imapflow 2.5.8 → 2.6.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## [2.6.0](https://github.com/postalsys/imapflow/compare/v2.5.9...v2.6.0) (2026-10-21)
+
+
+### Features
+
+* expose mailboxList, context, connectedAt and lastClientWrite on the client ([c054bd3](https://github.com/postalsys/imapflow/commit/c054bd33ab0068531c64d613718233d3a1eff9e6))
+
+
+### Bug Fixes
+
+* emit the error event at most once per connection ([434e6eb](https://github.com/postalsys/imapflow/commit/434e6eb84021892703d02a63dc28da4a8bf086d6))
+* let idle() wait for a free connection before starting IDLE ([4a3d7df](https://github.com/postalsys/imapflow/commit/4a3d7df2116321997a966e0856d7035ed2b60992))
+* reject a mailbox lock when the processLocks pass handling it throws ([a207cd0](https://github.com/postalsys/imapflow/commit/a207cd093535025524ff6066aed092779b0ff569))
+* reject fetch() without a selected mailbox instead of returning nothing ([78036b8](https://github.com/postalsys/imapflow/commit/78036b806b9f70e70a78fa2bc668e340e63297af))
+* report UIDVALIDITY and HIGHESTMODSEQ changes found by the polling fallback ([0f4c306](https://github.com/postalsys/imapflow/commit/0f4c306259ffc9bb973d4cb54f790707c100cc94))
+* require an exact LIST match before treating a failed SELECT mailbox as existing ([99a5db0](https://github.com/postalsys/imapflow/commit/99a5db09a02da721b230fd56bb7d1b240cbb2a0f))
+* start IDLE right away again when idle() is called inside a mailbox lock ([018967d](https://github.com/postalsys/imapflow/commit/018967ded2d6e44801c4af8e211b10870e0f2f44))
+
+## [2.5.9](https://github.com/postalsys/imapflow/compare/v2.5.8...v2.5.9) (2026-10-20)
+
+
+### Bug Fixes
+
+* bound the parse cost of responses with many literals or tokens ([cb2124f](https://github.com/postalsys/imapflow/commit/cb2124f7a4db4a4c3ec0f15bffa6e8d6e81c2426))
+* do not report APPENDUID UIDVALIDITY next to a looked up UID ([#448](https://github.com/postalsys/imapflow/issues/448)) ([b5aadd3](https://github.com/postalsys/imapflow/commit/b5aadd399599f600009bb4db8ce16fdc574d7ce6))
+
 ## [2.5.8](https://github.com/postalsys/imapflow/compare/v2.5.7...v2.5.8) (2026-10-19)
 
 

package/README.md

@@ -128,6 +128,15 @@ main().catch(console.error);
 
 An `ImapFlow` instance holds a single connection and cannot reconnect. Once the connection has closed, or after `connect()` has been called once, create a new instance to connect again. Calling `connect()` a second time on the same instance throws an error with the code `InstanceReused`.
 
+### Connection state
+
+Besides `mailbox`, `usable`, `authenticated` and `capabilities`, a client exposes:
+
+- `client.context` - data of the application's own, never read by ImapFlow. It starts as the `context` option (`new ImapFlow({ ..., context: { account: 'a1' } })`) and can be replaced at any time. Its type is `unknown`, cast it to what you store there.
+- `client.connectedAt` - when the TCP or TLS connection was established, in milliseconds since the epoch, `null` before that.
+- `client.lastClientWrite` - when the client last wrote to the server (a command, a literal, the `DONE` that ends IDLE), in milliseconds since the epoch, `null` before the first write. Useful for staying ahead of server inactivity timers.
+- `client.mailboxList` - with `verifyOnly` and `includeMailboxes`, the mailboxes listed before the connection logged out; `undefined` otherwise.
+
 See the [Quick Start guide](https://imapflow.com/docs/getting-started/quick-start) for more examples, including Gmail, Outlook, and Yahoo configuration.
 
