@withbuddi/buddi 0.1.0-pre.51 → 0.1.0-pre.53

package/node_modules/express/package.json

@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "5.2.1",
+  "version": "5.3.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",
@@ -33,9 +33,9 @@
   ],
   "dependencies": {
     "accepts": "^2.0.0",
-    "body-parser": "^2.2.1",
-    "content-disposition": "^1.0.0",
-    "content-type": "^1.0.5",
+    "body-parser": "^2.3.0",
+    "content-disposition": "^2.0.1",
+    "content-type": "^2.0.0",
     "cookie": "^0.7.1",
     "cookie-signature": "^1.2.1",
     "debug": "^4.4.0",
@@ -51,14 +51,14 @@
     "on-finished": "^2.4.1",
     "once": "^1.4.0",
     "parseurl": "^1.3.3",
-    "proxy-addr": "^2.0.7",
-    "qs": "^6.14.0",
+    "proxy-addr": "^2.0.8",
+    "qs": "^6.16.0",
     "range-parser": "^1.2.1",
     "router": "^2.2.0",
     "send": "^1.1.0",
     "serve-static": "^2.2.0",
     "statuses": "^2.0.1",
-    "type-is": "^2.0.1",
+    "type-is": "^2.1.0",
     "vary": "^1.1.2"
   },
   "devDependencies": {
@@ -69,11 +69,11 @@
     "ejs": "^3.1.10",
     "eslint": "8.47.0",
     "express-session": "^1.18.1",
-    "hbs": "4.2.0",
+    "hbs": "4.3.1",
     "marked": "^15.0.3",
     "method-override": "3.0.0",
-    "mocha": "^10.7.3",
-    "morgan": "1.10.1",
+    "mocha": "^11.7.5",
+    "morgan": "1.12.1",
     "nyc": "^17.1.0",
     "pbkdf2-password": "1.2.1",
     "supertest": "^6.3.0",

package/node_modules/imapflow/CHANGELOG.md

@@ -1,5 +1,53 @@
 # Changelog
 
+## [2.4.0](https://github.com/postalsys/imapflow/compare/v2.3.0...v2.4.0) (2026-10-10)
+
+
+### Features
+
+* re-raise unexpected parser exceptions as coded ParserErrorInternal errors ([dda3f7e](https://github.com/postalsys/imapflow/commit/dda3f7e71e3c227479763a8c6af617fd4f57679a))
+
+
+### Bug Fixes
+
+* keep append literals in sync with their data and fail downloads cleanly ([752248e](https://github.com/postalsys/imapflow/commit/752248e07fd8930cb0943287c32e3bab88484d80))
+
+## [2.3.0](https://github.com/postalsys/imapflow/compare/v2.2.11...v2.3.0) (2026-10-08)
+
+
+### Features
+
+* emit an alert event for ALERT response codes ([dcc0e42](https://github.com/postalsys/imapflow/commit/dcc0e42cef3c5c51226b29fd3a6bddd844728357))
+
+
+### Bug Fixes
+
+* a throttled login is not a rejected credential ([83fdbce](https://github.com/postalsys/imapflow/commit/83fdbce9968651c3d833b1e74bc20151c26fc769))
+* ask the first chunk of a download again when the answer comes back empty ([83fdbce](https://github.com/postalsys/imapflow/commit/83fdbce9968651c3d833b1e74bc20151c26fc769))
+
+## [2.2.11](https://github.com/postalsys/imapflow/compare/v2.2.10...v2.2.11) (2026-10-08)
+
+
+### Bug Fixes
+
+* ask a download chunk again when the answer comes back empty instead of failing the download ([0e6e46a](https://github.com/postalsys/imapflow/commit/0e6e46aa81a16a44ccb78df25382ab78a5708ce3))
+* read NAMESPACE prefixes, QUOTAROOT names and ID values that the server sends as literals ([9c77594](https://github.com/postalsys/imapflow/commit/9c7759468f7d64ad6ef857b1861d4a846a8c7c04))
+
+## [2.2.10](https://github.com/postalsys/imapflow/compare/v2.2.9...v2.2.10) (2026-10-07)
+
+
+### Bug Fixes
+
+* log socket errors after a failed STARTTLS upgrade instead of throwing them on Bun ([74fad57](https://github.com/postalsys/imapflow/commit/74fad57386cde6a60211b9b1671228b72aa9f94a))
+* take the requested message in fetchOne() when a FETCH answer also carries unsolicited rows ([74fad57](https://github.com/postalsys/imapflow/commit/74fad57386cde6a60211b9b1671228b72aa9f94a)), closes [#426](https://github.com/postalsys/imapflow/issues/426)
+
+## [2.2.9](https://github.com/postalsys/imapflow/compare/v2.2.8...v2.2.9) (2026-10-07)
+
+
+### Bug Fixes
+
+* declare DownloadOptions.binary, the QRESYNC mailboxOpen options and FetchQueryObject.emailId ([2ae26e6](https://github.com/postalsys/imapflow/commit/2ae26e64c39c83ac3e04a67e9d4d808a1258c55b))
+
 ## [2.2.8](https://github.com/postalsys/imapflow/compare/v2.2.7...v2.2.8) (2026-10-07)
 
