imapflow 1.4.8 → 1.5.0

package/test/connection-edge-cases-test.js

@@ -608,46 +608,10 @@ module.exports['Connection Edge: Race condition in mailbox lock'] = test => {
     });
 };
 
-module.exports['Connection Edge: Capability update after STARTTLS'] = test => {
-    let client = new ImapFlow({
-        host: 'imap.example.com',
-        port: 143,
-        auth: { user: 'test', pass: 'test' }
-    });
-
-    // Mock capabilities
-    client.capabilities = new Map();
-    client.capabilities.set('STARTTLS', true);
-
-    // Mock run method
-    client.run = async command => {
-        if (command === 'STARTTLS') {
-            client.expectCapabilityUpdate = true;
-            return true;
-        }
-        if (command === 'CAPABILITY') {
-            return true;
-        }
-    };
-
-    // Mock socket upgrade
-    client.socket = new EventEmitter();
-    client.socket.unpipe = () => {};
-    client.streamer = new EventEmitter();
-
-    // Override the upgradeToSTARTTLS to test capability update
-    client
-        .upgradeToSTARTTLS()
-        .then(result => {
-            test.ok(result, 'Should successfully upgrade to TLS');
-            test.ok(client.expectCapabilityUpdate, 'Should expect capability update');
-            test.done();
-        })
-        .catch(() => {
-            // Expected for this mock setup
-            test.done();
-        });
-};
+// NB! the capability discard/re-fetch behavior around STARTTLS is asserted end to
+// end in imap-flow-secure-test.js ('Secure: STARTTLS upgrade completes a session',
+// PRETLS-ONLY/POSTTLS-ONLY markers) - a mocked upgradeToSTARTTLS cannot reach the
+// re-fetch code without a real TLS handshake, so no vacuous variant is kept here.
 
 module.exports['Connection Edge: Event handlers attached before piping'] = test => {
     let client = new ImapFlow({

