@mavogel/awscdk-rootmail 0.1.7 → 0.1.9

package/node_modules/nodemailer/dist/cjs/smtp-connection/index.d.ts

@@ -3,8 +3,9 @@ import net from 'node:net';
 import tls from 'node:tls';
 import { type Readable } from 'node:stream';
 import * as shared from '../shared/index.js';
-import type { NodemailerError } from '../errors.js';
+import type { Callback, NodemailerError } from '../errors.js';
 import type XOAuth2 from '../xoauth2/index.js';
+import type { XOAuth2Options } from '../xoauth2/index.js';
 /**
  * Custom authentication handlers keyed by (case insensitive) SASL method name
  */
@@ -25,11 +26,11 @@ export interface SMTPConnectionOptions {
     secured?: boolean | undefined;
     /** Server name for SNI, defaults to host when that is not an IP address */
     servername?: string | undefined;
-    /** Ignore STARTTLS even when the server advertises it */
+    /** Ignore STARTTLS even when the server advertises it, has no effect when requireTLS is set */
     ignoreTLS?: boolean | undefined;
-    /** Force STARTTLS, fail when the server does not support it */
+    /** Force STARTTLS, fail when the server does not support it. Takes precedence over ignoreTLS and opportunisticTLS */
     requireTLS?: boolean | undefined;
-    /** Continue unencrypted when the STARTTLS upgrade fails */
+    /** Continue unencrypted when the STARTTLS upgrade fails, has no effect when requireTLS is set */
     opportunisticTLS?: boolean | undefined;
     /** Name of the client server, sent with EHLO/HELO, CRLF is stripped */
     name?: string | undefined;
@@ -117,12 +118,23 @@ export interface SMTPConnectionCustomAuthResponse {
  * Callback for a command sent by a custom authentication handler
  */
 export type SMTPConnectionCustomAuthCommandCallback = (err: Error | null, data: SMTPConnectionCustomAuthResponse) => void;
+/**
+ * The auth object as a custom authentication handler sees it: the object handed to login()
+ * with the credentials filled in from its user and pass values
+ */
+export interface SMTPConnectionCustomAuthData extends SMTPConnectionAuth {
+    /** The user and pass values of the auth object, the way @types/nodemailer declared them */
+    credentials: SMTPConnectionCredentials & {
+        user: string;
+        pass: string;
+    };
+}
 /**
  * The object a custom authentication handler is run with
  */
 export interface SMTPConnectionCustomAuthContext {
-    /** The auth object handed to login() */
-    auth: SMTPConnectionAuth;
+    /** The auth object handed to login(), with the credentials filled in */
+    auth: SMTPConnectionCustomAuthData;
     /** Selected authentication method name */
     method: string;
     /** SMTP extensions the server advertised */
@@ -131,17 +143,20 @@ export interface SMTPConnectionCustomAuthContext {
     authMethods: string[];
     /** Maximum message size the server accepts, false when not advertised */
     maxAllowedSize: number | false;
-    /** Sends a command to the server. Returns a promise when no callback is given */
-    sendCommand(cmd: string, done?: SMTPConnectionCustomAuthCommandCallback): Promise<SMTPConnectionCustomAuthResponse> | undefined;
+    /** Sends a command to the server and resolves with the parsed reply */
+    sendCommand(cmd: string): Promise<SMTPConnectionCustomAuthResponse>;
+    /** Sends a command to the server and hands the parsed reply to the callback */
+    sendCommand(cmd: string, done: SMTPConnectionCustomAuthCommandCallback): void;
     /** Marks the user as authenticated */
     resolve(): void;
     /** Fails the authentication with an error */
     reject(err: Error | string): void;
 }
 /**
- * A custom authentication handler. Calls resolve() or reject() on the context, or returns a promise
+ * A custom authentication handler. Calls resolve() or reject() on the context, or returns a
+ * promise that settles the authentication. Any other return value is ignored
