imapflow 2.2.6 → 2.2.7

package/dist/cjs/search-compiler.js

@@ -53,17 +53,12 @@ let toSequenceValue = (value) => [].concat(value).join(',');
 let toSearchValue = (value) => UNICODE_PATTERN.test(value) && !value.includes('\0') ? { type: 'LITERAL', value: Buffer.from(value) } : { type: 'ATOM', value };
 /**
  * Adds a search option with its value(s) to the attributes array.
- * Handles NOT operations and array values.
  *
  * @param attributes - Array to append the attribute to
  * @param term - The search term (e.g., 'FROM', 'SUBJECT')
- * @param value - The value for the search term (string, array, or falsy for NOT)
+ * @param value - The value for the search term (string or array)
  */
 let setOpt = (attributes, term, value) => {
-    // Handle NOT operations for false or null values
-    if (value === false || value === null) {
-        attributes.push({ type: 'ATOM', value: 'NOT' });
-    }
     attributes.push({ type: 'ATOM', value: term.toUpperCase() });
     // Handle array values (e.g. HEADER name/value pairs)
     if (Array.isArray(value)) {
@@ -253,6 +248,11 @@ const searchCompiler = (connection, query) => {
                     break;
                 // Email ID support (OBJECTID or Gmail extension)
                 case 'EMAILID':
+                    // A falsy value means no criterion, as for the text fields. It used to
+                    // compile into NOT EMAILID "false", which matched every message
+                    if (!params[term]) {
+                        break;
+                    }
                     if (connection.capabilities.has('OBJECTID')) {
                         setOpt(attributes, 'EMAILID', params[term]);
                     }
@@ -260,7 +260,7 @@ const searchCompiler = (connection, query) => {
                         // Fallback to Gmail message ID
                         setOpt(attributes, 'X-GM-MSGID', params[term]);
                     }
-                    else if (params[term]) {
+                    else {
                         // Dropping the criterion would widen the search to every message
                         // matching the rest of the query, which a delete or move acts on
                         fail('MissingServerExtension', 'Server does not support OBJECTID or X-GM-EXT-1 extension required for EMAILID');
@@ -268,6 +268,11 @@ const searchCompiler = (connection, query) => {
                     break;
                 // Thread ID support (OBJECTID or Gmail extension)
                 case 'THREADID':
+                    // A falsy value means no criterion, as for the text fields. It used to
+                    // compile into NOT THREADID "false", which matched every message
+                    if (!params[term]) {
+                        break;
+                    }
                     if (connection.capabilities.has('OBJECTID')) {
                         setOpt(attributes, 'THREADID', params[term]);
                     }
@@ -275,7 +280,7 @@ const searchCompiler = (connection, query) => {
                         // Fallback to Gmail thread ID
                         setOpt(attributes, 'X-GM-THRID', params[term]);
                     }
-                    else if (params[term]) {
+                    else {
                         // Dropping the criterion would widen the search to every message
                         // matching the rest of the query, which a delete or move acts on
                         fail('MissingServerExtension', 'Server does not support OBJECTID or X-GM-EXT-1 extension required for THREADID');
@@ -338,11 +343,11 @@ const searchCompiler = (connection, query) => {
                         if (!value) {
                             break;
                         }
-                        // Use WITHIN extension for better timezone handling if available
-                        if (connection.capabilities.has('WITHIN')) {
-                            // Convert to seconds ago from now
-                            const now = Date.now();
-                            const withinSeconds = Math.round(Math.max(0, now - value.getTime()) / 1000);
+                        // Use WITHIN extension for better timezone handling if available.
+                        // The interval is an nz-number (RFC 5032), so a date that is not in the
+                        // past (OLDER 0 would be answered with BAD) takes the date path instead
+                        const withinSeconds = Math.round((Date.now() - value.getTime()) / 1000);
+                        if (connection.capabilities.has('WITHIN') && withinSeconds >= 1) {
                             const withinKeyword = term.toUpperCase() === 'BEFORE' ? 'OLDER' : 'YOUNGER';
                             setOpt(attributes, withinKeyword, withinSeconds.toString());
                             break;
@@ -362,7 +367,15 @@ const searchCompiler = (connection, query) => {
                 case 'KEYWORD':
                 case 'UNKEYWORD':
                     {
+                        if (typeof params[term] !== 'string') {
+                            fail('InvalidSearchQuery', `Search value for ${term.toLowerCase()} must be a string`);
+                        }
                         let flag = (0, tools_js_1.formatFlag)(params[term]);
+                        // formatFlag() refuses \Recent, which is not a keyword. Dropping the
+                        // criterion would widen the search, so the query is refused instead
+                        if (flag === false) {
+                            fail('InvalidSearchQuery', `${params[term]} can not be searched as a keyword, use the "recent" search key instead`);
+                        }
                         // Compiled even when the mailbox does not allow the keyword: the
                         // correct answer is then the empty set, which dropping the
                         // criterion would turn into every message matching the rest
@@ -460,6 +473,10 @@ const searchCompiler = (connection, query) => {
                         walkOrTree(genOrTree(params[term]));
                     }
                     break;
+                default:
+                    // An unknown key is refused: dropping it silently widened the search (a
+                    // query of only unknown keys matched every message)
+                    fail('InvalidSearchQuery', `Unknown search key "${term}"`);
             }
         });
     };