package/test/fixtures/test-tls.js

@@ -3,6 +3,6 @@
 // Self-signed certificate + key for in-process TLS/STARTTLS mock servers in tests.
 // Generated once with: openssl req -x509 -newkey rsa:2048 -nodes -subj "/CN=localhost"
 module.exports = {
-    cert: "-----BEGIN CERTIFICATE-----\nMIIDCTCCAfGgAwIBAgIUQSc0WP7RlcOqGCdsMaxzCA97mfkwDQYJKoZIhvcNAQEL\nBQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI2MDYwODA0Mzg1NFoXDTM2MDYw\nNTA0Mzg1NFowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEA4TYnyK2nEn6wXEgVeEI3I9CDlONvWDO1Y51mslOaUwZR\nfuZp3YMUZDINNdZuFrREkD1WJfClRZtDKEurw9FfjEfA0gsM9RPvkQYXZ2zzhXgW\nx86li0Ra/Zx2RmajsWc+THTEpdOK0nqOqMMKFxiYJ7E+KiJY0X6HqKjdaB9CpZv7\nA1ROJoLjTnsdDG/NT9MCQxFbw05N2Bbbq+McKyXIEzxiZguYLIXsMKCi9MQOozvY\nT8X0AFWpFJCa8mRCW7LQngeSRQQckDONzHyELXnbvgIskr/WcmBEXMraTts3Z3QW\nouee6HFnYzi/pgCtVKX1Wu3oZm/nMblsWtopqg/YDwIDAQABo1MwUTAdBgNVHQ4E\nFgQUF5oycZ3ZaPs1fTaxZb666FQt+KcwHwYDVR0jBBgwFoAUF5oycZ3ZaPs1fTax\nZb666FQt+KcwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAWFk0\nMGw2pdkeU/s5j0T9GL8GjbOVC0G7H8tlx92XhQICmt/9GNHeb5nm84DgqRbkiTwS\nOXPoMsSvVEubnX0j/sqcbi5yQ6/YBG6Vx5E9CnfUbo4m9x1GofDkLdl+e6l636Mj\nWB5kJpNCH9sm2xPdLpl47pv/lwvyYjdy1DaATHn5nMGoM73IeEt0d4xoNN8Bso7B\nTTkjKRJ1QWgI2EjgU93x8tG4AqTj0CeH8Z6DDmfLhvJ6E0hSws4OQSnxWudh2aX8\niN+FkHgRobPS1GVCtibr+FxH1DtBv/grXhAbs4xP3Nf3m3Pn6AE0/lMtto3e67As\np4lf866gU9nbRkODqw==\n-----END CERTIFICATE-----\n",
-    key: "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDhNifIracSfrBc\nSBV4Qjcj0IOU429YM7VjnWayU5pTBlF+5mndgxRkMg011m4WtESQPVYl8KVFm0Mo\nS6vD0V+MR8DSCwz1E++RBhdnbPOFeBbHzqWLRFr9nHZGZqOxZz5MdMSl04rSeo6o\nwwoXGJgnsT4qIljRfoeoqN1oH0Klm/sDVE4mguNOex0Mb81P0wJDEVvDTk3YFtur\n4xwrJcgTPGJmC5gshewwoKL0xA6jO9hPxfQAVakUkJryZEJbstCeB5JFBByQM43M\nfIQtedu+AiySv9ZyYERcytpO2zdndBai557ocWdjOL+mAK1UpfVa7ehmb+cxuWxa\n2imqD9gPAgMBAAECggEACgBGqgG+0/JuUIV0S/UyJP6t098kYwKrgR33S99XO21M\nvIRCRUT8kyp/La81D6sNCb6/jvXDJnaA9/l29OjdA7TCr6aFT8jahafYmDjdY5rz\n9Vw25nAFqRIuqm0FGJa2Id0O8oeUuEjFrGGPltD6c3Yf2u0li+rA3tDeQYZ0hjge\nsVXzgI58SbO1Z1XCAXcdbcJOqjpEJ3w99GB5J/B1dDui3KR5Q6+L34HfoW8XmY/X\nCLe+Jcuk06Xa31iZ+0NEMIPOhVoCW//PfgEWD/dfG3jXhk84/Pb8DXaGahOvRPTY\nH1AVrqRBqW6PezR4qU4PdUfU3sp5NEBZl3oaW7/weQKBgQD8CKI7ek00KUhc9j5m\nHGuSR+lUzLziXRBt7xw0JXLa1rfok2RGDeTdIEGSjBr8xsNOe5aga843geoLptNe\n7LRrtJajgHl39NXnblroNidufmXjt9CRgjUsQuIREpjq9NyUGIh8o26/uZLB/Knq\nJ7Uum9YUHI/eEztmI/CZDbnUbQKBgQDkwXaf5UxkY9tsdbw8jHhV5Ypy/hwLXAcI\n90sCI9/mSQAOA9qNa+944MbRfReTseM+OFXHJRHXfuMXPPOrtObtVN94ECwFVePO\n2MI5CHc/SYZ/4Icf+jpPY+TAJtEW/39muwak43cmLhmrSmb9ExMhwfDoQotFBDOQ\nLyPPfMo46wKBgFwpWBHB1kt1sSV1UjoKuHdkXnmI6KUp/OEGZ9zVuNs3W0br5uYL\nHJ6Ttga9vvyiPjcL0HfXFDCODCS4m2CB1DPydIdTapen6zRW0V1KuD6ab+3GgLlE\n0ObfikVN9KcuZR6unfJd3Ri05mqTVxrt7D4f9DekfiNqCvV9vPRq5YI9AoGBAMeS\nYUOucK9EzzIYpVjN1E5cLCWWvDDM4PZZiP8c/UGTfpC7m/i1qf7zW4F4eRFJqM+n\npm5PUPmIoeasLoonETENUskUktM008KqKQhI8oAsTUNTR5AGZsjMhc1+D/zYevXN\nRUaljFWq8ooWJzOzaIWTBfIb3BUiTToFZmCmpmZxAoGAH2W3eDhuKrsE50ntofhZ\nx9Uy0OD30nztyecen26kuljcX7qdWh564mBob75wGSAoYzGSePZjJ/tQ4FznXUes\n6F4gM8Y58d3YZOjNq3xnT7AfaJHNnnjxA4pfnGRVr3wA2vwyrD3McgAPXf+mnB23\nl8nz6wxk97WnaIyo7Ofi/+A=\n-----END PRIVATE KEY-----\n"
