@yozz.app/imap 0.1.3 → 0.1.5

package/README.md

@@ -36,3 +36,9 @@ Or for a specific host with authentication:
 ```bash
 YOZZ_IMAP_HOST=imap.example.com YOZZ_IMAP_USER=me@example.com YOZZ_IMAP_PASSWORD=secret pnpm -F @yozz.app/imap live imap.example.com
 ```
+
+A literal over 64 MiB (`DEFAULT_MAX_LITERAL_BYTES`, or `maxLiteralBytes` in the options) is a protocol failure.
+
+`harness/relay-load.ts` pushes large messages through the hosted yozz.app relay, up over SMTP and
+back down over IMAP, using a throwaway Forward Email alias and YOZZ account that it deletes. It is
+for the maintainers; it needs `FORWARD_EMAIL_API_KEY` for the yozz.app domain.

package/dist/index.d.mts

@@ -1,16 +1,5 @@
 //#region src/tokenizer.d.ts
-/**
- * Hand-written tokenizer over byte offsets for IMAP4rev2/rev1 stream.
- *
- * Implements total parsing over attacker-controlled bytes:
- * - Line ends at CRLF; bare LF is a protocol failure.
- * - Logical line frames `{n}` literals (and `{n+}` LITERAL+).
- * - Enforces maxLiteralBytes (default 32 MiB).
- * - A number above 2^32 - 1 is an atom of digits, not a failure: RFC 9051's `number` is
- *   32-bit, but Gmail's X-GM-THRID is 64-bit and arrives as a bare number.
- * - Never throws on malformed input; returns typed ImapResult.
- */
-declare const DEFAULT_MAX_LITERAL_BYTES: number;
+export declare const DEFAULT_MAX_LITERAL_BYTES: number;
 type ImapToken = {
   readonly kind: 'atom';
   readonly value: string;
@@ -103,7 +92,9 @@ type ImapFetchItem = {
 } | {
   readonly kind: 'bodyStructure';
   readonly parts: readonly string[];
-} /** Gmail's `X-GM-THRID`: 64-bit, so kept as its decimal digits. */ | {
+} |
+/** Gmail's `X-GM-THRID` is 64-bit, so it stays decimal digits. */
+{
   readonly kind: 'gmailThreadId';
   readonly id: string;
 } | {
@@ -190,14 +181,9 @@ type ImapResponse = ImapTagged | {
   readonly kind: 'untagged';
   readonly untagged: ImapUntagged;
 } | ImapContinuation;
-declare const parseResponse: (tokens: readonly ImapToken[]) => ImapResult<ImapResponse>;
+export declare const parseResponse: (tokens: readonly ImapToken[]) => ImapResult<ImapResponse>;
 //#endregion
 //#region src/transport.d.ts
-/**
- * What this client needs from a transport: bytes in, bytes out. Declared here rather than
- * imported from `@yozz.app/tls` so the package has no runtime dependency at all; it is the same
- * two-method shape, so a `TlsConnection` satisfies it structurally.
- */
 type ByteDuplex = {
   readonly read: () => Promise<Uint8Array | null>;
   readonly write: (bytes: Uint8Array) => Promise<void>;
@@ -210,8 +196,10 @@ type ImapMessageSummary = {
   readonly flags: readonly string[];
   readonly internalDate: string | null;
   readonly size: number | null;
-  readonly envelope: ImapEnvelope | null; /** The msg-ids of the `References` header, in order; empty when the message carries none. */
-  readonly references: readonly string[]; /** Gmail's thread id (decimal digits), when the server was asked and answered. */
+  readonly envelope: ImapEnvelope | null;
+  /** The msg-ids of the `References` header, in order; empty when the message carries none. */
+  readonly references: readonly string[];
+  /** Gmail's thread id (decimal digits), when the server was asked and answered. */
   readonly gmailThreadId: string | null;
 };
 type ImapMessageFlags = {
@@ -228,11 +216,14 @@ type ImapSelected = {
   readonly readOnly: boolean;
 };
 type ImapClientOptions = {
-  readonly onUntagged?: (response: ImapUntagged) => void; /** Max bytes of a single literal the client will buffer; default 32 MiB. Larger → protocol failure. */
+  readonly onUntagged?: (response: ImapUntagged) => void;
+  /** Default 64 MiB; a larger literal is a protocol failure. */
   readonly maxLiteralBytes?: number;
 };
 type ImapIdle = {
-  /** Sends DONE (once; later calls are no-ops) and resolves with the IDLE's outcome. */readonly done: () => Promise<ImapResult<void>>; /** The same outcome, for a caller that wants to observe an idle ending on its own (BYE, EOF). */
+  /** Sends DONE (once; later calls are no-ops) and resolves with the IDLE's outcome. */
+  readonly done: () => Promise<ImapResult<void>>;
+  /** The same outcome, for a caller that wants to observe an idle ending on its own (BYE, EOF). */
   readonly ended: Promise<ImapResult<void>>;
 };
 type ImapClient = {
@@ -241,80 +232,76 @@ type ImapClient = {
     readonly capabilities: readonly string[] | null;
   }>>;
   readonly capability: () => Promise<ImapResult<readonly string[]>>;
-  readonly capabilities: () => readonly string[]; /** Case-insensitive check against the last known capability list. */
+  /** Last known. */
+  readonly capabilities: () => readonly string[];
+  /** Case-insensitive check against the last known capability list. */
   readonly hasCapability: (name: string) => boolean;
   readonly authenticate: (username: string, password: string) => Promise<ImapResult<void>>;
   readonly list: (reference: string, pattern: string) => Promise<ImapResult<readonly ImapMailbox[]>>;
   readonly select: (mailbox: string, options?: {
     readonly readOnly?: boolean;
   }) => Promise<ImapResult<ImapSelected>>;
-  /**
-   * UID FETCH with FLAGS ENVELOPE INTERNALDATE RFC822.SIZE, the `References` header and, on a
-   * server advertising `X-GM-EXT-1`, `X-GM-THRID`. `set` is an IMAP sequence-set string, e.g.
-   * "1:*" or "100:200".
-   */
+  /** `uidSet` is an IMAP sequence-set, e.g. "1:*" or "100:200". */
   readonly fetchSummaries: (uidSet: string) => Promise<ImapResult<readonly ImapMessageSummary[]>>;
-  /**
-   * The same FETCH read by message SEQUENCE number rather than uid. Sequence numbers are dense
-   * (1..EXISTS in the selected mailbox), so a fixed-width window is that many real messages —
-   * which uids, sparse wherever mail has been deleted, cannot promise.
