imapflow 1.4.9 → 1.5.0

package/test/commands-integration-test.js

@@ -488,6 +488,33 @@ module.exports['Commands: search collects results from an ESEARCH reply to plain
     test.done();
 };
 
+module.exports['Commands: search returns empty array for an ESEARCH reply without ALL'] = async test => {
+    const connection = createMockConnection({
+        state: 3,
+        capabilities: new Map([['IMAP4rev2', true]]),
+        exec: async (cmd, attrs, opts) => {
+            // RFC 9051: an ESEARCH response with no matches omits the ALL item
+            if (opts && opts.untagged && opts.untagged.ESEARCH) {
+                await opts.untagged.ESEARCH({
+                    attributes: [
+                        [
+                            { type: 'ATOM', value: 'TAG' },
+                            { type: 'STRING', value: 'A282' }
+                        ],
+                        { type: 'ATOM', value: 'COUNT' },
+                        { type: 'ATOM', value: '0' }
+                    ]
+                });
+            }
+            return { next: () => {} };
+        }
+    });
+
+    const result = await searchCommand(connection, true, {});
+    test.deepEqual(result, []);
+    test.done();
+};
+
 module.exports['Commands: search caps a hostile ESEARCH ALL range at the mailbox size'] = async test => {
     const connection = createMockConnection({
         state: 3,
@@ -693,6 +720,26 @@ module.exports['Commands: store add flags'] = async test => {
     test.done();
 };
 
+module.exports['Commands: store drops the Recent flag from the wire'] = async test => {
+    let execArgs = null;
+    const connection = createMockConnection({
+        state: 3,
+        exec: async (cmd, attrs) => {
+            execArgs = { cmd, attrs };
+            return { next: () => {} };
+        }
+    });
+
+    // \Recent is owned by the server (and removed entirely in IMAP4rev2) - a
+    // client-side STORE must never try to set it
+    const result = await storeCommand(connection, '1:10', ['\\Seen', '\\Recent'], { operation: 'add' });
+    test.equal(result, true);
+    const attrsStr = JSON.stringify(execArgs.attrs);
+    test.ok(attrsStr.includes('\\\\Seen'));
+    test.ok(!attrsStr.toLowerCase().includes('recent'));
+    test.done();
+};
+
 module.exports['Commands: store remove flags'] = async test => {
     let execArgs = null;
     const connection = createMockConnection({
@@ -2975,6 +3022,97 @@ module.exports['Commands: fetch with BINARY capability'] = async test => {
     test.done();
 };
 
