envelope}}async function H(z){try{await _(z,{type:"QUIT"}),await J(z)}catch{}finally{await z.close()}}async function I(z,B){await _(z,{type:"EHLO",domain:B});let G=await J(z);return N(G,[250],"EHLO"),j(G)}async function l(z,B,G){if(B.type==="OAUTH2"&&B.oauth2){let K=await new U(B.oauth2).buildXOAUTH2();await _(z,{type:"AUTH_XOAUTH2",xoauth2String:K});let $=await J(z);if($.code===334)await Y(z,E("")),$=await J(z);N($,[235],"AUTH XOAUTH2");return}let F=B.type??L(G);if(F==="CRAM-MD5"){let V=y(B,"CRAM-MD5");await _(z,{type:"AUTH_CRAM_MD5_INIT"});let K=await J(z);N(K,[334],"AUTH CRAM-MD5");let $=K.message.trim(),w=await k($,B.user,V);await _(z,{type:"AUTH_CRAM_MD5_RESPONSE",response:w}),K=await J(z),N(K,[235],"AUTH CRAM-MD5 response");return}if(F==="PLAIN"){let V=y(B,"PLAIN");await Y(z,Z({type:"AUTH_PLAIN",user:B.user,pass:V}));let K=await J(z);N(K,[235],"AUTH PLAIN");return}let W=y(B,"LOGIN");await Y(z,Z({type:"AUTH_LOGIN",user:B.user,pass:W}));let Q=await J(z);N(Q,[334],"AUTH LOGIN"),await Y(z,A(B.user)),Q=await J(z),N(Q,[334],"AUTH LOGIN user"),await Y(z,v(W)),Q=await J(z),N(Q,[235],"AUTH LOGIN pass")}function y(z,B){if(!z.pass)throw new x(`Password required for ${B} authentication`,0,`AUTH ${B}`,"");return z.pass}async function _(z,B){await Y(z,Z(B))}async function Y(z,B){await z.write(B)}async function J(z){let B=[];for await(let G of z.read()){B.push(G);let F=q(B);if(F)return O(F)}throw new x("Connection closed while reading SMTP response",0,"READ","")}async function M(z){let G=await(await import("node:dns/promises")).resolveMx(z);if(G.length===0)throw new x(`No MX records for ${z}`,0,"MX","");return G.sort((F,W)=>F.priority-W.priority),G[0]?.exchange??z}export{T as h,P as i,D as j,S as k,H as l,J as m};
 
-//# debugId=812F038BA87E1B8464756E2164756E21
+//# debugId=7F6A4A30744EE38A64756E2164756E21