-   */
-  readonly fetchSummariesBySeq: (seqSet: string) => Promise<ImapResult<readonly ImapMessageSummary[]>>; /** UID FETCH FLAGS only — what a resync of already-known messages asks for. */
-  readonly fetchFlags: (uidSet: string) => Promise<ImapResult<readonly ImapMessageFlags[]>>; /** UID FETCH BODY.PEEK[] — the whole raw message. */
+  /** By message sequence number (dense, 1..EXISTS) rather than uid (sparse after deletions). */
+  readonly fetchSummariesBySeq: (seqSet: string) => Promise<ImapResult<readonly ImapMessageSummary[]>>;
+  readonly fetchFlags: (uidSet: string) => Promise<ImapResult<readonly ImapMessageFlags[]>>;
   readonly fetchRaw: (uid: number) => Promise<ImapResult<Uint8Array>>;
   readonly storeFlags: (uidSet: string, mode: 'add' | 'remove' | 'set', flags: readonly string[]) => Promise<ImapResult<void>>;
-  /**
-   * APPEND a whole RFC 5322 message to a mailbox, e.g. a Sent copy after SMTP accepted it.
-   * Without `internalDate` the server stamps the message with its own clock.
-   *
-   * Resolves with the `APPENDUID` the server issued (RFC 4315), or `null` where it issued none —
-   * a server without UIDPLUS. That locator is how a caller addresses what it just wrote without
-   * searching for it, which matters for a draft: the alternative is finding it by Message-ID, and
-   * a retry after a lost response would then be indistinguishable from a duplicate.
-   */
-  readonly append: (mailbox: string, message: Uint8Array, flags: readonly string[], internalDate?: Date) => Promise<ImapResult<AppendUid | null>>; /** EXPUNGE: erases every `\\Deleted` message in the selected mailbox. */
+  /** Resolves with the RFC 4315 `APPENDUID`, or `null` from a server without UIDPLUS. */
+  readonly append: (mailbox: string, message: Uint8Array, flags: readonly string[], internalDate?: Date) => Promise<ImapResult<AppendUid | null>>;
   readonly expunge: () => Promise<ImapResult<void>>;
-  /**
-   * RFC 4315 UID EXPUNGE: erases only these `\\Deleted` messages, leaving anything another
-   * client flagged alone. Refuses without UIDPLUS rather than falling back to plain EXPUNGE,
-   * which would erase more than was asked.
-   */
+  /** RFC 4315. Refuses without UIDPLUS rather than falling back to EXPUNGE, which erases more than asked. */
   readonly uidExpunge: (uidSet: string) => Promise<ImapResult<void>>;
+  readonly uidSearchHeader: (header: string, value: string) => Promise<ImapResult<readonly number[]>>;
   /**
-   * UID SEARCH over one header's exact value in the selected mailbox, newest-last uid order as
-   * the server gives it. An empty array means the mailbox does not hold it.
+   * The selected mailbox's uids whose subject, sender or body contains `text`, ascending. One
+   * search per field and a union: `TEXT` alone is the body on Forward Email's server, and its `OR`
+   * answers a subset of what the operands do.
    */
-  readonly uidSearchHeader: (header: string, value: string) => Promise<ImapResult<readonly number[]>>; /** RFC 6851 UID MOVE. Refuses without the MOVE capability (no COPY+EXPUNGE fallback). */
-  readonly move: (uidSet: string, mailbox: string) => Promise<ImapResult<void>>; /** CREATE a mailbox. */
+  readonly uidSearchText: (text: string) => Promise<ImapResult<readonly number[]>>;
+  /** RFC 6851. Answers with the RFC 4315 `COPYUID`, or null when the server gave none. Refuses without MOVE. */
+  readonly move: (uidSet: string, mailbox: string) => Promise<ImapResult<CopyUid | null>>;
   readonly create: (mailbox: string) => Promise<ImapResult<void>>;
   readonly noop: () => Promise<ImapResult<void>>;
-  /**
-   * RFC 2177 IDLE. Occupies the command queue until `done()`: every other command waits
-   * behind it, so the caller MUST call `done()` before awaiting anything else. Untagged
-   * responses that arrive while idling (EXISTS, EXPUNGE, FETCH) go to `onUntagged`.
-   * Resolves once the server's tagged completion of the IDLE arrives after DONE.
-   */
+  /** RFC 2177. Occupies the command queue until `done()`; untagged responses meanwhile go to `onUntagged`. */
   readonly idle: () => ImapIdle;
   readonly logout: () => Promise<ImapResult<void>>;
 };
-/** Where an APPEND landed: RFC 4315's `[APPENDUID <uidvalidity> <uid>]`. */
+/** RFC 4315 `[APPENDUID <uidvalidity> <uid>]`. */
 type AppendUid = {
   readonly uidValidity: number;
   readonly uid: number;
 };
-declare const createImapClient: (transport: ByteDuplex, options?: ImapClientOptions) => ImapClient;
+/** `first` to `last` inclusive, ascending: RFC 4315 §3 reads a range `12:10` as 10, 11, 12. */
+type UidRange = readonly [first: number, last: number];
+/**
+ * RFC 4315 `COPYUID`: the n-th uid of `source` is now the n-th uid of `target`, in a destination
+ * mailbox whose UIDVALIDITY is `uidValidity`. Kept as ranges: a server's `1:4294967295` costs two
+ * numbers, never four billion. Read one uid's destination with `copiedUid`.
+ */
+type CopyUid = {
+  readonly uidValidity: number;
+  readonly source: readonly UidRange[];
+  readonly target: readonly UidRange[];
+};
+/** Where `COPYUID` says the message at `uid` went, or null when it does not mention it. */
+export declare const copiedUid: ({ source, target }: CopyUid, uid: number) => number | null;
+export declare const createImapClient: (transport: ByteDuplex, options?: ImapClientOptions) => ImapClient;
 //#endregion
 //#region src/rfc2047.d.ts
+export declare const decodeRfc2047: (header: string) => string;
+//#endregion
+//#region src/uid-set.d.ts
+/**
+ * RFC 7162 §4 asks a client to keep a command line to about 8192 octets. A set stops well short, so
+ * the tag, the command and a mailbox name fit beside it.
+ */
+export declare const MAX_UID_SET_LENGTH = 4096;
 /**
- * RFC 2047 MIME Part Three: Message Header Extensions for Non-ASCII Text.
- *
- * Decodes encoded-words in header fields (Q and B encodings).
- * Crucial invariants:
- * 1. Adjacent encoded-words separated only by linear-white-space (LWS) are joined by their
- *    raw decoded bytes before charset decoding.
- * 2. The output is NEVER re-scanned.
- * 3. Unknown charsets leave the raw word intact.
+ * Uids as RFC 9051 sequence sets, runs written as ranges (`3:5,9`), split so that no set is longer
+ * than `maxLength`: one command per set, however many uids are written to at once.
