imapflow 2.5.5 → 2.5.7

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [2.5.7](https://github.com/postalsys/imapflow/compare/v2.5.6...v2.5.7) (2026-10-19)
+
+
+### Bug Fixes
+
+* bump libmime to 5.5.2 ([8f0f6f7](https://github.com/postalsys/imapflow/commit/8f0f6f7818c0afd601f5e86e8d8b510733162a42))
+
+## [2.5.6](https://github.com/postalsys/imapflow/compare/v2.5.5...v2.5.6) (2026-10-19)
+
+
+### Bug Fixes
+
+* read SEARCH answers into a number array and reject search() when the command did not complete ([78bfccf](https://github.com/postalsys/imapflow/commit/78bfccfeabd1c4c636f34513154b5de85dbec2fd)), closes [#443](https://github.com/postalsys/imapflow/issues/443) [#444](https://github.com/postalsys/imapflow/issues/444)
+
 ## [2.5.5](https://github.com/postalsys/imapflow/compare/v2.5.4...v2.5.5) (2026-10-18)
 
 

package/dist/cjs/commands/search.js

@@ -21,6 +21,23 @@ const stripEsearchPrefix = (attrs) => {
         start++;
     return attrs.slice(start);
 };
+/**
+ * The failure path of both SEARCH forms. A NO or BAD answer is the server refusing the search,
+ * which resolves false. Any other failure means the command never completed (the connection
+ * closed or failed, the answer could not be read, the server throttled it), and is rethrown:
+ * resolving false would read as "nothing matched" to a caller that treats a non-array result as
+ * an empty one.
+ *
+ * @param connection - IMAP connection instance
+ * @param err - The command error
+ */
+async function searchFailed(connection, err) {
+    await (0, tools_js_1.reportCommandError)(connection, err);
+    if ((0, tools_js_1.isServerRefusal)(err)) {
+        return false;
+    }
+    throw err;
+}
 /**
  * Searches for messages matching the specified criteria.
  *
@@ -93,45 +110,61 @@ async function search(connection, query, options) {
                 return esearchResult;
             }
             catch (err) {
-                await (0, tools_js_1.reportCommandError)(connection, err);
-                return false;
+                return await searchFailed(connection, err);
             }
         }
         // returnItems was empty - fall through to legacy SEARCH path below
     }
     // Legacy SEARCH path (no returnOptions, or server lacks ESEARCH)
-    // Use a Set to deduplicate sequence numbers/UIDs - servers may return
-    // duplicates across multiple untagged SEARCH responses.
-    let results = new Set();
+    // A plain array, deduplicated once all responses are in: on a large mailbox the result
+    // holds millions of numbers, and a Set costs several times the memory of an array
+    let results = [];
+    // How many numbers ESEARCH ALL expansions have added, see the budget below
+    let esearchAdded = 0;
     let response;
     try {
         response = await connection.exec(options.uid ? 'UID SEARCH' : 'SEARCH', attributes, {
             untagged: {
                 SEARCH: async (untagged) => {
-                    if (untagged && untagged.attributes && untagged.attributes.length) {
+                    if (!untagged) {
+                        return;
+                    }
+                    // A line of plain numbers arrives already read into an array (see parser()),
+                    // anything else as attribute tokens
+                    let numbers = untagged.numbers;
+                    let attributes = untagged.attributes || [];
+                    let count = numbers ? numbers.length : attributes.length;
+                    if (count) {
+                        // The first array of numbers becomes the result itself, checked in place,
+                        // so a large answer is not held twice
+                        let target = numbers && !results.length ? numbers : results;
+                        let size = target === results ? results.length : 0;
                         let truncated = false;
                         let discarded = false;
-                        for (let attribute of untagged.attributes) {
+                        for (let i = 0; i < count; i++) {
                             // The result set is server-controlled and accumulated across
                             // responses, so stop at the same absolute ceiling expandRange()
                             // uses - a server streaming SEARCH responses could otherwise
                             // grow the set until the process runs out of memory
                             /* c8 ignore next 4 */ // reaching the ceiling needs 2^24 accumulated results, which no unit test can produce in reasonable time
-                            if (results.size >= tools_js_1.EXPANDED_RANGE_LIMIT) {
+                            if (size >= tools_js_1.EXPANDED_RANGE_LIMIT) {
                                 truncated = true;
                                 break;
                             }
+                            let attribute = attributes[i];
+                            let value = numbers ? numbers[i] : attribute && typeof attribute.value === 'string' ? Number(attribute.value) : NaN;
                             // Same nz-number check the ESEARCH branch below applies. isNaN()
                             // is not enough: it passes '1e400' (Infinity), '-3' and '2.5', and
