@blamejs/core 0.18.54 → 0.18.55

package/lib/guard-filename.js

@@ -561,7 +561,14 @@ function _detectIssues(input, opts) {
   }
 
   // 14. Extension allowlist.
-  if (Array.isArray(opts.extensionAllowlist) && opts.extensionAllowlist.length > 0) {
+  //
+  // Gated on "is an allowlist supplied at all", NOT on "is it non-empty". The
+  // profiles spell "no restriction" as `null`, so an operator who computes the
+  // list and gets back an empty one is saying nothing is permitted — and an
+  // empty list that silently permitted everything inverted exactly that. An
+  // allowlist that disappears when empty is a firewall rule set that opens when
+  // the last rule is deleted.
+  if (Array.isArray(opts.extensionAllowlist)) {
     var split = _splitExt(name);
     var ext = split.ext.toLowerCase();
     var allowed = opts.extensionAllowlist.map(function (e) { return e.toLowerCase(); });

package/lib/guard-html.js

@@ -556,7 +556,12 @@ function _detectIssues(input, opts) {
           location: tok.start,
           snippet: "dangerous tag <" + tok.name + ">",
         });
-      } else if (Object.keys(allowedTags).length > 0 && !allowedTags[tok.name]) {
+      // No `length > 0` guard: the resolved profile always supplies a tag set
+      // (balanced carries 52), so an EMPTY set here can only be a caller who
+      // passed `allowedTags: []` — which means "permit nothing", not "permit
+      // everything". An allowlist that disappears when empty is a firewall rule
+      // set that opens when the last rule is deleted.
+      } else if (!allowedTags[tok.name]) {
         issues.push({
           kind: "non-allowlisted-tag", severity: "high", ruleId: "html.tag",
           location: tok.start,
@@ -734,7 +739,10 @@ function _sanitize(input, opts) {
       var an = a.name.toLowerCase();
       if (_isEventHandlerAttr(an)) continue;
       if (DANGEROUS_ATTRS.indexOf(an) !== -1) continue;
-      if (Object.keys(allowedAttrs).length > 0 && !allowedAttrs[an]) continue;
+      // Same reasoning as the tag allowlist above: the resolved profile always
+      // supplies an attribute set, so an empty one is a caller asking that no
+      // attribute be permitted.
+      if (!allowedAttrs[an]) continue;
       if (a.value && Buffer.byteLength(a.value, "utf8") > opts.maxAttrValueBytes) continue;
       if (_isUrlAttr(an)) {
         var scheme = _extractScheme(a.value);

package/lib/guard-list-unsubscribe.js

@@ -211,7 +211,12 @@ function _isRefusedAutoFetchHost(hostname, allowedHosts) {
   if (lower === "internal" || lower.endsWith(".internal")) return "reserved-local-suffix";
   // Optional operator allowlist — when supplied, hostname (or any
   // ancestor domain) MUST be present.
-  if (Array.isArray(allowedHosts) && allowedHosts.length > 0) {
+  // Gated on "was an allowlist supplied", NOT on "is it non-empty". Omitting
+  // the option is how "any host" is spelled; an operator who computes the list
+  // and gets an empty one is saying no host may be auto-fetched, and reading
+  // that as "any host" inverts it. An allowlist that disappears when empty is a
+  // firewall rule set that opens when the last rule is deleted.
+  if (Array.isArray(allowedHosts)) {
     var matched = false;
     for (var i = 0; i < allowedHosts.length; i += 1) {
       var allowed = String(allowedHosts[i]).toLowerCase();

