@mavogel/awscdk-rootmail 0.1.27 → 0.1.28

package/node_modules/@zone-eu/mailsplit/lib/mime-node.js

@@ -12,7 +12,7 @@ const pathlib = require('path');
 /** @typedef {import('..').PartNumberItem} PartNumberItem */
 /** @typedef {import('..').PartNumber} PartNumber */
 /** @typedef {import('..').SplitterOptions} SplitterOptions */
-/** @typedef {import('libmime').StructuredHeader} StructuredHeader */
+/** @typedef {import('libmime').ParsedHeaderValue} StructuredHeader */
 /** @typedef {import('stream').Transform | import('stream').PassThrough} ContentStream */
 /** @typedef {import('..').MimeNode} MimeNodeType */
 
@@ -27,6 +27,9 @@ const HEADER_LINE_MIN_COST = 64;
  * `value.replace(/\(.*\)/g, '')`, but in linear time. The regex backtracks quadratically
  * on a value with many `(` characters and no closing `)`.
  *
+ * Used for the Content-Transfer-Encoding only. The MIME headers with parameters go through
+ * libmime's parseHeaderValue with stripComments, which knows where a comment may stand.
+ *
  * @param {string} value
  * @returns {string}
  */
@@ -48,59 +51,6 @@ function stripComments(value) {
         .join('');
 }
 
-/**
- * Lists the parameters a header value gives in RFC 2231 form (`name*=`, `name*0=` or
- * `name*0*=`). libmime decodes those while parsing the header, so the result must not
- * go through `decodeWords` as well: a value like `filename*=utf-8''a%3D%3Futf-8%3FQ%3F%3D2Eexe%3F%3D`
- * would otherwise come out as `a.exe` while a parser that decodes once sees the encoded word.
- *
- * @param {string} value Raw header value.
- * @returns {Set<string>} Lowercased parameter names.
- */
-function rfc2231ParamNames(value) {
-    let names = new Set();
-    let quote = false;
-    let escaped = false;
-    let start = 0;
-
-    /**
-     * @param {number} end End offset of the segment starting at `start`.
-     * @returns {void}
-     */
-    let addSegment = end => {
-        let segment = value.substring(start, end);
-        let eq = segment.indexOf('=');
-        if (eq < 0) {
-            return;
-        }
-        let match = segment
-            .substring(0, eq)
-            .trim()
-            .toLowerCase()
-            .match(/^(.+?)\*(\d+\*?)?$/);
-        if (match) {
-            names.add(match[1]);
-        }
-    };
-
-    for (let i = 0; i < value.length; i++) {
-        let chr = value.charAt(i);
-        if (escaped) {
-            escaped = false;
-        } else if (chr === '\\') {
-            escaped = true;
-        } else if (chr === '"') {
-            quote = !quote;
-        } else if (chr === ';' && !quote) {
-            addSegment(i);
-            start = i + 1;
-        }
-    }
-    addSegment(value.length);
-
-    return names;
-}
-
 /**
  * Parsed MIME node with mutable headers and transfer-encoding helpers.
  */
@@ -216,8 +166,14 @@ class MimeNode {
         this._headersLines = [];
         let headers = this.headers;
 
+        // The comments of the MIME headers are dropped, so that `boundary=b (comment)` names
+        // the boundary `b` that postal-mime and Python's email.policy.default split by. Read as
+        // content, it matched no delimiter line and the parts both of them find stayed hidden
+        // here. Python's legacy compat32 policy, the default of message_from_bytes() without a
+        // policy, keeps the comment and splits by `--b (comment)` lines instead: a split
+        // against it is the price of agreeing with the two readers a renderer is built on
         let dispositionHeader = headers.getFirst('Content-Disposition');
-        this._parsedContentDisposition = this.libmime.parseHeaderValue(dispositionHeader);
+        this._parsedContentDisposition = this.libmime.parseHeaderValue(dispositionHeader, { stripComments: true });
         let parsedContentDisposition = /** @type {StructuredHeader} */ (this._parsedContentDisposition);
 
         // if content-type is missing default to plaintext
@@ -240,9 +196,12 @@ class MimeNode {
             }
         }
 
