imapflow 2.3.0 → 2.4.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [2.4.0](https://github.com/postalsys/imapflow/compare/v2.3.0...v2.4.0) (2026-10-10)
+
+
+### Features
+
+* re-raise unexpected parser exceptions as coded ParserErrorInternal errors ([dda3f7e](https://github.com/postalsys/imapflow/commit/dda3f7e71e3c227479763a8c6af617fd4f57679a))
+
+
+### Bug Fixes
+
+* keep append literals in sync with their data and fail downloads cleanly ([752248e](https://github.com/postalsys/imapflow/commit/752248e07fd8930cb0943287c32e3bab88484d80))
+
 ## [2.3.0](https://github.com/postalsys/imapflow/compare/v2.2.11...v2.3.0) (2026-10-08)
 
 

package/dist/cjs/commands/append.d.ts

@@ -19,4 +19,4 @@ export interface AppendResult extends AppendResponseObject {
  * @returns Append result with UID info if available, or undefined if preconditions not met
  * @throws {Error} If the APPEND command fails or message exceeds APPENDLIMIT
  */
-export default function append(connection: ImapFlow, destination: string | string[], content: Buffer | string, flags?: string | string[] | undefined, idate?: Date | string | false | undefined): Promise<AppendResult | undefined>;
+export default function append(connection: ImapFlow, destination: string | string[], content: Buffer | Uint8Array | string, flags?: string | string[] | undefined, idate?: Date | string | false | undefined): Promise<AppendResult | undefined>;

package/dist/cjs/commands/append.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = append;
 const tools_js_1 = require("../tools.js");
+const errors_js_1 = require("../errors.js");
 /**
  * Appends a message to a mailbox.
  *
@@ -18,14 +19,24 @@ async function append(connection, destination, content, flags, idate) {
         // nothing to do here
         return;
     }
+    // The literal size marker is announced from these bytes, so anything that is not
+    // bytes (a Readable, a plain object) is refused here instead of desyncing the session
+    let message;
     if (typeof content === 'string') {
-        content = Buffer.from(content);
+        message = Buffer.from(content);
+    }
+    else if (content instanceof Uint8Array) {
+        // a Buffer as is, any other Uint8Array as a view over the same memory, not a copy
+        message = Buffer.isBuffer(content) ? content : Buffer.from(content.buffer, content.byteOffset, content.byteLength);
+    }
+    else {
+        throw (0, errors_js_1.createImapError)('Message content must be a Buffer, Uint8Array or string', 'InvalidMessageContent');
     }
     // APPENDLIMIT capability (RFC 7889): server may advertise the maximum message
     // size it accepts. Check before sending to avoid a wasted round-trip.
     if (connection.capabilities.has('APPENDLIMIT')) {
         let appendLimit = connection.capabilities.get('APPENDLIMIT');
-        if (typeof appendLimit === 'number' && appendLimit < content.length) {
+        if (typeof appendLimit === 'number' && appendLimit < message.length) {
             let err = new Error('Message content too big for APPENDLIMIT=' + appendLimit);
             err.serverResponseCode = 'APPENDLIMIT';
             throw err;
@@ -82,9 +93,9 @@ async function append(connection, destination, content, flags, idate) {
     // Regular literals cannot contain NUL bytes per the IMAP grammar.
     let isLiteral8 = false;
     if (connection.capabilities.has('BINARY') && !connection.disableBinary) {
-        isLiteral8 = content.indexOf(Buffer.from([0])) >= 0;
+        isLiteral8 = message.indexOf(0) >= 0;
     }
-    attributes.push({ type: 'LITERAL', value: content, isLiteral8 });
+    attributes.push({ type: 'LITERAL', value: message, isLiteral8 });
     let map = { destination };
     if (connection.mailbox && connection.mailbox.path) {
         map.path = connection.mailbox.path;