package/dist/cjs/special-use.js

@@ -77,6 +77,7 @@ const TOKEN_SPLIT = /[\s\-_/.,()[\]]+/;
 // we fall back to matching folder names against these lists of known
 // translations in various languages (including non-Latin scripts).
 exports.flags = ['\\All', '\\Archive', '\\Drafts', '\\Flagged', '\\Junk', '\\Sent', '\\Trash'];
+const LOWERCASE_FLAGS = exports.flags.map(flag => flag.toLowerCase());
 exports.names = {
     '\\Sent': [
         'aika',
@@ -863,9 +864,10 @@ for (let flag of Object.keys(exports.names)) {
     }
 }
 // Fold a folder name into the form the name tables are stored in.
-// Remove U+200E (LEFT-TO-RIGHT MARK) which some mail clients (especially for
-// RTL languages like Arabic, Hebrew) insert into folder names for display purposes.
-// These invisible marks would otherwise prevent exact string matching.
+// Remove U+200E and U+200F (LEFT-TO-RIGHT and RIGHT-TO-LEFT MARK) which some mail clients
+// (especially for RTL languages like Arabic, Hebrew) insert into folder names for display
+// purposes. These invisible marks would otherwise prevent exact string matching. U+200B
+// (ZERO WIDTH SPACE) is kept, Khmer names in the tables use it as their word separator.
 // Normalize with NFKC last: the same folder name can arrive in different but
 // equivalent forms depending on the client that created it, and matching is exact.
 // NFKC rather than NFC because the compatibility folding is what maps halfwidth
@@ -874,7 +876,7 @@ for (let flag of Object.keys(exports.names)) {
 function normalizeName(name) {
     return name
         .toLowerCase()
-        .replace(/\u200e/g, '')
+        .replace(/[\u200e\u200f]/g, '')
         .trim()
         .normalize('NFKC');
 }
@@ -883,7 +885,10 @@ const specialUse = (hasSpecialUseExtension, folder) => {
     // Extension-provided flags take precedence over name-based detection because they
     // are authoritative - the server explicitly marks the folder's role.
     if (hasSpecialUseExtension) {
-        const flag = exports.flags.find(flag => folder.flags.has(flag));
+        // Flags are atoms and compare case-insensitively (RFC 9051 section 9)
+        const listed = new Set();
+        folder.flags.forEach(flag => listed.add(flag.toLowerCase()));
+        const flag = exports.flags.find((flag, i) => listed.has(LOWERCASE_FLAGS[i]));
         if (flag) {
             return { flag, source: 'extension' };
         }