-        this._parsedContentType = this.libmime.parseHeaderValue(contentHeader);
+        this._parsedContentType = this.libmime.parseHeaderValue(contentHeader, { stripComments: true });
         let parsedContentType = /** @type {StructuredHeader} */ (this._parsedContentType);
 
+        // The encoding is a bare token, and one written in quotes stays quoted, so that
+        // "base64" is not decoded, as Python and postal-mime do not decode it. parseHeaderValue
+        // would unquote it, so the transfer encoding keeps its own comment stripper
         this.encoding = stripComments(headers.getFirst('Content-Transfer-Encoding')).toLowerCase().trim();
         this.contentType = (parsedContentType.value || '').toLowerCase().trim() || false;
         this.charset = parsedContentType.params.charset || false;
@@ -259,7 +218,11 @@ class MimeNode {
 
         this.filename = parsedContentDisposition.params.filename || parsedContentType.params.name || false;
 
-        if (parsedContentType.params.format && parsedContentType.params.format.toLowerCase().trim() === 'flowed') {
+        // format=flowed is defined for text/plain (RFC 3676), and a browser never unfolds an
+        // html part. Flagged on any text part, a text/html part with delsp=yes had its
+        // `<scri \r\npt>` joined into a script tag by the consumer that unfolded it, a tag
+        // neither Python nor a browser given the raw bytes sees
+        if (this.contentType === 'text/plain' && parsedContentType.params.format && parsedContentType.params.format.toLowerCase().trim() === 'flowed') {
             this.flowed = true;
             if (parsedContentType.params.delsp && parsedContentType.params.delsp.toLowerCase().trim() === 'yes') {
                 this.delSp = true;
@@ -267,10 +230,15 @@ class MimeNode {
         }
 
         if (this.filename) {
-            // a parameter given in RFC 2231 form was decoded by libmime already
+            // A parameter given in RFC 2231 form was decoded by libmime already, which names
+            // it in decodedParams, and must not go through decodeWords as well:
+            // filename*=utf-8''a%3D%3Futf-8%3FQ%3F%3D2Eexe%3F%3D would otherwise come out as
+            // a.exe while a parser that decodes once sees the encoded word. A second scan of
+            // the raw header for the name used to decide this, and read `(c)filename*=` as
+            // a parameter named `(c)filename` once the comment was dropped from the real one
             let decoded = parsedContentDisposition.params.filename
-                ? rfc2231ParamNames(dispositionHeader).has('filename')
-                : rfc2231ParamNames(contentHeader).has('name');
+                ? parsedContentDisposition.decodedParams.includes('filename')
+                : parsedContentType.decodedParams.includes('name');
             if (!decoded) {
                 try {
                     this.filename = this.libmime.decodeWords(this.filename);
@@ -285,7 +253,16 @@ class MimeNode {
                 this.contentType.substr(0, this.contentType.indexOf('/')) === 'multipart' &&
                 this.contentType.substr(this.contentType.indexOf('/') + 1)) ||
             false;
-        this._boundary = (parsedContentType.params.boundary && Buffer.from(parsedContentType.params.boundary)) || false;
+        // A boundary is ASCII and does not end in whitespace (RFC 2046 5.1.1, bchars), and
+        // Python matches no line against one that is not. One holding a non-ASCII character
+        // came out of a header read as latin1 or as UTF-8, and matched under `--ab\xC3\xA9cd`
+        // lines parts that a scanner built on Python never saw. Such a boundary counts as
+        // none, as a boundary parameter that is missing does. Trailing whitespace is dropped
+        // as Python drops it, a delimiter line may end in whitespace anyway
+        let boundary = (parsedContentType.params.boundary || '').trimEnd();
+        // a non-ASCII character takes more than one byte in UTF-8
+        let ascii = Buffer.byteLength(boundary) === boundary.length;
+        this._boundary = boundary && ascii ? Buffer.from(boundary) : false;
 
         this.rfc822 = this.contentType === 'message/rfc822';
 

package/node_modules/@zone-eu/mailsplit/lib/types.d.ts

@@ -107,7 +107,7 @@ export interface MimeNode {
     /** Decoded filename from Content-Disposition or Content-Type parameters, or `false` when absent. */
     filename: string | false;
 
