@mavogel/awscdk-rootmail 0.1.33 → 0.1.35

package/node_modules/@aws-sdk/middleware-sdk-s3/dist-es/submodules/s3-control/middleware-process-arnables/parse-outpost-arnables.js

@@ -5,8 +5,9 @@ import { CONTEXT_ARN_REGION, CONTEXT_OUTPOST_ID, CONTEXT_SIGNING_REGION, CONTEXT
 export const parseOutpostArnablesMiddleaware = (options) => (next, context) => async (args) => {
     const { input } = args;
     const parameter = input.Name && validateArn(input.Name) ? "Name" : input.Bucket && validateArn(input.Bucket) ? "Bucket" : undefined;
-    if (!parameter)
+    if (!parameter) {
         return next(args);
+    }
     const clientRegion = await options.region();
     const useArnRegion = await options.useArnRegion();
     const useFipsEndpoint = await options.useFipsEndpoint();
@@ -52,8 +53,9 @@ export const parseOutpostArnablesMiddleaware = (options) => (next, context) => a
     if (!input.AccountId) {
         input.AccountId = arn.accountId;
     }
-    if (useArnRegion)
+    if (useArnRegion) {
         context[CONTEXT_ARN_REGION] = arn.region;
+    }
     return next(args);
 };
 export const parseOutpostArnablesMiddleawareOptions = {

package/node_modules/@aws-sdk/middleware-sdk-s3/dist-es/submodules/s3-control/middleware-redirect-from-postid/redirect-from-postid.js

@@ -3,8 +3,9 @@ import { CONTEXT_SIGNING_SERVICE } from "../constants";
 import { getOutpostEndpoint } from "../middleware-process-arnables/getOutpostEndpoint";
 export const redirectFromPostIdMiddleware = (config) => (next, context) => async (args) => {
     const { input, request } = args;
-    if (!HttpRequest.isInstance(request))
+    if (!HttpRequest.isInstance(request)) {
         return next(args);
+    }
     if (input.OutpostId) {
         const { isCustomEndpoint } = config;
         const useFipsEndpoint = await config.useFipsEndpoint();

package/node_modules/@aws-sdk/middleware-sdk-s3/dist-types/submodules/s3/middleware-s3-express/classes/S3ExpressIdentityCache.d.ts

@@ -12,5 +12,6 @@ export declare class S3ExpressIdentityCache {
     get(key: string): undefined | S3ExpressIdentityCacheEntry;
     set(key: string, entry: S3ExpressIdentityCacheEntry): S3ExpressIdentityCacheEntry;
     delete(key: string): void;
+    clear(): void;
     purgeExpired(): Promise<void>;
 }

package/node_modules/@aws-sdk/middleware-sdk-s3/dist-types/submodules/s3/middleware-s3-express/classes/S3ExpressIdentityProviderImpl.d.ts

@@ -21,7 +21,9 @@ export declare class S3ExpressIdentityProviderImpl implements S3ExpressIdentityP
     private createSessionFn;
     private cache;
     static REFRESH_WINDOW_MS: number;
-    constructor(createSessionFn: (key: string) => Promise<{
+    private accessKeyId?;
+    private cacheGeneration;
+    constructor(createSessionFn: (bucket: string) => Promise<{
         Credentials: Credentials;
     }>, cache?: S3ExpressIdentityCache);
     getS3ExpressIdentity(awsIdentity: AwsCredentialIdentity, identityProperties: {

package/node_modules/@aws-sdk/middleware-sdk-s3/dist-types/ts3.4/submodules/s3/middleware-s3-express/classes/S3ExpressIdentityCache.d.ts

@@ -7,5 +7,6 @@ export declare class S3ExpressIdentityCache {
   get(key: string): undefined | S3ExpressIdentityCacheEntry;
   set(key: string, entry: S3ExpressIdentityCacheEntry): S3ExpressIdentityCacheEntry;
   delete(key: string): void;
+  clear(): void;
   purgeExpired(): Promise<void>;
 }

package/node_modules/@aws-sdk/middleware-sdk-s3/dist-types/ts3.4/submodules/s3/middleware-s3-express/classes/S3ExpressIdentityProviderImpl.d.ts

