@getstrata/core 2.2.21 → 2.2.23

package/dist/entries/tenant/enableTenantRls.js

@@ -191,15 +191,11 @@ BEGIN
 END
 $$`;
 }
-function postgresAppRoleSql(options) {
+var POSTGRES_PRIVILEGE_LOCK_SQL = "SELECT pg_advisory_xact_lock(hashtext('strata:postgres-privileges'), hashtext(current_database()))";
+function postgresAppRolePrivilegeSql(options) {
   const database = assertSafeSqlIdentifier(options.database, "database name");
   const role = assertSafeSqlIdentifier(options.role ?? POSTGRES_APP_ROLE, "role name");
-  return `-- Application login role. FORCE RLS applies because this role is NOSUPERUSER and NOBYPASSRLS.
--- Superuser remains for CREATE ROLE / CREATE DATABASE / GRANT / migrate / migrate:fresh DROP.
--- This script is repeatable on an already-existing volume (not only docker-entrypoint-initdb.d).
-${postgresAppRoleCreateSql(options)};
-
-GRANT CONNECT ON DATABASE ${database} TO ${role};
+  return `GRANT CONNECT ON DATABASE ${database} TO ${role};
 GRANT USAGE, CREATE ON SCHEMA public TO ${role};
 GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO ${role};
 GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO ${role};
@@ -209,17 +205,21 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO ${role};
 ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT EXECUTE ON FUNCTIONS TO ${role};
 `;
 }
+function postgresAppRoleSql(options) {
+  const privileges = postgresAppRolePrivilegeSql(options);
+  return `-- Application login role. FORCE RLS applies because this role is NOSUPERUSER and NOBYPASSRLS.
+-- Superuser remains for CREATE ROLE / CREATE DATABASE / GRANT / migrate / migrate:fresh DROP.
+-- This script is repeatable on an already-existing volume (not only docker-entrypoint-initdb.d).
+${POSTGRES_PRIVILEGE_LOCK_SQL};
+${postgresAppRoleCreateSql(options)};
+
+${privileges}
+`;
+}
 async function grantPostgresAppRolePrivileges(sql, options) {
-  const database = assertSafeSqlIdentifier(options.database, "database name");
-  const role = assertSafeSqlIdentifier(options.role ?? POSTGRES_APP_ROLE, "role name");
-  await sql.unsafe(`GRANT CONNECT ON DATABASE ${database} TO ${role}`);
-  await sql.unsafe(`GRANT USAGE, CREATE ON SCHEMA public TO ${role}`);
-  await sql.unsafe(`GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO ${role}`);
-  await sql.unsafe(`GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO ${role}`);
-  await sql.unsafe(`GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO ${role}`);
-  await sql.unsafe(`ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO ${role}`);
-  await sql.unsafe(`ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO ${role}`);
-  await sql.unsafe(`ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT EXECUTE ON FUNCTIONS TO ${role}`);
+  const privileges = postgresAppRolePrivilegeSql(options);
+  await sql.unsafe(`${POSTGRES_PRIVILEGE_LOCK_SQL};
+${privileges}`);
 }
 async function ensurePostgresAppRole(sql, options) {
   await sql.unsafe(postgresAppRoleSql(options));

package/dist/entries/tenant/tenantDatabaseScope.js

@@ -651,6 +651,7 @@ var init_repositoryConnection = __esm(() => {
 });
 
 // ../../src/core/database/transaction.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 async function runInSavepoint(connection, operation) {
   const inherited = transactionFrame.getStore();
   let parent = inherited?.connection === connection ? inherited : outerFrames.get(connection);
@@ -710,9 +711,9 @@ async function runInTransaction(operation, options = {}) {
       signal?.throwIfAborted();
       if (!supportsTransactions(connection))
         throw new Error("Reserved database connection does not support transactions.");
-      return await connection.begin(async (transaction) => {
+      return await connection.begin(AsyncLocalStorage2.bind(async (transaction) => {
         return await runWithDatabaseConnection(transaction, () => transactionFrame.run({ connection: transaction, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await admittedOperation(createDatabaseConnection(transaction))))));
-      });
+      }));
     } finally {
       await reserved?.release();
     }
@@ -756,6 +757,7 @@ var init_tenancyConfig = __esm(() => {
 
