@limetech/lime-elements 40.17.0 → 40.18.0

package/dist/cjs/limel-file-viewer.cjs.entry.js

@@ -221,7 +221,8 @@ const codePagePattern = /^(?:cp|windows|ms|ibm)(\d+)$/;
 function normalizeCharset(charset) {
     return charset.replace(/^(?:x-ms-|x-|cs)/, '').replace(/[\s._-]+/g, '');
 }
-// Every label of the WHATWG Encoding Standard, https://encoding.spec.whatwg.org/encodings.json
+// Every label of the WHATWG Encoding Standard, https://encoding.spec.whatwg.org/encodings.json,
+// but for the UTF-16 family, which UTF16_LABELS resolves on its own.
 //
 // TextDecoder accepts these and nothing else, so a label outside the list is turned away
 // without constructing a decoder for it. Letting the constructor throw instead costs
@@ -308,36 +309,92 @@ const ENCODING_LABELS = new Set([
     'windows-949',
     // replacement
     'csiso2022kr hz-gb-2312 iso-2022-cn iso-2022-cn-ext iso-2022-kr replacement',
-    // UTF-16BE
-    'unicodefffe utf-16be',
-    // UTF-16LE
-    'csunicode iso-10646-ucs-2 ucs-2 unicode unicodefeff utf-16 utf-16le',
     // x-user-defined
     'x-user-defined'
 ]
     .join(' ')
     .split(' '));
-// Decoders by label, or null where the runtime refuses the label (the replacement
-// encoding, or an encoding a runtime was built without). Only labels from the list above
-// are stored, so the map can not grow past it however many labels a message makes up.
+// The labels the Encoding Standard maps to the replacement encoding: ISO-2022-KR,
+// ISO-2022-CN and HZ-GB-2312, whose escape and shift sequences let the same bytes read as
+// text to one decoder and as markup to another. A browser decodes a document in any of
+// them to a single U+FFFD for that reason, and TextDecoder refuses to be constructed for
+// them. They used to fall through to the UTF-8 or windows-1252 reading, which is the
+// markup reading: a body of `ESC$)C SO <img onerror=…> SI` under charset=iso-2022-kr is
+// Hangul to Python and a scanner built on it, and was an image tag here.
+const REPLACEMENT_LABELS = new Set([
+    'csiso2022kr',
+    'hz-gb-2312',
+    'iso-2022-cn',
+    'iso-2022-cn-ext',
+    'iso-2022-kr',
+    'replacement'
+]);
+// The decoder of the replacement encoding: U+FFFD once there is a byte to replace
+const replacementDecoder = {
+    encoding: 'replacement',
+    decode: input => (input && input.byteLength ? '�' : '')
+};
+// The UTF-16 labels honoured and the label of the standard each stands for: the spellings
+// that Python and iconv-lite both decode, and nothing else. Matched as written only, never
+// after normalization: `x-utf16` is known to neither.
+//
+// A label that one of the two reads and the other does not is the split this table
+// exists to close: under it a scanner built on the other reads the bytes as single byte
+// text, NUL interleaved and inert, where they decoded to markup here. So the standard's
+// `unicode`, `csunicode`, `iso-10646-ucs-2`, `unicodefeff` and `unicodefffe`, which
+// neither knows, are out, and so are `ucs-2`, `ucs2`, `utf16le` and `utf16be`, which
+// iconv-lite alone knows (and `ucs-2` as little endian whatever mark the bytes carry).
+// They all fall back like any unknown label.
+const UTF16_LABELS = new Map([
+    ['utf-16', 'utf-16'],
+    ['utf16', 'utf-16'],
+    ['utf_16', 'utf-16'],
+    ['utf-16le', 'utf-16le'],
+    ['utf-16be', 'utf-16be']
+]);
+/**
+ * The label of the Encoding Standard a charset resolves to, as written or through the
+ * alias tables, or null when it names no encoding the standard lists
+ */
+function resolveLabel(charset) {
+    charset = (charset || 'utf8').trim().toLowerCase();
+    // The label as written first, so the alias table only ever adds to what the standard
+    // lists instead of shadowing it
+    if (ENCODING_LABELS.has(charset)) {
+        return charset;
+    }
+    const utf16 = UTF16_LABELS.get(charset);
+    if (utf16) {
+        return utf16;
+    }
+    const normalized = normalizeCharset(charset);
+    const codePage = normalized.match(codePagePattern);
+    // The normalized label is itself the last candidate, which resolves everything that
+    // differed from a listed label only by a prefix or a separator, eg. x-big5.
+    const alias = (codePage && codePageAliases.get(codePage[1])) || charsetAliases.get(normalized) || normalized;
+    return ENCODING_LABELS.has(alias) ? alias : null;
+}
+// Decoders by label, or null where the runtime refuses the label (an encoding a runtime
+// was built without). Only labels from the list above are stored, so the map can not grow
+// past it however many labels a message makes up.
 //
 // Sharing a decoder is safe because nothing decodes with `stream: true`, so every
 // decode() call starts from a fresh state.
 const decoders = new Map();
-function tryDecoder(charset) {
-    if (!ENCODING_LABELS.has(charset)) {
-        return null;
+function tryDecoder(label) {
+    if (REPLACEMENT_LABELS.has(label)) {
+        return replacementDecoder;
     }
-    let decoder = decoders.get(charset);
+    let decoder = decoders.get(label);
     if (decoder === undefined) {
         decoder = null;
         try {
-            decoder = new TextDecoder(charset);
+            decoder = new TextDecoder(label);
         }
         catch {
             // not supported by this runtime
         }
-        decoders.set(charset, decoder);
+        decoders.set(label, decoder);
     }
     return decoder;
 }
@@ -348,23 +405,32 @@ const utf8Decoder = new TextDecoder();
  * Finds the decoder for a charset label, or null when the runtime has no encoding for it
  */
 function findDecoder(charset) {
-    charset = (charset || 'utf8').trim().toLowerCase();
-    // Try the label as written first, so the alias table only ever adds to what the
-    // runtime already supports instead of shadowing it.
-    const decoder = tryDecoder(charset);
-    if (decoder) {
-        return decoder;
-    }
-    const normalized = normalizeCharset(charset);
-    const codePage = normalized.match(codePagePattern);
-    // The normalized label is itself the last candidate, which resolves everything that
-    // differed from a supported label only by a prefix or a separator, eg. x-big5.
-    const alias = (codePage && codePageAliases.get(codePage[1])) || charsetAliases.get(normalized) || normalized;
-    return tryDecoder(alias);
+    const label = resolveLabel(charset);
+    return label ? tryDecoder(label) : null;
 }
 function getDecoder(charset) {
     return findDecoder(charset) || tryDecoder('windows-1252') || utf8Decoder;
 }
+const UTF16_ENCODINGS = new Set(['utf-16le', 'utf-16be']);
+// The label of UTF-16 that leaves the byte order to the bytes, which a byte order mark
+// then decides, as it does for Python's utf-16 codec and for iconv-lite. The labels that
+// name the order, utf-16le and utf-16be, are read as they say whatever mark the bytes
+// carry, and no label honours a UTF-8 mark. The Encoding Standard lets any mark override
+// any label, but Python and mailparser do not, and following it here rendered as markup
+// under charset=utf-16be a body that a scanner built on either reads as CJK text.