  */
-declare const decodeRfc2047: (header: string) => string;
+export declare const uidSets: (uids: Iterable<number>, maxLength?: number) => readonly string[];
 //#endregion
-export { type ByteDuplex, DEFAULT_MAX_LITERAL_BYTES, type ImapAddress, type ImapClient, type ImapClientOptions, type ImapContinuation, type ImapEnvelope, type ImapFailure, type ImapFetchItem, type ImapIdle, type ImapMailbox, type ImapMessageSummary, type ImapResponse, type ImapResponseCode, type ImapResult, type ImapSelected, type ImapTagged, type ImapToken, type ImapUntagged, createImapClient, decodeRfc2047, parseResponse };
+export type { ByteDuplex, CopyUid, ImapAddress, ImapClient, ImapClientOptions, ImapContinuation, ImapEnvelope, ImapFailure, ImapFetchItem, ImapIdle, ImapMailbox, ImapMessageSummary, ImapResponse, ImapResponseCode, ImapResult, ImapSelected, ImapTagged, ImapToken, ImapUntagged };

package/dist/index.mjs

@@ -49,14 +49,7 @@ const bytesToBase64 = (bytes) => {
 };
 //#endregion
 //#region src/utf7.ts
-/**
-* RFC 3501 §5.1.3 Modified UTF-7 encoding and decoding for IMAP mailbox names.
-*
-* Printable ASCII (0x20..0x7E) except '&' are direct.
-* '&' is encoded as '&-'.
-* Non-ASCII characters are encoded as UTF-16BE in modified Base64 (',' instead of '/', no '=' padding),
-* enclosed between '&' and '-'.
-*/
+/** RFC 3501 §5.1.3 modified UTF-7: UTF-16BE in base64 with `,` for `/` and no padding, between `&` and `-`. */
 const b64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+,";
 const encodeModifiedBase64 = (codeUnits) => {
 	const bytes = [];
@@ -156,10 +149,6 @@ const decodeModifiedUtf7 = (str) => {
 };
 //#endregion
 //#region src/commands.ts
-/**
-* Pure builders for IMAP commands. Each builder returns exact bytes to send.
-* No I/O is performed here.
-*/
 const quoteString = (str) => {
 	return `"${str.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
 };
@@ -182,11 +171,13 @@ const buildSaslPlainBytes = (user, pass) => {
 };
 const buildCapabilityCommand = (tag) => ({ lines: [{ text: stringToBytes(`${tag} CAPABILITY\r\n`) }] });
 const buildAuthenticatePlainSaslIrCommand = (tag, user, pass) => {
-	return { lines: [{ text: stringToBytes(`${tag} AUTHENTICATE PLAIN ${bytesToBase64(buildSaslPlainBytes(user, pass))}\r\n`) }] };
+	const base64Auth = bytesToBase64(buildSaslPlainBytes(user, pass));
+	return { lines: [{ text: stringToBytes(`${tag} AUTHENTICATE PLAIN ${base64Auth}\r\n`) }] };
 };
 const buildAuthenticatePlainInitialCommand = (tag) => ({ lines: [{ text: stringToBytes(`${tag} AUTHENTICATE PLAIN\r\n`) }] });
 const buildAuthenticatePlainResponse = (user, pass) => {
-	return { lines: [{ text: stringToBytes(`${bytesToBase64(buildSaslPlainBytes(user, pass))}\r\n`) }] };
+	const base64Auth = bytesToBase64(buildSaslPlainBytes(user, pass));
+	return { lines: [{ text: stringToBytes(`${base64Auth}\r\n`) }] };
 };
 const buildLoginCommand = (tag, user, pass) => {
 	const userSafe = isSafeQuotedString(user);
@@ -218,21 +209,22 @@ const buildListCommand = (tag, reference, pattern) => {
 	return { lines: [{ text: stringToBytes(`${tag} LIST ${quoteString(refUtf7)} ${quoteString(patUtf7)}\r\n`) }] };
 };
 const buildSelectCommand = (tag, mailbox, readOnly = false) => {
-	return { lines: [{ text: stringToBytes(`${tag} ${readOnly ? "EXAMINE" : "SELECT"} ${quoteString(encodeModifiedUtf7(mailbox))}\r\n`) }] };
+	const verb = readOnly ? "EXAMINE" : "SELECT";
+	const mboxUtf7 = encodeModifiedUtf7(mailbox);
+	return { lines: [{ text: stringToBytes(`${tag} ${verb} ${quoteString(mboxUtf7)}\r\n`) }] };
 };
-/**
-* Everything a list row and client-side threading need, in one round trip. `References` is the
-* one header ENVELOPE does not carry; `X-GM-THRID` is Gmail's own threading answer and is only
-* asked for when the server advertised `X-GM-EXT-1`, since an unknown item is a BAD.
-*
-* `bySeq` drops the `UID` prefix, so `set` is read as message sequence numbers instead. `UID`
-* stays in the items either way: a summary is worthless without the id its folder is keyed by.
-*/
+/** `X-GM-THRID` is asked for only when the server advertised `X-GM-EXT-1`: an unknown item is a BAD. */
 const buildFetchSummariesCommand = (tag, set, { gmail, bySeq = false }) => ({ lines: [{ text: stringToBytes(`${tag} ${bySeq ? "FETCH" : "UID FETCH"} ${set} (FLAGS ENVELOPE INTERNALDATE RFC822.SIZE UID BODY.PEEK[HEADER.FIELDS (REFERENCES)]${gmail ? " X-GM-THRID" : ""})\r\n`) }] });
 const buildFetchFlagsCommand = (tag, uidSet) => ({ lines: [{ text: stringToBytes(`${tag} UID FETCH ${uidSet} (FLAGS UID)\r\n`) }] });
 const buildFetchRawCommand = (tag, uid) => ({ lines: [{ text: stringToBytes(`${tag} UID FETCH ${uid} (BODY.PEEK[])\r\n`) }] });
+const STORE_OPS = {
+	add: "+FLAGS",
+	remove: "-FLAGS",
+	set: "FLAGS"
+};
 const buildStoreFlagsCommand = (tag, uidSet, mode, flags) => {
-	return { lines: [{ text: stringToBytes(`${tag} UID STORE ${uidSet} ${mode === "add" ? "+FLAGS" : mode === "remove" ? "-FLAGS" : "FLAGS"} (${flags.join(" ")})\r\n`) }] };
+	const op = STORE_OPS[mode];
+	return { lines: [{ text: stringToBytes(`${tag} UID STORE ${uidSet} ${op} (${flags.join(" ")})\r\n`) }] };
 };
 const MONTHS = [
 	"Jan",
@@ -249,17 +241,12 @@ const MONTHS = [
 	"Dec"
 ];
 const two = (value) => String(value).padStart(2, "0");
-/**
-* RFC 9051 date-time, quoted: `"28-Aug-2026 09:48:00 +0800"`. The day is space-padded rather
-* than zero-padded, which the grammar requires and several servers enforce. Local zone, so it
-* says when the message reached this client.
