@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/lib/security-txt.mjs

@@ -4,7 +4,7 @@
 // Risk. Published contact and policy values are normalized into a small,
 // bounded record; the response body itself is discarded after parsing.
 import { safeFetchDetailed, readTextCapped } from "./safe-fetch.mjs";
-import { createObservation } from "../packages/evidence/observation.mjs";
+import { createObservation, normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 const SECURITY_TXT_VERSION = 1;
 const SECURITY_TXT_PATH = '/.well-known/security.txt';
 const SECURITY_TXT_TIMEOUT_MS = 6_000;
@@ -18,7 +18,6 @@ const CONTROL_CHARACTER_RE = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/u;
 const URI_CONTROL_CHARACTER_RE = /[\u0000-\u001f\u007f]/u;
 const FIELD_RE = /^([A-Za-z][A-Za-z-]*):[ \t]*(.*)$/u;
 const LANGUAGE_RE = /^[a-z]{2,8}(?:-[a-z0-9]{1,8})*$/iu;
-const RFC3339_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/u;
 const CONTACT_PROTOCOLS = new Set(['https:', 'mailto:', 'tel:']);
 const HTTPS_PROTOCOLS = new Set(['https:']);
 const ENCRYPTION_PROTOCOLS = new Set(['https:', 'dns:', 'openpgp4fpr:']);
@@ -222,8 +221,9 @@ function parseSecurityTxt(text, options = {}) {
             malformedCount += languages.length - valid.length;
         }
         else if (field === 'expires') {
-            if (RFC3339_RE.test(value) && Number.isFinite(Date.parse(value)))
-                expires.push(new Date(value).toISOString());
+            const expiry = normalizeExplicitIsoTimestamp(value);
+            if (expiry)
+                expires.push(expiry);
             else
                 malformedCount += 1;
         }
@@ -235,15 +235,18 @@ function parseSecurityTxt(text, options = {}) {
     const boundedPolicies = uniqueBounded(policies);
     const boundedEncryption = uniqueBounded(encryption);
     const boundedCanonical = uniqueBounded(canonical);
+    const boundedCanonicalComparison = uniqueBounded(canonicalComparison);
+    const canonicalComparisonTruncated = valuesTruncated || boundedCanonicalComparison.truncated;
     const boundedLanguages = uniqueBounded(preferredLanguages);
-    valuesTruncated ||= [boundedContacts, boundedPolicies, boundedEncryption, boundedCanonical, boundedLanguages]
+    valuesTruncated ||= [boundedContacts, boundedPolicies, boundedEncryption, boundedCanonical, boundedCanonicalComparison, boundedLanguages]
         .some((entry) => entry.truncated);
     const expiresAt = expires.length === 1 ? expires[0] : null;
     const finalUrl = options.finalUrl ? normalizedHttpsUrl(options.finalUrl) : null;
     const finalComparisonUrl = options.finalUrl ? normalizedCanonicalComparisonUrl(options.finalUrl) : null;
     const canonicalMatches = boundedCanonical.values.length && finalUrl && finalComparisonUrl
-        ? canonicalComparison.slice(0, MAX_SECURITY_TXT_VALUES)
-            .some((value) => value === finalComparisonUrl)
+        ? boundedCanonicalComparison.values.includes(finalComparisonUrl)
+            ? true
+            : canonicalComparisonTruncated ? null : false
         : null;
     const stale = Boolean(expiresAt && Date.parse(expiresAt) <= (options.now ?? Date.now()));
     const requiredMalformed = boundedContacts.values.length === 0 || expires.length !== 1;

package/lib/semantic-version.mjs

@@ -1,54 +1,2 @@
-// Dependency-free semantic-version validation shared by release tooling,
-// runtime identity, and the frontend build. Callers provide a bounded label so
-// errors retain their local context without reimplementing SemVer parsing.
