imapflow 2.5.0 → 2.5.2

package/dist/esm/handler/token-parser.js

@@ -9,14 +9,23 @@ const STATE_PARTIAL = 0x004;
 const STATE_SEQUENCE = 0x005;
 const STATE_STRING = 0x006;
 const RE_SINGLE_DIGIT = /^\d$/;
-// Prevents stack overflow from maliciously crafted deeply-nested IMAP input (e.g., (((((...))))))
-const MAX_NODE_DEPTH = 25;
+// Prevents stack overflow from maliciously crafted deeply-nested IMAP input (e.g., (((((...)))))).
+// The tokenizer itself is iterative; what recurses is the getAttributes() walk and the
+// consumers of its output (the body structure parser, the compiler used for logging), and
+// a hundred frames is nothing to any of them. The old bound of 25 was reached by a message
+// with 22 nested multiparts, which an external sender can produce, and the whole FETCH row
+// then failed to parse and was dropped silently.
+const MAX_NODE_DEPTH = 100;
+// The depth at which the data items of a FETCH response sit: TREE (0) > the item list (1) >
+// a key or value (2). See createNode() for what happens when nesting overflows below one.
+const FETCH_DATA_ITEM_DEPTH = 2;
 /**
  * Tokenizes an IMAP attribute string into a tree of typed nodes.
  * Handles all IMAP data types: atoms, quoted strings, literals (including literal8),
  * sequences, lists (parenthesized groups), sections (bracketed groups), and partial ranges.
  * Enforces a maximum nesting depth of {@link MAX_NODE_DEPTH} to prevent stack overflow
- * from malicious input.
+ * from malicious input: a FETCH data item that nests deeper is replaced by NIL and listed in
+ * `truncatedAttributes`, any other input that nests deeper fails to parse.
  */
 export class TokenParser {
     /**
@@ -38,6 +47,7 @@ export class TokenParser {
         // Same normalization and default as the streaming parser, so a direct user of this parser
         // gets the same bound (an explicit 0 means "reject any non-empty inline literal").
         this.maxLiteralSize = normalizeLimit(this.options.maxLiteralSize, MAX_LITERAL_SIZE);
+        this.truncatedAttributes = [];
         this.tree = this.currentNode = this.createNode();
         this.pos = startPos || 0;
         this.currentNode.type = 'TREE';
@@ -86,6 +96,16 @@ export class TokenParser {
                 throw this.parserError(`Unexpected end of input at position ${this.pos + this.str.length - 1} [E9]`, 'ParserError9', this.pos + this.str.length - 1);
             }
             let type = (node.type || '').toString().toUpperCase();
+            if (node.truncated) {
+                // The item nested deeper than MAX_NODE_DEPTH, see createNode(). Its subtree is
+                // not walked (that is what keeps this recursion bounded). A list is replaced by
+                // NIL so the data items keep pairing up as key and value; a section is attached
+                // to the item before it, so it is dropped whole.
+                if (type === 'LIST') {
+                    branch.push(null);
+                }
+                return;
+            }
             switch (type) {
                 case 'LITERAL':
                 case 'STRING':
@@ -136,7 +156,7 @@ export class TokenParser {
      * @param parentNode - The parent node to attach this node to. If omitted, creates a root node.
      * @param startPos - The starting position of this node in the original input string.
      * @returns The newly created node with childNodes, type, value, and isClosed properties.
-     * @throws {Error} If the nesting depth exceeds MAX_NODE_DEPTH.
+     * @throws {Error} If the nesting depth exceeds MAX_NODE_DEPTH outside a FETCH data item.
      */
