imapflow 2.2.6 → 2.2.8

package/dist/cjs/imap-flow.js

@@ -260,6 +260,7 @@ class ImapFlow extends node_events_1.EventEmitter {
         this.requestTagMap = new Map();
         this.requestQueue = [];
         this.currentRequest = false;
+        this.parkedRelease = null;
         this._unknownTagCount = 0;
         this._nextUnknownTagWarn = 1;
         this.writeBytesCounter = 0;
@@ -289,6 +290,8 @@ class ImapFlow extends node_events_1.EventEmitter {
         this.autoIdleDelay = normalizeAutoIdleDelay(this.options.autoIdleDelay, this.socketTimeout, this.log, this.id);
         this._lastPollAt = 0;
         this._openDownloads = 0;
+        this._recoveryPending = false;
+        this._processingResponse = false;
         this.missingIdleCommand = (this.options.missingIdleCommand || '').toString().toUpperCase().trim() || 'NOOP';
         this.disableBinary = !!this.options.disableBinary;
         this.idHashAlgorithm = this.options.idHashAlgorithm || 'md5';
@@ -296,6 +299,7 @@ class ImapFlow extends node_events_1.EventEmitter {
         this.skipListStatusArgs = false;
         this.skipListAuxArgs = false;
         this.skipLsub = false;
+        this.skipIdle = false;
         this.skipRev2 = !!this.options.disableIMAP4rev2;
         // Named error handler for proper cleanup. Certain error codes represent
         // expected socket/network issues (buffer exhaustion, connection reset, broken pipe,
@@ -444,15 +448,11 @@ class ImapFlow extends node_events_1.EventEmitter {
     /** @internal */
     async send(data) {
         if (this.state === this.states.LOGOUT) {
-            // already logged out
-            if (data.tag) {
-                let request = this.requestTagMap.get(data.tag);
-                if (request) {
-                    this.requestTagMap.delete(data.tag);
-                    request.reject(this.createNoConnectionError(false, { rejectedFrom: 'sendAfterLogout', command: request.command }));
-                }
-            }
-            return;
+            // Already logged out. Thrown rather than rejected here so trySend() clears the
+            // request from currentRequest and goes on to the next one: a request left there
+            // never gets a tagged response, and everything queued behind it would wait for
+            // the socket watchdog.
+            throw this.createNoConnectionError(false, { rejectedFrom: 'sendAfterLogout', command: data.command });
         }
         // Classify before the first await. Every frame of this command - the command line and
         // any continuation write that follows it - belongs to it until the next send(), because
@@ -475,14 +475,16 @@ class ImapFlow extends node_events_1.EventEmitter {
             literalMinus: (0, tools_js_1.hasCapability)(this, 'LITERAL-') || this.capabilities.has('LITERAL+')
         });
         this.commandParts = compiled;
-        // Compile again for logging with isLogging=true: masks sensitive values
-        // like passwords while producing a human-readable command string
-        let logCompiled = await (0, imap_handler_js_1.compiler)(data, {
-            isLogging: true
-        });
         /* c8 ignore next */ // send() is always invoked with a request object carrying options, so the {} fallback is unreachable
         let options = data.options || {};
-        this.log.debug({ src: 'c', msg: logCompiled.toString(), cid: this.id, comment: options.comment });
+        // Compile again for logging with isLogging=true: masks sensitive values
+        // like passwords while producing a human-readable command string
+        if (this.isLogLevelEnabled('debug')) {
+            let logCompiled = await (0, imap_handler_js_1.compiler)(data, {
+                isLogging: true
+            });
+            this.log.debug({ src: 'c', msg: logCompiled.toString(), cid: this.id, comment: options.comment });
+        }
         // Send the first part (command text). If there are literal parts,
         // the server will respond with "+" continuations and reader() will
         // send each remaining part from this.commandParts.
@@ -525,7 +527,6 @@ class ImapFlow extends node_events_1.EventEmitter {
                 // nothing reached the wire, so no tagged response ever clears it, and
                 // every later command would queue behind it until the socket timeout.
                 // Reject the failed command and keep draining the queue.
-                this.commandParts = [];
                 this.rejectCurrentRequest(err);
             }
         }
@@ -644,16 +645,53 @@ class ImapFlow extends node_events_1.EventEmitter {
     // a way that leaves the command's outcome unknown.