-export const MAX_SEMANTIC_VERSION_LENGTH = 128;
-function fail(label, detail) {
-    throw new TypeError(`${label} ${detail}`);
-}
-function validateIdentifierList(value, label, kind, forbidNumericLeadingZero) {
-    const identifiers = value.split('.');
-    if (identifiers.some((identifier) => identifier.length === 0)) {
-        fail(label, `${kind} contains an empty identifier.`);
-    }
-    for (const identifier of identifiers) {
-        if (!/^[0-9A-Za-z-]+$/u.test(identifier)) {
-            fail(label, `${kind} contains an invalid identifier.`);
-        }
-        if (forbidNumericLeadingZero && /^[0-9]+$/u.test(identifier) && identifier.length > 1 && identifier.startsWith('0')) {
-            fail(label, `${kind} numeric identifiers must not contain leading zeroes.`);
-        }
-    }
-}
-export function normalizeBoundedSemanticVersion(value, label = 'Semantic') {
-    if (typeof value !== 'string'
-        || value.length === 0
-        || value.length > MAX_SEMANTIC_VERSION_LENGTH
-        || value.trim() !== value) {
-        fail(label, 'version must be a bounded semantic-version string.');
-    }
-    const buildParts = value.split('+');
-    if (buildParts.length > 2)
-        fail(label, 'version contains more than one build-metadata separator.');
-    const [precedence, buildMetadata] = buildParts;
-    if (!precedence)
-        fail(label, 'version must include numeric precedence.');
-    const prereleaseSeparator = precedence.indexOf('-');
-    const core = prereleaseSeparator === -1 ? precedence : precedence.slice(0, prereleaseSeparator);
-    const prerelease = prereleaseSeparator === -1 ? undefined : precedence.slice(prereleaseSeparator + 1);
-    const coreParts = core.split('.');
-    if (coreParts.length !== 3 || coreParts.some((part) => !/^(?:0|[1-9][0-9]*)$/u.test(part))) {
-        fail(label, 'version must contain major, minor, and patch numbers without leading zeroes.');
-    }
-    if (prerelease !== undefined)
-        validateIdentifierList(prerelease, label, 'prerelease', true);
-    if (buildMetadata !== undefined)
-        validateIdentifierList(buildMetadata, label, 'build metadata', false);
-    return value;
-}
-export function normalizeBoundedStableSemanticVersion(value, label = 'Stable semantic') {
-    const version = normalizeBoundedSemanticVersion(value, label);
-    if (version.includes('-') || version.includes('+')) {
-        fail(label, 'version must not include prerelease or build identifiers.');
-    }
-    return version;
-}
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/semantic-version.mjs";

package/lib/service-binding-dns.mjs

@@ -376,6 +376,8 @@ function parseServiceBindingDnsResponse(messageValue, expected) {
         throw new ServiceBindingDnsError('DNS response question does not match the query');
     }
     const records = [];
+    const aliases = new Map();
+    const answerOwners = new Set();
     let truncated = false;
     for (let index = 0; index < recordCount; index += 1) {
         const ownerResult = decodeDnsName(message, offset);
@@ -388,9 +390,18 @@ function parseServiceBindingDnsResponse(messageValue, expected) {
         offset += 10;
         const rdataEnd = offset + rdataLength;
         assertRange(message, offset, rdataLength);
+        if (index < answerCount && rrClass === DNS_CLASS_IN && rrType === 5) {
+            const alias = decodeDnsName(message, offset);
+            if (alias.nextOffset !== rdataEnd || alias.name === '.'
+                || (aliases.has(ownerResult.name) && aliases.get(ownerResult.name) !== alias.name)) {
+                throw new ServiceBindingDnsError('DNS answer contains an invalid or ambiguous alias');
+            }
+            aliases.set(ownerResult.name, alias.name);
+        }
         if (index < answerCount
             && rrType === recordTypeCode(expected.type)
             && rrClass === DNS_CLASS_IN) {
+            answerOwners.add(ownerResult.name);
             const parsed = parseServiceBindingRecord(message, ownerResult.name, expected.type, ttl, offset, rdataEnd);