                             // a single one of those makes the sequence set compiled from this
                             // result set invalid, failing the caller's whole follow-up command
-                            let value = attribute && typeof attribute.value === 'string' ? Number(attribute.value) : NaN;
                             if (!(0, tools_js_1.isValidSequenceValue)(value)) {
                                 discarded = true;
                                 continue;
                             }
-                            results.add(value);
+                            target[size++] = value;
                         }
+                        target.length = size;
+                        results = target;
                         if (truncated || discarded) {
                             connection.log.warn({
                                 msg: 'Invalid entries in the SEARCH result',
@@ -151,7 +184,7 @@ async function search(connection, query, options) {
                     }
                     let parsed = (0, esearch_parser_js_1.parseEsearchResponse)(stripEsearchPrefix(untagged.attributes));
                     if (parsed.all) {
-                        // Walk the compact sequence-set directly into the Set - the ALL
+                        // Walk the compact sequence-set directly into the results - the ALL
                         // result may cover the entire mailbox, so expanding it into an
                         // intermediate array first would double the peak memory use.
                         // The set comes from an untrusted server: endpoints must be
@@ -164,11 +197,17 @@ async function search(connection, query, options) {
                         // not contain '*' at all (RFC 9051 section 4.1.1), so UID
                         // parts with '*' are dropped
                         let existsCount = () => mailbox.exists || 0;
-                        // The mailbox EXISTS count is itself server-supplied and can be
-                        // absurdly large, so the budget is additionally capped at the same
-                        // absolute ceiling expandRange() uses - a hostile server cannot
-                        // bypass it by inflating EXISTS first
-                        let overBudget = () => results.size >= existsCount() || results.size >= tools_js_1.EXPANDED_RANGE_LIMIT;
+                        // The budget counts what the expansions added, across responses, so
+                        // a server repeating the same range cannot multiply it. The mailbox
+                        // EXISTS count is itself server-supplied and can be absurdly large, so
+                        // the budget is additionally capped at the same absolute ceiling
+                        // expandRange() uses - a hostile server cannot bypass it by inflating
+                        // EXISTS first
+                        let overBudget = () => esearchAdded >= existsCount() || results.length >= tools_js_1.EXPANDED_RANGE_LIMIT;
+                        let add = (value) => {
+                            results.push(value);
+                            esearchAdded++;
+                        };
                         let resolveId = (part) => (part === '*' ? (options.uid ? 0 : existsCount()) : Number(part));
                         let truncated = false;
                         let discarded = false;
@@ -185,7 +224,7 @@ async function search(connection, query, options) {
                                     truncated = true;
                                     break;
                                 }
-                                results.add(value);
+                                add(value);
                                 continue;
                             }
                             let first = resolveId(part.substring(0, colon));
@@ -199,7 +238,7 @@ async function search(connection, query, options) {
                                     truncated = true;
                                     break sequenceSetLoop;
                                 }
-                                results.add(id);
+                                add(id);
                             }
                         }
                         if (truncated || discarded) {
@@ -215,12 +254,20 @@ async function search(connection, query, options) {
             }
         });
         response.next();
-        // Sort numerically for consistent, predictable output order
-        return Array.from(results).sort((a, b) => a - b);
+        // Sort numerically for consistent, predictable output order, then drop the duplicates
+        // in place: servers may repeat numbers across multiple untagged responses
+        results.sort((a, b) => a - b);
+        let unique = 0;
+        for (let i = 0; i < results.length; i++) {
+            if (!unique || results[i] !== results[unique - 1]) {
+                results[unique++] = results[i];
+            }
+        }
+        results.length = unique;
+        return results;
     }
     catch (err) {
-        await (0, tools_js_1.reportCommandError)(connection, err);
-        return false;
+        return await searchFailed(connection, err);
     }
 }
 module.exports = exports.default;

