@mavogel/awscdk-rootmail 0.1.26 → 0.1.28

package/node_modules/libmime/dist/esm/libmime.js

@@ -6,6 +6,26 @@ import * as libcharset from './charset.js';
 import * as mimetypes from './mimetypes.js';
 const STAGE_KEY = 0x1001;
 const STAGE_VALUE = 0x1002;
+/**
+ * Offset of the ")" that closes the rfc822 comment opening at `start`, or -1 when the
+ * comment never closes. Comments nest, and a backslash escapes the character after it
+ */
+const findCommentEnd = (str, start) => {
+    let depth = 0;
+    for (let i = start, len = str.length; i < len; i++) {
+        let chr = str.charAt(i);
+        if (chr === '\\') {
+            i++;
+        }
+        else if (chr === '(') {
+            depth++;
+        }
+        else if (chr === ')' && --depth === 0) {
+            return i;
+        }
+    }
+    return -1;
+};
 // Sets an own property on a plain object. A regular assignment with a
 // '__proto__' key would silently modify the object's prototype instead of
 // creating an own property, so it needs special handling.
@@ -22,6 +42,9 @@ const setOwnProperty = (obj, key, value) => {
         obj[key] = value;
     }
 };
+// Header names decodeHeaders() leaves out with the skipPrototypeKeys option. Keys are lowercased,
+// so of these only '__proto__' and 'constructor' can ever match
+const PROTOTYPE_KEYS = new Set(Object.getOwnPropertyNames(Object.prototype));
 // Whitespace that separates the tokens of a header value. Kept as a char comparison,
 // a regex test would be run for every single char of every parsed header
 const isWSP = (chr) => chr === ' ' || chr === '\t' || chr === '\r' || chr === '\n' || chr === '\f' || chr === '\v';
@@ -259,6 +282,18 @@ export class Libmime {
     normalizeCharset(charset) {
         return libcharset.normalizeCharset(charset);
     }
+    /**
+     * Creates a Transform stream that decodes a body in the given charset into UTF-8 Buffers,
+     * resolving the charset name and handling the Japanese charsets the same way header
+     * decoding does. An unknown or refused charset (UTF-7, base64, hex) is decoded as UTF-8,
+     * and the stream says so with `supported` set to false.
+     *
+     * @param {String} [charset='UTF-8'] Charset the input is encoded in
+     * @return {DecodeStream} Transform stream with `charset` and `supported` properties
+     */
+    createDecodeStream(charset) {
+        return libcharset.createDecodeStream(charset);
+    }
     /**
      * Decodes the inner payload of a single mime encoded-word into a unicode string.
      * Expects the three components of `=?charset?encoding?text?=` already separated.
@@ -417,9 +452,11 @@ export class Libmime {
      * header might have its own rules (eg. formatted email addresses and such)
      *
      * @param {String} headers Headers string
+     * @param {Object} [options] Options
+     * @param {Boolean} [options.skipPrototypeKeys] Leave out headers named like an Object.prototype member, eg. `__proto__` and `constructor`
      * @return {Object} An object of headers, where header keys are object keys and every value is an Array of the values for that key
      */
-    decodeHeaders(headers) {
+    decodeHeaders(headers, options) {
         let lines = headers.split(/\r?\n|\r/), headersObj = {}, header, i, len;
         // Empty lines in front of the block are not part of any header, a caller might
         // include the line break that separates a mime part boundary from its headers
@@ -445,6 +482,9 @@ export class Libmime {
         lines = unfolded;
         for (i = 0, len = lines.length; i < len; i++) {
             header = this.decodeHeader(lines[i]);
+            if (options?.skipPrototypeKeys && PROTOTYPE_KEYS.has(header.key)) {
+                continue;
+            }
             // own properties only, an attacker controlled key such as '__proto__' or 'toString' would
             // otherwise resolve to an inherited Object.prototype member
             if (!Object.hasOwn(headersObj, header.key)) {
@@ -513,9 +553,12 @@ export class Libmime {
      * decoded, so a caller that runs decodeWords() over the params has to leave them out
      *
      * @param {String} str Header value
+     * @param {Object} [options] Options, see ParseHeaderValueOptions
      * @return {Object} Header value as a parsed structure
      */
-    parseHeaderValue(str) {
+    parseHeaderValue(str, options) {
+        // Cleared again by an unclosed "(", see the loop
+        let stripComments = !!options?.stripComments;
         let response = {
             value: '',
             params: {}
@@ -535,10 +578,23 @@ export class Libmime {
         let valueEnd = 0;
         let stage = STAGE_VALUE;
         let quote = false;
+        // A quoted string has closed and the ";" that ends the parameter has not come yet
+        let quoteClosed = false;
         let escaped = false;
         let chr;
+        // Whether a "(" would continue the unquoted token of a parameter value, which it does
+        // right behind the "=" and behind a character of the token: `filename=Invoice(1).pdf`
+        // names the file and `boundary=(c)b` the boundary `(c)b`, as they do for Python and
+        // postal-mime. Anywhere else, in the type, in a parameter name, behind whitespace or
+        // behind a quoted string, a "(" opens a comment
+        let tokenOpen = false;
         // Stores the collected value, either as the default value, as the value for the