     createNode(parentNode, startPos) {
         let node = {
@@ -154,8 +174,20 @@ export class TokenParser {
             node.depth = 0;
         }
         if (node.depth > MAX_NODE_DEPTH) {
-            // A bounded prefix only, the error travels whole into logs and rejections
-            throw createImapError('Too much nesting in IMAP string', 'MAX_IMAP_NESTING_REACHED', { _imapStr: this.str.slice(0, ERROR_CONTEXT_LENGTH) });
+            if (!this.isFetchResponse()) {
+                // A bounded prefix only, the error travels whole into logs and rejections
+                throw createImapError('Too much nesting in IMAP string', 'MAX_IMAP_NESTING_REACHED', { _imapStr: this.str.slice(0, ERROR_CONTEXT_LENGTH) });
+            }
+            // A FETCH row carries the data of one message, and the item nesting this deep (a
+            // BODYSTRUCTURE of a message with a hundred nested multiparts, which the sender of
+            // that message controls) is one of several. Failing the line would drop the whole
+            // row, and with it the message, from the FETCH result. The data item is marked
+            // instead, which getAttributes() turns into NIL, and the tokenizer carries on: it
+            // keeps no stack, so the depth costs it nothing. Marked on the first crossing only,
+            // every node below that one is already inside a marked item.
+            if (parentNode.depth === MAX_NODE_DEPTH) {
+                this.truncateFetchDataItem(parentNode);
+            }
         }
         if (typeof startPos === 'number') {
             node.startPos = startPos;
@@ -165,6 +197,44 @@ export class TokenParser {
         }
         return node;
     }
+    /**
+     * Whether the line being parsed is a message data response (`* 12 FETCH (...)`): a numeric
+     * command with FETCH as its first attribute. Only those get the per-item nesting fallback.
+     *
+     * @returns True for an untagged FETCH response
+     */
+    isFetchResponse() {
+        let command = this.parent.command;
+        let first = this.tree.childNodes[0];
+        return (typeof command === 'string' &&
+            /^\d+$/.test(command) &&
+            !!first &&
+            first.type === 'ATOM' &&
+            typeof first.value === 'string' &&
+            first.value.toUpperCase() === 'FETCH');
+    }
+    /**
+     * Marks the FETCH data item a too deeply nested node belongs to as truncated and records
+     * its key (the item before it in the list, e.g. BODYSTRUCTURE) for the caller to report.
+     *
+     * @param node - The node at MAX_NODE_DEPTH whose child would exceed the limit
+     */
+    truncateFetchDataItem(node) {
+        let item = node;
+        while (item.depth > FETCH_DATA_ITEM_DEPTH && item.parentNode) {
+            item = item.parentNode;
+        }
+        if (item.truncated) {
+            return;
+        }
+        item.truncated = true;
+        // The item is the last child of the list while it is being parsed, so its key is the
+        // child before it. A key is an atom (BODYSTRUCTURE, ENVELOPE, BODY); anything else means
+        // the row itself is malformed, and the key is reported as unknown.
+        let siblings = item.parentNode ? item.parentNode.childNodes : [];
+        let key = siblings[siblings.length - 2];
+        this.truncatedAttributes.push(key && key.type === 'ATOM' && typeof key.value === 'string' ? key.value.toUpperCase() : '?');
+    }
     /**
      * Processes the entire input string character by character using a state machine.
      * Transitions between states (NORMAL, ATOM, STRING, LITERAL, SEQUENCE, PARTIAL, TEXT)