+    cert: '-----BEGIN CERTIFICATE-----\nMIIDCTCCAfGgAwIBAgIUQSc0WP7RlcOqGCdsMaxzCA97mfkwDQYJKoZIhvcNAQEL\nBQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI2MDYwODA0Mzg1NFoXDTM2MDYw\nNTA0Mzg1NFowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEA4TYnyK2nEn6wXEgVeEI3I9CDlONvWDO1Y51mslOaUwZR\nfuZp3YMUZDINNdZuFrREkD1WJfClRZtDKEurw9FfjEfA0gsM9RPvkQYXZ2zzhXgW\nx86li0Ra/Zx2RmajsWc+THTEpdOK0nqOqMMKFxiYJ7E+KiJY0X6HqKjdaB9CpZv7\nA1ROJoLjTnsdDG/NT9MCQxFbw05N2Bbbq+McKyXIEzxiZguYLIXsMKCi9MQOozvY\nT8X0AFWpFJCa8mRCW7LQngeSRQQckDONzHyELXnbvgIskr/WcmBEXMraTts3Z3QW\nouee6HFnYzi/pgCtVKX1Wu3oZm/nMblsWtopqg/YDwIDAQABo1MwUTAdBgNVHQ4E\nFgQUF5oycZ3ZaPs1fTaxZb666FQt+KcwHwYDVR0jBBgwFoAUF5oycZ3ZaPs1fTax\nZb666FQt+KcwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAWFk0\nMGw2pdkeU/s5j0T9GL8GjbOVC0G7H8tlx92XhQICmt/9GNHeb5nm84DgqRbkiTwS\nOXPoMsSvVEubnX0j/sqcbi5yQ6/YBG6Vx5E9CnfUbo4m9x1GofDkLdl+e6l636Mj\nWB5kJpNCH9sm2xPdLpl47pv/lwvyYjdy1DaATHn5nMGoM73IeEt0d4xoNN8Bso7B\nTTkjKRJ1QWgI2EjgU93x8tG4AqTj0CeH8Z6DDmfLhvJ6E0hSws4OQSnxWudh2aX8\niN+FkHgRobPS1GVCtibr+FxH1DtBv/grXhAbs4xP3Nf3m3Pn6AE0/lMtto3e67As\np4lf866gU9nbRkODqw==\n-----END CERTIFICATE-----\n',
+    key: '-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDhNifIracSfrBc\nSBV4Qjcj0IOU429YM7VjnWayU5pTBlF+5mndgxRkMg011m4WtESQPVYl8KVFm0Mo\nS6vD0V+MR8DSCwz1E++RBhdnbPOFeBbHzqWLRFr9nHZGZqOxZz5MdMSl04rSeo6o\nwwoXGJgnsT4qIljRfoeoqN1oH0Klm/sDVE4mguNOex0Mb81P0wJDEVvDTk3YFtur\n4xwrJcgTPGJmC5gshewwoKL0xA6jO9hPxfQAVakUkJryZEJbstCeB5JFBByQM43M\nfIQtedu+AiySv9ZyYERcytpO2zdndBai557ocWdjOL+mAK1UpfVa7ehmb+cxuWxa\n2imqD9gPAgMBAAECggEACgBGqgG+0/JuUIV0S/UyJP6t098kYwKrgR33S99XO21M\nvIRCRUT8kyp/La81D6sNCb6/jvXDJnaA9/l29OjdA7TCr6aFT8jahafYmDjdY5rz\n9Vw25nAFqRIuqm0FGJa2Id0O8oeUuEjFrGGPltD6c3Yf2u0li+rA3tDeQYZ0hjge\nsVXzgI58SbO1Z1XCAXcdbcJOqjpEJ3w99GB5J/B1dDui3KR5Q6+L34HfoW8XmY/X\nCLe+Jcuk06Xa31iZ+0NEMIPOhVoCW//PfgEWD/dfG3jXhk84/Pb8DXaGahOvRPTY\nH1AVrqRBqW6PezR4qU4PdUfU3sp5NEBZl3oaW7/weQKBgQD8CKI7ek00KUhc9j5m\nHGuSR+lUzLziXRBt7xw0JXLa1rfok2RGDeTdIEGSjBr8xsNOe5aga843geoLptNe\n7LRrtJajgHl39NXnblroNidufmXjt9CRgjUsQuIREpjq9NyUGIh8o26/uZLB/Knq\nJ7Uum9YUHI/eEztmI/CZDbnUbQKBgQDkwXaf5UxkY9tsdbw8jHhV5Ypy/hwLXAcI\n90sCI9/mSQAOA9qNa+944MbRfReTseM+OFXHJRHXfuMXPPOrtObtVN94ECwFVePO\n2MI5CHc/SYZ/4Icf+jpPY+TAJtEW/39muwak43cmLhmrSmb9ExMhwfDoQotFBDOQ\nLyPPfMo46wKBgFwpWBHB1kt1sSV1UjoKuHdkXnmI6KUp/OEGZ9zVuNs3W0br5uYL\nHJ6Ttga9vvyiPjcL0HfXFDCODCS4m2CB1DPydIdTapen6zRW0V1KuD6ab+3GgLlE\n0ObfikVN9KcuZR6unfJd3Ri05mqTVxrt7D4f9DekfiNqCvV9vPRq5YI9AoGBAMeS\nYUOucK9EzzIYpVjN1E5cLCWWvDDM4PZZiP8c/UGTfpC7m/i1qf7zW4F4eRFJqM+n\npm5PUPmIoeasLoonETENUskUktM008KqKQhI8oAsTUNTR5AGZsjMhc1+D/zYevXN\nRUaljFWq8ooWJzOzaIWTBfIb3BUiTToFZmCmpmZxAoGAH2W3eDhuKrsE50ntofhZ\nx9Uy0OD30nztyecen26kuljcX7qdWh564mBob75wGSAoYzGSePZjJ/tQ4FznXUes\n6F4gM8Y58d3YZOjNq3xnT7AfaJHNnnjxA4pfnGRVr3wA2vwyrD3McgAPXf+mnB23\nl8nz6wxk97WnaIyo7Ofi/+A=\n-----END PRIVATE KEY-----\n'
 };