+const UTF16_UNORDERED_LABELS = new Set(['utf-16']);
+/**
+ * The byte order a UTF-16 byte order mark at the start of the bytes names, or null without one
+ */
+function bomByteOrder(bytes) {
+    if (bytes[0] === 0xfe && bytes[1] === 0xff) {
+        return 'utf-16be';
+    }
+    if (bytes[0] === 0xff && bytes[1] === 0xfe) {
+        return 'utf-16le';
+    }
+    return null;
+}
 /**
  * Whether the bytes are well formed UTF-8. A scan rather than a fatal TextDecoder, since
  * the exception one throws costs more than the decode itself and a message decides how
@@ -438,8 +504,19 @@ function decodeUtf8OrWindows1252(bytes, utf8 = utf8Decoder) {
  * @return Decoded text
  */
 function decodeCharset(bytes, charset) {
-    const decoder = findDecoder(charset);
-    return decoder ? decoder.decode(bytes) : decodeUtf8OrWindows1252(bytes);
+    const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    const label = resolveLabel(charset);
+    let decoder = label ? tryDecoder(label) : null;
+    if (label && UTF16_UNORDERED_LABELS.has(label)) {
+        // `utf-16` reads as little endian on its own, so a byte order mark decides the
+        // order. Read in the other order the bytes are swapped pairs of the characters
+        // every other reader got: FE FF and big endian text under charset=utf-16 was CJK
+        // text to Python and a browser, and here it was the little endian reading, which
+        // the sender picks to be markup.
+        const order = bomByteOrder(view);
+        decoder = (order && tryDecoder(order)) || decoder;
+    }
+    return decoder ? decoder.decode(view) : decodeUtf8OrWindows1252(view);
 }
 // The charset an html document names for itself, in a `<meta charset>` or in the
 // Content-Type `<meta http-equiv>`, read from the first 1024 bytes like a browser's prescan.
@@ -448,7 +525,6 @@ function decodeCharset(bytes, charset) {
 // nothing but `<meta ` took it quadratic
 const META_PRESCAN_BYTES = 1024;
 const CHARSET_ATTRIBUTE = /charset\s*=\s*["']?\s*([^\s"';>]+)/;
-const UTF16_ENCODINGS = new Set(['utf-16le', 'utf-16be']);
 function sniffHtmlCharset(bytes) {
     const head = utf8Decoder.decode(bytes.subarray(0, META_PRESCAN_BYTES)).toLowerCase();
     let pos = 0;
@@ -483,7 +559,9 @@ function decodeText(bytes, charset, html) {
     // The HTML prescan has two overrides, and for a reason: a `<meta>` tag that could be
     // read as ASCII proves the document is not UTF-16, so such a label is read as UTF-8,
     // and x-user-defined is read as windows-1252. Without them a sender picks the encoding
-    // that turns bytes a scanner sees as inert into markup for this parser alone
+    // that turns bytes a scanner sees as inert into markup for this parser alone. A label
+    // of the replacement encoding is the replacement text, as it is for a browser, see
+    // tryDecoder
     const sniffed = html ? sniffHtmlCharset(view) : null;
     const decoder = sniffed ? findDecoder(sniffed) : null;
     if (!decoder || UTF16_ENCODINGS.has(decoder.encoding)) {
@@ -1059,6 +1137,30 @@ class QPDecoder {
     }
 }
 
+// The error class each code is thrown as. An invalid option or input is a TypeError, as an
+// invalid option was before codes were added
+const ERROR_TYPES = {
+    EINVALIDOPTION: TypeError,
+    EINVALIDINPUT: TypeError,
+    EPARSERREUSED: Error,
+    EMAXNESTINGDEPTH: Error,
+    EMAXHEADERSIZE: Error,
+    EMAXPARTCOUNT: Error,
+    EMAXFORWARDEDADDRESSES: Error
+};
+/**
+ * Creates an error with a code
+ *
+ * @param code Error code
+ * @param message Error message
+ * @returns The error
+ */
+function createError(code, message) {
+    const error = new ERROR_TYPES[code](message);
+    error.code = code;
+    return error;
+}
+
 // Header lines are decoded with ignoreBOM so that a U+FEFF at the start of a line is
 // kept as a character instead of being swallowed. A stripped BOM turns a line a strict
 // parser skips into a genuine header, which is how a second `From:` gets smuggled past
@@ -1076,12 +1178,9 @@ const FLOWED_JOIN_INTERVAL = 4096;
 // hundred megabytes. Counting every line for at least this much keeps the memory in step
 // with the budget, 32768 lines at the default 2 MiB.
 const HEADER_LINE_MIN_COST = 64;
-// Trims only the whitespace RFC 5322 allows around a field name. String.prototype.trim
-// also strips U+00A0, U+FEFF, U+2028 and the rest of the Unicode spaces, which turns a
-// line that a strict parser rejects into a canonical field name: a `From:` line with a
-// leading U+00A0 became a `from` header, and since the first occurrence of a header wins
-// it outranked the real sender. Leaving the character in the key keeps the line visible
-// without letting it collide with a genuine header.
+// Trims the SP and HTAB around a field body, the only whitespace RFC 5322 reads as padding
+// there. String.prototype.trim also strips U+00A0, U+FEFF, U+2028 and the rest of the
+// Unicode spaces, which a raw UTF-8 header (RFC 6532) may carry as content.
 //
 // An index scan rather than `/^[ \t]+|[ \t]+$/g`, which retries the trailing branch at
 // every position of a blank run that is followed by other text, so a single header with
@@ -1097,12 +1196,11 @@ const trimWsp = (str) => {
     }
     return str.slice(start, end);
 };
-// A line of nothing but SP and HTAB, see feed
-const isBlankLine = (line) => line.every(isWsp);
-// The start of a header field: a field name of printable ASCII other than the colon
-// (RFC 5322 3.6.8 ftext) and the colon itself, with the whitespace in between that
-// processHeaders tolerates as well
-const FIELD_START = /^[!-9;-~]+[ \t]*:/;
+// The start of a header field, the shape Python's header pattern reads: a field name of
+// printable ASCII other than the colon (RFC 5322 3.6.8 ftext), an empty one included, and
+// the colon itself, with the whitespace in between that processHeaders tolerates as well,
+// or the `From ` of an mbox separator line, which every reader lets through
+const FIELD_START = /^(?:From |[!-9;-~]*[ \t]*:)/;
 // Headers that decide how this part's body is read, see processHeaders
 const CONTENT_HEADERS = new Set([
     'content-type',
@@ -1121,7 +1219,7 @@ class MimeNode {
         const limits = this.postalMime.limits;
         this.postalMime.counters.partCount++;
         if (this.postalMime.counters.partCount > limits.maxPartCount) {
-            throw new Error(`Maximum MIME part count of ${limits.maxPartCount} parts exceeded`);
+            throw createError('EMAXPARTCOUNT', `Maximum MIME part count of ${limits.maxPartCount} parts exceeded`);
         }
         this.childNodes = [];
         // Cursor into childNodes for finalizeChildNodes. Every new part of a multipart
@@ -1132,7 +1230,7 @@ class MimeNode {
             this.parentNode = options.parentNode;
             this.depth = this.parentNode.depth + 1;
             if (this.depth > limits.maxNestingDepth) {
-                throw new Error(`Maximum MIME nesting depth of ${limits.maxNestingDepth} levels exceeded`);
+                throw createError('EMAXNESTINGDEPTH', `Maximum MIME nesting depth of ${limits.maxNestingDepth} levels exceeded`);
             }
             options.parentNode.childNodes.push(this);
         }
@@ -1141,7 +1239,6 @@ class MimeNode {
         }
         this.state = 'header';
         this.headerLines = [];
-        this.lastLineBlank = false;
         // RFC 2046 Section 5.1.5: multipart/digest defaults to message/rfc822
         const parentMultipartType = options.parentMultipartType || null;
         const defaultContentType = parentMultipartType === 'digest' ? 'message/rfc822' : 'text/plain';
@@ -1165,11 +1262,15 @@ class MimeNode {
         this.contentDecoder = null;
         this.content = null;
     }
+    // `transferEncoding` is the lowercased token of the header, see processHeaders. It is
+    // matched whole: `x-base64` or `7bit-base64` is no encoding Python or mailparser
+    // decode, and decoding it here rendered as markup a body every other reader keeps as
+    // inert base64
     setupContentDecoder(transferEncoding) {
-        if (/base64/i.test(transferEncoding)) {
+        if (transferEncoding === 'base64') {
             this.contentDecoder = new Base64Decoder();
         }
-        else if (/quoted-printable/i.test(transferEncoding)) {
+        else if (transferEncoding === 'quoted-printable') {
             this.contentDecoder = new QPDecoder();
         }
         else {
@@ -1223,49 +1324,52 @@ class MimeNode {
         let commentStart = -1;
         // A parameter value starts at `=` and ends at the `;` that begins the next one
         let inParameterValue = false;
-        // Whether result ends in SP or HTAB. Kept up to date on every append, because
-        // testing `/[ \t]$/` against result flattens the whole string on each `(` and is
-        // quadratic in the length of the header.