package/dist/{chunk-jfs80vhp.js.map → chunk-c8ya9em0.js.map}

@@ -5,6 +5,6 @@
     "/**\n * @module\n * SMTP transport — orchestrates socket adapter, MIME builder, and protocol logic.\n *\n * @example\n * ```ts\n * import { SMTPTransport } from \"sently/transports/smtp\";\n * import { NodeAdapter } from \"sently/adapters/node\";\n * import { createMailer } from \"sently\";\n *\n * const mailer = await createMailer({\n *   transport: new SMTPTransport({\n *     host: \"smtp.example.com\",\n *     auth: { user: \"you@example.com\", pass: \"secret\" },\n *     adapter: new NodeAdapter(),\n *   }),\n * });\n * ```\n */\nimport { OAuth2Client } from \"../auth/oauth2.js\";\nimport { buildMIME, type MIMEBuildResult } from \"../core/mime.js\";\nimport type { SMTPResponse } from \"../core/smtp.js\";\nimport {\n  accumulateResponse,\n  assertResponse,\n  computeCRAMMD5,\n  encodeAuthLoginPass,\n  encodeAuthLoginUser,\n  encodeCommand,\n  encodeLine,\n  parseEHLO,\n  parseResponse,\n  SMTPError,\n  selectAuthMethod,\n} from \"../core/smtp.js\";\nimport type {\n  MailOptions,\n  SendResult,\n  SMTPConfig,\n  SocketAdapter,\n  Transport,\n  VerifyResult,\n} from \"../core/types.js\";\nimport { resolveAttachments } from \"./resolve-attachments.js\";\n\n/**\n * SMTP transport orchestrating adapter, MIME builder, and protocol logic.\n */\nexport class SMTPTransport implements Transport {\n  /** Resolved SMTP configuration with defaults applied. */\n  private readonly config: ResolvedSMTPConfig;\n  /** Active socket adapter for the current session, if any. */\n  private adapter: SocketAdapter | null = null;\n\n  /** Creates an SMTP transport with the given configuration. */\n  constructor(config: SMTPConfig) {\n    this.config = resolveSMTPConfig(config);\n  }\n\n  /** Sends an email via SMTP using the configured adapter. */\n  async send(options: MailOptions): Promise<SendResult> {\n    const resolvedOptions = {\n      ...options,\n      attachments: await resolveAttachments(options.attachments),\n    };\n    const mime = await buildMIME(resolvedOptions, this.config.dkim);\n    const adapter = await this.getAdapter();\n\n    const host = this.config.direct\n      ? await resolveMX(mime.envelope.from.split(\"@\")[1] ?? this.config.host)\n      : this.config.host;\n\n    await adapter.connect(host, this.config.port);\n    this.adapter = adapter;\n\n    try {\n      await openSMTPSession(adapter, this.config);\n      return await deliverSMTPMessage(adapter, mime);\n    } finally {\n      await closeSMTPSession(adapter);\n      this.adapter = null;\n    }\n  }\n\n  /** Verifies SMTP connectivity and authentication without sending mail. */\n  async verify(): Promise<VerifyResult> {\n    try {\n      const adapter = await this.getAdapter();\n      await adapter.connect(this.config.host, this.config.port);\n\n      try {\n        await openSMTPSession(adapter, this.config);\n        return { ok: true, provider: \"smtp\" };\n      } finally {\n        await closeSMTPSession(adapter);\n      }\n    } catch (err) {\n      return {\n        ok: false,\n        provider: \"smtp\",\n        message: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  /** Closes the underlying socket adapter if connected. */\n  async close(): Promise<void> {\n    if (this.adapter) {\n      await this.adapter.close();\n      this.adapter = null;\n    }\n  }\n\n  /** Returns the configured socket adapter or throws if none is set. */\n  private async getAdapter(): Promise<SocketAdapter> {\n    if (!this.config.adapter) {\n      throw new SMTPError(\"No socket adapter configured\", 0, \"CONNECT\", \"\");\n    }\n    return this.config.adapter;\n  }\n}\n\n/** Resolved SMTP transport configuration with defaults applied. */\nexport interface ResolvedSMTPConfig {\n  /** SMTP server hostname. */\n  host: string;\n  /** SMTP port with secure/default applied. */\n  port: number;\n  /** Whether implicit TLS is used. */\n  secure: boolean;\n  /** Resolved authentication credentials, if any. */\n  auth?: SMTPConfig[\"auth\"];\n  /** Whether AUTH requires an encrypted connection. */\n  requireTLS?: boolean;\n  /** TLS options for STARTTLS and direct TLS. */\n  tls?: SMTPConfig[\"tls\"];\n  /** DKIM signing configuration. */\n  dkim?: SMTPConfig[\"dkim\"];\n  /** Socket connect timeout in milliseconds. */\n  connectionTimeout?: number;\n  /** Timeout waiting for the SMTP greeting in milliseconds. */\n  greetingTimeout?: number;\n  /** Idle socket timeout in milliseconds. */\n  socketTimeout?: number;\n  /** Direct-to-MX delivery mode. */\n  direct?: boolean;\n  /** Runtime socket adapter. */\n  adapter?: SocketAdapter;\n}\n\n/** Apply defaults to SMTP configuration. */\nexport function resolveSMTPConfig(config: SMTPConfig): ResolvedSMTPConfig {\n  const secure = config.secure ?? false;\n  return {\n    host: config.host,\n    port: config.port ?? (secure ? 465 : 587),\n    secure,\n    ...(config.auth !== undefined ? { auth: config.auth } : {}),\n    ...(config.requireTLS !== undefined ? { requireTLS: config.requireTLS } : {}),\n    ...(config.dkim !== undefined ? { dkim: config.dkim } : {}),\n    ...(config.tls !== undefined ? { tls: config.tls } : {}),\n    ...(config.connectionTimeout !== undefined\n      ? { connectionTimeout: config.connectionTimeout }\n      : {}),\n    ...(config.greetingTimeout !== undefined ? { greetingTimeout: config.greetingTimeout } : {}),\n    ...(config.socketTimeout !== undefined ? { socketTimeout: config.socketTimeout } : {}),\n    ...(config.direct !== undefined ? { direct: config.direct } : {}),\n    ...(config.adapter !== undefined ? { adapter: config.adapter } : {}),\n  };\n}\n\n/**\n * Connect greeting, EHLO, optional STARTTLS, and AUTH on an open adapter.\n */\nexport async function openSMTPSession(\n  adapter: SocketAdapter,\n  config: ResolvedSMTPConfig,\n): Promise<void> {\n  const greeting = await readSMTPResponse(adapter);\n  assertResponse(greeting, [220], \"greeting\");\n\n  let capabilities = await ehlo(adapter, config.host);\n  const supportsStartTls = capabilities.some((cap) => cap.toUpperCase() === \"STARTTLS\");\n  if (!config.secure && !adapter.secure && supportsStartTls) {\n    await sendRaw(adapter, encodeCommand({ type: \"STARTTLS\" }));\n    const starttlsResp = await readSMTPResponse(adapter);\n    assertResponse(starttlsResp, [220], \"STARTTLS\");\n    await adapter.startTLS(config.tls);\n    capabilities = await ehlo(adapter, config.host);\n  }\n\n  if (config.auth) {\n    const tlsRequired = config.requireTLS ?? true;\n    const encrypted = adapter.secure || config.secure;\n    if (tlsRequired && !encrypted) {\n      throw new SMTPError(\n        \"Refusing to authenticate over unencrypted connection. \" +\n          \"Set requireTLS: false to disable this check (not recommended).\",\n        0,\n        \"AUTH\",\n        \"\",\n      );\n    }\n    await authenticate(adapter, config.auth, capabilities);\n  }\n}\n\n/**\n * MAIL FROM, RCPT TO, and DATA for a built MIME message on an authenticated session.\n */\nexport async function deliverSMTPMessage(\n  adapter: SocketAdapter,\n  mime: MIMEBuildResult,\n): Promise<SendResult> {\n  await sendCommand(adapter, { type: \"MAIL_FROM\", address: mime.envelope.from });\n  const mailResp = await readSMTPResponse(adapter);\n  assertResponse(mailResp, [250], \"MAIL FROM\");\n\n  const accepted: string[] = [];\n  const rejected: string[] = [];\n\n  for (const recipient of mime.envelope.to) {\n    await sendRaw(adapter, encodeCommand({ type: \"RCPT_TO\", address: recipient }));\n    const rcptResp = await readSMTPResponse(adapter);\n    if (rcptResp.isSuccess) {\n      accepted.push(recipient);\n    } else {\n      rejected.push(recipient);\n    }\n  }\n\n  await sendCommand(adapter, { type: \"DATA\" });\n  const dataResp = await readSMTPResponse(adapter);\n  assertResponse(dataResp, [354], \"DATA\");\n\n  let finalResp: SMTPResponse;\n  try {\n    await sendRaw(adapter, encodeCommand({ type: \"DATA_BODY\", content: mime.raw }));\n    finalResp = await readSMTPResponse(adapter);\n  } catch (err) {\n    await sendRaw(adapter, encodeCommand({ type: \"DATA_BODY\", content: mime.raw }));\n    finalResp = await readSMTPResponse(adapter);\n    if (finalResp.isError) {\n      throw err;\n    }\n  }\n  assertResponse(finalResp, [250], \"DATA end\");\n\n  return {\n    messageId: mime.messageId,\n    accepted,\n    rejected,\n    response: finalResp.message,\n    envelope: mime.envelope,\n  };\n}\n\n/**\n * QUIT and close an SMTP session adapter.\n */\nexport async function closeSMTPSession(adapter: SocketAdapter): Promise<void> {\n  try {\n    await sendCommand(adapter, { type: \"QUIT\" });\n    await readSMTPResponse(adapter);\n  } catch {\n    // ignore errors during shutdown\n  } finally {\n    await adapter.close();\n  }\n}\n\nasync function ehlo(adapter: SocketAdapter, host: string): Promise<string[]> {\n  await sendCommand(adapter, { type: \"EHLO\", domain: host });\n  const response = await readSMTPResponse(adapter);\n  assertResponse(response, [250], \"EHLO\");\n  return parseEHLO(response);\n}\n\nasync function authenticate(\n  adapter: SocketAdapter,\n  auth: NonNullable<SMTPConfig[\"auth\"]>,\n  capabilities: string[],\n): Promise<void> {\n  if (auth.type === \"OAUTH2\" && auth.oauth2) {\n    const client = new OAuth2Client(auth.oauth2);\n    const xoauth2 = await client.buildXOAUTH2();\n    await sendCommand(adapter, { type: \"AUTH_XOAUTH2\", xoauth2String: xoauth2 });\n    let resp = await readSMTPResponse(adapter);\n    if (resp.code === 334) {\n      await sendRaw(adapter, encodeLine(\"\"));\n      resp = await readSMTPResponse(adapter);\n    }\n    assertResponse(resp, [235], \"AUTH XOAUTH2\");\n    return;\n  }\n\n  const method = auth.type ?? selectAuthMethod(capabilities);\n\n  if (method === \"CRAM-MD5\") {\n    const pass = requirePassword(auth, \"CRAM-MD5\");\n    await sendCommand(adapter, { type: \"AUTH_CRAM_MD5_INIT\" });\n    let resp = await readSMTPResponse(adapter);\n    assertResponse(resp, [334], \"AUTH CRAM-MD5\");\n    const challenge = resp.message.trim();\n    const response = await computeCRAMMD5(challenge, auth.user, pass);\n    await sendCommand(adapter, { type: \"AUTH_CRAM_MD5_RESPONSE\", response });\n    resp = await readSMTPResponse(adapter);\n    assertResponse(resp, [235], \"AUTH CRAM-MD5 response\");\n    return;\n  }\n\n  if (method === \"PLAIN\") {\n    const pass = requirePassword(auth, \"PLAIN\");\n    await sendRaw(adapter, encodeCommand({ type: \"AUTH_PLAIN\", user: auth.user, pass }));\n    const resp = await readSMTPResponse(adapter);\n    assertResponse(resp, [235], \"AUTH PLAIN\");\n    return;\n  }\n\n  const pass = requirePassword(auth, \"LOGIN\");\n  await sendRaw(adapter, encodeCommand({ type: \"AUTH_LOGIN\", user: auth.user, pass }));\n  let resp = await readSMTPResponse(adapter);\n  assertResponse(resp, [334], \"AUTH LOGIN\");\n\n  await sendRaw(adapter, encodeAuthLoginUser(auth.user));\n  resp = await readSMTPResponse(adapter);\n  assertResponse(resp, [334], \"AUTH LOGIN user\");\n\n  await sendRaw(adapter, encodeAuthLoginPass(pass));\n  resp = await readSMTPResponse(adapter);\n  assertResponse(resp, [235], \"AUTH LOGIN pass\");\n}\n\nfunction requirePassword(auth: NonNullable<SMTPConfig[\"auth\"]>, method: string): string {\n  if (!auth.pass) {\n    throw new SMTPError(`Password required for ${method} authentication`, 0, `AUTH ${method}`, \"\");\n  }\n  return auth.pass;\n}\n\nasync function sendCommand(\n  adapter: SocketAdapter,\n  command: Parameters<typeof encodeCommand>[0],\n): Promise<void> {\n  await sendRaw(adapter, encodeCommand(command));\n}\n\nasync function sendRaw(adapter: SocketAdapter, data: Uint8Array): Promise<void> {\n  await adapter.write(data);\n}\n\n/** Reads and parses a complete SMTP response from the adapter. */\nasync function readSMTPResponse(adapter: SocketAdapter): Promise<SMTPResponse> {\n  const chunks: Uint8Array[] = [];\n  for await (const chunk of adapter.read()) {\n    chunks.push(chunk);\n    const complete = accumulateResponse(chunks);\n    if (complete) {\n      return parseResponse(complete);\n    }\n  }\n  throw new SMTPError(\"Connection closed while reading SMTP response\", 0, \"READ\", \"\");\n}\n\nasync function resolveMX(domain: string): Promise<string> {\n  const dns = await import(\"node:dns/promises\");\n  const records = await dns.resolveMx(domain);\n  if (records.length === 0) {\n    throw new SMTPError(`No MX records for ${domain}`, 0, \"MX\", \"\");\n  }\n  records.sort((a: { priority: number }, b: { priority: number }) => a.priority - b.priority);\n  return records[0]?.exchange ?? domain;\n}\n\n/** @internal Test helper for raw line writes. */\nexport { encodeLine, readSMTPResponse };\n"
   ],
   "mappings": "sSAgDO,AAAM,LAAmC,LAE7B,CAET,QAAgC,KAGxC,WAAW,CAAC,EAAoB,CAC9B,KAAK,OAAS,EAAkB,CAAM,OAIlC,KAAI,CAAC,EAA2C,CACpD,IAAM,EAAkB,IACnB,EACH,YAAa,MAAM,EAAmB,EAAQ,WAAW,CAC3D,EACM,EAAO,MAAM,EAAU,EAAiB,KAAK,OAAO,IAAI,EACxD,EAAU,MAAM,KAAK,WAAW,EAEhC,EAAO,KAAK,OAAO,OACrB,MAAM,EAAU,EAAK,SAAS,KAAK,MAAM,GAAG,EAAE,IAAM,KAAK,OAAO,IAAI,EACpE,KAAK,OAAO,KAEhB,MAAM,EAAQ,QAAQ,EAAM,KAAK,OAAO,IAAI,EAC5C,KAAK,QAAU,EAEf,GAAI,CAEF,OADA,MAAM,EAAgB,EAAS,KAAK,MAAM,EACnC,MAAM,EAAmB,EAAS,CAAI,SAC7C,CACA,MAAM,EAAiB,CAAO,EAC9B,KAAK,QAAU,WAKb,OAAM,EAA0B,CACpC,GAAI,CACF,IAAM,EAAU,MAAM,KAAK,WAAW,EACtC,MAAM,EAAQ,QAAQ,KAAK,OAAO,KAAM,KAAK,OAAO,IAAI,EAExD,GAAI,CAEF,OADA,MAAM,EAAgB,EAAS,KAAK,MAAM,EACnC,CAAE,GAAI,GAAM,SAAU,MAAO,SACpC,CACA,MAAM,EAAiB,CAAO,GAEhC,MAAO,EAAK,CACZ,MAAO,CACL,GAAI,GACJ,SAAU,OACV,QAAS,aAAe,MAAQ,EAAI,QAAU,OAAO,CAAG,CAC1D,QAKE,MAAK,EAAkB,CAC3B,GAAI,KAAK,QACP,MAAM,KAAK,QAAQ,MAAM,EACzB,KAAK,QAAU,UAKL,WAAU,EAA2B,CACjD,GAAI,CAAC,KAAK,OAAO,QACf,MAAM,IAAI,EAAU,+BAAgC,EAAG,UAAW,EAAE,EAEtE,OAAO,KAAK,OAAO,QAEvB,CA+BO,SAAS,CAAiB,CAAC,EAAwC,CACxE,IAAM,EAAS,EAAO,QAAU,GAChC,MAAO,CACL,KAAM,EAAO,KACb,KAAM,EAAO,OAAS,EAAS,IAAM,KACrC,YACI,EAAO,OAAS,OAAY,CAAE,KAAM,EAAO,IAAK,EAAI,CAAC,KACrD,EAAO,aAAe,OAAY,CAAE,WAAY,EAAO,UAAW,EAAI,CAAC,KACvE,EAAO,OAAS,OAAY,CAAE,KAAM,EAAO,IAAK,EAAI,CAAC,KACrD,EAAO,MAAQ,OAAY,CAAE,IAAK,EAAO,GAAI,EAAI,CAAC,KAClD,EAAO,oBAAsB,OAC7B,CAAE,kBAAmB,EAAO,iBAAkB,EAC9C,CAAC,KACD,EAAO,kBAAoB,OAAY,CAAE,gBAAiB,EAAO,eAAgB,EAAI,CAAC,KACtF,EAAO,gBAAkB,OAAY,CAAE,cAAe,EAAO,aAAc,EAAI,CAAC,KAChF,EAAO,SAAW,OAAY,CAAE,OAAQ,EAAO,MAAO,EAAI,CAAC,KAC3D,EAAO,UAAY,OAAY,CAAE,QAAS,EAAO,OAAQ,EAAI,CAAC,CACpE,EAMF,eAAsB,CAAe,CACnC,EACA,EACe,CACf,IAAM,EAAW,MAAM,EAAiB,CAAO,EAC/C,EAAe,EAAU,CAAC,GAAG,EAAG,UAAU,EAE1C,IAAI,EAAe,MAAM,EAAK,EAAS,EAAO,IAAI,EAC5C,EAAmB,EAAa,KAAK,CAAC,IAAQ,EAAI,YAAY,IAAM,UAAU,EACpF,GAAI,CAAC,EAAO,QAAU,CAAC,EAAQ,QAAU,EAAkB,CACzD,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,UAAW,CAAC,CAAC,EAC1D,IAAM,EAAe,MAAM,EAAiB,CAAO,EACnD,EAAe,EAAc,CAAC,GAAG,EAAG,UAAU,EAC9C,MAAM,EAAQ,SAAS,EAAO,GAAG,EACjC,EAAe,MAAM,EAAK,EAAS,EAAO,IAAI,EAGhD,GAAI,EAAO,KAAM,CACf,IAAM,EAAc,EAAO,YAAc,GACnC,EAAY,EAAQ,QAAU,EAAO,OAC3C,GAAI,GAAe,CAAC,EAClB,MAAM,IAAI,EACR,uHAEA,EACA,OACA,EACF,EAEF,MAAM,EAAa,EAAS,EAAO,KAAM,CAAY,GAOzD,eAAsB,CAAkB,CACtC,EACA,EACqB,CACrB,MAAM,EAAY,EAAS,CAAE,KAAM,YAAa,QAAS,EAAK,SAAS,IAAK,CAAC,EAC7E,IAAM,EAAW,MAAM,EAAiB,CAAO,EAC/C,EAAe,EAAU,CAAC,GAAG,EAAG,WAAW,EAE3C,IAAM,EAAqB,CAAC,EACtB,EAAqB,CAAC,EAE5B,QAAW,KAAa,EAAK,SAAS,GAGpC,GAFA,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,UAAW,QAAS,CAAU,CAAC,CAAC,GAC5D,MAAM,EAAiB,CAAO,GAClC,UACX,EAAS,KAAK,CAAS,EAEvB,OAAS,KAAK,CAAS,EAI3B,MAAM,EAAY,EAAS,CAAE,KAAM,MAAO,CAAC,EAC3C,IAAM,EAAW,MAAM,EAAiB,CAAO,EAC/C,EAAe,EAAU,CAAC,GAAG,EAAG,MAAM,EAEtC,IAAI,EACJ,GAAI,CACF,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,YAAa,QAAS,EAAK,GAAI,CAAC,CAAC,EAC9E,EAAY,MAAM,EAAiB,CAAO,EAC1C,MAAO,EAAK,CAGZ,GAFA,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,YAAa,QAAS,EAAK,GAAI,CAAC,CAAC,EAC9E,EAAY,MAAM,EAAiB,CAAO,EACtC,EAAU,QACZ,MAAM,EAKV,OAFA,EAAe,EAAW,CAAC,GAAG,EAAG,UAAU,EAEpC,CACL,UAAW,EAAK,UAChB,WACA,WACA,SAAU,EAAU,QACpB,SAAU,EAAK,QACjB,EAMF,eAAsB,CAAgB,CAAC,EAAuC,CAC5E,GAAI,CACF,MAAM,EAAY,EAAS,CAAE,KAAM,MAAO,CAAC,EAC3C,MAAM,EAAiB,CAAO,EAC9B,KAAM,SAEN,CACA,MAAM,EAAQ,MAAM,GAIxB,eAAe,CAAI,CAAC,EAAwB,EAAiC,CAC3E,MAAM,EAAY,EAAS,CAAE,KAAM,OAAQ,OAAQ,CAAK,CAAC,EACzD,IAAM,EAAW,MAAM,EAAiB,CAAO,EAE/C,OADA,EAAe,EAAU,CAAC,GAAG,EAAG,MAAM,EAC/B,EAAU,CAAQ,EAG3B,eAAe,CAAY,CACzB,EACA,EACA,EACe,CACf,GAAI,EAAK,OAAS,UAAY,EAAK,OAAQ,CAEzC,IAAM,EAAU,MADD,IAAI,EAAa,EAAK,MAAM,EACd,aAAa,EAC1C,MAAM,EAAY,EAAS,CAAE,KAAM,eAAgB,cAAe,CAAQ,CAAC,EAC3E,IAAI,EAAO,MAAM,EAAiB,CAAO,EACzC,GAAI,EAAK,OAAS,IAChB,MAAM,EAAQ,EAAS,EAAW,EAAE,CAAC,EACrC,EAAO,MAAM,EAAiB,CAAO,EAEvC,EAAe,EAAM,CAAC,GAAG,EAAG,cAAc,EAC1C,OAGF,IAAM,EAAS,EAAK,MAAQ,EAAiB,CAAY,EAEzD,GAAI,IAAW,WAAY,CACzB,IAAM,EAAO,EAAgB,EAAM,UAAU,EAC7C,MAAM,EAAY,EAAS,CAAE,KAAM,oBAAqB,CAAC,EACzD,IAAI,EAAO,MAAM,EAAiB,CAAO,EACzC,EAAe,EAAM,CAAC,GAAG,EAAG,eAAe,EAC3C,IAAM,EAAY,EAAK,QAAQ,KAAK,EAC9B,EAAW,MAAM,EAAe,EAAW,EAAK,KAAM,CAAI,EAChE,MAAM,EAAY,EAAS,CAAE,KAAM,yBAA0B,UAAS,CAAC,EACvE,EAAO,MAAM,EAAiB,CAAO,EACrC,EAAe,EAAM,CAAC,GAAG,EAAG,wBAAwB,EACpD,OAGF,GAAI,IAAW,QAAS,CACtB,IAAM,EAAO,EAAgB,EAAM,OAAO,EAC1C,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,aAAc,KAAM,EAAK,KAAM,MAAK,CAAC,CAAC,EACnF,IAAM,EAAO,MAAM,EAAiB,CAAO,EAC3C,EAAe,EAAM,CAAC,GAAG,EAAG,YAAY,EACxC,OAGF,IAAM,EAAO,EAAgB,EAAM,OAAO,EAC1C,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,aAAc,KAAM,EAAK,KAAM,MAAK,CAAC,CAAC,EACnF,IAAI,EAAO,MAAM,EAAiB,CAAO,EACzC,EAAe,EAAM,CAAC,GAAG,EAAG,YAAY,EAExC,MAAM,EAAQ,EAAS,EAAoB,EAAK,IAAI,CAAC,EACrD,EAAO,MAAM,EAAiB,CAAO,EACrC,EAAe,EAAM,CAAC,GAAG,EAAG,iBAAiB,EAE7C,MAAM,EAAQ,EAAS,EAAoB,CAAI,CAAC,EAChD,EAAO,MAAM,EAAiB,CAAO,EACrC,EAAe,EAAM,CAAC,GAAG,EAAG,iBAAiB,EAG/C,SAAS,CAAe,CAAC,EAAuC,EAAwB,CACtF,GAAI,CAAC,EAAK,KACR,MAAM,IAAI,EAAU,yBAAyB,mBAAyB,EAAG,QAAQ,IAAU,EAAE,EAE/F,OAAO,EAAK,KAGd,eAAe,CAAW,CACxB,EACA,EACe,CACf,MAAM,EAAQ,EAAS,EAAc,CAAO,CAAC,EAG/C,eAAe,CAAO,CAAC,EAAwB,EAAiC,CAC9E,MAAM,EAAQ,MAAM,CAAI,EAI1B,eAAe,CAAgB,CAAC,EAA+C,CAC7E,IAAM,EAAuB,CAAC,EAC9B,cAAiB,KAAS,EAAQ,KAAK,EAAG,CACxC,EAAO,KAAK,CAAK,EACjB,IAAM,EAAW,EAAmB,CAAM,EAC1C,GAAI,EACF,OAAO,EAAc,CAAQ,EAGjC,MAAM,IAAI,EAAU,gDAAiD,EAAG,OAAQ,EAAE,EAGpF,eAAe,CAAS,CAAC,EAAiC,CAExD,IAAM,EAAU,MADJ,KAAa,8BACC,UAAU,CAAM,EAC1C,GAAI,EAAQ,SAAW,EACrB,MAAM,IAAI,EAAU,qBAAqB,IAAU,EAAG,KAAM,EAAE,EAGhE,OADA,EAAQ,KAAK,CAAC,EAAyB,IAA4B,EAAE,SAAW,EAAE,QAAQ,EACnF,EAAQ,IAAI,UAAY",
-  "debugId": "812F038BA87E1B8464756E2164756E21",
+  "debugId": "7F6A4A30744EE38A64756E2164756E21",
   "names": []
 }

