@withbuddi/buddi 0.1.0-pre.48 → 0.1.0-pre.49

package/node_modules/docx/dist/watermarks.cjs

@@ -1103,7 +1103,7 @@ var createVmlImageData = ({ relationshipId, title, gain, blackLevel, gamma, gray
 	}
 });
 //#endregion
-//#region \0@oxc-project+runtime@0.150.0/helpers/esm/typeof.js
+//#region \0@oxc-project+runtime@0.152.0/helpers/esm/typeof.js
 function _typeof(o) {
 	"@babel/helpers - typeof";
 	return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(o) {
@@ -1113,7 +1113,7 @@ function _typeof(o) {
 	}, _typeof(o);
 }
 //#endregion
-//#region \0@oxc-project+runtime@0.150.0/helpers/esm/toPrimitive.js
+//#region \0@oxc-project+runtime@0.152.0/helpers/esm/toPrimitive.js
 function toPrimitive(t, r) {
 	if ("object" != _typeof(t) || !t) return t;
 	var e = t[Symbol.toPrimitive];
@@ -1125,13 +1125,13 @@ function toPrimitive(t, r) {
 	return ("string" === r ? String : Number)(t);
 }
 //#endregion
-//#region \0@oxc-project+runtime@0.150.0/helpers/esm/toPropertyKey.js
+//#region \0@oxc-project+runtime@0.152.0/helpers/esm/toPropertyKey.js
 function toPropertyKey(t) {
 	var i = toPrimitive(t, "string");
 	return "symbol" == _typeof(i) ? i : i + "";
 }
 //#endregion
-//#region \0@oxc-project+runtime@0.150.0/helpers/esm/defineProperty.js
+//#region \0@oxc-project+runtime@0.152.0/helpers/esm/defineProperty.js
 function _defineProperty(e, r, t) {
 	return (r = toPropertyKey(r)) in e ? Object.defineProperty(e, r, {
 		value: t,

package/node_modules/docx/dist/watermarks.iife.js

@@ -1103,7 +1103,7 @@ var docxWatermarks = (function(exports, docx) {
 		}
 	});
 	//#endregion
-	//#region \0@oxc-project+runtime@0.150.0/helpers/esm/typeof.js
+	//#region \0@oxc-project+runtime@0.152.0/helpers/esm/typeof.js
 	function _typeof(o) {
 		"@babel/helpers - typeof";
 		return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(o) {
@@ -1113,7 +1113,7 @@ var docxWatermarks = (function(exports, docx) {
 		}, _typeof(o);
 	}
 	//#endregion
-	//#region \0@oxc-project+runtime@0.150.0/helpers/esm/toPrimitive.js
+	//#region \0@oxc-project+runtime@0.152.0/helpers/esm/toPrimitive.js
 	function toPrimitive(t, r) {
 		if ("object" != _typeof(t) || !t) return t;
 		var e = t[Symbol.toPrimitive];
@@ -1125,13 +1125,13 @@ var docxWatermarks = (function(exports, docx) {
 		return ("string" === r ? String : Number)(t);
 	}
 	//#endregion
-	//#region \0@oxc-project+runtime@0.150.0/helpers/esm/toPropertyKey.js
+	//#region \0@oxc-project+runtime@0.152.0/helpers/esm/toPropertyKey.js
 	function toPropertyKey(t) {
 		var i = toPrimitive(t, "string");
 		return "symbol" == _typeof(i) ? i : i + "";
 	}
 	//#endregion
-	//#region \0@oxc-project+runtime@0.150.0/helpers/esm/defineProperty.js
+	//#region \0@oxc-project+runtime@0.152.0/helpers/esm/defineProperty.js
 	function _defineProperty(e, r, t) {
 		return (r = toPropertyKey(r)) in e ? Object.defineProperty(e, r, {
 			value: t,