  */
-export type SMTPConnectionCustomAuthHandler = (ctx: SMTPConnectionCustomAuthContext) => void | Promise<unknown>;
+export type SMTPConnectionCustomAuthHandler = (ctx: SMTPConnectionCustomAuthContext) => unknown;
 /**
  * An envelope address, either a plain string or an object with an address property
  */
@@ -168,12 +183,16 @@ export interface SMTPEnvelopeDsn {
     /** Alias of recipient, in the 'rfc822;address' form */
     orcpt?: string | null | undefined;
 }
+/**
+ * A single DSN notify value
+ */
+export type SMTPEnvelopeDsnNotify = 'NEVER' | 'SUCCESS' | 'FAILURE' | 'DELAY';
 /**
  * Envelope object accepted by send()
  */
 export interface SMTPEnvelope {
-    /** Sender address */
-    from?: string | SMTPEnvelopeAddress | undefined;
+    /** Sender address, false for the null sender of a bounce message (MAIL FROM:<>) */
+    from?: string | SMTPEnvelopeAddress | false | undefined;
     /** Recipient address or addresses */
     to?: string | SMTPEnvelopeAddress | Array<string | SMTPEnvelopeAddress> | undefined;
     /** Message size in bytes, sent as the SIZE parameter when the server supports it */
@@ -202,9 +221,9 @@ export interface SMTPConnectionEnvelope extends SMTPEnvelope {
     accepted: string[];
 }
 /**
- * Result of a sent message
+ * The recipient bookkeeping of a sent message, known once the envelope is accepted
  */
-export interface SMTPConnectionSendInfo {
+export interface SMTPConnectionEnvelopeInfo {
     /** Recipients the server accepted */
     accepted: string[];
     /** Recipients the server rejected */
@@ -213,19 +232,25 @@ export interface SMTPConnectionSendInfo {
     ehlo?: string[] | undefined;
     /** Errors for the rejected recipients */
     rejectedErrors?: NodemailerError[] | undefined;
+}
+/**
+ * Result of a sent message
+ */
+export interface SMTPConnectionSendInfo extends SMTPConnectionEnvelopeInfo {
     /** Time in ms spent on the envelope commands */
-    envelopeTime?: number | undefined;
+    envelopeTime: number;
     /** Time in ms spent on streaming the message */
-    messageTime?: number | undefined;
+    messageTime: number;
     /** Size of the encoded message in bytes */
-    messageSize?: number | undefined;
+    messageSize: number;
     /** Final server response for the message */
-    response?: string | undefined;
+    response: string;
 }
 /**
- * Callback for send()
+ * Callback for send(), receives the result once the server accepted the message. The error
+ * path hands over the error alone
  */
-export type SMTPConnectionSendCallback = (err: NodemailerError | null, info?: SMTPConnectionSendInfo) => void;
+export type SMTPConnectionSendCallback = Callback<SMTPConnectionSendInfo>;
 /**
  * Callback for login() and reset(), the result is true on success
  */
@@ -263,8 +288,8 @@ export type SMTPConnectionResponseAction = (str: string) => void;
  *  * **port** - is the port to connect to (defaults to 587 or 465)
  *  * **host** - is the hostname or IP address to connect to (defaults to 'localhost')
  *  * **secure** - use SSL
- *  * **ignoreTLS** - ignore server support for STARTTLS
- *  * **requireTLS** - forces the client to use STARTTLS
+ *  * **ignoreTLS** - ignore server support for STARTTLS (has no effect when requireTLS is set)
+ *  * **requireTLS** - forces the client to use STARTTLS, takes precedence over ignoreTLS and opportunisticTLS
  *  * **name** - the name of the client server
  *  * **localAddress** - outbound address to bind to (see: http://nodejs.org/api/net.html#net_net_connect_options_connectionlistener)
  *  * **greetingTimeout** - Time to wait in ms until greeting message is received from the server (defaults to 30 seconds)
@@ -285,7 +310,7 @@ export type SMTPConnectionResponseAction = (str: string) => void;
  */
 declare class SMTPConnection extends EventEmitter {
     id: string;
-    stage: string;
