@bobfrankston/iflow-direct 0.1.51 → 0.1.52

package/imap-native.js

@@ -356,8 +356,15 @@ export class NativeImapClient {
                 // is the QRESYNC case; without it, the message just vanished
                 // mid-session (post-EXPUNGE on another client).
                 const text = r.text.replace(/^\(EARLIER\)\s*/i, "").trim();
-                for (const uid of proto.parseUidSet(text))
+                // Cap expansion (see parseUidSet): a stale-modseq VANISHED range
+                // can be millions of UIDs. Stop at 100k — the caller's bounded
+                // reconcile takes over for an over-cap set rather than trusting
+                // it (Bob 2026-06-04). 100k > any real single-cycle vanish.
+                const VANISHED_EXPAND_CAP = 100_000;
+                for (const uid of proto.parseUidSet(text, VANISHED_EXPAND_CAP))
                     vanishedUids.push(uid);
+                if (vanishedUids.length >= VANISHED_EXPAND_CAP)
+                    break;
             }
         }
         this.selectedMailbox = mailbox;

package/imap-protocol.d.ts

@@ -90,7 +90,7 @@ export declare function enableCommand(tag: string, extensions: string[]): string
  *  when it has one; here `*` is treated as a sentinel and skipped so the
  *  call site can decide what to do (typically: ignore — VANISHED never
  *  emits `*` because that would be open-ended). */
-export declare function parseUidSet(set: string): number[];
+export declare function parseUidSet(set: string, maxExpand?: number): number[];
 /** Build EXAMINE command (read-only SELECT) */
 export declare function examineCommand(tag: string, mailbox: string): string;
 /** Build STATUS command */

package/imap-protocol.js

@@ -56,9 +56,17 @@ export function enableCommand(tag, extensions) {
  *  when it has one; here `*` is treated as a sentinel and skipped so the
  *  call site can decide what to do (typically: ignore — VANISHED never
  *  emits `*` because that would be open-ended). */
-export function parseUidSet(set) {
+export function parseUidSet(set, maxExpand = Infinity) {
+    // maxExpand caps the expanded output. A VANISHED *range* like
+    // `(EARLIER) 1:4828883` (sent when the client's modseq is very stale)
+    // would otherwise expand to MILLIONS of integers — burning CPU/memory
+    // here and wedging the consumer downstream. The caller passes a cap and
+    // treats an at-cap result as "too stale, reconcile some other way"
+    // (Bob 2026-06-04). Default Infinity keeps every existing caller unchanged.
     const out = [];
     for (const part of set.split(",")) {
+        if (out.length >= maxExpand)
+            break;
         const trimmed = part.trim();
         if (!trimmed)
             continue;
@@ -73,7 +81,7 @@ export function parseUidSet(set) {
             const hi = range[1] === "*" ? lo : parseInt(range[1], 10);
             if (!Number.isFinite(lo) || !Number.isFinite(hi) || hi < lo)
                 continue;
-            for (let u = lo; u <= hi; u++)
+            for (let u = lo; u <= hi && out.length < maxExpand; u++)
                 out.push(u);
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/iflow-direct",
-  "version": "0.1.51",
+  "version": "0.1.52",
   "description": "Direct IMAP client — transport-agnostic, no Node.js dependencies, browser-ready",
   "main": "index.js",
   "types": "index.ts",