nodemailer 9.1.1 → 10.0.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # CHANGELOG
 
+## [10.0.0](https://github.com/nodemailer/nodemailer/compare/v9.1.1...v10.0.0) (2026-09-03)
+
+
+### ⚠ BREAKING CHANGES
+
+* Node.js 20 or newer is required. The Node.js 6 syntax compatibility check and the .npmignore file are gone.
+
+### Features
+
+* keep the @types/nodemailer type layout working ([1cc5356](https://github.com/nodemailer/nodemailer/commit/1cc535627e1bb672214b09fa4cc503567275fd7f))
+* migrate to TypeScript with ES module and CommonJS builds ([f7cbf83](https://github.com/nodemailer/nodemailer/commit/f7cbf8384e0ea6055efcc514afb8bc070ac3a2b1))
+
+
+### Bug Fixes
+
+* apply the other keys of a configuration object next to its url ([29610f9](https://github.com/nodemailer/nodemailer/commit/29610f9fe04dbd8af04c4a3362f3b68d293592da))
+* **dkim:** canonicalize raw messages the way verifiers do ([2c84b11](https://github.com/nodemailer/nodemailer/commit/2c84b117d4d138751e9ffa8607f3796771bb5e66))
+* keep a transporter assignable to the plain Transporter type ([8bf55fb](https://github.com/nodemailer/nodemailer/commit/8bf55fb177cf155b24d6bb86a7cd86670146d551))
+* **shared:** keep a colon in the user name of a connection or proxy url ([6acf4b6](https://github.com/nodemailer/nodemailer/commit/6acf4b67d919971f516f58940113c9b8598b2254))
+* **shared:** refuse URL hosts the legacy parser would truncate ([17a5068](https://github.com/nodemailer/nodemailer/commit/17a5068f06e62fc04e1d5545ed70d4248bef258e))
+* **shared:** resolve hostnames when the runtime has no interface table ([8b03240](https://github.com/nodemailer/nodemailer/commit/8b032407135ea05ae377e623a7021705a4a139d0))
+* **smtp-connection:** clear the timers of a connection dropped before the greeting ([01dcaa0](https://github.com/nodemailer/nodemailer/commit/01dcaa05b212aafc33747041027fb8c66497e0eb))
+* **smtp-connection:** keep an incomplete server reply out of lastServerResponse ([1a6e427](https://github.com/nodemailer/nodemailer/commit/1a6e4271adb808509adf11832ad1adfdfc05c31b))
+* **smtp-pool:** free the pool slot when the proxy socket can not be opened ([204a344](https://github.com/nodemailer/nodemailer/commit/204a344f7e4068ff41385195ee394a223ebadd84))
+* **well-known:** keep nodemailer/lib/well-known/services.json available ([367730c](https://github.com/nodemailer/nodemailer/commit/367730cce85bc78c7804405c2cc7d89d93aafdd1))
+
 ## [9.1.1](https://github.com/nodemailer/nodemailer/compare/v9.1.0...v9.1.1) (2026-09-01)
 
 

package/README.md

@@ -10,15 +10,19 @@ See [nodemailer.com](https://nodemailer.com/) for documentation and terms.
 
 > Nodemailer is developed by the team behind **[EmailEngine](https://emailengine.app/?utm_source=nodemailer-readme&utm_medium=readme&utm_campaign=oss-docs)**, a self-hosted email API that turns any Gmail, Microsoft 365, or IMAP account into a REST endpoint, with managed OAuth2, webhooks for incoming mail, and built-in [sending](https://emailengine.app/sending-emails?utm_source=nodemailer-readme&utm_medium=readme&utm_campaign=oss-docs). If you would rather call an HTTP API than maintain IMAP and SMTP connections yourself, that is what it is for.
 
