@nocobase/plugin-workflow-mailer 2.2.19 → 2.2.21

package/dist/node_modules/nodemailer/{lib → dist/esm}/smtp-connection/index.js

@@ -1,22 +1,21 @@
-'use strict';
-
-const packageInfo = require('../../package.json');
-const { EventEmitter } = require('events');
-const net = require('net');
-const tls = require('tls');
-const os = require('os');
-const crypto = require('crypto');
-const DataStream = require('./data-stream');
-const { PassThrough } = require('stream');
-const shared = require('../shared');
-
+import * as packageData from '../package-info.js';
+import { EventEmitter } from 'node:events';
+import net from 'node:net';
+import tls from 'node:tls';
+import os from 'node:os';
+import crypto from 'node:crypto';
+import DataStream from './data-stream.js';
+import { PassThrough } from 'node:stream';
+import * as shared from '../shared/index.js';
 // default timeout values in ms
 const CONNECTION_TIMEOUT = 2 * 60 * 1000; // how much to wait for the connection to be established
 const SOCKET_TIMEOUT = 10 * 60 * 1000; // how much to wait for socket inactivity before disconnecting the client
 const GREETING_TIMEOUT = 30 * 1000; // how much to wait after connection is established but SMTP greeting is not receieved
 const DNS_TIMEOUT = 30 * 1000; // how much to wait for resolveHostname
-const TEARDOWN_NOOP = () => {}; // reusable no-op handler for absorbing errors during socket teardown
-
+const TEARDOWN_NOOP = () => { }; // reusable no-op handler for absorbing errors during socket teardown
+// how many bytes a single server response may occupy while it is still being received.
+// Generous compared to any real reply, it only stops a peer that never completes one
+const MAX_RESPONSE_SIZE = 1024 * 1024;
 /**
  * Re-interpret a server response stored in fake 8-bit byte-container form
  * (the result of chunk.toString('binary') in _onData) as UTF-8.
@@ -38,7 +37,27 @@ function decodeServerResponse(str) {
     // decoder for invalid bytes, which means we should return the original bytes intact.
     return utf8.includes('\uFFFD') ? str : utf8;
 }
-
+/**
+ * True when the last line of a queued reply is a continuation ("250-..."), which means
+ * the rest of the reply is still on its way.
+ *
+ * Called with the byte-container form the queue holds (see _onData): the check only looks
+ * at leading ASCII digits and '-' of the last line, and a UTF-8 continuation byte is never
+ * 0x0A, so line boundaries and the tested prefix are the same before and after decoding.
+ * The last line is read with lastIndexOf rather than split() because a queue entry may hold
+ * a whole multiline reply and only its final line matters.
+ */
+function isPartialResponse(str) {
+    return isPartialLine(str.slice(str.lastIndexOf('\n') + 1));
+}
+/**
+ * True when a single reply line is a continuation ("250-..."). Used where the line is
+ * already known to be one line, which skips the scan isPartialResponse needs to find the
+ * last line of a whole reply.
+ */
+function isPartialLine(line) {
+    return /^\d+-/.test(line);
+}
 /**
  * Generates a SMTP connection object
  *
@@ -47,13 +66,14 @@ function decodeServerResponse(str) {
  *  * **port** - is the port to connect to (defaults to 587 or 465)
  *  * **host** - is the hostname or IP address to connect to (defaults to 'localhost')
  *  * **secure** - use SSL
- *  * **ignoreTLS** - ignore server support for STARTTLS
- *  * **requireTLS** - forces the client to use STARTTLS
+ *  * **ignoreTLS** - ignore server support for STARTTLS (has no effect when requireTLS is set)
+ *  * **requireTLS** - forces the client to use STARTTLS, takes precedence over ignoreTLS and opportunisticTLS
  *  * **name** - the name of the client server
  *  * **localAddress** - outbound address to bind to (see: http://nodejs.org/api/net.html#net_net_connect_options_connectionlistener)
  *  * **greetingTimeout** - Time to wait in ms until greeting message is received from the server (defaults to 30 seconds)
  *  * **connectionTimeout** - how many milliseconds to wait for the connection to establish (defaults to 2 minutes)
  *  * **socketTimeout** - Time of inactivity until the connection is closed (defaults to 10 minutes)
+ *  * **maxResponseSize** - Largest single server response to accept in bytes (defaults to 1 MB)
  *  * **dnsTimeout** - Time to wait in ms for the DNS requests to be resolved (defaults to 30 seconds)
  *  * **lmtp** - if true, uses LMTP instead of SMTP protocol
  *  * **logger** - bunyan compatible logger interface
@@ -64,39 +84,34 @@ function decodeServerResponse(str) {
  *
  * @constructor
  * @namespace SMTP Client module
- * @param {Object} [options] Option properties
+ * @param [options] Option properties
  */
 class SMTPConnection extends EventEmitter {
     constructor(options) {
         super(options);
-
         this.id = crypto.randomBytes(8).toString('base64').replace(/\W/g, '');
         this.stage = 'init';
-
         this.options = options || {};
-
+        if (this.options.requireTLS && (this.options.ignoreTLS || this.options.opportunisticTLS)) {
+            // requireTLS wins, a contradictory configuration must not quietly fall back to plaintext.
+            // Copied so the caller's (possibly shared) options object is left as it was
+            this.options = Object.assign({}, this.options, { ignoreTLS: false, opportunisticTLS: false });
+        }
         this.secureConnection = !!this.options.secure;
         this.alreadySecured = !!this.options.secured;
-
         this.port = Number(this.options.port) || (this.secureConnection ? 465 : 587);
         this.host = this.options.host || 'localhost';
-
         this.servername = this.options.servername ? this.options.servername : !net.isIP(this.host) ? this.host : false;
-
         this.allowInternalNetworkInterfaces = this.options.allowInternalNetworkInterfaces || false;
-
         if (typeof this.options.secure === 'undefined' && this.port === 465) {
             // if secure option is not set but port is 465, then default to secure
             this.secureConnection = true;
         }
-
         this.name = (this.options.name || this._getHostname()).toString().replace(/[\r\n]+/g, '');
-
         this.logger = shared.getLogger(this.options, {
             component: this.options.component || 'smtp-connection',
             sid: this.id
         });
-
         this.customAuth = new Map();
         for (const key of Object.keys(this.options.customAuth || {})) {
             const mapKey = (key || '').toString().trim().toUpperCase();
@@ -104,201 +119,90 @@ class SMTPConnection extends EventEmitter {
                 this.customAuth.set(mapKey, this.options.customAuth[key]);
             }
         }
-
-        /**
-         * Expose version nr, just for the reference
-         * @type {String}
-         */
-        this.version = packageInfo.version;
-
-        /**
-         * If true, then the user is authenticated
-         * @type {Boolean}
-         */
+        this.version = packageData.version;
         this.authenticated = false;
-
-        /**
-         * If set to true, this instance is no longer active
-         * @private
-         */
         this.destroyed = false;
-
-        /**
-         * Defines if the current connection is secure or not. If not,
-         * STARTTLS can be used if available
-         * @private
-         */
         this.secure = !!this.secureConnection;
-
-        /**
-         * Store incomplete messages coming from the server
-         * @private
-         */
         this._remainder = '';
-
-        /**
-         * Unprocessed responses from the server
-         * @type {Array}
-         */
         this._responseQueue = [];
-
+        this._responsePartial = false;
         this.lastServerResponse = false;
-
-        /**
-         * The socket connecting to the server
-         * @public
-         */
         this._socket = false;
-
-        /**
-         * Lists supported auth mechanisms
-         * @private
-         */
         this._supportedAuth = [];
-
-        /**
-         * Set to true, if EHLO response includes "AUTH".
-         * If false then authentication is not tried
-         */
         this.allowsAuth = false;
-
-        /**
-         * Includes current envelope (from, to)
-         * @private
-         */
         this._envelope = false;
-
-        /**
-         * Lists supported extensions
-         * @private
-         */
         this._supportedExtensions = [];
-
-        /**
-         * Defines the maximum allowed size for a single message
-         * @private
-         */
         this._maxAllowedSize = 0;
-
-        /**
-         * Function queue to run if a data chunk comes from the server
-         * @private
-         */
         this._responseActions = [];
         this._recipientQueue = [];
-
-        /**
-         * Timeout variable for waiting the greeting
-         * @private
-         */
         this._greetingTimeout = false;
-
-        /**
-         * Timeout variable for waiting the connection to start
-         * @private
-         */
         this._connectionTimeout = false;
-
-        /**
-         * If the socket is deemed already closed
-         * @private
-         */
         this._destroyed = false;
-
-        /**
-         * If the socket is already being closed
-         * @private
-         */
         this._closing = false;
-
-        /**
-         * Message DATA stream currently piped to the socket, if any. Tracked so
-         * close() can unpipe it before tearing the socket down.
