nodemailer 10.1.7 → 10.2.1

package/dist/cjs/qp/index.js

@@ -50,15 +50,9 @@ function encodeBytes(buffer, next, binary, previous) {
     for (let i = 0; i < len; i++) {
         const ord = buffer[i];
         const following = i + 1 < len ? buffer[i + 1] : next;
-        const lineBreakByte = binary && (ord === 0x0d || ord === 0x0a)
-            ? ord === 0x0d
-                ? following === 0x0a
-                : (i > 0 ? buffer[i - 1] : previous) === 0x0d
-            : true;
+        const lineBreakByte = binary && (ord === 0x0d || ord === 0x0a) ? (ord === 0x0d ? following === 0x0a : (i > 0 ? buffer[i - 1] : previous) === 0x0d) : true;
         // if the char is in allowed range, then keep as is, unless it is a WS in the end of a line
-        if (QP_LITERAL[ord] &&
-            lineBreakByte &&
-            !(isWhitespace(ord) && (following === undefined || following === 0x0a || following === 0x0d))) {
+        if (QP_LITERAL[ord] && lineBreakByte && !(isWhitespace(ord) && (following === undefined || following === 0x0a || following === 0x0d))) {
             output[pos++] = ord;
             continue;
         }
@@ -119,10 +113,7 @@ function wrap(str, lineLength) {
                 line = line.substr(0, line.length - match[0].length);
             }
             // ensure that utf-8 sequences are not split
-            while (line.length > 3 &&
-                line.length < len - pos &&
-                !line.match(/^(?:=[\da-f]{2}){1,4}$/i) &&
-                (match = line.match(/[=][\da-f]{2}$/gi))) {
+            while (line.length > 3 && line.length < len - pos && !line.match(/^(?:=[\da-f]{2}){1,4}$/i) && (match = line.match(/[=][\da-f]{2}$/gi))) {
                 code = parseInt(match[0].substr(1, 2), 16);
                 if (code < 128) {
                     break;

package/dist/cjs/sendmail-transport/index.js

@@ -109,9 +109,7 @@ class SendmailTransport {
             return done(err);
         }
         // force -i to keep single dots
-        const args = this.args
-            ? ['-i'].concat(this.args).concat(envelope.to)
-            : ['-i'].concat(envelope.from ? ['-f', envelope.from] : []).concat(envelope.to);
+        const args = this.args ? ['-i'].concat(this.args).concat(envelope.to) : ['-i'].concat(envelope.from ? ['-f', envelope.from] : []).concat(envelope.to);
         const callback = (err) => {
             if (returned) {
                 // ignore any additional responses, already done

package/dist/cjs/shared/index.js

@@ -263,9 +263,7 @@ const resolveHostname = (options, callback) => {
                     return respond(err);
                 }
                 // Get all supported addresses from dns.lookup
-                const supportedAddresses = addresses
-                    ? addresses.filter(addr => isFamilySupported(addr.family)).map(addr => addr.address)
-                    : [];
+                const supportedAddresses = addresses ? addresses.filter(addr => isFamilySupported(addr.family)).map(addr => addr.address) : [];
                 if (addresses && addresses.length && !supportedAddresses.length) {
                     // there are addresses but none can be used
                     console.warn(`Failed to resolve IPv${addresses[0].family} addresses with current network`);
@@ -601,9 +599,7 @@ const assign = function (...args) {
             if ((0, objects_js_1.isProtoKey)(key)) {
                 return;
             }
-            if (['tls', 'auth'].includes(key) &&
-                source[key] &&
-                typeof source[key] === 'object') {
+            if (['tls', 'auth'].includes(key) && source[key] && typeof source[key] === 'object') {
                 // tls and auth are special keys that need to be enumerated separately
                 // other objects are passed as is. Enumerating is a copy of user supplied
                 // keys just like the loop above, so it gets the same treatment