 // ../../src/core/tenant/databaseTenantContext.ts
 import { getDefaultDatabasePool as getDefaultDatabasePool2 } from "@getstrata/core/database/defaultConnection";
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
 async function applyBypassToTransaction(transaction, bypass) {
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, [
     bypass ? "true" : "false"
@@ -807,10 +809,10 @@ async function runWithScopedTenantTransaction(apply, callback) {
     throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage3.bind(async (transaction) => {
       await apply(transaction);
       return await runWithDatabaseConnection(transaction, () => runWithTransactionScope(async () => commitOrRollbackScope(await callback())));
-    });
+    }));
   }));
 }
 async function runWithMigrationBypass(callback) {
@@ -830,6 +832,7 @@ var init_databaseTenantContext = __esm(() => {
 
 // ../../src/core/tenant/tenantDatabaseScope.ts
 import { getDefaultDatabasePool as getDefaultDatabasePool3 } from "@getstrata/core/database/defaultConnection";
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
 async function applyTenantContextToTransaction(transaction, tenantId) {
   await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
@@ -852,12 +855,12 @@ async function runWithTenantDatabase(tenant, callback) {
     throw new Error("RLS tenant scope requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage4.bind(async (transaction) => {
       await applyTenantContextToTransaction(transaction, tenant.id);
       return await runWithDatabaseConnection(transaction, async () => {
         return await runWithTransactionScope(async () => commitOrRollbackScope(await runWithTenant(tenant, callback)));
       });
-    });
+    }));
   }));
 }
 function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {

package/dist/index.js

@@ -807,6 +807,7 @@ function createDatabaseConnection(source) {
 var init_connection = () => {};
 
 // ../../src/core/database/transaction.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 async function runInSavepoint(connection, operation) {
   const inherited = transactionFrame.getStore();
   let parent = inherited?.connection === connection ? inherited : outerFrames.get(connection);
@@ -866,9 +867,9 @@ async function runInTransaction(operation, options = {}) {
       signal?.throwIfAborted();
       if (!supportsTransactions(connection))
         throw new Error("Reserved database connection does not support transactions.");
-      return await connection.begin(async (transaction) => {
+      return await connection.begin(AsyncLocalStorage2.bind(async (transaction) => {
         return await runWithDatabaseConnection(transaction, () => transactionFrame.run({ connection: transaction, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await admittedOperation(createDatabaseConnection(transaction))))));
-      });
+      }));
     } finally {
       await reserved?.release();
     }
@@ -889,6 +890,7 @@ var init_transaction = __esm(() => {
 });
 
 // ../../src/core/tenant/databaseTenantContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
 async function applyBypassToTransaction(transaction, bypass) {
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, [
     bypass ? "true" : "false"
@@ -940,10 +942,10 @@ async function runWithScopedTenantTransaction(apply, callback) {
     throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage3.bind(async (transaction) => {
       await apply(transaction);
       return await runWithDatabaseConnection(transaction, () => runWithTransactionScope(async () => commitOrRollbackScope(await callback())));
-    });
+    }));
   }));
 }
 async function runWithMigrationBypass(callback) {
@@ -963,6 +965,7 @@ var init_databaseTenantContext = __esm(() => {
 });
 