+    stage: 'init' | 'connected';
     options: SMTPConnectionOptions;
     secureConnection: boolean;
     alreadySecured: boolean;
@@ -354,7 +379,7 @@ declare class SMTPConnection extends EventEmitter {
      *
      * @param envelope Envelope object, {from: addr, to: [addr]}
      * @param message String, Buffer or a Stream
-     * @param callback Callback to return once sending is completed
+     * @param done Callback to return once sending is completed
      */
     send(envelope: SMTPEnvelope, message: string | Buffer | Readable, done: SMTPConnectionSendCallback): void;
     /**
@@ -370,12 +395,22 @@ declare class SMTPConnection extends EventEmitter {
 declare namespace SMTPConnection {
     type Options = SMTPConnectionOptions;
     type AuthenticationType = SMTPConnectionAuth;
+    type AuthenticationTypeLogin = SMTPConnectionAuth;
+    type AuthenticationTypeOAuth2 = SMTPConnectionAuth;
+    type AuthenticationTypeCustom = SMTPConnectionAuth;
+    type AuthenticationCredentials = SMTPConnectionAuth;
+    type AuthenticationOAuth2 = SMTPConnectionAuth;
     type Credentials = SMTPConnectionCredentials;
+    type OAuth2 = XOAuth2Options;
     type Envelope = SMTPEnvelope;
     type DSNOptions = SMTPEnvelopeDsn;
+    type DSNOption = SMTPEnvelopeDsnNotify;
     type SentMessageInfo = SMTPConnectionSendInfo;
+    type SMTPError = NodemailerError;
     type CustomAuthenticationContext = SMTPConnectionCustomAuthContext;
     type CustomAuthenticationResponse = SMTPConnectionCustomAuthResponse;
     type CustomAuthenticationHandlers = SMTPConnectionCustomAuthHandlers;
 }
+/** The same aliases as module level exports, for `import * as SMTPConnection` and `import SMTPConnection = require()` */
+export type { SMTPConnectionOptions as Options, SMTPConnectionAuth as AuthenticationType, SMTPConnectionAuth as AuthenticationTypeLogin, SMTPConnectionAuth as AuthenticationTypeOAuth2, SMTPConnectionAuth as AuthenticationTypeCustom, SMTPConnectionAuth as AuthenticationCredentials, SMTPConnectionAuth as AuthenticationOAuth2, SMTPConnectionCredentials as Credentials, XOAuth2Options as OAuth2, SMTPEnvelope as Envelope, SMTPEnvelopeDsn as DSNOptions, SMTPEnvelopeDsnNotify as DSNOption, SMTPConnectionSendInfo as SentMessageInfo, NodemailerError as SMTPError, SMTPConnectionCustomAuthContext as CustomAuthenticationContext, SMTPConnectionCustomAuthResponse as CustomAuthenticationResponse, SMTPConnectionCustomAuthHandlers as CustomAuthenticationHandlers };
 export default SMTPConnection;

package/node_modules/nodemailer/dist/cjs/smtp-connection/index.js

@@ -104,8 +104,8 @@ function isPartialLine(line) {
  *  * **port** - is the port to connect to (defaults to 587 or 465)
  *  * **host** - is the hostname or IP address to connect to (defaults to 'localhost')
  *  * **secure** - use SSL
- *  * **ignoreTLS** - ignore server support for STARTTLS
- *  * **requireTLS** - forces the client to use STARTTLS
+ *  * **ignoreTLS** - ignore server support for STARTTLS (has no effect when requireTLS is set)
+ *  * **requireTLS** - forces the client to use STARTTLS, takes precedence over ignoreTLS and opportunisticTLS
  *  * **name** - the name of the client server
  *  * **localAddress** - outbound address to bind to (see: http://nodejs.org/api/net.html#net_net_connect_options_connectionlistener)
  *  * **greetingTimeout** - Time to wait in ms until greeting message is received from the server (defaults to 30 seconds)
@@ -130,6 +130,11 @@ class SMTPConnection extends node_events_1.EventEmitter {
         this.id = node_crypto_1.default.randomBytes(8).toString('base64').replace(/\W/g, '');
         this.stage = 'init';
         this.options = options || {};
+        if (this.options.requireTLS && (this.options.ignoreTLS || this.options.opportunisticTLS)) {
+            // requireTLS wins, a contradictory configuration must not quietly fall back to plaintext.
