imapflow 1.4.8 → 1.5.0

package/test/integration/run-rev2-tests.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Runs the ImapFlow live integration tests against a real IMAP4rev2 server
+# (Dovecot 2.4+ in Docker). Opt-in via `npm run test:rev2` - not part of the
+# regular `npm test` run, which stays Docker-free.
+#
+# Environment overrides:
+#   IMAPFLOW_DOVECOT_IMAGE     image to run (default dovecot/dovecot:2.4.4)
+#   IMAPFLOW_DOVECOT_PLATFORM  e.g. linux/amd64; defaults to the host platform.
+#                              Note: forcing linux/amd64 on Apple Silicon does
+#                              not work - Rosetta cannot start Dovecot's
+#                              privilege-separated login processes.
+#   IMAPFLOW_TEST_PORT         host port to publish (default 31143)
+
+CONTAINER_NAME="${IMAPFLOW_DOVECOT_CONTAINER:-imapflow-rev2-test}"
+IMAGE="${IMAPFLOW_DOVECOT_IMAGE:-dovecot/dovecot:2.4.4}"
+PORT="${IMAPFLOW_TEST_PORT:-31143}"
+
+# Empty unless a platform override was requested; --platform=value keeps it a
+# single argument so plain ${PLATFORM_ARG:+...} expansion works under set -u
+PLATFORM_ARG="${IMAPFLOW_DOVECOT_PLATFORM:+--platform=$IMAPFLOW_DOVECOT_PLATFORM}"
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
+
+cleanup() {
+    docker rm -f "$CONTAINER_NAME" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+cleanup
+
+# Guard against a stale image cached for the wrong architecture: `docker run`
+# without --platform silently reuses a local image even when its architecture
+# does not match the host (e.g. an amd64 image left behind on an arm64 host),
+# and Dovecot then fails to start with confusing emulation errors. Only applies
+# when no explicit platform override was requested.
+if [ -z "${IMAPFLOW_DOVECOT_PLATFORM:-}" ] && docker image inspect "$IMAGE" >/dev/null 2>&1; then
+    image_arch="$(docker image inspect --format '{{.Architecture}}' "$IMAGE" 2>/dev/null || true)"
+    host_arch="$(docker version --format '{{.Server.Arch}}' 2>/dev/null || true)"
+    if [ -n "$image_arch" ] && [ -n "$host_arch" ] && [ "$image_arch" != "$host_arch" ]; then
+        echo "Local $IMAGE image is $image_arch but the Docker host is $host_arch - re-pulling for linux/$host_arch..."
+        docker pull --platform "linux/$host_arch" "$IMAGE"
+    fi
+fi
+
+docker run ${PLATFORM_ARG:+"$PLATFORM_ARG"} -d --name "$CONTAINER_NAME" \
+    -e USER_PASSWORD=pass \
+    -v "$SCRIPT_DIR/dovecot-test.conf:/etc/dovecot/conf.d/99-imapflow-test.conf:ro" \
+    -p "127.0.0.1:$PORT:31143" \
+    "$IMAGE" >/dev/null
+
+echo "Waiting for Dovecot to accept IMAP connections on port $PORT..."
+for i in $(seq 1 30); do
+    if node -e "
+        const net = require('net');
+        const socket = net.connect(Number(process.argv[1]), '127.0.0.1');
+        const bail = code => { socket.destroy(); process.exit(code); };
+        socket.on('data', chunk => bail(chunk.toString().startsWith('* OK') ? 0 : 1));
+        socket.on('error', () => bail(1));
+        setTimeout(() => bail(1), 2000);
+    " "$PORT" 2>/dev/null; then
+        echo "Dovecot is ready"
+        break
+    fi
+    if [ "$i" = 30 ]; then
+        echo "Dovecot container did not become ready" >&2
+        docker logs "$CONTAINER_NAME" >&2 || true
+        exit 1
+    fi
+    sleep 1
+done
+
+cd "$PROJECT_DIR"
+IMAPFLOW_TEST_HOST=127.0.0.1 IMAPFLOW_TEST_PORT="$PORT" npx nodeunit test/integration/rev2-live-test.js

package/test/reliability-improvements-test.js

@@ -204,7 +204,10 @@ module.exports['Reliability: per-call maxLockHoldTime overrides constructor opti
     let lock = await client.getMailboxLock('INBOX', { maxLockHoldTime: 20 });
     await new Promise(r => setTimeout(r, 50));
 
