@upyo/smtp 0.5.0-dev.128 → 0.5.0-dev.136

package/dist/index.cjs

@@ -154,7 +154,7 @@ function escapeSaslName(name) {
 */
 function selectOAuth2Mechanism(capabilities) {
 	const authLine = capabilities.find((cap) => cap.toUpperCase().startsWith("AUTH"));
-	const mechanisms = authLine == null ? [] : authLine.toUpperCase().split(/\s+/).slice(1);
+	const mechanisms = authLine == null ? [] : authLine.toUpperCase().replace(/=/g, " ").split(/\s+/).slice(1);
 	if (mechanisms.includes("XOAUTH2")) return "xoauth2";
 	if (mechanisms.includes("OAUTHBEARER")) return "oauthbearer";
 	return "xoauth2";
@@ -218,8 +218,9 @@ function truncateErrorBody(text) {
 function abortable(promise, signal) {
 	if (signal == null) return promise;
 	return new Promise((resolve, reject) => {
-		const onAbort = () => reject(signal.reason);
-		if (signal.aborted) reject(signal.reason);
+		const abortReason = () => signal.reason ?? new DOMException("The operation was aborted.", "AbortError");
+		const onAbort = () => reject(abortReason());
+		if (signal.aborted) reject(abortReason());
 		else signal.addEventListener("abort", onAbort, { once: true });
 		promise.then((value) => {
 			signal.removeEventListener("abort", onAbort);
@@ -276,11 +277,13 @@ var OAuth2TokenManager = class {
 		const auth = this.auth;
 		if ("accessToken" in auth) return typeof auth.accessToken === "function" ? await auth.accessToken(signal) : auth.accessToken;
 		const cached = this.cached;
-		if (cached != null && cached.expiresAt - REFRESH_SAFETY_MARGIN_MS > Date.now()) return cached.accessToken;
+		if (cached != null && cached.expiresAt > Date.now()) return cached.accessToken;
 		this.pending ??= this.refresh(auth).then((result) => {
+			const lifetimeMs = result.expiresIn * 1e3;
+			const safetyMargin = Math.min(REFRESH_SAFETY_MARGIN_MS, lifetimeMs / 2);
 			this.cached = {
 				accessToken: result.accessToken,
-				expiresAt: Date.now() + result.expiresIn * 1e3
+				expiresAt: Date.now() + lifetimeMs - safetyMargin
 			};
 			return result;
 		}).finally(() => {
@@ -314,8 +317,9 @@ var OAuth2TokenManager = class {
 		}, TOKEN_REQUEST_TIMEOUT_MS);
 		let response;
 		let text;
+		const fetchFn = this.fetchFn;
 		try {
-			response = await this.fetchFn(auth.tokenEndpoint, {
+			response = await fetchFn(auth.tokenEndpoint, {
 				method: "POST",
 				headers: {
 					"content-type": "application/x-www-form-urlencoded",
@@ -340,12 +344,12 @@ var OAuth2TokenManager = class {
 		}
 		if (typeof json !== "object" || json == null || typeof json.access_token !== "string") throw new SmtpAuthError(`OAuth 2.0 token endpoint response did not include an access_token: ${safeText}`);
 		const record = json;
-		let expiresIn = DEFAULT_EXPIRES_IN;
-		if (typeof record.expires_in === "number") expiresIn = record.expires_in;
-		else if (typeof record.expires_in === "string") {
-			const parsed = Number.parseInt(record.expires_in, 10);
-			if (Number.isFinite(parsed)) expiresIn = parsed;
-		}
+		const rawExpiresIn = record.expires_in;
+		let parsedExpiresIn;
+		if (typeof rawExpiresIn === "number") parsedExpiresIn = rawExpiresIn;
+		else if (typeof rawExpiresIn === "string" && rawExpiresIn.trim() !== "") parsedExpiresIn = Number(rawExpiresIn);
+		else parsedExpiresIn = NaN;
+		const expiresIn = Number.isFinite(parsedExpiresIn) && parsedExpiresIn >= 0 ? parsedExpiresIn : DEFAULT_EXPIRES_IN;
 		return {
 			accessToken: record.access_token,
 			expiresIn
@@ -363,6 +367,12 @@ const MAX_COMMAND_LINE_LENGTH = 512;
 /** The length of the CRLF terminator appended to every command. */
 const CRLF_LENGTH = 2;
 /**
+* How long, in milliseconds, to wait for the graceful `QUIT` to flush during
+* teardown before giving up, so an unresponsive server cannot block shutdown
+* for the full socket timeout.
