imapflow 2.2.5 → 2.2.6

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [2.2.6](https://github.com/postalsys/imapflow/compare/v2.2.5...v2.2.6) (2026-10-06)
+
+
+### Bug Fixes
+
+* harden response parsing and command compilation found by fuzzing ([85b842a](https://github.com/postalsys/imapflow/commit/85b842a2eafd92afad90649968a11cdeee363758))
+* read digit-led atoms like "2024:Q1" instead of dropping the response line ([47bf6ec](https://github.com/postalsys/imapflow/commit/47bf6eca2178bad831ccc878f75f165ed1b8d4e9))
+
 ## [2.2.5](https://github.com/postalsys/imapflow/compare/v2.2.4...v2.2.5) (2026-10-04)
 
 

package/dist/cjs/commands/copyuid-parser.js

@@ -2,6 +2,20 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseCopyUid = parseCopyUid;
 const tools_js_1 = require("../tools.js");
+/**
+ * Whether a value is a complete uid-set (RFC 4315): comma separated UIDs and UID ranges. The UID
+ * map pairs the source and destination sets by position, so a set with a malformed element must
+ * be refused as a whole: skipping the element, as expandRange() does, would shift every UID after
+ * it onto the wrong counterpart. Checked per element, as a whole-set regex with an unbounded
+ * repeat can overflow the regex engine on very long sets.
+ */
+const UID_SET_ELEMENT = /^\d+(:\d+)?$/;
+const isUidSet = (value) => typeof value === 'string' && value.split(',').every(part => UID_SET_ELEMENT.test(part));
+// The UIDs of a uid-set attribute, or false when the attribute is not a complete uid-set
+const uidSetValues = (attribute) => {
+    const value = attribute && attribute.value;
+    return isUidSet(value) ? (0, tools_js_1.expandRange)(value) : false;
+};
 /**
  * Parses COPYUID response code from an IMAP response (RFC 4315).
  * Used by both COPY and MOVE commands to extract the UID mapping
@@ -24,8 +38,8 @@ function parseCopyUid(response, map) {
     if (uidValidity !== false) {
         map.uidValidity = uidValidity;
     }
-    const sourceUids = codeSection[2] && typeof codeSection[2].value === 'string' ? (0, tools_js_1.expandRange)(codeSection[2].value) : false;
-    const destinationUids = codeSection[3] && typeof codeSection[3].value === 'string' ? (0, tools_js_1.expandRange)(codeSection[3].value) : false;
+    const sourceUids = uidSetValues(codeSection[2]);
+    const destinationUids = uidSetValues(codeSection[3]);
     if (sourceUids && destinationUids && sourceUids.length === destinationUids.length) {
         map.uidMap = new Map(sourceUids.map((uid, i) => [uid, destinationUids[i]]));
     }

package/dist/cjs/handler/imap-compiler.js

@@ -86,28 +86,27 @@ async function compiler(response, options) {
         .concat(response.command ? emitEntry(' ' + response.command) : []);
     let val;
     let lastType;
+    // Set right after the compiler writes "(" or "[" itself, so the first element inside gets no
+    // leading space
+    let afterOpener = false;
     let walk = async (node, options) => {
         options = options || {};
-        // Determine whether a space separator is needed before this node.
-        // Inspect the last byte written to decide context.
-        let lastRespEntry = resp.length && resp[resp.length - 1];
-        let lastRespByte = (lastRespEntry && lastRespEntry.length && lastRespEntry[lastRespEntry.length - 1]) || '';
-        if (typeof lastRespByte === 'number') {
-            lastRespByte = String.fromCharCode(lastRespByte);
-        }
         // Add a space separator when:
         // - The previous token was a LITERAL. Literal data ends exactly at its declared length, so
         //   a following token always needs an explicit separator, even though the last written byte
         //   is arbitrary literal content.
-        // - Otherwise: there is something written already (resp is not empty) and the last byte is
-        //   not an opening delimiter ('(', '<' or '['), which suppresses the space.
+        // - Otherwise: there is something written already (resp is not empty) and the compiler did
+        //   not just open a list or a section. This is tracked rather than read back from the last
+        //   written byte: a token value can itself end in "(", "[" or "<" (an atom such as "X["),
+        //   and suppressing the space after it would fuse it with the next argument.
         // A sub-array element in a consecutive-list context never gets one (no space between
         // adjacent lists).
-        if (lastType === 'LITERAL' || (!['(', '<', '['].includes(lastRespByte) && resp.length)) {
+        if (lastType === 'LITERAL' || (!afterOpener && resp.length)) {
             if (!options.subArray) {
                 resp.push(emitEntry(' '));
             }
         }
+        afterOpener = false;
         if (node && node.buffer && !Buffer.isBuffer(node)) {
             // mongodb binary
             node = node.buffer;
@@ -115,6 +114,7 @@ async function compiler(response, options) {
         if (Array.isArray(node)) {
             lastType = 'LIST';
             resp.push(emitEntry('('));
+            afterOpener = true;
             // check if we need to skip separator WS between two arrays
             let subArray = node.length > 1 && Array.isArray(node[0]);
             for (let child of node) {
@@ -124,6 +124,7 @@ async function compiler(response, options) {
                 await walk(child, { subArray });
             }
             resp.push(emitEntry(')'));
+            afterOpener = false;
             return;
         }
         if (!node && typeof node !== 'string' && typeof node !== 'number' && !Buffer.isBuffer(node)) {
@@ -199,19 +200,22 @@ async function compiler(response, options) {
                 // when logging: the incoming token parser accepts sequence-shaped tokens
                 // this strict grammar rejects (an ESEARCH set like "1:2:3", a folder
                 // name like "12:30:00"), and re-compiling a server response for the log
-                // or for error text must never throw.
-                if (!isLogging && (typeof node.value === 'string' || typeof node.value === 'number' || Buffer.isBuffer(node.value))) {
-                    val = node.value.toString();
-                    if (val && !isValidSequenceSet(val)) {
+                // or for error text must never throw. An empty or missing set is refused
+                // too: it would put nothing on the wire and leave the next argument in its
+                // place.
+                // Emitted raw: the validated alphabet cannot contain a line terminator, and
+                // re-scanning a potentially multi-megabyte set in the choke point would
+                // double the cost of exactly the sets this branch exists for
+                if (!isLogging) {
+                    val = node.value === null || node.value === undefined ? '' : node.value.toString();
+                    if (!isValidSequenceSet(val)) {
                         let error = new Error('Invalid sequence set value');
                         error.code = 'InvalidSequenceSet';
                         throw error;
                     }
+                    resp.push(emitEntry(val, { raw: true }));
                 }
-                if (node.value) {
-                    // raw: the validated alphabet cannot contain a line terminator, and
-                    // re-scanning a potentially multi-megabyte set in the choke point
-                    // would double the cost of exactly the sets this branch exists for
+                else if (node.value) {
                     resp.push(emitEntry(node.value, { raw: true }));
                 }
                 break;
@@ -252,10 +256,12 @@ async function compiler(response, options) {
                 // e.g., BODY[HEADER.FIELDS (Subject)] or BODY[1.MIME]
                 if (node.section) {
                     resp.push(emitEntry('['));
+                    afterOpener = true;
                     for (let child of node.section) {
                         await walk(child);
                     }
                     resp.push(emitEntry(']'));
+                    afterOpener = false;
                 }
                 // Partial range: emit <origin.length> after the section brackets. Coerced
                 // rather than joined as-is: this is the last token component written
@@ -278,7 +284,8 @@ async function compiler(response, options) {
         respParts.push(resp);
     }
     const compiled = respParts.map(part => Buffer.concat(part));
-    return asArray ? compiled : compiled.flatMap(entry => entry);
+    // without asArray there is a single part, returned as is instead of copied
+    return asArray ? compiled : compiled.length === 1 ? compiled[0] : Buffer.concat(compiled);
 }
 exports.default = compiler;
 module.exports = exports.default;