-*/
+/** RFC 9051 date-time. The day is space-padded, which the grammar requires and several servers enforce. */
 const formatImapDateTime = (date) => {
 	const offset = -date.getTimezoneOffset();
 	const zone = `${offset < 0 ? "-" : "+"}${two(Math.floor(Math.abs(offset) / 60))}${two(Math.abs(offset) % 60)}`;
 	return `"${String(date.getDate()).padStart(2, " ")}-${MONTHS[date.getMonth()]}-${date.getFullYear()} ${two(date.getHours())}:${two(date.getMinutes())}:${two(date.getSeconds())} ${zone}"`;
 };
-/** APPEND with the message as a literal; flags are IMAP atoms such as `\\Seen`, sent unquoted. */
 const buildAppendCommand = (tag, mailbox, flags, message, internalDate) => {
 	const mboxUtf7 = encodeModifiedUtf7(mailbox);
 	const stamp = internalDate === void 0 ? "" : `${formatImapDateTime(internalDate)} `;
@@ -268,32 +255,21 @@ const buildAppendCommand = (tag, mailbox, flags, message, internalDate) => {
 		literal: message
 	}, { text: stringToBytes("\r\n") }] };
 };
-/** EXPUNGE: erases every `\\Deleted` message in the selected mailbox. */
 const buildExpungeCommand = (tag) => ({ lines: [{ text: stringToBytes(`${tag} EXPUNGE\r\n`) }] });
-/**
-* RFC 4315 UID EXPUNGE: erases only the named `\\Deleted` messages. Plain EXPUNGE erases every
-* `\\Deleted` message in the mailbox, including ones another client flagged and has not yet
-* erased itself — so replacing a draft with it would quietly take somebody else's deletions with
-* it. Needs UIDPLUS; the client refuses without it rather than falling back.
-*/
+/** RFC 4315. */
 const buildUidExpungeCommand = (tag, uidSet) => ({ lines: [{ text: stringToBytes(`${tag} UID EXPUNGE ${uidSet}\r\n`) }] });
+/** A server need only index the headers IMAP names; on a private `X-` header it may answer the empty list. */
+const buildUidSearchHeaderCommand = (tag, header, value) => ({ lines: [{ text: stringToBytes(`${tag} UID SEARCH HEADER ${quoteString(header)} ${quoteString(value)}\r\n`) }] });
 /**
-* UID SEARCH for one header's exact value, e.g. `HEADER "Message-ID" "<id>"`.
-*
-* What makes an APPEND retry safe: after a lost response the client asks whether the copy it was
-* about to write is already there, instead of writing a second one.
-*
-* **Ask it about a header IMAP names.** A private `X-` header looks like the better question — a
-* Message-ID can be rewritten by a provider, a subject match is a guess — but a server need only
-* index the headers the protocol defines, and one that does not index yours answers the EMPTY LIST
-* rather than an error. That is indistinguishable from "no copy is there", so the caller writes
-* the second copy, or decides it has nothing to erase. Measured on Forward Email:
-* docs/knowledge/forwardemail-api.md.
+* One `UID SEARCH <key> <text>`. A printable-ASCII query is a quoted string in the default charset;
+* anything else is a UTF-8 literal, which every server must accept.
 */
-const buildUidSearchHeaderCommand = (tag, header, value) => ({ lines: [{ text: stringToBytes(`${tag} UID SEARCH HEADER ${quoteString(header)} ${quoteString(value)}\r\n`) }] });
-/** RFC 6851 UID MOVE — relocates messages into another mailbox in one round trip. */
+const buildUidSearchTextCommand = (tag, key, text) => isSafeQuotedString(text) ? { lines: [{ text: stringToBytes(`${tag} UID SEARCH ${key} ${quoteString(text)}\r\n`) }] } : { lines: [{
+	text: stringToBytes(`${tag} UID SEARCH CHARSET UTF-8 ${key} `),
+	literal: stringToBytes(text)
+}, { text: stringToBytes("\r\n") }] };
+/** RFC 6851. */
 const buildMoveCommand = (tag, uidSet, mailbox) => ({ lines: [{ text: stringToBytes(`${tag} UID MOVE ${uidSet} ${quoteString(encodeModifiedUtf7(mailbox))}\r\n`) }] });
-/** CREATE a mailbox (e.g. Archive the first time the client needs one). */
 const buildCreateCommand = (tag, mailbox) => ({ lines: [{ text: stringToBytes(`${tag} CREATE ${quoteString(encodeModifiedUtf7(mailbox))}\r\n`) }] });
 const buildNoopCommand = (tag) => ({ lines: [{ text: stringToBytes(`${tag} NOOP\r\n`) }] });
 const buildIdleCommand = (tag) => ({ lines: [{ text: stringToBytes(`${tag} IDLE\r\n`) }] });
@@ -302,16 +278,6 @@ const buildIdleDoneLine = () => stringToBytes("DONE\r\n");
 const buildLogoutCommand = (tag) => ({ lines: [{ text: stringToBytes(`${tag} LOGOUT\r\n`) }] });
 //#endregion
 //#region src/rfc2047.ts
-/**
-* RFC 2047 MIME Part Three: Message Header Extensions for Non-ASCII Text.
-*
-* Decodes encoded-words in header fields (Q and B encodings).
-* Crucial invariants:
-* 1. Adjacent encoded-words separated only by linear-white-space (LWS) are joined by their
-*    raw decoded bytes before charset decoding.
-* 2. The output is NEVER re-scanned.
-* 3. Unknown charsets leave the raw word intact.
-*/
 const ENCODED_WORD_REGEX = /=\?([^?]+)\?([bBqQ])\?([^?]*)\?=/g;
 const decodeQToBytes = (text) => {
 	const bytes = [];
@@ -423,7 +389,8 @@ const decodeRfc2047 = (header) => {
 				}
 				if (hasDecodeError) for (const w of sameCharsetWords) result += w.raw;
 				else {
-					const decodedText = decodeBytesWithCharset(concatByteArrays(byteChunks), firstInCharset.charset);
+					const mergedBytes = concatByteArrays(byteChunks);
+					const decodedText = decodeBytesWithCharset(mergedBytes, firstInCharset.charset);
 					if (decodedText !== null) result += decodedText;
 					else for (const w of sameCharsetWords) result += w.raw;
 				}
@@ -439,9 +406,6 @@ const decodeRfc2047 = (header) => {
 };
 //#endregion
 //#region src/envelope.ts
-/**
-* Parsers for IMAP FETCH items: ENVELOPE, FLAGS, INTERNALDATE, RFC822.SIZE, BODYSTRUCTURE.