+## Supported runtimes
+
+Nodemailer targets Node.js 20 and later. The ES module build also runs on [Bun](https://bun.sh/) (tested against the latest release) and on [Cloudflare Workers](https://developers.cloudflare.com/workers/) with the `nodejs_compat` compatibility flag. On Workers only the SMTP based transports apply, `sendmail` needs a child process, and the runtime does not allow turning certificate validation off, so `tls.rejectUnauthorized: false` fails there with an error.
+
 ## Having an issue?
 
 #### First review the docs
 
 Documentation for Nodemailer can be found at [nodemailer.com](https://nodemailer.com/about/).
 
-#### Nodemailer throws a SyntaxError for "..."
+#### Nodemailer fails to load or throws a SyntaxError
 
-You are using an older Node.js version than v6.0. Upgrade Node.js to get support for the spread operator. Nodemailer supports all Node.js versions starting from Node.js@v6.0.0.
+Nodemailer 10 and later require Node.js 20 or newer. The package ships both ES module and CommonJS builds, so `import nodemailer from 'nodemailer'` and `const nodemailer = require('nodemailer')` both work. If you need to run on an older Node.js version, stay on the 9.x line.
 
 #### I'm having issues with Gmail
 
@@ -68,7 +72,7 @@ let configOptions = {
 
 #### I have an issue with TypeScript types
 
-Nodemailer has official support for Node.js only. For anything related to TypeScript, you need to directly contact the authors of the [type definitions](https://www.npmjs.com/package/@types/nodemailer).
+Nodemailer 10 and later are written in TypeScript and ship their own type definitions, so `@types/nodemailer` is no longer needed and should be removed from your project to avoid conflicting declarations. The type names follow the layout of the old definitions, so references such as `Mail.Options`, `SMTPTransport.Options` or `Transporter<SMTPTransport.SentMessageInfo>` keep compiling, and the most used types (`SendMailOptions`, `Transporter`, `SentMessageInfo`, `Attachment`, `Address`) are exported from the package root. For older Nodemailer versions, the community maintained [type definitions](https://www.npmjs.com/package/@types/nodemailer) still apply.
 
 #### I have a different problem
 

package/SECURITY.md

@@ -6,13 +6,13 @@ reports seriously and aim to respond quickly.
 ## Supported Versions
 
 Security fixes are released only against the latest major version. We do not
-backport patches to older majors — upgrading to the current release line is the
-supported way to receive security updates.
+backport patches to older majors, so upgrading to the current release line is
+the supported way to receive security updates.
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 9.x     | :white_check_mark: |
-| < 9.0   | :x:                |
+| 10.x    | :white_check_mark: |
+| < 10.0  | :x:                |
 
 If you are on an older major, please upgrade. See the migration notes at
 <https://nodemailer.com/> before updating.
@@ -41,7 +41,7 @@ When reporting, please include as much of the following as you can:
 - Any suggested remediation, if you have one.
 
 Nodemailer is maintained by a single person, so there is no guaranteed response
-time — sometimes reports are handled within hours, sometimes they take longer.
+time: sometimes reports are handled within hours, sometimes they take longer.
 Accepted issues are fixed in a new release and coordinated through a GitHub
 Security Advisory, and reporters who wish to be named are credited.
 
@@ -49,12 +49,12 @@ Security Advisory, and reporters who wish to be named are credited.
 
 We track and disclose vulnerabilities through GitHub Security Advisories. We do
 not request or manage CVE identifiers ourselves. If you need a CVE assigned for a
-reported issue, please request one yourself — for example, through GitHub's own
+reported issue, please request one yourself, for example through GitHub's own
 CVE request flow on the published advisory, or another CNA.
 
