@mavogel/awscdk-rootmail 0.1.14 → 0.1.16

package/node_modules/nodemailer/dist/esm/shared/index.js

@@ -8,6 +8,7 @@ import { isProtoKey, copyOwnKeys } from './objects.js';
 import dns from 'node:dns';
 import net from 'node:net';
 import os from 'node:os';
+import { finished } from 'node:stream';
 // re-exported for the callers that already depend on this module, see ./objects
 export { isProtoKey, copyOwnKeys };
 const DNS_TTL = 5 * 60 * 1000;
@@ -21,14 +22,24 @@ export const _resetCacheCleanup = () => {
     lastCacheCleanup = 0;
 };
 export let networkInterfaces;
-try {
-    networkInterfaces = os.networkInterfaces();
-}
-catch (_err) {
-    // fails on some systems
-}
+let networkInterfacesRead = false;
+// Read on first use rather than at load, so that importing the module does not ask for
+// the interface table (Deno prompts for --allow-sys on it)
+/** @internal */
+export const _readNetworkInterfaces = () => {
+    if (!networkInterfacesRead) {
+        networkInterfacesRead = true;
+        try {
+            networkInterfaces = os.networkInterfaces();
+        }
+        catch (_err) {
+            // fails on some systems
+        }
+    }
+    return networkInterfaces;
+};
 const isFamilySupported = (family, allowInternal) => {
-    const addresses = Object.values(networkInterfaces || {}).flat();
+    const addresses = Object.values(_readNetworkInterfaces() || {}).flat();
     if (!addresses.length) {
         // hope for the best. Runtimes without an interface table (Cloudflare
         // Workers) report an empty object rather than throwing
@@ -39,7 +50,8 @@ const isFamilySupported = (family, allowInternal) => {
 const resolve = (family, hostname, options, callback) => {
     options = options || {};
     if (!isFamilySupported(family, options.allowInternalNetworkInterfaces)) {
-        return callback(null, []);
+        callback(null, []);
+        return null;
     }
     const dnsResolver = dns.Resolver ? new dns.Resolver(options) : dns;
     dnsResolver['resolve' + family](hostname, (err, addresses) => {
@@ -58,6 +70,7 @@ const resolve = (family, hostname, options, callback) => {
         }
         return callback(null, Array.isArray(addresses) ? addresses : [].concat(addresses || []));
     });
+    return dns.Resolver ? dnsResolver : null;
 };
 export const dnsCache = new Map();
 const formatDNSValue = (value, extra) => {
@@ -121,115 +134,139 @@ export const resolveHostname = (options, callback) => {
             }));
         }
     }
-    // Resolve both IPv4 and IPv6 addresses for fallback support
+    // The timeout limits the lookup as a whole. It is also handed to the resolver, but there
+    // it applies to every query attempt on its own, and the resolver retries a few times
+    let responded = false;
+    let deadline;
+    const respond = (err, result) => {
+        if (responded) {
+            return;
+        }
+        responded = true;
+        clearTimeout(deadline);
+        callback(err, result);
+    };
+    // a stale cached value is still better than no value at all
+    const respondCached = (error) => {
+        if (!cached) {
+            return false;
+        }
+        dnsCache.set(host, {
+            value: cached.value,
+            expires: Date.now() + (options.dnsTtl || DNS_TTL)
+        });
+        respond(null, formatDNSValue(cached.value, {
+            servername,
+            cached: true,
+            error
+        }));
+        return true;
+    };
+    const resolvers = [];
+    const timeout = Number(options.timeout) || 0;
+    if (timeout > 0) {
+        deadline = setTimeout(() => {
+            for (const resolver of resolvers) {
+                if (typeof resolver.cancel === 'function') {
+                    resolver.cancel();
+                }
+            }
+            const err = new Error('DNS lookup for ' + host + ' timed out');
+            err.code = dns.TIMEOUT;
+            if (!respondCached(err)) {
+                respond(err);
+            }
+        }, timeout);
+    }
+    // Resolve both IPv4 and IPv6 addresses for fallback support, at the same time
     let ipv4Addresses = [];
     let ipv6Addresses = [];
     let ipv4Error = null;
     let ipv6Error = null;
-    resolve(4, options.host, options, (err, addresses) => {
-        if (err) {
-            ipv4Error = err;
+    let pending = 2;
+    const onResolved = () => {
+        if (--pending || responded) {
+            return;
         }
-        else {
-            ipv4Addresses = addresses || [];
+        // Combine addresses: IPv4 first, then IPv6
+        const allAddresses = ipv4Addresses.concat(ipv6Addresses);