+        // The characters kept are copied into the result as runs, a run ending at the
+        // next character dropped. Appended one at a time they made a cons string of a
+        // node per character, tens of megabytes of pointer chasing for the collector on a
+        // header of a megabyte, and the parse grew faster than the header did
+        let runStart = 0;
+        const drop = (i) => {
+            result += str.slice(runStart, i);
+            runStart = i + 1;
+        };
+        // Whether anything has been kept, and whether the last character kept is SP or
+        // HTAB. Kept up to date on every character, because testing `/[ \t]$/` against the
+        // result flattens the whole string on each `(` and is quadratic in the length of
+        // the header.
+        let keptAny = false;
         let endsWithWsp = false;
-        const append = (c) => {
-            result += c;
-            endsWithWsp = c === ' ' || c === '\t';
+        const keep = (i) => {
+            keptAny = true;
+            endsWithWsp = isWsp(str.charCodeAt(i));
         };
         // A comment may only appear where linear whitespace is allowed, so inside a
         // parameter value the parenthesis has to follow whitespace to open one. Outside
         // one, eg. after the type itself, anything goes.
-        const opensComment = () => !inParameterValue || !result.length || endsWithWsp;
+        const opensComment = () => !inParameterValue || !keptAny || endsWithWsp;
         for (let i = 0; i < str.length; i++) {
             const chr = str.charAt(i);
             if (escaped) {
-                if (depth === 0) {
-                    append(chr);
-                }
                 escaped = false;
-                continue;
             }
-            if (chr === '\\') {
+            else if (chr === '\\') {
                 escaped = true;
-                if (depth === 0) {
-                    append(chr);
-                }
-                continue;
             }
-            if (chr === '"' && depth === 0) {
+            else if (chr === '"' && depth === 0) {
                 inQuote = !inQuote;
-                append(chr);
-                continue;
             }
-            if (!inQuote) {
+            else if (!inQuote) {
                 if (chr === '(' && opensComment()) {
                     if (depth === 0) {
                         commentStart = i;
                     }
                     depth++;
+                    drop(i);
                     continue;
                 }
                 if (chr === ')' && depth > 0) {
                     depth--;
+                    drop(i);
                     continue;
                 }
                 if (depth === 0) {
@@ -1278,16 +1382,19 @@ class MimeNode {
                 }
             }
             if (depth === 0) {
-                append(chr);
+                keep(i);
+            }
+            else {
+                drop(i);
             }
         }
         if (depth === 0) {
-            return result;
+            return result + str.slice(runStart);
         }
         // An unbalanced `(` is not a comment. Dropping everything after it would take any
         // parameter that follows with it, including the boundary that holds the message
         // together, so the dangling text is only discarded when nothing follows it.
-        return str.indexOf(';', commentStart) < 0 ? result : str;
+        return str.indexOf(';', commentStart) < 0 ? result + str.slice(runStart) : str;
     }
     parseStructuredHeader(str) {
         // Strip RFC 822 comments before parsing
@@ -1317,9 +1424,22 @@ class MimeNode {
             }
             pendingSpace = '';
         };
-        const addChr = (c) => {
-            flushSpace();
-            value += c;
+        // The characters of the value are copied as runs, see stripComments. A run is the
+        // characters from runStart on, none is open while it is -1, and it is closed by
+        // whatever is not a character of the value
+        let runStart = -1;
+        const closeRun = (end) => {
+            if (runStart >= 0) {
+                value += str.slice(runStart, end);
+                runStart = -1;
+            }
+        };
+        // the character at i is part of the value
+        const addChr = (i) => {
+            if (runStart < 0) {
+                flushSpace();
+                runStart = i;
+            }
         };
         const takeValue = () => {
             const result = value;
@@ -1359,15 +1479,19 @@ class MimeNode {
             switch (stage) {
                 case 'key':
                     if (chr === '=') {
+                        closeRun(i);
                         key = takeValue().trim().toLowerCase();
                         stage = 'value';
                         break;
                     }
                     if (chr === ';') {
+                        closeRun(i);
                         storeEmptyKey();
                         break;
                     }
-                    value += chr;
+                    if (runStart < 0) {
+                        runStart = i;
+                    }
                     break;
                 case 'value':
                     if (quoteClosed && chr !== ';') {
@@ -1387,37 +1511,43 @@ class MimeNode {
                         break;
                     }
                     if (escaped) {
-                        addChr(chr);
+                        addChr(i);
                     }
                     else if (quote && chr === '\\') {
                         // backslash only escapes inside a quoted string, everywhere else
                         // it is an ordinary character. Treating it as an escape turns
                         // `filename=C:\Users\me\a.txt` into `C:Usersmea.txt`.