+*/
+const QUIT_TIMEOUT_MS = 5e3;
+/**
 * Whether a host refers to the local loopback interface, for which cleartext
 * OAuth 2.0 authentication is permitted (e.g. local testing and development).
 *
@@ -679,9 +689,22 @@ var SmtpConnection = class {
 	async quit() {
 		const socket = this.socket;
 		if (!socket) return;
-		if (socket.writable) try {
-			await this.sendCommand("QUIT");
-		} catch {}
+		if (socket.writable) await new Promise((resolve) => {
+			const done = () => {
+				clearTimeout(timer);
+				socket.off("error", done);
+				socket.off("close", done);
+				resolve();
+			};
+			const timer = setTimeout(done, QUIT_TIMEOUT_MS);
+			socket.once("error", done);
+			socket.once("close", done);
+			try {
+				socket.write("QUIT\r\n", done);
+			} catch {
+				done();
+			}
+		});
 		try {
 			socket.destroy();
 		} catch {}
@@ -699,12 +722,17 @@ var SmtpConnection = class {
 * Decodes the Base64 JSON error challenge a server sends after a failed OAuth
 * SASL exchange, falling back to the raw message when it is not valid Base64.
 *
+* The bytes are decoded as UTF-8 (via `TextDecoder`) so non-ASCII challenge
+* messages are not corrupted, unlike decoding `atob`'s Latin-1 output directly.
+*
 * @param message The challenge text from the server's 334 response.
 * @returns A human-readable description of the failure.
 */
 function decodeOAuth2Challenge(message) {
 	try {
-		return atob(message.trim());
+		const binary = atob(message.trim());
+		const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+		return new TextDecoder().decode(bytes);
 	} catch {
 		return message;
 	}

package/dist/index.js

@@ -131,7 +131,7 @@ function escapeSaslName(name) {
 */
 function selectOAuth2Mechanism(capabilities) {
 	const authLine = capabilities.find((cap) => cap.toUpperCase().startsWith("AUTH"));
-	const mechanisms = authLine == null ? [] : authLine.toUpperCase().split(/\s+/).slice(1);
+	const mechanisms = authLine == null ? [] : authLine.toUpperCase().replace(/=/g, " ").split(/\s+/).slice(1);
 	if (mechanisms.includes("XOAUTH2")) return "xoauth2";
 	if (mechanisms.includes("OAUTHBEARER")) return "oauthbearer";
 	return "xoauth2";
@@ -195,8 +195,9 @@ function truncateErrorBody(text) {
 function abortable(promise, signal) {
 	if (signal == null) return promise;
 	return new Promise((resolve, reject) => {
-		const onAbort = () => reject(signal.reason);
-		if (signal.aborted) reject(signal.reason);
+		const abortReason = () => signal.reason ?? new DOMException("The operation was aborted.", "AbortError");
+		const onAbort = () => reject(abortReason());
+		if (signal.aborted) reject(abortReason());
 		else signal.addEventListener("abort", onAbort, { once: true });
 		promise.then((value) => {
 			signal.removeEventListener("abort", onAbort);
@@ -253,11 +254,13 @@ var OAuth2TokenManager = class {
 		const auth = this.auth;
 		if ("accessToken" in auth) return typeof auth.accessToken === "function" ? await auth.accessToken(signal) : auth.accessToken;
 		const cached = this.cached;
-		if (cached != null && cached.expiresAt - REFRESH_SAFETY_MARGIN_MS > Date.now()) return cached.accessToken;
+		if (cached != null && cached.expiresAt > Date.now()) return cached.accessToken;
 		this.pending ??= this.refresh(auth).then((result) => {
+			const lifetimeMs = result.expiresIn * 1e3;
+			const safetyMargin = Math.min(REFRESH_SAFETY_MARGIN_MS, lifetimeMs / 2);
 			this.cached = {
 				accessToken: result.accessToken,
-				expiresAt: Date.now() + result.expiresIn * 1e3
+				expiresAt: Date.now() + lifetimeMs - safetyMargin
 			};
 			return result;
 		}).finally(() => {
@@ -291,8 +294,9 @@ var OAuth2TokenManager = class {
 		}, TOKEN_REQUEST_TIMEOUT_MS);