package/dist/cjs/tools.d.ts

@@ -119,6 +119,14 @@ export declare function unrefTimer<T extends NodeJS.Timeout | null | undefined>(
  * @param err - The error to log
  */
 export declare function logConnectionError(connection: ImapFlow, msg: string, err: ImapFlowError | null | undefined): void;
+/**
+ * Whether a command failed because the server answered it with a tagged NO or BAD, as opposed
+ * to a lost connection, a timeout or a local failure that says nothing about the server's answer.
+ *
+ * @param err - The error the command failed with
+ * @returns True for a tagged NO or BAD
+ */
+export declare function isServerRefusal(err: ImapFlowError | null | undefined): boolean;
 /**
  * Checks whether IMAP4rev2 semantics are active for the connection: either the
  * client enabled IMAP4rev2 explicitly, or the server is rev2-only (advertises
@@ -407,7 +415,8 @@ export declare function isUnsafeKey(key: unknown): boolean;
 /**
  * Reads a parsed attribute list of atoms or strings (a flag list, a capability list) into
  * an array of strings. Any element can be a parsed NIL, and the list itself can be NIL,
- * so both levels are guarded here rather than at each call site.
+ * so both levels are guarded here rather than at each call site. A literal (a Gmail label
+ * the server could not send quoted) arrives as a Buffer and is decoded as UTF-8.
  *
  * @param list - Parsed attribute list from a response.
  * @returns The string values, in order, with unusable entries dropped.

package/dist/cjs/tools.js

@@ -12,6 +12,7 @@ exports.guardedReject = guardedReject;
 exports.clearTimer = clearTimer;
 exports.unrefTimer = unrefTimer;
 exports.logConnectionError = logConnectionError;
+exports.isServerRefusal = isServerRefusal;
 exports.isRev2Active = isRev2Active;
 exports.hasCapability = hasCapability;
 exports.buildStatusQueryAttributes = buildStatusQueryAttributes;
@@ -266,6 +267,16 @@ function logConnectionError(connection, msg, err) {
     let routine = !!err && CONNECTION_GONE_CODES.has(err.code) && !err.reason;
     connection.log[routine ? 'debug' : 'warn']({ msg, err, cid: connection.id });
 }
+/**
+ * Whether a command failed because the server answered it with a tagged NO or BAD, as opposed
+ * to a lost connection, a timeout or a local failure that says nothing about the server's answer.
+ *
+ * @param err - The error the command failed with
+ * @returns True for a tagged NO or BAD
+ */
+function isServerRefusal(err) {
+    return !!err && (err.responseStatus === 'NO' || err.responseStatus === 'BAD');
+}
 /**
  * Checks whether IMAP4rev2 semantics are active for the connection: either the
  * client enabled IMAP4rev2 explicitly, or the server is rev2-only (advertises
@@ -593,7 +604,12 @@ function getFolderTree(folders) {
         }
         return node;
     };
-    for (let folder of folders) {
+    // Parents are inserted before their children, as getTreeNode() can only descend into nodes
+    // that already exist. LIST gives no ordering guarantee, and the LIST command sorts special-use
+    // mailboxes first, which put a child such as "[Gmail]/Sent Mail" ahead of "[Gmail]" and left
+    // it at the root. The sort is stable, so siblings keep their listing order
+    let byDepth = [...folders].sort((a, b) => (a.parent ? a.parent.length : 0) - (b.parent ? b.parent.length : 0));
+    for (let folder of byDepth) {
         let parent = getTreeNode(folder.parent);
         // see if entry already exists
         let existing = parent.folders && parent.folders.find(existing => existing.name === folder.name);
@@ -1412,7 +1428,8 @@ function isUnsafeKey(key) {
 /**
  * Reads a parsed attribute list of atoms or strings (a flag list, a capability list) into
  * an array of strings. Any element can be a parsed NIL, and the list itself can be NIL,
- * so both levels are guarded here rather than at each call site.
+ * so both levels are guarded here rather than at each call site. A literal (a Gmail label
+ * the server could not send quoted) arrives as a Buffer and is decoded as UTF-8.
  *
  * @param list - Parsed attribute list from a response.
  * @returns The string values, in order, with unusable entries dropped.
@@ -1421,7 +1438,17 @@ function getStringList(list) {
     if (!Array.isArray(list)) {
         return [];
     }
-    return list.map(entry => (entry && typeof entry.value === 'string' ? entry.value : false)).filter(entry => entry);
+    let strings = [];
+    for (let entry of list) {
+        let value = entry && entry.value;
+        if (Buffer.isBuffer(value)) {
+            value = value.toString();
+        }
+        if (value && typeof value === 'string') {
+            strings.push(value);
+        }
+    }
+    return strings;
 }
 /**
  * Parses an untrusted decimal value from a server response into a BigInt.

