@withbuddi/buddi 0.1.0-pre.21 → 0.1.0-pre.23

package/node_modules/imapflow/dist/esm/search-compiler.js

@@ -1,5 +1,5 @@
 /* eslint no-control-regex:0 */
-import { formatDate, formatFlag, canUseFlag, toValidDate, isRev2Active } from './tools.js';
+import { formatDate, formatFlag, toValidDate, isRev2Active } from './tools.js';
 /**
  * Sets a boolean flag in the IMAP search attributes.
  * Automatically handles UN- prefixing for falsy values.
@@ -88,6 +88,17 @@ let processDateField = (attributes, term, value) => {
 };
 // Pre-compiled regex for better performance
 const UNICODE_PATTERN = /[^\x00-\x7F]/;
+/**
+ * Throws a coded search compilation error.
+ *
+ * @param code - Error code, one of the ImapFlowErrorCode values
+ * @param message - Error message
+ */
+let fail = (code, message) => {
+    let error = new Error(message);
+    error.code = code;
+    throw error;
+};
 /**
  * Checks if a string contains Unicode characters.
  * Used to determine if CHARSET UTF-8 needs to be specified.
@@ -107,7 +118,7 @@ let isUnicodeString = (str) => {
  * Compiles a JavaScript object query into IMAP search command attributes.
  * Supports standard IMAP search criteria and extensions like OBJECTID and Gmail extensions.
  *
- * @param connection - IMAP connection object (capabilities, enabled extensions and the current mailbox are read)
+ * @param connection - IMAP connection object (capabilities and enabled extensions are read)
  * @param query - Search query object
  * @returns Array of IMAP search attributes
  * @throws {Error} When required server extensions are not available
@@ -133,21 +144,29 @@ export const searchCompiler = (connection, query) => {
     const attributes = [];
     // Track if we need to specify UTF-8 charset
     let hasUnicode = false;
-    const mailbox = connection.mailbox;
     /**
      * Recursively walks through the query object and builds IMAP attributes.
      * @param params - Query parameters to process
      */
     const walk = (params) => {
-        // Walks a query object and wraps the resulting attributes in a
-        // sub-array so the IMAP compiler emits parentheses around them.
-        // Used when a single search-key is required (NOT, OR operands)
-        // but the condition has multiple keys (RFC 3501 Section 6.4.4).
-        let walkGrouped = (obj) => {
+        // Compiles one NOT or OR operand, which the caller has already put its operator in
+        // front of. An operand with several keys is wrapped in a sub-array so the IMAP compiler
+        // emits parentheses around it, as the operator takes a single search-key
+        // (RFC 3501 Section 6.4.4). An operand that compiles to nothing (an invalid date, an
+        // empty object, ...) is refused: the operator would otherwise bind to whatever
+        // criterion follows it and invert or widen the search.
+        let walkOperand = (operator, obj) => {
             let startIdx = attributes.length;
-            walk(obj);
-            let subAttrs = attributes.splice(startIdx);
-            attributes.push(subAttrs);
+            if (obj && typeof obj === 'object') {
+                walk(obj);
+            }
+            if (attributes.length === startIdx) {
+                fail('InvalidSearchQuery', `Search operand for ${operator} does not include any usable search criteria`);
+            }
+            if (Object.keys(obj).length > 1) {
+                let subAttrs = attributes.splice(startIdx);
+                attributes.push(subAttrs);
+            }
         };
         Object.keys(params || {}).forEach(term => {
             switch (term.toUpperCase()) {
@@ -193,9 +212,7 @@ export const searchCompiler = (connection, query) => {
                         // reject the whole search with a tagged BAD, so fail with a
                         // descriptive error instead
                         if (isRev2Active(connection)) {
-                            let error = new Error(`The "${term.toLowerCase()}" search key does not exist in IMAP4rev2`);
-                            error.code = 'MissingServerExtension';
-                            throw error;
+                            fail('MissingServerExtension', `The "${term.toLowerCase()}" search key does not exist in IMAP4rev2`);
                         }
                         setBoolOpt(attributes, term, true);
                     }
@@ -241,6 +258,11 @@ export const searchCompiler = (connection, query) => {
                         // Fallback to Gmail message ID
                         setOpt(attributes, 'X-GM-MSGID', params[term]);
                     }
+                    else if (params[term]) {
+                        // Dropping the criterion would widen the search to every message