+                        closeRun(i);
                         escaped = true;
                         continue;
                     }
                     else if (quote && chr === quote) {
+                        closeRun(i);
                         quote = false;
                         quoteClosed = true;
                     }
                     else if (!quote && chr === '"') {
+                        closeRun(i);
                         quote = chr;
                         flushSpace();
                     }
                     else if (!quote && chr === ';') {
+                        closeRun(i);
                         storeValue();
                         stage = 'key';
                     }
                     else if (!quote && (chr === ' ' || chr === '\t')) {
+                        closeRun(i);
                         pendingSpace += chr;
                     }
                     else {
-                        addChr(chr);
+                        addChr(i);
                     }
                     escaped = false;
                     break;
             }
         }
+        closeRun(str.length);
         // finalize remainder
         if (stage === 'value') {
             storeValue();
@@ -1504,7 +1634,10 @@ class MimeNode {
         // which differ from one transfer encoding to the next. Text is normalized to LF so
         // that a consumer does not get CRLF from one message and LF from another
         let str = decodeText(this.content, this.contentType.parsed.params.charset, this.contentType.parsed.value === 'text/html').replace(/\r\n/g, '\n');
-        if (/^flowed$/i.test(this.contentType.parsed.params.format)) {
+        // format=flowed is defined for text/plain (RFC 3676), and a browser never unfolds
+        // an html part. Unfolded here anyway, `<scri \r\npt>` under delsp=yes was joined
+        // into a tag that neither Python nor a browser given the raw bytes sees
+        if (this.contentType.parsed.value === 'text/plain' && /^flowed$/i.test(this.contentType.parsed.params.format)) {
             str = this.decodeFlowedText(str, /^yes$/i.test(this.contentType.parsed.params.delsp));
         }
         return str;
@@ -1534,9 +1667,21 @@ class MimeNode {
         // Second pass: process headers in document order
         for (let parts of foldedLines) {
             let rawLine = parts.join('\n');
-            // Extract key from raw line for rawHeaderLines
+            // The field name is kept as it was written, whitespace included. RFC 5322 puts
+            // the colon right after the name and only its obsolete syntax lets whitespace
+            // come between the two, so `From :` names a different field than `From:`, as
+            // Go reads it, and the first line of a message may start with whitespace while
+            // it is a fold of nothing, a line Python drops and Go rejects the message for.
+            // Trimming the name made such a line the canonical header, and since the first
+            // occurrence of a header wins, a ` From:` first line or a `From :` ahead of the
+            // genuine From named the sender here while a verifier reading the other had
+            // authenticated the one this parser ignored. The same put a Content-Type ahead
+            // of the one every other parser reads the body by. Leaving the whitespace in
+            // the key keeps the line visible without letting it collide with a genuine
+            // header. A line whose name holds anything else, a non-ASCII space say, is no
+            // field at all and ends the headers, see feed.
             let sep = rawLine.indexOf(':');
-            let rawKey = trimWsp(sep < 0 ? rawLine : rawLine.slice(0, sep));
+            let rawKey = sep < 0 ? rawLine : rawLine.slice(0, sep);
             // Store raw line with lowercase key
             this.rawHeaderLines.push({
                 key: rawKey.toLowerCase(),
@@ -1548,7 +1693,7 @@ class MimeNode {
             // replaced the non-ASCII spaces that raw UTF-8 headers (RFC 6532) may carry.
             let unfoldedLine = parts.join('');
             sep = unfoldedLine.indexOf(':');
-            let key = trimWsp(sep < 0 ? unfoldedLine : unfoldedLine.slice(0, sep));
+            let key = sep < 0 ? unfoldedLine : unfoldedLine.slice(0, sep);
             // A bare CR is not legal in a field body, see foldLineBreaks
             let value = sep < 0 ? '' : trimWsp(foldLineBreaks(unfoldedLine.slice(sep + 1)));
             this.headers.push({ key: key.toLowerCase(), originalKey: key, value });
@@ -1582,29 +1727,58 @@ class MimeNode {
         this.contentType.multipart = /^multipart\//i.test(this.contentType.parsed.value)
             ? this.contentType.parsed.value.slice(this.contentType.parsed.value.indexOf('/') + 1)
             : false;
-        if (this.contentType.multipart && !this.contentType.parsed.params.boundary) {
-            // A multipart without the boundary RFC 2046 5.1.1 requires has no parts to find,
-            // and its body used to be dropped without a trace. RFC 2045 5.2 recommends
-            // reading an invalid Content-Type as plain text, which is also what the body of
-            // such a message usually is
+        // A boundary does not end in whitespace (RFC 2046 5.1.1, bcharsnospace), and one
+        // written with some anyway, `boundary="abc "`, is `abc` to Python. Registered as
+        // written it matched no delimiter line and the whole body was dropped without a
+        // trace, an attachment included. A delimiter line written with the space still
+        // matches, since a boundary line may end in whitespace. trimEnd rather than
+        // trimWsp, because Python strips any whitespace here.
+        //
+        // A boundary is ASCII as well (RFC 2046 5.1.1, bchars), and Python matches no line
+        // against one that is not. One holding a non-ASCII character came out of a header
+        // line decoded as windows-1252 and re-encoded as UTF-8, or was written in UTF-8 to
+        // begin with. Matched here, `boundary="ab\xE9cd"` found the parts under lines of
+        // `--ab\xC3\xA9cd` that a scanner built on Python never saw, and with the same byte
+        // on both sides nothing matched and the body was dropped without a trace. Such a
+        // boundary counts as none, so the body reads as text below
+        let boundary = this.contentType.multipart ? (this.contentType.parsed.params.boundary || '').trimEnd() : '';
+        if (/[^\x00-\x7f]/.test(boundary)) {
+            boundary = '';
+        }
+        if (this.contentType.multipart && !boundary) {
+            // A multipart without the boundary RFC 2046 5.1.1 requires, or with one it does
+            // not allow, has no parts to find, and its body used to be dropped without a
+            // trace. RFC 2045 5.2 recommends reading an invalid Content-Type as plain text,
+            // which is also what the body of such a message usually is
             this.contentType.parsed.value = 'text/plain';
             this.contentType.multipart = false;
         }
         if (this.contentType.multipart) {
             // add self to boundary terminator listing
             this.postalMime.boundaries.push({
-                value: textEncoder.encode(this.contentType.parsed.params.boundary),
+                value: textEncoder.encode(boundary),
                 node: this
             });
         }
         this.contentDisposition.parsed = this.parseStructuredHeader(this.contentDisposition.value);
-        // Take the first token rather than splitting on the first non-token character.
-        // `split()` returns an empty string for anything that does not start with a word
-        // character, so `(comment) base64` and `"base64"` used to fall through to the
-        // pass-through decoder and hand the caller undecoded base64 as the message body.
+        // The disposition type is a token, so it ends at the first whitespace. Read whole,
+        // `attachment garbage` was neither attachment nor inline, and a text/html part
+        // declaring it was rendered as the body while Python and mailparser keep it an
+        // attachment. The type of a Content-Type stays as it is: `text/html garbage` is no
+        // html to them either, and reading it as html here would be the reverse mistake
+        const disposition = this.contentDisposition.parsed.value;
+        const dispositionEnd = disposition.search(/[ \t]/);
+        if (dispositionEnd >= 0) {
+            this.contentDisposition.parsed.value = disposition.slice(0, dispositionEnd);
+        }
+        // The token at the start of the value, behind the whitespace a leading comment
+        // leaves: `(comment) base64`, `base64 (comment)` and `base64 x` decode, as they do
+        // for Python. A quoted token does not. `"base64"` is raw base64 to Python and to
+        // mailparser, and decoding it here rendered as markup a body both hand through as
+        // it is. Taking the first token anywhere in the value read it, and `x "base64"`.