     /** @internal */
     rejectCurrentRequest(err) {
+        let request = this.takeCurrentRequest();
+        if (request) {
+            request.reject(err);
+        }
+    }
+    /**
+     * Takes the in-flight command off the connection: its tag map entry, and the literal parts it
+     * still had to send (a tagged NO before the "+" of a refused APPEND leaves them behind, and
+     * they must neither stay referenced nor answer a later continuation). The parts are dropped
+     * whether or not a command is still current, as a failed dispatch may have cleared it already.
+     *
+     * @returns The pending request entry, if the command was still current
+     * @internal
+     */
+    takeCurrentRequest() {
+        this.commandParts = [];
         if (!this.currentRequest) {
-            return;
+            return undefined;
         }
         let tag = this.currentRequest.tag;
         this.currentRequest = false;
         let request = this.requestTagMap.get(tag);
-        if (request) {
-            this.requestTagMap.delete(tag);
-            request.reject(err);
-        }
+        this.requestTagMap.delete(tag);
+        return request;
+    }
+    /**
+     * Resolves a command's promise with its tagged response and parks the reader until the
+     * command's handler calls next(). The release is kept in parkedRelease so a handler that
+     * throws before calling next() can be unparked (see releaseOrphanedResponse()); every path
+     * that resolves a command this way goes through here for that reason.
+     *
+     * @param request - Pending request entry
+     * @param parsed - Parsed tagged response
+     * @param hasTrailingData - Whether more input was already buffered after this line
+     * @internal
+     */
+    resolveParked(request, parsed, hasTrailingData) {
+        return new Promise(resolve => {
+            let release = () => {
+                if (this.parkedRelease === release) {
+                    this.parkedRelease = null;
+                }
+                resolve();
+            };
+            this.parkedRelease = release;
+            request.resolve({ response: parsed, next: release, hasTrailingData });
+        });
     }
     /**
      * Waits out a throttle back-off.
@@ -687,6 +725,10 @@ class ImapFlow extends node_events_1.EventEmitter {
         while ((data = this.streamer.read()) !== null) {
             let keepReading;
             try {
+                // The reader is parked here for as long as processing takes (a fetch consumer
+                // working on a row), so a socket that goes quiet meanwhile is this side's doing,
+                // see _socketTimeout
+                this._processingResponse = true;
                 keepReading = await this.handleResponse(data);
             }
             catch (err) {
@@ -703,6 +745,7 @@ class ImapFlow extends node_events_1.EventEmitter {
                 this.failProtocol(error);
             }
             finally {
+                this._processingResponse = false;
                 this.releaseStreamData(data);
             }
             if (!keepReading) {
@@ -794,15 +837,14 @@ class ImapFlow extends node_events_1.EventEmitter {
                 this.log.warn({ err, cid: this.id });
             }
         }
-        let logCompiled = await (0, imap_handler_js_1.compiler)(parsed, {
-            isLogging: true
-        });
-        if (/^\d+$/.test(parsed.command || '') && parsed.attributes && parsed.attributes[0] && parsed.attributes[0].value === 'FETCH') {
-            // too many FETCH responses, might want to filter these out
-            this.log.trace({ src: 's', msg: logCompiled.toString(), cid: this.id, nullBytesRemoved: parsed.nullBytesRemoved });
-        }
-        else {
-            this.log.debug({ src: 's', msg: logCompiled.toString(), cid: this.id, nullBytesRemoved: parsed.nullBytesRemoved });
+        // FETCH responses are the bulk of a session, so they log at trace. The serialization is
+        // skipped when the level is off.
+        let logLevel = /^\d+$/.test(parsed.command || '') && parsed.attributes && parsed.attributes[0] && parsed.attributes[0].value === 'FETCH' ? 'trace' : 'debug';
+        if (this.isLogLevelEnabled(logLevel)) {
+            let logCompiled = await (0, imap_handler_js_1.compiler)(parsed, {
+                isLogging: true
+            });
+            this.log[logLevel]({ src: 's', msg: logCompiled.toString(), cid: this.id, nullBytesRemoved: parsed.nullBytesRemoved });
         }
         // IMAP "+" (continuation request) handling. The server sends "+" in two cases:
         // 1. During IDLE or AUTHENTICATE, where a custom handler (onPlusTag) processes it
@@ -878,9 +920,7 @@ class ImapFlow extends node_events_1.EventEmitter {
         // and an entirely unknown tag is recorded but tolerated.
