@zerotal/notifications 1.15.1 → 1.15.3

package/CHANGELOG.md

@@ -8,6 +8,23 @@ follows the Zerotal monorepo's unified versioning.
 
 ## [Unreleased]
 
+## [1.15.2] — 2026-10-23
+
+### Fixed
+
+- **`SmtpDriver` transfer-encodes text and HTML parts.** They went on the wire raw,
+  with no `Content-Transfer-Encoding`, so a body line over RFC 5322's 998-octet limit
+  was cut by a relay wherever the limit fell — a single-line HTML email reached a
+  customer reading "sup pliers" — and a non-ASCII body was sent as undeclared 8-bit
+  on a connection that never negotiated `8BITMIME`. A part that is plain ASCII with
+  lines of 78 characters or fewer is still sent as written, now declared `7bit`;
+  anything else is quoted-printable, which keeps ASCII readable where base64 would
+  not.
+
+- **`DatabaseChannel` runs on Bun 1.4.4.** It built its query templates with an enumerable
+  `raw`, which Bun 1.4.4 refuses. It uses the ORM's `_templateStrings()` now; see
+  `@zerotal/orm`.
+
 ## [1.11.1] — 2026-08-31
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zerotal/notifications",
-  "version": "1.15.1",
+  "version": "1.15.3",
   "license": "MIT",
   "maturity": "stable",
   "private": false,
@@ -30,12 +30,12 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@zerotal/core": "1.15.1",
-    "@zerotal/orm": "1.15.1",
-    "@zerotal/queue": "1.15.1"
+    "@zerotal/core": "1.15.3",
+    "@zerotal/orm": "1.15.3",
+    "@zerotal/queue": "1.15.3"
   },
   "devDependencies": {
-    "@zerotal/broadcasting": "1.15.1",
+    "@zerotal/broadcasting": "1.15.3",
     "typescript": "^5.8.0"
   },
   "description": "Multi-channel notifications for Zerotal — mail (SMTP/Resend), database, broadcast, Slack, and SMS.",

package/src/DatabaseChannel.ts

@@ -1,23 +1,16 @@
-import type { SQLInstance } from "@zerotal/orm";
+import { _templateStrings, type SQLInstance } from "@zerotal/orm";
 import type { Notifiable } from "./types.ts";
 import { NotificationError } from "./errors.ts";
 import { notifiableType } from "./serialization.ts";
 import type { Notification } from "./Notification.ts";
 
-/** Build a TemplateStringsArray from a plain string array (mirrors ORM helper). */
-function tpl(strings: string[]): TemplateStringsArray {
-  return Object.freeze(
-    Object.assign([...strings], { raw: [...strings] }),
-  ) as unknown as TemplateStringsArray;
-}
-
 /** Execute sql with a dynamically-constructed template (table name in static parts). */
 async function run<T = Record<string, unknown>>(
   conn: SQLInstance,
   parts: string[],
   ...values: unknown[]
 ): Promise<T[]> {
-  return conn<T>(tpl(parts), ...values);
+  return conn<T>(_templateStrings(parts), ...values);
 }
 
 /** Allow only simple identifier characters — guards against injection in table names. */

package/src/drivers/SmtpDriver.ts

@@ -669,28 +669,91 @@ function buildRawMessage(msg: MailPayload): string {
 function renderBody(msg: MailPayload): { headers: string; content: string } {
   if (msg.html && msg.text) {
     const alt = `zerotal-alt-${crypto.randomUUID()}`;
+    const text = encodeTextPart(msg.text);
+    const html = encodeTextPart(msg.html);
     const content = [
       `--${alt}`,
       "Content-Type: text/plain; charset=utf-8",
+      `Content-Transfer-Encoding: ${text.encoding}`,
       "",
-      dotStuff(msg.text),
+      text.content,
       `--${alt}`,
       "Content-Type: text/html; charset=utf-8",
+      `Content-Transfer-Encoding: ${html.encoding}`,
       "",
-      dotStuff(msg.html),
+      html.content,
       `--${alt}--`,
     ].join("\r\n");
     return { headers: `Content-Type: multipart/alternative; boundary="${alt}"`, content };
   }
-  if (msg.html) {
-    return { headers: "Content-Type: text/html; charset=utf-8", content: dotStuff(msg.html) };
-  }
+  const type = msg.html ? "text/html" : "text/plain";
+  const part = encodeTextPart(msg.html || msg.text || "");
   return {
-    headers: "Content-Type: text/plain; charset=utf-8",
-    content: dotStuff(msg.text ?? ""),
+    headers: `Content-Type: ${type}; charset=utf-8\r\nContent-Transfer-Encoding: ${part.encoding}`,
+    content: part.content,
   };
 }
 
+/**
+ * RFC 5322 §2.1.1's recommended line length. A part whose lines all fit, in plain
+ * ASCII, goes on the wire as written; anything else is quoted-printable.
+ */
+const PLAIN_LINE_LIMIT = 78;
+
+/**
+ * Pick a transfer encoding for a text part and apply it.
+ *
+ * Sent raw, a part breaks two rules at once. A line may not exceed 998 octets
+ * (RFC 5322 §2.1.1), and relays enforce that by cutting the line wherever the
+ * limit falls — a single-line HTML email arrived with "sup pliers" in it. And a
+ * part with no Content-Transfer-Encoding is 7bit by default, which raw UTF-8 is
+ * not; this driver never negotiates 8BITMIME. Quoted-printable fixes both and
+ * leaves ASCII readable, which base64 would not — and spam filters score a
+ * base64-wrapped ASCII body as disguised.
+ *
+ * The result is dot-stuffed, since quoted-printable lines can still begin with
+ * a period.
+ */
+function encodeTextPart(text: string): { encoding: "7bit" | "quoted-printable"; content: string } {
+  const lines = text.split(/\r?\n/);
+  // eslint-disable-next-line no-control-regex -- matching non-ASCII by definition
+  const plain = !/[^\x00-\x7F]/.test(text) && lines.every((l) => l.length <= PLAIN_LINE_LIMIT);
+  if (plain) return { encoding: "7bit", content: dotStuff(text) };
+  return {
+    encoding: "quoted-printable",
+    content: dotStuff(lines.map(quotedPrintableLine).join("\r\n")),
+  };
+}
+
+/**
+ * Quoted-printable encode one line of text (RFC 2045 §6.7), with soft breaks
+ * keeping every output line at 76 characters or fewer.
+ */
+function quotedPrintableLine(line: string): string {
+  const bytes = Buffer.from(line, "utf8");
+  const out: string[] = [];
+  let current = "";
+  for (let i = 0; i < bytes.length; i++) {
+    const byte = bytes[i]!;
+    // Printable ASCII bar `=` is literal, as are space and tab — except at the
+    // end of the line, where a relay may strip them, so they are escaped there.
+    const literal =
+      (byte >= 33 && byte <= 126 && byte !== 61) ||
+      ((byte === 32 || byte === 9) && i < bytes.length - 1);
+    const token = literal
+      ? String.fromCharCode(byte)
+      : `=${byte.toString(16).toUpperCase().padStart(2, "0")}`;
+    // 75 leaves room for the `=` of the soft break, and never splits an escape.
+    if (current.length + token.length > 75) {
+      out.push(`${current}=`);
+      current = "";
+    }
+    current += token;
+  }
+  out.push(current);
+  return out.join("\r\n");
+}
+
 function toBase64(content: string | Uint8Array): string {
   return typeof content === "string"
     ? Buffer.from(content, "utf8").toString("base64")