+module.exports['Commands: fetch with binary uses BINARY on rev2-only servers without the token'] = async test => {
+    let queryAttrs = null;
+    const connection = createMockConnection({
+        state: 3,
+        // rev2-only server: no BINARY token, but RFC 9051 folds the FETCH side of
+        // the BINARY extension into base IMAP4rev2
+        capabilities: new Map([['IMAP4rev2', true]]),
+        exec: async (cmd, attrs) => {
+            queryAttrs = attrs;
+            return { next: () => {} };
+        }
+    });
+
+    await fetchCommand(connection, '1', { source: true }, { binary: true });
+    test.ok(queryAttrs);
+    test.ok(JSON.stringify(queryAttrs).includes('BINARY.PEEK'));
+    test.done();
+};
+
+module.exports['Commands: fetch with binary keeps BODY for non-numeric sections'] = async test => {
+    let queryAttrs = null;
+    const connection = createMockConnection({
+        state: 3,
+        capabilities: new Map([['BINARY', true]]),
+        exec: async (cmd, attrs) => {
+            queryAttrs = attrs;
+            return { next: () => {} };
+        }
+    });
+
+    // RFC 3516/RFC 9051: section-binary only allows numeric part specifiers -
+    // BINARY[HEADER], BINARY[TEXT] and BINARY[n.MIME] are invalid syntax that
+    // servers reject, so those sections must stay BODY fetches even with
+    // options.binary set
+    await fetchCommand(connection, '1', { headers: true, bodyParts: ['TEXT', '1.MIME', '1.2'] }, { binary: true });
+    test.ok(queryAttrs);
+    const sections = [];
+    const walk = list => {
+        for (let entry of Array.isArray(list) ? list : [list]) {
+            if (Array.isArray(entry)) {
+                walk(entry);
+            } else if (entry && entry.section) {
+                sections.push({ value: entry.value, section: entry.section.length ? entry.section[0].value : '' });
+            }
+        }
+    };
+    walk(queryAttrs);
+
+    for (let entry of sections) {
+        if (['HEADER', 'TEXT', '1.MIME'].includes(entry.section)) {
+            test.equal(entry.value, 'BODY.PEEK', `${entry.section} must be fetched via BODY.PEEK`);
+        }
+        if (entry.section === '1.2') {
+            test.equal(entry.value, 'BINARY.PEEK', 'numeric part specifiers may use BINARY.PEEK');
+        }
+    }
+    test.ok(
+        sections.some(entry => entry.section === '1.2'),
+        'numeric body part present'
+    );
+    test.ok(
+        sections.some(entry => entry.section === 'TEXT'),
+        'TEXT body part present'
+    );
+    test.done();
+};
+
+module.exports['Commands: fetch with binary keeps BODY on unenabled dual rev1+rev2 servers'] = async test => {
+    let queryAttrs = null;
+    const connection = createMockConnection({
+        state: 3,
+        // dual server without ENABLE IMAP4rev2 - rev2 semantics are not active, so
+        // the BINARY fold must not apply
+        capabilities: new Map([
+            ['IMAP4rev1', true],
+            ['IMAP4rev2', true]
+        ]),
+        exec: async (cmd, attrs) => {
+            queryAttrs = attrs;
+            return { next: () => {} };
+        }
+    });
+
+    await fetchCommand(connection, '1', { source: true }, { binary: true });
+    test.ok(queryAttrs);
+    const queryStr = JSON.stringify(queryAttrs);
+    test.ok(queryStr.includes('BODY.PEEK'));
+    test.ok(!queryStr.includes('BINARY.PEEK'));
+    test.done();
+};
+
 module.exports['Commands: fetch with OBJECTID capability'] = async test => {
     let queryAttrs = null;
     const connection = createMockConnection({
@@ -3453,6 +3591,71 @@ module.exports['Commands: list with statusQuery'] = async test => {
     test.done();
 };
 
+module.exports['Commands: list statusQuery parses inline SIZE and DELETED on rev2 sessions'] = async test => {
+    let listAttrs = null;
+    const connection = createMockConnection({
+        state: 3,
+        capabilities: new Map([['IMAP4rev2', true]]),
+        exec: async (cmd, attrs, opts) => {
+            if (cmd === 'LIST') {
+                listAttrs = attrs;
+                if (opts && opts.untagged && opts.untagged.LIST) {
+                    await opts.untagged.LIST({
+                        attributes: [[{ value: '\\HasNoChildren' }], { value: '/' }, { value: 'INBOX' }]
+                    });
+                }
+                if (opts && opts.untagged && opts.untagged.STATUS) {
+                    await opts.untagged.STATUS({
+                        attributes: [
+                            { value: 'INBOX' },
+                            [{ value: 'MESSAGES' }, { value: '10' }, { value: 'SIZE' }, { value: '12345678901234' }, { value: 'DELETED' }, { value: '3' }]
+                        ]
+                    });
+                }
+            }
+            return { next: () => {} };
+        }
+    });
+
+    const result = await listCommand(connection, '', '*', {
+        statusQuery: { messages: true, size: true, deleted: true }
+    });
+    const attrsStr = JSON.stringify(listAttrs);
+    test.ok(attrsStr.includes('SIZE'));
+    test.ok(attrsStr.includes('DELETED'));
+    const inbox = result.find(entry => entry.path === 'INBOX');
+    test.ok(inbox);
+    test.equal(inbox.status.messages, 10);
+    // STATUS SIZE is a number64 - values beyond 2^32 must survive
+    test.strictEqual(inbox.status.size, 12345678901234);
+    test.strictEqual(inbox.status.deleted, 3);
+    test.done();
+};
+
+module.exports['Commands: list tolerates an OLDNAME extended data item'] = async test => {
+    const connection = createMockConnection({
+        state: 3,
+        capabilities: new Map([['IMAP4rev2', true]]),
+        exec: async (cmd, attrs, opts) => {
+            if (cmd === 'LIST' && opts && opts.untagged && opts.untagged.LIST) {
+                // RFC 9051 6.3.9.7: a LIST response may carry an OLDNAME extended
+                // data item after a RENAME or name normalization - the client must
+                // parse the response without choking on the extra attribute
+                await opts.untagged.LIST({
+                    attributes: [[{ value: '\\HasNoChildren' }], { value: '/' }, { value: 'NewBox' }, [{ value: 'OLDNAME' }, [{ value: 'OldBox' }]]]
+                });
+            }
+            return { next: () => {} };
+        }
+    });
+
+    const result = await listCommand(connection, '', '*');
+    const entry = result.find(folder => folder.path === 'NewBox');
+    test.ok(entry, 'mailbox with OLDNAME extended data must be listed');
+    test.ok(entry.flags.has('\\HasNoChildren'));
+    test.done();
+};
+
 module.exports['Commands: list with CONDSTORE status query'] = async test => {
     let listAttrs = null;
     const connection = createMockConnection({
@@ -5742,6 +5945,108 @@ module.exports['Commands: status merges synthetic recent into rev2 query results
     test.done();
 };
 
