sently 0.8.0 → 0.9.0

package/dist/{chunk-8phpsns1.js.map → chunk-n0qeyzqm.js.map}

@@ -5,7 +5,7 @@
     "/**\n * @module\n * Pure-JS HMAC-MD5 implementation for SMTP CRAM-MD5 authentication.\n * Web Crypto does not support MD5, so this is implemented in pure TypeScript\n * with no external dependencies.\n *\n * @example\n * ```ts\n * import { computeCRAMMD5 } from \"sently/core/cram-md5\";\n * const response = await computeCRAMMD5(\"<challenge>\", \"user\", \"pass\");\n * ```\n */\nimport { decodeBase64, encodeBase64, encodeUtf8 } from \"./base64.js\";\n\n/** MD5 block size in bytes (HMAC block size per RFC 2104). */\nconst BLOCK_SIZE = 64;\n\n/** Coerce to unsigned 32-bit integer. */\nfunction u32(x: number): number {\n  return x >>> 0;\n}\n\n/**\n * Compute an MD5 hash of the given data (RFC 1321).\n */\nexport function md5(data: Uint8Array): Uint8Array {\n  const padded = padMessage(data);\n\n  let a0 = 0x67452301;\n  let b0 = 0xefcdab89;\n  let c0 = 0x98badcfe;\n  let d0 = 0x10325476;\n\n  for (let i = 0; i < padded.length; i += 64) {\n    const block = padded.subarray(i, i + 64);\n    const m = new Uint32Array(16);\n    for (let j = 0; j < 16; j++) {\n      const o = j * 4;\n      m[j] = u32(\n        (block[o] ?? 0) |\n          ((block[o + 1] ?? 0) << 8) |\n          ((block[o + 2] ?? 0) << 16) |\n          ((block[o + 3] ?? 0) << 24),\n      );\n    }\n\n    let a = a0;\n    let b = b0;\n    let c = c0;\n    let d = d0;\n\n    for (let k = 0; k < 64; k++) {\n      let f: number;\n      let g: number;\n      if (k < 16) {\n        f = u32((b & c) | (~b & d));\n        g = k;\n      } else if (k < 32) {\n        f = u32((b & d) | (c & ~d));\n        g = u32((5 * k + 1) % 16);\n      } else if (k < 48) {\n        f = u32(b ^ c ^ d);\n        g = u32((3 * k + 5) % 16);\n      } else {\n        f = u32(c ^ (b | ~d));\n        g = u32((7 * k) % 16);\n      }\n\n      const temp = d;\n      d = c;\n      c = b;\n      b = u32(b + leftRotate(u32(a + f + u32((K[k] ?? 0) + (m[g] ?? 0))), S[k] ?? 0));\n      a = temp;\n    }\n\n    a0 = u32(a0 + a);\n    b0 = u32(b0 + b);\n    c0 = u32(c0 + c);\n    d0 = u32(d0 + d);\n  }\n\n  const out = new Uint8Array(16);\n  const view = new DataView(out.buffer);\n  view.setUint32(0, a0, true);\n  view.setUint32(4, b0, true);\n  view.setUint32(8, c0, true);\n  view.setUint32(12, d0, true);\n  return out;\n}\n\nconst S = [\n  7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14,\n  20, 5, 9, 14, 20, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 6, 10, 15, 21, 6,\n  10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21,\n];\n\nconst K = new Uint32Array([\n  0xd76aa478, 0xe8c7b756, 0x242070db, 0xc1bdceee, 0xf57c0faf, 0x4787c62a, 0xa8304613, 0xfd469501,\n  0x698098d8, 0x8b44f7af, 0xffff5bb1, 0x895cd7be, 0x6b901122, 0xfd987193, 0xa679438e, 0x49b40821,\n  0xf61e2562, 0xc040b340, 0x265e5a51, 0xe9b6c7aa, 0xd62f105d, 0x02441453, 0xd8a1e681, 0xe7d3fbc8,\n  0x21e1cde6, 0xc33707d6, 0xf4d50d87, 0x455a14ed, 0xa9e3e905, 0xfcefa3f8, 0x676f02d9, 0x8d2a4c8a,\n  0xfffa3942, 0x8771f681, 0x6d9d6122, 0xfde5380c, 0xa4beea44, 0x4bdecfa9, 0xf6bb4b60, 0xbebfbc70,\n  0x289b7ec6, 0xeaa127fa, 0xd4ef3085, 0x04881d05, 0xd9d4d039, 0xe6db99e5, 0x1fa27cf8, 0xc4ac5665,\n  0xf4292244, 0x432aff97, 0xab9423a7, 0xfc93a039, 0x655b59c3, 0x8f0ccc92, 0xffeff47d, 0x85845dd1,\n  0x6fa87e4f, 0xfe2ce6e0, 0xa3014314, 0x4e0811a1, 0xf7537e82, 0xbd3af235, 0x2ad7d2bb, 0xeb86d391,\n]);\n\nfunction leftRotate(value: number, shift: number): number {\n  return u32((value << shift) | (value >>> (32 - shift)));\n}\n\nfunction padMessage(data: Uint8Array): Uint8Array {\n  const bitLen = data.length * 8;\n  const padLen = (56 - ((data.length + 1) % 64) + 64) % 64;\n  const totalLen = data.length + 1 + padLen + 8;\n  const padded = new Uint8Array(totalLen);\n  padded.set(data);\n  padded[data.length] = 0x80;\n\n  const view = new DataView(padded.buffer);\n  view.setUint32(totalLen - 8, bitLen >>> 0, true);\n  view.setUint32(totalLen - 4, Math.floor(bitLen / 0x100000000), true);\n  return padded;\n}\n\n/**\n * Compute HMAC-MD5(key, data) per RFC 2104.\n */\nexport function hmacMD5(key: Uint8Array, data: Uint8Array): Uint8Array {\n  let k = key;\n  if (k.length > BLOCK_SIZE) {\n    k = md5(k);\n  }\n  const paddedKey = new Uint8Array(BLOCK_SIZE);\n  paddedKey.set(k);\n\n  const ipad = new Uint8Array(BLOCK_SIZE);\n  const opad = new Uint8Array(BLOCK_SIZE);\n  for (let i = 0; i < BLOCK_SIZE; i++) {\n    ipad[i] = (paddedKey[i] ?? 0) ^ 0x36;\n    opad[i] = (paddedKey[i] ?? 0) ^ 0x5c;\n  }\n\n  const inner = new Uint8Array(ipad.length + data.length);\n  inner.set(ipad);\n  inner.set(data, ipad.length);\n  const innerHash = md5(inner);\n\n  const outer = new Uint8Array(opad.length + innerHash.length);\n  outer.set(opad);\n  outer.set(innerHash, opad.length);\n  return md5(outer);\n}\n\nfunction bytesToHex(bytes: Uint8Array): string {\n  return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/**\n * Compute the CRAM-MD5 response string for SMTP authentication.\n *\n * @param challenge - base64-encoded challenge from server\n * @param user - SMTP username\n * @param pass - SMTP password\n * @returns base64-encoded CRAM-MD5 response\n */\nexport async function computeCRAMMD5(\n  challenge: string,\n  user: string,\n  pass: string,\n): Promise<string> {\n  const challengeBytes = decodeBase64(challenge.trim());\n  const passBytes = encodeUtf8(pass);\n  const digest = hmacMD5(passBytes, challengeBytes);\n  const hex = bytesToHex(digest);\n  return encodeBase64(`${user} ${hex}`).replace(/\\r\\n/g, \"\");\n}\n",
     "// src/core/smtp.ts\nimport { encodeBase64, encodeUtf8 } from \"./base64.js\";\nimport { SentlyError, smtpCodeToSentlyCode } from \"./errors.js\";\n\nexport { computeCRAMMD5 } from \"./cram-md5.js\";\n\n/** SMTP command to send to the server. */\nexport type SMTPCommand =\n  | { type: \"EHLO\"; domain: string }\n  | { type: \"STARTTLS\" }\n  | { type: \"AUTH_LOGIN\"; user: string; pass: string }\n  | { type: \"AUTH_PLAIN\"; user: string; pass: string }\n  | { type: \"AUTH_CRAM_MD5_INIT\" }\n  | { type: \"AUTH_CRAM_MD5_RESPONSE\"; response: string }\n  | { type: \"AUTH_XOAUTH2\"; xoauth2String: string }\n  | { type: \"MAIL_FROM\"; address: string }\n  | { type: \"RCPT_TO\"; address: string }\n  | { type: \"DATA\" }\n  | { type: \"DATA_BODY\"; content: Uint8Array }\n  | { type: \"QUIT\" }\n  | { type: \"RSET\" }\n  | { type: \"NOOP\" };\n\n/** Parsed SMTP server response. */\nexport interface SMTPResponse {\n  /** Three-digit SMTP status code. */\n  code: number;\n  /** Human-readable response text after the status code. */\n  message: string;\n  /** True when the code is in the 2xx success range. */\n  isSuccess: boolean;\n  /** True when the code is 354 (ready for message data). */\n  isReady: boolean;\n  /** True when the code is 4xx or 5xx. */\n  isError: boolean;\n}\n\n/** SMTP protocol error with server response details. */\nexport class SMTPError extends SentlyError {\n  /** Creates an SMTP protocol error. */\n  constructor(\n    message: string,\n    smtpCode: number,\n    public readonly command: string,\n    public readonly response: string,\n  ) {\n    super(message, smtpCodeToSentlyCode(smtpCode, command), { provider: \"smtp\" });\n    this.name = \"SMTPError\";\n    this.code = smtpCode;\n  }\n}\n\n/**\n * Encode an SMTPCommand into a Uint8Array for sending over the socket.\n */\nexport function encodeCommand(cmd: SMTPCommand): Uint8Array {\n  let line: string;\n\n  switch (cmd.type) {\n    case \"EHLO\": {\n      const safeDomain = cmd.domain.replace(/[\\r\\n]/g, \"\");\n      line = `EHLO ${safeDomain}`;\n      break;\n    }\n    case \"STARTTLS\":\n      line = \"STARTTLS\";\n      break;\n    case \"AUTH_LOGIN\":\n      line = \"AUTH LOGIN\";\n      break;\n    case \"AUTH_PLAIN\":\n      line = `AUTH PLAIN ${encodeBase64(`\\0${cmd.user}\\0${cmd.pass}`).replace(/\\r\\n/g, \"\")}`;\n      break;\n    case \"AUTH_CRAM_MD5_INIT\":\n      line = \"AUTH CRAM-MD5\";\n      break;\n    case \"AUTH_CRAM_MD5_RESPONSE\":\n      return encodeUtf8(`${cmd.response}\\r\\n`);\n    case \"AUTH_XOAUTH2\":\n      line = `AUTH XOAUTH2 ${cmd.xoauth2String}`;\n      break;\n    case \"MAIL_FROM\":\n      if (/[\\r\\n]/.test(cmd.address)) {\n        throw new SMTPError(`Invalid address: contains CRLF`, 0, \"MAIL FROM\", cmd.address);\n      }\n      line = `MAIL FROM:<${cmd.address}>`;\n      break;\n    case \"RCPT_TO\":\n      if (/[\\r\\n]/.test(cmd.address)) {\n        throw new SMTPError(`Invalid address: contains CRLF`, 0, \"RCPT TO\", cmd.address);\n      }\n      line = `RCPT TO:<${cmd.address}>`;\n      break;\n    case \"DATA\":\n      line = \"DATA\";\n      break;\n    case \"DATA_BODY\":\n      return encodeUtf8(applyDotStuffing(cmd.content));\n    case \"QUIT\":\n      line = \"QUIT\";\n      break;\n    case \"RSET\":\n      line = \"RSET\";\n      break;\n    case \"NOOP\":\n      line = \"NOOP\";\n      break;\n  }\n\n  return encodeUtf8(`${line}\\r\\n`);\n}\n\n/**\n * Parse raw bytes from the server into an SMTPResponse.\n */\nexport function parseResponse(data: Uint8Array): SMTPResponse {\n  const text = new TextDecoder().decode(data).trim();\n  const lines = text.split(/\\r?\\n/);\n  const lastLine = lines[lines.length - 1] ?? \"\";\n  const match = lastLine.match(/^(\\d{3})([\\s-])(.*)$/);\n\n  if (!match) {\n    throw new SMTPError(\"Invalid SMTP response\", 0, \"PARSE\", text);\n  }\n\n  const code = Number.parseInt(match[1] ?? \"0\", 10);\n  const message = lines.map((l) => l.replace(/^\\d{3}[\\s-]/, \"\")).join(\" \");\n\n  return {\n    code,\n    message,\n    isSuccess: code >= 200 && code < 300,\n    isReady: code >= 300 && code < 400,\n    isError: code >= 400,\n  };\n}\n\n/**\n * Accumulate byte chunks until a complete SMTP response is received.\n */\nexport function accumulateResponse(chunks: Uint8Array[]): Uint8Array | null {\n  if (chunks.length === 0) {\n    return null;\n  }\n\n  const total = chunks.reduce((sum, c) => sum + c.length, 0);\n  const combined = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    combined.set(chunk, offset);\n    offset += chunk.length;\n  }\n\n  const text = new TextDecoder().decode(combined);\n  const lines = text.split(/\\r?\\n/).filter((l) => l.length > 0);\n\n  if (lines.length === 0) {\n    return null;\n  }\n\n  const lastLine = lines[lines.length - 1] ?? \"\";\n  if (/^\\d{3} /.test(lastLine)) {\n    return combined;\n  }\n\n  return null;\n}\n\n/**\n * Select the best AUTH method from EHLO capability lines.\n * Priority: XOAUTH2 > CRAM-MD5 > LOGIN > PLAIN.\n */\nexport function selectAuthMethod(\n  capabilities: string[],\n): \"LOGIN\" | \"PLAIN\" | \"CRAM-MD5\" | \"OAUTH2\" {\n  const upper = capabilities.map((c) => c.toUpperCase());\n  if (upper.some((c) => c.includes(\"AUTH\") && c.includes(\"XOAUTH2\"))) {\n    return \"OAUTH2\";\n  }\n  if (upper.some((c) => c.includes(\"AUTH\") && c.includes(\"CRAM-MD5\"))) {\n    return \"CRAM-MD5\";\n  }\n  if (upper.some((c) => c.includes(\"AUTH\") && c.includes(\"LOGIN\"))) {\n    return \"LOGIN\";\n  }\n  if (upper.some((c) => c.includes(\"AUTH\") && c.includes(\"PLAIN\"))) {\n    return \"PLAIN\";\n  }\n  throw new SMTPError(\"No supported AUTH method\", 0, \"EHLO\", capabilities.join(\" \"));\n}\n\n/**\n * Parse an EHLO multi-line response and extract capability keywords.\n */\nexport function parseEHLO(response: SMTPResponse): string[] {\n  return response.message\n    .split(/\\s+/)\n    .flatMap((part) => part.split(/\\r?\\n/))\n    .filter(Boolean);\n}\n\n/**\n * Assert that an SMTPResponse code is within the expected set.\n */\nexport function assertResponse(\n  response: SMTPResponse,\n  expectedCodes: number[],\n  command: string,\n): void {\n  if (!expectedCodes.includes(response.code)) {\n    throw new SMTPError(\n      `Unexpected SMTP response for ${command}`,\n      response.code,\n      command,\n      response.message,\n    );\n  }\n}\n\nfunction applyDotStuffing(content: Uint8Array): string {\n  const text = new TextDecoder().decode(content);\n  const lines = text.split(/\\r?\\n/);\n  const stuffed = lines.map((line) => (line.startsWith(\".\") ? `.${line}` : line));\n  return `${stuffed.join(\"\\r\\n\")}\\r\\n.\\r\\n`;\n}\n\n/** Encode AUTH LOGIN password step (second base64 chunk). */\nexport function encodeAuthLoginPass(pass: string): Uint8Array {\n  return encodeUtf8(`${encodeBase64(pass).replace(/\\r\\n/g, \"\")}\\r\\n`);\n}\n\n/** Encode AUTH LOGIN user step when sent separately after 334. */\nexport function encodeAuthLoginUser(user: string): Uint8Array {\n  return encodeUtf8(`${encodeBase64(user).replace(/\\r\\n/g, \"\")}\\r\\n`);\n}\n\n/** Encode CRAM-MD5 response after challenge. */\nexport function encodeAuthCramResponse(response: string): Uint8Array {\n  return encodeUtf8(`${response}\\r\\n`);\n}\n\n/** Encode raw SMTP line with CRLF. */\nexport function encodeLine(line: string): Uint8Array {\n  return encodeUtf8(`${line}\\r\\n`);\n}\n"
