sently 0.9.1 → 0.10.0

package/AGENTS.md

@@ -1,6 +1,6 @@
 # sently — agent contract
 
-sently is a runtime-agnostic TypeScript messaging library (email, SMS, WhatsApp, Web Push) for Node.js, Bun, Deno, and Cloudflare Workers. ESM-only, zero runtime dependencies.
+sently is a runtime-agnostic TypeScript messaging library (email, SMS, WhatsApp, Web Push, FCM) for Node.js, Bun, Deno, and Cloudflare Workers. ESM-only, zero runtime dependencies.
 
 ## Sently-first provider model
 

package/CHANGELOG.md

@@ -2,6 +2,66 @@
 
 ## [Unreleased]
 
+## [0.10.0] — 2026-08-01
+
+### ✨ Added
+
+- **Channel send result** — `toChannelSendResult` / `ChannelSendResult`
+  (`sently/channel-result`, also on the main barrel) maps email, SMS,
+  WhatsApp, and push results to `{ messageId, provider, accepted }`
+- **Cross-channel decorators** — `RetryTransport`, `FallbackTransport`, and
+  `WeightedFallbackTransport` wrap SMS / WhatsApp / Push transports; SMS /
+  WhatsApp / push senders wire `onRetry` / `onFallback` like email
+- **Unifonic SMS** — `sently/transports/unifonic` (`AppSid` + el.cloud REST
+  send); webhook parser at `sently/webhooks/unifonic`
+- **FCM push** — `sently/transports/fcm` (HTTP v1 + service-account JWT, zero
+  Google SDK)
+- **Non-email webhooks** — `DeliveryEvent` plus parsers for Twilio SMS and
+  WhatsApp Cloud (`sently/webhooks/twilio-sms`, `whatsapp-cloud`);
+  `toDeliveryEvent` maps `EmailEvent` into the shared shape; Twilio and
+  WhatsApp Cloud parsers expose `verifySignature` for inbound authenticity
+- **Docs landing** — homepage transport marquee and channel cards include
+  Unifonic and FCM
+
+### ♻️ Changed
+
+- **`PushOptions`** — union of `WebPushOptions` (`subscription`) and
+  `FcmPushOptions` (`token`); Web Push and FCM transports reject the wrong
+  shape
+- **SMS / WhatsApp / Push results** — optional `providerIndex` when a
+  fallback decorator handles the send
+
+### 🐛 Fixed
+
+- **Unifonic success parsing** — accept OpenAPI `success: "true"` (string) in
+  addition to boolean `true`
+- **Unifonic `statusCallback`** — reject non-HTTPS URLs at construction (el.cloud
+  OpenAPI requires a public HTTPS callback)
+- **Empty FCM token** — reject blank `token` before calling the FCM API
+- **Landing provider strip** — keep transport icons and labels on one vertical
+  midline in the homepage marquee
+
+### 🔒 Security
+
+- **WhatsApp Cloud webhooks** — `verifySignature` for `X-Hub-Signature-256`
+  (HMAC-SHA256 over the raw body with the Meta app secret)
+- **Twilio SMS webhooks** — `verifySignature` for `X-Twilio-Signature`
+  (HMAC-SHA1 over URL + sorted form params with the Auth Token)
+
+## [0.9.2] — 2026-08-01
+
+### ♻️ Changed
+
+- **`bun run verify`** — runs `site:build` before tests so static-export and
+  docs-site failures block pack/publish
+- **CI Actions** — `actions/checkout` and `actions/setup-node` to v7; Node smoke
+  job on Node 24 (drops the Node 24 force-env workaround)
+
+### 🐛 Fixed
+
+- **Apple touch icon** — mark `apple-icon` as force-static so `output: "export"`
+  can prerender it during `site:build`
+
 ## [0.9.1] — 2026-08-01
 
 ### 🐛 Fixed

package/README.md

@@ -13,13 +13,13 @@
 </p>
 
 <p align="center">
-  <a href="https://www.npmjs.com/package/sently"><img alt="npm" src="https://shieldcn.dev/npm/sently.svg?size=sm" /></a>
+  <a href="https://www.npmjs.com/package/sently"><img alt="npm" src="https://shieldcn.dev/npm/sently.svg?size=sm&variant=outline" /></a>
   <a href="https://jsr.io/@alialnaghmoush/sently"><img alt="JSR" src="https://shieldcn.dev/jsr/@alialnaghmoush/sently.svg?size=sm&variant=outline" /></a>
-  <a href="https://bundlephobia.com/package/sently"><img alt="bundle" src="https://shieldcn.dev/bundlephobia/minzip/sently.svg?size=sm&variant=secondary" /></a>
-  <a href="https://opensource.org/licenses/MIT"><img alt="MIT" src="https://shieldcn.dev/npm/license/sently.svg?size=sm" /></a>
+  <a href="https://bundlephobia.com/package/sently"><img alt="bundle" src="https://shieldcn.dev/bundlephobia/minzip/sently.svg?size=sm&variant=outline" /></a>
+  <a href="https://opensource.org/licenses/MIT"><img alt="MIT" src="https://shieldcn.dev/npm/license/sently.svg?size=sm&variant=outline" /></a>
   <a href="https://bun.sh"><img alt="Bun" src="https://shieldcn.dev/badge/Bun-ready-000000.svg?logo=bun&size=sm&variant=outline" /></a>
   <a href="https://github.com/alialnaghmoush/sently/stargazers"><img alt="stars" src="https://shieldcn.dev/github/stars/alialnaghmoush/sently.svg?size=sm&variant=outline" /></a>
-  <a href="https://github.com/alialnaghmoush/sently/actions"><img alt="CI" src="https://shieldcn.dev/github/ci/alialnaghmoush/sently.svg?size=sm" /></a>
+  <a href="https://github.com/alialnaghmoush/sently/actions"><img alt="CI" src="https://shieldcn.dev/github/ci/alialnaghmoush/sently.svg?size=sm&variant=outline" /></a>
 </p>
 
 <p align="center">
@@ -67,12 +67,12 @@ await mailer.send({
 
 Same shape for every channel — apps use **sently senders**, not vendor SDKs:
 
-| Channel  | Sender                               | Example transport                          |
-| -------- | ------------------------------------ | ------------------------------------------ |
-| Email    | `createMailer` / `createSMTPMailer`  | `sently/transports/resend`, `sently/smtp`  |
-| SMS      | `createSmsSender`                    | `sently/transports/twilio-sms`             |
-| WhatsApp | `createWhatsAppSender`               | `sently/transports/whatsapp-cloud`         |
-| Push     | `createPushSender`                   | `sently/transports/webpush`                |
+| Channel  | Sender                               | Example transport                                      |
+| -------- | ------------------------------------ | ------------------------------------------------------ |
+| Email    | `createMailer` / `createSMTPMailer`  | `sently/transports/resend`, `sently/smtp`              |
+| SMS      | `createSmsSender`                    | `sently/transports/twilio-sms`, `unifonic`, `taqnyat-sms` |
+| WhatsApp | `createWhatsAppSender`               | `sently/transports/whatsapp-cloud`                     |
+| Push     | `createPushSender`                   | `sently/transports/webpush`, `fcm`                     |
 
 Full walkthrough: [Get started](https://sently.omqkhafi.dev/docs/get-started).
 
@@ -95,12 +95,14 @@ Nodemailer is Node.js–only and ships the full mail stack on every import (~59
 
 | Import                 | Use when                                      |
 | ---------------------- | --------------------------------------------- |
-| `sently/mailer`        | HTTP / custom email transports (smallest)     |
-| `sently/smtp`          | SMTP host, pool, adapters, DKIM               |
-| `sently/sms`           | SMS                                           |
-| `sently/whatsapp`      | WhatsApp                                      |
-| `sently/push`          | Web Push                                      |
-| `sently/transports/*`  | One provider per subpath                      |
+| `sently/mailer`          | HTTP / custom email transports (smallest)   |
+| `sently/smtp`            | SMTP host, pool, adapters, DKIM             |
+| `sently/sms`             | SMS                                         |
+| `sently/whatsapp`        | WhatsApp                                    |
+| `sently/push`            | Push (Web Push or FCM)                      |
+| `sently/channel-result`  | Shared `{ messageId, provider, accepted }`  |
+| `sently/transports/*`    | One provider or decorator per subpath       |
+| `sently/webhooks/*`      | Email / SMS / WhatsApp delivery parsers     |
 
 ## Documentation
 

package/dist/adapters/bun.js

@@ -1,3 +1,3 @@
-import"../chunk-6npp3x3c.js";import W from"node:net";import Q from"node:tls";function V(f){if(f.rejectUnauthorized===!1)console.warn("[sently] TLS certificate verification is disabled. Never use rejectUnauthorized: false in production.")}class X{socket=null;_secure;_connected=!1;connectionTimeout;tlsOptions;constructor(f={}){if(typeof Bun>"u")throw Error("BunAdapter requires the Bun runtime");this._secure=f.secure??!1,this.connectionTimeout=f.connectionTimeout??30000,this.tlsOptions=f.tls??{}}get secure(){return this._secure}get connected(){return this._connected}async connect(f,B){if(this._secure)await this.connectTls(f,B);else await this.connectPlain(f,B);this._connected=!0}async startTLS(f){if(!this.socket||this._secure)throw Error("Cannot STARTTLS: no plain socket available");let B=this.socket,y={...this.tlsOptions,...f};V(y),await new Promise((F,A)=>{let G=Q.connect({socket:B,servername:y.servername,rejectUnauthorized:y.rejectUnauthorized??!0,minVersion:y.minVersion});G.once("secureConnect",()=>{this.socket=G,this._secure=!0,F()}),G.once("error",A)})}async write(f){if(!this.socket)throw Error("Socket not connected");await new Promise((B,y)=>{this.socket?.write(Buffer.from(f),(F)=>{if(F)y(F);else B()})})}async*read(){if(!this.socket)throw Error("Socket not connected");let f=this.socket,B=[],y=null,F=!1,A=null,G=(H)=>{let I=new Uint8Array(H);if(y)y({value:I,done:!1}),y=null;else B.push(I)},J=(H)=>{if(A=H,F=!0,y)y({value:void 0,done:!0}),y=null},K=()=>{if(F=!0,y)y({value:void 0,done:!0}),y=null};f.on("data",G),f.on("error",J),f.on("close",K);try{while(!F||B.length>0){if(A)throw A;if(B.length>0){yield B.shift();continue}if(F)break;let H=await new Promise((I)=>{y=I});if(H.done)break;yield H.value}}finally{f.off("data",G),f.off("error",J),f.off("close",K)}}async close(){if(!this.socket)return;await new Promise((f)=>{this.socket?.end(()=>f())}),this.socket=null,this._connected=!1}connectPlain(f,B){return new Promise((y,F)=>{let A=W.connect({host:f,port:B},()=>y());A.setTimeout(this.connectionTimeout),A.once("timeout",()=>{A.destroy(),F(Error("Connection timeout"))}),A.once("error",F),this.socket=A})}connectTls(f,B){return V(this.tlsOptions),new Promise((y,F)=>{let A=Q.connect({host:f,port:B,servername:this.tlsOptions.servername??f,rejectUnauthorized:this.tlsOptions.rejectUnauthorized??!0,minVersion:this.tlsOptions.minVersion},()=>y());A.setTimeout(this.connectionTimeout),A.once("timeout",()=>{A.destroy(),F(Error("Connection timeout"))}),A.once("error",F),this.socket=A})}}export{X as BunAdapter};
+import"../chunk-th4cwrpb.js";import W from"node:net";import Q from"node:tls";function V(f){if(f.rejectUnauthorized===!1)console.warn("[sently] TLS certificate verification is disabled. Never use rejectUnauthorized: false in production.")}class X{socket=null;_secure;_connected=!1;connectionTimeout;tlsOptions;constructor(f={}){if(typeof Bun>"u")throw Error("BunAdapter requires the Bun runtime");this._secure=f.secure??!1,this.connectionTimeout=f.connectionTimeout??30000,this.tlsOptions=f.tls??{}}get secure(){return this._secure}get connected(){return this._connected}async connect(f,B){if(this._secure)await this.connectTls(f,B);else await this.connectPlain(f,B);this._connected=!0}async startTLS(f){if(!this.socket||this._secure)throw Error("Cannot STARTTLS: no plain socket available");let B=this.socket,y={...this.tlsOptions,...f};V(y),await new Promise((F,A)=>{let G=Q.connect({socket:B,servername:y.servername,rejectUnauthorized:y.rejectUnauthorized??!0,minVersion:y.minVersion});G.once("secureConnect",()=>{this.socket=G,this._secure=!0,F()}),G.once("error",A)})}async write(f){if(!this.socket)throw Error("Socket not connected");await new Promise((B,y)=>{this.socket?.write(Buffer.from(f),(F)=>{if(F)y(F);else B()})})}async*read(){if(!this.socket)throw Error("Socket not connected");let f=this.socket,B=[],y=null,F=!1,A=null,G=(H)=>{let I=new Uint8Array(H);if(y)y({value:I,done:!1}),y=null;else B.push(I)},J=(H)=>{if(A=H,F=!0,y)y({value:void 0,done:!0}),y=null},K=()=>{if(F=!0,y)y({value:void 0,done:!0}),y=null};f.on("data",G),f.on("error",J),f.on("close",K);try{while(!F||B.length>0){if(A)throw A;if(B.length>0){yield B.shift();continue}if(F)break;let H=await new Promise((I)=>{y=I});if(H.done)break;yield H.value}}finally{f.off("data",G),f.off("error",J),f.off("close",K)}}async close(){if(!this.socket)return;await new Promise((f)=>{this.socket?.end(()=>f())}),this.socket=null,this._connected=!1}connectPlain(f,B){return new Promise((y,F)=>{let A=W.connect({host:f,port:B},()=>y());A.setTimeout(this.connectionTimeout),A.once("timeout",()=>{A.destroy(),F(Error("Connection timeout"))}),A.once("error",F),this.socket=A})}connectTls(f,B){return V(this.tlsOptions),new Promise((y,F)=>{let A=Q.connect({host:f,port:B,servername:this.tlsOptions.servername??f,rejectUnauthorized:this.tlsOptions.rejectUnauthorized??!0,minVersion:this.tlsOptions.minVersion},()=>y());A.setTimeout(this.connectionTimeout),A.once("timeout",()=>{A.destroy(),F(Error("Connection timeout"))}),A.once("error",F),this.socket=A})}}export{X as BunAdapter};
 
 //# debugId=94AAFD676203266764756E2164756E21

package/dist/adapters/cf.js

@@ -1,3 +1,3 @@
-import{fa as q}from"../chunk-6npp3x3c.js";class w{socket=null;writer=null;_secure;_connected=!1;directTls;starttls;constructor(b={}){this._secure=b.secure??!1,this.directTls=b.secure??!1,this.starttls=b.starttls??!this.directTls}get secure(){return this._secure}get connected(){return this._connected}async connect(b,g){let{connect:j}=await import("cloudflare:sockets"),m=this.directTls?"on":this.starttls?"starttls":"off";this.socket=j({hostname:b,port:g},{secureTransport:m}),this.writer=this.socket.writable.getWriter(),this._connected=!0,this._secure=m==="on"}async startTLS(b){if(!this.socket||this._secure)throw Error("Cannot STARTTLS: no plain socket available");await this.writer?.close(),this.socket=this.socket.startTls(),this.writer=this.socket.writable.getWriter(),this._secure=!0}async write(b){if(!this.writer)throw Error("Socket not connected");await this.writer.write(b)}async*read(){if(!this.socket)throw Error("Socket not connected");let b=this.socket.readable.getReader();try{while(!0){let{value:g,done:j}=await b.read();if(j)break;if(g)yield g}}finally{b.releaseLock()}}async close(){await this.writer?.close(),await this.socket?.close(),this.writer=null,this.socket=null,this._connected=!1}}export{w as CloudflareAdapter};
+import{ma as q}from"../chunk-th4cwrpb.js";class w{socket=null;writer=null;_secure;_connected=!1;directTls;starttls;constructor(b={}){this._secure=b.secure??!1,this.directTls=b.secure??!1,this.starttls=b.starttls??!this.directTls}get secure(){return this._secure}get connected(){return this._connected}async connect(b,g){let{connect:j}=await import("cloudflare:sockets"),m=this.directTls?"on":this.starttls?"starttls":"off";this.socket=j({hostname:b,port:g},{secureTransport:m}),this.writer=this.socket.writable.getWriter(),this._connected=!0,this._secure=m==="on"}async startTLS(b){if(!this.socket||this._secure)throw Error("Cannot STARTTLS: no plain socket available");await this.writer?.close(),this.socket=this.socket.startTls(),this.writer=this.socket.writable.getWriter(),this._secure=!0}async write(b){if(!this.writer)throw Error("Socket not connected");await this.writer.write(b)}async*read(){if(!this.socket)throw Error("Socket not connected");let b=this.socket.readable.getReader();try{while(!0){let{value:g,done:j}=await b.read();if(j)break;if(g)yield g}}finally{b.releaseLock()}}async close(){await this.writer?.close(),await this.socket?.close(),this.writer=null,this.socket=null,this._connected=!1}}export{w as CloudflareAdapter};
 