package/node_modules/docx/dist/watermarks.mjs

@@ -1102,7 +1102,7 @@ var createVmlImageData = ({ relationshipId, title, gain, blackLevel, gamma, gray
 	}
 });
 //#endregion
-//#region \0@oxc-project+runtime@0.150.0/helpers/esm/typeof.js
+//#region \0@oxc-project+runtime@0.152.0/helpers/esm/typeof.js
 function _typeof(o) {
 	"@babel/helpers - typeof";
 	return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(o) {
@@ -1112,7 +1112,7 @@ function _typeof(o) {
 	}, _typeof(o);
 }
 //#endregion
-//#region \0@oxc-project+runtime@0.150.0/helpers/esm/toPrimitive.js
+//#region \0@oxc-project+runtime@0.152.0/helpers/esm/toPrimitive.js
 function toPrimitive(t, r) {
 	if ("object" != _typeof(t) || !t) return t;
 	var e = t[Symbol.toPrimitive];
@@ -1124,13 +1124,13 @@ function toPrimitive(t, r) {
 	return ("string" === r ? String : Number)(t);
 }
 //#endregion
-//#region \0@oxc-project+runtime@0.150.0/helpers/esm/toPropertyKey.js
+//#region \0@oxc-project+runtime@0.152.0/helpers/esm/toPropertyKey.js
 function toPropertyKey(t) {
 	var i = toPrimitive(t, "string");
 	return "symbol" == _typeof(i) ? i : i + "";
 }
 //#endregion
-//#region \0@oxc-project+runtime@0.150.0/helpers/esm/defineProperty.js
+//#region \0@oxc-project+runtime@0.152.0/helpers/esm/defineProperty.js
 function _defineProperty(e, r, t) {
 	return (r = toPropertyKey(r)) in e ? Object.defineProperty(e, r, {
 		value: t,

package/node_modules/docx/dist/watermarks.umd.cjs

@@ -1105,7 +1105,7 @@
 		}
 	});
 	//#endregion
-	//#region \0@oxc-project+runtime@0.150.0/helpers/esm/typeof.js
+	//#region \0@oxc-project+runtime@0.152.0/helpers/esm/typeof.js
 	function _typeof(o) {
 		"@babel/helpers - typeof";
 		return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(o) {
@@ -1115,7 +1115,7 @@
 		}, _typeof(o);
 	}
 	//#endregion
-	//#region \0@oxc-project+runtime@0.150.0/helpers/esm/toPrimitive.js
+	//#region \0@oxc-project+runtime@0.152.0/helpers/esm/toPrimitive.js
 	function toPrimitive(t, r) {
 		if ("object" != _typeof(t) || !t) return t;
 		var e = t[Symbol.toPrimitive];
@@ -1127,13 +1127,13 @@
 		return ("string" === r ? String : Number)(t);
 	}
 	//#endregion
-	//#region \0@oxc-project+runtime@0.150.0/helpers/esm/toPropertyKey.js
+	//#region \0@oxc-project+runtime@0.152.0/helpers/esm/toPropertyKey.js
 	function toPropertyKey(t) {
 		var i = toPrimitive(t, "string");
 		return "symbol" == _typeof(i) ? i : i + "";
 	}
 	//#endregion
-	//#region \0@oxc-project+runtime@0.150.0/helpers/esm/defineProperty.js
+	//#region \0@oxc-project+runtime@0.152.0/helpers/esm/defineProperty.js
 	function _defineProperty(e, r, t) {
 		return (r = toPropertyKey(r)) in e ? Object.defineProperty(e, r, {
 			value: t,