 ## Documentation

package/dist/cjs/commands/append.js

@@ -144,11 +144,14 @@ async function append(connection, destination, content, flags, idate) {
                 // message was already stored and a retrying caller would duplicate it.
                 let uidValidity = (0, tools_js_1.parseBigIntValue)(section[1] && section[1].value, tools_js_1.MAX_UINT32_DIGITS);
                 let uid = (0, tools_js_1.parseUintValue)(section[2] && section[2].value, tools_js_1.MAX_UINT32_DIGITS);
-                if (uidValidity !== false) {
-                    map.uidValidity = uidValidity;
-                }
+                // UIDVALIDITY is only reported next to the UID it was sent with: kept without one,
+                // it would end up paired with the UID the SEARCH fallback below guesses from the
+                // sequence number, and the pair would pass for a server-confirmed identity.
                 if (uid) {
                     map.uid = uid;
+                    if (uidValidity) {
+                        map.uidValidity = uidValidity;
+                    }
                 }
             }
         }

package/dist/cjs/commands/fetch.d.ts

@@ -25,6 +25,7 @@ export interface FetchCommandResult {
  * @param range - Message sequence number or UID range
  * @param query - Fetch query specifying which data to retrieve (e.g., flags, envelope, bodyStructure, headers, source, bodyParts)
  * @param options - Fetch options
- * @returns Object with message count and list, or undefined if not in SELECTED state
+ * @returns Object with message count and list, or undefined when the range is empty
+ * @throws NoMailboxSelected when not in SELECTED state (NoConnection once the connection is gone)
  */
 export default function fetch(connection: ImapFlow, range: string, query: FetchQueryObject, options?: FetchCommandOptions | undefined): Promise<FetchCommandResult | undefined>;

package/dist/cjs/commands/fetch.js

@@ -10,11 +10,17 @@ const errors_js_1 = require("../errors.js");
  * @param range - Message sequence number or UID range
  * @param query - Fetch query specifying which data to retrieve (e.g., flags, envelope, bodyStructure, headers, source, bodyParts)
  * @param options - Fetch options
- * @returns Object with message count and list, or undefined if not in SELECTED state
+ * @returns Object with message count and list, or undefined when the range is empty
+ * @throws NoMailboxSelected when not in SELECTED state (NoConnection once the connection is gone)
  */
 async function fetch(connection, range, query, options) {
     let mailbox = (0, tools_js_1.getSelectedMailbox)(connection);
-    if (!mailbox || !range) {
+    if (!mailbox) {
+        // queued behind a CLOSE or a failed SELECT: rejecting keeps fetch() from yielding
+        // nothing as if the mailbox were empty
+        throw connection.createNoMailboxError('FETCH');
+    }
+    if (!range) {
         // nothing to do here
         return;
     }

package/dist/cjs/commands/idle.js

@@ -215,6 +215,7 @@ async function pollOnce(connection, session) {
             // HIGHESTMODSEQ is filtered out again unless the server advertises CONDSTORE, so a
             // CONDSTORE session keeps mailbox.highestModseq current without asking a plain
             // server for an item it does not know.
+            let polled = connection.mailbox;
             let status = await connection.runInternal('STATUS', path, {
                 messages: true,
                 uidNext: true,
@@ -225,6 +226,12 @@ async function pollOnce(connection, session) {
             if (!status) {
                 throw (0, errors_js_1.createImapError)('STATUS poll failed', 'PollFailed');
             }
+            // STATUS can only tell that the UIDs changed, the selected view is stale then: select
+            // the mailbox again, which reports it as closed and opened anew with the new state
+            if (polled && connection.mailbox === polled && status.uidValidity && polled.uidValidity && status.uidValidity !== polled.uidValidity) {
+                connection.log.info({ msg: 'UIDVALIDITY changed, selecting the mailbox again', path, cid: connection.id });
+                await connection.runInternal('SELECT', path, { readOnly: session.selectCommand.command === 'EXAMINE' });
+            }
             break;
         }
         case 'NOOP':

