@mavogel/awscdk-rootmail 0.1.33 → 0.1.35

package/node_modules/mailparser/dist/esm/mail-parser.js

@@ -9,6 +9,7 @@ import { Transform } from 'node:stream';
 import tlds from './tlds.cjs';
 import StreamHash from './stream-hash.js';
 import { decodeAddresses, formatAddressesHTML, formatAddressesText } from './address-header.js';
+import { getOtp } from './otp-token.js';
 const { Splitter, ChunkedPassthrough } = mailsplit;
 // Bounds for link detection in text bodies. Message content is untrusted and
 // linkify-it backtracks heavily on crafted input: matching a host is quadratic
@@ -858,6 +859,10 @@ class MailParser extends Transform {
                             this[key.replace(/-([a-z])/g, (m, c) => c.toUpperCase())] = node.headers.get(key);
                         }
                     });
+                    let otp = getOtp(node.headerLines);
+                    if (otp) {
+                        this.otp = otp;
+                    }
                     this.emit('headers', node.headers);
                     if (node.headerLines) {
                         this.emit('headerLines', node.headerLines);

package/node_modules/mailparser/dist/esm/otp-token.d.ts

@@ -0,0 +1,9 @@
+import type { Otp } from './types.js';
+/**
+ * Returns the one-time passcode from the values of the `OTP-Token` headers of a message header
+ * section, following the receiver steps of the draft (section 3.2), or undefined if there is no
+ * valid one. Pass every `OTP-Token` value of the message's own header section, not of a MIME
+ * part: more than one makes the message have none. The values are the raw ones, with any
+ * folding left in and no encoded words decoded
+ */
+export declare function parseOtpToken(values: string | string[] | undefined): Otp | undefined;