package/test/handler-branches-test.js

@@ -115,8 +115,9 @@ module.exports['imap-compiler: synchronizing literal with non-buffer value seeds
                 {
                     tag: '*',
                     command: 'CMD',
-                    // value is an object that is neither string/number/Buffer but has a numeric
-                    // length, so literalLength resolves to 10 while formatRespEntry(value, true)
+                    // value is an object that is neither string/number/Buffer, so the size
+                    // marker derives from the UTF-8 byte length of its stringified form
+                    // ('[object Object]', 15 bytes) while formatRespEntry(value, true)
                     // returns null -> the seeded resp falls back to [] (line 156 right side).
                     attributes: [{ type: 'LITERAL', value: { length: 10 } }]
                 },
@@ -125,7 +126,7 @@ module.exports['imap-compiler: synchronizing literal with non-buffer value seeds
         ).map(entry => entry.toString());
         // Only the header segment is emitted; the empty seeded data segment is dropped
         // because `if (resp.length)` is false at the end.
-        test.deepEqual(out, ['* CMD {10}\r\n']);
+        test.deepEqual(out, ['* CMD {15}\r\n']);
     });
 
 // STRING node with falsy value -> `(node.value || '')` right side (line 165).

package/test/imap-compiler-test.js

@@ -362,6 +362,91 @@ module.exports['IMAP Compiler: LITERAL literal8'] = test =>
         )
     );
 
+// RFC 7888 (folded into IMAP4rev2): with LITERAL- a non-synchronizing literal
+// marker {n+} is only allowed for literals of up to 4096 bytes - anything larger
+// must use the synchronizing {n} form, in every compilation mode
+module.exports['IMAP Compiler: LITERAL- oversized literal stays synchronizing in single-buffer mode'] = test =>
+    asyncWrapper(test, async test => {
+        let payload = 'a'.repeat(4097);
+        let compiled = (
+            await compiler(
+                {
+                    tag: '*',
+                    command: 'CMD',
+                    attributes: [
+                        {
+                            type: 'LITERAL',
+                            value: payload
+                        }
+                    ]
+                },
+                { literalMinus: true }
+            )
+        ).toString();
+        test.ok(compiled.startsWith('* CMD {4097}\r\n'), `must not use a non-synchronizing marker: ${compiled.slice(0, 20)}`);
+    });
+
+module.exports['IMAP Compiler: LITERAL- boundary: exactly 4096 bytes is non-synchronizing'] = test =>
+    asyncWrapper(test, async test => {
+        let payload = 'a'.repeat(4096);
+        let parts = (
+            await compiler(
+                {
+                    tag: '*',
+                    command: 'CMD',
+                    attributes: [
+                        {
+                            type: 'LITERAL',
+                            value: payload
+                        }
+                    ]
+                },
+                { asArray: true, literalMinus: true }
+            )
+        ).map(entry => entry.toString());
+        test.equal(parts.length, 1, 'literal must be appended inline without a continuation break');
+        test.ok(parts[0].startsWith('* CMD {4096+}\r\n'));
+    });
+
+module.exports['IMAP Compiler: LITERAL- boundary: 4097 bytes falls back to synchronizing'] = test =>
+    asyncWrapper(test, async test => {
+        let payload = 'a'.repeat(4097);
+        let parts = (
+            await compiler(
+                {
+                    tag: '*',
+                    command: 'CMD',
+                    attributes: [
+                        {
+                            type: 'LITERAL',
+                            value: payload
+                        }
+                    ]
+                },
+                { asArray: true, literalMinus: true }
+            )
+        ).map(entry => entry.toString());
+        test.equal(parts.length, 2, 'literal must wait for a continuation response');
+        test.ok(parts[0].endsWith('{4097}\r\n'), `marker must be synchronizing: ${parts[0].slice(-12)}`);
+    });
+
+// The literal size marker counts octets, not UTF-16 code units - a unicode string
+// value must declare its UTF-8 byte length
+module.exports['IMAP Compiler: LITERAL declares byte length for unicode string values'] = test =>
+    asyncWrapper(test, async test => {
+        let compiled = await compiler({
+            tag: '*',
+            command: 'CMD',
+            attributes: [
+                {
+                    type: 'LITERAL',
+                    value: 'Sõnumid'
+                }
+            ]
+        });
+        test.equal(compiled.toString(), '* CMD {8}\r\nSõnumid');
+    });
+
 module.exports['IMAP Compiler: LITERAL array 1'] = test =>
     asyncWrapper(test, async test =>
         test.deepEqual(