   ],
-  "mappings": "2GAeA,FAAM,EAAa,GAGnB,SAAS,CAAG,CAAC,EAAmB,CAC9B,OAAO,IAAM,EAMR,SAAS,CAAG,CAAC,EAA8B,CAChD,IAAM,EAAS,EAAW,CAAI,EAE1B,EAAK,WACL,EAAK,WACL,EAAK,WACL,EAAK,UAET,QAAS,EAAI,EAAG,EAAI,EAAO,OAAQ,GAAK,GAAI,CAC1C,IAAM,EAAQ,EAAO,SAAS,EAAG,EAAI,EAAE,EACjC,EAAI,IAAI,YAAY,EAAE,EAC5B,QAAS,EAAI,EAAG,EAAI,GAAI,IAAK,CAC3B,IAAM,EAAI,EAAI,EACd,EAAE,GAAK,GACJ,EAAM,IAAM,IACT,EAAM,EAAI,IAAM,IAAM,GACtB,EAAM,EAAI,IAAM,IAAM,IACtB,EAAM,EAAI,IAAM,IAAM,EAC5B,EAGF,IAAI,EAAI,EACJ,EAAI,EACJ,EAAI,EACJ,EAAI,EAER,QAAS,EAAI,EAAG,EAAI,GAAI,IAAK,CAC3B,IAAI,EACA,EACJ,GAAI,EAAI,GACN,EAAI,EAAK,EAAI,EAAM,CAAC,EAAI,CAAE,EAC1B,EAAI,EACC,QAAI,EAAI,GACb,EAAI,EAAK,EAAI,EAAM,EAAI,CAAC,CAAE,EAC1B,EAAI,GAAK,EAAI,EAAI,GAAK,EAAE,EACnB,QAAI,EAAI,GACb,EAAI,EAAI,EAAI,EAAI,CAAC,EACjB,EAAI,GAAK,EAAI,EAAI,GAAK,EAAE,EAExB,OAAI,EAAI,GAAK,EAAI,CAAC,EAAE,EACpB,EAAI,EAAK,EAAI,EAAK,EAAE,EAGtB,IAAM,EAAO,EACb,EAAI,EACJ,EAAI,EACJ,EAAI,EAAI,EAAI,EAAW,EAAI,EAAI,EAAI,GAAK,EAAE,IAAM,IAAM,EAAE,IAAM,EAAE,CAAC,EAAG,EAAE,IAAM,CAAC,CAAC,EAC9E,EAAI,EAGN,EAAK,EAAI,EAAK,CAAC,EACf,EAAK,EAAI,EAAK,CAAC,EACf,EAAK,EAAI,EAAK,CAAC,EACf,EAAK,EAAI,EAAK,CAAC,EAGjB,IAAM,EAAM,IAAI,WAAW,EAAE,EACvB,EAAO,IAAI,SAAS,EAAI,MAAM,EAKpC,OAJA,EAAK,UAAU,EAAG,EAAI,EAAI,EAC1B,EAAK,UAAU,EAAG,EAAI,EAAI,EAC1B,EAAK,UAAU,EAAG,EAAI,EAAI,EAC1B,EAAK,UAAU,GAAI,EAAI,EAAI,EACpB,EAGT,IAAM,EAAI,CACR,EAAG,GAAI,GAAI,GAAI,EAAG,GAAI,GAAI,GAAI,EAAG,GAAI,GAAI,GAAI,EAAG,GAAI,GAAI,GAAI,EAAG,EAAG,GAAI,GAAI,EAAG,EAAG,GAAI,GAAI,EAAG,EAAG,GAC9F,GAAI,EAAG,EAAG,GAAI,GAAI,EAAG,GAAI,GAAI,GAAI,EAAG,GAAI,GAAI,GAAI,EAAG,GAAI,GAAI,GAAI,EAAG,GAAI,GAAI,GAAI,EAAG,GAAI,GAAI,GAAI,EAC7F,GAAI,GAAI,GAAI,EAAG,GAAI,GAAI,GAAI,EAAG,GAAI,GAAI,EACxC,EAEM,EAAI,IAAI,YAAY,CACxB,WAAY,WAAY,UAAY,WAAY,WAAY,WAAY,WAAY,WACpF,WAAY,WAAY,WAAY,WAAY,WAAY,WAAY,WAAY,WACpF,WAAY,WAAY,UAAY,WAAY,WAAY,SAAY,WAAY,WACpF,UAAY,WAAY,WAAY,WAAY,WAAY,WAAY,WAAY,WACpF,WAAY,WAAY,WAAY,WAAY,WAAY,WAAY,WAAY,WACpF,UAAY,WAAY,WAAY,SAAY,WAAY,WAAY,UAAY,WACpF,WAAY,WAAY,WAAY,WAAY,WAAY,WAAY,WAAY,WACpF,WAAY,WAAY,WAAY,WAAY,WAAY,WAAY,UAAY,UACtF,CAAC,EAED,SAAS,CAAU,CAAC,EAAe,EAAuB,CACxD,OAAO,EAAK,GAAS,EAAU,IAAW,GAAK,CAAO,EAGxD,SAAS,CAAU,CAAC,EAA8B,CAChD,IAAM,EAAS,EAAK,OAAS,EACvB,GAAU,IAAO,EAAK,OAAS,GAAK,GAAM,IAAM,GAChD,EAAW,EAAK,OAAS,EAAI,EAAS,EACtC,EAAS,IAAI,WAAW,CAAQ,EACtC,EAAO,IAAI,CAAI,EACf,EAAO,EAAK,QAAU,IAEtB,IAAM,EAAO,IAAI,SAAS,EAAO,MAAM,EAGvC,OAFA,EAAK,UAAU,EAAW,EAAG,IAAW,EAAG,EAAI,EAC/C,EAAK,UAAU,EAAW,EAAG,KAAK,MAAM,EAAS,UAAW,EAAG,EAAI,EAC5D,EAMF,SAAS,CAAO,CAAC,EAAiB,EAA8B,CACrE,IAAI,EAAI,EACR,GAAI,EAAE,OAAS,EACb,EAAI,EAAI,CAAC,EAEX,IAAM,EAAY,IAAI,WAAW,CAAU,EAC3C,EAAU,IAAI,CAAC,EAEf,IAAM,EAAO,IAAI,WAAW,CAAU,EAChC,EAAO,IAAI,WAAW,CAAU,EACtC,QAAS,EAAI,EAAG,EAAI,EAAY,IAC9B,EAAK,IAAM,EAAU,IAAM,GAAK,GAChC,EAAK,IAAM,EAAU,IAAM,GAAK,GAGlC,IAAM,EAAQ,IAAI,WAAW,EAAK,OAAS,EAAK,MAAM,EACtD,EAAM,IAAI,CAAI,EACd,EAAM,IAAI,EAAM,EAAK,MAAM,EAC3B,IAAM,EAAY,EAAI,CAAK,EAErB,EAAQ,IAAI,WAAW,EAAK,OAAS,EAAU,MAAM,EAG3D,OAFA,EAAM,IAAI,CAAI,EACd,EAAM,IAAI,EAAW,EAAK,MAAM,EACzB,EAAI,CAAK,EAGlB,SAAS,CAAU,CAAC,EAA2B,CAC7C,OAAO,MAAM,KAAK,EAAO,CAAC,IAAM,EAAE,SAAS,EAAE,EAAE,SAAS,EAAG,GAAG,CAAC,EAAE,KAAK,EAAE,EAW1E,eAAsB,CAAc,CAClC,EACA,EACA,EACiB,CACjB,IAAM,EAAiB,EAAa,EAAU,KAAK,CAAC,EAC9C,EAAY,EAAW,CAAI,EAC3B,EAAS,EAAQ,EAAW,CAAc,EAC1C,EAAM,EAAW,CAAM,EAC7B,OAAO,EAAa,GAAG,KAAQ,GAAK,EAAE,QAAQ,QAAS,EAAE,ECzIpD,MAAM,UAAkB,CAAY,CAKvB,QACA,SAJlB,WAAW,CACT,EACA,EACgB,EACA,EAChB,CACA,MAAM,EAAS,EAAqB,EAAU,CAAO,EAAG,CAAE,SAAU,MAAO,CAAC,EAH5D,eACA,gBAGhB,KAAK,KAAO,YACZ,KAAK,KAAO,EAEhB,CAKO,SAAS,CAAa,CAAC,EAA8B,CAC1D,IAAI,EAEJ,OAAQ,EAAI,UACL,OAAQ,CAEX,EAAO,QADY,EAAI,OAAO,QAAQ,UAAW,EAAE,IAEnD,KACF,KACK,WACH,EAAO,WACP,UACG,aACH,EAAO,aACP,UACG,aACH,EAAO,cAAc,EAAa,OAAK,EAAI,WAAS,EAAI,MAAM,EAAE,QAAQ,QAAS,EAAE,IACnF,UACG,qBACH,EAAO,gBACP,UACG,yBACH,OAAO,EAAW,GAAG,EAAI;AAAA,CAAc,MACpC,eACH,EAAO,gBAAgB,EAAI,gBAC3B,UACG,YACH,GAAI,SAAS,KAAK,EAAI,OAAO,EAC3B,MAAM,IAAI,EAAU,iCAAkC,EAAG,YAAa,EAAI,OAAO,EAEnF,EAAO,cAAc,EAAI,WACzB,UACG,UACH,GAAI,SAAS,KAAK,EAAI,OAAO,EAC3B,MAAM,IAAI,EAAU,iCAAkC,EAAG,UAAW,EAAI,OAAO,EAEjF,EAAO,YAAY,EAAI,WACvB,UACG,OACH,EAAO,OACP,UACG,YACH,OAAO,EAAW,EAAiB,EAAI,OAAO,CAAC,MAC5C,OACH,EAAO,OACP,UACG,OACH,EAAO,OACP,UACG,OACH,EAAO,OACP,MAGJ,OAAO,EAAW,GAAG;AAAA,CAAU,EAM1B,SAAS,CAAa,CAAC,EAAgC,CAC5D,IAAM,EAAO,IAAI,YAAY,EAAE,OAAO,CAAI,EAAE,KAAK,EAC3C,EAAQ,EAAK,MAAM,OAAO,EAE1B,GADW,EAAM,EAAM,OAAS,IAAM,IACrB,MAAM,sBAAsB,EAEnD,GAAI,CAAC,EACH,MAAM,IAAI,EAAU,wBAAyB,EAAG,QAAS,CAAI,EAG/D,IAAM,EAAO,OAAO,SAAS,EAAM,IAAM,IAAK,EAAE,EAC1C,EAAU,EAAM,IAAI,CAAC,IAAM,EAAE,QAAQ,cAAe,EAAE,CAAC,EAAE,KAAK,GAAG,EAEvE,MAAO,CACL,OACA,UACA,UAAW,GAAQ,KAAO,EAAO,IACjC,QAAS,GAAQ,KAAO,EAAO,IAC/B,QAAS,GAAQ,GACnB,EAMK,SAAS,CAAkB,CAAC,EAAyC,CAC1E,GAAI,EAAO,SAAW,EACpB,OAAO,KAGT,IAAM,EAAQ,EAAO,OAAO,CAAC,EAAK,IAAM,EAAM,EAAE,OAAQ,CAAC,EACnD,EAAW,IAAI,WAAW,CAAK,EACjC,EAAS,EACb,QAAW,KAAS,EAClB,EAAS,IAAI,EAAO,CAAM,EAC1B,GAAU,EAAM,OAIlB,IAAM,EADO,IAAI,YAAY,EAAE,OAAO,CAAQ,EAC3B,MAAM,OAAO,EAAE,OAAO,CAAC,IAAM,EAAE,OAAS,CAAC,EAE5D,GAAI,EAAM,SAAW,EACnB,OAAO,KAGT,IAAM,EAAW,EAAM,EAAM,OAAS,IAAM,GAC5C,GAAI,UAAU,KAAK,CAAQ,EACzB,OAAO,EAGT,OAAO,KAOF,SAAS,CAAgB,CAC9B,EAC2C,CAC3C,IAAM,EAAQ,EAAa,IAAI,CAAC,IAAM,EAAE,YAAY,CAAC,EACrD,GAAI,EAAM,KAAK,CAAC,IAAM,EAAE,SAAS,MAAM,GAAK,EAAE,SAAS,SAAS,CAAC,EAC/D,MAAO,SAET,GAAI,EAAM,KAAK,CAAC,IAAM,EAAE,SAAS,MAAM,GAAK,EAAE,SAAS,UAAU,CAAC,EAChE,MAAO,WAET,GAAI,EAAM,KAAK,CAAC,IAAM,EAAE,SAAS,MAAM,GAAK,EAAE,SAAS,OAAO,CAAC,EAC7D,MAAO,QAET,GAAI,EAAM,KAAK,CAAC,IAAM,EAAE,SAAS,MAAM,GAAK,EAAE,SAAS,OAAO,CAAC,EAC7D,MAAO,QAET,MAAM,IAAI,EAAU,2BAA4B,EAAG,OAAQ,EAAa,KAAK,GAAG,CAAC,EAM5E,SAAS,CAAS,CAAC,EAAkC,CAC1D,OAAO,EAAS,QACb,MAAM,KAAK,EACX,QAAQ,CAAC,IAAS,EAAK,MAAM,OAAO,CAAC,EACrC,OAAO,OAAO,EAMZ,SAAS,CAAc,CAC5B,EACA,EACA,EACM,CACN,GAAI,CAAC,EAAc,SAAS,EAAS,IAAI,EACvC,MAAM,IAAI,EACR,gCAAgC,IAChC,EAAS,KACT,EACA,EAAS,OACX,EAIJ,SAAS,CAAgB,CAAC,EAA6B,CAIrD,MAAO,GAHM,IAAI,YAAY,EAAE,OAAO,CAAO,EAC1B,MAAM,OAAO,EACV,IAAI,CAAC,IAAU,EAAK,WAAW,GAAG,EAAI,IAAI,IAAS,CAAK,EAC5D,KAAK;AAAA,CAAM;AAAA;AAAA,EAIxB,SAAS,CAAmB,CAAC,EAA0B,CAC5D,OAAO,EAAW,GAAG,EAAa,CAAI,EAAE,QAAQ,QAAS,EAAE;AAAA,CAAO,EAI7D,SAAS,CAAmB,CAAC,EAA0B,CAC5D,OAAO,EAAW,GAAG,EAAa,CAAI,EAAE,QAAQ,QAAS,EAAE;AAAA,CAAO,EAI7D,SAAS,CAAsB,CAAC,EAA8B,CACnE,OAAO,EAAW,GAAG;AAAA,CAAc,EAI9B,SAAS,CAAU,CAAC,EAA0B,CACnD,OAAO,EAAW,GAAG;AAAA,CAAU",
-  "debugId": "B24DD712C817A87F64756E2164756E21",
+  "mappings": "8GAeA,FAAM,EAAa,GAGnB,SAAS,CAAG,CAAC,EAAmB,CAC9B,OAAO,IAAM,EAMR,SAAS,CAAG,CAAC,EAA8B,CAChD,IAAM,EAAS,EAAW,CAAI,EAE1B,EAAK,WACL,EAAK,WACL,EAAK,WACL,EAAK,UAET,QAAS,EAAI,EAAG,EAAI,EAAO,OAAQ,GAAK,GAAI,CAC1C,IAAM,EAAQ,EAAO,SAAS,EAAG,EAAI,EAAE,EACjC,EAAI,IAAI,YAAY,EAAE,EAC5B,QAAS,EAAI,EAAG,EAAI,GAAI,IAAK,CAC3B,IAAM,EAAI,EAAI,EACd,EAAE,GAAK,GACJ,EAAM,IAAM,IACT,EAAM,EAAI,IAAM,IAAM,GACtB,EAAM,EAAI,IAAM,IAAM,IACtB,EAAM,EAAI,IAAM,IAAM,EAC5B,EAGF,IAAI,EAAI,EACJ,EAAI,EACJ,EAAI,EACJ,EAAI,EAER,QAAS,EAAI,EAAG,EAAI,GAAI,IAAK,CAC3B,IAAI,EACA,EACJ,GAAI,EAAI,GACN,EAAI,EAAK,EAAI,EAAM,CAAC,EAAI,CAAE,EAC1B,EAAI,EACC,QAAI,EAAI,GACb,EAAI,EAAK,EAAI,EAAM,EAAI,CAAC,CAAE,EAC1B,EAAI,GAAK,EAAI,EAAI,GAAK,EAAE,EACnB,QAAI,EAAI,GACb,EAAI,EAAI,EAAI,EAAI,CAAC,EACjB,EAAI,GAAK,EAAI,EAAI,GAAK,EAAE,EAExB,OAAI,EAAI,GAAK,EAAI,CAAC,EAAE,EACpB,EAAI,EAAK,EAAI,EAAK,EAAE,EAGtB,IAAM,EAAO,EACb,EAAI,EACJ,EAAI,EACJ,EAAI,EAAI,EAAI,EAAW,EAAI,EAAI,EAAI,GAAK,EAAE,IAAM,IAAM,EAAE,IAAM,EAAE,CAAC,EAAG,EAAE,IAAM,CAAC,CAAC,EAC9E,EAAI,EAGN,EAAK,EAAI,EAAK,CAAC,EACf,EAAK,EAAI,EAAK,CAAC,EACf,EAAK,EAAI,EAAK,CAAC,EACf,EAAK,EAAI,EAAK,CAAC,EAGjB,IAAM,EAAM,IAAI,WAAW,EAAE,EACvB,EAAO,IAAI,SAAS,EAAI,MAAM,EAKpC,OAJA,EAAK,UAAU,EAAG,EAAI,EAAI,EAC1B,EAAK,UAAU,EAAG,EAAI,EAAI,EAC1B,EAAK,UAAU,EAAG,EAAI,EAAI,EAC1B,EAAK,UAAU,GAAI,EAAI,EAAI,EACpB,EAGT,IAAM,EAAI,CACR,EAAG,GAAI,GAAI,GAAI,EAAG,GAAI,GAAI,GAAI,EAAG,GAAI,GAAI,GAAI,EAAG,GAAI,GAAI,GAAI,EAAG,EAAG,GAAI,GAAI,EAAG,EAAG,GAAI,GAAI,EAAG,EAAG,GAC9F,GAAI,EAAG,EAAG,GAAI,GAAI,EAAG,GAAI,GAAI,GAAI,EAAG,GAAI,GAAI,GAAI,EAAG,GAAI,GAAI,GAAI,EAAG,GAAI,GAAI,GAAI,EAAG,GAAI,GAAI,GAAI,EAC7F,GAAI,GAAI,GAAI,EAAG,GAAI,GAAI,GAAI,EAAG,GAAI,GAAI,EACxC,EAEM,EAAI,IAAI,YAAY,CACxB,WAAY,WAAY,UAAY,WAAY,WAAY,WAAY,WAAY,WACpF,WAAY,WAAY,WAAY,WAAY,WAAY,WAAY,WAAY,WACpF,WAAY,WAAY,UAAY,WAAY,WAAY,SAAY,WAAY,WACpF,UAAY,WAAY,WAAY,WAAY,WAAY,WAAY,WAAY,WACpF,WAAY,WAAY,WAAY,WAAY,WAAY,WAAY,WAAY,WACpF,UAAY,WAAY,WAAY,SAAY,WAAY,WAAY,UAAY,WACpF,WAAY,WAAY,WAAY,WAAY,WAAY,WAAY,WAAY,WACpF,WAAY,WAAY,WAAY,WAAY,WAAY,WAAY,UAAY,UACtF,CAAC,EAED,SAAS,CAAU,CAAC,EAAe,EAAuB,CACxD,OAAO,EAAK,GAAS,EAAU,IAAW,GAAK,CAAO,EAGxD,SAAS,CAAU,CAAC,EAA8B,CAChD,IAAM,EAAS,EAAK,OAAS,EACvB,GAAU,IAAO,EAAK,OAAS,GAAK,GAAM,IAAM,GAChD,EAAW,EAAK,OAAS,EAAI,EAAS,EACtC,EAAS,IAAI,WAAW,CAAQ,EACtC,EAAO,IAAI,CAAI,EACf,EAAO,EAAK,QAAU,IAEtB,IAAM,EAAO,IAAI,SAAS,EAAO,MAAM,EAGvC,OAFA,EAAK,UAAU,EAAW,EAAG,IAAW,EAAG,EAAI,EAC/C,EAAK,UAAU,EAAW,EAAG,KAAK,MAAM,EAAS,UAAW,EAAG,EAAI,EAC5D,EAMF,SAAS,CAAO,CAAC,EAAiB,EAA8B,CACrE,IAAI,EAAI,EACR,GAAI,EAAE,OAAS,EACb,EAAI,EAAI,CAAC,EAEX,IAAM,EAAY,IAAI,WAAW,CAAU,EAC3C,EAAU,IAAI,CAAC,EAEf,IAAM,EAAO,IAAI,WAAW,CAAU,EAChC,EAAO,IAAI,WAAW,CAAU,EACtC,QAAS,EAAI,EAAG,EAAI,EAAY,IAC9B,EAAK,IAAM,EAAU,IAAM,GAAK,GAChC,EAAK,IAAM,EAAU,IAAM,GAAK,GAGlC,IAAM,EAAQ,IAAI,WAAW,EAAK,OAAS,EAAK,MAAM,EACtD,EAAM,IAAI,CAAI,EACd,EAAM,IAAI,EAAM,EAAK,MAAM,EAC3B,IAAM,EAAY,EAAI,CAAK,EAErB,EAAQ,IAAI,WAAW,EAAK,OAAS,EAAU,MAAM,EAG3D,OAFA,EAAM,IAAI,CAAI,EACd,EAAM,IAAI,EAAW,EAAK,MAAM,EACzB,EAAI,CAAK,EAGlB,SAAS,CAAU,CAAC,EAA2B,CAC7C,OAAO,MAAM,KAAK,EAAO,CAAC,IAAM,EAAE,SAAS,EAAE,EAAE,SAAS,EAAG,GAAG,CAAC,EAAE,KAAK,EAAE,EAW1E,eAAsB,CAAc,CAClC,EACA,EACA,EACiB,CACjB,IAAM,EAAiB,EAAa,EAAU,KAAK,CAAC,EAC9C,EAAY,EAAW,CAAI,EAC3B,EAAS,EAAQ,EAAW,CAAc,EAC1C,EAAM,EAAW,CAAM,EAC7B,OAAO,EAAa,GAAG,KAAQ,GAAK,EAAE,QAAQ,QAAS,EAAE,ECzIpD,MAAM,UAAkB,CAAY,CAKvB,QACA,SAJlB,WAAW,CACT,EACA,EACgB,EACA,EAChB,CACA,MAAM,EAAS,EAAqB,EAAU,CAAO,EAAG,CAAE,SAAU,MAAO,CAAC,EAH5D,eACA,gBAGhB,KAAK,KAAO,YACZ,KAAK,KAAO,EAEhB,CAKO,SAAS,CAAa,CAAC,EAA8B,CAC1D,IAAI,EAEJ,OAAQ,EAAI,UACL,OAAQ,CAEX,EAAO,QADY,EAAI,OAAO,QAAQ,UAAW,EAAE,IAEnD,KACF,KACK,WACH,EAAO,WACP,UACG,aACH,EAAO,aACP,UACG,aACH,EAAO,cAAc,EAAa,OAAK,EAAI,WAAS,EAAI,MAAM,EAAE,QAAQ,QAAS,EAAE,IACnF,UACG,qBACH,EAAO,gBACP,UACG,yBACH,OAAO,EAAW,GAAG,EAAI;AAAA,CAAc,MACpC,eACH,EAAO,gBAAgB,EAAI,gBAC3B,UACG,YACH,GAAI,SAAS,KAAK,EAAI,OAAO,EAC3B,MAAM,IAAI,EAAU,iCAAkC,EAAG,YAAa,EAAI,OAAO,EAEnF,EAAO,cAAc,EAAI,WACzB,UACG,UACH,GAAI,SAAS,KAAK,EAAI,OAAO,EAC3B,MAAM,IAAI,EAAU,iCAAkC,EAAG,UAAW,EAAI,OAAO,EAEjF,EAAO,YAAY,EAAI,WACvB,UACG,OACH,EAAO,OACP,UACG,YACH,OAAO,EAAW,EAAiB,EAAI,OAAO,CAAC,MAC5C,OACH,EAAO,OACP,UACG,OACH,EAAO,OACP,UACG,OACH,EAAO,OACP,MAGJ,OAAO,EAAW,GAAG;AAAA,CAAU,EAM1B,SAAS,CAAa,CAAC,EAAgC,CAC5D,IAAM,EAAO,IAAI,YAAY,EAAE,OAAO,CAAI,EAAE,KAAK,EAC3C,EAAQ,EAAK,MAAM,OAAO,EAE1B,GADW,EAAM,EAAM,OAAS,IAAM,IACrB,MAAM,sBAAsB,EAEnD,GAAI,CAAC,EACH,MAAM,IAAI,EAAU,wBAAyB,EAAG,QAAS,CAAI,EAG/D,IAAM,EAAO,OAAO,SAAS,EAAM,IAAM,IAAK,EAAE,EAC1C,EAAU,EAAM,IAAI,CAAC,IAAM,EAAE,QAAQ,cAAe,EAAE,CAAC,EAAE,KAAK,GAAG,EAEvE,MAAO,CACL,OACA,UACA,UAAW,GAAQ,KAAO,EAAO,IACjC,QAAS,GAAQ,KAAO,EAAO,IAC/B,QAAS,GAAQ,GACnB,EAMK,SAAS,CAAkB,CAAC,EAAyC,CAC1E,GAAI,EAAO,SAAW,EACpB,OAAO,KAGT,IAAM,EAAQ,EAAO,OAAO,CAAC,EAAK,IAAM,EAAM,EAAE,OAAQ,CAAC,EACnD,EAAW,IAAI,WAAW,CAAK,EACjC,EAAS,EACb,QAAW,KAAS,EAClB,EAAS,IAAI,EAAO,CAAM,EAC1B,GAAU,EAAM,OAIlB,IAAM,EADO,IAAI,YAAY,EAAE,OAAO,CAAQ,EAC3B,MAAM,OAAO,EAAE,OAAO,CAAC,IAAM,EAAE,OAAS,CAAC,EAE5D,GAAI,EAAM,SAAW,EACnB,OAAO,KAGT,IAAM,EAAW,EAAM,EAAM,OAAS,IAAM,GAC5C,GAAI,UAAU,KAAK,CAAQ,EACzB,OAAO,EAGT,OAAO,KAOF,SAAS,CAAgB,CAC9B,EAC2C,CAC3C,IAAM,EAAQ,EAAa,IAAI,CAAC,IAAM,EAAE,YAAY,CAAC,EACrD,GAAI,EAAM,KAAK,CAAC,IAAM,EAAE,SAAS,MAAM,GAAK,EAAE,SAAS,SAAS,CAAC,EAC/D,MAAO,SAET,GAAI,EAAM,KAAK,CAAC,IAAM,EAAE,SAAS,MAAM,GAAK,EAAE,SAAS,UAAU,CAAC,EAChE,MAAO,WAET,GAAI,EAAM,KAAK,CAAC,IAAM,EAAE,SAAS,MAAM,GAAK,EAAE,SAAS,OAAO,CAAC,EAC7D,MAAO,QAET,GAAI,EAAM,KAAK,CAAC,IAAM,EAAE,SAAS,MAAM,GAAK,EAAE,SAAS,OAAO,CAAC,EAC7D,MAAO,QAET,MAAM,IAAI,EAAU,2BAA4B,EAAG,OAAQ,EAAa,KAAK,GAAG,CAAC,EAM5E,SAAS,CAAS,CAAC,EAAkC,CAC1D,OAAO,EAAS,QACb,MAAM,KAAK,EACX,QAAQ,CAAC,IAAS,EAAK,MAAM,OAAO,CAAC,EACrC,OAAO,OAAO,EAMZ,SAAS,CAAc,CAC5B,EACA,EACA,EACM,CACN,GAAI,CAAC,EAAc,SAAS,EAAS,IAAI,EACvC,MAAM,IAAI,EACR,gCAAgC,IAChC,EAAS,KACT,EACA,EAAS,OACX,EAIJ,SAAS,CAAgB,CAAC,EAA6B,CAIrD,MAAO,GAHM,IAAI,YAAY,EAAE,OAAO,CAAO,EAC1B,MAAM,OAAO,EACV,IAAI,CAAC,IAAU,EAAK,WAAW,GAAG,EAAI,IAAI,IAAS,CAAK,EAC5D,KAAK;AAAA,CAAM;AAAA;AAAA,EAIxB,SAAS,CAAmB,CAAC,EAA0B,CAC5D,OAAO,EAAW,GAAG,EAAa,CAAI,EAAE,QAAQ,QAAS,EAAE;AAAA,CAAO,EAI7D,SAAS,CAAmB,CAAC,EAA0B,CAC5D,OAAO,EAAW,GAAG,EAAa,CAAI,EAAE,QAAQ,QAAS,EAAE;AAAA,CAAO,EAI7D,SAAS,CAAsB,CAAC,EAA8B,CACnE,OAAO,EAAW,GAAG;AAAA,CAAc,EAI9B,SAAS,CAAU,CAAC,EAA0B,CACnD,OAAO,EAAW,GAAG;AAAA,CAAU",
+  "debugId": "E879B8E2491095AF64756E2164756E21",
   "names": []
 }