package/dist/cjs/handler/token-parser.js

@@ -13,7 +13,6 @@ const STATE_NORMAL = 0x003;
 const STATE_PARTIAL = 0x004;
 const STATE_SEQUENCE = 0x005;
 const STATE_STRING = 0x006;
-const RE_DIGITS = /^\d+$/;
 const RE_SINGLE_DIGIT = /^\d$/;
 // Prevents stack overflow from maliciously crafted deeply-nested IMAP input (e.g., (((((...))))))
 const MAX_NODE_DEPTH = 25;
@@ -175,6 +174,63 @@ class TokenParser {
                 i++;
             }
         };
+        // Whether chr is the closing delimiter of node: ")" ends a LIST, "]" ends a SECTION
+        const closesNode = (c, node) => !!node && ((c === ')' && node.type === 'LIST') || (c === ']' && node.type === 'SECTION'));
+        // Facts about the ATOM, SEQUENCE or PARTIAL token being read, kept up to date as its
+        // characters are appended. Reading them back from the value instead (value.at(-1),
+        // value.includes('*'), a regex test) makes V8 flatten the string built with += on every
+        // character, which is quadratic in the token length, and the server decides that length:
+        // a 600 KB ESEARCH result took seconds of event loop time
+        let tokenLength = 0;
+        let tokenLast = '';
+        let tokenPrev = '';
+        let tokenDigitsOnly = true;
+        let tokenHasStar = false;
+        let tokenHasDot = false;
+        const appendToToken = (c) => {
+            this.currentNode.value += c;
+            tokenLength++;
+            tokenPrev = tokenLast;
+            tokenLast = c;
+            tokenDigitsOnly = tokenDigitsOnly && RE_SINGLE_DIGIT.test(c);
+            tokenHasStar = tokenHasStar || c === '*';
+            tokenHasDot = tokenHasDot || c === '.';
+        };
+        // A digit-led token is only a guess at a sequence set. ":" and "," are ATOM-CHARs, so a
+        // server sends a mailbox name, keyword or label such as "2024:Q1" or "1,a" unquoted, and
+        // rejecting it would drop the whole response line: the mailbox missing from LIST, the
+        // message missing from FETCH. When the sequence grammar breaks, such a token is read on as
+        // an atom, and the atom rules decide whether the current character is acceptable. A token
+        // holding "*" can not be an atom ("*" is not an ATOM-CHAR), so it keeps the sequence errors
+        const continueAsAtom = () => {
+            this.currentNode.type = 'ATOM';
+            this.state = STATE_ATOM;
+            // read the current character again, in STATE_ATOM
+            i--;
+        };
+        // Starts the value of the current node as a new token, with its first character if any
+        const startToken = (first) => {
+            this.currentNode.value = '';
+            tokenLength = 0;
+            tokenLast = tokenPrev = '';
+            tokenDigitsOnly = true;
+            tokenHasStar = tokenHasDot = false;
+            if (first) {
+                appendToToken(first);
+            }
+        };
+        // ImapStream supplies one buffer per literal marker it framed, {0} included. A marker
+        // without a buffer means the line and its literals do not match up, so fail with a parser
+        // error instead of reading a missing buffer or shifting every later literal by one
+        const takeLiteral = (literals) => {
+            if (!literals.length) {
+                let error = new Error(`Literal without data at position ${this.pos + i} [E35]`);
+                error.code = 'ParserError35';
+                error.parserContext = { input: this.str, pos: this.pos + i, chr };
+                throw error;
+            }
+            return literals.shift();
+        };
         // Any ATOM supported char starts a new Atom sequence, otherwise throw an error
         // Allow \ as the first char for atom to support system flags
         // Allow % to support LIST '' %
@@ -190,7 +246,7 @@ class TokenParser {
             }
             this.currentNode = this.createNode(this.currentNode, this.pos + i);
             this.currentNode.type = 'ATOM';
-            this.currentNode.value = chr;
+            startToken(chr);
             this.state = STATE_ATOM;
         };
         for (i = 0, len = this.str.length; i < len; i++) {
@@ -245,12 +301,13 @@ class TokenParser {
                             if (this.str.charAt(i - 1) !== ']') {
                                 this.currentNode = this.createNode(this.currentNode, this.pos + i);
                                 this.currentNode.type = 'ATOM';
-                                this.currentNode.value = chr;
+                                startToken(chr);
                                 this.state = STATE_ATOM;
                             }
                             else {
                                 this.currentNode = this.createNode(this.currentNode, this.pos + i);
                                 this.currentNode.type = 'PARTIAL';
+                                startToken();
                                 this.state = STATE_PARTIAL;
                                 this.currentNode.isClosed = false;
                             }
@@ -260,12 +317,14 @@ class TokenParser {
                         case '~': {
                             let nextChr = this.str.charAt(i + 1);
                             if (nextChr !== '{') {
-                                if (imap_formal_syntax_js_1.default['ATOM-CHAR']().includes(nextChr)) {
-                                    // '~' not followed by '{' but followed by an ATOM char: treat as ATOM
-                                    this.currentNode = this.createNode(this.currentNode, this.pos + i);
-                                    this.currentNode.type = 'ATOM';
-                                    this.currentNode.value = chr;
-                                    this.state = STATE_ATOM;
+                                // '~' is an ATOM-CHAR itself, so when it does not start a literal8
+                                // it starts an atom, including the one-character atom "~" that a
+                                // space, the end of the line or a closing delimiter ends
+                                if (imap_formal_syntax_js_1.default['ATOM-CHAR']().includes(nextChr) ||
+                                    nextChr === ' ' ||
+                                    nextChr === '' ||
+                                    closesNode(nextChr, this.currentNode)) {
+                                    startAtom();
                                     break;
                                 }
                                 let error = new Error(`Unexpected literal8 marker at position ${this.pos + i} [E12]`);
@@ -291,7 +350,7 @@ class TokenParser {
                         case '*':
                             this.currentNode = this.createNode(this.currentNode, this.pos + i);
                             this.currentNode.type = 'SEQUENCE';
-                            this.currentNode.value = chr;
+                            startToken(chr);
                             this.currentNode.isClosed = false;
                             this.state = STATE_SEQUENCE;
                             break;
@@ -372,8 +431,7 @@ class TokenParser {
                         break;
                     }
                     // ')' or ']' terminates the atom AND closes the enclosing LIST or SECTION
-                    if (this.currentNode.parentNode &&
-                        ((chr === ')' && this.currentNode.parentNode.type === 'LIST') || (chr === ']' && this.currentNode.parentNode.type === 'SECTION'))) {
+                    if (closesNode(chr, this.currentNode.parentNode)) {
                         this.currentNode.endPos = this.pos + i - 1;
                         this.currentNode = this.currentNode.parentNode;
                         this.currentNode.isClosed = true;
@@ -409,14 +467,16 @@ class TokenParser {
                     }
                     // If the atom so far is all digits and we see ',' or ':', it is actually
                     // a sequence set (e.g., "1:5" or "1,3,5"), so reclassify and switch state
-                    if ((chr === ',' || chr === ':') && RE_DIGITS.test(this.currentNode.value)) {
+                    if ((chr === ',' || chr === ':') && tokenLength && tokenDigitsOnly) {
                         this.currentNode.type = 'SEQUENCE';
                         this.currentNode.isClosed = true;
                         this.state = STATE_SEQUENCE;
                     }
                     // [ starts a section group for this element
                     // Allowed only for selected elements, otherwise falls through to regular ATOM processing
-                    if (chr === '[' && ['BODY', 'BODY.PEEK', 'BINARY', 'BINARY.PEEK'].includes(this.currentNode.value.toUpperCase())) {
+                    if (chr === '[' &&
+                        tokenLength <= 11 &&
+                        ['BODY', 'BODY.PEEK', 'BINARY', 'BINARY.PEEK'].includes(this.currentNode.value.toUpperCase())) {
                         this.currentNode.endPos = this.pos + i;
                         this.currentNode = this.createNode(this.currentNode.parentNode, this.pos + i);
                         this.currentNode.type = 'SECTION';
@@ -441,7 +501,7 @@ class TokenParser {
                         error.parserContext = { input: this.str, pos: this.pos + i, chr };
                         throw error;
                     }
-                    this.currentNode.value += chr;
+                    appendToToken(chr);
                     break;
                 case STATE_STRING:
                     // DQUOTE ends the string sequence
@@ -468,7 +528,7 @@ class TokenParser {
                     break;
                 case STATE_PARTIAL:
                     if (chr === '>') {
-                        if (this.currentNode.value.at(-1) === '.') {
+                        if (tokenLast === '.') {
                             let error = new Error(`Unexpected end of partial at position ${this.pos + i} [E19]`);
                             error.code = 'ParserError19';
                             error.parserContext = { input: this.str, pos: this.pos + i, chr };
@@ -481,7 +541,7 @@ class TokenParser {
                         checkSP();
                         break;
                     }
-                    if (chr === '.' && (this.currentNode.value === '' || this.currentNode.value.includes('.'))) {
+                    if (chr === '.' && (!tokenLength || tokenHasDot)) {
                         let error = new Error(`Unexpected partial separator . at position ${this.pos + i} [E20]`);
                         error.code = 'ParserError20';
                         error.parserContext = { input: this.str, pos: this.pos + i, chr };