package/node_modules/mailparser/dist/esm/otp-token.js

@@ -0,0 +1,180 @@
+// Parser for the OTP-Token header of draft-goto-otp-token-01, an Internet-Draft that expires
+// on 25 March 2027. By then check for a newer revision of the draft or a published RFC, the
+// header name and its parameters are still open questions in the draft.
+//
+// The header value is a structured field item (RFC 9651): a String holding the passcode,
+// with an `origin` parameter naming the origin the passcode is bound to. Unknown parameters
+// are ignored, but they still have to be valid, otherwise the whole field fails to parse.
+// RFC 9651 lets a parser limit the size of a field. A passcode and an origin take well under
+// a kilobyte, the limit keeps the regular expressions below away from megabyte inputs
+const MAX_FIELD_LENGTH = 8192;
+// The bare item syntax of RFC 9651 4.2.3.1, keyed by the first character of the item. An
+// Integer has at most 15 digits, a Decimal at most 12 before and 1 to 3 after the dot, and a
+// Date is an Integer. Whatever follows a match is left for the caller, which only accepts a
+// parameter separator or the end of the field, so a 16th digit or a 4th decimal fails there
+const NUMBER = /-?(?:\d{1,12}\.\d{1,3}|\d{1,15})/y;
+const STRING = /"((?:[\x20\x21\x23-\x5b\x5d-\x7e]|\\["\\])*)"/y;
+const TOKEN = /[A-Za-z*][!#$%&'*+\-.^_`|~0-9A-Za-z:/]*/y;
+const BYTE_SEQUENCE = /:[A-Za-z0-9+/=]*:/y;
+const BOOLEAN = /\?[01]/y;
+const DATE = /@-?\d{1,15}/y;
+const DISPLAY_STRING = /%"((?:[\x20\x21\x23\x24\x26-\x7e]|%[0-9a-f]{2})*)"/y;
+const KEY = /[a-z*][a-z0-9_\-.*]*/y;
+const SPACES = / */y;
+// Matches the sticky expression at the cursor and moves past it, returns null if it does not match
+function match(cursor, re) {
+    re.lastIndex = cursor.pos;
+    const result = re.exec(cursor.input);
+    if (result) {
+        cursor.pos = re.lastIndex;
+    }
+    return result;
+}
+// RFC 9651 4.2.5, returns the unescaped String or null if there is no valid String at the cursor
+function parseString(cursor) {
+    const result = match(cursor, STRING);
+    return result && result[1].replace(/\\(["\\])/g, '$1');
+}
+// RFC 9651 4.2.10. The percent encoded bytes must be valid UTF-8, which decodeURIComponent
+// checks as it decodes them
+function isDisplayString(cursor) {
+    const result = match(cursor, DISPLAY_STRING);
+    if (!result) {
+        return false;
+    }
+    try {
+        decodeURIComponent(result[1]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// RFC 9651 4.2.3.1. Returns the value of a String, true for any other valid bare item and
+// false for an invalid one
+function parseBareItem(cursor) {
+    const c = cursor.input.charAt(cursor.pos);
+    switch (c) {
+        case '"':
+            return parseString(cursor) ?? false;
+        case ':':
+            return !!match(cursor, BYTE_SEQUENCE);
+        case '?':
+            return !!match(cursor, BOOLEAN);
+        case '@':
+            return !!match(cursor, DATE);
+        case '%':
+            return isDisplayString(cursor);
+    }
+    return !!match(cursor, c === '-' || (c >= '0' && c <= '9') ? NUMBER : TOKEN);
+}
+/**
+ * Parses a structured field item (RFC 9651 4.2 with field_type "item") whose bare item is a
+ * String. Returns the String and the String parameters, or null if the value does not parse
+ * or the bare item is of another type. A parameter of any other type is stored as true
+ * @internal
+ */
+export function parseStringItem(value) {
+    const cursor = { input: value, pos: 0 };
+    match(cursor, SPACES);
+    const item = parseString(cursor);
+    if (item === null) {
+        return null;
+    }
+    // a later parameter with the same key replaces the earlier one
+    const params = new Map();
+    while (cursor.input[cursor.pos] === ';') {
+        cursor.pos++;
+        match(cursor, SPACES);
+        const key = match(cursor, KEY);
+        if (!key) {
+            return null;
+        }
+        let paramValue = true;
+        if (cursor.input[cursor.pos] === '=') {
+            cursor.pos++;
+            paramValue = parseBareItem(cursor);
+            if (paramValue === false) {
+                return null;
+            }
+        }
+        params.set(key[0], paramValue);
+    }
+    match(cursor, SPACES);
+    return cursor.pos === cursor.input.length ? { value: item, params } : null;
+}
+/**
+ * Checks that the origin is the canonical ASCII serialization of a potentially trustworthy
+ * origin, as the draft requires: https, or http on a loopback host
+ * @internal
+ */
+export function isOtpOrigin(origin) {
+    let url;
+    try {
+        url = new URL(origin);
+    }
+    catch {
+        return false;
+    }
+    // the URL parser lowercases the host, converts it to punycode and drops the default port, so
+    // a value that is not canonical, or has a path, userinfo or an opaque origin, does not match
+    // its own origin. The WHATWG parser lets characters such as a quote or a brace into a host,
+    // which the origin grammar (RFC 6454) does not allow, so only a DNS name, an IPv4 address or a
+    // bracketed IPv6 address is accepted
+    if (url.origin !== origin || !/^([a-z0-9_-]+\.)*[a-z0-9_-]+$|^\[[0-9a-f:.]+\]$/.test(url.hostname)) {
+        return false;
+    }
+    const isLoopback = /^(localhost|.+\.localhost|127(\.\d+){3}|\[::1\])$/.test(url.hostname);
+    return url.protocol === 'https:' || (url.protocol === 'http:' && isLoopback);
+}
+// The field name with its colon. A line with whitespace before the colon is not counted, it
+// is obsolete syntax (RFC 5322 4.5) the draft has no reason to accept
+const OTP_HEADER = /^otp-token:/i;
+/**
+ * Returns the value of a header without its line breaks and the whitespace around it, or null if
+ * the value is longer than the field size limit
+ */
+function getFieldValue(value) {
+    // unfolding removes the line breaks and keeps the whitespace that follows them (RFC 5322 2.2.3)
+    value = value.replace(/\r?\n/g, '');
+    let start = 0;
+    let end = value.length;
+    while (start < end && (value[start] === ' ' || value[start] === '\t')) {
+        start++;
+    }
+    while (end > start && (value[end - 1] === ' ' || value[end - 1] === '\t')) {
+        end--;
+    }
+    return end - start > MAX_FIELD_LENGTH ? null : value.slice(start, end);
+}
+/**
+ * Returns the one-time passcode from the values of the `OTP-Token` headers of a message header
+ * section, following the receiver steps of the draft (section 3.2), or undefined if there is no
+ * valid one. Pass every `OTP-Token` value of the message's own header section, not of a MIME
+ * part: more than one makes the message have none. The values are the raw ones, with any
+ * folding left in and no encoded words decoded
+ */
+export function parseOtpToken(values) {
+    const list = typeof values === 'string' ? [values] : values;
+    if (!Array.isArray(list) || list.length !== 1 || typeof list[0] !== 'string') {
+        return undefined;
+    }
+    const value = getFieldValue(list[0]);
+    const parsed = value === null ? null : parseStringItem(value);
+    const origin = parsed?.params.get('origin');
+    // an empty passcode is valid syntax, but there is nothing in it to fill in
+    if (!parsed?.value || typeof origin !== 'string' || !isOtpOrigin(origin)) {
+        return undefined;
+    }
+    return { code: parsed.value, origin };
+}
+/**
+ * Returns the one-time passcode from the OTP-Token header of a message, or undefined if the
+ * message has no valid one. Only the header of the message itself counts, the draft has an
+ * OTP-Token in a MIME part ignored
+ * @internal
+ */
+export function getOtp(headerLines) {
+    const values = headerLines.filter(({ line }) => OTP_HEADER.test(line)).map(({ line }) => line.slice(line.indexOf(':') + 1));
+    return values.length ? parseOtpToken(values) : undefined;
+}

