imapflow 1.4.8 → 1.4.9

package/test/fixtures/test-tls.js

@@ -3,6 +3,6 @@
 // Self-signed certificate + key for in-process TLS/STARTTLS mock servers in tests.
 // Generated once with: openssl req -x509 -newkey rsa:2048 -nodes -subj "/CN=localhost"
 module.exports = {
-    cert: "-----BEGIN CERTIFICATE-----\nMIIDCTCCAfGgAwIBAgIUQSc0WP7RlcOqGCdsMaxzCA97mfkwDQYJKoZIhvcNAQEL\nBQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI2MDYwODA0Mzg1NFoXDTM2MDYw\nNTA0Mzg1NFowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEA4TYnyK2nEn6wXEgVeEI3I9CDlONvWDO1Y51mslOaUwZR\nfuZp3YMUZDINNdZuFrREkD1WJfClRZtDKEurw9FfjEfA0gsM9RPvkQYXZ2zzhXgW\nx86li0Ra/Zx2RmajsWc+THTEpdOK0nqOqMMKFxiYJ7E+KiJY0X6HqKjdaB9CpZv7\nA1ROJoLjTnsdDG/NT9MCQxFbw05N2Bbbq+McKyXIEzxiZguYLIXsMKCi9MQOozvY\nT8X0AFWpFJCa8mRCW7LQngeSRQQckDONzHyELXnbvgIskr/WcmBEXMraTts3Z3QW\nouee6HFnYzi/pgCtVKX1Wu3oZm/nMblsWtopqg/YDwIDAQABo1MwUTAdBgNVHQ4E\nFgQUF5oycZ3ZaPs1fTaxZb666FQt+KcwHwYDVR0jBBgwFoAUF5oycZ3ZaPs1fTax\nZb666FQt+KcwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAWFk0\nMGw2pdkeU/s5j0T9GL8GjbOVC0G7H8tlx92XhQICmt/9GNHeb5nm84DgqRbkiTwS\nOXPoMsSvVEubnX0j/sqcbi5yQ6/YBG6Vx5E9CnfUbo4m9x1GofDkLdl+e6l636Mj\nWB5kJpNCH9sm2xPdLpl47pv/lwvyYjdy1DaATHn5nMGoM73IeEt0d4xoNN8Bso7B\nTTkjKRJ1QWgI2EjgU93x8tG4AqTj0CeH8Z6DDmfLhvJ6E0hSws4OQSnxWudh2aX8\niN+FkHgRobPS1GVCtibr+FxH1DtBv/grXhAbs4xP3Nf3m3Pn6AE0/lMtto3e67As\np4lf866gU9nbRkODqw==\n-----END CERTIFICATE-----\n",
-    key: "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDhNifIracSfrBc\nSBV4Qjcj0IOU429YM7VjnWayU5pTBlF+5mndgxRkMg011m4WtESQPVYl8KVFm0Mo\nS6vD0V+MR8DSCwz1E++RBhdnbPOFeBbHzqWLRFr9nHZGZqOxZz5MdMSl04rSeo6o\nwwoXGJgnsT4qIljRfoeoqN1oH0Klm/sDVE4mguNOex0Mb81P0wJDEVvDTk3YFtur\n4xwrJcgTPGJmC5gshewwoKL0xA6jO9hPxfQAVakUkJryZEJbstCeB5JFBByQM43M\nfIQtedu+AiySv9ZyYERcytpO2zdndBai557ocWdjOL+mAK1UpfVa7ehmb+cxuWxa\n2imqD9gPAgMBAAECggEACgBGqgG+0/JuUIV0S/UyJP6t098kYwKrgR33S99XO21M\nvIRCRUT8kyp/La81D6sNCb6/jvXDJnaA9/l29OjdA7TCr6aFT8jahafYmDjdY5rz\n9Vw25nAFqRIuqm0FGJa2Id0O8oeUuEjFrGGPltD6c3Yf2u0li+rA3tDeQYZ0hjge\nsVXzgI58SbO1Z1XCAXcdbcJOqjpEJ3w99GB5J/B1dDui3KR5Q6+L34HfoW8XmY/X\nCLe+Jcuk06Xa31iZ+0NEMIPOhVoCW//PfgEWD/dfG3jXhk84/Pb8DXaGahOvRPTY\nH1AVrqRBqW6PezR4qU4PdUfU3sp5NEBZl3oaW7/weQKBgQD8CKI7ek00KUhc9j5m\nHGuSR+lUzLziXRBt7xw0JXLa1rfok2RGDeTdIEGSjBr8xsNOe5aga843geoLptNe\n7LRrtJajgHl39NXnblroNidufmXjt9CRgjUsQuIREpjq9NyUGIh8o26/uZLB/Knq\nJ7Uum9YUHI/eEztmI/CZDbnUbQKBgQDkwXaf5UxkY9tsdbw8jHhV5Ypy/hwLXAcI\n90sCI9/mSQAOA9qNa+944MbRfReTseM+OFXHJRHXfuMXPPOrtObtVN94ECwFVePO\n2MI5CHc/SYZ/4Icf+jpPY+TAJtEW/39muwak43cmLhmrSmb9ExMhwfDoQotFBDOQ\nLyPPfMo46wKBgFwpWBHB1kt1sSV1UjoKuHdkXnmI6KUp/OEGZ9zVuNs3W0br5uYL\nHJ6Ttga9vvyiPjcL0HfXFDCODCS4m2CB1DPydIdTapen6zRW0V1KuD6ab+3GgLlE\n0ObfikVN9KcuZR6unfJd3Ri05mqTVxrt7D4f9DekfiNqCvV9vPRq5YI9AoGBAMeS\nYUOucK9EzzIYpVjN1E5cLCWWvDDM4PZZiP8c/UGTfpC7m/i1qf7zW4F4eRFJqM+n\npm5PUPmIoeasLoonETENUskUktM008KqKQhI8oAsTUNTR5AGZsjMhc1+D/zYevXN\nRUaljFWq8ooWJzOzaIWTBfIb3BUiTToFZmCmpmZxAoGAH2W3eDhuKrsE50ntofhZ\nx9Uy0OD30nztyecen26kuljcX7qdWh564mBob75wGSAoYzGSePZjJ/tQ4FznXUes\n6F4gM8Y58d3YZOjNq3xnT7AfaJHNnnjxA4pfnGRVr3wA2vwyrD3McgAPXf+mnB23\nl8nz6wxk97WnaIyo7Ofi/+A=\n-----END PRIVATE KEY-----\n"