package/dist/esm/handler/types.d.ts

@@ -39,6 +39,11 @@ export interface ImapResponse {
     attributes?: ImapAttributeList | undefined;
     /** Number of leading NUL bytes stripped from the line, if any */
     nullBytesRemoved?: number | undefined;
+    /**
+     * Keys of the FETCH data items (e.g. BODYSTRUCTURE) that were replaced by NIL because they
+     * nested deeper than the parser's limit, if any
+     */
+    truncatedAttributes?: string[] | undefined;
 }
 /**
  * What the command compiler accepts as a node: parsed tokens and lists, and also bare

package/dist/esm/imap-flow.js

@@ -15,7 +15,7 @@ import { ConnectionDeadline } from './connection-deadline.js';
 import { downloadMessage, downloadMessageParts } from './download.js';
 import { AuthenticationFailure, createImapError } from './errors.js';
 import imapCommands from './imap-commands.js';
-import { comparePaths, updateCapabilities, getFolderTree, formatMessageResponse, mergeFetchRows, packMessageRange, normalizePath, expandRange, getColorFlags, hasCapability, isRev2Active, logConnectionError, unrefTimer, clearTimer, parseUintValue, getStringList, getTextValues, emitSafe, buildConnectionError, guardedPromise, guardedReject, isIpLiteral, MAX_UINT32_DIGITS } from './tools.js';
+import { comparePaths, updateCapabilities, getFolderTree, formatMessageResponse, mergeFetchRows, packMessageRange, normalizePath, iterateRange, countRange, getColorFlags, hasCapability, isRev2Active, logConnectionError, unrefTimer, clearTimer, parseUintValue, getStringList, getTextValues, emitSafe, buildConnectionError, guardedPromise, guardedReject, isIpLiteral, MAX_UINT32_DIGITS } from './tools.js';
 export { AuthenticationFailure, ImapFlowErrorCode } from './errors.js';
 export { createSocketsTransport } from './sockets-transport.js';
 export { createStreamsTransport } from './streams-transport.js';
@@ -846,6 +846,16 @@ export class ImapFlow extends EventEmitter {
             }
             return true;
         }
+        if (parsed.truncatedAttributes) {
+            // The row is kept with the item missing rather than dropped with the whole line: the
+            // nesting is the message sender's doing, and the message must still reach the caller
+            this.log.warn({
+                msg: 'FETCH data item exceeded the nesting limit and was dropped',
+                seq: parsed.command,
+                attributes: parsed.truncatedAttributes,
+                cid: this.id
+            });
+        }
         if (parsed.tag && !['*', '+'].includes(parsed.tag) && parsed.command) {
             let payload = { response: parsed.command };
             if (parsed.attributes &&
@@ -1009,11 +1019,24 @@ export class ImapFlow extends EventEmitter {
     async settleRequest(request, parsed, hasTrailingData) {
         switch ((parsed.command || '').toUpperCase()) {
             case 'OK':
-            case 'BYE':
                 // hasTrailingData is forwarded so STARTTLS can detect a plaintext
                 // injection (data buffered after the tagged OK, before the handshake).
                 await this.resolveParked(request, parsed, hasTrailingData);
                 break;
+            case 'BYE': {
+                // BYE is always untagged (RFC 9051 section 7.1.5), it is never the completion
+                // result of a command. It used to resolve the command like an OK, so a server (or
+                // a cleartext MITM) answering LOGIN with a tagged BYE marked the session
+                // authenticated. The server says it is closing: the command fails as a lost
+                // connection and the connection is closed, which for a LOGOUT is the outcome it
+                // was after anyway.
+                await this.serverBye(parsed);
+                let err = this.createNoConnectionError(this.byeReason, { rejectedFrom: 'taggedBye', command: request.command });
+                err.response = parsed;
+                err.responseStatus = 'BYE';
+                request.reject(err);
+                break;
+            }
             case 'NO':
             case 'BAD': {
                 let txt = getTextValues(parsed.attributes)
@@ -1495,6 +1518,13 @@ export class ImapFlow extends EventEmitter {
             // STARTTLS explictly disabled by config
             return false;
         }
+        if (this.state !== this.states.NOT_AUTHENTICATED) {
+            // STARTTLS is only valid in the not-authenticated state (RFC 9051 section 6.2.1),
+            // which a PREAUTH greeting skips, so there is no way left to protect this session.
+            // Required STARTTLS fails here with that reason: the greeting arrived in cleartext,
+            // and a MITM can answer with PREAUTH precisely to keep it that way.
+            return this._failSTARTTLS('STARTTLS is not possible after a PREAUTH greeting');
+        }
         if (!this.capabilities.has('STARTTLS')) {
             return this._failSTARTTLS();
         }
@@ -1939,7 +1969,7 @@ export class ImapFlow extends EventEmitter {
         let tags = [];
         let uids = false;
         // A malformed VANISHED can carry no attributes at all, and one carrying only the
-        // (EARLIER) tag leaves `uids` false - expandRange() handles that and yields nothing
+        // (EARLIER) tag leaves `uids` false - iterateRange() handles that and yields nothing
         if (!untagged.attributes || !untagged.attributes.length) {
             return;
         }
@@ -1950,14 +1980,16 @@ export class ImapFlow extends EventEmitter {
         if (untagged.attributes[0] && typeof untagged.attributes[0].value === 'string') {
             uids = untagged.attributes[0].value;
         }
-        let uidList = expandRange(uids);
         let earlier = tags.includes('EARLIER');
         // RFC 7162 section 3.2.10: unlike VANISHED (EARLIER), a plain VANISHED reports messages the
         // client knows about and decrements the message count like the same number of EXPUNGEs would
         if (!earlier) {
-            mailbox.exists = Math.max(0, mailbox.exists - uidList.length);
+            mailbox.exists = Math.max(0, mailbox.exists - countRange(uids));
         }
-        for (let uid of uidList) {
+        // The set is walked one UID at a time rather than expanded first: it is the server's to
+        // choose, and a single "1:16777216" is a few bytes on the wire but sixteen million array
+        // entries expanded, for every such line the server cares to send
+        for (let uid of iterateRange(uids)) {
             let payload = {
                 path: mailbox.path,
                 uid,

