imapflow 1.4.8 → 1.5.0

package/test/imap-parser-test.js

@@ -341,8 +341,7 @@ module.exports['IMAP Parser: empty continuation (+) response'] = test =>
         test.equal(parsed.command, '');
     });
 
-module.exports['IMAP Parser: non-space after command throws ParserError5'] = test =>
-    expectErrorCode(test, 'ParserError5', () => parser('TAG1 CMD\tx'));
+module.exports['IMAP Parser: non-space after command throws ParserError5'] = test => expectErrorCode(test, 'ParserError5', () => parser('TAG1 CMD\tx'));
 
 module.exports['IMAP Parser: leading whitespace in attributes throws ParserError7'] = test =>
     expectErrorCode(test, 'ParserError7', () => parser('TAG1 CMD \tx'));
@@ -436,6 +435,115 @@ module.exports['IMAP Parser: Literals: allow zero length literal in the end of a
         ])
     );
 
+module.exports['IMAP Parser: Literals: zero length literal keeps the literal queue aligned'] = test =>
+    asyncWrapper(test, async test =>
+        // ImapStream queues a Buffer for every literal marker it extracts, including
+        // {0}, so the parser must consume exactly one queue entry per marker.
+        // Otherwise every literal after a {0} in the same response is silently
+        // shifted to the wrong value (RFC 9051 4.3 allows {0} as an empty string).
+        test.deepEqual((await parser('TAG1 CMD ({0}\r\n {5}\r\n)', { literals: [Buffer.from(''), Buffer.from('hello')] })).attributes, [
+            [
+                {
+                    type: 'LITERAL',
+                    value: Buffer.from('')
+                },
+                {
+                    type: 'LITERAL',
+                    value: Buffer.from('hello')
+                }
+            ]
+        ])
+    );
+
+module.exports['IMAP Parser: Literals: zero length literal between literals keeps values aligned'] = test =>
+    asyncWrapper(test, async test =>
+        test.deepEqual(
+            (await parser('TAG1 CMD ({3}\r\n {0}\r\n {5}\r\n)', { literals: [Buffer.from('abc'), Buffer.from(''), Buffer.from('world')] })).attributes,
+            [
+                [
+                    {
+                        type: 'LITERAL',
+                        value: Buffer.from('abc')
+                    },
+                    {
+                        type: 'LITERAL',
+                        value: Buffer.from('')
+                    },
+                    {
+                        type: 'LITERAL',
+                        value: Buffer.from('world')
+                    }
+                ]
+            ]
+        )
+    );
+
+// RFC 9051 updated resp-text to allow empty text: resp-text = ["[" resp-text-code "]" SP] [text]
+module.exports['IMAP Parser: resp-text: bare OK with no text'] = test =>
+    asyncWrapper(test, async test => test.deepEqual(await parser('* OK'), { tag: '*', command: 'OK' }));
+
+module.exports['IMAP Parser: resp-text: tagged OK with no text'] = test =>
+    asyncWrapper(test, async test => test.deepEqual(await parser('TAG1 OK'), { tag: 'TAG1', command: 'OK' }));
+
+module.exports['IMAP Parser: resp-text: response code with no trailing text'] = test =>
+    asyncWrapper(test, async test => {
+        let parsed = await parser('* OK [UIDNEXT 5]');
+        test.equal(parsed.command, 'OK');
+        test.deepEqual(parsed.attributes, [
+            {
+                type: 'ATOM',
+                value: '',
+                section: [
+                    { type: 'ATOM', value: 'UIDNEXT' },
+                    { type: 'ATOM', value: '5' }
+                ]
+            }
+        ]);
+    });
+
+module.exports['IMAP Parser: resp-text: response code with trailing space and no text'] = test =>
+    asyncWrapper(test, async test => {
+        let parsed = await parser('* OK [READ-WRITE] ');
+        test.equal(parsed.command, 'OK');
+        test.deepEqual(parsed.attributes, [
+            {
+                type: 'ATOM',
+                value: '',
+                section: [{ type: 'ATOM', value: 'READ-WRITE' }]
+            }
+        ]);
+    });
+
+// RFC 9051 uses number64 (up to 2^63-1) for message and body sizes - values beyond
+// 2^32 must survive the tokenizer without truncation
+module.exports['IMAP Parser: number64: RFC822.SIZE beyond 32 bits'] = test =>
+    asyncWrapper(test, async test => {
+        let parsed = await parser('* 1 FETCH (RFC822.SIZE 12345678901234)');
+        test.deepEqual(parsed.attributes, [
+            { type: 'ATOM', value: 'FETCH' },
+            [
+                { type: 'ATOM', value: 'RFC822.SIZE' },
+                { type: 'ATOM', value: '12345678901234' }
+            ]
+        ]);
+    });
+
+module.exports['IMAP Parser: number64: response code argument beyond 32 bits'] = test =>
+    asyncWrapper(test, async test => {
+        let parsed = await parser('* OK [HIGHESTMODSEQ 90060115194045007] Ok');
+        test.deepEqual(parsed.attributes, [
+            {
+                type: 'ATOM',
+                value: '',
+                section: [
+                    { type: 'ATOM', value: 'HIGHESTMODSEQ' },
+                    { type: 'ATOM', value: '90060115194045007' }
+                ]
+            },
+            { type: 'TEXT', value: 'Ok' }
+        ]);
+    });
+
 module.exports['IMAP Parser: Section: empty'] = test =>
     asyncWrapper(test, async test =>
         test.deepEqual((await parser('TAG1 CMD BODY[]')).attributes, [
@@ -1285,7 +1393,9 @@ module.exports['IMAP Parser, FETCH with BODYSTRUCTURE'] = test =>
         ]);
     });
 