package/node_modules/mailparser/dist/esm/simple-parser.js

@@ -46,6 +46,9 @@ function simpleParser(input, options, callback) {
     parser.on('headers', headers => {
         mail.headers = headers;
         mail.headerLines = parser.headerLines;
+        if (parser.otp) {
+            mail.otp = parser.otp;
+        }
     });
     let reading = false;
     let reader = () => {

package/node_modules/mailparser/dist/esm/types.d.ts

@@ -104,6 +104,17 @@ export type HeaderLines = ReadonlyArray<{
     key: string;
     line: string;
 }>;
+/**
+ * A one-time passcode from the `OTP-Token` header (draft-goto-otp-token), so that a mail
+ * client can offer it for the origin it is bound to. The header is set by the sender and not
+ * authenticated by the parser, check the DKIM signature of the message before trusting it.
+ */
+export interface Otp {
+    /** The passcode, printable ASCII. */
+    code: string;
+    /** Canonical ASCII serialization of the origin the code is bound to, eg. `https://example.com`. */
+    origin: string;
+}
 /**
  * The properties every attachment has, whether streamed by {@link MailParser} or buffered by
  * `simpleParser`.
@@ -329,6 +340,16 @@ export interface ParsedMail {
     inReplyTo?: string;
     /** The `Reply-To` header. */
     replyTo?: AddressObject;
+    /**
+     * One-time passcode from the `OTP-Token` header of the message. Set only when the header
+     * section has exactly one `OTP-Token` header and it is valid. The header is not
+     * authenticated, verify that the message is signed by the domain of the origin before
+     * trusting it.
+     *
+     * @experimental The header is defined by an Internet-Draft, so this property may change
+     * in a minor release when the draft does.
+     */
+    otp?: Otp;
 }
 /**
  * A message to parse: the raw message as a Buffer or a string, or a readable stream of it.

package/node_modules/mailparser/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailparser",
-    "version": "3.12.4",
+    "version": "3.14.1",
     "description": "Parse e-mails",
     "type": "module",
     "main": "./dist/cjs/index.js",
@@ -97,7 +97,7 @@
         "html-to-text": "10.0.1",
         "libmime": "5.6.3",
         "linkify-it": "5.0.2",
-        "nodemailer": "10.2.1",
+        "nodemailer": "10.3.1",
         "punycode.js": "2.3.1",
         "tlds": "1.261.0"
     },
@@ -112,7 +112,7 @@
         "prettier": "3.9.10",
         "tsx": "4.23.15",
         "typescript": "6.0.3",
-        "typescript-eslint": "8.72.0"
+        "typescript-eslint": "8.72.1"
     },
     "repository": {
         "type": "git",