-//# debugId=2B32628B9F6A971D64756E2164756E21
+//# debugId=F82291F9158AD62F64756E2164756E21

package/dist/adapters/cf.js.map

@@ -5,6 +5,6 @@
     "/**\n * @module\n * Cloudflare Workers socket adapter for SMTP via cloudflare:sockets.\n *\n * @example\n * ```ts\n * import { CloudflareAdapter } from \"sently/adapters/cf\";\n * import { createSMTPMailer } from \"sently/smtp\";\n *\n * const mailer = await createSMTPMailer({\n *   host: \"smtp.example.com\",\n *   adapter: new CloudflareAdapter(),\n *   auth: { user: \"relay@example.com\", pass: \"secret\" },\n * });\n * ```\n */\nimport type { SocketAdapter, TLSOptions } from \"../core/types.js\";\n\ninterface CFSocket {\n  readonly readable: ReadableStream<Uint8Array>;\n  readonly writable: WritableStream<Uint8Array>;\n  readonly closed: Promise<void>;\n  close(): Promise<void>;\n  startTls(): CFSocket;\n}\n\ntype CFConnect = (\n  address: { hostname: string; port: number },\n  options?: { secureTransport?: \"off\" | \"on\" | \"starttls\"; allowHalfOpen?: boolean },\n) => CFSocket;\n\n/** Configuration options for {@link CloudflareAdapter}. */\nexport interface CloudflareAdapterOptions {\n  /** Use implicit TLS on connect (secureTransport: \"on\"). Default: false. */\n  secure?: boolean;\n  /** Enable STARTTLS upgrade after plain connect. Default: true when not secure. */\n  starttls?: boolean;\n  /** Reserved for future TLS tuning (Workers sockets API). */\n  tls?: TLSOptions;\n}\n\n/**\n * Cloudflare Workers socket adapter via cloudflare:sockets.\n *\n * Limitations:\n * - No connection pooling (isolate lifecycle)\n * - No file system access for attachment.path\n * - No DNS MX lookup — explicit SMTP relay host required\n */\nexport class CloudflareAdapter implements SocketAdapter {\n  /** Underlying Cloudflare Workers socket. */\n  private socket: CFSocket | null = null;\n  /** Writable stream writer for outbound bytes. */\n  private writer: WritableStreamDefaultWriter<Uint8Array> | null = null;\n  /** Whether the connection is currently encrypted. */\n  private _secure: boolean;\n  /** Whether the socket is connected. */\n  private _connected = false;\n  /** Whether implicit TLS is used on connect (port 465 style). */\n  private readonly directTls: boolean;\n  /** Whether STARTTLS upgrade is enabled after plain connect. */\n  private readonly starttls: boolean;\n\n  /** Creates a Cloudflare Workers socket adapter. */\n  constructor(options: CloudflareAdapterOptions = {}) {\n    this._secure = options.secure ?? false;\n    this.directTls = options.secure ?? false;\n    this.starttls = options.starttls ?? !this.directTls;\n  }\n\n  /** Whether the connection uses TLS. */\n  get secure(): boolean {\n    return this._secure;\n  }\n\n  /** Whether the socket is currently connected. */\n  get connected(): boolean {\n    return this._connected;\n  }\n\n  /** Opens a TCP or TLS connection to the given host and port. */\n  async connect(host: string, port: number): Promise<void> {\n    const { connect } = (await import(\"cloudflare:sockets\")) as { connect: CFConnect };\n\n    const secureTransport = this.directTls ? \"on\" : this.starttls ? \"starttls\" : \"off\";\n    this.socket = connect({ hostname: host, port }, { secureTransport });\n    this.writer = this.socket.writable.getWriter();\n    this._connected = true;\n    this._secure = secureTransport === \"on\";\n  }\n\n  /** Upgrades a plain connection to TLS via STARTTLS. */\n  async startTLS(_options?: TLSOptions): Promise<void> {\n    if (!this.socket || this._secure) {\n      throw new Error(\"Cannot STARTTLS: no plain socket available\");\n    }\n\n    await this.writer?.close();\n    this.socket = this.socket.startTls();\n    this.writer = this.socket.writable.getWriter();\n    this._secure = true;\n  }\n\n  /** Writes raw bytes to the socket. */\n  async write(data: Uint8Array): Promise<void> {\n    if (!this.writer) {\n      throw new Error(\"Socket not connected\");\n    }\n    await this.writer.write(data);\n  }\n\n  /** Reads incoming socket data as an async iterable of byte chunks. */\n  async *read(): AsyncGenerator<Uint8Array, void, unknown> {\n    if (!this.socket) {\n      throw new Error(\"Socket not connected\");\n    }\n\n    const reader = this.socket.readable.getReader();\n    try {\n      while (true) {\n        const { value, done } = await reader.read();\n        if (done) {\n          break;\n        }\n        if (value) {\n          yield value;\n        }\n      }\n    } finally {\n      reader.releaseLock();\n    }\n  }\n\n  /** Closes the socket connection. */\n  async close(): Promise<void> {\n    await this.writer?.close();\n    await this.socket?.close();\n    this.writer = null;\n    this.socket = null;\n    this._connected = false;\n  }\n}\n"
   ],
   "mappings": "0CAiDO,MAAM,CAA2C,CAE9C,OAA0B,KAE1B,OAAyD,KAEzD,QAEA,WAAa,GAEJ,UAEA,SAGjB,WAAW,CAAC,EAAoC,CAAC,EAAG,CAClD,KAAK,QAAU,EAAQ,QAAU,GACjC,KAAK,UAAY,EAAQ,QAAU,GACnC,KAAK,SAAW,EAAQ,UAAY,CAAC,KAAK,aAIxC,OAAM,EAAY,CACpB,OAAO,KAAK,WAIV,UAAS,EAAY,CACvB,OAAO,KAAK,gBAIR,QAAO,CAAC,EAAc,EAA6B,CACvD,IAAQ,WAAa,KAAa,8BAE5B,EAAkB,KAAK,UAAY,KAAO,KAAK,SAAW,WAAa,MAC7E,KAAK,OAAS,EAAQ,CAAE,SAAU,EAAM,MAAK,EAAG,CAAE,iBAAgB,CAAC,EACnE,KAAK,OAAS,KAAK,OAAO,SAAS,UAAU,EAC7C,KAAK,WAAa,GAClB,KAAK,QAAU,IAAoB,UAI/B,SAAQ,CAAC,EAAsC,CACnD,GAAI,CAAC,KAAK,QAAU,KAAK,QACvB,MAAU,MAAM,4CAA4C,EAG9D,MAAM,KAAK,QAAQ,MAAM,EACzB,KAAK,OAAS,KAAK,OAAO,SAAS,EACnC,KAAK,OAAS,KAAK,OAAO,SAAS,UAAU,EAC7C,KAAK,QAAU,QAIX,MAAK,CAAC,EAAiC,CAC3C,GAAI,CAAC,KAAK,OACR,MAAU,MAAM,sBAAsB,EAExC,MAAM,KAAK,OAAO,MAAM,CAAI,QAIvB,IAAI,EAA8C,CACvD,GAAI,CAAC,KAAK,OACR,MAAU,MAAM,sBAAsB,EAGxC,IAAM,EAAS,KAAK,OAAO,SAAS,UAAU,EAC9C,GAAI,CACF,MAAO,GAAM,CACX,IAAQ,QAAO,QAAS,MAAM,EAAO,KAAK,EAC1C,GAAI,EACF,MAEF,GAAI,EACF,MAAM,UAGV,CACA,EAAO,YAAY,QAKjB,MAAK,EAAkB,CAC3B,MAAM,KAAK,QAAQ,MAAM,EACzB,MAAM,KAAK,QAAQ,MAAM,EACzB,KAAK,OAAS,KACd,KAAK,OAAS,KACd,KAAK,WAAa,GAEtB",
-  "debugId": "2B32628B9F6A971D64756E2164756E21",
+  "debugId": "F82291F9158AD62F64756E2164756E21",
   "names": []
 }

package/dist/adapters/deno.js

@@ -1,3 +1,3 @@
-import"../chunk-6npp3x3c.js";class v{conn=null;_secure;_connected=!1;tlsOptions;constructor(j={}){if(typeof Deno>"u")throw Error("DenoAdapter requires the Deno runtime");this._secure=j.secure??!1,this.tlsOptions=j.tls??{}}get secure(){return this._secure}get connected(){return this._connected}async connect(j,q){if(this._secure)this.conn=await Deno.connectTls({hostname:j,port:q,...this.tlsOptions.servername?{servername:this.tlsOptions.servername}:{}});else this.conn=await Deno.connect({hostname:j,port:q});this._connected=!0}async startTLS(j){if(!this.conn||this._secure)throw Error("Cannot STARTTLS: no plain connection available");let q={...this.tlsOptions,...j};this.conn=await Deno.startTls(this.conn,{...q.servername?{hostname:q.servername}:{}}),this._secure=!0}async write(j){if(!this.conn)throw Error("Socket not connected");await this.conn.write(j)}async*read(){if(!this.conn)throw Error("Socket not connected");let j=new Uint8Array(8192);while(!0){let q=await this.conn.read(j);if(q===null)break;yield j.slice(0,q)}}async close(){this.conn?.close(),this.conn=null,this._connected=!1}}export{v as DenoAdapter};
+import"../chunk-th4cwrpb.js";class v{conn=null;_secure;_connected=!1;tlsOptions;constructor(j={}){if(typeof Deno>"u")throw Error("DenoAdapter requires the Deno runtime");this._secure=j.secure??!1,this.tlsOptions=j.tls??{}}get secure(){return this._secure}get connected(){return this._connected}async connect(j,q){if(this._secure)this.conn=await Deno.connectTls({hostname:j,port:q,...this.tlsOptions.servername?{servername:this.tlsOptions.servername}:{}});else this.conn=await Deno.connect({hostname:j,port:q});this._connected=!0}async startTLS(j){if(!this.conn||this._secure)throw Error("Cannot STARTTLS: no plain connection available");let q={...this.tlsOptions,...j};this.conn=await Deno.startTls(this.conn,{...q.servername?{hostname:q.servername}:{}}),this._secure=!0}async write(j){if(!this.conn)throw Error("Socket not connected");await this.conn.write(j)}async*read(){if(!this.conn)throw Error("Socket not connected");let j=new Uint8Array(8192);while(!0){let q=await this.conn.read(j);if(q===null)break;yield j.slice(0,q)}}async close(){this.conn?.close(),this.conn=null,this._connected=!1}}export{v as DenoAdapter};
 
 //# debugId=433F0358DDA6910C64756E2164756E21

package/dist/adapters/node.js

@@ -1,3 +1,3 @@
-import"../chunk-6npp3x3c.js";import W from"node:net";import Q from"node:tls";function V(f){if(f.rejectUnauthorized===!1)console.warn("[sently] TLS certificate verification is disabled. Never use rejectUnauthorized: false in production.")}class X{socket=null;_secure;_connected=!1;connectionTimeout;tlsOptions;constructor(f={}){this._secure=f.secure??!1,this.connectionTimeout=f.connectionTimeout??30000,this.tlsOptions=f.tls??{}}get secure(){return this._secure}get connected(){return this._connected}async connect(f,B){if(this._secure)await this.connectTls(f,B);else await this.connectPlain(f,B);this._connected=!0}async startTLS(f){if(!this.socket||this._secure)throw Error("Cannot STARTTLS: no plain socket available");let B=this.socket,y={...this.tlsOptions,...f};V(y),await new Promise((F,A)=>{let G=Q.connect({socket:B,servername:y.servername,rejectUnauthorized:y.rejectUnauthorized??!0,minVersion:y.minVersion});G.once("secureConnect",()=>{this.socket=G,this._secure=!0,F()}),G.once("error",A)})}async write(f){if(!this.socket)throw Error("Socket not connected");await new Promise((B,y)=>{this.socket?.write(Buffer.from(f),(F)=>{if(F)y(F);else B()})})}async*read(){if(!this.socket)throw Error("Socket not connected");let f=this.socket,B=[],y=null,F=!1,A=null,G=(H)=>{let I=new Uint8Array(H);if(y)y({value:I,done:!1}),y=null;else B.push(I)},J=(H)=>{if(A=H,y)y({value:void 0,done:!0}),y=null;F=!0},K=()=>{if(F=!0,y)y({value:void 0,done:!0}),y=null};f.on("data",G),f.on("error",J),f.on("close",K);try{while(!F||B.length>0){if(A)throw A;if(B.length>0){yield B.shift();continue}if(F)break;let H=await new Promise((I)=>{y=I});if(H.done)break;yield H.value}}finally{f.off("data",G),f.off("error",J),f.off("close",K)}}async close(){if(!this.socket)return;await new Promise((f)=>{this.socket?.end(()=>f())}),this.socket=null,this._connected=!1}connectPlain(f,B){return new Promise((y,F)=>{let A=W.connect({host:f,port:B},()=>y());A.setTimeout(this.connectionTimeout),A.once("timeout",()=>{A.destroy(),F(Error("Connection timeout"))}),A.once("error",F),this.socket=A})}connectTls(f,B){return V(this.tlsOptions),new Promise((y,F)=>{let A=Q.connect({host:f,port:B,servername:this.tlsOptions.servername??f,rejectUnauthorized:this.tlsOptions.rejectUnauthorized??!0,minVersion:this.tlsOptions.minVersion},()=>y());A.setTimeout(this.connectionTimeout),A.once("timeout",()=>{A.destroy(),F(Error("Connection timeout"))}),A.once("error",F),this.socket=A})}}export{X as NodeAdapter};
+import"../chunk-th4cwrpb.js";import W from"node:net";import Q from"node:tls";function V(f){if(f.rejectUnauthorized===!1)console.warn("[sently] TLS certificate verification is disabled. Never use rejectUnauthorized: false in production.")}class X{socket=null;_secure;_connected=!1;connectionTimeout;tlsOptions;constructor(f={}){this._secure=f.secure??!1,this.connectionTimeout=f.connectionTimeout??30000,this.tlsOptions=f.tls??{}}get secure(){return this._secure}get connected(){return this._connected}async connect(f,B){if(this._secure)await this.connectTls(f,B);else await this.connectPlain(f,B);this._connected=!0}async startTLS(f){if(!this.socket||this._secure)throw Error("Cannot STARTTLS: no plain socket available");let B=this.socket,y={...this.tlsOptions,...f};V(y),await new Promise((F,A)=>{let G=Q.connect({socket:B,servername:y.servername,rejectUnauthorized:y.rejectUnauthorized??!0,minVersion:y.minVersion});G.once("secureConnect",()=>{this.socket=G,this._secure=!0,F()}),G.once("error",A)})}async write(f){if(!this.socket)throw Error("Socket not connected");await new Promise((B,y)=>{this.socket?.write(Buffer.from(f),(F)=>{if(F)y(F);else B()})})}async*read(){if(!this.socket)throw Error("Socket not connected");let f=this.socket,B=[],y=null,F=!1,A=null,G=(H)=>{let I=new Uint8Array(H);if(y)y({value:I,done:!1}),y=null;else B.push(I)},J=(H)=>{if(A=H,y)y({value:void 0,done:!0}),y=null;F=!0},K=()=>{if(F=!0,y)y({value:void 0,done:!0}),y=null};f.on("data",G),f.on("error",J),f.on("close",K);try{while(!F||B.length>0){if(A)throw A;if(B.length>0){yield B.shift();continue}if(F)break;let H=await new Promise((I)=>{y=I});if(H.done)break;yield H.value}}finally{f.off("data",G),f.off("error",J),f.off("close",K)}}async close(){if(!this.socket)return;await new Promise((f)=>{this.socket?.end(()=>f())}),this.socket=null,this._connected=!1}connectPlain(f,B){return new Promise((y,F)=>{let A=W.connect({host:f,port:B},()=>y());A.setTimeout(this.connectionTimeout),A.once("timeout",()=>{A.destroy(),F(Error("Connection timeout"))}),A.once("error",F),this.socket=A})}connectTls(f,B){return V(this.tlsOptions),new Promise((y,F)=>{let A=Q.connect({host:f,port:B,servername:this.tlsOptions.servername??f,rejectUnauthorized:this.tlsOptions.rejectUnauthorized??!0,minVersion:this.tlsOptions.minVersion},()=>y());A.setTimeout(this.connectionTimeout),A.once("timeout",()=>{A.destroy(),F(Error("Connection timeout"))}),A.once("error",F),this.socket=A})}}export{X as NodeAdapter};
 
 //# debugId=81CB75805F76C9AC64756E2164756E21

package/dist/auth/oauth2.js

@@ -1,3 +1,3 @@
-import{r as a,s as b,t as c}from"../chunk-b602dhck.js";import"../chunk-ywq6s10g.js";import"../chunk-6npp3x3c.js";export{c as OAuth2Client,b as MICROSOFT_TOKEN_URL,a as GOOGLE_TOKEN_URL};
+import{t as a,u as b,v as c}from"../chunk-f5x8vesr.js";import"../chunk-hnzmn4s4.js";import"../chunk-th4cwrpb.js";export{c as OAuth2Client,b as MICROSOFT_TOKEN_URL,a as GOOGLE_TOKEN_URL};
 