-    test.ok(warnings.some(w => w && w.msg === 'Mailbox lock held for a long time'), 'Per-call override must take effect');
+    test.ok(
+        warnings.some(w => w && w.msg === 'Mailbox lock held for a long time'),
+        'Per-call override must take effect'
+    );
 
     lock.release();
     await drain();

package/test/search-compiler-test.js

@@ -191,6 +191,25 @@ module.exports['Search Compiler: RECENT flag'] = test => {
     test.done();
 };
 
+module.exports['Search Compiler: NEW/OLD/RECENT throw on rev2 sessions'] = test => {
+    // IMAP4rev2 (RFC 9051) removed the \Recent flag and these search keys -
+    // a rev2 server would reject the whole search with a tagged BAD
+    let connection = createMockConnection({ enabled: ['IMAP4REV2'] });
+    for (let key of ['new', 'old', 'recent']) {
+        try {
+            searchCompiler(connection, { [key]: true });
+            test.ok(false, `Should have thrown for ${key}`);
+        } catch (err) {
+            test.equal(err.code, 'MissingServerExtension');
+        }
+    }
+    // Falsy values compile to nothing and must not throw
+    test.equal(searchCompiler(connection, { recent: false }).length, 0);
+    // ALL is still part of the rev2 grammar
+    test.ok(hasAttr(searchCompiler(connection, { all: true }), 'ALL'));
+    test.done();
+};
+
 module.exports['Search Compiler: Simple flags ignored when falsy'] = test => {
     let connection = createMockConnection();
     let compiled = searchCompiler(connection, {
@@ -900,6 +919,23 @@ module.exports['Search Compiler: Unicode skipped when UTF8=ACCEPT enabled'] = te
     test.done();
 };
 
+module.exports['Search Compiler: Unicode on rev2 without UTF8=ACCEPT still adds CHARSET UTF-8'] = test => {
+    // RFC 9051 6.4.4: rev2 servers MUST assume UTF-8 when CHARSET is absent, and
+    // sending CHARSET UTF-8 is "redundant" but explicitly "permitted for improved
+    // compatibility" - pin the compiler's choice to send it until UTF8=ACCEPT is
+    // actually ENABLEd
+    let connection = createMockConnection({
+        capabilities: [['IMAP4rev2', true]],
+        enabled: new Set()
+    });
+    let compiled = searchCompiler(connection, { subject: 'Sõnum' });
+
+    let charset = findAttr(compiled, 'CHARSET');
+    test.ok(charset, 'CHARSET prefix expected for a unicode search value');
+    test.ok(hasAttr(compiled, 'UTF-8'));
+    test.done();
+};
+
 module.exports['Search Compiler: GMRAW with Unicode adds CHARSET'] = test => {
     let connection = createMockConnection({
         capabilities: [['X-GM-EXT-1', true]],

package/test/search-test.js

@@ -14,6 +14,7 @@ function makeConnection({ hasEsearch = true } = {}) {
         state: 'SELECTED',
         states: { SELECTED: 'SELECTED' },
         capabilities: caps,
+        enabled: new Set(),
         exec: async () => ({ next: () => {} }),
         log: { warn: () => {} }
     };
@@ -72,23 +73,6 @@ module.exports['ESEARCH: parseEsearchResponse PARTIAL (Array form)'] = test => {
     test.done();
 };
 