package/node_modules/nodemailer/CHANGELOG.md

@@ -1,5 +1,24 @@
 # CHANGELOG
 
+## [10.3.1](https://github.com/nodemailer/nodemailer/compare/v10.3.0...v10.3.1) (2026-10-29)
+
+
+### Bug Fixes
+
+* apply the otp option in MailComposer too ([1d4087f](https://github.com/nodemailer/nodemailer/commit/1d4087f358d124267bddd5eb5e11a4e22fccd3d0))
+
+## [10.3.0](https://github.com/nodemailer/nodemailer/compare/v10.2.1...v10.3.0) (2026-10-29)
+
+
+### Features
+
+* add the otp option for the OTP-Token header ([7789e15](https://github.com/nodemailer/nodemailer/commit/7789e1501e4f555e9754a15664aa30f1415902b9))
+
+
+### Bug Fixes
+
+* encode a Content-ID header as a message id ([#1904](https://github.com/nodemailer/nodemailer/issues/1904)) ([47f2b25](https://github.com/nodemailer/nodemailer/commit/47f2b252fccc8ec6a1a5700e12c1087ae3633e17))
+
 ## [10.2.1](https://github.com/nodemailer/nodemailer/compare/v10.2.0...v10.2.1) (2026-10-22)
 
 

package/node_modules/nodemailer/dist/cjs/dkim/sign.js

@@ -68,7 +68,7 @@ function sign(headers, hashAlgo, bodyHash, options) {
         'Content-Description:Resent-Date:Resent-From:Resent-Sender:' +
         'Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:' +
         'List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:' +
-        'List-Owner:List-Archive';
+        'List-Owner:List-Archive:OTP-Token';
     const fieldNames = options.headerFieldNames || defaultFieldNames;
     const canonicalizedHeaderData = relaxedHeaders(headers, fieldNames, options.skipFields);
     const dkimHeader = generateDKIMHeader(options.domainName, options.keySelector, canonicalizedHeaderData.fieldNames, hashAlgo, bodyHash);

package/node_modules/nodemailer/dist/cjs/errors.d.ts

@@ -21,6 +21,7 @@ export declare const ERROR_CODES: {
     readonly EPROTOCOL: "Invalid SMTP server response";
     readonly EENVELOPE: "Invalid mail envelope (sender or recipients)";
     readonly EMESSAGE: "Message delivery error";
+    readonly EOTP: "Invalid one-time passcode data (otp option)";
     readonly ESTREAM: "Stream processing error";
     readonly EAUTH: "Authentication failed";
     readonly ENOAUTH: "Authentication credentials not provided";
@@ -48,6 +49,7 @@ export declare const EREQUIRETLS = "EREQUIRETLS";
 export declare const EPROTOCOL = "EPROTOCOL";
 export declare const EENVELOPE = "EENVELOPE";
 export declare const EMESSAGE = "EMESSAGE";
+export declare const EOTP = "EOTP";
 export declare const ESTREAM = "ESTREAM";
 export declare const EAUTH = "EAUTH";
 export declare const ENOAUTH = "ENOAUTH";

package/node_modules/nodemailer/dist/cjs/errors.js

@@ -10,7 +10,7 @@
  *   err.code = errors.ECONNECTION;
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ERR_ACCESS_DENIED = exports.isPermanentResponseCode = exports.isTransientError = exports.EFETCH = exports.EURLACCESS = exports.EFILEACCESS = exports.EPROXY = exports.ECONFIG = exports.ESES = exports.ESENDMAIL = exports.EMAXRECIPIENTS = exports.EMAXLIMIT = exports.EOAUTH2 = exports.ENOAUTH = exports.EAUTH = exports.ESTREAM = exports.EMESSAGE = exports.EENVELOPE = exports.EPROTOCOL = exports.EREQUIRETLS = exports.ETLS = exports.EDNS = exports.ESOCKET = exports.ETIMEDOUT = exports.ECONNECTION = exports.ERROR_CODES = void 0;
+exports.ERR_ACCESS_DENIED = exports.isPermanentResponseCode = exports.isTransientError = exports.EFETCH = exports.EURLACCESS = exports.EFILEACCESS = exports.EPROXY = exports.ECONFIG = exports.ESES = exports.ESENDMAIL = exports.EMAXRECIPIENTS = exports.EMAXLIMIT = exports.EOAUTH2 = exports.ENOAUTH = exports.EAUTH = exports.ESTREAM = exports.EOTP = exports.EMESSAGE = exports.EENVELOPE = exports.EPROTOCOL = exports.EREQUIRETLS = exports.ETLS = exports.EDNS = exports.ESOCKET = exports.ETIMEDOUT = exports.ECONNECTION = exports.ERROR_CODES = void 0;
 /**
  * Error code descriptions for documentation and debugging
  */
@@ -27,6 +27,7 @@ exports.ERROR_CODES = {
     EPROTOCOL: 'Invalid SMTP server response',
     EENVELOPE: 'Invalid mail envelope (sender or recipients)',
     EMESSAGE: 'Message delivery error',
+    EOTP: 'Invalid one-time passcode data (otp option)',
     ESTREAM: 'Stream processing error',
     // Authentication errors
     EAUTH: 'Authentication failed',
@@ -55,6 +56,7 @@ exports.EREQUIRETLS = 'EREQUIRETLS';
 exports.EPROTOCOL = 'EPROTOCOL';
 exports.EENVELOPE = 'EENVELOPE';
 exports.EMESSAGE = 'EMESSAGE';
+exports.EOTP = 'EOTP';
 exports.ESTREAM = 'ESTREAM';
 exports.EAUTH = 'EAUTH';
 exports.ENOAUTH = 'ENOAUTH';