 // ../../src/core/tenant/tenantDatabaseScope.ts
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
 async function applyTenantContextToTransaction(transaction, tenantId) {
   await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
@@ -985,12 +988,12 @@ async function runWithTenantDatabase(tenant, callback) {
     throw new Error("RLS tenant scope requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage4.bind(async (transaction) => {
       await applyTenantContextToTransaction(transaction, tenant.id);
       return await runWithDatabaseConnection(transaction, async () => {
         return await runWithTransactionScope(async () => commitOrRollbackScope(await runWithTenant(tenant, callback)));
       });
-    });
+    }));
   }));
 }
 function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
@@ -10638,8 +10641,8 @@ function resolveSmtpConfig() {
   if (!from) {
     throw new Error('MAIL_DRIVER="smtp" requires MAIL_FROM to be set.');
   }
-  const port = Number.parseInt(process.env.MAIL_PORT ?? "587", 10);
-  if (!Number.isInteger(port) || port <= 0) {
+  const port = Number(process.env.MAIL_PORT ?? "587");
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
     throw new Error('Environment variable "MAIL_PORT" must be a positive integer.');
   }
   return {
@@ -10647,6 +10650,7 @@ function resolveSmtpConfig() {
     port,
     from,
     secure: (process.env.MAIL_SECURE ?? "false") === "true",
+    ...process.env.MAIL_TIMEOUT_MS !== undefined ? { timeoutMs: smtpTimeout(Number(process.env.MAIL_TIMEOUT_MS)) } : {},
     ...process.env.MAIL_USERNAME?.trim() ? { username: process.env.MAIL_USERNAME.trim() } : {},
     ...process.env.MAIL_PASSWORD?.trim() ? { password: process.env.MAIL_PASSWORD.trim() } : {}
   };
@@ -10656,6 +10660,12 @@ function assertSafeSmtpField(value, field) {
   if (/[\r\n]/u.test(value)) {
     throw new Error(`Mail ${field} must not contain CR or LF.`);
   }
+  for (const character of value) {
+    const code = character.charCodeAt(0);
+    if (code < 32 && code !== 9 || code === 127) {
+      throw new Error(`Mail ${field} must not contain control characters.`);
+    }
+  }
   return value;
 }
 function smtpEnvelopeAddress(value, field) {
@@ -10676,148 +10686,307 @@ function redactMailBody(body) {
 function encodeBase64(value) {
   return Buffer.from(value, "utf8").toString("base64");
 }
-function parseSmtpResponses(buffer) {
-  const responses = [];
-  let remainder = buffer;
-  while (remainder.includes(`\r
-`)) {
-    const index = remainder.indexOf(`\r
-`);
-    const line = remainder.slice(0, index);
-    remainder = remainder.slice(index + 2);
-    if (line.length >= 4 && line[3] === "-") {
-      continue;
-    }
-    responses.push(line);
+function smtpTimeout(value = 1e4) {
+  if (!Number.isSafeInteger(value) || value < 1 || value > 2147483647) {
+    throw new RangeError("SMTP timeoutMs must be a positive integer within the timer range.");
   }
-  return { responses, remainder };
+  return value;
 }
-async function waitForSmtpResponse(readResponse, expectedCodes) {
-  const response = await readResponse();
-  const code = response.slice(0, 3);
-  if (!expectedCodes.includes(code)) {
-    throw new Error(`Unexpected SMTP response: ${response}`);
+async function defaultSmtpTransport(config, message) {
+  const timeoutMs = smtpTimeout(config.timeoutMs);
+  if (!config.host.trim() || !Number.isInteger(config.port) || config.port < 1 || config.port > 65535) {
+    throw new RangeError("SMTP requires a host and a port between 1 and 65535.");
   }
-  return response;
-}
-async function openSmtpConnection(config) {
-  let buffer = "";
+  if (Boolean(config.username) !== Boolean(config.password)) {
+    throw new Error("SMTP authentication requires both username and password.");
+  }
+  if (config.username)
+    assertSafeSmtpField(config.username, "username");
+  if (config.password)
+    assertSafeSmtpField(config.password, "password");
+  const fromHeader = assertSafeSmtpAddress(config.from, "from");
+  const toHeader = assertSafeSmtpAddress(message.to, "to");
+  assertSafeSmtpField(message.subject, "subject");
+  const fromEnvelope = smtpEnvelopeAddress(config.from, "from");