package/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "imapflow";
-export declare const version = "2.5.0";
+export declare const version = "2.5.2";
 export declare const homepage = "https://imapflow.com/";

package/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = "imapflow";
-export const version = "2.5.0";
+export const version = "2.5.2";
 export const homepage = "https://imapflow.com/";

package/dist/esm/tools.d.ts

@@ -5,6 +5,7 @@ import type { ImapAttributeList, ImapAttributeNode, ImapResponse } from './handl
 import type { FetchMessageObject, ListResponse, ListTreeResponse, MailboxObject, MessageEnvelopeObject, MessageStructureObject, ImapFlowEvents, StatusQuery } from './types.js';
 export { AuthenticationFailure } from './errors.js';
 export declare const EXPANDED_RANGE_LIMIT = 16777216;
+export declare const MAX_COLLECTED_RESPONSES = 1000000;
 export declare const MAX_UINT32_DIGITS = 10;
 export declare const noop: () => void;
 /**
@@ -471,6 +472,26 @@ export declare function parseBigIntValue(value: unknown, maxDigits?: number): bi
  * @returns The parsed value, or false when it is not usable.
  */
 export declare function parseUintValue(value: unknown, maxDigits?: number): number | false;
+/**
+ * Walks an IMAP sequence range string (e.g. "1:3,5,7:9") one number at a time, without
+ * materializing it. A single "1:16777216" is a few bytes on the wire but sixteen million
+ * entries expanded, so a consumer that only needs to visit each number (the VANISHED handler)
+ * iterates instead of calling expandRange().
+ *
+ * The same bound as expandRange() applies: at most EXPANDED_RANGE_LIMIT numbers in total are
+ * produced, over all entries of the set.
+ *
+ * @param range - IMAP sequence range string
+ * @returns The sequence numbers, in the order the set lists them
+ */
+export declare function iterateRange(range: unknown): Generator<number, void, undefined>;
+/**
+ * Counts the numbers iterateRange() produces for a sequence range string, without walking it.
+ *
+ * @param range - IMAP sequence range string
+ * @returns The number of entries, capped at EXPANDED_RANGE_LIMIT like the expansion itself
+ */
+export declare function countRange(range: unknown): number;
 /**
  * Expands an IMAP sequence range string (e.g. "1:3,5,7:9") into an array of numbers.
  *