package/node_modules/nodemailer/dist/cjs/mail-composer/index.d.ts

@@ -72,6 +72,16 @@ export type MailComposerListHeaderEntry = string | {
 export interface MailComposerListHeaders {
     [key: string]: MailComposerListHeaderEntry | (MailComposerListHeaderEntry | MailComposerListHeaderEntry[])[];
 }
+/**
+ * The otp value: a one-time passcode and the origin it is bound to, sent as the OTP-Token
+ * header (draft-goto-otp-token)
+ */
+export interface MailComposerOtp {
+    /** The passcode, printable ascii */
+    code: string;
+    /** Origin the code is bound to, https or a loopback http origin. A full url is reduced to its origin */
+    origin: string;
+}
 /**
  * Encoding for the non-ascii header values: quoted-printable ('Q', the default) or base64
  * ('B'). Only the first letter is read, so the short forms work as well
@@ -114,6 +124,8 @@ export interface MailComposerOptions {
     headers?: MimeNodeHeaders | undefined;
     /** List-* headers, read by the mailer */
     list?: MailComposerListHeaders | undefined;
+    /** One-time passcode for the OTP-Token header. An invalid value makes compile() throw an EOTP error */
+    otp?: MailComposerOtp | undefined;
     /** SMTP envelope to use instead of the one generated from the headers */
     envelope?: MimeNodeEnvelopeInput | undefined;
     /** Content-Transfer-Encoding to force for the text/* nodes that do not set their own */