package/dist/cjs/commands/select.js

@@ -214,8 +214,13 @@ async function select(connection, pathInput, options) {
         let currentMailbox = connection.mailbox;
         connection.mailbox = false;
         // Emit mailboxClose if we're switching from a different mailbox.
-        // Re-selecting the same mailbox (e.g., for resync) does not trigger close/open.
-        if (currentMailbox && currentMailbox.path !== path) {
+        // Re-selecting the same mailbox (e.g., for resync) does not trigger close/open, unless
+        // it came back with a new UIDVALIDITY: the old view and every UID in it are gone then,
+        // which is reported the way a fresh mailboxOpen() of another mailbox would be.
+        let reopened = !currentMailbox ||
+            currentMailbox.path !== path ||
+            (!!currentMailbox.uidValidity && !!map.uidValidity && currentMailbox.uidValidity !== map.uidValidity);
+        if (currentMailbox && reopened) {
             (0, tools_js_1.emitSafe)(connection, 'mailboxClose', currentMailbox);
         }
         connection.mailbox = map;
@@ -223,13 +228,19 @@ async function select(connection, pathInput, options) {
         // re-issues the SELECT to detect changes on servers without IDLE support).
         connection.currentSelectCommand = selectCommand;
         connection.state = connection.states.SELECTED;
-        if (!currentMailbox || currentMailbox.path !== path) {
+        if (reopened || !currentMailbox) {
             (0, tools_js_1.emitSafe)(connection, 'mailboxOpen', connection.mailbox);
         }
-        else if (typeof map.exists === 'number' && map.exists !== currentMailbox.exists) {
+        else {
             // A re-SELECT of the open mailbox (the SELECT polling fallback) gets its EXISTS here
-            // instead of in the global handler, so it is reported the same way
-            (0, tools_js_1.emitSafe)(connection, 'exists', { path, count: map.exists, prevCount: currentMailbox.exists });
+            // instead of in the global handler, so it is reported the same way. Flag changes are
+            // not reported by SELECT, a new HIGHESTMODSEQ is the cue to resync them.
+            if (typeof map.exists === 'number' && map.exists !== currentMailbox.exists) {
+                (0, tools_js_1.emitSafe)(connection, 'exists', { path, count: map.exists, prevCount: currentMailbox.exists });
+            }
+            if (map.highestModseq && map.highestModseq !== currentMailbox.highestModseq) {
+                (0, tools_js_1.emitSafe)(connection, 'highestModseq', { path, highestModseq: map.highestModseq, prevHighestModseq: currentMailbox.highestModseq });
+            }
         }
         response.next();
         return map;

package/dist/cjs/commands/status.js

@@ -17,8 +17,13 @@ const MAILBOX_UPDATERS = {
     uidNext: (value, mailbox) => {
         mailbox.uidNext = value;
     },
-    highestModseq: (value, mailbox) => {
-        mailbox.highestModseq = value;
+    highestModseq: (value, mailbox, connection, path) => {
+        let prevHighestModseq = mailbox.highestModseq;
+        if (prevHighestModseq !== value) {
+            mailbox.highestModseq = value;
+            // the changes behind it are not reported by STATUS, the event is the cue to resync
+            (0, tools_js_1.emitSafe)(connection, 'highestModseq', { path, highestModseq: value, prevHighestModseq });
+        }
     }
 };
 /**
@@ -68,13 +73,22 @@ async function status(connection, path, query) {
                     if (!list) {
                         return;
                     }
+                    let updates = [];
                     (0, status_fields_js_1.parseStatusList)(list, (key, value) => {
                         map[key] = value;
-                        let updater = MAILBOX_UPDATERS[key];
-                        if (currentMailbox && updater) {
-                            updater(value, currentMailbox, connection, path);
+                        if (currentMailbox && MAILBOX_UPDATERS[key]) {
+                            updates.push([key, value]);
                         }
                     });
+                    // Under a new UIDVALIDITY the counts describe a mailbox the selected view no
+                    // longer matches, so they are not applied to it; the STATUS poll selects the
+                    // mailbox again instead, which reports it as opened anew
+                    if (currentMailbox && map.uidValidity && currentMailbox.uidValidity && map.uidValidity !== currentMailbox.uidValidity) {
+                        return;
+                    }
+                    for (let [key, value] of updates) {
+                        MAILBOX_UPDATERS[key](value, currentMailbox, connection, path);
+                    }
                 }
             }
         });