+            // Copied so the caller's (possibly shared) options object is left as it was
+            this.options = Object.assign({}, this.options, { ignoreTLS: false, opportunisticTLS: false });
+        }
         this.secureConnection = !!this.options.secure;
         this.alreadySecured = !!this.options.secured;
         this.port = Number(this.options.port) || (this.secureConnection ? 465 : 587);
@@ -173,6 +178,8 @@ class SMTPConnection extends node_events_1.EventEmitter {
         this._destroyed = false;
         this._closing = false;
         this._currentDataStream = false;
+        this._pendingSend = false;
+        this._connectCallback = false;
         this._onSocketData = chunk => this._onData(chunk);
         this._onSocketError = error => this._onError(error, 'ESOCKET', false, 'CONN');
         this._onSocketClose = () => this._onClose();
@@ -187,7 +194,9 @@ class SMTPConnection extends node_events_1.EventEmitter {
      */
     connect(connectCallback) {
         if (typeof connectCallback === 'function') {
+            this._connectCallback = connectCallback;
             this.once('connect', () => {
+                this._connectCallback = false;
                 this.logger.debug({
                     tnx: 'smtp'
                 }, 'SMTP handshake finished');
@@ -419,6 +428,16 @@ class SMTPConnection extends node_events_1.EventEmitter {
             }
             this._currentDataStream = false;
         }
+        // Detach from the message stream as well. The listener is swapped for a no-op rather than
+        // removed, a stream destroyed with an error later on would otherwise throw it as unhandled
+        if (this._pendingSend) {
+            const { stream, onStreamError } = this._pendingSend;
+            if (stream) {
+                stream.removeListener('error', onStreamError);
+                stream.on('error', TEARDOWN_NOOP);
+            }
+            this._pendingSend = false;
+        }
         if (socket && !socket.destroyed) {
             try {
                 // Clear socket timeout to prevent timer leaks
@@ -452,14 +471,21 @@ class SMTPConnection extends node_events_1.EventEmitter {
         this._auth = authData || {};
         // Select SASL authentication method
         this._authMethod = (this._auth.method || '').toString().trim().toUpperCase() || false;
+        // XOAUTH2 needs a token generator or a custom handler, without either the method
+        // can not be run even when it is the only one the server advertised
+        const canUseXOAuth2 = !!this._auth.oauth2 || this.customAuth.has('XOAUTH2');
         if (!this._authMethod && this._auth.oauth2 && !this._auth.credentials) {
             this._authMethod = 'XOAUTH2';
         }
         else if (!this._authMethod || (this._authMethod === 'XOAUTH2' && !this._auth.oauth2)) {
-            // use first supported
-            this._authMethod = (this._supportedAuth[0] || 'PLAIN').toUpperCase().trim();
-        }
-        if (this._authMethod !== 'XOAUTH2' && (!this._auth.credentials || !this._auth.credentials.user || !this._auth.credentials.pass)) {
+            // use the first supported method that can be run
+            const supported = this._supportedAuth.find(method => method !== 'XOAUTH2' || canUseXOAuth2);
+            this._authMethod = (supported || 'PLAIN').toUpperCase().trim();
+        }
+        // a token login needs no credentials, every other method and every custom handler
+        // gets them filled in from the user and pass values
+        if ((this._authMethod !== 'XOAUTH2' || this.customAuth.has('XOAUTH2')) &&
+            (!this._auth.credentials || !this._auth.credentials.user || !this._auth.credentials.pass)) {
             if ((this._auth.user && this._auth.pass) || this.customAuth.has(this._authMethod)) {
                 this._auth.credentials = {
                     user: this._auth.user,
@@ -496,42 +522,45 @@ class SMTPConnection extends node_events_1.EventEmitter {
                 returned = true;
                 callback(this._formatError(err, 'EAUTH', lastResponse, 'AUTH ' + this._authMethod));
             };
+            // one implementation serves both sendCommand overloads, the promise is returned
+            // exactly when no callback was given
+            const sendCommand = (cmd, done) => {
+                let promise;
+                if (!done) {
+                    promise = new Promise((resolve, reject) => {
+                        done = shared.callbackPromise(resolve, reject);
+                    });
+                }
+                this._responseActions.push(str => {
+                    lastResponse = str;
+                    let codes = str.match(/^(\d+)(?:\s(\d+\.\d+\.\d+))?\s/);
+                    let data = {
+                        command: cmd,
+                        response: str
+                    };
+                    if (codes) {
+                        data.status = Number(codes[1]) || 0;
+                        if (codes[2]) {
+                            data.code = codes[2];
+                        }
+                        data.text = str.substr(codes[0].length);
+                    }
+                    else {
+                        data.text = str;