package/dist/cjs/smtp-connection/http-proxy-client.js

@@ -47,7 +47,7 @@ const errors = __importStar(require("../errors.js"));
 // never sends \r\n\r\n cannot grow memory unboundedly before the socket times out.
 const MAX_RESPONSE_HEADER_BYTES = 64 * 1024;
 // URL hostnames keep the brackets around an IPv6 literal, socket options and net.isIPv6 take it without
-const unbracket = (host) => typeof host === 'string' && host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
+const unbracket = (host) => (typeof host === 'string' && host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host);
 function httpProxyClient(proxyUrl, destinationPort, destinationHost, tlsOptions, callback) {
     if (typeof tlsOptions === 'function') {
         callback = tlsOptions;

package/dist/cjs/smtp-connection/index.d.ts

@@ -245,6 +245,12 @@ export interface SMTPConnectionSendInfo extends SMTPConnectionEnvelopeInfo {
     messageSize: number;
     /** Final server response for the message */
     response: string;
+    /**
+     * Message-ID the server gave the message, with angle brackets, when its final reply names
+     * one in a known format (Microsoft 365 and Outlook.com, Amazon SES). Such a server replaces
+     * the Message-ID header, so the delivered copy carries this id instead of messageId
+     */
+    serverMessageId?: string | undefined;
 }
 /**
  * Callback for send(), receives the result once the server accepted the message. The error

package/dist/cjs/smtp-connection/index.js

@@ -45,6 +45,7 @@ const node_crypto_1 = __importDefault(require("node:crypto"));
 const data_stream_js_1 = __importDefault(require("./data-stream.js"));
 const node_stream_1 = require("node:stream");
 const shared = __importStar(require("../shared/index.js"));
+const server_message_id_js_1 = require("./server-message-id.js");
 const errors_js_1 = require("../errors.js");
 // default timeout values in ms
 const CONNECTION_TIMEOUT = 2 * 60 * 1000; // how much to wait for the connection to be established
@@ -399,9 +400,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
         if (this._destroyed || this._closing) {
             return;
         }
-        const connectFn = secure
-            ? node_tls_1.default.connect
-            : node_net_1.default.connect;
+        const connectFn = secure ? node_tls_1.default.connect : node_net_1.default.connect;
         try {
             this._socket = connectFn(opts, () => this._onConnect());
             this._setupConnectionHandlers();
@@ -739,6 +738,16 @@ class SMTPConnection extends node_events_1.EventEmitter {
                 result.messageTime = Date.now() - envelopeTime;
                 result.messageSize = stream.outByteCount;
                 result.response = str;
+                const serverMessageId = (0, server_message_id_js_1.parseServerMessageId)(result.response, this.options.host);
+                if (serverMessageId) {
+                    result.serverMessageId = serverMessageId;
+                }
+                // an LMTP server answers the message once per recipient, so recipients can be
+                // refused after the envelope info was built without any rejected errors on it
+                const rejectedErrors = this._envelope?.rejectedErrors;
+                if (!result.rejectedErrors && rejectedErrors && rejectedErrors.length) {
+                    result.rejectedErrors = rejectedErrors;
+                }
                 return callback(null, result);
             });
             if (typeof message.pipe === 'function') {
@@ -966,6 +975,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
         const responseCode = (typeof response === 'string' && Number((response.match(/^\d+/) || [])[0])) || false;
         if (responseCode) {
             err.responseCode = responseCode;
+            err.permanent = (0, errors_js_1.isPermanentResponseCode)(responseCode);
         }
         if (command) {
             err.command = command;
@@ -1008,12 +1018,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
             this.close();
             return;
         }
-        if (!failureResponse &&
-            this.stage === 'connected' &&
-            !this._responseActions.length &&
-            !this._pendingSend &&
-            !this._destroyed &&
-            !this._closing) {
+        if (!failureResponse && this.stage === 'connected' && !this._responseActions.length && !this._pendingSend && !this._destroyed && !this._closing) {
             // nothing was waiting for the server, so this is the server ending an idle session
             // (usually after its idle timeout), not a failure
             this.logger.info({
@@ -1234,9 +1239,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
         const args = [];
         let useSmtpUtf8 = false;
         this._envelope = (envelope || {});
-        this._envelope.from = ((this._envelope.from && this._envelope.from.address) || this._envelope.from || '')
-            .toString()
-            .trim();
+        this._envelope.from = ((this._envelope.from && this._envelope.from.address) || this._envelope.from || '').toString().trim();
         this._envelope.to = []
             .concat(this._envelope.to || [])
             .map(to => ((to && to.address) || to || '').toString().trim());