+                        // matching the rest of the query, which a delete or move acts on
+                        fail('MissingServerExtension', 'Server does not support OBJECTID or X-GM-EXT-1 extension required for EMAILID');
+                    }
                     break;
                 // Thread ID support (OBJECTID or Gmail extension)
                 case 'THREADID':
@@ -251,6 +273,11 @@ export const searchCompiler = (connection, query) => {
                         // Fallback to Gmail thread ID
                         setOpt(attributes, 'X-GM-THRID', params[term]);
                     }
+                    else if (params[term]) {
+                        // Dropping the criterion would widen the search to every message
+                        // matching the rest of the query, which a delete or move acts on
+                        fail('MissingServerExtension', 'Server does not support OBJECTID or X-GM-EXT-1 extension required for THREADID');
+                    }
                     break;
                 // Gmail raw search
                 case 'GMRAW':
@@ -262,9 +289,7 @@ export const searchCompiler = (connection, query) => {
                         setOpt(attributes, 'X-GM-RAW', params[term]);
                     }
                     else {
-                        let error = new Error('Server does not support X-GM-EXT-1 extension required for X-GM-RAW');
-                        error.code = 'MissingServerExtension';
-                        throw error;
+                        fail('MissingServerExtension', 'Server does not support X-GM-EXT-1 extension required for X-GM-RAW');
                     }
                     break;
                 // Gmail label search. Compiles { has, not } into an X-GM-RAW "label:"/"-label:" query
@@ -298,9 +323,7 @@ export const searchCompiler = (connection, query) => {
                         break;
                     }
                     if (!connection.capabilities.has('X-GM-EXT-1')) {
-                        let error = new Error('Server does not support X-GM-EXT-1 extension required for label search');
-                        error.code = 'MissingServerExtension';
-                        throw error;
+                        fail('MissingServerExtension', 'Server does not support X-GM-EXT-1 extension required for label search');
                     }
                     let rawQuery = rawParts.join(' ');
                     if (isUnicodeString(rawQuery)) {
@@ -344,8 +367,10 @@ export const searchCompiler = (connection, query) => {
                 case 'UNKEYWORD':
                     {
                         let flag = formatFlag(params[term]);
-                        // Only add if flag is supported or already exists in mailbox
-                        if (canUseFlag(mailbox, flag) || mailbox.flags.has(flag)) {
+                        // Compiled even when the mailbox does not allow the keyword: the
+                        // correct answer is then the empty set, which dropping the
+                        // criterion would turn into every message matching the rest
+                        if (flag) {
                             setOpt(attributes, term, flag);
                         }
                     }
@@ -374,12 +399,7 @@ export const searchCompiler = (connection, query) => {
                 case 'NOT':
                     if (params[term] && typeof params[term] === 'object') {
                         attributes.push({ type: 'ATOM', value: 'NOT' });
-                        if (Object.keys(params[term]).length > 1) {
-                            walkGrouped(params[term]);
-                        }
-                        else {
-                            walk(params[term]);
-                        }
+                        walkOperand('NOT', params[term]);
                     }
                     break;
                 // OR operator - complex logic for building OR trees
@@ -438,14 +458,7 @@ export const searchCompiler = (connection, query) => {
                                 entry.forEach(walkOrTree);
                                 return;
                             }
-                            if (entry && typeof entry === 'object') {
-                                if (Object.keys(entry).length > 1) {
-                                    walkGrouped(entry);
-                                }
-                                else {
-                                    walk(entry);
-                                }
-                            }
+                            walkOperand('OR', entry);
                         };
                         walkOrTree(genOrTree(params[term]));
                     }