-module.exports['ESEARCH: parseEsearchResponse PARTIAL (LIST object form)'] = test => {
-    // Also handle {type: 'LIST', attributes: [...]} form for robustness
-    const attrs = [
-        { type: 'ATOM', value: 'PARTIAL' },
-        {
-            type: 'LIST',
-            attributes: [
-                { type: 'ATOM', value: '1:100' },
-                { type: 'ATOM', value: '1001,1003:1010,1015' }
-            ]
-        }
-    ];
-    const result = parseEsearchResponse(attrs);
-    test.deepEqual(result.partial, { range: '1:100', messages: '1001,1003:1010,1015' });
-    test.done();
-};
-
 module.exports['ESEARCH: parseEsearchResponse COUNT + PARTIAL combined'] = test => {
     const attrs = [
         { type: 'ATOM', value: 'COUNT' },
@@ -116,12 +100,14 @@ module.exports['ESEARCH: emits RETURN clause when returnOptions present and serv
         capturedAttributes = JSON.stringify(attributes);
         return { next: () => {} };
     };
-    searchCmd(conn, { seen: false }, { uid: true, returnOptions: ['COUNT'] }).then(() => {
-        test.equal(capturedCommand, 'UID SEARCH');
-        test.ok(capturedAttributes.includes('"RETURN"'), 'should include RETURN atom');
-        test.ok(capturedAttributes.includes('"COUNT"'), 'should include COUNT in return list');
-        test.done();
-    }).catch(err => test.done(err));
+    searchCmd(conn, { seen: false }, { uid: true, returnOptions: ['COUNT'] })
+        .then(() => {
+            test.equal(capturedCommand, 'UID SEARCH');
+            test.ok(capturedAttributes.includes('"RETURN"'), 'should include RETURN atom');
+            test.ok(capturedAttributes.includes('"COUNT"'), 'should include COUNT in return list');
+            test.done();
+        })
+        .catch(err => test.done(err));
 };
 
 module.exports['ESEARCH: RETURN clause includes PARTIAL range atom'] = test => {
@@ -131,11 +117,13 @@ module.exports['ESEARCH: RETURN clause includes PARTIAL range atom'] = test => {
         capturedAttributes = JSON.stringify(attributes);
         return { next: () => {} };
     };
-    searchCmd(conn, { seen: false }, { uid: true, returnOptions: [{ partial: '1:100' }] }).then(() => {
-        test.ok(capturedAttributes.includes('"PARTIAL"'), 'should include PARTIAL atom');
-        test.ok(capturedAttributes.includes('"1:100"'), 'should include range string');
-        test.done();
-    }).catch(err => test.done(err));
+    searchCmd(conn, { seen: false }, { uid: true, returnOptions: [{ partial: '1:100' }] })
+        .then(() => {
+            test.ok(capturedAttributes.includes('"PARTIAL"'), 'should include PARTIAL atom');
+            test.ok(capturedAttributes.includes('"1:100"'), 'should include range string');
+            test.done();
+        })
+        .catch(err => test.done(err));
 };
 
 module.exports['ESEARCH: no RETURN clause when server lacks ESEARCH capability'] = test => {
@@ -152,12 +140,14 @@ module.exports['ESEARCH: no RETURN clause when server lacks ESEARCH capability']
         }
         return { next: () => {} };
     };
-    searchCmd(conn, { seen: false }, { uid: true, returnOptions: ['COUNT', 'ALL'] }).then(result => {
-        test.ok(!capturedAttributes.includes('"RETURN"'), 'should NOT include RETURN when no ESEARCH');
-        test.ok(Array.isArray(result), 'should return number[] when ESEARCH unavailable');
-        test.deepEqual(result, [1, 2, 3]);
-        test.done();
-    }).catch(err => test.done(err));
+    searchCmd(conn, { seen: false }, { uid: true, returnOptions: ['COUNT', 'ALL'] })
+        .then(result => {
+            test.ok(!capturedAttributes.includes('"RETURN"'), 'should NOT include RETURN when no ESEARCH');
+            test.ok(Array.isArray(result), 'should return number[] when ESEARCH unavailable');
+            test.deepEqual(result, [1, 2, 3]);
+            test.done();
+        })
+        .catch(err => test.done(err));
 };
 
