@getstrata/core 2.2.21 → 2.2.23

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @getstrata/core changelog
 
+## 2.2.23
+
+Fix native SMTP hangs with bounded whole-send deadlines, cancellation, buffered multiline replies, complete writes and verified implicit TLS. Preserve known final DATA acceptance through cleanup failures. Correct DATA transparency, CRLF, UTF-8 MIME/header encoding and long-line framing; reject incomplete AUTH and unsupported SMTPUTF8 envelopes explicitly. Generate documented SMTP timeout and TLS defaults. Real socket/TLS/protocol regressions cover outages, cancellation, accepted sends and framing; SMTP delivery before final acknowledgement remains uncertain.
+
+## 2.2.22
+
+Preserve caller auth, credential sources, request metadata and application async stores through cold/queued native transaction callbacks. Serialize Postgres privilege grants with full provisioning using atomic database-scoped batches, retaining delegated-admin permissions and rollback/retry safety. Add real constrained-pool JSON/HTML bearer/session-CSRF and concurrent grant/atomicity regressions; no automatic workers, auth bypass or production runtime provisioning.
+
 ## 2.2.21
 
 Make registered queue/outbox workers discoverable in CLI help and generated startup guidance. Announce polling after boot and when it stops without claiming dependency health, printing secrets, or starting workers automatically. Preserve explicit process ownership, delivery semantics and graceful lifecycle; cover idle, boot/runtime/cleanup failures and real SIGTERM draining.

package/dist/core/mail/mailer.d.ts

@@ -1,8 +1,10 @@
+import type { TLSOptions } from "bun";
 interface MailMessage {
     to: string;
     subject: string;
     body: string;
     html?: string;
+    signal?: AbortSignal;
 }
 interface MailDriver {
     send(message: MailMessage): Promise<void>;
@@ -14,6 +16,8 @@ interface SmtpConfig {
     password?: string;
     from: string;
     secure: boolean;
+    timeoutMs?: number;
+    tls?: Pick<TLSOptions, "ca" | "serverName">;
 }
 type SmtpTransport = (config: SmtpConfig, message: MailMessage) => Promise<void>;
 declare function resolveSmtpConfig(): SmtpConfig;

package/dist/entries/audit/exportAuditLogs.js

@@ -221,6 +221,7 @@ var init_tenancyConfig = __esm(() => {
 
 // ../../src/core/tenant/tenantDatabaseScope.ts
 import { getDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 async function applyTenantContextToTransaction(transaction, tenantId) {
   await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
@@ -243,12 +244,12 @@ async function runWithTenantDatabase(tenant, callback) {
     throw new Error("RLS tenant scope requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage2.bind(async (transaction) => {
       await applyTenantContextToTransaction(transaction, tenant.id);
       return await runWithDatabaseConnection(transaction, async () => {
         return await runWithTransactionScope(async () => commitOrRollbackScope(await runWithTenant(tenant, callback)));
       });
-    });
+    }));
   }));
 }
 function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
@@ -717,6 +718,7 @@ var init_repositoryConnection = __esm(() => {
 });
 
 // ../../src/core/database/transaction.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
 async function runInSavepoint(connection, operation) {
   const inherited = transactionFrame.getStore();
   let parent = inherited?.connection === connection ? inherited : outerFrames.get(connection);
@@ -776,9 +778,9 @@ async function runInTransaction(operation, options = {}) {
       signal?.throwIfAborted();
       if (!supportsTransactions(connection))
         throw new Error("Reserved database connection does not support transactions.");
-      return await connection.begin(async (transaction) => {
+      return await connection.begin(AsyncLocalStorage3.bind(async (transaction) => {
         return await runWithDatabaseConnection(transaction, () => transactionFrame.run({ connection: transaction, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await admittedOperation(createDatabaseConnection(transaction))))));
-      });
+      }));
     } finally {
       await reserved?.release();
     }
@@ -800,6 +802,7 @@ var init_transaction = __esm(() => {
 