         if (parsed.tag && !['*', '+'].includes(parsed.tag)) {
             if (this.currentRequest && this.currentRequest.tag === parsed.tag && this.currentRequest.sent) {
-                let request = this.requestTagMap.get(parsed.tag);
-                this.requestTagMap.delete(parsed.tag);
-                this.currentRequest = false;
+                let request = this.takeCurrentRequest();
                 if (request) {
                     await this.settleRequest(request, parsed, !!data.trailingAfterLine);
                 }
@@ -940,7 +980,7 @@ class ImapFlow extends node_events_1.EventEmitter {
             case 'BYE':
                 // hasTrailingData is forwarded so STARTTLS can detect a plaintext
                 // injection (data buffered after the tagged OK, before the handshake).
-                await new Promise(resolve => request.resolve({ response: parsed, next: resolve, hasTrailingData }));
+                await this.resolveParked(request, parsed, hasTrailingData);
                 break;
             case 'NO':
             case 'BAD': {
@@ -968,7 +1008,7 @@ class ImapFlow extends node_events_1.EventEmitter {
                         // is told nothing else about it, so this entry is the only record that
                         // the response was truncated.
                         this.log.warn({ msg: 'Partial FETCH response', cid: this.id, err });
-                        await new Promise(resolve => request.resolve({ response: parsed, next: resolve }));
+                        await this.resolveParked(request, parsed);
                         break;
                     }
                     let throttleDelay = false;
@@ -1062,6 +1102,16 @@ class ImapFlow extends node_events_1.EventEmitter {
         if (typeof socket.setKeepAlive === 'function') {
             socket.setKeepAlive(true, 5 * 1000);
         }
+        this.armSocketTimeout(socket);
+    }
+    /**
+     * Arms the inactivity watchdog on a socket. Guarded the same way as the rest of
+     * configureSocket(): other runtimes stub socket features.
+     *
+     * @param socket - The socket to arm
+     * @internal
+     */
+    armSocketTimeout(socket) {
         if (typeof socket.setTimeout === 'function') {
             socket.setTimeout(this.socketTimeout);
         }
@@ -1101,25 +1151,50 @@ class ImapFlow extends node_events_1.EventEmitter {
         this._socketTimeout =
             this._socketTimeout ||
                 (() => {
-                    const err = new Error('Socket timeout');
-                    err.code = 'ETIMEOUT';
-                    const quietExpected = this.idling || this._openDownloads || this.currentLock;
+                    const timeoutError = () => {
+                        const err = new Error('Socket timeout');
+                        err.code = 'ETIMEOUT';
+                        return err;
+                    };
+                    if (!this.usable || !this.socket || this.socket.destroyed) {
+                        this.emitError(timeoutError());
+                        return;
+                    }
+                    if (this._processingResponse) {
+                        // The reader is parked processing a response (a fetch consumer taking its
+                        // time over a row), so nothing is being read: the quiet is this side's, and
+                        // the server is not overdue with anything. The timer is one-shot and nothing
+                        // resumes it until reading does, so it is re-armed for the next check.
+                        this.log.debug({ msg: 'Socket timeout while a response is being processed', cid: this.id });
+                        this.armSocketTimeout(this.socket);
+                        return;
+                    }
+                    // A throttle back-off is quiet by design, the NOOP below probes that the server
+                    // is still there
+                    const quietExpected = this.idling || this._openDownloads || this.currentLock || this._throttleWaits.size;
                     const commandStuck = this.currentRequest && !(this.idling && this.currentRequest.command === 'IDLE');
-                    if (quietExpected && !commandStuck) {
-                        if (!this.usable || !this.socket || this.socket.destroyed) {
-                            this.emitError(err);
-                            return;
-                        }
-                        this.run('NOOP').catch(err => {
+                    // A recovery NOOP that has not settled by the next timeout means the peer is gone
+                    if (quietExpected && !commandStuck && !this._recoveryPending) {
+                        // The inactivity timer is one-shot, re-armed only by traffic. The NOOP can not
+                        // reach the wire while IDLE still waits for its continuation (DONE is sent
+                        // only after the "+"), so without re-arming it here a peer that went silent
+                        // right after IDLE would never time out again.