package/dist/cjs/smtp-connection/server-message-id.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Reads the Message-ID a receiving server gave the message out of its final 250 reply. Some
+ * servers replace the Message-ID header of a submitted message with one of their own, and
+ * the copy the recipients and the sent folder get carries that one instead of the id the
+ * message was built with. Only replies in a format known to carry such an id are read.
+ */
+/**
+ * Reads the server assigned Message-ID out of the final reply to a message
+ *
+ * @param response Final server reply for the message
+ * @param [host] Hostname the connection was made to, SES replies are only read for an SES host
+ * @returns The Message-ID with its angle brackets, or undefined when the reply names none
+ */
+export declare function parseServerMessageId(response: string | undefined, host?: string): string | undefined;

package/dist/cjs/smtp-connection/server-message-id.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * Reads the Message-ID a receiving server gave the message out of its final 250 reply. Some
+ * servers replace the Message-ID header of a submitted message with one of their own, and
+ * the copy the recipients and the sent folder get carries that one instead of the id the
+ * message was built with. Only replies in a format known to carry such an id are read.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseServerMessageId = parseServerMessageId;
+// Microsoft 365 and Outlook.com: "250 2.0.0 OK <id@host.prod.outlook.com> [Hostname=...]"
+const OUTLOOK_REPLY = /^250 2\.0\.0 OK (<[^<>\s]+\.prod\.outlook\.com>)/i;
+// Amazon SES: "250 Ok 0100018b5c3c0a4f-...-000000", the local part of the Message-ID it sets
+const SES_REPLY = /^250 Ok ([0-9a-f]+(?:-[0-9a-f]+)+)$/i;
+// an AWS region name such as us-east-1 or ap-southeast-2
+const AWS_REGION = /^[a-z]{2}(?:-[a-z]+)+-\d+$/;
+/**
+ * Finds the AWS region an SES SMTP endpoint is in from its hostname, such as
+ * email-smtp.eu-west-1.amazonaws.com or a VPC endpoint name under it
+ *
+ * @param host SMTP hostname
+ * @returns Region name, or undefined for a host outside amazonaws.com and awsapps.com
+ */
+function sesRegion(host) {
+    const labels = host.toLowerCase().replace(/\.$/, '').split('.');
+    const domain = labels.slice(-2).join('.');
+    if (domain !== 'amazonaws.com' && domain !== 'awsapps.com') {
+        return undefined;
+    }
+    return labels.slice(0, -2).find(label => AWS_REGION.test(label));
+}
+/**
+ * Reads the server assigned Message-ID out of the final reply to a message
+ *
+ * @param response Final server reply for the message
+ * @param [host] Hostname the connection was made to, SES replies are only read for an SES host
+ * @returns The Message-ID with its angle brackets, or undefined when the reply names none
+ */
+function parseServerMessageId(response, host) {
+    const reply = (response || '').toString().trim();
+    const outlook = reply.match(OUTLOOK_REPLY);
+    if (outlook) {
+        return outlook[1];
+    }
+    const ses = reply.match(SES_REPLY);
+    if (ses && host) {
+        const region = sesRegion(host);
+        if (region) {
+            // the SES Message-ID domain is email.amazonses.com in us-east-1 and the region elsewhere
+            return '<' + ses[1].toLowerCase() + '@' + (region === 'us-east-1' ? 'email' : region) + '.amazonses.com>';
+        }
+    }
+    return undefined;
+}