+module.exports['Commands: status requests and parses SIZE and DELETED on rev2 sessions'] = async test => {
+    let queryAttrs = null;
+    const connection = createMockConnection({
+        state: 2,
+        // rev2-only server: STATUS=SIZE is folded in and DELETED is a base rev2
+        // status item (RFC 9051 Appendix E item 3)
+        capabilities: new Map([['IMAP4rev2', true]]),
+        exec: async (cmd, attrs, opts) => {
+            queryAttrs = JSON.stringify(attrs);
+            await opts.untagged.STATUS({
+                attributes: [
+                    { value: 'INBOX' },
+                    [{ value: 'MESSAGES' }, { value: '100' }, { value: 'SIZE' }, { value: '12345678901234' }, { value: 'DELETED' }, { value: '3' }]
+                ]
+            });
+            return { next: () => {} };
+        }
+    });
+
+    const result = await statusCommand(connection, 'INBOX', { messages: true, size: true, deleted: true });
+    test.ok(queryAttrs.includes('SIZE'));
+    test.ok(queryAttrs.includes('DELETED'));
+    test.equal(result.messages, 100);
+    // STATUS SIZE is a number64 - values beyond 2^32 must survive
+    test.strictEqual(result.size, 12345678901234);
+    test.strictEqual(result.deleted, 3);
+    test.done();
+};
+
+module.exports['Commands: status requests SIZE with the STATUS=SIZE token on rev1 sessions'] = async test => {
+    let queryAttrs = null;
+    const connection = createMockConnection({
+        state: 2,
+        // RFC 8438 server: SIZE is available via the capability token, DELETED is
+        // rev2-only and must be dropped
+        capabilities: new Map([
+            ['IMAP4rev1', true],
+            ['STATUS=SIZE', true]
+        ]),
+        exec: async (cmd, attrs, opts) => {
+            queryAttrs = JSON.stringify(attrs);
+            await opts.untagged.STATUS({
+                attributes: [{ value: 'INBOX' }, [{ value: 'SIZE' }, { value: '2048' }]]
+            });
+            return { next: () => {} };
+        }
+    });
+
+    const result = await statusCommand(connection, 'INBOX', { size: true, deleted: true });
+    test.ok(queryAttrs.includes('SIZE'));
+    test.ok(!queryAttrs.includes('DELETED'));
+    test.strictEqual(result.size, 2048);
+    test.done();
+};
+
+module.exports['Commands: status requests DELETED with QUOTA=RES-MESSAGE on rev1 sessions'] = async test => {
+    let queryAttrs = null;
+    const connection = createMockConnection({
+        state: 2,
+        // RFC 9208: the DELETED status item is mandatory when QUOTA=RES-MESSAGE
+        // is advertised, even without IMAP4rev2
+        capabilities: new Map([
+            ['IMAP4rev1', true],
+            ['QUOTA=RES-MESSAGE', true]
+        ]),
+        exec: async (cmd, attrs, opts) => {
+            queryAttrs = JSON.stringify(attrs);
+            await opts.untagged.STATUS({
+                attributes: [{ value: 'INBOX' }, [{ value: 'DELETED' }, { value: '4' }]]
+            });
+            return { next: () => {} };
+        }
+    });
+
+    const result = await statusCommand(connection, 'INBOX', { deleted: true });
+    test.ok(queryAttrs.includes('DELETED'));
+    test.strictEqual(result.deleted, 4);
+    test.done();
+};
+
+module.exports['Commands: status drops SIZE and DELETED on rev1 sessions without support'] = async test => {
+    let queryAttrs = null;
+    const connection = createMockConnection({
+        state: 2,
+        exec: async (cmd, attrs, opts) => {
+            queryAttrs = JSON.stringify(attrs);
+            await opts.untagged.STATUS({
+                attributes: [{ value: 'INBOX' }, [{ value: 'MESSAGES' }, { value: '100' }]]
+            });
+            return { next: () => {} };
+        }
+    });
+
+    // requesting them must not poison the whole STATUS command on a server that
+    // does not know these items
+    const result = await statusCommand(connection, 'INBOX', { messages: true, size: true, deleted: true });
+    test.ok(!queryAttrs.includes('SIZE'));
+    test.ok(!queryAttrs.includes('DELETED'));
+    test.equal(result.messages, 100);
+    test.done();
+};
+
 module.exports['Commands: status skips when all query values are false'] = async test => {
     const connection = createMockConnection({ state: 2 });
 