 module.exports['ESEARCH: parseEsearchResponse skips non-ATOM tokens'] = test => {
@@ -247,11 +237,13 @@ module.exports['ESEARCH: backward compat — no returnOptions returns number[]']
         return { next: () => {} };
     };
     // No returnOptions — must return number[] even if server has ESEARCH
-    searchCmd(conn, { seen: true }, { uid: true }).then(result => {
-        test.ok(Array.isArray(result));
-        test.deepEqual(result, [10, 20]);
-        test.done();
-    }).catch(err => test.done(err));
+    searchCmd(conn, { seen: true }, { uid: true })
+        .then(result => {
+            test.ok(Array.isArray(result));
+            test.deepEqual(result, [10, 20]);
+            test.done();
+        })
+        .catch(err => test.done(err));
 };
 
 // ── imap-flow.js public API fallback test ─────────────────────────────────
@@ -271,16 +263,19 @@ module.exports['imap-flow: search() derives ESearchResult when server has no ESE
     // Stub run() to return a sorted number[]
     client.run = async () => [10, 20, 30, 40, 50];
 
-    client.search({ seen: false }, { uid: true, returnOptions: ['COUNT', 'MIN', 'MAX', 'ALL'] }).then(result => {
-        test.equal(typeof result, 'object', 'should return object, not array');
-        test.ok(!Array.isArray(result), 'should not be an array');
-        test.equal(result.count, 5);
-        test.equal(result.min, 10);
-        test.equal(result.max, 50);
-        // packMessageRange([10,20,30,40,50]) → "10,20,30,40,50" (non-contiguous)
-        test.ok(typeof result.all === 'string' && result.all.length > 0, 'all should be non-empty compact string');
-        test.done();
-    }).catch(err => test.done(err));
+    client
+        .search({ seen: false }, { uid: true, returnOptions: ['COUNT', 'MIN', 'MAX', 'ALL'] })
+        .then(result => {
+            test.equal(typeof result, 'object', 'should return object, not array');
+            test.ok(!Array.isArray(result), 'should not be an array');
+            test.equal(result.count, 5);
+            test.equal(result.min, 10);
+            test.equal(result.max, 50);
+            // packMessageRange([10,20,30,40,50]) → "10,20,30,40,50" (non-contiguous)
+            test.ok(typeof result.all === 'string' && result.all.length > 0, 'all should be non-empty compact string');
+            test.done();
+        })
+        .catch(err => test.done(err));
 };
 
 module.exports['imap-flow: search() fallback with empty result set'] = test => {
@@ -294,9 +289,12 @@ module.exports['imap-flow: search() fallback with empty result set'] = test => {
     client.state = client.states.SELECTED;
     client.capabilities = new Map();
     client.run = async () => [];
-    client.search({}, { uid: true, returnOptions: ['COUNT', 'ALL'] }).then(result => {
-        test.equal(result.count, 0);
-        test.equal(result.all, undefined, 'all should be absent for empty result');
-        test.done();
-    }).catch(err => test.done(err));
+    client
+        .search({}, { uid: true, returnOptions: ['COUNT', 'ALL'] })
+        .then(result => {
+            test.equal(result.count, 0);
+            test.equal(result.all, undefined, 'all should be absent for empty result');
+            test.done();
+        })
+        .catch(err => test.done(err));
 };

package/test/tools-test.js

@@ -7,7 +7,8 @@ const iconv = require('iconv-lite');
 
 // Mock connection for testing
 let createMockConnection = (options = {}) => ({
-    enabled: new Set(options.utf8 ? ['UTF8=ACCEPT'] : []),
+    enabled: new Set(options.enabled || (options.utf8 ? ['UTF8=ACCEPT'] : [])),
+    capabilities: new Map(options.capabilities || []),
     namespace: options.namespace || null
 });
 
@@ -22,7 +23,7 @@ module.exports['Tools: encodePath with ASCII path'] = test => {
     test.done();
 };
 