+    cert: '-----BEGIN CERTIFICATE-----\nMIIDCTCCAfGgAwIBAgIUQSc0WP7RlcOqGCdsMaxzCA97mfkwDQYJKoZIhvcNAQEL\nBQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI2MDYwODA0Mzg1NFoXDTM2MDYw\nNTA0Mzg1NFowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEA4TYnyK2nEn6wXEgVeEI3I9CDlONvWDO1Y51mslOaUwZR\nfuZp3YMUZDINNdZuFrREkD1WJfClRZtDKEurw9FfjEfA0gsM9RPvkQYXZ2zzhXgW\nx86li0Ra/Zx2RmajsWc+THTEpdOK0nqOqMMKFxiYJ7E+KiJY0X6HqKjdaB9CpZv7\nA1ROJoLjTnsdDG/NT9MCQxFbw05N2Bbbq+McKyXIEzxiZguYLIXsMKCi9MQOozvY\nT8X0AFWpFJCa8mRCW7LQngeSRQQckDONzHyELXnbvgIskr/WcmBEXMraTts3Z3QW\nouee6HFnYzi/pgCtVKX1Wu3oZm/nMblsWtopqg/YDwIDAQABo1MwUTAdBgNVHQ4E\nFgQUF5oycZ3ZaPs1fTaxZb666FQt+KcwHwYDVR0jBBgwFoAUF5oycZ3ZaPs1fTax\nZb666FQt+KcwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAWFk0\nMGw2pdkeU/s5j0T9GL8GjbOVC0G7H8tlx92XhQICmt/9GNHeb5nm84DgqRbkiTwS\nOXPoMsSvVEubnX0j/sqcbi5yQ6/YBG6Vx5E9CnfUbo4m9x1GofDkLdl+e6l636Mj\nWB5kJpNCH9sm2xPdLpl47pv/lwvyYjdy1DaATHn5nMGoM73IeEt0d4xoNN8Bso7B\nTTkjKRJ1QWgI2EjgU93x8tG4AqTj0CeH8Z6DDmfLhvJ6E0hSws4OQSnxWudh2aX8\niN+FkHgRobPS1GVCtibr+FxH1DtBv/grXhAbs4xP3Nf3m3Pn6AE0/lMtto3e67As\np4lf866gU9nbRkODqw==\n-----END CERTIFICATE-----\n',
+    key: '-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDhNifIracSfrBc\nSBV4Qjcj0IOU429YM7VjnWayU5pTBlF+5mndgxRkMg011m4WtESQPVYl8KVFm0Mo\nS6vD0V+MR8DSCwz1E++RBhdnbPOFeBbHzqWLRFr9nHZGZqOxZz5MdMSl04rSeo6o\nwwoXGJgnsT4qIljRfoeoqN1oH0Klm/sDVE4mguNOex0Mb81P0wJDEVvDTk3YFtur\n4xwrJcgTPGJmC5gshewwoKL0xA6jO9hPxfQAVakUkJryZEJbstCeB5JFBByQM43M\nfIQtedu+AiySv9ZyYERcytpO2zdndBai557ocWdjOL+mAK1UpfVa7ehmb+cxuWxa\n2imqD9gPAgMBAAECggEACgBGqgG+0/JuUIV0S/UyJP6t098kYwKrgR33S99XO21M\nvIRCRUT8kyp/La81D6sNCb6/jvXDJnaA9/l29OjdA7TCr6aFT8jahafYmDjdY5rz\n9Vw25nAFqRIuqm0FGJa2Id0O8oeUuEjFrGGPltD6c3Yf2u0li+rA3tDeQYZ0hjge\nsVXzgI58SbO1Z1XCAXcdbcJOqjpEJ3w99GB5J/B1dDui3KR5Q6+L34HfoW8XmY/X\nCLe+Jcuk06Xa31iZ+0NEMIPOhVoCW//PfgEWD/dfG3jXhk84/Pb8DXaGahOvRPTY\nH1AVrqRBqW6PezR4qU4PdUfU3sp5NEBZl3oaW7/weQKBgQD8CKI7ek00KUhc9j5m\nHGuSR+lUzLziXRBt7xw0JXLa1rfok2RGDeTdIEGSjBr8xsNOe5aga843geoLptNe\n7LRrtJajgHl39NXnblroNidufmXjt9CRgjUsQuIREpjq9NyUGIh8o26/uZLB/Knq\nJ7Uum9YUHI/eEztmI/CZDbnUbQKBgQDkwXaf5UxkY9tsdbw8jHhV5Ypy/hwLXAcI\n90sCI9/mSQAOA9qNa+944MbRfReTseM+OFXHJRHXfuMXPPOrtObtVN94ECwFVePO\n2MI5CHc/SYZ/4Icf+jpPY+TAJtEW/39muwak43cmLhmrSmb9ExMhwfDoQotFBDOQ\nLyPPfMo46wKBgFwpWBHB1kt1sSV1UjoKuHdkXnmI6KUp/OEGZ9zVuNs3W0br5uYL\nHJ6Ttga9vvyiPjcL0HfXFDCODCS4m2CB1DPydIdTapen6zRW0V1KuD6ab+3GgLlE\n0ObfikVN9KcuZR6unfJd3Ri05mqTVxrt7D4f9DekfiNqCvV9vPRq5YI9AoGBAMeS\nYUOucK9EzzIYpVjN1E5cLCWWvDDM4PZZiP8c/UGTfpC7m/i1qf7zW4F4eRFJqM+n\npm5PUPmIoeasLoonETENUskUktM008KqKQhI8oAsTUNTR5AGZsjMhc1+D/zYevXN\nRUaljFWq8ooWJzOzaIWTBfIb3BUiTToFZmCmpmZxAoGAH2W3eDhuKrsE50ntofhZ\nx9Uy0OD30nztyecen26kuljcX7qdWh564mBob75wGSAoYzGSePZjJ/tQ4FznXUes\n6F4gM8Y58d3YZOjNq3xnT7AfaJHNnnjxA4pfnGRVr3wA2vwyrD3McgAPXf+mnB23\nl8nz6wxk97WnaIyo7Ofi/+A=\n-----END PRIVATE KEY-----\n'
 };