@@ -493,13 +553,13 @@ class TokenParser {
                         error.parserContext = { input: this.str, pos: this.pos + i, chr };
                         throw error;
                     }
-                    if ((this.currentNode.value === '0' || this.currentNode.value.endsWith('.0')) && chr !== '.') {
+                    if (tokenLast === '0' && (tokenLength === 1 || tokenPrev === '.') && chr !== '.') {
                         let error = new Error(`Invalid partial at position ${this.pos + i} [E22: ${JSON.stringify(chr)}]`);
                         error.code = 'ParserError22';
                         error.parserContext = { input: this.str, pos: this.pos + i, chr };
                         throw error;
                     }
-                    this.currentNode.value += chr;
+                    appendToToken(chr);
                     break;
                 case STATE_LITERAL:
                     if (this.currentNode.started) {
@@ -550,12 +610,10 @@ class TokenParser {
                         if (!this.currentNode.literalLength) {
                             // special case where literal content length is 0
                             // close the node right away, do not wait for additional input
-                            if (this.options.literals && this.options.literals.length) {
-                                // ImapStream queues a Buffer for every literal marker it
-                                // extracts, including {0} - consume the queue entry so
-                                // subsequent literals in the same response stay aligned
-                                // with their markers instead of shifting by one
-                                this.currentNode.value = this.options.literals.shift();
+                            if (this.options.literals) {
+                                // consume the queue entry of the {0} marker too, so later
+                                // literals in the same response stay aligned with their markers
+                                this.currentNode.value = takeLiteral(this.options.literals);
                             }
                             this.currentNode.endPos = this.pos + i;
                             this.currentNode.isClosed = true;
@@ -565,7 +623,7 @@ class TokenParser {
                         }
                         else if (this.options.literals) {
                             // use the next precached literal values
-                            this.currentNode.value = this.options.literals.shift();
+                            this.currentNode.value = takeLiteral(this.options.literals);
                             // only APPEND arguments are kept as Buffers
                             /*
                             if ((this.parent.command || '').toString().toUpperCase() !== 'APPEND') {
@@ -620,19 +678,24 @@ class TokenParser {
                     }
                     this.currentNode.literalLength = (this.currentNode.literalLength || '') + chr;
                     break;
-                case STATE_SEQUENCE:
-                    // space finishes the sequence set
-                    if (chr === ' ') {
-                        if (!RE_SINGLE_DIGIT.test(this.currentNode.value.at(-1)) && this.currentNode.value.at(-1) !== '*') {
-                            let error = new Error(`Unexpected whitespace at position ${this.pos + i} [E27]`);
+                case STATE_SEQUENCE: {
+                    // A space ends the sequence set, and so does the closing delimiter of the
+                    // enclosing list or section ("PARTIAL (1:100 5,7,9)", "[COPYUID 1 1:3 4,5]")
+                    let closesParent = closesNode(chr, this.currentNode.parentNode);
+                    if (chr === ' ' || closesParent) {
+                        if (!RE_SINGLE_DIGIT.test(tokenLast) && tokenLast !== '*') {
+                            if (!tokenHasStar) {
+                                // a dangling separator, "10:" or "1,"
+                                continueAsAtom();
+                                break;
+                            }
+                            let error = new Error(`Unexpected end of sequence at position ${this.pos + i} [E27: ${JSON.stringify(chr)}]`);
                             error.code = 'ParserError27';
                             error.parserContext = { input: this.str, pos: this.pos + i, chr };
                             throw error;
                         }
-                        if (this.currentNode.value !== '*' &&
-                            this.currentNode.value.at(-1) === '*' &&
-                            this.currentNode.value.at(-2) !== ':') {
-                            let error = new Error(`Unexpected whitespace at position ${this.pos + i} [E28]`);
+                        if (this.currentNode.value !== '*' && tokenLast === '*' && tokenPrev !== ':') {
+                            let error = new Error(`Unexpected end of sequence at position ${this.pos + i} [E28: ${JSON.stringify(chr)}]`);
                             error.code = 'ParserError28';
                             error.parserContext = { input: this.str, pos: this.pos + i, chr };
                             throw error;
@@ -641,20 +704,20 @@ class TokenParser {
                         this.currentNode.endPos = this.pos + i - 1;
                         this.currentNode = this.currentNode.parentNode;
                         this.state = STATE_NORMAL;
-                        break;
-                    }
-                    else if (this.currentNode.parentNode && chr === ']' && this.currentNode.parentNode.type === 'SECTION') {
-                        this.currentNode.endPos = this.pos + i - 1;
-                        this.currentNode = this.currentNode.parentNode;
-                        this.currentNode.isClosed = true;
-                        this.currentNode.endPos = this.pos + i;
-                        this.currentNode = this.currentNode.parentNode;
-                        this.state = STATE_NORMAL;
-                        checkSP();
+                        if (closesParent) {
+                            this.currentNode.isClosed = true;
+                            this.currentNode.endPos = this.pos + i;
+                            this.currentNode = this.currentNode.parentNode;
+                            checkSP();
+                        }
                         break;
                     }
                     if (chr === ':') {
-                        if (!RE_SINGLE_DIGIT.test(this.currentNode.value.at(-1)) && this.currentNode.value.at(-1) !== '*') {
+                        if (!RE_SINGLE_DIGIT.test(tokenLast) && tokenLast !== '*') {
+                            if (!tokenHasStar) {
+                                continueAsAtom();
+                                break;
+                            }
                             let error = new Error(`Unexpected range separator : at position ${this.pos + i} [E29]`);
                             error.code = 'ParserError29';
                             error.parserContext = { input: this.str, pos: this.pos + i, chr };
@@ -662,7 +725,7 @@ class TokenParser {
                         }
                     }
                     else if (chr === '*') {
-                        if (![',', ':'].includes(this.currentNode.value.at(-1))) {
+                        if (![',', ':'].includes(tokenLast)) {
                             let error = new Error(`Unexpected range wildcard at position ${this.pos + i} [E30]`);
                             error.code = 'ParserError30';
                             error.parserContext = { input: this.str, pos: this.pos + i, chr };
@@ -670,13 +733,17 @@ class TokenParser {
                         }
                     }
                     else if (chr === ',') {
-                        if (!RE_SINGLE_DIGIT.test(this.currentNode.value.at(-1)) && this.currentNode.value.at(-1) !== '*') {
+                        if (!RE_SINGLE_DIGIT.test(tokenLast) && tokenLast !== '*') {
+                            if (!tokenHasStar) {
+                                continueAsAtom();
+                                break;
+                            }
                             let error = new Error(`Unexpected sequence separator , at position ${this.pos + i} [E31]`);
                             error.code = 'ParserError31';
                             error.parserContext = { input: this.str, pos: this.pos + i, chr };
                             throw error;
                         }
-                        if (this.currentNode.value.at(-1) === '*' && this.currentNode.value.at(-2) !== ':') {
+                        if (tokenLast === '*' && tokenPrev !== ':') {
                             let error = new Error(`Unexpected sequence separator , at position ${this.pos + i} [E32]`);
                             error.code = 'ParserError32';
                             error.parserContext = { input: this.str, pos: this.pos + i, chr };
@@ -684,21 +751,30 @@ class TokenParser {
                         }
                     }
                     else if (!RE_SINGLE_DIGIT.test(chr)) {
+                        if (!tokenHasStar) {
+                            continueAsAtom();
+                            break;
+                        }
                         let error = new Error(`Unexpected char at position ${this.pos + i} [E33: ${JSON.stringify(chr)}]`);
                         error.code = 'ParserError33';
                         error.parserContext = { input: this.str, pos: this.pos + i, chr };
                         throw error;
                     }
-                    if (RE_SINGLE_DIGIT.test(chr) && this.currentNode.value.at(-1) === '*') {
+                    if (RE_SINGLE_DIGIT.test(chr) && tokenLast === '*') {
                         let error = new Error(`Unexpected number at position ${this.pos + i} [E34: ${JSON.stringify(chr)}]`);
                         error.code = 'ParserError34';
                         error.parserContext = { input: this.str, pos: this.pos + i, chr };
                         throw error;
                     }
-                    this.currentNode.value += chr;
+                    appendToToken(chr);
                     break;
+                }
             }
         }
+        // the same applies to a digit-led token that ends the input on a dangling separator ("10:")
+        if (this.state === STATE_SEQUENCE && (tokenLast === ':' || tokenLast === ',') && !tokenHasStar) {
+            this.currentNode.type = 'ATOM';
+        }
     }
 }
 exports.TokenParser = TokenParser;