             truncated = parsed.truncated || truncated;
             if (records.length < MAX_SERVICE_BINDING_RECORDS)
@@ -402,6 +413,22 @@ function parseServiceBindingDnsResponse(messageValue, expected) {
     }
     if (offset !== message.length)
         throw new ServiceBindingDnsError('DNS response has trailing bytes');
+    const allowedOwners = new Set();
+    let owner = question.name;
+    while (true) {
+        if (allowedOwners.has(owner))
+            throw new ServiceBindingDnsError('DNS answer contains a cyclic alias chain');
+        allowedOwners.add(owner);
+        const next = aliases.get(owner);
+        if (!next)
+            break;
+        if (answerOwners.has(owner))
+            throw new ServiceBindingDnsError('DNS alias owner also contains service-binding records');
+        owner = next;
+    }
+    if ([...answerOwners].some(value => !allowedOwners.has(value))) {
+        throw new ServiceBindingDnsError('DNS service-binding answer owner is not bound to the query');
+    }
     const unique = new Map();
     for (const record of records)
         unique.set(JSON.stringify(record), record);
@@ -442,6 +469,7 @@ function parseResolverEndpoint(value) {
 }
 function defaultTcpExchange(query, resolver, options) {
     return new Promise((resolve, reject) => {
+        options.signal?.throwIfAborted();
         const socket = createConnection({
             host: resolver.address,
             port: resolver.port,
@@ -457,12 +485,19 @@ function defaultTcpExchange(query, resolver, options) {
             settled = true;
             if (hardDeadline)
                 clearTimeout(hardDeadline);
+            options.signal?.removeEventListener('abort', abort);
             socket.destroy();
             if (error)
                 reject(error);
             else
                 resolve(response);
         };
+        const abort = () => finish(options.signal?.reason ?? new Error('DNS TCP query cancelled'));
+        options.signal?.addEventListener('abort', abort, { once: true });
+        if (options.signal?.aborted) {
+            abort();
+            return;
+        }
         hardDeadline = setTimeout(() => finish(new ServiceBindingDnsError('DNS TCP query timed out', 'ETIMEOUT')), options.timeoutMs);
         hardDeadline.unref();
         socket.setTimeout(options.timeoutMs, () => finish(new ServiceBindingDnsError('DNS TCP query timed out', 'ETIMEOUT')));

package/lib/smtp-transport-review.mjs

@@ -25,6 +25,7 @@ const MAX_SMTP_RESPONSE_BYTES = 16 * 1024;
 const MAX_SMTP_REPLY_LINES = 64;
 const MAX_SMTP_LINE_BYTES = 1_000;
 const MAX_SMTP_CAPABILITIES = 32;
+const SMTP_CAPABILITY_OMISSION = 'The retained EHLO capability inventory is incomplete; additional names were omitted. STARTTLS detection used the full bounded reply.';
 const MAX_SMTP_CERTIFICATE_BYTES = 256 * 1024;
 const SMTP_ENDPOINT_TIMEOUT_MS = 8_000;
 const MAIL_TRANSPORT_TOTAL_TIMEOUT_MS = 30_000;
@@ -138,19 +139,27 @@ function normalizeSmtpReply(linesValue) {
     const sha256 = crypto.createHash('sha256').update(`${lines.join('\r\n')}\r\n`, 'ascii').digest('hex');
     return Object.freeze({ code, lines: Object.freeze(lines), bytes, sha256 });
 }
-function smtpCapabilities(reply) {
-    if (!reply || reply.code !== 250)
-        return Object.freeze([]);
+function smtpCapabilityInventory(reply) {
+    // The reply has already passed line and byte admission. The display cap must
+    // not decide which protocol extensions the endpoint advertised.
+    const seen = new Set();
     const output = [];
-    for (const line of reply.lines.slice(1)) {
+    for (const line of reply?.code === 250 ? reply.lines.slice(1) : []) {
         const capability = line.slice(4).trim().split(/\s+/u)[0]?.toUpperCase() || '';
-        if (!/^[A-Z0-9][A-Z0-9-]{0,31}$/u.test(capability) || output.includes(capability))
+        if (!/^[A-Z0-9][A-Z0-9-]{0,31}$/u.test(capability) || seen.has(capability))
             continue;
-        if (output.length >= MAX_SMTP_CAPABILITIES)
