@mavogel/awscdk-rootmail 0.1.34 → 0.1.36

package/node_modules/@smithy/signature-v4/dist-cjs/index.js

@@ -1,4 +1,4 @@
-const { hasOwn, fromUtf8, fromHex, toHex, toUint8Array, isArrayBuffer } = require("@smithy/core/serde");
+const { hasOwn, fromUtf8, fromHex, toHex, toUint8Array, writeKey, isArrayBuffer } = require("@smithy/core/serde");
 const { normalizeProvider } = require("@smithy/core/client");
 const { escapeUri, HttpRequest } = require("@smithy/core/protocols");
 
@@ -6,8 +6,9 @@ class HeaderFormatter {
     format(headers) {
         const chunks = [];
         for (const headerName in headers) {
-            if (!hasOwn(headers, headerName))
+            if (!hasOwn(headers, headerName)) {
                 continue;
+            }
             const bytes = fromUtf8(headerName);
             chunks.push(Uint8Array.from([bytes.byteLength]), bytes, this.formatHeaderValue(headers[headerName]));
         }
@@ -124,8 +125,9 @@ function negate(bytes) {
     }
     for (let i = 7; i > -1; i--) {
         bytes[i]++;
-        if (bytes[i] !== 0)
+        if (bytes[i] !== 0) {
             break;
+        }
     }
 }
 
@@ -177,8 +179,9 @@ const getCanonicalQuery = ({ query = {} }) => {
     const keys = [];
     const serialized = {};
     for (const key in query) {
-        if (!hasOwn(query, key))
+        if (!hasOwn(query, key)) {
             continue;
+        }
         if (key.toLowerCase() === SIGNATURE_HEADER) {
             continue;
         }
@@ -257,10 +260,12 @@ ${toHex(hashedRequest)}`;
         if (this.uriEscapePath) {
             const normalizedPathSegments = [];
             for (const pathSegment of path.split("/")) {
-                if (pathSegment?.length === 0)
+                if (pathSegment?.length === 0) {
                     continue;
-                if (pathSegment === ".")
+                }
+                if (pathSegment === ".") {
                     continue;
+                }
                 if (pathSegment === "..") {
                     normalizedPathSegments.pop();
                 }
@@ -331,7 +336,7 @@ const getCanonicalHeaders = ({ headers }, unsignableHeaders, signableHeaders) =>
             continue;
         }
         const canonicalHeaderName = headerName.toLowerCase();
-        if (canonicalHeaderName in ALWAYS_UNSIGNABLE_HEADERS ||
+        if (hasOwn(ALWAYS_UNSIGNABLE_HEADERS, canonicalHeaderName) ||
             unsignableHeaders?.has(canonicalHeaderName) ||
             PROXY_HEADER_PATTERN.test(canonicalHeaderName) ||
             SEC_HEADER_PATTERN.test(canonicalHeaderName)) {
@@ -339,6 +344,9 @@ const getCanonicalHeaders = ({ headers }, unsignableHeaders, signableHeaders) =>
                 continue;
             }
         }
+        if (canonicalHeaderName === "__proto__") {
+            writeKey(canonical);
+        }
         canonical[canonicalHeaderName] = headers[headerName]
             .replace(/[\r\n]/g, " ")
             .replace(/[ \t]+/g, " ")
@@ -349,8 +357,9 @@ const getCanonicalHeaders = ({ headers }, unsignableHeaders, signableHeaders) =>
 