package/node_modules/nodemailer/dist/cjs/mail-composer/index.js

@@ -39,6 +39,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const index_js_1 = __importDefault(require("../mime-node/index.js"));
 const mimeFuncs = __importStar(require("../mime-funcs/index.js"));
+const errors = __importStar(require("../errors.js"));
 const index_js_2 = require("../shared/index.js");
 /**
  * Creates the object for composing a MimeNode instance out from the mail options
@@ -133,6 +134,10 @@ class MailComposer {
         if (this.mail.headers) {
             this.message.addHeader(this.mail.headers);
         }
+        // after the custom headers, so it replaces an OTP-Token from them, the field may appear only once
+        if (this.mail.otp) {
+            this.message.setHeader('OTP-Token', formatOtpToken(this.mail.otp));
+        }
         // Add headers to the root node, always overrides custom headers
         ['from', 'sender', 'to', 'cc', 'bcc', 'reply-to', 'in-reply-to', 'references', 'subject', 'message-id', 'date'].forEach(header => {
             const key = header.replace(/-(\w)/g, (o, c) => c.toUpperCase());
@@ -641,6 +646,54 @@ class MailComposer {
         return element;
     }
 }
+/**
+ * Returns the value of the OTP-Token header for the otp option. The header is defined by
+ * draft-goto-otp-token-01, an Internet-Draft that expires on 25 March 2027. By then check
+ * for a newer revision of the draft or a published RFC, the header name and its
+ * parameters are still open questions in the draft.
+ */
+function formatOtpToken(otp) {
+    // a structured field String can only hold printable ascii. The code is a secret the recipient
+    // compares against the one in the message body, so it is rejected rather than cleaned up
+    if (typeof otp.code !== 'string' || !/^[\x20-\x7e]+$/.test(otp.code)) {
+        throw otpError('The otp code must be a non-empty string of printable ASCII characters');
+    }
+    // a structured field String escapes the same two characters as a quoted-string
+    return mimeFuncs.quoteString(otp.code) + '; origin=' + mimeFuncs.quoteString(getOtpOrigin(otp.origin));
+}
+/**
+ * Returns the canonical ascii serialization of the origin the code is bound to. The draft
+ * requires a potentially trustworthy origin, so only https is accepted, plus http on a
+ * loopback host for local development
+ */
+function getOtpOrigin(origin) {
+    let url;
+    try {
+        url = new URL(String(origin));
+    }
+    catch {
+        // handled below
+    }
+    // the WHATWG parser lets characters such as a quote or a brace into a host, which the
+    // origin grammar the draft requires (RFC 6454) does not allow, so a receiver would discard
+    // the header. Only a DNS name, an IPv4 address or a bracketed IPv6 address is accepted.
+    // Userinfo is refused as well, an origin never has it and it turns a value built as
+    // 'https://example.com' + input into the origin of whatever host follows an "@"
+    if (!url || url.username || url.password || !/^([a-z0-9_-]+\.)*[a-z0-9_-]+$|^\[[0-9a-f:.]+\]$/.test(url.hostname)) {
+        throw otpError('The otp origin must be an absolute https URL');
+    }
+    const isLoopback = /^(localhost|.+\.localhost|127(\.\d+){3}|\[::1\])$/.test(url.hostname);
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && isLoopback)) {
+        throw otpError('The otp origin must be an https URL, or an http URL on a loopback host');
+    }
+    // the URL parser already lowercases the host, converts it to punycode and drops the default port
+    return url.origin;
+}
+function otpError(message) {
+    const err = new Error(message);
+    err.code = errors.EOTP;
+    return err;
+}
 exports.default = MailComposer;
 module.exports = exports.default;
 Object.defineProperty(module.exports, 'default', { value: exports.default, enumerable: false, writable: true, configurable: true });

package/node_modules/nodemailer/dist/cjs/mailer/index.d.ts

@@ -4,7 +4,7 @@ import DKIM, { type DKIMOptions } from '../dkim/index.js';
 import MailMessage, { type MailDefaults, type SendMailOptions } from './mail-message.js';
 import net from 'node:net';
 import type { ConnectionOptions } from 'node:tls';
-import type { MailComposerAlternative, MailComposerAttachment, MailComposerIcalEvent, MailComposerListHeaderEntry, MailComposerListHeaders, MailComposerTextEncoding } from '../mail-composer/index.js';
+import type { MailComposerAlternative, MailComposerAttachment, MailComposerIcalEvent, MailComposerListHeaderEntry, MailComposerListHeaders, MailComposerOtp, MailComposerTextEncoding } from '../mail-composer/index.js';
 import type { Callback, NodemailerError, ResultCallback } from '../errors.js';
 import type { ParsedUrl } from '../shared/url.js';
 import type { MimeNodeAddress, MimeNodeEnvelope, MimeNodeEnvelopeInput, MimeNodeHeaders, MimeNodeOptions } from '../mime-node/index.js';
@@ -227,11 +227,12 @@ declare namespace Mail {
     type Headers = MimeNodeHeaders;
     type ListHeader = MailComposerListHeaderEntry;
     type ListHeaders = MailComposerListHeaders;
+    type Otp = MailComposerOtp;
     type Envelope = MimeNodeEnvelopeInput;
     type Connection = SocketOptions;
     type TextEncoding = MailComposerTextEncoding;
     type PluginFunction<T = SentMessageInfo> = MailPluginFunction<T>;
 }
 /** The same aliases as module level exports, for `import * as Mail` and `import Mail = require()` */
-export type { SendMailOptions as Options, MimeNodeAddress as Address, MailComposerAttachment as Attachment, MailComposerAlternative as AttachmentLike, MailComposerAlternative as AmpAttachment, MailComposerIcalEvent as IcalAttachment, MimeNodeHeaders as Headers, MailComposerListHeaderEntry as ListHeader, MailComposerListHeaders as ListHeaders, MimeNodeEnvelopeInput as Envelope, SocketOptions as Connection, MailComposerTextEncoding as TextEncoding };
+export type { SendMailOptions as Options, MimeNodeAddress as Address, MailComposerAttachment as Attachment, MailComposerAlternative as AttachmentLike, MailComposerAlternative as AmpAttachment, MailComposerIcalEvent as IcalAttachment, MimeNodeHeaders as Headers, MailComposerListHeaderEntry as ListHeader, MailComposerListHeaders as ListHeaders, MailComposerOtp as Otp, MimeNodeEnvelopeInput as Envelope, SocketOptions as Connection, MailComposerTextEncoding as TextEncoding };
 export default Mail;