package/dist/cjs/handler/imap-compiler.js

@@ -287,6 +287,11 @@ function compiler(response, options) {
             walk(child);
         }
     }
+    if (response.numbers) {
+        for (let value of response.numbers) {
+            walk(value);
+        }
+    }
     if (resp.length) {
         respParts.push(resp);
     }

package/dist/cjs/handler/imap-parser.d.ts

@@ -10,7 +10,8 @@ import type { ImapResponse, ParserOptions } from './types.js';
  * @param options.literals - Pre-parsed literal values extracted from the input stream.
  * @returns A promise that resolves to a parsed response object with `tag` (the IMAP tag, e.g. "*",
  *   "+", or a command tag like "A1"), `command` (the IMAP command or response name, e.g. "OK",
- *   "FETCH"), `attributes` (parsed attributes of the response) and `nullBytesRemoved` (number of
- *   leading null bytes removed, if any).
+ *   "FETCH"), `attributes` (parsed attributes of the response), `numbers` (the numbers of an
+ *   untagged SEARCH response that holds nothing else, instead of `attributes`) and
+ *   `nullBytesRemoved` (number of leading null bytes removed, if any).
  */
 export default function parser(command: Buffer | string, options?: ParserOptions | undefined): Promise<ImapResponse>;

package/dist/cjs/handler/imap-parser.js

@@ -31,6 +31,56 @@ function asParserError(err, input) {
         ...(err instanceof Error ? { _err: err } : {})
     });
 }
+/**
+ * Reads the numbers of an untagged SEARCH response, the part of the line after the command
+ * (" 2 5 9"), into an array. A SEARCH answer holds one number per matching message, so on a
+ * large mailbox one line carries millions of them, and run through the tokenizer each would
+ * become a parse tree node and an attribute object, some 30 times the size of the line in heap.
+ *
+ * @param str - The rest of the line after the command
+ * @returns The numbers, or null when the line holds anything but a space before every number
+ *   and trailing spaces (a CONDSTORE MODSEQ list, extra spaces, a number past 2^53), which is
+ *   left to the tokenizer
+ */
+function readSearchNumbers(str) {
+    // trailing spaces are tolerated, as the tokenizer does, some servers end the line with one
+    let end = str.length;
+    while (end > 1 && str.charCodeAt(end - 1) === 0x20) {
+        end--;
+    }
+    if (end < 2 || str.charCodeAt(0) !== 0x20) {
+        return null;
+    }
+    const numbers = [];
+    // -1 until the first digit of the current number
+    let value = -1;
+    for (let i = 1; i < end; i++) {
+        const c = str.charCodeAt(i);
+        if (c === 0x20) {
+            if (value < 0) {
+                return null;
+            }
+            numbers.push(value);
+            value = -1;
+        }
+        else if (c >= 0x30 && c <= 0x39) {
+            value = (value < 0 ? 0 : value * 10) + (c - 0x30);
+            // past 2^53 the digits no longer add up exactly, a line with such a number is left
+            // to the tokenizer
+            if (value > Number.MAX_SAFE_INTEGER) {
+                return null;
+            }
+        }
+        else {
+            return null;
+        }
+    }
+    if (value < 0) {
+        return null;
+    }
+    numbers.push(value);
+    return numbers;
+}
 /**
  * Parses a raw IMAP command or response buffer into a structured object.
  * Handles edge cases such as null-byte-padded responses from buggy servers and
@@ -42,8 +92,9 @@ function asParserError(err, input) {
  * @param options.literals - Pre-parsed literal values extracted from the input stream.
  * @returns A promise that resolves to a parsed response object with `tag` (the IMAP tag, e.g. "*",
  *   "+", or a command tag like "A1"), `command` (the IMAP command or response name, e.g. "OK",
- *   "FETCH"), `attributes` (parsed attributes of the response) and `nullBytesRemoved` (number of
- *   leading null bytes removed, if any).
+ *   "FETCH"), `attributes` (parsed attributes of the response), `numbers` (the numbers of an
+ *   untagged SEARCH response that holds nothing else, instead of `attributes`) and
+ *   `nullBytesRemoved` (number of leading null bytes removed, if any).
  */
 async function parser(command, options) {
     options = options || {};
@@ -84,6 +135,13 @@ async function parser(command, options) {
             await parserInstance.getSpace();
             response.command += ' ' + (await parserInstance.getElement(imap_formal_syntax_js_1.default.command()));
         }
+        if (response.tag === '*' && (response.command || '').toUpperCase() === 'SEARCH') {
+            const numbers = readSearchNumbers(parserInstance.remainder);
+            if (numbers) {
+                response.numbers = numbers;
+                return response;
+            }
+        }
         if (parserInstance.remainder.trim().length) {
             await parserInstance.getSpace();
             response.attributes = await parserInstance.getAttributes();