package/lib/guard-managesieve-command.js

@@ -333,8 +333,9 @@ function _validateAuthenticate(rest, caps, profileName, opts) {
       }
     }
   }
-  var literalBytes = null;
-  var literalPlus  = false;
+  var literalBytes    = null;
+  var literalPlus     = false;
+  var initialResponse = null;
   if (trailing) {
     // Optional initial-response — either `{N+?}` literal or a quoted
     // base64 string.
@@ -365,9 +366,29 @@ function _validateAuthenticate(rest, caps, profileName, opts) {
           "guardManageSieveCommand.validate: AUTHENTICATE initial-response must be a " +
           "literal `{N}` / `{N+}` or quoted base64 string");
       }
+      // Returned rather than discarded. RFC 5804 §2.1 allows the initial
+      // response inline, and this branch already parsed and validated it; the
+      // value was then dropped, so a client that used the quoted form was
+      // answered as though it had sent no initial response at all.
+      if (inner.value.length > MAX_SASL_TOKEN_BYTES) {
+        throw new GuardManageSieveCommandError("guard-managesieve-command/literal-too-large",
+          "guardManageSieveCommand.validate: AUTHENTICATE initial-response " +
+          inner.value.length + " bytes exceeds " + MAX_SASL_TOKEN_BYTES + "-byte cap");
+      }
+      initialResponse = inner.value;
     }
   }
-  return { verb: "AUTHENTICATE", args: [mech], literalBytes: literalBytes, literalPlus: literalPlus };
+  return {
+    verb:            "AUTHENTICATE",
+    args:            [mech],
+    literalBytes:    literalBytes,
+    literalPlus:     literalPlus,
+    // The quoted form's value, or null when the client sent none or sent it as
+    // a literal (whose bytes arrive on the following line). One field, so a
+    // caller asks "was there an initial response" once rather than per
+    // representation.
+    initialResponse: initialResponse,
+  };
 }
 
 function _validateNoop(rest, caps) {

package/lib/guard-smtp-command.js

@@ -500,7 +500,7 @@ function gate(opts) {
 
 /**
  * @primitive b.guardSmtpCommand.detectBodySmuggling
- * @signature b.guardSmtpCommand.detectBodySmuggling(buf)
+ * @signature b.guardSmtpCommand.detectBodySmuggling(buf, isBodyStart?, precededByCr?)
  * @since     0.9.46
  * @status    stable
  * @related   b.guardSmtpCommand.validate, b.safeSmtp.findDotTerminator
@@ -526,11 +526,25 @@ function gate(opts) {
  *   b.guardSmtpCommand.detectBodySmuggling(Buffer.from("body\n.\n"));
  *   // → true (bare-LF dot-line — CVE-2023-51764 shape)
  */
-function detectBodySmuggling(buf) {
+// `isBodyStart` defaults true, which is the whole-body call every existing
+// caller makes. An incremental scanner passes false for every window after the
+// first: the dot-at-offset-0 case below is about a dot that begins the BODY,
+// and a window whose index 0 is mid-line would otherwise report one that is not
+// there.
+//
+// `precededByCr` supplies the one byte a window cannot carry. Deciding whether
+// an LF is bare means reading the byte before it, and the buffer has that byte
+// for every offset except zero. Overlapping windows does not supply it — it
+// only moves which byte lands at offset zero — so a scanner whose window opens
+// on the LF of a canonical `\r\n` had no way to say so, and the boundary read
+// as bare. Default false: at a true body start there is no preceding byte, and
+// a leading LF there really is bare.
+function detectBodySmuggling(buf, isBodyStart, precededByCr) {
   if (!Buffer.isBuffer(buf)) {
     throw new GuardSmtpCommandError("guard-smtp-command/bad-input",
       "detectBodySmuggling: input must be a Buffer");
   }
+  var atStart = isBodyStart === undefined ? true : isBodyStart === true;
   // The CVE-2023-51764 / 51765 / 51766 class is any
   // dot-line whose line boundary is anything OTHER than canonical
   // \r\n on BOTH sides of the dot. The canonical-and-only terminator
@@ -548,14 +562,16 @@ function detectBodySmuggling(buf) {
   // count: a dot at byte 0 followed by `\n` would terminate any
   // receiver that accepts bare-LF dot.
   //   0x0a = LF, 0x0d = CR, 0x2e = `.`
-  if (buf.length >= 2 && buf[0] === 0x2e && buf[1] === 0x0a) return true;
+  if (atStart && buf.length >= 2 && buf[0] === 0x2e && buf[1] === 0x0a) return true;
   // Walk every LF in the buffer. The previous byte must be CR for the
   // line boundary to be canonical; otherwise the line started with
   // bare-LF. If the next bytes are `.` followed by ANY of (LF, CRLF),
   // the shape is a smuggling candidate.
   for (var i = 0; i < buf.length - 1; i += 1) {
     if (buf[i] !== 0x0a) continue;
-    var leadingBareLf = (i === 0) || (buf[i - 1] !== 0x0d);
+    var leadingBareLf = (i === 0)
+      ? (precededByCr !== true)
+      : (buf[i - 1] !== 0x0d);
     if (buf[i + 1] !== 0x2e) continue;
     // Trailing terminator shape after the dot:
     //   buf[i+2] == LF        → bare-LF terminator (always smuggling)