package/dist/cjs/commands/compress.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = compress;
+const errors_js_1 = require("../errors.js");
 /**
  * Requests DEFLATE compression from the server.
  *
@@ -36,8 +37,7 @@ async function compress(connection) {
     // back its unconsumed tail on unpipe so the transport can feed it into the
     // inflater - not something a command module can reach from here.
     if (response.hasTrailingData) {
-        let error = new Error('Server sent data between the COMPRESS response and the compression layer switch');
-        error.code = 'COMPRESS_TRAILING_DATA';
+        let error = (0, errors_js_1.createImapError)('Server sent data between the COMPRESS response and the compression layer switch', 'COMPRESS_TRAILING_DATA');
         connection.log.error({ err: error, cid: connection.id });
         // Schedule the close before releasing parser backpressure, so the buffered
         // deflate-framed bytes cannot settle anything before teardown begins. This is

package/dist/cjs/commands/idle.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = idle;
 const tools_js_1 = require("../tools.js");
+const errors_js_1 = require("../errors.js");
 const NOOP_INTERVAL = 2 * 60 * 1000;
 /**
  * Marks the connection as idling on behalf of one session and returns a release function.
@@ -192,9 +193,7 @@ async function pollOnce(connection, session) {
                 highestModseq: true
             });
             if (!status) {
-                let err = new Error('STATUS poll failed');
-                err.code = 'PollFailed';
-                throw err;
+                throw (0, errors_js_1.createImapError)('STATUS poll failed', 'PollFailed');
             }
             break;
         }

package/dist/cjs/commands/status.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = status;
 const tools_js_1 = require("../tools.js");
 const status_fields_js_1 = require("./status-fields.js");
+const errors_js_1 = require("../errors.js");
 // STATUS fields that also refresh the live mailbox state when the queried mailbox is the
 // currently selected one. Keyed by the output property name parseStatusList() reports.
 const MAILBOX_UPDATERS = {
@@ -99,10 +100,7 @@ async function status(connection, path, query) {
                 return false;
             });
             if (folders && !folders.length) {
-                let error = new Error(`Mailbox doesn't exist: ${path}`);
-                error.code = 'NotFound';
-                error.response = err;
-                throw error;
+                throw (0, errors_js_1.createImapError)(`Mailbox doesn't exist: ${path}`, 'NotFound', { response: err });
             }
         }
         connection.log.warn({ err, cid: connection.id });

package/dist/cjs/connection-deadline.d.ts

@@ -1,4 +1,4 @@
-import type { ImapFlowError } from './errors.js';
+import { type ImapFlowError } from './errors.js';
 export declare const CONNECT_TIMEOUT: number;
 /**
  * One deadline for an entire connection attempt.

package/dist/cjs/connection-deadline.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ConnectionDeadline = exports.CONNECT_TIMEOUT = void 0;
 const tools_js_1 = require("./tools.js");
+const errors_js_1 = require("./errors.js");
 // Default upper bound for establishing a usable transport, including DNS and proxy negotiation.
 exports.CONNECT_TIMEOUT = 90 * 1000;
 /**
@@ -31,10 +32,7 @@ class ConnectionDeadline {
      * @returns The shared `CONNECT_TIMEOUT` error.
      */
     error() {
-        let err = new Error('Failed to establish connection in required time');
-        err.code = 'CONNECT_TIMEOUT';
-        err.details = { connectionTimeout: this.timeout };
-        return err;
+        return (0, errors_js_1.createImapError)('Failed to establish connection in required time', 'CONNECT_TIMEOUT', { details: { connectionTimeout: this.timeout } });
     }
     /**
      * Maps a dependency's own expiry onto the shared `CONNECT_TIMEOUT` shape, so callers see one