package/test/imap-flow-coverage-test.js

@@ -553,7 +553,14 @@ module.exports['Coverage: reader handles compiler failure when building executed
     client.requestTagMap.set('A1', {
         command: 'NOOP',
         // a circular/odd attribute that makes the logging compiler throw
-        attributes: [{ type: 'LITERAL', get value() { throw new Error('compile boom'); } }],
+        attributes: [
+            {
+                type: 'LITERAL',
+                get value() {
+                    throw new Error('compile boom');
+                }
+            }
+        ],
         options: {},
         resolve: () => {},
         reject: err => {

package/test/imap-flow-fetch-download-test.js

@@ -624,10 +624,7 @@ module.exports['DownloadMany: returns {response:false} when no bodyParts'] = asy
 
 module.exports['DownloadMany: parses charset, flowed and name params'] = async test => {
     let client = makeClient();
-    let mime = Buffer.from(
-        'Content-Type: text/plain; charset=iso-8859-1; format=flowed; delsp=yes; name="x.txt"\r\n' +
-            'Content-Disposition: inline\r\n\r\n'
-    );
+    let mime = Buffer.from('Content-Type: text/plain; charset=iso-8859-1; format=flowed; delsp=yes; name="x.txt"\r\nContent-Disposition: inline\r\n\r\n');
     client.fetchOne = async () => {
         let bodyParts = new Map();
         bodyParts.set('2.mime', mime);

package/test/imap-flow-internals-test.js

@@ -355,7 +355,7 @@ module.exports['Internals: secure connection defaults to port 993'] = test => {
 