+  const toEnvelope = smtpEnvelopeAddress(message.to, "to");
+  if (/[^\x21-\x7e]/u.test(fromEnvelope + toEnvelope)) {
+    throw new Error("Default SMTP transport requires ASCII envelopes; SMTPUTF8 is not negotiated.");
+  }
+  for (const address of [fromEnvelope, toEnvelope]) {
+    const at = address.lastIndexOf("@");
+    if (Buffer.byteLength(address) > 254 || Buffer.byteLength(address.slice(0, at)) > 64) {
+      throw new RangeError("SMTP envelope address exceeds the path/local-part length limit.");
+    }
+  }
+  message.signal?.throwIfAborted();
+  let socket;
+  let finished = false;
+  let failed = false;
+  let failure;
+  let rejectFailure;
+  const failurePromise = new Promise((_, reject) => {
+    rejectFailure = reject;
+  });
+  failurePromise.catch(() => {});
+  const responses = [];
   const waiters = [];
-  const readResponse = () => new Promise((resolve, reject) => {
-    const parsed = parseSmtpResponses(buffer);
-    if (parsed.responses.length > 0) {
-      buffer = parsed.remainder;
-      resolve(parsed.responses.shift());
+  let drain;
+  let drainVersion = 0;
+  let buffer = "";
+  let multilineCode;
+  let multilineLines = 0;
+  const decoder = new TextDecoder;
+  const fail = (reason) => {
+    if (finished || failed)
       return;
+    failed = true;
+    failure = reason;
+    rejectFailure(reason);
+    waiters.length = 0;
+    drain?.();
+    drain = undefined;
+    socket?.terminate();
+  };
+  const onAbort = () => fail(message.signal?.reason ?? new DOMException("Mail send aborted.", "AbortError"));
+  const timer = setTimeout(() => fail(new DOMException("SMTP send deadline exceeded.", "TimeoutError")), timeoutMs);
+  message.signal?.addEventListener("abort", onAbort, { once: true });
+  if (message.signal?.aborted)
+    onAbort();
+  const readResponse = async (expected) => {
+    const queued = responses.shift();
+    const response = queued ?? await Promise.race([
+      failed ? Promise.reject(failure) : new Promise((resolve) => waiters.push(resolve)),
+      failurePromise
+    ]);
+    const code = response.slice(0, 3);
+    if (!expected.includes(code))
+      throw new Error(`Unexpected SMTP response code: ${code}`);
+  };
+  const write = async (text) => {
+    const bytes = Buffer.from(text, "utf8");
+    let offset = 0;
+    while (offset < bytes.length) {
+      if (failed)
+        throw failure;
+      const version = drainVersion;
+      if (!socket)
+        throw new Error("SMTP socket is not connected.");
+      const written = socket.write(bytes.subarray(offset));
+      if (written < 0)
+        throw new Error("SMTP socket write failed.");
+      offset += written;
+      if (offset < bytes.length && version === drainVersion) {
+        await Promise.race([
+          new Promise((resolve) => {
+            drain = resolve;
+          }),
+          failurePromise
+        ]);
+      }
     }
-    waiters.push({ resolve, reject });
-  });
-  const socket = await Bun.connect({
-    hostname: config.host,
-    port: config.port,
-    socket: {
-      open() {},
-      data(_socket, chunk) {
-        buffer += Buffer.from(chunk).toString("utf8");
-        const parsed = parseSmtpResponses(buffer);
-        buffer = parsed.remainder;
-        while (parsed.responses.length > 0 && waiters.length > 0) {
-          const response = parsed.responses.shift();
-          waiters.shift()?.resolve(response);
+  };
+  try {
+    const connecting = Bun.connect({
+      hostname: config.host,
+      port: config.port,
+      ...config.secure ? {
+        tls: {
+          ...config.tls,
+          serverName: config.tls?.serverName ?? config.host,
+          rejectUnauthorized: true
         }
-      },
-      error(_socket, error) {
-        const pending = waiters.splice(0);
-        for (const waiter of pending) {
-          waiter.reject(error instanceof Error ? error : new Error(String(error)));
+      } : {},
+      socket: {
+        open(value) {
+          socket = value;
+          if (failed || finished)
+            value.terminate();
+        },
+        data(_socket, chunk) {
+          if (failed || finished)
+            return;
+          buffer += decoder.decode(chunk, { stream: true });