package/node_modules/docx/package.json

@@ -1,6 +1,6 @@
 {
     "name": "docx",
-    "version": "9.8.1",
+    "version": "9.9.0",
     "description": "Easily generate .docx files with JS/TS with a nice declarative API. Works for Node and on the Browser.",
     "type": "module",
     "main": "dist/index.umd.cjs",
@@ -56,6 +56,16 @@
                 "types": "./dist/math.d.cts",
                 "default": "./dist/math.cjs"
             }
+        },
+        "./layout": {
+            "import": {
+                "types": "./dist/layout.d.ts",
+                "default": "./dist/layout.mjs"
+            },
+            "require": {
+                "types": "./dist/layout.d.cts",
+                "default": "./dist/layout.cjs"
+            }
         }
     },
     "typesVersions": {
@@ -71,6 +81,9 @@
             ],
             "math": [
                 "./dist/math.d.ts"
+            ],
+            "layout": [
+                "./dist/layout.d.ts"
             ]
         }
     },
@@ -78,14 +91,14 @@
         "dist"
     ],
     "scripts": {
-        "build": "tsc && vite build && vite build --config vite.entries.config.ts --mode shapes && vite build --config vite.entries.config.ts --mode watermarks && vite build --config vite.entries.config.ts --mode charts && vite build --config vite.entries.config.ts --mode math",
+        "build": "tsc && vite build && vite build --config vite.entries.config.ts --mode shapes && vite build --config vite.entries.config.ts --mode watermarks && vite build --config vite.entries.config.ts --mode charts && vite build --config vite.entries.config.ts --mode math && vite build --config vite.entries.config.ts --mode layout",
         "test": "vitest --ui --coverage",
         "test:ci": "vitest run --coverage",
         "prepublishOnly": "npm run build --omit=dev",
         "lint": "eslint --config eslint.config.ts",
         "predemo": "npm run build",
         "demo": "tsx ./demo/index.ts",
-        "typedoc": "typedoc src/index.ts src/shapes/index.ts src/watermarks/index.ts src/charts/index.ts src/math/index.ts --tsconfig tsconfig.typedoc.json",
+        "typedoc": "typedoc src/index.ts src/shapes/index.ts src/watermarks/index.ts src/charts/index.ts src/math/index.ts src/layout/index.ts --tsconfig tsconfig.typedoc.json",
         "prettier": "prettier -l \"{src,scripts,demo,docs}/**/*.{ts,html,md}\"",
         "prettier:fix": "npm run prettier -- --write",
         "cspell": "cspell \"{src,demo,docs,scripts}/**/*.{ts,scss,html,md}\" && cspell \"./*.*\"",
@@ -145,10 +158,10 @@
         "eslint-import-resolver-typescript": "^4.3.2",
         "eslint-plugin-functional": "^10.0.1",
         "eslint-plugin-import-x": "^4.17.1",
-        "eslint-plugin-jsdoc": "^64.5.4",
+        "eslint-plugin-jsdoc": "^65.0.0",
         "eslint-plugin-no-null": "^1.0.2",
         "eslint-plugin-prefer-arrow": "^1.2.3",
-        "eslint-plugin-unicorn": "^76.0.0",
+        "eslint-plugin-unicorn": "^77.0.0",
         "execa": "^10.0.1",
         "glob": "^13.0.3",
         "globals": "^17.12.0",

package/node_modules/imapflow/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## [2.2.7](https://github.com/postalsys/imapflow/compare/v2.2.6...v2.2.7) (2026-10-07)
+
+
+### Bug Fixes
+
+* close the transport with a failed connect, report a lost login once, and other reliability fixes ([6a3915a](https://github.com/postalsys/imapflow/commit/6a3915a0391442a9f4c98cf2622b70918387d26b))
+* enforce downloadMany maxBytes, warn on cleartext STARTTLS fallback, refuse unknown search keys ([44f7b7f](https://github.com/postalsys/imapflow/commit/44f7b7ff0b93414507e3824597919b831868f257))
+* harden session setup, SASL, search and folder handling found in code review ([d71d27e](https://github.com/postalsys/imapflow/commit/d71d27e9ccd44974c4424532b83920114126aacb))
+
 ## [2.2.6](https://github.com/postalsys/imapflow/compare/v2.2.5...v2.2.6) (2026-10-06)
 