 module.exports['Internals: getUntaggedHandler ignores non-string type token'] = test => {
     let client = makeClient();
-    client.untaggedHandlers = { '5': () => 'numeric-keyword-handler' };
+    client.untaggedHandlers = { 5: () => 'numeric-keyword-handler' };
     // numeric prefix but attributes[0].value is not a string -> keyword stays '5'
     let handler = client.getUntaggedHandler('5', [{ type: 'ATOM', value: 12345 }]);
     test.equal(handler(), 'numeric-keyword-handler');
@@ -409,7 +409,7 @@ module.exports['Internals: unbind falls back to socket when writeSocket missing'
     };
     client.socket = raw;
     client.writeSocket = null;
-    client.streamer = { /* unused here */ };
+    client.streamer = {/* unused here */};
     let result = client.unbind();
     test.equal(result.writeSocket, raw);
     test.done();

package/test/imap-flow-methods-test.js

@@ -96,6 +96,19 @@ module.exports['Methods: listTree returns tree structure'] = async test => {
     test.done();
 };
 
+module.exports['Methods: listTree passes through inline status objects'] = async test => {
+    let client = makeClient();
+    recordRun(client, [
+        { path: 'INBOX', name: 'INBOX', delimiter: '/', parent: [], flags: new Set(), status: { path: 'INBOX', messages: 5, unseen: 2 } },
+        { path: 'INBOX/Sub', name: 'Sub', delimiter: '/', parent: ['INBOX'], flags: new Set() }
+    ]);
+    let tree = await client.listTree({ statusQuery: { messages: true, unseen: true } });
+    // The StatusObject must survive into the tree node - it used to be coerced
+    // into a boolean by the tree builder
+    test.deepEqual(tree.folders[0].status, { path: 'INBOX', messages: 5, unseen: 2 });
+    test.done();
+};
+
 module.exports['Methods: noop dispatches NOOP'] = async test => {
     let client = makeClient();
     let calls = recordRun(client, true);
@@ -721,12 +734,7 @@ module.exports['Methods: untaggedFetch emits flags event'] = async test => {
         command: '1',
         attributes: [
             { type: 'ATOM', value: 'FETCH' },
-            [
-                { type: 'ATOM', value: 'UID' },
-                { type: 'ATOM', value: '100' },
-                { type: 'ATOM', value: 'FLAGS' },
-                [{ type: 'ATOM', value: '\\Seen' }]
-            ]
+            [{ type: 'ATOM', value: 'UID' }, { type: 'ATOM', value: '100' }, { type: 'ATOM', value: 'FLAGS' }, [{ type: 'ATOM', value: '\\Seen' }]]
         ]
     };
     await client.untaggedFetch(untagged);
@@ -736,3 +744,54 @@ module.exports['Methods: untaggedFetch emits flags event'] = async test => {
     test.ok(evt.flags.has('\\Seen'));
     test.done();
 };
+
+// ============================================
+// autoEnable
+// ============================================
+
+module.exports['Methods: autoEnable requests IMAP4rev2 alongside the base extensions'] = async test => {
+    let client = makeClient();
+    let calls = recordRun(client, new Set(['CONDSTORE', 'IMAP4REV2']));
+    await client.autoEnable();
+    test.equal(calls.length, 1);
+    test.deepEqual(calls[0], ['ENABLE', ['CONDSTORE', 'UTF8=ACCEPT', 'IMAP4rev2']]);
+    test.done();
+};
+
+module.exports['Methods: autoEnable honors disableIMAP4rev2'] = async test => {
+    let client = makeClient({ disableIMAP4rev2: true });
+    let calls = recordRun(client, new Set(['CONDSTORE']));
+    await client.autoEnable();
+    test.equal(calls.length, 1);
+    test.deepEqual(calls[0], ['ENABLE', ['CONDSTORE', 'UTF8=ACCEPT']]);
+    test.done();
+};
+
+module.exports['Methods: autoEnable includes QRESYNC when requested'] = async test => {
+    let client = makeClient({ qresync: true });
+    let calls = recordRun(client, new Set(['CONDSTORE', 'QRESYNC', 'IMAP4REV2']));
+    await client.autoEnable();
+    test.equal(calls.length, 1);
+    test.deepEqual(calls[0], ['ENABLE', ['CONDSTORE', 'UTF8=ACCEPT', 'QRESYNC', 'IMAP4rev2']]);
+    test.done();
+};
+
+module.exports['Methods: autoEnable retries without IMAP4rev2 when the whole command fails'] = async test => {
+    let client = makeClient();
+    // RFC 5161 requires unknown ENABLE arguments to be ignored, but a broken
+    // server may reject the whole command over IMAP4rev2 - the retry keeps
+    // CONDSTORE/UTF8=ACCEPT from being lost as collateral damage
+    let calls = recordRun(client, (cmd, list) => (list.includes('IMAP4rev2') ? false : new Set(['CONDSTORE'])));
+    await client.autoEnable();
+    test.equal(calls.length, 2);
+    test.deepEqual(calls[1], ['ENABLE', ['CONDSTORE', 'UTF8=ACCEPT']]);
+    test.done();
+};
+
+module.exports['Methods: autoEnable does not retry when disableIMAP4rev2 already omitted it'] = async test => {
+    let client = makeClient({ disableIMAP4rev2: true });
+    let calls = recordRun(client, () => false);
+    await client.autoEnable();
+    test.equal(calls.length, 1);
+    test.done();
+};