+                        this._recoveryPending = true;
+                        this.armSocketTimeout(this.socket);
+                        this.run('NOOP')
+                            .catch(err => {
                             this.log.warn({ msg: 'Connection recovery failed after timeout', err, cid: this.id });
                             if (!this.isClosed) {
                                 this.close();
                             }
+                        })
+                            .finally(() => {
+                            this._recoveryPending = false;
                         });
                     }
                     else {
                         this.log.debug({ msg: 'Socket timeout', cid: this.id });
-                        this.emitError(err);
+                        this.emitError(timeoutError());
                     }
                 });
         const socket = this.socket;
@@ -1349,8 +1424,15 @@ class ImapFlow extends node_events_1.EventEmitter {
             err.tlsFailed = true;
             throw err;
         }
-        // Opportunistic STARTTLS. But it's not possible right now.
-        // Attention: Could be a downgrade attack.
+        // Opportunistic STARTTLS not offered. The capability list arrived in cleartext, so this
+        // may be a downgrade attack: say so rather than fall back silently (see the doSTARTTLS
+        // option for the policy).
+        this.log.warn({
+            msg: 'Server does not support STARTTLS, continuing over an unencrypted connection',
+            host: this.host,
+            port: this.port,
+            cid: this.id
+        });
         return false;
     }
     /**
@@ -1418,9 +1500,8 @@ class ImapFlow extends node_events_1.EventEmitter {
                 // of the IP - accepting any "localhost" certificate for any IP-hosted
                 // server, and rejecting legitimate IP-SAN certificates.
                 host: this.host,
-                servername: this.servername,
                 port: this.port
-            }, this.options.tls || {});
+            }, this.tlsServername(), this.options.tls || {});
             this.clearSocketHandlers();
             let settled = false;
             // Single settlement path for the upgrade. Every terminal outcome - handshake
@@ -1613,7 +1694,7 @@ class ImapFlow extends node_events_1.EventEmitter {
         throw new errors_js_1.AuthenticationFailure('No matching authentication method');
     }
     /** @internal */
-    beginSession(onUnhandledError) {
+    beginSession() {
         (0, tools_js_1.clearTimer)(this.greetingTimeout);
         this.greetingReceived = true;
         this.untaggedHandlers.OK = null;
@@ -1632,15 +1713,21 @@ class ImapFlow extends node_events_1.EventEmitter {
             }
         })
             .catch(err => {
-            this.log.error({ err, cid: this.id });
+            // The transport goes with the failed attempt: the instance can not be reused, and
+            // an open socket would only trip the inactivity watchdog later
+            this.closeAfter();
             if (typeof this.initialReject === 'function') {
+                this.log.error({ err, cid: this.id });
                 (0, tools_js_1.clearTimer)(this.greetingTimeout);
                 let reject = this.initialReject;
                 this.initialResolve = false;
                 this.initialReject = false;
                 return reject(err);
             }
-            onUnhandledError(err);
+            // connect() was already settled by whatever took the connection down (a socket
+            // error or close rejected it first), so this failure is a consequence of that.
+            // A second 'error' event for it would throw when no listener is attached.
+            (0, tools_js_1.logConnectionError)(this, 'Session setup failed', err);
         });
     }
     /** @internal */
@@ -1648,8 +1735,7 @@ class ImapFlow extends node_events_1.EventEmitter {
         this.greeting = (0, tools_js_1.getTextValues)(message.attributes)
             .filter(entry => entry)
             .join('');
-        // ALWAYS emit the error so users can handle it
-        this.beginSession(err => this.emitError(err));
+        this.beginSession();
     }
     /** @internal */
     async initialPREAUTH() {
@@ -1660,10 +1746,7 @@ class ImapFlow extends node_events_1.EventEmitter {
         // documented contract for the `authenticated` property: `true` when the
         // connection was authenticated by a PREAUTH greeting (no credentials known)
         this.authenticated = true;
-        this.beginSession(err => {
-            this.log.error({ err, cid: this.id });
-            this.closeAfter();
-        });
+        this.beginSession();
     }
     /** @internal */
     async serverBye(parsed) {
@@ -1675,10 +1758,13 @@ class ImapFlow extends node_events_1.EventEmitter {
         this.byeReason = reason || 'Server closed connection';
         this.untaggedHandlers.BYE = null;
         this.state = this.states.LOGOUT;
-        // A BYE greeting rejects the connection outright. Do not wait for the server to close
-        // the socket: one that keeps it open would leave connect() pending until the greeting
-        // timeout.