package/lib/guard-svg.js

@@ -561,7 +561,12 @@ function _detectIssues(input, opts) {
         });
         continue;
       }
-    } else if (Object.keys(allowedTags).length > 0 && !allowedTags[tok.name]) {
+    // No `length > 0` guard: the resolved profile always supplies a tag set
+    // (balanced carries 54), so an EMPTY set here can only be a caller who
+    // passed `allowedTags: []` — which means "permit nothing", not "permit
+    // everything". An allowlist that disappears when empty is a firewall rule
+    // set that opens when the last rule is deleted.
+    } else if (!allowedTags[tok.name]) {
       issues.push({
         kind: "non-allowlisted-tag", severity: "high", ruleId: "svg.tag",
         location: tok.start,

package/lib/http-client.js

@@ -621,7 +621,13 @@ function _fromH2Headers(h2Headers) {
 //   { host: "api.x.com", methods: ["GET","HEAD"] }
 //                       method-restricted; methods omitted = any method
 function hostAllowed(host, allowedHosts, method) {
-  if (!Array.isArray(allowedHosts) || allowedHosts.length === 0) return true;
+  // A NON-array means no pin was supplied, so nothing is constrained. An EMPTY
+  // array is a pin that permits nothing, and falls through to the `false` at
+  // the end rather than short-circuiting to `true` here — an allowlist that
+  // disappears when empty is a firewall rule set that opens when the last rule
+  // is deleted. Every caller enforcing this pin routes through here, so the
+  // distinction has to live at this function and not at each of them.
+  if (!Array.isArray(allowedHosts)) return true;
   var wanted = String(host || "").toLowerCase();
   var verb = String(method || "GET").toUpperCase();
   for (var ai = 0; ai < allowedHosts.length; ai++) {
@@ -720,7 +726,9 @@ function pinnedClient(client, allowedHosts) {
   // redirect the wrapper never sees is a hop none of that applied to. Returning
   // the client untouched when no pin was named would leave a 307 from https to
   // http free to resend the credentials that were checked onto the first hop.
-  var pin = (Array.isArray(allowedHosts) && allowedHosts.length > 0) ? allowedHosts : null;
+  // An EMPTY allowlist is a real pin meaning "reach nothing", not the absence
+  // of one — same reasoning as the request path above.
+  var pin = Array.isArray(allowedHosts) ? allowedHosts : null;
   return {
     request: function (opts) {
       var target = opts && opts.url;
@@ -1746,7 +1754,13 @@ function _requestSingle(opts) {
   // A disallowed call rejects with HOST_DISALLOWED AND emits an
   // audit event when opts.audit is wired (operator gets a structured
   // signal that the application tried to reach somewhere it shouldn't).
-  if (Array.isArray(opts.allowedHosts) && opts.allowedHosts.length > 0) {
+  // Gated on "was an allowlist supplied", NOT on "is it non-empty". Omitting
+  // the option is how "no egress pin" is spelled; an operator who builds the
+  // list from config and gets an empty one is saying this process may reach
+  // nothing, and reading that as "no pin" inverts the request exactly. An
+  // allowlist that disappears when empty is a firewall rule set that opens when
+  // the last rule is deleted.
+  if (Array.isArray(opts.allowedHosts)) {
     var host = u.hostname.toLowerCase();
     var method = (opts.method || "GET").toUpperCase();
     var ok = hostAllowed(host, opts.allowedHosts, method);