 

package/node_modules/imapflow/dist/cjs/commands/append.d.ts

@@ -19,4 +19,4 @@ export interface AppendResult extends AppendResponseObject {
  * @returns Append result with UID info if available, or undefined if preconditions not met
  * @throws {Error} If the APPEND command fails or message exceeds APPENDLIMIT
  */
-export default function append(connection: ImapFlow, destination: string | string[], content: Buffer | string, flags?: string | string[] | undefined, idate?: Date | string | false | undefined): Promise<AppendResult | undefined>;
+export default function append(connection: ImapFlow, destination: string | string[], content: Buffer | Uint8Array | string, flags?: string | string[] | undefined, idate?: Date | string | false | undefined): Promise<AppendResult | undefined>;

package/node_modules/imapflow/dist/cjs/commands/append.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = append;
 const tools_js_1 = require("../tools.js");
+const errors_js_1 = require("../errors.js");
 /**
  * Appends a message to a mailbox.
  *
@@ -18,14 +19,24 @@ async function append(connection, destination, content, flags, idate) {
         // nothing to do here
         return;
     }
+    // The literal size marker is announced from these bytes, so anything that is not
+    // bytes (a Readable, a plain object) is refused here instead of desyncing the session
+    let message;
     if (typeof content === 'string') {
-        content = Buffer.from(content);
+        message = Buffer.from(content);
+    }
+    else if (content instanceof Uint8Array) {
+        // a Buffer as is, any other Uint8Array as a view over the same memory, not a copy
+        message = Buffer.isBuffer(content) ? content : Buffer.from(content.buffer, content.byteOffset, content.byteLength);
+    }
+    else {
+        throw (0, errors_js_1.createImapError)('Message content must be a Buffer, Uint8Array or string', 'InvalidMessageContent');
     }
     // APPENDLIMIT capability (RFC 7889): server may advertise the maximum message
     // size it accepts. Check before sending to avoid a wasted round-trip.
     if (connection.capabilities.has('APPENDLIMIT')) {
         let appendLimit = connection.capabilities.get('APPENDLIMIT');
-        if (typeof appendLimit === 'number' && appendLimit < content.length) {
+        if (typeof appendLimit === 'number' && appendLimit < message.length) {
             let err = new Error('Message content too big for APPENDLIMIT=' + appendLimit);
             err.serverResponseCode = 'APPENDLIMIT';
             throw err;
@@ -82,9 +93,9 @@ async function append(connection, destination, content, flags, idate) {
     // Regular literals cannot contain NUL bytes per the IMAP grammar.
     let isLiteral8 = false;
     if (connection.capabilities.has('BINARY') && !connection.disableBinary) {
-        isLiteral8 = content.indexOf(Buffer.from([0])) >= 0;
+        isLiteral8 = message.indexOf(0) >= 0;
     }
-    attributes.push({ type: 'LITERAL', value: content, isLiteral8 });
+    attributes.push({ type: 'LITERAL', value: message, isLiteral8 });
     let map = { destination };
     if (connection.mailbox && connection.mailbox.path) {
         map.path = connection.mailbox.path;

