@mavogel/awscdk-rootmail 0.1.4 → 0.1.5

package/node_modules/nodemailer/dist/esm/addressparser/index.d.ts

@@ -3,9 +3,7 @@
  */
 export interface AddressParserOptions {
     /** Flatten groups into a single list of mailboxes */
-    flatten?: boolean;
-    /** Internal recursion depth counter (do not set manually) */
-    _depth?: number;
+    flatten?: boolean | undefined;
 }
 /**
  * A single mailbox. Either value may be an empty string when the input did not carry it

package/node_modules/nodemailer/dist/esm/addressparser/index.js

@@ -47,6 +47,134 @@ const ADDR_SPEC = /^[^@\s]+@[^@\s]+$/;
  * further '@' that a domain should not have but malformed headers carry anyway.
  */
 const LOOSE_ADDR_SPEC = /^[^@\s]+@\S+$/;
+/**
+ * An addr-spec sitting inside free text, together with the whitespace around it. Sticky
+ * on purpose: it is run at the one offset _looseAddressStart picks rather than being let
+ * loose to search, see there.
+ */
+const LOOSE_TEXT_ADDR = /\s*\b[^@\s]+@[^\s]+\b\s*/y;
+/**
+ * The characters JS `\s` matches, which the scan below has to agree with to land on the
+ * same match the pattern would.
+ */
+function _isSpaceCode(code) {
+    return (code === 0x20 ||
+        (code >= 0x09 && code <= 0x0d) ||
+        code === 0xa0 ||
+        code === 0x1680 ||
+        (code >= 0x2000 && code <= 0x200a) ||
+        code === 0x2028 ||
+        code === 0x2029 ||
+        code === 0x202f ||
+        code === 0x205f ||
+        code === 0x3000 ||
+        code === 0xfeff);
+}
+/**
+ * The characters JS `\w` matches without the unicode flag, the set the `\b` in
+ * LOOSE_TEXT_ADDR is read against. charCodeAt off either end of the string gives NaN,
+ * which compares false throughout, so out of range reads as the non-word the pattern
+ * treats them as.
+ */
+function _isWordCode(code) {
+    return (code >= 0x30 && code <= 0x39) || (code >= 0x41 && code <= 0x5a) || (code >= 0x61 && code <= 0x7a) || code === 0x5f;
+}
+/**
+ * Whether `\b` holds at an offset
+ */
+function _isBoundary(text, at) {
+    return _isWordCode(text.charCodeAt(at - 1)) !== _isWordCode(text.charCodeAt(at));
+}
+/**
+ * Offset of the first '@' in `text` between `from` and `to`, or -1 when the range holds none.
+ *
+ * indexOf would scan on to the end of the value, and the value here is a whole header. The
+ * walk below steps one whitespace delimited run at a time and only ever uses a '@' that sits
+ * inside the run it is on, so an unbounded probe rescans everything behind that run once per
+ * run and grows with the square of the header: 400KB of free text carrying no '@' took a
+ * quarter of a second. GHSA-v53p-9fqp-m79j took the pattern search out of this walk and left
+ * the probe unbounded behind it.
+ *
+ * @param text Text to look in
+ * @param from Offset to start at
+ * @param to Offset to stop before
+ * @return Offset of the '@', or -1
+ */
+function _indexOfAt(text, from, to) {
+    for (let i = from; i < to; i++) {
+        if (text.charCodeAt(i) === 0x40) {
+            return i;
+        }
+    }
+    return -1;
+}
+/**
+ * Finds the offset LOOSE_TEXT_ADDR matches at, or -1 when it does not match at all.
+ *
+ * Letting the pattern search for itself is quadratic: '[^@\s]+' is retried from every
+ * offset and rescans the run to the next '@' each time, so 140KB of header holding no
+ * usable '@' blocks the event loop for about ten seconds (GHSA-v53p-9fqp-m79j). The search is also unnecessary.
+ * '[^@\s]+' crosses neither whitespace nor a '@', so a match can only begin at the head of
+ * a whitespace delimited run or just past a '@' inside one, and '[^\s]+\b' gives characters
+ * back until it lands on a boundary, so the only end it can take in that run is the last
+ * boundary in it. Both are found in one pass, and the pattern is then run at that single
+ * offset.
+ *
+ * @param text Free text to look in
+ * @return Offset to match at, or -1
+ */
+function _looseAddressStart(text) {
+    const len = text.length;
+    let pos = 0;
+    while (pos < len) {
+        while (pos < len && _isSpaceCode(text.charCodeAt(pos))) {
+            pos++;