package/lib/mail-agent.js

@@ -77,6 +77,7 @@
 var lazyRequire        = require("./lazy-require");
 var validateOpts       = require("./validate-opts");
 var C                  = require("./constants");
+var agentAudit         = require("./agent-audit");
 var { defineClass }    = require("./framework-error");
 var guardMailQuery     = require("./guard-mail-query");
 var guardMailCompose   = require("./guard-mail-compose");
@@ -789,10 +790,11 @@ function _auditEmitter(auditOverride) {
   };
 }
 
-function _actorShape(actor) {
-  if (!actor || typeof actor !== "object") return { id: "<unknown>" };
-  return { id: actor.id, roles: actor.roles || [] };
-}
+// Through the shared shaper rather than a local copy. This module had its own,
+// and the two drifted in exactly the way that matters: both emitted `{ id,
+// roles }` while `b.audit.record` reads `actor.userId`, so every row either
+// produced landed unattributable. One shaper means one place to be right.
+var _actorShape = agentAudit.actorShape;
 
 module.exports = {
   create:           create,

package/lib/mail-auth.js

@@ -2088,6 +2088,15 @@ async function arcVerify(rfc822, opts) {
   // 3. Per-hop AMS + AS verification.
   var perHop = [];
   var anyFail = false;
+  // A hop that failed for a reason OTHER than the key being unreachable. RFC
+  // 8601 §2.7 keeps `temperror` apart from `fail` for exactly this reason: one
+  // is a statement about the message, the other about the resolver. Collapsing
+  // them tells a consumer a seal was forged when a DNS query timed out.
+  //
+  // Tracked as the hard case rather than the transient one, because `anyFail`
+  // without `anyHardFail` already means every non-passing hop was a temperror,
+  // and a second flag could disagree with the first.
+  var anyHardFail = false;
   // RFC 8617 §5.2 — operator-tunable clock skew on t= (signing
   // timestamp) and x= (expiration) tags. Default 5 min.
   // A present clockSkewMs must be a non-negative finite integer; an Infinity /
@@ -2147,7 +2156,16 @@ async function arcVerify(rfc822, opts) {
       amsErrors:                amsResult.errors,
       asErrors:                 asResult.errors,
     });
-    if (amsResult.result !== "pass" || asResult.result !== "pass") anyFail = true;
+    if (amsResult.result !== "pass" || asResult.result !== "pass") {
+      anyFail = true;
+      // Accumulated across ALL hops, not decided per hop: a temperror on one
+      // hop and a genuine failure on another is a genuine failure, whichever
+      // order they arrive in.
+      if ((amsResult.result !== "pass" && amsResult.result !== "temperror") ||
+          (asResult.result  !== "pass" && asResult.result  !== "temperror")) {
+        anyHardFail = true;
+      }
+    }
   }
 