package/dist/{chunk-6yggz45h.js → chunk-gxq2aamv.js}

@@ -1,5 +1,5 @@
 var J=new TextEncoder;function P(k){let f=typeof k==="string"?J.encode(k):k,j="",A=0;while(A<f.length){let m=f[A]??0,q=f[A+1],z=f[A+2];if(q===void 0){j+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[m>>2],j+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[(m&3)<<4],j+="==";break}if(z===void 0){j+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[m>>2],j+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[(m&3)<<4|q>>4],j+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[(q&15)<<2],j+="=";break}j+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[m>>2],j+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[(m&3)<<4|q>>4],j+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[(q&15)<<2|z>>6],j+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[z&63],A+=3}return R(j)}function S(k){let f=k.replace(/\s/g,""),j=f.length;if(j===0)return new Uint8Array(0);if(j%4!==0)throw Error("Invalid base64 string length");let A=f.endsWith("==")?2:f.endsWith("=")?1:0,m=j*3/4-A,q=new Uint8Array(m),z=0;for(let D=0;D<j;D+=4){let K=G(f[D]??"="),M=G(f[D+1]??"="),N=G(f[D+2]??"="),O=G(f[D+3]??"="),H=K<<18|M<<12|N<<6|O;if(z<m)q[z++]=H>>16&255;if(z<m)q[z++]=H>>8&255;if(z<m)q[z++]=H&255}return q}function W(k){if(!Q(k))return k;return`=?UTF-8?B?${P(k).replace(/\r\n/g,"")}?=`}function Q(k){for(let f=0;f<k.length;f++)if(k.charCodeAt(f)>127)return!0;return!1}function G(k){if(k==="=")return 0;let f="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".indexOf(k);if(f===-1)throw Error(`Invalid base64 character: ${k}`);return f}function R(k){let f=[];for(let j=0;j<k.length;j+=76)f.push(k.slice(j,j+76));return f.join(`\r
 `)}function X(k){return J.encode(k)}
-export{P as E,S as F,W as G,X as H};
+export{P as N,S as O,W as P,X as Q};
 
-//# debugId=CA1328BCB199FC6564756E2164756E21
+//# debugId=678FAACF05287D3164756E2164756E21

package/dist/{chunk-6yggz45h.js.map → chunk-gxq2aamv.js.map}

@@ -5,6 +5,6 @@
     "// src/core/base64.ts\n\nconst BASE64_CHARS = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\nconst BASE64_LINE_LENGTH = 76;\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\n/**\n * Encode a Uint8Array or string to Base64.\n * Uses TextEncoder + manual base64 to support binary data correctly.\n */\nexport function encodeBase64(data: Uint8Array | string): string {\n  const bytes = typeof data === \"string\" ? encoder.encode(data) : data;\n  let result = \"\";\n  let i = 0;\n\n  while (i < bytes.length) {\n    const b0 = bytes[i] ?? 0;\n    const b1 = bytes[i + 1];\n    const b2 = bytes[i + 2];\n\n    if (b1 === undefined) {\n      result += BASE64_CHARS[b0 >> 2];\n      result += BASE64_CHARS[(b0 & 0x03) << 4];\n      result += \"==\";\n      break;\n    }\n\n    if (b2 === undefined) {\n      result += BASE64_CHARS[b0 >> 2];\n      result += BASE64_CHARS[((b0 & 0x03) << 4) | (b1 >> 4)];\n      result += BASE64_CHARS[(b1 & 0x0f) << 2];\n      result += \"=\";\n      break;\n    }\n\n    result += BASE64_CHARS[b0 >> 2];\n    result += BASE64_CHARS[((b0 & 0x03) << 4) | (b1 >> 4)];\n    result += BASE64_CHARS[((b1 & 0x0f) << 2) | (b2 >> 6)];\n    result += BASE64_CHARS[b2 & 0x3f];\n    i += 3;\n  }\n\n  return wrapBase64Lines(result);\n}\n\n/**\n * Decode a Base64 string to Uint8Array.\n */\nexport function decodeBase64(data: string): Uint8Array {\n  const cleaned = data.replace(/\\s/g, \"\");\n  const len = cleaned.length;\n\n  if (len === 0) {\n    return new Uint8Array(0);\n  }\n\n  if (len % 4 !== 0) {\n    throw new Error(\"Invalid base64 string length\");\n  }\n\n  const padding = cleaned.endsWith(\"==\") ? 2 : cleaned.endsWith(\"=\") ? 1 : 0;\n  const outputLen = (len * 3) / 4 - padding;\n  const output = new Uint8Array(outputLen);\n\n  let outIndex = 0;\n  for (let i = 0; i < len; i += 4) {\n    const c0 = base64CharToValue(cleaned[i] ?? \"=\");\n    const c1 = base64CharToValue(cleaned[i + 1] ?? \"=\");\n    const c2 = base64CharToValue(cleaned[i + 2] ?? \"=\");\n    const c3 = base64CharToValue(cleaned[i + 3] ?? \"=\");\n    const triple = (c0 << 18) | (c1 << 12) | (c2 << 6) | c3;\n\n    if (outIndex < outputLen) {\n      output[outIndex++] = (triple >> 16) & 0xff;\n    }\n    if (outIndex < outputLen) {\n      output[outIndex++] = (triple >> 8) & 0xff;\n    }\n    if (outIndex < outputLen) {\n      output[outIndex++] = triple & 0xff;\n    }\n  }\n\n  return output;\n}\n\n/**\n * Encode text using Quoted-Printable (RFC 2045).\n */\nexport function encodeQP(text: string): string {\n  const bytes = encoder.encode(text);\n  const lines: string[] = [];\n  let line = \"\";\n\n  for (let i = 0; i < bytes.length; i++) {\n    const byte = bytes[i] ?? 0;\n\n    if (byte === 0x0a) {\n      lines.push(line);\n      line = \"\";\n      continue;\n    }\n\n    if (byte === 0x0d) {\n      continue;\n    }\n\n    let encoded: string;\n    if (\n      (byte >= 33 && byte <= 60) ||\n      (byte >= 62 && byte <= 126) ||\n      byte === 0x09 ||\n      byte === 0x20\n    ) {\n      encoded = String.fromCharCode(byte);\n    } else {\n      encoded = `=${byte.toString(16).toUpperCase().padStart(2, \"0\")}`;\n    }\n\n    if (line.length + encoded.length > 75) {\n      lines.push(`${line}=`);\n      line = encoded;\n    } else {\n      line += encoded;\n    }\n  }\n\n  if (line.length > 0) {\n    lines.push(line);\n  }\n\n  return lines.join(\"\\r\\n\");\n}\n\n/**\n * Encode an email header value per RFC 2047.\n * Non-ASCII values become: =?UTF-8?B?<base64>?=\n */\nexport function encodeHeader(value: string): string {\n  if (!needsEncoding(value)) {\n    return value;\n  }\n\n  const encoded = encodeBase64(value).replace(/\\r\\n/g, \"\");\n  return `=?UTF-8?B?${encoded}?=`;\n}\n\n/**\n * Returns true if the string contains non-ASCII characters\n * and therefore requires RFC 2047 encoding in headers.\n */\nexport function needsEncoding(text: string): boolean {\n  for (let i = 0; i < text.length; i++) {\n    if (text.charCodeAt(i) > 127) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction base64CharToValue(char: string): number {\n  if (char === \"=\") {\n    return 0;\n  }\n  const index = BASE64_CHARS.indexOf(char);\n  if (index === -1) {\n    throw new Error(`Invalid base64 character: ${char}`);\n  }\n  return index;\n}\n\nfunction wrapBase64Lines(base64: string): string {\n  const lines: string[] = [];\n  for (let i = 0; i < base64.length; i += BASE64_LINE_LENGTH) {\n    lines.push(base64.slice(i, i + BASE64_LINE_LENGTH));\n  }\n  return lines.join(\"\\r\\n\");\n}\n\n/** Decode bytes to UTF-8 string. */\nexport function decodeUtf8(bytes: Uint8Array): string {\n  return decoder.decode(bytes);\n}\n\n/** Encode string to UTF-8 bytes. */\nexport function encodeUtf8(text: string): Uint8Array {\n  return encoder.encode(text);\n}\n"
   ],
   "mappings": "AAKA,IAAM,EAAU,IAAI,YAOb,SAAS,CAAY,CAAC,EAAmC,CAC9D,IAAM,EAAQ,OAAO,IAAS,SAAW,EAAQ,OAAO,CAAI,EAAI,EAC5D,EAAS,GACT,EAAI,EAER,MAAO,EAAI,EAAM,OAAQ,CACvB,IAAM,EAAK,EAAM,IAAM,EACjB,EAAK,EAAM,EAAI,GACf,EAAK,EAAM,EAAI,GAErB,GAAI,IAAO,OAAW,CACpB,GArBe,mEAqBQ,GAAM,GAC7B,GAtBe,mEAsBS,GAAK,IAAS,GACtC,GAAU,KACV,MAGF,GAAI,IAAO,OAAW,CACpB,GA5Be,mEA4BQ,GAAM,GAC7B,GA7Be,mEA6BU,GAAK,IAAS,EAAM,GAAM,GACnD,GA9Be,mEA8BS,GAAK,KAAS,GACtC,GAAU,IACV,MAGF,GAnCiB,mEAmCM,GAAM,GAC7B,GApCiB,mEAoCQ,GAAK,IAAS,EAAM,GAAM,GACnD,GArCiB,mEAqCQ,GAAK,KAAS,EAAM,GAAM,GACnD,GAtCiB,mEAsCM,EAAK,IAC5B,GAAK,EAGP,OAAO,EAAgB,CAAM,EAMxB,SAAS,CAAY,CAAC,EAA0B,CACrD,IAAM,EAAU,EAAK,QAAQ,MAAO,EAAE,EAChC,EAAM,EAAQ,OAEpB,GAAI,IAAQ,EACV,OAAO,IAAI,WAAW,CAAC,EAGzB,GAAI,EAAM,IAAM,EACd,MAAU,MAAM,8BAA8B,EAGhD,IAAM,EAAU,EAAQ,SAAS,IAAI,EAAI,EAAI,EAAQ,SAAS,GAAG,EAAI,EAAI,EACnE,EAAa,EAAM,EAAK,EAAI,EAC5B,EAAS,IAAI,WAAW,CAAS,EAEnC,EAAW,EACf,QAAS,EAAI,EAAG,EAAI,EAAK,GAAK,EAAG,CAC/B,IAAM,EAAK,EAAkB,EAAQ,IAAM,GAAG,EACxC,EAAK,EAAkB,EAAQ,EAAI,IAAM,GAAG,EAC5C,EAAK,EAAkB,EAAQ,EAAI,IAAM,GAAG,EAC5C,EAAK,EAAkB,EAAQ,EAAI,IAAM,GAAG,EAC5C,EAAU,GAAM,GAAO,GAAM,GAAO,GAAM,EAAK,EAErD,GAAI,EAAW,EACb,EAAO,KAAe,GAAU,GAAM,IAExC,GAAI,EAAW,EACb,EAAO,KAAe,GAAU,EAAK,IAEvC,GAAI,EAAW,EACb,EAAO,KAAc,EAAS,IAIlC,OAAO,EAuDF,SAAS,CAAY,CAAC,EAAuB,CAClD,GAAI,CAAC,EAAc,CAAK,EACtB,OAAO,EAIT,MAAO,aADS,EAAa,CAAK,EAAE,QAAQ,QAAS,EAAE,MAQlD,SAAS,CAAa,CAAC,EAAuB,CACnD,QAAS,EAAI,EAAG,EAAI,EAAK,OAAQ,IAC/B,GAAI,EAAK,WAAW,CAAC,EAAI,IACvB,MAAO,GAGX,MAAO,GAGT,SAAS,CAAiB,CAAC,EAAsB,CAC/C,GAAI,IAAS,IACX,MAAO,GAET,IAAM,EApKa,mEAoKQ,QAAQ,CAAI,EACvC,GAAI,IAAU,GACZ,MAAU,MAAM,6BAA6B,GAAM,EAErD,OAAO,EAGT,SAAS,CAAe,CAAC,EAAwB,CAC/C,IAAM,EAAkB,CAAC,EACzB,QAAS,EAAI,EAAG,EAAI,EAAO,OAAQ,GA5KV,GA6KvB,EAAM,KAAK,EAAO,MAAM,EAAG,EA7KJ,EA6K0B,CAAC,EAEpD,OAAO,EAAM,KAAK;AAAA,CAAM,EASnB,SAAS,CAAU,CAAC,EAA0B,CACnD,OAAO,EAAQ,OAAO,CAAI",
-  "debugId": "CA1328BCB199FC6564756E2164756E21",
+  "debugId": "678FAACF05287D3164756E2164756E21",
   "names": []
 }

package/dist/chunk-k0gw3qmb.js

@@ -0,0 +1,4 @@
+import{R as C}from"./chunk-mg8m26nr.js";async function K(D,y){let E=D??[],j=[];for(let b of E){if(b.content instanceof Uint8Array){j.push(b);continue}if(b.path){let z;try{z=await import("node:fs/promises")}catch{throw Error("attachment.path is not supported on this runtime — use attachment.content (Uint8Array) instead")}if(y?.basePath){let{resolve:A,sep:H}=await import("node:path"),k=A(b.path),w=A(y.basePath);if(!(k===w||k.startsWith(w+H)))throw Error(`[sently] Attachment path "${k}" escapes basePath "${w}". Use absolute paths within the allowed directory.`)}let F=await z.readFile(b.path),{path:I,...G}=b;j.push({...G,content:new Uint8Array(F)});continue}if(typeof b.content==="string"){j.push(b);continue}j.push(b)}return j}
+export{K as s};
+
+//# debugId=94F87AE0DE874B5764756E2164756E21