+        if (allAddresses.length) {
+            const value = {
+                addresses: allAddresses
+            };
+            dnsCache.set(host, {
+                value,
+                expires: Date.now() + (options.dnsTtl || DNS_TTL)
+            });
+            return respond(null, formatDNSValue(value, {
+                servername,
+                cached: false
+            }));
         }
-        resolve(6, host, options, (err, addresses) => {
-            if (err) {
-                ipv6Error = err;
-            }
-            else {
-                ipv6Addresses = addresses || [];
-            }
-            // Combine addresses: IPv4 first, then IPv6
-            const allAddresses = ipv4Addresses.concat(ipv6Addresses);
-            if (allAddresses.length) {
+        // No addresses from resolve4/resolve6, try dns.lookup as fallback
+        if (ipv4Error && ipv6Error && respondCached(ipv4Error)) {
+            // Both resolvers had errors
+            return;
+        }
+        try {
+            dns.lookup(host, { all: true }, (err, addresses) => {
+                if (err) {
+                    if (respondCached(err)) {
+                        return;
+                    }
+                    return respond(err);
+                }
+                // Get all supported addresses from dns.lookup
+                const supportedAddresses = addresses
+                    ? addresses.filter(addr => isFamilySupported(addr.family)).map(addr => addr.address)
+                    : [];
+                if (addresses && addresses.length && !supportedAddresses.length) {
+                    // there are addresses but none can be used
+                    console.warn(`Failed to resolve IPv${addresses[0].family} addresses with current network`);
+                }
+                if (!supportedAddresses.length && cached) {
+                    // nothing was found, fallback to cached value
+                    return respond(null, formatDNSValue(cached.value, {
+                        servername,
+                        cached: true
+                    }));
+                }
                 const value = {
-                    addresses: allAddresses
+                    addresses: supportedAddresses.length ? supportedAddresses : [host]
                 };
                 dnsCache.set(host, {
                     value,
                     expires: Date.now() + (options.dnsTtl || DNS_TTL)
                 });
-                return callback(null, formatDNSValue(value, {
+                return respond(null, formatDNSValue(value, {
                     servername,
                     cached: false
                 }));
+            });
+        }
+        catch (lookupErr) {
+            if (respondCached(lookupErr)) {
+                return;
             }
-            // No addresses from resolve4/resolve6, try dns.lookup as fallback
-            if (ipv4Error && ipv6Error) {
-                // Both resolvers had errors
-                if (cached) {
-                    dnsCache.set(host, {
-                        value: cached.value,
-                        expires: Date.now() + (options.dnsTtl || DNS_TTL)
-                    });
-                    return callback(null, formatDNSValue(cached.value, {
-                        servername,
-                        cached: true,
-                        error: ipv4Error
-                    }));
-                }
-            }
-            try {
-                dns.lookup(host, { all: true }, (err, addresses) => {
-                    if (err) {
-                        if (cached) {
-                            dnsCache.set(host, {
-                                value: cached.value,
-                                expires: Date.now() + (options.dnsTtl || DNS_TTL)
-                            });
-                            return callback(null, formatDNSValue(cached.value, {
-                                servername,
-                                cached: true,
-                                error: err
-                            }));
-                        }
-                        return callback(err);
-                    }
-                    // Get all supported addresses from dns.lookup
-                    const supportedAddresses = addresses
-                        ? addresses.filter(addr => isFamilySupported(addr.family)).map(addr => addr.address)
-                        : [];
-                    if (addresses && addresses.length && !supportedAddresses.length) {
-                        // there are addresses but none can be used