 const getPayloadHash = async ({ headers, body }, hashConstructor) => {
     for (const headerName in headers) {
-        if (!hasOwn(headers, headerName))
+        if (!hasOwn(headers, headerName)) {
             continue;
+        }
         if (headerName.toLowerCase() === SHA256_HEADER) {
             return headers[headerName];
         }
@@ -369,8 +378,9 @@ const getPayloadHash = async ({ headers, body }, hashConstructor) => {
 const hasHeader = (soughtHeader, headers) => {
     soughtHeader = soughtHeader.toLowerCase();
     for (const headerName in headers) {
-        if (!hasOwn(headers, headerName))
+        if (!hasOwn(headers, headerName)) {
             continue;
+        }
         if (soughtHeader === headerName.toLowerCase()) {
             return true;
         }
@@ -381,8 +391,9 @@ const hasHeader = (soughtHeader, headers) => {
 const moveHeadersToQuery = (request, options = {}) => {
     const { headers, query = {} } = HttpRequest.clone(request);
     for (const name in headers) {
-        if (!hasOwn(headers, name))
+        if (!hasOwn(headers, name)) {
             continue;
+        }
         const lname = name.toLowerCase();
         if ((lname.slice(0, 6) === "x-amz-" && !options.unhoistableHeaders?.has(lname)) ||
             options.hoistableHeaders?.has(lname)) {
@@ -400,8 +411,9 @@ const moveHeadersToQuery = (request, options = {}) => {
 const prepareRequest = (request) => {
     request = HttpRequest.clone(request);
     for (const headerName in request.headers) {
-        if (!hasOwn(request.headers, headerName))
+        if (!hasOwn(request.headers, headerName)) {
             continue;
+        }
         if (GENERATED_HEADERS.indexOf(headerName.toLowerCase()) > -1) {
             delete request.headers[headerName];
         }

package/node_modules/@smithy/signature-v4/dist-es/HeaderFormatter.js

@@ -4,8 +4,9 @@ export class HeaderFormatter {
     format(headers) {
         const chunks = [];
         for (const headerName in headers) {
-            if (!hasOwn(headers, headerName))
+            if (!hasOwn(headers, headerName)) {
                 continue;
+            }
             const bytes = fromUtf8(headerName);
             chunks.push(Uint8Array.from([bytes.byteLength]), bytes, this.formatHeaderValue(headers[headerName]));
         }
@@ -122,7 +123,8 @@ function negate(bytes) {
     }
     for (let i = 7; i > -1; i--) {
         bytes[i]++;
-        if (bytes[i] !== 0)
+        if (bytes[i] !== 0) {
             break;
+        }
     }
 }

package/node_modules/@smithy/signature-v4/dist-es/SignatureV4Base.js

@@ -41,10 +41,12 @@ ${toHex(hashedRequest)}`;
         if (this.uriEscapePath) {
             const normalizedPathSegments = [];
             for (const pathSegment of path.split("/")) {
-                if (pathSegment?.length === 0)
+                if (pathSegment?.length === 0) {
                     continue;
-                if (pathSegment === ".")
+                }
+                if (pathSegment === ".") {
                     continue;
+                }
                 if (pathSegment === "..") {
                     normalizedPathSegments.pop();
                 }

package/node_modules/@smithy/signature-v4/dist-es/getCanonicalHeaders.js

@@ -1,3 +1,4 @@
+import { hasOwn, writeKey } from "@smithy/core/serde";
 import { ALWAYS_UNSIGNABLE_HEADERS, PROXY_HEADER_PATTERN, SEC_HEADER_PATTERN } from "./constants";
 export const getCanonicalHeaders = ({ headers }, unsignableHeaders, signableHeaders) => {
     const canonical = {};
@@ -6,7 +7,7 @@ export const getCanonicalHeaders = ({ headers }, unsignableHeaders, signableHead
             continue;
         }
         const canonicalHeaderName = headerName.toLowerCase();
-        if (canonicalHeaderName in ALWAYS_UNSIGNABLE_HEADERS ||
+        if (hasOwn(ALWAYS_UNSIGNABLE_HEADERS, canonicalHeaderName) ||
             unsignableHeaders?.has(canonicalHeaderName) ||
             PROXY_HEADER_PATTERN.test(canonicalHeaderName) ||
             SEC_HEADER_PATTERN.test(canonicalHeaderName)) {
@@ -14,6 +15,9 @@ export const getCanonicalHeaders = ({ headers }, unsignableHeaders, signableHead
                 continue;
             }
         }
+        if (canonicalHeaderName === "__proto__") {
+            writeKey(canonical);
+        }
         canonical[canonicalHeaderName] = headers[headerName]
             .replace(/[\r\n]/g, " ")
             .replace(/[ \t]+/g, " ")