package/dist/chunk-k0gw3qmb.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/transports/resolve-attachments.ts"],
+  "sourcesContent": [
+    "import type { Attachment } from \"../core/types.js\";\n\n/** Options for {@link resolveAttachments}. */\nexport interface ResolveAttachmentsOptions {\n  /**\n   * If set, attachment paths must resolve within this directory.\n   * Prevents path traversal via `..` segments and sibling-directory\n   * prefix matches. Opt-in only.\n   *\n   * Note: this check uses `node:path` `resolve()`, which does NOT\n   * dereference symlinks. A symlink located inside `basePath` that\n   * points outside of it will pass this check. If symlink traversal is\n   * a concern, resolve paths with `fs.realpath()` before passing them in.\n   */\n  basePath?: string;\n}\n\n/**\n * Resolve attachment.path to in-memory Uint8Array content.\n * @throws When attachment.path is used on runtimes without node:fs/promises\n */\nexport async function resolveAttachments(\n  attachments: Attachment[] | undefined,\n  options?: ResolveAttachmentsOptions,\n): Promise<Attachment[]> {\n  const list = attachments ?? [];\n  const resolved: Attachment[] = [];\n\n  for (const attachment of list) {\n    if (attachment.content instanceof Uint8Array) {\n      resolved.push(attachment);\n      continue;\n    }\n\n    if (attachment.path) {\n      let fs: typeof import(\"node:fs/promises\");\n      try {\n        fs = await import(\"node:fs/promises\");\n      } catch {\n        throw new Error(\n          \"attachment.path is not supported on this runtime — use attachment.content (Uint8Array) instead\",\n        );\n      }\n\n      if (options?.basePath) {\n        const { resolve, sep } = await import(\"node:path\");\n        const resolvedPath = resolve(attachment.path);\n        const resolvedBase = resolve(options.basePath);\n        // startsWith alone is vulnerable: \"/var/data-secret\" passes \"/var/data\".\n        // Require an exact match or a trailing path separator.\n        const isWithin =\n          resolvedPath === resolvedBase || resolvedPath.startsWith(resolvedBase + sep);\n        if (!isWithin) {\n          throw new Error(\n            `[sently] Attachment path \"${resolvedPath}\" escapes basePath \"${resolvedBase}\". ` +\n              \"Use absolute paths within the allowed directory.\",\n          );\n        }\n      }\n\n      const data = await fs.readFile(attachment.path);\n      const { path: _path, ...rest } = attachment;\n      resolved.push({ ...rest, content: new Uint8Array(data) });\n      continue;\n    }\n\n    if (typeof attachment.content === \"string\") {\n      resolved.push(attachment);\n      continue;\n    }\n\n    resolved.push(attachment);\n  }\n\n  return resolved;\n}\n"
+  ],
+  "mappings": "wCAqBA,eAAsB,CAAkB,CACtC,EACA,EACuB,CACvB,IAAM,EAAO,GAAe,CAAC,EACvB,EAAyB,CAAC,EAEhC,QAAW,KAAc,EAAM,CAC7B,GAAI,EAAW,mBAAmB,WAAY,CAC5C,EAAS,KAAK,CAAU,EACxB,SAGF,GAAI,EAAW,KAAM,CACnB,IAAI,EACJ,GAAI,CACF,EAAK,KAAa,4BAClB,KAAM,CACN,MAAU,MACR,gGACF,EAGF,GAAI,GAAS,SAAU,CACrB,IAAQ,UAAS,OAAQ,KAAa,qBAChC,EAAe,EAAQ,EAAW,IAAI,EACtC,EAAe,EAAQ,EAAQ,QAAQ,EAK7C,GAAI,EADF,IAAiB,GAAgB,EAAa,WAAW,EAAe,CAAG,GAE3E,MAAU,MACR,6BAA6B,wBAAmC,sDAElE,EAIJ,IAAM,EAAO,MAAM,EAAG,SAAS,EAAW,IAAI,GACtC,KAAM,KAAU,GAAS,EACjC,EAAS,KAAK,IAAK,EAAM,QAAS,IAAI,WAAW,CAAI,CAAE,CAAC,EACxD,SAGF,GAAI,OAAO,EAAW,UAAY,SAAU,CAC1C,EAAS,KAAK,CAAU,EACxB,SAGF,EAAS,KAAK,CAAU,EAG1B,OAAO",
+  "debugId": "94F87AE0DE874B5764756E2164756E21",
+  "names": []
+}

package/dist/{chunk-sqn04kae.js → chunk-mg8m26nr.js}

@@ -1,4 +1,4 @@
 import{createRequire as a}from"node:module";var c=a(import.meta.url);
-export{c as I};
+export{c as R};
 
-//# debugId=F5A5666131F06DB864756E2164756E21
+//# debugId=78316B99719BC7AC64756E2164756E21

package/dist/{chunk-sqn04kae.js.map → chunk-mg8m26nr.js.map}

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "F5A5666131F06DB864756E2164756E21",
+  "debugId": "78316B99719BC7AC64756E2164756E21",
   "names": []
 }

package/dist/chunk-pqp843mh.js

@@ -0,0 +1,4 @@
+function C(k,j){let m=Math.max(k.length,j.length),q=k.length^j.length;for(let z=0;z<m;z++){let A=z<k.length?k[z]??0:0,B=z<j.length?j[z]??0:0;q|=A^B}return q===0}function E(k){try{let j=atob(k),m=new Uint8Array(j.length);for(let q=0;q<j.length;q++)m[q]=j.charCodeAt(q);return m}catch{return null}}function F(k){if(k.length%2!==0)return null;let j=new Uint8Array(k.length/2);for(let m=0;m<j.length;m++){let q=Number.parseInt(k.slice(m*2,m*2+2),16);if(Number.isNaN(q))return null;j[m]=q}return j}
+export{C as a,E as b,F as c};
+
+//# debugId=4E8731D8B9FFEA7D64756E2164756E21

package/dist/chunk-pqp843mh.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/webhooks/timing-safe-equal.ts"],
+  "sourcesContent": [
+    "/**\n * Constant-time byte comparison for cryptographic signatures.\n * Never short-circuits the XOR loop; length mismatch is folded into `diff`.\n */\nexport function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n  const len = Math.max(a.length, b.length);\n  let diff = a.length ^ b.length;\n\n  for (let i = 0; i < len; i++) {\n    const ai = i < a.length ? (a[i] ?? 0) : 0;\n    const bi = i < b.length ? (b[i] ?? 0) : 0;\n    diff |= ai ^ bi;\n  }\n\n  return diff === 0;\n}\n\n/** Decode a base64 string to bytes; returns null on invalid input. */\nexport function decodeBase64Bytes(value: string): Uint8Array | null {\n  try {\n    const binary = atob(value);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) {\n      bytes[i] = binary.charCodeAt(i);\n    }\n    return bytes;\n  } catch {\n    return null;\n  }\n}\n\n/** Decode a lowercase hex string to bytes; returns null on invalid input. */\nexport function decodeHexBytes(value: string): Uint8Array | null {\n  if (value.length % 2 !== 0) {\n    return null;\n  }\n\n  const bytes = new Uint8Array(value.length / 2);\n  for (let i = 0; i < bytes.length; i++) {\n    const byte = Number.parseInt(value.slice(i * 2, i * 2 + 2), 16);\n    if (Number.isNaN(byte)) {\n      return null;\n    }\n    bytes[i] = byte;\n  }\n\n  return bytes;\n}\n"
+  ],
+  "mappings": "AAIO,SAAS,CAAe,CAAC,EAAe,EAAwB,CACrE,IAAM,EAAM,KAAK,IAAI,EAAE,OAAQ,EAAE,MAAM,EACnC,EAAO,EAAE,OAAS,EAAE,OAExB,QAAS,EAAI,EAAG,EAAI,EAAK,IAAK,CAC5B,IAAM,EAAK,EAAI,EAAE,OAAU,EAAE,IAAM,EAAK,EAClC,EAAK,EAAI,EAAE,OAAU,EAAE,IAAM,EAAK,EACxC,GAAQ,EAAK,EAGf,OAAO,IAAS,EAIX,SAAS,CAAiB,CAAC,EAAkC,CAClE,GAAI,CACF,IAAM,EAAS,KAAK,CAAK,EACnB,EAAQ,IAAI,WAAW,EAAO,MAAM,EAC1C,QAAS,EAAI,EAAG,EAAI,EAAO,OAAQ,IACjC,EAAM,GAAK,EAAO,WAAW,CAAC,EAEhC,OAAO,EACP,KAAM,CACN,OAAO,MAKJ,SAAS,CAAc,CAAC,EAAkC,CAC/D,GAAI,EAAM,OAAS,IAAM,EACvB,OAAO,KAGT,IAAM,EAAQ,IAAI,WAAW,EAAM,OAAS,CAAC,EAC7C,QAAS,EAAI,EAAG,EAAI,EAAM,OAAQ,IAAK,CACrC,IAAM,EAAO,OAAO,SAAS,EAAM,MAAM,EAAI,EAAG,EAAI,EAAI,CAAC,EAAG,EAAE,EAC9D,GAAI,OAAO,MAAM,CAAI,EACnB,OAAO,KAET,EAAM,GAAK,EAGb,OAAO",
+  "debugId": "4E8731D8B9FFEA7D64756E2164756E21",
+  "names": []
+}

package/dist/chunk-q8k3m6qe.js

@@ -0,0 +1,4 @@
+function j(b,f){return f[b]??"unknown"}function q(b){if(typeof b==="number"){let f=b<1000000000000?b*1000:b,h=new Date(f);return Number.isNaN(h.getTime())?void 0:h}if(typeof b==="string"){let f=new Date(b);return Number.isNaN(f.getTime())?void 0:f}return}function w(b){return Array.isArray(b)?b:[b]}function z(b){let f={provider:b.provider,type:b.type,raw:b.raw};if(b.messageId!==void 0)f.messageId=b.messageId;if(b.recipient!==void 0)f.recipient=b.recipient;if(b.timestamp!==void 0)f.timestamp=b.timestamp;return f}
+export{j as d,q as e,w as f,z as g};
+
+//# debugId=F5B96C321D2447A964756E2164756E21

package/dist/chunk-q8k3m6qe.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/webhooks/types.ts"],
+  "sourcesContent": [
+    "/** Normalized email lifecycle event from any provider webhook. */\nexport interface EmailEvent {\n  /** Provider identifier (e.g. `\"resend\"`, `\"sendgrid\"`). */\n  provider: string;\n  /** Normalized event type. */\n  type: \"delivered\" | \"bounced\" | \"complained\" | \"opened\" | \"clicked\" | \"deferred\" | \"unknown\";\n  /** Provider message identifier when available. */\n  messageId?: string;\n  /** Recipient email address when available. */\n  recipient?: string;\n  /** Event timestamp when available. */\n  timestamp?: Date;\n  /** Original provider payload for debugging or custom handling. */\n  raw: unknown;\n}\n\n/** Map a provider-specific event string to a normalized {@link EmailEvent.type}. */\nexport type EventTypeMapper = (event: string) => EmailEvent[\"type\"];\n\n/** Default mapper — returns `\"unknown\"` for unrecognized events. */\nexport function mapEventType(\n  event: string,\n  mapping: Record<string, EmailEvent[\"type\"]>,\n): EmailEvent[\"type\"] {\n  return mapping[event] ?? \"unknown\";\n}\n\n/** Parse an ISO or Unix timestamp into a Date, or undefined when invalid. */\nexport function parseTimestamp(value: unknown): Date | undefined {\n  if (typeof value === \"number\") {\n    const ms = value < 1_000_000_000_000 ? value * 1000 : value;\n    const date = new Date(ms);\n    return Number.isNaN(date.getTime()) ? undefined : date;\n  }\n  if (typeof value === \"string\") {\n    const date = new Date(value);\n    return Number.isNaN(date.getTime()) ? undefined : date;\n  }\n  return undefined;\n}\n\n/** Ensure payload is an array (for providers that batch events). */\nexport function asArray(payload: unknown): unknown[] {\n  return Array.isArray(payload) ? payload : [payload];\n}\n\n/** Build an {@link EmailEvent} respecting exact optional property types. */\nexport function emailEvent(input: {\n  provider: string;\n  type: EmailEvent[\"type\"];\n  raw: unknown;\n  messageId?: string | undefined;\n  recipient?: string | undefined;\n  timestamp?: Date | undefined;\n}): EmailEvent {\n  const event: EmailEvent = {\n    provider: input.provider,\n    type: input.type,\n    raw: input.raw,\n  };\n\n  if (input.messageId !== undefined) {\n    event.messageId = input.messageId;\n  }\n  if (input.recipient !== undefined) {\n    event.recipient = input.recipient;\n  }\n  if (input.timestamp !== undefined) {\n    event.timestamp = input.timestamp;\n  }\n\n  return event;\n}\n"
+  ],
+  "mappings": "AAoBO,SAAS,CAAY,CAC1B,EACA,EACoB,CACpB,OAAO,EAAQ,IAAU,UAIpB,SAAS,CAAc,CAAC,EAAkC,CAC/D,GAAI,OAAO,IAAU,SAAU,CAC7B,IAAM,EAAK,EAAQ,cAAoB,EAAQ,KAAO,EAChD,EAAO,IAAI,KAAK,CAAE,EACxB,OAAO,OAAO,MAAM,EAAK,QAAQ,CAAC,EAAI,OAAY,EAEpD,GAAI,OAAO,IAAU,SAAU,CAC7B,IAAM,EAAO,IAAI,KAAK,CAAK,EAC3B,OAAO,OAAO,MAAM,EAAK,QAAQ,CAAC,EAAI,OAAY,EAEpD,OAIK,SAAS,CAAO,CAAC,EAA6B,CACnD,OAAO,MAAM,QAAQ,CAAO,EAAI,EAAU,CAAC,CAAO,EAI7C,SAAS,CAAU,CAAC,EAOZ,CACb,IAAM,EAAoB,CACxB,SAAU,EAAM,SAChB,KAAM,EAAM,KACZ,IAAK,EAAM,GACb,EAEA,GAAI,EAAM,YAAc,OACtB,EAAM,UAAY,EAAM,UAE1B,GAAI,EAAM,YAAc,OACtB,EAAM,UAAY,EAAM,UAE1B,GAAI,EAAM,YAAc,OACtB,EAAM,UAAY,EAAM,UAG1B,OAAO",
+  "debugId": "F5B96C321D2447A964756E2164756E21",
+  "names": []
+}

package/dist/chunk-qp4y0kp2.js

@@ -0,0 +1,4 @@
+function j(b){if(b.idempotencyKey)return b.idempotencyKey;if(b.messageId)return`msg:${b.messageId}`;return}
+export{j as q};
+
+//# debugId=2D95E69BACCC221D64756E2164756E21