package/dist/cjs/download.js

@@ -18,6 +18,7 @@ const limited_passthrough_js_1 = require("./limited-passthrough.js");
 // What a wait on the head stream listens for: it can take more input, it failed, or it went
 // away (a consumer destroying it closes it without a 'drain')
 const DRAIN_WAIT_EVENTS = ['drain', 'error', 'close'];
+const errors_js_1 = require("./errors.js");
 const tools_js_1 = require("./tools.js");
 const isEmptySection = (value) => !value?.length;
 /**
@@ -88,10 +89,7 @@ async function fetchExpected(client, range, query, options, expected) {
             cid: client.id
         });
         if (attempt >= MAX_FETCH_ATTEMPTS) {
-            let err = new Error('Server kept answering with data of another request');
-            err.code = 'DownloadIncomplete';
-            err.cid = client.id;
-            throw err;
+            throw (0, errors_js_1.createImapError)('Server kept answering with data of another request', 'DownloadIncomplete', { cid: client.id });
         }
     }
 }
@@ -238,6 +236,12 @@ async function downloadMessage(client, range, part, options) {
         };
         let response = await fetchExpected(client, range, query, downloadOptions, expected);
         if (!response) {
+            // An empty answer also comes from a connection that closed while the consumer was
+            // paused between chunks (fetchOne() finds no mailbox then), and that is not a
+            // missing message: a caller that retries would skip it
+            if (!client.usable) {
+                throw client.createNoConnectionError(false, { rejectedFrom: 'download' });
+            }
             return { response: false, chunk: false };
         }
         if (!uid && response.uid) {
@@ -374,13 +378,19 @@ async function downloadMessage(client, range, part, options) {
     // would still pull the entire part off the wire.
     let limiters = [];
     let isLimited = () => limiters.some(entry => entry.limited);
+    // Every stage after the head, so a download that ends early can release all of them
+    let stages = [];
     // Appending a stage means forwarding the current tail's errors to it before piping, so a
-    // failure anywhere reaches the stream the caller is reading
+    // failure anywhere reaches the stream the caller is reading. The stage is destroyed with
+    // the error rather than only emitting it: pipe() does not end its destination on a source
+    // error, so a consumer that only listens for 'finish' or 'close' (a plain .pipe() into a
+    // file) would otherwise wait forever.
     let pipeStage = (stage) => {
         output.on('error', err => {
-            stage.emit('error', err);
+            stage.destroy(err);
         });
         output = output.pipe(stage);
+        stages.push(stage);
         return stage;
     };
     let isTextNode = ['text/html', 'text/plain', 'text/x-amp-html'].includes(meta.contentType) || (part === '1' && !meta.contentType);
@@ -425,8 +435,8 @@ async function downloadMessage(client, range, part, options) {
     // Cleanup function
     const cleanup = () => {
         fetchAborted = true;
-        if (stream && !stream.destroyed) {
-            stream.destroy();
+        for (let entry of [stream, ...stages]) {
+            entry.destroy();
         }
     };
     // Listen for stream destruction
@@ -499,11 +509,7 @@ async function downloadMessage(client, range, part, options) {
                 // Loud on purpose. Everything written downstream by this point holds
                 // duplicated content, and a quiet stop is indistinguishable from a clean EOF,
                 // so the consumer would store a corrupt body believing it intact.
-                let err = new Error('Download exceeded the expected message size');
-                err.code = 'DownloadOverflow';
-                err.maxSize = maxTotalBytes;
-                err.cid = client.id;
-                throw err;
+                throw (0, errors_js_1.createImapError)('Download exceeded the expected message size', 'DownloadOverflow', { maxSize: maxTotalBytes, cid: client.id });
             }
             let { response, chunk } = await getNextPart();
             // A consumer that gave up while the chunk was in flight
@@ -514,10 +520,7 @@ async function downloadMessage(client, range, part, options) {
                 // The message is gone mid-download (expunged by another client, or the
                 // mailbox was closed). Ending the stream here would pass the truncated body
                 // off as complete, so the consumer is told the same way as for an overflow.
-                let err = new Error('Message disappeared before the download completed');
-                err.code = 'DownloadIncomplete';
-                err.cid = client.id;
-                throw err;
+                throw (0, errors_js_1.createImapError)('Message disappeared before the download completed', 'DownloadIncomplete', { cid: client.id });
             }
             if (!chunk) {
                 break;
@@ -547,7 +550,7 @@ async function downloadMessage(client, range, part, options) {
         fetchAllParts(head)
             .catch(err => {
             if (!fetchAborted && stream && !stream.destroyed) {
-                stream.emit('error', err);
+                stream.destroy(err);
                 /* c8 ignore start */ // the else logs when a fetch error arrives after the stream was already torn down (timing-dependent)
             }
             else {
@@ -572,7 +575,7 @@ async function downloadMessage(client, range, part, options) {
             // above rejects a promise nobody holds and takes the process down on
             // unhandledRejection. Reaching it always means an invariant broke - the head
             // stream kept pipeStage()'s error forwarder for the life of the download, so
-            // emit('error') above has somewhere to go - which is why it logs at error even
+            // destroy(err) above has somewhere to go - which is why it logs at error even
             // for a routine-looking connection code.
             .catch(err => client.log.error({ msg: 'Failed to fail the download stream', err, cid: client.id }));
     };