package/dist/chunk-qtkd5bak.js

@@ -0,0 +1,4 @@
+async function t(n,...e){if(n===void 0)return;try{await n(...e)}catch(o){if(!(typeof process<"u"&&process.env?.NODE_ENV==="production"))console.warn("[sently] hook threw; send continues:",o)}}async function i(n,e){if(!e||e.length===0)return n;let o=n;for(let r of e)o=await r(o);return o}
+export{t as W,i as X};
+
+//# debugId=675428B56EEB607264756E2164756E21

package/dist/chunk-qtkd5bak.js.map

@@ -0,0 +1,11 @@
+{
+  "version": 3,
+  "sources": ["../src/core/hooks.ts", "../src/core/plugin.ts"],
+  "sourcesContent": [
+    "/**\n * @module\n * Shared lifecycle hook invocation for mailer and channel senders.\n * Hook failures are swallowed so they never break the send path.\n */\n\n/**\n * Invoke a lifecycle hook without letting hook failures break the send.\n * In non-production environments, hook errors are logged with `console.warn`.\n *\n * @typeParam T - Hook argument tuple types.\n * @param hook - Optional sync or async hook callback.\n * @param args - Arguments forwarded to the hook.\n */\nexport async function invokeHook<T extends unknown[]>(\n  hook: ((...args: T) => void | Promise<void>) | undefined,\n  ...args: T\n): Promise<void> {\n  if (hook === undefined) {\n    return;\n  }\n  try {\n    await hook(...args);\n  } catch (hookError) {\n    const isProduction = typeof process !== \"undefined\" && process.env?.NODE_ENV === \"production\";\n    if (!isProduction) {\n      console.warn(\"[sently] hook threw; send continues:\", hookError);\n    }\n  }\n}\n",
+    "/**\n * @module\n * Plugin pipeline for sently channel senders.\n * Plugins transform channel options before the transport sends.\n * They run sequentially — each receives the previous plugin's output.\n *\n * @example\n * ```ts\n * import { runPlugins } from \"sently/core/plugin\";\n * const result = await runPlugins(options, [pluginA, pluginB]);\n * ```\n */\n\n/**\n * Run a list of plugins sequentially over channel options.\n * If plugins is empty or undefined, returns options unchanged.\n * Each plugin may be sync or async.\n *\n * @typeParam T - Channel options type (e.g. MailOptions, SmsOptions).\n * @param options - the original options\n * @param plugins - ordered list of plugins to apply\n * @returns transformed options after all plugins have run\n */\nexport async function runPlugins<T>(\n  options: T,\n  plugins: Array<(o: T) => T | Promise<T>> | undefined,\n): Promise<T> {\n  if (!plugins || plugins.length === 0) {\n    return options;\n  }\n\n  let current = options;\n  for (const plugin of plugins) {\n    current = await plugin(current);\n  }\n  return current;\n}\n"
+  ],
+  "mappings": "AAcA,eAAsB,CAA+B,CACnD,KACG,EACY,CACf,GAAI,IAAS,OACX,OAEF,GAAI,CACF,MAAM,EAAK,GAAG,CAAI,EAClB,MAAO,EAAW,CAElB,GAAI,EADiB,OAAO,QAAY,KAAe,QAAQ,KAAK,WAAa,cAE/E,QAAQ,KAAK,uCAAwC,CAAS,GCHpE,eAAsB,CAAa,CACjC,EACA,EACY,CACZ,GAAI,CAAC,GAAW,EAAQ,SAAW,EACjC,OAAO,EAGT,IAAI,EAAU,EACd,QAAW,KAAU,EACnB,EAAU,MAAM,EAAO,CAAO,EAEhC,OAAO",
+  "debugId": "675428B56EEB607264756E2164756E21",
+  "names": []
+}

package/dist/chunk-skqhj0rm.js

@@ -0,0 +1,4 @@
+import{fa as C}from"./chunk-6npp3x3c.js";async function K(D,y){let E=D??[],j=[];for(let b of E){if(b.content instanceof Uint8Array){j.push(b);continue}if(b.path){let z;try{z=await import("node:fs/promises")}catch{throw Error("attachment.path is not supported on this runtime — use attachment.content (Uint8Array) instead")}if(y?.basePath){let{resolve:A,sep:H}=await import("node:path"),k=A(b.path),w=A(y.basePath);if(!(k===w||k.startsWith(w+H)))throw Error(`[sently] Attachment path "${k}" escapes basePath "${w}". Use absolute paths within the allowed directory.`)}let F=await z.readFile(b.path),{path:I,...G}=b;j.push({...G,content:new Uint8Array(F)});continue}if(typeof b.content==="string"){j.push(b);continue}j.push(b)}return j}
+export{K as I};
+
+//# debugId=B9395DEA67ACA6C864756E2164756E21

package/dist/{chunk-vhxzhx8b.js.map → chunk-skqhj0rm.js.map}

@@ -4,7 +4,7 @@
   "sourcesContent": [
     "import type { Attachment } from \"../core/types.js\";\n\n/** Options for {@link resolveAttachments}. */\nexport interface ResolveAttachmentsOptions {\n  /**\n   * If set, attachment paths must resolve within this directory.\n   * Prevents path traversal via `..` segments and sibling-directory\n   * prefix matches. Opt-in only.\n   *\n   * Note: this check uses `node:path` `resolve()`, which does NOT\n   * dereference symlinks. A symlink located inside `basePath` that\n   * points outside of it will pass this check. If symlink traversal is\n   * a concern, resolve paths with `fs.realpath()` before passing them in.\n   */\n  basePath?: string;\n}\n\n/**\n * Resolve attachment.path to in-memory Uint8Array content.\n * @throws When attachment.path is used on runtimes without node:fs/promises\n */\nexport async function resolveAttachments(\n  attachments: Attachment[] | undefined,\n  options?: ResolveAttachmentsOptions,\n): Promise<Attachment[]> {\n  const list = attachments ?? [];\n  const resolved: Attachment[] = [];\n\n  for (const attachment of list) {\n    if (attachment.content instanceof Uint8Array) {\n      resolved.push(attachment);\n      continue;\n    }\n\n    if (attachment.path) {\n      let fs: typeof import(\"node:fs/promises\");\n      try {\n        fs = await import(\"node:fs/promises\");\n      } catch {\n        throw new Error(\n          \"attachment.path is not supported on this runtime — use attachment.content (Uint8Array) instead\",\n        );\n      }\n\n      if (options?.basePath) {\n        const { resolve, sep } = await import(\"node:path\");\n        const resolvedPath = resolve(attachment.path);\n        const resolvedBase = resolve(options.basePath);\n        // startsWith alone is vulnerable: \"/var/data-secret\" passes \"/var/data\".\n        // Require an exact match or a trailing path separator.\n        const isWithin =\n          resolvedPath === resolvedBase || resolvedPath.startsWith(resolvedBase + sep);\n        if (!isWithin) {\n          throw new Error(\n            `[sently] Attachment path \"${resolvedPath}\" escapes basePath \"${resolvedBase}\". ` +\n              \"Use absolute paths within the allowed directory.\",\n          );\n        }\n      }\n\n      const data = await fs.readFile(attachment.path);\n      const { path: _path, ...rest } = attachment;\n      resolved.push({ ...rest, content: new Uint8Array(data) });\n      continue;\n    }\n\n    if (typeof attachment.content === \"string\") {\n      resolved.push(attachment);\n      continue;\n    }\n\n    resolved.push(attachment);\n  }\n\n  return resolved;\n}\n"
   ],
-  "mappings": "wCAqBA,eAAsB,CAAkB,CACtC,EACA,EACuB,CACvB,IAAM,EAAO,GAAe,CAAC,EACvB,EAAyB,CAAC,EAEhC,QAAW,KAAc,EAAM,CAC7B,GAAI,EAAW,mBAAmB,WAAY,CAC5C,EAAS,KAAK,CAAU,EACxB,SAGF,GAAI,EAAW,KAAM,CACnB,IAAI,EACJ,GAAI,CACF,EAAK,KAAa,4BAClB,KAAM,CACN,MAAU,MACR,gGACF,EAGF,GAAI,GAAS,SAAU,CACrB,IAAQ,UAAS,OAAQ,KAAa,qBAChC,EAAe,EAAQ,EAAW,IAAI,EACtC,EAAe,EAAQ,EAAQ,QAAQ,EAK7C,GAAI,EADF,IAAiB,GAAgB,EAAa,WAAW,EAAe,CAAG,GAE3E,MAAU,MACR,6BAA6B,wBAAmC,sDAElE,EAIJ,IAAM,EAAO,MAAM,EAAG,SAAS,EAAW,IAAI,GACtC,KAAM,KAAU,GAAS,EACjC,EAAS,KAAK,IAAK,EAAM,QAAS,IAAI,WAAW,CAAI,CAAE,CAAC,EACxD,SAGF,GAAI,OAAO,EAAW,UAAY,SAAU,CAC1C,EAAS,KAAK,CAAU,EACxB,SAGF,EAAS,KAAK,CAAU,EAG1B,OAAO",
-  "debugId": "3442FCDDB36F8C9264756E2164756E21",
+  "mappings": "yCAqBA,eAAsB,CAAkB,CACtC,EACA,EACuB,CACvB,IAAM,EAAO,GAAe,CAAC,EACvB,EAAyB,CAAC,EAEhC,QAAW,KAAc,EAAM,CAC7B,GAAI,EAAW,mBAAmB,WAAY,CAC5C,EAAS,KAAK,CAAU,EACxB,SAGF,GAAI,EAAW,KAAM,CACnB,IAAI,EACJ,GAAI,CACF,EAAK,KAAa,4BAClB,KAAM,CACN,MAAU,MACR,gGACF,EAGF,GAAI,GAAS,SAAU,CACrB,IAAQ,UAAS,OAAQ,KAAa,qBAChC,EAAe,EAAQ,EAAW,IAAI,EACtC,EAAe,EAAQ,EAAQ,QAAQ,EAK7C,GAAI,EADF,IAAiB,GAAgB,EAAa,WAAW,EAAe,CAAG,GAE3E,MAAU,MACR,6BAA6B,wBAAmC,sDAElE,EAIJ,IAAM,EAAO,MAAM,EAAG,SAAS,EAAW,IAAI,GACtC,KAAM,KAAU,GAAS,EACjC,EAAS,KAAK,IAAK,EAAM,QAAS,IAAI,WAAW,CAAI,CAAE,CAAC,EACxD,SAGF,GAAI,OAAO,EAAW,UAAY,SAAU,CAC1C,EAAS,KAAK,CAAU,EACxB,SAGF,EAAS,KAAK,CAAU,EAG1B,OAAO",
+  "debugId": "B9395DEA67ACA6C864756E2164756E21",
   "names": []
 }

package/dist/{chunk-6bkj4y4r.js → chunk-tamww15j.js}

@@ -1,4 +1,4 @@
 class v extends Error{sentlyCode;statusCode;provider;code;constructor(j,k,q){super(j,q?.cause!==void 0?{cause:q.cause}:void 0);if(this.name="SentlyError",this.sentlyCode=k,this.code=k,q?.statusCode!==void 0)this.statusCode=q.statusCode;if(q?.provider!==void 0)this.provider=q.provider}}function w(j){if(j===429)return"RATE_LIMITED";if(j>=500)return"PROVIDER_ERROR";if(j>=400)return"BAD_REQUEST";return"PROVIDER_ERROR"}function x(j,k){if(j===535||j===534)return"SMTP_AUTH_FAILED";if(j===421||j===450||j===451)return"TIMEOUT";if(j===0){if(k==="CONNECT"||k==="READ"||k==="MX")return"CONNECTION_FAILED";return"PROVIDER_ERROR"}if(j>=500)return"PROVIDER_ERROR";if(j>=400)return"BAD_REQUEST";return"PROVIDER_ERROR"}
-export{v as X,w as Y,x as Z};
+export{v as ca,w as da,x as ea};
 