package/dist/esm/tools.js

@@ -19,6 +19,15 @@ const CONNECTION_GONE_CODES = new Set([ImapFlowErrorCode.NoConnection, ImapFlowE
 // expand server sequences (e.g. ESEARCH ALL in commands/search.ts) can apply the same absolute
 // ceiling instead of inventing their own.
 export const EXPANDED_RANGE_LIMIT = 0x1000000;
+// Upper bound for the untagged responses one command may accumulate in memory: the FETCH rows
+// fetchAll() collects and the mailboxes list() collects. The response size limits bound one
+// response at a time, not how many of them a server sends in reply to one command, so a hostile
+// server answering a single-message FETCH with an endless stream of unsolicited FETCH rows (or a
+// LIST with endless mailboxes) would otherwise grow the process without limit. Generous on
+// purpose: a million rows is far beyond any legitimate listing, and a mailbox that large is read
+// through the streaming fetch() generator, which keeps nothing. Reaching it therefore fails the
+// command (code TooManyResponses) instead of silently truncating its result.
+export const MAX_COLLECTED_RESPONSES = 1000000;
 // Digit bounds for untrusted numeric values in server responses. UIDs, UIDVALIDITY and
 // message counts are 32-bit unsigned (nz-number in the RFC 9051 grammar, so at most 10
 // digits); MODSEQ and number64 values are 63-bit unsigned (RFC 7162, RFC 9051), at most
@@ -547,13 +556,30 @@ export function getFolderTree(folders) {
         root: true,
         folders: []
     };
+    // Children of every node indexed by name. Looking a child up with folders.find() made the
+    // tree quadratic in the number of siblings: a listing of 50k mailboxes at one level (a size
+    // the server chooses) took seconds of event loop time. A name is unique among its siblings,
+    // as the loop below updates an existing entry rather than adding a second one.
+    let childIndex = new Map();
+    let childByName = (node, name) => {
+        let index = childIndex.get(node);
+        return index ? index.get(name) : undefined;
+    };
+    let indexChild = (node, child) => {
+        let index = childIndex.get(node);
+        if (!index) {
+            index = new Map();
+            childIndex.set(node, index);
+        }
+        index.set(child.name, child);
+    };
     let getTreeNode = (parents) => {
         let node = tree;
         if (!parents || !parents.length) {
             return node;
         }
         for (let parent of parents) {
-            let cur = node.folders && node.folders.find(folder => folder.name === parent);
+            let cur = childByName(node, parent);
             if (cur) {
                 node = cur;
             }
@@ -568,7 +594,7 @@ export function getFolderTree(folders) {
     for (let folder of byDepth) {
         let parent = getTreeNode(folder.parent);
         // see if entry already exists
-        let existing = parent.folders && parent.folders.find(existing => existing.name === folder.name);
+        let existing = childByName(parent, folder.name);
         if (existing) {
             // update values
             existing.name = folder.name;
@@ -613,6 +639,7 @@ export function getFolderTree(folders) {
                 parent.folders = [];
             }
             parent.folders.push(data);
+            indexChild(parent, data);
         }
     }
     return tree;
@@ -1507,67 +1534,103 @@ export function parseUintValue(value, maxDigits) {
     return Number.isSafeInteger(num) ? num : false;
 }
 /**
- * Expands an IMAP sequence range string (e.g. "1:3,5,7:9") into an array of numbers.
+ * Parses an IMAP sequence set string (e.g. "1:3,5,9:7") into its entries, each as the pair of
+ * endpoints in the order written: a reversed "9:7" stays reversed, and iterateRange() walks it
+ * downwards. Entries with an endpoint that is not a valid nz-number are skipped - the input may
+ * come from an untrusted server, and 'Infinity' or similar garbage would otherwise loop without
+ * bound.
  *
- * Entries with endpoints that are not valid nz-numbers are skipped - the input
- * may come from an untrusted server, and 'Infinity' or similar garbage would
- * otherwise loop without bound. The whole set is expanded to at most
- * EXPANDED_RANGE_LIMIT entries in total: legitimate responses never reach the limit
- * (the mailbox would need that many messages), while hostile input is cut off
- * instead of exhausting memory. The total is capped, not just each range -
- * otherwise "1:16777216,1:16777216,..." would multiply the per-range bound by an
- * unbounded number of ranges.
- *
- * @param range - IMAP sequence range string
- * @returns Array of expanded sequence numbers
+ * @param range - IMAP sequence set string, or whatever the response parser produced for it
+ * @returns The validated entries
  */
-export function expandRange(range) {
-    let result = [];
+function parseRangeEntries(range) {
+    let entries = [];
     // Callers pass whatever the response parser produced for the sequence set, and a
     // malformed response can leave that as `false` (e.g. a VANISHED response carrying
     // only the (EARLIER) tag). Nothing to expand then, and throwing here would abort
     // the handler for the rest of the response.
     if (typeof range !== 'string') {
-        return result;
+        return entries;
     }
     for (let entry of range.split(',')) {