-            break;
-        output.push(capability);
+        seen.add(capability);
+        if (output.length < MAX_SMTP_CAPABILITIES)
+            output.push(capability);
     }
-    return Object.freeze(output.sort());
+    return Object.freeze({
+        capabilities: Object.freeze(output.sort()),
+        starttlsAdvertised: seen.has('STARTTLS'),
+        truncated: seen.size > output.length,
+    });
+}
+function smtpCapabilities(reply) {
+    return smtpCapabilityInventory(reply).capabilities;
 }
 async function runSmtpConversation(hostname, connection) {
     try {
@@ -162,8 +171,7 @@ async function runSmtpConversation(hostname, connection) {
         connection.assertIdle();
         await connection.write(EHLO_COMMAND);
         const ehlo = await connection.readReply();
-        const capabilities = smtpCapabilities(ehlo);
-        const starttlsAdvertised = capabilities.includes('STARTTLS');
+        const { capabilities, starttlsAdvertised } = smtpCapabilityInventory(ehlo);
         if (!starttlsAdvertised) {
             const diagnostics = connection.diagnostics();
             return Object.freeze({ connectedAddress: connection.remoteAddress, greeting, ehlo, capabilities, starttlsAdvertised, starttlsReply: null, starttlsState: 'not_advertised', tls: null, ...diagnostics });
@@ -197,12 +205,17 @@ class SocketReplyReader {
     #endedError = null;
     bytesRead = 0;
     lineCount = 0;
+    #onData = (chunk) => this.#receive(chunk);
+    #onError = (error) => this.#fail(error);
+    #onEnd = () => this.#fail(new Error('SMTP server closed the connection before completing a reply.'));
+    #onTimeout = () => this.#fail(new Error('SMTP transport timed out.'));
     constructor(socket) {
         this.#socket = socket;
-        socket.on('data', (chunk) => this.#receive(Buffer.from(chunk)));
-        socket.once('error', (error) => this.#fail(error));
-        socket.once('end', () => this.#fail(new Error('SMTP server closed the connection before completing a reply.')));
-        socket.once('timeout', () => this.#fail(new Error('SMTP transport timed out.')));
+        socket.on('data', this.#onData);
+        socket.once('error', this.#onError);
+        socket.once('end', this.#onEnd);
+        socket.once('close', this.#onEnd);
+        socket.once('timeout', this.#onTimeout);
     }
     #receive(chunk) {
         if (this.#endedError)
@@ -273,10 +286,14 @@ class SocketReplyReader {
     }
     release() {
         this.assertIdle();
-        this.#socket.removeAllListeners('data');
-        this.#socket.removeAllListeners('error');
-        this.#socket.removeAllListeners('end');
-        this.#socket.removeAllListeners('timeout');
+        this.detach();
+    }
+    detach() {
+        this.#socket.removeListener('data', this.#onData);
+        this.#socket.removeListener('error', this.#onError);
+        this.#socket.removeListener('end', this.#onEnd);
+        this.#socket.removeListener('close', this.#onEnd);
+        this.#socket.removeListener('timeout', this.#onTimeout);
     }
 }
 function smtpStartTlsOptions(socket, hostname) {
@@ -289,10 +306,18 @@ function smtpStartTlsOptions(socket, hostname) {
         checkServerIdentity: () => undefined,
     };
 }
-async function defaultSmtpProbe(options) {
-    const socket = net.createConnection({ host: options.address, port: SMTP_PORT, family: options.family });
+async function defaultSmtpProbe(options, transport = {
+    connect: options => net.createConnection(options),
+    startTls: options => tls.connect(options),
+}) {
+    options.signal.throwIfAborted();
+    const socket = transport.connect({ host: options.address, port: SMTP_PORT, family: options.family });
+    let activeSocket = socket;
+    let reader = null;
     socket.setTimeout(options.timeoutMs);
-    const aborted = () => socket.destroy(new Error('SMTP endpoint review timed out.'));
+    // Closing the active phase rejects its pending read/handshake. Do not emit
+    // an unhandled error on the raw socket after ownership has moved to TLS.