+          if (Buffer.byteLength(buffer, "utf8") > 16384) {
+            fail(new Error("SMTP response exceeded the buffer limit."));
+            return;
+          }
+          while (buffer.includes(`\r
+`)) {
+            const index = buffer.indexOf(`\r
+`);
+            const line = buffer.slice(0, index);
+            buffer = buffer.slice(index + 2);
+            const match = /^([2-5]\d{2})([- ]|$)/.exec(line);
+            if (!match || multilineCode !== undefined && match[1] !== multilineCode) {
+              fail(new Error("Malformed SMTP reply."));
+              return;
+            }
+            if (++multilineLines > 128) {
+              fail(new Error("SMTP reply exceeded the line limit."));
+              return;
+            }
+            if (match[2] === "-") {
+              multilineCode = match[1];
+              continue;
+            }
+            multilineCode = undefined;
+            multilineLines = 0;
+            const waiter = waiters.shift();
+            if (waiter)
+              waiter(line);
+            else {
+              responses.push(line);
+              if (responses.length > 32) {
+                fail(new Error("Too many buffered SMTP replies."));
+                return;
+              }
+            }
+          }
+        },
+        drain() {
+          drainVersion++;
+          const waiting = drain;
+          drain = undefined;
+          waiting?.();
+        },
+        end() {
+          fail(new Error("SMTP peer closed before the send completed."));
+        },
+        close() {
+          fail(new Error("SMTP connection closed before the send completed."));
+        },
+        error() {
+          fail(new Error("SMTP socket failed."));
+        },
+        connectError() {
+          fail(new Error("SMTP connection failed."));
+        },
+        handshake(_socket, success) {
+          if (!success)
+            fail(new Error("SMTP TLS verification failed."));
         }
       }
-    }
-  });
-  return { socket, readResponse };
-}
-async function defaultSmtpTransport(config, message) {
-  if (config.username) {
-    assertSafeSmtpField(config.username, "username");
-  }
-  if (config.password) {
-    assertSafeSmtpField(config.password, "password");
-  }
-  const { socket, readResponse } = await openSmtpConnection(config);
-  try {
-    await waitForSmtpResponse(readResponse, ["220"]);
-    await socket.write(`EHLO ${smtpEhloHost()}\r
+    });
+    connecting.then((value) => {
+      socket = value;
+      if (failed || finished)
+        value.terminate();
+    }, () => {});
+    socket = await Promise.race([connecting, failurePromise]);
+    await readResponse(["220"]);
+    await write(`EHLO ${smtpEhloHost()}\r
 `);
-    await waitForSmtpResponse(readResponse, ["250"]);
+    await readResponse(["250"]);
     if (config.username && config.password) {
-      await socket.write(`AUTH LOGIN\r
+      await write(`AUTH LOGIN\r
 `);
-      await waitForSmtpResponse(readResponse, ["334"]);
-      await socket.write(`${encodeBase64(config.username)}\r
+      await readResponse(["334"]);
+      await write(`${encodeBase64(config.username)}\r
 `);
-      await waitForSmtpResponse(readResponse, ["334"]);
-      await socket.write(`${encodeBase64(config.password)}\r
+      await readResponse(["334"]);
+      await write(`${encodeBase64(config.password)}\r
 `);
-      await waitForSmtpResponse(readResponse, ["235"]);
+      await readResponse(["235"]);
     }
-    const fromHeader = assertSafeSmtpAddress(config.from, "from");
-    const toHeader = assertSafeSmtpAddress(message.to, "to");
-    const from = smtpEnvelopeAddress(config.from, "from");
-    const to = smtpEnvelopeAddress(message.to, "to");
-    await socket.write(`MAIL FROM:<${from}>\r
+    await write(`MAIL FROM:<${fromEnvelope}>\r
 `);
-    await waitForSmtpResponse(readResponse, ["250"]);
-    await socket.write(`RCPT TO:<${to}>\r
+    await readResponse(["250"]);
+    await write(`RCPT TO:<${toEnvelope}>\r
 `);
-    await waitForSmtpResponse(readResponse, ["250", "251"]);
-    await socket.write(`DATA\r
+    await readResponse(["250", "251"]);
+    await write(`DATA\r
 `);
-    await waitForSmtpResponse(readResponse, ["354"]);