package/dist/cjs/download.js

@@ -236,9 +236,9 @@ async function downloadMessage(client, range, part, options) {
         };
         let response = await fetchExpected(client, range, query, downloadOptions, expected);
         if (!response) {
-            // An empty answer also comes from a connection that closed while the consumer was
-            // paused between chunks (fetchOne() finds no mailbox then), and that is not a
-            // missing message: a caller that retries would skip it
+            // An empty answer from a connection that closed while the consumer was paused
+            // between chunks is not a missing message: a caller that retries would skip it
+            // (fetchOne() itself rejects with NoConnection when it finds no mailbox then)
             if (!client.usable) {
                 throw client.createNoConnectionError(false, { rejectedFrom: 'download' });
             }

package/dist/cjs/errors.d.ts

@@ -35,6 +35,7 @@ export declare const ImapFlowErrorCode: {
     readonly LineTooLarge: "LineTooLarge";
     readonly LiteralTooLarge: "LiteralTooLarge";
     readonly ResponseTooLarge: "ResponseTooLarge";
+    readonly TooManyTokens: "TooManyTokens";
     readonly TooManyResponses: "TooManyResponses";
     readonly InvalidStringValue: "InvalidStringValue";
     readonly InvalidTokenValue: "InvalidTokenValue";
@@ -50,6 +51,7 @@ export declare const ImapFlowErrorCode: {
     readonly ERR_INVALID_URL: "ERR_INVALID_URL";
     readonly UnsupportedTransportOption: "UnsupportedTransportOption";
     readonly InstanceReused: "InstanceReused";
+    readonly NoMailboxSelected: "NoMailboxSelected";
 };
 /** One of the {@link ImapFlowErrorCode} values */
 export type ImapFlowErrorCode = (typeof ImapFlowErrorCode)[keyof typeof ImapFlowErrorCode];
@@ -117,7 +119,7 @@ export interface ImapFlowError extends Error {
     lineLength?: number | undefined;
     /** The size of a rejected response */
     responseSize?: number | undefined;
-    /** The bound that was exceeded */
+    /** The bound that was exceeded (bytes, or tokens for TooManyTokens) */
     maxSize?: number | undefined;
     /** OAuth error details from the server, for XOAUTH2 authentication failures */
     oauthError?: any;

package/dist/cjs/errors.js

@@ -43,6 +43,7 @@ exports.ImapFlowErrorCode = {
     LineTooLarge: 'LineTooLarge',
     LiteralTooLarge: 'LiteralTooLarge',
     ResponseTooLarge: 'ResponseTooLarge',
+    TooManyTokens: 'TooManyTokens',
     // one command received more untagged responses than are kept, see MAX_COLLECTED_RESPONSES
     TooManyResponses: 'TooManyResponses',
     // invalid values in a command
@@ -63,7 +64,9 @@ exports.ImapFlowErrorCode = {
     // the transport option
     UnsupportedTransportOption: 'UnsupportedTransportOption',
     // API misuse
-    InstanceReused: 'InstanceReused'
+    InstanceReused: 'InstanceReused',
+    // a message command (FETCH) was called while no mailbox was selected
+    NoMailboxSelected: 'NoMailboxSelected'
 };
 /**
  * Error subclass thrown when IMAP authentication fails.