-        if (!this.greetingReceived) {
+        // BYE means the server is about to close the connection (RFC 9051 7.1.5), so the socket
+        // is not waited out: a BYE greeting kept open would leave connect() pending until the
+        // greeting timeout, and an unsolicited BYE whose FIN never arrives would leave the
+        // in-flight command and the queue behind it waiting for the socket watchdog. The BYE
+        // that answers a LOGOUT is the exception: its tagged completion closes the connection.
+        const answersLogout = !!this.currentRequest && this.currentRequest.command.toUpperCase() === 'LOGOUT';
+        if (!this.greetingReceived || !answersLogout) {
             this.closeAfter();
         }
     }
@@ -1740,7 +1826,7 @@ class ImapFlow extends node_events_1.EventEmitter {
         // keep exists up to date
         let prevCount = this.mailbox.exists;
         this.mailbox.exists = count;
-        this.emit('exists', {
+        (0, tools_js_1.emitSafe)(this, 'exists', {
             path: this.mailbox.path,
             count,
             prevCount
@@ -1751,7 +1837,7 @@ class ImapFlow extends node_events_1.EventEmitter {
     /** @internal */
     async notifyExpunge(payload) {
         if (typeof this.options.expungeHandler !== 'function') {
-            this.emit('expunge', payload);
+            (0, tools_js_1.emitSafe)(this, 'expunge', payload);
             return;
         }
         try {
@@ -1805,12 +1891,18 @@ class ImapFlow extends node_events_1.EventEmitter {
             uids = untagged.attributes[0].value;
         }
         let uidList = (0, tools_js_1.expandRange)(uids);
+        let earlier = tags.includes('EARLIER');
+        // RFC 7162 section 3.2.10: unlike VANISHED (EARLIER), a plain VANISHED reports messages the
+        // client knows about and decrements the message count like the same number of EXPUNGEs would
+        if (!earlier) {
+            mailbox.exists = Math.max(0, mailbox.exists - uidList.length);
+        }
         for (let uid of uidList) {
             let payload = {
                 path: mailbox.path,
                 uid,
                 vanished: true,
-                earlier: tags.includes('EARLIER')
+                earlier
             };
             await this.notifyExpunge(payload);
         }
@@ -1822,7 +1914,7 @@ class ImapFlow extends node_events_1.EventEmitter {
             // mailbox closed, ignore
             return;
         }
-        let message = await (0, tools_js_1.formatMessageResponse)(untagged, mailbox, this.idHashAlgorithm);
+        let message = await (0, tools_js_1.formatMessageResponse)(untagged, mailbox, this.idHashAlgorithm, this);
         if (message.flags) {
             let updateEvent = {
                 path: mailbox.path,
@@ -1838,7 +1930,7 @@ class ImapFlow extends node_events_1.EventEmitter {
             if (message.flagColor) {
                 updateEvent.flagColor = message.flagColor;
             }
-            this.emit('flags', updateEvent);
+            (0, tools_js_1.emitSafe)(this, 'flags', updateEvent);
         }
     }
     /** @internal */
@@ -1851,6 +1943,12 @@ class ImapFlow extends node_events_1.EventEmitter {
         }
         return true;
     }
+    // servername for tls.connect(), left out for an IP literal host (this.servername is false then):
+    // Node treats a false value like a missing one, but Bun throws a TypeError for it
+    /** @internal */
+    tlsServername() {
+        return this.servername ? { servername: this.servername } : {};
+    }
     // Normalizes a message range from various input formats into an IMAP-compatible
     // sequence string (e.g., "1:5,7,10:*"). Handles: numbers, "*", {all:true},
     // {uid:value}, search query objects (resolved via SEARCH), and arrays of numbers.
@@ -1893,6 +1991,11 @@ class ImapFlow extends node_events_1.EventEmitter {
         if (!value) {
             return false;
         }
+        // An empty mailbox has no message numbers: every sequence set, "1:*" included, would get a
+        // BAD (RFC 9051 section 9, seq-number). UID sets may point past the end, so they are sent.