package/node_modules/@smithy/signature-v4/dist-es/getCanonicalQuery.js

@@ -5,8 +5,9 @@ export const getCanonicalQuery = ({ query = {} }) => {
     const keys = [];
     const serialized = {};
     for (const key in query) {
-        if (!hasOwn(query, key))
+        if (!hasOwn(query, key)) {
             continue;
+        }
         if (key.toLowerCase() === SIGNATURE_HEADER) {
             continue;
         }

package/node_modules/@smithy/signature-v4/dist-es/getPayloadHash.js

@@ -3,8 +3,9 @@ import { isArrayBuffer, toHex, toUint8Array } from "@smithy/core/serde";
 import { SHA256_HEADER, UNSIGNED_PAYLOAD } from "./constants";
 export const getPayloadHash = async ({ headers, body }, hashConstructor) => {
     for (const headerName in headers) {
-        if (!hasOwn(headers, headerName))
+        if (!hasOwn(headers, headerName)) {
             continue;
+        }
         if (headerName.toLowerCase() === SHA256_HEADER) {
             return headers[headerName];
         }

package/node_modules/@smithy/signature-v4/dist-es/headerUtil.js

@@ -2,8 +2,9 @@ import { hasOwn } from "@smithy/core/serde";
 export const hasHeader = (soughtHeader, headers) => {
     soughtHeader = soughtHeader.toLowerCase();
     for (const headerName in headers) {
-        if (!hasOwn(headers, headerName))
+        if (!hasOwn(headers, headerName)) {
             continue;
+        }
         if (soughtHeader === headerName.toLowerCase()) {
             return true;
         }
@@ -13,8 +14,9 @@ export const hasHeader = (soughtHeader, headers) => {
 export const getHeaderValue = (soughtHeader, headers) => {
     soughtHeader = soughtHeader.toLowerCase();
     for (const headerName in headers) {
-        if (!hasOwn(headers, headerName))
+        if (!hasOwn(headers, headerName)) {
             continue;
+        }
         if (soughtHeader === headerName.toLowerCase()) {
             return headers[headerName];
         }
@@ -24,8 +26,9 @@ export const getHeaderValue = (soughtHeader, headers) => {
 export const deleteHeader = (soughtHeader, headers) => {
     soughtHeader = soughtHeader.toLowerCase();
     for (const headerName in headers) {
-        if (!hasOwn(headers, headerName))
+        if (!hasOwn(headers, headerName)) {
             continue;
+        }
         if (soughtHeader === headerName.toLowerCase()) {
             delete headers[headerName];
         }

package/node_modules/@smithy/signature-v4/dist-es/moveHeadersToQuery.js

@@ -3,8 +3,9 @@ import { HttpRequest } from "@smithy/core/protocols";
 export const moveHeadersToQuery = (request, options = {}) => {
     const { headers, query = {} } = HttpRequest.clone(request);
     for (const name in headers) {
-        if (!hasOwn(headers, name))
+        if (!hasOwn(headers, name)) {
             continue;
+        }
         const lname = name.toLowerCase();
         if ((lname.slice(0, 6) === "x-amz-" && !options.unhoistableHeaders?.has(lname)) ||
             options.hoistableHeaders?.has(lname)) {

package/node_modules/@smithy/signature-v4/dist-es/prepareRequest.js

@@ -4,8 +4,9 @@ import { GENERATED_HEADERS } from "./constants";
 export const prepareRequest = (request) => {
     request = HttpRequest.clone(request);
     for (const headerName in request.headers) {
-        if (!hasOwn(request.headers, headerName))
+        if (!hasOwn(request.headers, headerName)) {
             continue;
+        }
         if (GENERATED_HEADERS.indexOf(headerName.toLowerCase()) > -1) {
             delete request.headers[headerName];
         }