package/node_modules/imapflow/dist/esm/tools.js

@@ -761,11 +761,18 @@ export async function formatMessageResponse(untagged, mailbox) {
             case 'flags':
                 map.flags = new Set(getArray(attribute));
                 break;
+            // A server with nothing to report can answer ENVELOPE NIL or BODYSTRUCTURE NIL.
+            // The field is left unset then: parsing NIL threw, and the whole message
+            // disappeared from the FETCH result.
             case 'envelope':
-                map.envelope = parseEnvelope(attribute);
+                if (Array.isArray(attribute)) {
+                    map.envelope = parseEnvelope(attribute);
+                }
                 break;
             case 'bodystructure':
-                map.bodyStructure = parseBodystructure(attribute);
+                if (Array.isArray(attribute)) {
+                    map.bodyStructure = parseBodystructure(attribute);
+                }
                 break;
             case 'internaldate': {
                 let value = getString(attribute);

package/node_modules/imapflow/package.json

@@ -1,6 +1,6 @@
 {
     "name": "imapflow",
-    "version": "2.1.0",
+    "version": "2.1.2",
     "description": "IMAP Client for Node",
     "type": "module",
     "main": "./dist/cjs/imap-flow.js",
@@ -81,12 +81,12 @@
         "wrangler": "4.142.0"
     },
     "dependencies": {
-        "@zone-eu/mailsplit": "5.4.17",
+        "@zone-eu/mailsplit": "5.4.19",
         "encoding-japanese": "2.4.0",
         "iconv-lite": "0.7.3",
-        "libbase64": "1.3.0",
-        "libmime": "5.4.4",
-        "libqp": "2.1.1",
+        "libbase64": "1.3.1",
+        "libmime": "5.4.6",
+        "libqp": "2.1.2",
         "pino": "10.3.1",
         "socks": "2.8.10"
     },

package/node_modules/libbase64/.github/workflows/release.yaml

@@ -2,6 +2,9 @@ on:
     push:
         branches:
             - master
+    # Manual run: publish the version currently on master (used when a release was cut
+    # but the publish step failed)
+    workflow_dispatch:
 
 permissions:
     contents: write
@@ -15,23 +18,22 @@ jobs:
         steps:
             - uses: google-github-actions/release-please-action@v3
               id: release
+              if: ${{ github.event_name == 'push' }}
               with:
                   release-type: node
                   package-name: ${{vars.NPM_MODULE_NAME}}
                   pull-request-title-pattern: 'chore${scope}: release ${version} [skip-ci]'
-            # The logic below handles the npm publication:
+            # The logic below handles the npm publication through npm trusted publishing
+            # (OIDC, no token secret): it runs when a new release is created, or on a
+            # manual dispatch.
             - uses: actions/checkout@v4
-              # these if statements ensure that a publication only occurs when
-              # a new release is created:
-              if: ${{ steps.release.outputs.release_created }}
+              if: ${{ steps.release.outputs.release_created || github.event_name == 'workflow_dispatch' }}
             - uses: actions/setup-node@v4
               with:
-                  node-version: 20
+                  node-version: 24
                   registry-url: 'https://registry.npmjs.org'
-              if: ${{ steps.release.outputs.release_created }}
+              if: ${{ steps.release.outputs.release_created || github.event_name == 'workflow_dispatch' }}
             - run: npm ci
-              if: ${{ steps.release.outputs.release_created }}
+              if: ${{ steps.release.outputs.release_created || github.event_name == 'workflow_dispatch' }}
             - run: npm publish --provenance --access public
-              env:
-                  NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
-              if: ${{ steps.release.outputs.release_created }}
+              if: ${{ steps.release.outputs.release_created || github.event_name == 'workflow_dispatch' }}

package/node_modules/libbase64/.ncurc.js

@@ -1,7 +1,13 @@
 module.exports = {
     upgrade: true,
     reject: [
+        // 12 is esm only ("type": "module"), and grunt-mocha-test require()s it as a
+        // constructor - "Mocha is not a constructor". Node 24 hides this through
+        // require(esm); CI on Node 22 does not. Lift it when the runner drops grunt.
+        'mocha',
         // 5x is esm only
-        'chai'
+        'chai',
+        // api changes in newer eslint
+        'grunt-eslint'
     ]
 };

package/node_modules/libbase64/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.3.1](https://github.com/nodemailer/libbase64/compare/v1.3.0...v1.3.1) (2026-09-28)
+
+
+### Bug Fixes
+
+* **decoder:** decode every padded segment instead of stopping at the first padding ([d9ba154](https://github.com/nodemailer/libbase64/commit/d9ba154ba13e45338936a55acec417dfb6ae2e52))
+
 ## [1.3.0](https://github.com/nodemailer/libbase64/compare/v1.2.1...v1.3.0) (2024-02-23)
 