-//# debugId=7C0C74639C4239A864756E2164756E21
+//# debugId=6589248A704E74F364756E2164756E21

package/dist/auth/oauth2.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "7C0C74639C4239A864756E2164756E21",
+  "debugId": "6589248A704E74F364756E2164756E21",
   "names": []
 }

package/dist/channel-result.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @module
+ * Cross-channel send-result mapping — `sently/channel-result`.
+ */
+export type { AnySendResult, ChannelSendResult } from "./core/channel-result.js";
+export { toChannelSendResult } from "./core/channel-result.js";

package/dist/channel-result.js

@@ -0,0 +1 @@
+export { toChannelSendResult } from "./core/channel-result.js";

package/dist/{chunk-skqhj0rm.js → chunk-1ke3nmyg.js}

@@ -1,4 +1,4 @@
-import{fa as C}from"./chunk-6npp3x3c.js";async function K(D,y){let E=D??[],j=[];for(let b of E){if(b.content instanceof Uint8Array){j.push(b);continue}if(b.path){let z;try{z=await import("node:fs/promises")}catch{throw Error("attachment.path is not supported on this runtime — use attachment.content (Uint8Array) instead")}if(y?.basePath){let{resolve:A,sep:H}=await import("node:path"),k=A(b.path),w=A(y.basePath);if(!(k===w||k.startsWith(w+H)))throw Error(`[sently] Attachment path "${k}" escapes basePath "${w}". Use absolute paths within the allowed directory.`)}let F=await z.readFile(b.path),{path:I,...G}=b;j.push({...G,content:new Uint8Array(F)});continue}if(typeof b.content==="string"){j.push(b);continue}j.push(b)}return j}
-export{K as I};
+import{ma as C}from"./chunk-th4cwrpb.js";async function K(D,y){let E=D??[],j=[];for(let b of E){if(b.content instanceof Uint8Array){j.push(b);continue}if(b.path){let z;try{z=await import("node:fs/promises")}catch{throw Error("attachment.path is not supported on this runtime — use attachment.content (Uint8Array) instead")}if(y?.basePath){let{resolve:A,sep:H}=await import("node:path"),k=A(b.path),w=A(y.basePath);if(!(k===w||k.startsWith(w+H)))throw Error(`[sently] Attachment path "${k}" escapes basePath "${w}". Use absolute paths within the allowed directory.`)}let F=await z.readFile(b.path),{path:I,...G}=b;j.push({...G,content:new Uint8Array(F)});continue}if(typeof b.content==="string"){j.push(b);continue}j.push(b)}return j}
+export{K};
 
-//# debugId=B9395DEA67ACA6C864756E2164756E21
+//# debugId=25EBFCB353862CB964756E2164756E21

package/dist/{chunk-skqhj0rm.js.map → chunk-1ke3nmyg.js.map}

@@ -5,6 +5,6 @@
     "import type { Attachment } from \"../core/types.js\";\n\n/** Options for {@link resolveAttachments}. */\nexport interface ResolveAttachmentsOptions {\n  /**\n   * If set, attachment paths must resolve within this directory.\n   * Prevents path traversal via `..` segments and sibling-directory\n   * prefix matches. Opt-in only.\n   *\n   * Note: this check uses `node:path` `resolve()`, which does NOT\n   * dereference symlinks. A symlink located inside `basePath` that\n   * points outside of it will pass this check. If symlink traversal is\n   * a concern, resolve paths with `fs.realpath()` before passing them in.\n   */\n  basePath?: string;\n}\n\n/**\n * Resolve attachment.path to in-memory Uint8Array content.\n * @throws When attachment.path is used on runtimes without node:fs/promises\n */\nexport async function resolveAttachments(\n  attachments: Attachment[] | undefined,\n  options?: ResolveAttachmentsOptions,\n): Promise<Attachment[]> {\n  const list = attachments ?? [];\n  const resolved: Attachment[] = [];\n\n  for (const attachment of list) {\n    if (attachment.content instanceof Uint8Array) {\n      resolved.push(attachment);\n      continue;\n    }\n\n    if (attachment.path) {\n      let fs: typeof import(\"node:fs/promises\");\n      try {\n        fs = await import(\"node:fs/promises\");\n      } catch {\n        throw new Error(\n          \"attachment.path is not supported on this runtime — use attachment.content (Uint8Array) instead\",\n        );\n      }\n\n      if (options?.basePath) {\n        const { resolve, sep } = await import(\"node:path\");\n        const resolvedPath = resolve(attachment.path);\n        const resolvedBase = resolve(options.basePath);\n        // startsWith alone is vulnerable: \"/var/data-secret\" passes \"/var/data\".\n        // Require an exact match or a trailing path separator.\n        const isWithin =\n          resolvedPath === resolvedBase || resolvedPath.startsWith(resolvedBase + sep);\n        if (!isWithin) {\n          throw new Error(\n            `[sently] Attachment path \"${resolvedPath}\" escapes basePath \"${resolvedBase}\". ` +\n              \"Use absolute paths within the allowed directory.\",\n          );\n        }\n      }\n\n      const data = await fs.readFile(attachment.path);\n      const { path: _path, ...rest } = attachment;\n      resolved.push({ ...rest, content: new Uint8Array(data) });\n      continue;\n    }\n\n    if (typeof attachment.content === \"string\") {\n      resolved.push(attachment);\n      continue;\n    }\n\n    resolved.push(attachment);\n  }\n\n  return resolved;\n}\n"
   ],
   "mappings": "yCAqBA,eAAsB,CAAkB,CACtC,EACA,EACuB,CACvB,IAAM,EAAO,GAAe,CAAC,EACvB,EAAyB,CAAC,EAEhC,QAAW,KAAc,EAAM,CAC7B,GAAI,EAAW,mBAAmB,WAAY,CAC5C,EAAS,KAAK,CAAU,EACxB,SAGF,GAAI,EAAW,KAAM,CACnB,IAAI,EACJ,GAAI,CACF,EAAK,KAAa,4BAClB,KAAM,CACN,MAAU,MACR,gGACF,EAGF,GAAI,GAAS,SAAU,CACrB,IAAQ,UAAS,OAAQ,KAAa,qBAChC,EAAe,EAAQ,EAAW,IAAI,EACtC,EAAe,EAAQ,EAAQ,QAAQ,EAK7C,GAAI,EADF,IAAiB,GAAgB,EAAa,WAAW,EAAe,CAAG,GAE3E,MAAU,MACR,6BAA6B,wBAAmC,sDAElE,EAIJ,IAAM,EAAO,MAAM,EAAG,SAAS,EAAW,IAAI,GACtC,KAAM,KAAU,GAAS,EACjC,EAAS,KAAK,IAAK,EAAM,QAAS,IAAI,WAAW,CAAI,CAAE,CAAC,EACxD,SAGF,GAAI,OAAO,EAAW,UAAY,SAAU,CAC1C,EAAS,KAAK,CAAU,EACxB,SAGF,EAAS,KAAK,CAAU,EAG1B,OAAO",
-  "debugId": "B9395DEA67ACA6C864756E2164756E21",
+  "debugId": "25EBFCB353862CB964756E2164756E21",
   "names": []
 }

package/dist/{chunk-7gy2q9sh.js → chunk-5es0v1j7.js}

@@ -1,4 +1,4 @@
 function n(i){let t=i.trim();if(t.startsWith("+"))t=t.slice(1);if(t.startsWith("00"))t=t.slice(2);return t}
-export{n as h};
+export{n as j};
 
-//# debugId=28FA353EF68D309D64756E2164756E21
+//# debugId=68D244B9DA586D9C64756E2164756E21

package/dist/{chunk-7gy2q9sh.js.map → chunk-5es0v1j7.js.map}

@@ -5,6 +5,6 @@
     "/**\n * International digits without `+` or leading `00` (Taqnyat SMS / WhatsApp / Verify docs).\n */\nexport function normalizeTaqnyatPhone(phone: string): string {\n  let normalized = phone.trim();\n  if (normalized.startsWith(\"+\")) {\n    normalized = normalized.slice(1);\n  }\n  if (normalized.startsWith(\"00\")) {\n    normalized = normalized.slice(2);\n  }\n  return normalized;\n}\n"
   ],
   "mappings": "AAGO,SAAS,CAAqB,CAAC,EAAuB,CAC3D,IAAI,EAAa,EAAM,KAAK,EAC5B,GAAI,EAAW,WAAW,GAAG,EAC3B,EAAa,EAAW,MAAM,CAAC,EAEjC,GAAI,EAAW,WAAW,IAAI,EAC5B,EAAa,EAAW,MAAM,CAAC,EAEjC,OAAO",
-  "debugId": "28FA353EF68D309D64756E2164756E21",
+  "debugId": "68D244B9DA586D9C64756E2164756E21",
   "names": []
 }

package/dist/{chunk-0qxws3kj.js → chunk-7wtfjx0d.js}

@@ -1,4 +1,4 @@
 class y{rateDelta;rateLimit;now;static defaultNow=Date.now;tokens;lastRefill;waiters=[];constructor(h,x,j=y.defaultNow){this.rateDelta=h;this.rateLimit=x;this.now=j;this.tokens=h,this.lastRefill=j()}async acquire(){for(;;){if(this.refill(),this.tokens>0){this.tokens-=1;return}if(this.now===y.defaultNow){let h=this.now()-this.lastRefill,x=Math.max(1,this.rateLimit-h);await new Promise((j)=>setTimeout(j,x));continue}await new Promise((h)=>{this.waiters.push(h)})}}notify(){this.refill()}refill(){let x=this.now()-this.lastRefill;if(x>=this.rateLimit){let j=Math.floor(x/this.rateLimit);this.tokens=Math.min(this.rateDelta,this.tokens+j*this.rateDelta),this.lastRefill+=j*this.rateLimit;while(this.tokens>0&&this.waiters.length>0)this.tokens-=1,this.waiters.shift()?.()}}}
-export{y as O};
+export{y as Q};
 
-//# debugId=94CBA29B22651C4264756E2164756E21
+//# debugId=2A4807B72724BF3964756E2164756E21

package/dist/{chunk-0qxws3kj.js.map → chunk-7wtfjx0d.js.map}

@@ -5,6 +5,6 @@
     "/**\n * Token bucket rate limiter with lazy refill on acquire.\n */\nexport class RateLimiter {\n  private static readonly defaultNow = Date.now;\n\n  /** Remaining tokens in the current rate-limit window. */\n  private tokens: number;\n  /** Timestamp (ms) of the last token refill. */\n  private lastRefill: number;\n  /** Resolvers waiting for a token when the bucket is empty. */\n  private waiters: Array<() => void> = [];\n\n  /** Creates a rate limiter with the given burst size and window duration. */\n  constructor(\n    private readonly rateDelta: number,\n    private readonly rateLimit: number,\n    private readonly now: () => number = RateLimiter.defaultNow,\n  ) {\n    this.tokens = rateDelta;\n    this.lastRefill = now();\n  }\n\n  /** Wait until a token is available, then consume one. */\n  async acquire(): Promise<void> {\n    for (;;) {\n      this.refill();\n      if (this.tokens > 0) {\n        this.tokens -= 1;\n        return;\n      }\n\n      if (this.now === RateLimiter.defaultNow) {\n        const elapsed = this.now() - this.lastRefill;\n        const waitMs = Math.max(1, this.rateLimit - elapsed);\n        await new Promise<void>((resolve) => setTimeout(resolve, waitMs));\n        continue;\n      }\n\n      await new Promise<void>((resolve) => {\n        this.waiters.push(resolve);\n      });\n    }\n  }\n\n  /** Wake waiters after the clock advances (for testing). */\n  notify(): void {\n    this.refill();\n  }\n\n  /** Refills tokens based on elapsed time and wakes waiting acquirers. */\n  private refill(): void {\n    const t = this.now();\n    const elapsed = t - this.lastRefill;\n    if (elapsed >= this.rateLimit) {\n      const periods = Math.floor(elapsed / this.rateLimit);\n      this.tokens = Math.min(this.rateDelta, this.tokens + periods * this.rateDelta);\n      this.lastRefill += periods * this.rateLimit;\n      while (this.tokens > 0 && this.waiters.length > 0) {\n        this.tokens -= 1;\n        const next = this.waiters.shift();\n        next?.();\n      }\n    }\n  }\n}\n"
   ],
   "mappings": "AAGO,MAAM,CAAY,CAYJ,UACA,UACA,UAbK,YAAa,KAAK,IAGlC,OAEA,WAEA,QAA6B,CAAC,EAGtC,WAAW,CACQ,EACA,EACA,EAAoB,EAAY,WACjD,CAHiB,iBACA,iBACA,WAEjB,KAAK,OAAS,EACd,KAAK,WAAa,EAAI,OAIlB,QAAO,EAAkB,CAC7B,OAAS,CAEP,GADA,KAAK,OAAO,EACR,KAAK,OAAS,EAAG,CACnB,KAAK,QAAU,EACf,OAGF,GAAI,KAAK,MAAQ,EAAY,WAAY,CACvC,IAAM,EAAU,KAAK,IAAI,EAAI,KAAK,WAC5B,EAAS,KAAK,IAAI,EAAG,KAAK,UAAY,CAAO,EACnD,MAAM,IAAI,QAAc,CAAC,IAAY,WAAW,EAAS,CAAM,CAAC,EAChE,SAGF,MAAM,IAAI,QAAc,CAAC,IAAY,CACnC,KAAK,QAAQ,KAAK,CAAO,EAC1B,GAKL,MAAM,EAAS,CACb,KAAK,OAAO,EAIN,MAAM,EAAS,CAErB,IAAM,EADI,KAAK,IAAI,EACC,KAAK,WACzB,GAAI,GAAW,KAAK,UAAW,CAC7B,IAAM,EAAU,KAAK,MAAM,EAAU,KAAK,SAAS,EACnD,KAAK,OAAS,KAAK,IAAI,KAAK,UAAW,KAAK,OAAS,EAAU,KAAK,SAAS,EAC7E,KAAK,YAAc,EAAU,KAAK,UAClC,MAAO,KAAK,OAAS,GAAK,KAAK,QAAQ,OAAS,EAC9C,KAAK,QAAU,EACF,KAAK,QAAQ,MAAM,IACzB,GAIf",
-  "debugId": "94CBA29B22651C4264756E2164756E21",
+  "debugId": "2A4807B72724BF3964756E2164756E21",
   "names": []
 }

package/dist/chunk-8kpgbrba.js

@@ -0,0 +1,4 @@
+import{fa as V}from"./chunk-hnzmn4s4.js";function W(q){for(let E=0;E<q.length;E++){let z=q.charCodeAt(E);if(z<=31||z===127||z===8232||z===8233)return z}return-1}function K(q,E="address"){let z=W(q);if(z!==-1){let G=z.toString(16).padStart(2,"0");throw Error(`Email ${E} contains a forbidden control character (0x${G}). CR, LF, NUL, and other control characters are not allowed.`)}}function X(q){if(Array.isArray(q))return q.flatMap((z)=>X(z));if(typeof q==="object"){if(K(q.address,"address"),q.name!==void 0)K(q.name,"display name");return[{...q}]}K(q,"address");let E=q.trim();if(!E)return[];return Y(E).map(Z)}function $(q){if(K(q.address,"address"),q.name)return K(q.name,"display name"),`${V(q.name)} <${q.address}>`;return q.address}function w(q){return X(q).map((E)=>E.address)}function x(q){if(W(q)!==-1)return!1;return/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/.test(q)}function Y(q){let E=[],z="",G=!1,J=!1;for(let O=0;O<q.length;O++){let I=q[O]??"";if(I==='"'&&q[O-1]!=="\\"){G=!G,z+=I;continue}if(I==="<"&&!G){J=!0,z+=I;continue}if(I===">"&&!G){J=!1,z+=I;continue}if(I===","&&!G&&!J){if(z.trim())E.push(z.trim());z="";continue}z+=I}if(z.trim())E.push(z.trim());return E}function Z(q){let E=q.trim(),z=E.match(/^(?:"([^"]*)"|([^<]*?))\s*<([^>]+)>$/);if(z){let G=(z[1]??z[2]??"").trim(),J=(z[3]??"").trim();if(G)return{name:G,address:J};return{address:J}}if(E.startsWith('"')&&E.endsWith('"'))return{address:E.slice(1,-1)};return{address:E}}
+export{K as R,X as S,$ as T,w as U,x as V};
+
+//# debugId=BEA561F6EE30059664756E2164756E21