 ## Scope
 
-In scope: the `nodemailer` package source in this repository — message and MIME
+In scope: the `nodemailer` package source in this repository: message and MIME
 generation, SMTP/LMTP client behaviour, address parsing, header handling, DKIM
 signing, and the bundled transports.
 

package/dist/cjs/addressparser/index.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Options for addressparser
+ */
+export interface AddressParserOptions {
+    /** Flatten groups into a single list of mailboxes */
+    flatten?: boolean;
+    /** Internal recursion depth counter (do not set manually) */
+    _depth?: number;
+}
+/**
+ * A single mailbox. Either value may be an empty string when the input did not carry it
+ */
+export interface MailboxAddress {
+    name: string;
+    address: string;
+    group?: undefined;
+}
+/**
+ * An address group. RFC 5322 does not allow nested groups, so any nesting is flattened
+ * into `group`
+ */
+export interface GroupAddress {
+    name: string;
+    group: Address[];
+    address?: undefined;
+}
+/**
+ * A parsed address entry, either a mailbox or a group
+ */
+export type Address = MailboxAddress | GroupAddress;
+/**
+ * Parses structured e-mail addresses from an address field
+ *
+ * Example:
+ *
+ *    'Name <address@domain>'
+ *
+ * will be converted to
+ *
+ *     [{name: 'Name', address: 'address@domain'}]
+ *
+ * @param str Address field
+ * @param options Optional options object
+ * @param options._depth Internal recursion depth counter (do not set manually)
+ * @return An array of address objects
+ */
+export default function addressparser(str?: string | null, options?: AddressParserOptions): Address[];