 

package/node_modules/libbase64/lib/libbase64.js

@@ -26,6 +26,22 @@ function encode(buffer) {
  */
 function decode(str) {
     str = str || '';
+
+    // Buffer.from() stops decoding at the first padding char, so input made of several
+    // padded segments (eg. every line padded on its own) is decoded segment by segment
+    if (typeof str === 'string') {
+        let padPos = str.indexOf('=');
+        if (padPos >= 0 && /[a-zA-Z0-9+/\-_]/.test(str.substr(padPos))) {
+            let parts = [];
+            for (let segment of str.split(/[=]+/)) {
+                if (segment) {
+                    parts.push(Buffer.from(segment, 'base64'));
+                }
+            }
+            return Buffer.concat(parts);
+        }
+    }
+
     return Buffer.from(str, 'base64');
 }
 
@@ -215,6 +231,15 @@ class Decoder extends Transform {
             b64 = b64.replace(/[^a-zA-Z0-9+/=]/g, '');
         }
 
+        // everything up to the last padding char ends in complete segments, quartets are
+        // only counted from there on as a padding run restarts the quartet alignment
+        let padded = '';
+        let lastPad = b64.lastIndexOf('=');
+        if (lastPad >= 0) {
+            padded = b64.substr(0, lastPad + 1);
+            b64 = b64.substr(lastPad + 1);
+        }
+
         if (b64.length < 4) {
             this._curLine = b64;
             b64 = '';
@@ -223,6 +248,8 @@ class Decoder extends Transform {
             b64 = b64.substr(0, b64.length - this._curLine.length);
         }
 
+        b64 = padded + b64;
+
         if (b64) {
             let buf = decode(b64);
             this.outputBytes += buf.length;

package/node_modules/libbase64/package.json

@@ -1,6 +1,6 @@
 {
     "name": "libbase64",
-    "version": "1.3.0",
+    "version": "1.3.1",
     "description": "Encode and decode base64 encoded strings",
     "main": "lib/libbase64.js",
     "scripts": {
@@ -24,9 +24,9 @@
     "devDependencies": {
         "chai": "4.4.1",
         "eslint-config-nodemailer": "1.2.0",
-        "eslint-config-prettier": "9.1.0",
-        "grunt": "1.6.1",
-        "grunt-cli": "1.4.3",
+        "eslint-config-prettier": "10.1.8",
+        "grunt": "1.6.3",
+        "grunt-cli": "1.5.0",
         "grunt-eslint": "24.3.0",
         "grunt-mocha-test": "0.13.3",
         "mocha": "10.3.0"

package/node_modules/libmime/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [5.4.6](https://github.com/nodemailer/libmime/compare/v5.4.5...v5.4.6) (2026-09-28)
+
+
+### Bug Fixes
+
+* decode B-encoded words through libbase64 ([362f5ff](https://github.com/nodemailer/libmime/commit/362f5ff9cab6afab4a7673763f57b66d54d0f3e3))
+
+## [5.4.5](https://github.com/nodemailer/libmime/compare/v5.4.4...v5.4.5) (2026-09-28)
+
+
+### Bug Fixes
+
+* linear-time flowed decoding and header unfolding ([4035752](https://github.com/nodemailer/libmime/commit/4035752083f9eee25dff595062f2f9b9bbabee2e))
+
 ## [5.4.4](https://github.com/nodemailer/libmime/compare/v5.4.3...v5.4.4) (2026-09-15)
 
 

package/node_modules/libmime/lib/libmime.js

@@ -82,35 +82,55 @@ class Libmime {
 
         let lines = str.split(/\r?\n/);
 