package/dist/chunk-qp4y0kp2.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/core/idempotency-key.ts"],
+  "sourcesContent": [
+    "import type { MailOptions } from \"./types.js\";\n\n/**\n * Resolve the idempotency key for a message.\n * Uses explicit `idempotencyKey` or derives from `messageId` when present.\n */\nexport function resolveIdempotencyKey(options: MailOptions): string | undefined {\n  if (options.idempotencyKey) {\n    return options.idempotencyKey;\n  }\n  if (options.messageId) {\n    return `msg:${options.messageId}`;\n  }\n  return undefined;\n}\n"
+  ],
+  "mappings": "AAMO,SAAS,CAAqB,CAAC,EAA0C,CAC9E,GAAI,EAAQ,eACV,OAAO,EAAQ,eAEjB,GAAI,EAAQ,UACV,MAAO,OAAO,EAAQ,YAExB",
+  "debugId": "2D95E69BACCC221D64756E2164756E21",
+  "names": []
+}

package/dist/chunk-vws105eb.js

@@ -0,0 +1,4 @@
+class y{rateDelta;rateLimit;now;static defaultNow=Date.now;tokens;lastRefill;waiters=[];constructor(h,x,j=y.defaultNow){this.rateDelta=h;this.rateLimit=x;this.now=j;this.tokens=h,this.lastRefill=j()}async acquire(){for(;;){if(this.refill(),this.tokens>0){this.tokens-=1;return}if(this.now===y.defaultNow){let h=this.now()-this.lastRefill,x=Math.max(1,this.rateLimit-h);await new Promise((j)=>setTimeout(j,x));continue}await new Promise((h)=>{this.waiters.push(h)})}}notify(){this.refill()}refill(){let x=this.now()-this.lastRefill;if(x>=this.rateLimit){let j=Math.floor(x/this.rateLimit);this.tokens=Math.min(this.rateDelta,this.tokens+j*this.rateDelta),this.lastRefill+=j*this.rateLimit;while(this.tokens>0&&this.waiters.length>0)this.tokens-=1,this.waiters.shift()?.()}}}
+export{y as A};
+
+//# debugId=FABB2451969B5F3264756E2164756E21

package/dist/chunk-vws105eb.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/core/rate-limiter.ts"],
+  "sourcesContent": [
+    "/**\n * Token bucket rate limiter with lazy refill on acquire.\n */\nexport class RateLimiter {\n  private static readonly defaultNow = Date.now;\n\n  /** Remaining tokens in the current rate-limit window. */\n  private tokens: number;\n  /** Timestamp (ms) of the last token refill. */\n  private lastRefill: number;\n  /** Resolvers waiting for a token when the bucket is empty. */\n  private waiters: Array<() => void> = [];\n\n  /** Creates a rate limiter with the given burst size and window duration. */\n  constructor(\n    private readonly rateDelta: number,\n    private readonly rateLimit: number,\n    private readonly now: () => number = RateLimiter.defaultNow,\n  ) {\n    this.tokens = rateDelta;\n    this.lastRefill = now();\n  }\n\n  /** Wait until a token is available, then consume one. */\n  async acquire(): Promise<void> {\n    for (;;) {\n      this.refill();\n      if (this.tokens > 0) {\n        this.tokens -= 1;\n        return;\n      }\n\n      if (this.now === RateLimiter.defaultNow) {\n        const elapsed = this.now() - this.lastRefill;\n        const waitMs = Math.max(1, this.rateLimit - elapsed);\n        await new Promise<void>((resolve) => setTimeout(resolve, waitMs));\n        continue;\n      }\n\n      await new Promise<void>((resolve) => {\n        this.waiters.push(resolve);\n      });\n    }\n  }\n\n  /** Wake waiters after the clock advances (for testing). */\n  notify(): void {\n    this.refill();\n  }\n\n  /** Refills tokens based on elapsed time and wakes waiting acquirers. */\n  private refill(): void {\n    const t = this.now();\n    const elapsed = t - this.lastRefill;\n    if (elapsed >= this.rateLimit) {\n      const periods = Math.floor(elapsed / this.rateLimit);\n      this.tokens = Math.min(this.rateDelta, this.tokens + periods * this.rateDelta);\n      this.lastRefill += periods * this.rateLimit;\n      while (this.tokens > 0 && this.waiters.length > 0) {\n        this.tokens -= 1;\n        const next = this.waiters.shift();\n        next?.();\n      }\n    }\n  }\n}\n"
+  ],
+  "mappings": "AAGO,MAAM,CAAY,CAYJ,UACA,UACA,UAbK,YAAa,KAAK,IAGlC,OAEA,WAEA,QAA6B,CAAC,EAGtC,WAAW,CACQ,EACA,EACA,EAAoB,EAAY,WACjD,CAHiB,iBACA,iBACA,WAEjB,KAAK,OAAS,EACd,KAAK,WAAa,EAAI,OAIlB,QAAO,EAAkB,CAC7B,OAAS,CAEP,GADA,KAAK,OAAO,EACR,KAAK,OAAS,EAAG,CACnB,KAAK,QAAU,EACf,OAGF,GAAI,KAAK,MAAQ,EAAY,WAAY,CACvC,IAAM,EAAU,KAAK,IAAI,EAAI,KAAK,WAC5B,EAAS,KAAK,IAAI,EAAG,KAAK,UAAY,CAAO,EACnD,MAAM,IAAI,QAAc,CAAC,IAAY,WAAW,EAAS,CAAM,CAAC,EAChE,SAGF,MAAM,IAAI,QAAc,CAAC,IAAY,CACnC,KAAK,QAAQ,KAAK,CAAO,EAC1B,GAKL,MAAM,EAAS,CACb,KAAK,OAAO,EAIN,MAAM,EAAS,CAErB,IAAM,EADI,KAAK,IAAI,EACC,KAAK,WACzB,GAAI,GAAW,KAAK,UAAW,CAC7B,IAAM,EAAU,KAAK,MAAM,EAAU,KAAK,SAAS,EACnD,KAAK,OAAS,KAAK,IAAI,KAAK,UAAW,KAAK,OAAS,EAAU,KAAK,SAAS,EAC7E,KAAK,YAAc,EAAU,KAAK,UAClC,MAAO,KAAK,OAAS,GAAK,KAAK,QAAQ,OAAS,EAC9C,KAAK,QAAU,EACF,KAAK,QAAQ,MAAM,IACzB,GAIf",
+  "debugId": "FABB2451969B5F3264756E2164756E21",
+  "names": []
+}

package/dist/{chunk-dgkh77yp.js → chunk-zkczgj2c.js}

@@ -1,4 +1,4 @@
-import{E as D,H as J}from"./chunk-6yggz45h.js";var Q="https://oauth2.googleapis.com/token",$="https://login.microsoftonline.com/common/oauth2/v2.0/token",V=30000;class W{config;cachedToken=null;expiresAt=0;refreshPromise=null;constructor(m){if(this.config=m,m.accessToken)this.cachedToken=m.accessToken,this.expiresAt=Date.now()+3600000}async getAccessToken(){if(this.config.getToken)return this.config.getToken();if(this.cachedToken&&Date.now()<this.expiresAt-V)return this.cachedToken;if(!this.refreshPromise)this.refreshPromise=this.refreshAccessToken().finally(()=>{this.refreshPromise=null});return this.refreshPromise}async refreshAccessToken(){if(this.config.getToken){let v=await this.config.getToken();return this.cachedToken=v,this.expiresAt=Date.now()+3600000,v}let m=this.config.tokenUrl??Q,z=new URLSearchParams({client_id:this.config.clientId,client_secret:this.config.clientSecret,refresh_token:this.config.refreshToken,grant_type:"refresh_token"}),q=await fetch(m,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:z.toString()});if(!q.ok){let v=await q.text();throw Error(`OAuth2 token refresh failed (${q.status}): ${v}`)}let C=await q.json();return this.cachedToken=C.access_token,this.expiresAt=Date.now()+C.expires_in*1000,C.access_token}async buildXOAUTH2(){let m=await this.getAccessToken(),z=`user=${this.config.user}\x01auth=Bearer ${m}\x01\x01`;return D(J(z)).replace(/\r\n/g,"")}}
-export{Q as g,$ as h,W as i};
+import{N as D,Q as J}from"./chunk-gxq2aamv.js";var Q="https://oauth2.googleapis.com/token",$="https://login.microsoftonline.com/common/oauth2/v2.0/token",V=30000;class W{config;cachedToken=null;expiresAt=0;refreshPromise=null;constructor(m){if(this.config=m,m.accessToken)this.cachedToken=m.accessToken,this.expiresAt=Date.now()+3600000}async getAccessToken(){if(this.config.getToken)return this.config.getToken();if(this.cachedToken&&Date.now()<this.expiresAt-V)return this.cachedToken;if(!this.refreshPromise)this.refreshPromise=this.refreshAccessToken().finally(()=>{this.refreshPromise=null});return this.refreshPromise}async refreshAccessToken(){if(this.config.getToken){let v=await this.config.getToken();return this.cachedToken=v,this.expiresAt=Date.now()+3600000,v}let m=this.config.tokenUrl??Q,z=new URLSearchParams({client_id:this.config.clientId,client_secret:this.config.clientSecret,refresh_token:this.config.refreshToken,grant_type:"refresh_token"}),q=await fetch(m,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:z.toString()});if(!q.ok){let v=await q.text();throw Error(`OAuth2 token refresh failed (${q.status}): ${v}`)}let C=await q.json();return this.cachedToken=C.access_token,this.expiresAt=Date.now()+C.expires_in*1000,C.access_token}async buildXOAUTH2(){let m=await this.getAccessToken(),z=`user=${this.config.user}\x01auth=Bearer ${m}\x01\x01`;return D(J(z)).replace(/\r\n/g,"")}}
+export{Q as n,$ as o,W as p};
 
-//# debugId=B98629F8950EE32E64756E2164756E21
+//# debugId=FAE5F0B424F38FDA64756E2164756E21

package/dist/{chunk-dgkh77yp.js.map → chunk-zkczgj2c.js.map}

@@ -5,6 +5,6 @@
     "/**\n * @module\n * OAuth2 / XOAUTH2 authentication for SMTP.\n * Supports Gmail, Microsoft 365, and custom OAuth2 providers.\n *\n * @example\n * ```ts\n * import { OAuth2Client } from \"sently/auth/oauth2\";\n * const client = new OAuth2Client({\n *   user: \"me@gmail.com\",\n *   clientId: \"...\",\n *   clientSecret: \"...\",\n *   refreshToken: \"...\",\n * });\n * const token = await client.getAccessToken();\n * ```\n */\nimport { encodeBase64, encodeUtf8 } from \"../core/base64.js\";\nimport type { OAuth2Config } from \"../core/types.js\";\n\n/** Default Google OAuth2 token endpoint. */\nexport const GOOGLE_TOKEN_URL = \"https://oauth2.googleapis.com/token\";\n\n/** Microsoft OAuth2 token endpoint (common tenant). */\nexport const MICROSOFT_TOKEN_URL = \"https://login.microsoftonline.com/common/oauth2/v2.0/token\";\n\n/** OAuth2 token endpoint response shape. */\nexport interface TokenResponse {\n  /** Bearer access token for API or SMTP XOAUTH2. */\n  access_token: string;\n  /** Token lifetime in seconds. */\n  expires_in: number;\n  /** Token type (typically `\"Bearer\"`). */\n  token_type: string;\n}\n\nconst EXPIRY_BUFFER_MS = 30_000;\n\n/**\n * OAuth2 client with in-memory token cache and automatic refresh.\n */\nexport class OAuth2Client {\n  /** OAuth2 configuration supplied at construction. */\n  private readonly config: OAuth2Config;\n  /** Cached access token, or null before the first fetch. */\n  private cachedToken: string | null = null;\n  /** Expiry timestamp (ms) for the cached access token. */\n  private expiresAt = 0;\n  /** In-flight refresh promise used to deduplicate concurrent refreshes. */\n  private refreshPromise: Promise<string> | null = null;\n\n  /** Creates an OAuth2 client from configuration. */\n  constructor(config: OAuth2Config) {\n    this.config = config;\n    if (config.accessToken) {\n      this.cachedToken = config.accessToken;\n      this.expiresAt = Date.now() + 3_600_000;\n    }\n  }\n\n  /**\n   * Get a valid access token (cached when still valid, refreshed otherwise).\n   */\n  async getAccessToken(): Promise<string> {\n    if (this.config.getToken) {\n      return this.config.getToken();\n    }\n\n    if (this.cachedToken && Date.now() < this.expiresAt - EXPIRY_BUFFER_MS) {\n      return this.cachedToken;\n    }\n\n    if (!this.refreshPromise) {\n      this.refreshPromise = this.refreshAccessToken().finally(() => {\n        this.refreshPromise = null;\n      });\n    }\n    return this.refreshPromise;\n  }\n\n  /**\n   * Force-refresh the access token regardless of expiry.\n   */\n  async refreshAccessToken(): Promise<string> {\n    if (this.config.getToken) {\n      const token = await this.config.getToken();\n      this.cachedToken = token;\n      this.expiresAt = Date.now() + 3_600_000;\n      return token;\n    }\n\n    const tokenUrl = this.config.tokenUrl ?? GOOGLE_TOKEN_URL;\n    const body = new URLSearchParams({\n      client_id: this.config.clientId,\n      client_secret: this.config.clientSecret,\n      refresh_token: this.config.refreshToken,\n      grant_type: \"refresh_token\",\n    });\n\n    const response = await fetch(tokenUrl, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body: body.toString(),\n    });\n\n    if (!response.ok) {\n      const text = await response.text();\n      throw new Error(`OAuth2 token refresh failed (${response.status}): ${text}`);\n    }\n\n    const data = (await response.json()) as TokenResponse;\n    this.cachedToken = data.access_token;\n    this.expiresAt = Date.now() + data.expires_in * 1000;\n    return data.access_token;\n  }\n\n  /**\n   * Build the XOAUTH2 SASL string for SMTP AUTH (base64-encoded).\n   */\n  async buildXOAUTH2(): Promise<string> {\n    const token = await this.getAccessToken();\n    const raw = `user=${this.config.user}\\x01auth=Bearer ${token}\\x01\\x01`;\n    return encodeBase64(encodeUtf8(raw)).replace(/\\r\\n/g, \"\");\n  }\n}\n"
   ],
   "mappings": "+CAqBO,IAAM,EAAmB,sCAGnB,EAAsB,6DAY7B,EAAmB,MAKlB,MAAM,CAAa,CAEP,OAET,YAA6B,KAE7B,UAAY,EAEZ,eAAyC,KAGjD,WAAW,CAAC,EAAsB,CAEhC,GADA,KAAK,OAAS,EACV,EAAO,YACT,KAAK,YAAc,EAAO,YAC1B,KAAK,UAAY,KAAK,IAAI,EAAI,aAO5B,eAAc,EAAoB,CACtC,GAAI,KAAK,OAAO,SACd,OAAO,KAAK,OAAO,SAAS,EAG9B,GAAI,KAAK,aAAe,KAAK,IAAI,EAAI,KAAK,UAAY,EACpD,OAAO,KAAK,YAGd,GAAI,CAAC,KAAK,eACR,KAAK,eAAiB,KAAK,mBAAmB,EAAE,QAAQ,IAAM,CAC5D,KAAK,eAAiB,KACvB,EAEH,OAAO,KAAK,oBAMR,mBAAkB,EAAoB,CAC1C,GAAI,KAAK,OAAO,SAAU,CACxB,IAAM,EAAQ,MAAM,KAAK,OAAO,SAAS,EAGzC,OAFA,KAAK,YAAc,EACnB,KAAK,UAAY,KAAK,IAAI,EAAI,QACvB,EAGT,IAAM,EAAW,KAAK,OAAO,UAAY,EACnC,EAAO,IAAI,gBAAgB,CAC/B,UAAW,KAAK,OAAO,SACvB,cAAe,KAAK,OAAO,aAC3B,cAAe,KAAK,OAAO,aAC3B,WAAY,eACd,CAAC,EAEK,EAAW,MAAM,MAAM,EAAU,CACrC,OAAQ,OACR,QAAS,CAAE,eAAgB,mCAAoC,EAC/D,KAAM,EAAK,SAAS,CACtB,CAAC,EAED,GAAI,CAAC,EAAS,GAAI,CAChB,IAAM,EAAO,MAAM,EAAS,KAAK,EACjC,MAAU,MAAM,gCAAgC,EAAS,YAAY,GAAM,EAG7E,IAAM,EAAQ,MAAM,EAAS,KAAK,EAGlC,OAFA,KAAK,YAAc,EAAK,aACxB,KAAK,UAAY,KAAK,IAAI,EAAI,EAAK,WAAa,KACzC,EAAK,kBAMR,aAAY,EAAoB,CACpC,IAAM,EAAQ,MAAM,KAAK,eAAe,EAClC,EAAM,QAAQ,KAAK,OAAO,uBAAuB,YACvD,OAAO,EAAa,EAAW,CAAG,CAAC,EAAE,QAAQ,QAAS,EAAE,EAE5D",
-  "debugId": "B98629F8950EE32E64756E2164756E21",
+  "debugId": "FAE5F0B424F38FDA64756E2164756E21",
   "names": []
 }