 

package/node_modules/imapflow/dist/cjs/commands/append.js

@@ -158,10 +158,17 @@ async function append(connection, destination, content, flags, idate) {
         }
         // If we have a sequence number but no UID (server doesn't support UIDPLUS),
         // look up the UID via SEARCH to provide a consistent result to the caller.
+        // The message is already stored, so a failed lookup only leaves the UID out:
+        // rejecting here would make a retrying caller append it twice.
         if (map.seq && !map.uid) {
-            let list = await connection.search({ seq: map.seq }, { uid: true });
-            if (Array.isArray(list) && list.length) {
-                map.uid = list[0];
+            try {
+                let list = await connection.search({ seq: map.seq }, { uid: true });
+                if (Array.isArray(list) && list.length) {
+                    map.uid = list[0];
+                }
+            }
+            catch (err) {
+                (0, tools_js_1.logConnectionError)(connection, 'Failed to look up the UID of the appended message', err);
             }
         }
         return map;

package/node_modules/imapflow/dist/cjs/commands/authenticate.js

@@ -14,7 +14,10 @@ async function handleAuthError(err, errorResponse) {
     if (errorCode) {
         err.serverResponseCode = errorCode;
     }
-    err.authenticationFailed = true;
+    // Only a tagged NO/BAD is the server refusing the credentials, see login.ts
+    if ((0, tools_js_1.isServerRefusal)(err)) {
+        err.authenticationFailed = true;
+    }
     err.response = await (0, tools_js_1.getErrorText)(err.response);
     if (errorResponse) {
         err.oauthError = errorResponse;
@@ -111,27 +114,33 @@ async function authLogin(connection, username, password) {
     try {
         // SASL LOGIN is a challenge-response mechanism: the server sends base64-encoded
         // prompts ("Username:" and "Password:") and the client responds with base64-encoded values.
+        let usernameSent = false;
         let response = await connection.exec('AUTHENTICATE', [{ type: 'ATOM', value: 'LOGIN' }], {
             onPlusTag: async (resp) => {
-                if (resp.attributes && resp.attributes[0] && resp.attributes[0].type === 'TEXT') {
-                    // Decode the server's base64 challenge to determine what it's asking for.
-                    // Strip trailing colons and null bytes (\x00) that some servers append to the prompt.
-                    let question = Buffer.from(resp.attributes[0].value, 'base64')
+                // Decode the server's base64 challenge to determine what it's asking for.
+                // Strip trailing colons and null bytes (\x00) that some servers append to the prompt.
+                let question = resp.attributes && resp.attributes[0] && resp.attributes[0].type === 'TEXT'
+                    ? Buffer.from(resp.attributes[0].value, 'base64')
                         .toString()
                         .toLowerCase()
-                        .replace(/[:\x00]*$/, '');
-                    if (question === 'username' || question === 'user name') {
-                        let encodedUsername = Buffer.from(username).toString('base64');
-                        connection.log.debug({ src: 'c', msg: encodedUsername, comment: `Encoded username for AUTH=LOGIN`, cid: connection.id });
-                        connection.write(encodedUsername);
-                    }
-                    else if (question === 'password') {
-                        connection.log.debug({ src: 'c', msg: '(* value hidden *)', comment: `Encoded password for AUTH=LOGIN`, cid: connection.id });
-                        connection.write(Buffer.from(password).toString('base64'));
-                    }
-                    else {
-                        throw new Error(`Unknown LOGIN question "${question}"`);
-                    }
+                        .replace(/[:\x00]*$/, '')
+                    : '';
+                // Some servers send an empty first challenge, which by SASL LOGIN convention asks for the username
+                if (question === 'username' || question === 'user name' || (!question && !usernameSent)) {
+                    let encodedUsername = Buffer.from(username).toString('base64');
+                    connection.log.debug({ src: 'c', msg: encodedUsername, comment: `Encoded username for AUTH=LOGIN`, cid: connection.id });
+                    connection.write(encodedUsername);
+                    usernameSent = true;
+                }
+                else if (question === 'password') {
+                    connection.log.debug({ src: 'c', msg: '(* value hidden *)', comment: `Encoded password for AUTH=LOGIN`, cid: connection.id });
+                    connection.write(Buffer.from(password).toString('base64'));
+                }
+                else {
+                    // Cancel the exchange (RFC 9051 section 6.2.2), so the server fails the command
+                    // with a tagged BAD instead of waiting for an answer that never comes
+                    connection.log.warn({ msg: 'Unknown AUTH=LOGIN challenge, cancelling', question, cid: connection.id });
+                    connection.write('*');
                 }
             }
         });