-    const payload = buildSmtpPayload(fromHeader, {
-      ...message,
-      to: toHeader,
-      subject: assertSafeSmtpField(message.subject, "subject")
-    });
-    await socket.write(payload);
-    await waitForSmtpResponse(readResponse, ["250"]);
-    await socket.write(`QUIT\r
+    await readResponse(["354"]);
+    await write(buildSmtpPayload(fromHeader, { ...message, to: toHeader }));
+    await readResponse(["250"]);
+    finished = true;
+    try {
+      socket.write(`QUIT\r
 `);
-    await waitForSmtpResponse(readResponse, ["221"]);
+    } catch {}
   } finally {
-    socket.end();
+    finished = true;
+    clearTimeout(timer);
+    message.signal?.removeEventListener("abort", onAbort);
+    waiters.length = 0;
+    responses.length = 0;
+    drain = undefined;
+    socket?.end();
   }
 }
+function encodeSmtpHeader(value) {
+  if (/^[\x20-\x7e]{0,60}$/u.test(value))
+    return value;
+  const words = [];
+  let part = "";
+  for (const character of value) {
+    if (Buffer.byteLength(part + character, "utf8") > 45) {
+      words.push(`=?UTF-8?B?${encodeBase64(part)}?=`);
+      part = "";
+    }
+    part += character;
+  }
+  if (part)
+    words.push(`=?UTF-8?B?${encodeBase64(part)}?=`);
+  return words.join(`\r
+ `);
+}
+function smtpAddressHeader(value) {
+  if (!value.includes("<"))
+    return value;
+  const name = value.slice(0, value.lastIndexOf("<")).trim();
+  const address = smtpEnvelopeAddress(value, "address");
+  if (!name)
+    return address;
+  const encoded = encodeSmtpHeader(name);
+  const display = encoded.startsWith("=?UTF-8?B?") ? encoded : `"${encoded.replace(/[\\"]/gu, "\\$&")}"`;
+  return `${display} <${address}>`;
+}
+function smtpMimePart(type, value) {
+  const normalized = value.replace(/\r\n|\r|\n/gu, `\r
+`);
+  const base64 = /[^\t\r\n\x20-\x7e]/u.test(normalized) || normalized.split(`\r
+`).some((line) => line.length > 998);
+  return [
+    `Content-Type: ${type}; charset=utf-8`,
+    `Content-Transfer-Encoding: ${base64 ? "base64" : "7bit"}`,
+    "",
+    base64 ? (encodeBase64(normalized).match(/.{1,76}/gu) ?? []).join(`\r
+`) : normalized
+  ];
+}
 function buildSmtpPayload(from, message) {
-  const safeFrom = assertSafeSmtpAddress(from, "from");
-  const safeTo = assertSafeSmtpAddress(message.to, "to");
-  const safeSubject = assertSafeSmtpField(message.subject, "subject");
   const headers = [
-    `From: ${safeFrom}`,
-    `To: ${safeTo}`,
-    `Subject: ${safeSubject}`,
+    `From: ${smtpAddressHeader(assertSafeSmtpAddress(from, "from"))}`,
+    `To: ${smtpAddressHeader(assertSafeSmtpAddress(message.to, "to"))}`,
+    `Subject: ${encodeSmtpHeader(assertSafeSmtpField(message.subject, "subject"))}`,
     "MIME-Version: 1.0"
   ];
+  let lines;
   if (message.html) {
-    const boundary = `strata-${Date.now().toString(36)}`;
-    headers.push(`Content-Type: multipart/alternative; boundary="${boundary}"`);
-    const parts = [
-      `--${boundary}`,
-      "Content-Type: text/plain; charset=utf-8",
+    let boundary;
+    do {
+      boundary = `strata-${crypto.randomUUID()}`;
+    } while (message.body.includes(boundary) || message.html.includes(boundary));
+    lines = [
+      ...headers,
+      `Content-Type: multipart/alternative; boundary="${boundary}"`,
       "",
-      message.body,
       `--${boundary}`,
-      "Content-Type: text/html; charset=utf-8",
-      "",
-      message.html,
+      ...smtpMimePart("text/plain", message.body),
+      `--${boundary}`,
+      ...smtpMimePart("text/html", message.html),
       `--${boundary}--`,
       ""
     ];
-    return [...headers, "", ...parts, ".", ""].join(`\r
-`);
-  }
-  headers.push("Content-Type: text/plain; charset=utf-8");
-  return [...headers, "", message.body, ".", ""].join(`\r
-`);
+  } else
+    lines = [...headers, ...smtpMimePart("text/plain", message.body)];
+  const content = lines.join(`\r
+`).replace(/(^|\r\n)\./gu, "$1..");
+  return `${content}${content.endsWith(`\r
+`) ? "" : `\r
+`}.\r
+`;
 }
 
 class LogMailDriver {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "2.2.21",
+  "version": "2.2.23",
   "description": "Strata Bun framework public API",
   "type": "module",
   "license": "MIT",