package/dist/cjs/handler/types.d.ts

@@ -37,6 +37,11 @@ export interface ImapResponse {
     command?: string | undefined;
     /** Parsed attributes of the response */
     attributes?: ImapAttributeList | undefined;
+    /**
+     * The numbers of an untagged SEARCH response (`* SEARCH 2 5 9`), set instead of `attributes`
+     * when the line holds nothing else, see parser()
+     */
+    numbers?: number[] | undefined;
     /** Number of leading NUL bytes stripped from the line, if any */
     nullBytesRemoved?: number | undefined;
     /**
@@ -54,6 +59,8 @@ export interface ImapCompileInput {
     tag?: string | undefined;
     command?: string | undefined;
     attributes?: ImapCompileNode | ImapCompileNode[] | undefined;
+    /** The numbers of a parsed SEARCH response, written after the attributes */
+    numbers?: number[] | undefined;
 }
 export interface CompilerOptions {
     /** Return an array of Buffers, one per literal segment, instead of a single Buffer */

package/dist/cjs/imap-flow.d.ts

@@ -470,7 +470,11 @@ export declare class ImapFlow extends EventEmitter {
      *
      * @param query Query to filter the messages
      * @param options Search options. With `returnOptions` set the result is an ESEARCH result object
-     * @returns An array of sequence or UID numbers, or an ESearchResult when `returnOptions` was used
+     * @returns An array of sequence or UID numbers, or an ESearchResult when `returnOptions` was used.
+     *   `false` when the server rejected the search (a NO or BAD answer, for example an unsupported
+     *   charset or search key), `undefined` when no mailbox is open. Rejects when the command could
+     *   not complete, for example because the connection closed or failed, so a failed search is
+     *   never mistaken for an empty result
      *
      * @example
      * let mailbox = await client.mailboxOpen('INBOX');

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "imapflow";
-export declare const version = "2.5.5";
+export declare const version = "2.5.7";
 export declare const homepage = "https://imapflow.com/";

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = "imapflow";
-exports.version = "2.5.5";
+exports.version = "2.5.7";
 exports.homepage = "https://imapflow.com/";

package/dist/cjs/types.d.ts

@@ -132,7 +132,9 @@ export interface ImapFlowOptions {
      * accepted. `Infinity` disables the limit. An in-progress line is additionally bounded by
      * whatever is left of `maxResponseSize`, so lowering that also bounds line buffering.
      * Exceeding it is terminal: the connection fails with error code `LineTooLarge` and
-     * no further input is parsed.
+     * no further input is parsed. The limit bounds the bytes of a line, not the memory its parse
+     * takes, which is several times the line size for a line of many small tokens. A SEARCH
+     * answer of plain numbers is read into an array of about the size of the line.
      */
     maxLineLength?: number | undefined;
     /**