package/dist/cjs/smtp-pool/index.d.ts

@@ -110,6 +110,17 @@ declare class SMTPPool extends EventEmitter {
      * Returns true if there are free slots in the queue
      */
     isIdle(): boolean;
+    /**
+     * Counts the messages the pool has not finished with yet: the ones waiting in the queue
+     * plus the ones a connection is transmitting right now. isIdle() only tells whether the
+     * pool can take another message, it is already true while a message is still being sent,
+     * so use this to check that nothing would be lost by closing the pool. A message that is
+     * re-queued after its connection dropped is counted until its callback runs, also while it waits to be put back on the queue, and
+     * it is no longer counted by the time its callback runs.
+     *
+     * @returns Number of queued and in-flight messages
+     */
+    pendingCount(): number;
     /**
      * Verifies SMTP configuration
      *

package/dist/cjs/smtp-pool/index.js

@@ -100,6 +100,7 @@ class SMTPPool extends node_events_1.EventEmitter {
         this._queue = [];
         this._connections = [];
         this._connectionCounter = 0;
+        this._pending = 0;
         this.idling = true;
         setImmediate(() => {
             if (this.idling) {
@@ -132,10 +133,20 @@ class SMTPPool extends node_events_1.EventEmitter {
             setImmediate(() => callback(err));
             return false;
         }
+        // counted until the callback runs, whichever path runs it: delivered, failed, requeued
+        // until it gives up, or drained by close()
+        let counted = true;
+        this._pending++;
         this._queue.push({
             mail,
             requeueAttempts: 0,
-            callback
+            callback: (err, info) => {
+                if (counted) {
+                    counted = false;
+                    this._pending--;
+                }
+                callback(err, info);
+            }
         });
         if (this.idling && this._queue.length >= this.options.maxConnections) {
             this.idling = false;
@@ -479,6 +490,19 @@ class SMTPPool extends node_events_1.EventEmitter {
     isIdle() {
         return this.idling;
     }
+    /**
+     * Counts the messages the pool has not finished with yet: the ones waiting in the queue
+     * plus the ones a connection is transmitting right now. isIdle() only tells whether the
+     * pool can take another message, it is already true while a message is still being sent,
+     * so use this to check that nothing would be lost by closing the pool. A message that is
+     * re-queued after its connection dropped is counted until its callback runs, also while it waits to be put back on the queue, and
+     * it is no longer counted by the time its callback runs.
+     *
+     * @returns Number of queued and in-flight messages
+     */
+    pendingCount() {
+        return this._pending;
+    }
     verify(callback) {
         let promise;
         if (!callback) {

package/dist/cjs/smtp-pool/pool-resource.js

@@ -57,8 +57,7 @@ class PoolResource extends node_events_1.EventEmitter {
             switch ((this.options.auth.type || '').toString().toUpperCase()) {
                 case 'OAUTH2': {
                     const oauth2 = new index_js_3.default(this.options.auth, this.logger);
-                    oauth2.provisionCallback =
-                        (this.pool.mailer && this.pool.mailer.get('oauth2_provision_cb')) || oauth2.provisionCallback;
+                    oauth2.provisionCallback = (this.pool.mailer && this.pool.mailer.get('oauth2_provision_cb')) || oauth2.provisionCallback;
                     this.auth = {
                         type: 'OAUTH2',
                         user: this.options.auth.user,
@@ -246,9 +245,7 @@ class PoolResource extends node_events_1.EventEmitter {
                     this.connection.close();
                     return;
                 }
-                if ((err.code === errors.EENVELOPE || err.code === errors.EMESSAGE) &&
-                    err.responseCode !== 421 &&
-                    !this.connection._destroyed) {
+                if ((err.code === errors.EENVELOPE || err.code === errors.EMESSAGE) && err.responseCode !== 421 && !this.connection._destroyed) {
                     // The server refused this message, the connection itself is fine. Reset the
                     // session and keep using it instead of opening a new one
                     this.connection.reset(resetErr => {