-    /** Whether this node is `text/*` with `format=flowed`. */
+    /** Whether this node is `text/plain` with `format=flowed`. */
     flowed: boolean;
 
     /** Whether flowed text uses `delsp=yes`. */

package/node_modules/@zone-eu/mailsplit/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@zone-eu/mailsplit",
-    "version": "5.4.27",
+    "version": "5.4.29",
     "description": "Split email messages into an object stream",
     "main": "index.js",
     "types": "index.d.ts",
@@ -25,7 +25,7 @@
     "license": "(MIT OR EUPL-1.1+)",
     "dependencies": {
         "libbase64": "1.4.1",
-        "libmime": "5.5.2",
+        "libmime": "5.6.3",
         "libqp": "3.0.1"
     },
     "devDependencies": {

package/node_modules/libmime/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## [5.6.3](https://github.com/nodemailer/libmime/compare/v5.6.2...v5.6.3) (2026-10-22)
+
+
+### Bug Fixes
+
+* drop what follows a closed quoted string up to the next parameter ([d2324b8](https://github.com/nodemailer/libmime/commit/d2324b8146896c580308a9d81fa539198b963850))
+
+## [5.6.2](https://github.com/nodemailer/libmime/compare/v5.6.1...v5.6.2) (2026-10-22)
+
+
+### Bug Fixes
+
+* continue the token of a parameter value with a parenthesis right behind the equals sign ([9bcc718](https://github.com/nodemailer/libmime/commit/9bcc7187734f7fb9e3573aa488dd7a0c47ae4adf))
+
+## [5.6.1](https://github.com/nodemailer/libmime/compare/v5.6.0...v5.6.1) (2026-10-22)
+
+
+### Bug Fixes
+
+* drop the comments of a MIME header value with the stripComments option ([2c36976](https://github.com/nodemailer/libmime/commit/2c369764904ec1e41535fc010d3b048e605330e3))
+* keep the first value of a duplicated parameter ([c6f9df5](https://github.com/nodemailer/libmime/commit/c6f9df58312ff40a551abc5522a11bac1841a6cf))
+
+## [5.6.0](https://github.com/nodemailer/libmime/compare/v5.5.2...v5.6.0) (2026-10-21)
+
+
+### Features
+
+* add a skipPrototypeKeys option to decodeHeaders() ([cfbf67d](https://github.com/nodemailer/libmime/commit/cfbf67dce5074f954ffcf05b04129473ebd40ef6))
+* add createDecodeStream() for decoding a body in any charset ([dbc96a0](https://github.com/nodemailer/libmime/commit/dbc96a06e0e38f5ca45a30dac602cb525e2b0c02))
+
+
+### Bug Fixes
+
+* read the byte order of UTF-16 from the BOM ([a9332ee](https://github.com/nodemailer/libmime/commit/a9332ee23cf0527854cc89f6ea6b438d51ca1e29))
+* resolve the x-mac charset labels and Big5-HKSCS ([40d9eda](https://github.com/nodemailer/libmime/commit/40d9eda949b9d086ccb4c47b34811a439a14a8f8))
+
 ## [5.5.2](https://github.com/nodemailer/libmime/compare/v5.5.1...v5.5.2) (2026-10-19)
 
 