package/dist/core/idempotency-key.d.ts

@@ -0,0 +1,6 @@
+import type { MailOptions } from "./types.js";
+/**
+ * Resolve the idempotency key for a message.
+ * Uses explicit `idempotencyKey` or derives from `messageId` when present.
+ */
+export declare function resolveIdempotencyKey(options: MailOptions): string | undefined;

package/dist/core/rate-limiter.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Token bucket rate limiter with lazy refill on acquire.
+ */
+export declare class RateLimiter {
+    private readonly rateDelta;
+    private readonly rateLimit;
+    private readonly now;
+    private static readonly defaultNow;
+    /** Remaining tokens in the current rate-limit window. */
+    private tokens;
+    /** Timestamp (ms) of the last token refill. */
+    private lastRefill;
+    /** Resolvers waiting for a token when the bucket is empty. */
+    private waiters;
+    /** Creates a rate limiter with the given burst size and window duration. */
+    constructor(rateDelta: number, rateLimit: number, now?: () => number);
+    /** Wait until a token is available, then consume one. */
+    acquire(): Promise<void>;
+    /** Wake waiters after the clock advances (for testing). */
+    notify(): void;
+    /** Refills tokens based on elapsed time and wakes waiting acquirers. */
+    private refill;
+}

package/dist/core/smtp.js

@@ -1,3 +1,3 @@
-import{A as i,B as j,C as k,D as l,s as a,t as b,u as c,v as d,w as e,x as f,y as g,z as h}from"../chunk-wgtbr6ge.js";import"../chunk-6yggz45h.js";import"../chunk-sqn04kae.js";export{f as selectAuthMethod,d as parseResponse,g as parseEHLO,l as encodeLine,c as encodeCommand,j as encodeAuthLoginUser,i as encodeAuthLoginPass,k as encodeAuthCramResponse,a as computeCRAMMD5,h as assertResponse,e as accumulateResponse,b as SMTPError};
+import{B as a,C as b,D as c,E as d,F as e,G as f,H as g,I as h,J as i,K as j,L as k,M as l}from"../chunk-9p4vev6j.js";import"../chunk-gxq2aamv.js";import"../chunk-mg8m26nr.js";export{f as selectAuthMethod,d as parseResponse,g as parseEHLO,l as encodeLine,c as encodeCommand,j as encodeAuthLoginUser,i as encodeAuthLoginPass,k as encodeAuthCramResponse,a as computeCRAMMD5,h as assertResponse,e as accumulateResponse,b as SMTPError};
 
-//# debugId=00A4DDD5C9B0C55264756E2164756E21
+//# debugId=FCECF4885B1C1DCF64756E2164756E21

package/dist/core/smtp.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "00A4DDD5C9B0C55264756E2164756E21",
+  "debugId": "FCECF4885B1C1DCF64756E2164756E21",
   "names": []
 }

package/dist/core/types.d.ts

@@ -60,6 +60,16 @@ export interface MailOptions {
     template?: string;
     /** Template variables passed to the rendering engine */
     data?: Record<string, unknown>;
+    /**
+     * React element rendered to html + text by the sently/react plugin.
+     * Requires `@react-email/render`.
+     */
+    react?: unknown;
+    /**
+     * Idempotency key for deduplicating sends on retry or replay.
+     * When absent but `messageId` is set, transports derive a stable key from it.
+     */
+    idempotencyKey?: string;
 }
 /** Result returned after a message is accepted for delivery. */
 export interface SendResult {
@@ -73,6 +83,10 @@ export interface SendResult {
     response: string;
     /** SMTP envelope used for delivery. */
     envelope: Envelope;
+    /** When true, the send was skipped because an idempotency key was already recorded. */
+    deduped?: boolean;
+    /** Set when this item failed inside an otherwise successful batch HTTP response. */
+    batchError?: unknown;
 }
 /** SMTP envelope addresses (MAIL FROM / RCPT TO). */
 export interface Envelope {
@@ -122,6 +136,16 @@ export interface VerifyResult {
 export interface Transport {
     /** Send a message through this transport. */
     send(options: MailOptions): Promise<SendResult>;
+    /**
+     * Send multiple messages in one provider batch request when supported.
+     * Messages with attachments may be excluded by the mailer and sent individually.
+     */
+    sendBatch?(messages: MailOptions[]): Promise<SendResult[]>;
+    /**
+     * When set, {@link Mailer.sendBulk} splits batch sends into chunks of this size.
+     * Omit when the transport sends all messages in one HTTP request (e.g. SendGrid).
+     */
+    batchMax?: number;
     /** Test connectivity and credentials without sending mail. */
     verify?(): Promise<VerifyResult>;
     /** Release resources held by the transport. */
@@ -258,6 +282,17 @@ export interface BulkSendOptions {
     onError?: (message: MailOptions, index: number, error: unknown) => void;
     /** Max concurrent sends. Defaults to pool maxConnections or 1 */
     concurrency?: number;
+    /** When true, stop sending after the first failure. Default: false */
+    stopOnError?: boolean;
+    /**
+     * Max batch HTTP requests per rate window (e.g. Resend default 2 req/s).
+     * Set to `0` to disable batch rate limiting. Default: `2`.
+     */
+    rateDelta?: number;
+    /** Rate limit window in milliseconds. Default: `1000`. */
+    rateLimit?: number;
+    /** Injectable clock for batch rate limiting (testing). */
+    now?: () => number;
 }
 /** Result of a batch send operation. */
 export interface BulkSendResult {

package/dist/detect.js

@@ -1,3 +1,3 @@
-import{q as z,r as w}from"./chunk-2kcwa9gt.js";import{I as v}from"./chunk-sqn04kae.js";function K(){if(typeof Bun<"u")return"bun";if(typeof Deno<"u")return"deno";if(typeof caches<"u"&&globalThis.navigator?.userAgent==="Cloudflare-Workers")return"cf-workers";if(typeof window<"u")return"browser";if(typeof process<"u"&&process.versions?.node)return"node";return"unknown"}async function x(k){let h=K();switch(h){case"node":{let{NodeAdapter:q}=await import("./adapters/node.js");return new q(k)}case"bun":{let{BunAdapter:q}=await import("./adapters/bun.js");return new q(k)}case"deno":{let{DenoAdapter:q}=await import("./adapters/deno.js");return new q(k)}case"cf-workers":{let{CloudflareAdapter:q}=await import("./adapters/cf.js");return new q(k)}default:throw Error(`No socket adapter available for runtime: ${h}`)}}async function Q(k){if("transport"in k)return z({transport:k.transport,...k.plugins!==void 0?{plugins:k.plugins}:{}});let h=k,q={...h.secure!==void 0?{secure:h.secure}:{},...h.connectionTimeout!==void 0?{connectionTimeout:h.connectionTimeout}:{},...h.tls!==void 0?{tls:h.tls}:{}};if(h.pool){let{SMTPPool:J}=await import("./pool/pool.js");return new w(new J(h,{createAdapter:async()=>h.adapter??await x(q)}),h.plugins)}let E=h.adapter??await x(q),{SMTPTransport:G}=await import("./transports/smtp.js");return new w(new G({...h,adapter:E}),h.plugins)}export{K as detectRuntime,Q as createMailer,x as createDefaultAdapter};
+import{y as z,z as w}from"./chunk-9ea4hx7m.js";import"./chunk-vws105eb.js";import{R as v}from"./chunk-mg8m26nr.js";function K(){if(typeof Bun<"u")return"bun";if(typeof Deno<"u")return"deno";if(typeof caches<"u"&&globalThis.navigator?.userAgent==="Cloudflare-Workers")return"cf-workers";if(typeof window<"u")return"browser";if(typeof process<"u"&&process.versions?.node)return"node";return"unknown"}async function x(k){let h=K();switch(h){case"node":{let{NodeAdapter:q}=await import("./adapters/node.js");return new q(k)}case"bun":{let{BunAdapter:q}=await import("./adapters/bun.js");return new q(k)}case"deno":{let{DenoAdapter:q}=await import("./adapters/deno.js");return new q(k)}case"cf-workers":{let{CloudflareAdapter:q}=await import("./adapters/cf.js");return new q(k)}default:throw Error(`No socket adapter available for runtime: ${h}`)}}async function Q(k){if("transport"in k)return z({transport:k.transport,...k.plugins!==void 0?{plugins:k.plugins}:{}});let h=k,q={...h.secure!==void 0?{secure:h.secure}:{},...h.connectionTimeout!==void 0?{connectionTimeout:h.connectionTimeout}:{},...h.tls!==void 0?{tls:h.tls}:{}};if(h.pool){let{SMTPPool:J}=await import("./pool/pool.js");return new w(new J(h,{createAdapter:async()=>h.adapter??await x(q)}),h.plugins)}let E=h.adapter??await x(q),{SMTPTransport:G}=await import("./transports/smtp.js");return new w(new G({...h,adapter:E}),h.plugins)}export{K as detectRuntime,Q as createMailer,x as createDefaultAdapter};
 
-//# debugId=1210DC19744F68B364756E2164756E21
+//# debugId=E95737E930123F1064756E2164756E21