-                        console.warn(`Failed to resolve IPv${addresses[0].family} addresses with current network`);
-                    }
-                    if (!supportedAddresses.length && cached) {
-                        // nothing was found, fallback to cached value
-                        return callback(null, formatDNSValue(cached.value, {
-                            servername,
-                            cached: true
-                        }));
-                    }
-                    const value = {
-                        addresses: supportedAddresses.length ? supportedAddresses : [host]
-                    };
-                    dnsCache.set(host, {
-                        value,
-                        expires: Date.now() + (options.dnsTtl || DNS_TTL)
-                    });
-                    return callback(null, formatDNSValue(value, {
-                        servername,
-                        cached: false
-                    }));
-                });
+            return respond(ipv4Error || ipv6Error || lookupErr);
+        }
+    };
+    for (const family of [4, 6]) {
+        const resolver = resolve(family, host, options, (err, addresses) => {
+            if (family === 4) {
+                ipv4Error = err;
+                ipv4Addresses = addresses || [];
             }
-            catch (lookupErr) {
-                if (cached) {
-                    dnsCache.set(host, {
-                        value: cached.value,
-                        expires: Date.now() + (options.dnsTtl || DNS_TTL)
-                    });
-                    return callback(null, formatDNSValue(cached.value, {
-                        servername,
-                        cached: true,
-                        error: lookupErr
-                    }));
-                }
-                return callback(ipv4Error || ipv6Error || lookupErr);
+            else {
+                ipv6Error = err;
+                ipv6Addresses = addresses || [];
             }
+            onResolved();
         });
-    });
+        if (resolver) {
+            resolvers.push(resolver);
+        }
+    }
 };
 /**
  * Parses connection url to a structured configuration object
@@ -548,43 +585,98 @@ export const encodeXText = (str) => {
     }
     return result;
 };
+// The first error a stream emitted, see recordStreamErrors
+const streamErrors = new WeakMap();
+/**
+ * Keeps the first error a content stream emits before it is read, so the error is reported
+ * when the stream is read instead of being thrown as unhandled. The listener stays attached
+ * for good, a stream that emits 'error' more than once never throws the later ones either
+ *
+ * @param stream Readable stream
+ */
+export function recordStreamErrors(stream) {
+    stream.on('error', err => {
+        if (!streamErrors.has(stream)) {
+            streamErrors.set(stream, err);
+        }
+    });
+}
+/**
+ * Destroys a value if it is a readable stream that was not destroyed yet
+ *
+ * @param value Any content value
+ */
+export function destroyStream(value) {
+    const stream = value;
+    if (stream && typeof stream.pipe === 'function' && typeof stream.destroy === 'function' && !stream.destroyed) {
+        stream.destroy();
+    }
+}
+/**
+ * Tells why a stream can not be read from start to end anymore. A stream that ended or was
+ * destroyed before anyone read it would never emit 'end' to a new reader, or, when piped, would
+ * end the destination right away and turn into an empty value without any error
+ *
+ * @param stream Readable stream
+ * @returns The error the stream failed with, an ESTREAM error, or null when it can be read
+ */
+export function unreadableStreamError(stream) {
+    const err = streamErrors.get(stream) || stream.errored;
+    if (err) {
+        return err;
+    }
+    if (stream.readableEnded || stream.destroyed) {
+        const unreadable = new Error('Content stream was already read or destroyed');
+        unreadable.code = errors.ESTREAM;
+        return unreadable;
+    }
+    return null;
+}
 /**
  * Streams a stream value into a Buffer
  *
  * @param stream Readable stream
  * @param callback Callback function with (err, value)
  */
-function resolveStream(stream, callback) {
+export function resolveStream(stream, callback) {
     let responded = false;
-    const chunks = [];
-    let chunklen = 0;
-    stream.on('error', err => {
+    const respond = (err, value) => {
         if (responded) {
             return;
         }
         responded = true;
-        callback(err);
-    });
-    stream.on('readable', () => {
-        let chunk;