@@ -12,8 +12,10 @@ export declare class S3ExpressIdentityProviderImpl implements S3ExpressIdentityP
   private createSessionFn;
   private cache;
   static REFRESH_WINDOW_MS: number;
+  private accessKeyId?;
+  private cacheGeneration;
   constructor(
-    createSessionFn: (key: string) => Promise<{
+    createSessionFn: (bucket: string) => Promise<{
       Credentials: Credentials;
     }>,
     cache?: S3ExpressIdentityCache,

package/node_modules/@aws-sdk/middleware-sdk-s3/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/middleware-sdk-s3",
-  "version": "3.972.82",
+  "version": "3.972.84",
   "homepage": "https://github.com/aws/aws-sdk-js-v3/tree/main/packages-internal/middleware-sdk-s3",
   "license": "Apache-2.0",
   "author": {
@@ -94,8 +94,8 @@
     "test:types": "tsc -p tsconfig.test.json"
   },
   "dependencies": {
-    "@aws-sdk/core": "^3.978.6",
-    "@aws-sdk/signature-v4-multi-region": "^3.996.49",
+    "@aws-sdk/core": "^3.979.0",
+    "@aws-sdk/signature-v4-multi-region": "^3.996.50",
     "@aws-sdk/types": "^3.975.0",
     "@smithy/core": "^3.37.0",
     "@smithy/types": "^4.19.0",

package/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/cognito-identity/index.js

@@ -83,7 +83,7 @@ const commonParams = {
     UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" },
 };
 
-var version = "3.997.50";
+var version = "3.997.52";
 var packageInfo = {
 	version: version};
 

package/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/signin/index.js

@@ -78,7 +78,7 @@ const commonParams = {
     UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" },
 };
 
-var version = "3.997.50";
+var version = "3.997.52";
 var packageInfo = {
 	version: version};
 

package/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/sso/index.js

@@ -78,7 +78,7 @@ const commonParams = {
     UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" },
 };
 
-var version = "3.997.50";
+var version = "3.997.52";
 var packageInfo = {
 	version: version};
 

package/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/sso-oidc/index.js

@@ -78,7 +78,7 @@ const commonParams = {
     UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" },
 };
 
-var version = "3.997.50";
+var version = "3.997.52";
 var packageInfo = {
 	version: version};
 

package/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/sts/index.js

@@ -258,7 +258,7 @@ const commonParams = {
     UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" },
 };
 
-var version = "3.997.50";
+var version = "3.997.52";
 var packageInfo = {
 	version: version};
 

package/node_modules/@aws-sdk/nested-clients/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/nested-clients",
-  "version": "3.997.51",
+  "version": "3.997.53",
   "description": "Nested clients for AWS SDK packages.",
   "homepage": "https://github.com/aws/aws-sdk-js-v3/tree/main/packages/nested-clients",
   "license": "Apache-2.0",
@@ -100,8 +100,8 @@
     "test:watch": "yarn g:vitest watch"
   },
   "dependencies": {
-    "@aws-sdk/core": "^3.978.6",
-    "@aws-sdk/signature-v4-multi-region": "^3.996.49",
+    "@aws-sdk/core": "^3.979.0",
+    "@aws-sdk/signature-v4-multi-region": "^3.996.50",
     "@aws-sdk/types": "^3.975.0",
     "@smithy/core": "^3.37.0",
     "@smithy/fetch-http-handler": "^5.8.0",

package/node_modules/@aws-sdk/signature-v4-multi-region/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/signature-v4-multi-region",
-  "version": "3.996.49",
+  "version": "3.996.50",
   "homepage": "https://github.com/aws/aws-sdk-js-v3/tree/main/packages/signature-v4-multi-region",
   "license": "Apache-2.0",
   "author": {