-//# debugId=894390EEDA2D4BE364756E2164756E21
+//# debugId=A59A134E1BF4550C64756E2164756E21

package/dist/{chunk-6bkj4y4r.js.map → chunk-tamww15j.js.map}

@@ -5,6 +5,6 @@
     "/**\n * @module\n * Unified error hierarchy for sently transports and SMTP.\n */\n\n/** Stable machine-readable error codes shared across providers. */\nexport type SentlyErrorCode =\n  | \"INVALID_CONFIG\"\n  | \"SMTP_AUTH_FAILED\"\n  | \"RATE_LIMITED\"\n  | \"TIMEOUT\"\n  | \"CONNECTION_FAILED\"\n  | \"PROVIDER_ERROR\"\n  | \"BAD_REQUEST\";\n\n/** Options for constructing a {@link SentlyError}. */\nexport interface SentlyErrorOptions {\n  /** HTTP status code when the failure originated from an HTTP transport. */\n  statusCode?: number;\n  /** Original error or response payload. */\n  cause?: unknown;\n  /** Provider identifier (e.g. `\"smtp\"`, `\"resend\"`). */\n  provider?: string;\n}\n\n/**\n * Base error class for all sently transport and protocol failures.\n *\n * Subclasses may shadow {@link code} with provider-specific or numeric values\n * (e.g. SMTP response codes). Use {@link sentlyCode} for the stable machine-readable\n * code in those cases.\n */\nexport class SentlyError extends Error {\n  /**\n   * Stable machine-readable error code.\n   * Preserved even when a subclass shadows {@link code}.\n   */\n  readonly sentlyCode: SentlyErrorCode;\n\n  /** HTTP status code when applicable. */\n  readonly statusCode?: number;\n\n  /** Provider identifier when applicable. */\n  readonly provider?: string;\n\n  /**\n   * Error code — machine-readable string on {@link SentlyError}, or a legacy\n   * provider/SMTP-specific value on subclasses (numeric SMTP codes, Brevo/SES API codes).\n   */\n  code: string | number;\n\n  /** Creates a sently error with a machine-readable code and optional metadata. */\n  constructor(message: string, sentlyCode: SentlyErrorCode, options?: SentlyErrorOptions) {\n    super(message, options?.cause !== undefined ? { cause: options.cause } : undefined);\n    this.name = \"SentlyError\";\n    this.sentlyCode = sentlyCode;\n    this.code = sentlyCode;\n    if (options?.statusCode !== undefined) {\n      this.statusCode = options.statusCode;\n    }\n    if (options?.provider !== undefined) {\n      this.provider = options.provider;\n    }\n  }\n}\n\n/**\n * Map an HTTP status code to a stable sently error code.\n *\n * @param status - HTTP response status code\n * @returns Machine-readable error code\n */\nexport function httpStatusToSentlyCode(status: number): SentlyErrorCode {\n  if (status === 429) {\n    return \"RATE_LIMITED\";\n  }\n  if (status >= 500) {\n    return \"PROVIDER_ERROR\";\n  }\n  if (status >= 400) {\n    return \"BAD_REQUEST\";\n  }\n  return \"PROVIDER_ERROR\";\n}\n\n/**\n * Map an SMTP response code and command to a stable sently error code.\n *\n * @param smtpCode - Three-digit SMTP response code (0 for local/parse errors)\n * @param command - SMTP command that failed\n * @returns Machine-readable error code\n */\nexport function smtpCodeToSentlyCode(smtpCode: number, command: string): SentlyErrorCode {\n  if (smtpCode === 535 || smtpCode === 534) {\n    return \"SMTP_AUTH_FAILED\";\n  }\n  if (smtpCode === 421 || smtpCode === 450 || smtpCode === 451) {\n    return \"TIMEOUT\";\n  }\n  if (smtpCode === 0) {\n    if (command === \"CONNECT\" || command === \"READ\" || command === \"MX\") {\n      return \"CONNECTION_FAILED\";\n    }\n    return \"PROVIDER_ERROR\";\n  }\n  if (smtpCode >= 500) {\n    return \"PROVIDER_ERROR\";\n  }\n  if (smtpCode >= 400) {\n    return \"BAD_REQUEST\";\n  }\n  return \"PROVIDER_ERROR\";\n}\n"
   ],
   "mappings": "AAgCO,MAAM,UAAoB,KAAM,CAK5B,WAGA,WAGA,SAMT,KAGA,WAAW,CAAC,EAAiB,EAA6B,EAA8B,CACtF,MAAM,EAAS,GAAS,QAAU,OAAY,CAAE,MAAO,EAAQ,KAAM,EAAI,MAAS,EAIlF,GAHA,KAAK,KAAO,cACZ,KAAK,WAAa,EAClB,KAAK,KAAO,EACR,GAAS,aAAe,OAC1B,KAAK,WAAa,EAAQ,WAE5B,GAAI,GAAS,WAAa,OACxB,KAAK,SAAW,EAAQ,SAG9B,CAQO,SAAS,CAAsB,CAAC,EAAiC,CACtE,GAAI,IAAW,IACb,MAAO,eAET,GAAI,GAAU,IACZ,MAAO,iBAET,GAAI,GAAU,IACZ,MAAO,cAET,MAAO,iBAUF,SAAS,CAAoB,CAAC,EAAkB,EAAkC,CACvF,GAAI,IAAa,KAAO,IAAa,IACnC,MAAO,mBAET,GAAI,IAAa,KAAO,IAAa,KAAO,IAAa,IACvD,MAAO,UAET,GAAI,IAAa,EAAG,CAClB,GAAI,IAAY,WAAa,IAAY,QAAU,IAAY,KAC7D,MAAO,oBAET,MAAO,iBAET,GAAI,GAAY,IACd,MAAO,iBAET,GAAI,GAAY,IACd,MAAO,cAET,MAAO",
-  "debugId": "894390EEDA2D4BE364756E2164756E21",
+  "debugId": "A59A134E1BF4550C64756E2164756E21",
   "names": []
 }

package/dist/chunk-vjpds2pf.js

@@ -0,0 +1,3 @@
+import{t as U}from"./chunk-b602dhck.js";import{u as X}from"./chunk-8dty8c4p.js";import{A as L,B as v,C as N,D as A,E as j,G as E,v as k,w as $,x as Z,y as O,z as q}from"./chunk-n0qeyzqm.js";import{I as b}from"./chunk-skqhj0rm.js";import{fa as C}from"./chunk-6npp3x3c.js";class T{provider="smtp";config;adapter=null;constructor(z){this.config=P(z)}async send(z){let B={...z,attachments:await b(z.attachments)},G=await X(B,this.config.dkim),F=await this.getAdapter(),W=this.config.direct?await M(G.envelope.from.split("@")[1]??this.config.host):this.config.host;await F.connect(W,this.config.port),this.adapter=F;try{return await D(F,this.config),await S(F,G)}finally{await H(F),this.adapter=null}}async verify(){try{let z=await this.getAdapter();await z.connect(this.config.host,this.config.port);try{return await D(z,this.config),{ok:!0,provider:"smtp"}}finally{await H(z)}}catch(z){return{ok:!1,provider:"smtp",message:z instanceof Error?z.message:String(z)}}}async close(){if(this.adapter)await this.adapter.close(),this.adapter=null}async getAdapter(){if(!this.config.adapter)throw new $("No socket adapter configured",0,"CONNECT","");return this.config.adapter}}function P(z){let B=z.secure??!1;return{host:z.host,port:z.port??(B?465:587),secure:B,...z.auth!==void 0?{auth:z.auth}:{},...z.requireTLS!==void 0?{requireTLS:z.requireTLS}:{},...z.dkim!==void 0?{dkim:z.dkim}:{},...z.tls!==void 0?{tls:z.tls}:{},...z.connectionTimeout!==void 0?{connectionTimeout:z.connectionTimeout}:{},...z.greetingTimeout!==void 0?{greetingTimeout:z.greetingTimeout}:{},...z.socketTimeout!==void 0?{socketTimeout:z.socketTimeout}:{},...z.direct!==void 0?{direct:z.direct}:{},...z.adapter!==void 0?{adapter:z.adapter}:{}}}async function D(z,B){let G=await J(z);N(G,[220],"greeting");let F=await I(z,B.host),W=F.some((Q)=>Q.toUpperCase()==="STARTTLS");if(!B.secure&&!z.secure&&W){await Y(z,Z({type:"STARTTLS"}));let Q=await J(z);N(Q,[220],"STARTTLS"),await z.startTLS(B.tls),F=await I(z,B.host)}if(B.auth){let Q=B.requireTLS??!0,V=z.secure||B.secure;if(Q&&!V)throw new $("Refusing to authenticate over unencrypted connection. Set requireTLS: false to disable this check (not recommended).",0,"AUTH","");await l(z,B.auth,F)}}async function S(z,B){await _(z,{type:"MAIL_FROM",address:B.envelope.from});let G=await J(z);N(G,[250],"MAIL FROM");let F=[],W=[];for(let K of B.envelope.to)if(await Y(z,Z({type:"RCPT_TO",address:K})),(await J(z)).isSuccess)F.push(K);else W.push(K);await _(z,{type:"DATA"});let Q=await J(z);N(Q,[354],"DATA");let V;try{await Y(z,Z({type:"DATA_BODY",content:B.raw})),V=await J(z)}catch(K){if(await Y(z,Z({type:"DATA_BODY",content:B.raw})),V=await J(z),V.isError)throw K}return N(V,[250],"DATA end"),{messageId:B.messageId,accepted:F,rejected:W,response:V.message,envelope:B.envelope}}async function H(z){try{await _(z,{type:"QUIT"}),await J(z)}catch{}finally{await z.close()}}async function I(z,B){await _(z,{type:"EHLO",domain:B});let G=await J(z);return N(G,[250],"EHLO"),v(G)}async function l(z,B,G){if(B.type==="OAUTH2"&&B.oauth2){let K=await new U(B.oauth2).buildXOAUTH2();await _(z,{type:"AUTH_XOAUTH2",xoauth2String:K});let x=await J(z);if(x.code===334)await Y(z,E("")),x=await J(z);N(x,[235],"AUTH XOAUTH2");return}let F=B.type??L(G);if(F==="CRAM-MD5"){let V=y(B,"CRAM-MD5");await _(z,{type:"AUTH_CRAM_MD5_INIT"});let K=await J(z);N(K,[334],"AUTH CRAM-MD5");let x=K.message.trim(),w=await k(x,B.user,V);await _(z,{type:"AUTH_CRAM_MD5_RESPONSE",response:w}),K=await J(z),N(K,[235],"AUTH CRAM-MD5 response");return}if(F==="PLAIN"){let V=y(B,"PLAIN");await Y(z,Z({type:"AUTH_PLAIN",user:B.user,pass:V}));let K=await J(z);N(K,[235],"AUTH PLAIN");return}let W=y(B,"LOGIN");await Y(z,Z({type:"AUTH_LOGIN",user:B.user,pass:W}));let Q=await J(z);N(Q,[334],"AUTH LOGIN"),await Y(z,j(B.user)),Q=await J(z),N(Q,[334],"AUTH LOGIN user"),await Y(z,A(W)),Q=await J(z),N(Q,[235],"AUTH LOGIN pass")}function y(z,B){if(!z.pass)throw new $(`Password required for ${B} authentication`,0,`AUTH ${B}`,"");return z.pass}async function _(z,B){await Y(z,Z(B))}async function Y(z,B){await z.write(B)}async function J(z){let B=[];for await(let G of z.read()){B.push(G);let F=q(B);if(F)return O(F)}throw new $("Connection closed while reading SMTP response",0,"READ","")}async function M(z){let G=await(await import("node:dns/promises")).resolveMx(z);if(G.length===0)throw new $(`No MX records for ${z}`,0,"MX","");return G.sort((F,W)=>F.priority-W.priority),G[0]?.exchange??z}export{T as l,P as m,D as n,S as o,H as p,J as q};
+
+//# debugId=B20B39B95D5ED1FD64756E2164756E21