-        while ((chunk = stream.read()) !== null) {
-            chunks.push(chunk);
-            chunklen += chunk.length;
+        callback(err, value);
+    };
+    const unreadable = unreadableStreamError(stream);
+    if (unreadable) {
+        // absorbs a later 'error' from the stream, there is nobody left to report it to
+        stream.on('error', () => false);
+        setImmediate(() => respond(unreadable));
+        return;
+    }
+    const chunks = [];
+    let chunklen = 0;
+    stream.on('data', (chunk) => {
+        if (typeof chunk === 'string') {
+            chunk = Buffer.from(chunk);
         }
+        chunks.push(chunk);
+        chunklen += chunk.length;
     });
-    stream.on('end', () => {
-        if (responded) {
-            return;
+    // finished() also reports a stream that is destroyed before 'end', which would otherwise
+    // leave the callback waiting forever
+    finished(stream, { writable: false }, err => {
+        if (err) {
+            return respond(err);
         }
-        responded = true;
         let value;
         try {
             value = Buffer.concat(chunks, chunklen);
         }
         catch (E) {
-            return callback(E);
+            return respond(E);
         }
-        callback(null, value);
+        respond(null, value);
     });
 }
 /**

package/node_modules/nodemailer/dist/esm/smtp-connection/http-proxy-client.d.ts

@@ -9,6 +9,8 @@ import type { Callback } from '../errors.js';
 export interface HttpProxyClientOptions {
     /** Set to false to accept a proxy certificate that fails validation (e.g. self-signed) */
     rejectUnauthorized?: boolean | undefined;
+    /** Time in milliseconds the CONNECT handshake may take, defaults to httpProxyClient.timeout or 30 seconds */
+    timeout?: number | undefined;
 }
 /**
  * Receives the proxied socket once the CONNECT handshake has succeeded, or the error that prevented it
@@ -38,7 +40,7 @@ declare function httpProxyClient(proxyUrl: string, destinationPort: number | str
  */
 declare function httpProxyClient(proxyUrl: string, destinationPort: number | string, destinationHost: string, tlsOptions: HttpProxyClientOptions | undefined, callback: HttpProxyClientCallback): void;
 /**
- * Socket timeout in milliseconds while the CONNECT handshake is in progress, defaults to 30 seconds.
+ * Time in milliseconds the CONNECT handshake may take when the call does not set one, defaults to 30 seconds.
  * Settable on the function itself, the same way the CommonJS module exposed it.
  */
 declare namespace httpProxyClient {

package/node_modules/nodemailer/dist/esm/smtp-connection/http-proxy-client.js

@@ -8,6 +8,8 @@ import * as errors from '../errors.js';
 // Cap the CONNECT response we buffer before the header terminator, so a proxy that
 // never sends \r\n\r\n cannot grow memory unboundedly before the socket times out.
 const MAX_RESPONSE_HEADER_BYTES = 64 * 1024;
+// URL hostnames keep the brackets around an IPv6 literal, socket options and net.isIPv6 take it without
+const unbracket = (host) => typeof host === 'string' && host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
 function httpProxyClient(proxyUrl, destinationPort, destinationHost, tlsOptions, callback) {
     if (typeof tlsOptions === 'function') {
         callback = tlsOptions;
@@ -27,6 +29,8 @@ function httpProxyClient(proxyUrl, destinationPort, destinationHost, tlsOptions,
         return;
     }
     const proxy = urllib.parse(proxyUrl);
+    // the CONNECT request line and the Host header take an IPv6 destination in brackets
+    const authority = (net.isIPv6(unbracket(destinationHost)) ? '[' + unbracket(destinationHost) + ']' : destinationHost) + ':' + destinationPort;
     const connectOptions = {
         host: proxy.hostname,
         port: Number(proxy.port) ? Number(proxy.port) : proxy.protocol === 'https:' ? 443 : 80
@@ -42,15 +46,27 @@ function httpProxyClient(proxyUrl, destinationPort, destinationHost, tlsOptions,
     else {
         connect = net.connect.bind(net);
     }
+    // The handshake is bounded as a whole, a proxy that keeps sending a byte now and then can
+    // not hold the connection open past it
+    const timeout = Number(tlsOptions.timeout) || httpProxyClient.timeout || 30 * 1000;
     let socket;
-    // Error harness for initial connection. Once connection is established, the responsibility
-    // to handle errors is passed to whoever uses this socket
+    // Single settlement path for the handshake: every temporary listener and the timer are
+    // dropped exactly once. Once the tunnel is up, the responsibility to handle errors is passed