-module.exports['IMAP Parser, FETCH with BODYSTRUCTURE'] = test =>
+// NB! must not share a name with the deep-BODYSTRUCTURE test above - a duplicate
+// module.exports key silently overwrites the earlier test and it never runs
+module.exports['IMAP Parser, FETCH exceeding max nesting depth'] = test =>
     asyncWrapper(test, async test => {
         try {
             let parsed = await parser('* 1 FETCH (UID 1 (((((((((((((((((((((((((');

package/test/imap-stream-test.js

@@ -66,6 +66,52 @@ A LOGOUT
     writer().catch(err => test.ifError(err));
 };
 
+module.exports['Literal8 marker activates literal extraction'] = test => {
+    // RFC 9051 folds the FETCH side of BINARY into base IMAP4rev2 - servers answer
+    // BINARY fetches with literal8 syntax (~{n}) whose content may contain NULs.
+    // The stream must treat the trailing {n} as a literal marker regardless of the
+    // '~' prefix and hand the raw bytes over unmodified.
+    let input = Buffer.from('* 1 FETCH (BINARY[1] ~{5}\r\nhel\x00o)\r\n', 'binary');
+
+    let stream = new ImapStream();
+
+    let reading = false;
+    let reader = async () => {
+        let cmd;
+        while ((cmd = stream.read()) !== null) {
+            test.equal(cmd.payload.toString('binary'), '* 1 FETCH (BINARY[1] ~{5}\r\n)');
+            test.equal(cmd.literals.length, 1);
+            test.deepEqual(cmd.literals[0], Buffer.from('hel\x00o', 'binary'));
+
+            // and the parser consumes the literal8 into a LITERAL node with the NUL intact
+            let parsed = await parser(cmd.payload, { literals: cmd.literals });
+            test.deepEqual(parsed.attributes[1][1], { type: 'LITERAL', value: Buffer.from('hel\x00o', 'binary') });
+            cmd.next();
+        }
+    };
+
+    stream.on('readable', () => {
+        if (!reading) {
+            reading = true;
+            reader()
+                .catch(err => test.ifError(err))
+                .finally(() => {
+                    reading = false;
+                });
+        }
+    });
+
+    stream.on('error', err => {
+        test.ifError(err);
+    });
+
+    stream.on('end', () => {
+        test.done();
+    });
+
+    stream.end(input);
+};
+
 module.exports['Single byte'] = test => {
     let input = Buffer.from(
         `A CAPABILITY