package/node_modules/libmime/README.md

@@ -29,7 +29,7 @@ import { Libmime } from 'libmime';
 const mime = new Libmime();
 ```
 
-The helper modules can be loaded directly as well, for example `libmime/lib/charset` (`encode`, `decode`, `convert`, `normalizeCharset`) and `libmime/lib/mimetypes` (`list`, `extensions`).
+The helper modules can be loaded directly as well, for example `libmime/lib/charset` (`encode`, `decode`, `convert`, `normalizeCharset`, `createDecodeStream`, `DecodeStream`) and `libmime/lib/mimetypes` (`list`, `extensions`).
 
 ### TypeScript
 
@@ -137,18 +137,27 @@ Parses a block of header lines. Does not decode mime words as every header might
 
 Return value is an object of headers, where header keys are object keys and values are arrays.
 
-    libmime.decodeHeaders(headers) → Object
+    libmime.decodeHeaders(headers[, options]) → Object
 
 - **headers** - Headers string
+- **options** - Optional options object
+    - **skipPrototypeKeys** - if `true`, headers named like an `Object.prototype` member (`__proto__`, `constructor`) are left out. By default they are kept as own properties of the result
 
 #### #parseHeaderValue
 
 Parses a header value with `key=value` arguments into a structured object. Useful when dealing with
 `content-type` and such. Continuation encoded params are joined into mime encoded words.
 
-    parseHeaderValue(valueString) → Object
+    parseHeaderValue(valueString[, options]) → Object
 
 - **valueString** - a header value without the key
+- **options** - optional options object
+    - **stripComments** - if `true`, RFC 822 comments outside quoted strings are dropped, so `boundary=b (comment)` gives the boundary `b`. A parenthesis right behind the `=` of a parameter or behind a token of its value continues the token, `filename=Invoice(1).pdf` keeps its name and `boundary=(c)b` names the boundary `(c)b`, as both do for Python and postal-mime. A comment that never closes runs to the end of the value, unless a parameter follows it, in which case it is content and the parameter survives. Use it for the MIME headers (`Content-Type`, `Content-Disposition`). By default comments are kept, since a header such as `Authentication-Results` carries information in them
+
+A parameter value is a token or a quoted string, so what follows a closed quoted string up to the next `;` is
+dropped (`boundary="b"c` gives `b`), and a parameter that occurs more than once keeps its first value, both as Python and postal-mime read them. An RFC 2231
+continuation overrides the plain parameter of the same name in either order, libmime's own rule after RFC 6266
+section 4.3.
 
 **Example**
 
@@ -207,6 +216,34 @@ Content-disposition: attachment; filename*0*=utf-8''filename%20
   filename*1*=%C3%B5%C3%A4%C3%B6; filename*2*=%C3%BC.txt
 ```
 
+### Charsets
+
+#### #normalizeCharset
+
+Resolves a charset name to its canonical form, eg. `win-1257` becomes `windows-1257`. Unknown names are returned uppercased.
+
+    libmime.normalizeCharset(charset) → String
+
+#### #createDecodeStream
+
+Creates a Transform stream that decodes bytes in a charset into UTF-8 Buffers, for example a message body. The output is what decoding the whole input at once gives, however it is split into chunks. The charset name is resolved the same way as for encoded words, the Japanese charsets iconv-lite does not support (ISO-2022-JP and friends) are decoded with encoding-japanese, which is not incremental, so such input is collected until the stream ends. The double byte charsets (Shift_JIS, GBK, GB18030, Big5, EUC-KR, EUC-JP) are decoded up to the last byte below 0x30 (a space, a line break, most ASCII punctuation) of what has arrived, so input without any such byte is held until the stream ends as well.
+
+    libmime.createDecodeStream(charset) → DecodeStream
+
+- **charset** - Charset the input is encoded in, defaults to UTF-8
+
+The stream has two extra properties:
+
+- **charset** - the canonical charset name
+- **supported** - `false` when the charset is unknown or refused (UTF-7, which could smuggle markup past filters, and the base64 and hex transfer encodings). The input is then decoded as UTF-8 regardless, invalid bytes replaced with U+FFFD, the same fallback encoded words get. Check it before piping when the bytes must not be relabelled as UTF-8, for example to keep the original part as it is
+
+```javascript
+const stream = libmime.createDecodeStream('iso-8859-1');
+if (stream.supported) {
+    body.pipe(stream).pipe(output);
+}
+```
+
 ### MIME Types
 