-         * @private
-         */
         this._currentDataStream = false;
-
-        /**
-         * Callbacks for socket's listeners
-         */
+        this._pendingSend = false;
+        this._connectCallback = false;
         this._onSocketData = chunk => this._onData(chunk);
         this._onSocketError = error => this._onError(error, 'ESOCKET', false, 'CONN');
         this._onSocketClose = () => this._onClose();
         this._onSocketEnd = () => this._onEnd();
         this._onSocketTimeout = () => this._onTimeout();
-
-        /**
-         * Connection-phase error handler (supports fallback to alternative addresses)
-         */
         this._onConnectionSocketError = err => this._onConnectionError(err, 'ESOCKET');
-
-        /**
-         * Connection attempt counter for fallback race condition protection
-         * @private
-         */
         this._connectionAttemptId = 0;
     }
-
     /**
      * Creates a connection to a SMTP server and sets up connection
      * listener
      */
     connect(connectCallback) {
         if (typeof connectCallback === 'function') {
+            this._connectCallback = connectCallback;
             this.once('connect', () => {
-                this.logger.debug(
-                    {
-                        tnx: 'smtp'
-                    },
-                    'SMTP handshake finished'
-                );
+                this._connectCallback = false;
+                this.logger.debug({
+                    tnx: 'smtp'
+                }, 'SMTP handshake finished');
                 connectCallback();
             });
-
             const isDestroyedMessage = this._isDestroyedMessage('connect');
             if (isDestroyedMessage) {
                 return connectCallback(this._formatError(isDestroyedMessage, 'ECONNECTION', false, 'CONN'));
             }
         }
-
         let opts = {
             port: this.port,
             host: this.host,
             allowInternalNetworkInterfaces: this.allowInternalNetworkInterfaces,
             timeout: this.options.dnsTimeout || DNS_TIMEOUT
         };
-
         if (this.options.localAddress) {
             opts.localAddress = this.options.localAddress;
         }
-
         if (this.options.connection) {
             // connection is already opened
             this._socket = this.options.connection;
             this._setupConnectionHandlers();
-
             if (this.secureConnection && !this.alreadySecured) {
-                setImmediate(() =>
-                    this._upgradeConnection(err => {
-                        if (err) {
-                            this._onError(new Error('Error initiating TLS - ' + (err.message || err)), 'ETLS', false, 'CONN');
-                            return;
-                        }
-                        this._onConnect();
-                    })
-                );
-            } else {
+                setImmediate(() => this._upgradeConnection(err => {
+                    if (err) {
+                        this._onError(new Error('Error initiating TLS - ' + (err.message || err)), 'ETLS', false, 'CONN');
+                        return;
+                    }
+                    this._onConnect();
+                }));
+            }
+            else {
                 setImmediate(() => this._onConnect());
             }
             return;
-        } else if (this.options.socket) {
+        }
+        else if (this.options.socket) {
             // socket object is set up but not yet connected
             this._socket = this.options.socket;
             return this._resolveAndConnect(opts, _resolved => {
                 try {
                     this._socket.connect(this.port, this.host, () => {
                         this._socket.setKeepAlive(true);
-
                         // a `secure` connection over a caller-provided socket must still
                         // perform the TLS handshake, otherwise AUTH and the message body
                         // would be sent in cleartext despite the caller requesting TLS
@@ -311,58 +215,51 @@ class SMTPConnection extends EventEmitter {
                                 this._onConnect();
                             });
                         }
-
                         this._onConnect();
                     });
                     this._setupConnectionHandlers();
-                } catch (E) {
-                    return setImmediate(() => this._onError(E, 'ECONNECTION', false, 'CONN'));
+                }
+                catch (E) {
+                    setImmediate(() => this._onError(E, 'ECONNECTION', false, 'CONN'));
+                    return;
                 }
             });
-        } else {
+        }
+        else {
             if (this.secureConnection) {
                 Object.assign(opts, this.options.tls || {});
-
                 // ensure servername for SNI
                 if (this.servername && !opts.servername) {
                     opts.servername = this.servername;
                 }
             }
-
             return this._resolveAndConnect(opts, resolved => {
                 // Store fallback addresses for retry on connection failure
                 this._fallbackAddresses = (resolved._addresses || []).filter(addr => addr !== opts.host);
                 this._connectOpts = Object.assign({}, opts);
-
                 this._connectToHost(opts, this.secureConnection);
             });
         }
     }
-
     /**
      * Resolves the hostname and applies resolved values to opts,
      * then calls the provided callback with the resolved data
      *
-     * @param {Object} opts Connection options (modified in place)
-     * @param {Function} callback Called with resolved data on success
+     * @param opts Connection options (modified in place)
+     * @param callback Called with resolved data on success
+     * @internal
      */
     _resolveAndConnect(opts, callback) {
         return shared.resolveHostname(opts, (err, resolved) => {
             if (err) {
                 return setImmediate(() => this._onError(err, 'EDNS', false, 'CONN'));
             }
-            this.logger.debug(
-                {
-                    tnx: 'dns',
-                    source: opts.host,
-                    resolved: resolved.host,
-                    cached: !!resolved.cached
-                },
-                'Resolved %s as %s [cache %s]',
-                opts.host,
-                resolved.host,
-                resolved.cached ? 'hit' : 'miss'
-            );
+            this.logger.debug({
+                tnx: 'dns',
+                source: opts.host,
+                resolved: resolved.host,
+                cached: !!resolved.cached
+            }, 'Resolved %s as %s [cache %s]', opts.host, resolved.host, resolved.cached ? 'hit' : 'miss');
             for (const key of Object.keys(resolved)) {
                 if (key.charAt(0) !== '_' && resolved[key]) {
                     opts[key] = resolved[key];
@@ -371,26 +268,26 @@ class SMTPConnection extends EventEmitter {
             callback(resolved);
         });
     }
-
     /**
      * Attempts to connect to the specified host address
      *
-     * @param {Object} opts Connection options
-     * @param {Boolean} secure Whether to use TLS
+     * @param opts Connection options
+     * @param secure Whether to use TLS
+     * @internal
      */
     _connectToHost(opts, secure) {
         // If the client was closed while DNS resolution was in flight, do not open
         // a socket here: close() ran with this._socket still unset and so had
         // nothing to tear down, and _onConnect's remedial close() is a no-op once
-        // _closing is set — the freshly connected socket would leak.
+        // _closing is set, the freshly connected socket would leak.
         if (this._destroyed || this._closing) {
             return;
         }
-
         this._connectionAttemptId++;
         const currentAttemptId = this._connectionAttemptId;
-
-        const connectFn = secure ? tls.connect : net.connect;
+        const connectFn = secure
+            ? tls.connect
+            : net.connect;
         try {
             this._socket = connectFn(opts, () => {
                 // Ignore callback if this is a stale connection attempt
@@ -401,54 +298,45 @@ class SMTPConnection extends EventEmitter {
                 this._onConnect();
             });
             this._setupConnectionHandlers();
-        } catch (E) {
-            return setImmediate(() => this._onError(E, 'ECONNECTION', false, 'CONN'));
+        }
+        catch (E) {
+            setImmediate(() => this._onError(E, 'ECONNECTION', false, 'CONN'));
+            return;
         }
     }
-
     /**
      * Sets up connection timeout and error handlers
+     * @internal
      */
     _setupConnectionHandlers() {
         this._connectionTimeout = setTimeout(() => {
             this._onConnectionError('Connection timeout', 'ETIMEDOUT');
         }, this.options.connectionTimeout || CONNECTION_TIMEOUT);
-
         this._socket.on('error', this._onConnectionSocketError);
     }
-
     /**
      * Handles connection errors with fallback to alternative addresses
      *
-     * @param {Error|String} err Error object or message
-     * @param {String} code Error code
+     * @param err Error object or message
+     * @param code Error code
+     * @internal
      */
     _onConnectionError(err, code) {
         clearTimeout(this._connectionTimeout);
-
         // Check if we have fallback addresses to try
         const canFallback = this._fallbackAddresses && this._fallbackAddresses.length && this.stage === 'init' && !this._destroyed;
-
         if (!canFallback) {
             // No more fallback addresses, report the error
             this._onError(err, code, false, 'CONN');
             return;
         }
-
         const nextHost = this._fallbackAddresses.shift();
-
-        this.logger.info(
-            {
-                tnx: 'network',
-                failedHost: this._connectOpts.host,
-                nextHost,
-                error: err.message || err
-            },
-            'Connection to %s failed, trying %s',
-            this._connectOpts.host,
-            nextHost
-        );
-
+        this.logger.info({
+            tnx: 'network',
+            failedHost: this._connectOpts.host,
+            nextHost,
+            error: err.message || err
+        }, 'Connection to %s failed, trying %s', this._connectOpts.host, nextHost);
         // Clean up current socket
         if (this._socket) {
             try {
@@ -457,17 +345,16 @@ class SMTPConnection extends EventEmitter {
                 // after destroy), mirroring the guard used in close()
                 this._socket.on('error', TEARDOWN_NOOP);
                 this._socket.destroy();
-            } catch (_E) {
+            }
+            catch (_E) {
                 // ignore
             }
             this._socket = null;
         }
-
         // Update host and retry
         this._connectOpts.host = nextHost;
         this._connectToHost(this._connectOpts, this.secureConnection);
     }
-
     /**
      * Sends QUIT
      */
@@ -475,7 +362,6 @@ class SMTPConnection extends EventEmitter {
         this._sendCommand('QUIT');
         this._responseActions.push(this.close);
     }
-
     /**
      * Closes the connection to the server
      */
@@ -483,36 +369,37 @@ class SMTPConnection extends EventEmitter {
         clearTimeout(this._connectionTimeout);
         clearTimeout(this._greetingTimeout);
         this._responseActions = [];
-
         // allow to run this function only once
         if (this._closing) {
             return;
         }
         this._closing = true;
-
         const closeMethod = this.stage === 'init' ? 'destroy' : 'end';
-
-        this.logger.debug(
-            {
-                tnx: 'smtp'
-            },
-            'Closing connection to the server using "%s"',
-            closeMethod
-        );
-
+        this.logger.debug({
+            tnx: 'smtp'
+        }, 'Closing connection to the server using "%s"', closeMethod);
         const socket = (this._socket && this._socket.socket) || this._socket;
-
         // Detach any in-flight DATA stream from the socket so the source stream
         // can be garbage-collected once the socket is gone.