package/node_modules/imapflow/dist/cjs/commands/close.d.ts

@@ -1,8 +1,19 @@
 import type { ImapFlow } from '../imap-flow.js';
+/**
+ * Options for the CLOSE command
+ */
+export interface CloseCommandOptions {
+    /**
+     * Only deselect the mailbox: use UNSELECT (RFC 3691, folded into IMAP4rev2) when the server
+     * supports it, so messages flagged \Deleted are not expunged as a side effect. Falls back to CLOSE
+     */
+    unselect?: boolean | undefined;
+}
 /**
  * Closes the currently selected mailbox.
  *
  * @param connection - IMAP connection instance
+ * @param options - Close options
  * @returns True on success, false on failure, or undefined if not in SELECTED state
  */
-export default function close(connection: ImapFlow): Promise<boolean | undefined>;
+export default function close(connection: ImapFlow, options?: CloseCommandOptions | undefined): Promise<boolean | undefined>;

package/node_modules/imapflow/dist/cjs/commands/close.js

@@ -6,9 +6,10 @@ const tools_js_1 = require("../tools.js");
  * Closes the currently selected mailbox.
  *
  * @param connection - IMAP connection instance
+ * @param options - Close options
  * @returns True on success, false on failure, or undefined if not in SELECTED state
  */
-async function close(connection) {
+async function close(connection, options) {
     if (connection.state !== connection.states.SELECTED) {
         // nothing to do here
         return;
@@ -18,7 +19,8 @@ async function close(connection) {
         // IMAP CLOSE (RFC 3501 6.4.2): permanently removes all messages flagged \Deleted
         // from the currently selected mailbox (implicit expunge) and deselects it.
         // Unlike EXPUNGE, CLOSE does not send individual untagged EXPUNGE responses.
-        response = await connection.exec('CLOSE');
+        // UNSELECT deselects the same way without removing anything.
+        response = await connection.exec(options?.unselect && (0, tools_js_1.hasCapability)(connection, 'UNSELECT') ? 'UNSELECT' : 'CLOSE');
         response.next();
         // Transition from SELECTED back to AUTHENTICATED state.
         // Clear mailbox metadata so subsequent operations know no mailbox is selected.

package/node_modules/imapflow/dist/cjs/commands/delete.js

@@ -20,7 +20,8 @@ async function deleteMailbox(connection, path) {
     // IMAP servers reject DELETE on the currently selected mailbox (RFC 3501 6.3.4).
     let selected = (0, tools_js_1.getSelectedMailbox)(connection);
     if (selected && selected.path === path) {
-        await connection.run('CLOSE');
+        // UNSELECT where possible, CLOSE would expunge messages flagged \Deleted
+        await connection.run('CLOSE', { unselect: true });
     }
     let response;
     try {

package/node_modules/imapflow/dist/cjs/commands/esearch-parser.js

@@ -72,9 +72,15 @@ function parseEsearchResponse(attrs) {
                 const items = Array.isArray(listToken) ? listToken : null;
                 if (!items || items.length < 2)
                     break;
+                const range = items[0]?.value;
+                if (typeof range !== 'string')
+                    break;
+                // RFC 9394 partial-results is a sequence-set or NIL, the latter when the requested
+                // range lies past the end of the results. NIL is reported as an empty set.
+                const messages = items[1]?.value;
                 result.partial = {
-                    range: items[0].value,
-                    messages: items[1].value
+                    range,
+                    messages: typeof messages === 'string' ? messages : ''
                 };
                 break;
             }