   // 4. Chain Validation per RFC 8617 §5.2.
@@ -2190,12 +2208,37 @@ async function arcVerify(rfc822, opts) {
   var lastCv = perHopCv[perHopCv.length - 1];
   var chainStatus;
   var reasonOut = null;
+  // Whether this verdict is worth retrying. A consumer that lets the chain
+  // influence a disposition must not read a resolver outage as a forgery.
+  var transientOut = false;
   if (hopRuleViolation) {
     chainStatus = "fail";
     reasonOut = hopRuleViolation;
   } else if (anyFail) {
     chainStatus = "fail";
-    reasonOut = "signature-verification-failed";
+    // The chain does not validate either way, so the wire token stays "fail" —
+    // RFC 8617 §5.2 gives the chain none / pass / fail and nothing else, and
+    // putting a word on the wire that receivers have no rule for would be a
+    // worse answer than a coarse one. The distinction a consumer needs lives in
+    // the structured verdict beside it.
+    // A cv=fail recorded by a hop is TERMINAL — RFC 8617 §5.2 makes the chain
+    // unrecoverable from that point, so it is reported as the reason even when
+    // an upstream lookup also failed, and it is never transient. Retrying DNS
+    // cannot turn it into a pass, and calling it transient tells a consumer to
+    // defer and re-deliver mail that will never validate.
+    //
+    // Believing that claim requires the hop making it to have proved it made
+    // it. cv= is a token in a header the sender wrote; only the ARC-Seal
+    // covering that header says the named hop is who wrote it. So terminality
+    // is gated on the LAST hop's seal verifying: when its own key lookup
+    // temperrored, the token is unauthenticated text, and honouring it would
+    // let anyone who can stall one DNS query stamp cv=fail on a chain and turn
+    // a retryable outage into a permanent rejection.
+    var lastSeal = perHop.length ? perHop[perHop.length - 1].asResult : null;
+    var terminalCv = lastCv === "fail" && lastSeal === "pass";
+    reasonOut = terminalCv ? "last-as-cv=fail"
+      : (anyHardFail ? "signature-verification-failed" : "key-lookup-unavailable");
+    transientOut = !terminalCv && !anyHardFail;
   } else if (lastCv === "fail") {
     chainStatus = "fail";
     reasonOut = "last-as-cv=fail";
@@ -2216,6 +2259,7 @@ async function arcVerify(rfc822, opts) {
     hops:        perHop,
   };
   if (reasonOut) out.reason = reasonOut;
+  if (transientOut) out.transient = true;
   return out;
 }
 
@@ -2490,6 +2534,9 @@ async function arcEvaluate(rfc822, opts) {
     breakAt:        null,
   };
   if (verdict.reason) out.reason = verdict.reason;
+  // Carried for the same reason `reason` is: a caller deciding what to do about
+  // a chain that did not validate needs to know whether the answer is stable.
+  if (verdict.transient) out.transient = true;
 
   // Re-extract per-hop d= (signing domain on AS) AND the AAR text from
   // the original headers — the verify-result shape doesn't carry
@@ -2719,6 +2766,16 @@ function authResultsEmit(opts) {
 //   // → { spf, dkim, from, dmarc, arc, authResults }
 //   if (v.dmarc.recommendedAction === "reject") { /* refuse 550 5.7.1 */ }
 //
+// `arc.chainStatus` is "none" / "pass" / "fail" — the vocabulary RFC 8617 §5.2
+// gives the chain, and the token that goes on the wire in
+// Authentication-Results. A "fail" carries `arc.reason`, and `arc.transient` is
+// true when the chain did not validate because a key could not be looked up
+// rather than because a seal did not verify. Those want opposite responses: one
+// is a statement about the sender, the other about a resolver, and a consumer
+// that lets the chain influence a disposition must not read an outage as a
+// forgery. The header cannot carry the distinction, which is why the structured
+// verdict does.
+//
 // From-header discipline (RFC 9989 §5.3.1, RFC 7489 §6.6.1 before it):
 // DMARC evaluates exactly one author domain. A message with zero From fields, several From fields,
 // or several author addresses in one field is the header-duplication