+                        data.status = 0; // just in case we need to perform numeric comparisons
+                    }
+                    done(null, data);
+                });
+                setImmediate(() => this._sendCommand(cmd));
+                return promise;
+            };
             const handlerResponse = handler({
                 auth: this._auth,
                 method: this._authMethod,
                 extensions: [].concat(this._supportedExtensions),
                 authMethods: [].concat(this._supportedAuth),
                 maxAllowedSize: this._maxAllowedSize || false,
-                sendCommand: (cmd, done) => {
-                    let promise;
-                    if (!done) {
-                        promise = new Promise((resolve, reject) => {
-                            done = shared.callbackPromise(resolve, reject);
-                        });
-                    }
-                    this._responseActions.push(str => {
-                        lastResponse = str;
-                        let codes = str.match(/^(\d+)(?:\s(\d+\.\d+\.\d+))?\s/);
-                        let data = {
-                            command: cmd,
-                            response: str
-                        };
-                        if (codes) {
-                            data.status = Number(codes[1]) || 0;
-                            if (codes[2]) {
-                                data.code = codes[2];
-                            }
-                            data.text = str.substr(codes[0].length);
-                        }
-                        else {
-                            data.text = str;
-                            data.status = 0; // just in case we need to perform numeric comparisons
-                        }
-                        done(null, data);
-                    });
-                    setImmediate(() => this._sendCommand(cmd));
-                    return promise;
-                },
+                sendCommand: sendCommand,
                 resolve,
                 reject
             });
@@ -585,35 +614,46 @@ class SMTPConnection extends node_events_1.EventEmitter {
      *
      * @param envelope Envelope object, {from: addr, to: [addr]}
      * @param message String, Buffer or a Stream
-     * @param callback Callback to return once sending is completed
+     * @param done Callback to return once sending is completed
      */
     send(envelope, message, done) {
+        // ensure that the callback is only called once. The public callback type has a
+        // required result, the error paths hand over the error alone
+        let returned = false;
+        const callback = (err, info) => {
+            if (returned) {
+                return;
+            }
+            returned = true;
+            if (this._pendingSend && this._pendingSend.callback === callback) {
+                this._pendingSend = false;
+            }
+            done(err, info);
+        };
         if (!message) {
-            return done(this._formatError('Empty message', 'EMESSAGE', false, 'API'));
+            return callback(this._formatError('Empty message', 'EMESSAGE', false, 'API'));
         }
         const isDestroyedMessage = this._isDestroyedMessage('send message');
         if (isDestroyedMessage) {
-            return done(this._formatError(isDestroyedMessage, 'ECONNECTION', false, 'API'));
+            return callback(this._formatError(isDestroyedMessage, 'ECONNECTION', false, 'API'));
         }
         // reject larger messages than allowed
         if (this._maxAllowedSize && envelope.size > this._maxAllowedSize) {
             setImmediate(() => {
-                done(this._formatError('Message size larger than allowed ' + this._maxAllowedSize, 'EMESSAGE', false, 'MAIL FROM'));
+                callback(this._formatError('Message size larger than allowed ' + this._maxAllowedSize, 'EMESSAGE', false, 'MAIL FROM'));
             });
             return;
         }
-        // ensure that callback is only called once
-        let returned = false;
-        const callback = function (...args) {
-            if (returned) {
-                return;
-            }
-            returned = true;
-            done(...args);
+        const pendingSend = {
+            callback,
+            stream: false,
+            onStreamError: err => callback(this._formatError(err, 'ESTREAM', false, 'API'))
         };
         if (typeof message.on === 'function') {
-            message.on('error', err => callback(this._formatError(err, 'ESTREAM', false, 'API')));
+            pendingSend.stream = message;
+            pendingSend.stream.on('error', pendingSend.onStreamError);
         }
+        this._pendingSend = pendingSend;
         const startTime = Date.now();
         this._setEnvelope(envelope, (err, info) => {
             if (err) {
@@ -633,11 +673,13 @@ class SMTPConnection extends node_events_1.EventEmitter {
                 if (err) {
                     return callback(err);
                 }
-                info.envelopeTime = envelopeTime - startTime;
-                info.messageTime = Date.now() - envelopeTime;
-                info.messageSize = stream.outByteCount;