package/node_modules/@aws-sdk/token-providers/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/token-providers",
-  "version": "3.1157.0",
+  "version": "3.1160.0",
   "description": "A collection of token providers",
   "keywords": [
     "aws",
@@ -48,8 +48,8 @@
     "test:integration:watch": "yarn g:vitest watch -c vitest.config.integ.mts"
   },
   "dependencies": {
-    "@aws-sdk/core": "^3.978.6",
-    "@aws-sdk/nested-clients": "^3.997.51",
+    "@aws-sdk/core": "^3.979.0",
+    "@aws-sdk/nested-clients": "^3.997.53",
     "@aws-sdk/types": "^3.975.0",
     "@smithy/core": "^3.37.0",
     "@smithy/types": "^4.19.0",

package/node_modules/@aws-sdk/xml-builder/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/xml-builder",
-  "version": "3.972.41",
+  "version": "3.972.42",
   "description": "XML utilities for the AWS SDK",
   "homepage": "https://github.com/aws/aws-sdk-js-v3/tree/main/packages-internal/xml-builder",
   "license": "Apache-2.0",

package/node_modules/mailparser/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## [3.14.1](https://github.com/nodemailer/mailparser/compare/v3.14.0...v3.14.1) (2026-10-29)
+
+
+### Bug Fixes
+
+* update dependencies ([e5ae8e4](https://github.com/nodemailer/mailparser/commit/e5ae8e4d06058878e7a2bea4440f31af659a3c10))
+
+## [3.14.0](https://github.com/nodemailer/mailparser/compare/v3.13.0...v3.14.0) (2026-10-29)
+
+
+### Features
+
+* export parseOtpToken for OTP-Token values read outside the parser ([fda26b2](https://github.com/nodemailer/mailparser/commit/fda26b2c1a14927b17a16a42d406576f21de4fc4))
+
+## [3.13.0](https://github.com/nodemailer/mailparser/compare/v3.12.4...v3.13.0) (2026-10-29)
+
+
+### Features
+
+* parse the OTP-Token header into mail.otp ([bc20682](https://github.com/nodemailer/mailparser/commit/bc206829c8cc287b7d980d604d0a3fbe6cbc0179))
+
+
+### Bug Fixes
+
+* update dependencies ([f94b954](https://github.com/nodemailer/mailparser/commit/f94b954efcdf63d117097ebdecf79acb71e81bfa))
+
 ## [3.12.4](https://github.com/nodemailer/mailparser/compare/v3.12.3...v3.12.4) (2026-10-22)
 
 

package/node_modules/mailparser/README.md

@@ -24,7 +24,7 @@ const mailparser = require('mailparser');
 or, from an ES module or TypeScript (type declarations are included):
 
 ```js
-import { simpleParser, MailParser, parseAddressHeader } from 'mailparser';
+import { simpleParser, MailParser, parseAddressHeader, parseOtpToken } from 'mailparser';
 ```
 
 ## Usage
@@ -54,6 +54,26 @@ parseAddressHeader('=?utf-8?Q?J=C3=B5geva?= <info@xn--mnchen-3ya.example>, Team:
 
 Each entry of `value` has a `name` (an empty string when there is none, encoded words decoded) and either an `address` (a punycode domain decoded to Unicode) or, for a group, a `group` list of the same entries. RFC 2047 does not allow encoded words in the address itself, so an address part hiding one is kept only when it decodes to a plain `local@domain`, otherwise `address` is an empty string; a display name that decodes to something looking like an address stays a name.
 