package/dist/cjs/types.d.ts

@@ -155,7 +155,15 @@ export interface ImapFlowOptions {
      * 30 minutes. Set to 0 or false to disable.
      */
     maxLockHoldTime?: number | false | undefined;
-    /** If true, uses TLS. If false, uses cleartext. If not set, upgrades to TLS if available */
+    /**
+     * STARTTLS policy for a connection that was not opened with `secure: true`. If true, the
+     * connection must upgrade to TLS, and connecting fails when the server does not offer
+     * STARTTLS. If false, the connection stays in cleartext. If not set, the connection upgrades
+     * when the server offers STARTTLS and otherwise continues in cleartext with a warning logged:
+     * the capability list that decides this was itself received in cleartext, so an attacker on
+     * the path can strip it. Set `doSTARTTLS: true` whenever the credentials must never cross the
+     * wire unencrypted.
+     */
     doSTARTTLS?: boolean | undefined;
     /** Custom instance ID string for logs */
     id?: string | undefined;
@@ -646,8 +654,8 @@ export interface DownloadOptions {
     /** How large content parts to ask from the server. Defaults to 65536 */
     chunkSize?: number | undefined;
 }
-/** Options for downloadMany(), the same shape as the download() options */
-export type DownloadManyOptions = DownloadOptions;
+/** Options for downloadMany(): the download() options without `chunkSize`, as the parts come in one FETCH */
+export type DownloadManyOptions = Pick<DownloadOptions, 'uid' | 'maxBytes'>;
 export interface DownloadManyPart {
     meta: DownloadMeta;
     content?: Buffer | null | undefined;
@@ -769,6 +777,13 @@ export type LogLevel = 'trace' | 'debug' | 'info' | 'warn' | 'error' | 'fatal';
  */
 export type InternalLogger = {
     [level in LogLevel]: (obj: any) => void;
+} & {
+    /**
+     * Whether an entry logged at this level reaches anyone (the logger, or a 'log' event
+     * listener). Set on the logger the connection builds; a logger assigned from outside may
+     * lack it, and every level then counts as enabled
+     */
+    isLevelEnabled?: ((level: LogLevel) => boolean) | undefined;
 };
 export interface LogEvent {
     /** Log level */
@@ -802,7 +817,7 @@ export interface ESearchResult {
     partial?: {
         /** The requested range, e.g. "1:100" */
         range: string;
-        /** Matching UIDs in that range as compact sequence-set */
+        /** Matching UIDs in that range as compact sequence-set, an empty string when the range lies past the end of the results */
         messages: string;
     } | undefined;
     /** Highest mod-sequence of the matching messages (RFC 7162, present when the search used a modseq criterion on a CONDSTORE session) */