-*/
 const tokenToString$1 = (token) => {
 	if (token === void 0 || token.kind === "nil") return null;
 	if (token.kind === "quoted" || token.kind === "atom") return token.value;
@@ -449,9 +413,7 @@ const tokenToString$1 = (token) => {
 	if (token.kind === "literal") return asciiToString(token.value);
 	return null;
 };
-/**
-* Parses a single address tuple `(name adl mailbox host)` and advances index past `)`.
-*/
+/** RFC 9051 address: `(name adl mailbox host)`. */
 const parseAddressTuple = (tokens, start) => {
 	let idx = start;
 	if (tokens[idx]?.kind !== "lparen") return null;
@@ -487,10 +449,6 @@ const parseAddressTuple = (tokens, start) => {
 		nextIndex: idx
 	};
 };
-/**
-* Parses an address list `( (addr1) (addr2) ... )` or `NIL`.
-* Flattening groups to their member addresses.
-*/
 const parseAddressList = (tokens, start) => {
 	const first = tokens[start];
 	if (first === void 0 || first.kind === "nil") return {
@@ -523,10 +481,7 @@ const parseAddressList = (tokens, start) => {
 		nextIndex: idx
 	};
 };
-/**
-* Parses an ENVELOPE structure:
-* `(date subject from sender reply-to to cc bcc in-reply-to message-id)`
-*/
+/** RFC 9051 envelope: `(date subject from sender reply-to to cc bcc in-reply-to message-id)`. */
 const parseEnvelope = (tokens, start) => {
 	if (tokens[start]?.kind !== "lparen") return null;
 	let idx = start + 1;
@@ -576,9 +531,7 @@ const parseEnvelope = (tokens, start) => {
 		nextIndex: idx
 	};
 };
-/**
-* Parses BODYSTRUCTURE, extracting only the list of MIME parts (e.g. ['TEXT/PLAIN', 'TEXT/HTML']).
-*/
+/** Only the MIME types, e.g. `['TEXT/PLAIN', 'TEXT/HTML']`. */
 const parseBodyStructureParts = (tokens, start) => {
 	if (tokens[start]?.kind !== "lparen") return {
 		parts: [],
@@ -619,9 +572,6 @@ const parseBodyStructureParts = (tokens, start) => {
 		nextIndex: idx
 	};
 };
-/**
-* Parses items inside a FETCH response `(...)`.
-*/
 const parseFetchItems = (tokens, start) => {
 	if (tokens[start]?.kind !== "lparen") return {
 		items: [],
@@ -661,21 +611,22 @@ const parseFetchItems = (tokens, start) => {
 					kind: "internalDate",
 					date: dateStr
 				});
-			} else if (itemName === "FLAGS") if (tokens[idx]?.kind === "lparen") {
-				idx++;
-				const flags = [];
-				while (idx < tokens.length && tokens[idx]?.kind !== "rparen") {
-					const flagTok = tokens[idx];
-					if (flagTok?.kind === "atom") flags.push(flagTok.value);
+			} else if (itemName === "FLAGS") {
+				if (tokens[idx]?.kind === "lparen") {
 					idx++;
-				}
-				if (tokens[idx]?.kind === "rparen") idx++;
-				items.push({
-					kind: "flags",
-					flags
-				});
-			} else idx++;
-			else if (itemName === "ENVELOPE") {
+					const flags = [];
+					while (idx < tokens.length && tokens[idx]?.kind !== "rparen") {
+						const flagTok = tokens[idx];
+						if (flagTok?.kind === "atom") flags.push(flagTok.value);
+						idx++;
+					}
+					if (tokens[idx]?.kind === "rparen") idx++;
+					items.push({
+						kind: "flags",
+						flags
+					});
+				} else idx++;
+			} else if (itemName === "ENVELOPE") {
 				const envResult = parseEnvelope(tokens, idx);
 				if (envResult !== null) {
 					items.push({
@@ -684,45 +635,46 @@ const parseFetchItems = (tokens, start) => {
 					});
 					idx = envResult.nextIndex;
 				} else idx++;
-			} else if (itemName === "BODYSTRUCTURE" || itemName === "BODY" || itemName === "BODY.PEEK") if (tokens[idx]?.kind === "lparen") {
-				const bsResult = parseBodyStructureParts(tokens, idx);
-				items.push({
-					kind: "bodyStructure",
-					parts: bsResult.parts
-				});
-				idx = bsResult.nextIndex;
-			} else if (tokens[idx]?.kind === "lbracket") {
-				idx++;
-				const sectionParts = [];
-				while (idx < tokens.length && tokens[idx]?.kind !== "rbracket") {
-					const secTok = tokens[idx];
-					if (secTok !== void 0) {
-						if (secTok.kind === "atom" || secTok.kind === "quoted") sectionParts.push(secTok.value);
-						else if (secTok.kind === "number") sectionParts.push(String(secTok.value));
-						else if (secTok.kind === "lparen") sectionParts.push("(");
-						else if (secTok.kind === "rparen") sectionParts.push(")");
-						else if (secTok.kind === "nil") sectionParts.push("NIL");
-						else if (secTok.kind === "literal") sectionParts.push(asciiToString(secTok.value));
+			} else if (itemName === "BODYSTRUCTURE" || itemName === "BODY" || itemName === "BODY.PEEK") {
+				if (tokens[idx]?.kind === "lparen") {
+					const bsResult = parseBodyStructureParts(tokens, idx);
+					items.push({
+						kind: "bodyStructure",
+						parts: bsResult.parts
+					});
+					idx = bsResult.nextIndex;
+				} else if (tokens[idx]?.kind === "lbracket") {
+					idx++;
+					const sectionParts = [];
+					while (idx < tokens.length && tokens[idx]?.kind !== "rbracket") {
+						const secTok = tokens[idx];
+						if (secTok !== void 0) {
+							if (secTok.kind === "atom" || secTok.kind === "quoted") sectionParts.push(secTok.value);
+							else if (secTok.kind === "number") sectionParts.push(String(secTok.value));
+							else if (secTok.kind === "lparen") sectionParts.push("(");
+							else if (secTok.kind === "rparen") sectionParts.push(")");
+							else if (secTok.kind === "nil") sectionParts.push("NIL");
+							else if (secTok.kind === "literal") sectionParts.push(asciiToString(secTok.value));
+						}
+						idx++;
 					}
+					if (tokens[idx]?.kind === "rbracket") idx++;
+					const section = sectionParts.join(" ");
+					const originTok = tokens[idx];
+					if (originTok?.kind === "atom" && /^<\d+(\.\d+)?>$/.test(originTok.value)) idx++;
+					const bodyTok = tokens[idx];
 					idx++;
-				}
-				if (tokens[idx]?.kind === "rbracket") idx++;
-				const section = sectionParts.join(" ");
-				const originTok = tokens[idx];
-				if (originTok?.kind === "atom" && /^<\d+(\.\d+)?>$/.test(originTok.value)) idx++;
-				const bodyTok = tokens[idx];
-				idx++;
-				let bytes = null;
-				if (bodyTok?.kind === "literal") bytes = bodyTok.value;
-				else if (bodyTok?.kind === "quoted" || bodyTok?.kind === "atom") bytes = stringToBytes(bodyTok.value);
-				else if (bodyTok?.kind === "nil") bytes = null;
-				items.push({
-					kind: "body",
-					section,
-					bytes
-				});
-			} else idx++;
-			else if (itemName === "X-GM-THRID") {
+					let bytes = null;
+					if (bodyTok?.kind === "literal") bytes = bodyTok.value;
+					else if (bodyTok?.kind === "quoted" || bodyTok?.kind === "atom") bytes = stringToBytes(bodyTok.value);
+					else if (bodyTok?.kind === "nil") bytes = null;
+					items.push({
+						kind: "body",
+						section,
+						bytes
+					});
+				} else idx++;
+			} else if (itemName === "X-GM-THRID") {
 				const id = tokenToString$1(tokens[idx]);
 				idx++;
 				if (id !== null && /^\d+$/.test(id)) items.push({
@@ -745,9 +697,6 @@ const parseFetchItems = (tokens, start) => {
 };
 //#endregion
 //#region src/response.ts
-/**
-* IMAP response parser: converts token stream into typed tagged, untagged, and continuation responses.