package/test/imap-parser-test.js

@@ -341,8 +341,7 @@ module.exports['IMAP Parser: empty continuation (+) response'] = test =>
         test.equal(parsed.command, '');
     });
 
-module.exports['IMAP Parser: non-space after command throws ParserError5'] = test =>
-    expectErrorCode(test, 'ParserError5', () => parser('TAG1 CMD\tx'));
+module.exports['IMAP Parser: non-space after command throws ParserError5'] = test => expectErrorCode(test, 'ParserError5', () => parser('TAG1 CMD\tx'));
 
 module.exports['IMAP Parser: leading whitespace in attributes throws ParserError7'] = test =>
     expectErrorCode(test, 'ParserError7', () => parser('TAG1 CMD \tx'));

package/test/integration/README.md

@@ -0,0 +1,40 @@
+# Live IMAP4rev2 integration tests
+
+Runs the ImapFlow client against a real IMAP4rev2 server - Dovecot 2.4+ in
+Docker - instead of protocol mocks. Covers the ENABLE IMAP4rev2 negotiation,
+LIST RETURN (SUBSCRIBED) without LSUB, subscription round-trips, UTF-8 mailbox
+names, inline LIST-STATUS, ESEARCH responses to plain SEARCH, and a message
+lifecycle smoke test with UID EXPUNGE.
+
+## Running
+
+```
+npm run test:rev2
+```
+
+Requires Docker. The script pulls `dovecot/dovecot:2.4.4`, starts a container
+with the drop-in config from `dovecot-test.conf`, waits for the IMAP greeting
+on `127.0.0.1:31143`, runs `rev2-live-test.js` with nodeunit, and always
+removes the container afterwards.
+
+These tests are intentionally not part of `npm test` - the Gruntfile nodeunit
+config excludes `test/integration/**`, so CI and plain test runs stay
+Docker-free.
+
+## Environment overrides
+
+- `IMAPFLOW_DOVECOT_IMAGE` - image to run (default `dovecot/dovecot:2.4.4`;
+  any 2.4.2+ tag supports IMAP4rev2)
+- `IMAPFLOW_DOVECOT_PLATFORM` - e.g. `linux/amd64`; defaults to the host
+  platform. Forcing `linux/amd64` on Apple Silicon does not work - Rosetta
+  cannot start Dovecot's privilege-separated login processes
+  (`rosetta error: mmap_anonymous_rw mmap failed`)
+- `IMAPFLOW_TEST_PORT` - host port to publish (default 31143)
+
+## Test account model
+
+The container uses Dovecot's static passdb (`USER_PASSWORD=pass`): any
+username authenticates with the password `pass` and gets its own empty mail
+home, so every test connects as a brand-new user and needs no cleanup between
+runs. Special-use mailboxes (Sent/Drafts/Junk/Trash) are auto-created and
+subscribed via `dovecot-test.conf`.

package/test/integration/dovecot-test.conf

@@ -0,0 +1,27 @@
+# Drop-in configuration for the ImapFlow IMAP4rev2 integration test container.
+# Mounted into /etc/dovecot/conf.d/ of the dovecot/dovecot:2.4.x image, which
+# already ships with imap4rev2_enable = yes and mail_utf8_extensions = yes.
+
+# The test client connects over plain TCP on the container-internal IMAP port
+# (31143), so cleartext logins must be allowed
+auth_allow_cleartext = yes
+
+# Special-use mailboxes, auto-created and subscribed for every test user
+namespace inbox {
+  mailbox Sent {
+    special_use = \Sent
+    auto = subscribe
+  }
+  mailbox Drafts {
+    special_use = \Drafts
+    auto = subscribe
+  }
+  mailbox Junk {
+    special_use = \Junk
+    auto = subscribe
+  }
+  mailbox Trash {
+    special_use = \Trash
+    auto = subscribe
+  }
+}