@@ -7591,6 +7896,30 @@ module.exports['Commands: namespace with NAMESPACE capability'] = async test =>
     test.done();
 };
 
+module.exports['Commands: namespace uses the real command on rev2-only servers without the token'] = async test => {
+    const connection = createMockConnection({
+        state: 2,
+        // NAMESPACE is folded into base IMAP4rev2 (RFC 9051 Appendix E) - a
+        // rev2-only server gets a real NAMESPACE command, not the LIST fallback
+        capabilities: new Map([['IMAP4rev2', true]]),
+        exec: async (cmd, args, opts) => {
+            test.equal(cmd, 'NAMESPACE');
+            if (opts && opts.untagged && opts.untagged.NAMESPACE) {
+                await opts.untagged.NAMESPACE({
+                    attributes: [[[{ value: '' }, { value: '/' }]], null, null]
+                });
+            }
+            return { next: () => {} };
+        }
+    });
+
+    const result = await namespaceCommand(connection);
+    test.ok(result);
+    test.equal(result.prefix, '');
+    test.equal(result.delimiter, '/');
+    test.done();
+};
+
 module.exports['Commands: namespace fallback without capability'] = async test => {
     const connection = createMockConnection({
         state: 2, // AUTHENTICATED

package/test/connection-edge-cases-test.js

@@ -608,46 +608,10 @@ module.exports['Connection Edge: Race condition in mailbox lock'] = test => {
     });
 };
 
-module.exports['Connection Edge: Capability update after STARTTLS'] = test => {
-    let client = new ImapFlow({
-        host: 'imap.example.com',
-        port: 143,
-        auth: { user: 'test', pass: 'test' }
-    });
-
-    // Mock capabilities
-    client.capabilities = new Map();
-    client.capabilities.set('STARTTLS', true);
-
-    // Mock run method
-    client.run = async command => {
-        if (command === 'STARTTLS') {
-            client.expectCapabilityUpdate = true;
-            return true;
-        }
-        if (command === 'CAPABILITY') {
-            return true;
-        }
-    };
-
-    // Mock socket upgrade
-    client.socket = new EventEmitter();
-    client.socket.unpipe = () => {};
-    client.streamer = new EventEmitter();
-
-    // Override the upgradeToSTARTTLS to test capability update
-    client
-        .upgradeToSTARTTLS()
-        .then(result => {
-            test.ok(result, 'Should successfully upgrade to TLS');
-            test.ok(client.expectCapabilityUpdate, 'Should expect capability update');
-            test.done();
-        })
-        .catch(() => {
-            // Expected for this mock setup
-            test.done();
-        });
-};
+// NB! the capability discard/re-fetch behavior around STARTTLS is asserted end to
+// end in imap-flow-secure-test.js ('Secure: STARTTLS upgrade completes a session',
+// PRETLS-ONLY/POSTTLS-ONLY markers) - a mocked upgradeToSTARTTLS cannot reach the
+// re-fetch code without a real TLS handshake, so no vacuous variant is kept here.
 