-module.exports['Tools: encodePath with Unicode path (no UTF8)'] = test => {
+module.exports['Tools: encodePath with ASCII path (no UTF8)'] = test => {
     let connection = createMockConnection({ utf8: false });
     let result = tools.encodePath(connection, 'Sent/Gesendete');
     // ASCII path should remain unchanged
@@ -30,6 +31,15 @@ module.exports['Tools: encodePath with Unicode path (no UTF8)'] = test => {
     test.done();
 };
 
+module.exports['Tools: encodePath encodes Unicode to modified UTF-7 on rev1 (no UTF8)'] = test => {
+    let connection = createMockConnection({ utf8: false });
+    // 'õ' (U+00F5) -> UTF-16BE 00F5 -> modified-base64 'APU'
+    test.equal(tools.encodePath(connection, 'Tõrva'), 'T&APU-rva');
+    // a literal '&' must be escaped as '&-'
+    test.equal(tools.encodePath(connection, 'Test&Folder'), 'Test&-Folder');
+    test.done();
+};
+
 module.exports['Tools: encodePath with Unicode when UTF8=ACCEPT enabled'] = test => {
     let connection = createMockConnection({ utf8: true });
     let result = tools.encodePath(connection, 'Posteingang/Ordner');
@@ -54,9 +64,10 @@ module.exports['Tools: decodePath with ASCII path'] = test => {
 
 module.exports['Tools: decodePath with ampersand'] = test => {
     let connection = createMockConnection({ utf8: false });
-    // UTF-7-IMAP encoded string
-    let result = tools.decodePath(connection, 'Test&-Folder');
-    test.ok(typeof result === 'string');
+    // modified UTF-7: '&-' is the escaped form of a literal ampersand
+    test.equal(tools.decodePath(connection, 'Test&-Folder'), 'Test&Folder');
+    // and an encoded sequence round-trips back to Unicode
+    test.equal(tools.decodePath(connection, 'T&APU-rva'), 'Tõrva');
     test.done();
 };
 
@@ -162,6 +173,102 @@ module.exports['Tools: updateCapabilities with valid list'] = test => {
     test.done();
 };
 