package/dist/esm/commands/append.js

@@ -1,4 +1,4 @@
-import { formatFlag, canUseFlag, formatDateTime, normalizePath, encodePath, comparePaths, parseBigIntValue, parseUintValue, MAX_UINT32_DIGITS, getSelectedMailbox, emitSafe, isAuthenticatedState, reportCommandError } from '../tools.js';
+import { formatFlag, canUseFlag, formatDateTime, normalizePath, encodePath, comparePaths, parseBigIntValue, parseUintValue, MAX_UINT32_DIGITS, getSelectedMailbox, emitSafe, isAuthenticatedState, reportCommandError, logConnectionError } from '../tools.js';
 /**
  * Appends a message to a mailbox.
  *
@@ -155,10 +155,17 @@ export default async function append(connection, destination, content, flags, id
         }
         // If we have a sequence number but no UID (server doesn't support UIDPLUS),
         // look up the UID via SEARCH to provide a consistent result to the caller.
+        // The message is already stored, so a failed lookup only leaves the UID out:
+        // rejecting here would make a retrying caller append it twice.
         if (map.seq && !map.uid) {
-            let list = await connection.search({ seq: map.seq }, { uid: true });
-            if (Array.isArray(list) && list.length) {
-                map.uid = list[0];
+            try {
+                let list = await connection.search({ seq: map.seq }, { uid: true });
+                if (Array.isArray(list) && list.length) {
+                    map.uid = list[0];
+                }
+            }
+            catch (err) {
+                logConnectionError(connection, 'Failed to look up the UID of the appended message', err);
             }
         }
         return map;

package/dist/esm/commands/authenticate.js

@@ -1,4 +1,4 @@
-import { getStatusCode, getErrorText } from '../tools.js';
+import { getStatusCode, getErrorText, isServerRefusal } from '../tools.js';
 /**
  * Handles authentication errors by enriching the error object with server response details.
  *
@@ -11,7 +11,10 @@ async function handleAuthError(err, errorResponse) {
     if (errorCode) {
         err.serverResponseCode = errorCode;
     }
-    err.authenticationFailed = true;
+    // Only a tagged NO/BAD is the server refusing the credentials, see login.ts
+    if (isServerRefusal(err)) {
+        err.authenticationFailed = true;
+    }
     err.response = await getErrorText(err.response);
     if (errorResponse) {
         err.oauthError = errorResponse;
@@ -108,27 +111,33 @@ async function authLogin(connection, username, password) {
     try {
         // SASL LOGIN is a challenge-response mechanism: the server sends base64-encoded
         // prompts ("Username:" and "Password:") and the client responds with base64-encoded values.
+        let usernameSent = false;
         let response = await connection.exec('AUTHENTICATE', [{ type: 'ATOM', value: 'LOGIN' }], {
             onPlusTag: async (resp) => {
-                if (resp.attributes && resp.attributes[0] && resp.attributes[0].type === 'TEXT') {
-                    // Decode the server's base64 challenge to determine what it's asking for.
-                    // Strip trailing colons and null bytes (\x00) that some servers append to the prompt.
-                    let question = Buffer.from(resp.attributes[0].value, 'base64')
+                // Decode the server's base64 challenge to determine what it's asking for.
+                // Strip trailing colons and null bytes (\x00) that some servers append to the prompt.
+                let question = resp.attributes && resp.attributes[0] && resp.attributes[0].type === 'TEXT'
+                    ? Buffer.from(resp.attributes[0].value, 'base64')
                         .toString()
                         .toLowerCase()
-                        .replace(/[:\x00]*$/, '');
-                    if (question === 'username' || question === 'user name') {
-                        let encodedUsername = Buffer.from(username).toString('base64');
-                        connection.log.debug({ src: 'c', msg: encodedUsername, comment: `Encoded username for AUTH=LOGIN`, cid: connection.id });
-                        connection.write(encodedUsername);
-                    }
-                    else if (question === 'password') {
-                        connection.log.debug({ src: 'c', msg: '(* value hidden *)', comment: `Encoded password for AUTH=LOGIN`, cid: connection.id });
-                        connection.write(Buffer.from(password).toString('base64'));
-                    }
-                    else {
-                        throw new Error(`Unknown LOGIN question "${question}"`);
-                    }
+                        .replace(/[:\x00]*$/, '')
+                    : '';
+                // Some servers send an empty first challenge, which by SASL LOGIN convention asks for the username
+                if (question === 'username' || question === 'user name' || (!question && !usernameSent)) {
+                    let encodedUsername = Buffer.from(username).toString('base64');
+                    connection.log.debug({ src: 'c', msg: encodedUsername, comment: `Encoded username for AUTH=LOGIN`, cid: connection.id });
+                    connection.write(encodedUsername);
+                    usernameSent = true;
+                }
+                else if (question === 'password') {
+                    connection.log.debug({ src: 'c', msg: '(* value hidden *)', comment: `Encoded password for AUTH=LOGIN`, cid: connection.id });
+                    connection.write(Buffer.from(password).toString('base64'));
+                }
+                else {
+                    // Cancel the exchange (RFC 9051 section 6.2.2), so the server fails the command
+                    // with a tagged BAD instead of waiting for an answer that never comes
+                    connection.log.warn({ msg: 'Unknown AUTH=LOGIN challenge, cancelling', question, cid: connection.id });
+                    connection.write('*');
                 }
             }
         });