         this.contentTransferEncoding.encoding = (this.stripComments(this.contentTransferEncoding.value)
             .toLowerCase()
-            .match(/[\w-]+/) || [''])[0];
+            .match(/^[ \t]*([\w-]+)/) || ['', ''])[1];
         this.setupContentDecoder(this.contentTransferEncoding.encoding);
         // the lines live on in rawHeaderLines and headers, so the raw copies are released
         this.headerLines = [];
@@ -1630,24 +1804,25 @@ class MimeNode {
                 this.postalMime.counters.headerSize += Math.max(line.length, HEADER_LINE_MIN_COST);
                 const maxHeadersSize = this.postalMime.limits.maxHeadersSize;
                 if (this.postalMime.counters.headerSize > maxHeadersSize) {
-                    throw new Error(`Maximum header size of ${maxHeadersSize} bytes exceeded`);
+                    throw createError('EMAXHEADERSIZE', `Maximum header size of ${maxHeadersSize} bytes exceeded`);
                 }
                 const text = decodeUtf8OrWindows1252(line, headerDecoder);
-                // A line of nothing but whitespace is legal folding (RFC 5322 4.2, obs-FWS),
-                // but broken generators also put one where the empty line that ends the
-                // headers belongs, and reading it as a fold then turned the whole body into
-                // one more header. So the next line decides what it was: a continuation or
-                // another header keep it a fold, anything else means the headers ended with
-                // it, and it is taken back out of the header lines. Python and Go read such
-                // a line as the end of the headers outright, so the body is where the other
-                // parsers find it.
-                if (this.lastLineBlank && !isWsp(line[0]) && !FIELD_START.test(text)) {
-                    this.headerLines.pop();
+                // A line that is neither a header field nor a fold ends the headers, as it
+                // does for Python and for an MTA that stores the header block on its own,
+                // and Go rejects the message for it. Read on as a header here, a Content-Type
+                // or a From behind such a line was honoured where a scanner built on Python
+                // had read it as the first line of a text/plain body.
+                //
+                // A line of nothing but whitespace is a fold (RFC 5322 4.2, obs-FWS), but
+                // broken generators also put one where the empty line that ends the headers
+                // belongs, and reading it as a fold used to turn the whole body into one
+                // more header. The next line decides: a field or a fold keeps it a fold,
+                // anything else ends the headers, as it does for Python
+                if (!isWsp(line[0]) && !FIELD_START.test(text)) {
                     this.endHeaders();
                     return true;
                 }
                 this.headerLines.push(text);
-                this.lastLineBlank = isBlankLine(line);
                 break;
             }
             case 'body':
@@ -3967,14 +4142,26 @@ function decodeHTMLEntities(str) {
         return output;
     });
 }
+// two uppercase hex digits of a value below 256
+const hexByte = (value) => value.toString(16).toUpperCase().padStart(2, '0');
 function escapeHtml(str) {
-    return str.trim().replace(/[<>"'?&]/g, c => {
-        let hex = c.charCodeAt(0).toString(16);
-        if (hex.length < 2) {
-            hex = '0' + hex;
-        }
-        return '&#x' + hex.toUpperCase() + ';';
-    });
+    return str.trim().replace(/[<>"'?&]/g, c => '&#x' + hexByte(c.charCodeAt(0)) + ';');
+}
+// The characters an address may carry into a mailto URL as they are (RFC 6068 2:
+// unreserved and some-delims). Anything else is percent encoded: a `?` or `&` starts the
+// header fields of the URL, so `help@bank.example?cc=attacker@evil.example&body=…` given
+// as the address of a forwarded message opened a compose window with a Cc and a body the
+// sender chose once the link was clicked. Html escaping alone does not help, the browser
+// decodes the entities back before it reads the URL
+const MAILTO_UNSAFE = /[^A-Za-z0-9\-._~!$'()*+,;:@]+/g;
+// the percent encoded form of every byte, so that an encoded run allocates nothing per byte
+const PERCENT_ENCODED = Array.from({ length: 256 }, (_, byte) => '%' + hexByte(byte));
+// Each unsafe run is encoded whole and the result is built flat by replace. Appended one
+// character at a time it was a cons string of a node per character, which escapeHtml then
+// flattened: a long address of percent signs in a forwarded header held some sixty bytes
+// of heap per byte of it until then
+function encodeMailto(address) {
+    return address.replace(MAILTO_UNSAFE, run => Array.from(textEncoder.encode(run), byte => PERCENT_ENCODED[byte]).join(''));
 }
 function textToHtml(str) {
     let html = escapeHtml(str).replace(/\n/g, '<br />');
@@ -3982,15 +4169,10 @@ function textToHtml(str) {
 }
 // htmlToText strips tags with regexes like `<br\b[^>]*>` and `<!--.*?-->`. Handed to
 // String#replace as they are, the engine tries every candidate in turn and a candidate
-// that does not close scans on to the next `>`, the end of the line or the end of the
-// input before giving up, so an html part holding many unclosed `<`, `<a ` or `<!--`
-// took seconds to minutes to convert. The helpers below give the same results in linear
-// time.
-// Characters that `.` does not match, so a `.*` can not run across them
-const LINE_TERMINATOR = /[\n\r\u2028\u2029]/g;
-function lastLineTerminator(str) {
-    return Math.max(str.lastIndexOf('\n'), str.lastIndexOf('\r'), str.lastIndexOf('\u2028'), str.lastIndexOf('\u2029'));
-}
+// that does not close scans on to the next `>` or the end of the input before giving up,
+// so an html part holding many unclosed `<`, `<a ` or `<!--` took seconds to minutes to
+// convert. The helpers below give the same results in linear time. They run on text
+// without line terminators, see htmlToText, so `.` matches every character of it.
 /**
  * Returns a function that finds the next match of a global regex at or after a position.
  *
@@ -4092,7 +4274,7 @@ function replaceTags(str, prefix, pattern, replacement) {
  * `str.replace(pattern, replacement)` for a pattern like `<!--.*?-->` or
  * `<script\b[^>]*>.*?<\/script\b[^>]*>`, ie. an opener and a closer, either of which may
  * continue with `[^>]*>`, and a lazy `.*?` between them. The engine rescans to the end of
- * the line for every opener that is not closed.
+ * the input for every opener that is not closed.
  *
  * @param str String to process
  * @param open Global regex for the opener
@@ -4105,7 +4287,6 @@ function replaceTags(str, prefix, pattern, replacement) {
 function replaceBlocks(str, open, openToGt, close, closeToGt, replacement) {
     const nextGt = createFinder(str, />/g);
     const nextClose = createFinder(str, close);
-    const nextLineEnd = createFinder(str, LINE_TERMINATOR);
     const parts = [];
     let copied = 0;
     let searchFrom = 0;
@@ -4132,11 +4313,6 @@ function replaceBlocks(str, open, openToGt, close, closeToGt, replacement) {
             // no closer follows this opener, so none follows a later one either
             break;
         }
-        // `.*?` can not reach the closer across a line terminator
-        const lineEnd = nextLineEnd(from);
-        if (lineEnd && lineEnd.index < closer.index) {
-            continue;
-        }
         let end = closer.index + closer[0].length;
         if (closeToGt) {
             const gt = nextGt(end);
@@ -4155,16 +4331,15 @@ function replaceBlocks(str, open, openToGt, close, closeToGt, replacement) {
 }
 /**
  * `str.replace(pattern, '')` for `^.*<tag\b[^>]*>`, ie. drops everything up to and
- * including the last such tag on the first line.