+module.exports['Tools: updateCapabilities normalizes IMAP4rev2 casing'] = test => {
+    let list = [{ value: 'IMAP4rev2' }, { value: 'imap4rev1' }];
+    let result = tools.updateCapabilities(list);
+    // Wire tokens are uppercased, but the rev1/rev2 keys use the RFC spelling
+    test.equal(result.get('IMAP4rev2'), true);
+    test.equal(result.get('IMAP4rev1'), true);
+    test.equal(result.has('IMAP4REV2'), false);
+    test.done();
+};
+
+module.exports['Tools: isRev2Active for rev2-only server'] = test => {
+    // rev2 without rev1 means rev2 is the base protocol, no ENABLE needed
+    let connection = createMockConnection({ capabilities: [['IMAP4rev2', true]] });
+    test.equal(tools.isRev2Active(connection), true);
+    test.done();
+};
+
+module.exports['Tools: isRev2Active for dual server without ENABLE'] = test => {
+    // Advertising both keeps the session in rev1 mode until ENABLE IMAP4rev2
+    let connection = createMockConnection({
+        capabilities: [
+            ['IMAP4rev1', true],
+            ['IMAP4rev2', true]
+        ]
+    });
+    test.equal(tools.isRev2Active(connection), false);
+    test.done();
+};
+
+module.exports['Tools: isRev2Active for dual server with ENABLE'] = test => {
+    let connection = createMockConnection({
+        capabilities: [
+            ['IMAP4rev1', true],
+            ['IMAP4rev2', true]
+        ],
+        enabled: ['IMAP4REV2']
+    });
+    test.equal(tools.isRev2Active(connection), true);
+    test.done();
+};
+
+module.exports['Tools: isRev2Active for rev1-only server'] = test => {
+    let connection = createMockConnection({ capabilities: [['IMAP4rev1', true]] });
+    test.equal(tools.isRev2Active(connection), false);
+    test.done();
+};
+
+module.exports['Tools: hasCapability with advertised token'] = test => {
+    let connection = createMockConnection({
+        capabilities: [
+            ['IMAP4rev1', true],
+            ['UIDPLUS', true]
+        ]
+    });
+    test.equal(tools.hasCapability(connection, 'UIDPLUS'), true);
+    test.equal(tools.hasCapability(connection, 'MOVE'), false);
+    test.done();
+};
+
+module.exports['Tools: hasCapability folds extensions into active rev2'] = test => {
+    let connection = createMockConnection({ capabilities: [['IMAP4rev2', true]] });
+    // RFC 9051 Appendix E folds these into base IMAP4rev2
+    for (let capability of ['UIDPLUS', 'MOVE', 'NAMESPACE', 'ESEARCH', 'LITERAL-', 'LIST-EXTENDED', 'LIST-STATUS', 'SPECIAL-USE', 'ENABLE']) {
+        test.equal(tools.hasCapability(connection, capability), true, `${capability} should be folded into rev2`);
+    }
+    // BINARY is intentionally not folded
+    test.equal(tools.hasCapability(connection, 'BINARY'), false);
+    test.done();
+};
+
+module.exports['Tools: hasCapability does not fold on unenabled dual server'] = test => {
+    let connection = createMockConnection({
+        capabilities: [
+            ['IMAP4rev1', true],
+            ['IMAP4rev2', true]
+        ]
+    });
+    // Session is in rev1 mode - only explicitly advertised tokens count
+    test.equal(tools.hasCapability(connection, 'UIDPLUS'), false);
+    test.done();
+};
+
+module.exports['Tools: encodePath keeps UTF-8 when rev2 is active'] = test => {
+    let connection = createMockConnection({ capabilities: [['IMAP4rev2', true]] });
+    // rev2 mailbox names are native UTF-8, modified UTF-7 must not be applied
+    test.equal(tools.encodePath(connection, 'T\u00f5rva'), 'T\u00f5rva');
+    test.done();
+};
+
+module.exports['Tools: decodePath keeps ampersand sequences when rev2 is active'] = test => {
+    let connection = createMockConnection({ capabilities: [['IMAP4rev2', true]] });
+    // Under rev2 an "&"-sequence is a literal name, not modified UTF-7
+    test.equal(tools.decodePath(connection, 'A&AOQ-B'), 'A&AOQ-B');
+    test.done();
+};
+
 module.exports['Tools: updateCapabilities with APPENDLIMIT'] = test => {
     let list = [{ value: 'APPENDLIMIT=52428800' }];
     let result = tools.updateCapabilities(list);
@@ -493,6 +600,30 @@ module.exports['Tools: expandRange with same start/end'] = test => {
     test.done();
 };
 
+module.exports['Tools: expandRange skips entries that are not valid nz-numbers'] = test => {
+    // Server-supplied garbage must not produce bogus ids or endless loops
+    test.deepEqual(tools.expandRange('Infinity:5'), []);
+    test.deepEqual(tools.expandRange('0:3'), []);
+    test.deepEqual(tools.expandRange('abc,4,1:x'), [4]);
+    test.deepEqual(tools.expandRange('*'), []);
+    test.deepEqual(tools.expandRange('4294967296'), []);
+    test.done();
+};
+
+module.exports['Tools: expandRange caps hostile range spans'] = test => {
+    // A hostile range like 1:4294967295 is cut off at the expansion limit
+    // instead of exhausting memory
+    let result = tools.expandRange('1:4294967295');
+    test.equal(result.length, 0x1000000);
+    test.equal(result[0], 1);
+    test.equal(result[result.length - 1], 0x1000000);
+
+    let reverse = tools.expandRange('4294967295:4278190080');
+    test.equal(reverse.length, 0x1000000);
+    test.equal(reverse[0], 4294967295);
+    test.done();
+};
+
 // ============================================
 // packMessageRange tests
 // ============================================
@@ -1167,6 +1298,34 @@ module.exports['Tools: formatMessageResponse handles normal THREADID'] = async t
     test.done();
 };
 