-        if (result.length >= EXPANDED_RANGE_LIMIT) {
-            break;
-        }
         entry = entry.trim();
         let colon = entry.indexOf(':');
         if (colon < 0) {
             let value = Number(entry);
             if (isValidSequenceValue(value)) {
-                result.push(value);
+                entries.push([value, value]);
             }
             continue;
         }
         let first = Number(entry.substring(0, colon));
         let second = Number(entry.slice(colon + 1));
-        if (!isValidSequenceValue(first) || !isValidSequenceValue(second)) {
-            continue;
+        if (isValidSequenceValue(first) && isValidSequenceValue(second)) {
+            entries.push([first, second]);
         }
-        if (first === second) {
-            result.push(first);
-            continue;
-        }
-        // Remaining total budget doubles as the per-range bound
-        let remaining = EXPANDED_RANGE_LIMIT - result.length;
-        if (first < second) {
-            let last = Math.min(second, first + remaining - 1);
-            for (let i = first; i <= last; i++) {
-                result.push(i);
+    }
+    return entries;
+}
+/**
+ * Walks an IMAP sequence range string (e.g. "1:3,5,7:9") one number at a time, without
+ * materializing it. A single "1:16777216" is a few bytes on the wire but sixteen million
+ * entries expanded, so a consumer that only needs to visit each number (the VANISHED handler)
+ * iterates instead of calling expandRange().
+ *
+ * The same bound as expandRange() applies: at most EXPANDED_RANGE_LIMIT numbers in total are
+ * produced, over all entries of the set.
+ *
+ * @param range - IMAP sequence range string
+ * @returns The sequence numbers, in the order the set lists them
+ */
+export function* iterateRange(range) {
+    let count = 0;
+    for (let [first, second] of parseRangeEntries(range)) {
+        let step = first <= second ? 1 : -1;
+        for (let i = first; count < EXPANDED_RANGE_LIMIT; i += step) {
+            yield i;
+            count++;
+            if (i === second) {
+                break;
             }
         }
-        else {
-            let last = Math.max(second, first - remaining + 1);
-            for (let i = first; i >= last; i--) {
-                result.push(i);
-            }
+        if (count >= EXPANDED_RANGE_LIMIT) {
+            break;
         }
     }
-    return result;
+}
+/**
+ * Counts the numbers iterateRange() produces for a sequence range string, without walking it.
+ *
+ * @param range - IMAP sequence range string
+ * @returns The number of entries, capped at EXPANDED_RANGE_LIMIT like the expansion itself
+ */
+export function countRange(range) {
+    let count = 0;
+    for (let [first, second] of parseRangeEntries(range)) {
+        count += Math.abs(second - first) + 1;
+        if (count >= EXPANDED_RANGE_LIMIT) {
+            return EXPANDED_RANGE_LIMIT;
+        }
+    }
+    return count;
+}
+/**
+ * Expands an IMAP sequence range string (e.g. "1:3,5,7:9") into an array of numbers.
+ *
+ * Entries with endpoints that are not valid nz-numbers are skipped - the input
+ * may come from an untrusted server, and 'Infinity' or similar garbage would
+ * otherwise loop without bound. The whole set is expanded to at most
+ * EXPANDED_RANGE_LIMIT entries in total: legitimate responses never reach the limit
+ * (the mailbox would need that many messages), while hostile input is cut off
+ * instead of exhausting memory. The total is capped, not just each range -
+ * otherwise "1:16777216,1:16777216,..." would multiply the per-range bound by an
+ * unbounded number of ranges.
+ *
+ * @param range - IMAP sequence range string
+ * @returns Array of expanded sequence numbers
+ */
+export function expandRange(range) {
+    return Array.from(iterateRange(range));
 }
 /**
  * Returns a stream decoder for the given charset. Uses a special Japanese
@@ -1609,20 +1672,21 @@ export function packMessageRange(list) {
     // Deduplicate before sorting so that repeated values do not produce
     // overlapping/non-canonical tokens (e.g. [1,1,2,3] -> "1:3", not "1,1:3").
     items = Array.from(new Set(items)).sort((a, b) => a - b);
-    let last = items[items.length - 1];
-    let result = [[last]];
-    for (let i = items.length - 2; i >= 0; i--) {
-        if (items[i] === items[i + 1] - 1) {
-            result[0].unshift(items[i]);
+    // One forward pass: a run of consecutive values is written out as soon as it ends. The runs
+    // used to be built with unshift(), which copies the array on every call, so packing a large
+    // SEARCH result (a server-chosen size) took seconds for 200k UIDs and about a minute for 1M,
+    // all of it on the event loop.
+    let parts = [];
+    let start = items[0];
+    let prev = start;
+    for (let i = 1; i <= items.length; i++) {
+        let value = items[i];
+        if (i < items.length && value === prev + 1) {
+            prev = value;
             continue;
         }
-        result.unshift([items[i]]);
+        parts.push(start === prev ? String(start) : start + ':' + prev);
+        start = prev = value;
     }
-    let parts = result.map(item => {
-        if (item.length === 1) {
-            return item[0];
-        }
-        return item.shift() + ':' + item.pop();
-    });
     return parts.join(',');
 }