-        let result = [],
-            buffer = null;
+        let result = [];
+
+        // The current paragraph is kept as a list of non-empty pieces and joined once when it
+        // ends. Appending to one string and testing it with a regex on every line re-scans (and
+        // flattens) the whole paragraph each time, which is quadratic on long soft-wrapped bodies.
+        let parts = null,
+            partsLength = 0;
+
+        let pushPart = part => {
+            if (part) {
+                parts.push(part);
+                partsLength += part.length;
+            }
+        };
 
         // remove soft linebreaks
         // soft linebreaks are added after space symbols
         for (let i = 0; i < lines.length; i++) {
             let line = lines[i];
 
-            let isSoftBreak = buffer !== null && / $/.test(buffer) && !/(^|\n)-- $/.test(buffer);
+            // the last piece is never empty, so it holds the last character of the paragraph
+            let last = parts !== null && parts.length ? parts[parts.length - 1] : '';
+
+            // Lines never contain a line break, so a signature separator can only be the whole
+            // paragraph being exactly "-- "
+            let isSoftBreak = last.endsWith(' ') && !(partsLength === 3 && parts.join('') === '-- ');
 
             if (isSoftBreak) {
                 if (delSp) {
                     // delsp adds space to text to be able to fold it
                     // these spaces can be removed once the text is unfolded
-                    buffer = buffer.slice(0, -1) + line;
-                } else {
-                    buffer += line;
+                    parts.pop();
+                    partsLength -= last.length;
+                    pushPart(last.slice(0, -1));
                 }
+                pushPart(line);
             } else {
-                if (buffer !== null) {
-                    result.push(buffer);
+                if (parts !== null) {
+                    result.push(parts.join(''));
                 }
 
-                buffer = line;
+                parts = [];
+                partsLength = 0;
+                pushPart(line);
             }
         }
 
-        if (buffer) {
-            result.push(buffer);
+        if (parts !== null && partsLength) {
+            result.push(parts.join(''));
         }
 
         // remove whitespace stuffing
@@ -279,12 +299,8 @@ class Libmime {
             }
             str = Buffer.from(bytes);
         } else if (encoding === 'B') {
-            str = Buffer.concat(
-                str
-                    .split('=')
-                    .filter(s => s !== '') // filter empty string
-                    .map(str => Buffer.from(str, 'base64'))
-            );
+            // libbase64 decodes input made of several padded segments segment by segment
+            str = libbase64.decode(str);
         } else {
             // keep as is, convert Buffer to unicode string, assume utf8
             str = Buffer.from(str);
@@ -433,12 +449,16 @@ class Libmime {
         lines = lines.slice(headersPos, bodyPos >= 0 ? bodyPos : lines.length);
 
         // unfold folded lines, a continuation line always starts with a space or a tab
-        for (i = lines.length - 1; i > 0; i--) {
-            if (/^[ \t]/.test(lines[i])) {
-                lines[i - 1] += '\r\n' + lines[i];
-                lines.splice(i, 1);
+        // Built in one forward pass, removing continuation lines with splice() is quadratic
+        let unfolded = [];
+        for (i = 0, len = lines.length; i < len; i++) {
+            if (unfolded.length && /^[ \t]/.test(lines[i])) {
+                unfolded[unfolded.length - 1] += '\r\n' + lines[i];
+            } else {
+                unfolded.push(lines[i]);
             }
         }
+        lines = unfolded;
 
         for (i = 0, len = lines.length; i < len; i++) {
             header = this.decodeHeader(lines[i]);

package/node_modules/libmime/package.json

@@ -1,7 +1,7 @@
 {
     "name": "libmime",
     "description": "Encode and decode quoted printable and base64 strings",
-    "version": "5.4.4",
+    "version": "5.4.6",
     "main": "lib/libmime.js",
     "files": [
         "lib",
@@ -26,8 +26,8 @@
     "dependencies": {
         "encoding-japanese": "2.4.0",
         "iconv-lite": "0.7.3",
-        "libbase64": "1.3.0",
-        "libqp": "2.1.1"
+        "libbase64": "1.3.1",
+        "libqp": "2.1.2"
     },
     "devDependencies": {
         "chai": "4.4.1",

package/node_modules/libqp/.github/workflows/release.yaml

@@ -2,6 +2,9 @@ on:
     push:
         branches:
             - master
+    # Manual run: publish the version currently on master (used when a release was cut
+    # but the publish step failed)
+    workflow_dispatch:
 