+// ============================================
+// formatMessageResponse: BINARY vs BODY part tracking (RFC 3516 / RFC 9051)
+// ============================================
+
+module.exports['Tools: formatMessageResponse records which parts arrived via BINARY'] = async test => {
+    // Parts answered as BINARY[...] arrive with the content-transfer-encoding
+    // already decoded by the server; consumers (download/downloadMany) use the
+    // binaryParts set to skip their own decoder for exactly those parts
+    let untagged = await parser('* 1 FETCH (UID 7 BINARY[1] {4}\r\n BODY[2] {4}\r\n)', {
+        literals: [Buffer.from('AAAA'), Buffer.from('BBBB')]
+    });
+    let result = await tools.formatMessageResponse(untagged, {});
+    test.equal(result.bodyParts.get('1').toString(), 'AAAA');
+    test.equal(result.bodyParts.get('2').toString(), 'BBBB');
+    test.ok(result.binaryParts, 'binaryParts set should exist when a BINARY part arrived');
+    test.ok(result.binaryParts.has('1'), 'BINARY-answered part is recorded');
+    test.ok(!result.binaryParts.has('2'), 'BODY-answered part is not recorded');
+    test.done();
+};
+
+module.exports['Tools: formatMessageResponse leaves binaryParts unset for plain BODY fetches'] = async test => {
+    let untagged = await parser('* 1 FETCH (UID 8 BODY[1] {4}\r\n)', { literals: [Buffer.from('CCCC')] });
+    let result = await tools.formatMessageResponse(untagged, {});
+    test.equal(result.bodyParts.get('1').toString(), 'CCCC');
+    test.equal(result.binaryParts, undefined);
+    test.done();
+};
+
 // ============================================
 // formatMessageResponse: non-ASCII mailbox path normalization for stable id
 // ============================================
@@ -1303,9 +1462,7 @@ module.exports['Tools: parseBodystructure parses message/rfc822 with envelope an
 };
 
 module.exports['Tools: parseBodystructure parses multipart with params and disposition'] = async test => {
-    let bs =
-        '(("TEXT" "PLAIN" NIL NIL NIL "7BIT" 10 1)("TEXT" "HTML" NIL NIL NIL "7BIT" 20 2) ' +
-        '"ALTERNATIVE" ("BOUNDARY" "xyz") ("inline" NIL) ("en"))';
+    let bs = '(("TEXT" "PLAIN" NIL NIL NIL "7BIT" 10 1)("TEXT" "HTML" NIL NIL NIL "7BIT" 20 2) "ALTERNATIVE" ("BOUNDARY" "xyz") ("inline" NIL) ("en"))';
     let untagged = await parser('* 1 FETCH (BODYSTRUCTURE ' + bs + ')');
     let node = tools.parseBodystructure(untagged.attributes[1][1]);
     test.equal(node.type, 'multipart/alternative');
@@ -1348,7 +1505,7 @@ module.exports['Tools: parseBodystructure handles minimal NIL fields'] = async t
 };
 
 module.exports['Tools: parseBodystructure decodes RFC 2231 charset continuation params'] = async test => {
-    let bs = "(\"TEXT\" \"PLAIN\" (\"name*0*\" \"utf-8''%E2%82%AC abc\" \"name*1\" \"def\") NIL NIL \"7BIT\" 10 1)";
+    let bs = '("TEXT" "PLAIN" ("name*0*" "utf-8\'\'%E2%82%AC abc" "name*1" "def") NIL NIL "7BIT" 10 1)';
     let untagged = await parser('* 1 FETCH (BODYSTRUCTURE ' + bs + ')');
     let node = tools.parseBodystructure(untagged.attributes[1][1]);
     test.equal(node.parameters.name, '€ abcdef');
@@ -1453,9 +1610,7 @@ module.exports['Tools: parseBodystructure empty-string size/linecount/language/l
 };
 