 // ../../src/core/tenant/databaseTenantContext.ts
 import { getDefaultDatabasePool as getDefaultDatabasePool3 } from "@getstrata/core/database/defaultConnection";
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
 async function applyBypassToTransaction(transaction, bypass) {
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, [
     bypass ? "true" : "false"
@@ -851,10 +854,10 @@ async function runWithScopedTenantTransaction(apply, callback) {
     throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage4.bind(async (transaction) => {
       await apply(transaction);
       return await runWithDatabaseConnection(transaction, () => runWithTransactionScope(async () => commitOrRollbackScope(await callback())));
-    });
+    }));
   }));
 }
 async function runWithMigrationBypass(callback) {

package/dist/entries/auth/scimAuthMiddleware.js

@@ -673,6 +673,7 @@ var init_repositoryConnection = __esm(() => {
 });
 
 // ../../src/core/database/transaction.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 async function runInSavepoint(connection, operation) {
   const inherited = transactionFrame.getStore();
   let parent = inherited?.connection === connection ? inherited : outerFrames.get(connection);
@@ -732,9 +733,9 @@ async function runInTransaction(operation, options = {}) {
       signal?.throwIfAborted();
       if (!supportsTransactions(connection))
         throw new Error("Reserved database connection does not support transactions.");
-      return await connection.begin(async (transaction) => {
+      return await connection.begin(AsyncLocalStorage2.bind(async (transaction) => {
         return await runWithDatabaseConnection(transaction, () => transactionFrame.run({ connection: transaction, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await admittedOperation(createDatabaseConnection(transaction))))));
-      });
+      }));
     } finally {
       await reserved?.release();
     }
@@ -756,6 +757,7 @@ var init_transaction = __esm(() => {
 
 // ../../src/core/tenant/databaseTenantContext.ts
 import { getDefaultDatabasePool as getDefaultDatabasePool2 } from "@getstrata/core/database/defaultConnection";
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
 async function applyBypassToTransaction(transaction, bypass) {
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, [
     bypass ? "true" : "false"
@@ -807,10 +809,10 @@ async function runWithScopedTenantTransaction(apply, callback) {
     throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage3.bind(async (transaction) => {
       await apply(transaction);
       return await runWithDatabaseConnection(transaction, () => runWithTransactionScope(async () => commitOrRollbackScope(await callback())));
-    });
+    }));
   }));
 }
 async function runWithMigrationBypass(callback) {
@@ -830,6 +832,7 @@ var init_databaseTenantContext = __esm(() => {
 
 // ../../src/core/tenant/tenantDatabaseScope.ts
 import { getDefaultDatabasePool as getDefaultDatabasePool3 } from "@getstrata/core/database/defaultConnection";
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
 async function applyTenantContextToTransaction(transaction, tenantId) {
   await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
@@ -852,12 +855,12 @@ async function runWithTenantDatabase(tenant, callback) {
     throw new Error("RLS tenant scope requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage4.bind(async (transaction) => {
       await applyTenantContextToTransaction(transaction, tenant.id);
       return await runWithDatabaseConnection(transaction, async () => {
         return await runWithTransactionScope(async () => commitOrRollbackScope(await runWithTenant(tenant, callback)));
       });
-    });
+    }));
   }));
 }
 function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {

package/dist/entries/facades.js

@@ -107,8 +107,8 @@ function resolveSmtpConfig() {
   if (!from) {
     throw new Error('MAIL_DRIVER="smtp" requires MAIL_FROM to be set.');
   }
-  const port = Number.parseInt(process.env.MAIL_PORT ?? "587", 10);
-  if (!Number.isInteger(port) || port <= 0) {
+  const port = Number(process.env.MAIL_PORT ?? "587");
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
     throw new Error('Environment variable "MAIL_PORT" must be a positive integer.');
   }
   return {
@@ -116,6 +116,7 @@ function resolveSmtpConfig() {
     port,
     from,
     secure: (process.env.MAIL_SECURE ?? "false") === "true",
+    ...process.env.MAIL_TIMEOUT_MS !== undefined ? { timeoutMs: smtpTimeout(Number(process.env.MAIL_TIMEOUT_MS)) } : {},
     ...process.env.MAIL_USERNAME?.trim() ? { username: process.env.MAIL_USERNAME.trim() } : {},
     ...process.env.MAIL_PASSWORD?.trim() ? { password: process.env.MAIL_PASSWORD.trim() } : {}
   };
@@ -125,6 +126,12 @@ function assertSafeSmtpField(value, field) {
   if (/[\r\n]/u.test(value)) {
     throw new Error(`Mail ${field} must not contain CR or LF.`);
   }
+  for (const character of value) {
+    const code = character.charCodeAt(0);
+    if (code < 32 && code !== 9 || code === 127) {
+      throw new Error(`Mail ${field} must not contain control characters.`);
+    }
+  }
   return value;
 }
 function smtpEnvelopeAddress(value, field) {
@@ -145,148 +152,307 @@ function redactMailBody(body) {
 function encodeBase64(value) {
   return Buffer.from(value, "utf8").toString("base64");
 }
-function parseSmtpResponses(buffer) {
-  const responses = [];
-  let remainder = buffer;
-  while (remainder.includes(`\r
-`)) {
-    const index = remainder.indexOf(`\r
-`);
-    const line = remainder.slice(0, index);
-    remainder = remainder.slice(index + 2);
-    if (line.length >= 4 && line[3] === "-") {
-      continue;
-    }
-    responses.push(line);
+function smtpTimeout(value = 1e4) {
+  if (!Number.isSafeInteger(value) || value < 1 || value > 2147483647) {
+    throw new RangeError("SMTP timeoutMs must be a positive integer within the timer range.");
   }
-  return { responses, remainder };
+  return value;
 }
-async function waitForSmtpResponse(readResponse, expectedCodes) {
-  const response = await readResponse();
-  const code = response.slice(0, 3);
-  if (!expectedCodes.includes(code)) {
-    throw new Error(`Unexpected SMTP response: ${response}`);
+async function defaultSmtpTransport(config, message) {
+  const timeoutMs = smtpTimeout(config.timeoutMs);
+  if (!config.host.trim() || !Number.isInteger(config.port) || config.port < 1 || config.port > 65535) {
+    throw new RangeError("SMTP requires a host and a port between 1 and 65535.");
   }
-  return response;
-}
-async function openSmtpConnection(config) {
-  let buffer = "";
+  if (Boolean(config.username) !== Boolean(config.password)) {
+    throw new Error("SMTP authentication requires both username and password.");
+  }
+  if (config.username)
+    assertSafeSmtpField(config.username, "username");
+  if (config.password)
+    assertSafeSmtpField(config.password, "password");
+  const fromHeader = assertSafeSmtpAddress(config.from, "from");
+  const toHeader = assertSafeSmtpAddress(message.to, "to");
+  assertSafeSmtpField(message.subject, "subject");
+  const fromEnvelope = smtpEnvelopeAddress(config.from, "from");
+  const toEnvelope = smtpEnvelopeAddress(message.to, "to");
+  if (/[^\x21-\x7e]/u.test(fromEnvelope + toEnvelope)) {
+    throw new Error("Default SMTP transport requires ASCII envelopes; SMTPUTF8 is not negotiated.");
+  }
+  for (const address of [fromEnvelope, toEnvelope]) {
+    const at = address.lastIndexOf("@");
+    if (Buffer.byteLength(address) > 254 || Buffer.byteLength(address.slice(0, at)) > 64) {
+      throw new RangeError("SMTP envelope address exceeds the path/local-part length limit.");
+    }
+  }
+  message.signal?.throwIfAborted();
+  let socket;