package/test/integration/rev2-live-test.js

@@ -0,0 +1,242 @@
+'use strict';
+
+// Live integration tests against a real IMAP4rev2 server (Dovecot 2.4+ in Docker).
+// Started via `npm run test:rev2` (see run-rev2-tests.sh) - excluded from the
+// Gruntfile nodeunit config so `npm test` stays Docker-free.
+//
+// The container uses a static passdb: any username logs in with the password
+// "pass", and every user gets a fresh mail home, so each test connects with a
+// unique user for isolation.
+
+const { ImapFlow } = require('../../lib/imap-flow');
+
+const HOST = process.env.IMAPFLOW_TEST_HOST || '127.0.0.1';
+const PORT = Number(process.env.IMAPFLOW_TEST_PORT) || 31143;
+
+let userCounter = 0;
+
+const connectClient = async (options, logs) => {
+    let client = new ImapFlow(
+        Object.assign(
+            {
+                host: HOST,
+                port: PORT,
+                secure: false,
+                // The test container upgrades via STARTTLS with a self-signed cert
+                tls: { rejectUnauthorized: false },
+                auth: { user: `livetest-${Date.now()}-${++userCounter}`, pass: 'pass' },
+                logger: false,
+                emitLogs: !!logs
+            },
+            options || {}
+        )
+    );
+    if (logs) {
+        client.on('log', entry => logs.push(entry));
+    }
+    await client.connect();
+    return client;
+};
+
+const wireLines = logs => logs.filter(entry => entry && typeof entry.msg === 'string' && ['c', 's'].includes(entry.src));
+const clientSent = (logs, needle) => wireLines(logs).some(entry => entry.src === 'c' && entry.msg.includes(needle));
+// Matches only an untagged response for the given command ("* ESEARCH ...").
+// A plain substring check would false-positive on capability listings - the
+// login response advertises tokens like ESEARCH in its CAPABILITY list.
+const serverSentUntagged = (logs, command) => {
+    let re = new RegExp(`^\\* ${command}( |$)`);
+    return wireLines(logs).some(entry => entry.src === 's' && re.test(entry.msg));
+};
+
+module.exports['Live rev2: connect negotiates ENABLE IMAP4rev2'] = async test => {
+    const client = await connectClient();
+    try {
+        test.ok(client.capabilities.has('IMAP4rev2'), 'server should advertise IMAP4rev2');
+        test.ok(client.enabled.has('IMAP4REV2'), 'IMAP4rev2 should be enabled');
+        // The single merged ENABLE call must not lose the other extensions
+        test.ok(client.enabled.has('CONDSTORE'), 'CONDSTORE should still be enabled');
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: list uses RETURN (SUBSCRIBED) and skips LSUB'] = async test => {
+    const logs = [];
+    const client = await connectClient(null, logs);
+    try {
+        const folders = await client.list();
+
+        test.ok(clientSent(logs, 'SUBSCRIBED'), 'LIST should request RETURN (SUBSCRIBED)');
+        test.ok(!clientSent(logs, 'LSUB'), 'LSUB must not be issued on a rev2 session');
+
+        const sent = folders.find(folder => folder.path === 'Sent');
+        test.ok(sent, 'Sent mailbox should be listed');
+        test.equal(sent.subscribed, true, 'Sent should be reported as subscribed');
+        test.equal(sent.specialUse, '\\Sent', 'special-use flag should be honored');
+        // \HasNoChildren must survive the extended LIST (RETURN (CHILDREN) requested)
+        test.ok(sent.flags.has('\\HasNoChildren'), 'child info should be present');
+        for (let folder of folders) {
+            test.ok(!folder.flags.has('\\Subscribed'), '\\Subscribed must be folded into the subscribed property');
+        }
+
+        const inbox = folders.find(folder => folder.path === 'INBOX');
+        test.ok(inbox, 'INBOX should be listed');
+        test.equal(inbox.subscribed, true, 'INBOX is always reported as subscribed');
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: subscription state round-trips'] = async test => {
+    const client = await connectClient();
+    try {
+        await client.mailboxCreate('RoundTrip');
+        await client.mailboxSubscribe('RoundTrip');
+        let folders = await client.list();
+        test.equal(folders.find(folder => folder.path === 'RoundTrip').subscribed, true);
+
+        await client.mailboxUnsubscribe('RoundTrip');
+        folders = await client.list();
+        test.ok(!folders.find(folder => folder.path === 'RoundTrip').subscribed);
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: deleted-but-subscribed folders stay out of listings'] = async test => {
+    const client = await connectClient();
+    try {
+        await client.mailboxCreate('Ghost');
+        await client.mailboxSubscribe('Ghost');
+        await client.mailboxDelete('Ghost');
+
+        const folders = await client.list();
+        // The RETURN (SUBSCRIBED) option must not resurrect phantom subscriptions
+        // the way a raw LSUB would
+        test.ok(!folders.find(folder => folder.path === 'Ghost'), 'deleted folder must not be listed');
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: UTF-8 mailbox names round-trip'] = async test => {
+    const client = await connectClient();
+    try {
+        const name = 'T\u00f5rva \u00f5un';
+        await client.mailboxCreate(name);
+        const folders = await client.list();
+        const created = folders.find(folder => folder.path === name);
+        test.ok(created, 'UTF-8 mailbox should be listed under its literal name');
+
+        const mailbox = await client.mailboxOpen(name);
+        test.equal(mailbox.path, name);
+        await client.mailboxClose();
+        await client.mailboxDelete(name);
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: statusQuery is answered inline via LIST-STATUS'] = async test => {
+    const logs = [];
+    const client = await connectClient(null, logs);
+    try {
+        await client.append('INBOX', Buffer.from('Subject: status probe\r\n\r\nstatus probe body\r\n'));
+
+        const folders = await client.list({ statusQuery: { messages: true, unseen: true } });
+
+        test.ok(clientSent(logs, 'STATUS'), 'LIST should carry RETURN (STATUS ...)');
+        const inbox = folders.find(folder => folder.path === 'INBOX');
+        test.equal(inbox.status.messages, 1, 'inline STATUS should report the appended message');
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: plain search results are collected'] = async test => {
+    const logs = [];
+    const client = await connectClient(null, logs);
+    try {
+        await client.append('INBOX', Buffer.from('Subject: first\r\n\r\nfirst\r\n'));
+        await client.append('INBOX', Buffer.from('Subject: second\r\n\r\nsecond\r\n'));
+
+        await client.mailboxOpen('INBOX');
+        const results = await client.search({ all: true });
+
+        // RFC 9051 deprecates the untagged SEARCH response in favor of ESEARCH,
+        // but Dovecot 2.4 still answers a plain SEARCH with the legacy form even
+        // on an ENABLEd rev2 session (verified on the wire). The client accepts
+        // both forms, so assert that the results arrived via one of them - the
+        // ESEARCH-answered variant of a plain SEARCH is covered by the mock
+        // suite, and a real ESEARCH response is exercised live in the
+        // returnOptions test below.
+        test.ok(serverSentUntagged(logs, 'SEARCH') || serverSentUntagged(logs, 'ESEARCH'), 'results should arrive via an untagged SEARCH or ESEARCH response');
+        test.deepEqual(results, [1, 2]);
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: returnOptions search is answered via a real ESEARCH response'] = async test => {
+    const logs = [];
+    const client = await connectClient(null, logs);
+    try {
+        await client.append('INBOX', Buffer.from('Subject: first\r\n\r\nfirst\r\n'));
+        await client.append('INBOX', Buffer.from('Subject: second\r\n\r\nsecond\r\n'));
+
+        await client.mailboxOpen('INBOX');
+        const result = await client.search({ all: true }, { returnOptions: ['ALL', 'COUNT'] });
+
+        // SEARCH RETURN (...) makes Dovecot answer with a genuine untagged
+        // ESEARCH response - this exercises the ESEARCH parsing path against a
+        // real server
+        test.ok(serverSentUntagged(logs, 'ESEARCH'), 'server should reply with an untagged ESEARCH response');
+        test.ok(!serverSentUntagged(logs, 'SEARCH'), 'no legacy untagged SEARCH response is expected');
+        test.equal(result.count, 2);
+        test.equal(result.all, '1:2');
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: message lifecycle smoke test'] = async test => {
+    const client = await connectClient();
+    try {
+        await client.append('INBOX', Buffer.from('Subject: smoke\r\n\r\nsmoke body\r\n'), ['\\Seen']);
+
+        await client.mailboxOpen('INBOX');
+        const message = await client.fetchOne('1', { envelope: true, flags: true, uid: true });
+        test.equal(message.envelope.subject, 'smoke');
+        test.ok(message.flags.has('\\Seen'));
+
+        await client.mailboxCreate('Smoke');
+        await client.messageCopy('1', 'Smoke');
+        await client.messageMove('1', 'Smoke');
+
+        const status = await client.status('Smoke', { messages: true });
+        test.equal(status.messages, 2, 'copy plus move should land two messages');
+
+        // uid expunge - UIDPLUS is folded into base rev2, so only the requested
+        // message may disappear
+        await client.mailboxOpen('Smoke');
+        const first = await client.fetchOne('1', { uid: true });
+        await client.messageDelete(`${first.uid}`, { uid: true });
+        const statusAfter = await client.status('Smoke', { messages: true });
+        test.equal(statusAfter.messages, 1, 'UID EXPUNGE must remove only the targeted message');
+
+        await client.mailboxClose();
+        await client.mailboxRename('Smoke', 'Smoke2');
+        await client.mailboxDelete('Smoke2');
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};