package/dist/cjs/addressparser/index.js

@@ -0,0 +1,508 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = addressparser;
+/**
+ * Restores the quoting of a local part that was read out of a quoted string.
+ *
+ * RFC 5321 allows '@' inside a quoted local part, so handing '"user@evil.com"@good.com'
+ * on as the bare 'user@evil.com@good.com' leaves it to the consumer which '@' splits the
+ * domain off. Getting that wrong is a misrouting vector, so the quotes go back on. The
+ * same holds for the other specials: a ',' or a ';' that loses its quotes reads as a
+ * recipient separator once the consumer puts the address back into a header.
+ *
+ * This module has no dependencies so that it can ship on its own, which is why the two
+ * grammar tests below are spelled out here instead of shared with src/mime-node. Keeping
+ * only what is ambiguous quoted is deliberate, mime-node applies the stricter RFC 5321
+ * dot-atom rule on top of this when it emits an address.
+ *
+ * @param address Address with an unquoted local part
+ * @return Address with the local part as a quoted-string
+ */
+function _quoteLocalPart(address) {
+    const lastAt = address.lastIndexOf('@');
+    if (lastAt < 0) {
+        // no domain to split off, nothing can be misrouted
+        return address;
+    }
+    const user = address.substr(0, lastAt);
+    if (/^[^\s"(),:;<>@[\\\]]+$/.test(user) || /^"(?:[^"\\]|\\[\s\S])*"$/.test(user)) {
+        // a local part that carries no special reads the same with or without the quotes,
+        // and one that is already a complete quoted-string needs nothing either
+        return address;
+    }
+    return '"' + user.replace(/["\\]/g, '\\$&') + '"@' + address.substr(lastAt + 1);
+}
+/**
+ * Reached for every parsed address, so it is built once rather than per call.
+ */
+const HAS_WHITESPACE = /\s/;
+/**
+ * An addr-spec that carries its whitespace legally, inside a quoted local part. The
+ * optional tail is the malformed shape: a real mailbox with wreckage trailing it.
+ */
+const QUOTED_LOCAL_ADDR = /^("(?:[^"\\]|\\[\s\S])*"@\S+)(?:\s+([\s\S]+))?$/;
+/**
+ * One run holding a single '@' and no whitespace, the shape an addr-spec has to have.
+ */
+const ADDR_SPEC = /^[^@\s]+@[^@\s]+$/;
+/**
+ * The looser reading applied once the strict one finds nothing, which tolerates the
+ * further '@' that a domain should not have but malformed headers carry anyway.
+ */
+const LOOSE_ADDR_SPEC = /^[^@\s]+@\S+$/;
+/**
+ * Recovers the addr-spec from an angle-addr that came back holding unquoted whitespace.
+ *
+ * A malformed header can put more than a mailbox between the angle brackets, most often
+ * because the generator wrote the recipient twice: '<user@example.com user@example.com>'
+ * or '<example.com user@example.com>'. Whitespace is not addr-spec, so the whole run can
+ * never be a mailbox anyone could deliver to, and passing it on as the address loses the
+ * recipient that is sitting right there in the header.
+ *
+ * The run that still reads as an addr-spec is kept and whatever is left over becomes
+ * display text rather than being dropped. Candidates are read strictly first and then
+ * under the looser grammar, the same two tiers the unquoted-text branch below applies to
+ * the same problem, so that '<a@b@c.com junk>' and a bare 'a@b@c.com junk' agree on the
+ * recipient. When several runs qualify the first wins, which is what that branch's looser
+ * tier does within a token.
+ *
+ * A quoted local part is left alone: RFC 5321 allows whitespace inside it, so
+ * '<"user name"@example.com>' is well formed and means exactly what it says.
+ *
+ * @param data Collected address parts, mutated in place
+ */
+function _recoverAddrSpec(data) {
+    if (!HAS_WHITESPACE.test(data.address)) {
+        return;
+    }
+    let address;
+    let rest;
+    const quoted = data.address.match(QUOTED_LOCAL_ADDR);
+    if (quoted) {
+        if (!quoted[2]) {
+            // the whitespace sits inside the quoted local part, this is a well formed mailbox
+            return;
+        }
+        // a real mailbox with wreckage trailing it, so peel the addr-spec off whole rather
+        // than splitting into the quotes
+        address = quoted[1];
+        rest = [quoted[2]];
+    }
+    else {
+        if (data.address.indexOf('"') >= 0) {
+            // Splitting on whitespace loses track of where the quoted string starts and ends,
+            // and this module does not take addresses out of quoted strings: the run picked out
+            // of '<junk "user@evil.com b"@good.com>' would be an address from the domain the
+            // quotes were hiding. Every well formed shape was already handled above, so what is
+            // left is wreckage either way and the original is the honest answer
+            return;
+        }
+        const parts = data.address.split(/\s+/);
+        let addrIndex = parts.findIndex(part => ADDR_SPEC.test(part));
+        if (addrIndex < 0) {
+            addrIndex = parts.findIndex(part => LOOSE_ADDR_SPEC.test(part));
+        }
+        if (addrIndex < 0) {