+  let finished = false;
+  let failed = false;
+  let failure;
+  let rejectFailure;
+  const failurePromise = new Promise((_, reject) => {
+    rejectFailure = reject;
+  });
+  failurePromise.catch(() => {});
+  const responses = [];
   const waiters = [];
-  const readResponse = () => new Promise((resolve, reject) => {
-    const parsed = parseSmtpResponses(buffer);
-    if (parsed.responses.length > 0) {
-      buffer = parsed.remainder;
-      resolve(parsed.responses.shift());
+  let drain;
+  let drainVersion = 0;
+  let buffer = "";
+  let multilineCode;
+  let multilineLines = 0;
+  const decoder = new TextDecoder;
+  const fail = (reason) => {
+    if (finished || failed)
       return;
+    failed = true;
+    failure = reason;
+    rejectFailure(reason);
+    waiters.length = 0;
+    drain?.();
+    drain = undefined;
+    socket?.terminate();
+  };
+  const onAbort = () => fail(message.signal?.reason ?? new DOMException("Mail send aborted.", "AbortError"));
+  const timer = setTimeout(() => fail(new DOMException("SMTP send deadline exceeded.", "TimeoutError")), timeoutMs);
+  message.signal?.addEventListener("abort", onAbort, { once: true });
+  if (message.signal?.aborted)
+    onAbort();
+  const readResponse = async (expected) => {
+    const queued = responses.shift();
+    const response = queued ?? await Promise.race([
+      failed ? Promise.reject(failure) : new Promise((resolve) => waiters.push(resolve)),
+      failurePromise
+    ]);
+    const code = response.slice(0, 3);
+    if (!expected.includes(code))
+      throw new Error(`Unexpected SMTP response code: ${code}`);
+  };
+  const write = async (text) => {
+    const bytes = Buffer.from(text, "utf8");
+    let offset = 0;
+    while (offset < bytes.length) {
+      if (failed)
+        throw failure;
+      const version = drainVersion;
+      if (!socket)
+        throw new Error("SMTP socket is not connected.");
+      const written = socket.write(bytes.subarray(offset));
+      if (written < 0)
+        throw new Error("SMTP socket write failed.");
+      offset += written;
+      if (offset < bytes.length && version === drainVersion) {
+        await Promise.race([
+          new Promise((resolve) => {
+            drain = resolve;
+          }),
+          failurePromise
+        ]);
+      }
     }
-    waiters.push({ resolve, reject });
-  });
-  const socket = await Bun.connect({
-    hostname: config.host,
-    port: config.port,
-    socket: {
-      open() {},
-      data(_socket, chunk) {
-        buffer += Buffer.from(chunk).toString("utf8");
-        const parsed = parseSmtpResponses(buffer);
-        buffer = parsed.remainder;
-        while (parsed.responses.length > 0 && waiters.length > 0) {
-          const response = parsed.responses.shift();
-          waiters.shift()?.resolve(response);
+  };
+  try {
+    const connecting = Bun.connect({
+      hostname: config.host,
+      port: config.port,
+      ...config.secure ? {
+        tls: {
+          ...config.tls,
+          serverName: config.tls?.serverName ?? config.host,
+          rejectUnauthorized: true
         }
-      },
-      error(_socket, error) {
-        const pending = waiters.splice(0);
-        for (const waiter of pending) {
-          waiter.reject(error instanceof Error ? error : new Error(String(error)));
+      } : {},
+      socket: {
+        open(value) {
+          socket = value;
+          if (failed || finished)
+            value.terminate();
+        },
+        data(_socket, chunk) {
+          if (failed || finished)
+            return;
+          buffer += decoder.decode(chunk, { stream: true });
+          if (Buffer.byteLength(buffer, "utf8") > 16384) {
+            fail(new Error("SMTP response exceeded the buffer limit."));
+            return;
+          }
+          while (buffer.includes(`\r
+`)) {
+            const index = buffer.indexOf(`\r
+`);
+            const line = buffer.slice(0, index);