package/dist/esm/commands/search.js

@@ -1,4 +1,4 @@
-import { hasCapability, isValidSequenceValue, EXPANDED_RANGE_LIMIT, reportCommandError, getSelectedMailbox } from '../tools.js';
+import { hasCapability, isValidSequenceValue, isServerRefusal, EXPANDED_RANGE_LIMIT, reportCommandError, getSelectedMailbox } from '../tools.js';
 import { searchCompiler } from '../search-compiler.js';
 import { parseEsearchResponse } from './esearch-parser.js';
 /**
@@ -18,6 +18,23 @@ const stripEsearchPrefix = (attrs) => {
         start++;
     return attrs.slice(start);
 };
+/**
+ * The failure path of both SEARCH forms. A NO or BAD answer is the server refusing the search,
+ * which resolves false. Any other failure means the command never completed (the connection
+ * closed or failed, the answer could not be read, the server throttled it), and is rethrown:
+ * resolving false would read as "nothing matched" to a caller that treats a non-array result as
+ * an empty one.
+ *
+ * @param connection - IMAP connection instance
+ * @param err - The command error
+ */
+async function searchFailed(connection, err) {
+    await reportCommandError(connection, err);
+    if (isServerRefusal(err)) {
+        return false;
+    }
+    throw err;
+}
 /**
  * Searches for messages matching the specified criteria.
  *
@@ -90,45 +107,61 @@ export default async function search(connection, query, options) {
                 return esearchResult;
             }
             catch (err) {
-                await reportCommandError(connection, err);
-                return false;
+                return await searchFailed(connection, err);
             }
         }
         // returnItems was empty - fall through to legacy SEARCH path below
     }
     // Legacy SEARCH path (no returnOptions, or server lacks ESEARCH)
-    // Use a Set to deduplicate sequence numbers/UIDs - servers may return
-    // duplicates across multiple untagged SEARCH responses.
-    let results = new Set();
+    // A plain array, deduplicated once all responses are in: on a large mailbox the result
+    // holds millions of numbers, and a Set costs several times the memory of an array
+    let results = [];
+    // How many numbers ESEARCH ALL expansions have added, see the budget below
+    let esearchAdded = 0;
     let response;
     try {
         response = await connection.exec(options.uid ? 'UID SEARCH' : 'SEARCH', attributes, {
             untagged: {
                 SEARCH: async (untagged) => {
-                    if (untagged && untagged.attributes && untagged.attributes.length) {
+                    if (!untagged) {
+                        return;
+                    }
+                    // A line of plain numbers arrives already read into an array (see parser()),
+                    // anything else as attribute tokens
+                    let numbers = untagged.numbers;
+                    let attributes = untagged.attributes || [];
+                    let count = numbers ? numbers.length : attributes.length;
+                    if (count) {
+                        // The first array of numbers becomes the result itself, checked in place,
+                        // so a large answer is not held twice
+                        let target = numbers && !results.length ? numbers : results;
+                        let size = target === results ? results.length : 0;
                         let truncated = false;
                         let discarded = false;
-                        for (let attribute of untagged.attributes) {
+                        for (let i = 0; i < count; i++) {
                             // The result set is server-controlled and accumulated across
                             // responses, so stop at the same absolute ceiling expandRange()
                             // uses - a server streaming SEARCH responses could otherwise
                             // grow the set until the process runs out of memory
                             /* c8 ignore next 4 */ // reaching the ceiling needs 2^24 accumulated results, which no unit test can produce in reasonable time
-                            if (results.size >= EXPANDED_RANGE_LIMIT) {
+                            if (size >= EXPANDED_RANGE_LIMIT) {
                                 truncated = true;
                                 break;
                             }
+                            let attribute = attributes[i];
+                            let value = numbers ? numbers[i] : attribute && typeof attribute.value === 'string' ? Number(attribute.value) : NaN;
                             // Same nz-number check the ESEARCH branch below applies. isNaN()
                             // is not enough: it passes '1e400' (Infinity), '-3' and '2.5', and
                             // a single one of those makes the sequence set compiled from this
                             // result set invalid, failing the caller's whole follow-up command