package/test/imap-flow-coverage-test.js

@@ -553,7 +553,14 @@ module.exports['Coverage: reader handles compiler failure when building executed
     client.requestTagMap.set('A1', {
         command: 'NOOP',
         // a circular/odd attribute that makes the logging compiler throw
-        attributes: [{ type: 'LITERAL', get value() { throw new Error('compile boom'); } }],
+        attributes: [
+            {
+                type: 'LITERAL',
+                get value() {
+                    throw new Error('compile boom');
+                }
+            }
+        ],
         options: {},
         resolve: () => {},
         reject: err => {

package/test/imap-flow-fetch-download-test.js

@@ -300,6 +300,62 @@ module.exports['Download: base64 body part is decoded'] = async test => {
     test.done();
 };
 
+module.exports['Download: binary-fetched part skips the client-side transfer decoding'] = async test => {
+    let client = makeClient();
+    // BINARY fetch (RFC 3516, FETCH side folded into IMAP4rev2): the server
+    // decodes the content-transfer-encoding itself, so the client gets raw bytes
+    // even though the MIME headers still declare base64 - decoding again would
+    // corrupt the data. formatMessageResponse records the parts that arrived via
+    // BINARY[...] in the binaryParts set, which the mock mirrors here.
+    let mime = Buffer.from('Content-Type: text/plain\r\nContent-Transfer-Encoding: base64\r\n\r\n');
+    let decoded = Buffer.from('Hello World');
+    client.fetchOne = async () => {
+        let bodyParts = new Map();
+        bodyParts.set('2.mime', mime);
+        bodyParts.set('2', decoded);
+        return { uid: 1, size: decoded.length, bodyParts, binaryParts: new Set(['2']) };
+    };
+    let { meta, content } = await client.download('1', '2', { chunkSize: 1024, binary: true });
+    test.equal(meta.encoding, 'base64');
+    let data = await collect(content);
+    test.equal(data.toString(), 'Hello World');
+    test.done();
+};
+
+module.exports['DownloadMany: binary-fetched parts skip the client-side transfer decoding'] = async test => {
+    let client = makeClient();
+    let mime = Buffer.from('Content-Type: text/plain\r\nContent-Transfer-Encoding: base64\r\n\r\n');
+    client.fetchOne = async () => {
+        let bodyParts = new Map();
+        bodyParts.set('2.mime', mime);
+        bodyParts.set('2', Buffer.from('part two'));
+        return { uid: 1, bodyParts, binaryParts: new Set(['2']) };
+    };
+    let res = await client.downloadMany('1', ['2'], { binary: true });
+    test.equal(res['2'].content.toString(), 'part two');
+    test.equal(res['2'].meta.encoding, 'base64');
+    test.done();
+};
+
+module.exports['Download: BODY-answered part is still decoded even when binary was requested'] = async test => {
+    let client = makeClient();
+    // RFC 3516 lets a server answer a BINARY request with a NO or a BODY response
+    // (e.g. [UNKNOWN-CTE]) - decoding must follow what actually arrived, so a part
+    // absent from binaryParts gets the client-side decoder despite options.binary
+    let mime = Buffer.from('Content-Type: text/plain\r\nContent-Transfer-Encoding: base64\r\n\r\n');
+    let encoded = Buffer.from(libbase64.encode(Buffer.from('Hello World')));
+    client.fetchOne = async () => {
+        let bodyParts = new Map();
+        bodyParts.set('2.mime', mime);
+        bodyParts.set('2', encoded);
+        return { uid: 1, size: encoded.length, bodyParts };
+    };
+    let { content } = await client.download('1', '2', { chunkSize: 1024, binary: true });
+    let data = await collect(content);
+    test.equal(data.toString(), 'Hello World');
+    test.done();
+};
+
 module.exports['Download: quoted-printable inline text with charset + filename'] = async test => {
     let client = makeClient();
     let mime = Buffer.from(
@@ -624,10 +680,7 @@ module.exports['DownloadMany: returns {response:false} when no bodyParts'] = asy
 