package/dist/{chunk-93vqxxj2.js.map → chunk-8kpgbrba.js.map}

@@ -4,7 +4,7 @@
   "sourcesContent": [
     "// src/core/address.ts\nimport { encodeHeader } from \"./base64.js\";\nimport type { Address, AddressInput } from \"./types.js\";\n\n/**\n * Find the first forbidden control character in a string.\n *\n * Forbidden characters must never appear in an email address or display name,\n * because each enables a distinct attack:\n * - CR (0x0D) / LF (0x0A): email header injection and SMTP command injection\n * - NUL (0x00): C-string truncation / parser confusion in downstream agents\n * - other C0 controls (0x01–0x1F), DEL (0x7F): header/parser confusion\n * - U+2028 / U+2029: line separators that some parsers treat as newlines\n *\n * @returns The char code of the first forbidden character, or -1 if none.\n */\nfunction findForbiddenChar(value: string): number {\n  for (let i = 0; i < value.length; i++) {\n    const code = value.charCodeAt(i);\n    if (code <= 0x1f || code === 0x7f || code === 0x2028 || code === 0x2029) {\n      return code;\n    }\n  }\n  return -1;\n}\n\n/**\n * Assert that a raw address or display-name value contains no forbidden\n * control characters. Throws immediately (fail closed) — the library never\n * attempts to strip or rewrite hostile input into an accepted value.\n *\n * The check is intentionally performed on the RAW input, before any trimming\n * or normalization, so hostile values are rejected rather than repaired.\n *\n * @param value - The raw, untransformed string to validate.\n * @param label - Field label used in the error message (e.g. \"address\").\n * @throws {Error} If the value contains any forbidden control character.\n */\nexport function assertSafeAddress(value: string, label = \"address\"): void {\n  const code = findForbiddenChar(value);\n  if (code !== -1) {\n    const hex = code.toString(16).padStart(2, \"0\");\n    throw new Error(\n      `Email ${label} contains a forbidden control character (0x${hex}). ` +\n        \"CR, LF, NUL, and other control characters are not allowed.\",\n    );\n  }\n}\n\n/**\n * Normalize any AddressInput form into Address[].\n *\n * Every address and display name is validated against control-character\n * injection before any transformation. This is the single chokepoint shared\n * by all transports and address fields (From, To, Cc, Bcc, Reply-To), so the\n * protection is uniform and secure by default.\n *\n * @throws {Error} If any address or name contains a forbidden control character.\n */\nexport function parseAddresses(input: AddressInput): Address[] {\n  if (Array.isArray(input)) {\n    return input.flatMap((item) => parseAddresses(item));\n  }\n\n  if (typeof input === \"object\") {\n    assertSafeAddress(input.address, \"address\");\n    if (input.name !== undefined) {\n      assertSafeAddress(input.name, \"display name\");\n    }\n    return [{ ...input }];\n  }\n\n  // Validate the raw input string before splitting or trimming so injected\n  // newlines cannot hide inside a multi-address list.\n  assertSafeAddress(input, \"address\");\n\n  const trimmed = input.trim();\n  if (!trimmed) {\n    return [];\n  }\n\n  return splitAddressList(trimmed).map(parseSingleAddress);\n}\n\n/**\n * Format an Address for SMTP envelope commands (MAIL FROM / RCPT TO).\n */\nexport function toEnvelope(address: Address): string {\n  return address.address;\n}\n\n/**\n * Format an Address for use in a MIME header (From, To, CC, etc.).\n *\n * Re-validates the address and name at render time so a header can never be\n * emitted with an embedded control character, even if the {@link Address} was\n * constructed without going through {@link parseAddresses}.\n *\n * @throws {Error} If the address or name contains a forbidden control character.\n */\nexport function toMIMEHeader(address: Address): string {\n  assertSafeAddress(address.address, \"address\");\n  if (address.name) {\n    assertSafeAddress(address.name, \"display name\");\n    const name = encodeHeader(address.name);\n    return `${name} <${address.address}>`;\n  }\n  return address.address;\n}\n\n/**\n * Extract plain email strings from any AddressInput.\n */\nexport function extractEmails(input: AddressInput): string[] {\n  return parseAddresses(input).map((addr) => addr.address);\n}\n\n/**\n * Basic email format validation (format only, no DNS lookup).\n *\n * Rejects any control character (including CR, LF, tab, and NUL) before\n * applying the structural check, so a \"valid\" result is always safe to place\n * into a header or SMTP command.\n */\nexport function isValidEmail(email: string): boolean {\n  if (findForbiddenChar(email) !== -1) return false;\n  return /^[^\\s@<>]+@[^\\s@<>]+\\.[^\\s@<>]+$/.test(email);\n}\n\nfunction splitAddressList(input: string): string[] {\n  const parts: string[] = [];\n  let current = \"\";\n  let inQuotes = false;\n  let inAngle = false;\n\n  for (let i = 0; i < input.length; i++) {\n    const char = input[i] ?? \"\";\n    if (char === '\"' && input[i - 1] !== \"\\\\\") {\n      inQuotes = !inQuotes;\n      current += char;\n      continue;\n    }\n    if (char === \"<\" && !inQuotes) {\n      inAngle = true;\n      current += char;\n      continue;\n    }\n    if (char === \">\" && !inQuotes) {\n      inAngle = false;\n      current += char;\n      continue;\n    }\n    if (char === \",\" && !inQuotes && !inAngle) {\n      if (current.trim()) {\n        parts.push(current.trim());\n      }\n      current = \"\";\n      continue;\n    }\n    current += char;\n  }\n\n  if (current.trim()) {\n    parts.push(current.trim());\n  }\n\n  return parts;\n}\n\nfunction parseSingleAddress(input: string): Address {\n  const trimmed = input.trim();\n\n  const angleMatch = trimmed.match(/^(?:\"([^\"]*)\"|([^<]*?))\\s*<([^>]+)>$/);\n  if (angleMatch) {\n    const name = (angleMatch[1] ?? angleMatch[2] ?? \"\").trim();\n    const address = (angleMatch[3] ?? \"\").trim();\n    if (name) {\n      return { name, address };\n    }\n    return { address };\n  }\n\n  if (trimmed.startsWith('\"') && trimmed.endsWith('\"')) {\n    return { address: trimmed.slice(1, -1) };\n  }\n\n  return { address: trimmed };\n}\n"
   ],
-  "mappings": "wCAgBA,SAAS,CAAiB,CAAC,EAAuB,CAChD,QAAS,EAAI,EAAG,EAAI,EAAM,OAAQ,IAAK,CACrC,IAAM,EAAO,EAAM,WAAW,CAAC,EAC/B,GAAI,GAAQ,IAAQ,IAAS,KAAQ,IAAS,MAAU,IAAS,KAC/D,OAAO,EAGX,MAAO,GAeF,SAAS,CAAiB,CAAC,EAAe,EAAQ,UAAiB,CACxE,IAAM,EAAO,EAAkB,CAAK,EACpC,GAAI,IAAS,GAAI,CACf,IAAM,EAAM,EAAK,SAAS,EAAE,EAAE,SAAS,EAAG,GAAG,EAC7C,MAAU,MACR,SAAS,+CAAmD,gEAE9D,GAcG,SAAS,CAAc,CAAC,EAAgC,CAC7D,GAAI,MAAM,QAAQ,CAAK,EACrB,OAAO,EAAM,QAAQ,CAAC,IAAS,EAAe,CAAI,CAAC,EAGrD,GAAI,OAAO,IAAU,SAAU,CAE7B,GADA,EAAkB,EAAM,QAAS,SAAS,EACtC,EAAM,OAAS,OACjB,EAAkB,EAAM,KAAM,cAAc,EAE9C,MAAO,CAAC,IAAK,CAAM,CAAC,EAKtB,EAAkB,EAAO,SAAS,EAElC,IAAM,EAAU,EAAM,KAAK,EAC3B,GAAI,CAAC,EACH,MAAO,CAAC,EAGV,OAAO,EAAiB,CAAO,EAAE,IAAI,CAAkB,EAmBlD,SAAS,CAAY,CAAC,EAA0B,CAErD,GADA,EAAkB,EAAQ,QAAS,SAAS,EACxC,EAAQ,KAGV,OAFA,EAAkB,EAAQ,KAAM,cAAc,EAEvC,GADM,EAAa,EAAQ,IAAI,MACnB,EAAQ,WAE7B,OAAO,EAAQ,QAMV,SAAS,CAAa,CAAC,EAA+B,CAC3D,OAAO,EAAe,CAAK,EAAE,IAAI,CAAC,IAAS,EAAK,OAAO,EAUlD,SAAS,CAAY,CAAC,EAAwB,CACnD,GAAI,EAAkB,CAAK,IAAM,GAAI,MAAO,GAC5C,MAAO,mCAAmC,KAAK,CAAK,EAGtD,SAAS,CAAgB,CAAC,EAAyB,CACjD,IAAM,EAAkB,CAAC,EACrB,EAAU,GACV,EAAW,GACX,EAAU,GAEd,QAAS,EAAI,EAAG,EAAI,EAAM,OAAQ,IAAK,CACrC,IAAM,EAAO,EAAM,IAAM,GACzB,GAAI,IAAS,KAAO,EAAM,EAAI,KAAO,KAAM,CACzC,EAAW,CAAC,EACZ,GAAW,EACX,SAEF,GAAI,IAAS,KAAO,CAAC,EAAU,CAC7B,EAAU,GACV,GAAW,EACX,SAEF,GAAI,IAAS,KAAO,CAAC,EAAU,CAC7B,EAAU,GACV,GAAW,EACX,SAEF,GAAI,IAAS,KAAO,CAAC,GAAY,CAAC,EAAS,CACzC,GAAI,EAAQ,KAAK,EACf,EAAM,KAAK,EAAQ,KAAK,CAAC,EAE3B,EAAU,GACV,SAEF,GAAW,EAGb,GAAI,EAAQ,KAAK,EACf,EAAM,KAAK,EAAQ,KAAK,CAAC,EAG3B,OAAO,EAGT,SAAS,CAAkB,CAAC,EAAwB,CAClD,IAAM,EAAU,EAAM,KAAK,EAErB,EAAa,EAAQ,MAAM,sCAAsC,EACvE,GAAI,EAAY,CACd,IAAM,GAAQ,EAAW,IAAM,EAAW,IAAM,IAAI,KAAK,EACnD,GAAW,EAAW,IAAM,IAAI,KAAK,EAC3C,GAAI,EACF,MAAO,CAAE,OAAM,SAAQ,EAEzB,MAAO,CAAE,SAAQ,EAGnB,GAAI,EAAQ,WAAW,GAAG,GAAK,EAAQ,SAAS,GAAG,EACjD,MAAO,CAAE,QAAS,EAAQ,MAAM,EAAG,EAAE,CAAE,EAGzC,MAAO,CAAE,QAAS,CAAQ",
-  "debugId": "72AC62736D4BEF9164756E2164756E21",
+  "mappings": "yCAgBA,SAAS,CAAiB,CAAC,EAAuB,CAChD,QAAS,EAAI,EAAG,EAAI,EAAM,OAAQ,IAAK,CACrC,IAAM,EAAO,EAAM,WAAW,CAAC,EAC/B,GAAI,GAAQ,IAAQ,IAAS,KAAQ,IAAS,MAAU,IAAS,KAC/D,OAAO,EAGX,MAAO,GAeF,SAAS,CAAiB,CAAC,EAAe,EAAQ,UAAiB,CACxE,IAAM,EAAO,EAAkB,CAAK,EACpC,GAAI,IAAS,GAAI,CACf,IAAM,EAAM,EAAK,SAAS,EAAE,EAAE,SAAS,EAAG,GAAG,EAC7C,MAAU,MACR,SAAS,+CAAmD,gEAE9D,GAcG,SAAS,CAAc,CAAC,EAAgC,CAC7D,GAAI,MAAM,QAAQ,CAAK,EACrB,OAAO,EAAM,QAAQ,CAAC,IAAS,EAAe,CAAI,CAAC,EAGrD,GAAI,OAAO,IAAU,SAAU,CAE7B,GADA,EAAkB,EAAM,QAAS,SAAS,EACtC,EAAM,OAAS,OACjB,EAAkB,EAAM,KAAM,cAAc,EAE9C,MAAO,CAAC,IAAK,CAAM,CAAC,EAKtB,EAAkB,EAAO,SAAS,EAElC,IAAM,EAAU,EAAM,KAAK,EAC3B,GAAI,CAAC,EACH,MAAO,CAAC,EAGV,OAAO,EAAiB,CAAO,EAAE,IAAI,CAAkB,EAmBlD,SAAS,CAAY,CAAC,EAA0B,CAErD,GADA,EAAkB,EAAQ,QAAS,SAAS,EACxC,EAAQ,KAGV,OAFA,EAAkB,EAAQ,KAAM,cAAc,EAEvC,GADM,EAAa,EAAQ,IAAI,MACnB,EAAQ,WAE7B,OAAO,EAAQ,QAMV,SAAS,CAAa,CAAC,EAA+B,CAC3D,OAAO,EAAe,CAAK,EAAE,IAAI,CAAC,IAAS,EAAK,OAAO,EAUlD,SAAS,CAAY,CAAC,EAAwB,CACnD,GAAI,EAAkB,CAAK,IAAM,GAAI,MAAO,GAC5C,MAAO,mCAAmC,KAAK,CAAK,EAGtD,SAAS,CAAgB,CAAC,EAAyB,CACjD,IAAM,EAAkB,CAAC,EACrB,EAAU,GACV,EAAW,GACX,EAAU,GAEd,QAAS,EAAI,EAAG,EAAI,EAAM,OAAQ,IAAK,CACrC,IAAM,EAAO,EAAM,IAAM,GACzB,GAAI,IAAS,KAAO,EAAM,EAAI,KAAO,KAAM,CACzC,EAAW,CAAC,EACZ,GAAW,EACX,SAEF,GAAI,IAAS,KAAO,CAAC,EAAU,CAC7B,EAAU,GACV,GAAW,EACX,SAEF,GAAI,IAAS,KAAO,CAAC,EAAU,CAC7B,EAAU,GACV,GAAW,EACX,SAEF,GAAI,IAAS,KAAO,CAAC,GAAY,CAAC,EAAS,CACzC,GAAI,EAAQ,KAAK,EACf,EAAM,KAAK,EAAQ,KAAK,CAAC,EAE3B,EAAU,GACV,SAEF,GAAW,EAGb,GAAI,EAAQ,KAAK,EACf,EAAM,KAAK,EAAQ,KAAK,CAAC,EAG3B,OAAO,EAGT,SAAS,CAAkB,CAAC,EAAwB,CAClD,IAAM,EAAU,EAAM,KAAK,EAErB,EAAa,EAAQ,MAAM,sCAAsC,EACvE,GAAI,EAAY,CACd,IAAM,GAAQ,EAAW,IAAM,EAAW,IAAM,IAAI,KAAK,EACnD,GAAW,EAAW,IAAM,IAAI,KAAK,EAC3C,GAAI,EACF,MAAO,CAAE,OAAM,SAAQ,EAEzB,MAAO,CAAE,SAAQ,EAGnB,GAAI,EAAQ,WAAW,GAAG,GAAK,EAAQ,SAAS,GAAG,EACjD,MAAO,CAAE,QAAS,EAAQ,MAAM,EAAG,EAAE,CAAE,EAGzC,MAAO,CAAE,QAAS,CAAQ",
+  "debugId": "BEA561F6EE30059664756E2164756E21",
   "names": []
 }