-                            let value = attribute && typeof attribute.value === 'string' ? Number(attribute.value) : NaN;
                             if (!isValidSequenceValue(value)) {
                                 discarded = true;
                                 continue;
                             }
-                            results.add(value);
+                            target[size++] = value;
                         }
+                        target.length = size;
+                        results = target;
                         if (truncated || discarded) {
                             connection.log.warn({
                                 msg: 'Invalid entries in the SEARCH result',
@@ -148,7 +181,7 @@ export default async function search(connection, query, options) {
                     }
                     let parsed = parseEsearchResponse(stripEsearchPrefix(untagged.attributes));
                     if (parsed.all) {
-                        // Walk the compact sequence-set directly into the Set - the ALL
+                        // Walk the compact sequence-set directly into the results - the ALL
                         // result may cover the entire mailbox, so expanding it into an
                         // intermediate array first would double the peak memory use.
                         // The set comes from an untrusted server: endpoints must be
@@ -161,11 +194,17 @@ export default async function search(connection, query, options) {
                         // not contain '*' at all (RFC 9051 section 4.1.1), so UID
                         // parts with '*' are dropped
                         let existsCount = () => mailbox.exists || 0;
-                        // The mailbox EXISTS count is itself server-supplied and can be
-                        // absurdly large, so the budget is additionally capped at the same
-                        // absolute ceiling expandRange() uses - a hostile server cannot
-                        // bypass it by inflating EXISTS first
-                        let overBudget = () => results.size >= existsCount() || results.size >= EXPANDED_RANGE_LIMIT;
+                        // The budget counts what the expansions added, across responses, so
+                        // a server repeating the same range cannot multiply it. The mailbox
+                        // EXISTS count is itself server-supplied and can be absurdly large, so
+                        // the budget is additionally capped at the same absolute ceiling
+                        // expandRange() uses - a hostile server cannot bypass it by inflating
+                        // EXISTS first
+                        let overBudget = () => esearchAdded >= existsCount() || results.length >= EXPANDED_RANGE_LIMIT;
+                        let add = (value) => {
+                            results.push(value);
+                            esearchAdded++;
+                        };
                         let resolveId = (part) => (part === '*' ? (options.uid ? 0 : existsCount()) : Number(part));
                         let truncated = false;
                         let discarded = false;
@@ -182,7 +221,7 @@ export default async function search(connection, query, options) {
                                     truncated = true;
                                     break;
                                 }
-                                results.add(value);
+                                add(value);
                                 continue;
                             }
                             let first = resolveId(part.substring(0, colon));
@@ -196,7 +235,7 @@ export default async function search(connection, query, options) {
                                     truncated = true;
                                     break sequenceSetLoop;
                                 }
-                                results.add(id);
+                                add(id);
                             }
                         }
                         if (truncated || discarded) {
@@ -212,11 +251,19 @@ export default async function search(connection, query, options) {
             }
         });
         response.next();
-        // Sort numerically for consistent, predictable output order
-        return Array.from(results).sort((a, b) => a - b);
+        // Sort numerically for consistent, predictable output order, then drop the duplicates
+        // in place: servers may repeat numbers across multiple untagged responses
+        results.sort((a, b) => a - b);
+        let unique = 0;
+        for (let i = 0; i < results.length; i++) {
+            if (!unique || results[i] !== results[unique - 1]) {
+                results[unique++] = results[i];
+            }
+        }
+        results.length = unique;
+        return results;
     }
     catch (err) {
-        await reportCommandError(connection, err);
-        return false;
+        return await searchFailed(connection, err);
     }
 }