+        }
+        if (pos >= len) {
+            break;
+        }
+        const runStart = pos;
+        let runEnd = pos;
+        while (runEnd < len && !_isSpaceCode(text.charCodeAt(runEnd))) {
+            runEnd++;
+        }
+        let at = _indexOfAt(text, runStart, runEnd);
+        if (at >= 0) {
+            let lastBoundary = -1;
+            for (let k = runEnd; k > runStart; k--) {
+                if (_isBoundary(text, k)) {
+                    lastBoundary = k;
+                    break;
+                }
+            }
+            let atomStart = runStart;
+            while (lastBoundary >= 0 && at >= 0) {
+                // '[^@\s]+' has to cover a character before the '@' and '[^\s]+' one after it,
+                // and the boundary that ends the match has to sit past both
+                if (at > atomStart && runEnd > at + 1 && lastBoundary > at + 1) {
+                    for (let start = atomStart; start < at; start++) {
+                        if (_isBoundary(text, start)) {
+                            if (start > runStart) {
+                                return start;
+                            }
+                            // the leading '\s*' is greedy, so a match that begins at the run
+                            // takes the whitespace in front of it along
+                            let padded = runStart;
+                            while (padded > 0 && _isSpaceCode(text.charCodeAt(padded - 1))) {
+                                padded--;
+                            }
+                            return padded;
+                        }
+                    }
+                }
+                atomStart = at + 1;
+                at = _indexOfAt(text, atomStart, runEnd);
+            }
+        }
+        pos = runEnd;
+    }
+    return -1;
+}
 /**
  * Recovers the addr-spec from an angle-addr that came back holding unquoted whitespace.
  *
@@ -131,6 +259,12 @@ function _handleAddress(tokens, depth) {
         textWasQuoted: []
     };
     let insideQuotes = false;
+    // Last character of the run each state is currently accumulating. Reading it back off
+    // the accumulator with slice(-1) makes the engine flatten the whole growing string on
+    // every token, which is quadratic over an address built from many comment-joined atoms
+    // (GHSA-prgh-xp8r-p3m5). A run only ever grows by the token appended below, so the
+    // character is carried along instead of re-read.
+    const lastChars = { address: '', comment: '', group: '', text: '' };
     // Filter out <addresses>, (comments) and regular text
     for (let i = 0, len = tokens.length; i < len; i++) {
         const token = tokens[i];
@@ -161,6 +295,19 @@ function _handleAddress(tokens, depth) {
             }
         }
         else if (token.value) {
+            // An empty quoted string is dropped by the tokenizer, leaving no text token of its
+            // own for textWasQuoted to be recorded on, so the pair of quote operators right in
+            // front of this token is all that is left of it and the run it opens carries the
+            // quoting instead. Without this '""@example.com' reads as the bare '@example.com',
+            // the quotes never go back on, and the value is no longer an addr-spec a trailing
+            // comment can be peeled off of. It only ever opens a run: a run that already holds
+            // material collected outside the quotes is not a quoted string, whatever follows it
+            const prevPrevToken = i > 1 ? tokens[i - 2] : null;
+            const opensAfterEmptyQuotedString = prevToken?.type === 'operator' &&
+                prevToken.value === '"' &&
+                !!prevToken.noBreak &&
+                prevPrevToken?.type === 'operator' &&
+                prevPrevToken.value === '"';
             if (state === 'address') {
                 // Handle unquoted name that includes a "<".
                 // Apple Mail truncates everything between an unexpected < and an address.
@@ -174,17 +321,21 @@ function _handleAddress(tokens, depth) {
             const joins = prevToken &&