 #### #detectExtension

package/node_modules/libmime/dist/cjs/charset.d.ts

@@ -1,4 +1,6 @@
 import { Buffer } from 'node:buffer';
+import { Transform } from 'node:stream';
+import type { TransformCallback } from 'node:stream';
 /**
  * Encodes an unicode string into an Buffer object as UTF-8
  *
@@ -34,10 +36,44 @@ export declare function convert(data: string | Buffer, fromCharset?: string): Bu
  * @return Canonicalized charset name
  */
 export declare function normalizeCharset(charset?: unknown): string;
+/**
+ * Transform stream that decodes bytes in a charset into UTF-8 Buffers, see createDecodeStream()
+ */
+export declare class DecodeStream extends Transform {
+    /** Canonical name of the charset the input was declared in, what normalizeCharset() gives */
+    readonly charset: string;
+    /**
+     * false when the declared charset is unknown, or one that is refused (UTF-7, base64, hex). The
+     * input is then decoded as UTF-8, the same fallback decode() applies, so a caller that must
+     * not relabel such bytes as UTF-8 checks this before piping anything through
+     */
+    readonly supported: boolean;
+    private decoder;
+    private chunks;
+    private highSurrogate;
+    constructor(charset?: unknown);
+    _transform(chunk: Buffer, _encoding: BufferEncoding, done: TransformCallback): void;
+    _flush(done: TransformCallback): void;
+    private pushText;
+}
+/**
+ * Creates a Transform stream that decodes bytes in the given charset into UTF-8 Buffers. The
+ * charset name is resolved with normalizeCharset(), and the output is what decode() gives for
+ * the whole input, however it is split into chunks: the Japanese charsets iconv-lite does not
+ * support are decoded with encoding-japanese (collected until the input ends, as that decoder
+ * is not incremental), and an unknown or refused charset (UTF-7, base64, hex) is decoded as
+ * UTF-8 with `supported` set to false on the stream.
+ *
+ * @param [charset='UTF-8'] Charset the input is encoded in
+ * @return Transform stream with `charset` and `supported` properties
+ */
+export declare function createDecodeStream(charset?: unknown): DecodeStream;
 declare const _default: {
     encode: typeof encode;
     decode: typeof decode;
     convert: typeof convert;
     normalizeCharset: typeof normalizeCharset;
+    createDecodeStream: typeof createDecodeStream;
+    DecodeStream: typeof DecodeStream;
 };
 export default _default;