package/dist/esm/handler/imap-compiler.js

@@ -282,6 +282,11 @@ function compiler(response, options) {
             walk(child);
         }
     }
+    if (response.numbers) {
+        for (let value of response.numbers) {
+            walk(value);
+        }
+    }
     if (resp.length) {
         respParts.push(resp);
     }

package/dist/esm/handler/imap-parser.d.ts

@@ -10,7 +10,8 @@ import type { ImapResponse, ParserOptions } from './types.js';
  * @param options.literals - Pre-parsed literal values extracted from the input stream.
  * @returns A promise that resolves to a parsed response object with `tag` (the IMAP tag, e.g. "*",
  *   "+", or a command tag like "A1"), `command` (the IMAP command or response name, e.g. "OK",
- *   "FETCH"), `attributes` (parsed attributes of the response) and `nullBytesRemoved` (number of
- *   leading null bytes removed, if any).
+ *   "FETCH"), `attributes` (parsed attributes of the response), `numbers` (the numbers of an
+ *   untagged SEARCH response that holds nothing else, instead of `attributes`) and
+ *   `nullBytesRemoved` (number of leading null bytes removed, if any).
  */
 export default function parser(command: Buffer | string, options?: ParserOptions | undefined): Promise<ImapResponse>;

package/dist/esm/handler/imap-parser.js

@@ -25,6 +25,56 @@ function asParserError(err, input) {
         ...(err instanceof Error ? { _err: err } : {})
     });
 }
+/**
+ * Reads the numbers of an untagged SEARCH response, the part of the line after the command
+ * (" 2 5 9"), into an array. A SEARCH answer holds one number per matching message, so on a
+ * large mailbox one line carries millions of them, and run through the tokenizer each would
+ * become a parse tree node and an attribute object, some 30 times the size of the line in heap.
+ *
+ * @param str - The rest of the line after the command
+ * @returns The numbers, or null when the line holds anything but a space before every number
+ *   and trailing spaces (a CONDSTORE MODSEQ list, extra spaces, a number past 2^53), which is
+ *   left to the tokenizer
+ */
+function readSearchNumbers(str) {
+    // trailing spaces are tolerated, as the tokenizer does, some servers end the line with one
+    let end = str.length;
+    while (end > 1 && str.charCodeAt(end - 1) === 0x20) {
+        end--;
+    }
+    if (end < 2 || str.charCodeAt(0) !== 0x20) {
+        return null;
+    }
+    const numbers = [];
+    // -1 until the first digit of the current number
+    let value = -1;
+    for (let i = 1; i < end; i++) {
+        const c = str.charCodeAt(i);
+        if (c === 0x20) {
+            if (value < 0) {
+                return null;
+            }
+            numbers.push(value);
+            value = -1;
+        }
+        else if (c >= 0x30 && c <= 0x39) {
+            value = (value < 0 ? 0 : value * 10) + (c - 0x30);
+            // past 2^53 the digits no longer add up exactly, a line with such a number is left
+            // to the tokenizer
+            if (value > Number.MAX_SAFE_INTEGER) {
+                return null;
+            }
+        }
+        else {
+            return null;
+        }
+    }
+    if (value < 0) {
+        return null;
+    }
+    numbers.push(value);
+    return numbers;
+}
 /**
  * Parses a raw IMAP command or response buffer into a structured object.
  * Handles edge cases such as null-byte-padded responses from buggy servers and
@@ -36,8 +86,9 @@ function asParserError(err, input) {
  * @param options.literals - Pre-parsed literal values extracted from the input stream.
  * @returns A promise that resolves to a parsed response object with `tag` (the IMAP tag, e.g. "*",
  *   "+", or a command tag like "A1"), `command` (the IMAP command or response name, e.g. "OK",
- *   "FETCH"), `attributes` (parsed attributes of the response) and `nullBytesRemoved` (number of
- *   leading null bytes removed, if any).
+ *   "FETCH"), `attributes` (parsed attributes of the response), `numbers` (the numbers of an
+ *   untagged SEARCH response that holds nothing else, instead of `attributes`) and
+ *   `nullBytesRemoved` (number of leading null bytes removed, if any).
  */
 export default async function parser(command, options) {
     options = options || {};
@@ -78,6 +129,13 @@ export default async function parser(command, options) {
             await parserInstance.getSpace();
             response.command += ' ' + (await parserInstance.getElement(imapFormalSyntax.command()));
         }
+        if (response.tag === '*' && (response.command || '').toUpperCase() === 'SEARCH') {
+            const numbers = readSearchNumbers(parserInstance.remainder);
+            if (numbers) {
+                response.numbers = numbers;
+                return response;
+            }
+        }
         if (parserInstance.remainder.trim().length) {
             await parserInstance.getSpace();
             response.attributes = await parserInstance.getAttributes();

package/dist/esm/handler/types.d.ts

@@ -37,6 +37,11 @@ export interface ImapResponse {
     command?: string | undefined;
     /** Parsed attributes of the response */
     attributes?: ImapAttributeList | undefined;
+    /**
+     * The numbers of an untagged SEARCH response (`* SEARCH 2 5 9`), set instead of `attributes`
+     * when the line holds nothing else, see parser()
+     */
+    numbers?: number[] | undefined;
     /** Number of leading NUL bytes stripped from the line, if any */
     nullBytesRemoved?: number | undefined;
     /**
@@ -54,6 +59,8 @@ export interface ImapCompileInput {
     tag?: string | undefined;
     command?: string | undefined;
     attributes?: ImapCompileNode | ImapCompileNode[] | undefined;
+    /** The numbers of a parsed SEARCH response, written after the attributes */
+    numbers?: number[] | undefined;
 }
 export interface CompilerOptions {
     /** Return an array of Buffers, one per literal segment, instead of a single Buffer */