                 prevToken.noBreak &&
                 parts.length &&
-                (prevToken.value !== ')' || parts[parts.length - 1].slice(-1) === '@' || token.value.charAt(0) === '@');
+                (prevToken.value !== ')' || lastChars[state] === '@' || token.value.charAt(0) === '@');
             if (joins) {
                 data[state][data[state].length - 1] += token.value;
+                if (token.value) {
+                    lastChars[state] = token.value.charAt(token.value.length - 1);
+                }
                 if (state === 'text' && insideQuotes) {
                     data.textWasQuoted[data.textWasQuoted.length - 1] = true;
                 }
             }
             else {
                 data[state].push(token.value);
+                lastChars[state] = token.value.charAt(token.value.length - 1);
                 if (state === 'text') {
-                    data.textWasQuoted.push(insideQuotes);
+                    data.textWasQuoted.push(insideQuotes || opensAfterEmptyQuotedString);
                 }
             }
         }
@@ -234,16 +385,19 @@ function _handleAddress(tokens, depth) {
                 for (let i = data.text.length - 1; i >= 0; i--) {
                     // Security: Do not extract email addresses from quoted strings
                     if (!data.textWasQuoted[i]) {
-                        data.text[i] = data.text[i]
-                            .replace(/\s*\b[^@\s]+@[^\s]+\b\s*/, (match) => {
-                            if (!extracted) {
-                                data.address = [match.trim()];
+                        const part = data.text[i];
+                        let remainder = part;
+                        const at = _looseAddressStart(part);
+                        if (at >= 0) {
+                            LOOSE_TEXT_ADDR.lastIndex = at;
+                            const match = LOOSE_TEXT_ADDR.exec(part);
+                            if (match) {
+                                data.address = [match[0].trim()];
                                 extracted = true;
-                                return ' ';
+                                remainder = part.slice(0, at) + ' ' + part.slice(at + match[0].length);
                             }
-                            return match;
-                        })
-                            .trim();
+                        }
+                        data.text[i] = remainder.trim();
                         if (extracted) {
                             break;
                         }
@@ -266,6 +420,18 @@ function _handleAddress(tokens, depth) {
         // Join values with spaces
         data.text = data.text.join(' ');
         data.address = data.address.join(' ');
+        if (addressFromQuotedText && data.text) {
+            // The mailbox is still sitting in the text, so it moves over here and is quoted
+            // before the recovery below rather than after it. Anything else the text holds
+            // came along with it: a comment ends the domain but leaves the atoms behind it in
+            // the same text, and '"user"@example.com(x)evil.com' was handed on as the address
+            // 'user@example.com evil.com', a second domain riding into the envelope recipient
+            // on a value that is no addr-spec at all (GHSA-g57g-f23g-4646). Putting the quotes
+            // back first is what lets the recovery tell the whitespace an addr-spec may carry
+            // from the wreckage trailing one, as only a quoted local part may hold whitespace
+            data.address = _quoteLocalPart(data.text);
+            data.text = '';
+        }
         _recoverAddrSpec(data);
         const address = {
             address: data.address || data.text || '',
@@ -279,9 +445,6 @@ function _handleAddress(tokens, depth) {
                 address.address = '';
             }
         }
-        if (addressFromQuotedText && address.address) {
-            address.address = _quoteLocalPart(address.address);
-        }
         addresses.push(address);
     }
     return addresses;