package/node_modules/@smithy/signature-v4/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smithy/signature-v4",
-  "version": "5.7.4",
+  "version": "5.7.5",
   "description": "A standalone implementation of the AWS Signature V4 request signing algorithm",
   "homepage": "https://github.com/smithy-lang/smithy-typescript/tree/main/packages/signature-v4",
   "license": "Apache-2.0",
@@ -38,7 +38,7 @@
     "test:watch": "yarn g:vitest watch"
   },
   "dependencies": {
-    "@smithy/core": "^3.35.0",
+    "@smithy/core": "^3.38.0",
     "@smithy/types": "^4.19.0",
     "tslib": "^2.6.2"
   },

package/node_modules/mailparser/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## [3.14.1](https://github.com/nodemailer/mailparser/compare/v3.14.0...v3.14.1) (2026-10-29)
+
+
+### Bug Fixes
+
+* update dependencies ([e5ae8e4](https://github.com/nodemailer/mailparser/commit/e5ae8e4d06058878e7a2bea4440f31af659a3c10))
+
+## [3.14.0](https://github.com/nodemailer/mailparser/compare/v3.13.0...v3.14.0) (2026-10-29)
+
+
+### Features
+
+* export parseOtpToken for OTP-Token values read outside the parser ([fda26b2](https://github.com/nodemailer/mailparser/commit/fda26b2c1a14927b17a16a42d406576f21de4fc4))
+
+## [3.13.0](https://github.com/nodemailer/mailparser/compare/v3.12.4...v3.13.0) (2026-10-29)
+
+
+### Features
+
+* parse the OTP-Token header into mail.otp ([bc20682](https://github.com/nodemailer/mailparser/commit/bc206829c8cc287b7d980d604d0a3fbe6cbc0179))
+
+
+### Bug Fixes
+
+* update dependencies ([f94b954](https://github.com/nodemailer/mailparser/commit/f94b954efcdf63d117097ebdecf79acb71e81bfa))
+
 ## [3.12.4](https://github.com/nodemailer/mailparser/compare/v3.12.3...v3.12.4) (2026-10-22)
 
 

package/node_modules/mailparser/README.md

@@ -24,7 +24,7 @@ const mailparser = require('mailparser');
 or, from an ES module or TypeScript (type declarations are included):
 
 ```js
-import { simpleParser, MailParser, parseAddressHeader } from 'mailparser';
+import { simpleParser, MailParser, parseAddressHeader, parseOtpToken } from 'mailparser';
 ```
 
 ## Usage
@@ -54,6 +54,26 @@ parseAddressHeader('=?utf-8?Q?J=C3=B5geva?= <info@xn--mnchen-3ya.example>, Team:
 
 Each entry of `value` has a `name` (an empty string when there is none, encoded words decoded) and either an `address` (a punycode domain decoded to Unicode) or, for a group, a `group` list of the same entries. RFC 2047 does not allow encoded words in the address itself, so an address part hiding one is kept only when it decodes to a plain `local@domain`, otherwise `address` is an empty string; a display name that decodes to something looking like an address stays a name.
 