package/dist/esm/commands/close.d.ts

@@ -1,8 +1,19 @@
 import type { ImapFlow } from '../imap-flow.js';
+/**
+ * Options for the CLOSE command
+ */
+export interface CloseCommandOptions {
+    /**
+     * Only deselect the mailbox: use UNSELECT (RFC 3691, folded into IMAP4rev2) when the server
+     * supports it, so messages flagged \Deleted are not expunged as a side effect. Falls back to CLOSE
+     */
+    unselect?: boolean | undefined;
+}
 /**
  * Closes the currently selected mailbox.
  *
  * @param connection - IMAP connection instance
+ * @param options - Close options
  * @returns True on success, false on failure, or undefined if not in SELECTED state
  */
-export default function close(connection: ImapFlow): Promise<boolean | undefined>;
+export default function close(connection: ImapFlow, options?: CloseCommandOptions | undefined): Promise<boolean | undefined>;

package/dist/esm/commands/close.js

@@ -1,11 +1,12 @@
-import { emitSafe } from '../tools.js';
+import { emitSafe, hasCapability } from '../tools.js';
 /**
  * Closes the currently selected mailbox.
  *
  * @param connection - IMAP connection instance
+ * @param options - Close options
  * @returns True on success, false on failure, or undefined if not in SELECTED state
  */
-export default async function close(connection) {
+export default async function close(connection, options) {
     if (connection.state !== connection.states.SELECTED) {
         // nothing to do here
         return;
@@ -15,7 +16,8 @@ export default async function close(connection) {
         // IMAP CLOSE (RFC 3501 6.4.2): permanently removes all messages flagged \Deleted
         // from the currently selected mailbox (implicit expunge) and deselects it.
         // Unlike EXPUNGE, CLOSE does not send individual untagged EXPUNGE responses.
-        response = await connection.exec('CLOSE');
+        // UNSELECT deselects the same way without removing anything.
+        response = await connection.exec(options?.unselect && hasCapability(connection, 'UNSELECT') ? 'UNSELECT' : 'CLOSE');
         response.next();
         // Transition from SELECTED back to AUTHENTICATED state.
         // Clear mailbox metadata so subsequent operations know no mailbox is selected.