+ * including the last such tag.
  *
  * @param str String to process
  * @param prefix Global regex for the start of the tag, which can not contain `>`
  * @return Processed string
  */
 function stripThroughLastTag(str, prefix) {
-    const lineEnd = str.search(LINE_TERMINATOR);
-    // `.*` stops at the first line terminator, and `[^>]*>` needs a `>` after the tag
-    const limit = Math.min(lineEnd < 0 ? str.length : lineEnd, str.lastIndexOf('>'));
+    // `[^>]*>` needs a `>` after the tag
+    const limit = str.lastIndexOf('>');
     let last = -1;
     prefix.lastIndex = 0;
     let match;
@@ -4174,28 +4349,32 @@ function stripThroughLastTag(str, prefix) {
     return last < 0 ? str : str.slice(str.indexOf('>', last) + 1);
 }
 /**
- * `str.replace(pattern, '')` for `<tag\b[^>]*>.*$`, ie. drops the first such tag whose
- * `>` is on the last line, and everything after it.
+ * `str.replace(pattern, '')` for `<tag\b[^>]*>.*$`, ie. drops the first such tag that is
+ * closed, and everything after it.
  *
  * @param str String to process
  * @param prefix Global regex for the start of the tag, which can not contain `>`
  * @return Processed string
  */
 function stripFromFirstTag(str, prefix) {
-    // `.*$` has to reach the end of the string without crossing a line terminator, so the
-    // tag has to start after the last `>` that comes before the last line terminator
-    const lineEnd = lastLineTerminator(str);
-    prefix.lastIndex = lineEnd < 0 ? 0 : str.lastIndexOf('>', lineEnd) + 1;
+    prefix.lastIndex = 0;
     const match = prefix.exec(str);
     return match && match.index < str.lastIndexOf('>') ? str.slice(0, match.index) : str;
 }
 function htmlToText(str) {
-    // we can't process tags on multiple lines so remove newlines first
-    str = str.replace(/\r?\n/g, '\u0001');
+    // Tags are not processed across lines, so every line terminator, every character `.`
+    // does not match, becomes a placeholder first. Only `\r?\n` used to, and the patterns
+    // below do not cross the others either: `.*?` stops at a bare CR or a U+2028, so a
+    // script whose body held one was not removed as a block, its tags were stripped as
+    // tags and the script itself landed in the text, which a filter reading the text then
+    // took for content
+    str = str.replace(/\r\n|[\n\r\u2028\u2029]/g, '\u0001');
     str = replaceBlocks(str, /<!--/g, false, /-->/g, false, ' ');
     str = replaceClosedTags(str, /<br\b[^>]*>/gi, '\n');
     str = replaceClosedTags(str, /<\/?(p|div|table|tr|td|th)\b[^>]*>/gi, '\n\n');
     str = replaceBlocks(str, /<script\b/gi, true, /<\/script\b/gi, true, ' ');
+    // a stylesheet in the body is no text of the message either
+    str = replaceBlocks(str, /<style\b/gi, true, /<\/style\b/gi, true, ' ');
     str = stripThroughLastTag(str, /<body\b/gi);
     str = stripThroughLastTag(str, /<\/head\b/gi);
     str = stripThroughLastTag(str, /<!doctype\b/gi);
@@ -4221,6 +4400,12 @@ function htmlToText(str) {
     str = decodeHTMLEntities(str);
     return str;
 }
+// The formatter the dates of forwarded headers are rendered with, created on first use.
+// One instance serves every date, a formatter is immutable. Constructing one per rendered
+// header held some 30 KB of ICU state outside the V8 heap for each, so a message of a few
+// thousand dated forwards took hundreds of megabytes that no heap limit saw, and several
+// times the time of the same message without the dates
+let dateFormatter = null;
 // A message date is not always a date. PostalMime keeps the raw header value when it does
 // not parse, and Intl.DateTimeFormat throws a RangeError on that, which used to reject the
 // whole parse of any message carrying a forwarded copy with a broken Date header.
@@ -4232,7 +4417,7 @@ function formatDate(date) {
     if (isNaN(parsed.getTime())) {
         return date;
     }
-    return new Intl.DateTimeFormat('default', {
+    dateFormatter ??= new Intl.DateTimeFormat('default', {
         year: 'numeric',
         month: 'numeric',
         day: 'numeric',
@@ -4240,7 +4425,8 @@ function formatDate(date) {
         minute: 'numeric',
         second: 'numeric',
         hour12: false
-    }).format(parsed);
+    });
+    return dateFormatter.format(parsed);
 }
 function formatTextAddress(address) {
     return (address.name ? [address.name, `<${address.address}>`] : [address.address]).join(' ');
@@ -4266,7 +4452,7 @@ function formatTextAddresses(addresses) {
     return parts.join('');
 }
 function formatHtmlAddress(address) {
-    return `<a href="mailto:${escapeHtml(address.address)}" class="postal-email-address">${escapeHtml(address.name || `<${address.address}>`)}</a>`;
+    return `<a href="mailto:${escapeHtml(encodeMailto(address.address))}" class="postal-email-address">${escapeHtml(address.name || `<${address.address}>`)}</a>`;
 }
 function formatHtmlAddresses(addresses) {
     let parts = [];
@@ -4920,40 +5106,6 @@ function stripAddressComments(address) {
     }
     return { address: result.trim(), comments: comments.filter(text => text) };
 }
-/**
- * Checks whether text holds an angle bracket address, ie. `<` and `>` around a run
- * without other angle brackets that has an '@' with at least one character on each side.
- *
- * Same answer as `/<[^<>]+@[^<>]+>/.test(text)`, which backtracks quadratically on a `<`
- * followed by a long run of '@' and no closing `>`.
- *
- * @param text Text to check
- * @return true if an angle bracket address is present
- */
-function hasAngleAddress(text) {
-    // position right after the `<` that opened the current bracket, or -1
-    let start = -1;
-    // first '@' inside the bracket that has a character before it, or -1
-    let at = -1;
-    for (let i = 0; i < text.length; i++) {
-        const chr = text.charAt(i);
-        if (chr === '<') {
-            start = i + 1;
-            at = -1;
-        }
-        else if (chr === '>') {
-            if (at >= 0 && at < i - 1) {
-                return true;
-            }
-            start = -1;
-            at = -1;
-        }
-        else if (chr === '@' && start >= 0 && at < 0 && i > start) {
-            at = i;
-        }
-    }
-    return false;
-}
 /**
  * Walks the tokens of one entry of an address list and sorts them into the runs of display
  * text, angle-addr and comment they belong to
@@ -5076,17 +5228,14 @@ function groupName(tokens, from, to) {
     return decodeWords(collectAddressParts(tokens, from, to).data.text.join(' '));
 }
 /**
- * Converts tokens for a single address into an address object. An address that is nothing
- * but an encoded word holding an angle-addr is parsed again once decoded, which can give
- * more than one entry.