 module.exports['DownloadMany: parses charset, flowed and name params'] = async test => {
     let client = makeClient();
-    let mime = Buffer.from(
-        'Content-Type: text/plain; charset=iso-8859-1; format=flowed; delsp=yes; name="x.txt"\r\n' +
-            'Content-Disposition: inline\r\n\r\n'
-    );
+    let mime = Buffer.from('Content-Type: text/plain; charset=iso-8859-1; format=flowed; delsp=yes; name="x.txt"\r\nContent-Disposition: inline\r\n\r\n');
     client.fetchOne = async () => {
         let bodyParts = new Map();
         bodyParts.set('2.mime', mime);

package/test/imap-flow-internals-test.js

@@ -355,7 +355,7 @@ module.exports['Internals: secure connection defaults to port 993'] = test => {
 
 module.exports['Internals: getUntaggedHandler ignores non-string type token'] = test => {
     let client = makeClient();
-    client.untaggedHandlers = { '5': () => 'numeric-keyword-handler' };
+    client.untaggedHandlers = { 5: () => 'numeric-keyword-handler' };
     // numeric prefix but attributes[0].value is not a string -> keyword stays '5'
     let handler = client.getUntaggedHandler('5', [{ type: 'ATOM', value: 12345 }]);
     test.equal(handler(), 'numeric-keyword-handler');
@@ -409,7 +409,7 @@ module.exports['Internals: unbind falls back to socket when writeSocket missing'
     };
     client.socket = raw;
     client.writeSocket = null;
-    client.streamer = { /* unused here */ };
+    client.streamer = {/* unused here */};
     let result = client.unbind();
     test.equal(result.writeSocket, raw);
     test.done();

package/test/imap-flow-methods-test.js

@@ -96,6 +96,19 @@ module.exports['Methods: listTree returns tree structure'] = async test => {
     test.done();
 };
 
+module.exports['Methods: listTree passes through inline status objects'] = async test => {
+    let client = makeClient();
+    recordRun(client, [
+        { path: 'INBOX', name: 'INBOX', delimiter: '/', parent: [], flags: new Set(), status: { path: 'INBOX', messages: 5, unseen: 2 } },
+        { path: 'INBOX/Sub', name: 'Sub', delimiter: '/', parent: ['INBOX'], flags: new Set() }
+    ]);
+    let tree = await client.listTree({ statusQuery: { messages: true, unseen: true } });
+    // The StatusObject must survive into the tree node - it used to be coerced
+    // into a boolean by the tree builder
+    test.deepEqual(tree.folders[0].status, { path: 'INBOX', messages: 5, unseen: 2 });
+    test.done();
+};
+
 module.exports['Methods: noop dispatches NOOP'] = async test => {
     let client = makeClient();
     let calls = recordRun(client, true);
@@ -721,12 +734,7 @@ module.exports['Methods: untaggedFetch emits flags event'] = async test => {
         command: '1',
         attributes: [
             { type: 'ATOM', value: 'FETCH' },
-            [
-                { type: 'ATOM', value: 'UID' },
-                { type: 'ATOM', value: '100' },
-                { type: 'ATOM', value: 'FLAGS' },
-                [{ type: 'ATOM', value: '\\Seen' }]
-            ]
+            [{ type: 'ATOM', value: 'UID' }, { type: 'ATOM', value: '100' }, { type: 'ATOM', value: 'FLAGS' }, [{ type: 'ATOM', value: '\\Seen' }]]
         ]
     };
     await client.untaggedFetch(untagged);
@@ -736,3 +744,54 @@ module.exports['Methods: untaggedFetch emits flags event'] = async test => {
     test.ok(evt.flags.has('\\Seen'));
     test.done();
 };
+
+// ============================================
+// autoEnable
+// ============================================
+
+module.exports['Methods: autoEnable requests IMAP4rev2 alongside the base extensions'] = async test => {
+    let client = makeClient();
+    let calls = recordRun(client, new Set(['CONDSTORE', 'IMAP4REV2']));
+    await client.autoEnable();
+    test.equal(calls.length, 1);
+    test.deepEqual(calls[0], ['ENABLE', ['CONDSTORE', 'UTF8=ACCEPT', 'IMAP4rev2']]);
+    test.done();
+};
+
+module.exports['Methods: autoEnable honors disableIMAP4rev2'] = async test => {
+    let client = makeClient({ disableIMAP4rev2: true });
+    let calls = recordRun(client, new Set(['CONDSTORE']));
+    await client.autoEnable();
+    test.equal(calls.length, 1);
+    test.deepEqual(calls[0], ['ENABLE', ['CONDSTORE', 'UTF8=ACCEPT']]);
+    test.done();
+};
+
+module.exports['Methods: autoEnable includes QRESYNC when requested'] = async test => {
+    let client = makeClient({ qresync: true });
+    let calls = recordRun(client, new Set(['CONDSTORE', 'QRESYNC', 'IMAP4REV2']));
+    await client.autoEnable();
+    test.equal(calls.length, 1);
+    test.deepEqual(calls[0], ['ENABLE', ['CONDSTORE', 'UTF8=ACCEPT', 'QRESYNC', 'IMAP4rev2']]);
+    test.done();
+};
+
+module.exports['Methods: autoEnable retries without IMAP4rev2 when the whole command fails'] = async test => {
+    let client = makeClient();
+    // RFC 5161 requires unknown ENABLE arguments to be ignored, but a broken
+    // server may reject the whole command over IMAP4rev2 - the retry keeps
+    // CONDSTORE/UTF8=ACCEPT from being lost as collateral damage
+    let calls = recordRun(client, (cmd, list) => (list.includes('IMAP4rev2') ? false : new Set(['CONDSTORE'])));
+    await client.autoEnable();
+    test.equal(calls.length, 2);
+    test.deepEqual(calls[1], ['ENABLE', ['CONDSTORE', 'UTF8=ACCEPT']]);
+    test.done();
+};
+
+module.exports['Methods: autoEnable does not retry when disableIMAP4rev2 already omitted it'] = async test => {
+    let client = makeClient({ disableIMAP4rev2: true });
+    let calls = recordRun(client, () => false);
+    await client.autoEnable();
+    test.equal(calls.length, 1);
+    test.done();
+};