 module.exports['Connection Edge: Event handlers attached before piping'] = test => {
     let client = new ImapFlow({

package/test/handler-branches-test.js

@@ -115,8 +115,9 @@ module.exports['imap-compiler: synchronizing literal with non-buffer value seeds
                 {
                     tag: '*',
                     command: 'CMD',
-                    // value is an object that is neither string/number/Buffer but has a numeric
-                    // length, so literalLength resolves to 10 while formatRespEntry(value, true)
+                    // value is an object that is neither string/number/Buffer, so the size
+                    // marker derives from the UTF-8 byte length of its stringified form
+                    // ('[object Object]', 15 bytes) while formatRespEntry(value, true)
                     // returns null -> the seeded resp falls back to [] (line 156 right side).
                     attributes: [{ type: 'LITERAL', value: { length: 10 } }]
                 },
@@ -125,7 +126,7 @@ module.exports['imap-compiler: synchronizing literal with non-buffer value seeds
         ).map(entry => entry.toString());
         // Only the header segment is emitted; the empty seeded data segment is dropped
         // because `if (resp.length)` is false at the end.
-        test.deepEqual(out, ['* CMD {10}\r\n']);
+        test.deepEqual(out, ['* CMD {15}\r\n']);
     });
 
 // STRING node with falsy value -> `(node.value || '')` right side (line 165).

package/test/imap-compiler-test.js

@@ -362,6 +362,91 @@ module.exports['IMAP Compiler: LITERAL literal8'] = test =>
         )
     );
 
+// RFC 7888 (folded into IMAP4rev2): with LITERAL- a non-synchronizing literal
+// marker {n+} is only allowed for literals of up to 4096 bytes - anything larger
+// must use the synchronizing {n} form, in every compilation mode
+module.exports['IMAP Compiler: LITERAL- oversized literal stays synchronizing in single-buffer mode'] = test =>
+    asyncWrapper(test, async test => {
+        let payload = 'a'.repeat(4097);
+        let compiled = (
+            await compiler(
+                {
+                    tag: '*',
+                    command: 'CMD',
+                    attributes: [
+                        {
+                            type: 'LITERAL',
+                            value: payload
+                        }
+                    ]
+                },
+                { literalMinus: true }
+            )
+        ).toString();
+        test.ok(compiled.startsWith('* CMD {4097}\r\n'), `must not use a non-synchronizing marker: ${compiled.slice(0, 20)}`);
+    });
+
+module.exports['IMAP Compiler: LITERAL- boundary: exactly 4096 bytes is non-synchronizing'] = test =>
+    asyncWrapper(test, async test => {
+        let payload = 'a'.repeat(4096);
+        let parts = (
+            await compiler(
+                {
+                    tag: '*',
+                    command: 'CMD',
+                    attributes: [
+                        {
+                            type: 'LITERAL',
+                            value: payload
+                        }
+                    ]
+                },
+                { asArray: true, literalMinus: true }
+            )
+        ).map(entry => entry.toString());
+        test.equal(parts.length, 1, 'literal must be appended inline without a continuation break');
+        test.ok(parts[0].startsWith('* CMD {4096+}\r\n'));
+    });
+
+module.exports['IMAP Compiler: LITERAL- boundary: 4097 bytes falls back to synchronizing'] = test =>
+    asyncWrapper(test, async test => {
+        let payload = 'a'.repeat(4097);
+        let parts = (
+            await compiler(
+                {
+                    tag: '*',
+                    command: 'CMD',
+                    attributes: [
+                        {
+                            type: 'LITERAL',
+                            value: payload
+                        }
+                    ]
+                },
+                { asArray: true, literalMinus: true }
+            )
+        ).map(entry => entry.toString());
+        test.equal(parts.length, 2, 'literal must wait for a continuation response');
+        test.ok(parts[0].endsWith('{4097}\r\n'), `marker must be synchronizing: ${parts[0].slice(-12)}`);
+    });
+
+// The literal size marker counts octets, not UTF-16 code units - a unicode string
+// value must declare its UTF-8 byte length
+module.exports['IMAP Compiler: LITERAL declares byte length for unicode string values'] = test =>
+    asyncWrapper(test, async test => {
+        let compiled = await compiler({
+            tag: '*',
+            command: 'CMD',
+            attributes: [
+                {
+                    type: 'LITERAL',
+                    value: 'Sõnumid'
+                }
+            ]
+        });
+        test.equal(compiled.toString(), '* CMD {8}\r\nSõnumid');
+    });
+
 module.exports['IMAP Compiler: LITERAL array 1'] = test =>
     asyncWrapper(test, async test =>
         test.deepEqual(