package/dist/{chunk-vjpds2pf.js → chunk-a057jzsy.js}

@@ -1,3 +1,3 @@
-import{t as U}from"./chunk-b602dhck.js";import{u as X}from"./chunk-8dty8c4p.js";import{A as L,B as v,C as N,D as A,E as j,G as E,v as k,w as $,x as Z,y as O,z as q}from"./chunk-n0qeyzqm.js";import{I as b}from"./chunk-skqhj0rm.js";import{fa as C}from"./chunk-6npp3x3c.js";class T{provider="smtp";config;adapter=null;constructor(z){this.config=P(z)}async send(z){let B={...z,attachments:await b(z.attachments)},G=await X(B,this.config.dkim),F=await this.getAdapter(),W=this.config.direct?await M(G.envelope.from.split("@")[1]??this.config.host):this.config.host;await F.connect(W,this.config.port),this.adapter=F;try{return await D(F,this.config),await S(F,G)}finally{await H(F),this.adapter=null}}async verify(){try{let z=await this.getAdapter();await z.connect(this.config.host,this.config.port);try{return await D(z,this.config),{ok:!0,provider:"smtp"}}finally{await H(z)}}catch(z){return{ok:!1,provider:"smtp",message:z instanceof Error?z.message:String(z)}}}async close(){if(this.adapter)await this.adapter.close(),this.adapter=null}async getAdapter(){if(!this.config.adapter)throw new $("No socket adapter configured",0,"CONNECT","");return this.config.adapter}}function P(z){let B=z.secure??!1;return{host:z.host,port:z.port??(B?465:587),secure:B,...z.auth!==void 0?{auth:z.auth}:{},...z.requireTLS!==void 0?{requireTLS:z.requireTLS}:{},...z.dkim!==void 0?{dkim:z.dkim}:{},...z.tls!==void 0?{tls:z.tls}:{},...z.connectionTimeout!==void 0?{connectionTimeout:z.connectionTimeout}:{},...z.greetingTimeout!==void 0?{greetingTimeout:z.greetingTimeout}:{},...z.socketTimeout!==void 0?{socketTimeout:z.socketTimeout}:{},...z.direct!==void 0?{direct:z.direct}:{},...z.adapter!==void 0?{adapter:z.adapter}:{}}}async function D(z,B){let G=await J(z);N(G,[220],"greeting");let F=await I(z,B.host),W=F.some((Q)=>Q.toUpperCase()==="STARTTLS");if(!B.secure&&!z.secure&&W){await Y(z,Z({type:"STARTTLS"}));let Q=await J(z);N(Q,[220],"STARTTLS"),await z.startTLS(B.tls),F=await I(z,B.host)}if(B.auth){let Q=B.requireTLS??!0,V=z.secure||B.secure;if(Q&&!V)throw new $("Refusing to authenticate over unencrypted connection. Set requireTLS: false to disable this check (not recommended).",0,"AUTH","");await l(z,B.auth,F)}}async function S(z,B){await _(z,{type:"MAIL_FROM",address:B.envelope.from});let G=await J(z);N(G,[250],"MAIL FROM");let F=[],W=[];for(let K of B.envelope.to)if(await Y(z,Z({type:"RCPT_TO",address:K})),(await J(z)).isSuccess)F.push(K);else W.push(K);await _(z,{type:"DATA"});let Q=await J(z);N(Q,[354],"DATA");let V;try{await Y(z,Z({type:"DATA_BODY",content:B.raw})),V=await J(z)}catch(K){if(await Y(z,Z({type:"DATA_BODY",content:B.raw})),V=await J(z),V.isError)throw K}return N(V,[250],"DATA end"),{messageId:B.messageId,accepted:F,rejected:W,response:V.message,envelope:B.envelope}}async function H(z){try{await _(z,{type:"QUIT"}),await J(z)}catch{}finally{await z.close()}}async function I(z,B){await _(z,{type:"EHLO",domain:B});let G=await J(z);return N(G,[250],"EHLO"),v(G)}async function l(z,B,G){if(B.type==="OAUTH2"&&B.oauth2){let K=await new U(B.oauth2).buildXOAUTH2();await _(z,{type:"AUTH_XOAUTH2",xoauth2String:K});let x=await J(z);if(x.code===334)await Y(z,E("")),x=await J(z);N(x,[235],"AUTH XOAUTH2");return}let F=B.type??L(G);if(F==="CRAM-MD5"){let V=y(B,"CRAM-MD5");await _(z,{type:"AUTH_CRAM_MD5_INIT"});let K=await J(z);N(K,[334],"AUTH CRAM-MD5");let x=K.message.trim(),w=await k(x,B.user,V);await _(z,{type:"AUTH_CRAM_MD5_RESPONSE",response:w}),K=await J(z),N(K,[235],"AUTH CRAM-MD5 response");return}if(F==="PLAIN"){let V=y(B,"PLAIN");await Y(z,Z({type:"AUTH_PLAIN",user:B.user,pass:V}));let K=await J(z);N(K,[235],"AUTH PLAIN");return}let W=y(B,"LOGIN");await Y(z,Z({type:"AUTH_LOGIN",user:B.user,pass:W}));let Q=await J(z);N(Q,[334],"AUTH LOGIN"),await Y(z,j(B.user)),Q=await J(z),N(Q,[334],"AUTH LOGIN user"),await Y(z,A(W)),Q=await J(z),N(Q,[235],"AUTH LOGIN pass")}function y(z,B){if(!z.pass)throw new $(`Password required for ${B} authentication`,0,`AUTH ${B}`,"");return z.pass}async function _(z,B){await Y(z,Z(B))}async function Y(z,B){await z.write(B)}async function J(z){let B=[];for await(let G of z.read()){B.push(G);let F=q(B);if(F)return O(F)}throw new $("Connection closed while reading SMTP response",0,"READ","")}async function M(z){let G=await(await import("node:dns/promises")).resolveMx(z);if(G.length===0)throw new $(`No MX records for ${z}`,0,"MX","");return G.sort((F,W)=>F.priority-W.priority),G[0]?.exchange??z}export{T as l,P as m,D as n,S as o,H as p,J as q};
+import{v as U}from"./chunk-f5x8vesr.js";import{w as X}from"./chunk-yg3kj723.js";import{A as O,B as q,C as L,D as v,E as N,F as A,G as j,I as E,x as k,y as $,z as Z}from"./chunk-w4c9kj70.js";import{K as b}from"./chunk-1ke3nmyg.js";import{ma as C}from"./chunk-th4cwrpb.js";class T{provider="smtp";config;adapter=null;constructor(z){this.config=P(z)}async send(z){let B={...z,attachments:await b(z.attachments)},G=await X(B,this.config.dkim),F=await this.getAdapter(),W=this.config.direct?await M(G.envelope.from.split("@")[1]??this.config.host):this.config.host;await F.connect(W,this.config.port),this.adapter=F;try{return await D(F,this.config),await S(F,G)}finally{await H(F),this.adapter=null}}async verify(){try{let z=await this.getAdapter();await z.connect(this.config.host,this.config.port);try{return await D(z,this.config),{ok:!0,provider:"smtp"}}finally{await H(z)}}catch(z){return{ok:!1,provider:"smtp",message:z instanceof Error?z.message:String(z)}}}async close(){if(this.adapter)await this.adapter.close(),this.adapter=null}async getAdapter(){if(!this.config.adapter)throw new $("No socket adapter configured",0,"CONNECT","");return this.config.adapter}}function P(z){let B=z.secure??!1;return{host:z.host,port:z.port??(B?465:587),secure:B,...z.auth!==void 0?{auth:z.auth}:{},...z.requireTLS!==void 0?{requireTLS:z.requireTLS}:{},...z.dkim!==void 0?{dkim:z.dkim}:{},...z.tls!==void 0?{tls:z.tls}:{},...z.connectionTimeout!==void 0?{connectionTimeout:z.connectionTimeout}:{},...z.greetingTimeout!==void 0?{greetingTimeout:z.greetingTimeout}:{},...z.socketTimeout!==void 0?{socketTimeout:z.socketTimeout}:{},...z.direct!==void 0?{direct:z.direct}:{},...z.adapter!==void 0?{adapter:z.adapter}:{}}}async function D(z,B){let G=await J(z);N(G,[220],"greeting");let F=await I(z,B.host),W=F.some((Q)=>Q.toUpperCase()==="STARTTLS");if(!B.secure&&!z.secure&&W){await Y(z,Z({type:"STARTTLS"}));let Q=await J(z);N(Q,[220],"STARTTLS"),await z.startTLS(B.tls),F=await I(z,B.host)}if(B.auth){let Q=B.requireTLS??!0,V=z.secure||B.secure;if(Q&&!V)throw new $("Refusing to authenticate over unencrypted connection. Set requireTLS: false to disable this check (not recommended).",0,"AUTH","");await l(z,B.auth,F)}}async function S(z,B){await _(z,{type:"MAIL_FROM",address:B.envelope.from});let G=await J(z);N(G,[250],"MAIL FROM");let F=[],W=[];for(let K of B.envelope.to)if(await Y(z,Z({type:"RCPT_TO",address:K})),(await J(z)).isSuccess)F.push(K);else W.push(K);await _(z,{type:"DATA"});let Q=await J(z);N(Q,[354],"DATA");let V;try{await Y(z,Z({type:"DATA_BODY",content:B.raw})),V=await J(z)}catch(K){if(await Y(z,Z({type:"DATA_BODY",content:B.raw})),V=await J(z),V.isError)throw K}return N(V,[250],"DATA end"),{messageId:B.messageId,accepted:F,rejected:W,response:V.message,envelope:B.envelope}}async function H(z){try{await _(z,{type:"QUIT"}),await J(z)}catch{}finally{await z.close()}}async function I(z,B){await _(z,{type:"EHLO",domain:B});let G=await J(z);return N(G,[250],"EHLO"),v(G)}async function l(z,B,G){if(B.type==="OAUTH2"&&B.oauth2){let K=await new U(B.oauth2).buildXOAUTH2();await _(z,{type:"AUTH_XOAUTH2",xoauth2String:K});let x=await J(z);if(x.code===334)await Y(z,E("")),x=await J(z);N(x,[235],"AUTH XOAUTH2");return}let F=B.type??L(G);if(F==="CRAM-MD5"){let V=y(B,"CRAM-MD5");await _(z,{type:"AUTH_CRAM_MD5_INIT"});let K=await J(z);N(K,[334],"AUTH CRAM-MD5");let x=K.message.trim(),w=await k(x,B.user,V);await _(z,{type:"AUTH_CRAM_MD5_RESPONSE",response:w}),K=await J(z),N(K,[235],"AUTH CRAM-MD5 response");return}if(F==="PLAIN"){let V=y(B,"PLAIN");await Y(z,Z({type:"AUTH_PLAIN",user:B.user,pass:V}));let K=await J(z);N(K,[235],"AUTH PLAIN");return}let W=y(B,"LOGIN");await Y(z,Z({type:"AUTH_LOGIN",user:B.user,pass:W}));let Q=await J(z);N(Q,[334],"AUTH LOGIN"),await Y(z,j(B.user)),Q=await J(z),N(Q,[334],"AUTH LOGIN user"),await Y(z,A(W)),Q=await J(z),N(Q,[235],"AUTH LOGIN pass")}function y(z,B){if(!z.pass)throw new $(`Password required for ${B} authentication`,0,`AUTH ${B}`,"");return z.pass}async function _(z,B){await Y(z,Z(B))}async function Y(z,B){await z.write(B)}async function J(z){let B=[];for await(let G of z.read()){B.push(G);let F=q(B);if(F)return O(F)}throw new $("Connection closed while reading SMTP response",0,"READ","")}async function M(z){let G=await(await import("node:dns/promises")).resolveMx(z);if(G.length===0)throw new $(`No MX records for ${z}`,0,"MX","");return G.sort((F,W)=>F.priority-W.priority),G[0]?.exchange??z}export{T as n,P as o,D as p,S as q,H as r,J as s};
 
-//# debugId=B20B39B95D5ED1FD64756E2164756E21
+//# debugId=2968A910208D398E64756E2164756E21