package/test/imap-flow-secure-test.js

@@ -13,13 +13,17 @@ const CAPS = 'IMAP4rev1 ID ENABLE NAMESPACE';
 
 // Shared per-connection IMAP line handler used by both the plaintext and the
 // upgraded TLS phases. Returns responses for the minimal session commands.
-const handleLine = (sock, line, onStartTls) => {
+// `caps` is the full capability list to advertise for this phase - the STARTTLS
+// test uses different pre- and post-TLS sets to prove the client discards the
+// plaintext capabilities and re-fetches them over TLS (RFC 9051 6.2.1).
+const handleLine = (sock, line, onStartTls, caps) => {
+    caps = caps || `${CAPS} STARTTLS`;
     let parts = line.split(' ');
     let tag = parts[0];
     let cmd = (parts[1] || '').toUpperCase();
     switch (cmd) {
         case 'CAPABILITY':
-            sock.write(`* CAPABILITY ${CAPS} STARTTLS\r\n${tag} OK CAPABILITY done\r\n`);
+            sock.write(`* CAPABILITY ${caps}\r\n${tag} OK CAPABILITY done\r\n`);
             break;
         case 'STARTTLS':
             sock.write(`${tag} OK Begin TLS\r\n`);
@@ -81,17 +85,23 @@ module.exports['Secure: STARTTLS upgrade completes a session'] = async test => {
 
         let detachPlain;
         detachPlain = lineReader(rawSocket, line => {
-            handleLine(rawSocket, line, () => {
-                // Upgrade: stop reading plaintext, wrap the socket in TLS
-                detachPlain();
-                let tlsSocket = new tls.TLSSocket(rawSocket, { isServer: true, key, cert });
-                tlsSocket.on('error', () => {});
-                tlsSocket.on('secure', () => {});
-                lineReader(tlsSocket, l => handleLine(tlsSocket, l));
-            });
+            handleLine(
+                rawSocket,
+                line,
+                () => {
+                    // Upgrade: stop reading plaintext, wrap the socket in TLS
+                    detachPlain();
+                    let tlsSocket = new tls.TLSSocket(rawSocket, { isServer: true, key, cert });
+                    tlsSocket.on('error', () => {});
+                    tlsSocket.on('secure', () => {});
+                    // post-TLS phase advertises a different capability set
+                    lineReader(tlsSocket, l => handleLine(tlsSocket, l, null, `${CAPS} POSTTLS-ONLY`));
+                },
+                `${CAPS} STARTTLS PRETLS-ONLY`
+            );
         });
 