-        // current key, or as a key that has no value at all. Runs once per parameter
+        // current key, or as a key that has no value at all. Runs once per parameter.
+        //
+        // A parameter given twice keeps its first value, as it does for Python and for
+        // postal-mime. Letting the last one win read `boundary=b; boundary=c` as a multipart
+        // of the parts under `--c`, which the other readers leave in the epilogue of the
+        // parts under `--b`
         let commit = () => {
             let collected = value.substring(0, valueEnd);
             value = '';
@@ -546,21 +602,42 @@ export class Libmime {
             if (stage === STAGE_KEY) {
                 // key without a value, see emptykey:
                 // Header-Key: somevalue; key=value; emptykey
-                if (collected) {
-                    setOwnProperty(response.params, collected.toLowerCase(), '');
+                let name = collected.toLowerCase();
+                if (name && !Object.hasOwn(response.params, name)) {
+                    setOwnProperty(response.params, name, '');
                 }
             }
             else if (key === false) {
                 // default value
                 response.value = collected;
             }
-            else {
+            else if (!Object.hasOwn(response.params, key)) {
                 // subkey value
                 setOwnProperty(response.params, key, collected);
             }
         };
         for (let i = 0, len = str.length; i < len; i++) {
             chr = str.charAt(i);
+            // With stripComments, an rfc822 comment stands anywhere outside a quoted string
+            // but right behind a token it would continue. Read as content, `boundary=b (comment)`
+            // named a boundary no delimiter line matches, so the parts that Python and
+            // postal-mime find stayed hidden from a splitter built on this
+            if (stripComments && chr === '(' && !quote && !escaped && !tokenOpen) {
+                let end = findCommentEnd(str, i);
+                if (end < 0 && str.indexOf(';', i) < 0) {
+                    // A comment that never closes runs to the end of the value, as it does for
+                    // Python. One that a parameter follows is content instead, with everything
+                    // after it, so that the parameter survives, as postal-mime keeps it
+                    end = len - 1;
+                }
+                if (end >= 0) {
+                    i = end;
+                    continue;
+                }
+                // Looking for a closing ")" again would scan a run of unclosed "(" to its end
+                // once for each of them
+                stripComments = false;
+            }
             switch (stage) {
                 case STAGE_KEY:
                     if (chr === '=') {
@@ -568,6 +645,7 @@ export class Libmime {
                         value = '';
                         valueEnd = 0;
                         stage = STAGE_VALUE;
+                        tokenOpen = true;
                     }
                     else if (chr === ';') {
                         // key without a value, eg. the "inline" in "attachment; inline; filename=a.txt"
@@ -584,9 +662,19 @@ export class Libmime {
                     }
                     break;
                 case STAGE_VALUE:
+                    if (quoteClosed && chr !== ';') {
+                        // Nothing behind a closed quoted string reaches the value: a parameter
+                        // value is a token or a quoted string, not both (rfc2045 section 5.1),
+                        // so what follows one is junk up to the ";" that ends the parameter, as
+                        // Python and postal-mime read it. Read on, `boundary="b"c` named a
+                        // boundary bc that no delimiter line of the message matches
+                        escaped = false;
+                        break;
+                    }
                     if (escaped) {
                         value += chr;
                         valueEnd = value.length;
+                        tokenOpen = key !== false && !quote;
                     }
                     else if (chr === '\\') {
                         escaped = true;
@@ -594,20 +682,26 @@ export class Libmime {
                     }
                     else if (chr === '"') {
                         // every char between the quotes is significant, including whitespace
+                        quoteClosed = quote;
                         quote = !quote;
+                        tokenOpen = false;
                     }
                     else if (!quote && chr === ';') {
                         commit();
                         stage = STAGE_KEY;
+                        tokenOpen = false;
+                        quoteClosed = false;
                     }
                     else if (!quote && isWSP(chr)) {
                         if (value.length) {
                             value += chr;
                         }
+                        tokenOpen = false;
                     }
                     else {
                         value += chr;
                         valueEnd = value.length;
+                        tokenOpen = key !== false && !quote;
                     }
                     escaped = false;
                     break;