+### One-time passcodes
+
+A message with an `OTP-Token` header ([draft-goto-otp-token](https://datatracker.ietf.org/doc/draft-goto-otp-token/), the header Nodemailer sets with its `otp` option) gets an `otp` property on the `simpleParser` result and on the `MailParser` instance, an object with `code` (the passcode) and `origin` (the origin it is bound to, such as `"https://example.com"`).
+
+```js
+const mail = await simpleParser('OTP-Token: "123456"; origin="https://example.com"\r\nSubject: Code\r\n\r\nYour code is 123456');
+// mail.otp: { code: '123456', origin: 'https://example.com' }
+```
+
+`otp` is set only when the message header has exactly one `OTP-Token` header and its value is valid: a structured field String with an `origin` parameter holding a canonical `https` origin, or an `http` origin on a loopback host. An `OTP-Token` header of a MIME part or a forwarded message is ignored. The header is not authenticated, so check that the message carries a valid DKIM signature from the domain of the origin before offering the code. The header comes from an Internet-Draft, so `otp` is experimental and may change in a minor release when the draft does.
+
+For a header that comes from somewhere else than a message being parsed, such as an IMAP `HEADER.FIELDS` fetch or a provider API, `parseOtpToken(values)` takes the raw values of every `OTP-Token` header of the message's own header section (a string or an array) and returns the same `{ code, origin }` object, or `undefined`. The same rules apply, so more than one value returns `undefined`.
+
+```js
+const { parseOtpToken } = require('mailparser');
+
+parseOtpToken(['"123456"; origin="https://example.com"']);
+// { code: '123456', origin: 'https://example.com' }
+```
+
 ### Character sets
 
 Text bodies are decoded with libmime's `createDecodeStream()`, which resolves charset aliases, decodes the Japanese charsets iconv-lite does not support (ISO-2022-JP and friends) and keeps a multibyte character that is split across chunks intact. A body in a charset that is not known, or one that is refused, is decoded as UTF-8 with invalid bytes replaced by U+FFFD, the same fallback encoded words in headers get. The refused charsets are UTF-7 (and its aliases), which can carry markup past a filter that looks for `<` (`+ADw-script+AD4-` decodes to `<script>`), and the base64 and hex transfer encodings. A UTF-7 body therefore keeps its `+ADw-` sequences as literal text. The refusal applies with the `Iconv` option as well.

package/node_modules/mailparser/dist/cjs/index.d.ts

@@ -1,12 +1,14 @@
 import MailParser from './mail-parser.js';
 import simpleParser from './simple-parser.js';
 import { parseAddressHeader } from './address-header.js';
-export { MailParser, simpleParser, parseAddressHeader };
+import { parseOtpToken } from './otp-token.js';
+export { MailParser, simpleParser, parseAddressHeader, parseOtpToken };
 export type { SimpleParserCallback } from './simple-parser.js';
 export type * from './types.js';
 declare const _default: {
     MailParser: typeof MailParser;
     simpleParser: typeof simpleParser;
     parseAddressHeader: typeof parseAddressHeader;
+    parseOtpToken: typeof parseOtpToken;
 };
 export default _default;

package/node_modules/mailparser/dist/cjs/index.js

@@ -3,12 +3,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseAddressHeader = exports.simpleParser = exports.MailParser = void 0;
+exports.parseOtpToken = exports.parseAddressHeader = exports.simpleParser = exports.MailParser = void 0;
 const mail_parser_js_1 = __importDefault(require("./mail-parser.js"));
 exports.MailParser = mail_parser_js_1.default;
 const simple_parser_js_1 = __importDefault(require("./simple-parser.js"));
 exports.simpleParser = simple_parser_js_1.default;
 const address_header_js_1 = require("./address-header.js");
 Object.defineProperty(exports, "parseAddressHeader", { enumerable: true, get: function () { return address_header_js_1.parseAddressHeader; } });
-exports.default = { MailParser: mail_parser_js_1.default, simpleParser: simple_parser_js_1.default, parseAddressHeader: address_header_js_1.parseAddressHeader };
+const otp_token_js_1 = require("./otp-token.js");
+Object.defineProperty(exports, "parseOtpToken", { enumerable: true, get: function () { return otp_token_js_1.parseOtpToken; } });
+exports.default = { MailParser: mail_parser_js_1.default, simpleParser: simple_parser_js_1.default, parseAddressHeader: address_header_js_1.parseAddressHeader, parseOtpToken: otp_token_js_1.parseOtpToken };
 Object.defineProperty(exports, 'default', { value: exports, enumerable: false, writable: true, configurable: true });