package/node_modules/nodemailer/dist/esm/base64/index.d.ts

@@ -1,4 +1,4 @@
-import { Transform, type TransformCallback } from 'node:stream';
+import { Transform } from 'node:stream';
 /**
  * Encodes a Buffer into a base64 encoded string
  *
@@ -19,7 +19,7 @@ export declare function wrap(str: string, lineLength?: number | false): string;
  */
 export interface EncoderOptions {
     /** Maximum length for lines, set to false to disable wrapping */
-    lineLength?: number | false;
+    lineLength?: number | false | undefined;
 }
 /**
  * Creates a transform stream for encoding data to base64 encoding
@@ -32,9 +32,5 @@ export declare class Encoder extends Transform {
     options: EncoderOptions;
     inputBytes: number;
     outputBytes: number;
-    _curLine: string;
-    _remainingBytes: Buffer | false;
     constructor(options?: EncoderOptions);
-    _transform(chunk: Buffer | string, encoding: BufferEncoding | 'buffer', done: TransformCallback): void;
-    _flush(done: TransformCallback): void;
 }

package/node_modules/nodemailer/dist/esm/base64/index.js

@@ -54,6 +54,7 @@ export class Encoder extends Transform {
         this.inputBytes = 0;
         this.outputBytes = 0;
     }
+    /** @internal */
     _transform(chunk, encoding, done) {
         let buf = encoding !== 'buffer' ? Buffer.from(chunk, encoding) : chunk;
         if (!buf || !buf.length) {
@@ -95,6 +96,7 @@ export class Encoder extends Transform {
         }
         setImmediate(done);
     }
+    /** @internal */
     _flush(done) {
         if (this._remainingBytes && this._remainingBytes.length) {
             this._curLine += encode(this._remainingBytes);

package/node_modules/nodemailer/dist/esm/dkim/index.d.ts

@@ -9,13 +9,13 @@ export type { DKIMKey, DKIMPrivateKey, DKIMSignOptions };
  */
 export interface DKIMOptions extends DKIMSignOptions {
     /** One or more signing keys, used instead of the domainName, keySelector and privateKey options */
-    keys?: DKIMKey | DKIMKey[];
+    keys?: DKIMKey | DKIMKey[] | undefined;
     /** Directory for buffering large message bodies to disk, no buffering when not set */
-    cacheDir?: string | false;
+    cacheDir?: string | false | undefined;
     /** Body size in bytes from which the body is buffered to cacheDir, defaults to 10 MB */
-    cacheTreshold?: number;
+    cacheTreshold?: number | undefined;
     /** Hash algorithm for the body hash and the signature, defaults to sha256 */
-    hashAlgo?: string;
+    hashAlgo?: string | undefined;
 }
 /**
  * The signed message as returned by DKIM#sign

package/node_modules/nodemailer/dist/esm/dkim/message-parser.d.ts

@@ -1,4 +1,4 @@
-import { Transform, type TransformCallback, type TransformOptions } from 'node:stream';
+import { Transform, type TransformOptions } from 'node:stream';
 /**
  * A header line as emitted with the 'headers' event
  */
@@ -35,7 +35,5 @@ export default class MessageParser extends Transform {
      * @return Returns true if headers are already found or false otherwise
      */
     checkHeaders(data: Buffer): boolean;
-    _transform(chunk: Buffer | string, encoding: BufferEncoding, callback: TransformCallback): void;
-    _flush(callback: TransformCallback): void;
     parseHeaders(): MessageParserHeaderLine[];
 }

package/node_modules/nodemailer/dist/esm/dkim/message-parser.js

@@ -88,6 +88,7 @@ export default class MessageParser extends Transform {
         this.updateLastBytes(data);
         return false;
     }
+    /** @internal */
     _transform(chunk, encoding, callback) {
         if (!chunk || !chunk.length) {
             return callback();
@@ -108,6 +109,7 @@ export default class MessageParser extends Transform {
         }
         setImmediate(callback);
     }
+    /** @internal */
     _flush(callback) {
         if (this.headerChunks) {
             // no empty line was seen, so the message consists of headers only