-        rawSocket.write(`* OK [CAPABILITY ${CAPS} STARTTLS] ready\r\n`);
+        rawSocket.write(`* OK [CAPABILITY ${CAPS} STARTTLS PRETLS-ONLY] ready\r\n`);
     });
 
     let port = await listen(server);
@@ -113,6 +123,10 @@ module.exports['Secure: STARTTLS upgrade completes a session'] = async test => {
     test.ok(client.secureConnection, 'connection upgraded to TLS');
     test.ok(client.authenticated, 'authenticated over TLS');
     test.ok(client.usable);
+    // RFC 9051 6.2.1: capabilities cached before STARTTLS MUST be discarded and
+    // re-fetched over the TLS channel
+    test.ok(client.capabilities.has('POSTTLS-ONLY'), 'post-TLS capabilities were re-fetched');
+    test.ok(!client.capabilities.has('PRETLS-ONLY'), 'pre-TLS capabilities were discarded');
 
     await client.noop();
     await client.logout();

package/test/imap-flow-server-test.js

@@ -797,6 +797,8 @@ module.exports['Server: PREAUTH greeting skips login'] = async test => {
     await client.connect();
     test.equal(client.state, client.states.AUTHENTICATED);
     test.ok(client.usable);
+    // documented contract: `true` if the connection was authenticated by PREAUTH
+    test.strictEqual(client.authenticated, true);
 
     await client.logout();
     client.close();
@@ -845,6 +847,84 @@ module.exports['Server: unsolicited EXISTS and VANISHED reach the untagged handl
     test.done();
 };
 
+module.exports['Server: rev2-shaped SELECT response is tolerated through the full pipeline'] = async test => {
+    // RFC 9051 requires rev2 servers to include an untagged LIST in the SELECT
+    // response and a CLOSED response code when another mailbox was selected, and
+    // to omit RECENT/UNSEEN. The client must consume such a response cleanly.
+    let server = createServer({
+        capabilities: 'IMAP4rev2 ID ENABLE NAMESPACE',
+        handlers: {
+            SELECT(ctx) {
+                ctx.write('* OK [CLOSED] Previous mailbox closed\r\n');
+                ctx.write('* 3 EXISTS\r\n');
+                ctx.write('* LIST () "/" INBOX\r\n');
+                ctx.write('* FLAGS (\\Seen \\Answered \\Flagged \\Deleted \\Draft)\r\n');
+                ctx.write('* OK [PERMANENTFLAGS (\\Seen \\*)] Limited\r\n');
+                ctx.write('* OK [UIDVALIDITY 12345] UIDs valid\r\n');
+                ctx.write('* OK [UIDNEXT 100] Predicted next UID\r\n');
+                ctx.ok('[READ-WRITE] SELECT completed');
+            }
+        }
+    });
+    let port = await listen(server);
+    let client = makeClient(port);
+    let errors = [];
+    client.on('error', err => errors.push(err));
+
+    await client.connect();
+    test.ok(client.capabilities.has('IMAP4rev2'));
+
+    let mailbox = await client.mailboxOpen('INBOX');
+    test.equal(mailbox.path, 'INBOX');
+    test.equal(mailbox.exists, 3);
+    test.equal(mailbox.uidNext, 100);
+    test.equal(mailbox.uidValidity, 12345n);
+
+    // re-select drives the CLOSED response code through the live pipeline again
+    let again = await client.mailboxOpen('INBOX');
+    test.equal(again.exists, 3);
+    test.equal(errors.length, 0, 'no errors from the rev2-shaped response');
+
+    await client.logout();
+    client.close();
+    server.close();
+    test.done();
+};
+
+module.exports['Server: unsolicited STATUS for another mailbox is tolerated'] = async test => {
+    // RFC 9051 (Appendix E item 20): with rev2, servers may push updates that are
+    // unrelated to the selected mailbox (e.g. a STATUS for another mailbox during
+    // IDLE). The client must ignore them without corrupting the selected state.
+    let server = createServer({
+        handlers: {
+            NOOP(ctx) {
+                ctx.write('* STATUS "Other" (MESSAGES 5 UNSEEN 1)\r\n');
+                ctx.ok('NOOP completed');
+            }
+        }
+    });
+    let port = await listen(server);
+    let client = makeClient(port);
+    let errors = [];
+    client.on('error', err => errors.push(err));
+
+    await client.connect();
+    await client.mailboxOpen('INBOX');
+    test.equal(client.mailbox.exists, 3);
+
+    await client.noop();
+    await new Promise(r => setTimeout(r, 20));
+
+    test.equal(client.mailbox.path, 'INBOX', 'selected mailbox unchanged');
+    test.equal(client.mailbox.exists, 3, 'selected mailbox message count unchanged');
+    test.equal(errors.length, 0, 'unsolicited STATUS must not raise errors');
+
+    await client.logout();
+    client.close();
+    server.close();
+    test.done();
+};
+
 module.exports['Server: invalid tagged response rejects with InvalidResponse'] = async test => {
     let server = createServer({
         handlers: {