+### One-time passcodes
+
+A message with an `OTP-Token` header ([draft-goto-otp-token](https://datatracker.ietf.org/doc/draft-goto-otp-token/), the header Nodemailer sets with its `otp` option) gets an `otp` property on the `simpleParser` result and on the `MailParser` instance, an object with `code` (the passcode) and `origin` (the origin it is bound to, such as `"https://example.com"`).
+
+```js
+const mail = await simpleParser('OTP-Token: "123456"; origin="https://example.com"\r\nSubject: Code\r\n\r\nYour code is 123456');
+// mail.otp: { code: '123456', origin: 'https://example.com' }
+```
+
+`otp` is set only when the message header has exactly one `OTP-Token` header and its value is valid: a structured field String with an `origin` parameter holding a canonical `https` origin, or an `http` origin on a loopback host. An `OTP-Token` header of a MIME part or a forwarded message is ignored. The header is not authenticated, so check that the message carries a valid DKIM signature from the domain of the origin before offering the code. The header comes from an Internet-Draft, so `otp` is experimental and may change in a minor release when the draft does.
+
+For a header that comes from somewhere else than a message being parsed, such as an IMAP `HEADER.FIELDS` fetch or a provider API, `parseOtpToken(values)` takes the raw values of every `OTP-Token` header of the message's own header section (a string or an array) and returns the same `{ code, origin }` object, or `undefined`. The same rules apply, so more than one value returns `undefined`.
+
+```js
+const { parseOtpToken } = require('mailparser');
+
+parseOtpToken(['"123456"; origin="https://example.com"']);
+// { code: '123456', origin: 'https://example.com' }
+```
+
 ### Character sets
 
 Text bodies are decoded with libmime's `createDecodeStream()`, which resolves charset aliases, decodes the Japanese charsets iconv-lite does not support (ISO-2022-JP and friends) and keeps a multibyte character that is split across chunks intact. A body in a charset that is not known, or one that is refused, is decoded as UTF-8 with invalid bytes replaced by U+FFFD, the same fallback encoded words in headers get. The refused charsets are UTF-7 (and its aliases), which can carry markup past a filter that looks for `<` (`+ADw-script+AD4-` decodes to `<script>`), and the base64 and hex transfer encodings. A UTF-7 body therefore keeps its `+ADw-` sequences as literal text. The refusal applies with the `Iconv` option as well.

package/node_modules/mailparser/dist/cjs/index.d.ts

@@ -1,12 +1,14 @@
 import MailParser from './mail-parser.js';
 import simpleParser from './simple-parser.js';
 import { parseAddressHeader } from './address-header.js';
-export { MailParser, simpleParser, parseAddressHeader };
+import { parseOtpToken } from './otp-token.js';
+export { MailParser, simpleParser, parseAddressHeader, parseOtpToken };
 export type { SimpleParserCallback } from './simple-parser.js';
 export type * from './types.js';
 declare const _default: {
     MailParser: typeof MailParser;
     simpleParser: typeof simpleParser;
     parseAddressHeader: typeof parseAddressHeader;
+    parseOtpToken: typeof parseOtpToken;
 };
 export default _default;

package/node_modules/mailparser/dist/cjs/index.js

@@ -3,12 +3,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseAddressHeader = exports.simpleParser = exports.MailParser = void 0;
+exports.parseOtpToken = exports.parseAddressHeader = exports.simpleParser = exports.MailParser = void 0;
 const mail_parser_js_1 = __importDefault(require("./mail-parser.js"));
 exports.MailParser = mail_parser_js_1.default;
 const simple_parser_js_1 = __importDefault(require("./simple-parser.js"));
 exports.simpleParser = simple_parser_js_1.default;
 const address_header_js_1 = require("./address-header.js");
 Object.defineProperty(exports, "parseAddressHeader", { enumerable: true, get: function () { return address_header_js_1.parseAddressHeader; } });
-exports.default = { MailParser: mail_parser_js_1.default, simpleParser: simple_parser_js_1.default, parseAddressHeader: address_header_js_1.parseAddressHeader };
+const otp_token_js_1 = require("./otp-token.js");
+Object.defineProperty(exports, "parseOtpToken", { enumerable: true, get: function () { return otp_token_js_1.parseOtpToken; } });
+exports.default = { MailParser: mail_parser_js_1.default, simpleParser: simple_parser_js_1.default, parseAddressHeader: address_header_js_1.parseAddressHeader, parseOtpToken: otp_token_js_1.parseOtpToken };
 Object.defineProperty(exports, 'default', { value: exports, enumerable: false, writable: true, configurable: true });