package/dist/cjs/errors.d.ts

@@ -29,6 +29,7 @@ export declare const ImapFlowErrorCode: {
     readonly MissingServerExtension: "MissingServerExtension";
     readonly ParserError: "ParserError";
     readonly ParserErrorExchange: "ParserErrorExchange";
+    readonly ParserErrorInternal: "ParserErrorInternal";
     readonly MAX_IMAP_NESTING_REACHED: "MAX_IMAP_NESTING_REACHED";
     readonly LineTooLarge: "LineTooLarge";
     readonly LiteralTooLarge: "LiteralTooLarge";
@@ -38,6 +39,7 @@ export declare const ImapFlowErrorCode: {
     readonly InvalidTextValue: "InvalidTextValue";
     readonly InvalidSequenceSet: "InvalidSequenceSet";
     readonly InvalidSearchQuery: "InvalidSearchQuery";
+    readonly InvalidMessageContent: "InvalidMessageContent";
     readonly DownloadOverflow: "DownloadOverflow";
     readonly DownloadIncomplete: "DownloadIncomplete";
     readonly ProxyError: "ProxyError";
@@ -48,6 +50,8 @@ export declare const ImapFlowErrorCode: {
 };
 /** One of the {@link ImapFlowErrorCode} values */
 export type ImapFlowErrorCode = (typeof ImapFlowErrorCode)[keyof typeof ImapFlowErrorCode];
+/** A numbered parser error code, `ParserError1` and up */
+export type ParserErrorCode = `ParserError${number}`;
 /**
  * An Error raised by ImapFlow, with the extra properties the library attaches to describe
  * the failure. Every property is optional: which ones are present depends on where the
@@ -132,3 +136,14 @@ export declare class AuthenticationFailure extends Error implements ImapFlowErro
     response?: string | undefined;
     oauthError?: any;
 }
+/**
+ * Creates an {@link ImapFlowError} with a code and optional extra properties. The code is
+ * checked by the compiler against {@link ImapFlowErrorCode}, so a typo or an undeclared
+ * code fails the build instead of reaching consumers.
+ *
+ * @param message - The error message
+ * @param code - The error code
+ * @param props - Extra properties to set on the error
+ * @returns The error, ready to throw or reject with
+ */
+export declare function createImapError(message: string, code: ImapFlowErrorCode | ParserErrorCode, props?: Omit<ImapFlowError, 'name' | 'message' | 'stack' | 'code'> | undefined): ImapFlowError;