package/dist/esm/commands/delete.js

@@ -17,7 +17,8 @@ export default async function deleteMailbox(connection, path) {
     // IMAP servers reject DELETE on the currently selected mailbox (RFC 3501 6.3.4).
     let selected = getSelectedMailbox(connection);
     if (selected && selected.path === path) {
-        await connection.run('CLOSE');
+        // UNSELECT where possible, CLOSE would expunge messages flagged \Deleted
+        await connection.run('CLOSE', { unselect: true });
     }
     let response;
     try {

package/dist/esm/commands/esearch-parser.js

@@ -69,9 +69,15 @@ export function parseEsearchResponse(attrs) {
                 const items = Array.isArray(listToken) ? listToken : null;
                 if (!items || items.length < 2)
                     break;
+                const range = items[0]?.value;
+                if (typeof range !== 'string')
+                    break;
+                // RFC 9394 partial-results is a sequence-set or NIL, the latter when the requested
+                // range lies past the end of the results. NIL is reported as an empty set.
+                const messages = items[1]?.value;
                 result.partial = {
-                    range: items[0].value,
-                    messages: items[1].value
+                    range,
+                    messages: typeof messages === 'string' ? messages : ''
                 };
                 break;
             }

package/dist/esm/commands/fetch.js

@@ -25,11 +25,20 @@ export default async function fetch(connection, range, query, options) {
     // Every pass returns or throws: the last throttled attempt throws instead of retrying.
     const maxRetries = 4;
     const baseDelay = 1000; // Start with 1 second delay
+    // The highest UID (sequence number for a plain FETCH) handed to the streaming consumer. A
+    // retried FETCH answers with every message again, so a retry skips up to it: servers answer
+    // in ascending order, which keeps this to one comparison per row rather than a set of every
+    // row delivered. The consumer was otherwise given the rows before the throttle twice.
+    let maxDelivered = 0;
     for (let retryCount = 0;; retryCount++) {
         let messages = {
             count: 0,
             list: []
         };
+        // The first error the onUntaggedFetch consumer reported through next(err). Errors thrown
+        // by untagged handlers are only logged by the connection, so it is kept here and fails
+        // the command once the FETCH completes; later messages are no longer handed to the consumer.
+        let consumerError = null;
         let response;
         try {
             /* c8 ignore next */ // range is guaranteed truthy by the early-return guard above, so the '*' fallback is unreachable
@@ -179,18 +188,32 @@ export default async function fetch(connection, range, query, options) {
                     // (useful for large result sets). Otherwise, collect all into messages.list.
                     FETCH: async (untagged) => {
                         messages.count++;
+                        if (consumerError) {
+                            return;
+                        }
                         let formatted = await formatMessageResponse(untagged, mailbox, connection.idHashAlgorithm);
                         if (typeof options.onUntaggedFetch === 'function') {
-                            await new Promise((resolve, reject) => {
-                                options.onUntaggedFetch(formatted, err => {
-                                    if (err) {
-                                        reject(err);
-                                    }
-                                    else {
-                                        resolve();
-                                    }
+                            /* c8 ignore next */ // a UID FETCH row without its UID is a non-compliant server, so the seq fallback is not exercised
+                            let key = options.uid ? formatted.uid || formatted.seq : formatted.seq;
+                            if (retryCount && key <= maxDelivered) {
+                                return;
+                            }
+                            maxDelivered = Math.max(maxDelivered, key);
+                            try {
+                                await new Promise((resolve, reject) => {
+                                    options.onUntaggedFetch(formatted, err => {
+                                        if (err) {
+                                            reject(err);
+                                        }
+                                        else {
+                                            resolve();
+                                        }
+                                    });
                                 });
-                            });
+                            }
+                            catch (err) {
+                                consumerError = err;
+                            }
                         }
                         else {
                             messages.list.push(formatted);
@@ -199,6 +222,9 @@ export default async function fetch(connection, range, query, options) {
                 }
             });
             response.next();
+            if (consumerError) {
+                throw consumerError;
+            }
             return messages;
         }
         catch (err) {