package/node_modules/nodemailer/dist/cjs/mime-node/index.js

@@ -1302,7 +1302,7 @@ class MimeNode {
             .replace(/[\s\x00-\x20\x7f:]/g, '')
             .toLowerCase()
             // use uppercase words, except MIME
-            .replace(/^X-SMTPAPI$|^(MIME|DKIM|ARC|BIMI)\b|^[a-z]|-(SPF|FBL|ID|MD5)$|-[a-z]/gi, c => c.toUpperCase())
+            .replace(/^X-SMTPAPI$|^(MIME|DKIM|ARC|BIMI)\b|^OTP(?=-Token$)|^[a-z]|-(SPF|FBL|ID|MD5)$|-[a-z]/gi, c => c.toUpperCase())
             // special case
             .replace(/^Content-Features$/i, 'Content-features');
         return key;
@@ -1374,7 +1374,7 @@ class MimeNode {
             // values enclosed in <>
             case 'Message-ID':
             case 'In-Reply-To':
-            case 'Content-Id':
+            case 'Content-ID':
                 // a msg-id is structured, so an encoded word inside the angle brackets would
                 // be read as literal text. drop the characters that can not appear in a header
                 // at all, but leave HT alone, it separates the ids of a multi id value
@@ -1389,6 +1389,14 @@ class MimeNode {
                     value = value + '>';
                 }
                 return value;
+            // a structured field (RFC 9651) that can not be mime encoded, an encoded word would
+            // turn its quoted strings into text that no structured field parser reads. Only
+            // the characters that can not appear in a header at all are removed
+            case 'OTP-Token':
+                return (value || '')
+                    .toString()
+                    .replace(/\r?\n|\r/g, ' ')
+                    .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '');
             // space separated list of values enclosed in <>
             case 'References': {
                 const ids = [];

package/node_modules/nodemailer/dist/cjs/nodemailer.d.ts

@@ -111,7 +111,7 @@ export type { Mail, MailDefaults, SentMessageInfo, Transport, TransportOptions }
 export type { SendMailOptions, Transporter } from './mailer/index.js';
 export type { NodemailerError, ErrorCode } from './errors.js';
 export type { MailMessage, MailMessageData, PluginFunction, VerifyCallback } from './mailer/index.js';
-export type { MailComposerOptions, MailComposerAttachment as Attachment, MailComposerAlternative as AttachmentLike, MailComposerIcalEvent as IcalAttachment, MailComposerListHeaders as ListHeaders } from './mail-composer/index.js';
+export type { MailComposerOptions, MailComposerAttachment as Attachment, MailComposerAlternative as AttachmentLike, MailComposerIcalEvent as IcalAttachment, MailComposerListHeaders as ListHeaders, MailComposerOtp as Otp } from './mail-composer/index.js';
 export type { MimeNodeAddress as Address, MimeNodeHeaders as Headers } from './mime-node/index.js';
 export type { SMTPConnectionOptions, SMTPConnectionAuth, SMTPEnvelope, SMTPEnvelopeDsn } from './smtp-connection/index.js';
 export type { DKIMOptions } from './dkim/index.js';

package/node_modules/nodemailer/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.2.1";
+export declare const version = "10.3.1";
 export declare const homepage = "https://nodemailer.com/";

package/node_modules/nodemailer/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = 'nodemailer';
-exports.version = '10.2.1';
+exports.version = '10.3.1';
 exports.homepage = 'https://nodemailer.com/';

package/node_modules/nodemailer/dist/cjs/well-known/services.js

@@ -208,6 +208,13 @@ exports.services = {
         "host": "smtp.europe.secureserver.net",
         "port": 25
     },
+    "Groundmail": {
+        "description": "Groundmail",
+        "host": "smtp.groundmail.dev",
+        "port": 587,
+        "secure": false,
+        "requireTLS": true
+    },
     "hot.ee": {
         "description": "Hot.ee (Estonian email provider)",
         "host": "mail.hot.ee"