-*/
 const tokenToString = (token) => {
 	if (token === void 0 || token.kind === "nil") return null;
 	if (token.kind === "quoted" || token.kind === "atom") return token.value;
@@ -995,6 +944,7 @@ const parseResponse = (tokens) => {
 				}
 				const delimiter = tokenToString(tokens[idx]);
 				idx++;
+				const rawName = tokenToString(tokens[idx]) ?? "";
 				return {
 					ok: true,
 					value: {
@@ -1002,7 +952,7 @@ const parseResponse = (tokens) => {
 						untagged: {
 							kind: "list",
 							mailbox: {
-								name: decodeModifiedUtf7(tokenToString(tokens[idx]) ?? ""),
+								name: decodeModifiedUtf7(rawName),
 								delimiter,
 								attributes
 							}
@@ -1133,22 +1083,8 @@ const parseResponse = (tokens) => {
 };
 //#endregion
 //#region src/tokenizer.ts
-/**
-* Hand-written tokenizer over byte offsets for IMAP4rev2/rev1 stream.
-*
-* Implements total parsing over attacker-controlled bytes:
-* - Line ends at CRLF; bare LF is a protocol failure.
-* - Logical line frames `{n}` literals (and `{n+}` LITERAL+).
-* - Enforces maxLiteralBytes (default 32 MiB).
-* - A number above 2^32 - 1 is an atom of digits, not a failure: RFC 9051's `number` is
-*   32-bit, but Gmail's X-GM-THRID is 64-bit and arrives as a bare number.
-* - Never throws on malformed input; returns typed ImapResult.
-*/
-const DEFAULT_MAX_LITERAL_BYTES = 32 * 1024 * 1024;
+const DEFAULT_MAX_LITERAL_BYTES = 67108864;
 const MAX_UINT32 = 4294967295;
-/**
-* Checks for bare LF in a slice of bytes.
-*/
 const checkBareLf = (bytes, start, end) => {
 	for (let i = start; i < end; i++) if (bytes[i] === 10 && (i === 0 || bytes[i - 1] !== 13)) return {
 		kind: "protocol",
@@ -1156,10 +1092,6 @@ const checkBareLf = (bytes, start, end) => {
 	};
 	return null;
 };
-/**
-* Parses literal length from `{<digits>}` or `{<digits>+}` before CRLF.
-* Returns valid length, invalid failure, or none if not a literal header.
-*/
 const parseLiteralHeader = (bytes, textStart, crlfIndex, maxLiteralBytes) => {
 	if (crlfIndex === 0) return { kind: "none" };
 	let i = crlfIndex - 1;
@@ -1197,9 +1129,6 @@ const parseLiteralHeader = (bytes, textStart, crlfIndex, maxLiteralBytes) => {
 		braceIndex
 	};
 };
-/**
-* Scans `buffer` for a complete logical line (including any literals).
-*/
 const readLogicalLine = (buffer, maxLiteralBytes = DEFAULT_MAX_LITERAL_BYTES, resume) => {
 	const segments = resume?.segments ? [...resume.segments] : [];
 	let scanOffset = resume?.resumeAt ?? 0;
@@ -1307,9 +1236,6 @@ const readLogicalLine = (buffer, maxLiteralBytes = DEFAULT_MAX_LITERAL_BYTES, re
 		textStart
 	};
 };
-/**
-* Tokenizes a text segment into IMAP tokens.
-*/
 const tokenizeTextSegment = (bytes, tokens) => {
 	let i = 0;
 	const len = bytes.length;
@@ -1421,9 +1347,6 @@ const tokenizeTextSegment = (bytes, tokens) => {
 		value: void 0
 	};
 };
-/**
-* Tokenizes a complete LogicalLine into ImapTokens.
-*/
 const tokenizeLogicalLine = (line) => {
 	const tokens = [];
 	for (const seg of line.segments) if (seg.kind === "literal") tokens.push({
@@ -1441,21 +1364,6 @@ const tokenizeLogicalLine = (line) => {
 };
 //#endregion
 //#region src/client.ts
-/**
-* IMAP client state machine over ByteDuplex.
-*
-* Invariants:
-* - One IMAP connection object per device (no connection pool).
-* - Transport is ByteDuplex from @yozz.app/tls.
-* - Parsing is total: parser never throws, returns typed ImapFailure and closes.
-* - Commands are serialised: one in-flight command at a time, queued in order (no pipelining in this slice).
-* - Greeting is captured immediately upon creation.
-*/
-/**
-* The `APPENDUID` of a tagged OK, when the server issued one. It arrives as an unrecognised
-* response code, which is exactly what `other` is for — no parser change, and a server without
-* UIDPLUS simply has nothing here.