+    // to whoever uses this socket
     let finished = false;
-    const tempSocketErr = (err) => {
+    let timer;
+    const cleanup = () => {
+        clearTimeout(timer);
+        socket.removeListener('data', onSocketData);
+        socket.removeListener('error', fail);
+        socket.removeListener('close', onEarlyClose);
+    };
+    function fail(err) {
         if (finished) {
             return;
         }
         finished = true;
+        cleanup();
         try {
             socket.destroy();
         }
@@ -58,18 +74,72 @@ function httpProxyClient(proxyUrl, destinationPort, destinationHost, tlsOptions,
             // ignore
         }
         done(err);
-    };
-    const timeoutErr = () => {
-        const err = new Error('Proxy socket timed out');
-        err.code = 'ETIMEDOUT';
-        tempSocketErr(err);
-    };
+    }
+    function onEarlyClose() {
+        const err = new Error('Proxy closed the connection before the tunnel was established');
+        err.code = errors.EPROXY;
+        fail(err);
+    }
+    // The response is collected as chunks and only the bytes that just arrived, together
+    // with the three before them, are searched for the end of the headers. Appending to a
+    // string and searching all of it again re-read the whole response on every chunk.
+    const chunks = [];
+    let received = 0;
+    let tail = '';
+    function onSocketData(chunk) {
+        if (finished) {
+            return;
+        }
+        const window = tail + chunk.toString('binary');
+        const windowEnd = window.indexOf('\r\n\r\n');
+        chunks.push(chunk);
+        received += chunk.length;
+        tail = window.slice(-3);
+        if (windowEnd < 0) {
+            if (received > MAX_RESPONSE_HEADER_BYTES) {
+                const err = new Error('Proxy response headers too large');
+                err.code = errors.EPROXY;
+                fail(err);
+            }
+            return;
+        }
+        // Stop reading before anything is put back. A socket that keeps flowing would emit the
+        // bytes after the headers, a greeting the proxy sent together with its own response,
+        // before the next owner of the socket has a listener for them
+        socket.removeListener('data', onSocketData);
+        socket.pause();
+        const headerEnd = received - window.length + windowEnd;
+        const response = Buffer.concat(chunks, received);
+        if (response.length > headerEnd + 4) {
+            socket.unshift(response.subarray(headerEnd + 4));
+        }
+        // check response code
+        const match = response.toString('binary', 0, headerEnd).match(/^HTTP\/\d+\.\d+ (\d+)/i);
+        if (!match || (match[1] || '').charAt(0) !== '2') {
+            const err = new Error('Invalid response from proxy' + ((match && ': ' + match[1]) || ''));
+            err.code = errors.EPROXY;
+            return fail(err);
+        }
+        // proxy connection is now established
+        finished = true;
+        cleanup();
+        // A fresh socket starts flowing once something listens for 'data', a paused one would
+        // not. Keep that behaviour for the next owner of the socket
+        const resumeOnData = (event) => {
+            if (event === 'data') {
+                socket.removeListener('newListener', resumeOnData);
+                socket.resume();
+            }
+        };
+        socket.on('newListener', resumeOnData);
+        return done(null, socket);
+    }
     socket = connect(connectOptions, () => {
         if (finished) {
             return;
         }
         const reqHeaders = {
-            Host: destinationHost + ':' + destinationPort,
+            Host: authority,
             Connection: 'close'
         };
         if (proxy.auth) {
@@ -78,9 +148,7 @@ function httpProxyClient(proxyUrl, destinationPort, destinationHost, tlsOptions,
         socket.write(
         // HTTP method
         'CONNECT ' +
-            destinationHost +
-            ':' +
-            destinationPort +
+            authority +
             ' HTTP/1.1\r\n' +
             // HTTP request headers
             Object.keys(reqHeaders)
@@ -88,62 +156,14 @@ function httpProxyClient(proxyUrl, destinationPort, destinationHost, tlsOptions,
                 .join('\r\n') +
             // End request
             '\r\n\r\n');
-        // The response is collected as chunks and only the bytes that just arrived, together
-        // with the three before them, are searched for the end of the headers. Appending to a
-        // string and searching all of it again re-read the whole response on every chunk.