package/dist/cjs/handler/imap-parser.js

@@ -9,8 +9,8 @@ const parser_instance_js_1 = require("./parser-instance.js");
 const errors_js_1 = require("../errors.js");
 const limits_js_1 = require("./limits.js");
 // The codes the parser raises on purpose: the numbered ParserErrorN codes, ParserErrorExchange,
-// the nesting limit and the inline literal size limit
-const PARSER_ERROR_CODES = /^(?:ParserError\d+|ParserErrorExchange|MAX_IMAP_NESTING_REACHED|LiteralTooLarge)$/;
+// the nesting limit, the inline literal size limit and the token limit
+const PARSER_ERROR_CODES = /^(?:ParserError\d+|ParserErrorExchange|MAX_IMAP_NESTING_REACHED|LiteralTooLarge|TooManyTokens)$/;
 /**
  * Anything the parser throws other than one of its own coded errors - a TypeError from a parser
  * bug, a RangeError from runaway recursion or a bad Buffer offset (which carries a Node code), a
@@ -81,6 +81,39 @@ function readSearchNumbers(str) {
     numbers.push(value);
     return numbers;
 }
+// The CONDSTORE list that ends a SEARCH answer to a MODSEQ query (RFC 7162 section 3.1.5)
+const RE_SEARCH_MODSEQ = /^ \(MODSEQ (\d{1,19})\) *$/i;
+/**
+ * Reads an untagged SEARCH response without the tokenizer, see readSearchNumbers(): the numbers,
+ * and the MODSEQ value of a trailing CONDSTORE list. A MODSEQ query on a large mailbox matches as
+ * many messages as any other, so its answer must not fall back to the tokenizer either.
+ *
+ * @param str - The rest of the line after the command
+ * @returns The numbers, with the MODSEQ list as the attributes the tokenizer would have made of
+ *   it, or null when the line is left to the tokenizer
+ */
+function readSearchResponse(str) {
+    // the last character tells whether there is a list to look for, without scanning the line
+    if (!str.trimEnd().endsWith(')')) {
+        const numbers = readSearchNumbers(str);
+        return numbers && { numbers };
+    }
+    const open = str.lastIndexOf(' (');
+    const match = open < 0 ? null : RE_SEARCH_MODSEQ.exec(str.slice(open));
+    if (!match) {
+        return null;
+    }
+    const numbers = readSearchNumbers(str.slice(0, open));
+    return (numbers && {
+        numbers,
+        attributes: [
+            [
+                { type: 'ATOM', value: 'MODSEQ' },
+                { type: 'ATOM', value: match[1] }
+            ]
+        ]
+    });
+}
 /**
  * Parses a raw IMAP command or response buffer into a structured object.
  * Handles edge cases such as null-byte-padded responses from buggy servers and
@@ -136,10 +169,9 @@ async function parser(command, options) {
             response.command += ' ' + (await parserInstance.getElement(imap_formal_syntax_js_1.default.command()));
         }
         if (response.tag === '*' && (response.command || '').toUpperCase() === 'SEARCH') {
-            const numbers = readSearchNumbers(parserInstance.remainder);
-            if (numbers) {
-                response.numbers = numbers;
-                return response;
+            const search = readSearchResponse(parserInstance.remainder);
+            if (search) {
+                return Object.assign(response, search);
             }
         }
         if (parserInstance.remainder.trim().length) {

package/dist/cjs/handler/limits.d.ts

@@ -2,6 +2,7 @@ import { type ImapFlowError } from '../errors.js';
 export declare const MAX_LITERAL_SIZE: number;
 export declare const MAX_LINE_SIZE: number;
 export declare const MAX_RESPONSE_SIZE: number;
+export declare const MAX_RESPONSE_TOKENS = 1000000;
 export declare const ERROR_CONTEXT_LENGTH = 1024;
 /**
  * The input a parse error carries: a bounded prefix with the full length.

package/dist/cjs/handler/limits.js

@@ -3,7 +3,7 @@
 // (ImapStream) and the standalone token parser cannot drift apart, and so the documented
 // defaults in the ImapFlowOptions type describe both paths.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createLiteralTooLargeError = exports.normalizeLimit = exports.boundedInput = exports.ERROR_CONTEXT_LENGTH = exports.MAX_RESPONSE_SIZE = exports.MAX_LINE_SIZE = exports.MAX_LITERAL_SIZE = void 0;
+exports.createLiteralTooLargeError = exports.normalizeLimit = exports.boundedInput = exports.ERROR_CONTEXT_LENGTH = exports.MAX_RESPONSE_TOKENS = exports.MAX_RESPONSE_SIZE = exports.MAX_LINE_SIZE = exports.MAX_LITERAL_SIZE = void 0;
 const errors_js_1 = require("../errors.js");
 // Maximum allowed literal size: 1GB (1073741824 bytes)
 exports.MAX_LITERAL_SIZE = 1024 * 1024 * 1024;
@@ -21,6 +21,13 @@ exports.MAX_LINE_SIZE = exports.MAX_LITERAL_SIZE;
 // of exactly the maximum permitted size impossible to receive. Configuring both limits calls for
 // the same headroom - set maxResponseSize above maxLiteralSize, not equal to it.
 exports.MAX_RESPONSE_SIZE = 2 * exports.MAX_LITERAL_SIZE;
+// Default maximum number of tokens (atoms, strings, literals, lists and the other parse tree
+// nodes) in a single response. The byte limits bound what a server sends, not what parsing it
+// costs: every token becomes a tree node and an attribute object, around a hundred bytes of heap
+// for a two-byte "1 ", so a line of many small tokens costs fifty times its size. A legitimate
+// response stays far below this (the long one, a SEARCH answer of plain numbers, is read without
+// the tokenizer, see parser()), so the bound only stops a server that floods one response.
+exports.MAX_RESPONSE_TOKENS = 1000000;
 // How much of the offending input a parse error carries along. The error travels whole into log
 // entries (pino copies every property of a logged error) and into the rejection of the command
 // the line belonged to, and the line can be as long as the configured line cap.