package/dist/{chunk-m07smapm.js.map → chunk-vjpds2pf.js.map}

@@ -4,7 +4,7 @@
   "sourcesContent": [
     "/**\n * @module\n * SMTP transport — orchestrates socket adapter, MIME builder, and protocol logic.\n *\n * @example\n * ```ts\n * import { SMTPTransport } from \"sently/transports/smtp\";\n * import { NodeAdapter } from \"sently/adapters/node\";\n * import { createMailer } from \"sently/mailer\";\n *\n * const mailer = await createMailer({\n *   transport: new SMTPTransport({\n *     host: \"smtp.example.com\",\n *     auth: { user: \"you@example.com\", pass: \"secret\" },\n *     adapter: new NodeAdapter(),\n *   }),\n * });\n * ```\n */\nimport { OAuth2Client } from \"../auth/oauth2.js\";\nimport { buildMIME, type MIMEBuildResult } from \"../core/mime.js\";\nimport type { SMTPResponse } from \"../core/smtp.js\";\nimport {\n  accumulateResponse,\n  assertResponse,\n  computeCRAMMD5,\n  encodeAuthLoginPass,\n  encodeAuthLoginUser,\n  encodeCommand,\n  encodeLine,\n  parseEHLO,\n  parseResponse,\n  SMTPError,\n  selectAuthMethod,\n} from \"../core/smtp.js\";\nimport type {\n  MailOptions,\n  SendResult,\n  SMTPConfig,\n  SocketAdapter,\n  Transport,\n  VerifyResult,\n} from \"../core/types.js\";\nimport { resolveAttachments } from \"./resolve-attachments.js\";\n\n/**\n * SMTP transport orchestrating adapter, MIME builder, and protocol logic.\n */\nexport class SMTPTransport implements Transport {\n  readonly provider = \"smtp\";\n\n  /** Resolved SMTP configuration with defaults applied. */\n  private readonly config: ResolvedSMTPConfig;\n  /** Active socket adapter for the current session, if any. */\n  private adapter: SocketAdapter | null = null;\n\n  /** Creates an SMTP transport with the given configuration. */\n  constructor(config: SMTPConfig) {\n    this.config = resolveSMTPConfig(config);\n  }\n\n  /** Sends an email via SMTP using the configured adapter. */\n  async send(options: MailOptions): Promise<SendResult> {\n    const resolvedOptions = {\n      ...options,\n      attachments: await resolveAttachments(options.attachments),\n    };\n    const mime = await buildMIME(resolvedOptions, this.config.dkim);\n    const adapter = await this.getAdapter();\n\n    const host = this.config.direct\n      ? await resolveMX(mime.envelope.from.split(\"@\")[1] ?? this.config.host)\n      : this.config.host;\n\n    await adapter.connect(host, this.config.port);\n    this.adapter = adapter;\n\n    try {\n      await openSMTPSession(adapter, this.config);\n      return await deliverSMTPMessage(adapter, mime);\n    } finally {\n      await closeSMTPSession(adapter);\n      this.adapter = null;\n    }\n  }\n\n  /** Verifies SMTP connectivity and authentication without sending mail. */\n  async verify(): Promise<VerifyResult> {\n    try {\n      const adapter = await this.getAdapter();\n      await adapter.connect(this.config.host, this.config.port);\n\n      try {\n        await openSMTPSession(adapter, this.config);\n        return { ok: true, provider: \"smtp\" };\n      } finally {\n        await closeSMTPSession(adapter);\n      }\n    } catch (err) {\n      return {\n        ok: false,\n        provider: \"smtp\",\n        message: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  /** Closes the underlying socket adapter if connected. */\n  async close(): Promise<void> {\n    if (this.adapter) {\n      await this.adapter.close();\n      this.adapter = null;\n    }\n  }\n\n  /** Returns the configured socket adapter or throws if none is set. */\n  private async getAdapter(): Promise<SocketAdapter> {\n    if (!this.config.adapter) {\n      throw new SMTPError(\"No socket adapter configured\", 0, \"CONNECT\", \"\");\n    }\n    return this.config.adapter;\n  }\n}\n\n/** Resolved SMTP transport configuration with defaults applied. */\nexport interface ResolvedSMTPConfig {\n  /** SMTP server hostname. */\n  host: string;\n  /** SMTP port with secure/default applied. */\n  port: number;\n  /** Whether implicit TLS is used. */\n  secure: boolean;\n  /** Resolved authentication credentials, if any. */\n  auth?: SMTPConfig[\"auth\"];\n  /** Whether AUTH requires an encrypted connection. */\n  requireTLS?: boolean;\n  /** TLS options for STARTTLS and direct TLS. */\n  tls?: SMTPConfig[\"tls\"];\n  /** DKIM signing configuration. */\n  dkim?: SMTPConfig[\"dkim\"];\n  /** Socket connect timeout in milliseconds. */\n  connectionTimeout?: number;\n  /** Timeout waiting for the SMTP greeting in milliseconds. */\n  greetingTimeout?: number;\n  /** Idle socket timeout in milliseconds. */\n  socketTimeout?: number;\n  /** Direct-to-MX delivery mode. */\n  direct?: boolean;\n  /** Runtime socket adapter. */\n  adapter?: SocketAdapter;\n}\n\n/** Apply defaults to SMTP configuration. */\nexport function resolveSMTPConfig(config: SMTPConfig): ResolvedSMTPConfig {\n  const secure = config.secure ?? false;\n  return {\n    host: config.host,\n    port: config.port ?? (secure ? 465 : 587),\n    secure,\n    ...(config.auth !== undefined ? { auth: config.auth } : {}),\n    ...(config.requireTLS !== undefined ? { requireTLS: config.requireTLS } : {}),\n    ...(config.dkim !== undefined ? { dkim: config.dkim } : {}),\n    ...(config.tls !== undefined ? { tls: config.tls } : {}),\n    ...(config.connectionTimeout !== undefined\n      ? { connectionTimeout: config.connectionTimeout }\n      : {}),\n    ...(config.greetingTimeout !== undefined ? { greetingTimeout: config.greetingTimeout } : {}),\n    ...(config.socketTimeout !== undefined ? { socketTimeout: config.socketTimeout } : {}),\n    ...(config.direct !== undefined ? { direct: config.direct } : {}),\n    ...(config.adapter !== undefined ? { adapter: config.adapter } : {}),\n  };\n}\n\n/**\n * Connect greeting, EHLO, optional STARTTLS, and AUTH on an open adapter.\n */\nexport async function openSMTPSession(\n  adapter: SocketAdapter,\n  config: ResolvedSMTPConfig,\n): Promise<void> {\n  const greeting = await readSMTPResponse(adapter);\n  assertResponse(greeting, [220], \"greeting\");\n\n  let capabilities = await ehlo(adapter, config.host);\n  const supportsStartTls = capabilities.some((cap) => cap.toUpperCase() === \"STARTTLS\");\n  if (!config.secure && !adapter.secure && supportsStartTls) {\n    await sendRaw(adapter, encodeCommand({ type: \"STARTTLS\" }));\n    const starttlsResp = await readSMTPResponse(adapter);\n    assertResponse(starttlsResp, [220], \"STARTTLS\");\n    await adapter.startTLS(config.tls);\n    capabilities = await ehlo(adapter, config.host);\n  }\n\n  if (config.auth) {\n    const tlsRequired = config.requireTLS ?? true;\n    const encrypted = adapter.secure || config.secure;\n    if (tlsRequired && !encrypted) {\n      throw new SMTPError(\n        \"Refusing to authenticate over unencrypted connection. \" +\n          \"Set requireTLS: false to disable this check (not recommended).\",\n        0,\n        \"AUTH\",\n        \"\",\n      );\n    }\n    await authenticate(adapter, config.auth, capabilities);\n  }\n}\n\n/**\n * MAIL FROM, RCPT TO, and DATA for a built MIME message on an authenticated session.\n */\nexport async function deliverSMTPMessage(\n  adapter: SocketAdapter,\n  mime: MIMEBuildResult,\n): Promise<SendResult> {\n  await sendCommand(adapter, { type: \"MAIL_FROM\", address: mime.envelope.from });\n  const mailResp = await readSMTPResponse(adapter);\n  assertResponse(mailResp, [250], \"MAIL FROM\");\n\n  const accepted: string[] = [];\n  const rejected: string[] = [];\n\n  for (const recipient of mime.envelope.to) {\n    await sendRaw(adapter, encodeCommand({ type: \"RCPT_TO\", address: recipient }));\n    const rcptResp = await readSMTPResponse(adapter);\n    if (rcptResp.isSuccess) {\n      accepted.push(recipient);\n    } else {\n      rejected.push(recipient);\n    }\n  }\n\n  await sendCommand(adapter, { type: \"DATA\" });\n  const dataResp = await readSMTPResponse(adapter);\n  assertResponse(dataResp, [354], \"DATA\");\n\n  let finalResp: SMTPResponse;\n  try {\n    await sendRaw(adapter, encodeCommand({ type: \"DATA_BODY\", content: mime.raw }));\n    finalResp = await readSMTPResponse(adapter);\n  } catch (err) {\n    await sendRaw(adapter, encodeCommand({ type: \"DATA_BODY\", content: mime.raw }));\n    finalResp = await readSMTPResponse(adapter);\n    if (finalResp.isError) {\n      throw err;\n    }\n  }\n  assertResponse(finalResp, [250], \"DATA end\");\n\n  return {\n    messageId: mime.messageId,\n    accepted,\n    rejected,\n    response: finalResp.message,\n    envelope: mime.envelope,\n  };\n}\n\n/**\n * QUIT and close an SMTP session adapter.\n */\nexport async function closeSMTPSession(adapter: SocketAdapter): Promise<void> {\n  try {\n    await sendCommand(adapter, { type: \"QUIT\" });\n    await readSMTPResponse(adapter);\n  } catch {\n    // ignore errors during shutdown\n  } finally {\n    await adapter.close();\n  }\n}\n\nasync function ehlo(adapter: SocketAdapter, host: string): Promise<string[]> {\n  await sendCommand(adapter, { type: \"EHLO\", domain: host });\n  const response = await readSMTPResponse(adapter);\n  assertResponse(response, [250], \"EHLO\");\n  return parseEHLO(response);\n}\n\nasync function authenticate(\n  adapter: SocketAdapter,\n  auth: NonNullable<SMTPConfig[\"auth\"]>,\n  capabilities: string[],\n): Promise<void> {\n  if (auth.type === \"OAUTH2\" && auth.oauth2) {\n    const client = new OAuth2Client(auth.oauth2);\n    const xoauth2 = await client.buildXOAUTH2();\n    await sendCommand(adapter, { type: \"AUTH_XOAUTH2\", xoauth2String: xoauth2 });\n    let resp = await readSMTPResponse(adapter);\n    if (resp.code === 334) {\n      await sendRaw(adapter, encodeLine(\"\"));\n      resp = await readSMTPResponse(adapter);\n    }\n    assertResponse(resp, [235], \"AUTH XOAUTH2\");\n    return;\n  }\n\n  const method = auth.type ?? selectAuthMethod(capabilities);\n\n  if (method === \"CRAM-MD5\") {\n    const pass = requirePassword(auth, \"CRAM-MD5\");\n    await sendCommand(adapter, { type: \"AUTH_CRAM_MD5_INIT\" });\n    let resp = await readSMTPResponse(adapter);\n    assertResponse(resp, [334], \"AUTH CRAM-MD5\");\n    const challenge = resp.message.trim();\n    const response = await computeCRAMMD5(challenge, auth.user, pass);\n    await sendCommand(adapter, { type: \"AUTH_CRAM_MD5_RESPONSE\", response });\n    resp = await readSMTPResponse(adapter);\n    assertResponse(resp, [235], \"AUTH CRAM-MD5 response\");\n    return;\n  }\n\n  if (method === \"PLAIN\") {\n    const pass = requirePassword(auth, \"PLAIN\");\n    await sendRaw(adapter, encodeCommand({ type: \"AUTH_PLAIN\", user: auth.user, pass }));\n    const resp = await readSMTPResponse(adapter);\n    assertResponse(resp, [235], \"AUTH PLAIN\");\n    return;\n  }\n\n  const pass = requirePassword(auth, \"LOGIN\");\n  await sendRaw(adapter, encodeCommand({ type: \"AUTH_LOGIN\", user: auth.user, pass }));\n  let resp = await readSMTPResponse(adapter);\n  assertResponse(resp, [334], \"AUTH LOGIN\");\n\n  await sendRaw(adapter, encodeAuthLoginUser(auth.user));\n  resp = await readSMTPResponse(adapter);\n  assertResponse(resp, [334], \"AUTH LOGIN user\");\n\n  await sendRaw(adapter, encodeAuthLoginPass(pass));\n  resp = await readSMTPResponse(adapter);\n  assertResponse(resp, [235], \"AUTH LOGIN pass\");\n}\n\nfunction requirePassword(auth: NonNullable<SMTPConfig[\"auth\"]>, method: string): string {\n  if (!auth.pass) {\n    throw new SMTPError(`Password required for ${method} authentication`, 0, `AUTH ${method}`, \"\");\n  }\n  return auth.pass;\n}\n\nasync function sendCommand(\n  adapter: SocketAdapter,\n  command: Parameters<typeof encodeCommand>[0],\n): Promise<void> {\n  await sendRaw(adapter, encodeCommand(command));\n}\n\nasync function sendRaw(adapter: SocketAdapter, data: Uint8Array): Promise<void> {\n  await adapter.write(data);\n}\n\n/** Reads and parses a complete SMTP response from the adapter. */\nasync function readSMTPResponse(adapter: SocketAdapter): Promise<SMTPResponse> {\n  const chunks: Uint8Array[] = [];\n  for await (const chunk of adapter.read()) {\n    chunks.push(chunk);\n    const complete = accumulateResponse(chunks);\n    if (complete) {\n      return parseResponse(complete);\n    }\n  }\n  throw new SMTPError(\"Connection closed while reading SMTP response\", 0, \"READ\", \"\");\n}\n\nasync function resolveMX(domain: string): Promise<string> {\n  const dns = await import(\"node:dns/promises\");\n  const records = await dns.resolveMx(domain);\n  if (records.length === 0) {\n    throw new SMTPError(`No MX records for ${domain}`, 0, \"MX\", \"\");\n  }\n  records.sort((a: { priority: number }, b: { priority: number }) => a.priority - b.priority);\n  return records[0]?.exchange ?? domain;\n}\n\nexport { SMTPError } from \"../core/smtp.js\";\n/** @internal Test helper for raw line writes. */\nexport { encodeLine, readSMTPResponse };\n"
   ],
-  "mappings": "sSAgDO,AAAM,LAAmC,LACrC,GAAW,OAGH,OAET,QAAgC,KAGxC,WAAW,CAAC,EAAoB,CAC9B,KAAK,OAAS,EAAkB,CAAM,OAIlC,KAAI,CAAC,EAA2C,CACpD,IAAM,EAAkB,IACnB,EACH,YAAa,MAAM,EAAmB,EAAQ,WAAW,CAC3D,EACM,EAAO,MAAM,EAAU,EAAiB,KAAK,OAAO,IAAI,EACxD,EAAU,MAAM,KAAK,WAAW,EAEhC,EAAO,KAAK,OAAO,OACrB,MAAM,EAAU,EAAK,SAAS,KAAK,MAAM,GAAG,EAAE,IAAM,KAAK,OAAO,IAAI,EACpE,KAAK,OAAO,KAEhB,MAAM,EAAQ,QAAQ,EAAM,KAAK,OAAO,IAAI,EAC5C,KAAK,QAAU,EAEf,GAAI,CAEF,OADA,MAAM,EAAgB,EAAS,KAAK,MAAM,EACnC,MAAM,EAAmB,EAAS,CAAI,SAC7C,CACA,MAAM,EAAiB,CAAO,EAC9B,KAAK,QAAU,WAKb,OAAM,EAA0B,CACpC,GAAI,CACF,IAAM,EAAU,MAAM,KAAK,WAAW,EACtC,MAAM,EAAQ,QAAQ,KAAK,OAAO,KAAM,KAAK,OAAO,IAAI,EAExD,GAAI,CAEF,OADA,MAAM,EAAgB,EAAS,KAAK,MAAM,EACnC,CAAE,GAAI,GAAM,SAAU,MAAO,SACpC,CACA,MAAM,EAAiB,CAAO,GAEhC,MAAO,EAAK,CACZ,MAAO,CACL,GAAI,GACJ,SAAU,OACV,QAAS,aAAe,MAAQ,EAAI,QAAU,OAAO,CAAG,CAC1D,QAKE,MAAK,EAAkB,CAC3B,GAAI,KAAK,QACP,MAAM,KAAK,QAAQ,MAAM,EACzB,KAAK,QAAU,UAKL,WAAU,EAA2B,CACjD,GAAI,CAAC,KAAK,OAAO,QACf,MAAM,IAAI,EAAU,+BAAgC,EAAG,UAAW,EAAE,EAEtE,OAAO,KAAK,OAAO,QAEvB,CA+BO,SAAS,CAAiB,CAAC,EAAwC,CACxE,IAAM,EAAS,EAAO,QAAU,GAChC,MAAO,CACL,KAAM,EAAO,KACb,KAAM,EAAO,OAAS,EAAS,IAAM,KACrC,YACI,EAAO,OAAS,OAAY,CAAE,KAAM,EAAO,IAAK,EAAI,CAAC,KACrD,EAAO,aAAe,OAAY,CAAE,WAAY,EAAO,UAAW,EAAI,CAAC,KACvE,EAAO,OAAS,OAAY,CAAE,KAAM,EAAO,IAAK,EAAI,CAAC,KACrD,EAAO,MAAQ,OAAY,CAAE,IAAK,EAAO,GAAI,EAAI,CAAC,KAClD,EAAO,oBAAsB,OAC7B,CAAE,kBAAmB,EAAO,iBAAkB,EAC9C,CAAC,KACD,EAAO,kBAAoB,OAAY,CAAE,gBAAiB,EAAO,eAAgB,EAAI,CAAC,KACtF,EAAO,gBAAkB,OAAY,CAAE,cAAe,EAAO,aAAc,EAAI,CAAC,KAChF,EAAO,SAAW,OAAY,CAAE,OAAQ,EAAO,MAAO,EAAI,CAAC,KAC3D,EAAO,UAAY,OAAY,CAAE,QAAS,EAAO,OAAQ,EAAI,CAAC,CACpE,EAMF,eAAsB,CAAe,CACnC,EACA,EACe,CACf,IAAM,EAAW,MAAM,EAAiB,CAAO,EAC/C,EAAe,EAAU,CAAC,GAAG,EAAG,UAAU,EAE1C,IAAI,EAAe,MAAM,EAAK,EAAS,EAAO,IAAI,EAC5C,EAAmB,EAAa,KAAK,CAAC,IAAQ,EAAI,YAAY,IAAM,UAAU,EACpF,GAAI,CAAC,EAAO,QAAU,CAAC,EAAQ,QAAU,EAAkB,CACzD,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,UAAW,CAAC,CAAC,EAC1D,IAAM,EAAe,MAAM,EAAiB,CAAO,EACnD,EAAe,EAAc,CAAC,GAAG,EAAG,UAAU,EAC9C,MAAM,EAAQ,SAAS,EAAO,GAAG,EACjC,EAAe,MAAM,EAAK,EAAS,EAAO,IAAI,EAGhD,GAAI,EAAO,KAAM,CACf,IAAM,EAAc,EAAO,YAAc,GACnC,EAAY,EAAQ,QAAU,EAAO,OAC3C,GAAI,GAAe,CAAC,EAClB,MAAM,IAAI,EACR,uHAEA,EACA,OACA,EACF,EAEF,MAAM,EAAa,EAAS,EAAO,KAAM,CAAY,GAOzD,eAAsB,CAAkB,CACtC,EACA,EACqB,CACrB,MAAM,EAAY,EAAS,CAAE,KAAM,YAAa,QAAS,EAAK,SAAS,IAAK,CAAC,EAC7E,IAAM,EAAW,MAAM,EAAiB,CAAO,EAC/C,EAAe,EAAU,CAAC,GAAG,EAAG,WAAW,EAE3C,IAAM,EAAqB,CAAC,EACtB,EAAqB,CAAC,EAE5B,QAAW,KAAa,EAAK,SAAS,GAGpC,GAFA,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,UAAW,QAAS,CAAU,CAAC,CAAC,GAC5D,MAAM,EAAiB,CAAO,GAClC,UACX,EAAS,KAAK,CAAS,EAEvB,OAAS,KAAK,CAAS,EAI3B,MAAM,EAAY,EAAS,CAAE,KAAM,MAAO,CAAC,EAC3C,IAAM,EAAW,MAAM,EAAiB,CAAO,EAC/C,EAAe,EAAU,CAAC,GAAG,EAAG,MAAM,EAEtC,IAAI,EACJ,GAAI,CACF,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,YAAa,QAAS,EAAK,GAAI,CAAC,CAAC,EAC9E,EAAY,MAAM,EAAiB,CAAO,EAC1C,MAAO,EAAK,CAGZ,GAFA,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,YAAa,QAAS,EAAK,GAAI,CAAC,CAAC,EAC9E,EAAY,MAAM,EAAiB,CAAO,EACtC,EAAU,QACZ,MAAM,EAKV,OAFA,EAAe,EAAW,CAAC,GAAG,EAAG,UAAU,EAEpC,CACL,UAAW,EAAK,UAChB,WACA,WACA,SAAU,EAAU,QACpB,SAAU,EAAK,QACjB,EAMF,eAAsB,CAAgB,CAAC,EAAuC,CAC5E,GAAI,CACF,MAAM,EAAY,EAAS,CAAE,KAAM,MAAO,CAAC,EAC3C,MAAM,EAAiB,CAAO,EAC9B,KAAM,SAEN,CACA,MAAM,EAAQ,MAAM,GAIxB,eAAe,CAAI,CAAC,EAAwB,EAAiC,CAC3E,MAAM,EAAY,EAAS,CAAE,KAAM,OAAQ,OAAQ,CAAK,CAAC,EACzD,IAAM,EAAW,MAAM,EAAiB,CAAO,EAE/C,OADA,EAAe,EAAU,CAAC,GAAG,EAAG,MAAM,EAC/B,EAAU,CAAQ,EAG3B,eAAe,CAAY,CACzB,EACA,EACA,EACe,CACf,GAAI,EAAK,OAAS,UAAY,EAAK,OAAQ,CAEzC,IAAM,EAAU,MADD,IAAI,EAAa,EAAK,MAAM,EACd,aAAa,EAC1C,MAAM,EAAY,EAAS,CAAE,KAAM,eAAgB,cAAe,CAAQ,CAAC,EAC3E,IAAI,EAAO,MAAM,EAAiB,CAAO,EACzC,GAAI,EAAK,OAAS,IAChB,MAAM,EAAQ,EAAS,EAAW,EAAE,CAAC,EACrC,EAAO,MAAM,EAAiB,CAAO,EAEvC,EAAe,EAAM,CAAC,GAAG,EAAG,cAAc,EAC1C,OAGF,IAAM,EAAS,EAAK,MAAQ,EAAiB,CAAY,EAEzD,GAAI,IAAW,WAAY,CACzB,IAAM,EAAO,EAAgB,EAAM,UAAU,EAC7C,MAAM,EAAY,EAAS,CAAE,KAAM,oBAAqB,CAAC,EACzD,IAAI,EAAO,MAAM,EAAiB,CAAO,EACzC,EAAe,EAAM,CAAC,GAAG,EAAG,eAAe,EAC3C,IAAM,EAAY,EAAK,QAAQ,KAAK,EAC9B,EAAW,MAAM,EAAe,EAAW,EAAK,KAAM,CAAI,EAChE,MAAM,EAAY,EAAS,CAAE,KAAM,yBAA0B,UAAS,CAAC,EACvE,EAAO,MAAM,EAAiB,CAAO,EACrC,EAAe,EAAM,CAAC,GAAG,EAAG,wBAAwB,EACpD,OAGF,GAAI,IAAW,QAAS,CACtB,IAAM,EAAO,EAAgB,EAAM,OAAO,EAC1C,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,aAAc,KAAM,EAAK,KAAM,MAAK,CAAC,CAAC,EACnF,IAAM,EAAO,MAAM,EAAiB,CAAO,EAC3C,EAAe,EAAM,CAAC,GAAG,EAAG,YAAY,EACxC,OAGF,IAAM,EAAO,EAAgB,EAAM,OAAO,EAC1C,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,aAAc,KAAM,EAAK,KAAM,MAAK,CAAC,CAAC,EACnF,IAAI,EAAO,MAAM,EAAiB,CAAO,EACzC,EAAe,EAAM,CAAC,GAAG,EAAG,YAAY,EAExC,MAAM,EAAQ,EAAS,EAAoB,EAAK,IAAI,CAAC,EACrD,EAAO,MAAM,EAAiB,CAAO,EACrC,EAAe,EAAM,CAAC,GAAG,EAAG,iBAAiB,EAE7C,MAAM,EAAQ,EAAS,EAAoB,CAAI,CAAC,EAChD,EAAO,MAAM,EAAiB,CAAO,EACrC,EAAe,EAAM,CAAC,GAAG,EAAG,iBAAiB,EAG/C,SAAS,CAAe,CAAC,EAAuC,EAAwB,CACtF,GAAI,CAAC,EAAK,KACR,MAAM,IAAI,EAAU,yBAAyB,mBAAyB,EAAG,QAAQ,IAAU,EAAE,EAE/F,OAAO,EAAK,KAGd,eAAe,CAAW,CACxB,EACA,EACe,CACf,MAAM,EAAQ,EAAS,EAAc,CAAO,CAAC,EAG/C,eAAe,CAAO,CAAC,EAAwB,EAAiC,CAC9E,MAAM,EAAQ,MAAM,CAAI,EAI1B,eAAe,CAAgB,CAAC,EAA+C,CAC7E,IAAM,EAAuB,CAAC,EAC9B,cAAiB,KAAS,EAAQ,KAAK,EAAG,CACxC,EAAO,KAAK,CAAK,EACjB,IAAM,EAAW,EAAmB,CAAM,EAC1C,GAAI,EACF,OAAO,EAAc,CAAQ,EAGjC,MAAM,IAAI,EAAU,gDAAiD,EAAG,OAAQ,EAAE,EAGpF,eAAe,CAAS,CAAC,EAAiC,CAExD,IAAM,EAAU,MADJ,KAAa,8BACC,UAAU,CAAM,EAC1C,GAAI,EAAQ,SAAW,EACrB,MAAM,IAAI,EAAU,qBAAqB,IAAU,EAAG,KAAM,EAAE,EAGhE,OADA,EAAQ,KAAK,CAAC,EAAyB,IAA4B,EAAE,SAAW,EAAE,QAAQ,EACnF,EAAQ,IAAI,UAAY",
-  "debugId": "27963FE5C2BAA8F464756E2164756E21",
+  "mappings": "uSAgDO,AAAM,LAAmC,LACrC,GAAW,OAGH,OAET,QAAgC,KAGxC,WAAW,CAAC,EAAoB,CAC9B,KAAK,OAAS,EAAkB,CAAM,OAIlC,KAAI,CAAC,EAA2C,CACpD,IAAM,EAAkB,IACnB,EACH,YAAa,MAAM,EAAmB,EAAQ,WAAW,CAC3D,EACM,EAAO,MAAM,EAAU,EAAiB,KAAK,OAAO,IAAI,EACxD,EAAU,MAAM,KAAK,WAAW,EAEhC,EAAO,KAAK,OAAO,OACrB,MAAM,EAAU,EAAK,SAAS,KAAK,MAAM,GAAG,EAAE,IAAM,KAAK,OAAO,IAAI,EACpE,KAAK,OAAO,KAEhB,MAAM,EAAQ,QAAQ,EAAM,KAAK,OAAO,IAAI,EAC5C,KAAK,QAAU,EAEf,GAAI,CAEF,OADA,MAAM,EAAgB,EAAS,KAAK,MAAM,EACnC,MAAM,EAAmB,EAAS,CAAI,SAC7C,CACA,MAAM,EAAiB,CAAO,EAC9B,KAAK,QAAU,WAKb,OAAM,EAA0B,CACpC,GAAI,CACF,IAAM,EAAU,MAAM,KAAK,WAAW,EACtC,MAAM,EAAQ,QAAQ,KAAK,OAAO,KAAM,KAAK,OAAO,IAAI,EAExD,GAAI,CAEF,OADA,MAAM,EAAgB,EAAS,KAAK,MAAM,EACnC,CAAE,GAAI,GAAM,SAAU,MAAO,SACpC,CACA,MAAM,EAAiB,CAAO,GAEhC,MAAO,EAAK,CACZ,MAAO,CACL,GAAI,GACJ,SAAU,OACV,QAAS,aAAe,MAAQ,EAAI,QAAU,OAAO,CAAG,CAC1D,QAKE,MAAK,EAAkB,CAC3B,GAAI,KAAK,QACP,MAAM,KAAK,QAAQ,MAAM,EACzB,KAAK,QAAU,UAKL,WAAU,EAA2B,CACjD,GAAI,CAAC,KAAK,OAAO,QACf,MAAM,IAAI,EAAU,+BAAgC,EAAG,UAAW,EAAE,EAEtE,OAAO,KAAK,OAAO,QAEvB,CA+BO,SAAS,CAAiB,CAAC,EAAwC,CACxE,IAAM,EAAS,EAAO,QAAU,GAChC,MAAO,CACL,KAAM,EAAO,KACb,KAAM,EAAO,OAAS,EAAS,IAAM,KACrC,YACI,EAAO,OAAS,OAAY,CAAE,KAAM,EAAO,IAAK,EAAI,CAAC,KACrD,EAAO,aAAe,OAAY,CAAE,WAAY,EAAO,UAAW,EAAI,CAAC,KACvE,EAAO,OAAS,OAAY,CAAE,KAAM,EAAO,IAAK,EAAI,CAAC,KACrD,EAAO,MAAQ,OAAY,CAAE,IAAK,EAAO,GAAI,EAAI,CAAC,KAClD,EAAO,oBAAsB,OAC7B,CAAE,kBAAmB,EAAO,iBAAkB,EAC9C,CAAC,KACD,EAAO,kBAAoB,OAAY,CAAE,gBAAiB,EAAO,eAAgB,EAAI,CAAC,KACtF,EAAO,gBAAkB,OAAY,CAAE,cAAe,EAAO,aAAc,EAAI,CAAC,KAChF,EAAO,SAAW,OAAY,CAAE,OAAQ,EAAO,MAAO,EAAI,CAAC,KAC3D,EAAO,UAAY,OAAY,CAAE,QAAS,EAAO,OAAQ,EAAI,CAAC,CACpE,EAMF,eAAsB,CAAe,CACnC,EACA,EACe,CACf,IAAM,EAAW,MAAM,EAAiB,CAAO,EAC/C,EAAe,EAAU,CAAC,GAAG,EAAG,UAAU,EAE1C,IAAI,EAAe,MAAM,EAAK,EAAS,EAAO,IAAI,EAC5C,EAAmB,EAAa,KAAK,CAAC,IAAQ,EAAI,YAAY,IAAM,UAAU,EACpF,GAAI,CAAC,EAAO,QAAU,CAAC,EAAQ,QAAU,EAAkB,CACzD,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,UAAW,CAAC,CAAC,EAC1D,IAAM,EAAe,MAAM,EAAiB,CAAO,EACnD,EAAe,EAAc,CAAC,GAAG,EAAG,UAAU,EAC9C,MAAM,EAAQ,SAAS,EAAO,GAAG,EACjC,EAAe,MAAM,EAAK,EAAS,EAAO,IAAI,EAGhD,GAAI,EAAO,KAAM,CACf,IAAM,EAAc,EAAO,YAAc,GACnC,EAAY,EAAQ,QAAU,EAAO,OAC3C,GAAI,GAAe,CAAC,EAClB,MAAM,IAAI,EACR,uHAEA,EACA,OACA,EACF,EAEF,MAAM,EAAa,EAAS,EAAO,KAAM,CAAY,GAOzD,eAAsB,CAAkB,CACtC,EACA,EACqB,CACrB,MAAM,EAAY,EAAS,CAAE,KAAM,YAAa,QAAS,EAAK,SAAS,IAAK,CAAC,EAC7E,IAAM,EAAW,MAAM,EAAiB,CAAO,EAC/C,EAAe,EAAU,CAAC,GAAG,EAAG,WAAW,EAE3C,IAAM,EAAqB,CAAC,EACtB,EAAqB,CAAC,EAE5B,QAAW,KAAa,EAAK,SAAS,GAGpC,GAFA,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,UAAW,QAAS,CAAU,CAAC,CAAC,GAC5D,MAAM,EAAiB,CAAO,GAClC,UACX,EAAS,KAAK,CAAS,EAEvB,OAAS,KAAK,CAAS,EAI3B,MAAM,EAAY,EAAS,CAAE,KAAM,MAAO,CAAC,EAC3C,IAAM,EAAW,MAAM,EAAiB,CAAO,EAC/C,EAAe,EAAU,CAAC,GAAG,EAAG,MAAM,EAEtC,IAAI,EACJ,GAAI,CACF,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,YAAa,QAAS,EAAK,GAAI,CAAC,CAAC,EAC9E,EAAY,MAAM,EAAiB,CAAO,EAC1C,MAAO,EAAK,CAGZ,GAFA,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,YAAa,QAAS,EAAK,GAAI,CAAC,CAAC,EAC9E,EAAY,MAAM,EAAiB,CAAO,EACtC,EAAU,QACZ,MAAM,EAKV,OAFA,EAAe,EAAW,CAAC,GAAG,EAAG,UAAU,EAEpC,CACL,UAAW,EAAK,UAChB,WACA,WACA,SAAU,EAAU,QACpB,SAAU,EAAK,QACjB,EAMF,eAAsB,CAAgB,CAAC,EAAuC,CAC5E,GAAI,CACF,MAAM,EAAY,EAAS,CAAE,KAAM,MAAO,CAAC,EAC3C,MAAM,EAAiB,CAAO,EAC9B,KAAM,SAEN,CACA,MAAM,EAAQ,MAAM,GAIxB,eAAe,CAAI,CAAC,EAAwB,EAAiC,CAC3E,MAAM,EAAY,EAAS,CAAE,KAAM,OAAQ,OAAQ,CAAK,CAAC,EACzD,IAAM,EAAW,MAAM,EAAiB,CAAO,EAE/C,OADA,EAAe,EAAU,CAAC,GAAG,EAAG,MAAM,EAC/B,EAAU,CAAQ,EAG3B,eAAe,CAAY,CACzB,EACA,EACA,EACe,CACf,GAAI,EAAK,OAAS,UAAY,EAAK,OAAQ,CAEzC,IAAM,EAAU,MADD,IAAI,EAAa,EAAK,MAAM,EACd,aAAa,EAC1C,MAAM,EAAY,EAAS,CAAE,KAAM,eAAgB,cAAe,CAAQ,CAAC,EAC3E,IAAI,EAAO,MAAM,EAAiB,CAAO,EACzC,GAAI,EAAK,OAAS,IAChB,MAAM,EAAQ,EAAS,EAAW,EAAE,CAAC,EACrC,EAAO,MAAM,EAAiB,CAAO,EAEvC,EAAe,EAAM,CAAC,GAAG,EAAG,cAAc,EAC1C,OAGF,IAAM,EAAS,EAAK,MAAQ,EAAiB,CAAY,EAEzD,GAAI,IAAW,WAAY,CACzB,IAAM,EAAO,EAAgB,EAAM,UAAU,EAC7C,MAAM,EAAY,EAAS,CAAE,KAAM,oBAAqB,CAAC,EACzD,IAAI,EAAO,MAAM,EAAiB,CAAO,EACzC,EAAe,EAAM,CAAC,GAAG,EAAG,eAAe,EAC3C,IAAM,EAAY,EAAK,QAAQ,KAAK,EAC9B,EAAW,MAAM,EAAe,EAAW,EAAK,KAAM,CAAI,EAChE,MAAM,EAAY,EAAS,CAAE,KAAM,yBAA0B,UAAS,CAAC,EACvE,EAAO,MAAM,EAAiB,CAAO,EACrC,EAAe,EAAM,CAAC,GAAG,EAAG,wBAAwB,EACpD,OAGF,GAAI,IAAW,QAAS,CACtB,IAAM,EAAO,EAAgB,EAAM,OAAO,EAC1C,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,aAAc,KAAM,EAAK,KAAM,MAAK,CAAC,CAAC,EACnF,IAAM,EAAO,MAAM,EAAiB,CAAO,EAC3C,EAAe,EAAM,CAAC,GAAG,EAAG,YAAY,EACxC,OAGF,IAAM,EAAO,EAAgB,EAAM,OAAO,EAC1C,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,aAAc,KAAM,EAAK,KAAM,MAAK,CAAC,CAAC,EACnF,IAAI,EAAO,MAAM,EAAiB,CAAO,EACzC,EAAe,EAAM,CAAC,GAAG,EAAG,YAAY,EAExC,MAAM,EAAQ,EAAS,EAAoB,EAAK,IAAI,CAAC,EACrD,EAAO,MAAM,EAAiB,CAAO,EACrC,EAAe,EAAM,CAAC,GAAG,EAAG,iBAAiB,EAE7C,MAAM,EAAQ,EAAS,EAAoB,CAAI,CAAC,EAChD,EAAO,MAAM,EAAiB,CAAO,EACrC,EAAe,EAAM,CAAC,GAAG,EAAG,iBAAiB,EAG/C,SAAS,CAAe,CAAC,EAAuC,EAAwB,CACtF,GAAI,CAAC,EAAK,KACR,MAAM,IAAI,EAAU,yBAAyB,mBAAyB,EAAG,QAAQ,IAAU,EAAE,EAE/F,OAAO,EAAK,KAGd,eAAe,CAAW,CACxB,EACA,EACe,CACf,MAAM,EAAQ,EAAS,EAAc,CAAO,CAAC,EAG/C,eAAe,CAAO,CAAC,EAAwB,EAAiC,CAC9E,MAAM,EAAQ,MAAM,CAAI,EAI1B,eAAe,CAAgB,CAAC,EAA+C,CAC7E,IAAM,EAAuB,CAAC,EAC9B,cAAiB,KAAS,EAAQ,KAAK,EAAG,CACxC,EAAO,KAAK,CAAK,EACjB,IAAM,EAAW,EAAmB,CAAM,EAC1C,GAAI,EACF,OAAO,EAAc,CAAQ,EAGjC,MAAM,IAAI,EAAU,gDAAiD,EAAG,OAAQ,EAAE,EAGpF,eAAe,CAAS,CAAC,EAAiC,CAExD,IAAM,EAAU,MADJ,KAAa,8BACC,UAAU,CAAM,EAC1C,GAAI,EAAQ,SAAW,EACrB,MAAM,IAAI,EAAU,qBAAqB,IAAU,EAAG,KAAM,EAAE,EAGhE,OADA,EAAQ,KAAK,CAAC,EAAyB,IAA4B,EAAE,SAAW,EAAE,QAAQ,EACnF,EAAQ,IAAI,UAAY",
+  "debugId": "B20B39B95D5ED1FD64756E2164756E21",
   "names": []
 }