package/test/integration/run-rev2-tests.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Runs the ImapFlow live integration tests against a real IMAP4rev2 server
+# (Dovecot 2.4+ in Docker). Opt-in via `npm run test:rev2` - not part of the
+# regular `npm test` run, which stays Docker-free.
+#
+# Environment overrides:
+#   IMAPFLOW_DOVECOT_IMAGE     image to run (default dovecot/dovecot:2.4.4)
+#   IMAPFLOW_DOVECOT_PLATFORM  e.g. linux/amd64; defaults to the host platform.
+#                              Note: forcing linux/amd64 on Apple Silicon does
+#                              not work - Rosetta cannot start Dovecot's
+#                              privilege-separated login processes.
+#   IMAPFLOW_TEST_PORT         host port to publish (default 31143)
+
+CONTAINER_NAME="${IMAPFLOW_DOVECOT_CONTAINER:-imapflow-rev2-test}"
+IMAGE="${IMAPFLOW_DOVECOT_IMAGE:-dovecot/dovecot:2.4.4}"
+PORT="${IMAPFLOW_TEST_PORT:-31143}"
+
+# Empty unless a platform override was requested; --platform=value keeps it a
+# single argument so plain ${PLATFORM_ARG:+...} expansion works under set -u
+PLATFORM_ARG="${IMAPFLOW_DOVECOT_PLATFORM:+--platform=$IMAPFLOW_DOVECOT_PLATFORM}"
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
+
+cleanup() {
+    docker rm -f "$CONTAINER_NAME" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+cleanup
+
+docker run ${PLATFORM_ARG:+"$PLATFORM_ARG"} -d --name "$CONTAINER_NAME" \
+    -e USER_PASSWORD=pass \
+    -v "$SCRIPT_DIR/dovecot-test.conf:/etc/dovecot/conf.d/99-imapflow-test.conf:ro" \
+    -p "127.0.0.1:$PORT:31143" \
+    "$IMAGE" >/dev/null
+
+echo "Waiting for Dovecot to accept IMAP connections on port $PORT..."
+for i in $(seq 1 30); do
+    if node -e "
+        const net = require('net');
+        const socket = net.connect(Number(process.argv[1]), '127.0.0.1');
+        const bail = code => { socket.destroy(); process.exit(code); };
+        socket.on('data', chunk => bail(chunk.toString().startsWith('* OK') ? 0 : 1));
+        socket.on('error', () => bail(1));
+        setTimeout(() => bail(1), 2000);
+    " "$PORT" 2>/dev/null; then
+        echo "Dovecot is ready"
+        break
+    fi
+    if [ "$i" = 30 ]; then
+        echo "Dovecot container did not become ready" >&2
+        docker logs "$CONTAINER_NAME" >&2 || true
+        exit 1
+    fi
+    sleep 1
+done
+
+cd "$PROJECT_DIR"
+IMAPFLOW_TEST_HOST=127.0.0.1 IMAPFLOW_TEST_PORT="$PORT" npx nodeunit test/integration/rev2-live-test.js