package/lib/mail-server-imap.js

@@ -98,10 +98,18 @@
  *
  *   ## What v1 does NOT ship
  *
- *   - **SEARCH** — operator wires `opts.search(actor, mailbox, query)`
- *     when ready; the listener emits `BAD search-not-configured`
- *     until then. SEARCH expressions are operator-domain logic
- *     against the mailStore index.
+ *   - **SEARCH / COPY / MOVE** — operator-domain logic against the
+ *     mailStore index, supplied through `opts.overrides`; until then
+ *     the listener answers `NO <verb> not configured`. A handler
+ *     supplied once serves BOTH the plain and the `UID` form: the UID
+ *     verb dispatches back through the same registry entry and sets
+ *     `parsed.useUid`, which the handler reads to answer in unique
+ *     identifiers per RFC 9051 §6.4.9.
+ *   - **UID EXPUNGE (RFC 4315)** — refused unless the operator
+ *     supplies an EXPUNGE handler that reads the uid-set. The shipped
+ *     EXPUNGE takes no set and expunges every message flagged
+ *     `\Deleted`, so serving the UID form from it would delete
+ *     messages the client did not name.
  *   - **NOTIFY (RFC 5465)**, **METADATA (RFC 5464)**, **CATENATE
  *     (RFC 4469)**, **URLAUTH (RFC 4467)**, **IMAPSIEVE (RFC 6785)**,
  *     **COMPRESS=DEFLATE (RFC 4978)** — opt-in / refused.
@@ -121,7 +129,6 @@
 var net  = require("node:net");
 var safeBuffer = require("./safe-buffer");
 var C = require("./constants");
-var bCrypto = require("./crypto");
 var numericBounds = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
 var guardImapCommand = require("./guard-imap-command");
@@ -229,6 +236,7 @@ function _validateMailboxName(name, opts) {
  *   maxLineBytes:      number,           // default 8192
  *   maxLiteralBytes:   number,           // default 64 MiB
  *   idleTimeoutMs:     number,           // default 30 min
+ *   maxConnections:    number,           // default 1024 — listener-wide ceiling
  *   profile:           "strict" | "balanced" | "permissive",
  *   auth: {
  *     mechanisms:      ["PLAIN", "LOGIN", "SCRAM-SHA-256", "EXTERNAL", "XOAUTH2"],
@@ -274,7 +282,7 @@ function create(opts) {
       "mail.server.imap.create: mailStore is required (compose b.mailStore.create({ backend: ... }))");
   }
   numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxLineBytes", "maxLiteralBytes", "idleTimeoutMs"],
+    ["maxLineBytes", "maxLiteralBytes", "idleTimeoutMs", "maxConnections"],
     "mail.server.imap.", MailServerImapError, "mail-server-imap/bad-bound");
 
   var greeting          = opts.greeting        || DEFAULT_GREETING_VENDOR;
@@ -293,16 +301,18 @@ function create(opts) {
   var _emit = auditEmit.emit;
 
   function _handleConnection(rawSocket) {
-    var remoteAddress = mailServerNet.admitConnection(rawSocket, rateLimit, _emit, {
+    var accepted = mailServerNet.acceptConnection(rawSocket, {
+      rateLimit:    rateLimit,
+      connections:  connections,
+      emit:         _emit,
       refusedEvent: "mail.server.imap.rate_limit_refused",
       refusalLine:  "* BAD Too many connections from your IP\r\n",
+      idPrefix:     "imapconn-",
     });
-    if (remoteAddress === null) return;
-    rawSocket.once("close", function () { rateLimit.releaseConnection(remoteAddress); });
-
-    var connectionId = "imapconn-" + bCrypto.generateToken(8);                                       // connection-id length
-    var socket = rawSocket;
-    connections.add(socket);
+    if (accepted === null) return;
+    var remoteAddress = accepted.remoteAddress;
+    var connectionId  = accepted.connectionId;
+    var socket        = accepted.socket;
 