package/dist/cjs/errors.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthenticationFailure = exports.ImapFlowErrorCode = void 0;
+exports.createImapError = createImapError;
 /**
  * The `code` values ImapFlow sets on the errors it raises, so they can be matched without
  * string literals: `if (err.code === ImapFlowErrorCode.NoConnection)`.
@@ -35,6 +36,8 @@ exports.ImapFlowErrorCode = {
     // response parsing and size limits
     ParserError: 'ParserError',
     ParserErrorExchange: 'ParserErrorExchange',
+    // an unexpected exception inside the parser, re-raised with a code; a parser bug
+    ParserErrorInternal: 'ParserErrorInternal',
     MAX_IMAP_NESTING_REACHED: 'MAX_IMAP_NESTING_REACHED',
     LineTooLarge: 'LineTooLarge',
     LiteralTooLarge: 'LiteralTooLarge',
@@ -45,6 +48,7 @@ exports.ImapFlowErrorCode = {
     InvalidTextValue: 'InvalidTextValue',
     InvalidSequenceSet: 'InvalidSequenceSet',
     InvalidSearchQuery: 'InvalidSearchQuery',
+    InvalidMessageContent: 'InvalidMessageContent',
     // download()
     DownloadOverflow: 'DownloadOverflow',
     DownloadIncomplete: 'DownloadIncomplete',
@@ -66,3 +70,21 @@ class AuthenticationFailure extends Error {
     }
 }
 exports.AuthenticationFailure = AuthenticationFailure;
+/**
+ * Creates an {@link ImapFlowError} with a code and optional extra properties. The code is
+ * checked by the compiler against {@link ImapFlowErrorCode}, so a typo or an undeclared
+ * code fails the build instead of reaching consumers.
+ *
+ * @param message - The error message
+ * @param code - The error code
+ * @param props - Extra properties to set on the error
+ * @returns The error, ready to throw or reject with
+ */
+function createImapError(message, code, props) {
+    const error = new Error(message);
+    error.code = code;
+    if (props) {
+        Object.assign(error, props);
+    }
+    return error;
+}

package/dist/cjs/handler/imap-compiler.d.ts

@@ -12,13 +12,13 @@ import type { CompilerOptions, ImapCompileInput } from './types.js';
  * @param options.isLogging - If true, redacts sensitive values and truncates long strings/literals for logging purposes.
  * @param options.literalPlus - If true, uses the LITERAL+ extension (appends "+" to literal length markers).
  * @param options.literalMinus - If true, uses the LITERAL- extension for literals up to 4096 bytes.
- * @returns A promise that resolves to an array of Buffers (if asArray is true) or a single concatenated Buffer.
+ * @returns An array of Buffers (if asArray is true) or a single concatenated Buffer.
  */
 declare function compiler(response: ImapCompileInput, options: CompilerOptions & {
     asArray: true;
-}): Promise<Buffer[]>;
+}): Buffer[];
 declare function compiler(response: ImapCompileInput, options?: (CompilerOptions & {
     asArray?: false | undefined;
-}) | undefined): Promise<Buffer>;
-declare function compiler(response: ImapCompileInput, options?: CompilerOptions | undefined): Promise<Buffer | Buffer[]>;
+}) | undefined): Buffer;
+declare function compiler(response: ImapCompileInput, options?: CompilerOptions | undefined): Buffer | Buffer[];
 export default compiler;