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "imapflow";
-export declare const version = "2.2.5";
+export declare const version = "2.2.6";
 export declare const homepage = "https://imapflow.com/";

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = "imapflow";
-exports.version = "2.2.5";
+exports.version = "2.2.6";
 exports.homepage = "https://imapflow.com/";

package/dist/cjs/search-compiler.js

@@ -389,8 +389,12 @@ const searchCompiler = (connection, query) => {
                     }
                     break;
                 // NOT operator
+                // A falsy operand means no NOT clause (`not: cond && {...}`). Any other one goes
+                // through walkOperand(), which refuses a value that is not a query object or
+                // compiles to nothing: dropping it would turn the filter into a search that
+                // matches everything
                 case 'NOT':
-                    if (params[term] && typeof params[term] === 'object') {
+                    if (params[term]) {
                         attributes.push({ type: 'ATOM', value: 'NOT' });
                         walkOperand('NOT', params[term]);
                     }
@@ -403,8 +407,8 @@ const searchCompiler = (connection, query) => {
                         }
                         // Single element - just process it directly
                         if (params[term].length === 1) {
-                            if (typeof params[term][0] === 'object' && params[term][0]) {
-                                walk(params[term][0]);
+                            if (params[term][0]) {
+                                walkOperand('OR', params[term][0]);
                             }
                             break;
                         }