package/node_modules/mailparser/dist/cjs/mail-parser.d.ts

@@ -1,6 +1,6 @@
 import { Transform } from 'node:stream';
 import type { TransformCallback } from 'node:stream';
-import type { AddressObject, AttachmentStream, EmailAddress, HeaderLines, Headers, MailParserOptions, MessageText } from './types.js';
+import type { AddressObject, AttachmentStream, EmailAddress, HeaderLines, Headers, MailParserOptions, MessageText, Otp } from './types.js';
 /**
  * A lower level, streaming e-mail parser. It is a Transform stream: write the raw message in and
  * read the parsed content out. It emits:
@@ -46,6 +46,13 @@ declare class MailParser extends Transform {
     inReplyTo?: string;
     /** The `Reply-To` header, set once the headers have been parsed. */
     replyTo?: AddressObject;
+    /**
+     * One-time passcode from the `OTP-Token` header, set once the headers have been parsed if the
+     * message has a valid one. The header is not authenticated, see `ParsedMail.otp`.
+     *
+     * @experimental
+     */
+    otp?: Otp;
     constructor(config?: MailParserOptions);
     _transform(chunk: Buffer, encoding: BufferEncoding, done: TransformCallback): void;
     _flush(done: TransformCallback): void;

package/node_modules/mailparser/dist/cjs/mail-parser.js

@@ -14,6 +14,7 @@ const node_stream_1 = require("node:stream");
 const tlds_cjs_1 = __importDefault(require("./tlds.cjs"));
 const stream_hash_js_1 = __importDefault(require("./stream-hash.js"));
 const address_header_js_1 = require("./address-header.js");
+const otp_token_js_1 = require("./otp-token.js");
 const { Splitter, ChunkedPassthrough } = mailsplit_1.default;
 // Bounds for link detection in text bodies. Message content is untrusted and
 // linkify-it backtracks heavily on crafted input: matching a host is quadratic
@@ -863,6 +864,10 @@ class MailParser extends node_stream_1.Transform {
                             this[key.replace(/-([a-z])/g, (m, c) => c.toUpperCase())] = node.headers.get(key);
                         }
                     });
+                    let otp = (0, otp_token_js_1.getOtp)(node.headerLines);
+                    if (otp) {
+                        this.otp = otp;
+                    }
                     this.emit('headers', node.headers);
                     if (node.headerLines) {
                         this.emit('headerLines', node.headerLines);

package/node_modules/mailparser/dist/cjs/otp-token.d.ts

@@ -0,0 +1,9 @@
+import type { Otp } from './types.js';
+/**
+ * Returns the one-time passcode from the values of the `OTP-Token` headers of a message header
+ * section, following the receiver steps of the draft (section 3.2), or undefined if there is no
+ * valid one. Pass every `OTP-Token` value of the message's own header section, not of a MIME
+ * part: more than one makes the message have none. The values are the raw ones, with any
+ * folding left in and no encoded words decoded
+ */
+export declare function parseOtpToken(values: string | string[] | undefined): Otp | undefined;