package/test/integration/README.md

@@ -0,0 +1,52 @@
+# Live IMAP4rev2 integration tests
+
+Runs the ImapFlow client against a real IMAP4rev2 server - Dovecot 2.4+ in
+Docker - instead of protocol mocks. Covers the ENABLE IMAP4rev2 negotiation,
+LIST RETURN (SUBSCRIBED) without LSUB, subscription round-trips, UTF-8 mailbox
+names, inline LIST-STATUS (including the rev2 SIZE and DELETED status items),
+ESEARCH responses to plain SEARCH, STATUS SIZE/DELETED, the rev2-shaped SELECT
+response (untagged LIST, CLOSED on re-select), the folded-in FETCH BINARY,
+COPYUID from the untagged OK on MOVE, and a message lifecycle smoke test with
+UID EXPUNGE.
+
+## Running
+
+```
+npm run test:rev2
+```
+
+Requires Docker. The script pulls `dovecot/dovecot:2.4.4`, starts a container
+with the drop-in config from `dovecot-test.conf`, waits for the IMAP greeting
+on `127.0.0.1:31143`, runs `rev2-live-test.js` with nodeunit, and always
+removes the container afterwards.
+
+These tests are intentionally not part of `npm test` - the Gruntfile nodeunit
+config excludes `test/integration/**`, so plain test runs stay Docker-free.
+CI runs this suite in a dedicated `test-rev2` job on `ubuntu-latest` (amd64
+with Docker preinstalled), forcing `IMAPFLOW_DOVECOT_PLATFORM=linux/amd64` -
+that job is the authoritative linux/amd64 run, since Apple Silicon machines
+cannot execute the amd64 image (see below).
+
+If a local image for the configured tag exists but was pulled for a different
+architecture than the Docker host (e.g. an amd64 image left behind on an arm64
+host), the runner script detects the mismatch and re-pulls the host-native
+variant before starting the container.
+
+## Environment overrides
+
+- `IMAPFLOW_DOVECOT_IMAGE` - image to run (default `dovecot/dovecot:2.4.4`;
+  any 2.4.2+ tag supports IMAP4rev2)
+- `IMAPFLOW_DOVECOT_PLATFORM` - e.g. `linux/amd64`; defaults to the host
+  platform. Forcing `linux/amd64` on Apple Silicon does not work - Rosetta
+  cannot start Dovecot's privilege-separated login processes
+  (`rosetta error: mmap_anonymous_rw mmap failed`; reconfirmed with
+  dovecot/dovecot:2.4.4 in July 2026)
+- `IMAPFLOW_TEST_PORT` - host port to publish (default 31143)
+
+## Test account model
+
+The container uses Dovecot's static passdb (`USER_PASSWORD=pass`): any
+username authenticates with the password `pass` and gets its own empty mail
+home, so every test connects as a brand-new user and needs no cleanup between
+runs. Special-use mailboxes (Sent/Drafts/Junk/Trash) are auto-created and
+subscribed via `dovecot-test.conf`.

package/test/integration/dovecot-test.conf

@@ -0,0 +1,27 @@
+# Drop-in configuration for the ImapFlow IMAP4rev2 integration test container.
+# Mounted into /etc/dovecot/conf.d/ of the dovecot/dovecot:2.4.x image, which
+# already ships with imap4rev2_enable = yes and mail_utf8_extensions = yes.
+
+# The test client connects over plain TCP on the container-internal IMAP port
+# (31143), so cleartext logins must be allowed
+auth_allow_cleartext = yes
+
+# Special-use mailboxes, auto-created and subscribed for every test user
+namespace inbox {
+  mailbox Sent {
+    special_use = \Sent
+    auto = subscribe
+  }
+  mailbox Drafts {
+    special_use = \Drafts
+    auto = subscribe
+  }
+  mailbox Junk {
+    special_use = \Junk
+    auto = subscribe
+  }
+  mailbox Trash {
+    special_use = \Trash
+    auto = subscribe
+  }
+}