-*/
 const appendUidOf = (tagged) => {
 	const code = tagged.code;
 	if (code?.kind !== "other" || code.code !== "APPENDUID") return null;
@@ -1466,20 +1374,88 @@ const appendUidOf = (tagged) => {
 		uid
 	} : null;
 };
+/** RFC 3501 nz-number: what a uid can be. */
+const MAX_UID = 4294967295;
+const uidOf = (text) => {
+	if (!/^[1-9][0-9]*$/.test(text)) return null;
+	const uid = Number(text);
+	return uid <= MAX_UID ? uid : null;
+};
+/** A uid set without `*`, which COPYUID never carries; null when malformed. */
+const uidRangesOf = (text) => {
+	const ranges = [];
+	for (const part of text.split(",")) {
+		const bounds = part.split(":").map(uidOf);
+		const uids = bounds.filter((uid) => uid !== null);
+		const [first, last] = uids;
+		if (first === void 0 || uids.length < bounds.length || uids.length > 2) return null;
+		const end = last ?? first;
+		ranges.push([Math.min(first, end), Math.max(first, end)]);
+	}
+	return ranges;
+};
+const sizeOfRange = ([first, last]) => last - first + 1;
+const sizeOf = (ranges) => ranges.reduce((size, range) => size + sizeOfRange(range), 0);
+const copyUidOfCode = (code) => {
+	if (code?.kind !== "other" || code.code !== "COPYUID") return null;
+	const [validity, sourceSet, targetSet] = code.args;
+	if (validity === void 0 || sourceSet === void 0 || targetSet === void 0) return null;
+	const uidValidity = uidOf(validity);
+	const source = uidRangesOf(sourceSet);
+	const target = uidRangesOf(targetSet);
+	if (uidValidity === null || source === null || target === null) return null;
+	return sizeOf(source) === sizeOf(target) ? {
+		uidValidity,
+		source,
+		target
+	} : null;
+};
 /**
-* The msg-ids out of a `HEADER.FIELDS (REFERENCES)` section: the header unfolded, then every
-* `<...>` in order. A truncated or absent header is simply fewer ids.
+* RFC 6851 §4.3 has a MOVE's COPYUID in an untagged OK ahead of its EXPUNGEs (Gmail, Dovecot);
+* RFC 4315 puts a COPY's on the tagged OK, and some servers do that for MOVE too. Either, or
+* several of them, read as one answer.
 */
+const copyUidOf = (untagged, tagged) => {
+	const answers = [...untagged.map((response) => response.kind === "status" ? response.code : null), tagged.code].flatMap((code) => copyUidOfCode(code) ?? []);
+	const [first] = answers;
+	if (first === void 0) return null;
+	if (answers.some((answer) => answer.uidValidity !== first.uidValidity)) return null;
+	return {
+		uidValidity: first.uidValidity,
+		source: answers.flatMap((answer) => answer.source),
+		target: answers.flatMap((answer) => answer.target)
+	};
+};
+/** How many uids come before `uid`, counting through `ranges` in order; null when none holds it. */
+const positionOf = (ranges, uid) => {
+	let before = 0;
+	for (const range of ranges) {
+		const [first, last] = range;
+		if (uid >= first && uid <= last) return before + uid - first;
+		before += sizeOfRange(range);
+	}
+	return null;
+};
+/** The uid at `position`, counting through `ranges` in order; null past their end. */
+const uidAt = (ranges, position) => {
+	let before = 0;
+	for (const range of ranges) {
+		if (position < before + sizeOfRange(range)) return range[0] + position - before;
+		before += sizeOfRange(range);
+	}
+	return null;
+};
+/** Where `COPYUID` says the message at `uid` went, or null when it does not mention it. */
+const copiedUid = ({ source, target }, uid) => {
+	const position = positionOf(source, uid);
+	return position === null ? null : uidAt(target, position);
+};
 const parseReferencesHeader = (bytes) => {
 	if (bytes === null) return [];
 	const line = asciiToString(bytes).replace(/\r?\n[ \t]+/g, " ").split(/\r?\n/).find((l) => /^references:/i.test(l));
 	if (line === void 0) return [];
 	return line.slice(line.indexOf(":") + 1).match(/<[^<>\s]+>/g) ?? [];
 };
-/**
-* The summaries in a FETCH response's untagged lines, whether the command asked by uid or by
-* sequence number: `* <seq> FETCH (UID n …)` carries both either way.
-*/
 const summariesFrom = (untagged) => untagged.flatMap((item) => {
 	if (item.kind !== "fetch") return [];
 	let uid = 0;
@@ -1508,7 +1484,7 @@ const summariesFrom = (untagged) => untagged.flatMap((item) => {
 	}];
 });
 const createImapClient = (transport, options) => {
-	const maxLiteralBytes = options?.maxLiteralBytes ?? 33554432;
+	const maxLiteralBytes = options?.maxLiteralBytes ?? 67108864;
 	const onUntagged = options?.onUntagged;
 	let chunks = [];
 	let totalBufferedBytes = 0;
@@ -1518,9 +1494,6 @@ const createImapClient = (transport, options) => {
 	let knownCapabilities = [];
 	let tagCounter = 1;
 	const nextTag = () => `A${String(tagCounter++).padStart(4, "0")}`;
-	/**
-	* Reads and parses the next complete IMAP response from the transport.
-	*/
 	const readNextResponse = async () => {
 		if (failureReason !== null) return {
 			ok: false,
@@ -1587,9 +1560,6 @@ const createImapClient = (transport, options) => {
 			totalBufferedBytes += chunk.length;
 		}
 	};
-	/**
-	* Greeting is captured immediately as soon as client is created.
-	*/
 	const greetingPromise = (async () => {
 		const res = await readNextResponse();
 		if (!res.ok) return res;
@@ -1637,9 +1607,6 @@ const createImapClient = (transport, options) => {
 			reason: { kind: "closed" }
 		}));
 	};
-	/**
-	* Sends a command and collects untagged responses until matching tagged response.