package/node_modules/mailparser/dist/cjs/otp-token.js

@@ -0,0 +1,186 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseStringItem = parseStringItem;
+exports.isOtpOrigin = isOtpOrigin;
+exports.parseOtpToken = parseOtpToken;
+exports.getOtp = getOtp;
+// Parser for the OTP-Token header of draft-goto-otp-token-01, an Internet-Draft that expires
+// on 25 March 2027. By then check for a newer revision of the draft or a published RFC, the
+// header name and its parameters are still open questions in the draft.
+//
+// The header value is a structured field item (RFC 9651): a String holding the passcode,
+// with an `origin` parameter naming the origin the passcode is bound to. Unknown parameters
+// are ignored, but they still have to be valid, otherwise the whole field fails to parse.
+// RFC 9651 lets a parser limit the size of a field. A passcode and an origin take well under
+// a kilobyte, the limit keeps the regular expressions below away from megabyte inputs
+const MAX_FIELD_LENGTH = 8192;
+// The bare item syntax of RFC 9651 4.2.3.1, keyed by the first character of the item. An
+// Integer has at most 15 digits, a Decimal at most 12 before and 1 to 3 after the dot, and a
+// Date is an Integer. Whatever follows a match is left for the caller, which only accepts a
+// parameter separator or the end of the field, so a 16th digit or a 4th decimal fails there
+const NUMBER = /-?(?:\d{1,12}\.\d{1,3}|\d{1,15})/y;
+const STRING = /"((?:[\x20\x21\x23-\x5b\x5d-\x7e]|\\["\\])*)"/y;
+const TOKEN = /[A-Za-z*][!#$%&'*+\-.^_`|~0-9A-Za-z:/]*/y;
+const BYTE_SEQUENCE = /:[A-Za-z0-9+/=]*:/y;
+const BOOLEAN = /\?[01]/y;
+const DATE = /@-?\d{1,15}/y;
+const DISPLAY_STRING = /%"((?:[\x20\x21\x23\x24\x26-\x7e]|%[0-9a-f]{2})*)"/y;
+const KEY = /[a-z*][a-z0-9_\-.*]*/y;
+const SPACES = / */y;
+// Matches the sticky expression at the cursor and moves past it, returns null if it does not match
+function match(cursor, re) {
+    re.lastIndex = cursor.pos;
+    const result = re.exec(cursor.input);
+    if (result) {
+        cursor.pos = re.lastIndex;
+    }
+    return result;
+}
+// RFC 9651 4.2.5, returns the unescaped String or null if there is no valid String at the cursor
+function parseString(cursor) {
+    const result = match(cursor, STRING);
+    return result && result[1].replace(/\\(["\\])/g, '$1');
+}
+// RFC 9651 4.2.10. The percent encoded bytes must be valid UTF-8, which decodeURIComponent
+// checks as it decodes them
+function isDisplayString(cursor) {
+    const result = match(cursor, DISPLAY_STRING);
+    if (!result) {
+        return false;
+    }
+    try {
+        decodeURIComponent(result[1]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// RFC 9651 4.2.3.1. Returns the value of a String, true for any other valid bare item and
+// false for an invalid one
+function parseBareItem(cursor) {
+    const c = cursor.input.charAt(cursor.pos);
+    switch (c) {
+        case '"':
+            return parseString(cursor) ?? false;
+        case ':':
+            return !!match(cursor, BYTE_SEQUENCE);
+        case '?':
+            return !!match(cursor, BOOLEAN);
+        case '@':
+            return !!match(cursor, DATE);
+        case '%':
+            return isDisplayString(cursor);
+    }
+    return !!match(cursor, c === '-' || (c >= '0' && c <= '9') ? NUMBER : TOKEN);
+}
+/**
+ * Parses a structured field item (RFC 9651 4.2 with field_type "item") whose bare item is a
+ * String. Returns the String and the String parameters, or null if the value does not parse
+ * or the bare item is of another type. A parameter of any other type is stored as true
+ * @internal
+ */
+function parseStringItem(value) {
+    const cursor = { input: value, pos: 0 };
+    match(cursor, SPACES);
+    const item = parseString(cursor);
+    if (item === null) {
+        return null;
+    }
+    // a later parameter with the same key replaces the earlier one
+    const params = new Map();
+    while (cursor.input[cursor.pos] === ';') {
+        cursor.pos++;
+        match(cursor, SPACES);
+        const key = match(cursor, KEY);
+        if (!key) {
+            return null;
+        }
+        let paramValue = true;
+        if (cursor.input[cursor.pos] === '=') {