package/dist/{chunk-vjpds2pf.js.map → chunk-a057jzsy.js.map}

@@ -5,6 +5,6 @@
     "/**\n * @module\n * SMTP transport — orchestrates socket adapter, MIME builder, and protocol logic.\n *\n * @example\n * ```ts\n * import { SMTPTransport } from \"sently/transports/smtp\";\n * import { NodeAdapter } from \"sently/adapters/node\";\n * import { createMailer } from \"sently/mailer\";\n *\n * const mailer = await createMailer({\n *   transport: new SMTPTransport({\n *     host: \"smtp.example.com\",\n *     auth: { user: \"you@example.com\", pass: \"secret\" },\n *     adapter: new NodeAdapter(),\n *   }),\n * });\n * ```\n */\nimport { OAuth2Client } from \"../auth/oauth2.js\";\nimport { buildMIME, type MIMEBuildResult } from \"../core/mime.js\";\nimport type { SMTPResponse } from \"../core/smtp.js\";\nimport {\n  accumulateResponse,\n  assertResponse,\n  computeCRAMMD5,\n  encodeAuthLoginPass,\n  encodeAuthLoginUser,\n  encodeCommand,\n  encodeLine,\n  parseEHLO,\n  parseResponse,\n  SMTPError,\n  selectAuthMethod,\n} from \"../core/smtp.js\";\nimport type {\n  MailOptions,\n  SendResult,\n  SMTPConfig,\n  SocketAdapter,\n  Transport,\n  VerifyResult,\n} from \"../core/types.js\";\nimport { resolveAttachments } from \"./resolve-attachments.js\";\n\n/**\n * SMTP transport orchestrating adapter, MIME builder, and protocol logic.\n */\nexport class SMTPTransport implements Transport {\n  readonly provider = \"smtp\";\n\n  /** Resolved SMTP configuration with defaults applied. */\n  private readonly config: ResolvedSMTPConfig;\n  /** Active socket adapter for the current session, if any. */\n  private adapter: SocketAdapter | null = null;\n\n  /** Creates an SMTP transport with the given configuration. */\n  constructor(config: SMTPConfig) {\n    this.config = resolveSMTPConfig(config);\n  }\n\n  /** Sends an email via SMTP using the configured adapter. */\n  async send(options: MailOptions): Promise<SendResult> {\n    const resolvedOptions = {\n      ...options,\n      attachments: await resolveAttachments(options.attachments),\n    };\n    const mime = await buildMIME(resolvedOptions, this.config.dkim);\n    const adapter = await this.getAdapter();\n\n    const host = this.config.direct\n      ? await resolveMX(mime.envelope.from.split(\"@\")[1] ?? this.config.host)\n      : this.config.host;\n\n    await adapter.connect(host, this.config.port);\n    this.adapter = adapter;\n\n    try {\n      await openSMTPSession(adapter, this.config);\n      return await deliverSMTPMessage(adapter, mime);\n    } finally {\n      await closeSMTPSession(adapter);\n      this.adapter = null;\n    }\n  }\n\n  /** Verifies SMTP connectivity and authentication without sending mail. */\n  async verify(): Promise<VerifyResult> {\n    try {\n      const adapter = await this.getAdapter();\n      await adapter.connect(this.config.host, this.config.port);\n\n      try {\n        await openSMTPSession(adapter, this.config);\n        return { ok: true, provider: \"smtp\" };\n      } finally {\n        await closeSMTPSession(adapter);\n      }\n    } catch (err) {\n      return {\n        ok: false,\n        provider: \"smtp\",\n        message: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  /** Closes the underlying socket adapter if connected. */\n  async close(): Promise<void> {\n    if (this.adapter) {\n      await this.adapter.close();\n      this.adapter = null;\n    }\n  }\n\n  /** Returns the configured socket adapter or throws if none is set. */\n  private async getAdapter(): Promise<SocketAdapter> {\n    if (!this.config.adapter) {\n      throw new SMTPError(\"No socket adapter configured\", 0, \"CONNECT\", \"\");\n    }\n    return this.config.adapter;\n  }\n}\n\n/** Resolved SMTP transport configuration with defaults applied. */\nexport interface ResolvedSMTPConfig {\n  /** SMTP server hostname. */\n  host: string;\n  /** SMTP port with secure/default applied. */\n  port: number;\n  /** Whether implicit TLS is used. */\n  secure: boolean;\n  /** Resolved authentication credentials, if any. */\n  auth?: SMTPConfig[\"auth\"];\n  /** Whether AUTH requires an encrypted connection. */\n  requireTLS?: boolean;\n  /** TLS options for STARTTLS and direct TLS. */\n  tls?: SMTPConfig[\"tls\"];\n  /** DKIM signing configuration. */\n  dkim?: SMTPConfig[\"dkim\"];\n  /** Socket connect timeout in milliseconds. */\n  connectionTimeout?: number;\n  /** Timeout waiting for the SMTP greeting in milliseconds. */\n  greetingTimeout?: number;\n  /** Idle socket timeout in milliseconds. */\n  socketTimeout?: number;\n  /** Direct-to-MX delivery mode. */\n  direct?: boolean;\n  /** Runtime socket adapter. */\n  adapter?: SocketAdapter;\n}\n\n/** Apply defaults to SMTP configuration. */\nexport function resolveSMTPConfig(config: SMTPConfig): ResolvedSMTPConfig {\n  const secure = config.secure ?? false;\n  return {\n    host: config.host,\n    port: config.port ?? (secure ? 465 : 587),\n    secure,\n    ...(config.auth !== undefined ? { auth: config.auth } : {}),\n    ...(config.requireTLS !== undefined ? { requireTLS: config.requireTLS } : {}),\n    ...(config.dkim !== undefined ? { dkim: config.dkim } : {}),\n    ...(config.tls !== undefined ? { tls: config.tls } : {}),\n    ...(config.connectionTimeout !== undefined\n      ? { connectionTimeout: config.connectionTimeout }\n      : {}),\n    ...(config.greetingTimeout !== undefined ? { greetingTimeout: config.greetingTimeout } : {}),\n    ...(config.socketTimeout !== undefined ? { socketTimeout: config.socketTimeout } : {}),\n    ...(config.direct !== undefined ? { direct: config.direct } : {}),\n    ...(config.adapter !== undefined ? { adapter: config.adapter } : {}),\n  };\n}\n\n/**\n * Connect greeting, EHLO, optional STARTTLS, and AUTH on an open adapter.\n */\nexport async function openSMTPSession(\n  adapter: SocketAdapter,\n  config: ResolvedSMTPConfig,\n): Promise<void> {\n  const greeting = await readSMTPResponse(adapter);\n  assertResponse(greeting, [220], \"greeting\");\n\n  let capabilities = await ehlo(adapter, config.host);\n  const supportsStartTls = capabilities.some((cap) => cap.toUpperCase() === \"STARTTLS\");\n  if (!config.secure && !adapter.secure && supportsStartTls) {\n    await sendRaw(adapter, encodeCommand({ type: \"STARTTLS\" }));\n    const starttlsResp = await readSMTPResponse(adapter);\n    assertResponse(starttlsResp, [220], \"STARTTLS\");\n    await adapter.startTLS(config.tls);\n    capabilities = await ehlo(adapter, config.host);\n  }\n\n  if (config.auth) {\n    const tlsRequired = config.requireTLS ?? true;\n    const encrypted = adapter.secure || config.secure;\n    if (tlsRequired && !encrypted) {\n      throw new SMTPError(\n        \"Refusing to authenticate over unencrypted connection. \" +\n          \"Set requireTLS: false to disable this check (not recommended).\",\n        0,\n        \"AUTH\",\n        \"\",\n      );\n    }\n    await authenticate(adapter, config.auth, capabilities);\n  }\n}\n\n/**\n * MAIL FROM, RCPT TO, and DATA for a built MIME message on an authenticated session.\n */\nexport async function deliverSMTPMessage(\n  adapter: SocketAdapter,\n  mime: MIMEBuildResult,\n): Promise<SendResult> {\n  await sendCommand(adapter, { type: \"MAIL_FROM\", address: mime.envelope.from });\n  const mailResp = await readSMTPResponse(adapter);\n  assertResponse(mailResp, [250], \"MAIL FROM\");\n\n  const accepted: string[] = [];\n  const rejected: string[] = [];\n\n  for (const recipient of mime.envelope.to) {\n    await sendRaw(adapter, encodeCommand({ type: \"RCPT_TO\", address: recipient }));\n    const rcptResp = await readSMTPResponse(adapter);\n    if (rcptResp.isSuccess) {\n      accepted.push(recipient);\n    } else {\n      rejected.push(recipient);\n    }\n  }\n\n  await sendCommand(adapter, { type: \"DATA\" });\n  const dataResp = await readSMTPResponse(adapter);\n  assertResponse(dataResp, [354], \"DATA\");\n\n  let finalResp: SMTPResponse;\n  try {\n    await sendRaw(adapter, encodeCommand({ type: \"DATA_BODY\", content: mime.raw }));\n    finalResp = await readSMTPResponse(adapter);\n  } catch (err) {\n    await sendRaw(adapter, encodeCommand({ type: \"DATA_BODY\", content: mime.raw }));\n    finalResp = await readSMTPResponse(adapter);\n    if (finalResp.isError) {\n      throw err;\n    }\n  }\n  assertResponse(finalResp, [250], \"DATA end\");\n\n  return {\n    messageId: mime.messageId,\n    accepted,\n    rejected,\n    response: finalResp.message,\n    envelope: mime.envelope,\n  };\n}\n\n/**\n * QUIT and close an SMTP session adapter.\n */\nexport async function closeSMTPSession(adapter: SocketAdapter): Promise<void> {\n  try {\n    await sendCommand(adapter, { type: \"QUIT\" });\n    await readSMTPResponse(adapter);\n  } catch {\n    // ignore errors during shutdown\n  } finally {\n    await adapter.close();\n  }\n}\n\nasync function ehlo(adapter: SocketAdapter, host: string): Promise<string[]> {\n  await sendCommand(adapter, { type: \"EHLO\", domain: host });\n  const response = await readSMTPResponse(adapter);\n  assertResponse(response, [250], \"EHLO\");\n  return parseEHLO(response);\n}\n\nasync function authenticate(\n  adapter: SocketAdapter,\n  auth: NonNullable<SMTPConfig[\"auth\"]>,\n  capabilities: string[],\n): Promise<void> {\n  if (auth.type === \"OAUTH2\" && auth.oauth2) {\n    const client = new OAuth2Client(auth.oauth2);\n    const xoauth2 = await client.buildXOAUTH2();\n    await sendCommand(adapter, { type: \"AUTH_XOAUTH2\", xoauth2String: xoauth2 });\n    let resp = await readSMTPResponse(adapter);\n    if (resp.code === 334) {\n      await sendRaw(adapter, encodeLine(\"\"));\n      resp = await readSMTPResponse(adapter);\n    }\n    assertResponse(resp, [235], \"AUTH XOAUTH2\");\n    return;\n  }\n\n  const method = auth.type ?? selectAuthMethod(capabilities);\n\n  if (method === \"CRAM-MD5\") {\n    const pass = requirePassword(auth, \"CRAM-MD5\");\n    await sendCommand(adapter, { type: \"AUTH_CRAM_MD5_INIT\" });\n    let resp = await readSMTPResponse(adapter);\n    assertResponse(resp, [334], \"AUTH CRAM-MD5\");\n    const challenge = resp.message.trim();\n    const response = await computeCRAMMD5(challenge, auth.user, pass);\n    await sendCommand(adapter, { type: \"AUTH_CRAM_MD5_RESPONSE\", response });\n    resp = await readSMTPResponse(adapter);\n    assertResponse(resp, [235], \"AUTH CRAM-MD5 response\");\n    return;\n  }\n\n  if (method === \"PLAIN\") {\n    const pass = requirePassword(auth, \"PLAIN\");\n    await sendRaw(adapter, encodeCommand({ type: \"AUTH_PLAIN\", user: auth.user, pass }));\n    const resp = await readSMTPResponse(adapter);\n    assertResponse(resp, [235], \"AUTH PLAIN\");\n    return;\n  }\n\n  const pass = requirePassword(auth, \"LOGIN\");\n  await sendRaw(adapter, encodeCommand({ type: \"AUTH_LOGIN\", user: auth.user, pass }));\n  let resp = await readSMTPResponse(adapter);\n  assertResponse(resp, [334], \"AUTH LOGIN\");\n\n  await sendRaw(adapter, encodeAuthLoginUser(auth.user));\n  resp = await readSMTPResponse(adapter);\n  assertResponse(resp, [334], \"AUTH LOGIN user\");\n\n  await sendRaw(adapter, encodeAuthLoginPass(pass));\n  resp = await readSMTPResponse(adapter);\n  assertResponse(resp, [235], \"AUTH LOGIN pass\");\n}\n\nfunction requirePassword(auth: NonNullable<SMTPConfig[\"auth\"]>, method: string): string {\n  if (!auth.pass) {\n    throw new SMTPError(`Password required for ${method} authentication`, 0, `AUTH ${method}`, \"\");\n  }\n  return auth.pass;\n}\n\nasync function sendCommand(\n  adapter: SocketAdapter,\n  command: Parameters<typeof encodeCommand>[0],\n): Promise<void> {\n  await sendRaw(adapter, encodeCommand(command));\n}\n\nasync function sendRaw(adapter: SocketAdapter, data: Uint8Array): Promise<void> {\n  await adapter.write(data);\n}\n\n/** Reads and parses a complete SMTP response from the adapter. */\nasync function readSMTPResponse(adapter: SocketAdapter): Promise<SMTPResponse> {\n  const chunks: Uint8Array[] = [];\n  for await (const chunk of adapter.read()) {\n    chunks.push(chunk);\n    const complete = accumulateResponse(chunks);\n    if (complete) {\n      return parseResponse(complete);\n    }\n  }\n  throw new SMTPError(\"Connection closed while reading SMTP response\", 0, \"READ\", \"\");\n}\n\nasync function resolveMX(domain: string): Promise<string> {\n  const dns = await import(\"node:dns/promises\");\n  const records = await dns.resolveMx(domain);\n  if (records.length === 0) {\n    throw new SMTPError(`No MX records for ${domain}`, 0, \"MX\", \"\");\n  }\n  records.sort((a: { priority: number }, b: { priority: number }) => a.priority - b.priority);\n  return records[0]?.exchange ?? domain;\n}\n\nexport { SMTPError } from \"../core/smtp.js\";\n/** @internal Test helper for raw line writes. */\nexport { encodeLine, readSMTPResponse };\n"
   ],
   "mappings": "uSAgDO,AAAM,LAAmC,LACrC,GAAW,OAGH,OAET,QAAgC,KAGxC,WAAW,CAAC,EAAoB,CAC9B,KAAK,OAAS,EAAkB,CAAM,OAIlC,KAAI,CAAC,EAA2C,CACpD,IAAM,EAAkB,IACnB,EACH,YAAa,MAAM,EAAmB,EAAQ,WAAW,CAC3D,EACM,EAAO,MAAM,EAAU,EAAiB,KAAK,OAAO,IAAI,EACxD,EAAU,MAAM,KAAK,WAAW,EAEhC,EAAO,KAAK,OAAO,OACrB,MAAM,EAAU,EAAK,SAAS,KAAK,MAAM,GAAG,EAAE,IAAM,KAAK,OAAO,IAAI,EACpE,KAAK,OAAO,KAEhB,MAAM,EAAQ,QAAQ,EAAM,KAAK,OAAO,IAAI,EAC5C,KAAK,QAAU,EAEf,GAAI,CAEF,OADA,MAAM,EAAgB,EAAS,KAAK,MAAM,EACnC,MAAM,EAAmB,EAAS,CAAI,SAC7C,CACA,MAAM,EAAiB,CAAO,EAC9B,KAAK,QAAU,WAKb,OAAM,EAA0B,CACpC,GAAI,CACF,IAAM,EAAU,MAAM,KAAK,WAAW,EACtC,MAAM,EAAQ,QAAQ,KAAK,OAAO,KAAM,KAAK,OAAO,IAAI,EAExD,GAAI,CAEF,OADA,MAAM,EAAgB,EAAS,KAAK,MAAM,EACnC,CAAE,GAAI,GAAM,SAAU,MAAO,SACpC,CACA,MAAM,EAAiB,CAAO,GAEhC,MAAO,EAAK,CACZ,MAAO,CACL,GAAI,GACJ,SAAU,OACV,QAAS,aAAe,MAAQ,EAAI,QAAU,OAAO,CAAG,CAC1D,QAKE,MAAK,EAAkB,CAC3B,GAAI,KAAK,QACP,MAAM,KAAK,QAAQ,MAAM,EACzB,KAAK,QAAU,UAKL,WAAU,EAA2B,CACjD,GAAI,CAAC,KAAK,OAAO,QACf,MAAM,IAAI,EAAU,+BAAgC,EAAG,UAAW,EAAE,EAEtE,OAAO,KAAK,OAAO,QAEvB,CA+BO,SAAS,CAAiB,CAAC,EAAwC,CACxE,IAAM,EAAS,EAAO,QAAU,GAChC,MAAO,CACL,KAAM,EAAO,KACb,KAAM,EAAO,OAAS,EAAS,IAAM,KACrC,YACI,EAAO,OAAS,OAAY,CAAE,KAAM,EAAO,IAAK,EAAI,CAAC,KACrD,EAAO,aAAe,OAAY,CAAE,WAAY,EAAO,UAAW,EAAI,CAAC,KACvE,EAAO,OAAS,OAAY,CAAE,KAAM,EAAO,IAAK,EAAI,CAAC,KACrD,EAAO,MAAQ,OAAY,CAAE,IAAK,EAAO,GAAI,EAAI,CAAC,KAClD,EAAO,oBAAsB,OAC7B,CAAE,kBAAmB,EAAO,iBAAkB,EAC9C,CAAC,KACD,EAAO,kBAAoB,OAAY,CAAE,gBAAiB,EAAO,eAAgB,EAAI,CAAC,KACtF,EAAO,gBAAkB,OAAY,CAAE,cAAe,EAAO,aAAc,EAAI,CAAC,KAChF,EAAO,SAAW,OAAY,CAAE,OAAQ,EAAO,MAAO,EAAI,CAAC,KAC3D,EAAO,UAAY,OAAY,CAAE,QAAS,EAAO,OAAQ,EAAI,CAAC,CACpE,EAMF,eAAsB,CAAe,CACnC,EACA,EACe,CACf,IAAM,EAAW,MAAM,EAAiB,CAAO,EAC/C,EAAe,EAAU,CAAC,GAAG,EAAG,UAAU,EAE1C,IAAI,EAAe,MAAM,EAAK,EAAS,EAAO,IAAI,EAC5C,EAAmB,EAAa,KAAK,CAAC,IAAQ,EAAI,YAAY,IAAM,UAAU,EACpF,GAAI,CAAC,EAAO,QAAU,CAAC,EAAQ,QAAU,EAAkB,CACzD,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,UAAW,CAAC,CAAC,EAC1D,IAAM,EAAe,MAAM,EAAiB,CAAO,EACnD,EAAe,EAAc,CAAC,GAAG,EAAG,UAAU,EAC9C,MAAM,EAAQ,SAAS,EAAO,GAAG,EACjC,EAAe,MAAM,EAAK,EAAS,EAAO,IAAI,EAGhD,GAAI,EAAO,KAAM,CACf,IAAM,EAAc,EAAO,YAAc,GACnC,EAAY,EAAQ,QAAU,EAAO,OAC3C,GAAI,GAAe,CAAC,EAClB,MAAM,IAAI,EACR,uHAEA,EACA,OACA,EACF,EAEF,MAAM,EAAa,EAAS,EAAO,KAAM,CAAY,GAOzD,eAAsB,CAAkB,CACtC,EACA,EACqB,CACrB,MAAM,EAAY,EAAS,CAAE,KAAM,YAAa,QAAS,EAAK,SAAS,IAAK,CAAC,EAC7E,IAAM,EAAW,MAAM,EAAiB,CAAO,EAC/C,EAAe,EAAU,CAAC,GAAG,EAAG,WAAW,EAE3C,IAAM,EAAqB,CAAC,EACtB,EAAqB,CAAC,EAE5B,QAAW,KAAa,EAAK,SAAS,GAGpC,GAFA,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,UAAW,QAAS,CAAU,CAAC,CAAC,GAC5D,MAAM,EAAiB,CAAO,GAClC,UACX,EAAS,KAAK,CAAS,EAEvB,OAAS,KAAK,CAAS,EAI3B,MAAM,EAAY,EAAS,CAAE,KAAM,MAAO,CAAC,EAC3C,IAAM,EAAW,MAAM,EAAiB,CAAO,EAC/C,EAAe,EAAU,CAAC,GAAG,EAAG,MAAM,EAEtC,IAAI,EACJ,GAAI,CACF,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,YAAa,QAAS,EAAK,GAAI,CAAC,CAAC,EAC9E,EAAY,MAAM,EAAiB,CAAO,EAC1C,MAAO,EAAK,CAGZ,GAFA,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,YAAa,QAAS,EAAK,GAAI,CAAC,CAAC,EAC9E,EAAY,MAAM,EAAiB,CAAO,EACtC,EAAU,QACZ,MAAM,EAKV,OAFA,EAAe,EAAW,CAAC,GAAG,EAAG,UAAU,EAEpC,CACL,UAAW,EAAK,UAChB,WACA,WACA,SAAU,EAAU,QACpB,SAAU,EAAK,QACjB,EAMF,eAAsB,CAAgB,CAAC,EAAuC,CAC5E,GAAI,CACF,MAAM,EAAY,EAAS,CAAE,KAAM,MAAO,CAAC,EAC3C,MAAM,EAAiB,CAAO,EAC9B,KAAM,SAEN,CACA,MAAM,EAAQ,MAAM,GAIxB,eAAe,CAAI,CAAC,EAAwB,EAAiC,CAC3E,MAAM,EAAY,EAAS,CAAE,KAAM,OAAQ,OAAQ,CAAK,CAAC,EACzD,IAAM,EAAW,MAAM,EAAiB,CAAO,EAE/C,OADA,EAAe,EAAU,CAAC,GAAG,EAAG,MAAM,EAC/B,EAAU,CAAQ,EAG3B,eAAe,CAAY,CACzB,EACA,EACA,EACe,CACf,GAAI,EAAK,OAAS,UAAY,EAAK,OAAQ,CAEzC,IAAM,EAAU,MADD,IAAI,EAAa,EAAK,MAAM,EACd,aAAa,EAC1C,MAAM,EAAY,EAAS,CAAE,KAAM,eAAgB,cAAe,CAAQ,CAAC,EAC3E,IAAI,EAAO,MAAM,EAAiB,CAAO,EACzC,GAAI,EAAK,OAAS,IAChB,MAAM,EAAQ,EAAS,EAAW,EAAE,CAAC,EACrC,EAAO,MAAM,EAAiB,CAAO,EAEvC,EAAe,EAAM,CAAC,GAAG,EAAG,cAAc,EAC1C,OAGF,IAAM,EAAS,EAAK,MAAQ,EAAiB,CAAY,EAEzD,GAAI,IAAW,WAAY,CACzB,IAAM,EAAO,EAAgB,EAAM,UAAU,EAC7C,MAAM,EAAY,EAAS,CAAE,KAAM,oBAAqB,CAAC,EACzD,IAAI,EAAO,MAAM,EAAiB,CAAO,EACzC,EAAe,EAAM,CAAC,GAAG,EAAG,eAAe,EAC3C,IAAM,EAAY,EAAK,QAAQ,KAAK,EAC9B,EAAW,MAAM,EAAe,EAAW,EAAK,KAAM,CAAI,EAChE,MAAM,EAAY,EAAS,CAAE,KAAM,yBAA0B,UAAS,CAAC,EACvE,EAAO,MAAM,EAAiB,CAAO,EACrC,EAAe,EAAM,CAAC,GAAG,EAAG,wBAAwB,EACpD,OAGF,GAAI,IAAW,QAAS,CACtB,IAAM,EAAO,EAAgB,EAAM,OAAO,EAC1C,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,aAAc,KAAM,EAAK,KAAM,MAAK,CAAC,CAAC,EACnF,IAAM,EAAO,MAAM,EAAiB,CAAO,EAC3C,EAAe,EAAM,CAAC,GAAG,EAAG,YAAY,EACxC,OAGF,IAAM,EAAO,EAAgB,EAAM,OAAO,EAC1C,MAAM,EAAQ,EAAS,EAAc,CAAE,KAAM,aAAc,KAAM,EAAK,KAAM,MAAK,CAAC,CAAC,EACnF,IAAI,EAAO,MAAM,EAAiB,CAAO,EACzC,EAAe,EAAM,CAAC,GAAG,EAAG,YAAY,EAExC,MAAM,EAAQ,EAAS,EAAoB,EAAK,IAAI,CAAC,EACrD,EAAO,MAAM,EAAiB,CAAO,EACrC,EAAe,EAAM,CAAC,GAAG,EAAG,iBAAiB,EAE7C,MAAM,EAAQ,EAAS,EAAoB,CAAI,CAAC,EAChD,EAAO,MAAM,EAAiB,CAAO,EACrC,EAAe,EAAM,CAAC,GAAG,EAAG,iBAAiB,EAG/C,SAAS,CAAe,CAAC,EAAuC,EAAwB,CACtF,GAAI,CAAC,EAAK,KACR,MAAM,IAAI,EAAU,yBAAyB,mBAAyB,EAAG,QAAQ,IAAU,EAAE,EAE/F,OAAO,EAAK,KAGd,eAAe,CAAW,CACxB,EACA,EACe,CACf,MAAM,EAAQ,EAAS,EAAc,CAAO,CAAC,EAG/C,eAAe,CAAO,CAAC,EAAwB,EAAiC,CAC9E,MAAM,EAAQ,MAAM,CAAI,EAI1B,eAAe,CAAgB,CAAC,EAA+C,CAC7E,IAAM,EAAuB,CAAC,EAC9B,cAAiB,KAAS,EAAQ,KAAK,EAAG,CACxC,EAAO,KAAK,CAAK,EACjB,IAAM,EAAW,EAAmB,CAAM,EAC1C,GAAI,EACF,OAAO,EAAc,CAAQ,EAGjC,MAAM,IAAI,EAAU,gDAAiD,EAAG,OAAQ,EAAE,EAGpF,eAAe,CAAS,CAAC,EAAiC,CAExD,IAAM,EAAU,MADJ,KAAa,8BACC,UAAU,CAAM,EAC1C,GAAI,EAAQ,SAAW,EACrB,MAAM,IAAI,EAAU,qBAAqB,IAAU,EAAG,KAAM,EAAE,EAGhE,OADA,EAAQ,KAAK,CAAC,EAAyB,IAA4B,EAAE,SAAW,EAAE,QAAQ,EACnF,EAAQ,IAAI,UAAY",
-  "debugId": "B20B39B95D5ED1FD64756E2164756E21",
+  "debugId": "2968A910208D398E64756E2164756E21",
   "names": []
 }

package/dist/{chunk-8njyga62.js → chunk-bhr7w3gg.js}

@@ -1,4 +1,4 @@
 function j(b){if(b.idempotencyKey)return b.idempotencyKey;if(b.messageId)return`msg:${b.messageId}`;return}
-export{j as H};
+export{j as J};
 