-                info.response = str;
-                return callback(null, info);
+                // the envelope info becomes the send result once the timings are on it
+                const result = info;
+                result.envelopeTime = envelopeTime - startTime;
+                result.messageTime = Date.now() - envelopeTime;
+                result.messageSize = stream.outByteCount;
+                result.response = str;
+                return callback(null, result);
             });
             if (typeof message.pipe === 'function') {
                 message.pipe(stream);
@@ -785,6 +827,8 @@ class SMTPConnection extends node_events_1.EventEmitter {
      * @event
      * @param err Error object
      * @param type Error name
+     * @param data Server response that triggered the error, false if there is none
+     * @param command SMTP command that was in flight
      * @internal
      */
     _onError(err, type, data, command) {
@@ -804,8 +848,14 @@ class SMTPConnection extends node_events_1.EventEmitter {
         else {
             this.logger.error(data, err.message);
         }
+        // close() forgets the send in flight, it is completed with this same error afterwards so
+        // a late message stream error has nothing left to report
+        const pendingSend = this._pendingSend;
         this.emit('error', err);
         this.close();
+        if (pendingSend) {
+            pendingSend.callback(err);
+        }
     }
     /** @internal */
     _formatError(message, type, response, command) {
@@ -851,14 +901,25 @@ class SMTPConnection extends node_events_1.EventEmitter {
         this.logger.info({
             tnx: 'network'
         }, 'Connection closed');
+        // the unterminated remainder is only reported as a reply (and so gives the error a responseCode)
+        // when it starts like a complete failure reply, not for a fragment such as "55" or a 250
+        const failureResponse = typeof serverResponse === 'string' && /^[45]\d{2}[ -]/.test(serverResponse) ? serverResponse : false;
         if (this.upgrading && !this._destroyed) {
-            return this._onError(new Error('Connection closed unexpectedly'), 'ETLS', serverResponse, 'CONN');
-        }
-        else if (![this._actionGreeting, this.close].includes(this._responseActions[0]) && !this._destroyed) {
-            return this._onError(new Error('Connection closed unexpectedly'), 'ECONNECTION', serverResponse, 'CONN');
+            return this._onError(new Error('Connection closed unexpectedly'), 'ETLS', failureResponse, 'CONN');
+        }
+        if (!failureResponse && this._responseActions[0] === this._actionGreeting && this._connectCallback && !this._destroyed) {
+            // A silent close before the greeting is handed to the connect() callback rather than
+            // emitted as 'error', callers that never saw an error for it must not start throwing one
+            const connectCallback = this._connectCallback;
+            this._connectCallback = false;
+            const err = this._formatError(new Error('Connection closed unexpectedly'), 'ECONNECTION', false, 'CONN');
+            this.logger.warn({ tnx: 'network' }, err.message);
+            connectCallback(err);
+            this.close();
+            return;
         }
-        else if (/^[45]\d{2}\b/.test(serverResponse)) {
-            return this._onError(new Error('Connection closed unexpectedly'), 'ECONNECTION', serverResponse, 'CONN');
+        if (failureResponse || (this._responseActions[0] !== this.close && !this._destroyed)) {
+            return this._onError(new Error('Connection closed unexpectedly'), 'ECONNECTION', failureResponse, 'CONN');
         }
         this._destroy();
     }
@@ -1036,6 +1097,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
      *        {from:'...', to:['...']}
      *        or
      *        {from:{address:'...',name:'...'}, to:[address:'...',name:'...']}
+     * @param callback Callback to run once the envelope is processed
      * @internal
      */
     _setEnvelope(envelope, callback) {
@@ -1335,21 +1397,25 @@ class SMTPConnection extends node_events_1.EventEmitter {
         if (/[ -]AUTH\b/i.test(str)) {
             this.allowsAuth = true;
         }
-        // Detect if the server supports PLAIN auth
-        if (/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)PLAIN/i.test(str)) {
-            this._supportedAuth.push('PLAIN');
-        }
-        // Detect if the server supports LOGIN auth
-        if (/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)LOGIN/i.test(str)) {
-            this._supportedAuth.push('LOGIN');
-        }
-        // Detect if the server supports CRAM-MD5 auth
-        if (/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)CRAM-MD5/i.test(str)) {
-            this._supportedAuth.push('CRAM-MD5');
+        // Detect the advertised SASL mechanisms. The list is split into whole tokens rather
+        // than searched for each name with a pattern: the patterns this replaced let two
+        // whitespace runs overlap and backtracked quadratically over an AUTH line padded with
+        // spaces, so a hostile server could stall the event loop from its EHLO reply
+        // (GHSA-4ffr-jq9g-5ffx).