 		let response;
 		let text;
+		const fetchFn = this.fetchFn;
 		try {
-			response = await this.fetchFn(auth.tokenEndpoint, {
+			response = await fetchFn(auth.tokenEndpoint, {
 				method: "POST",
 				headers: {
 					"content-type": "application/x-www-form-urlencoded",
@@ -317,12 +321,12 @@ var OAuth2TokenManager = class {
 		}
 		if (typeof json !== "object" || json == null || typeof json.access_token !== "string") throw new SmtpAuthError(`OAuth 2.0 token endpoint response did not include an access_token: ${safeText}`);
 		const record = json;
-		let expiresIn = DEFAULT_EXPIRES_IN;
-		if (typeof record.expires_in === "number") expiresIn = record.expires_in;
-		else if (typeof record.expires_in === "string") {
-			const parsed = Number.parseInt(record.expires_in, 10);
-			if (Number.isFinite(parsed)) expiresIn = parsed;
-		}
+		const rawExpiresIn = record.expires_in;
+		let parsedExpiresIn;
+		if (typeof rawExpiresIn === "number") parsedExpiresIn = rawExpiresIn;
+		else if (typeof rawExpiresIn === "string" && rawExpiresIn.trim() !== "") parsedExpiresIn = Number(rawExpiresIn);
+		else parsedExpiresIn = NaN;
+		const expiresIn = Number.isFinite(parsedExpiresIn) && parsedExpiresIn >= 0 ? parsedExpiresIn : DEFAULT_EXPIRES_IN;
 		return {
 			accessToken: record.access_token,
 			expiresIn
@@ -340,6 +344,12 @@ const MAX_COMMAND_LINE_LENGTH = 512;
 /** The length of the CRLF terminator appended to every command. */
 const CRLF_LENGTH = 2;
 /**
+* How long, in milliseconds, to wait for the graceful `QUIT` to flush during
+* teardown before giving up, so an unresponsive server cannot block shutdown
+* for the full socket timeout.
+*/
+const QUIT_TIMEOUT_MS = 5e3;
+/**
 * Whether a host refers to the local loopback interface, for which cleartext
 * OAuth 2.0 authentication is permitted (e.g. local testing and development).
 *
@@ -656,9 +666,22 @@ var SmtpConnection = class {
 	async quit() {
 		const socket = this.socket;
 		if (!socket) return;
-		if (socket.writable) try {
-			await this.sendCommand("QUIT");
-		} catch {}
+		if (socket.writable) await new Promise((resolve) => {
+			const done = () => {
+				clearTimeout(timer);
+				socket.off("error", done);
+				socket.off("close", done);
+				resolve();
+			};
+			const timer = setTimeout(done, QUIT_TIMEOUT_MS);
+			socket.once("error", done);
+			socket.once("close", done);
+			try {
+				socket.write("QUIT\r\n", done);
+			} catch {
+				done();
+			}
+		});
 		try {
 			socket.destroy();
 		} catch {}
@@ -676,12 +699,17 @@ var SmtpConnection = class {
 * Decodes the Base64 JSON error challenge a server sends after a failed OAuth
 * SASL exchange, falling back to the raw message when it is not valid Base64.
 *
+* The bytes are decoded as UTF-8 (via `TextDecoder`) so non-ASCII challenge
+* messages are not corrupted, unlike decoding `atob`'s Latin-1 output directly.
+*
 * @param message The challenge text from the server's 334 response.
 * @returns A human-readable description of the failure.
 */
 function decodeOAuth2Challenge(message) {
 	try {
-		return atob(message.trim());
+		const binary = atob(message.trim());
+		const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+		return new TextDecoder().decode(bytes);
 	} catch {
 		return message;
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@upyo/smtp",
-  "version": "0.5.0-dev.128",
+  "version": "0.5.0-dev.136",
   "description": "SMTP transport for Upyo email library",
   "keywords": [
     "email",
@@ -53,7 +53,7 @@
   },
   "sideEffects": false,
   "peerDependencies": {
-    "@upyo/core": "0.5.0-dev.128+6e126027"
+    "@upyo/core": "0.5.0-dev.136+adacf579"
   },
   "devDependencies": {
     "@dotenvx/dotenvx": "^1.47.3",