package/dist/esm/commands/copyuid-parser.js

@@ -1,4 +1,18 @@
 import { expandRange, parseBigIntValue } from '../tools.js';
+/**
+ * Whether a value is a complete uid-set (RFC 4315): comma separated UIDs and UID ranges. The UID
+ * map pairs the source and destination sets by position, so a set with a malformed element must
+ * be refused as a whole: skipping the element, as expandRange() does, would shift every UID after
+ * it onto the wrong counterpart. Checked per element, as a whole-set regex with an unbounded
+ * repeat can overflow the regex engine on very long sets.
+ */
+const UID_SET_ELEMENT = /^\d+(:\d+)?$/;
+const isUidSet = (value) => typeof value === 'string' && value.split(',').every(part => UID_SET_ELEMENT.test(part));
+// The UIDs of a uid-set attribute, or false when the attribute is not a complete uid-set
+const uidSetValues = (attribute) => {
+    const value = attribute && attribute.value;
+    return isUidSet(value) ? expandRange(value) : false;
+};
 /**
  * Parses COPYUID response code from an IMAP response (RFC 4315).
  * Used by both COPY and MOVE commands to extract the UID mapping
@@ -21,8 +35,8 @@ export function parseCopyUid(response, map) {
     if (uidValidity !== false) {
         map.uidValidity = uidValidity;
     }
-    const sourceUids = codeSection[2] && typeof codeSection[2].value === 'string' ? expandRange(codeSection[2].value) : false;
-    const destinationUids = codeSection[3] && typeof codeSection[3].value === 'string' ? expandRange(codeSection[3].value) : false;
+    const sourceUids = uidSetValues(codeSection[2]);
+    const destinationUids = uidSetValues(codeSection[3]);
     if (sourceUids && destinationUids && sourceUids.length === destinationUids.length) {
         map.uidMap = new Map(sourceUids.map((uid, i) => [uid, destinationUids[i]]));
     }

package/dist/esm/handler/imap-compiler.js

@@ -81,28 +81,27 @@ async function compiler(response, options) {
         .concat(response.command ? emitEntry(' ' + response.command) : []);
     let val;
     let lastType;
+    // Set right after the compiler writes "(" or "[" itself, so the first element inside gets no
+    // leading space
+    let afterOpener = false;
     let walk = async (node, options) => {
         options = options || {};
-        // Determine whether a space separator is needed before this node.
-        // Inspect the last byte written to decide context.
-        let lastRespEntry = resp.length && resp[resp.length - 1];
-        let lastRespByte = (lastRespEntry && lastRespEntry.length && lastRespEntry[lastRespEntry.length - 1]) || '';
-        if (typeof lastRespByte === 'number') {
-            lastRespByte = String.fromCharCode(lastRespByte);
-        }
         // Add a space separator when:
         // - The previous token was a LITERAL. Literal data ends exactly at its declared length, so
         //   a following token always needs an explicit separator, even though the last written byte
         //   is arbitrary literal content.
-        // - Otherwise: there is something written already (resp is not empty) and the last byte is
-        //   not an opening delimiter ('(', '<' or '['), which suppresses the space.
+        // - Otherwise: there is something written already (resp is not empty) and the compiler did
+        //   not just open a list or a section. This is tracked rather than read back from the last
+        //   written byte: a token value can itself end in "(", "[" or "<" (an atom such as "X["),
+        //   and suppressing the space after it would fuse it with the next argument.
         // A sub-array element in a consecutive-list context never gets one (no space between
         // adjacent lists).
-        if (lastType === 'LITERAL' || (!['(', '<', '['].includes(lastRespByte) && resp.length)) {
+        if (lastType === 'LITERAL' || (!afterOpener && resp.length)) {
             if (!options.subArray) {
                 resp.push(emitEntry(' '));
             }
         }
+        afterOpener = false;
         if (node && node.buffer && !Buffer.isBuffer(node)) {
             // mongodb binary
             node = node.buffer;
@@ -110,6 +109,7 @@ async function compiler(response, options) {
         if (Array.isArray(node)) {
             lastType = 'LIST';
             resp.push(emitEntry('('));
+            afterOpener = true;
             // check if we need to skip separator WS between two arrays
             let subArray = node.length > 1 && Array.isArray(node[0]);
             for (let child of node) {
@@ -119,6 +119,7 @@ async function compiler(response, options) {
                 await walk(child, { subArray });
             }
             resp.push(emitEntry(')'));
+            afterOpener = false;
             return;
         }
         if (!node && typeof node !== 'string' && typeof node !== 'number' && !Buffer.isBuffer(node)) {
@@ -194,19 +195,22 @@ async function compiler(response, options) {
                 // when logging: the incoming token parser accepts sequence-shaped tokens
                 // this strict grammar rejects (an ESEARCH set like "1:2:3", a folder
                 // name like "12:30:00"), and re-compiling a server response for the log
-                // or for error text must never throw.
-                if (!isLogging && (typeof node.value === 'string' || typeof node.value === 'number' || Buffer.isBuffer(node.value))) {
-                    val = node.value.toString();
-                    if (val && !isValidSequenceSet(val)) {
+                // or for error text must never throw. An empty or missing set is refused
+                // too: it would put nothing on the wire and leave the next argument in its
+                // place.
+                // Emitted raw: the validated alphabet cannot contain a line terminator, and
+                // re-scanning a potentially multi-megabyte set in the choke point would
+                // double the cost of exactly the sets this branch exists for
+                if (!isLogging) {
+                    val = node.value === null || node.value === undefined ? '' : node.value.toString();
+                    if (!isValidSequenceSet(val)) {
                         let error = new Error('Invalid sequence set value');
                         error.code = 'InvalidSequenceSet';
                         throw error;
                     }
+                    resp.push(emitEntry(val, { raw: true }));
                 }
-                if (node.value) {
-                    // raw: the validated alphabet cannot contain a line terminator, and
-                    // re-scanning a potentially multi-megabyte set in the choke point
-                    // would double the cost of exactly the sets this branch exists for
+                else if (node.value) {
                     resp.push(emitEntry(node.value, { raw: true }));
                 }
                 break;
@@ -247,10 +251,12 @@ async function compiler(response, options) {
                 // e.g., BODY[HEADER.FIELDS (Subject)] or BODY[1.MIME]
                 if (node.section) {
                     resp.push(emitEntry('['));
+                    afterOpener = true;
                     for (let child of node.section) {
                         await walk(child);
                     }
                     resp.push(emitEntry(']'));
+                    afterOpener = false;
                 }
                 // Partial range: emit <origin.length> after the section brackets. Coerced
                 // rather than joined as-is: this is the last token component written
@@ -273,6 +279,7 @@ async function compiler(response, options) {
         respParts.push(resp);
     }
     const compiled = respParts.map(part => Buffer.concat(part));
-    return asArray ? compiled : compiled.flatMap(entry => entry);
+    // without asArray there is a single part, returned as is instead of copied
+    return asArray ? compiled : compiled.length === 1 ? compiled[0] : Buffer.concat(compiled);
 }
 export default compiler;