package/dist/cjs/handler/token-parser.d.ts

@@ -7,7 +7,8 @@ import type { ParserInstance } from './parser-instance.js';
  * (ATOM, string, LITERAL, SEQUENCE, LIST, SECTION, PARTIAL).
  */
 export interface TokenNode {
-    childNodes: TokenNode[];
+    /** Created with the first child, a leaf token does not carry an empty array */
+    childNodes?: TokenNode[] | undefined;
     type: string | false;
     value: string | Buffer;
     isClosed: boolean;
@@ -44,6 +45,9 @@ export declare class TokenParser {
     options: ParserOptions;
     parent: TokenParserParent | ParserInstance;
     maxLiteralSize: number;
+    maxResponseTokens: number;
+    /** Nodes created so far, checked against maxResponseTokens */
+    tokenCount: number;
     tree: TokenNode;
     currentNode: TokenNode;
     pos: number;
@@ -62,6 +66,7 @@ export declare class TokenParser {
      * @param options.literals - Pre-parsed literal values from the input stream.
      * @param options.maxLiteralSize - Maximum size (in bytes) of a literal parsed inline
      *   from the input, i.e. when no pre-parsed literal buffers were supplied. Defaults to 1GB.
+     * @param options.maxResponseTokens - Maximum number of parse tree nodes, see MAX_RESPONSE_TOKENS.
      */
     constructor(parent: TokenParserParent | ParserInstance, startPos?: number | undefined, str?: string | null | undefined, options?: ParserOptions | undefined);
     /**
@@ -93,7 +98,8 @@ export declare class TokenParser {
      * @param parentNode - The parent node to attach this node to. If omitted, creates a root node.
      * @param startPos - The starting position of this node in the original input string.
      * @returns The newly created node with childNodes, type, value, and isClosed properties.
-     * @throws {Error} If the nesting depth exceeds MAX_NODE_DEPTH outside a FETCH data item.
+     * @throws {Error} If the nesting depth exceeds MAX_NODE_DEPTH outside a FETCH data item, or
+     *   the response has more than maxResponseTokens nodes.
      */
     createNode(parentNode?: TokenNode | undefined, startPos?: number | undefined): TokenNode;
     /**