package/dist/esm/types.d.ts

@@ -170,7 +170,8 @@ export interface ImapFlowOptions {
      * when the server offers STARTTLS and otherwise continues in cleartext with a warning logged:
      * the capability list that decides this was itself received in cleartext, so an attacker on
      * the path can strip it. Set `doSTARTTLS: true` whenever the credentials must never cross the
-     * wire unencrypted.
+     * wire unencrypted. STARTTLS is only possible before authentication, so a server greeting
+     * with PREAUTH is a connection failure when the upgrade is required.
      */
     doSTARTTLS?: boolean | undefined;
     /** Custom instance ID string for logs */

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "imapflow",
-    "version": "2.5.0",
+    "version": "2.5.2",
     "description": "IMAP Client for Node",
     "type": "module",
     "main": "./dist/cjs/imap-flow.js",
@@ -95,12 +95,12 @@
         "wrangler": "4.151.0"
     },
     "dependencies": {
-        "@zone-eu/mailsplit": "5.4.21",
+        "@zone-eu/mailsplit": "5.4.23",
         "encoding-japanese": "2.4.0",
         "iconv-lite": "0.7.3",
         "libbase64": "1.3.3",
-        "libmime": "5.4.8",
-        "libqp": "2.1.2",
+        "libmime": "5.4.9",
+        "libqp": "2.1.3",
         "pino": "10.3.1",
         "socks": "2.8.10"
     },