package/dist/esm/handler/token-parser.js

@@ -7,7 +7,6 @@ const STATE_NORMAL = 0x003;
 const STATE_PARTIAL = 0x004;
 const STATE_SEQUENCE = 0x005;
 const STATE_STRING = 0x006;
-const RE_DIGITS = /^\d+$/;
 const RE_SINGLE_DIGIT = /^\d$/;
 // Prevents stack overflow from maliciously crafted deeply-nested IMAP input (e.g., (((((...))))))
 const MAX_NODE_DEPTH = 25;
@@ -169,6 +168,63 @@ export class TokenParser {
                 i++;
             }
         };
+        // Whether chr is the closing delimiter of node: ")" ends a LIST, "]" ends a SECTION
+        const closesNode = (c, node) => !!node && ((c === ')' && node.type === 'LIST') || (c === ']' && node.type === 'SECTION'));
+        // Facts about the ATOM, SEQUENCE or PARTIAL token being read, kept up to date as its
+        // characters are appended. Reading them back from the value instead (value.at(-1),
+        // value.includes('*'), a regex test) makes V8 flatten the string built with += on every
+        // character, which is quadratic in the token length, and the server decides that length:
+        // a 600 KB ESEARCH result took seconds of event loop time
+        let tokenLength = 0;
+        let tokenLast = '';
+        let tokenPrev = '';
+        let tokenDigitsOnly = true;
+        let tokenHasStar = false;
+        let tokenHasDot = false;
+        const appendToToken = (c) => {
+            this.currentNode.value += c;
+            tokenLength++;
+            tokenPrev = tokenLast;
+            tokenLast = c;
+            tokenDigitsOnly = tokenDigitsOnly && RE_SINGLE_DIGIT.test(c);
+            tokenHasStar = tokenHasStar || c === '*';
+            tokenHasDot = tokenHasDot || c === '.';
+        };
+        // A digit-led token is only a guess at a sequence set. ":" and "," are ATOM-CHARs, so a
+        // server sends a mailbox name, keyword or label such as "2024:Q1" or "1,a" unquoted, and
+        // rejecting it would drop the whole response line: the mailbox missing from LIST, the
+        // message missing from FETCH. When the sequence grammar breaks, such a token is read on as
+        // an atom, and the atom rules decide whether the current character is acceptable. A token
+        // holding "*" can not be an atom ("*" is not an ATOM-CHAR), so it keeps the sequence errors
+        const continueAsAtom = () => {
+            this.currentNode.type = 'ATOM';
+            this.state = STATE_ATOM;
+            // read the current character again, in STATE_ATOM
+            i--;
+        };
+        // Starts the value of the current node as a new token, with its first character if any
+        const startToken = (first) => {
+            this.currentNode.value = '';
+            tokenLength = 0;
+            tokenLast = tokenPrev = '';
+            tokenDigitsOnly = true;
+            tokenHasStar = tokenHasDot = false;
+            if (first) {
+                appendToToken(first);
+            }
+        };
+        // ImapStream supplies one buffer per literal marker it framed, {0} included. A marker
+        // without a buffer means the line and its literals do not match up, so fail with a parser
+        // error instead of reading a missing buffer or shifting every later literal by one
+        const takeLiteral = (literals) => {
+            if (!literals.length) {
+                let error = new Error(`Literal without data at position ${this.pos + i} [E35]`);
+                error.code = 'ParserError35';
+                error.parserContext = { input: this.str, pos: this.pos + i, chr };
+                throw error;
+            }
+            return literals.shift();
+        };
         // Any ATOM supported char starts a new Atom sequence, otherwise throw an error
         // Allow \ as the first char for atom to support system flags
         // Allow % to support LIST '' %
@@ -184,7 +240,7 @@ export class TokenParser {
             }
             this.currentNode = this.createNode(this.currentNode, this.pos + i);
             this.currentNode.type = 'ATOM';
-            this.currentNode.value = chr;
+            startToken(chr);
             this.state = STATE_ATOM;
         };
         for (i = 0, len = this.str.length; i < len; i++) {
@@ -239,12 +295,13 @@ export class TokenParser {
                             if (this.str.charAt(i - 1) !== ']') {
                                 this.currentNode = this.createNode(this.currentNode, this.pos + i);
                                 this.currentNode.type = 'ATOM';
-                                this.currentNode.value = chr;
+                                startToken(chr);
                                 this.state = STATE_ATOM;
                             }
                             else {
                                 this.currentNode = this.createNode(this.currentNode, this.pos + i);
                                 this.currentNode.type = 'PARTIAL';
+                                startToken();
                                 this.state = STATE_PARTIAL;
                                 this.currentNode.isClosed = false;
                             }
@@ -254,12 +311,14 @@ export class TokenParser {
                         case '~': {
                             let nextChr = this.str.charAt(i + 1);
                             if (nextChr !== '{') {
-                                if (imapFormalSyntax['ATOM-CHAR']().includes(nextChr)) {
-                                    // '~' not followed by '{' but followed by an ATOM char: treat as ATOM
-                                    this.currentNode = this.createNode(this.currentNode, this.pos + i);
-                                    this.currentNode.type = 'ATOM';
-                                    this.currentNode.value = chr;
-                                    this.state = STATE_ATOM;
+                                // '~' is an ATOM-CHAR itself, so when it does not start a literal8
+                                // it starts an atom, including the one-character atom "~" that a
+                                // space, the end of the line or a closing delimiter ends
+                                if (imapFormalSyntax['ATOM-CHAR']().includes(nextChr) ||
+                                    nextChr === ' ' ||
+                                    nextChr === '' ||
+                                    closesNode(nextChr, this.currentNode)) {
+                                    startAtom();
                                     break;
                                 }
                                 let error = new Error(`Unexpected literal8 marker at position ${this.pos + i} [E12]`);
@@ -285,7 +344,7 @@ export class TokenParser {
                         case '*':
                             this.currentNode = this.createNode(this.currentNode, this.pos + i);
                             this.currentNode.type = 'SEQUENCE';
-                            this.currentNode.value = chr;
+                            startToken(chr);
                             this.currentNode.isClosed = false;
                             this.state = STATE_SEQUENCE;
                             break;
@@ -366,8 +425,7 @@ export class TokenParser {
                         break;
                     }
                     // ')' or ']' terminates the atom AND closes the enclosing LIST or SECTION
-                    if (this.currentNode.parentNode &&
-                        ((chr === ')' && this.currentNode.parentNode.type === 'LIST') || (chr === ']' && this.currentNode.parentNode.type === 'SECTION'))) {
+                    if (closesNode(chr, this.currentNode.parentNode)) {
                         this.currentNode.endPos = this.pos + i - 1;
                         this.currentNode = this.currentNode.parentNode;
                         this.currentNode.isClosed = true;
@@ -403,14 +461,16 @@ export class TokenParser {
                     }
                     // If the atom so far is all digits and we see ',' or ':', it is actually
                     // a sequence set (e.g., "1:5" or "1,3,5"), so reclassify and switch state
-                    if ((chr === ',' || chr === ':') && RE_DIGITS.test(this.currentNode.value)) {
+                    if ((chr === ',' || chr === ':') && tokenLength && tokenDigitsOnly) {
                         this.currentNode.type = 'SEQUENCE';
                         this.currentNode.isClosed = true;
                         this.state = STATE_SEQUENCE;
                     }
                     // [ starts a section group for this element
                     // Allowed only for selected elements, otherwise falls through to regular ATOM processing
-                    if (chr === '[' && ['BODY', 'BODY.PEEK', 'BINARY', 'BINARY.PEEK'].includes(this.currentNode.value.toUpperCase())) {
+                    if (chr === '[' &&
+                        tokenLength <= 11 &&
+                        ['BODY', 'BODY.PEEK', 'BINARY', 'BINARY.PEEK'].includes(this.currentNode.value.toUpperCase())) {
                         this.currentNode.endPos = this.pos + i;
                         this.currentNode = this.createNode(this.currentNode.parentNode, this.pos + i);
                         this.currentNode.type = 'SECTION';
@@ -435,7 +495,7 @@ export class TokenParser {
                         error.parserContext = { input: this.str, pos: this.pos + i, chr };
                         throw error;
                     }
-                    this.currentNode.value += chr;
+                    appendToToken(chr);
                     break;
                 case STATE_STRING:
                     // DQUOTE ends the string sequence
@@ -462,7 +522,7 @@ export class TokenParser {
                     break;
                 case STATE_PARTIAL:
                     if (chr === '>') {
-                        if (this.currentNode.value.at(-1) === '.') {
+                        if (tokenLast === '.') {
                             let error = new Error(`Unexpected end of partial at position ${this.pos + i} [E19]`);
                             error.code = 'ParserError19';
                             error.parserContext = { input: this.str, pos: this.pos + i, chr };
@@ -475,7 +535,7 @@ export class TokenParser {
                         checkSP();
                         break;
                     }
-                    if (chr === '.' && (this.currentNode.value === '' || this.currentNode.value.includes('.'))) {
+                    if (chr === '.' && (!tokenLength || tokenHasDot)) {
                         let error = new Error(`Unexpected partial separator . at position ${this.pos + i} [E20]`);
                         error.code = 'ParserError20';
                         error.parserContext = { input: this.str, pos: this.pos + i, chr };