package/test/imap-flow-fetch-download-test.js

@@ -300,6 +300,62 @@ module.exports['Download: base64 body part is decoded'] = async test => {
     test.done();
 };
 
+module.exports['Download: binary-fetched part skips the client-side transfer decoding'] = async test => {
+    let client = makeClient();
+    // BINARY fetch (RFC 3516, FETCH side folded into IMAP4rev2): the server
+    // decodes the content-transfer-encoding itself, so the client gets raw bytes
+    // even though the MIME headers still declare base64 - decoding again would
+    // corrupt the data. formatMessageResponse records the parts that arrived via
+    // BINARY[...] in the binaryParts set, which the mock mirrors here.
+    let mime = Buffer.from('Content-Type: text/plain\r\nContent-Transfer-Encoding: base64\r\n\r\n');
+    let decoded = Buffer.from('Hello World');
+    client.fetchOne = async () => {
+        let bodyParts = new Map();
+        bodyParts.set('2.mime', mime);
+        bodyParts.set('2', decoded);
+        return { uid: 1, size: decoded.length, bodyParts, binaryParts: new Set(['2']) };
+    };
+    let { meta, content } = await client.download('1', '2', { chunkSize: 1024, binary: true });
+    test.equal(meta.encoding, 'base64');
+    let data = await collect(content);
+    test.equal(data.toString(), 'Hello World');
+    test.done();
+};
+
+module.exports['DownloadMany: binary-fetched parts skip the client-side transfer decoding'] = async test => {
+    let client = makeClient();
+    let mime = Buffer.from('Content-Type: text/plain\r\nContent-Transfer-Encoding: base64\r\n\r\n');
+    client.fetchOne = async () => {
+        let bodyParts = new Map();
+        bodyParts.set('2.mime', mime);
+        bodyParts.set('2', Buffer.from('part two'));
+        return { uid: 1, bodyParts, binaryParts: new Set(['2']) };
+    };
+    let res = await client.downloadMany('1', ['2'], { binary: true });
+    test.equal(res['2'].content.toString(), 'part two');
+    test.equal(res['2'].meta.encoding, 'base64');
+    test.done();
+};
+
+module.exports['Download: BODY-answered part is still decoded even when binary was requested'] = async test => {
+    let client = makeClient();
+    // RFC 3516 lets a server answer a BINARY request with a NO or a BODY response
+    // (e.g. [UNKNOWN-CTE]) - decoding must follow what actually arrived, so a part
+    // absent from binaryParts gets the client-side decoder despite options.binary
+    let mime = Buffer.from('Content-Type: text/plain\r\nContent-Transfer-Encoding: base64\r\n\r\n');
+    let encoded = Buffer.from(libbase64.encode(Buffer.from('Hello World')));
+    client.fetchOne = async () => {
+        let bodyParts = new Map();
+        bodyParts.set('2.mime', mime);
+        bodyParts.set('2', encoded);
+        return { uid: 1, size: encoded.length, bodyParts };
+    };
+    let { content } = await client.download('1', '2', { chunkSize: 1024, binary: true });
+    let data = await collect(content);
+    test.equal(data.toString(), 'Hello World');
+    test.done();
+};
+
 module.exports['Download: quoted-printable inline text with charset + filename'] = async test => {
     let client = makeClient();
     let mime = Buffer.from(