+            buffer = buffer.slice(index + 2);
+            const match = /^([2-5]\d{2})([- ]|$)/.exec(line);
+            if (!match || multilineCode !== undefined && match[1] !== multilineCode) {
+              fail(new Error("Malformed SMTP reply."));
+              return;
+            }
+            if (++multilineLines > 128) {
+              fail(new Error("SMTP reply exceeded the line limit."));
+              return;
+            }
+            if (match[2] === "-") {
+              multilineCode = match[1];
+              continue;
+            }
+            multilineCode = undefined;
+            multilineLines = 0;
+            const waiter = waiters.shift();
+            if (waiter)
+              waiter(line);
+            else {
+              responses.push(line);
+              if (responses.length > 32) {
+                fail(new Error("Too many buffered SMTP replies."));
+                return;
+              }
+            }
+          }
+        },
+        drain() {
+          drainVersion++;
+          const waiting = drain;
+          drain = undefined;
+          waiting?.();
+        },
+        end() {
+          fail(new Error("SMTP peer closed before the send completed."));
+        },
+        close() {
+          fail(new Error("SMTP connection closed before the send completed."));
+        },
+        error() {
+          fail(new Error("SMTP socket failed."));
+        },
+        connectError() {
+          fail(new Error("SMTP connection failed."));
+        },
+        handshake(_socket, success) {
+          if (!success)
+            fail(new Error("SMTP TLS verification failed."));
         }
       }
-    }
-  });
-  return { socket, readResponse };
-}
-async function defaultSmtpTransport(config, message) {
-  if (config.username) {
-    assertSafeSmtpField(config.username, "username");
-  }
-  if (config.password) {
-    assertSafeSmtpField(config.password, "password");
-  }
-  const { socket, readResponse } = await openSmtpConnection(config);
-  try {
-    await waitForSmtpResponse(readResponse, ["220"]);
-    await socket.write(`EHLO ${smtpEhloHost()}\r
+    });
+    connecting.then((value) => {
+      socket = value;
+      if (failed || finished)
+        value.terminate();
+    }, () => {});
+    socket = await Promise.race([connecting, failurePromise]);
+    await readResponse(["220"]);
+    await write(`EHLO ${smtpEhloHost()}\r
 `);
-    await waitForSmtpResponse(readResponse, ["250"]);
+    await readResponse(["250"]);
     if (config.username && config.password) {
-      await socket.write(`AUTH LOGIN\r
+      await write(`AUTH LOGIN\r
 `);
-      await waitForSmtpResponse(readResponse, ["334"]);
-      await socket.write(`${encodeBase64(config.username)}\r
+      await readResponse(["334"]);
+      await write(`${encodeBase64(config.username)}\r
 `);
-      await waitForSmtpResponse(readResponse, ["334"]);
-      await socket.write(`${encodeBase64(config.password)}\r
+      await readResponse(["334"]);
+      await write(`${encodeBase64(config.password)}\r
 `);
-      await waitForSmtpResponse(readResponse, ["235"]);
+      await readResponse(["235"]);
     }
-    const fromHeader = assertSafeSmtpAddress(config.from, "from");
-    const toHeader = assertSafeSmtpAddress(message.to, "to");
-    const from = smtpEnvelopeAddress(config.from, "from");
-    const to = smtpEnvelopeAddress(message.to, "to");
-    await socket.write(`MAIL FROM:<${from}>\r
+    await write(`MAIL FROM:<${fromEnvelope}>\r
 `);
-    await waitForSmtpResponse(readResponse, ["250"]);
-    await socket.write(`RCPT TO:<${to}>\r
+    await readResponse(["250"]);
+    await write(`RCPT TO:<${toEnvelope}>\r
 `);
-    await waitForSmtpResponse(readResponse, ["250", "251"]);
-    await socket.write(`DATA\r
+    await readResponse(["250", "251"]);
+    await write(`DATA\r
 `);
-    await waitForSmtpResponse(readResponse, ["354"]);
-    const payload = buildSmtpPayload(fromHeader, {