+ * Converts tokens for a single address into an address object
  *
  * @param tokens Tokens of the whole address list
  * @param from Index of the first token of this address
  * @param to Index just past the last token of this address
- * @param depth Current recursion depth of the encoded word re-parse
- * @return Address objects
+ * @return The address object
  */
-function _handleAddress(tokens, from, to, depth) {
+function _handleAddress(tokens, from, to) {
     const collected = collectAddressParts(tokens, from, to);
     const data = collected.data;
     let textFromComment = collected.textFromComment;
@@ -5173,25 +5322,19 @@ function _handleAddress(tokens, from, to, depth) {
     // Join values with spaces
     let text = data.text.join(' ');
     let addressValue = data.address.join(' ');
+    // A field that is nothing but encoded words names the mailbox and is not one. The
+    // decoded text used to be parsed again when it held an angle-addr, so a word decoding
+    // to `CEO <ceo@victim.example>` became that mailbox. Nothing that authenticates the
+    // message reads it that way: a DMARC verifier takes the author from the raw header,
+    // where the word holds no mailbox, so the message has no author domain to check and
+    // the sender it showed here was one no verifier had seen. nodemailer, mailparser and
+    // Python read the field as a name as well.
+    //
     // `^=\?[^=]+?=$` could not match a base64 word whose padding puts an '=' inside it,
     // so whether a bare encoded word was decoded or left to become the address itself
     // came down to whether its payload happened to need padding.
     if (!addressValue && isEncodedWordsOnly(text.trim())) {
-        // try to extract words from text content
-        const decodedText = decodeWords(text);
-        // Security: only re-parse if decoded text contains angle-bracket addresses.
-        // Without this, a bare encoded email (e.g. =?utf-8?B?dGVzdEBldmlsLmNv?=)
-        // would be fabricated into an address from attacker-controlled input. A quoted
-        // encoded word is never re-parsed, addresses are not taken out of quoted strings
-        // and neither is one that came out of a comment
-        if (!addressFromQuotedText && !textFromComment && hasAngleAddress(decodedText)) {
-            const parsedSubAddresses = parseAddressList(decodedText, depth + 1);
-            if (parsedSubAddresses.length) {
-                return parsedSubAddresses;
-            }
-        }
-        // No usable address found - treat decoded text as display name only
-        return [{ address: '', name: decodedText }];
+        return { address: '', name: decodeWords(text) };
     }
     if (addressFromQuotedText && text.indexOf('@') >= 0) {
         // The mailbox is still sitting in the text, so it moves over here and is quoted
@@ -5229,7 +5372,7 @@ function _handleAddress(tokens, from, to, depth) {
             address.address = '';
         }
     }
-    return [address];
+    return address;
 }
 /**
  * Tokenizer for address field strings
@@ -5554,12 +5697,6 @@ class Tokenizer {
         this.innerEscaped = false;
     }
 }
-/**
- * Maximum depth of the re-parse of an address that is nothing but an encoded word holding
- * an angle-addr. Groups no longer recurse, but a decoded word could hold another one, so this
- * still bounds that.
- */
-const MAX_NESTED_GROUP_DEPTH = 10;
 /**
  * Folds the fragments an unquoted display name holding a comma is split into back together.
  *
@@ -5598,14 +5735,9 @@ function mergeNameFragments(list) {
  * ends the group, nested or not, as before.
  *
  * @param str Address field
- * @param depth Current depth of the encoded word re-parse
  * @return An array of address objects
  */
-function parseAddressList(str, depth) {
-    // Prevent stack overflow from encoded words decoding to more of them (DoS protection)
-    if (depth > MAX_NESTED_GROUP_DEPTH) {
-        return [];
-    }
+function parseAddressList(str) {
     const tokens = new Tokenizer(str).tokenize();
     const parsedAddresses = [];
     let group = null;
@@ -5632,21 +5764,7 @@ function parseAddressList(str, depth) {
         if (i > from) {
             // Appended in place. Rebuilding the list with concat() for every address copies
             // everything parsed so far and is quadratic in the number of addresses.
-            for (const address of _handleAddress(tokens, from, i, depth)) {
-                if (!group) {
-                    parsedAddresses.push(address);
-                }
-                else if (address.group) {
-                    // an encoded word inside a group decoded to a group of its own, which is
-                    // flattened into this one as a nested group is
-                    for (const member of address.group) {
-                        members.push(member);
-                    }
-                }
-                else {
-                    members.push(address);
-                }
-            }
+            (group ? members : parsedAddresses).push(_handleAddress(tokens, from, i));
         }
         from = i + 1;
         if (group && (operator === ';' || i === len)) {
@@ -5673,7 +5791,7 @@ function parseAddressList(str, depth) {
  * @return An array of address objects
  */
 function addressParser(str, options) {
-    const parsedAddresses = parseAddressList(str, 0);
+    const parsedAddresses = parseAddressList(str);
     return parsedAddresses;
 }
 
@@ -5738,6 +5856,23 @@ function isReadableStream(value) {
 function isBlob(value) {
     return value instanceof Blob || Object.prototype.toString.call(value) === '[object Blob]';
 }
+// Checked by tag rather than instanceof, which fails for a buffer from another realm
+function isArrayBuffer(value) {
+    const tag = Object.prototype.toString.call(value);
+    return tag === '[object ArrayBuffer]' || tag === '[object SharedArrayBuffer]';
+}
+const ATTACHMENT_ENCODINGS = new Set(['arraybuffer', 'base64', 'utf8']);
+// Checked up front, an unknown encoding used to reject only once the whole message had
+// been parsed
+function parseAttachmentEncoding(value) {
+    const encoding = String(value || '')
+        .replace(/[-_\s]/g, '')
+        .toLowerCase() || 'arraybuffer';
+    if (!ATTACHMENT_ENCODINGS.has(encoding)) {
+        throw createError('EINVALIDOPTION', `Unknown attachment encoding ${encoding}`);
+    }
+    return encoding;
+}
 // Renders one entry of a node as the requested text type. A text part of the other type
 // is converted, and a nested message becomes a header block in that format
 function renderEntry(textEntry, textType, convert) {
@@ -5784,12 +5919,12 @@ function countAddresses(addresses) {
 // every `size > limit` comparison against such a value is false. Callers that
 // forward a request supplied options object would otherwise hand an attacker a way
 // to turn the limits off.
-function parseLimitOption(value, defaultValue, name) {
+function parseLimitOption(value, defaultValue, name, min = 0) {
     if (value === undefined || value === null) {
         return defaultValue;
     }
-    if (typeof value !== 'number' || !Number.isInteger(value) || value < 0) {
-        throw new TypeError(`${name} must be a non-negative integer`);
+    if (typeof value !== 'number' || !Number.isInteger(value) || value < min) {
+        throw createError('EINVALIDOPTION', `${name} must be a ${min ? 'positive' : 'non-negative'} integer`);
     }
     return value;
 }
@@ -5797,7 +5932,10 @@ function parseLimits(options) {
     return {
         maxNestingDepth: parseLimitOption(options.maxNestingDepth, MAX_NESTING_DEPTH, 'maxNestingDepth'),
         maxHeadersSize: parseLimitOption(options.maxHeadersSize, MAX_HEADERS_SIZE, 'maxHeadersSize'),
-        maxPartCount: parseLimitOption(options.maxPartCount, MAX_PART_COUNT, 'maxPartCount'),
+        // The root part is always counted, so a limit of zero can parse nothing, not even
+        // an empty message, and it threw EMAXPARTCOUNT from the constructor, where only
+        // EINVALIDOPTION is thrown
+        maxPartCount: parseLimitOption(options.maxPartCount, MAX_PART_COUNT, 'maxPartCount', 1),
         // A limit of 0 disables inline parsing entirely, so every message/rfc822 part
         // becomes an attachment.