+    const aborted = () => { activeSocket.destroy(); };
     options.signal.addEventListener('abort', aborted, { once: true });
     try {
         await new Promise((resolve, reject) => {
@@ -300,38 +325,48 @@ async function defaultSmtpProbe(options) {
                 socket.removeListener('connect', connected);
                 socket.removeListener('error', failed);
                 socket.removeListener('timeout', timedOut);
+                socket.removeListener('close', closed);
             };
             const connected = () => { cleanup(); resolve(); };
             const failed = (error) => { cleanup(); socket.destroy(); reject(error); };
             const timedOut = () => { cleanup(); socket.destroy(); reject(new Error('SMTP connection timed out.')); };
+            const closed = () => failed(new Error('SMTP connection closed before connecting.'));
             socket.once('connect', connected);
             socket.once('error', failed);
             socket.once('timeout', timedOut);
+            socket.once('close', closed);
             if (options.signal.aborted)
                 aborted();
         });
-        const reader = new SocketReplyReader(socket);
+        const replyReader = new SocketReplyReader(socket);
+        reader = replyReader;
         const connection = {
             remoteAddress: socket.remoteAddress || null,
-            readReply: () => reader.readReply(),
-            assertIdle: () => reader.assertIdle(),
+            readReply: () => replyReader.readReply(),
+            assertIdle: () => replyReader.assertIdle(),
             write: (command) => new Promise((resolve, reject) => socket.write(command, (error) => error ? reject(error) : resolve())),
             startTls: async (hostname) => {
-                reader.release();
-                const tlsSocket = tls.connect(smtpStartTlsOptions(socket, hostname));
+                replyReader.release();
+                const tlsSocket = transport.startTls(smtpStartTlsOptions(socket, hostname));
+                activeSocket = tlsSocket;
                 tlsSocket.setTimeout(options.timeoutMs);
                 await new Promise((resolve, reject) => {
                     const cleanup = () => {
                         tlsSocket.removeListener('secureConnect', secured);
                         tlsSocket.removeListener('error', failed);
                         tlsSocket.removeListener('timeout', timedOut);
+                        tlsSocket.removeListener('close', closed);
                     };
                     const secured = () => { cleanup(); resolve(); };
                     const failed = (error) => { cleanup(); tlsSocket.destroy(); reject(error); };
                     const timedOut = () => { cleanup(); tlsSocket.destroy(); reject(new Error('SMTP STARTTLS handshake timed out.')); };
+                    const closed = () => failed(new Error('SMTP STARTTLS connection closed before completing the handshake.'));
                     tlsSocket.once('secureConnect', secured);
                     tlsSocket.once('error', failed);
                     tlsSocket.once('timeout', timedOut);
+                    tlsSocket.once('close', closed);
+                    if (options.signal.aborted)
+                        aborted();
                 });
                 const cipher = tlsSocket.getCipher();
                 return Object.freeze({
@@ -343,13 +378,15 @@ async function defaultSmtpProbe(options) {
                     remoteAddress: tlsSocket.remoteAddress || null,
                 });
             },
-            diagnostics: () => ({ bytesRead: reader.bytesRead, lineCount: reader.lineCount }),
-            destroy: () => socket.destroy(),
+            diagnostics: () => ({ bytesRead: replyReader.bytesRead, lineCount: replyReader.lineCount }),
+            destroy: () => { activeSocket.destroy(); socket.destroy(); },
         };
         return await runSmtpConversation(options.hostname, connection);
     }
     finally {
         options.signal.removeEventListener('abort', aborted);
+        reader?.detach();
+        activeSocket.destroy();
         socket.destroy();
     }
 }
@@ -486,11 +523,12 @@ function addressAuthentication(selected) {
         })
         : Object.freeze({ state: 'unavailable', detail: 'No address candidate was retained for cryptographic authentication review.' });
 }
-function endpointLimitations(addressState) {
+function endpointLimitations(addressState, capabilitiesTruncated = false) {
     const addressLimitation = addressState === 'connected'
         ? 'The endpoint observation is one point-in-time connection to one revalidated and pinned public address. Other addresses or later observations may differ.'