package/dist/esm/addressparser/index.js

@@ -691,9 +691,7 @@ function _handleAddress(tokens, from, to) {
             // A run that is a quoted local part with its '@' and domain is an addr-spec of
             // its own, with the quoting put back on, and takes its turn like any other
             const local = data.quotedLocalAt[i];
-            const quotedLocal = data.textWasQuoted[i] && local >= 0 && QUOTED_LOCAL_DOMAIN.test(data.text[i].slice(local))
-                ? _quoteLocalPart(data.text[i])
-                : '';
+            const quotedLocal = data.textWasQuoted[i] && local >= 0 && QUOTED_LOCAL_DOMAIN.test(data.text[i].slice(local)) ? _quoteLocalPart(data.text[i]) : '';
             if (quotedLocal || (!data.textWasQuoted[i] && _isAddrSpec(candidates[i]))) {
                 data.address = [quotedLocal || candidates[i]];
                 data.text.splice(i, 1);
@@ -1018,8 +1016,7 @@ class Tokenizer {
             return;
         }
         if (this.node < 0) {
-            this.node = this.list.push((this.operatorExpecting === '"' || this.operatorExpecting === ')' ? TOKEN_ESCAPES : 0) |
-                (this.escaped ? TOKEN_STARTS_ESCAPED : 0), i, i);
+            this.node = this.list.push((this.operatorExpecting === '"' || this.operatorExpecting === ')' ? TOKEN_ESCAPES : 0) | (this.escaped ? TOKEN_STARTS_ESCAPED : 0), i, i);
         }
         if (chr === '\n') {
             // Convert newlines to spaces. Carriage return is ignored as \r and \n usually

package/dist/esm/dkim/index.js

@@ -20,9 +20,7 @@ class DKIMSigner {
         this.chunks = [];
         this.chunklen = 0;
         this.readPos = 0;
-        this.cachePath = this.cacheDir
-            ? path.join(this.cacheDir, 'message.' + Date.now() + '-' + crypto.randomBytes(14).toString('hex'))
-            : false;
+        this.cachePath = this.cacheDir ? path.join(this.cacheDir, 'message.' + Date.now() + '-' + crypto.randomBytes(14).toString('hex')) : false;
         this.cache = false;
         this.headers = false;
         this.bodyHash = false;

package/dist/esm/errors.d.ts

@@ -68,6 +68,18 @@ export declare const isTransientError: (err: {
     code?: string | undefined;
     responseCode?: number | undefined;
 }) => boolean;
+/**
+ * Tells whether an SMTP reply code is a permanent rejection, one that retrying the same
+ * message would get again. RFC 5321 makes every 5yz reply a permanent negative completion
+ * and every 4yz reply a transient one. 503 (bad sequence of commands) is the exception: it
+ * says the session was in the wrong state for the command rather than that the message was
+ * refused, so the same message can go through on a new connection. 2yz and 3yz replies are
+ * only an error when the client expected something else, and are not permanent either.
+ *
+ * @param responseCode SMTP reply code
+ * @returns true for a permanent rejection
+ */
+export declare const isPermanentResponseCode: (responseCode: number) => boolean;
 /**
  * Code Node.js sets on an error when its permission model (`--permission`) denies an
  * operation. It is not replaced with the Nodemailer code of the failing step (`ESOCKET`,
@@ -89,6 +101,13 @@ export interface NodemailerError extends NodeJS.ErrnoException {
     response?: string | undefined;
     /** Numeric SMTP response code */
     responseCode?: number | undefined;
+    /**
+     * Set together with responseCode, from the reply class: true when the server rejected the
+     * message for good (5xx except 503), false when the same message may be accepted on a later
+     * attempt (4xx, 503, or an unexpected 2xx or 3xx). Not set on an error that carries no SMTP
+     * reply, such as a connection failure or missing credentials, see isPermanentResponseCode
+     */
+    permanent?: boolean | undefined;
     /** URL of the resource that could not be fetched */
     sourceUrl?: string | undefined;
     /** Recipient address the error applies to */