package/test/integration/rev2-live-test.js

@@ -0,0 +1,367 @@
+'use strict';
+
+// Live integration tests against a real IMAP4rev2 server (Dovecot 2.4+ in Docker).
+// Started via `npm run test:rev2` (see run-rev2-tests.sh) - excluded from the
+// Gruntfile nodeunit config so `npm test` stays Docker-free.
+//
+// The container uses a static passdb: any username logs in with the password
+// "pass", and every user gets a fresh mail home, so each test connects with a
+// unique user for isolation.
+
+const { ImapFlow } = require('../../lib/imap-flow');
+
+const HOST = process.env.IMAPFLOW_TEST_HOST || '127.0.0.1';
+const PORT = Number(process.env.IMAPFLOW_TEST_PORT) || 31143;
+
+let userCounter = 0;
+
+const connectClient = async (options, logs) => {
+    let client = new ImapFlow(
+        Object.assign(
+            {
+                host: HOST,
+                port: PORT,
+                secure: false,
+                // The test container upgrades via STARTTLS with a self-signed cert
+                tls: { rejectUnauthorized: false },
+                auth: { user: `livetest-${Date.now()}-${++userCounter}`, pass: 'pass' },
+                logger: false,
+                emitLogs: !!logs
+            },
+            options || {}
+        )
+    );
+    if (logs) {
+        client.on('log', entry => logs.push(entry));
+    }
+    await client.connect();
+    return client;
+};
+
+const wireLines = logs => logs.filter(entry => entry && typeof entry.msg === 'string' && ['c', 's'].includes(entry.src));
+const clientSent = (logs, needle) => wireLines(logs).some(entry => entry.src === 'c' && entry.msg.includes(needle));
+// Matches only an untagged response for the given command ("* ESEARCH ...").
+// A plain substring check would false-positive on capability listings - the
+// login response advertises tokens like ESEARCH in its CAPABILITY list.
+const serverSentUntagged = (logs, command) => {
+    let re = new RegExp(`^\\* ${command}( |$)`);
+    return wireLines(logs).some(entry => entry.src === 's' && re.test(entry.msg));
+};
+
+module.exports['Live rev2: connect negotiates ENABLE IMAP4rev2'] = async test => {
+    const client = await connectClient();
+    try {
+        test.ok(client.capabilities.has('IMAP4rev2'), 'server should advertise IMAP4rev2');
+        test.ok(client.enabled.has('IMAP4REV2'), 'IMAP4rev2 should be enabled');
+        // The single merged ENABLE call must not lose the other extensions
+        test.ok(client.enabled.has('CONDSTORE'), 'CONDSTORE should still be enabled');
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: list uses RETURN (SUBSCRIBED) and skips LSUB'] = async test => {
+    const logs = [];
+    const client = await connectClient(null, logs);
+    try {
+        const folders = await client.list();
+
+        test.ok(clientSent(logs, 'SUBSCRIBED'), 'LIST should request RETURN (SUBSCRIBED)');
+        test.ok(!clientSent(logs, 'LSUB'), 'LSUB must not be issued on a rev2 session');
+
+        const sent = folders.find(folder => folder.path === 'Sent');
+        test.ok(sent, 'Sent mailbox should be listed');
+        test.equal(sent.subscribed, true, 'Sent should be reported as subscribed');
+        test.equal(sent.specialUse, '\\Sent', 'special-use flag should be honored');
+        // \HasNoChildren must survive the extended LIST (RETURN (CHILDREN) requested)
+        test.ok(sent.flags.has('\\HasNoChildren'), 'child info should be present');
+        for (let folder of folders) {
+            test.ok(!folder.flags.has('\\Subscribed'), '\\Subscribed must be folded into the subscribed property');
+        }
+
+        const inbox = folders.find(folder => folder.path === 'INBOX');
+        test.ok(inbox, 'INBOX should be listed');
+        test.equal(inbox.subscribed, true, 'INBOX is always reported as subscribed');
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: subscription state round-trips'] = async test => {
+    const client = await connectClient();
+    try {
+        await client.mailboxCreate('RoundTrip');
+        await client.mailboxSubscribe('RoundTrip');
+        let folders = await client.list();
+        test.equal(folders.find(folder => folder.path === 'RoundTrip').subscribed, true);
+
+        await client.mailboxUnsubscribe('RoundTrip');
+        folders = await client.list();
+        test.ok(!folders.find(folder => folder.path === 'RoundTrip').subscribed);
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: deleted-but-subscribed folders stay out of listings'] = async test => {
+    const client = await connectClient();
+    try {
+        await client.mailboxCreate('Ghost');
+        await client.mailboxSubscribe('Ghost');
+        await client.mailboxDelete('Ghost');
+
+        const folders = await client.list();
+        // The RETURN (SUBSCRIBED) option must not resurrect phantom subscriptions
+        // the way a raw LSUB would
+        test.ok(!folders.find(folder => folder.path === 'Ghost'), 'deleted folder must not be listed');
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: UTF-8 mailbox names round-trip'] = async test => {