package/dist/esm/imap-flow.d.ts

@@ -470,7 +470,11 @@ export declare class ImapFlow extends EventEmitter {
      *
      * @param query Query to filter the messages
      * @param options Search options. With `returnOptions` set the result is an ESEARCH result object
-     * @returns An array of sequence or UID numbers, or an ESearchResult when `returnOptions` was used
+     * @returns An array of sequence or UID numbers, or an ESearchResult when `returnOptions` was used.
+     *   `false` when the server rejected the search (a NO or BAD answer, for example an unsupported
+     *   charset or search key), `undefined` when no mailbox is open. Rejects when the command could
+     *   not complete, for example because the connection closed or failed, so a failed search is
+     *   never mistaken for an empty result
      *
      * @example
      * let mailbox = await client.mailboxOpen('INBOX');

package/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "imapflow";
-export declare const version = "2.5.5";
+export declare const version = "2.5.7";
 export declare const homepage = "https://imapflow.com/";

package/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = "imapflow";
-export const version = "2.5.5";
+export const version = "2.5.7";
 export const homepage = "https://imapflow.com/";

package/dist/esm/types.d.ts

@@ -132,7 +132,9 @@ export interface ImapFlowOptions {
      * accepted. `Infinity` disables the limit. An in-progress line is additionally bounded by
      * whatever is left of `maxResponseSize`, so lowering that also bounds line buffering.
      * Exceeding it is terminal: the connection fails with error code `LineTooLarge` and
-     * no further input is parsed.
+     * no further input is parsed. The limit bounds the bytes of a line, not the memory its parse
+     * takes, which is several times the line size for a line of many small tokens. A SEARCH
+     * answer of plain numbers is read into an array of about the size of the line.
      */
     maxLineLength?: number | undefined;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "imapflow",
-    "version": "2.5.5",
+    "version": "2.5.7",
     "description": "IMAP Client for Node",
     "type": "module",
     "main": "./dist/cjs/imap-flow.js",
@@ -40,6 +40,8 @@
         "test": "node --import tsx --test --test-force-exit --test-concurrency=1 $(find test -name '*-test.ts' -not -path '*/integration/*' -not -path '*/cloudflare/*' -not -path '*/celld/*' -not -path '*/browser/*')",
         "pretest:coverage": "npm run build",
         "test:coverage": "c8 node --import tsx --test --test-force-exit --test-concurrency=1 $(find test -name '*-test.ts' -not -path '*/integration/*' -not -path '*/cloudflare/*' -not -path '*/celld/*' -not -path '*/browser/*')",
+        "pretest:cjs": "npm run build",
+        "test:cjs": "NODE_OPTIONS=--no-experimental-require-module node test/package/cjs-smoke.cjs",
         "pretest:bun": "npm run build",
         "test:bun": "bun test --timeout 60000 $(find ./test -name '*-test.ts' -not -path '*/integration/*' -not -path '*/cloudflare/*' -not -path '*/celld/*' -not -path '*/browser/*')",
         "pretest:workers": "npm run build",
@@ -92,14 +94,14 @@
         "types-node-legacy": "npm:@types/node@20.0.0",
         "typescript": "6.0.3",
         "typescript-eslint": "8.71.2",
-        "wrangler": "4.151.1"
+        "wrangler": "4.151.2"
     },
     "dependencies": {
-        "@zone-eu/mailsplit": "5.4.26",
+        "@zone-eu/mailsplit": "5.4.27",
         "encoding-japanese": "2.4.0",
         "iconv-lite": "0.7.3",
         "libbase64": "1.4.1",
-        "libmime": "5.5.1",
+        "libmime": "5.5.2",
         "libqp": "3.0.1",
         "pino": "10.3.1",
         "socks": "2.8.10"