     var state = {
       id:            connectionId,
@@ -1733,29 +1743,49 @@ function create(opts) {
     var subArgs = sub[2];
     if (subVerb === "FETCH") return _handleFetch(state, socket, tag, subArgs, true);
     if (subVerb === "STORE") return _handleStore(state, socket, tag, subArgs, true);
-    // RFC 9051 §6.4.9 also defines UID SEARCH / UID COPY / UID MOVE /
-    // UID EXPUNGE; deferred from the initial listener slice.
-    //
-    //   SEARCH:  composes with the existing _handleSearch path; needs
-    //            the searchRange path threaded through `useUid: true`.
-    //   COPY:    composes with the existing _handleCopy path; needs
-    //            the mailStore.copyRange opt accepted.
-    //   MOVE:    RFC 6851; same shape as COPY plus an atomic-delete
-    //            step on the source mailbox.
-    //   EXPUNGE: RFC 4315 UIDPLUS; expunges by uid-set instead of by
-    //            \Deleted-flag scan.
+    // Every other sub-command RFC 9051 §6.4.9 defines — SEARCH, COPY, MOVE,
+    // EXPUNGE — goes back through the registry to the SAME entry the
+    // unprefixed verb dispatches to, carrying `useUid` so the handler answers
+    // in unique identifiers.
     //
-    // Re-open condition: operator surfaces a real IMAP client that
-    // refuses to fall back to seq-number variants (most modern
-    // clients — mutt / Thunderbird / Apple Mail / Outlook — already
-    // use the seq-number forms when UID variants are unavailable).
+    // The listener ships no search, copy or move of its own: those are
+    // operator-domain, and the registry holds a "not configured" default that
+    // a consumer replaces through `opts.overrides`. Dispatching the UID forms
+    // here instead of through the registry made that seam reachable from one
+    // side only — a consumer who supplied SEARCH got the sequence form served
+    // and the UID form refused, and the only way to supply the UID form was to
+    // replace the whole UID verb, taking the working UID FETCH and UID STORE
+    // with it. A client that keeps a cross-session cache asks for the UID form
+    // precisely because a sequence number does not survive the session, so the
+    // refusal fell on the clients doing the durable thing.
     //
-    // Operator escape hatch today: clients that issue these UID
-    // sub-commands receive `BAD` and retry against the seq-number
-    // variant (SEARCH / COPY / MOVE / EXPUNGE) which the listener
-    // does serve.
-    _writeTagged(socket, tag, "BAD UID " + subVerb +
-                 " is not yet implemented; client may retry with the seq-number form");
+    // Going through the registry also keeps the tenant check, the guard
+    // validation and the audit emission on the UID path, which a direct call
+    // from here would have skipped.
+    // An allowlist, not "whatever the registry holds". UID takes the five
+    // sub-commands §6.4.9 names plus EXPUNGE from RFC 4315; sending anything
+    // else through would dispatch a real handler that knows nothing about UIDs
+    // — `UID SELECT INBOX` would select a mailbox, and `UID UID …` would
+    // recurse.
+    if (subVerb !== "SEARCH" && subVerb !== "COPY" &&
+        subVerb !== "MOVE"   && subVerb !== "EXPUNGE") {
+      _writeTagged(socket, tag, "BAD UID " + subVerb + " is not a UID sub-command");
+      return;
+    }
+    // EXPUNGE is the one that cannot be forwarded blind. RFC 4315 §2.1 makes
+    // `UID EXPUNGE <uid-set>` expunge ONLY the named messages, while the
+    // listener's own EXPUNGE expunges every message flagged \Deleted and takes
+    // no set at all. Forwarding to it would delete messages the client did not
+    // name, which is worse than not answering. A consumer who supplies their
+    // own EXPUNGE reads `useUid` and the set, so theirs can serve it.
+    if (subVerb === "EXPUNGE" && _registry.source("EXPUNGE") !== "operator-override") {
+      _writeTagged(socket, tag,
+        "NO UID EXPUNGE needs a uid-set-aware EXPUNGE handler; " +
+        "the default expunges by \\Deleted flag and would exceed the set");
+      return;
+    }
+    return _registry.dispatch(subVerb, state, socket,
+      { tag: tag, args: subArgs, useUid: true });
   }
 
   function _handleIdle(state, socket, tag) {
@@ -1855,6 +1885,7 @@ function create(opts) {
   // ---- Lifecycle ----------------------------------------------------------
   return mailServerNet.createStoreServer(net, {
     defaultPort:      143,                                                                              // RFC 9051 IMAP port (IANA)
+    maxConnections:   opts.maxConnections,
     handleConnection: _handleConnection,
     errorClass:       MailServerImapError,
     errorCodePrefix:  "mail-server-imap/",