package/node_modules/imapflow/dist/cjs/commands/fetch.js

@@ -28,11 +28,20 @@ async function fetch(connection, range, query, options) {
     // Every pass returns or throws: the last throttled attempt throws instead of retrying.
     const maxRetries = 4;
     const baseDelay = 1000; // Start with 1 second delay
+    // The highest UID (sequence number for a plain FETCH) handed to the streaming consumer. A
+    // retried FETCH answers with every message again, so a retry skips up to it: servers answer
+    // in ascending order, which keeps this to one comparison per row rather than a set of every
+    // row delivered. The consumer was otherwise given the rows before the throttle twice.
+    let maxDelivered = 0;
     for (let retryCount = 0;; retryCount++) {
         let messages = {
             count: 0,
             list: []
         };
+        // The first error the onUntaggedFetch consumer reported through next(err). Errors thrown
+        // by untagged handlers are only logged by the connection, so it is kept here and fails
+        // the command once the FETCH completes; later messages are no longer handed to the consumer.
+        let consumerError = null;
         let response;
         try {
             /* c8 ignore next */ // range is guaranteed truthy by the early-return guard above, so the '*' fallback is unreachable
@@ -182,18 +191,32 @@ async function fetch(connection, range, query, options) {
                     // (useful for large result sets). Otherwise, collect all into messages.list.
                     FETCH: async (untagged) => {
                         messages.count++;
+                        if (consumerError) {
+                            return;
+                        }
                         let formatted = await (0, tools_js_1.formatMessageResponse)(untagged, mailbox, connection.idHashAlgorithm);
                         if (typeof options.onUntaggedFetch === 'function') {
-                            await new Promise((resolve, reject) => {
-                                options.onUntaggedFetch(formatted, err => {
-                                    if (err) {
-                                        reject(err);
-                                    }
-                                    else {
-                                        resolve();
-                                    }
+                            /* c8 ignore next */ // a UID FETCH row without its UID is a non-compliant server, so the seq fallback is not exercised
+                            let key = options.uid ? formatted.uid || formatted.seq : formatted.seq;
+                            if (retryCount && key <= maxDelivered) {
+                                return;
+                            }
+                            maxDelivered = Math.max(maxDelivered, key);
+                            try {
+                                await new Promise((resolve, reject) => {
+                                    options.onUntaggedFetch(formatted, err => {
+                                        if (err) {
+                                            reject(err);
+                                        }
+                                        else {
+                                            resolve();
+                                        }
+                                    });
                                 });
-                            });
+                            }
+                            catch (err) {
+                                consumerError = err;
+                            }
                         }
                         else {
                             messages.list.push(formatted);
@@ -202,6 +225,9 @@ async function fetch(connection, range, query, options) {
                 }
             });
             response.next();
+            if (consumerError) {
+                throw consumerError;
+            }
             return messages;
         }
         catch (err) {

package/node_modules/imapflow/dist/cjs/commands/id.js

@@ -43,7 +43,14 @@ async function id(connection, clientInfo) {
                             key = val.value;
                         }
                         else if (typeof key === 'string' && typeof val.value === 'string') {
-                            map[key.toLowerCase().trim()] = val.value;
+                            // The server picks the keys of this object, which the caller reads
+                            // back as serverInfo: a prototype-chain name is skipped as it is for
+                            // every other server-named key, so it can neither be shadowed nor
+                            // written through
+                            let name = key.toLowerCase().trim();
+                            if (!(0, tools_js_1.isUnsafeKey)(name)) {
+                                map[name] = val.value;
+                            }
                         }
                     });
                 }