package/node_modules/mailparser/dist/cjs/mail-parser.d.ts

@@ -1,6 +1,6 @@
 import { Transform } from 'node:stream';
 import type { TransformCallback } from 'node:stream';
-import type { AddressObject, AttachmentStream, EmailAddress, HeaderLines, Headers, MailParserOptions, MessageText } from './types.js';
+import type { AddressObject, AttachmentStream, EmailAddress, HeaderLines, Headers, MailParserOptions, MessageText, Otp } from './types.js';
 /**
  * A lower level, streaming e-mail parser. It is a Transform stream: write the raw message in and
  * read the parsed content out. It emits:
@@ -46,6 +46,13 @@ declare class MailParser extends Transform {
     inReplyTo?: string;
     /** The `Reply-To` header, set once the headers have been parsed. */
     replyTo?: AddressObject;
+    /**
+     * One-time passcode from the `OTP-Token` header, set once the headers have been parsed if the
+     * message has a valid one. The header is not authenticated, see `ParsedMail.otp`.
+     *
+     * @experimental
+     */
+    otp?: Otp;
     constructor(config?: MailParserOptions);
     _transform(chunk: Buffer, encoding: BufferEncoding, done: TransformCallback): void;
     _flush(done: TransformCallback): void;

package/node_modules/mailparser/dist/cjs/mail-parser.js

@@ -14,6 +14,7 @@ const node_stream_1 = require("node:stream");
 const tlds_cjs_1 = __importDefault(require("./tlds.cjs"));
 const stream_hash_js_1 = __importDefault(require("./stream-hash.js"));
 const address_header_js_1 = require("./address-header.js");
+const otp_token_js_1 = require("./otp-token.js");
 const { Splitter, ChunkedPassthrough } = mailsplit_1.default;
 // Bounds for link detection in text bodies. Message content is untrusted and
 // linkify-it backtracks heavily on crafted input: matching a host is quadratic
@@ -863,6 +864,10 @@ class MailParser extends node_stream_1.Transform {
                             this[key.replace(/-([a-z])/g, (m, c) => c.toUpperCase())] = node.headers.get(key);
                         }
                     });
+                    let otp = (0, otp_token_js_1.getOtp)(node.headerLines);
+                    if (otp) {
+                        this.otp = otp;
+                    }
                     this.emit('headers', node.headers);
                     if (node.headerLines) {
                         this.emit('headerLines', node.headerLines);

package/node_modules/mailparser/dist/cjs/otp-token.d.ts

@@ -0,0 +1,9 @@
+import type { Otp } from './types.js';
+/**
+ * Returns the one-time passcode from the values of the `OTP-Token` headers of a message header
+ * section, following the receiver steps of the draft (section 3.2), or undefined if there is no
+ * valid one. Pass every `OTP-Token` value of the message's own header section, not of a MIME
+ * part: more than one makes the message have none. The values are the raw ones, with any
+ * folding left in and no encoded words decoded
+ */
+export declare function parseOtpToken(values: string | string[] | undefined): Otp | undefined;