package/dist/esm/errors.js

@@ -69,6 +69,18 @@ export const EFETCH = 'EFETCH';
  * Tells whether the error ended the connection rather than rejected what was sent over it
  */
 export const isTransientError = (err) => err.responseCode === 421 || err.code === ECONNECTION || err.code === ESOCKET || err.code === ETIMEDOUT;
+/**
+ * Tells whether an SMTP reply code is a permanent rejection, one that retrying the same
+ * message would get again. RFC 5321 makes every 5yz reply a permanent negative completion
+ * and every 4yz reply a transient one. 503 (bad sequence of commands) is the exception: it
+ * says the session was in the wrong state for the command rather than that the message was
+ * refused, so the same message can go through on a new connection. 2yz and 3yz replies are
+ * only an error when the client expected something else, and are not permanent either.
+ *
+ * @param responseCode SMTP reply code
+ * @returns true for a permanent rejection
+ */
+export const isPermanentResponseCode = (responseCode) => responseCode >= 500 && responseCode < 600 && responseCode !== 503;
 /**
  * Code Node.js sets on an error when its permission model (`--permission`) denies an
  * operation. It is not replaced with the Nodemailer code of the failing step (`ESOCKET`,

package/dist/esm/fetch/cookies.js

@@ -160,16 +160,14 @@ class Cookies {
         // check if hostname matches
         // .foo.com also matches subdomains, foo.com does not
         if (urlparts.hostname !== cookie.domain &&
-            (cookie.domain.charAt(0) !== '.' ||
-                ('.' + urlparts.hostname).substr(-cookie.domain.length) !== cookie.domain)) {
+            (cookie.domain.charAt(0) !== '.' || ('.' + urlparts.hostname).substr(-cookie.domain.length) !== cookie.domain)) {
             return false;
         }
         // check if the request path path-matches the cookie path (RFC 6265 section 5.1.4):
         // identical paths match, otherwise the cookie path must be a directory prefix
         const pathname = urlparts.pathname || '/';
         const cookiePath = cookie.path;
-        const pathMatches = pathname === cookiePath ||
-            (pathname.startsWith(cookiePath) && (cookiePath.endsWith('/') || pathname.charAt(cookiePath.length) === '/'));
+        const pathMatches = pathname === cookiePath || (pathname.startsWith(cookiePath) && (cookiePath.endsWith('/') || pathname.charAt(cookiePath.length) === '/'));
         if (!pathMatches) {
             return false;
         }

package/dist/esm/fetch/index.js

@@ -224,11 +224,7 @@ function nmfetch(url, options) {
             }
         });
     }
-    if (parsed.protocol === 'https:' &&
-        parsed.hostname &&
-        parsed.hostname !== reqOptions.host &&
-        !net.isIP(parsed.hostname) &&
-        !reqOptions.servername) {
+    if (parsed.protocol === 'https:' && parsed.hostname && parsed.hostname !== reqOptions.host && !net.isIP(parsed.hostname) && !reqOptions.servername) {
         reqOptions.servername = parsed.hostname;
     }
     try {
@@ -331,9 +327,7 @@ function nmfetch(url, options) {
             // downgrade would also put them on the wire in cleartext). Strip sensitive
             // request headers so an attacker who controls the redirect target cannot
             // harvest them.
-            const crossOrigin = redirectParsed.protocol !== parsed.protocol ||
-                redirectParsed.hostname !== parsed.hostname ||
-                fetchPort(redirectParsed) !== fetchPort(parsed);
+            const crossOrigin = redirectParsed.protocol !== parsed.protocol || redirectParsed.hostname !== parsed.hostname || fetchPort(redirectParsed) !== fetchPort(parsed);
             if (options.headers && crossOrigin) {
                 const sensitive = ['authorization', 'cookie', 'proxy-authorization'];
                 Object.keys(options.headers).forEach(key => {