package/node_modules/libmime/dist/esm/types.d.ts

@@ -15,6 +15,34 @@ export interface HeaderLine {
  * Parsed header block, every key holds the values of all the header lines with that key
  */
 export type HeaderObject = Record<string, string[]>;
+/**
+ * Options of decodeHeaders()
+ */
+export interface DecodeHeadersOptions {
+    /**
+     * Leave out the headers whose name is also the name of an Object.prototype member, such as
+     * `__proto__` and `constructor`. By default they are kept as own properties of the result,
+     * where a lookup with the `in` operator or a merge into another object can not tell them
+     * apart from the inherited members
+     */
+    skipPrototypeKeys?: boolean | undefined;
+}
+/**
+ * Options of parseHeaderValue()
+ */
+export interface ParseHeaderValueOptions {
+    /**
+     * Drop the RFC 822 comments outside quoted strings. The MIME headers (Content-Type,
+     * Content-Disposition) allow them and they are not part of the value, so `boundary=b (comment)`
+     * names the boundary `b`. A parenthesis right behind the `=` of a parameter or behind a token
+     * of its value continues the token, as it does for Python and postal-mime: `filename=Invoice(1).pdf`
+     * keeps its name and `boundary=(c)b` names the boundary `(c)b`. A comment that never closes runs to the end
+     * of the value, unless a parameter follows it, in which case it is content and the parameter
+     * survives. By default comments are kept as they are, since a header such as
+     * Authentication-Results carries information in them
+     */
+    stripComments?: boolean | undefined;
+}
 /**
  * Header value with key=value parameters as returned by parseHeaderValue()
  */

package/node_modules/libmime/package.json

@@ -1,7 +1,7 @@
 {
     "name": "libmime",
     "description": "Encode and decode quoted printable and base64 strings",
-    "version": "5.5.2",
+    "version": "5.6.3",
     "type": "module",
     "main": "./dist/cjs/libmime.js",
     "types": "./dist/cjs/libmime.d.ts",
@@ -75,11 +75,11 @@
         "eslint": "10.13.0",
         "eslint-config-prettier": "10.1.8",
         "globals": "17.13.0",
-        "nodemailer": "10.1.6",
+        "nodemailer": "10.2.0",
         "prettier": "3.9.10",
         "tsx": "4.23.15",
         "typescript": "6.0.3",
-        "typescript-eslint": "8.71.2"
+        "typescript-eslint": "8.72.0"
     },
     "engines": {
         "node": ">=20.0.0"