package/node_modules/imapflow/dist/cjs/commands/compress.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = compress;
+const errors_js_1 = require("../errors.js");
 /**
  * Requests DEFLATE compression from the server.
  *
@@ -36,8 +37,7 @@ async function compress(connection) {
     // back its unconsumed tail on unpipe so the transport can feed it into the
     // inflater - not something a command module can reach from here.
     if (response.hasTrailingData) {
-        let error = new Error('Server sent data between the COMPRESS response and the compression layer switch');
-        error.code = 'COMPRESS_TRAILING_DATA';
+        let error = (0, errors_js_1.createImapError)('Server sent data between the COMPRESS response and the compression layer switch', 'COMPRESS_TRAILING_DATA');
         connection.log.error({ err: error, cid: connection.id });
         // Schedule the close before releasing parser backpressure, so the buffered
         // deflate-framed bytes cannot settle anything before teardown begins. This is

package/node_modules/imapflow/dist/cjs/commands/id.js

@@ -39,17 +39,19 @@ async function id(connection, clientInfo) {
                     let params = untagged.attributes && untagged.attributes[0];
                     let key;
                     (Array.isArray(params) ? params : [].concat(params || [])).forEach((val, i) => {
+                        // keys are strings and values nstrings, either may come as a literal
+                        let value = (0, tools_js_1.getStringValue)(val);
                         if (i % 2 === 0) {
-                            key = val.value;
+                            key = value;
                         }
-                        else if (typeof key === 'string' && typeof val.value === 'string') {
+                        else if (key !== undefined && value !== undefined) {
                             // The server picks the keys of this object, which the caller reads
                             // back as serverInfo: a prototype-chain name is skipped as it is for
                             // every other server-named key, so it can neither be shadowed nor
                             // written through
                             let name = key.toLowerCase().trim();
                             if (!(0, tools_js_1.isUnsafeKey)(name)) {
-                                map[name] = val.value;
+                                map[name] = value;
                             }
                         }
                     });

package/node_modules/imapflow/dist/cjs/commands/idle.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = idle;
 const tools_js_1 = require("../tools.js");
+const errors_js_1 = require("../errors.js");
 const NOOP_INTERVAL = 2 * 60 * 1000;
 /**
  * Marks the connection as idling on behalf of one session and returns a release function.
@@ -127,14 +128,15 @@ async function runIdle(connection) {
     }
     catch (err) {
         (0, tools_js_1.logConnectionError)(connection, 'IDLE session failed', err);
-        // A tagged NO or BAD only means the server refused IDLE; the connection is still usable,
-        // so the waiters are released by the finally block below and their own commands run.
-        // Anything else (close, lost socket, parser failure) fails the waiters too.
-        let refusedByServer = (0, tools_js_1.isServerRefusal)(err);
-        if (refusedByServer) {
+        // A tagged NO or BAD only means the server did not run IDLE; the connection is still
+        // usable, so the waiters are released by the finally block below and their own commands
+        // run. Anything else (close, lost socket, parser failure) fails the waiters too. Only a
+        // refusal turns IDLE off for the session, a throttled IDLE is tried again later.
+        let answeredByServer = err.responseStatus === 'NO' || err.responseStatus === 'BAD';
+        if ((0, tools_js_1.isServerRefusal)(err)) {
             connection.skipIdle = true;
         }
-        if (preCheckWaitQueue.length && !refusedByServer) {
+        if (preCheckWaitQueue.length && !answeredByServer) {
             // One error for the whole queue: every waiter failed at the same site, for the same
             // reason. Built inside the guard so a teardown with nothing queued - the common case -
             // does not pay for an Error and its stack capture.
@@ -191,9 +193,7 @@ async function pollOnce(connection, session) {
                 highestModseq: true
             });
             if (!status) {
-                let err = new Error('STATUS poll failed');
-                err.code = 'PollFailed';
-                throw err;
+                throw (0, errors_js_1.createImapError)('STATUS poll failed', 'PollFailed');
             }
             break;
         }

package/node_modules/imapflow/dist/cjs/commands/list.js

@@ -158,7 +158,7 @@ async function list(connection, reference, mailbox, options) {
                             path: (0, tools_js_1.normalizePath)(connection, (0, tools_js_1.decodePath)(connection, rawPath)),
                             pathAsListed: rawPath,
                             flags: new Set((0, tools_js_1.getStringList)(untagged.attributes[0])),
-                            delimiter: (untagged.attributes[1] && untagged.attributes[1].value),
+                            delimiter: (0, tools_js_1.getStringValue)(untagged.attributes[1]),
                             listed: true
                         };
                         normalizeFlags(entry);
@@ -399,7 +399,7 @@ async function list(connection, reference, mailbox, options) {
                             path: (0, tools_js_1.normalizePath)(connection, (0, tools_js_1.decodePath)(connection, rawPath)),
                             pathAsListed: rawPath,
                             flags: new Set((0, tools_js_1.getStringList)(untagged.attributes[0])),
-                            delimiter: (untagged.attributes[1] && untagged.attributes[1].value),
+                            delimiter: (0, tools_js_1.getStringValue)(untagged.attributes[1]),
                             subscribed: true
                         };
                         if (entry.path.toUpperCase() === 'INBOX') {