package/dist/chunk-yp311efr.js

@@ -0,0 +1,4 @@
+import{$ as K,ba as M}from"./chunk-ywq6s10g.js";var V=["fcm.googleapis.com","android.googleapis.com","updates.push.services.mozilla.com","push.services.mozilla.com","web.push.apple.com"],W=[".push.services.mozilla.com",".notify.windows.com",".push.apple.com"];function g(C,G=[]){let z;try{z=new URL(C)}catch{throw Error("Invalid push subscription endpoint URL")}if(z.protocol!=="https:")throw Error("Push subscription endpoint must use https:");if(z.username||z.password)throw Error("Push subscription endpoint must not include credentials");let J=z.hostname.toLowerCase();if(Z(J))throw Error("Push subscription endpoint must not be an IP address");if(!Y(J,G))throw Error(`Push subscription endpoint host is not allowlisted: ${J}`)}async function j(C){try{let G=new URL(C),z=M(C),J=await crypto.subtle.digest("SHA-256",z.buffer.slice(z.byteOffset,z.byteOffset+z.byteLength)),Q=K(new Uint8Array(J).subarray(0,8));return`${G.origin}/#${Q}`}catch{return"[invalid-endpoint]"}}function Y(C,G){if(V.includes(C)||G.includes(C))return!0;return W.some((z)=>C.endsWith(z)&&C.length>z.length)}function Z(C){if(C.includes(":"))return!0;if(/^\d{1,3}(?:\.\d{1,3}){3}$/u.test(C))return!0;return!1}
+export{g as U,j as V};
+
+//# debugId=6BC361CE3959323764756E2164756E21

package/dist/chunk-yp311efr.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/core/push-endpoint.ts"],
+  "sourcesContent": [
+    "/**\n * @module\n * Push subscription endpoint safety and hook redaction helpers.\n *\n * Full push endpoints embed long-lived delivery tokens. Never put the raw URL\n * in logs or hook context — use {@link redactPushEndpoint} instead.\n */\n\nimport { encodeBase64Url, encodeUtf8 } from \"./base64.js\";\n\n/**\n * Built-in hosts for major browser push services.\n * Custom hosts can be added via {@link WebPushConfig.allowedEndpointHosts}.\n */\nexport const DEFAULT_PUSH_ENDPOINT_HOSTS: readonly string[] = [\n  \"fcm.googleapis.com\",\n  \"android.googleapis.com\",\n  \"updates.push.services.mozilla.com\",\n  \"push.services.mozilla.com\",\n  \"web.push.apple.com\",\n];\n\n/** Suffix patterns for regional / vendor push hosts. */\nconst DEFAULT_PUSH_ENDPOINT_SUFFIXES: readonly string[] = [\n  \".push.services.mozilla.com\",\n  \".notify.windows.com\",\n  \".push.apple.com\",\n];\n\n/**\n * Validate a push subscription endpoint before server-side fetch.\n *\n * Rejects non-HTTPS schemes, IP literals (including link-local / private),\n * and hostnames outside the allowlist — mitigates SSRF when subscriptions\n * come from untrusted clients.\n *\n * @param endpoint - Raw subscription endpoint URL.\n * @param extraHosts - Additional exact hostnames to allow.\n * @throws Error when the endpoint is unsafe.\n */\nexport function assertSafePushEndpoint(endpoint: string, extraHosts: readonly string[] = []): void {\n  let url: URL;\n  try {\n    url = new URL(endpoint);\n  } catch {\n    throw new Error(\"Invalid push subscription endpoint URL\");\n  }\n\n  if (url.protocol !== \"https:\") {\n    throw new Error(\"Push subscription endpoint must use https:\");\n  }\n\n  if (url.username || url.password) {\n    throw new Error(\"Push subscription endpoint must not include credentials\");\n  }\n\n  const host = url.hostname.toLowerCase();\n\n  if (isIpLiteral(host)) {\n    throw new Error(\"Push subscription endpoint must not be an IP address\");\n  }\n\n  if (!isAllowedPushHost(host, extraHosts)) {\n    throw new Error(`Push subscription endpoint host is not allowlisted: ${host}`);\n  }\n}\n\n/**\n * Redact a push endpoint for hook/observability context.\n * Returns `origin/#<8-byte-hash>` so logs never store the delivery token path.\n */\nexport async function redactPushEndpoint(endpoint: string): Promise<string> {\n  try {\n    const url = new URL(endpoint);\n    const bytes = encodeUtf8(endpoint);\n    const digest = await crypto.subtle.digest(\n      \"SHA-256\",\n      bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength) as ArrayBuffer,\n    );\n    const short = encodeBase64Url(new Uint8Array(digest).subarray(0, 8));\n    return `${url.origin}/#${short}`;\n  } catch {\n    return \"[invalid-endpoint]\";\n  }\n}\n\nfunction isAllowedPushHost(host: string, extraHosts: readonly string[]): boolean {\n  if (DEFAULT_PUSH_ENDPOINT_HOSTS.includes(host) || extraHosts.includes(host)) {\n    return true;\n  }\n  return DEFAULT_PUSH_ENDPOINT_SUFFIXES.some(\n    (suffix) => host.endsWith(suffix) && host.length > suffix.length,\n  );\n}\n\nfunction isIpLiteral(host: string): boolean {\n  // IPv6 in URLs is bracketed; URL.hostname strips brackets.\n  if (host.includes(\":\")) {\n    return true;\n  }\n  // IPv4 dotted-quad\n  if (/^\\d{1,3}(?:\\.\\d{1,3}){3}$/u.test(host)) {\n    return true;\n  }\n  return false;\n}\n"
+  ],
+  "mappings": "gDAcO,IAAM,EAAiD,CAC5D,qBACA,yBACA,oCACA,4BACA,oBACF,EAGM,EAAoD,CACxD,6BACA,sBACA,iBACF,EAaO,SAAS,CAAsB,CAAC,EAAkB,EAAgC,CAAC,EAAS,CACjG,IAAI,EACJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAQ,EACtB,KAAM,CACN,MAAU,MAAM,wCAAwC,EAG1D,GAAI,EAAI,WAAa,SACnB,MAAU,MAAM,4CAA4C,EAG9D,GAAI,EAAI,UAAY,EAAI,SACtB,MAAU,MAAM,yDAAyD,EAG3E,IAAM,EAAO,EAAI,SAAS,YAAY,EAEtC,GAAI,EAAY,CAAI,EAClB,MAAU,MAAM,sDAAsD,EAGxE,GAAI,CAAC,EAAkB,EAAM,CAAU,EACrC,MAAU,MAAM,uDAAuD,GAAM,EAQjF,eAAsB,CAAkB,CAAC,EAAmC,CAC1E,GAAI,CACF,IAAM,EAAM,IAAI,IAAI,CAAQ,EACtB,EAAQ,EAAW,CAAQ,EAC3B,EAAS,MAAM,OAAO,OAAO,OACjC,UACA,EAAM,OAAO,MAAM,EAAM,WAAY,EAAM,WAAa,EAAM,UAAU,CAC1E,EACM,EAAQ,EAAgB,IAAI,WAAW,CAAM,EAAE,SAAS,EAAG,CAAC,CAAC,EACnE,MAAO,GAAG,EAAI,WAAW,IACzB,KAAM,CACN,MAAO,sBAIX,SAAS,CAAiB,CAAC,EAAc,EAAwC,CAC/E,GAAI,EAA4B,SAAS,CAAI,GAAK,EAAW,SAAS,CAAI,EACxE,MAAO,GAET,OAAO,EAA+B,KACpC,CAAC,IAAW,EAAK,SAAS,CAAM,GAAK,EAAK,OAAS,EAAO,MAC5D,EAGF,SAAS,CAAW,CAAC,EAAuB,CAE1C,GAAI,EAAK,SAAS,GAAG,EACnB,MAAO,GAGT,GAAI,6BAA6B,KAAK,CAAI,EACxC,MAAO,GAET,MAAO",
+  "debugId": "6BC361CE3959323764756E2164756E21",
+  "names": []
+}