package/node_modules/nodemailer/dist/esm/dkim/relaxed-body.d.ts

@@ -1,13 +1,13 @@
-import { Transform, type TransformCallback } from 'node:stream';
+import { Transform } from 'node:stream';
 import crypto from 'node:crypto';
 /**
  * Options for the relaxed body hash stream
  */
 export interface RelaxedBodyOptions {
     /** Hash algorithm for the body hash, defaults to sha256 */
-    hashAlgo?: string;
+    hashAlgo?: string | undefined;
     /** Collect the canonicalized body and emit it with the 'hash' event */
-    debug?: boolean;
+    debug?: boolean | undefined;
 }
 /**
  * Passes the message body through unchanged and hashes its relaxed
@@ -22,25 +22,6 @@ export default class RelaxedBody extends Transform {
     /** Bytes of the original body seen so far */
     byteLength: number;
     debug: boolean | undefined;
-    _debugBody: Buffer[] | false;
-    /** The current line has bytes that survive canonicalization */
-    _lineHasContent: boolean;
-    /** Whitespace that ends up as a single space if more content follows on the line */
-    _pendingWsp: boolean;
-    /** A CR that is part of the line ending if LF follows, otherwise content */
-    _pendingCr: boolean;
-    /** Empty lines that are hashed only once a non-empty line follows them */
-    _pendingEmptyLines: number;
     constructor(options?: RelaxedBodyOptions);
-    _hashCanonical(data: Buffer): void;
-    _hashEmptyLines(): void;
-    /**
-     * Writes a content byte, with the space a pending run of whitespace collapses to,
-     * into the output buffer and returns the new write position. Kept a method rather
-     * than a closure so the write position stays a plain local in the byte loop
-     */
-    _emitContent(out: Buffer, outPos: number, c: number): number;
     updateHash(chunk: Buffer, final?: boolean): void;
-    _transform(chunk: Buffer | string, encoding: BufferEncoding, callback: TransformCallback): void;
-    _flush(callback: TransformCallback): void;
 }

package/node_modules/nodemailer/dist/esm/dkim/relaxed-body.js

@@ -29,6 +29,7 @@ export default class RelaxedBody extends Transform {
         this._pendingCr = false;
         this._pendingEmptyLines = 0;
     }
+    /** @internal */
     _hashCanonical(data) {
         if (!data.length) {
             return;
@@ -38,6 +39,7 @@ export default class RelaxedBody extends Transform {
             this._debugBody.push(Buffer.from(data));
         }
     }
+    /** @internal */
     _hashEmptyLines() {
         while (this._pendingEmptyLines > 0) {
             const count = Math.min(this._pendingEmptyLines, EMPTY_LINES.length / 2);
@@ -49,6 +51,7 @@ export default class RelaxedBody extends Transform {
      * Writes a content byte, with the space a pending run of whitespace collapses to,
      * into the output buffer and returns the new write position. Kept a method rather
      * than a closure so the write position stays a plain local in the byte loop
+     * @internal
      */
     _emitContent(out, outPos, c) {
         if (!this._lineHasContent) {
@@ -111,6 +114,7 @@ export default class RelaxedBody extends Transform {
         }
         this._hashCanonical(out.subarray(0, outPos));
     }
+    /** @internal */
     _transform(chunk, encoding, callback) {
         if (!chunk || !chunk.length) {
             return callback();
@@ -123,6 +127,7 @@ export default class RelaxedBody extends Transform {
         this.push(chunk);
         callback();
     }
+    /** @internal */
     _flush(callback) {
         this.updateHash(Buffer.alloc(0), true);
         if (this._lineHasContent) {

package/node_modules/nodemailer/dist/esm/dkim/sign.d.ts

@@ -10,17 +10,17 @@ export type DKIMPrivateKey = crypto.KeyLike | crypto.SignKeyObjectInput | crypto
  */
 export interface DKIMKey {
     /** Domain name to be signed for */
-    domainName?: string;
+    domainName?: string | undefined;
     /** DKIM key selector to use */
-    keySelector?: string;
+    keySelector?: string | undefined;
     /** DKIM private key to use */
-    privateKey?: DKIMPrivateKey;
+    privateKey?: DKIMPrivateKey | undefined;
 }
 export interface DKIMSignOptions extends DKIMKey {
     /** Colon separated list of header field names to sign, defaults to the RFC4871 list */
-    headerFieldNames?: string;
+    headerFieldNames?: string | undefined;
     /** Colon separated list of header field names to leave out of the signature */
-    skipFields?: string;
+    skipFields?: string | undefined;
 }
 /**
  * Canonicalized headers and the list of field names that went into them