 permissions:
     contents: write
@@ -15,23 +18,22 @@ jobs:
         steps:
             - uses: google-github-actions/release-please-action@v3
               id: release
+              if: ${{ github.event_name == 'push' }}
               with:
                   release-type: node
                   package-name: ${{vars.NPM_MODULE_NAME}}
                   pull-request-title-pattern: 'chore${scope}: release ${version} [skip-ci]'
-            # The logic below handles the npm publication:
+            # The logic below handles the npm publication through npm trusted publishing
+            # (OIDC, no token secret): it runs when a new release is created, or on a
+            # manual dispatch.
             - uses: actions/checkout@v4
-              # these if statements ensure that a publication only occurs when
-              # a new release is created:
-              if: ${{ steps.release.outputs.release_created }}
+              if: ${{ steps.release.outputs.release_created || github.event_name == 'workflow_dispatch' }}
             - uses: actions/setup-node@v4
               with:
-                  node-version: 20
+                  node-version: 24
                   registry-url: 'https://registry.npmjs.org'
-              if: ${{ steps.release.outputs.release_created }}
+              if: ${{ steps.release.outputs.release_created || github.event_name == 'workflow_dispatch' }}
             - run: npm ci
-              if: ${{ steps.release.outputs.release_created }}
+              if: ${{ steps.release.outputs.release_created || github.event_name == 'workflow_dispatch' }}
             - run: npm publish --provenance --access public
-              env:
-                  NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
-              if: ${{ steps.release.outputs.release_created }}
+              if: ${{ steps.release.outputs.release_created || github.event_name == 'workflow_dispatch' }}

package/node_modules/libqp/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [2.1.2](https://github.com/nodemailer/libqp/compare/v2.1.1...v2.1.2) (2026-09-28)
+
+
+### Bug Fixes
+
+* **decoder:** keep raw 8-bit bytes intact when decoding ([7bbdcbe](https://github.com/nodemailer/libqp/commit/7bbdcbeac4475e5e16b7f24a578ed6209de133a8))
+
 ## [2.1.1](https://github.com/nodemailer/libqp/compare/v2.1.0...v2.1.1) (2024-11-29)
 
 

package/node_modules/libqp/lib/libqp.js

@@ -45,12 +45,14 @@ function encode(buffer) {
 /**
  * Decodes a Quoted-Printable encoded string to a Buffer object
  *
- * @param {String} str Quoted-Printable encoded string
+ * @param {String|Buffer} str Quoted-Printable encoded string. A Buffer is read byte for byte,
+ *        so raw 8-bit bytes in the input are copied to the output unchanged
  * @returns {Buffer} Decoded value
  */
 function decode(str) {
-    str = (str || '')
-        .toString()
+    // 'binary' maps every byte to one char code 0-255. A UTF-8 read would collapse raw
+    // multi-byte chars into one byte below and turn raw latin1 bytes into U+FFFD
+    str = (Buffer.isBuffer(str) ? str.toString('binary') : (str || '').toString())
         // remove invalid whitespace from the end of lines
         .replace(/[\t ]+$/gm, '')
         // remove soft line breaks
@@ -292,7 +294,7 @@ class Decoder extends Transform {
 
     _flush(done) {
         if (this.inputBytes) {
-            let buf = decode(Buffer.concat(this.qpChunks, this.inputBytes).toString());
+            let buf = decode(Buffer.concat(this.qpChunks, this.inputBytes));
             this.outputBytes += buf.length;
             this.push(buf);
         }

package/node_modules/libqp/package.json

@@ -1,6 +1,6 @@
 {
     "name": "libqp",
-    "version": "2.1.1",
+    "version": "2.1.2",
     "description": "Encode and decode quoted-printable strings according to rfc2045",
     "main": "lib/libqp.js",
     "scripts": {
@@ -23,6 +23,6 @@
     "homepage": "https://github.com/nodemailer/libqp",
     "devDependencies": {
         "eslint-config-nodemailer": "1.2.0",
-        "eslint-config-prettier": "9.1.0"
+        "eslint-config-prettier": "10.1.8"
     }
 }