package/node_modules/libmime/dist/cjs/charset.js

@@ -3,11 +3,15 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DecodeStream = void 0;
 exports.encode = encode;
 exports.decode = decode;
 exports.convert = convert;
 exports.normalizeCharset = normalizeCharset;
+exports.createDecodeStream = createDecodeStream;
 const node_buffer_1 = require("node:buffer");
+const node_stream_1 = require("node:stream");
+const node_string_decoder_1 = require("node:string_decoder");
 const iconv_lite_1 = __importDefault(require("iconv-lite"));
 const encoding_japanese_1 = __importDefault(require("encoding-japanese"));
 const charsets_js_1 = __importDefault(require("./charsets.js"));
@@ -31,6 +35,8 @@ const isUnsupportedCodec = (name) => {
         return false;
     }
 };
+// Charsets iconv-lite does not support, decoded with encoding-japanese instead
+const JAPANESE_CHARSET = /^jis|^iso-?2022-?jp|^EUCJP/i;
 // Own entries only, so that a name such as '__proto__' or 'constructor' does not resolve to an
 // inherited Object.prototype member
 const CHARSET_ALIASES = new Map(Object.entries(charsets_js_1.default));
@@ -63,7 +69,7 @@ function decode(buf, fromCharset) {
         return buf.toString();
     }
     try {
-        if (/^jis|^iso-?2022-?jp|^EUCJP/i.test(fromCharset)) {
+        if (JAPANESE_CHARSET.test(fromCharset)) {
             if (typeof buf === 'string') {
                 buf = node_buffer_1.Buffer.from(buf);
             }
@@ -131,5 +137,162 @@ function normalizeCharset(charset) {
     // updated pass
     return CHARSET_ALIASES.get(name) || name.toUpperCase();
 }
-exports.default = { encode, decode, convert, normalizeCharset };
+// The decoder all of iconv-lite's double byte codecs share
+const DBCS_DECODER = iconv_lite_1.default.getCodec('gbk').decoder;
+// The UTF-16 and UTF-32 decoders without a byte order in the name read it from a BOM or guess it
+// from the first 100 characters, but a stream guesses as soon as it has 16 or 32 bytes. Holding
+// back this many bytes makes the stream guess from the same characters as decode()
+const BYTE_ORDER_GUESSING = new Map([
+    [iconv_lite_1.default.getCodec('utf-16'), 200],
+    [iconv_lite_1.default.getCodec('utf-32'), 400]
+]);
+// iconv-lite 0.7 sizes what a DBCS decoder's write() returns by the length of the chunk, so when
+// the chunk finishes or rejects a character the previous one started, the output can outgrow
+// that size and its end is cut off: an astral GB18030 character split in two loses its low
+// surrogate, a GB18030 lead byte followed by a space loses everything after it. The input is
+// therefore cut where no character can be unfinished, right after a byte below 0x30. No lead,
+// trail or GB18030 digit byte is that low, so such a byte always decodes as itself and the
+// parse starts afresh after it. Every cut is decoded as a whole, with nothing carried over, and
+// the bytes after the last such byte wait for the next chunk
+class LowByteCutDecoder {
+    constructor(charset) {
+        this.pending = [];
+        this.charset = charset;
+    }
+    write(chunk) {
+        let cut = chunk.length;
+        while (cut > 0 && chunk[cut - 1] >= 0x30) {
+            cut--;
+        }
+        if (!cut) {
+            // copied, the caller may reuse the chunk it wrote
+            this.pending.push(node_buffer_1.Buffer.from(chunk));
+            return '';
+        }
+        let text = iconv_lite_1.default.decode(node_buffer_1.Buffer.concat([...this.pending, chunk.subarray(0, cut)]), this.charset);
+        this.pending = [node_buffer_1.Buffer.from(chunk.subarray(cut))];
+        return text;
+    }
+    end() {
+        let rest = node_buffer_1.Buffer.concat(this.pending);
+        this.pending = [];
+        return rest.length ? iconv_lite_1.default.decode(rest, this.charset) : undefined;
+    }
+}
+// Passes the input on once its first `size` bytes are in, see BYTE_ORDER_GUESSING
+class HeadBufferedDecoder {
+    constructor(decoder, size) {
+        this.head = [];
+        this.headLength = 0;
+        this.decoder = decoder;
+        this.size = size;
+    }
+    write(chunk) {
+        if (!this.head) {
+            return this.decoder.write(chunk);
+        }
+        // copied, the caller may reuse the chunk it wrote
+        this.head.push(node_buffer_1.Buffer.from(chunk));
+        this.headLength += chunk.length;
+        return this.headLength < this.size ? '' : this.releaseHead();
+    }
+    end() {
+        return (this.head ? this.releaseHead() : '') + (this.decoder.end() || '');
+    }
+    releaseHead() {
+        let head = node_buffer_1.Buffer.concat(this.head || []);
+        this.head = null;
+        return this.decoder.write(head);
+    }
+}
+// Picks the decoder for a charset iconv-lite knows
+function createChunkDecoder(charset) {
+    let codec = iconv_lite_1.default.getCodec(charset);
+    if (codec.decoder === DBCS_DECODER) {
+        return new LowByteCutDecoder(charset);
+    }
+    let headSize = BYTE_ORDER_GUESSING.get(codec);
+    return headSize ? new HeadBufferedDecoder(iconv_lite_1.default.getDecoder(charset), headSize) : iconv_lite_1.default.getDecoder(charset);
+}
+/**
+ * Transform stream that decodes bytes in a charset into UTF-8 Buffers, see createDecodeStream()
+ */
+class DecodeStream extends node_stream_1.Transform {
+    constructor(charset) {
+        super();
+        // null for the Japanese charsets, which are collected and decoded when the input ends
+        this.decoder = null;
+        this.chunks = [];
+        this.highSurrogate = '';
+        this.charset = normalizeCharset(charset || 'UTF-8');
+        if (UTF8_COMPATIBLE.test(this.charset)) {
+            this.supported = true;
+            this.decoder = new node_string_decoder_1.StringDecoder('utf-8');
+        }
+        else if (isUnsupportedCodec(this.charset) || !(JAPANESE_CHARSET.test(this.charset) || iconv_lite_1.default.encodingExists(this.charset))) {
+            this.supported = false;
+            this.decoder = new node_string_decoder_1.StringDecoder('utf-8');
+        }
+        else {
+            this.supported = true;
+            // encoding-japanese has no incremental decoder and ISO-2022-JP is stateful, so the
+            // Japanese charsets are left without one
+            this.decoder = JAPANESE_CHARSET.test(this.charset) ? null : createChunkDecoder(this.charset);
+        }
+    }
+    _transform(chunk, _encoding, done) {
+        if (!this.decoder) {
+            this.chunks.push(chunk);
+            return done();
+        }
+        try {
+            this.pushText(this.decoder.write(chunk), false);
+        }
+        catch (err) {
+            return done(err);
+        }
+        done();
+    }
+    _flush(done) {
+        try {
+            this.pushText(this.decoder ? this.decoder.end() : decode(node_buffer_1.Buffer.concat(this.chunks), this.charset), true);
+        }
+        catch (err) {
+            return done(err);
+        }
+        this.chunks = [];
+        done();
+    }
+    // A decoder may return the two halves of a surrogate pair from separate writes, and a lone
+    // half would turn into U+FFFD on its way to UTF-8, so a trailing high surrogate waits for
+    // the rest of its character
+    pushText(text, final) {
+        text = this.highSurrogate + (text || '');
+        this.highSurrogate = '';
+        let last = text.charCodeAt(text.length - 1);
+        if (!final && last >= 0xd800 && last <= 0xdbff) {
+            this.highSurrogate = text.slice(-1);
+            text = text.slice(0, -1);
+        }
+        if (text) {
+            this.push(node_buffer_1.Buffer.from(text, 'utf-8'));
+        }
+    }
+}
+exports.DecodeStream = DecodeStream;
+/**
+ * Creates a Transform stream that decodes bytes in the given charset into UTF-8 Buffers. The
+ * charset name is resolved with normalizeCharset(), and the output is what decode() gives for
+ * the whole input, however it is split into chunks: the Japanese charsets iconv-lite does not
+ * support are decoded with encoding-japanese (collected until the input ends, as that decoder
+ * is not incremental), and an unknown or refused charset (UTF-7, base64, hex) is decoded as
+ * UTF-8 with `supported` set to false on the stream.
+ *
+ * @param [charset='UTF-8'] Charset the input is encoded in
+ * @return Transform stream with `charset` and `supported` properties
+ */
+function createDecodeStream(charset) {
+    return new DecodeStream(charset);
+}
+exports.default = { encode, decode, convert, normalizeCharset, createDecodeStream, DecodeStream };
 Object.defineProperty(exports, 'default', { value: exports, enumerable: false, writable: true, configurable: true });