package/dist/cjs/handler/imap-compiler.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const imap_formal_syntax_js_1 = __importDefault(require("./imap-formal-syntax.js"));
+const errors_js_1 = require("../errors.js");
 // A single element of a sequence-set as defined by the RFC 9051 grammar: a number
 // or a range, where "*" stands for the largest number in use. Digit strings are not
 // range-checked here (a server rejects "0" or an overlong number on its own); the
@@ -46,13 +47,11 @@ const CRLF = /[\r\n]/;
  */
 const quoteString = (value) => {
     if (NOT_QUOTABLE.test(value)) {
-        let error = new Error('Unquotable character in IMAP string value');
-        error.code = 'InvalidStringValue';
-        throw error;
+        throw (0, errors_js_1.createImapError)('Unquotable character in IMAP string value', 'InvalidStringValue');
     }
     return '"' + value.replace(/["\\]/g, char => '\\' + char) + '"';
 };
-async function compiler(response, options) {
+function compiler(response, options) {
     let { asArray, isLogging, literalPlus, literalMinus } = options || {};
     const respParts = [];
     // Formats an entry (string, number or Buffer) into the Buffer that is written to
@@ -67,9 +66,7 @@ async function compiler(response, options) {
     const emitEntry = (entry, opts) => {
         let { returnEmpty, raw } = opts || {};
         if (!raw && !isLogging && (typeof entry === 'string' || Buffer.isBuffer(entry)) && CRLF.test(entry.toString('latin1'))) {
-            let error = new Error('Line terminator in IMAP token');
-            error.code = 'InvalidTokenValue';
-            throw error;
+            throw (0, errors_js_1.createImapError)('Line terminator in IMAP token', 'InvalidTokenValue');
         }
         if (typeof entry === 'string') {
             return Buffer.from(entry);
@@ -93,7 +90,7 @@ async function compiler(response, options) {
     // Set right after the compiler writes "(" or "[" itself, so the first element inside gets no
     // leading space
     let afterOpener = false;
-    let walk = async (node, options) => {
+    let walk = (node, options) => {
         options = options || {};
         // Add a space separator when:
         // - The previous token was a LITERAL. Literal data ends exactly at its declared length, so
@@ -125,7 +122,7 @@ async function compiler(response, options) {
                 if (subArray && !Array.isArray(child)) {
                     subArray = false;
                 }
-                await walk(child, { subArray });
+                walk(child, { subArray });
             }
             resp.push(emitEntry(')'));
             afterOpener = false;
@@ -159,6 +156,11 @@ async function compiler(response, options) {
                     resp.push(emitEntry(logPlaceholder(node.value.length, 'literal')));
                 }
                 else {
+                    // The size marker must match the bytes emitEntry() writes, and it writes
+                    // nothing for a value that is not a Buffer or a string
+                    if (node.value && !Buffer.isBuffer(node.value) && typeof node.value !== 'string') {
+                        throw (0, errors_js_1.createImapError)('Literal value must be a Buffer or a string', 'InvalidTokenValue');
+                    }
                     // The literal size marker counts octets - string values are written as
                     // UTF-8, so their UTF-16 .length would undercount multi-byte characters
                     let literalLength = !node.value ? 0 : Buffer.isBuffer(node.value) ? node.value.length : Buffer.byteLength(node.value.toString());
@@ -213,9 +215,7 @@ async function compiler(response, options) {
                 if (!isLogging) {
                     val = node.value === null || node.value === undefined ? '' : node.value.toString();
                     if (!isValidSequenceSet(val)) {
-                        let error = new Error('Invalid sequence set value');
-                        error.code = 'InvalidSequenceSet';
-                        throw error;
+                        throw (0, errors_js_1.createImapError)('Invalid sequence set value', 'InvalidSequenceSet');
                     }
                     resp.push(emitEntry(val, { raw: true }));
                 }
@@ -230,9 +230,7 @@ async function compiler(response, options) {
                 // this check runs first only to raise the more specific InvalidTextValue code.
                 if (node.value) {
                     if (!isLogging && CRLF.test(node.value.toString())) {
-                        let error = new Error('Line terminator in IMAP text value');
-                        error.code = 'InvalidTextValue';
-                        throw error;
+                        throw (0, errors_js_1.createImapError)('Line terminator in IMAP text value', 'InvalidTextValue');
                     }
                     resp.push(emitEntry(node.value));
                 }
@@ -267,7 +265,7 @@ async function compiler(response, options) {
                     resp.push(emitEntry('['));
                     afterOpener = true;
                     for (let child of node.section) {
-                        await walk(child);
+                        walk(child);
                     }
                     resp.push(emitEntry(']'));
                     afterOpener = false;
@@ -286,13 +284,15 @@ async function compiler(response, options) {
     if (response.attributes) {
         let attributes = Array.isArray(response.attributes) ? response.attributes : [].concat(response.attributes);
         for (let child of attributes) {
-            await walk(child);
+            walk(child);
         }
     }
     if (resp.length) {
         respParts.push(resp);
     }
-    const compiled = respParts.map(part => Buffer.concat(part));
+    // A part with a single entry (the data of a synchronizing literal) is used as is: copying a
+    // large message only to send it doubles its memory
+    const compiled = respParts.map(part => (part.length === 1 ? part[0] : Buffer.concat(part)));
     // without asArray there is a single part, returned as is instead of copied
     return asArray ? compiled : compiled.length === 1 ? compiled[0] : Buffer.concat(compiled);
 }