package/dist/detect.js.map

@@ -4,7 +4,7 @@
   "sourcesContent": [
     "// src/detect.ts\nimport type {\n  CreateMailerOptions,\n  Mailer,\n  Runtime,\n  SMTPConfig,\n  SocketAdapter,\n  TLSOptions,\n} from \"./core/types.js\";\nimport { createMailer as createTransportMailer, MailerImpl } from \"./mailer.js\";\n\n/** Detect the current JavaScript runtime. */\nexport function detectRuntime(): Runtime {\n  if (typeof Bun !== \"undefined\") {\n    return \"bun\";\n  }\n  if (typeof Deno !== \"undefined\") {\n    return \"deno\";\n  }\n  if (typeof caches !== \"undefined\" && globalThis.navigator?.userAgent === \"Cloudflare-Workers\") {\n    return \"cf-workers\";\n  }\n  if (typeof window !== \"undefined\") {\n    return \"browser\";\n  }\n  if (typeof process !== \"undefined\" && process.versions?.node) {\n    return \"node\";\n  }\n  return \"unknown\";\n}\n\n/**\n * Dynamically import and instantiate the correct adapter for the current runtime.\n */\nexport async function createDefaultAdapter(options?: {\n  secure?: boolean;\n  connectionTimeout?: number;\n  tls?: TLSOptions;\n}): Promise<SocketAdapter> {\n  const runtime = detectRuntime();\n\n  switch (runtime) {\n    case \"node\": {\n      const { NodeAdapter } = await import(\"./adapters/node.js\");\n      return new NodeAdapter(options);\n    }\n    case \"bun\": {\n      const { BunAdapter } = await import(\"./adapters/bun.js\");\n      return new BunAdapter(options);\n    }\n    case \"deno\": {\n      const { DenoAdapter } = await import(\"./adapters/deno.js\");\n      return new DenoAdapter(options);\n    }\n    case \"cf-workers\": {\n      const { CloudflareAdapter } = await import(\"./adapters/cf.js\");\n      return new CloudflareAdapter(options);\n    }\n    default:\n      throw new Error(`No socket adapter available for runtime: ${runtime}`);\n  }\n}\n\n/**\n * Create a ready-to-use Mailer instance.\n *\n * For HTTP transports and smallest bundles, prefer `import { createMailer } from \"sently/mailer\"`.\n */\nexport async function createMailer(options: CreateMailerOptions): Promise<Mailer> {\n  if (\"transport\" in options) {\n    return createTransportMailer({\n      transport: options.transport,\n      ...(options.plugins !== undefined ? { plugins: options.plugins } : {}),\n    });\n  }\n\n  const smtpConfig = options as SMTPConfig;\n  const adapterOptions = {\n    ...(smtpConfig.secure !== undefined ? { secure: smtpConfig.secure } : {}),\n    ...(smtpConfig.connectionTimeout !== undefined\n      ? { connectionTimeout: smtpConfig.connectionTimeout }\n      : {}),\n    ...(smtpConfig.tls !== undefined ? { tls: smtpConfig.tls } : {}),\n  };\n\n  if (smtpConfig.pool) {\n    const { SMTPPool } = await import(\"./pool/pool.js\");\n    return new MailerImpl(\n      new SMTPPool(smtpConfig, {\n        createAdapter: async () =>\n          smtpConfig.adapter ?? (await createDefaultAdapter(adapterOptions)),\n      }),\n      smtpConfig.plugins,\n    );\n  }\n\n  const adapter = smtpConfig.adapter ?? (await createDefaultAdapter(adapterOptions));\n  const { SMTPTransport } = await import(\"./transports/smtp.js\");\n\n  return new MailerImpl(new SMTPTransport({ ...smtpConfig, adapter }), smtpConfig.plugins);\n}\n\ndeclare const Bun: unknown;\ndeclare const Deno: unknown;\n"
   ],
-  "mappings": "6FAYO,GAAS,CAAa,EAAY,CACvC,GAAI,OAAO,IAAQ,IACjB,MAAO,MAET,GAAI,OAAO,KAAS,IAClB,MAAO,OAET,GAAI,OAAO,OAAW,KAAe,WAAW,WAAW,YAAc,qBACvE,MAAO,aAET,GAAI,OAAO,OAAW,IACpB,MAAO,UAET,GAAI,OAAO,QAAY,KAAe,QAAQ,UAAU,KACtD,MAAO,OAET,MAAO,UAMT,eAAsB,CAAoB,CAAC,EAIhB,CACzB,IAAM,EAAU,EAAc,EAE9B,OAAQ,OACD,OAAQ,CACX,IAAQ,eAAgB,KAAa,8BACrC,OAAO,IAAI,EAAY,CAAO,CAChC,KACK,MAAO,CACV,IAAQ,cAAe,KAAa,6BACpC,OAAO,IAAI,EAAW,CAAO,CAC/B,KACK,OAAQ,CACX,IAAQ,eAAgB,KAAa,8BACrC,OAAO,IAAI,EAAY,CAAO,CAChC,KACK,aAAc,CACjB,IAAQ,qBAAsB,KAAa,4BAC3C,OAAO,IAAI,EAAkB,CAAO,CACtC,SAEE,MAAU,MAAM,4CAA4C,GAAS,GAS3E,eAAsB,CAAY,CAAC,EAA+C,CAChF,GAAI,cAAe,EACjB,OAAO,EAAsB,CAC3B,UAAW,EAAQ,aACf,EAAQ,UAAY,OAAY,CAAE,QAAS,EAAQ,OAAQ,EAAI,CAAC,CACtE,CAAC,EAGH,IAAM,EAAa,EACb,EAAiB,IACjB,EAAW,SAAW,OAAY,CAAE,OAAQ,EAAW,MAAO,EAAI,CAAC,KACnE,EAAW,oBAAsB,OACjC,CAAE,kBAAmB,EAAW,iBAAkB,EAClD,CAAC,KACD,EAAW,MAAQ,OAAY,CAAE,IAAK,EAAW,GAAI,EAAI,CAAC,CAChE,EAEA,GAAI,EAAW,KAAM,CACnB,IAAQ,YAAa,KAAa,0BAClC,OAAO,IAAI,EACT,IAAI,EAAS,EAAY,CACvB,cAAe,SACb,EAAW,SAAY,MAAM,EAAqB,CAAc,CACpE,CAAC,EACD,EAAW,OACb,EAGF,IAAM,EAAU,EAAW,SAAY,MAAM,EAAqB,CAAc,GACxE,iBAAkB,KAAa,gCAEvC,OAAO,IAAI,EAAW,IAAI,EAAc,IAAK,EAAY,SAAQ,CAAC,EAAG,EAAW,OAAO",
-  "debugId": "1210DC19744F68B364756E2164756E21",
+  "mappings": "+HAYO,GAAS,LAAa,EAAY,CACvC,GAAI,OAAO,IAAQ,IACjB,MAAO,MAET,GAAI,OAAO,KAAS,IAClB,MAAO,OAET,GAAI,OAAO,OAAW,KAAe,WAAW,WAAW,YAAc,qBACvE,MAAO,aAET,GAAI,OAAO,OAAW,IACpB,MAAO,UAET,GAAI,OAAO,QAAY,KAAe,QAAQ,UAAU,KACtD,MAAO,OAET,MAAO,UAMT,eAAsB,CAAoB,CAAC,EAIhB,CACzB,IAAM,EAAU,EAAc,EAE9B,OAAQ,OACD,OAAQ,CACX,IAAQ,eAAgB,KAAa,8BACrC,OAAO,IAAI,EAAY,CAAO,CAChC,KACK,MAAO,CACV,IAAQ,cAAe,KAAa,6BACpC,OAAO,IAAI,EAAW,CAAO,CAC/B,KACK,OAAQ,CACX,IAAQ,eAAgB,KAAa,8BACrC,OAAO,IAAI,EAAY,CAAO,CAChC,KACK,aAAc,CACjB,IAAQ,qBAAsB,KAAa,4BAC3C,OAAO,IAAI,EAAkB,CAAO,CACtC,SAEE,MAAU,MAAM,4CAA4C,GAAS,GAS3E,eAAsB,CAAY,CAAC,EAA+C,CAChF,GAAI,cAAe,EACjB,OAAO,EAAsB,CAC3B,UAAW,EAAQ,aACf,EAAQ,UAAY,OAAY,CAAE,QAAS,EAAQ,OAAQ,EAAI,CAAC,CACtE,CAAC,EAGH,IAAM,EAAa,EACb,EAAiB,IACjB,EAAW,SAAW,OAAY,CAAE,OAAQ,EAAW,MAAO,EAAI,CAAC,KACnE,EAAW,oBAAsB,OACjC,CAAE,kBAAmB,EAAW,iBAAkB,EAClD,CAAC,KACD,EAAW,MAAQ,OAAY,CAAE,IAAK,EAAW,GAAI,EAAI,CAAC,CAChE,EAEA,GAAI,EAAW,KAAM,CACnB,IAAQ,YAAa,KAAa,0BAClC,OAAO,IAAI,EACT,IAAI,EAAS,EAAY,CACvB,cAAe,SACb,EAAW,SAAY,MAAM,EAAqB,CAAc,CACpE,CAAC,EACD,EAAW,OACb,EAGF,IAAM,EAAU,EAAW,SAAY,MAAM,EAAqB,CAAc,GACxE,iBAAkB,KAAa,gCAEvC,OAAO,IAAI,EAAW,IAAI,EAAc,IAAK,EAAY,SAAQ,CAAC,EAAG,EAAW,OAAO",
+  "debugId": "E95737E930123F1064756E2164756E21",
   "names": []
 }

package/dist/dkim.js

@@ -1,4 +1,4 @@
-import{E as G,H as E}from"./chunk-6yggz45h.js";import"./chunk-sqn04kae.js";var j=`\r
+import{N as G,Q as E}from"./chunk-gxq2aamv.js";import"./chunk-mg8m26nr.js";var j=`\r
 `,C="from:to:subject:date:message-id:mime-version:content-type";function _(M,I){let x=F(M),K=[];for(let S of I){let Y=S.toLowerCase().trim(),z=x.get(Y);if(!z)continue;for(let D of z){let w=D.replace(/\r?\n/g,"").replace(/\s+/g," ").trim();K.push(`${Y}:${w}`)}}return K.length>0?`${K.join(j)}${j}`:""}function $(M){let x=M.replace(/\r\n/g,`
 `).replace(/\r/g,`
 `).split(`
@@ -6,4 +6,4 @@ import{E as G,H as E}from"./chunk-6yggz45h.js";import"./chunk-sqn04kae.js";var j
 \r
 `),w=D>=0?z.slice(0,D):z,P=D>=0?z.slice(D+4):"",T=$(P),O=await k(E(T)),Q=x==="ed25519-sha256"?"ed25519-sha256":"rsa-sha256",X=Y.join(":"),Z=Math.floor(Date.now()/1000),W=["v=1",`a=${Q}`,"c=relaxed/relaxed",`d=${I.domainName}`,`s=${I.keySelector}`,`h=${X}`,`bh=${O}`,"b=",`t=${Z}`].join("; "),b="dkim-signature",H=`${w}${j}dkim-signature:${W}`,p=_(H,[...Y,"dkim-signature"]),A=await v(I.privateKey,x),R=E(p),U=await L(A,R,x),V=G(U).replace(/\r\n/g,"");return{header:`DKIM-Signature: v=1; a=${Q}; c=relaxed/relaxed; d=${I.domainName}; s=${I.keySelector}; h=${X}; bh=${O}; b=${V}; t=${Z}`}}function F(M){let I=new Map,x=M.split(/\r?\n/).filter((z)=>z.length>0),K="",S="",Y=()=>{if(!K)return;let z=K.toLowerCase(),D=I.get(z)??[];D.push(S),I.set(z,D),K="",S=""};for(let z of x){if(/^[ \t]/.test(z)&&K){S+=` ${z.trim()}`;continue}Y();let D=z.indexOf(":");if(D>0)K=z.slice(0,D).trim(),S=z.slice(D+1).trim()}return Y(),I}function B(M){let I=M.replace(/-----BEGIN[^-]+-----/g,"").replace(/-----END[^-]+-----/g,"").replace(/\s/g,""),x=atob(I),K=new Uint8Array(x.length);for(let S=0;S<x.length;S++)K[S]=x.charCodeAt(S);return K}function J(M){return M.buffer.slice(M.byteOffset,M.byteOffset+M.byteLength)}async function k(M){let I=await crypto.subtle.digest("SHA-256",J(M));return G(new Uint8Array(I)).replace(/\r\n/g,"")}async function L(M,I,x){let K=J(I);if(x==="ed25519-sha256"){let Y=await crypto.subtle.sign("Ed25519",M,K);return new Uint8Array(Y)}let S=await crypto.subtle.sign({name:"RSASSA-PKCS1-v1_5"},M,K);return new Uint8Array(S)}export{N as signDKIM,v as importPrivateKey,_ as canonicalizeHeadersRelaxed,$ as canonicalizeBodyRelaxed};
 
-//# debugId=6C34EDE3095573A464756E2164756E21
+//# debugId=C154E3241728AA9864756E2164756E21