+            cursor.pos++;
+            paramValue = parseBareItem(cursor);
+            if (paramValue === false) {
+                return null;
+            }
+        }
+        params.set(key[0], paramValue);
+    }
+    match(cursor, SPACES);
+    return cursor.pos === cursor.input.length ? { value: item, params } : null;
+}
+/**
+ * Checks that the origin is the canonical ASCII serialization of a potentially trustworthy
+ * origin, as the draft requires: https, or http on a loopback host
+ * @internal
+ */
+function isOtpOrigin(origin) {
+    let url;
+    try {
+        url = new URL(origin);
+    }
+    catch {
+        return false;
+    }
+    // the URL parser lowercases the host, converts it to punycode and drops the default port, so
+    // a value that is not canonical, or has a path, userinfo or an opaque origin, does not match
+    // its own origin. The WHATWG parser lets characters such as a quote or a brace into a host,
+    // which the origin grammar (RFC 6454) does not allow, so only a DNS name, an IPv4 address or a
+    // bracketed IPv6 address is accepted
+    if (url.origin !== origin || !/^([a-z0-9_-]+\.)*[a-z0-9_-]+$|^\[[0-9a-f:.]+\]$/.test(url.hostname)) {
+        return false;
+    }
+    const isLoopback = /^(localhost|.+\.localhost|127(\.\d+){3}|\[::1\])$/.test(url.hostname);
+    return url.protocol === 'https:' || (url.protocol === 'http:' && isLoopback);
+}
+// The field name with its colon. A line with whitespace before the colon is not counted, it
+// is obsolete syntax (RFC 5322 4.5) the draft has no reason to accept
+const OTP_HEADER = /^otp-token:/i;
+/**
+ * Returns the value of a header without its line breaks and the whitespace around it, or null if
+ * the value is longer than the field size limit
+ */
+function getFieldValue(value) {
+    // unfolding removes the line breaks and keeps the whitespace that follows them (RFC 5322 2.2.3)
+    value = value.replace(/\r?\n/g, '');
+    let start = 0;
+    let end = value.length;
+    while (start < end && (value[start] === ' ' || value[start] === '\t')) {
+        start++;
+    }
+    while (end > start && (value[end - 1] === ' ' || value[end - 1] === '\t')) {
+        end--;
+    }
+    return end - start > MAX_FIELD_LENGTH ? null : value.slice(start, end);
+}
+/**
+ * Returns the one-time passcode from the values of the `OTP-Token` headers of a message header
+ * section, following the receiver steps of the draft (section 3.2), or undefined if there is no
+ * valid one. Pass every `OTP-Token` value of the message's own header section, not of a MIME
+ * part: more than one makes the message have none. The values are the raw ones, with any
+ * folding left in and no encoded words decoded
+ */
+function parseOtpToken(values) {
+    const list = typeof values === 'string' ? [values] : values;
+    if (!Array.isArray(list) || list.length !== 1 || typeof list[0] !== 'string') {
+        return undefined;
+    }
+    const value = getFieldValue(list[0]);
+    const parsed = value === null ? null : parseStringItem(value);
+    const origin = parsed?.params.get('origin');
+    // an empty passcode is valid syntax, but there is nothing in it to fill in
+    if (!parsed?.value || typeof origin !== 'string' || !isOtpOrigin(origin)) {
+        return undefined;
+    }
+    return { code: parsed.value, origin };
+}
+/**
+ * Returns the one-time passcode from the OTP-Token header of a message, or undefined if the
+ * message has no valid one. Only the header of the message itself counts, the draft has an
+ * OTP-Token in a MIME part ignored
+ * @internal
+ */
+function getOtp(headerLines) {
+    const values = headerLines.filter(({ line }) => OTP_HEADER.test(line)).map(({ line }) => line.slice(line.indexOf(':') + 1));
+    return values.length ? parseOtpToken(values) : undefined;
+}

package/node_modules/mailparser/dist/cjs/simple-parser.js

@@ -51,6 +51,9 @@ function simpleParser(input, options, callback) {
     parser.on('headers', headers => {
         mail.headers = headers;
         mail.headerLines = parser.headerLines;
+        if (parser.otp) {
+            mail.otp = parser.otp;
+        }
     });
     let reading = false;
     let reader = () => {