package/dist/cjs/handler/imap-parser.js

@@ -6,6 +6,31 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = parser;
 const imap_formal_syntax_js_1 = __importDefault(require("./imap-formal-syntax.js"));
 const parser_instance_js_1 = require("./parser-instance.js");
+const errors_js_1 = require("../errors.js");
+const limits_js_1 = require("./limits.js");
+// The codes the parser raises on purpose: the numbered ParserErrorN codes, ParserErrorExchange,
+// the nesting limit and the inline literal size limit
+const PARSER_ERROR_CODES = /^(?:ParserError\d+|ParserErrorExchange|MAX_IMAP_NESTING_REACHED|LiteralTooLarge)$/;
+/**
+ * Anything the parser throws other than one of its own coded errors - a TypeError from a parser
+ * bug, a RangeError from runaway recursion or a bad Buffer offset (which carries a Node code), a
+ * thrown non-Error - is re-raised as a coded `ParserErrorInternal`, so callers that match on
+ * codes still handle it and settle the command the line belonged to. The fuzz suite treats this
+ * code as a failure, so the guard does not hide parser bugs from the tests.
+ *
+ * @param err - The thrown value
+ * @param input - The line that was being parsed
+ * @returns The error to rethrow
+ */
+function asParserError(err, input) {
+    if (err instanceof Error && PARSER_ERROR_CODES.test(err.code || '')) {
+        return err;
+    }
+    return (0, errors_js_1.createImapError)(`Unexpected parser failure: ${err instanceof Error ? err.message : String(err)}`, 'ParserErrorInternal', {
+        parserContext: (0, limits_js_1.boundedInput)(input.toString()),
+        ...(err instanceof Error ? { _err: err } : {})
+    });
+}
 /**
  * Parses a raw IMAP command or response buffer into a structured object.
  * Handles edge cases such as null-byte-padded responses from buggy servers and
@@ -26,7 +51,7 @@ async function parser(command, options) {
     // Workaround for buggy IMAP servers that pad responses with leading NUL (\x00) bytes.
     // Some servers (observed in the wild) prepend null bytes to their output, which would
     // cause parsing to fail. We strip them and note how many were removed for diagnostics.
-    if (command[0] === 0) {
+    if (Buffer.isBuffer(command) && command[0] === 0) {
         // find the first non null byte and trim
         let firstNonNull = -1;
         for (let i = 0; i < command.length; i++) {
@@ -39,7 +64,7 @@ async function parser(command, options) {
             // All bytes are null, treat as a BAD response
             return { tag: '*', command: 'BAD', attributes: [] };
         }
-        command = command.slice(firstNonNull);
+        command = command.subarray(firstNonNull);
         nullBytesRemoved = firstNonNull;
     }
     const parserInstance = new parser_instance_js_1.ParserInstance(command, options);
@@ -71,7 +96,7 @@ async function parser(command, options) {
         }
     }
     catch (err) {
-        let error = err;
+        let error = asParserError(err, command);
         if (error.code === 'ParserErrorExchange' && error.parserContext && error.parserContext.value) {
             return error.parserContext.value;
         }