package/node_modules/mailparser/CHANGELOG.md

@@ -1,5 +1,56 @@
 # Changelog
 
+## [3.12.4](https://github.com/nodemailer/mailparser/compare/v3.12.3...v3.12.4) (2026-10-22)
+
+
+### Bug Fixes
+
+* update dependencies ([fe3b459](https://github.com/nodemailer/mailparser/commit/fe3b4596140eccfdd8e224ab4576094e0e49ef54))
+
+## [3.12.3](https://github.com/nodemailer/mailparser/compare/v3.12.2...v3.12.3) (2026-10-22)
+
+
+### Bug Fixes
+
+* **deps:** bump mailsplit to 5.4.28 and libmime to 5.6.3 ([996a18f](https://github.com/nodemailer/mailparser/commit/996a18f06a8a7e93c3042e293a35f3abb4d159bf))
+* **deps:** bump mailsplit to 5.4.29, which reads an RFC 2231 filename the same way ([7ccd32b](https://github.com/nodemailer/mailparser/commit/7ccd32b72a1321543a02bddbfe0ef2c372ec0e0f))
+* drop the comments of a Content-Type or Content-Disposition in the headers map ([eaf345b](https://github.com/nodemailer/mailparser/commit/eaf345b8bb9c94866da3bf1722aede6a88a7e11b))
+* tell an RFC 2231 parameter apart by what libmime decoded, not by a second scan of the header ([eba8da2](https://github.com/nodemailer/mailparser/commit/eba8da294cd077d4816398a5499b14f1a79031d5))
+
+## [3.12.2](https://github.com/nodemailer/mailparser/compare/v3.12.1...v3.12.2) (2026-10-21)
+
+
+### Bug Fixes
+
+* the html and text forms parseAddressHeader() builds lazily can be assigned again ([bc6c421](https://github.com/nodemailer/mailparser/commit/bc6c4215c531a448c71540027c5ade74b4d60fab))
+
+## [3.12.1](https://github.com/nodemailer/mailparser/compare/v3.12.0...v3.12.1) (2026-10-21)
+
+
+### Bug Fixes
+
+* parseAddressHeader() builds the html and text forms only when they are read ([e08de61](https://github.com/nodemailer/mailparser/commit/e08de61740d04bdd534f8006d5b88eba6e4f89ed))
+
+## [3.12.0](https://github.com/nodemailer/mailparser/compare/v3.11.0...v3.12.0) (2026-10-21)
+
+
+### Features
+
+* parseAddressHeader() accepts decodePunycode: false to keep IDN domains in ASCII form ([0652c3f](https://github.com/nodemailer/mailparser/commit/0652c3fca470d975aed0e6ec5b1a4ca8e53d95f1))
+
+## [3.11.0](https://github.com/nodemailer/mailparser/compare/v3.10.0...v3.11.0) (2026-10-21)
+
+
+### Features
+
+* accept checksumAlgo: false to skip hashing attachments ([21f806c](https://github.com/nodemailer/mailparser/commit/21f806cd03b0b98644ad7a5b95678cc259f838db))
+* export parseAddressHeader() for parsing an address header value ([8ac364e](https://github.com/nodemailer/mailparser/commit/8ac364e330fbc815b45986a0f64251b382b88421))
+
+
+### Bug Fixes
+
+* decode text bodies with libmime's decode stream ([b9a5e41](https://github.com/nodemailer/mailparser/commit/b9a5e4125f1bf0a4aa88d275da5fbdb282cb779c))
+
 ## [3.10.0](https://github.com/nodemailer/mailparser/compare/v3.9.47...v3.10.0) (2026-10-19)
 
 

package/node_modules/mailparser/README.md

@@ -24,13 +24,44 @@ const mailparser = require('mailparser');
 or, from an ES module or TypeScript (type declarations are included):
 
 ```js
-import { simpleParser, MailParser } from 'mailparser';
+import { simpleParser, MailParser, parseAddressHeader } from 'mailparser';
 ```
 
 ## Usage
 
 See [mailparser homepage](https://nodemailer.com/extras/mailparser/) for documentation and terms.
 