+        if (!options.uid && this.mailbox && !this.mailbox.exists) {
+            return false;
+        }
         return value;
     }
     // The single definition of "the connection is not free". A held or queued mailbox lock, a
@@ -1962,9 +2065,8 @@ class ImapFlow extends node_events_1.EventEmitter {
         let connector = this.secureConnection ? node_tls_1.default : node_net_1.default;
         let opts = Object.assign({
             host: this.host,
-            servername: this.servername,
             port: this.port
-        }, this.options.tls || {});
+        }, this.tlsServername(), this.options.tls || {});
         this.untaggedHandlers.OK = (...args) => this.initialOK(...args);
         this.untaggedHandlers.BYE = (...args) => this.serverBye(...args);
         this.untaggedHandlers.PREAUTH = () => this.initialPREAUTH();
@@ -2022,6 +2124,12 @@ class ImapFlow extends node_events_1.EventEmitter {
                 reject(err);
             }, deadline.remaining());
             let onConnect = () => {
+                // close() may have run between the socket assignment and this callback (the
+                // cleartext proxy path defers it): connect() is already rejected and the socket
+                // gone, so arming the greeting timer now would only fire a stray GREETING_TIMEOUT
+                if (this.isClosed || !this.socket) {
+                    return;
+                }
                 try {
                     (0, tools_js_1.clearTimer)(this.connectTimeout);
                     // ImapFlow now owns the socket; drop the proxy's early error handler
@@ -2156,9 +2264,13 @@ class ImapFlow extends node_events_1.EventEmitter {
             this.idling = false;
             this.closeConnectSteps();
             if (typeof this.preCheck === 'function') {
-                // Runs while the connection is being torn down, so the rejection this sees is
-                // almost always the NoConnection close() is about to raise itself.
-                this.preCheck().catch(err => (0, tools_js_1.logConnectionError)(this, 'Failed to break IDLE while closing', err));
+                // Taken off the connection first: breaking IDLE writes DONE, a write on a dead
+                // transport calls close(), and close() must not find this function here and
+                // re-enter it. The rejection this sees is almost always the NoConnection close()
+                // is about to raise itself.
+                let preCheck = this.preCheck;
+                this.preCheck = false;
+                preCheck().catch(err => (0, tools_js_1.logConnectionError)(this, 'Failed to break IDLE while closing', err));
             }
             // Session-only public state must not survive the connection it describes: callers read
             // these properties in reconnect logic and would otherwise mistake cached objects for
@@ -2278,6 +2390,7 @@ class ImapFlow extends node_events_1.EventEmitter {
     closeRequests() {
         // Collect all pending requests to reject
         let pendingRequests = [];
+        this.commandParts = [];
         // reject command that is currently processed
         if (this.currentRequest && this.requestTagMap.has(this.currentRequest.tag)) {
             let tag = this.currentRequest.tag;
@@ -3136,7 +3249,34 @@ class ImapFlow extends node_events_1.EventEmitter {
             throw this.createNoConnectionError(false, { rejectedFrom: 'noSocket', command });
         }
         let handler = this.commands.get(command);
-        return await handler(this, ...args);
+        try {
+            return await handler(this, ...args);
+        }
+        finally {
+            this.releaseOrphanedResponse(command);
+        }
+    }
+    /**
+     * Safety net for the `next()` contract of settleRequest(): a command handler that throws or
+     * returns between the resolution of its exec() and the `next()` call would leave the reader
+     * loop parked, stalling every later command until the socket timeout. Checked one macrotask
+     * after the handler settled, so a concurrently running handler whose response has just been
+     * resolved gets to release it itself first.
+     *
+     * @param command Command name, for the log entry.
+     * @internal
+     */
+    releaseOrphanedResponse(command) {
+        let release = this.parkedRelease;
+        if (!release) {
+            return;
+        }
+        setImmediate(() => {
+            if (this.parkedRelease === release) {
+                this.log.warn({ msg: 'Command handler did not release its response', command, cid: this.id });
+                release();
+            }
+        });
     }
     // Mailbox lock queue processor. Implements a mutex pattern: only one lock
     // is active at a time. When the active lock is released, the next queued
@@ -3272,6 +3412,11 @@ class ImapFlow extends node_events_1.EventEmitter {
                 try {
                     // Need to SELECT/EXAMINE a different mailbox
                     await this.mailboxOpen(path, options);
+                    if (!this.mailbox) {
+                        // mailboxOpen() resolves with nothing when the connection is no longer
+                        // authenticated (a BYE arrived meanwhile): no mailbox, so no lock on it
+                        throw this.createNoConnectionError(false, { rejectedFrom: 'mailboxLock', path });
+                    }
                     this.log.trace({
                         msg: 'Mailbox lock acquired [selected]',
                         path,
@@ -3382,35 +3527,36 @@ class ImapFlow extends node_events_1.EventEmitter {
             // {logger:false} never consults mainLogger, so it does not create the default logger
             mainLogger = (0, logger_js_1.createConnectionLogger)({ cid: this.id, logRaw: this.options.logRaw });
         }
+        // Whether the configured logger takes entries at this level: a disabled logger takes
+        // none, a plain object of level methods the levels it has methods for, plus error and
+        // fatal, which fall back to the console. The level methods and isLevelEnabled() below
+        // share this one rule.