-        const chunks = [];
-        let received = 0;
-        let tail = '';
-        const onSocketData = (chunk) => {
-            let match;
-            if (finished) {
-                return;
-            }
-            const window = tail + chunk.toString('binary');
-            const windowEnd = window.indexOf('\r\n\r\n');
-            chunks.push(chunk);
-            received += chunk.length;
-            tail = window.slice(-3);
-            if (windowEnd >= 0) {
-                socket.removeListener('data', onSocketData);
-                const headerEnd = received - window.length + windowEnd;
-                const response = Buffer.concat(chunks, received).toString('binary');
-                const headers = response.substr(0, headerEnd);
-                const remainder = response.substr(headerEnd + 4);
-                if (remainder) {
-                    socket.unshift(Buffer.from(remainder, 'binary'));
-                }
-                // proxy connection is now established
-                finished = true;
-                // check response code
-                match = headers.match(/^HTTP\/\d+\.\d+ (\d+)/i);
-                if (!match || (match[1] || '').charAt(0) !== '2') {
-                    try {
-                        socket.destroy();
-                    }
-                    catch (_E) {
-                        // ignore
-                    }
-                    const err = new Error('Invalid response from proxy' + ((match && ': ' + match[1]) || ''));
-                    err.code = errors.EPROXY;
-                    return done(err);
-                }
-                socket.removeListener('error', tempSocketErr);
-                socket.removeListener('timeout', timeoutErr);
-                socket.setTimeout(0);
-                return done(null, socket);
-            }
-            if (received > MAX_RESPONSE_HEADER_BYTES) {
-                socket.removeListener('data', onSocketData);
-                const err = new Error('Proxy response headers too large');
-                err.code = errors.EPROXY;
-                return tempSocketErr(err);
-            }
-        };
         socket.on('data', onSocketData);
     });
-    socket.setTimeout(httpProxyClient.timeout || 30 * 1000);
-    socket.on('timeout', timeoutErr);
-    socket.once('error', tempSocketErr);
+    timer = setTimeout(() => {
+        const err = new Error('Proxy socket timed out');
+        err.code = errors.ETIMEDOUT;
+        fail(err);
+    }, timeout);
+    socket.once('error', fail);
+    socket.once('close', onEarlyClose);
 }
 export default httpProxyClient;

package/node_modules/nodemailer/dist/esm/smtp-connection/index.d.ts

@@ -3,7 +3,7 @@ import net from 'node:net';
 import tls from 'node:tls';
 import { type Readable } from 'node:stream';
 import * as shared from '../shared/index.js';
-import type { Callback, NodemailerError } from '../errors.js';
+import { type Callback, type NodemailerError } from '../errors.js';
 import type XOAuth2 from '../xoauth2/index.js';
 import type { XOAuth2Options } from '../xoauth2/index.js';
 /**
@@ -275,6 +275,12 @@ export interface SMTPConnectionConnectOptions extends tls.ConnectionOptions {
     allowInternalNetworkInterfaces?: boolean | undefined;
     /** DNS lookup timeout in ms */
     timeout?: number | undefined;
+    /** Try the resolved addresses in turn, see net.connect */
+    autoSelectFamily?: boolean | undefined;
+    /** Time in ms an address gets before the next one is tried, see net.connect */
+    autoSelectFamilyAttemptTimeout?: number | undefined;
+    /** Hands the resolved addresses to net.connect */
+    lookup?: net.LookupFunction | undefined;
 }
 /**
  * A queued handler for the next server response