package/node_modules/nodemailer/dist/esm/errors.d.ts

@@ -68,21 +68,21 @@ export declare const EFETCH = "EFETCH";
  */
 export interface NodemailerError extends Error {
     /** Nodemailer error code, see ERROR_CODES */
-    code?: string;
+    code?: string | undefined;
     /** SMTP command that was in flight when the server replied with an error */
-    command?: string;
+    command?: string | undefined;
     /** Raw SMTP server response */
-    response?: string;
+    response?: string | undefined;
     /** Numeric SMTP response code */
-    responseCode?: number;
+    responseCode?: number | undefined;
     /** URL of the resource that could not be fetched */
-    sourceUrl?: string;
+    sourceUrl?: string | undefined;
     /** Recipient address the error applies to */
-    recipient?: string;
+    recipient?: string | undefined;
     /** Recipient addresses rejected by the server */
-    rejected?: string[];
+    rejected?: string[] | undefined;
     /** Per-recipient errors for the rejected addresses */
-    rejectedErrors?: NodemailerError[];
+    rejectedErrors?: NodemailerError[] | undefined;
 }
 /**
  * Node style callback: called with an error, or with null and the result

package/node_modules/nodemailer/dist/esm/fetch/cookies.d.ts

@@ -3,19 +3,19 @@
  */
 export interface CookiesOptions {
     /** Lifetime in seconds for cookies that do not set their own expiration (default 1800) */
-    sessionTimeout?: number | string;
+    sessionTimeout?: number | string | undefined;
 }
 /**
  * A cookie as parsed from a 'Set-Cookie:' header and kept in the jar
  */
 export interface Cookie {
-    name?: string;
-    value?: string;
-    domain?: string;
-    path?: string;
-    expires?: Date;
-    secure?: boolean;
-    httponly?: boolean;
+    name?: string | undefined;
+    value?: string | undefined;
+    domain?: string | undefined;
+    path?: string | undefined;
+    expires?: Date | undefined;
+    secure?: boolean | undefined;
+    httponly?: boolean | undefined;
 }
 /**
  * Creates a biskviit cookie jar for managing cookie values in memory
@@ -85,10 +85,12 @@ export default class Cookies {
      */
     isExpired(cookie: Cookie): boolean;
     /**
-     * Returns normalized cookie path for an URL path argument
+     * Returns the default path for an URL path argument, the default-path of
+     * RFC 6265 section 5.1.4. A cookie that carries no Path attribute is scoped
+     * to the directory of the URL it was set from
      *
      * @param pathname
-     * @returns Normalized path
+     * @returns Default path
      */
     getPath(pathname?: string | null): string;
 }

package/node_modules/nodemailer/dist/esm/fetch/cookies.js

@@ -1,4 +1,5 @@
 // module to handle cookies
+import net from 'node:net';
 import * as urllib from '../shared/url.js';
 const SESSION_TIMEOUT = 1800; // 30 min
 /**
@@ -24,12 +25,19 @@ export default class Cookies {
         let domain;
         if (cookie.domain) {
             domain = cookie.domain.replace(/^\./, '');
-            // do not allow cross origin cookies
+            // do not allow cross origin cookies. There is no public suffix list here, so a
+            // multi-label suffix like 'co.uk' can not be told apart from a registrable domain
             if (
             // can't be valid if the requested domain is shorter than current hostname
             urlparts.hostname.length < domain.length ||
+                // a top level domain is not a valid scope, 'Domain=com' would otherwise be
+                // sent to every .com host. A trailing dot does not make 'com.' any better
+                domain.indexOf('.') < 0 ||
+                domain.endsWith('.') ||
+                // an IP address has no subdomains, so cookies set on it stay host-only
+                net.isIP(urlparts.hostname) ||
                 // prefix domains with dot to be sure that partial matches are not used
-                ('.' + urlparts.hostname).substr(-domain.length + 1) !== '.' + domain) {
+                !('.' + urlparts.hostname).endsWith('.' + domain)) {
                 cookie.domain = urlparts.hostname;
             }
         }
@@ -149,9 +157,13 @@ export default class Cookies {
                 ('.' + urlparts.hostname).substr(-cookie.domain.length) !== cookie.domain)) {
             return false;
         }
-        // check if path matches
-        const path = this.getPath(urlparts.pathname);
-        if (path.substr(0, cookie.path.length) !== cookie.path) {
+        // check if the request path path-matches the cookie path (RFC 6265 section 5.1.4):
+        // identical paths match, otherwise the cookie path must be a directory prefix
+        const pathname = urlparts.pathname || '/';
+        const cookiePath = cookie.path;
+        const pathMatches = pathname === cookiePath ||
+            (pathname.startsWith(cookiePath) && (cookiePath.endsWith('/') || pathname.charAt(cookiePath.length) === '/'));
+        if (!pathMatches) {
             return false;
         }
         // check secure argument
@@ -208,22 +220,21 @@ export default class Cookies {
         return (cookie.expires && cookie.expires < new Date()) || !cookie.value;
     }
     /**
-     * Returns normalized cookie path for an URL path argument
+     * Returns the default path for an URL path argument, the default-path of
+     * RFC 6265 section 5.1.4. A cookie that carries no Path attribute is scoped
+     * to the directory of the URL it was set from
      *
      * @param pathname
-     * @returns Normalized path
+     * @returns Default path
      */
     getPath(pathname) {
         const pathParts = (pathname || '/').split('/');
         pathParts.pop(); // remove filename part
-        let path = pathParts.join('/').trim();
-        // ensure path prefix /
+        const path = pathParts.join('/').trim();
+        // a path that holds no more than one '/' is scoped to the root path, and so
+        // is one that does not start with '/' at all
         if (path.charAt(0) !== '/') {
-            path = '/' + path;
-        }
-        // ensure path suffix /
-        if (path.substr(-1) !== '/') {
-            path += '/';
+            return '/';
         }
         return path;
     }