package/dist/cjs/handler/imap-stream.js

@@ -4,6 +4,7 @@ exports.ImapStream = void 0;
 const node_stream_1 = require("node:stream");
 const logger_js_1 = require("../logger.js");
 const limits_js_1 = require("./limits.js");
+const errors_js_1 = require("../errors.js");
 const LINE = 0x01;
 const LITERAL = 0x02;
 const LF = 0x0a;
@@ -180,10 +181,10 @@ class ImapStream extends node_stream_1.Transform {
         if (lineLength <= this.maxLineLength) {
             return true;
         }
-        const err = new Error(`Line length ${lineLength} exceeds maximum allowed size of ${this.maxLineLength} bytes`);
-        err.code = 'LineTooLarge';
-        err.lineLength = lineLength;
-        err.maxSize = this.maxLineLength;
+        const err = (0, errors_js_1.createImapError)(`Line length ${lineLength} exceeds maximum allowed size of ${this.maxLineLength} bytes`, 'LineTooLarge', {
+            lineLength,
+            maxSize: this.maxLineLength
+        });
         return this.failStream(err);
     }
     /**
@@ -206,10 +207,10 @@ class ImapStream extends node_stream_1.Transform {
             }
             return true;
         }
-        const err = new Error(`Response size ${total} exceeds maximum allowed size of ${this.maxResponseSize} bytes`);
-        err.code = 'ResponseTooLarge';
-        err.responseSize = total;
-        err.maxSize = this.maxResponseSize;
+        const err = (0, errors_js_1.createImapError)(`Response size ${total} exceeds maximum allowed size of ${this.maxResponseSize} bytes`, 'ResponseTooLarge', {
+            responseSize: total,
+            maxSize: this.maxResponseSize
+        });
         return this.failStream(err);
     }
     /**

package/dist/cjs/handler/limits.d.ts

@@ -1,4 +1,4 @@
-import type { ImapFlowError } from '../errors.js';
+import { type ImapFlowError } from '../errors.js';
 export declare const MAX_LITERAL_SIZE: number;
 export declare const MAX_LINE_SIZE: number;
 export declare const MAX_RESPONSE_SIZE: number;

package/dist/cjs/handler/limits.js

@@ -4,6 +4,7 @@
 // defaults in the ImapFlowOptions type describe both paths.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createLiteralTooLargeError = exports.normalizeLimit = exports.boundedInput = exports.ERROR_CONTEXT_LENGTH = exports.MAX_RESPONSE_SIZE = exports.MAX_LINE_SIZE = exports.MAX_LITERAL_SIZE = void 0;
+const errors_js_1 = require("../errors.js");
 // Maximum allowed literal size: 1GB (1073741824 bytes)
 exports.MAX_LITERAL_SIZE = 1024 * 1024 * 1024;
 // Default maximum length of a single line (a response without a literal). Matches the literal cap:
@@ -56,11 +57,8 @@ exports.normalizeLimit = normalizeLimit;
  * @param reason - What the bound was, when it is not the configured maximum.
  * @returns The error to emit or throw.
  */
-const createLiteralTooLargeError = (literalSize, maxSize, reason) => {
-    const err = new Error(`Literal size ${literalSize} exceeds ${reason || `maximum allowed size of ${maxSize} bytes`}`);
-    err.code = 'LiteralTooLarge';
-    err.literalSize = literalSize;
-    err.maxSize = maxSize;
-    return err;
-};
+const createLiteralTooLargeError = (literalSize, maxSize, reason) => (0, errors_js_1.createImapError)(`Literal size ${literalSize} exceeds ${reason || `maximum allowed size of ${maxSize} bytes`}`, 'LiteralTooLarge', {
+    literalSize,
+    maxSize
+});
 exports.createLiteralTooLargeError = createLiteralTooLargeError;