-	*/
 	const executeCommand = async (build, options) => {
 		if (isClosed) return {
 			ok: false,
@@ -1807,21 +1774,22 @@ const createImapClient = (transport, options) => {
 						text: resp.untagged.text
 					};
 				}
-			} else if (resp.kind === "continuation") if (options?.onContinuation !== void 0) {
-				const contRes = await options.onContinuation();
-				if (!contRes.ok) return contRes;
-			} else {
-				isClosed = true;
-				failureReason = {
-					kind: "protocol",
-					detail: "Unexpected continuation response from server"
-				};
-				return {
-					ok: false,
-					reason: failureReason
-				};
-			}
-			else if (resp.kind === "tagged") {
+			} else if (resp.kind === "continuation") {
+				if (options?.onContinuation !== void 0) {
+					const contRes = await options.onContinuation();
+					if (!contRes.ok) return contRes;
+				} else {
+					isClosed = true;
+					failureReason = {
+						kind: "protocol",
+						detail: "Unexpected continuation response from server"
+					};
+					return {
+						ok: false,
+						reason: failureReason
+					};
+				}
+			} else if (resp.kind === "tagged") {
 				if (resp.tag !== tag) {
 					isClosed = true;
 					failureReason = {
@@ -1885,25 +1853,26 @@ const createImapClient = (transport, options) => {
 			const hasSaslIr = knownCapabilities.some((c) => c.toUpperCase() === "SASL-IR");
 			const hasLoginDisabled = knownCapabilities.some((c) => c.toUpperCase() === "LOGINDISABLED");
 			let authCmdRes;
-			if (hasAuthPlain) if (hasSaslIr) authCmdRes = await executeCommand((tag) => buildAuthenticatePlainSaslIrCommand(tag, username, password));
-			else authCmdRes = await executeCommand((tag) => buildAuthenticatePlainInitialCommand(tag), { onContinuation: async () => {
-				try {
-					const respCmd = buildAuthenticatePlainResponse(username, password);
-					for (const line of respCmd.lines) await transport.write(line.text);
-					return {
-						ok: true,
-						value: void 0
-					};
-				} catch {
-					isClosed = true;
-					failureReason = { kind: "closed" };
-					return {
-						ok: false,
-						reason: { kind: "closed" }
-					};
-				}
-			} });
-			else if (!hasLoginDisabled) authCmdRes = await executeCommand((tag) => buildLoginCommand(tag, username, password));
+			if (hasAuthPlain) {
+				if (hasSaslIr) authCmdRes = await executeCommand((tag) => buildAuthenticatePlainSaslIrCommand(tag, username, password));
+				else authCmdRes = await executeCommand((tag) => buildAuthenticatePlainInitialCommand(tag), { onContinuation: async () => {
+					try {
+						const respCmd = buildAuthenticatePlainResponse(username, password);
+						for (const line of respCmd.lines) await transport.write(line.text);
+						return {
+							ok: true,
+							value: void 0
+						};
+					} catch {
+						isClosed = true;
+						failureReason = { kind: "closed" };
+						return {
+							ok: false,
+							reason: { kind: "closed" }
+						};
+					}
+				} });
+			} else if (!hasLoginDisabled) authCmdRes = await executeCommand((tag) => buildLoginCommand(tag, username, password));
 			else return {
 				ok: false,
 				reason: {
@@ -2073,6 +2042,22 @@ const createImapClient = (transport, options) => {
 				value: res.value.untagged.flatMap((item) => item.kind === "search" ? [...item.uids] : [])
 			};
 		}),
+		uidSearchText: (text) => enqueueCommand(async () => {
+			const found = /* @__PURE__ */ new Set();
+			for (const key of [
+				"SUBJECT",
+				"FROM",
+				"TEXT"
+			]) {
+				const res = await executeCommand((tag) => buildUidSearchTextCommand(tag, key, text));
+				if (!res.ok) return res;
+				for (const item of res.value.untagged) if (item.kind === "search") for (const uid of item.uids) found.add(uid);
+			}
+			return {
+				ok: true,
+				value: [...found].toSorted((a, b) => a - b)
+			};
+		}),
 		move: (uidSet, mailbox) => enqueueCommand(async () => {
 			const greetRes = await greetingPromise;
 			if (!greetRes.ok) return greetRes;
@@ -2090,7 +2075,7 @@ const createImapClient = (transport, options) => {
 			if (!res.ok) return res;
 			return {
 				ok: true,
-				value: void 0
+				value: copyUidOf(res.value.untagged, res.value.tagged)
 			};
 		}),
 		create: (mailbox) => enqueueCommand(async () => {
@@ -2122,9 +2107,8 @@ const createImapClient = (transport, options) => {
 			}
 			let doneRequested = false;
 			let doneSent = false;
-			/** True once '+' arrived; DONE may be written (including from `done()` while a read waits). */
+			/** Set once '+' arrived; only then may DONE be written. */
 			let isIdling = false;
-			/** True once the IDLE has settled either way; a `done()` after that has nothing to end. */
 			let isEnded = false;
 			const sendDone = async () => {
 				if (doneSent || !isIdling || isEnded) return null;
@@ -2326,4 +2310,34 @@ const createImapClient = (transport, options) => {
 	};
 };
 //#endregion
-export { DEFAULT_MAX_LITERAL_BYTES, createImapClient, decodeRfc2047, parseResponse };
+//#region src/uid-set.ts
+/**
+* RFC 7162 §4 asks a client to keep a command line to about 8192 octets. A set stops well short, so
+* the tag, the command and a mailbox name fit beside it.
+*/
+const MAX_UID_SET_LENGTH = 4096;
+/**
+* Uids as RFC 9051 sequence sets, runs written as ranges (`3:5,9`), split so that no set is longer
+* than `maxLength`: one command per set, however many uids are written to at once.
+*/
+const uidSets = (uids, maxLength = MAX_UID_SET_LENGTH) => {
+	const ranges = [];
+	for (const uid of [...new Set(uids)].toSorted((a, b) => a - b)) {
+		const last = ranges.at(-1);
+		if (last !== void 0 && uid === last[1] + 1) last[1] = uid;
+		else ranges.push([uid, uid]);
+	}
+	const sets = [];
+	let current = "";
+	for (const [first, last] of ranges) {
+		const range = first === last ? String(first) : `${first}:${last}`;
+		if (current !== "" && current.length + 1 + range.length > maxLength) {
+			sets.push(current);
+			current = "";
+		}
+		current = current === "" ? range : `${current},${range}`;
+	}
+	return current === "" ? sets : [...sets, current];
+};
+//#endregion
+export { DEFAULT_MAX_LITERAL_BYTES, MAX_UID_SET_LENGTH, copiedUid, createImapClient, decodeRfc2047, parseResponse, uidSets };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yozz.app/imap",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Transport-agnostic IMAP4rev2/rev1 client core: literals, total parsing, RFC 2047, SASL PLAIN/LOGIN, IDLE, UID MOVE, APPEND with APPENDUID, UID EXPUNGE.",
   "license": "MIT",
   "homepage": "https://github.com/fishballapp/yozz",
@@ -29,16 +29,15 @@
     "access": "public"
   },
   "devDependencies": {
-    "@types/node": "^24.0.0",
-    "tsdown": "^0.22.3",
-    "@yozz.app/smtp": "0.1.3",
-    "@yozz.app/tls": "0.1.3",
-    "@yozz.app/x509": "0.1.3"
+    "@types/node": "^24.13.4",
+    "@yozz.app/smtp": "0.1.5",
+    "@yozz.app/tls": "0.1.5",
+    "@yozz.app/x509": "0.1.5",
+    "tsdown": "^0.23.0"
   },
   "scripts": {
     "build": "tsdown src/index.ts --format esm --dts",
     "test": "vitest run",
-    "live": "node harness/live.ts",
-    "seed": "node harness/seed-inbox.ts"
+    "live": "node harness/live.ts"
   }
 }