package/dist/esm/mail-composer/index.js

@@ -16,6 +16,40 @@ function isContentObject(value) {
     const content = value;
     return typeof value === 'object' && !!(content.content || content.path || content.href || content.raw);
 }
+/**
+ * Tells whether attachment content is a string or a Buffer that 7bit can describe: ASCII
+ * only, no NUL and no line over the 998 octets of RFC 5322. Anything else, a stream or a
+ * file path included, can not be checked here
+ */
+function fitsSevenBit(content) {
+    let at;
+    let length;
+    if (typeof content === 'string') {
+        at = i => content.charCodeAt(i);
+        length = content.length;
+    }
+    else if (Buffer.isBuffer(content)) {
+        at = i => content[i];
+        length = content.length;
+    }
+    else {
+        return false;
+    }
+    let lineLength = 0;
+    for (let i = 0; i < length; i++) {
+        const c = at(i);
+        if (c === 0 || c > 0x7f) {
+            return false;
+        }
+        if (c === 0x0a || c === 0x0d) {
+            lineLength = 0;
+        }
+        else if (++lineLength > 998) {
+            return false;
+        }
+    }
+    return true;
+}
 class MailComposer {
     constructor(mail) {
         this.mail = mail || {};
@@ -98,8 +132,11 @@ class MailComposer {
                 contentTransferEncoding = attachment.contentTransferEncoding;
             }
             else if (isMessageNode) {
-                // the content might include non-ASCII bytes but at this point we do not know it yet
-                contentTransferEncoding = '8bit';
+                // a message/* part can not be encoded (RFC 2046 5.2.1), so the label has to describe
+                // the content as it is. A stream or a file might hold non-ASCII bytes that can not be
+                // checked here, so only content at hand that fits 7bit is labelled as such
+                // content with an `encoding` is decoded later, so what it decodes to is not known here either
+                contentTransferEncoding = !attachment.encoding && fitsSevenBit(attachment.content) ? '7bit' : '8bit';
             }
             else {
                 contentTransferEncoding = 'base64'; // the default
@@ -114,9 +151,7 @@ class MailComposer {
             }
             else if (!isMessageNode && attachment.filename !== false) {
                 // a backslash separates as well, so a Windows path does not put the sender's directories in the headers
-                data.filename =
-                    (attachment.path || attachment.href || '').split(/[/\\]/).pop().split('?').shift() ||
-                        'attachment-' + (i + 1);
+                data.filename = (attachment.path || attachment.href || '').split(/[/\\]/).pop().split('?').shift() || 'attachment-' + (i + 1);
                 if (data.filename.indexOf('.') < 0) {
                     data.filename += '.' + mimeFuncs.detectExtension(data.contentType);
                 }
@@ -277,8 +312,7 @@ class MailComposer {
         if (this.mail.icalEvent) {
             eventObject = Object.assign({}, this._getIcalEvent());
             eventObject.filename = false;
-            eventObject.contentType =
-                'text/calendar; charset=utf-8; method=' + (eventObject.method || 'PUBLISH').toString().trim().toUpperCase();
+            eventObject.contentType = 'text/calendar; charset=utf-8; method=' + (eventObject.method || 'PUBLISH').toString().trim().toUpperCase();
             if (!eventObject.headers) {
                 eventObject.headers = {};
             }
@@ -306,8 +340,7 @@ class MailComposer {
                 alternative = this._processDataUrl(alternative);
             }
             const data = {
-                contentType: alternative.contentType ||
-                    mimeFuncs.detectMimeType(alternative.filename || alternative.path || alternative.href || 'txt'),
+                contentType: alternative.contentType || mimeFuncs.detectMimeType(alternative.filename || alternative.path || alternative.href || 'txt'),
                 contentTransferEncoding: alternative.contentTransferEncoding
             };
             if (alternative.filename) {