         if (this._currentDataStream) {
             try {
                 this._currentDataStream.unpipe(this._socket);
-            } catch (_E) {
+            }
+            catch (_E) {
                 // ignore
             }
             this._currentDataStream = false;
         }
-
+        // Detach from the message stream as well. The listener is swapped for a no-op rather than
+        // removed, a stream destroyed with an error later on would otherwise throw it as unhandled
+        if (this._pendingSend) {
+            const { stream, onStreamError } = this._pendingSend;
+            if (stream) {
+                stream.removeListener('error', onStreamError);
+                stream.on('error', TEARDOWN_NOOP);
+            }
+            this._pendingSend = false;
+        }
         if (socket && !socket.destroyed) {
             try {
                 // Clear socket timeout to prevent timer leaks
@@ -528,14 +415,13 @@ class SMTPConnection extends EventEmitter {
                 // sending cleartext after TLS shutdown triggers ERR_SSL_BAD_RECORD_TYPE)
                 socket.on('error', TEARDOWN_NOOP);
                 socket[closeMethod]();
-            } catch (_E) {
+            }
+            catch (_E) {
                 // just ignore
             }
         }
-
         this._destroy();
     }
-
     /**
      * Authenticate user
      */
@@ -544,116 +430,108 @@ class SMTPConnection extends EventEmitter {
         if (isDestroyedMessage) {
             return callback(this._formatError(isDestroyedMessage, 'ECONNECTION', false, 'API'));
         }
-
         this._auth = authData || {};
         // Select SASL authentication method
         this._authMethod = (this._auth.method || '').toString().trim().toUpperCase() || false;
-
+        // XOAUTH2 needs a token generator or a custom handler, without either the method
+        // can not be run even when it is the only one the server advertised
+        const canUseXOAuth2 = !!this._auth.oauth2 || this.customAuth.has('XOAUTH2');
         if (!this._authMethod && this._auth.oauth2 && !this._auth.credentials) {
             this._authMethod = 'XOAUTH2';
-        } else if (!this._authMethod || (this._authMethod === 'XOAUTH2' && !this._auth.oauth2)) {
-            // use first supported
-            this._authMethod = (this._supportedAuth[0] || 'PLAIN').toUpperCase().trim();
         }
-
-        if (this._authMethod !== 'XOAUTH2' && (!this._auth.credentials || !this._auth.credentials.user || !this._auth.credentials.pass)) {
+        else if (!this._authMethod || (this._authMethod === 'XOAUTH2' && !this._auth.oauth2)) {
+            // use the first supported method that can be run
+            const supported = this._supportedAuth.find(method => method !== 'XOAUTH2' || canUseXOAuth2);
+            this._authMethod = (supported || 'PLAIN').toUpperCase().trim();
+        }
+        // a token login needs no credentials, every other method and every custom handler
+        // gets them filled in from the user and pass values
+        if ((this._authMethod !== 'XOAUTH2' || this.customAuth.has('XOAUTH2')) &&
+            (!this._auth.credentials || !this._auth.credentials.user || !this._auth.credentials.pass)) {
             if ((this._auth.user && this._auth.pass) || this.customAuth.has(this._authMethod)) {
                 this._auth.credentials = {
                     user: this._auth.user,
                     pass: this._auth.pass,
                     options: this._auth.options
                 };
-            } else {
+            }
+            else {
                 return callback(this._formatError('Missing credentials for "' + this._authMethod + '"', 'EAUTH', false, 'API'));
             }
         }
-
         if (this.customAuth.has(this._authMethod)) {
             const handler = this.customAuth.get(this._authMethod);
             let lastResponse;
             let returned = false;
-
             const resolve = () => {
                 if (returned) {
                     return;
                 }
                 returned = true;
-                this.logger.info(
-                    {
-                        tnx: 'smtp',
-                        username: this._auth.user,
-                        action: 'authenticated',
-                        method: this._authMethod
-                    },
-                    'User %s authenticated',
-                    JSON.stringify(this._auth.user)
-                );
+                this.logger.info({
+                    tnx: 'smtp',
+                    username: this._auth.user,
+                    action: 'authenticated',
+                    method: this._authMethod
+                }, 'User %s authenticated', JSON.stringify(this._auth.user));
                 this.authenticated = true;
                 callback(null, true);
             };
-
-            const reject = err => {
+            const reject = (err) => {
                 if (returned) {
                     return;
                 }
                 returned = true;
                 callback(this._formatError(err, 'EAUTH', lastResponse, 'AUTH ' + this._authMethod));
             };
-
+            // one implementation serves both sendCommand overloads, the promise is returned
+            // exactly when no callback was given
+            const sendCommand = (cmd, done) => {
+                let promise;
+                if (!done) {
+                    promise = new Promise((resolve, reject) => {
+                        done = shared.callbackPromise(resolve, reject);
+                    });
+                }
+                this._responseActions.push(str => {
+                    lastResponse = str;
+                    let codes = str.match(/^(\d+)(?:\s(\d+\.\d+\.\d+))?\s/);
+                    let data = {
+                        command: cmd,
+                        response: str
+                    };
+                    if (codes) {
+                        data.status = Number(codes[1]) || 0;
+                        if (codes[2]) {
+                            data.code = codes[2];
+                        }
+                        data.text = str.substr(codes[0].length);
+                    }
+                    else {
+                        data.text = str;
+                        data.status = 0; // just in case we need to perform numeric comparisons
+                    }
+                    done(null, data);
+                });
+                setImmediate(() => this._sendCommand(cmd));
+                return promise;
+            };
             const handlerResponse = handler({
                 auth: this._auth,
                 method: this._authMethod,
-
                 extensions: [].concat(this._supportedExtensions),
                 authMethods: [].concat(this._supportedAuth),
                 maxAllowedSize: this._maxAllowedSize || false,
-
-                sendCommand: (cmd, done) => {
-                    let promise;
-
-                    if (!done) {
-                        promise = new Promise((resolve, reject) => {
-                            done = shared.callbackPromise(resolve, reject);
-                        });
-                    }
-
-                    this._responseActions.push(str => {
-                        lastResponse = str;
-
-                        let codes = str.match(/^(\d+)(?:\s(\d+\.\d+\.\d+))?\s/);
-                        let data = {
-                            command: cmd,
-                            response: str
-                        };
-                        if (codes) {
-                            data.status = Number(codes[1]) || 0;
-                            if (codes[2]) {
-                                data.code = codes[2];
-                            }
-                            data.text = str.substr(codes[0].length);
-                        } else {
-                            data.text = str;
-                            data.status = 0; // just in case we need to perform numeric comparisons
-                        }
-                        done(null, data);
-                    });
-                    setImmediate(() => this._sendCommand(cmd));
-
-                    return promise;
-                },
-
+                sendCommand: sendCommand,
                 resolve,
                 reject
             });
-
             if (handlerResponse && typeof handlerResponse.catch === 'function') {
                 // a promise was returned
                 handlerResponse.then(resolve).catch(reject);
             }
-
             return;
         }
-
         switch (this._authMethod) {
             case 'XOAUTH2':
                 this._handleXOauth2Token(false, callback);
@@ -668,27 +546,21 @@ class SMTPConnection extends EventEmitter {
                 this._responseActions.push(str => {
                     this._actionAUTHComplete(str, callback);
                 });
-                this._sendCommand(
-                    'AUTH PLAIN ' +
-                        Buffer.from(
-                            //this._auth.user+'\u0000'+
-                            '\u0000' + // skip authorization identity as it causes problems with some servers
-                                this._auth.credentials.user +
-                                '\u0000' +
-                                this._auth.credentials.pass,
-                            'utf-8'
-                        ).toString('base64'),
-                    // log entry without passwords
-                    'AUTH PLAIN ' +
-                        Buffer.from(
-                            //this._auth.user+'\u0000'+
-                            '\u0000' + // skip authorization identity as it causes problems with some servers
-                                this._auth.credentials.user +
-                                '\u0000' +
-                                '/* secret */',
-                            'utf-8'
-                        ).toString('base64')
-                );
+                this._sendCommand('AUTH PLAIN ' +
+                    Buffer.from(
+                    //this._auth.user+'\u0000'+
+                    '\u0000' + // skip authorization identity as it causes problems with some servers
+                        this._auth.credentials.user +
+                        '\u0000' +
+                        this._auth.credentials.pass, 'utf-8').toString('base64'), 
+                // log entry without passwords
+                'AUTH PLAIN ' +
+                    Buffer.from(
+                    //this._auth.user+'\u0000'+
+                    '\u0000' + // skip authorization identity as it causes problems with some servers
+                        this._auth.credentials.user +
+                        '\u0000' +
+                        '/* secret */', 'utf-8').toString('base64'));
                 return;
             case 'CRAM-MD5':
                 this._responseActions.push(str => {
@@ -697,49 +569,53 @@ class SMTPConnection extends EventEmitter {
                 this._sendCommand('AUTH CRAM-MD5');
                 return;
         }
-
         return callback(this._formatError('Unknown authentication method "' + this._authMethod + '"', 'EAUTH', false, 'API'));
     }
-
     /**
      * Sends a message
      *
-     * @param {Object} envelope Envelope object, {from: addr, to: [addr]}
-     * @param {Object} message String, Buffer or a Stream
-     * @param {Function} callback Callback to return once sending is completed
+     * @param envelope Envelope object, {from: addr, to: [addr]}
+     * @param message String, Buffer or a Stream
+     * @param done Callback to return once sending is completed
      */
     send(envelope, message, done) {
+        // ensure that the callback is only called once. The public callback type has a
+        // required result, the error paths hand over the error alone
+        let returned = false;
+        const callback = (err, info) => {
+            if (returned) {
+                return;
+            }
+            returned = true;
+            if (this._pendingSend && this._pendingSend.callback === callback) {
+                this._pendingSend = false;
+            }
+            done(err, info);
+        };
         if (!message) {
-            return done(this._formatError('Empty message', 'EMESSAGE', false, 'API'));
+            return callback(this._formatError('Empty message', 'EMESSAGE', false, 'API'));
         }
-
         const isDestroyedMessage = this._isDestroyedMessage('send message');
         if (isDestroyedMessage) {
-            return done(this._formatError(isDestroyedMessage, 'ECONNECTION', false, 'API'));
+            return callback(this._formatError(isDestroyedMessage, 'ECONNECTION', false, 'API'));
         }
-
         // reject larger messages than allowed
         if (this._maxAllowedSize && envelope.size > this._maxAllowedSize) {
-            return setImmediate(() => {
-                done(this._formatError('Message size larger than allowed ' + this._maxAllowedSize, 'EMESSAGE', false, 'MAIL FROM'));
+            setImmediate(() => {
+                callback(this._formatError('Message size larger than allowed ' + this._maxAllowedSize, 'EMESSAGE', false, 'MAIL FROM'));
             });
+            return;
         }
-
-        // ensure that callback is only called once
-        let returned = false;
-        const callback = function () {
-            if (returned) {
-                return;
-            }
-            returned = true;
-
-            done(...arguments);
+        const pendingSend = {
+            callback,
+            stream: false,
+            onStreamError: err => callback(this._formatError(err, 'ESTREAM', false, 'API'))
         };
-
         if (typeof message.on === 'function') {
-            message.on('error', err => callback(this._formatError(err, 'ESTREAM', false, 'API')));
+            pendingSend.stream = message;
+            pendingSend.stream.on('error', pendingSend.onStreamError);
         }
-
+        this._pendingSend = pendingSend;
         const startTime = Date.now();
         this._setEnvelope(envelope, (err, info) => {
             if (err) {
@@ -747,11 +623,11 @@ class SMTPConnection extends EventEmitter {
                 const stream = new PassThrough();
                 if (typeof message.pipe === 'function') {
                     message.pipe(stream);
-                } else {
+                }
+                else {
                     stream.write(message);
                     stream.end();
                 }
-
                 return callback(err);
             }
             const envelopeTime = Date.now();
@@ -759,34 +635,33 @@ class SMTPConnection extends EventEmitter {