         : 'The endpoint did not produce confirmed connection evidence. Its address field retains only the highest completed public selection or revalidation stage, if any.';
     return Object.freeze([
+        ...(capabilitiesTruncated ? [SMTP_CAPABILITY_OMISSION] : []),
         addressLimitation,
         'Public-address validation, fresh revalidation, and connection pinning do not cryptographically authenticate the selected A or AAAA RRset or any CNAME chain.',
         'Only the SMTP greeting, EHLO capability names, and optional STARTTLS negotiation were observed. No authentication, recipient, mailbox, catch-all, relay, or message command was attempted.',
@@ -587,10 +625,12 @@ async function collectEndpoint(options) {
         const tlsaComplete = !['indeterminate', 'timed_out', 'unavailable'].includes(tlsa.state)
             && (tlsa.state !== 'validated' || !tlsa.dane || !['partial', 'unavailable', 'invalid'].includes(tlsa.dane.state));
         const certificateComplete = smtp.starttlsState !== 'negotiated' || certificate.observation.state === 'observed';
+        const capabilitiesTruncated = smtpCapabilityInventory(smtp.ehlo).truncated;
         const complete = smtpState === 'observed'
             && dnssec.report.completeness === 'complete'
             && tlsaComplete
-            && certificateComplete;
+            && certificateComplete
+            && !capabilitiesTruncated;
         return Object.freeze({
             host: options.host,
             observedAt: options.observedAt,
@@ -604,7 +644,7 @@ async function collectEndpoint(options) {
             dnssec: dnssec.report,
             tlsa,
             failure: null,
-            limitations: endpointLimitations(addressState),
+            limitations: endpointLimitations(addressState, capabilitiesTruncated),
         });
     }
     catch (error) {
@@ -627,7 +667,7 @@ async function collectEndpoint(options) {
             dnssec: dnssec?.report ?? null,
             tlsa: unavailableTlsa('unavailable', 'TLSA and DANE comparison was unavailable because endpoint collection did not complete.'),
             failure: Object.freeze({ stage, detail }),
-            limitations: endpointLimitations(addressState),
+            limitations: endpointLimitations(addressState, smtpCapabilityInventory(connectedSmtp?.ehlo ?? null).truncated),
         });
     }
 }
@@ -748,6 +788,7 @@ async function collectMailTransportReview(inputValue, options, dependencies = {}
             retries: 0,
         }),
         limitations: Object.freeze([
+            ...(endpoints.some((endpoint) => endpoint.limitations.includes(SMTP_CAPABILITY_OMISSION)) ? [SMTP_CAPABILITY_OMISSION] : []),
             'This command performs active network collection only for the selected MX hosts in this explicitly authorised run. It is not invoked by Lookup, Bulk, monitoring, or automatic recipes.',
             'DNSSEC, TLSA or DANE, PKIX, certificate identity, STARTTLS, SMTP transport, MTA-STS context, and TLS-RPT context retain separate states and provenance. One family never supplies or upgrades another family.',
             ACTIVE_DANE_TA_LIMITATION,
@@ -784,4 +825,4 @@ function formatMailTransportReview(review) {
         lines.push(`  - ${limitation}`);
     return `${lines.join('\n')}\n`;
 }
-export { EHLO_COMMAND, MAIL_TRANSPORT_INPUT_SCHEMA, MAIL_TRANSPORT_INPUT_VERSION, MAIL_TRANSPORT_REVIEW_SCHEMA, MAIL_TRANSPORT_REVIEW_VERSION, MAIL_TRANSPORT_TOTAL_TIMEOUT_MS, MAX_MAIL_TRANSPORT_CONCURRENCY, MAX_MAIL_TRANSPORT_ADDRESS_CANDIDATES, MAX_MAIL_TRANSPORT_DNS_ALIASES, MAX_MAIL_TRANSPORT_INPUT_BYTES, MAX_MAIL_TRANSPORT_TARGETS, MAX_SMTP_CAPABILITIES, MAX_SMTP_LINE_BYTES, MAX_SMTP_REPLY_LINES, MAX_SMTP_RESPONSE_BYTES, SMTP_ENDPOINT_TIMEOUT_MS, STARTTLS_COMMAND, collectMailTransportReview, certificateObservation, formatMailTransportReview, normalizeSmtpReply, parseMailTransportInput, resolveSelectedHost, runSmtpConversation, smtpStartTlsOptions, smtpCapabilities, };
+export { EHLO_COMMAND, MAIL_TRANSPORT_INPUT_SCHEMA, MAIL_TRANSPORT_INPUT_VERSION, MAIL_TRANSPORT_REVIEW_SCHEMA, MAIL_TRANSPORT_REVIEW_VERSION, MAIL_TRANSPORT_TOTAL_TIMEOUT_MS, MAX_MAIL_TRANSPORT_CONCURRENCY, MAX_MAIL_TRANSPORT_ADDRESS_CANDIDATES, MAX_MAIL_TRANSPORT_DNS_ALIASES, MAX_MAIL_TRANSPORT_INPUT_BYTES, MAX_MAIL_TRANSPORT_TARGETS, MAX_SMTP_CAPABILITIES, MAX_SMTP_LINE_BYTES, MAX_SMTP_REPLY_LINES, MAX_SMTP_RESPONSE_BYTES, SMTP_ENDPOINT_TIMEOUT_MS, STARTTLS_COMMAND, collectMailTransportReview, certificateObservation, formatMailTransportReview, normalizeSmtpReply, parseMailTransportInput, resolveSelectedHost, runSmtpConversation, smtpStartTlsOptions, smtpCapabilities, SocketReplyReader, defaultSmtpProbe, };