package/node_modules/imapflow/dist/cjs/commands/idle.js

@@ -60,8 +60,11 @@ async function runIdle(connection) {
                     path: connection.mailbox && connection.mailbox.path,
                     cid: connection.id
                 });
-                connection.write('DONE');
+                // Marked before the write: write() closes the connection when the transport is
+                // already gone, and close() breaks IDLE through this very function, which
+                // would otherwise write DONE again from inside itself
                 doneSent = true;
+                connection.write('DONE');
                 releaseIdling();
                 if (connection.preCheck === ownPreCheck) {
                     connection.preCheck = false; // unset itself
@@ -127,7 +130,10 @@ async function runIdle(connection) {
         // A tagged NO or BAD only means the server refused IDLE; the connection is still usable,
         // so the waiters are released by the finally block below and their own commands run.
         // Anything else (close, lost socket, parser failure) fails the waiters too.
-        let refusedByServer = ['NO', 'BAD'].includes(err.responseStatus);
+        let refusedByServer = (0, tools_js_1.isServerRefusal)(err);
+        if (refusedByServer) {
+            connection.skipIdle = true;
+        }
         if (preCheckWaitQueue.length && !refusedByServer) {
             // One error for the whole queue: every waiter failed at the same site, for the same
             // reason. Built inside the guard so a teardown with nothing queued - the common case -
@@ -313,7 +319,7 @@ async function idle(connection, maxIdleTime) {
     // If server supports IDLE (RFC 2177, folded into base IMAP4rev2), use it for
     // real-time push notifications. Otherwise, fall back to periodic polling with
     // NOOP/STATUS/SELECT.
-    if ((0, tools_js_1.hasCapability)(connection, 'IDLE')) {
+    if ((0, tools_js_1.hasCapability)(connection, 'IDLE') && !connection.skipIdle) {
         let idleTimer;
         let stillIdling = false;
         // IDLE loop: runs IDLE, and if maxIdleTime is reached, breaks and restarts to keep the
@@ -337,13 +343,17 @@ async function idle(connection, maxIdleTime) {
             }
             let resp = await runIdle(connection);
             clearTimeout(idleTimer);
-            if (!stillIdling) {
+            // A restart only makes sense with nothing queued behind the break (a CLOSE, say; run()
+            // re-arms auto-IDLE once that command is done) and the mailbox still selected on a
+            // usable connection
+            const canRestart = stillIdling && !connection.requestQueue.length && !!(0, tools_js_1.getSelectedMailbox)(connection) && connection.usable;
+            if (!canRestart) {
                 return resp;
             }
             stillIdling = false;
         }
     }
-    // Fallback for servers without IDLE support: poll at regular intervals using
+    // Fallback for servers without IDLE support, or that refused it: poll at regular intervals using
     // NOOP (default), STATUS, or SELECT depending on missingIdleCommand config.
     return runPollingFallback(connection, maxIdleTime);
 }

package/node_modules/imapflow/dist/cjs/commands/list.js

@@ -378,6 +378,15 @@ async function list(connection, reference, mailbox, options) {
         // Subscribed-only mailboxes that weren't in LIST are intentionally ignored
         // (they may be phantom entries from old subscriptions to deleted mailboxes).
         let runLsub = async () => {
+            // LIST has completed, so its entries are indexed once instead of searched per LSUB
+            // response, which was quadratic in the folder count. The first entry for a path wins,
+            // as with the linear search it replaces
+            let entriesByPath = new Map();
+            for (let entry of entries) {
+                if (!entriesByPath.has(entry.path)) {
+                    entriesByPath.set(entry.path, entry);
+                }
+            }
             let response = await connection.exec('LSUB', [(0, tools_js_1.encodePath)(connection, normalizedReference), (0, tools_js_1.encodePath)(connection, normalizedMailbox)], {
                 untagged: {
                     LSUB: async (untagged) => {
@@ -403,7 +412,7 @@ async function list(connection, reference, mailbox, options) {
                         entry.parent = entry.delimiter ? entry.path.split(entry.delimiter) : [entry.path];
                         entry.name = entry.parent.pop();
                         // Merge LSUB data into existing LIST entry if found
-                        let existing = entries.find(existing => existing.path === entry.path);
+                        let existing = entriesByPath.get(entry.path);
                         if (existing) {
                             existing.subscribed = true;
                             // Merge any additional flags from LSUB into the LIST entry