+### Parsing an address header
+
+`parseAddressHeader(value, [options])` parses the value of an address header (`From`, `To`, `Cc`, `Reply-To` and the like) into the same `{ value, html, text }` object `MailParser` and `simpleParser` produce for one, for when the header comes from somewhere else than a message being parsed, for example an IMAP `HEADER.FIELDS` fetch.
+
+```js
+const { parseAddressHeader } = require('mailparser');
+
+parseAddressHeader('=?utf-8?Q?J=C3=B5geva?= <info@xn--mnchen-3ya.example>, Team: a@example.com;');
+// {
+//   value: [
+//     { address: 'info@münchen.example', name: 'Jõgeva' },
+//     { name: 'Team', group: [{ address: 'a@example.com', name: '' }] }
+//   ],
+//   html: '<span class="mp_address_group">...',
+//   text: '"Jõgeva" <info@münchen.example>, "Team": a@example.com;'
+// }
+```
+
+- **value** - the header value without the `Name:` prefix, as a string. Folded lines are fine, raw 8-bit bytes have to be decoded into the string first. An array of values (a repeated header) is parsed one value at a time and the addresses are listed in order. An empty or missing value gives an empty list
+- **options.flatten** - if `true`, every group is replaced with its members and the group names are dropped, so `value` lists mailboxes only
+
+Each entry of `value` has a `name` (an empty string when there is none, encoded words decoded) and either an `address` (a punycode domain decoded to Unicode) or, for a group, a `group` list of the same entries. RFC 2047 does not allow encoded words in the address itself, so an address part hiding one is kept only when it decodes to a plain `local@domain`, otherwise `address` is an empty string; a display name that decodes to something looking like an address stays a name.
+
+### Character sets
+
+Text bodies are decoded with libmime's `createDecodeStream()`, which resolves charset aliases, decodes the Japanese charsets iconv-lite does not support (ISO-2022-JP and friends) and keeps a multibyte character that is split across chunks intact. A body in a charset that is not known, or one that is refused, is decoded as UTF-8 with invalid bytes replaced by U+FFFD, the same fallback encoded words in headers get. The refused charsets are UTF-7 (and its aliases), which can carry markup past a filter that looks for `<` (`+ADw-script+AD4-` decodes to `<script>`), and the base64 and hex transfer encodings. A UTF-7 body therefore keeps its `+ADw-` sequences as literal text. The refusal applies with the `Iconv` option as well.
+
+### Attachment checksums
+
+Every attachment gets a `checksum` (hex, md5 unless the `checksumAlgo` option names another algorithm `crypto.createHash()` accepts) and a `size`. Set `checksumAlgo: false` to skip hashing altogether, for example where MD5 is not available (FIPS mode) or the checksum is not used. `checksum` is then not set on the attachments, `size` still is.
+
 ### Limits
 
 - `simpleParser` replaces `cid:` image references in the HTML with `data:` URLs. The total length of the URLs written into the HTML is capped by the `maxInlinedImagesSize` option (default 20 MB, counted in characters of the inserted URLs). References past the cap stay as `cid:` links. The same cap applies to URLs returned from a custom `updateImageLinks()` callback.

package/node_modules/mailparser/dist/cjs/address-header.d.ts

@@ -0,0 +1,19 @@
+import type { AddressObject, ParseAddressHeaderOptions } from './types.js';
+/**
+ * Parses the value of an address header (`From`, `To`, `Cc`, `Reply-To` and the like) into the
+ * {@link AddressObject} `MailParser` and `simpleParser` produce for one: display names have their
+ * encoded words decoded, an internationalized (punycode) domain is decoded to Unicode (unless
+ * `decodePunycode` is false), and an
+ * address part that hides an encoded word is dropped unless it decodes to a plain `local@domain`
+ * (RFC 2047 keeps encoded words out of the address, so `=?utf-8?B?...?=@example.com` naming
+ * another address is not taken at its word).
+ *
+ * The value is the header value without the `Name:` prefix, as a string. Line folding may be left
+ * in. Raw 8-bit bytes have to be decoded into the string first, eg. `buffer.toString('utf-8')`.
+ * Several values (a header that occurs more than once) can be given as an array: each is parsed
+ * on its own and the addresses are listed in order.
+ *
+ * @param value The header value, or several of them
+ * @param options See {@link ParseAddressHeaderOptions}
+ */
+export declare function parseAddressHeader(value: string | string[] | null | undefined, options?: ParseAddressHeaderOptions): AddressObject;