package/node_modules/imapflow/dist/cjs/commands/namespace.js

@@ -94,8 +94,9 @@ async function getListPrefix(connection) {
                         return;
                     }
                     map.flags = new Set((0, tools_js_1.getStringList)(untagged.attributes[0]));
-                    map.delimiter = (untagged.attributes[1] && untagged.attributes[1].value);
-                    map.prefix = ((untagged.attributes[2] && untagged.attributes[2].value) || '');
+                    // the name may be a literal, which arrives as a Buffer
+                    map.delimiter = (0, tools_js_1.getStringValue)(untagged.attributes[1]) || null;
+                    map.prefix = (0, tools_js_1.getStringValue)(untagged.attributes[2]) || '';
                     if (map.delimiter && map.prefix.charAt(0) === map.delimiter) {
                         map.prefix = map.prefix.slice(1);
                     }
@@ -120,24 +121,27 @@ function getNamsepaceInfo(attribute) {
     if (!attribute || !Array.isArray(attribute) || !attribute.length) {
         return false;
     }
-    return attribute
-        .filter(entry => {
-        let pair = entry;
-        // RFC 2342 section 5 allows the delimiter to be NIL when the namespace has
-        // no hierarchy. The token parser emits a literal `null` for NIL.
-        return pair.length >= 2 && pair[0] && typeof pair[0].value === 'string' && (pair[1] === null || (pair[1] && typeof pair[1].value === 'string'));
-    })
-        .map(entry => {
+    let entries = [];
+    for (let entry of attribute) {
+        if (!Array.isArray(entry)) {
+            continue;
+        }
         let pair = entry;
-        let prefix = pair[0].value;
-        let delimiter = pair[1] === null ? null : pair[1].value;
+        let prefix = (0, tools_js_1.getStringValue)(pair[0]);
+        // RFC 2342 section 5 allows the delimiter to be NIL when the namespace has no hierarchy.
+        // The token parser emits a literal `null` for NIL.
+        let delimiter = pair[1] === null ? null : (0, tools_js_1.getStringValue)(pair[1]);
+        if (pair.length < 2 || prefix === undefined || delimiter === undefined) {
+            continue;
+        }
         // Append the delimiter to the prefix if it doesn't already end with one,
         // so callers can construct full paths by simply concatenating prefix + name.
         if (delimiter && prefix && prefix.charAt(prefix.length - 1) !== delimiter) {
             prefix += delimiter;
         }
-        return { prefix, delimiter };
-    });
+        entries.push({ prefix, delimiter });
+    }
+    return entries;
 }
 module.exports = exports.default;
 Object.defineProperty(module.exports, 'default', { value: exports.default, enumerable: false, writable: true, configurable: true });

package/node_modules/imapflow/dist/cjs/commands/quota.js

@@ -82,9 +82,8 @@ async function quota(connection, path) {
                 // QUOTAROOT response tells us which quota root applies to this mailbox.
                 // A mailbox may have zero or one quota root.
                 QUOTAROOT: async (untagged) => {
-                    let quotaRoot = untagged.attributes && untagged.attributes[1] && typeof untagged.attributes[1].value === 'string'
-                        ? untagged.attributes[1].value
-                        : false;
+                    // the root name is an astring, which may come as a literal
+                    let quotaRoot = (0, tools_js_1.getStringValue)(untagged.attributes && untagged.attributes[1]);
                     if (quotaRoot) {
                         map.quotaRoot = quotaRoot;
                     }