package/test/imap-flow-secure-test.js

@@ -13,13 +13,17 @@ const CAPS = 'IMAP4rev1 ID ENABLE NAMESPACE';
 
 // Shared per-connection IMAP line handler used by both the plaintext and the
 // upgraded TLS phases. Returns responses for the minimal session commands.
-const handleLine = (sock, line, onStartTls) => {
+// `caps` is the full capability list to advertise for this phase - the STARTTLS
+// test uses different pre- and post-TLS sets to prove the client discards the
+// plaintext capabilities and re-fetches them over TLS (RFC 9051 6.2.1).
+const handleLine = (sock, line, onStartTls, caps) => {
+    caps = caps || `${CAPS} STARTTLS`;
     let parts = line.split(' ');
     let tag = parts[0];
     let cmd = (parts[1] || '').toUpperCase();
     switch (cmd) {
         case 'CAPABILITY':
-            sock.write(`* CAPABILITY ${CAPS} STARTTLS\r\n${tag} OK CAPABILITY done\r\n`);
+            sock.write(`* CAPABILITY ${caps}\r\n${tag} OK CAPABILITY done\r\n`);
             break;
         case 'STARTTLS':
             sock.write(`${tag} OK Begin TLS\r\n`);
@@ -81,17 +85,23 @@ module.exports['Secure: STARTTLS upgrade completes a session'] = async test => {
 
         let detachPlain;
         detachPlain = lineReader(rawSocket, line => {
-            handleLine(rawSocket, line, () => {
-                // Upgrade: stop reading plaintext, wrap the socket in TLS
-                detachPlain();
-                let tlsSocket = new tls.TLSSocket(rawSocket, { isServer: true, key, cert });
-                tlsSocket.on('error', () => {});
-                tlsSocket.on('secure', () => {});
-                lineReader(tlsSocket, l => handleLine(tlsSocket, l));
-            });
+            handleLine(
+                rawSocket,
+                line,
+                () => {
+                    // Upgrade: stop reading plaintext, wrap the socket in TLS
+                    detachPlain();
+                    let tlsSocket = new tls.TLSSocket(rawSocket, { isServer: true, key, cert });
+                    tlsSocket.on('error', () => {});
+                    tlsSocket.on('secure', () => {});
+                    // post-TLS phase advertises a different capability set
+                    lineReader(tlsSocket, l => handleLine(tlsSocket, l, null, `${CAPS} POSTTLS-ONLY`));
+                },
+                `${CAPS} STARTTLS PRETLS-ONLY`
+            );
         });
 
-        rawSocket.write(`* OK [CAPABILITY ${CAPS} STARTTLS] ready\r\n`);
+        rawSocket.write(`* OK [CAPABILITY ${CAPS} STARTTLS PRETLS-ONLY] ready\r\n`);
     });
 
     let port = await listen(server);
@@ -113,6 +123,10 @@ module.exports['Secure: STARTTLS upgrade completes a session'] = async test => {
     test.ok(client.secureConnection, 'connection upgraded to TLS');
     test.ok(client.authenticated, 'authenticated over TLS');
     test.ok(client.usable);
+    // RFC 9051 6.2.1: capabilities cached before STARTTLS MUST be discarded and
+    // re-fetched over the TLS channel
+    test.ok(client.capabilities.has('POSTTLS-ONLY'), 'post-TLS capabilities were re-fetched');
+    test.ok(!client.capabilities.has('PRETLS-ONLY'), 'pre-TLS capabilities were discarded');
 
     await client.noop();
     await client.logout();