+            // nothing in there reads as an address, there is no better answer than the original
+            return;
+        }
+        address = parts.splice(addrIndex, 1)[0];
+        rest = parts;
+    }
+    data.address = address;
+    data.text = [data.text]
+        .concat(rest)
+        .filter(part => part)
+        .join(' ');
+}
+/**
+ * Converts tokens for a single address into an address object
+ *
+ * @param tokens Tokens object
+ * @param depth Current recursion depth for nested group protection
+ * @return Address object
+ */
+function _handleAddress(tokens, depth) {
+    let isGroup = false;
+    let state = 'text';
+    const addresses = [];
+    const data = {
+        address: [],
+        comment: [],
+        group: [],
+        text: [],
+        textWasQuoted: []
+    };
+    let insideQuotes = false;
+    // Filter out <addresses>, (comments) and regular text
+    for (let i = 0, len = tokens.length; i < len; i++) {
+        const token = tokens[i];
+        const prevToken = i ? tokens[i - 1] : null;
+        if (token.type === 'operator') {
+            switch (token.value) {
+                case '<':
+                    state = 'address';
+                    insideQuotes = false;
+                    break;
+                case '(':
+                    state = 'comment';
+                    insideQuotes = false;
+                    break;
+                case ':':
+                    state = 'group';
+                    isGroup = true;
+                    insideQuotes = false;
+                    break;
+                case '"':
+                    insideQuotes = !insideQuotes;
+                    state = 'text';
+                    break;
+                default:
+                    state = 'text';
+                    insideQuotes = false;
+                    break;
+            }
+        }
+        else if (token.value) {
+            if (state === 'address') {
+                // Handle unquoted name that includes a "<".
+                // Apple Mail truncates everything between an unexpected < and an address.
+                token.value = token.value.replace(/^[^<]*<\s*/, '');
+            }
+            // A comment is folding whitespace. It may sit inside an addr-spec, on either side
+            // of the '@', but it cannot join two atoms into one: gluing across it would read
+            // 'user@example.com(x)evil.com' as the single domain 'example.comevil.com' and
+            // deliver to a domain the sender never named.
+            const parts = data[state];
+            const joins = prevToken &&
+                prevToken.noBreak &&
+                parts.length &&
+                (prevToken.value !== ')' || parts[parts.length - 1].slice(-1) === '@' || token.value.charAt(0) === '@');
+            if (joins) {
+                data[state][data[state].length - 1] += token.value;
+                if (state === 'text' && insideQuotes) {
+                    data.textWasQuoted[data.textWasQuoted.length - 1] = true;
+                }
+            }
+            else {
+                data[state].push(token.value);
+                if (state === 'text') {
+                    data.textWasQuoted.push(insideQuotes);
+                }
+            }
+        }
+    }
+    // If there is no text but a comment, replace the two
+    if (!data.text.length && data.comment.length) {
+        data.text = data.comment;
+        data.comment = [];
+    }
+    if (isGroup) {
+        // http://tools.ietf.org/html/rfc2822#appendix-A.1.3
+        data.text = data.text.join(' ');
+        // Parse group members, but flatten any nested groups (RFC 5322 doesn't allow nesting)
+        let groupMembers = [];
+        if (data.group.length) {
+            const parsedGroup = addressparser(data.group.join(','), { _depth: depth + 1 });
+            parsedGroup.forEach(member => {
+                if (member.group) {
+                    groupMembers = groupMembers.concat(member.group);
+                }
+                else {
+                    groupMembers.push(member);
+                }
+            });
+        }
+        addresses.push({
+            name: data.text || '',
+            group: groupMembers
+        });
+    }
+    else {
+        // If no address was found, try to detect one from regular text
+        if (!data.address.length && data.text.length) {
+            for (let i = data.text.length - 1; i >= 0; i--) {
+                // Security: Do not extract email addresses from quoted strings.
+                // RFC 5321 allows @ inside quoted local-parts like "user@domain"@example.com.
+                // Extracting emails from quoted text leads to misrouting vulnerabilities.
+                if (!data.textWasQuoted[i] && ADDR_SPEC.test(data.text[i])) {
+                    data.address = data.text.splice(i, 1);
+                    data.textWasQuoted.splice(i, 1);
+                    break;
+                }
+            }
+            // Try a looser regex match if strict match found nothing
+            if (!data.address.length) {
+                let extracted = false;
+                for (let i = data.text.length - 1; i >= 0; i--) {