package/node_modules/imapflow/dist/cjs/commands/select.d.ts

@@ -1,24 +1,13 @@
 import type { ImapFlow } from '../imap-flow.js';
 import type { MailboxObject, MailboxOpenOptions } from '../types.js';
-/**
- * Options for SELECT/EXAMINE: the public open options plus the QRESYNC resynchronization
- * parameters, which are only honored when the QRESYNC extension has been enabled
- */
-export interface SelectOptions extends MailboxOpenOptions {
-    /** QRESYNC modseq value to fetch changes since */
-    changedSince?: bigint | number | string | undefined;
-    /** QRESYNC UID validity value */
-    uidValidity?: bigint | number | string | undefined;
-}
+/** SELECT/EXAMINE options, the QRESYNC parameters are part of the public mailboxOpen() options */
+export type SelectOptions = MailboxOpenOptions;
 /**
  * Selects or examines a mailbox, making it the current mailbox for subsequent operations.
  *
  * @param connection - IMAP connection instance
  * @param path - Mailbox path to select
- * @param options - Select options
- * @param options.readOnly - If true, use EXAMINE instead of SELECT (read-only access)
- * @param options.changedSince - QRESYNC modseq value to fetch changes since
- * @param options.uidValidity - QRESYNC UID validity value
+ * @param options - Select options, see MailboxOpenOptions
  * @returns Mailbox info object with path, flags, exists, uidNext, uidValidity, highestModseq, etc., or undefined if preconditions not met
  * @throws If the SELECT/EXAMINE command fails
  */

package/node_modules/imapflow/dist/cjs/commands/select.js

@@ -51,10 +51,7 @@ const VALUED_RESPONSE_CODES = Object.assign(Object.create(null), {
  *
  * @param connection - IMAP connection instance
  * @param path - Mailbox path to select
- * @param options - Select options
- * @param options.readOnly - If true, use EXAMINE instead of SELECT (read-only access)
- * @param options.changedSince - QRESYNC modseq value to fetch changes since
- * @param options.uidValidity - QRESYNC UID validity value
+ * @param options - Select options, see MailboxOpenOptions
  * @returns Mailbox info object with path, flags, exists, uidNext, uidValidity, highestModseq, etc., or undefined if preconditions not met
  * @throws If the SELECT/EXAMINE command fails
  */

package/node_modules/imapflow/dist/cjs/commands/status.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = status;
 const tools_js_1 = require("../tools.js");
 const status_fields_js_1 = require("./status-fields.js");
+const errors_js_1 = require("../errors.js");
 // STATUS fields that also refresh the live mailbox state when the queried mailbox is the
 // currently selected one. Keyed by the output property name parseStatusList() reports.
 const MAILBOX_UPDATERS = {
@@ -99,10 +100,7 @@ async function status(connection, path, query) {
                 return false;
             });
             if (folders && !folders.length) {
-                let error = new Error(`Mailbox doesn't exist: ${path}`);
-                error.code = 'NotFound';
-                error.response = err;
-                throw error;
+                throw (0, errors_js_1.createImapError)(`Mailbox doesn't exist: ${path}`, 'NotFound', { response: err });
             }
         }
         connection.log.warn({ err, cid: connection.id });

package/node_modules/imapflow/dist/cjs/connection-deadline.d.ts

@@ -1,4 +1,4 @@
-import type { ImapFlowError } from './errors.js';
+import { type ImapFlowError } from './errors.js';
 export declare const CONNECT_TIMEOUT: number;
 /**
  * One deadline for an entire connection attempt.

package/node_modules/imapflow/dist/cjs/connection-deadline.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ConnectionDeadline = exports.CONNECT_TIMEOUT = void 0;
 const tools_js_1 = require("./tools.js");
+const errors_js_1 = require("./errors.js");
 // Default upper bound for establishing a usable transport, including DNS and proxy negotiation.
 exports.CONNECT_TIMEOUT = 90 * 1000;
 /**
@@ -31,10 +32,7 @@ class ConnectionDeadline {
      * @returns The shared `CONNECT_TIMEOUT` error.
      */
     error() {
-        let err = new Error('Failed to establish connection in required time');
-        err.code = 'CONNECT_TIMEOUT';
-        err.details = { connectionTimeout: this.timeout };
-        return err;
+        return (0, errors_js_1.createImapError)('Failed to establish connection in required time', 'CONNECT_TIMEOUT', { details: { connectionTimeout: this.timeout } });
     }
     /**
      * Maps a dependency's own expiry onto the shared `CONNECT_TIMEOUT` shape, so callers see one