package/node_modules/nodemailer/dist/esm/dkim/sign.js

@@ -30,7 +30,7 @@ function sign(headers, hashAlgo, bodyHash, options) {
         'Content-Description:Resent-Date:Resent-From:Resent-Sender:' +
         'Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:' +
         'List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:' +
-        'List-Owner:List-Archive';
+        'List-Owner:List-Archive:OTP-Token';
     const fieldNames = options.headerFieldNames || defaultFieldNames;
     const canonicalizedHeaderData = relaxedHeaders(headers, fieldNames, options.skipFields);
     const dkimHeader = generateDKIMHeader(options.domainName, options.keySelector, canonicalizedHeaderData.fieldNames, hashAlgo, bodyHash);

package/node_modules/nodemailer/dist/esm/errors.d.ts

@@ -21,6 +21,7 @@ export declare const ERROR_CODES: {
     readonly EPROTOCOL: "Invalid SMTP server response";
     readonly EENVELOPE: "Invalid mail envelope (sender or recipients)";
     readonly EMESSAGE: "Message delivery error";
+    readonly EOTP: "Invalid one-time passcode data (otp option)";
     readonly ESTREAM: "Stream processing error";
     readonly EAUTH: "Authentication failed";
     readonly ENOAUTH: "Authentication credentials not provided";
@@ -48,6 +49,7 @@ export declare const EREQUIRETLS = "EREQUIRETLS";
 export declare const EPROTOCOL = "EPROTOCOL";
 export declare const EENVELOPE = "EENVELOPE";
 export declare const EMESSAGE = "EMESSAGE";
+export declare const EOTP = "EOTP";
 export declare const ESTREAM = "ESTREAM";
 export declare const EAUTH = "EAUTH";
 export declare const ENOAUTH = "ENOAUTH";

package/node_modules/nodemailer/dist/esm/errors.js

@@ -24,6 +24,7 @@ export const ERROR_CODES = {
     EPROTOCOL: 'Invalid SMTP server response',
     EENVELOPE: 'Invalid mail envelope (sender or recipients)',
     EMESSAGE: 'Message delivery error',
+    EOTP: 'Invalid one-time passcode data (otp option)',
     ESTREAM: 'Stream processing error',
     // Authentication errors
     EAUTH: 'Authentication failed',
@@ -52,6 +53,7 @@ export const EREQUIRETLS = 'EREQUIRETLS';
 export const EPROTOCOL = 'EPROTOCOL';
 export const EENVELOPE = 'EENVELOPE';
 export const EMESSAGE = 'EMESSAGE';
+export const EOTP = 'EOTP';
 export const ESTREAM = 'ESTREAM';
 export const EAUTH = 'EAUTH';
 export const ENOAUTH = 'ENOAUTH';

package/node_modules/nodemailer/dist/esm/mail-composer/index.d.ts

@@ -72,6 +72,16 @@ export type MailComposerListHeaderEntry = string | {
 export interface MailComposerListHeaders {
     [key: string]: MailComposerListHeaderEntry | (MailComposerListHeaderEntry | MailComposerListHeaderEntry[])[];
 }
+/**
+ * The otp value: a one-time passcode and the origin it is bound to, sent as the OTP-Token
+ * header (draft-goto-otp-token)
+ */
+export interface MailComposerOtp {
+    /** The passcode, printable ascii */
+    code: string;
+    /** Origin the code is bound to, https or a loopback http origin. A full url is reduced to its origin */
+    origin: string;
+}
 /**
  * Encoding for the non-ascii header values: quoted-printable ('Q', the default) or base64
  * ('B'). Only the first letter is read, so the short forms work as well
@@ -114,6 +124,8 @@ export interface MailComposerOptions {
     headers?: MimeNodeHeaders | undefined;
     /** List-* headers, read by the mailer */
     list?: MailComposerListHeaders | undefined;
+    /** One-time passcode for the OTP-Token header. An invalid value makes compile() throw an EOTP error */
+    otp?: MailComposerOtp | undefined;
     /** SMTP envelope to use instead of the one generated from the headers */
     envelope?: MimeNodeEnvelopeInput | undefined;
     /** Content-Transfer-Encoding to force for the text/* nodes that do not set their own */