@@ -487,13 +547,13 @@ export class TokenParser {
                         error.parserContext = { input: this.str, pos: this.pos + i, chr };
                         throw error;
                     }
-                    if ((this.currentNode.value === '0' || this.currentNode.value.endsWith('.0')) && chr !== '.') {
+                    if (tokenLast === '0' && (tokenLength === 1 || tokenPrev === '.') && chr !== '.') {
                         let error = new Error(`Invalid partial at position ${this.pos + i} [E22: ${JSON.stringify(chr)}]`);
                         error.code = 'ParserError22';
                         error.parserContext = { input: this.str, pos: this.pos + i, chr };
                         throw error;
                     }
-                    this.currentNode.value += chr;
+                    appendToToken(chr);
                     break;
                 case STATE_LITERAL:
                     if (this.currentNode.started) {
@@ -544,12 +604,10 @@ export class TokenParser {
                         if (!this.currentNode.literalLength) {
                             // special case where literal content length is 0
                             // close the node right away, do not wait for additional input
-                            if (this.options.literals && this.options.literals.length) {
-                                // ImapStream queues a Buffer for every literal marker it
-                                // extracts, including {0} - consume the queue entry so
-                                // subsequent literals in the same response stay aligned
-                                // with their markers instead of shifting by one
-                                this.currentNode.value = this.options.literals.shift();
+                            if (this.options.literals) {
+                                // consume the queue entry of the {0} marker too, so later
+                                // literals in the same response stay aligned with their markers
+                                this.currentNode.value = takeLiteral(this.options.literals);
                             }
                             this.currentNode.endPos = this.pos + i;
                             this.currentNode.isClosed = true;
@@ -559,7 +617,7 @@ export class TokenParser {
                         }
                         else if (this.options.literals) {
                             // use the next precached literal values
-                            this.currentNode.value = this.options.literals.shift();
+                            this.currentNode.value = takeLiteral(this.options.literals);
                             // only APPEND arguments are kept as Buffers
                             /*
                             if ((this.parent.command || '').toString().toUpperCase() !== 'APPEND') {
@@ -614,19 +672,24 @@ export class TokenParser {
                     }
                     this.currentNode.literalLength = (this.currentNode.literalLength || '') + chr;
                     break;
-                case STATE_SEQUENCE:
-                    // space finishes the sequence set
-                    if (chr === ' ') {
-                        if (!RE_SINGLE_DIGIT.test(this.currentNode.value.at(-1)) && this.currentNode.value.at(-1) !== '*') {
-                            let error = new Error(`Unexpected whitespace at position ${this.pos + i} [E27]`);
+                case STATE_SEQUENCE: {
+                    // A space ends the sequence set, and so does the closing delimiter of the
+                    // enclosing list or section ("PARTIAL (1:100 5,7,9)", "[COPYUID 1 1:3 4,5]")
+                    let closesParent = closesNode(chr, this.currentNode.parentNode);
+                    if (chr === ' ' || closesParent) {
+                        if (!RE_SINGLE_DIGIT.test(tokenLast) && tokenLast !== '*') {
+                            if (!tokenHasStar) {
+                                // a dangling separator, "10:" or "1,"
+                                continueAsAtom();
+                                break;
+                            }
+                            let error = new Error(`Unexpected end of sequence at position ${this.pos + i} [E27: ${JSON.stringify(chr)}]`);
                             error.code = 'ParserError27';
                             error.parserContext = { input: this.str, pos: this.pos + i, chr };
                             throw error;
                         }
-                        if (this.currentNode.value !== '*' &&
-                            this.currentNode.value.at(-1) === '*' &&
-                            this.currentNode.value.at(-2) !== ':') {
-                            let error = new Error(`Unexpected whitespace at position ${this.pos + i} [E28]`);
+                        if (this.currentNode.value !== '*' && tokenLast === '*' && tokenPrev !== ':') {
+                            let error = new Error(`Unexpected end of sequence at position ${this.pos + i} [E28: ${JSON.stringify(chr)}]`);
                             error.code = 'ParserError28';
                             error.parserContext = { input: this.str, pos: this.pos + i, chr };
                             throw error;
@@ -635,20 +698,20 @@ export class TokenParser {
                         this.currentNode.endPos = this.pos + i - 1;
                         this.currentNode = this.currentNode.parentNode;
                         this.state = STATE_NORMAL;
-                        break;
-                    }
-                    else if (this.currentNode.parentNode && chr === ']' && this.currentNode.parentNode.type === 'SECTION') {
-                        this.currentNode.endPos = this.pos + i - 1;
-                        this.currentNode = this.currentNode.parentNode;
-                        this.currentNode.isClosed = true;
-                        this.currentNode.endPos = this.pos + i;
-                        this.currentNode = this.currentNode.parentNode;
-                        this.state = STATE_NORMAL;
-                        checkSP();
+                        if (closesParent) {
+                            this.currentNode.isClosed = true;
+                            this.currentNode.endPos = this.pos + i;
+                            this.currentNode = this.currentNode.parentNode;
+                            checkSP();
+                        }
                         break;
                     }
                     if (chr === ':') {
-                        if (!RE_SINGLE_DIGIT.test(this.currentNode.value.at(-1)) && this.currentNode.value.at(-1) !== '*') {
+                        if (!RE_SINGLE_DIGIT.test(tokenLast) && tokenLast !== '*') {
+                            if (!tokenHasStar) {
+                                continueAsAtom();
+                                break;
+                            }
                             let error = new Error(`Unexpected range separator : at position ${this.pos + i} [E29]`);
                             error.code = 'ParserError29';
                             error.parserContext = { input: this.str, pos: this.pos + i, chr };
@@ -656,7 +719,7 @@ export class TokenParser {
                         }
                     }
                     else if (chr === '*') {
-                        if (![',', ':'].includes(this.currentNode.value.at(-1))) {
+                        if (![',', ':'].includes(tokenLast)) {
                             let error = new Error(`Unexpected range wildcard at position ${this.pos + i} [E30]`);
                             error.code = 'ParserError30';
                             error.parserContext = { input: this.str, pos: this.pos + i, chr };
@@ -664,13 +727,17 @@ export class TokenParser {
                         }
                     }
                     else if (chr === ',') {
-                        if (!RE_SINGLE_DIGIT.test(this.currentNode.value.at(-1)) && this.currentNode.value.at(-1) !== '*') {
+                        if (!RE_SINGLE_DIGIT.test(tokenLast) && tokenLast !== '*') {
+                            if (!tokenHasStar) {
+                                continueAsAtom();
+                                break;
+                            }
                             let error = new Error(`Unexpected sequence separator , at position ${this.pos + i} [E31]`);
                             error.code = 'ParserError31';
                             error.parserContext = { input: this.str, pos: this.pos + i, chr };
                             throw error;
                         }
-                        if (this.currentNode.value.at(-1) === '*' && this.currentNode.value.at(-2) !== ':') {
+                        if (tokenLast === '*' && tokenPrev !== ':') {
                             let error = new Error(`Unexpected sequence separator , at position ${this.pos + i} [E32]`);
                             error.code = 'ParserError32';
                             error.parserContext = { input: this.str, pos: this.pos + i, chr };
@@ -678,20 +745,29 @@ export class TokenParser {
                         }
                     }
                     else if (!RE_SINGLE_DIGIT.test(chr)) {
+                        if (!tokenHasStar) {
+                            continueAsAtom();
+                            break;
+                        }
                         let error = new Error(`Unexpected char at position ${this.pos + i} [E33: ${JSON.stringify(chr)}]`);
                         error.code = 'ParserError33';
                         error.parserContext = { input: this.str, pos: this.pos + i, chr };
                         throw error;
                     }
-                    if (RE_SINGLE_DIGIT.test(chr) && this.currentNode.value.at(-1) === '*') {
+                    if (RE_SINGLE_DIGIT.test(chr) && tokenLast === '*') {
                         let error = new Error(`Unexpected number at position ${this.pos + i} [E34: ${JSON.stringify(chr)}]`);
                         error.code = 'ParserError34';
                         error.parserContext = { input: this.str, pos: this.pos + i, chr };
                         throw error;
                     }
-                    this.currentNode.value += chr;
+                    appendToToken(chr);
                     break;
+                }
             }
         }
+        // the same applies to a digit-led token that ends the input on a dangling separator ("10:")
+        if (this.state === STATE_SEQUENCE && (tokenLast === ':' || tokenLast === ',') && !tokenHasStar) {
+            this.currentNode.type = 'ATOM';
+        }
     }
 }