package/test/reliability-improvements-test.js

@@ -204,7 +204,10 @@ module.exports['Reliability: per-call maxLockHoldTime overrides constructor opti
     let lock = await client.getMailboxLock('INBOX', { maxLockHoldTime: 20 });
     await new Promise(r => setTimeout(r, 50));
 
-    test.ok(warnings.some(w => w && w.msg === 'Mailbox lock held for a long time'), 'Per-call override must take effect');
+    test.ok(
+        warnings.some(w => w && w.msg === 'Mailbox lock held for a long time'),
+        'Per-call override must take effect'
+    );
 
     lock.release();
     await drain();

package/test/search-compiler-test.js

@@ -191,6 +191,25 @@ module.exports['Search Compiler: RECENT flag'] = test => {
     test.done();
 };
 
+module.exports['Search Compiler: NEW/OLD/RECENT throw on rev2 sessions'] = test => {
+    // IMAP4rev2 (RFC 9051) removed the \Recent flag and these search keys -
+    // a rev2 server would reject the whole search with a tagged BAD
+    let connection = createMockConnection({ enabled: ['IMAP4REV2'] });
+    for (let key of ['new', 'old', 'recent']) {
+        try {
+            searchCompiler(connection, { [key]: true });
+            test.ok(false, `Should have thrown for ${key}`);
+        } catch (err) {
+            test.equal(err.code, 'MissingServerExtension');
+        }
+    }
+    // Falsy values compile to nothing and must not throw
+    test.equal(searchCompiler(connection, { recent: false }).length, 0);
+    // ALL is still part of the rev2 grammar
+    test.ok(hasAttr(searchCompiler(connection, { all: true }), 'ALL'));
+    test.done();
+};
+
 module.exports['Search Compiler: Simple flags ignored when falsy'] = test => {
     let connection = createMockConnection();
     let compiled = searchCompiler(connection, {