package/node_modules/libmime/dist/cjs/charsets.js

@@ -113,6 +113,10 @@ const charsets = {
     mac: 'macintosh',
     macintosh: 'macintosh',
     'x-mac-roman': 'macintosh',
+    // the x-mac-* labels mail clients send, under the names iconv-lite knows them by
+    'x-mac-ce': 'maccenteuro',
+    'x-mac-cyrillic': 'maccyrillic',
+    'x-mac-ukrainian': 'macukraine',
     'dos-874': 'windows-874',
     'iso-8859-11': 'windows-874',
     'iso8859-11': 'windows-874',
@@ -180,7 +184,7 @@ const charsets = {
     'x-gbk': 'GBK',
     gb18030: 'gb18030',
     big5: 'Big5',
-    'big5-hkscs': 'Big5',
+    'big5-hkscs': 'Big5-HKSCS',
     'cn-big5': 'Big5',
     csbig5: 'Big5',
     'x-x-big5': 'Big5',
@@ -206,7 +210,9 @@ const charsets = {
     ksc_5601: 'EUC-KR',
     'windows-949': 'EUC-KR',
     'utf-16be': 'UTF-16BE',
-    'utf-16': 'UTF-16LE',
+    // iconv-lite's UTF-16 decoder reads the byte order from a BOM and guesses it from the
+    // content without one, falling back to little endian
+    'utf-16': 'UTF-16',
     'utf-16le': 'UTF-16LE'
 };
 exports.default = charsets;