-      ...message,
-      to: toHeader,
-      subject: assertSafeSmtpField(message.subject, "subject")
-    });
-    await socket.write(payload);
-    await waitForSmtpResponse(readResponse, ["250"]);
-    await socket.write(`QUIT\r
+    await readResponse(["354"]);
+    await write(buildSmtpPayload(fromHeader, { ...message, to: toHeader }));
+    await readResponse(["250"]);
+    finished = true;
+    try {
+      socket.write(`QUIT\r
 `);
-    await waitForSmtpResponse(readResponse, ["221"]);
+    } catch {}
   } finally {
-    socket.end();
-  }
+    finished = true;
+    clearTimeout(timer);
+    message.signal?.removeEventListener("abort", onAbort);
+    waiters.length = 0;
+    responses.length = 0;
+    drain = undefined;
+    socket?.end();
+  }
+}
+function encodeSmtpHeader(value) {
+  if (/^[\x20-\x7e]{0,60}$/u.test(value))
+    return value;
+  const words = [];
+  let part = "";
+  for (const character of value) {
+    if (Buffer.byteLength(part + character, "utf8") > 45) {
+      words.push(`=?UTF-8?B?${encodeBase64(part)}?=`);
+      part = "";
+    }
+    part += character;
+  }
+  if (part)
+    words.push(`=?UTF-8?B?${encodeBase64(part)}?=`);
+  return words.join(`\r
+ `);
+}
+function smtpAddressHeader(value) {
+  if (!value.includes("<"))
+    return value;
+  const name = value.slice(0, value.lastIndexOf("<")).trim();
+  const address = smtpEnvelopeAddress(value, "address");
+  if (!name)
+    return address;
+  const encoded = encodeSmtpHeader(name);
+  const display = encoded.startsWith("=?UTF-8?B?") ? encoded : `"${encoded.replace(/[\\"]/gu, "\\$&")}"`;
+  return `${display} <${address}>`;
+}
+function smtpMimePart(type, value) {
+  const normalized = value.replace(/\r\n|\r|\n/gu, `\r
+`);
+  const base64 = /[^\t\r\n\x20-\x7e]/u.test(normalized) || normalized.split(`\r
+`).some((line) => line.length > 998);
+  return [
+    `Content-Type: ${type}; charset=utf-8`,
+    `Content-Transfer-Encoding: ${base64 ? "base64" : "7bit"}`,
+    "",
+    base64 ? (encodeBase64(normalized).match(/.{1,76}/gu) ?? []).join(`\r
+`) : normalized
+  ];
 }
 function buildSmtpPayload(from, message) {
-  const safeFrom = assertSafeSmtpAddress(from, "from");
-  const safeTo = assertSafeSmtpAddress(message.to, "to");
-  const safeSubject = assertSafeSmtpField(message.subject, "subject");
   const headers = [
-    `From: ${safeFrom}`,
-    `To: ${safeTo}`,
-    `Subject: ${safeSubject}`,
+    `From: ${smtpAddressHeader(assertSafeSmtpAddress(from, "from"))}`,
+    `To: ${smtpAddressHeader(assertSafeSmtpAddress(message.to, "to"))}`,
+    `Subject: ${encodeSmtpHeader(assertSafeSmtpField(message.subject, "subject"))}`,
     "MIME-Version: 1.0"
   ];
+  let lines;
   if (message.html) {
-    const boundary = `strata-${Date.now().toString(36)}`;
-    headers.push(`Content-Type: multipart/alternative; boundary="${boundary}"`);
-    const parts = [
-      `--${boundary}`,
-      "Content-Type: text/plain; charset=utf-8",
+    let boundary;
+    do {
+      boundary = `strata-${crypto.randomUUID()}`;
+    } while (message.body.includes(boundary) || message.html.includes(boundary));
+    lines = [
+      ...headers,
+      `Content-Type: multipart/alternative; boundary="${boundary}"`,
       "",
-      message.body,
       `--${boundary}`,
-      "Content-Type: text/html; charset=utf-8",
-      "",
-      message.html,
+      ...smtpMimePart("text/plain", message.body),
+      `--${boundary}`,
+      ...smtpMimePart("text/html", message.html),
       `--${boundary}--`,
       ""
     ];
-    return [...headers, "", ...parts, ".", ""].join(`\r
-`);
-  }
-  headers.push("Content-Type: text/plain; charset=utf-8");
-  return [...headers, "", message.body, ".", ""].join(`\r
-`);
+  } else
+    lines = [...headers, ...smtpMimePart("text/plain", message.body)];
+  const content = lines.join(`\r
+`).replace(/(^|\r\n)\./gu, "$1..");
+  return `${content}${content.endsWith(`\r
+`) ? "" : `\r
+`}.\r
+`;
 }
 
 class LogMailDriver {