+                    // Security: Do not extract email addresses from quoted strings
+                    if (!data.textWasQuoted[i]) {
+                        data.text[i] = data.text[i]
+                            .replace(/\s*\b[^@\s]+@[^\s]+\b\s*/, (match) => {
+                            if (!extracted) {
+                                data.address = [match.trim()];
+                                extracted = true;
+                                return ' ';
+                            }
+                            return match;
+                        })
+                            .trim();
+                        if (extracted) {
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+        // If there's still no text but a comment exists, replace the two
+        if (!data.text.length && data.comment.length) {
+            data.text = data.comment;
+            data.comment = [];
+        }
+        // Keep only the first address occurrence, push others to regular text
+        if (data.address.length > 1) {
+            data.text = data.text.concat(data.address.splice(1));
+        }
+        // An address is only taken from unquoted text, so anything left in the text at this
+        // point that still has to serve as the address carries its quoting in this flag
+        const addressFromQuotedText = !data.address.length && data.textWasQuoted.some(wasQuoted => wasQuoted);
+        // Join values with spaces
+        data.text = data.text.join(' ');
+        data.address = data.address.join(' ');
+        _recoverAddrSpec(data);
+        const address = {
+            address: data.address || data.text || '',
+            name: data.text || data.address || ''
+        };
+        if (address.address === address.name) {
+            if (/@/.test(address.address || '')) {
+                address.name = '';
+            }
+            else {
+                address.address = '';
+            }
+        }
+        if (addressFromQuotedText && address.address) {
+            address.address = _quoteLocalPart(address.address);
+        }
+        addresses.push(address);
+    }
+    return addresses;
+}
+/**
+ * Creates a Tokenizer object for tokenizing address field strings
+ *
+ * @constructor
+ * @param str Address field string
+ */
+class Tokenizer {
+    constructor(str) {
+        this.str = (str || '').toString();
+        this.operatorCurrent = '';
+        this.operatorExpecting = '';
+        this.node = null;
+        this.escaped = false;
+        this.inDomainLiteral = false;
+        this.list = [];
+        /**
+         * Operator tokens and which tokens are expected to end the sequence
+         */
+        this.operators = {
+            '"': '"',
+            '(': ')',
+            '<': '>',
+            ',': '',
+            ':': ';',
+            // Semicolons are not a legal delimiter per the RFC2822 grammar other
+            // than for terminating a group, but they are also not valid for any
+            // other use in this context.  Given that some mail clients have
+            // historically allowed the semicolon as a delimiter equivalent to the
+            // comma in their UI, it makes sense to treat them the same as a comma
+            // when used outside of a group.
+            ';': ''
+        };
+    }
+    /**
+     * Tokenizes the original input string
+     *
+     * @return An array of operator|text tokens
+     */
+    tokenize() {
+        const list = [];
+        for (let i = 0, len = this.str.length; i < len; i++) {
+            const chr = this.str.charAt(i);
+            const nextChr = i < len - 1 ? this.str.charAt(i + 1) : null;
+            this.checkChar(chr, nextChr);
+        }
+        this.list.forEach(node => {
+            node.value = (node.value || '').toString().trim();
+            if (node.value) {
+                list.push(node);
+            }
+        });
+        return list;
+    }
+    /**
+     * Checks if a character is an operator or text and acts accordingly
+     *
+     * @param chr Character from the address field
+     */
+    checkChar(chr, nextChr) {
+        // Track RFC 5322 domain-literals ("[" *dtext "]"). Operator characters such
+        // as the ":" of an IPv6 address-literal (user@[IPv6:2001:db8::1]) are dtext
+        // and must not be treated as the group delimiter while inside the brackets.
+        // Quoted strings and comments are handled separately via operatorExpecting,
+        // so only enter this state when no operator is open. The list separators ","
+        // and ";" are the exception: they always end the literal (and split the
+        // address list) so that an unclosed "[" cannot swallow later recipients.
+        if (!this.escaped && !this.operatorExpecting) {
+            if (!this.inDomainLiteral && chr === '[') {
+                this.inDomainLiteral = true;
+            }
+            else if (this.inDomainLiteral && (chr === ']' || chr === ',' || chr === ';')) {
+                this.inDomainLiteral = false;
+            }
+        }
+        if (this.escaped) {
+            // ignore next condition blocks