package/node_modules/libmime/dist/cjs/libmime.d.ts

@@ -1,5 +1,6 @@
 import { Buffer } from 'node:buffer';
-import type { HeaderLine, HeaderObject, HeaderParam, LibmimeConfig, ParsedHeaderValue, StructuredHeaderValue } from './types.js';
+import * as libcharset from './charset.js';
+import type { DecodeHeadersOptions, HeaderLine, HeaderObject, HeaderParam, LibmimeConfig, ParsedHeaderValue, ParseHeaderValueOptions, StructuredHeaderValue } from './types.js';
 import type * as types from './types.js';
 declare class Libmime {
     config: LibmimeConfig;
@@ -69,6 +70,16 @@ declare class Libmime {
      * @return {String} Canonical charset name
      */
     normalizeCharset(charset?: unknown): string;
+    /**
+     * Creates a Transform stream that decodes a body in the given charset into UTF-8 Buffers,
+     * resolving the charset name and handling the Japanese charsets the same way header
+     * decoding does. An unknown or refused charset (UTF-7, base64, hex) is decoded as UTF-8,
+     * and the stream says so with `supported` set to false.
+     *
+     * @param {String} [charset='UTF-8'] Charset the input is encoded in
+     * @return {DecodeStream} Transform stream with `charset` and `supported` properties
+     */
+    createDecodeStream(charset?: unknown): libcharset.DecodeStream;
     /**
      * Decodes the inner payload of a single mime encoded-word into a unicode string.
      * Expects the three components of `=?charset?encoding?text?=` already separated.
@@ -111,9 +122,11 @@ declare class Libmime {
      * header might have its own rules (eg. formatted email addresses and such)
      *
      * @param {String} headers Headers string
+     * @param {Object} [options] Options
+     * @param {Boolean} [options.skipPrototypeKeys] Leave out headers named like an Object.prototype member, eg. `__proto__` and `constructor`
      * @return {Object} An object of headers, where header keys are object keys and every value is an Array of the values for that key
      */
-    decodeHeaders(headers: string): HeaderObject;
+    decodeHeaders(headers: string, options?: DecodeHeadersOptions): HeaderObject;
     /**
      * Joins parsed header value together as 'value; param1=value1; param2=value2'
      * PS: We are following RFC 822 for the list of special characters that we need to keep in quotes.
@@ -139,9 +152,10 @@ declare class Libmime {
      * decoded, so a caller that runs decodeWords() over the params has to leave them out
      *
      * @param {String} str Header value
+     * @param {Object} [options] Options, see ParseHeaderValueOptions
      * @return {Object} Header value as a parsed structure
      */
-    parseHeaderValue(str: string): ParsedHeaderValue;
+    parseHeaderValue(str: string, options?: ParseHeaderValueOptions): ParsedHeaderValue;
     /**
      * Encodes a string or an Buffer to an UTF-8 Parameter Value Continuation encoding (rfc2231)
      * Useful for splitting long parameter values.
@@ -206,12 +220,15 @@ declare const libmime: Libmime & {
 type LibmimeInstance = Libmime;
 declare namespace libmime {
     type Libmime = LibmimeInstance;
+    type DecodeStream = libcharset.DecodeStream;
+    type DecodeHeadersOptions = types.DecodeHeadersOptions;
     type HeaderLine = types.HeaderLine;
     type HeaderObject = types.HeaderObject;
     type HeaderParam = types.HeaderParam;
     type LibmimeConfig = types.LibmimeConfig;
     type MimeWordEncoding = types.MimeWordEncoding;
     type ParsedHeaderValue = types.ParsedHeaderValue;
+    type ParseHeaderValueOptions = types.ParseHeaderValueOptions;
     type StructuredHeader = types.StructuredHeader;
     type StructuredHeaderValue = types.StructuredHeaderValue;
 }