package/node_modules/mailparser/dist/cjs/otp-token.js

@@ -0,0 +1,186 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseStringItem = parseStringItem;
+exports.isOtpOrigin = isOtpOrigin;
+exports.parseOtpToken = parseOtpToken;
+exports.getOtp = getOtp;
+// Parser for the OTP-Token header of draft-goto-otp-token-01, an Internet-Draft that expires
+// on 25 March 2027. By then check for a newer revision of the draft or a published RFC, the
+// header name and its parameters are still open questions in the draft.
+//
+// The header value is a structured field item (RFC 9651): a String holding the passcode,
+// with an `origin` parameter naming the origin the passcode is bound to. Unknown parameters
+// are ignored, but they still have to be valid, otherwise the whole field fails to parse.
+// RFC 9651 lets a parser limit the size of a field. A passcode and an origin take well under
+// a kilobyte, the limit keeps the regular expressions below away from megabyte inputs
+const MAX_FIELD_LENGTH = 8192;
+// The bare item syntax of RFC 9651 4.2.3.1, keyed by the first character of the item. An
+// Integer has at most 15 digits, a Decimal at most 12 before and 1 to 3 after the dot, and a
+// Date is an Integer. Whatever follows a match is left for the caller, which only accepts a
+// parameter separator or the end of the field, so a 16th digit or a 4th decimal fails there
+const NUMBER = /-?(?:\d{1,12}\.\d{1,3}|\d{1,15})/y;
+const STRING = /"((?:[\x20\x21\x23-\x5b\x5d-\x7e]|\\["\\])*)"/y;
+const TOKEN = /[A-Za-z*][!#$%&'*+\-.^_`|~0-9A-Za-z:/]*/y;
+const BYTE_SEQUENCE = /:[A-Za-z0-9+/=]*:/y;
+const BOOLEAN = /\?[01]/y;
+const DATE = /@-?\d{1,15}/y;
+const DISPLAY_STRING = /%"((?:[\x20\x21\x23\x24\x26-\x7e]|%[0-9a-f]{2})*)"/y;
+const KEY = /[a-z*][a-z0-9_\-.*]*/y;
+const SPACES = / */y;
+// Matches the sticky expression at the cursor and moves past it, returns null if it does not match
+function match(cursor, re) {
+    re.lastIndex = cursor.pos;
+    const result = re.exec(cursor.input);
+    if (result) {
+        cursor.pos = re.lastIndex;
+    }
+    return result;
+}
+// RFC 9651 4.2.5, returns the unescaped String or null if there is no valid String at the cursor
+function parseString(cursor) {
+    const result = match(cursor, STRING);
+    return result && result[1].replace(/\\(["\\])/g, '$1');
+}
+// RFC 9651 4.2.10. The percent encoded bytes must be valid UTF-8, which decodeURIComponent
+// checks as it decodes them
+function isDisplayString(cursor) {
+    const result = match(cursor, DISPLAY_STRING);
+    if (!result) {
+        return false;
+    }
+    try {
+        decodeURIComponent(result[1]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// RFC 9651 4.2.3.1. Returns the value of a String, true for any other valid bare item and
+// false for an invalid one
+function parseBareItem(cursor) {
+    const c = cursor.input.charAt(cursor.pos);
+    switch (c) {
+        case '"':
+            return parseString(cursor) ?? false;
+        case ':':
+            return !!match(cursor, BYTE_SEQUENCE);
+        case '?':
+            return !!match(cursor, BOOLEAN);
+        case '@':
+            return !!match(cursor, DATE);
+        case '%':
+            return isDisplayString(cursor);
+    }
+    return !!match(cursor, c === '-' || (c >= '0' && c <= '9') ? NUMBER : TOKEN);
+}
+/**
+ * Parses a structured field item (RFC 9651 4.2 with field_type "item") whose bare item is a
+ * String. Returns the String and the String parameters, or null if the value does not parse
+ * or the bare item is of another type. A parameter of any other type is stored as true
+ * @internal
+ */
+function parseStringItem(value) {
+    const cursor = { input: value, pos: 0 };
+    match(cursor, SPACES);
+    const item = parseString(cursor);
+    if (item === null) {
+        return null;
+    }
+    // a later parameter with the same key replaces the earlier one
+    const params = new Map();
+    while (cursor.input[cursor.pos] === ';') {
+        cursor.pos++;