package/node_modules/nodemailer/dist/esm/fetch/index.d.ts

@@ -6,43 +6,43 @@ import Cookies from './cookies.js';
  */
 export interface FetchOptions {
     /** HTTP method, defaults to GET, or to POST when a body is given */
-    method?: string;
+    method?: string | undefined;
     /** Request headers, keys are lowercased before use */
-    headers?: http.OutgoingHttpHeaders;
+    headers?: http.OutgoingHttpHeaders | undefined;
     /** Overrides the default User-Agent header */
-    userAgent?: string;
+    userAgent?: string | undefined;
     /** Cookie string(s) to seed the cookie jar with for this URL */
-    cookie?: string | string[] | false;
+    cookie?: string | string[] | false | undefined;
     /** Cookie jar shared across redirects, created when missing */
-    cookies?: Cookies;
+    cookies?: Cookies | undefined;
     /** Request body: a readable stream, a Buffer, a form object or a string */
     body?: Readable | Buffer | {
         [key: string]: any;
-    } | string | false;
+    } | string | false | undefined;
     /** Content-Type header for the body, false leaves it out for a stream body */
-    contentType?: string | false;
+    contentType?: string | false | undefined;
     /** TLS settings, only the keys listed in TLS_OPTION_KEYS are used */
     tls?: {
         [key: string]: any;
-    };
+    } | undefined;
     /** Request timeout in milliseconds */
-    timeout?: number;
+    timeout?: number | undefined;
     /** Maximum number of redirects to follow (default 5) */
-    maxRedirects?: number;
+    maxRedirects?: number | undefined;
     /** Resolve responses with a status code of 300 or above instead of emitting an error */
-    allowErrorResponse?: boolean;
+    allowErrorResponse?: boolean | undefined;
     /** Redirects followed so far, set by nmfetch itself */
-    redirects?: number;
+    redirects?: number | undefined;
     /** Response stream shared across redirects, set by nmfetch itself */
-    fetchRes?: FetchResponse;
+    fetchRes?: FetchResponse | undefined;
 }
 /**
  * The stream nmfetch returns. The response body is piped into it, the status code and
  * headers of the final response are attached once they arrive
  */
 export interface FetchResponse extends PassThrough {
-    statusCode?: number;
-    headers?: http.IncomingHttpHeaders;
+    statusCode?: number | undefined;
+    headers?: http.IncomingHttpHeaders | undefined;
 }
 declare function nmfetch(url: string, options?: FetchOptions): FetchResponse;
 declare namespace nmfetch {