+        const authMechanisms = new Set();
+        for (const line of this._ehloLines) {
+            const authMatch = /^AUTH[\s=](.*)/i.exec(line);
+            if (authMatch) {
+                for (const mechanism of authMatch[1].split(/[\s=]+/)) {
+                    authMechanisms.add(mechanism.toUpperCase());
+                }
+            }
         }
-        // Detect if the server supports XOAUTH2 auth
-        if (/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)XOAUTH2/i.test(str)) {
-            this._supportedAuth.push('XOAUTH2');
+        // listed in order of preference, the first one the credentials allow is used
+        for (const mechanism of ['PLAIN', 'LOGIN', 'CRAM-MD5', 'XOAUTH2']) {
+            if (authMechanisms.has(mechanism)) {
+                this._supportedAuth.push(mechanism);
+            }
         }
         // Detect if the server supports SIZE extensions (and the max allowed size)
         if ((match = str.match(/[ -]SIZE(?:[ \t]+(\d+))?/im))) {
@@ -1426,6 +1492,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
      * hosts invalidly use a longer message than VXNlcm5hbWU6
      *
      * @param str Message from the server
+     * @param callback Callback to run once the authentication sequence completes
      * @internal
      */
     _actionAUTH_LOGIN_USER(str, callback) {
@@ -1447,6 +1514,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
      * base64 encoded again.
      *
      * @param str Message from the server
+     * @param callback Callback to run once the authentication sequence completes
      * @internal
      */
     _actionAUTH_CRAM_MD5(str, callback) {
@@ -1471,6 +1539,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
      * the user can be considered logged in. Start waiting for a message to send
      *
      * @param str Message from the server
+     * @param callback Callback to run once the authentication sequence completes
      * @internal
      */
     _actionAUTH_CRAM_MD5_PASS(str, callback) {
@@ -1492,6 +1561,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
      * response needs to be base64 encoded password.
      *
      * @param str Message from the server
+     * @param callback Callback to run once the authentication sequence completes
      * @internal
      */
     _actionAUTH_LOGIN_PASS(str, callback) {
@@ -1511,6 +1581,8 @@ class SMTPConnection extends node_events_1.EventEmitter {
      * the user can be considered logged in. Start waiting for a message to send
      *
      * @param str Message from the server
+     * @param isRetry True if this is a retry after a failed login, or the callback itself
+     * @param [callback] Callback to run once the authentication sequence completes
      * @internal
      */
     _actionAUTHComplete(str, isRetry, callback) {
@@ -1553,6 +1625,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
      * Handle response for a MAIL FROM: command
      *
      * @param str Message from the server
+     * @param callback Callback to run once the envelope is processed
      * @internal
      */
     _actionMAIL(str, callback) {
@@ -1581,6 +1654,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
      * Handle response for a RCPT TO: command
      *
      * @param str Message from the server
+     * @param callback Callback to run once the envelope is processed
      * @internal
      */
     _actionRCPT(str, callback) {
@@ -1609,7 +1683,11 @@ class SMTPConnection extends node_events_1.EventEmitter {
                 this._sendCommand('DATA');
             }
             else {
-                err = this._formatError("Can't send mail - all recipients were rejected", 'EENVELOPE', str, 'RCPT TO');
+                // report a temporary rejection when there is one, taking the last reply would mark the
+                // whole message as permanently failed although some recipients were only deferred
+                const deferred = envelope.rejectedErrors.find(rejectedErr => rejectedErr.responseCode && rejectedErr.responseCode < 500);
+                const reply = deferred?.response ?? str;
+                err = this._formatError("Can't send mail - all recipients were rejected", 'EENVELOPE', reply, 'RCPT TO');
                 err.rejected = envelope.rejected;
                 err.rejectedErrors = envelope.rejectedErrors;
                 return callback(err);
@@ -1628,6 +1706,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
      * Handle response for a DATA command
      *
      * @param str Message from the server
+     * @param callback Callback to run once the envelope is processed
      * @internal
      */
     _actionDATA(str, callback) {
@@ -1654,6 +1733,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
      * We expect a single response that defines if the sending succeeded or failed
      *
      * @param str Message from the server
+     * @param callback Callback to run with the final send result
      * @internal
      */
     _actionSMTPStream(str, callback) {
@@ -1670,6 +1750,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
      * @param recipient The recipient this response applies to
      * @param final Is this the final recipient?
      * @param str Message from the server
+     * @param callback Callback to run with the final send result
      * @internal
      */
     _actionLMTPStream(recipient, final, str, callback) {