+        match(cursor, SPACES);
+        const key = match(cursor, KEY);
+        if (!key) {
+            return null;
+        }
+        let paramValue = true;
+        if (cursor.input[cursor.pos] === '=') {
+            cursor.pos++;
+            paramValue = parseBareItem(cursor);
+            if (paramValue === false) {
+                return null;
+            }
+        }
+        params.set(key[0], paramValue);
+    }
+    match(cursor, SPACES);
+    return cursor.pos === cursor.input.length ? { value: item, params } : null;
+}
+/**
+ * Checks that the origin is the canonical ASCII serialization of a potentially trustworthy
+ * origin, as the draft requires: https, or http on a loopback host
+ * @internal
+ */
+function isOtpOrigin(origin) {
+    let url;
+    try {
+        url = new URL(origin);
+    }
+    catch {
+        return false;
+    }
+    // the URL parser lowercases the host, converts it to punycode and drops the default port, so
+    // a value that is not canonical, or has a path, userinfo or an opaque origin, does not match
+    // its own origin. The WHATWG parser lets characters such as a quote or a brace into a host,
+    // which the origin grammar (RFC 6454) does not allow, so only a DNS name, an IPv4 address or a
+    // bracketed IPv6 address is accepted
+    if (url.origin !== origin || !/^([a-z0-9_-]+\.)*[a-z0-9_-]+$|^\[[0-9a-f:.]+\]$/.test(url.hostname)) {
+        return false;
+    }
+    const isLoopback = /^(localhost|.+\.localhost|127(\.\d+){3}|\[::1\])$/.test(url.hostname);
+    return url.protocol === 'https:' || (url.protocol === 'http:' && isLoopback);
+}
+// The field name with its colon. A line with whitespace before the colon is not counted, it
+// is obsolete syntax (RFC 5322 4.5) the draft has no reason to accept
+const OTP_HEADER = /^otp-token:/i;
+/**
+ * Returns the value of a header without its line breaks and the whitespace around it, or null if
+ * the value is longer than the field size limit
+ */
+function getFieldValue(value) {
+    // unfolding removes the line breaks and keeps the whitespace that follows them (RFC 5322 2.2.3)
+    value = value.replace(/\r?\n/g, '');
+    let start = 0;
+    let end = value.length;
+    while (start < end && (value[start] === ' ' || value[start] === '\t')) {
+        start++;
+    }
+    while (end > start && (value[end - 1] === ' ' || value[end - 1] === '\t')) {
+        end--;
+    }
+    return end - start > MAX_FIELD_LENGTH ? null : value.slice(start, end);
+}
+/**
+ * Returns the one-time passcode from the values of the `OTP-Token` headers of a message header
+ * section, following the receiver steps of the draft (section 3.2), or undefined if there is no
+ * valid one. Pass every `OTP-Token` value of the message's own header section, not of a MIME
+ * part: more than one makes the message have none. The values are the raw ones, with any
+ * folding left in and no encoded words decoded
+ */
+function parseOtpToken(values) {
+    const list = typeof values === 'string' ? [values] : values;
+    if (!Array.isArray(list) || list.length !== 1 || typeof list[0] !== 'string') {
+        return undefined;
+    }
+    const value = getFieldValue(list[0]);
+    const parsed = value === null ? null : parseStringItem(value);
+    const origin = parsed?.params.get('origin');
+    // an empty passcode is valid syntax, but there is nothing in it to fill in
+    if (!parsed?.value || typeof origin !== 'string' || !isOtpOrigin(origin)) {
+        return undefined;
+    }
+    return { code: parsed.value, origin };
+}
+/**
+ * Returns the one-time passcode from the OTP-Token header of a message, or undefined if the
+ * message has no valid one. Only the header of the message itself counts, the draft has an
+ * OTP-Token in a MIME part ignored
+ * @internal
+ */
+function getOtp(headerLines) {
+    const values = headerLines.filter(({ line }) => OTP_HEADER.test(line)).map(({ line }) => line.slice(line.indexOf(':') + 1));
+    return values.length ? parseOtpToken(values) : undefined;
+}