package/dist/chunk-ywq6s10g.js

@@ -0,0 +1,5 @@
+var M=new TextEncoder;function N(j){let f=typeof j==="string"?M.encode(j):j,k="",G=0;while(G<f.length){let q=f[G]??0,A=f[G+1],D=f[G+2];if(A===void 0){k+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[q>>2],k+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[(q&3)<<4],k+="==";break}if(D===void 0){k+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[q>>2],k+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[(q&3)<<4|A>>4],k+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[(A&15)<<2],k+="=";break}k+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[q>>2],k+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[(q&3)<<4|A>>4],k+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[(A&15)<<2|D>>6],k+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[D&63],G+=3}return X(k)}function S(j){let f=j.replace(/\s/g,""),k=f.length;if(k===0)return new Uint8Array(0);if(k%4!==0)throw Error("Invalid base64 string length");let G=f.endsWith("==")?2:f.endsWith("=")?1:0,q=k*3/4-G,A=new Uint8Array(q),D=0;for(let H=0;H<k;H+=4){let O=J(f[H]??"="),P=J(f[H+1]??"="),Q=J(f[H+2]??"="),R=J(f[H+3]??"="),K=O<<18|P<<12|Q<<6|R;if(D<q)A[D++]=K>>16&255;if(D<q)A[D++]=K>>8&255;if(D<q)A[D++]=K&255}return A}function Y(j){if(!W(j))return j;return`=?UTF-8?B?${N(j).replace(/\r\n/g,"")}?=`}function W(j){for(let f=0;f<j.length;f++)if(j.charCodeAt(f)>127)return!0;return!1}function J(j){if(j==="=")return 0;let f="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".indexOf(j);if(f===-1)throw Error(`Invalid base64 character: ${j}`);return f}function X(j){let f=[];for(let k=0;k<j.length;k+=76)f.push(j.slice(k,k+76));return f.join(`\r
+`)}function Z(j){return N(j).replace(/\r\n/g,"").replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/u,"")}function _(j){let f=j.replace(/-/g,"+").replace(/_/g,"/"),k=f.length%4===0?"":"=".repeat(4-f.length%4);return S(f+k)}function $(j){return M.encode(j)}
+export{N as Y,S as Z,Y as _,Z as $,_ as aa,$ as ba};
+
+//# debugId=2107CB27BCD4972964756E2164756E21

package/dist/{chunk-5scdgffb.js.map → chunk-ywq6s10g.js.map}

@@ -2,9 +2,9 @@
   "version": 3,
   "sources": ["../src/core/base64.ts"],
   "sourcesContent": [
-    "// src/core/base64.ts\n\nconst BASE64_CHARS = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\nconst BASE64_LINE_LENGTH = 76;\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\n/**\n * Encode a Uint8Array or string to Base64.\n * Uses TextEncoder + manual base64 to support binary data correctly.\n */\nexport function encodeBase64(data: Uint8Array | string): string {\n  const bytes = typeof data === \"string\" ? encoder.encode(data) : data;\n  let result = \"\";\n  let i = 0;\n\n  while (i < bytes.length) {\n    const b0 = bytes[i] ?? 0;\n    const b1 = bytes[i + 1];\n    const b2 = bytes[i + 2];\n\n    if (b1 === undefined) {\n      result += BASE64_CHARS[b0 >> 2];\n      result += BASE64_CHARS[(b0 & 0x03) << 4];\n      result += \"==\";\n      break;\n    }\n\n    if (b2 === undefined) {\n      result += BASE64_CHARS[b0 >> 2];\n      result += BASE64_CHARS[((b0 & 0x03) << 4) | (b1 >> 4)];\n      result += BASE64_CHARS[(b1 & 0x0f) << 2];\n      result += \"=\";\n      break;\n    }\n\n    result += BASE64_CHARS[b0 >> 2];\n    result += BASE64_CHARS[((b0 & 0x03) << 4) | (b1 >> 4)];\n    result += BASE64_CHARS[((b1 & 0x0f) << 2) | (b2 >> 6)];\n    result += BASE64_CHARS[b2 & 0x3f];\n    i += 3;\n  }\n\n  return wrapBase64Lines(result);\n}\n\n/**\n * Decode a Base64 string to Uint8Array.\n */\nexport function decodeBase64(data: string): Uint8Array {\n  const cleaned = data.replace(/\\s/g, \"\");\n  const len = cleaned.length;\n\n  if (len === 0) {\n    return new Uint8Array(0);\n  }\n\n  if (len % 4 !== 0) {\n    throw new Error(\"Invalid base64 string length\");\n  }\n\n  const padding = cleaned.endsWith(\"==\") ? 2 : cleaned.endsWith(\"=\") ? 1 : 0;\n  const outputLen = (len * 3) / 4 - padding;\n  const output = new Uint8Array(outputLen);\n\n  let outIndex = 0;\n  for (let i = 0; i < len; i += 4) {\n    const c0 = base64CharToValue(cleaned[i] ?? \"=\");\n    const c1 = base64CharToValue(cleaned[i + 1] ?? \"=\");\n    const c2 = base64CharToValue(cleaned[i + 2] ?? \"=\");\n    const c3 = base64CharToValue(cleaned[i + 3] ?? \"=\");\n    const triple = (c0 << 18) | (c1 << 12) | (c2 << 6) | c3;\n\n    if (outIndex < outputLen) {\n      output[outIndex++] = (triple >> 16) & 0xff;\n    }\n    if (outIndex < outputLen) {\n      output[outIndex++] = (triple >> 8) & 0xff;\n    }\n    if (outIndex < outputLen) {\n      output[outIndex++] = triple & 0xff;\n    }\n  }\n\n  return output;\n}\n\n/**\n * Encode text using Quoted-Printable (RFC 2045).\n */\nexport function encodeQP(text: string): string {\n  const bytes = encoder.encode(text);\n  const lines: string[] = [];\n  let line = \"\";\n\n  for (let i = 0; i < bytes.length; i++) {\n    const byte = bytes[i] ?? 0;\n\n    if (byte === 0x0a) {\n      lines.push(line);\n      line = \"\";\n      continue;\n    }\n\n    if (byte === 0x0d) {\n      continue;\n    }\n\n    let encoded: string;\n    if (\n      (byte >= 33 && byte <= 60) ||\n      (byte >= 62 && byte <= 126) ||\n      byte === 0x09 ||\n      byte === 0x20\n    ) {\n      encoded = String.fromCharCode(byte);\n    } else {\n      encoded = `=${byte.toString(16).toUpperCase().padStart(2, \"0\")}`;\n    }\n\n    if (line.length + encoded.length > 75) {\n      lines.push(`${line}=`);\n      line = encoded;\n    } else {\n      line += encoded;\n    }\n  }\n\n  if (line.length > 0) {\n    lines.push(line);\n  }\n\n  return lines.join(\"\\r\\n\");\n}\n\n/**\n * Encode an email header value per RFC 2047.\n * Non-ASCII values become: =?UTF-8?B?<base64>?=\n */\nexport function encodeHeader(value: string): string {\n  if (!needsEncoding(value)) {\n    return value;\n  }\n\n  const encoded = encodeBase64(value).replace(/\\r\\n/g, \"\");\n  return `=?UTF-8?B?${encoded}?=`;\n}\n\n/**\n * Returns true if the string contains non-ASCII characters\n * and therefore requires RFC 2047 encoding in headers.\n */\nexport function needsEncoding(text: string): boolean {\n  for (let i = 0; i < text.length; i++) {\n    if (text.charCodeAt(i) > 127) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction base64CharToValue(char: string): number {\n  if (char === \"=\") {\n    return 0;\n  }\n  const index = BASE64_CHARS.indexOf(char);\n  if (index === -1) {\n    throw new Error(`Invalid base64 character: ${char}`);\n  }\n  return index;\n}\n\nfunction wrapBase64Lines(base64: string): string {\n  const lines: string[] = [];\n  for (let i = 0; i < base64.length; i += BASE64_LINE_LENGTH) {\n    lines.push(base64.slice(i, i + BASE64_LINE_LENGTH));\n  }\n  return lines.join(\"\\r\\n\");\n}\n\n/** Decode bytes to UTF-8 string. */\nexport function decodeUtf8(bytes: Uint8Array): string {\n  return decoder.decode(bytes);\n}\n\n/** Encode string to UTF-8 bytes. */\nexport function encodeUtf8(text: string): Uint8Array {\n  return encoder.encode(text);\n}\n"
+    "// src/core/base64.ts\n\nconst BASE64_CHARS = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\nconst BASE64_LINE_LENGTH = 76;\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\n/**\n * Encode a Uint8Array or string to Base64.\n * Uses TextEncoder + manual base64 to support binary data correctly.\n */\nexport function encodeBase64(data: Uint8Array | string): string {\n  const bytes = typeof data === \"string\" ? encoder.encode(data) : data;\n  let result = \"\";\n  let i = 0;\n\n  while (i < bytes.length) {\n    const b0 = bytes[i] ?? 0;\n    const b1 = bytes[i + 1];\n    const b2 = bytes[i + 2];\n\n    if (b1 === undefined) {\n      result += BASE64_CHARS[b0 >> 2];\n      result += BASE64_CHARS[(b0 & 0x03) << 4];\n      result += \"==\";\n      break;\n    }\n\n    if (b2 === undefined) {\n      result += BASE64_CHARS[b0 >> 2];\n      result += BASE64_CHARS[((b0 & 0x03) << 4) | (b1 >> 4)];\n      result += BASE64_CHARS[(b1 & 0x0f) << 2];\n      result += \"=\";\n      break;\n    }\n\n    result += BASE64_CHARS[b0 >> 2];\n    result += BASE64_CHARS[((b0 & 0x03) << 4) | (b1 >> 4)];\n    result += BASE64_CHARS[((b1 & 0x0f) << 2) | (b2 >> 6)];\n    result += BASE64_CHARS[b2 & 0x3f];\n    i += 3;\n  }\n\n  return wrapBase64Lines(result);\n}\n\n/**\n * Decode a Base64 string to Uint8Array.\n */\nexport function decodeBase64(data: string): Uint8Array {\n  const cleaned = data.replace(/\\s/g, \"\");\n  const len = cleaned.length;\n\n  if (len === 0) {\n    return new Uint8Array(0);\n  }\n\n  if (len % 4 !== 0) {\n    throw new Error(\"Invalid base64 string length\");\n  }\n\n  const padding = cleaned.endsWith(\"==\") ? 2 : cleaned.endsWith(\"=\") ? 1 : 0;\n  const outputLen = (len * 3) / 4 - padding;\n  const output = new Uint8Array(outputLen);\n\n  let outIndex = 0;\n  for (let i = 0; i < len; i += 4) {\n    const c0 = base64CharToValue(cleaned[i] ?? \"=\");\n    const c1 = base64CharToValue(cleaned[i + 1] ?? \"=\");\n    const c2 = base64CharToValue(cleaned[i + 2] ?? \"=\");\n    const c3 = base64CharToValue(cleaned[i + 3] ?? \"=\");\n    const triple = (c0 << 18) | (c1 << 12) | (c2 << 6) | c3;\n\n    if (outIndex < outputLen) {\n      output[outIndex++] = (triple >> 16) & 0xff;\n    }\n    if (outIndex < outputLen) {\n      output[outIndex++] = (triple >> 8) & 0xff;\n    }\n    if (outIndex < outputLen) {\n      output[outIndex++] = triple & 0xff;\n    }\n  }\n\n  return output;\n}\n\n/**\n * Encode text using Quoted-Printable (RFC 2045).\n */\nexport function encodeQP(text: string): string {\n  const bytes = encoder.encode(text);\n  const lines: string[] = [];\n  let line = \"\";\n\n  for (let i = 0; i < bytes.length; i++) {\n    const byte = bytes[i] ?? 0;\n\n    if (byte === 0x0a) {\n      lines.push(line);\n      line = \"\";\n      continue;\n    }\n\n    if (byte === 0x0d) {\n      continue;\n    }\n\n    let encoded: string;\n    if (\n      (byte >= 33 && byte <= 60) ||\n      (byte >= 62 && byte <= 126) ||\n      byte === 0x09 ||\n      byte === 0x20\n    ) {\n      encoded = String.fromCharCode(byte);\n    } else {\n      encoded = `=${byte.toString(16).toUpperCase().padStart(2, \"0\")}`;\n    }\n\n    if (line.length + encoded.length > 75) {\n      lines.push(`${line}=`);\n      line = encoded;\n    } else {\n      line += encoded;\n    }\n  }\n\n  if (line.length > 0) {\n    lines.push(line);\n  }\n\n  return lines.join(\"\\r\\n\");\n}\n\n/**\n * Encode an email header value per RFC 2047.\n * Non-ASCII values become: =?UTF-8?B?<base64>?=\n */\nexport function encodeHeader(value: string): string {\n  if (!needsEncoding(value)) {\n    return value;\n  }\n\n  const encoded = encodeBase64(value).replace(/\\r\\n/g, \"\");\n  return `=?UTF-8?B?${encoded}?=`;\n}\n\n/**\n * Returns true if the string contains non-ASCII characters\n * and therefore requires RFC 2047 encoding in headers.\n */\nexport function needsEncoding(text: string): boolean {\n  for (let i = 0; i < text.length; i++) {\n    if (text.charCodeAt(i) > 127) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction base64CharToValue(char: string): number {\n  if (char === \"=\") {\n    return 0;\n  }\n  const index = BASE64_CHARS.indexOf(char);\n  if (index === -1) {\n    throw new Error(`Invalid base64 character: ${char}`);\n  }\n  return index;\n}\n\nfunction wrapBase64Lines(base64: string): string {\n  const lines: string[] = [];\n  for (let i = 0; i < base64.length; i += BASE64_LINE_LENGTH) {\n    lines.push(base64.slice(i, i + BASE64_LINE_LENGTH));\n  }\n  return lines.join(\"\\r\\n\");\n}\n\n/**\n * Encode bytes to Base64url (RFC 4648 §5) without padding.\n * Used by Web Push (VAPID / RFC 8291) and similar protocols.\n */\nexport function encodeBase64Url(data: Uint8Array | string): string {\n  const encoded = encodeBase64(data).replace(/\\r\\n/g, \"\");\n  return encoded.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/u, \"\");\n}\n\n/**\n * Decode a Base64url (RFC 4648 §5) string to bytes.\n * Accepts both padded and unpadded input.\n */\nexport function decodeBase64Url(data: string): Uint8Array {\n  const normalized = data.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const padding = normalized.length % 4 === 0 ? \"\" : \"=\".repeat(4 - (normalized.length % 4));\n  return decodeBase64(normalized + padding);\n}\n\n/** Decode bytes to UTF-8 string. */\nexport function decodeUtf8(bytes: Uint8Array): string {\n  return decoder.decode(bytes);\n}\n\n/** Encode string to UTF-8 bytes. */\nexport function encodeUtf8(text: string): Uint8Array {\n  return encoder.encode(text);\n}\n"
   ],
-  "mappings": "AAKA,IAAM,EAAU,IAAI,YAOb,SAAS,CAAY,CAAC,EAAmC,CAC9D,IAAM,EAAQ,OAAO,IAAS,SAAW,EAAQ,OAAO,CAAI,EAAI,EAC5D,EAAS,GACT,EAAI,EAER,MAAO,EAAI,EAAM,OAAQ,CACvB,IAAM,EAAK,EAAM,IAAM,EACjB,EAAK,EAAM,EAAI,GACf,EAAK,EAAM,EAAI,GAErB,GAAI,IAAO,OAAW,CACpB,GArBe,mEAqBQ,GAAM,GAC7B,GAtBe,mEAsBS,GAAK,IAAS,GACtC,GAAU,KACV,MAGF,GAAI,IAAO,OAAW,CACpB,GA5Be,mEA4BQ,GAAM,GAC7B,GA7Be,mEA6BU,GAAK,IAAS,EAAM,GAAM,GACnD,GA9Be,mEA8BS,GAAK,KAAS,GACtC,GAAU,IACV,MAGF,GAnCiB,mEAmCM,GAAM,GAC7B,GApCiB,mEAoCQ,GAAK,IAAS,EAAM,GAAM,GACnD,GArCiB,mEAqCQ,GAAK,KAAS,EAAM,GAAM,GACnD,GAtCiB,mEAsCM,EAAK,IAC5B,GAAK,EAGP,OAAO,EAAgB,CAAM,EAMxB,SAAS,CAAY,CAAC,EAA0B,CACrD,IAAM,EAAU,EAAK,QAAQ,MAAO,EAAE,EAChC,EAAM,EAAQ,OAEpB,GAAI,IAAQ,EACV,OAAO,IAAI,WAAW,CAAC,EAGzB,GAAI,EAAM,IAAM,EACd,MAAU,MAAM,8BAA8B,EAGhD,IAAM,EAAU,EAAQ,SAAS,IAAI,EAAI,EAAI,EAAQ,SAAS,GAAG,EAAI,EAAI,EACnE,EAAa,EAAM,EAAK,EAAI,EAC5B,EAAS,IAAI,WAAW,CAAS,EAEnC,EAAW,EACf,QAAS,EAAI,EAAG,EAAI,EAAK,GAAK,EAAG,CAC/B,IAAM,EAAK,EAAkB,EAAQ,IAAM,GAAG,EACxC,EAAK,EAAkB,EAAQ,EAAI,IAAM,GAAG,EAC5C,EAAK,EAAkB,EAAQ,EAAI,IAAM,GAAG,EAC5C,EAAK,EAAkB,EAAQ,EAAI,IAAM,GAAG,EAC5C,EAAU,GAAM,GAAO,GAAM,GAAO,GAAM,EAAK,EAErD,GAAI,EAAW,EACb,EAAO,KAAe,GAAU,GAAM,IAExC,GAAI,EAAW,EACb,EAAO,KAAe,GAAU,EAAK,IAEvC,GAAI,EAAW,EACb,EAAO,KAAc,EAAS,IAIlC,OAAO,EAuDF,SAAS,CAAY,CAAC,EAAuB,CAClD,GAAI,CAAC,EAAc,CAAK,EACtB,OAAO,EAIT,MAAO,aADS,EAAa,CAAK,EAAE,QAAQ,QAAS,EAAE,MAQlD,SAAS,CAAa,CAAC,EAAuB,CACnD,QAAS,EAAI,EAAG,EAAI,EAAK,OAAQ,IAC/B,GAAI,EAAK,WAAW,CAAC,EAAI,IACvB,MAAO,GAGX,MAAO,GAGT,SAAS,CAAiB,CAAC,EAAsB,CAC/C,GAAI,IAAS,IACX,MAAO,GAET,IAAM,EApKa,mEAoKQ,QAAQ,CAAI,EACvC,GAAI,IAAU,GACZ,MAAU,MAAM,6BAA6B,GAAM,EAErD,OAAO,EAGT,SAAS,CAAe,CAAC,EAAwB,CAC/C,IAAM,EAAkB,CAAC,EACzB,QAAS,EAAI,EAAG,EAAI,EAAO,OAAQ,GA5KV,GA6KvB,EAAM,KAAK,EAAO,MAAM,EAAG,EA7KJ,EA6K0B,CAAC,EAEpD,OAAO,EAAM,KAAK;AAAA,CAAM,EASnB,SAAS,CAAU,CAAC,EAA0B,CACnD,OAAO,EAAQ,OAAO,CAAI",
-  "debugId": "4A06DB0A7917D84164756E2164756E21",
+  "mappings": "AAKA,IAAM,EAAU,IAAI,YAOb,SAAS,CAAY,CAAC,EAAmC,CAC9D,IAAM,EAAQ,OAAO,IAAS,SAAW,EAAQ,OAAO,CAAI,EAAI,EAC5D,EAAS,GACT,EAAI,EAER,MAAO,EAAI,EAAM,OAAQ,CACvB,IAAM,EAAK,EAAM,IAAM,EACjB,EAAK,EAAM,EAAI,GACf,EAAK,EAAM,EAAI,GAErB,GAAI,IAAO,OAAW,CACpB,GArBe,mEAqBQ,GAAM,GAC7B,GAtBe,mEAsBS,GAAK,IAAS,GACtC,GAAU,KACV,MAGF,GAAI,IAAO,OAAW,CACpB,GA5Be,mEA4BQ,GAAM,GAC7B,GA7Be,mEA6BU,GAAK,IAAS,EAAM,GAAM,GACnD,GA9Be,mEA8BS,GAAK,KAAS,GACtC,GAAU,IACV,MAGF,GAnCiB,mEAmCM,GAAM,GAC7B,GApCiB,mEAoCQ,GAAK,IAAS,EAAM,GAAM,GACnD,GArCiB,mEAqCQ,GAAK,KAAS,EAAM,GAAM,GACnD,GAtCiB,mEAsCM,EAAK,IAC5B,GAAK,EAGP,OAAO,EAAgB,CAAM,EAMxB,SAAS,CAAY,CAAC,EAA0B,CACrD,IAAM,EAAU,EAAK,QAAQ,MAAO,EAAE,EAChC,EAAM,EAAQ,OAEpB,GAAI,IAAQ,EACV,OAAO,IAAI,WAAW,CAAC,EAGzB,GAAI,EAAM,IAAM,EACd,MAAU,MAAM,8BAA8B,EAGhD,IAAM,EAAU,EAAQ,SAAS,IAAI,EAAI,EAAI,EAAQ,SAAS,GAAG,EAAI,EAAI,EACnE,EAAa,EAAM,EAAK,EAAI,EAC5B,EAAS,IAAI,WAAW,CAAS,EAEnC,EAAW,EACf,QAAS,EAAI,EAAG,EAAI,EAAK,GAAK,EAAG,CAC/B,IAAM,EAAK,EAAkB,EAAQ,IAAM,GAAG,EACxC,EAAK,EAAkB,EAAQ,EAAI,IAAM,GAAG,EAC5C,EAAK,EAAkB,EAAQ,EAAI,IAAM,GAAG,EAC5C,EAAK,EAAkB,EAAQ,EAAI,IAAM,GAAG,EAC5C,EAAU,GAAM,GAAO,GAAM,GAAO,GAAM,EAAK,EAErD,GAAI,EAAW,EACb,EAAO,KAAe,GAAU,GAAM,IAExC,GAAI,EAAW,EACb,EAAO,KAAe,GAAU,EAAK,IAEvC,GAAI,EAAW,EACb,EAAO,KAAc,EAAS,IAIlC,OAAO,EAuDF,SAAS,CAAY,CAAC,EAAuB,CAClD,GAAI,CAAC,EAAc,CAAK,EACtB,OAAO,EAIT,MAAO,aADS,EAAa,CAAK,EAAE,QAAQ,QAAS,EAAE,MAQlD,SAAS,CAAa,CAAC,EAAuB,CACnD,QAAS,EAAI,EAAG,EAAI,EAAK,OAAQ,IAC/B,GAAI,EAAK,WAAW,CAAC,EAAI,IACvB,MAAO,GAGX,MAAO,GAGT,SAAS,CAAiB,CAAC,EAAsB,CAC/C,GAAI,IAAS,IACX,MAAO,GAET,IAAM,EApKa,mEAoKQ,QAAQ,CAAI,EACvC,GAAI,IAAU,GACZ,MAAU,MAAM,6BAA6B,GAAM,EAErD,OAAO,EAGT,SAAS,CAAe,CAAC,EAAwB,CAC/C,IAAM,EAAkB,CAAC,EACzB,QAAS,EAAI,EAAG,EAAI,EAAO,OAAQ,GA5KV,GA6KvB,EAAM,KAAK,EAAO,MAAM,EAAG,EA7KJ,EA6K0B,CAAC,EAEpD,OAAO,EAAM,KAAK;AAAA,CAAM,EAOnB,SAAS,CAAe,CAAC,EAAmC,CAEjE,OADgB,EAAa,CAAI,EAAE,QAAQ,QAAS,EAAE,EACvC,QAAQ,MAAO,GAAG,EAAE,QAAQ,MAAO,GAAG,EAAE,QAAQ,OAAQ,EAAE,EAOpE,SAAS,CAAe,CAAC,EAA0B,CACxD,IAAM,EAAa,EAAK,QAAQ,KAAM,GAAG,EAAE,QAAQ,KAAM,GAAG,EACtD,EAAU,EAAW,OAAS,IAAM,EAAI,GAAK,IAAI,OAAO,EAAK,EAAW,OAAS,CAAE,EACzF,OAAO,EAAa,EAAa,CAAO,EASnC,SAAS,CAAU,CAAC,EAA0B,CACnD,OAAO,EAAQ,OAAO,CAAI",
+  "debugId": "2107CB27BCD4972964756E2164756E21",
   "names": []
 }