package/dist/esm/mailer/mail-message.js

@@ -71,8 +71,7 @@ export default class MailMessage {
                 if (!attachment.filename) {
                     // a backslash separates as well, so a Windows path does not put the sender's directories in the headers
                     attachment.filename =
-                        (attachment.path || attachment.href || '').split(/[/\\]/).pop().split('?').shift() ||
-                            'attachment-' + (i + 1);
+                        (attachment.path || attachment.href || '').split(/[/\\]/).pop().split('?').shift() || 'attachment-' + (i + 1);
                     if (attachment.filename.indexOf('.') < 0) {
                         attachment.filename += '.' + mimeFuncs.detectExtension(attachment.contentType);
                     }
@@ -207,7 +206,7 @@ export default class MailMessage {
                 value = (value && value.value) || value;
                 if (value) {
                     if (['references', 'in-reply-to', 'message-id', 'content-id'].includes(key)) {
-                        value = this.message._encodeHeaderValue(key, value);
+                        value = this.message.encodeHeaderValue(key, value);
                     }
                     data.normalizedHeaders[key] = value;
                 }
@@ -219,10 +218,10 @@ export default class MailMessage {
                 });
             }
             if (data.references) {
-                data.normalizedHeaders.references = this.message._encodeHeaderValue('references', data.references);
+                data.normalizedHeaders.references = this.message.encodeHeaderValue('references', data.references);
             }
             if (data.inReplyTo) {
-                data.normalizedHeaders['in-reply-to'] = this.message._encodeHeaderValue('in-reply-to', data.inReplyTo);
+                data.normalizedHeaders['in-reply-to'] = this.message.encodeHeaderValue('in-reply-to', data.inReplyTo);
             }
             return callback(null, data);
         });
@@ -291,7 +290,7 @@ export default class MailMessage {
                             comment = needsEncoding ? mimeFuncs.encodeWord(comment) : mimeFuncs.quoteString(comment);
                             // List-ID expects a bare domain-like identifier, so strip the
                             // scheme prefix that _formatListUrl adds or passes through
-                            return ((value.comment ? comment + ' ' : '') + this._formatListUrl(value.url).replace(/^<[^:]+:\/{0,2}/, '<'));
+                            return (value.comment ? comment + ' ' : '') + this._formatListUrl(value.url).replace(/^<[^:]+:\/{0,2}/, '<');
                         }
                         // List-*: <http://domain> (comment)
                         // the ctext specials go out as quoted-pairs, otherwise a ")" closes the

package/dist/esm/mime-funcs/index.d.ts

@@ -107,6 +107,22 @@ export declare function buildHeaderValue(structured: StructuredHeaderValue): str
  * @return A list of encoded keys and headers
  */
 export declare function buildHeaderParam(key: string, data: string | Buffer, maxLength?: number): EncodedHeaderParam[];
+/**
+ * Options of parseHeaderValue()
+ */
+export interface ParseHeaderValueOptions {
+    /**
+     * Drop the RFC 822 comments outside quoted strings, which the MIME headers allow and
+     * which are not part of the value: 'boundary=b (comment)' names the boundary 'b'. A
+     * parenthesis right behind the '=' of a parameter or behind a token character of its
+     * value continues the token, as it does for Python and postal-mime, so 'Invoice(1).pdf'
+     * keeps its name and 'boundary=(c)b' names the boundary '(c)b'. A comment that never
+     * closes runs to the end of the value, unless a parameter follows it, in which case it is
+     * content and the parameter survives. Comments are kept by default for the sake of the
+     * callers of this exported function, not because keeping them is ever the better reading
+     */
+    stripComments?: boolean | undefined;
+}
 /**
  * Parses a header value with key=value arguments into a structured
  * object.
@@ -120,9 +136,10 @@ export declare function buildHeaderParam(key: string, data: string | Buffer, max
  *   }
  *
  * @param str Header value
+ * @param options Options, see ParseHeaderValueOptions
  * @return Header value as a parsed structure
  */
-export declare function parseHeaderValue(str: string): ParsedHeaderValue;
+export declare function parseHeaderValue(str: string, options?: ParseHeaderValueOptions): ParsedHeaderValue;
 /**
  * Returns file extension for a content type string. If no suitable extensions
  * are found, 'bin' is used as the default extension