 module.exports['Tools: parseBodystructure message/rfc822 empty-string linecount'] = async test => {
-    let bs =
-        '("MESSAGE" "RFC822" NIL NIL NIL "7BIT" 100 ("d" "s" NIL NIL NIL NIL NIL NIL NIL NIL) ' +
-        '("TEXT" "PLAIN" NIL NIL NIL "7BIT" 1 1) "")';
+    let bs = '("MESSAGE" "RFC822" NIL NIL NIL "7BIT" 100 ("d" "s" NIL NIL NIL NIL NIL NIL NIL NIL) ("TEXT" "PLAIN" NIL NIL NIL "7BIT" 1 1) "")';
     let untagged = await parser('* 1 FETCH (BODYSTRUCTURE ' + bs + ')');
     let node = tools.parseBodystructure(untagged.attributes[1][1]);
     test.equal(node.type, 'message/rfc822');
@@ -1468,7 +1623,7 @@ module.exports['Tools: parseBodystructure decodes RFC 2231 with empty charset an
     // exercise the 2-char hex escape branch; the empty *1* continuation segment too.
     // value includes '=' / '?' (2-char hex escapes), a space (-> '_') and a TAB
     // (a <0x10 control char -> single-hex-digit escape needing a '0' pad).
-    let bs = "(\"TEXT\" \"PLAIN\" (\"name*0*\" \"''a=b?c d\te\" \"name*1*\" \"\") NIL NIL \"7BIT\" 1 1)";
+    let bs = '("TEXT" "PLAIN" ("name*0*" "\'\'a=b?c d\te" "name*1*" "") NIL NIL "7BIT" 1 1)';
     let untagged = await parser('* 1 FETCH (BODYSTRUCTURE ' + bs + ')');
     let node = tools.parseBodystructure(untagged.attributes[1][1]);
     test.ok(node.parameters.name.includes('a=b?c'));
@@ -1485,13 +1640,15 @@ module.exports['Tools: parseBodystructure parses empty-string body location'] =
     test.done();
 };
 
-module.exports['Tools: expandRange descending range to non-numeric second bound'] = test => {
-    test.deepEqual(tools.expandRange('5:abc'), [5, 4, 3, 2, 1, 0]);
+module.exports['Tools: expandRange skips descending range to non-numeric second bound'] = test => {
+    // Endpoints that are not valid nz-numbers make the whole entry invalid -
+    // the pre-hardening behavior expanded '5:abc' down to 0
+    test.deepEqual(tools.expandRange('5:abc'), []);
     test.done();
 };
 
-module.exports['Tools: expandRange tolerates non-numeric entries'] = test => {
-    test.deepEqual(tools.expandRange('abc,:5,1:3'), [0, 0, 1, 2, 3, 4, 5, 1, 2, 3]);
+module.exports['Tools: expandRange skips non-numeric entries but keeps valid ones'] = test => {
+    test.deepEqual(tools.expandRange('abc,:5,1:3'), [1, 2, 3]);
     test.done();
 };
 
@@ -1508,7 +1665,7 @@ module.exports['Tools: encodePath keeps name as-is when iconv encode throws'] =
         throw new Error('encode boom');
     };
     try {
-        let connection = { enabled: new Set() };
+        let connection = { enabled: new Set(), capabilities: new Map() };
         let result = tools.encodePath(connection, 'Tärä');
         test.equal(result, 'Tärä', 'falls back to the raw path');
     } finally {
@@ -1523,7 +1680,7 @@ module.exports['Tools: decodePath keeps name as-is when iconv decode throws'] =
         throw new Error('decode boom');
     };
     try {
-        let connection = { enabled: new Set() };
+        let connection = { enabled: new Set(), capabilities: new Map() };
         let result = tools.decodePath(connection, 'Inbox&AOk-');
         test.equal(result, 'Inbox&AOk-');
     } finally {