+        const reachesLogger = (level) => this.options.logger !== false && (typeof mainLogger[level] === 'function' || level === 'error' || level === 'fatal');
         let synteticLogger = {};
         let levels = ['trace', 'debug', 'info', 'warn', 'error', 'fatal'];
         for (let level of levels) {
             synteticLogger[level] = (...args) => {
-                // using {logger:false} disables logging
-                if (this.options.logger !== false) {
+                if (reachesLogger(level)) {
                     const logMethod = mainLogger[level];
-                    if (typeof logMethod !== 'function') {
-                        // we are checking to make sure the level is supported.
-                        // if it isn't supported but the level is error or fatal, log to console anyway.
-                        if (level === 'fatal' || level === 'error') {
-                            let entry = args[0];
-                            try {
-                                if (entry && typeof entry === 'object' && entry.err) {
-                                    entry = Object.assign({}, entry, { err: flattenLoggedError(entry.err) });
-                                }
-                                console.error(JSON.stringify(entry));
-                            }
-                            catch {
-                                // Serializing failed (a circular structure, a BigInt, a throwing
-                                // getter). This fallback exists so an error is never lost, so hand
-                                // the entry to console.error itself - it inspects rather than
-                                // serializes, and handles all three - instead of dropping it.
-                                console.error(entry);
-                            }
-                        }
+                    if (typeof logMethod === 'function') {
+                        logMethod.apply(mainLogger, args);
                     }
                     else {
-                        logMethod.apply(mainLogger, args);
+                        // error or fatal without a method of its own: the console, so it is never lost
+                        let entry = args[0];
+                        try {
+                            if (entry && typeof entry === 'object' && entry.err) {
+                                entry = Object.assign({}, entry, { err: flattenLoggedError(entry.err) });
+                            }
+                            console.error(JSON.stringify(entry));
+                        }
+                        catch {
+                            // Serializing failed (a circular structure, a BigInt, a throwing
+                            // getter). This fallback exists so an error is never lost, so hand
+                            // the entry to console.error itself - it inspects rather than
+                            // serializes, and handles all three - instead of dropping it.
+                            console.error(entry);
+                        }
                     }
                 }
                 if (this.emitLogs && args && args[0] && typeof args[0] === 'object') {
@@ -3433,8 +3579,23 @@ class ImapFlow extends node_events_1.EventEmitter {
                 }
             };
         }
+        // Whether an entry at this level reaches anyone, so the caller can skip building an
+        // expensive one (a response serialized for the log) that nobody would see. 'log' events
+        // carry every entry whatever the logger does with it, and a pino-like logger knows its
+        // own threshold.
+        synteticLogger.isLevelEnabled = (level) => this.emitLogs || (typeof mainLogger.isLevelEnabled === 'function' ? !!mainLogger.isLevelEnabled(level) : reachesLogger(level));
         return synteticLogger;
     }
+    /**
+     * Whether a log entry at this level reaches anyone, so the caller can skip building an
+     * expensive one. A logger assigned to `log` from outside may lack the method, and then
+     * every level counts as enabled.
+     *
+     * @internal
+     */
+    isLogLevelEnabled(level) {
+        return typeof this.log.isLevelEnabled === 'function' ? this.log.isLevelEnabled(level) : true;
+    }
     /**
      * Detaches sockets from the IMAP pipeline. Useful for upgrading the connection
      * (e.g., STARTTLS) or transferring socket ownership. Call it while the connection is not

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "imapflow";
-export declare const version = "2.2.6";
+export declare const version = "2.2.8";
 export declare const homepage = "https://imapflow.com/";

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = "imapflow";
-exports.version = "2.2.6";
+exports.version = "2.2.8";
 exports.homepage = "https://imapflow.com/";