package/node_modules/imapflow/dist/cjs/commands/login.js

@@ -33,7 +33,11 @@ async function login(connection, username, password) {
         if (errorCode) {
             err.serverResponseCode = errorCode;
         }
-        err.authenticationFailed = true;
+        // Only a tagged NO/BAD is the server refusing the credentials; a lost connection or a
+        // timeout during LOGIN says nothing about them, and a caller may retry it
+        if ((0, tools_js_1.isServerRefusal)(err)) {
+            err.authenticationFailed = true;
+        }
         err.response = await (0, tools_js_1.getErrorText)(err.response);
         throw err;
     }

package/node_modules/imapflow/dist/cjs/commands/logout.js

@@ -1,6 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = logout;
+const tools_js_1 = require("../tools.js");
+// How long to wait for the server to answer LOGOUT before closing the socket anyway. Without a
+// bound of its own, an unanswered LOGOUT kept logout() pending until the socket timeout.
+const LOGOUT_TIMEOUT = 10 * 1000;
 /**
  * Logs out the user and closes the connection.
  *
@@ -19,6 +23,8 @@ async function logout(connection) {
         return false;
     }
     let response;
+    // close() rejects the pending LOGOUT with NoConnection, which counts as a completed logout
+    let timer = setTimeout(() => connection.close(), LOGOUT_TIMEOUT);
     try {
         response = await connection.exec('LOGOUT');
         return true;
@@ -36,6 +42,7 @@ async function logout(connection) {
         // Set state to LOGOUT before closing to prevent any further commands from
         // being queued. The socket is closed unconditionally in this finally block
         // regardless of whether the LOGOUT command succeeded or failed.
+        (0, tools_js_1.clearTimer)(timer);
         connection.state = connection.states.LOGOUT;
         if (response && typeof response.next === 'function') {
             response.next();

package/node_modules/imapflow/dist/cjs/commands/namespace.js

@@ -34,7 +34,8 @@ async function namespace(connection) {
     }
     let response;
     try {
-        let map = {};
+        // NIL personal namespaces and a missing NAMESPACE response leave the defaults in place
+        let map = { personal: [], other: false, shared: false };
         response = await connection.exec('NAMESPACE', false, {
             untagged: {
                 // The NAMESPACE response (RFC 2342) contains exactly three sections:
@@ -46,19 +47,22 @@ async function namespace(connection) {
                     if (!untagged.attributes || !untagged.attributes.length) {
                         return;
                     }
-                    map.personal = getNamsepaceInfo(untagged.attributes[0]);
+                    // NIL personal namespaces are legal (RFC 2342 section 5, e.g. after an anonymous login)
+                    map.personal = getNamsepaceInfo(untagged.attributes[0]) || [];
                     map.other = getNamsepaceInfo(untagged.attributes[1]);
                     map.shared = getNamsepaceInfo(untagged.attributes[2]);
                 }
             }
         });
+        // Release the response before touching the parsed data, so nothing below can leave the
+        // reader parked behind this command
+        response.next();
         connection.namespaces = map;
         // make sure that we have the first personal namespace always set
         if (!connection.namespaces.personal[0]) {
             connection.namespaces.personal[0] = { prefix: '', delimiter: '.' };
         }
         connection.namespaces.personal[0].prefix = connection.namespaces.personal[0].prefix || '';
-        response.next();
         connection.namespace = connection.namespaces.personal[0];
         return connection.namespace;
     }