+    const client = await connectClient();
+    try {
+        const name = 'T\u00f5rva \u00f5un';
+        await client.mailboxCreate(name);
+        const folders = await client.list();
+        const created = folders.find(folder => folder.path === name);
+        test.ok(created, 'UTF-8 mailbox should be listed under its literal name');
+
+        const mailbox = await client.mailboxOpen(name);
+        test.equal(mailbox.path, name);
+        await client.mailboxClose();
+        await client.mailboxDelete(name);
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: statusQuery is answered inline via LIST-STATUS'] = async test => {
+    const logs = [];
+    const client = await connectClient(null, logs);
+    try {
+        await client.append('INBOX', Buffer.from('Subject: status probe\r\n\r\nstatus probe body\r\n'));
+
+        const folders = await client.list({ statusQuery: { messages: true, unseen: true } });
+
+        test.ok(clientSent(logs, 'STATUS'), 'LIST should carry RETURN (STATUS ...)');
+        const inbox = folders.find(folder => folder.path === 'INBOX');
+        test.equal(inbox.status.messages, 1, 'inline STATUS should report the appended message');
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: plain search results are collected'] = async test => {
+    const logs = [];
+    const client = await connectClient(null, logs);
+    try {
+        await client.append('INBOX', Buffer.from('Subject: first\r\n\r\nfirst\r\n'));
+        await client.append('INBOX', Buffer.from('Subject: second\r\n\r\nsecond\r\n'));
+
+        await client.mailboxOpen('INBOX');
+        const results = await client.search({ all: true });
+
+        // RFC 9051 deprecates the untagged SEARCH response in favor of ESEARCH,
+        // but Dovecot 2.4 still answers a plain SEARCH with the legacy form even
+        // on an ENABLEd rev2 session (verified on the wire). The client accepts
+        // both forms, so assert that the results arrived via one of them - the
+        // ESEARCH-answered variant of a plain SEARCH is covered by the mock
+        // suite, and a real ESEARCH response is exercised live in the
+        // returnOptions test below.
+        test.ok(serverSentUntagged(logs, 'SEARCH') || serverSentUntagged(logs, 'ESEARCH'), 'results should arrive via an untagged SEARCH or ESEARCH response');
+        test.deepEqual(results, [1, 2]);
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: returnOptions search is answered via a real ESEARCH response'] = async test => {
+    const logs = [];
+    const client = await connectClient(null, logs);
+    try {
+        await client.append('INBOX', Buffer.from('Subject: first\r\n\r\nfirst\r\n'));
+        await client.append('INBOX', Buffer.from('Subject: second\r\n\r\nsecond\r\n'));
+
+        await client.mailboxOpen('INBOX');
+        const result = await client.search({ all: true }, { returnOptions: ['ALL', 'COUNT'] });
+
+        // SEARCH RETURN (...) makes Dovecot answer with a genuine untagged
+        // ESEARCH response - this exercises the ESEARCH parsing path against a
+        // real server
+        test.ok(serverSentUntagged(logs, 'ESEARCH'), 'server should reply with an untagged ESEARCH response');
+        test.ok(!serverSentUntagged(logs, 'SEARCH'), 'no legacy untagged SEARCH response is expected');
+        test.equal(result.count, 2);
+        test.equal(result.all, '1:2');
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: STATUS reports SIZE and DELETED'] = async test => {
+    const logs = [];
+    const client = await connectClient(null, logs);
+    try {
+        const raw = Buffer.from('Subject: sized\r\n\r\nsized body\r\n');
+        await client.append('INBOX', raw, ['\\Deleted']);
+        await client.append('INBOX', Buffer.from('Subject: kept\r\n\r\nkept body\r\n'));
+
+        const status = await client.status('INBOX', { messages: true, size: true, deleted: true });
+
+        test.ok(clientSent(logs, 'SIZE'), 'STATUS should request SIZE');
+        test.ok(clientSent(logs, 'DELETED'), 'STATUS should request DELETED');
+        test.equal(status.messages, 2);
+        test.equal(status.deleted, 1, 'one message carries the \\Deleted flag');
+        test.ok(Number.isSafeInteger(status.size) && status.size >= raw.length, 'mailbox size should cover at least the first appended message');
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: statusQuery returns SIZE and DELETED inline via LIST-STATUS'] = async test => {
+    const client = await connectClient();
+    try {
+        await client.append('INBOX', Buffer.from('Subject: probe\r\n\r\nprobe body\r\n'), ['\\Deleted']);
+
+        const folders = await client.list({ statusQuery: { messages: true, size: true, deleted: true } });
+        const inbox = folders.find(folder => folder.path === 'INBOX');
+        test.equal(inbox.status.messages, 1);
+        test.equal(inbox.status.deleted, 1);
+        test.ok(Number.isSafeInteger(inbox.status.size) && inbox.status.size > 0);