package/dist/esm/commands/id.js

@@ -1,4 +1,4 @@
-import { formatDateTime } from '../tools.js';
+import { formatDateTime, isUnsafeKey } from '../tools.js';
 /**
  * Sends ID info to the server and updates server info data based on the response.
  *
@@ -40,7 +40,14 @@ export default async function id(connection, clientInfo) {
                             key = val.value;
                         }
                         else if (typeof key === 'string' && typeof val.value === 'string') {
-                            map[key.toLowerCase().trim()] = val.value;
+                            // The server picks the keys of this object, which the caller reads
+                            // back as serverInfo: a prototype-chain name is skipped as it is for
+                            // every other server-named key, so it can neither be shadowed nor
+                            // written through
+                            let name = key.toLowerCase().trim();
+                            if (!isUnsafeKey(name)) {
+                                map[name] = val.value;
+                            }
                         }
                     });
                 }

package/dist/esm/commands/idle.js

@@ -1,4 +1,4 @@
-import { guardedPromise, hasCapability, logConnectionError, restampConnectionError, unrefTimer, clearTimer, getSelectedMailbox } from '../tools.js';
+import { guardedPromise, hasCapability, isServerRefusal, logConnectionError, restampConnectionError, unrefTimer, clearTimer, getSelectedMailbox } from '../tools.js';
 const NOOP_INTERVAL = 2 * 60 * 1000;
 /**
  * Marks the connection as idling on behalf of one session and returns a release function.
@@ -57,8 +57,11 @@ async function runIdle(connection) {
                     path: connection.mailbox && connection.mailbox.path,
                     cid: connection.id
                 });
-                connection.write('DONE');
+                // Marked before the write: write() closes the connection when the transport is
+                // already gone, and close() breaks IDLE through this very function, which
+                // would otherwise write DONE again from inside itself
                 doneSent = true;
+                connection.write('DONE');
                 releaseIdling();
                 if (connection.preCheck === ownPreCheck) {
                     connection.preCheck = false; // unset itself
@@ -124,7 +127,10 @@ async function runIdle(connection) {
         // A tagged NO or BAD only means the server refused IDLE; the connection is still usable,
         // so the waiters are released by the finally block below and their own commands run.
         // Anything else (close, lost socket, parser failure) fails the waiters too.
-        let refusedByServer = ['NO', 'BAD'].includes(err.responseStatus);
+        let refusedByServer = isServerRefusal(err);
+        if (refusedByServer) {
+            connection.skipIdle = true;
+        }
         if (preCheckWaitQueue.length && !refusedByServer) {
             // One error for the whole queue: every waiter failed at the same site, for the same
             // reason. Built inside the guard so a teardown with nothing queued - the common case -
@@ -310,7 +316,7 @@ export default async function idle(connection, maxIdleTime) {
     // If server supports IDLE (RFC 2177, folded into base IMAP4rev2), use it for
     // real-time push notifications. Otherwise, fall back to periodic polling with
     // NOOP/STATUS/SELECT.
-    if (hasCapability(connection, 'IDLE')) {
+    if (hasCapability(connection, 'IDLE') && !connection.skipIdle) {
         let idleTimer;
         let stillIdling = false;
         // IDLE loop: runs IDLE, and if maxIdleTime is reached, breaks and restarts to keep the
@@ -334,13 +340,17 @@ export default async function idle(connection, maxIdleTime) {
             }
             let resp = await runIdle(connection);
             clearTimeout(idleTimer);
-            if (!stillIdling) {
+            // A restart only makes sense with nothing queued behind the break (a CLOSE, say; run()
+            // re-arms auto-IDLE once that command is done) and the mailbox still selected on a
+            // usable connection
+            const canRestart = stillIdling && !connection.requestQueue.length && !!getSelectedMailbox(connection) && connection.usable;
+            if (!canRestart) {
                 return resp;
             }
             stillIdling = false;
         }
     }
-    // Fallback for servers without IDLE support: poll at regular intervals using
+    // Fallback for servers without IDLE support, or that refused it: poll at regular intervals using
     // NOOP (default), STATUS, or SELECT depending on missingIdleCommand config.
     return runPollingFallback(connection, maxIdleTime);
 }