package/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "imapflow";
-export declare const version = "2.2.5";
+export declare const version = "2.2.6";
 export declare const homepage = "https://imapflow.com/";

package/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = "imapflow";
-export const version = "2.2.5";
+export const version = "2.2.6";
 export const homepage = "https://imapflow.com/";

package/dist/esm/search-compiler.js

@@ -386,8 +386,12 @@ export const searchCompiler = (connection, query) => {
                     }
                     break;
                 // NOT operator
+                // A falsy operand means no NOT clause (`not: cond && {...}`). Any other one goes
+                // through walkOperand(), which refuses a value that is not a query object or
+                // compiles to nothing: dropping it would turn the filter into a search that
+                // matches everything
                 case 'NOT':
-                    if (params[term] && typeof params[term] === 'object') {
+                    if (params[term]) {
                         attributes.push({ type: 'ATOM', value: 'NOT' });
                         walkOperand('NOT', params[term]);
                     }
@@ -400,8 +404,8 @@ export const searchCompiler = (connection, query) => {
                         }
                         // Single element - just process it directly
                         if (params[term].length === 1) {
-                            if (typeof params[term][0] === 'object' && params[term][0]) {
-                                walk(params[term][0]);
+                            if (params[term][0]) {
+                                walkOperand('OR', params[term][0]);
                             }
                             break;
                         }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "imapflow",
-    "version": "2.2.5",
+    "version": "2.2.6",
     "description": "IMAP Client for Node",
     "type": "module",
     "main": "./dist/cjs/imap-flow.js",
@@ -45,6 +45,7 @@
         "pretest:workers": "npm run build",
         "test:workers": "node --import tsx --test test/cloudflare/cloudflare-test.ts",
         "test:rev2": "bash test/integration/run-rev2-tests.sh",
+        "test:mutation": "node scripts/mutation-test.js",
         "format": "prettier --write \"**/*.{js,cjs,ts,json,md,yml,yaml}\"",
         "format:check": "prettier --check \"**/*.{js,cjs,ts,json,md,yml,yaml}\"",
         "lint": "npm run typecheck && eslint .",
@@ -77,7 +78,7 @@
         "tsx": "4.23.15",
         "types-node-legacy": "npm:@types/node@20.0.0",
         "typescript": "6.0.3",
-        "typescript-eslint": "8.71.0",
+        "typescript-eslint": "8.71.1",
         "wrangler": "4.147.0"
     },
     "dependencies": {