         maxRfc822NestingDepth: parseLimitOption(options.maxRfc822NestingDepth, MAX_RFC822_NESTING_DEPTH, 'maxRfc822NestingDepth'),
@@ -5834,12 +5972,7 @@ class PostalMime {
         this.textTypes = new Set();
         this.attachments = [];
         this.forceRfc822Attachments = false;
-        this.attachmentEncoding =
-            (this.options.attachmentEncoding || '')
-                .toString()
-                .replace(/[-_\s]/g, '')
-                .trim()
-                .toLowerCase() || 'arraybuffer';
+        this.attachmentEncoding = parseAttachmentEncoding(this.options.attachmentEncoding);
         this.started = false;
     }
     /** @internal */
@@ -5852,8 +5985,16 @@ class PostalMime {
         let boundaries = this.boundaries;
         // check if this is a mime boundary
         if (boundaries.length && line.length > 2 && line[0] === 0x2d && line[1] === 0x2d) {
-            // could be a boundary marker
-            for (let i = boundaries.length - 1; i >= 0; i--) {
+            // Could be a boundary marker. The open boundaries are checked outermost first:
+            // a boundary may not appear inside the parts it delimits (RFC 2046 5.1.1), and
+            // when a nested multipart declares the boundary of an ancestor anyway, or one
+            // that ancestor's terminator matches, the ancestor's delimiter is the one every
+            // other parser reads the line as. Reading it as the nested one instead gave the
+            // nested multipart parts, and an attachment after the ancestor's terminator, that
+            // Python and Go leave in the epilogue, which hid it from a scanner built on
+            // either while it was shown here. Legal boundaries match one line at most, the
+            // order changes nothing for them.
+            for (let i = 0; i < boundaries.length; i++) {
                 let boundary = boundaries[i];
                 // Line must be at least long enough for "--" + boundary
                 if (line.length < boundary.value.length + 2) {
@@ -6000,7 +6141,7 @@ class PostalMime {
             // Attachments are encoded by the parent parser, so raw buffers are kept here.
             attachmentEncoding: 'arraybuffer'
         }, this);
-        const subMessage = (node.subMessage = await subParser.parse(node.content || new ArrayBuffer(0)));
+        const subMessage = await subParser.parse(node.content || new ArrayBuffer(0));
         // counted before the header block below is rendered into the text and html
         this.counters.forwardedAddresses +=
             countAddresses(subMessage.from) +
@@ -6008,13 +6149,18 @@ class PostalMime {
                 countAddresses(subMessage.cc) +
                 countAddresses(subMessage.bcc);
         if (this.counters.forwardedAddresses > this.limits.maxForwardedAddresses) {
-            throw new Error(`Maximum forwarded address count of ${this.limits.maxForwardedAddresses} addresses exceeded`);
+            throw createError('EMAXFORWARDEDADDRESSES', `Maximum forwarded address count of ${this.limits.maxForwardedAddresses} addresses exceeded`);
         }
+        // The nested parser renders no text, see parse, its text parts are taken over below
+        // and rendered by the root parser along with everything else. What it holds of each
+        // kind is read off its text types instead of its text and html
+        const hasPlain = subParser.textTypes.has('plain');
+        const hasHtml = subParser.textTypes.has('html');
         // default to text if there is no content
-        if (subMessage.text || !subMessage.html) {
+        if (hasPlain || !hasHtml) {
             this.addTextEntry(node, 'plain', { type: 'subMessage', value: subMessage });
         }
-        if (subMessage.html) {
+        if (hasHtml) {
             this.addTextEntry(node, 'html', { type: 'subMessage', value: subMessage });
         }
         subParser.textMap.forEach((subTextEntry, subTextNode) => {
@@ -6119,6 +6265,16 @@ class PostalMime {
         if (this.forceRfc822Attachments || node.contentType.parsed.value !== 'message/rfc822') {
             return false;
         }
+        // RFC 2046 5.2.1 allows no encoding but 7bit, 8bit and binary for a message/rfc822
+        // body. Python parses the lines of a base64 or quoted-printable part as they are, so
+        // the nested message it sees has no headers and holds the encoded text, and
+        // mailparser keeps the part as one attachment. Decoding and inlining it here
+        // rendered the html and listed the attachments of a message no scanner built on
+        // either reads, so such a part is an attachment, with its content decoded
+        const encoding = node.contentTransferEncoding.encoding;
+        if (encoding === 'base64' || encoding === 'quoted-printable') {
+            return false;
+        }
         let disposition = node.contentDisposition.parsed.value || (this.options.rfc822Attachments ? 'attachment' : 'inline');
         return disposition === 'inline';
     }
@@ -6150,8 +6306,16 @@ class PostalMime {
             if (done) {
                 break;
             }
-            chunks.push(value);
-            chunkLen += value.length;
+            // A chunk that is not a byte view, eg. a string from a text stream, used to be
+            // copied in as zeros
+            if (!ArrayBuffer.isView(value)) {
+                const error = createError('EINVALIDINPUT', 'Stream chunks must be Uint8Array values');
+                // Not awaited, a source that fails or stalls on cancel must not hide this error
+                reader.cancel(error).catch(() => { });
+                throw error;
+            }
+            chunks.push(new Uint8Array(value.buffer, value.byteOffset, value.byteLength));
+            chunkLen += value.byteLength;
         }
         const result = new Uint8Array(chunkLen);
         let chunkPointer = 0;
@@ -6185,6 +6349,11 @@ class PostalMime {
         if (ArrayBuffer.isView(input)) {
             return input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength);
         }
+        // Anything else, eg. a number or a plain object, was handed to the Uint8Array
+        // constructor as it is and parsed into an empty or zero filled message
+        if (!isArrayBuffer(input)) {
+            throw createError('EINVALIDINPUT', 'Unsupported email input type');
+        }
         return input;
     }
     // Properties are added in the order the output has always had them, so the required
@@ -6293,8 +6462,6 @@ class PostalMime {
                 }
                 break;
             }
-            default:
-                throw new Error('Unknown attachment encoding');
         }
     }
     /**
@@ -6305,7 +6472,7 @@ class PostalMime {
      */
     async parse(buf) {
         if (this.started) {
-            throw new Error('Can not reuse parser, create a new PostalMime object');
+            throw createError('EPARSERREUSED', 'Can not reuse parser, create a new PostalMime object');
         }
         this.started = true;
         this.buf = await this.resolveInput(buf);
@@ -6317,7 +6484,14 @@ class PostalMime {
         }
         this.forceRfc822Attachments = Boolean(this.options.forceRfc822Attachments) || this.hasReportParts();
         await this.collectNode(this.root, false, false);
-        this.renderTextContent();
+        // A nested parser hands its text parts to its parent, see collectSubMessage, and the
+        // root parser renders them all at once. Rendering at every level as well cost each
+        // level the text and html of everything below it, and kept them until the root was
+        // done: a chain of forwards as deep as maxRfc822NestingDepth allows took ten times
+        // the time and the memory of the flat message it held
+        if (this.rfc822NestingDepth === 0) {
+            this.renderTextContent();
+        }
         const message = this.buildMessage();
         this.encodeAttachments();
         return message;