-//# debugId=EE388F66D48DCA5764756E2164756E21
+//# debugId=562807E14631A65364756E2164756E21

package/dist/{chunk-8njyga62.js.map → chunk-bhr7w3gg.js.map}

@@ -5,6 +5,6 @@
     "import type { MailOptions } from \"./types.js\";\n\n/**\n * Resolve the idempotency key for a message.\n * Uses explicit `idempotencyKey` or derives from `messageId` when present.\n */\nexport function resolveIdempotencyKey(options: MailOptions): string | undefined {\n  if (options.idempotencyKey) {\n    return options.idempotencyKey;\n  }\n  if (options.messageId) {\n    return `msg:${options.messageId}`;\n  }\n  return undefined;\n}\n"
   ],
   "mappings": "AAMO,SAAS,CAAqB,CAAC,EAA0C,CAC9E,GAAI,EAAQ,eACV,OAAO,EAAQ,eAEjB,GAAI,EAAQ,UACV,MAAO,OAAO,EAAQ,YAExB",
-  "debugId": "EE388F66D48DCA5764756E2164756E21",
+  "debugId": "562807E14631A65364756E2164756E21",
   "names": []
 }

package/dist/chunk-cs1tvehn.js

@@ -0,0 +1,4 @@
+function n(e){if(e.provider!==void 0&&e.provider.length>0)return e.provider;let r=e.constructor.name;if(r==="Object")return"custom";if(r.endsWith("Transport"))return r.slice(0,-9).toLowerCase();return r.toLowerCase()||"unknown"}
+export{n as P};
+
+//# debugId=46AAB8C72DDDE12C64756E2164756E21

package/dist/chunk-cs1tvehn.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/core/provider-label.ts"],
+  "sourcesContent": [
+    "/**\n * Resolve a stable provider label for observability and diagnostics.\n * Prefers `transport.provider` when set; falls back to constructor name.\n */\nexport function getProviderLabel(transport: {\n  readonly provider?: string;\n  readonly constructor: { name: string };\n}): string {\n  if (transport.provider !== undefined && transport.provider.length > 0) {\n    return transport.provider;\n  }\n\n  const name = transport.constructor.name;\n  if (name === \"Object\") {\n    return \"custom\";\n  }\n  if (name.endsWith(\"Transport\")) {\n    return name.slice(0, -\"Transport\".length).toLowerCase();\n  }\n  return name.toLowerCase() || \"unknown\";\n}\n"
+  ],
+  "mappings": "AAIO,SAAS,CAAgB,CAAC,EAGtB,CACT,GAAI,EAAU,WAAa,QAAa,EAAU,SAAS,OAAS,EAClE,OAAO,EAAU,SAGnB,IAAM,EAAO,EAAU,YAAY,KACnC,GAAI,IAAS,SACX,MAAO,SAET,GAAI,EAAK,SAAS,WAAW,EAC3B,OAAO,EAAK,MAAM,EAAG,EAAmB,EAAE,YAAY,EAExD,OAAO,EAAK,YAAY,GAAK",
+  "debugId": "46AAB8C72DDDE12C64756E2164756E21",
+  "names": []
+}

package/dist/{chunk-29z7fkzy.js → chunk-d5aw5vag.js}

@@ -1,4 +1,4 @@
-import{fa as q}from"./chunk-6npp3x3c.js";function w(){if(typeof Bun<"u")return"bun";if(typeof Deno<"u")return"deno";if(typeof caches<"u"&&globalThis.navigator?.userAgent==="Cloudflare-Workers")return"cf-workers";if(typeof window<"u")return"browser";if(typeof process<"u"&&process.versions?.node)return"node";return"unknown"}async function x(k){let v=w();switch(v){case"node":{let{NodeAdapter:g}=await import("./adapters/node.js");return new g(k)}case"bun":{let{BunAdapter:g}=await import("./adapters/bun.js");return new g(k)}case"deno":{let{DenoAdapter:g}=await import("./adapters/deno.js");return new g(k)}case"cf-workers":{let{CloudflareAdapter:g}=await import("./adapters/cf.js");return new g(k)}default:throw Error(`No socket adapter available for runtime: ${v}`)}}
-export{w as J,x as K};
+import{ma as q}from"./chunk-th4cwrpb.js";function w(){if(typeof Bun<"u")return"bun";if(typeof Deno<"u")return"deno";if(typeof caches<"u"&&globalThis.navigator?.userAgent==="Cloudflare-Workers")return"cf-workers";if(typeof window<"u")return"browser";if(typeof process<"u"&&process.versions?.node)return"node";return"unknown"}async function x(k){let v=w();switch(v){case"node":{let{NodeAdapter:g}=await import("./adapters/node.js");return new g(k)}case"bun":{let{BunAdapter:g}=await import("./adapters/bun.js");return new g(k)}case"deno":{let{DenoAdapter:g}=await import("./adapters/deno.js");return new g(k)}case"cf-workers":{let{CloudflareAdapter:g}=await import("./adapters/cf.js");return new g(k)}default:throw Error(`No socket adapter available for runtime: ${v}`)}}
+export{w as L,x as M};
 
-//# debugId=26DA36861A97760764756E2164756E21
+//# debugId=BEBFDE73D023C88B64756E2164756E21

package/dist/{chunk-29z7fkzy.js.map → chunk-d5aw5vag.js.map}

@@ -5,6 +5,6 @@
     "// src/detect.ts\nimport type { Runtime, SocketAdapter, TLSOptions } from \"./core/types.js\";\n\n/** Detect the current JavaScript runtime. */\nexport function detectRuntime(): Runtime {\n  if (typeof Bun !== \"undefined\") {\n    return \"bun\";\n  }\n  if (typeof Deno !== \"undefined\") {\n    return \"deno\";\n  }\n  if (typeof caches !== \"undefined\" && globalThis.navigator?.userAgent === \"Cloudflare-Workers\") {\n    return \"cf-workers\";\n  }\n  if (typeof window !== \"undefined\") {\n    return \"browser\";\n  }\n  if (typeof process !== \"undefined\" && process.versions?.node) {\n    return \"node\";\n  }\n  return \"unknown\";\n}\n\n/**\n * Dynamically import and instantiate the correct adapter for the current runtime.\n */\nexport async function createDefaultAdapter(options?: {\n  secure?: boolean;\n  connectionTimeout?: number;\n  tls?: TLSOptions;\n}): Promise<SocketAdapter> {\n  const runtime = detectRuntime();\n\n  switch (runtime) {\n    case \"node\": {\n      const { NodeAdapter } = await import(\"./adapters/node.js\");\n      return new NodeAdapter(options);\n    }\n    case \"bun\": {\n      const { BunAdapter } = await import(\"./adapters/bun.js\");\n      return new BunAdapter(options);\n    }\n    case \"deno\": {\n      const { DenoAdapter } = await import(\"./adapters/deno.js\");\n      return new DenoAdapter(options);\n    }\n    case \"cf-workers\": {\n      const { CloudflareAdapter } = await import(\"./adapters/cf.js\");\n      return new CloudflareAdapter(options);\n    }\n    default:\n      throw new Error(`No socket adapter available for runtime: ${runtime}`);\n  }\n}\n\ndeclare const Bun: unknown;\ndeclare const Deno: unknown;\n"
   ],
   "mappings": "yCAIO,SAAS,CAAa,EAAY,CACvC,GAAI,OAAO,IAAQ,IACjB,MAAO,MAET,GAAI,OAAO,KAAS,IAClB,MAAO,OAET,GAAI,OAAO,OAAW,KAAe,WAAW,WAAW,YAAc,qBACvE,MAAO,aAET,GAAI,OAAO,OAAW,IACpB,MAAO,UAET,GAAI,OAAO,QAAY,KAAe,QAAQ,UAAU,KACtD,MAAO,OAET,MAAO,UAMT,eAAsB,CAAoB,CAAC,EAIhB,CACzB,IAAM,EAAU,EAAc,EAE9B,OAAQ,OACD,OAAQ,CACX,IAAQ,eAAgB,KAAa,8BACrC,OAAO,IAAI,EAAY,CAAO,CAChC,KACK,MAAO,CACV,IAAQ,cAAe,KAAa,6BACpC,OAAO,IAAI,EAAW,CAAO,CAC/B,KACK,OAAQ,CACX,IAAQ,eAAgB,KAAa,8BACrC,OAAO,IAAI,EAAY,CAAO,CAChC,KACK,aAAc,CACjB,IAAQ,qBAAsB,KAAa,4BAC3C,OAAO,IAAI,EAAkB,CAAO,CACtC,SAEE,MAAU,MAAM,4CAA4C,GAAS",
-  "debugId": "26DA36861A97760764756E2164756E21",
+  "debugId": "BEBFDE73D023C88B64756E2164756E21",
   "names": []
 }

package/dist/chunk-f5x8vesr.js

@@ -0,0 +1,4 @@
+import{da as D,ia as J}from"./chunk-hnzmn4s4.js";var Q="https://oauth2.googleapis.com/token",$="https://login.microsoftonline.com/common/oauth2/v2.0/token",V=30000;class W{config;cachedToken=null;expiresAt=0;refreshPromise=null;constructor(m){if(this.config=m,m.accessToken)this.cachedToken=m.accessToken,this.expiresAt=Date.now()+3600000}async getAccessToken(){if(this.config.getToken)return this.config.getToken();if(this.cachedToken&&Date.now()<this.expiresAt-V)return this.cachedToken;if(!this.refreshPromise)this.refreshPromise=this.refreshAccessToken().finally(()=>{this.refreshPromise=null});return this.refreshPromise}async refreshAccessToken(){if(this.config.getToken){let v=await this.config.getToken();return this.cachedToken=v,this.expiresAt=Date.now()+3600000,v}let m=this.config.tokenUrl??Q,z=new URLSearchParams({client_id:this.config.clientId,client_secret:this.config.clientSecret,refresh_token:this.config.refreshToken,grant_type:"refresh_token"}),q=await fetch(m,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:z.toString()});if(!q.ok){let v=await q.text();throw Error(`OAuth2 token refresh failed (${q.status}): ${v}`)}let C=await q.json();return this.cachedToken=C.access_token,this.expiresAt=Date.now()+C.expires_in*1000,C.access_token}async buildXOAUTH2(){let m=await this.getAccessToken(),z=`user=${this.config.user}\x01auth=Bearer ${m}\x01\x01`;return D(J(z)).replace(/\r\n/g,"")}}
+export{Q as t,$ as u,W as v};
+
+//# debugId=9CF70341C886FD1964756E2164756E21

package/dist/{chunk-b602dhck.js.map → chunk-f5x8vesr.js.map}

@@ -4,7 +4,7 @@
   "sourcesContent": [
     "/**\n * @module\n * OAuth2 / XOAUTH2 authentication for SMTP.\n * Supports Gmail, Microsoft 365, and custom OAuth2 providers.\n *\n * @example\n * ```ts\n * import { OAuth2Client } from \"sently/auth/oauth2\";\n * const client = new OAuth2Client({\n *   user: \"me@gmail.com\",\n *   clientId: \"...\",\n *   clientSecret: \"...\",\n *   refreshToken: \"...\",\n * });\n * const token = await client.getAccessToken();\n * ```\n */\nimport { encodeBase64, encodeUtf8 } from \"../core/base64.js\";\nimport type { OAuth2Config } from \"../core/types.js\";\n\n/** Default Google OAuth2 token endpoint. */\nexport const GOOGLE_TOKEN_URL = \"https://oauth2.googleapis.com/token\";\n\n/** Microsoft OAuth2 token endpoint (common tenant). */\nexport const MICROSOFT_TOKEN_URL = \"https://login.microsoftonline.com/common/oauth2/v2.0/token\";\n\n/** OAuth2 token endpoint response shape. */\nexport interface TokenResponse {\n  /** Bearer access token for API or SMTP XOAUTH2. */\n  access_token: string;\n  /** Token lifetime in seconds. */\n  expires_in: number;\n  /** Token type (typically `\"Bearer\"`). */\n  token_type: string;\n}\n\nconst EXPIRY_BUFFER_MS = 30_000;\n\n/**\n * OAuth2 client with in-memory token cache and automatic refresh.\n */\nexport class OAuth2Client {\n  /** OAuth2 configuration supplied at construction. */\n  private readonly config: OAuth2Config;\n  /** Cached access token, or null before the first fetch. */\n  private cachedToken: string | null = null;\n  /** Expiry timestamp (ms) for the cached access token. */\n  private expiresAt = 0;\n  /** In-flight refresh promise used to deduplicate concurrent refreshes. */\n  private refreshPromise: Promise<string> | null = null;\n\n  /** Creates an OAuth2 client from configuration. */\n  constructor(config: OAuth2Config) {\n    this.config = config;\n    if (config.accessToken) {\n      this.cachedToken = config.accessToken;\n      this.expiresAt = Date.now() + 3_600_000;\n    }\n  }\n\n  /**\n   * Get a valid access token (cached when still valid, refreshed otherwise).\n   */\n  async getAccessToken(): Promise<string> {\n    if (this.config.getToken) {\n      return this.config.getToken();\n    }\n\n    if (this.cachedToken && Date.now() < this.expiresAt - EXPIRY_BUFFER_MS) {\n      return this.cachedToken;\n    }\n\n    if (!this.refreshPromise) {\n      this.refreshPromise = this.refreshAccessToken().finally(() => {\n        this.refreshPromise = null;\n      });\n    }\n    return this.refreshPromise;\n  }\n\n  /**\n   * Force-refresh the access token regardless of expiry.\n   */\n  async refreshAccessToken(): Promise<string> {\n    if (this.config.getToken) {\n      const token = await this.config.getToken();\n      this.cachedToken = token;\n      this.expiresAt = Date.now() + 3_600_000;\n      return token;\n    }\n\n    const tokenUrl = this.config.tokenUrl ?? GOOGLE_TOKEN_URL;\n    const body = new URLSearchParams({\n      client_id: this.config.clientId,\n      client_secret: this.config.clientSecret,\n      refresh_token: this.config.refreshToken,\n      grant_type: \"refresh_token\",\n    });\n\n    const response = await fetch(tokenUrl, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body: body.toString(),\n    });\n\n    if (!response.ok) {\n      const text = await response.text();\n      throw new Error(`OAuth2 token refresh failed (${response.status}): ${text}`);\n    }\n\n    const data = (await response.json()) as TokenResponse;\n    this.cachedToken = data.access_token;\n    this.expiresAt = Date.now() + data.expires_in * 1000;\n    return data.access_token;\n  }\n\n  /**\n   * Build the XOAUTH2 SASL string for SMTP AUTH (base64-encoded).\n   */\n  async buildXOAUTH2(): Promise<string> {\n    const token = await this.getAccessToken();\n    const raw = `user=${this.config.user}\\x01auth=Bearer ${token}\\x01\\x01`;\n    return encodeBase64(encodeUtf8(raw)).replace(/\\r\\n/g, \"\");\n  }\n}\n"
   ],
-  "mappings": "gDAqBO,IAAM,EAAmB,sCAGnB,EAAsB,6DAY7B,EAAmB,MAKlB,MAAM,CAAa,CAEP,OAET,YAA6B,KAE7B,UAAY,EAEZ,eAAyC,KAGjD,WAAW,CAAC,EAAsB,CAEhC,GADA,KAAK,OAAS,EACV,EAAO,YACT,KAAK,YAAc,EAAO,YAC1B,KAAK,UAAY,KAAK,IAAI,EAAI,aAO5B,eAAc,EAAoB,CACtC,GAAI,KAAK,OAAO,SACd,OAAO,KAAK,OAAO,SAAS,EAG9B,GAAI,KAAK,aAAe,KAAK,IAAI,EAAI,KAAK,UAAY,EACpD,OAAO,KAAK,YAGd,GAAI,CAAC,KAAK,eACR,KAAK,eAAiB,KAAK,mBAAmB,EAAE,QAAQ,IAAM,CAC5D,KAAK,eAAiB,KACvB,EAEH,OAAO,KAAK,oBAMR,mBAAkB,EAAoB,CAC1C,GAAI,KAAK,OAAO,SAAU,CACxB,IAAM,EAAQ,MAAM,KAAK,OAAO,SAAS,EAGzC,OAFA,KAAK,YAAc,EACnB,KAAK,UAAY,KAAK,IAAI,EAAI,QACvB,EAGT,IAAM,EAAW,KAAK,OAAO,UAAY,EACnC,EAAO,IAAI,gBAAgB,CAC/B,UAAW,KAAK,OAAO,SACvB,cAAe,KAAK,OAAO,aAC3B,cAAe,KAAK,OAAO,aAC3B,WAAY,eACd,CAAC,EAEK,EAAW,MAAM,MAAM,EAAU,CACrC,OAAQ,OACR,QAAS,CAAE,eAAgB,mCAAoC,EAC/D,KAAM,EAAK,SAAS,CACtB,CAAC,EAED,GAAI,CAAC,EAAS,GAAI,CAChB,IAAM,EAAO,MAAM,EAAS,KAAK,EACjC,MAAU,MAAM,gCAAgC,EAAS,YAAY,GAAM,EAG7E,IAAM,EAAQ,MAAM,EAAS,KAAK,EAGlC,OAFA,KAAK,YAAc,EAAK,aACxB,KAAK,UAAY,KAAK,IAAI,EAAI,EAAK,WAAa,KACzC,EAAK,kBAMR,aAAY,EAAoB,CACpC,IAAM,EAAQ,MAAM,KAAK,eAAe,EAClC,EAAM,QAAQ,KAAK,OAAO,uBAAuB,YACvD,OAAO,EAAa,EAAW,CAAG,CAAC,EAAE,QAAQ,QAAS,EAAE,EAE5D",
-  "debugId": "3EE074B9ACEA904764756E2164756E21",
+  "mappings": "iDAqBO,IAAM,EAAmB,sCAGnB,EAAsB,6DAY7B,EAAmB,MAKlB,MAAM,CAAa,CAEP,OAET,YAA6B,KAE7B,UAAY,EAEZ,eAAyC,KAGjD,WAAW,CAAC,EAAsB,CAEhC,GADA,KAAK,OAAS,EACV,EAAO,YACT,KAAK,YAAc,EAAO,YAC1B,KAAK,UAAY,KAAK,IAAI,EAAI,aAO5B,eAAc,EAAoB,CACtC,GAAI,KAAK,OAAO,SACd,OAAO,KAAK,OAAO,SAAS,EAG9B,GAAI,KAAK,aAAe,KAAK,IAAI,EAAI,KAAK,UAAY,EACpD,OAAO,KAAK,YAGd,GAAI,CAAC,KAAK,eACR,KAAK,eAAiB,KAAK,mBAAmB,EAAE,QAAQ,IAAM,CAC5D,KAAK,eAAiB,KACvB,EAEH,OAAO,KAAK,oBAMR,mBAAkB,EAAoB,CAC1C,GAAI,KAAK,OAAO,SAAU,CACxB,IAAM,EAAQ,MAAM,KAAK,OAAO,SAAS,EAGzC,OAFA,KAAK,YAAc,EACnB,KAAK,UAAY,KAAK,IAAI,EAAI,QACvB,EAGT,IAAM,EAAW,KAAK,OAAO,UAAY,EACnC,EAAO,IAAI,gBAAgB,CAC/B,UAAW,KAAK,OAAO,SACvB,cAAe,KAAK,OAAO,aAC3B,cAAe,KAAK,OAAO,aAC3B,WAAY,eACd,CAAC,EAEK,EAAW,MAAM,MAAM,EAAU,CACrC,OAAQ,OACR,QAAS,CAAE,eAAgB,mCAAoC,EAC/D,KAAM,EAAK,SAAS,CACtB,CAAC,EAED,GAAI,CAAC,EAAS,GAAI,CAChB,IAAM,EAAO,MAAM,EAAS,KAAK,EACjC,MAAU,MAAM,gCAAgC,EAAS,YAAY,GAAM,EAG7E,IAAM,EAAQ,MAAM,EAAS,KAAK,EAGlC,OAFA,KAAK,YAAc,EAAK,aACxB,KAAK,UAAY,KAAK,IAAI,EAAI,EAAK,WAAa,KACzC,EAAK,kBAMR,aAAY,EAAoB,CACpC,IAAM,EAAQ,MAAM,KAAK,eAAe,EAClC,EAAM,QAAQ,KAAK,OAAO,uBAAuB,YACvD,OAAO,EAAa,EAAW,CAAG,CAAC,EAAE,QAAQ,QAAS,EAAE,EAE5D",
+  "debugId": "9CF70341C886FD1964756E2164756E21",
   "names": []
 }