                 if (err) {
                     return callback(err);
                 }
-
-                info.envelopeTime = envelopeTime - startTime;
-                info.messageTime = Date.now() - envelopeTime;
-                info.messageSize = stream.outByteCount;
-                info.response = str;
-
-                return callback(null, info);
+                // the envelope info becomes the send result once the timings are on it
+                const result = info;
+                result.envelopeTime = envelopeTime - startTime;
+                result.messageTime = Date.now() - envelopeTime;
+                result.messageSize = stream.outByteCount;
+                result.response = str;
+                return callback(null, result);
             });
             if (typeof message.pipe === 'function') {
                 message.pipe(stream);
-            } else {
+            }
+            else {
                 stream.write(message);
                 stream.end();
             }
         });
     }
-
     /**
      * Resets connection state
      *
-     * @param {Function} callback Callback to return once connection is reset
+     * @param callback Callback to return once connection is reset
      */
     reset(callback) {
         const isDestroyedMessage = this._isDestroyedMessage('reset');
         if (isDestroyedMessage) {
             return callback(this._formatError(isDestroyedMessage, 'ECONNECTION', false, 'API'));
         }
-
         this._sendCommand('RSET');
         this._responseActions.push(str => {
             if (str.charAt(0) !== '2') {
@@ -796,231 +671,245 @@ class SMTPConnection extends EventEmitter {
             return callback(null, true);
         });
     }
-
     /**
      * Connection listener that is run when the connection to
      * the server is opened
      *
      * @event
+     * @internal
      */
     _onConnect() {
+        const socket = this._socket;
         clearTimeout(this._connectionTimeout);
-
-        this.logger.info(
-            {
-                tnx: 'network',
-                localAddress: this._socket.localAddress,
-                localPort: this._socket.localPort,
-                remoteAddress: this._socket.remoteAddress,
-                remotePort: this._socket.remotePort
-            },
-            '%s established to %s:%s',
-            this.secure ? 'Secure connection' : 'Connection',
-            this._socket.remoteAddress,
-            this._socket.remotePort
-        );
-
+        this.logger.info({
+            tnx: 'network',
+            localAddress: socket.localAddress,
+            localPort: socket.localPort,
+            remoteAddress: socket.remoteAddress,
+            remotePort: socket.remotePort
+        }, '%s established to %s:%s', this.secure ? 'Secure connection' : 'Connection', socket.remoteAddress, socket.remotePort);
         if (this._destroyed) {
             // Connection was established after we already had canceled it
             this.close();
             return;
         }
-
         this.stage = 'connected';
-
         // clear existing listeners for the socket
-        this._socket.removeListener('data', this._onSocketData);
-        this._socket.removeListener('timeout', this._onSocketTimeout);
-        this._socket.removeListener('close', this._onSocketClose);
-        this._socket.removeListener('end', this._onSocketEnd);
+        socket.removeListener('data', this._onSocketData);
+        socket.removeListener('timeout', this._onSocketTimeout);
+        socket.removeListener('close', this._onSocketClose);
+        socket.removeListener('end', this._onSocketEnd);
         // Switch from connection-phase error handler to normal error handler
-        this._socket.removeListener('error', this._onConnectionSocketError);
+        socket.removeListener('error', this._onConnectionSocketError);
         // _upgradeConnection (options.connection + secure) may already have attached
         // the normal handler; remove it first so we never end up with a duplicate
-        this._socket.removeListener('error', this._onSocketError);
-
-        this._socket.on('error', this._onSocketError);
-        this._socket.on('data', this._onSocketData);
-        this._socket.once('close', this._onSocketClose);
-        this._socket.once('end', this._onSocketEnd);
-
-        this._socket.setTimeout(this.options.socketTimeout || SOCKET_TIMEOUT);
-        this._socket.on('timeout', this._onSocketTimeout);
-
+        socket.removeListener('error', this._onSocketError);
+        socket.on('error', this._onSocketError);
+        socket.on('data', this._onSocketData);
+        socket.once('close', this._onSocketClose);
+        socket.once('end', this._onSocketEnd);
+        socket.setTimeout(this.options.socketTimeout || SOCKET_TIMEOUT);
+        socket.on('timeout', this._onSocketTimeout);
         this._greetingTimeout = setTimeout(() => {
             // if still waiting for greeting, give up
             if (this._socket && !this._destroyed && this._responseActions[0] === this._actionGreeting) {
                 this._onError('Greeting never received', 'ETIMEDOUT', false, 'CONN');
             }
         }, this.options.greetingTimeout || GREETING_TIMEOUT);
-
         this._responseActions.push(this._actionGreeting);
-
         // we have a 'data' listener set up so resume socket if it was paused
-        this._socket.resume();
+        socket.resume();
     }
-
     /**
      * 'data' listener for data coming from the server
      *
      * @event
-     * @param {Buffer} chunk Data chunk coming from the server
+     * @param chunk Data chunk coming from the server
+     * @internal
      */
     _onData(chunk) {
         if (this._destroyed || !chunk || !chunk.length) {
             return;
         }
-
-        let data = chunk.toString('binary');
-        let lines = (this._remainder + data).split(/\r?\n/);
-        let lastline;
-
+        const maxResponseSize = this.options.maxResponseSize || MAX_RESPONSE_SIZE;
+        const data = chunk.toString('binary');
+        // A chunk without a line break only extends the line currently being received, so
+        // keep it in the remainder and leave that string unflattened. Splitting the whole
+        // remainder again on every chunk would rescan everything buffered for that line so
+        // far, which is quadratic in the length of a line the peer never terminates
+        if (!data.includes('\n')) {
+            this._remainder += data;
+            if (this._remainder.length > maxResponseSize) {
+                return this._onResponseTooLarge();
+            }
+            return;
+        }
+        const lines = (this._remainder + data).split(/\r?\n/);
         this._remainder = lines.pop();
-
         for (let i = 0, len = lines.length; i < len; i++) {
-            if (this._responseQueue.length) {
-                lastline = this._responseQueue[this._responseQueue.length - 1];
-                if (/^\d+-/.test(lastline.split('\n').pop())) {
-                    this._responseQueue[this._responseQueue.length - 1] += '\n' + lines[i];
-                    continue;
-                }
+            if (this._responsePartial) {
+                this._responseQueue[this._responseQueue.length - 1] += '\n' + lines[i];
             }
-            this._responseQueue.push(lines[i]);
-        }
-
-        if (this._responseQueue.length) {
-            lastline = this._responseQueue[this._responseQueue.length - 1];
-            if (/^\d+-/.test(lastline.split('\n').pop())) {
-                return;
+            else {
+                this._responseQueue.push(lines[i]);
+            }
+            // The line just added is the last line of that queue entry, so it alone decides
+            // whether the reply is still partial. Looking for the last line of the accumulated
+            // entry instead would rescan a string that grows with every continuation line,
+            // which is quadratic in the size of the reply
+            this._responsePartial = isPartialLine(lines[i]);
+            // Checked as each line lands, so a peer that never completes a reply cannot keep
+            // buffering, and the limit does not depend on how it split its bytes into chunks
+            if (this._responsePartial && this._responseQueue[this._responseQueue.length - 1].length > maxResponseSize) {
+                return this._onResponseTooLarge();
             }
         }
-
+        if (this._remainder.length > maxResponseSize) {
+            return this._onResponseTooLarge();
+        }
+        if (this._responsePartial) {
+            return;
+        }
         this._processResponse();
     }
-
+    /**
+     * Drops a connection whose peer keeps extending a reply it never completes, releasing
+     * whatever was buffered for that reply
+     * @internal
+     */
+    _onResponseTooLarge() {
+        this._remainder = '';
+        this._responseQueue = [];
+        this._responsePartial = false;
+        this._onError(new Error('Server response exceeds maximum allowed size'), 'EPROTOCOL', false, 'CONN');
+    }
     /**
      * 'error' listener for the socket
      *
      * @event
-     * @param {Error} err Error object
-     * @param {String} type Error name
+     * @param err Error object
+     * @param type Error name
+     * @param data Server response that triggered the error, false if there is none
+     * @param command SMTP command that was in flight
+     * @internal
      */
     _onError(err, type, data, command) {
         clearTimeout(this._connectionTimeout);
         clearTimeout(this._greetingTimeout);
-
         if (this._destroyed) {
             // just ignore, already closed
             // this might happen when a socket is canceled because of reached timeout
             // but the socket timeout error itself receives only after
             return;
         }
-
         err = this._formatError(err, type, data, command);
-
         const transientCodes = ['ETIMEDOUT', 'ESOCKET', 'ECONNECTION'];
         if (transientCodes.includes(err.code)) {
             this.logger.warn(data, err.message);
-        } else {
+        }
+        else {
             this.logger.error(data, err.message);
         }
-
+        // close() forgets the send in flight, it is completed with this same error afterwards so
+        // a late message stream error has nothing left to report
+        const pendingSend = this._pendingSend;
         this.emit('error', err);
         this.close();
+        if (pendingSend) {
+            pendingSend.callback(err);
+        }
     }
-
+    /** @internal */
     _formatError(message, type, response, command) {
         let err;
-
         if (/Error\]$/i.test(Object.prototype.toString.call(message))) {
             err = message;
-        } else {
+        }
+        else {
             err = new Error(message);
         }
-
         if (type && type !== 'Error') {
             err.code = type;
         }
-
         if (response) {
             err.response = response;
             err.message += ': ' + response;
         }
-
         const responseCode = (typeof response === 'string' && Number((response.match(/^\d+/) || [])[0])) || false;
         if (responseCode) {
             err.responseCode = responseCode;
         }
-
         if (command) {
             err.command = command;
         }
-
         return err;
     }
-
     /**
      * 'close' listener for the socket
      *
      * @event
+     * @internal
      */
     _onClose() {
         let serverResponse = false;
-
         if (this._remainder && this._remainder.trim()) {
             this.lastServerResponse = serverResponse = decodeServerResponse(this._remainder.trim());
             if (this.options.debug || this.options.transactionLog) {
-                this.logger.debug(
-                    {
-                        tnx: 'server'
-                    },
-                    serverResponse
-                );
+                this.logger.debug({
+                    tnx: 'server'
+                }, serverResponse);
             }
         }
-
-        this.logger.info(
-            {
-                tnx: 'network'
-            },
-            'Connection closed'
-        );
-
+        this.logger.info({
+            tnx: 'network'
+        }, 'Connection closed');
+        // the unterminated remainder is only reported as a reply (and so gives the error a responseCode)
+        // when it starts like a complete failure reply, not for a fragment such as "55" or a 250
+        const failureResponse = typeof serverResponse === 'string' && /^[45]\d{2}[ -]/.test(serverResponse) ? serverResponse : false;
         if (this.upgrading && !this._destroyed) {
-            return this._onError(new Error('Connection closed unexpectedly'), 'ETLS', serverResponse, 'CONN');
-        } else if (![this._actionGreeting, this.close].includes(this._responseActions[0]) && !this._destroyed) {
-            return this._onError(new Error('Connection closed unexpectedly'), 'ECONNECTION', serverResponse, 'CONN');
-        } else if (/^[45]\d{2}\b/.test(serverResponse)) {
-            return this._onError(new Error('Connection closed unexpectedly'), 'ECONNECTION', serverResponse, 'CONN');
+            return this._onError(new Error('Connection closed unexpectedly'), 'ETLS', failureResponse, 'CONN');
+        }
+        if (!failureResponse && this._responseActions[0] === this._actionGreeting && this._connectCallback && !this._destroyed) {
+            // A silent close before the greeting is handed to the connect() callback rather than
+            // emitted as 'error', callers that never saw an error for it must not start throwing one
+            const connectCallback = this._connectCallback;
+            this._connectCallback = false;
+            const err = this._formatError(new Error('Connection closed unexpectedly'), 'ECONNECTION', false, 'CONN');
+            this.logger.warn({ tnx: 'network' }, err.message);
+            connectCallback(err);
+            this.close();
+            return;
+        }
+        if (failureResponse || (this._responseActions[0] !== this.close && !this._destroyed)) {
+            return this._onError(new Error('Connection closed unexpectedly'), 'ECONNECTION', failureResponse, 'CONN');
         }
-
         this._destroy();
     }
-
     /**
      * 'end' listener for the socket
      *
      * @event
+     * @internal
      */
     _onEnd() {
         if (this._socket && !this._socket.destroyed) {
-            // Peer sent FIN — finish our half of the close gracefully rather
+            // Peer sent FIN, finish our half of the close gracefully rather
             // than destroying. 'close' fires after the OS finalizes teardown.