package/node_modules/mailparser/dist/cjs/address-header.js

@@ -0,0 +1,185 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeAddresses = decodeAddresses;
+exports.formatAddressesHTML = formatAddressesHTML;
+exports.formatAddressesText = formatAddressesText;
+exports.parseAddressHeader = parseAddressHeader;
+const he_1 = __importDefault(require("he"));
+const libmime_1 = __importDefault(require("libmime"));
+const addressparser_1 = __importDefault(require("nodemailer/lib/addressparser"));
+const punycode_js_1 = __importDefault(require("punycode.js"));
+// An RFC 2047 encoded word
+const ENCODED_WORD = /[=]\?[^?]+\?[BbQq]\?[^?]*\?[=]/;
+/**
+ * Decodes the addresses addressparser produced, in place: encoded words in display names, an
+ * internationalized (punycode) domain, and the members of a group.
+ *
+ * @internal
+ */
+function decodeAddresses(addresses, decoder = libmime_1.default, decodePunycode = true) {
+    for (let address of addresses) {
+        address.name = (address.name || '').toString().trim();
+        // An encoded word decodes into the display name and nothing else, whatever it
+        // decodes to. RFC 2047 section 5 keeps encoded words out of the addr-spec, so a
+        // name that decodes to "CEO" <ceo@bank.com> is still only a name: parsing it
+        // again would report an address the header never carried
+        if (address.name) {
+            try {
+                address.name = decoder.decodeWords(address.name);
+            }
+            catch {
+                //ignore, keep as is
+            }
+        }
+        // Security fix: detect RFC 2047 encoded-words in the address field.
+        // Per RFC 2047 Section 5, encoded-words MUST NOT appear in addr-spec.
+        // If found, decode and validate; reject if result is not a simple local@domain.
+        if (address.address && ENCODED_WORD.test(address.address)) {
+            try {
+                let decodedAddr = decoder.decodeWords(address.address);
+                if (/^[^\s@]+@[^\s@]+$/.test(decodedAddr) && !/[=]\?/.test(decodedAddr)) {
+                    address.address = decodedAddr;
+                }
+                else {
+                    address.address = '';
+                }
+            }
+            catch {
+                address.address = '';
+            }
+        }
+        if (decodePunycode && address.address && /@xn--/.test(address.address)) {
+            try {
+                address.address =
+                    address.address.slice(0, address.address.lastIndexOf('@') + 1) +
+                        punycode_js_1.default.toUnicode(address.address.slice(address.address.lastIndexOf('@') + 1));
+            }
+            catch {
+                // Not a valid punycode string; keep as is
+            }
+        }
+        if (address.group) {
+            decodeAddresses(address.group, decoder, decodePunycode);
+        }
+    }
+}
+/**
+ * Formats parsed addresses for an HTML context, every value HTML-escaped.
+ *
+ * @internal
+ */
+function formatAddressesHTML(value) {
+    let formatSingleLevel = (addresses) => addresses
+        .map(address => {
+        let str = '<span class="mp_address_group">';
+        if (address.name) {
+            str += '<span class="mp_address_name">' + he_1.default.encode(address.name) + (address.group ? ': ' : '') + '</span>';
+        }
+        if (address.address) {
+            let link = '<a href="mailto:' + he_1.default.encode(address.address) + '" class="mp_address_email">' + he_1.default.encode(address.address) + '</a>';
+            if (address.name) {
+                str += ' &lt;' + link + '&gt;';
+            }
+            else {
+                str += link;
+            }
+        }
+        if (address.group) {
+            str += formatSingleLevel(address.group) + ';';
+        }
+        return str + '</span>';
+    })
+        .join(', ');
+    return formatSingleLevel([].concat(value || []));
+}
+/**
+ * Formats parsed addresses as plain text, display names quoted.
+ *
+ * @internal
+ */
+function formatAddressesText(value) {
+    let formatSingleLevel = (addresses) => addresses
+        .map(address => {
+        let str = '';
+        if (address.name) {
+            // a quoted-string, so a quote or backslash inside the name is escaped
+            str += `"${address.name.replace(/["\\]/g, '\\$&')}"` + (address.group ? ': ' : '');
+        }
+        if (address.address) {
+            let link = address.address;
+            if (address.name) {
+                str += ' <' + link + '>';
+            }
+            else {
+                str += link;
+            }
+        }
+        if (address.group) {
+            str += formatSingleLevel(address.group) + ';';
+        }
+        return str;
+    })
+        .join(', ');
+    return formatSingleLevel([].concat(value || []));
+}
+/**
+ * Parses the value of an address header (`From`, `To`, `Cc`, `Reply-To` and the like) into the
+ * {@link AddressObject} `MailParser` and `simpleParser` produce for one: display names have their
+ * encoded words decoded, an internationalized (punycode) domain is decoded to Unicode (unless
+ * `decodePunycode` is false), and an
+ * address part that hides an encoded word is dropped unless it decodes to a plain `local@domain`
+ * (RFC 2047 keeps encoded words out of the address, so `=?utf-8?B?...?=@example.com` naming
+ * another address is not taken at its word).
+ *
+ * The value is the header value without the `Name:` prefix, as a string. Line folding may be left
+ * in. Raw 8-bit bytes have to be decoded into the string first, eg. `buffer.toString('utf-8')`.
+ * Several values (a header that occurs more than once) can be given as an array: each is parsed
+ * on its own and the addresses are listed in order.
+ *
+ * @param value The header value, or several of them
+ * @param options See {@link ParseAddressHeaderOptions}
+ */
+function parseAddressHeader(value, options) {
+    let addresses = [];
+    for (let entry of [].concat(value)) {
+        if (typeof entry !== 'string' || !entry) {
+            continue;
+        }
+        let parsed = (0, addressparser_1.default)(entry, { flatten: !!options?.flatten });
+        decodeAddresses(parsed, libmime_1.default, options?.decodePunycode !== false);
+        for (let address of parsed) {
+            addresses.push(address);
+        }
+    }
+    return withLazyFormats(addresses);
+}
+/**
+ * The AddressObject for parsed addresses, with `html` and `text` built on first read: a caller
+ * that only wants the addresses (eg. for an SMTP envelope) pays for neither. Both stay enumerable
+ * and assignable, to read, compare, serialize and overwrite like the plain values they were.
+ */
+function withLazyFormats(addresses) {
+    let html;
+    let text;
+    const result = { value: addresses };
+    Object.defineProperties(result, {
+        html: {
+            enumerable: true,
+            get: () => (html ??= formatAddressesHTML(addresses)),
+            set: value => {
+                html = value;
+            }
+        },
+        text: {
+            enumerable: true,
+            get: () => (text ??= formatAddressesText(addresses)),
+            set: value => {
+                text = value;
+            }
+        }
+    });
+    return result;
+}