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: SELECT response carries an untagged LIST and re-select gets CLOSED'] = async test => {
+    const logs = [];
+    const client = await connectClient(null, logs);
+    try {
+        await client.mailboxCreate('Closer');
+        const mailbox = await client.mailboxOpen('INBOX');
+        test.equal(mailbox.path, 'INBOX');
+
+        // RFC 9051 6.3.1: the SELECT response includes an untagged LIST for the
+        // selected mailbox - the client must consume it without issue
+        test.ok(serverSentUntagged(logs, 'LIST'), 'rev2 SELECT should include an untagged LIST response');
+
+        // switching mailboxes must produce a CLOSED response code for the old one
+        await client.mailboxOpen('Closer');
+        const closed = wireLines(logs).some(entry => entry.src === 's' && entry.msg.includes('[CLOSED]'));
+        test.ok(closed, 're-select should carry a CLOSED response code');
+        test.equal(client.mailbox.path, 'Closer', 'client state should track the newly selected mailbox');
+
+        await client.mailboxClose();
+        await client.mailboxDelete('Closer');
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: binary fetch uses the folded-in FETCH BINARY'] = async test => {
+    const logs = [];
+    const client = await connectClient(null, logs);
+    try {
+        // BINARY sections only allow numeric part specifiers, so use a multipart
+        // message - part "1" of a single-part message would resolve to the TEXT
+        // section, which must stay a BODY fetch. The base64 encoding gives the
+        // server-side BINARY decoding something to undo.
+        const content = [
+            'Subject: bin',
+            'MIME-Version: 1.0',
+            'Content-Type: multipart/mixed; boundary=bb',
+            '',
+            '--bb',
+            'Content-Type: text/plain',
+            'Content-Transfer-Encoding: base64',
+            '',
+            Buffer.from('binary body').toString('base64'),
+            '--bb--',
+            ''
+        ].join('\r\n');
+        await client.append('INBOX', Buffer.from(content));
+
+        await client.mailboxOpen('INBOX');
+        const { content: downloadStream } = await client.download('1', '1', { binary: true });
+        const chunks = [];
+        for await (let chunk of downloadStream) {
+            chunks.push(chunk);
+        }
+
+        test.ok(clientSent(logs, 'BINARY.PEEK[1]'), 'client should issue a BINARY fetch for the numeric part on a rev2 session');
+        test.equal(Buffer.concat(chunks).toString().trim(), 'binary body', 'BINARY fetch should return the decoded content');
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: MOVE reports COPYUID from the untagged OK'] = async test => {
+    const client = await connectClient();
+    try {
+        await client.append('INBOX', Buffer.from('Subject: mover\r\n\r\nmover body\r\n'));
+        await client.mailboxCreate('Moved');
+
+        await client.mailboxOpen('INBOX');
+        const result = await client.messageMove('1', 'Moved');
+
+        // RFC 9051 6.4.8: the server is REQUIRED to send COPYUID in an untagged OK
+        // before the EXPUNGEs - verify the client captured it
+        test.ok(result, 'move should succeed');
+        test.equal(result.path, 'INBOX');
+        test.equal(result.destination, 'Moved');
+        test.ok(result.uidMap && result.uidMap.size === 1, 'COPYUID must be captured from the untagged OK');
+
+        await client.mailboxClose();
+        await client.mailboxDelete('Moved');
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: message lifecycle smoke test'] = async test => {
+    const client = await connectClient();
+    try {
+        await client.append('INBOX', Buffer.from('Subject: smoke\r\n\r\nsmoke body\r\n'), ['\\Seen']);
+
+        await client.mailboxOpen('INBOX');
+        const message = await client.fetchOne('1', { envelope: true, flags: true, uid: true });
+        test.equal(message.envelope.subject, 'smoke');
+        test.ok(message.flags.has('\\Seen'));
+
+        await client.mailboxCreate('Smoke');
+        await client.messageCopy('1', 'Smoke');
+        await client.messageMove('1', 'Smoke');
+
+        const status = await client.status('Smoke', { messages: true });
+        test.equal(status.messages, 2, 'copy plus move should land two messages');
+
+        // uid expunge - UIDPLUS is folded into base rev2, so only the requested
+        // message may disappear
+        await client.mailboxOpen('Smoke');
+        const first = await client.fetchOne('1', { uid: true });
+        await client.messageDelete(`${first.uid}`, { uid: true });
+        const statusAfter = await client.status('Smoke', { messages: true });
+        test.equal(statusAfter.messages, 1, 'UID EXPUNGE must remove only the targeted message');
+
+        await client.mailboxClose();
+        await client.mailboxRename('Smoke', 'Smoke2');
+        await client.mailboxDelete('Smoke2');
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};