             this._socket.end();
         }
     }
-
     /**
      * 'timeout' listener for the socket
      *
      * @event
+     * @internal
      */
     _onTimeout() {
         return this._onError(new Error('Timeout'), 'ETIMEDOUT', false, 'CONN');
     }
-
     /**
      * Destroys the client, emits 'end'
+     * @internal
      */
     _destroy() {
         if (this._destroyed) {
@@ -1029,14 +918,20 @@ class SMTPConnection extends EventEmitter {
         this._destroyed = true;
         // keep the documented public flag in sync with the private state
         this.destroyed = true;
+        // a connection the server dropped before the greeting would otherwise keep
+        // the greeting timer, and with it the process, alive until it fires
+        clearTimeout(this._connectionTimeout);
+        clearTimeout(this._greetingTimeout);
+        this._connectionTimeout = false;
+        this._greetingTimeout = false;
         this.emit('end');
     }
-
     /**
      * Upgrades the connection to TLS
      *
-     * @param {Function} callback Callback function to run when the connection
+     * @param callback Callback function to run when the connection
      *        has been secured
+     * @internal
      */
     _upgradeConnection(callback) {
         // RFC 3207 section 6: the client MUST discard any knowledge obtained from
@@ -1047,28 +942,21 @@ class SMTPConnection extends EventEmitter {
         // part of the secured EHLO capabilities). STARTTLS response injection.
         this._remainder = '';
         this._responseQueue = [];
-
+        this._responsePartial = false;
         // do not remove all listeners or it breaks node v0.10 as there's
         // apparently a 'finish' event set that would be cleared as well
-
         // we can safely keep 'error', 'end', 'close' etc. events
-        this._socket.removeListener('data', this._onSocketData); // incoming data is going to be gibberish from this point onwards
-        this._socket.removeListener('timeout', this._onSocketTimeout); // timeout will be re-set for the new socket object
-
         const socketPlain = this._socket;
-        const opts = Object.assign(
-            {
-                socket: this._socket,
-                host: this.host
-            },
-            this.options.tls || {}
-        );
-
+        socketPlain.removeListener('data', this._onSocketData); // incoming data is going to be gibberish from this point onwards
+        socketPlain.removeListener('timeout', this._onSocketTimeout); // timeout will be re-set for the new socket object
+        const opts = Object.assign({
+            socket: socketPlain,
+            host: this.host
+        }, this.options.tls || {});
         // ensure servername for SNI
         if (this.servername && !opts.servername) {
             opts.servername = this.servername;
         }
-
         // Remove all listeners from the plain socket to allow proper garbage
         // collection. Used on both the TLS-success path and the synchronous
         // tls.connect() throw path; either way the plain socket is done.
@@ -1080,7 +968,6 @@ class SMTPConnection extends EventEmitter {
             // options.connection socket; strip it so nothing lingers on the plain socket
             socketPlain.removeListener('error', this._onConnectionSocketError);
         };
-
         this.upgrading = true;
         // tls.connect is not an asynchronous function however it may still throw errors and requires to be wrapped with try/catch
         try {
@@ -1088,200 +975,170 @@ class SMTPConnection extends EventEmitter {
                 this.secure = true;
                 this.upgrading = false;
                 this._socket.on('data', this._onSocketData);
-
                 removePlainSocketListeners();
-
                 return callback(null, true);
             });
-        } catch (err) {
+        }
+        catch (err) {
             removePlainSocketListeners();
             return callback(err);
         }
-
         this._socket.on('error', this._onSocketError);
         this._socket.once('close', this._onSocketClose);
         this._socket.once('end', this._onSocketEnd);
-
         this._socket.setTimeout(this.options.socketTimeout || SOCKET_TIMEOUT); // 10 min.
         this._socket.on('timeout', this._onSocketTimeout);
-
         // resume in case the socket was paused
         socketPlain.resume();
     }
-
     /**
      * Processes queued responses from the server
+     * @internal
      */
     _processResponse() {
         if (!this._responseQueue.length) {
             return false;
         }
-
         const raw = (this._responseQueue.shift() || '').toString();
-
         // Skip unexpected empty lines without consuming a response action or
         // overwriting lastServerResponse; reprocess whatever else is queued.
         if (!raw.trim()) {
             setImmediate(() => this._processResponse());
             return;
         }
-
-        let str = (this.lastServerResponse = decodeServerResponse(raw));
-
-        if (/^\d+-/.test(str.split('\n').pop())) {
-            // last line is still a continuation: put the partial response back on the
-            // queue and wait for the rest rather than dropping it
+        if (isPartialResponse(raw)) {
+            // the rest of the reply is still on its way: put it back on the queue and wait
+            // rather than dropping it. It has not been received in full, so it must not be
+            // reported as the last server response either
             this._responseQueue.unshift(raw);
             return;
         }
-
+        const str = (this.lastServerResponse = decodeServerResponse(raw));
         if (this.options.debug || this.options.transactionLog) {
-            this.logger.debug(
-                {
-                    tnx: 'server'
-                },
-                str.replace(/\r?\n$/, '')
-            );
+            this.logger.debug({
+                tnx: 'server'
+            }, str.replace(/\r?\n$/, ''));
         }
-
         const action = this._responseActions.shift();
-
         if (typeof action === 'function') {
             action.call(this, str);
             setImmediate(() => this._processResponse());
-        } else {
+        }
+        else {
             return this._onError(new Error('Unexpected Response'), 'EPROTOCOL', str, 'CONN');
         }
     }
-
     /**
      * Send a command to the server, append \r\n
      *
-     * @param {String} str String to be sent to the server
-     * @param {String} logStr Optional string to be used for logging instead of the actual string
+     * @param str String to be sent to the server
+     * @param logStr Optional string to be used for logging instead of the actual string
+     * @internal
      */
     _sendCommand(str, logStr) {
         if (this._destroyed) {
             // Connection already closed, can't send any more data
             return;
         }
-
-        if (this._socket.destroyed) {
+        const socket = this._socket;
+        if (socket.destroyed) {
             return this.close();
         }
-
         if (this.options.debug || this.options.transactionLog) {
-            this.logger.debug(
-                {
-                    tnx: 'client'
-                },
-                (logStr || str || '').toString().replace(/\r?\n$/, '')
-            );
-        }
-
-        this._socket.write(Buffer.from(str + '\r\n', 'utf-8'));
+            this.logger.debug({
+                tnx: 'client'
+            }, (logStr || str || '').toString().replace(/\r?\n$/, ''));
+        }
+        socket.write(Buffer.from(str + '\r\n', 'utf-8'));
     }
-
     /**
      * Initiates a new message by submitting envelope data, starting with
      * MAIL FROM: command
      *
-     * @param {Object} envelope Envelope object in the form of
+     * @param envelope Envelope object in the form of
      *        {from:'...', to:['...']}
      *        or
      *        {from:{address:'...',name:'...'}, to:[address:'...',name:'...']}
+     * @param callback Callback to run once the envelope is processed
+     * @internal
      */
     _setEnvelope(envelope, callback) {
         const args = [];
         let useSmtpUtf8 = false;
-
-        this._envelope = envelope || {};
-        this._envelope.from = ((this._envelope.from && this._envelope.from.address) || this._envelope.from || '').toString().trim();
-
-        this._envelope.to = [].concat(this._envelope.to || []).map(to => ((to && to.address) || to || '').toString().trim());
-
+        this._envelope = (envelope || {});
+        this._envelope.from = ((this._envelope.from && this._envelope.from.address) || this._envelope.from || '')
+            .toString()
+            .trim();
+        this._envelope.to = []
+            .concat(this._envelope.to || [])
+            .map(to => ((to && to.address) || to || '').toString().trim());
         if (!this._envelope.to.length) {
             return callback(this._formatError('No recipients defined', 'EENVELOPE', false, 'API'));
         }
-
         if (this._envelope.from && /[\r\n<>]/.test(this._envelope.from)) {
             return callback(this._formatError('Invalid sender ' + JSON.stringify(this._envelope.from), 'EENVELOPE', false, 'API'));
         }
-
         // check if the sender address uses only ASCII characters,
         // otherwise require usage of SMTPUTF8 extension
         if (/[\x80-\uFFFF]/.test(this._envelope.from)) {
             useSmtpUtf8 = true;
         }
-
         for (let i = 0, len = this._envelope.to.length; i < len; i++) {
             if (!this._envelope.to[i] || /[\r\n<>]/.test(this._envelope.to[i])) {
                 return callback(this._formatError('Invalid recipient ' + JSON.stringify(this._envelope.to[i]), 'EENVELOPE', false, 'API'));
             }
-
             // check if the recipients addresses use only ASCII characters,
             // otherwise require usage of SMTPUTF8 extension
             if (/[\x80-\uFFFF]/.test(this._envelope.to[i])) {
                 useSmtpUtf8 = true;
             }
         }
-
         // clone the recipients array for latter manipulation
         this._envelope.rcptQueue = [].concat(this._envelope.to || []);
         this._envelope.rejected = [];
         this._envelope.rejectedErrors = [];
         this._envelope.accepted = [];
-
         if (this._envelope.dsn) {
             try {
                 this._envelope.dsn = this._setDsnEnvelope(this._envelope.dsn);
-            } catch (err) {
+            }
+            catch (err) {
                 return callback(this._formatError('Invalid DSN ' + err.message, 'EENVELOPE', false, 'API'));
             }
         }
-
         // RFC 8689: validate REQUIRETLS eligibility before queuing the MAIL FROM
         // response action, so a rejection here cannot leave an orphaned action in
         // _responseActions (which would consume the next reply and desync a reused
         // connection).