package/dist/dkim.js.map

@@ -5,6 +5,6 @@
     "/**\n * DKIM signing implementation (RFC 6376). Public entry: `sently/dkim`.\n */\nimport { encodeBase64, encodeUtf8 } from \"./base64.js\";\nimport type { DKIMConfig } from \"./types.js\";\n\nconst CRLF = \"\\r\\n\";\nconst DEFAULT_HEADER_FIELDS = \"from:to:subject:date:message-id:mime-version:content-type\";\n\n/** Result of DKIM signing — the header line to prepend. */\nexport interface DKIMSignResult {\n  /** Complete DKIM-Signature header line (without trailing CRLF). */\n  header: string;\n}\n\n/**\n * Canonicalize headers using the relaxed algorithm (RFC 6376 §3.4.2).\n */\nexport function canonicalizeHeadersRelaxed(headers: string, fieldNames: string[]): string {\n  const parsed = parseHeaders(headers);\n  const lines: string[] = [];\n\n  for (const name of fieldNames) {\n    const key = name.toLowerCase().trim();\n    const values = parsed.get(key);\n    if (!values) {\n      continue;\n    }\n    for (const value of values) {\n      const unfolded = value.replace(/\\r?\\n/g, \"\").replace(/\\s+/g, \" \").trim();\n      lines.push(`${key}:${unfolded}`);\n    }\n  }\n\n  return lines.length > 0 ? `${lines.join(CRLF)}${CRLF}` : \"\";\n}\n\n/**\n * Canonicalize body using the relaxed algorithm (RFC 6376 §3.4.4).\n */\nexport function canonicalizeBodyRelaxed(body: string): string {\n  const normalized = body.replace(/\\r\\n/g, \"\\n\").replace(/\\r/g, \"\\n\");\n  const lines = normalized\n    .split(\"\\n\")\n    .map((line) => line.replace(/[ \\t]+$/g, \"\").replace(/[ \\t]+/g, \" \"))\n    .filter((line) => line.length > 0);\n  if (lines.length === 0) {\n    return CRLF;\n  }\n  return `${lines.join(CRLF)}${CRLF}`;\n}\n\n/**\n * Import a PEM-encoded private key into a Web Crypto CryptoKey.\n */\nexport async function importPrivateKey(\n  pem: string,\n  algorithm: \"rsa-sha256\" | \"ed25519-sha256\",\n): Promise<CryptoKey> {\n  if (algorithm === \"ed25519-sha256\" && /OPENSSH PRIVATE KEY/i.test(pem)) {\n    throw new Error(\n      \"Ed25519 keys must be in PKCS#8 PEM format (-----BEGIN PRIVATE KEY-----). Convert with: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key_pkcs8.pem\",\n    );\n  }\n\n  const der = pemToDer(pem);\n\n  const derBuffer = toArrayBuffer(der);\n\n  try {\n    if (algorithm === \"ed25519-sha256\") {\n      return await crypto.subtle.importKey(\"pkcs8\", derBuffer, { name: \"Ed25519\" }, false, [\n        \"sign\",\n      ]);\n    }\n    return await crypto.subtle.importKey(\n      \"pkcs8\",\n      derBuffer,\n      { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\n      false,\n      [\"sign\"],\n    );\n  } catch (err) {\n    if (algorithm === \"ed25519-sha256\" && err instanceof DOMException) {\n      throw new Error(\"Ed25519 DKIM requires Node.js ≥ 18.4, Bun ≥ 1.0, or Cloudflare Workers\", {\n        cause: err,\n      });\n    }\n    throw err;\n  }\n}\n\n/**\n * Sign a raw MIME message with DKIM.\n */\nexport async function signDKIM(\n  rawMessage: Uint8Array,\n  config: DKIMConfig,\n): Promise<DKIMSignResult> {\n  const algorithm = config.algorithm ?? \"rsa-sha256\";\n  const fieldList = (config.headerFieldNames ?? DEFAULT_HEADER_FIELDS)\n    .split(\":\")\n    .map((f) => f.trim().toLowerCase())\n    .filter(Boolean);\n  const skip = new Set(\n    (config.skipFields ?? \"\")\n      .split(\":\")\n      .map((f) => f.trim().toLowerCase())\n      .filter(Boolean),\n  );\n  const signFields = fieldList.filter((f) => !skip.has(f));\n\n  const text = new TextDecoder().decode(rawMessage);\n  const sep = text.indexOf(\"\\r\\n\\r\\n\");\n  const headerPart = sep >= 0 ? text.slice(0, sep) : text;\n  const bodyPart = sep >= 0 ? text.slice(sep + 4) : \"\";\n\n  const bodyCanonical = canonicalizeBodyRelaxed(bodyPart);\n  const bodyHash = await sha256Base64(encodeUtf8(bodyCanonical));\n\n  const dkimAlgo = algorithm === \"ed25519-sha256\" ? \"ed25519-sha256\" : \"rsa-sha256\";\n  const headerList = signFields.join(\":\");\n  const timestamp = Math.floor(Date.now() / 1000);\n\n  const dkimWithoutSig = [\n    `v=1`,\n    `a=${dkimAlgo}`,\n    `c=relaxed/relaxed`,\n    `d=${config.domainName}`,\n    `s=${config.keySelector}`,\n    `h=${headerList}`,\n    `bh=${bodyHash}`,\n    `b=`,\n    `t=${timestamp}`,\n  ].join(\"; \");\n\n  const dkimHeaderName = \"dkim-signature\";\n  const dkimHeaderValue = dkimWithoutSig;\n  const headersWithDkim = `${headerPart}${CRLF}${dkimHeaderName}:${dkimHeaderValue}`;\n  const canonical = canonicalizeHeadersRelaxed(headersWithDkim, [...signFields, dkimHeaderName]);\n\n  const key = await importPrivateKey(config.privateKey, algorithm);\n  const data = encodeUtf8(canonical);\n  const signature = await signData(key, data, algorithm);\n  const bValue = encodeBase64(signature).replace(/\\r\\n/g, \"\");\n\n  const header = `DKIM-Signature: v=1; a=${dkimAlgo}; c=relaxed/relaxed; d=${config.domainName}; s=${config.keySelector}; h=${headerList}; bh=${bodyHash}; b=${bValue}; t=${timestamp}`;\n\n  return { header };\n}\n\nfunction parseHeaders(headerBlock: string): Map<string, string[]> {\n  const map = new Map<string, string[]>();\n  const lines = headerBlock.split(/\\r?\\n/).filter((l) => l.length > 0);\n  let currentName = \"\";\n  let currentValue = \"\";\n\n  const flush = (): void => {\n    if (!currentName) {\n      return;\n    }\n    const key = currentName.toLowerCase();\n    const list = map.get(key) ?? [];\n    list.push(currentValue);\n    map.set(key, list);\n    currentName = \"\";\n    currentValue = \"\";\n  };\n\n  for (const line of lines) {\n    if (/^[ \\t]/.test(line) && currentName) {\n      currentValue += ` ${line.trim()}`;\n      continue;\n    }\n    flush();\n    const colon = line.indexOf(\":\");\n    if (colon > 0) {\n      currentName = line.slice(0, colon).trim();\n      currentValue = line.slice(colon + 1).trim();\n    }\n  }\n  flush();\n  return map;\n}\n\nfunction pemToDer(pem: string): Uint8Array {\n  const lines = pem\n    .replace(/-----BEGIN[^-]+-----/g, \"\")\n    .replace(/-----END[^-]+-----/g, \"\")\n    .replace(/\\s/g, \"\");\n  const binary = atob(lines);\n  const der = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i++) {\n    der[i] = binary.charCodeAt(i);\n  }\n  return der;\n}\n\nfunction toArrayBuffer(bytes: Uint8Array): ArrayBuffer {\n  return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength) as ArrayBuffer;\n}\n\nasync function sha256Base64(data: Uint8Array): Promise<string> {\n  const hash = await crypto.subtle.digest(\"SHA-256\", toArrayBuffer(data));\n  return encodeBase64(new Uint8Array(hash)).replace(/\\r\\n/g, \"\");\n}\n\nasync function signData(\n  key: CryptoKey,\n  data: Uint8Array,\n  algorithm: \"rsa-sha256\" | \"ed25519-sha256\",\n): Promise<Uint8Array> {\n  const buf = toArrayBuffer(data);\n  if (algorithm === \"ed25519-sha256\") {\n    const sig = await crypto.subtle.sign(\"Ed25519\", key, buf);\n    return new Uint8Array(sig);\n  }\n  const sig = await crypto.subtle.sign({ name: \"RSASSA-PKCS1-v1_5\" }, key, buf);\n  return new Uint8Array(sig);\n}\n"
   ],
   "mappings": "iFAMA,FAAM,EAAO;AAAA,EACP,EAAwB,4DAWvB,SAAS,CAA0B,CAAC,EAAiB,EAA8B,CACxF,IAAM,EAAS,EAAa,CAAO,EAC7B,EAAkB,CAAC,EAEzB,QAAW,KAAQ,EAAY,CAC7B,IAAM,EAAM,EAAK,YAAY,EAAE,KAAK,EAC9B,EAAS,EAAO,IAAI,CAAG,EAC7B,GAAI,CAAC,EACH,SAEF,QAAW,KAAS,EAAQ,CAC1B,IAAM,EAAW,EAAM,QAAQ,SAAU,EAAE,EAAE,QAAQ,OAAQ,GAAG,EAAE,KAAK,EACvE,EAAM,KAAK,GAAG,KAAO,GAAU,GAInC,OAAO,EAAM,OAAS,EAAI,GAAG,EAAM,KAAK,CAAI,IAAI,IAAS,GAMpD,SAAS,CAAuB,CAAC,EAAsB,CAE5D,IAAM,EADa,EAAK,QAAQ,QAAS;AAAA,CAAI,EAAE,QAAQ,MAAO;AAAA,CAAI,EAE/D,MAAM;AAAA,CAAI,EACV,IAAI,CAAC,IAAS,EAAK,QAAQ,WAAY,EAAE,EAAE,QAAQ,UAAW,GAAG,CAAC,EAClE,OAAO,CAAC,IAAS,EAAK,OAAS,CAAC,EACnC,GAAI,EAAM,SAAW,EACnB,OAAO,EAET,MAAO,GAAG,EAAM,KAAK,CAAI,IAAI,IAM/B,eAAsB,CAAgB,CACpC,EACA,EACoB,CACpB,GAAI,IAAc,kBAAoB,uBAAuB,KAAK,CAAG,EACnE,MAAU,MACR,qJACF,EAGF,IAAM,EAAM,EAAS,CAAG,EAElB,EAAY,EAAc,CAAG,EAEnC,GAAI,CACF,GAAI,IAAc,iBAChB,OAAO,MAAM,OAAO,OAAO,UAAU,QAAS,EAAW,CAAE,KAAM,SAAU,EAAG,GAAO,CACnF,MACF,CAAC,EAEH,OAAO,MAAM,OAAO,OAAO,UACzB,QACA,EACA,CAAE,KAAM,oBAAqB,KAAM,SAAU,EAC7C,GACA,CAAC,MAAM,CACT,EACA,MAAO,EAAK,CACZ,GAAI,IAAc,kBAAoB,aAAe,aACnD,MAAU,MAAM,yEAAyE,CACvF,MAAO,CACT,CAAC,EAEH,MAAM,GAOV,eAAsB,CAAQ,CAC5B,EACA,EACyB,CACzB,IAAM,EAAY,EAAO,WAAa,aAChC,GAAa,EAAO,kBAAoB,GAC3C,MAAM,GAAG,EACT,IAAI,CAAC,IAAM,EAAE,KAAK,EAAE,YAAY,CAAC,EACjC,OAAO,OAAO,EACX,EAAO,IAAI,KACd,EAAO,YAAc,IACnB,MAAM,GAAG,EACT,IAAI,CAAC,IAAM,EAAE,KAAK,EAAE,YAAY,CAAC,EACjC,OAAO,OAAO,CACnB,EACM,EAAa,EAAU,OAAO,CAAC,IAAM,CAAC,EAAK,IAAI,CAAC,CAAC,EAEjD,EAAO,IAAI,YAAY,EAAE,OAAO,CAAU,EAC1C,EAAM,EAAK,QAAQ;AAAA;AAAA,CAAU,EAC7B,EAAa,GAAO,EAAI,EAAK,MAAM,EAAG,CAAG,EAAI,EAC7C,EAAW,GAAO,EAAI,EAAK,MAAM,EAAM,CAAC,EAAI,GAE5C,EAAgB,EAAwB,CAAQ,EAChD,EAAW,MAAM,EAAa,EAAW,CAAa,CAAC,EAEvD,EAAW,IAAc,iBAAmB,iBAAmB,aAC/D,EAAa,EAAW,KAAK,GAAG,EAChC,EAAY,KAAK,MAAM,KAAK,IAAI,EAAI,IAAI,EAExC,EAAiB,CACrB,MACA,KAAK,IACL,oBACA,KAAK,EAAO,aACZ,KAAK,EAAO,cACZ,KAAK,IACL,MAAM,IACN,KACA,KAAK,GACP,EAAE,KAAK,IAAI,EAEL,EAAiB,iBAEjB,EAAkB,GAAG,IAAa,mBADhB,IAElB,EAAY,EAA2B,EAAiB,CAAC,GAAG,EAH3C,gBAGqE,CAAC,EAEvF,EAAM,MAAM,EAAiB,EAAO,WAAY,CAAS,EACzD,EAAO,EAAW,CAAS,EAC3B,EAAY,MAAM,EAAS,EAAK,EAAM,CAAS,EAC/C,EAAS,EAAa,CAAS,EAAE,QAAQ,QAAS,EAAE,EAI1D,MAAO,CAAE,OAFM,0BAA0B,2BAAkC,EAAO,iBAAiB,EAAO,kBAAkB,SAAkB,QAAe,QAAa,GAE1J,EAGlB,SAAS,CAAY,CAAC,EAA4C,CAChE,IAAM,EAAM,IAAI,IACV,EAAQ,EAAY,MAAM,OAAO,EAAE,OAAO,CAAC,IAAM,EAAE,OAAS,CAAC,EAC/D,EAAc,GACd,EAAe,GAEb,EAAQ,IAAY,CACxB,GAAI,CAAC,EACH,OAEF,IAAM,EAAM,EAAY,YAAY,EAC9B,EAAO,EAAI,IAAI,CAAG,GAAK,CAAC,EAC9B,EAAK,KAAK,CAAY,EACtB,EAAI,IAAI,EAAK,CAAI,EACjB,EAAc,GACd,EAAe,IAGjB,QAAW,KAAQ,EAAO,CACxB,GAAI,SAAS,KAAK,CAAI,GAAK,EAAa,CACtC,GAAgB,IAAI,EAAK,KAAK,IAC9B,SAEF,EAAM,EACN,IAAM,EAAQ,EAAK,QAAQ,GAAG,EAC9B,GAAI,EAAQ,EACV,EAAc,EAAK,MAAM,EAAG,CAAK,EAAE,KAAK,EACxC,EAAe,EAAK,MAAM,EAAQ,CAAC,EAAE,KAAK,EAI9C,OADA,EAAM,EACC,EAGT,SAAS,CAAQ,CAAC,EAAyB,CACzC,IAAM,EAAQ,EACX,QAAQ,wBAAyB,EAAE,EACnC,QAAQ,sBAAuB,EAAE,EACjC,QAAQ,MAAO,EAAE,EACd,EAAS,KAAK,CAAK,EACnB,EAAM,IAAI,WAAW,EAAO,MAAM,EACxC,QAAS,EAAI,EAAG,EAAI,EAAO,OAAQ,IACjC,EAAI,GAAK,EAAO,WAAW,CAAC,EAE9B,OAAO,EAGT,SAAS,CAAa,CAAC,EAAgC,CACrD,OAAO,EAAM,OAAO,MAAM,EAAM,WAAY,EAAM,WAAa,EAAM,UAAU,EAGjF,eAAe,CAAY,CAAC,EAAmC,CAC7D,IAAM,EAAO,MAAM,OAAO,OAAO,OAAO,UAAW,EAAc,CAAI,CAAC,EACtE,OAAO,EAAa,IAAI,WAAW,CAAI,CAAC,EAAE,QAAQ,QAAS,EAAE,EAG/D,eAAe,CAAQ,CACrB,EACA,EACA,EACqB,CACrB,IAAM,EAAM,EAAc,CAAI,EAC9B,GAAI,IAAc,iBAAkB,CAClC,IAAM,EAAM,MAAM,OAAO,OAAO,KAAK,UAAW,EAAK,CAAG,EACxD,OAAO,IAAI,WAAW,CAAG,EAE3B,IAAM,EAAM,MAAM,OAAO,OAAO,KAAK,CAAE,KAAM,mBAAoB,EAAG,EAAK,CAAG,EAC5E,OAAO,IAAI,WAAW,CAAG",
-  "debugId": "6C34EDE3095573A464756E2164756E21",
+  "debugId": "C154E3241728AA9864756E2164756E21",
   "names": []
 }

package/dist/idempotency.d.ts

@@ -0,0 +1,46 @@
+import type { MailOptions, SendResult, Transport, VerifyResult } from "./core/types.js";
+/** Key-value store for idempotency deduplication. */
+export interface IdempotencyStore {
+    /** Returns true when the key was already recorded. */
+    has(key: string): Promise<boolean>;
+    /** Record a key, optionally expiring after `ttlMs` milliseconds. */
+    set(key: string, ttlMs?: number): Promise<void>;
+}
+/** In-memory idempotency store with optional TTL expiry. Suitable for single-process use. */
+export declare class MemoryIdempotencyStore implements IdempotencyStore {
+    private readonly entries;
+    /** Returns true when the key exists and has not expired. */
+    has(key: string): Promise<boolean>;
+    /** Record a key with optional TTL in milliseconds. */
+    set(key: string, ttlMs?: number): Promise<void>;
+}
+/** Options for {@link IdempotencyTransport}. */
+export interface IdempotencyTransportOptions {
+    /** Store used to track sent keys. Defaults to {@link MemoryIdempotencyStore}. */
+    store?: IdempotencyStore;
+    /** TTL in milliseconds for recorded keys. Default: 24 hours. */
+    ttlMs?: number;
+}
+/**
+ * Transport decorator that skips duplicate sends when an idempotency key
+ * was already recorded. Checks the store once before delegating to the inner
+ * transport, so retries inside RetryTransport reuse the same key automatically.
+ */
+export declare class IdempotencyTransport implements Transport {
+    /** Transport that performs the actual send when the key is new. */
+    private readonly inner;
+    private readonly store;
+    private readonly ttlMs;
+    /** Wraps an inner transport with idempotency deduplication. */
+    constructor(
+    /** Transport that performs the actual send when the key is new. */
+    inner: Transport, options?: IdempotencyTransportOptions);
+    /** Sends once per idempotency key; returns a synthetic result on duplicate keys. */
+    send(options: MailOptions): Promise<SendResult>;
+    /** Delegates batch sends to the inner transport when available. */
+    sendBatch(messages: MailOptions[]): Promise<SendResult[]>;
+    /** Delegates to the inner transport verify or returns a default success result. */
+    verify(): Promise<VerifyResult>;
+    /** Delegates close to the inner transport if available. */
+    close(): Promise<void>;
+}