package/node_modules/mailparser/dist/cjs/simple-parser.js

@@ -51,6 +51,9 @@ function simpleParser(input, options, callback) {
     parser.on('headers', headers => {
         mail.headers = headers;
         mail.headerLines = parser.headerLines;
+        if (parser.otp) {
+            mail.otp = parser.otp;
+        }
     });
     let reading = false;
     let reader = () => {

package/node_modules/mailparser/dist/cjs/types.d.ts

@@ -104,6 +104,17 @@ export type HeaderLines = ReadonlyArray<{
     key: string;
     line: string;
 }>;
+/**
+ * A one-time passcode from the `OTP-Token` header (draft-goto-otp-token), so that a mail
+ * client can offer it for the origin it is bound to. The header is set by the sender and not
+ * authenticated by the parser, check the DKIM signature of the message before trusting it.
+ */
+export interface Otp {
+    /** The passcode, printable ASCII. */
+    code: string;
+    /** Canonical ASCII serialization of the origin the code is bound to, eg. `https://example.com`. */
+    origin: string;
+}
 /**
  * The properties every attachment has, whether streamed by {@link MailParser} or buffered by
  * `simpleParser`.
@@ -329,6 +340,16 @@ export interface ParsedMail {
     inReplyTo?: string;
     /** The `Reply-To` header. */
     replyTo?: AddressObject;
+    /**
+     * One-time passcode from the `OTP-Token` header of the message. Set only when the header
+     * section has exactly one `OTP-Token` header and it is valid. The header is not
+     * authenticated, verify that the message is signed by the domain of the origin before
+     * trusting it.
+     *
+     * @experimental The header is defined by an Internet-Draft, so this property may change
+     * in a minor release when the draft does.
+     */
+    otp?: Otp;
 }
 /**
  * A message to parse: the raw message as a Buffer or a string, or a readable stream of it.

package/node_modules/mailparser/dist/esm/index.d.ts

@@ -1,12 +1,14 @@
 import MailParser from './mail-parser.js';
 import simpleParser from './simple-parser.js';
 import { parseAddressHeader } from './address-header.js';
-export { MailParser, simpleParser, parseAddressHeader };
+import { parseOtpToken } from './otp-token.js';
+export { MailParser, simpleParser, parseAddressHeader, parseOtpToken };
 export type { SimpleParserCallback } from './simple-parser.js';
 export type * from './types.js';
 declare const _default: {
     MailParser: typeof MailParser;
     simpleParser: typeof simpleParser;
     parseAddressHeader: typeof parseAddressHeader;
+    parseOtpToken: typeof parseOtpToken;
 };
 export default _default;

package/node_modules/mailparser/dist/esm/index.js

@@ -1,5 +1,6 @@
 import MailParser from './mail-parser.js';
 import simpleParser from './simple-parser.js';
 import { parseAddressHeader } from './address-header.js';
-export { MailParser, simpleParser, parseAddressHeader };
-export default { MailParser, simpleParser, parseAddressHeader };
+import { parseOtpToken } from './otp-token.js';
+export { MailParser, simpleParser, parseAddressHeader, parseOtpToken };
+export default { MailParser, simpleParser, parseAddressHeader, parseOtpToken };

package/node_modules/mailparser/dist/esm/mail-parser.d.ts

@@ -1,6 +1,6 @@
 import { Transform } from 'node:stream';
 import type { TransformCallback } from 'node:stream';
-import type { AddressObject, AttachmentStream, EmailAddress, HeaderLines, Headers, MailParserOptions, MessageText } from './types.js';
+import type { AddressObject, AttachmentStream, EmailAddress, HeaderLines, Headers, MailParserOptions, MessageText, Otp } from './types.js';
 /**
  * A lower level, streaming e-mail parser. It is a Transform stream: write the raw message in and
  * read the parsed content out. It emits:
@@ -46,6 +46,13 @@ declare class MailParser extends Transform {
     inReplyTo?: string;
     /** The `Reply-To` header, set once the headers have been parsed. */
     replyTo?: AddressObject;
+    /**
+     * One-time passcode from the `OTP-Token` header, set once the headers have been parsed if the
+     * message has a valid one. The header is not authenticated, see `ParsedMail.otp`.
+     *
+     * @experimental
+     */
+    otp?: Otp;
     constructor(config?: MailParserOptions);
     _transform(chunk: Buffer, encoding: BufferEncoding, done: TransformCallback): void;
     _flush(done: TransformCallback): void;