package/dist/core/base64.d.ts

@@ -21,6 +21,16 @@ export declare function encodeHeader(value: string): string;
  * and therefore requires RFC 2047 encoding in headers.
  */
 export declare function needsEncoding(text: string): boolean;
+/**
+ * Encode bytes to Base64url (RFC 4648 §5) without padding.
+ * Used by Web Push (VAPID / RFC 8291) and similar protocols.
+ */
+export declare function encodeBase64Url(data: Uint8Array | string): string;
+/**
+ * Decode a Base64url (RFC 4648 §5) string to bytes.
+ * Accepts both padded and unpadded input.
+ */
+export declare function decodeBase64Url(data: string): Uint8Array;
 /** Decode bytes to UTF-8 string. */
 export declare function decodeUtf8(bytes: Uint8Array): string;
 /** Encode string to UTF-8 bytes. */

package/dist/core/errors.js

@@ -1,3 +1,3 @@
-import{X as a,Y as b,Z as c}from"../chunk-6bkj4y4r.js";import"../chunk-nbmq8ejv.js";export{c as smtpCodeToSentlyCode,b as httpStatusToSentlyCode,a as SentlyError};
+import{ca as a,da as b,ea as c}from"../chunk-tamww15j.js";import"../chunk-6npp3x3c.js";export{c as smtpCodeToSentlyCode,b as httpStatusToSentlyCode,a as SentlyError};
 
-//# debugId=EA669FFC2ACB394064756E2164756E21
+//# debugId=8BB8C05CE319F39464756E2164756E21

package/dist/core/errors.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "EA669FFC2ACB394064756E2164756E21",
+  "debugId": "8BB8C05CE319F39464756E2164756E21",
   "names": []
 }

package/dist/core/hooks.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @module
+ * Shared lifecycle hook invocation for mailer and channel senders.
+ * Hook failures are swallowed so they never break the send path.
+ */
+/**
+ * Invoke a lifecycle hook without letting hook failures break the send.
+ * In non-production environments, hook errors are logged with `console.warn`.
+ *
+ * @typeParam T - Hook argument tuple types.
+ * @param hook - Optional sync or async hook callback.
+ * @param args - Arguments forwarded to the hook.
+ */
+export declare function invokeHook<T extends unknown[]>(hook: ((...args: T) => void | Promise<void>) | undefined, ...args: T): Promise<void>;

package/dist/core/plugin.d.ts

@@ -1,7 +1,7 @@
 /**
  * @module
- * Plugin pipeline for sently.
- * Plugins transform MailOptions before message construction.
+ * Plugin pipeline for sently channel senders.
+ * Plugins transform channel options before the transport sends.
  * They run sequentially — each receives the previous plugin's output.
  *
  * @example
@@ -10,14 +10,14 @@
  * const result = await runPlugins(options, [pluginA, pluginB]);
  * ```
  */
-import type { MailOptions, MailPlugin } from "./types.js";
 /**
- * Run a list of plugins sequentially over MailOptions.
+ * Run a list of plugins sequentially over channel options.
  * If plugins is empty or undefined, returns options unchanged.
  * Each plugin may be sync or async.
  *
- * @param options - the original mail options
+ * @typeParam T - Channel options type (e.g. MailOptions, SmsOptions).
+ * @param options - the original options
  * @param plugins - ordered list of plugins to apply
- * @returns transformed mail options after all plugins have run
+ * @returns transformed options after all plugins have run
  */
-export declare function runPlugins(options: MailOptions, plugins: MailPlugin[] | undefined): Promise<MailOptions>;
+export declare function runPlugins<T>(options: T, plugins: Array<(o: T) => T | Promise<T>> | undefined): Promise<T>;

package/dist/core/push-endpoint.d.ts

@@ -0,0 +1,29 @@
+/**
+ * @module
+ * Push subscription endpoint safety and hook redaction helpers.
+ *
+ * Full push endpoints embed long-lived delivery tokens. Never put the raw URL
+ * in logs or hook context — use {@link redactPushEndpoint} instead.
+ */
+/**
+ * Built-in hosts for major browser push services.
+ * Custom hosts can be added via {@link WebPushConfig.allowedEndpointHosts}.
+ */
+export declare const DEFAULT_PUSH_ENDPOINT_HOSTS: readonly string[];
+/**
+ * Validate a push subscription endpoint before server-side fetch.
+ *
+ * Rejects non-HTTPS schemes, IP literals (including link-local / private),
+ * and hostnames outside the allowlist — mitigates SSRF when subscriptions
+ * come from untrusted clients.
+ *
+ * @param endpoint - Raw subscription endpoint URL.
+ * @param extraHosts - Additional exact hostnames to allow.
+ * @throws Error when the endpoint is unsafe.
+ */
+export declare function assertSafePushEndpoint(endpoint: string, extraHosts?: readonly string[]): void;
+/**
+ * Redact a push endpoint for hook/observability context.
+ * Returns `origin/#<8-byte-hash>` so logs never store the delivery token path.
+ */
+export declare function redactPushEndpoint(endpoint: string): Promise<string>;

package/dist/core/push-types.d.ts

@@ -0,0 +1,98 @@
+/**
+ * @module
+ * Shared Web Push channel contracts — sibling types to email MailOptions/Transport/Hooks.
+ *
+ * Sently-first: this contract is the stable push surface. Provider transports
+ * implement {@link PushTransport}.
+ */
+import type { VerifyResult } from "./types.js";
+/** Browser push subscription as returned by the Push API. */
+export interface PushSubscription {
+    /** Push service endpoint URL. */
+    endpoint: string;
+    /** Client encryption keys for RFC 8291 payload encryption. */
+    keys: {
+        /** Base64url-encoded P-256 ECDH public key. */
+        p256dh: string;
+        /** Base64url-encoded authentication secret. */
+        auth: string;
+    };
+}
+/** Options for sending a Web Push notification. */
+export interface PushOptions {
+    /** Target browser push subscription. */
+    subscription: PushSubscription;
+    /** Notification title. */
+    title: string;
+    /** Notification body text. */
+    body: string;
+    /** Arbitrary application data attached to the notification. */
+    data?: Record<string, unknown>;
+    /** Notification icon URL. */
+    icon?: string;
+    /** Time-to-live in seconds for the push message. */
+    ttl?: number;
+    /** Client-supplied message identifier when known. */
+    messageId?: string;
+}
+/** Result returned after a push notification is accepted by the push service. */
+export interface PushSendResult {
+    /** Client-generated or assigned message identifier. */
+    messageId: string;
+    /** Delivery status string (e.g. `"accepted"`). */
+    status: string;
+    /** Human-readable or raw status text (often the HTTP status). */
+    response: string;
+    /** Transport or provider identifier (e.g. `"webpush"`). */
+    provider?: string;
+}
+/** Pluggable Web Push delivery backend. */
+export interface PushTransport {
+    /**
+     * Stable provider identifier for observability (e.g. `"webpush"`).
+     * Prefer this over constructor-name inference in hooks.
+     */
+    readonly provider?: string;
+    /** Send a push notification through this transport. */
+    send(options: PushOptions): Promise<PushSendResult>;
+    /** Test connectivity and credentials without sending. */
+    verify?(): Promise<VerifyResult>;
+    /** Release resources held by the transport. */
+    close?(): Promise<void>;
+}
+/**
+ * Context passed to push lifecycle hooks.
+ * Uses a redacted subscription endpoint instead of a recipient address (no natural `to`).
+ */
+export interface PushHookContext {
+    /** Message-ID when known (from options or send result). */
+    messageId?: string;
+    /**
+     * Redacted push endpoint for observability: `origin/#<short-hash>`.
+     * Never the full URL — the path embeds a long-lived delivery token.
+     */
+    endpoint: string;
+    /** Transport or provider identifier (e.g. `"webpush"`). */
+    provider: string;
+}
+/** Optional lifecycle hooks for metrics, tracing, and observability on every push send. */
+export interface PushHooks {
+    /** Fired before the transport sends the notification. */
+    onSend?: (ctx: PushHookContext) => void | Promise<void>;
+    /**
+     * Fired after a successful send.
+     * @param durationMs — elapsed milliseconds from send start to success (optional third argument).
+     */
+    onSuccess?: (ctx: PushHookContext, result: PushSendResult, durationMs?: number) => void | Promise<void>;
+    /**
+     * Fired when a send throws (error is re-thrown after the hook runs).
+     * @param durationMs — elapsed milliseconds from send start to failure (optional third argument).
+     */
+    onError?: (ctx: PushHookContext, error: unknown, durationMs?: number) => void | Promise<void>;
+}
+/**
+ * A push plugin transforms {@link PushOptions} before the transport sends.
+ * Plugins run sequentially. Each receives the output of the previous.
+ * Return a new options object — do not mutate the input.
+ */
+export type PushPlugin = ((options: PushOptions) => PushOptions) | ((options: PushOptions) => Promise<PushOptions>);

package/dist/core/sms-types.d.ts

@@ -0,0 +1,76 @@
+/**
+ * @module
+ * Shared SMS channel contracts — sibling types to email MailOptions/Transport/Hooks.
+ *
+ * Sently-first: this contract is the stable SMS surface. Provider transports
+ * implement {@link SmsTransport}; vendor extras stay off this module.
+ */
+import type { VerifyResult } from "./types.js";
+/** Options for sending an SMS message. */
+export interface SmsOptions {
+    /** Recipient phone number (E.164 recommended). */
+    to: string;
+    /** Message body text. */
+    body: string;
+    /** Sender phone number or alphanumeric sender ID. */
+    from?: string;
+    /** Client-supplied message identifier when known. */
+    messageId?: string;
+}
+/** Result returned after an SMS is accepted for delivery. */
+export interface SmsSendResult {
+    /** Provider-assigned or client message identifier. */
+    messageId: string;
+    /** Recipient phone number. */
+    to: string;
+    /** Provider delivery status string (e.g. `"queued"`, `"sent"`). */
+    status: string;
+    /** Human-readable or raw status text from the provider. */
+    response: string;
+    /** Transport or provider identifier (e.g. `"twilio-sms"`). */
+    provider?: string;
+}
+/** Pluggable SMS delivery backend. */
+export interface SmsTransport {
+    /**
+     * Stable provider identifier for observability (e.g. `"twilio-sms"`).
+     * Prefer this over constructor-name inference in hooks.
+     */
+    readonly provider?: string;
+    /** Send an SMS through this transport. */
+    send(options: SmsOptions): Promise<SmsSendResult>;
+    /** Test connectivity and credentials without sending. */
+    verify?(): Promise<VerifyResult>;
+    /** Release resources held by the transport. */
+    close?(): Promise<void>;
+}
+/** Context passed to SMS lifecycle hooks (no message body — avoids PII in logs). */
+export interface SmsHookContext {
+    /** Message-ID when known (from options or send result). */
+    messageId?: string;
+    /** Recipient phone number. */
+    to: string;
+    /** Transport or provider identifier (e.g. `"twilio-sms"`). */
+    provider: string;
+}
+/** Optional lifecycle hooks for metrics, tracing, and observability on every SMS send. */
+export interface SmsHooks {
+    /** Fired before the transport sends the message. */
+    onSend?: (ctx: SmsHookContext) => void | Promise<void>;
+    /**
+     * Fired after a successful send.
+     * @param durationMs — elapsed milliseconds from send start to success (optional third argument).
+     */
+    onSuccess?: (ctx: SmsHookContext, result: SmsSendResult, durationMs?: number) => void | Promise<void>;
+    /**
+     * Fired when a send throws (error is re-thrown after the hook runs).
+     * @param durationMs — elapsed milliseconds from send start to failure (optional third argument).
+     */
+    onError?: (ctx: SmsHookContext, error: unknown, durationMs?: number) => void | Promise<void>;
+}
+/**
+ * An SMS plugin transforms {@link SmsOptions} before the transport sends.
+ * Plugins run sequentially. Each receives the output of the previous.
+ * Return a new options object — do not mutate the input.
+ */
+export type SmsPlugin = ((options: SmsOptions) => SmsOptions) | ((options: SmsOptions) => Promise<SmsOptions>);

package/dist/core/smtp.js

@@ -1,3 +1,3 @@
-import{H as a,I as b,J as c,K as d,L as e,M as f,N as g,O as h,P as i,Q as j,R as k,S as l}from"../chunk-8phpsns1.js";import"../chunk-5scdgffb.js";import"../chunk-6bkj4y4r.js";import"../chunk-nbmq8ejv.js";export{f as selectAuthMethod,d as parseResponse,g as parseEHLO,l as encodeLine,c as encodeCommand,j as encodeAuthLoginUser,i as encodeAuthLoginPass,k as encodeAuthCramResponse,a as computeCRAMMD5,h as assertResponse,e as accumulateResponse,b as SMTPError};
+import{A as f,B as g,C as h,D as i,E as j,F as k,G as l,v as a,w as b,x as c,y as d,z as e}from"../chunk-n0qeyzqm.js";import"../chunk-ywq6s10g.js";import"../chunk-tamww15j.js";import"../chunk-6npp3x3c.js";export{f as selectAuthMethod,d as parseResponse,g as parseEHLO,l as encodeLine,c as encodeCommand,j as encodeAuthLoginUser,i as encodeAuthLoginPass,k as encodeAuthCramResponse,a as computeCRAMMD5,h as assertResponse,e as accumulateResponse,b as SMTPError};
 
-//# debugId=48767988D5CC2FF564756E2164756E21
+//# debugId=323A7FADB3AD978F64756E2164756E21