package/node_modules/mailparser/dist/cjs/index.d.ts

@@ -1,10 +1,12 @@
 import MailParser from './mail-parser.js';
 import simpleParser from './simple-parser.js';
-export { MailParser, simpleParser };
+import { parseAddressHeader } from './address-header.js';
+export { MailParser, simpleParser, parseAddressHeader };
 export type { SimpleParserCallback } from './simple-parser.js';
 export type * from './types.js';
 declare const _default: {
     MailParser: typeof MailParser;
     simpleParser: typeof simpleParser;
+    parseAddressHeader: typeof parseAddressHeader;
 };
 export default _default;

package/node_modules/mailparser/dist/cjs/index.js

@@ -3,10 +3,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.simpleParser = exports.MailParser = void 0;
+exports.parseAddressHeader = exports.simpleParser = exports.MailParser = void 0;
 const mail_parser_js_1 = __importDefault(require("./mail-parser.js"));
 exports.MailParser = mail_parser_js_1.default;
 const simple_parser_js_1 = __importDefault(require("./simple-parser.js"));
 exports.simpleParser = simple_parser_js_1.default;
-exports.default = { MailParser: mail_parser_js_1.default, simpleParser: simple_parser_js_1.default };
+const address_header_js_1 = require("./address-header.js");
+Object.defineProperty(exports, "parseAddressHeader", { enumerable: true, get: function () { return address_header_js_1.parseAddressHeader; } });
+exports.default = { MailParser: mail_parser_js_1.default, simpleParser: simple_parser_js_1.default, parseAddressHeader: address_header_js_1.parseAddressHeader };
 Object.defineProperty(exports, 'default', { value: exports, enumerable: false, writable: true, configurable: true });