         if (this._envelope.requireTLSExtensionEnabled) {
             if (!this.secure) {
-                return callback(
-                    this._formatError('REQUIRETLS can only be used over TLS connections (RFC 8689)', 'EREQUIRETLS', false, 'MAIL FROM')
-                );
+                return callback(this._formatError('REQUIRETLS can only be used over TLS connections (RFC 8689)', 'EREQUIRETLS', false, 'MAIL FROM'));
             }
             if (!this._supportedExtensions.includes('REQUIRETLS')) {
-                return callback(
-                    this._formatError('Server does not support REQUIRETLS extension (RFC 8689)', 'EREQUIRETLS', false, 'MAIL FROM')
-                );
+                return callback(this._formatError('Server does not support REQUIRETLS extension (RFC 8689)', 'EREQUIRETLS', false, 'MAIL FROM'));
             }
         }
-
         this._responseActions.push(str => {
             this._actionMAIL(str, callback);
         });
-
         // If the server supports SMTPUTF8 and the envelope includes an internationalized
         // email address then append SMTPUTF8 keyword to the MAIL FROM command
         if (useSmtpUtf8 && this._supportedExtensions.includes('SMTPUTF8')) {
             args.push('SMTPUTF8');
             this._usingSmtpUtf8 = true;
         }
-
         // If the server supports 8BITMIME and the message might contain non-ascii bytes
         // then append the 8BITMIME keyword to the MAIL FROM command
         if (this._envelope.use8BitMime && this._supportedExtensions.includes('8BITMIME')) {
             args.push('BODY=8BITMIME');
             this._using8BitMime = true;
         }
-
         if (this._envelope.size && this._supportedExtensions.includes('SIZE')) {
             const sizeValue = Number(this._envelope.size) || 0;
             if (sizeValue > 0) {
                 args.push('SIZE=' + sizeValue);
             }
         }
-
         // If the server supports DSN and the envelope includes an DSN prop
         // then append DSN params to the MAIL FROM command
         if (this._envelope.dsn && this._supportedExtensions.includes('DSN')) {
@@ -1292,17 +1149,15 @@ class SMTPConnection extends EventEmitter {
                 args.push('ENVID=' + shared.encodeXText(this._envelope.dsn.envid));
             }
         }
-
         // RFC 8689: append the REQUIRETLS keyword to MAIL FROM. Eligibility
         // (TLS connection + server support) was already validated above, before
         // the response action was queued.
         if (this._envelope.requireTLSExtensionEnabled) {
             args.push('REQUIRETLS');
         }
-
         this._sendCommand('MAIL FROM:<' + this._envelope.from + '>' + (args.length ? ' ' + args.join(' ') : ''));
     }
-
+    /** @internal */
     _setDsnEnvelope(params) {
         let ret = (params.ret || params.return || '').toString().toUpperCase() || null;
         if (ret) {
@@ -1317,13 +1172,10 @@ class SMTPConnection extends EventEmitter {
                     break;
             }
         }
-
         if (ret && !['FULL', 'HDRS'].includes(ret)) {
             throw new Error('ret: ' + JSON.stringify(ret));
         }
-
         const envid = (params.envid || params.id || '').toString() || null;
-
         let notify = params.notify || null;
         if (notify) {
             if (typeof notify === 'string') {
@@ -1337,12 +1189,10 @@ class SMTPConnection extends EventEmitter {
             }
             notify = notify.join(',');
         }
-
         let orcpt = (params.recipient || params.orcpt || '').toString() || null;
         if (orcpt && orcpt.indexOf(';') < 0) {
             orcpt = 'rfc822;' + orcpt;
         }
-
         return {
             ret,
             envid,
@@ -1350,292 +1200,252 @@ class SMTPConnection extends EventEmitter {
             orcpt
         };
     }
-
+    /** @internal */
     _getDsnRcptToArgs() {
+        const envelope = this._envelope;
         const args = [];
         // If the server supports DSN and the envelope includes an DSN prop
         // then append DSN params to the RCPT TO command
-        if (this._envelope.dsn && this._supportedExtensions.includes('DSN')) {
-            if (this._envelope.dsn.notify) {
-                args.push('NOTIFY=' + shared.encodeXText(this._envelope.dsn.notify));
+        if (envelope.dsn && this._supportedExtensions.includes('DSN')) {
+            if (envelope.dsn.notify) {
+                args.push('NOTIFY=' + shared.encodeXText(envelope.dsn.notify));
             }
-            if (this._envelope.dsn.orcpt) {
-                args.push('ORCPT=' + shared.encodeXText(this._envelope.dsn.orcpt));
+            if (envelope.dsn.orcpt) {
+                args.push('ORCPT=' + shared.encodeXText(envelope.dsn.orcpt));
             }
         }
         return args.length ? ' ' + args.join(' ') : '';
     }
-
+    /** @internal */
     _createSendStream(callback) {
+        const envelope = this._envelope;
         const dataStream = new DataStream();
-
         if (this.options.lmtp) {
-            this._envelope.accepted.forEach((recipient, i) => {
-                const final = i === this._envelope.accepted.length - 1;
+            envelope.accepted.forEach((recipient, i) => {
+                const final = i === envelope.accepted.length - 1;
                 this._responseActions.push(str => {
                     this._actionLMTPStream(recipient, final, str, callback);
                 });
             });
-        } else {
+        }
+        else {
             this._responseActions.push(str => {
                 this._actionSMTPStream(str, callback);
             });
         }
-
         this._currentDataStream = dataStream;
         dataStream.pipe(this._socket, {
             end: false
         });
-
         if (this.options.debug) {
             const logStream = new PassThrough();
             logStream.on('readable', () => {
                 let chunk;
                 while ((chunk = logStream.read())) {
-                    this.logger.debug(
-                        {
-                            tnx: 'message'
-                        },
-                        chunk.toString('binary').replace(/\r?\n$/, '')
-                    );
+                    this.logger.debug({
+                        tnx: 'message'
+                    }, chunk.toString('binary').replace(/\r?\n$/, ''));
                 }
             });
             dataStream.pipe(logStream);
         }
-
         dataStream.once('end', () => {
             if (this._currentDataStream === dataStream) {
                 this._currentDataStream = false;
             }
-            this.logger.info(
-                {
-                    tnx: 'message',
-                    inByteCount: dataStream.inByteCount,
-                    outByteCount: dataStream.outByteCount
-                },
-                '<%s bytes encoded mime message (source size %s bytes)>',
-                dataStream.outByteCount,
-                dataStream.inByteCount
-            );
+            this.logger.info({
+                tnx: 'message',
+                inByteCount: dataStream.inByteCount,
+                outByteCount: dataStream.outByteCount
+            }, '<%s bytes encoded mime message (source size %s bytes)>', dataStream.outByteCount, dataStream.inByteCount);
         });
-
         return dataStream;
     }
-
     /** ACTIONS **/
-
     /**
      * Will be run after the connection is created and the server sends
      * a greeting. If the incoming message starts with 220 initiate
      * SMTP session by sending EHLO command
      *
-     * @param {String} str Message from the server
+     * @param str Message from the server
+     * @internal
      */
     _actionGreeting(str) {
         clearTimeout(this._greetingTimeout);
-
         if (str.substr(0, 3) !== '220') {
             this._onError(new Error('Invalid greeting. response=' + str), 'EPROTOCOL', str, 'CONN');
             return;
         }
-
         if (this.options.lmtp) {
             this._responseActions.push(this._actionLHLO);
             this._sendCommand('LHLO ' + this.name);
-        } else {
+        }
+        else {
             this._responseActions.push(this._actionEHLO);
             this._sendCommand('EHLO ' + this.name);
         }
     }
-
     /**
      * Handles server response for LHLO command. If it yielded in
      * error, emit 'error', otherwise treat this as an EHLO response
      *
-     * @param {String} str Message from the server
+     * @param str Message from the server
+     * @internal
      */
     _actionLHLO(str) {
         if (str.charAt(0) !== '2') {
             this._onError(new Error('Invalid LHLO. response=' + str), 'EPROTOCOL', str, 'LHLO');
             return;
         }
-
         this._actionEHLO(str);
     }
-
     /**
      * Handles server response for EHLO command. If it yielded in
      * error, try HELO instead, otherwise initiate TLS negotiation
      * if STARTTLS is supported by the server or move into the
      * authentication phase.
      *
-     * @param {String} str Message from the server
+     * @param str Message from the server
+     * @internal
      */
     _actionEHLO(str) {
         let match;
-
         if (str.substr(0, 3) === '421') {
             this._onError(new Error('Server terminates connection. response=' + str), 'ECONNECTION', str, 'EHLO');
             return;
         }
-
         if (str.charAt(0) !== '2') {
             if (this.options.requireTLS) {
-                this._onError(
-                    new Error('EHLO failed but HELO does not support required STARTTLS. response=' + str),
-                    'ECONNECTION',
-                    str,
-                    'EHLO'
-                );
+                this._onError(new Error('EHLO failed but HELO does not support required STARTTLS. response=' + str), 'ECONNECTION', str, 'EHLO');
                 return;
             }
-
             // Try HELO instead
             this._responseActions.push(this._actionHELO);
             this._sendCommand('HELO ' + this.name);
             return;
         }
-
         this._ehloLines = str
             .split(/\r?\n/)
             .map(line => line.replace(/^\d+[ -]/, '').trim())
             .filter(line => line)
             .slice(1);
-
         // Detect if the server supports STARTTLS
         if (!this.secure && !this.options.ignoreTLS && (/[ -]STARTTLS\b/im.test(str) || this.options.requireTLS)) {
             this._sendCommand('STARTTLS');
             this._responseActions.push(this._actionSTARTTLS);
             return;
         }
-
         // Detect if the server supports SMTPUTF8
         if (/[ -]SMTPUTF8\b/im.test(str)) {
             this._supportedExtensions.push('SMTPUTF8');
         }
-
         // Detect if the server supports DSN
         if (/[ -]DSN\b/im.test(str)) {
             this._supportedExtensions.push('DSN');
         }
-
         // Detect if the server supports 8BITMIME
         if (/[ -]8BITMIME\b/im.test(str)) {
             this._supportedExtensions.push('8BITMIME');
         }
-
         // Detect if the server supports REQUIRETLS (RFC 8689)
         if (/[ -]REQUIRETLS\b/im.test(str)) {
             this._supportedExtensions.push('REQUIRETLS');
         }
-
         // Detect if the server supports PIPELINING
         if (/[ -]PIPELINING\b/im.test(str)) {
             this._supportedExtensions.push('PIPELINING');
         }
-
         // Detect if the server supports AUTH
         if (/[ -]AUTH\b/i.test(str)) {
             this.allowsAuth = true;
         }
-
-        // Detect if the server supports PLAIN auth
-        if (/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)PLAIN/i.test(str)) {
-            this._supportedAuth.push('PLAIN');
-        }
-
-        // Detect if the server supports LOGIN auth
-        if (/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)LOGIN/i.test(str)) {
-            this._supportedAuth.push('LOGIN');
-        }
-
-        // Detect if the server supports CRAM-MD5 auth
-        if (/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)CRAM-MD5/i.test(str)) {
-            this._supportedAuth.push('CRAM-MD5');
+        // Detect the advertised SASL mechanisms. The list is split into whole tokens rather
+        // than searched for each name with a pattern: the patterns this replaced let two
+        // whitespace runs overlap and backtracked quadratically over an AUTH line padded with
+        // spaces, so a hostile server could stall the event loop from its EHLO reply
+        // (GHSA-4ffr-jq9g-5ffx).