package/dist/chunk-fv0bemgf.js

@@ -0,0 +1,4 @@
+import{ga as K,ia as M}from"./chunk-hnzmn4s4.js";var V=["fcm.googleapis.com","android.googleapis.com","updates.push.services.mozilla.com","push.services.mozilla.com","web.push.apple.com"],W=[".push.services.mozilla.com",".notify.windows.com",".push.apple.com"];function g(z,G=[]){let C;try{C=new URL(z)}catch{throw Error("Invalid push subscription endpoint URL")}if(C.protocol!=="https:")throw Error("Push subscription endpoint must use https:");if(C.username||C.password)throw Error("Push subscription endpoint must not include credentials");let J=C.hostname.toLowerCase();if(Z(J))throw Error("Push subscription endpoint must not be an IP address");if(!Y(J,G))throw Error(`Push subscription endpoint host is not allowlisted: ${J}`)}async function j(z){try{let G=new URL(z),C=await Q(z);return`${G.origin}/#${C}`}catch{return"[invalid-endpoint]"}}async function m(z){return`fcm:#${await Q(z)}`}async function Q(z){let G=M(z),C=await crypto.subtle.digest("SHA-256",G.buffer.slice(G.byteOffset,G.byteOffset+G.byteLength));return K(new Uint8Array(C).subarray(0,8))}function Y(z,G){if(V.includes(z)||G.includes(z))return!0;return W.some((C)=>z.endsWith(C)&&z.length>C.length)}function Z(z){if(z.includes(":"))return!0;if(/^\d{1,3}(?:\.\d{1,3}){3}$/u.test(z))return!0;return!1}
+export{g as W,j as X,m as Y};
+
+//# debugId=24EF463CC70B30E764756E2164756E21

package/dist/{chunk-yp311efr.js.map → chunk-fv0bemgf.js.map}

@@ -2,9 +2,9 @@
   "version": 3,
   "sources": ["../src/core/push-endpoint.ts"],
   "sourcesContent": [
-    "/**\n * @module\n * Push subscription endpoint safety and hook redaction helpers.\n *\n * Full push endpoints embed long-lived delivery tokens. Never put the raw URL\n * in logs or hook context — use {@link redactPushEndpoint} instead.\n */\n\nimport { encodeBase64Url, encodeUtf8 } from \"./base64.js\";\n\n/**\n * Built-in hosts for major browser push services.\n * Custom hosts can be added via {@link WebPushConfig.allowedEndpointHosts}.\n */\nexport const DEFAULT_PUSH_ENDPOINT_HOSTS: readonly string[] = [\n  \"fcm.googleapis.com\",\n  \"android.googleapis.com\",\n  \"updates.push.services.mozilla.com\",\n  \"push.services.mozilla.com\",\n  \"web.push.apple.com\",\n];\n\n/** Suffix patterns for regional / vendor push hosts. */\nconst DEFAULT_PUSH_ENDPOINT_SUFFIXES: readonly string[] = [\n  \".push.services.mozilla.com\",\n  \".notify.windows.com\",\n  \".push.apple.com\",\n];\n\n/**\n * Validate a push subscription endpoint before server-side fetch.\n *\n * Rejects non-HTTPS schemes, IP literals (including link-local / private),\n * and hostnames outside the allowlist — mitigates SSRF when subscriptions\n * come from untrusted clients.\n *\n * @param endpoint - Raw subscription endpoint URL.\n * @param extraHosts - Additional exact hostnames to allow.\n * @throws Error when the endpoint is unsafe.\n */\nexport function assertSafePushEndpoint(endpoint: string, extraHosts: readonly string[] = []): void {\n  let url: URL;\n  try {\n    url = new URL(endpoint);\n  } catch {\n    throw new Error(\"Invalid push subscription endpoint URL\");\n  }\n\n  if (url.protocol !== \"https:\") {\n    throw new Error(\"Push subscription endpoint must use https:\");\n  }\n\n  if (url.username || url.password) {\n    throw new Error(\"Push subscription endpoint must not include credentials\");\n  }\n\n  const host = url.hostname.toLowerCase();\n\n  if (isIpLiteral(host)) {\n    throw new Error(\"Push subscription endpoint must not be an IP address\");\n  }\n\n  if (!isAllowedPushHost(host, extraHosts)) {\n    throw new Error(`Push subscription endpoint host is not allowlisted: ${host}`);\n  }\n}\n\n/**\n * Redact a push endpoint for hook/observability context.\n * Returns `origin/#<8-byte-hash>` so logs never store the delivery token path.\n */\nexport async function redactPushEndpoint(endpoint: string): Promise<string> {\n  try {\n    const url = new URL(endpoint);\n    const bytes = encodeUtf8(endpoint);\n    const digest = await crypto.subtle.digest(\n      \"SHA-256\",\n      bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength) as ArrayBuffer,\n    );\n    const short = encodeBase64Url(new Uint8Array(digest).subarray(0, 8));\n    return `${url.origin}/#${short}`;\n  } catch {\n    return \"[invalid-endpoint]\";\n  }\n}\n\nfunction isAllowedPushHost(host: string, extraHosts: readonly string[]): boolean {\n  if (DEFAULT_PUSH_ENDPOINT_HOSTS.includes(host) || extraHosts.includes(host)) {\n    return true;\n  }\n  return DEFAULT_PUSH_ENDPOINT_SUFFIXES.some(\n    (suffix) => host.endsWith(suffix) && host.length > suffix.length,\n  );\n}\n\nfunction isIpLiteral(host: string): boolean {\n  // IPv6 in URLs is bracketed; URL.hostname strips brackets.\n  if (host.includes(\":\")) {\n    return true;\n  }\n  // IPv4 dotted-quad\n  if (/^\\d{1,3}(?:\\.\\d{1,3}){3}$/u.test(host)) {\n    return true;\n  }\n  return false;\n}\n"
+    "/**\n * @module\n * Push subscription endpoint safety and hook redaction helpers.\n *\n * Full push endpoints embed long-lived delivery tokens. Never put the raw URL\n * in logs or hook context — use {@link redactPushEndpoint} instead.\n */\n\nimport { encodeBase64Url, encodeUtf8 } from \"./base64.js\";\n\n/**\n * Built-in hosts for major browser push services.\n * Custom hosts can be added via {@link WebPushConfig.allowedEndpointHosts}.\n */\nexport const DEFAULT_PUSH_ENDPOINT_HOSTS: readonly string[] = [\n  \"fcm.googleapis.com\",\n  \"android.googleapis.com\",\n  \"updates.push.services.mozilla.com\",\n  \"push.services.mozilla.com\",\n  \"web.push.apple.com\",\n];\n\n/** Suffix patterns for regional / vendor push hosts. */\nconst DEFAULT_PUSH_ENDPOINT_SUFFIXES: readonly string[] = [\n  \".push.services.mozilla.com\",\n  \".notify.windows.com\",\n  \".push.apple.com\",\n];\n\n/**\n * Validate a push subscription endpoint before server-side fetch.\n *\n * Rejects non-HTTPS schemes, IP literals (including link-local / private),\n * and hostnames outside the allowlist — mitigates SSRF when subscriptions\n * come from untrusted clients.\n *\n * @param endpoint - Raw subscription endpoint URL.\n * @param extraHosts - Additional exact hostnames to allow.\n * @throws Error when the endpoint is unsafe.\n */\nexport function assertSafePushEndpoint(endpoint: string, extraHosts: readonly string[] = []): void {\n  let url: URL;\n  try {\n    url = new URL(endpoint);\n  } catch {\n    throw new Error(\"Invalid push subscription endpoint URL\");\n  }\n\n  if (url.protocol !== \"https:\") {\n    throw new Error(\"Push subscription endpoint must use https:\");\n  }\n\n  if (url.username || url.password) {\n    throw new Error(\"Push subscription endpoint must not include credentials\");\n  }\n\n  const host = url.hostname.toLowerCase();\n\n  if (isIpLiteral(host)) {\n    throw new Error(\"Push subscription endpoint must not be an IP address\");\n  }\n\n  if (!isAllowedPushHost(host, extraHosts)) {\n    throw new Error(`Push subscription endpoint host is not allowlisted: ${host}`);\n  }\n}\n\n/**\n * Redact a push endpoint for hook/observability context.\n * Returns `origin/#<8-byte-hash>` so logs never store the delivery token path.\n */\nexport async function redactPushEndpoint(endpoint: string): Promise<string> {\n  try {\n    const url = new URL(endpoint);\n    const short = await shortHash(endpoint);\n    return `${url.origin}/#${short}`;\n  } catch {\n    return \"[invalid-endpoint]\";\n  }\n}\n\n/**\n * Redact an FCM device token for hook/observability context.\n * Returns `fcm:#<8-byte-hash>` so logs never store the raw registration token.\n */\nexport async function redactFcmToken(token: string): Promise<string> {\n  const short = await shortHash(token);\n  return `fcm:#${short}`;\n}\n\nasync function shortHash(value: string): Promise<string> {\n  const bytes = encodeUtf8(value);\n  const digest = await crypto.subtle.digest(\n    \"SHA-256\",\n    bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength) as ArrayBuffer,\n  );\n  return encodeBase64Url(new Uint8Array(digest).subarray(0, 8));\n}\n\nfunction isAllowedPushHost(host: string, extraHosts: readonly string[]): boolean {\n  if (DEFAULT_PUSH_ENDPOINT_HOSTS.includes(host) || extraHosts.includes(host)) {\n    return true;\n  }\n  return DEFAULT_PUSH_ENDPOINT_SUFFIXES.some(\n    (suffix) => host.endsWith(suffix) && host.length > suffix.length,\n  );\n}\n\nfunction isIpLiteral(host: string): boolean {\n  // IPv6 in URLs is bracketed; URL.hostname strips brackets.\n  if (host.includes(\":\")) {\n    return true;\n  }\n  // IPv4 dotted-quad\n  if (/^\\d{1,3}(?:\\.\\d{1,3}){3}$/u.test(host)) {\n    return true;\n  }\n  return false;\n}\n"
   ],
-  "mappings": "gDAcO,IAAM,EAAiD,CAC5D,qBACA,yBACA,oCACA,4BACA,oBACF,EAGM,EAAoD,CACxD,6BACA,sBACA,iBACF,EAaO,SAAS,CAAsB,CAAC,EAAkB,EAAgC,CAAC,EAAS,CACjG,IAAI,EACJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAQ,EACtB,KAAM,CACN,MAAU,MAAM,wCAAwC,EAG1D,GAAI,EAAI,WAAa,SACnB,MAAU,MAAM,4CAA4C,EAG9D,GAAI,EAAI,UAAY,EAAI,SACtB,MAAU,MAAM,yDAAyD,EAG3E,IAAM,EAAO,EAAI,SAAS,YAAY,EAEtC,GAAI,EAAY,CAAI,EAClB,MAAU,MAAM,sDAAsD,EAGxE,GAAI,CAAC,EAAkB,EAAM,CAAU,EACrC,MAAU,MAAM,uDAAuD,GAAM,EAQjF,eAAsB,CAAkB,CAAC,EAAmC,CAC1E,GAAI,CACF,IAAM,EAAM,IAAI,IAAI,CAAQ,EACtB,EAAQ,EAAW,CAAQ,EAC3B,EAAS,MAAM,OAAO,OAAO,OACjC,UACA,EAAM,OAAO,MAAM,EAAM,WAAY,EAAM,WAAa,EAAM,UAAU,CAC1E,EACM,EAAQ,EAAgB,IAAI,WAAW,CAAM,EAAE,SAAS,EAAG,CAAC,CAAC,EACnE,MAAO,GAAG,EAAI,WAAW,IACzB,KAAM,CACN,MAAO,sBAIX,SAAS,CAAiB,CAAC,EAAc,EAAwC,CAC/E,GAAI,EAA4B,SAAS,CAAI,GAAK,EAAW,SAAS,CAAI,EACxE,MAAO,GAET,OAAO,EAA+B,KACpC,CAAC,IAAW,EAAK,SAAS,CAAM,GAAK,EAAK,OAAS,EAAO,MAC5D,EAGF,SAAS,CAAW,CAAC,EAAuB,CAE1C,GAAI,EAAK,SAAS,GAAG,EACnB,MAAO,GAGT,GAAI,6BAA6B,KAAK,CAAI,EACxC,MAAO,GAET,MAAO",
-  "debugId": "6BC361CE3959323764756E2164756E21",
+  "mappings": "iDAcO,IAAM,EAAiD,CAC5D,qBACA,yBACA,oCACA,4BACA,oBACF,EAGM,EAAoD,CACxD,6BACA,sBACA,iBACF,EAaO,SAAS,CAAsB,CAAC,EAAkB,EAAgC,CAAC,EAAS,CACjG,IAAI,EACJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAQ,EACtB,KAAM,CACN,MAAU,MAAM,wCAAwC,EAG1D,GAAI,EAAI,WAAa,SACnB,MAAU,MAAM,4CAA4C,EAG9D,GAAI,EAAI,UAAY,EAAI,SACtB,MAAU,MAAM,yDAAyD,EAG3E,IAAM,EAAO,EAAI,SAAS,YAAY,EAEtC,GAAI,EAAY,CAAI,EAClB,MAAU,MAAM,sDAAsD,EAGxE,GAAI,CAAC,EAAkB,EAAM,CAAU,EACrC,MAAU,MAAM,uDAAuD,GAAM,EAQjF,eAAsB,CAAkB,CAAC,EAAmC,CAC1E,GAAI,CACF,IAAM,EAAM,IAAI,IAAI,CAAQ,EACtB,EAAQ,MAAM,EAAU,CAAQ,EACtC,MAAO,GAAG,EAAI,WAAW,IACzB,KAAM,CACN,MAAO,sBAQX,eAAsB,CAAc,CAAC,EAAgC,CAEnE,MAAO,QADO,MAAM,EAAU,CAAK,IAIrC,eAAe,CAAS,CAAC,EAAgC,CACvD,IAAM,EAAQ,EAAW,CAAK,EACxB,EAAS,MAAM,OAAO,OAAO,OACjC,UACA,EAAM,OAAO,MAAM,EAAM,WAAY,EAAM,WAAa,EAAM,UAAU,CAC1E,EACA,OAAO,EAAgB,IAAI,WAAW,CAAM,EAAE,SAAS,EAAG,CAAC,CAAC,EAG9D,SAAS,CAAiB,CAAC,EAAc,EAAwC,CAC/E,GAAI,EAA4B,SAAS,CAAI,GAAK,EAAW,SAAS,CAAI,EACxE,MAAO,GAET,OAAO,EAA+B,KACpC,CAAC,IAAW,EAAK,SAAS,CAAM,GAAK,EAAK,OAAS,EAAO,MAC5D,EAGF,SAAS,CAAW,CAAC,EAAuB,CAE1C,GAAI,EAAK,SAAS,GAAG,EACnB,MAAO,GAGT,GAAI,6BAA6B,KAAK,CAAI,EACxC,MAAO,GAET,MAAO",
+  "debugId": "24EF463CC70B30E764756E2164756E21",
   "names": []
 }