+        }
+        else if (chr === this.operatorExpecting) {
+            this.node = {
+                type: 'operator',
+                value: chr
+            };
+            if (nextChr && ![' ', '\t', '\r', '\n', ',', ';'].includes(nextChr)) {
+                this.node.noBreak = true;
+            }
+            this.list.push(this.node);
+            this.node = null;
+            this.operatorExpecting = '';
+            this.escaped = false;
+            return;
+        }
+        else if (!this.operatorExpecting && !this.inDomainLiteral && chr in this.operators) {
+            this.node = {
+                type: 'operator',
+                value: chr
+            };
+            this.list.push(this.node);
+            this.node = null;
+            this.operatorExpecting = this.operators[chr];
+            this.escaped = false;
+            return;
+        }
+        else if (['"', "'"].includes(this.operatorExpecting) && chr === '\\') {
+            this.escaped = true;
+            return;
+        }
+        if (!this.node) {
+            this.node = {
+                type: 'text',
+                value: ''
+            };
+            this.list.push(this.node);
+        }
+        if (chr === '\n') {
+            // Convert newlines to spaces. Carriage return is ignored as \r and \n usually
+            // go together anyway and there already is a WS for \n. Lone \r means something is fishy.
+            chr = ' ';
+        }
+        if (chr.charCodeAt(0) >= 0x21 || [' ', '\t'].includes(chr)) {
+            // skip command bytes
+            this.node.value += chr;
+        }
+        this.escaped = false;
+    }
+}
+/**
+ * Maximum recursion depth for parsing nested groups.
+ * RFC 5322 doesn't allow nested groups, so this is a safeguard against
+ * malicious input that could cause stack overflow.
+ */
+const MAX_NESTED_GROUP_DEPTH = 50;
+/**
+ * Parses structured e-mail addresses from an address field
+ *
+ * Example:
+ *
+ *    'Name <address@domain>'
+ *
+ * will be converted to
+ *
+ *     [{name: 'Name', address: 'address@domain'}]
+ *
+ * @param str Address field
+ * @param options Optional options object
+ * @param options._depth Internal recursion depth counter (do not set manually)
+ * @return An array of address objects
+ */
+function addressparser(str, options) {
+    options = options || {};
+    const depth = options._depth || 0;
+    // Prevent stack overflow from deeply nested groups (DoS protection)
+    if (depth > MAX_NESTED_GROUP_DEPTH) {
+        return [];
+    }
+    const tokenizer = new Tokenizer(str);
+    const tokens = tokenizer.tokenize();
+    const addresses = [];
+    let address = [];
+    let parsedAddresses = [];
+    tokens.forEach(token => {
+        if (token.type === 'operator' && (token.value === ',' || token.value === ';')) {
+            if (address.length) {
+                addresses.push(address);
+            }
+            address = [];
+        }
+        else {
+            address.push(token);
+        }
+    });
+    if (address.length) {
+        addresses.push(address);
+    }
+    addresses.forEach(addr => {
+        const handled = _handleAddress(addr, depth);
+        // Appended in place. Rebuilding the accumulator with concat() would copy every
+        // entry collected so far on each address, making a flat list cost O(n^2).
+        for (let i = 0; i < handled.length; i++) {
+            parsedAddresses.push(handled[i]);
+        }
+    });
+    // Merge fragments produced when unquoted display names contain commas.
+    // "Joe Foo, PhD <joe@example.com>" is split on the comma into
+    // [{name:"Joe Foo", address:""}, {name:"PhD", address:"joe@example.com"}].
+    // Recombine: a name-only entry followed by an entry with both name and address.
+    // Walked back to front so that a run of fragments folds into one entry in a single
+    // pass. Splicing each fragment out of the list instead would cost O(n^2).
+    const mergedAddresses = [];
+    for (let i = parsedAddresses.length - 1; i >= 0; i--) {
+        const current = parsedAddresses[i];
+        const next = mergedAddresses.length ? mergedAddresses[mergedAddresses.length - 1] : null;
+        if (next && current.address === '' && current.name && !current.group && next.address && next.name) {
+            next.name = current.name + ', ' + next.name;
+        }
+        else {
+            mergedAddresses.push(current);
+        }
+    }
+    mergedAddresses.reverse();
+    parsedAddresses = mergedAddresses;
+    if (options.flatten) {
+        const flatAddresses = [];
+        const walkAddressList = (list) => {
+            list.forEach(entry => {
+                if (entry.group) {
+                    return walkAddressList(entry.group);
+                }
+                flatAddresses.push(entry);
+            });
+        };
+        walkAddressList(parsedAddresses);
+        return flatAddresses;
+    }
+    return parsedAddresses;
+}
+module.exports = exports.default;
+Object.defineProperty(module.exports, 'default', { value: exports.default, enumerable: false, writable: true, configurable: true });