+        const authMechanisms = new Set();
+        for (const line of this._ehloLines) {
+            const authMatch = /^AUTH[\s=](.*)/i.exec(line);
+            if (authMatch) {
+                for (const mechanism of authMatch[1].split(/[\s=]+/)) {
+                    authMechanisms.add(mechanism.toUpperCase());
+                }
+            }
         }
-
-        // Detect if the server supports XOAUTH2 auth
-        if (/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)XOAUTH2/i.test(str)) {
-            this._supportedAuth.push('XOAUTH2');
+        // listed in order of preference, the first one the credentials allow is used
+        for (const mechanism of ['PLAIN', 'LOGIN', 'CRAM-MD5', 'XOAUTH2']) {
+            if (authMechanisms.has(mechanism)) {
+                this._supportedAuth.push(mechanism);
+            }
         }
-
         // Detect if the server supports SIZE extensions (and the max allowed size)
         if ((match = str.match(/[ -]SIZE(?:[ \t]+(\d+))?/im))) {
             this._supportedExtensions.push('SIZE');
             this._maxAllowedSize = Number(match[1]) || 0;
         }
-
         this.emit('connect');
     }
-
     /**
      * Handles server response for HELO command. If it yielded in
      * error, emit 'error', otherwise move into the authentication phase.
      *
-     * @param {String} str Message from the server
+     * @param str Message from the server
+     * @internal
      */
     _actionHELO(str) {
         if (str.charAt(0) !== '2') {
             this._onError(new Error('Invalid HELO. response=' + str), 'EPROTOCOL', str, 'HELO');
             return;
         }
-
         // assume that authentication is enabled (most probably is not though)
         this.allowsAuth = true;
-
         this.emit('connect');
     }
-
     /**
      * Handles server response for STARTTLS command. If there's an error
      * try HELO instead, otherwise initiate TLS upgrade. If the upgrade
      * succeedes restart the EHLO
      *
-     * @param {String} str Message from the server
+     * @param str Message from the server
+     * @internal
      */
     _actionSTARTTLS(str) {
         if (str.charAt(0) !== '2') {
             if (this.options.opportunisticTLS) {
-                this.logger.info(
-                    {
-                        tnx: 'smtp'
-                    },
-                    'Failed STARTTLS upgrade, continuing unencrypted'
-                );
-                return this.emit('connect');
+                this.logger.info({
+                    tnx: 'smtp'
+                }, 'Failed STARTTLS upgrade, continuing unencrypted');
+                this.emit('connect');
+                return;
             }
             this._onError(new Error('Error upgrading connection with STARTTLS'), 'ETLS', str, 'STARTTLS');
             return;
         }
-
         this._upgradeConnection((err, secured) => {
             if (err) {
                 this._onError(new Error('Error initiating TLS - ' + (err.message || err)), 'ETLS', false, 'STARTTLS');
                 return;
             }
-
-            this.logger.info(
-                {
-                    tnx: 'smtp'
-                },
-                'Connection upgraded with STARTTLS'
-            );
-
+            this.logger.info({
+                tnx: 'smtp'
+            }, 'Connection upgraded with STARTTLS');
             if (secured) {
                 // restart session
                 if (this.options.lmtp) {
                     this._responseActions.push(this._actionLHLO);
                     this._sendCommand('LHLO ' + this.name);
-                } else {
+                }
+                else {
                     this._responseActions.push(this._actionEHLO);
                     this._sendCommand('EHLO ' + this.name);
                 }
-            } else {
+            }
+            else {
                 this.emit('connect');
             }
         });
     }
-
     /**
      * Handle the response for AUTH LOGIN command. We are expecting
      * '334 VXNlcm5hbWU6' (base64 for 'Username:'). Data to be sent as
@@ -1643,7 +1453,9 @@ class SMTPConnection extends EventEmitter {
      * exact match but settle with 334 response in general as some
      * hosts invalidly use a longer message than VXNlcm5hbWU6
      *
-     * @param {String} str Message from the server
+     * @param str Message from the server
+     * @param callback Callback to run once the authentication sequence completes
+     * @internal
      */
     _actionAUTH_LOGIN_USER(str, callback) {
         if (!/^334[ -]/.test(str)) {
@@ -1651,14 +1463,11 @@ class SMTPConnection extends EventEmitter {
             callback(this._formatError('Invalid login sequence while waiting for "334 VXNlcm5hbWU6"', 'EAUTH', str, 'AUTH LOGIN'));
             return;
         }
-
         this._responseActions.push(str => {
             this._actionAUTH_LOGIN_PASS(str, callback);
         });
-
         this._sendCommand(Buffer.from(this._auth.credentials.user + '', 'utf-8').toString('base64'));
     }
-
     /**
      * Handle the response for AUTH CRAM-MD5 command. We are expecting
      * '334 <challenge string>'. Data to be sent as response needs to be
@@ -1666,102 +1475,89 @@ class SMTPConnection extends EventEmitter {
      * a HMAC key, prefixed by the username and a space, and finally all
      * base64 encoded again.
      *
-     * @param {String} str Message from the server
+     * @param str Message from the server
+     * @param callback Callback to run once the authentication sequence completes
+     * @internal
      */
     _actionAUTH_CRAM_MD5(str, callback) {
         const challengeMatch = str.match(/^334\s+(.+)$/);
-
         if (!challengeMatch) {
-            return callback(
-                this._formatError('Invalid login sequence while waiting for server challenge string', 'EAUTH', str, 'AUTH CRAM-MD5')
-            );
+            return callback(this._formatError('Invalid login sequence while waiting for server challenge string', 'EAUTH', str, 'AUTH CRAM-MD5'));
         }
-
         // Decode from base64
         const base64decoded = Buffer.from(challengeMatch[1], 'base64').toString('ascii');
         const hmacMD5 = crypto.createHmac('md5', this._auth.credentials.pass);
-
         hmacMD5.update(base64decoded);
-
         const prepended = this._auth.credentials.user + ' ' + hmacMD5.digest('hex');
-
         this._responseActions.push(str => {
             this._actionAUTH_CRAM_MD5_PASS(str, callback);
         });
-
-        this._sendCommand(
-            Buffer.from(prepended).toString('base64'),
-            // hidden hash for logs
-            Buffer.from(this._auth.credentials.user + ' /* secret */').toString('base64')
-        );
+        this._sendCommand(Buffer.from(prepended).toString('base64'), 
+        // hidden hash for logs
+        Buffer.from(this._auth.credentials.user + ' /* secret */').toString('base64'));
     }
-
     /**
      * Handles the response to CRAM-MD5 authentication, if there's no error,
      * the user can be considered logged in. Start waiting for a message to send
      *
-     * @param {String} str Message from the server
+     * @param str Message from the server
+     * @param callback Callback to run once the authentication sequence completes
+     * @internal
      */
     _actionAUTH_CRAM_MD5_PASS(str, callback) {
         if (!str.match(/^235\s+/)) {
             return callback(this._formatError('Invalid login sequence while waiting for "235"', 'EAUTH', str, 'AUTH CRAM-MD5'));
         }
-
-        this.logger.info(
-            {
-                tnx: 'smtp',
-                username: this._auth.user,
-                action: 'authenticated',
-                method: this._authMethod
-            },
-            'User %s authenticated',
-            JSON.stringify(this._auth.user)
-        );
+        this.logger.info({
+            tnx: 'smtp',
+            username: this._auth.user,
+            action: 'authenticated',
+            method: this._authMethod
+        }, 'User %s authenticated', JSON.stringify(this._auth.user));
         this.authenticated = true;
         callback(null, true);
     }
-
     /**
      * Handle the response for AUTH LOGIN command. We are expecting
      * '334 UGFzc3dvcmQ6' (base64 for 'Password:'). Data to be sent as
      * response needs to be base64 encoded password.
      *
-     * @param {String} str Message from the server
+     * @param str Message from the server
+     * @param callback Callback to run once the authentication sequence completes
+     * @internal
      */
     _actionAUTH_LOGIN_PASS(str, callback) {
         if (!/^334[ -]/.test(str)) {
             // expecting '334 UGFzc3dvcmQ6'
             return callback(this._formatError('Invalid login sequence while waiting for "334 UGFzc3dvcmQ6"', 'EAUTH', str, 'AUTH LOGIN'));
         }
-
         this._responseActions.push(str => {
             this._actionAUTHComplete(str, callback);
         });
-
-        this._sendCommand(
-            Buffer.from((this._auth.credentials.pass || '').toString(), 'utf-8').toString('base64'),
-            // Hidden pass for logs
-            Buffer.from('/* secret */', 'utf-8').toString('base64')
-        );
+        this._sendCommand(Buffer.from((this._auth.credentials.pass || '').toString(), 'utf-8').toString('base64'), 
+        // Hidden pass for logs
+        Buffer.from('/* secret */', 'utf-8').toString('base64'));
     }
-
     /**
      * Handles the response for authentication, if there's no error,
      * the user can be considered logged in. Start waiting for a message to send
      *
-     * @param {String} str Message from the server
+     * @param str Message from the server
+     * @param isRetry True if this is a retry after a failed login, or the callback itself
+     * @param [callback] Callback to run once the authentication sequence completes
+     * @internal
      */
     _actionAUTHComplete(str, isRetry, callback) {
         if (!callback && typeof isRetry === 'function') {
             callback = isRetry;
             isRetry = false;
         }
-
         if (str.substr(0, 3) === '334') {
             this._responseActions.push(str => {
                 if (isRetry || this._authMethod !== 'XOAUTH2') {
                     this._actionAUTHComplete(str, true, callback);
-                } else {
+                }
+                else {
                     // fetch a new OAuth2 access token
                     setImmediate(() => this._handleXOauth2Token(true, callback));
                 }
@@ -1769,103 +1565,98 @@ class SMTPConnection extends EventEmitter {
             this._sendCommand('');
             return;
         }
-
         if (str.charAt(0) !== '2') {
-            this.logger.info(
-                {
-                    tnx: 'smtp',
-                    username: this._auth.user,
-                    action: 'authfail',
-                    method: this._authMethod
-                },
-                'User %s failed to authenticate',
-                JSON.stringify(this._auth.user)
-            );
-            return callback(this._formatError('Invalid login', 'EAUTH', str, 'AUTH ' + this._authMethod));
-        }
-
-        this.logger.info(
-            {
+            this.logger.info({
                 tnx: 'smtp',
                 username: this._auth.user,
-                action: 'authenticated',
+                action: 'authfail',
                 method: this._authMethod
-            },
-            'User %s authenticated',
-            JSON.stringify(this._auth.user)
-        );
+            }, 'User %s failed to authenticate', JSON.stringify(this._auth.user));
+            return callback(this._formatError('Invalid login', 'EAUTH', str, 'AUTH ' + this._authMethod));
+        }
+        this.logger.info({
+            tnx: 'smtp',
+            username: this._auth.user,
+            action: 'authenticated',
+            method: this._authMethod
+        }, 'User %s authenticated', JSON.stringify(this._auth.user));
         this.authenticated = true;
         callback(null, true);
     }
-
     /**
      * Handle response for a MAIL FROM: command
      *
-     * @param {String} str Message from the server
+     * @param str Message from the server
+     * @param callback Callback to run once the envelope is processed
+     * @internal
      */
     _actionMAIL(str, callback) {
+        const envelope = this._envelope;
         if (Number(str.charAt(0)) !== 2) {
-            const message =
-                this._usingSmtpUtf8 && /^550 /.test(str) && /[\x80-\uFFFF]/.test(this._envelope.from)
-                    ? 'Internationalized mailbox name not allowed'
-                    : 'Mail command failed';
+            const message = this._usingSmtpUtf8 && /^550 /.test(str) && /[\x80-\uFFFF]/.test(envelope.from)
+                ? 'Internationalized mailbox name not allowed'
+                : 'Mail command failed';
             return callback(this._formatError(message, 'EENVELOPE', str, 'MAIL FROM'));
         }
-
-        if (!this._envelope.rcptQueue.length) {
+        if (!envelope.rcptQueue.length) {
             return callback(this._formatError("Can't send mail - no recipients defined", 'EENVELOPE', false, 'API'));
         }
-
         this._recipientQueue = [];
         const usePipelining = this._supportedExtensions.includes('PIPELINING');
-
         do {
-            const curRecipient = this._envelope.rcptQueue.shift();
+            const curRecipient = envelope.rcptQueue.shift();
             this._recipientQueue.push(curRecipient);
             this._responseActions.push(str => {
                 this._actionRCPT(str, callback);
             });
             this._sendCommand('RCPT TO:<' + curRecipient + '>' + this._getDsnRcptToArgs());
-        } while (usePipelining && this._envelope.rcptQueue.length);
+        } while (usePipelining && envelope.rcptQueue.length);
     }
-
     /**
      * Handle response for a RCPT TO: command
      *
-     * @param {String} str Message from the server
+     * @param str Message from the server
+     * @param callback Callback to run once the envelope is processed
+     * @internal
      */
     _actionRCPT(str, callback) {
+        const envelope = this._envelope;
         let err;
         const curRecipient = this._recipientQueue.shift();
         if (Number(str.charAt(0)) !== 2) {
             // this is a soft error
-            const message =
-                this._usingSmtpUtf8 && /^553 /.test(str) && /[\x80-\uFFFF]/.test(curRecipient)
-                    ? 'Internationalized mailbox name not allowed'
-                    : 'Recipient command failed';
-            this._envelope.rejected.push(curRecipient);
+            const message = this._usingSmtpUtf8 && /^553 /.test(str) && /[\x80-\uFFFF]/.test(curRecipient)
+                ? 'Internationalized mailbox name not allowed'
+                : 'Recipient command failed';
+            envelope.rejected.push(curRecipient);
             // store error for the failed recipient
             err = this._formatError(message, 'EENVELOPE', str, 'RCPT TO');
             err.recipient = curRecipient;
-            this._envelope.rejectedErrors.push(err);
-        } else {
-            this._envelope.accepted.push(curRecipient);
+            envelope.rejectedErrors.push(err);
+        }
+        else {
+            envelope.accepted.push(curRecipient);
         }
-
-        if (!this._envelope.rcptQueue.length && !this._recipientQueue.length) {
-            if (this._envelope.rejected.length < this._envelope.to.length) {
+        if (!envelope.rcptQueue.length && !this._recipientQueue.length) {
+            if (envelope.rejected.length < envelope.to.length) {
                 this._responseActions.push(str => {
                     this._actionDATA(str, callback);
                 });
                 this._sendCommand('DATA');
-            } else {
-                err = this._formatError("Can't send mail - all recipients were rejected", 'EENVELOPE', str, 'RCPT TO');
-                err.rejected = this._envelope.rejected;
-                err.rejectedErrors = this._envelope.rejectedErrors;
+            }
+            else {
+                // report a temporary rejection when there is one, taking the last reply would mark the
+                // whole message as permanently failed although some recipients were only deferred
+                const deferred = envelope.rejectedErrors.find(rejectedErr => rejectedErr.responseCode && rejectedErr.responseCode < 500);
+                const reply = deferred?.response ?? str;
+                err = this._formatError("Can't send mail - all recipients were rejected", 'EENVELOPE', reply, 'RCPT TO');
+                err.rejected = envelope.rejected;
+                err.rejectedErrors = envelope.rejectedErrors;
                 return callback(err);
             }
-        } else if (this._envelope.rcptQueue.length) {
-            const nextRecipient = this._envelope.rcptQueue.shift();
+        }
+        else if (envelope.rcptQueue.length) {
+            const nextRecipient = envelope.rcptQueue.shift();
             this._recipientQueue.push(nextRecipient);
             this._responseActions.push(str => {
                 this._actionRCPT(str, callback);
@@ -1873,40 +1664,39 @@ class SMTPConnection extends EventEmitter {
             this._sendCommand('RCPT TO:<' + nextRecipient + '>' + this._getDsnRcptToArgs());
         }
     }
-
     /**
      * Handle response for a DATA command
      *
-     * @param {String} str Message from the server
+     * @param str Message from the server
+     * @param callback Callback to run once the envelope is processed
+     * @internal
      */
     _actionDATA(str, callback) {
+        const envelope = this._envelope;
         // response should be 354 but according to this issue https://github.com/eleith/emailjs/issues/24
         // some servers might use 250 instead, so lets check for 2 or 3 as the first digit
         if (!/^[23]/.test(str)) {
             return callback(this._formatError('Data command failed', 'EENVELOPE', str, 'DATA'));
         }
-
         const response = {
-            accepted: this._envelope.accepted,
-            rejected: this._envelope.rejected
+            accepted: envelope.accepted,
+            rejected: envelope.rejected
         };
-
         if (this._ehloLines && this._ehloLines.length) {
             response.ehlo = this._ehloLines;
         }
-
-        if (this._envelope.rejectedErrors.length) {
-            response.rejectedErrors = this._envelope.rejectedErrors;
+        if (envelope.rejectedErrors.length) {
+            response.rejectedErrors = envelope.rejectedErrors;
         }
-
         callback(null, response);
     }
-
     /**
      * Handle response for a DATA stream when using SMTP
      * We expect a single response that defines if the sending succeeded or failed
      *
-     * @param {String} str Message from the server
+     * @param str Message from the server
+     * @param callback Callback to run with the final send result
+     * @internal
      */
     _actionSMTPStream(str, callback) {
         if (Number(str.charAt(0)) !== 2) {
@@ -1914,27 +1704,29 @@ class SMTPConnection extends EventEmitter {
         }
         return callback(null, str);
     }
-
     /**
      * Handle response for a DATA stream
      * We expect a separate response for every recipient. All recipients can either
      * succeed or fail separately
      *
-     * @param {String} recipient The recipient this response applies to
-     * @param {Boolean} final Is this the final recipient?
-     * @param {String} str Message from the server
+     * @param recipient The recipient this response applies to
+     * @param final Is this the final recipient?
+     * @param str Message from the server
+     * @param callback Callback to run with the final send result
+     * @internal
      */
     _actionLMTPStream(recipient, final, str, callback) {
+        const envelope = this._envelope;
         let err;
         if (Number(str.charAt(0)) !== 2) {
             // Message failed
             err = this._formatError('Message failed for recipient ' + recipient, 'EMESSAGE', str, 'DATA');
             err.recipient = recipient;
-            this._envelope.rejected.push(recipient);
-            this._envelope.rejectedErrors.push(err);
-            for (let i = 0, len = this._envelope.accepted.length; i < len; i++) {
-                if (this._envelope.accepted[i] === recipient) {
-                    this._envelope.accepted.splice(i, 1);
+            envelope.rejected.push(recipient);
+            envelope.rejectedErrors.push(err);
+            for (let i = 0, len = envelope.accepted.length; i < len; i++) {
+                if (envelope.accepted[i] === recipient) {
+                    envelope.accepted.splice(i, 1);
                 }
             }
         }
@@ -1942,76 +1734,64 @@ class SMTPConnection extends EventEmitter {
             return callback(null, str);
         }
     }
-
+    /** @internal */
     _handleXOauth2Token(isRetry, callback) {
         this._auth.oauth2.getToken(isRetry, (err, accessToken) => {
             if (err) {
-                this.logger.info(
-                    {
-                        tnx: 'smtp',
-                        username: this._auth.user,
-                        action: 'authfail',
-                        method: this._authMethod
-                    },
-                    'User %s failed to authenticate',
-                    JSON.stringify(this._auth.user)
-                );
+                this.logger.info({
+                    tnx: 'smtp',
+                    username: this._auth.user,
+                    action: 'authfail',
+                    method: this._authMethod
+                }, 'User %s failed to authenticate', JSON.stringify(this._auth.user));
                 return callback(this._formatError(err, 'EAUTH', false, 'AUTH XOAUTH2'));
             }
             this._responseActions.push(str => {
                 this._actionAUTHComplete(str, isRetry, callback);
             });
-            this._sendCommand(
-                'AUTH XOAUTH2 ' + this._auth.oauth2.buildXOAuth2Token(accessToken),
-                //  Hidden for logs
-                'AUTH XOAUTH2 ' + this._auth.oauth2.buildXOAuth2Token('/* secret */')
-            );
+            this._sendCommand('AUTH XOAUTH2 ' + this._auth.oauth2.buildXOAuth2Token(accessToken), 
+            //  Hidden for logs
+            'AUTH XOAUTH2 ' + this._auth.oauth2.buildXOAuth2Token('/* secret */'));
         });
     }
-
     /**
      *
-     * @param {string} command
-     * @private
+     * @param command
+     * @internal
      */
     _isDestroyedMessage(command) {
         if (this._destroyed) {
             return 'Cannot ' + command + ' - smtp connection is already destroyed.';
         }
-
         if (this._socket) {
             if (this._socket.destroyed) {
                 return 'Cannot ' + command + ' - smtp connection socket is already destroyed.';
             }
-
             if (!this._socket.writable) {
                 return 'Cannot ' + command + ' - smtp connection socket is already half-closed.';
             }
         }
     }
-
+    /** @internal */
     _getHostname() {
         // defaul hostname is machine hostname or [IP]
         let defaultHostname;
         try {
             defaultHostname = os.hostname() || '';
-        } catch (_err) {
+        }
+        catch (_err) {
             // fails on windows 7
             defaultHostname = 'localhost';
         }
-
         // ignore if not FQDN
         if (!defaultHostname || defaultHostname.indexOf('.') < 0) {
             defaultHostname = '[127.0.0.1]';
         }
-
         // IP should be enclosed in []
         if (defaultHostname.match(/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/)) {
             defaultHostname = '[' + defaultHostname + ']';
         }
-
         return defaultHostname;
     }
 }
-
-module.exports = SMTPConnection;
+export default SMTPConnection;