package/dist/cjs/handler/token-parser.js

@@ -45,6 +45,7 @@ class TokenParser {
      * @param options.literals - Pre-parsed literal values from the input stream.
      * @param options.maxLiteralSize - Maximum size (in bytes) of a literal parsed inline
      *   from the input, i.e. when no pre-parsed literal buffers were supplied. Defaults to 1GB.
+     * @param options.maxResponseTokens - Maximum number of parse tree nodes, see MAX_RESPONSE_TOKENS.
      */
     constructor(parent, startPos, str, options) {
         this.str = (str || '').toString();
@@ -53,6 +54,8 @@ class TokenParser {
         // Same normalization and default as the streaming parser, so a direct user of this parser
         // gets the same bound (an explicit 0 means "reject any non-empty inline literal").
         this.maxLiteralSize = (0, limits_js_1.normalizeLimit)(this.options.maxLiteralSize, limits_js_1.MAX_LITERAL_SIZE);
+        this.maxResponseTokens = (0, limits_js_1.normalizeLimit)(this.options.maxResponseTokens, limits_js_1.MAX_RESPONSE_TOKENS);
+        this.tokenCount = 0;
         this.truncatedAttributes = [];
         this.tree = this.currentNode = this.createNode();
         this.pos = startPos || 0;
@@ -89,7 +92,9 @@ class TokenParser {
         await this.processString();
         const attributes = [];
         let branch = attributes;
-        let walk = async (node) => {
+        // Synchronous on purpose: the recursion is bounded by MAX_NODE_DEPTH, and an async walk
+        // allocated a promise per token, which a line of many small tokens multiplies
+        let walk = (node) => {
             let curBranch = branch;
             let elm;
             let partial;
@@ -146,12 +151,16 @@ class TokenParser {
                     branch[branch.length - 1].partial = partial;
                     break;
             }
-            for (let childNode of node.childNodes) {
-                await walk(childNode);
+            // Each child is released once it is converted, so the tree and the attributes built
+            // from it are not both held whole at the peak of a line of many tokens
+            let childNodes = node.childNodes;
+            for (let i = 0; childNodes && i < childNodes.length; i++) {
+                walk(childNodes[i]);
+                childNodes[i] = null;
             }
             branch = curBranch;
         };
-        await walk(this.tree);
+        walk(this.tree);
         return attributes;
     }
     /**
@@ -162,11 +171,20 @@ class TokenParser {
      * @param parentNode - The parent node to attach this node to. If omitted, creates a root node.
      * @param startPos - The starting position of this node in the original input string.
      * @returns The newly created node with childNodes, type, value, and isClosed properties.
-     * @throws {Error} If the nesting depth exceeds MAX_NODE_DEPTH outside a FETCH data item.
+     * @throws {Error} If the nesting depth exceeds MAX_NODE_DEPTH outside a FETCH data item, or
+     *   the response has more than maxResponseTokens nodes.
      */
     createNode(parentNode, startPos) {
+        // The root node is not a token of the response
+        if (parentNode && ++this.tokenCount > this.maxResponseTokens) {
+            throw (0, errors_js_1.createImapError)(`Response has more than ${this.maxResponseTokens} tokens`, 'TooManyTokens', {
+                maxSize: this.maxResponseTokens,
+                parserContext: { ...(0, limits_js_1.boundedInput)(this.str), pos: startPos }
+            });
+        }
         let node = {
-            childNodes: [],
+            // declared up front, so a node keeps one shape when its first child arrives
+            childNodes: undefined,
             type: false,
             value: '',
             isClosed: true,
@@ -199,7 +217,7 @@ class TokenParser {
             node.startPos = startPos;
         }
         if (parentNode) {
-            parentNode.childNodes.push(node);
+            (parentNode.childNodes ||= []).push(node);
         }
         return node;
     }
@@ -211,7 +229,7 @@ class TokenParser {
      */
     isFetchResponse() {
         let command = this.parent.command;
-        let first = this.tree.childNodes[0];
+        let first = this.tree.childNodes?.[0];
         return (typeof command === 'string' &&
             /^\d+$/.test(command) &&
             !!first &&
@@ -237,7 +255,7 @@ class TokenParser {
         // The item is the last child of the list while it is being parsed, so its key is the
         // child before it. A key is an atom (BODYSTRUCTURE, ENVELOPE, BODY); anything else means
         // the row itself is malformed, and the key is reported as unknown.
-        let siblings = item.parentNode ? item.parentNode.childNodes : [];
+        let siblings = item.parentNode?.childNodes || [];
         let key = siblings[siblings.length - 2];
         this.truncatedAttributes.push(key && key.type === 'ATOM' && typeof key.value === 'string' ? key.value.toUpperCase() : '?');
     }
@@ -265,13 +283,26 @@ class TokenParser {
         // character, which is quadratic in the token length, and the server decides that length:
         // a 600 KB ESEARCH result took seconds of event loop time
         let tokenLength = 0;
+        // Where the token starts in the input, and whether its value still is that run of the
+        // input. A token is read as a run of characters, so its value is sliced from the input
+        // instead of grown with +=: each += of a long token adds a cons string of some twenty
+        // bytes per character, which the server multiplies with a long token
+        let tokenStart = 0;
+        let tokenSliced = true;
+        // Where the quoted string being read starts, and whether it holds an escape
+        let stringStart = 0;
+        let stringEscaped = false;
         let tokenLast = '';
         let tokenPrev = '';
         let tokenDigitsOnly = true;
         let tokenHasStar = false;
         let tokenHasDot = false;
         const appendToToken = (c) => {
-            this.currentNode.value += c;
+            if (!tokenLength) {
+                tokenStart = i;
+            }
+            tokenSliced = tokenSliced && i === tokenStart + tokenLength && this.str.charAt(i) === c;
+            this.currentNode.value = tokenSliced ? this.str.slice(tokenStart, i + 1) : this.currentNode.value + c;
             tokenLength++;
             tokenPrev = tokenLast;
             tokenLast = c;
@@ -295,6 +326,7 @@ class TokenParser {
         const startToken = (first) => {
             this.currentNode.value = '';
             tokenLength = 0;
+            tokenSliced = true;
             tokenLast = tokenPrev = '';
             tokenDigitsOnly = true;
             tokenHasStar = tokenHasDot = false;
@@ -305,11 +337,14 @@ class TokenParser {
         // ImapStream supplies one buffer per literal marker it framed, {0} included. A marker
         // without a buffer means the line and its literals do not match up, so fail with a parser
         // error instead of reading a missing buffer or shifting every later literal by one
+        // Read by index: shift() moves every remaining buffer, which made a response of many
+        // literals quadratic to parse
+        let literalIndex = 0;
         const takeLiteral = (literals) => {
-            if (!literals.length) {
+            if (literalIndex >= literals.length) {
                 throw this.parserError(`Literal without data at position ${this.pos + i} [E35]`, 'ParserError35', this.pos + i, chr);
             }
-            return literals.shift();
+            return literals[literalIndex++];
         };
         // Any ATOM supported char starts a new Atom sequence, otherwise throw an error
         // Allow \ as the first char for atom to support system flags
@@ -336,6 +371,8 @@ class TokenParser {
                             this.currentNode = this.createNode(this.currentNode, this.pos + i);
                             this.currentNode.type = 'string';
                             this.state = STATE_STRING;
+                            stringStart = i + 1;
+                            stringEscaped = false;
                             this.currentNode.isClosed = false;
                             break;
                         // ( starts a new list
@@ -566,8 +603,11 @@ class TokenParser {
                     appendToToken(chr);
                     break;
                 case STATE_STRING:
-                    // DQUOTE ends the string sequence
+                    // DQUOTE ends the string sequence. Its value is taken from the input in one
+                    // piece, for the same reason tokens are sliced, see appendToToken()
                     if (chr === '"') {
+                        let value = this.str.slice(stringStart, i);
+                        this.currentNode.value = stringEscaped ? value.replace(/\\([\s\S])/g, '$1') : value;
                         this.currentNode.endPos = this.pos + i;
                         this.currentNode.isClosed = true;
                         this.currentNode = this.currentNode.parentNode;
@@ -575,15 +615,14 @@ class TokenParser {
                         checkSP();
                         break;
                     }
-                    // \ Escapes the following char
+                    // \ Escapes the following char, which is skipped here so it can not end the string
                     if (chr === '\\') {
                         i++;
                         if (i >= len) {
                             throw this.parserError(`Unexpected end of input at position ${this.pos + i} [E18]`, 'ParserError18', this.pos + i);
                         }
-                        chr = this.str.charAt(i);
+                        stringEscaped = true;
                     }
-                    this.currentNode.value += chr;
                     break;
                 case STATE_PARTIAL:
                     if (chr === '>') {

package/dist/cjs/handler/types.d.ts

@@ -38,8 +38,9 @@ export interface ImapResponse {
     /** Parsed attributes of the response */
     attributes?: ImapAttributeList | undefined;
     /**
-     * The numbers of an untagged SEARCH response (`* SEARCH 2 5 9`), set instead of `attributes`
-     * when the line holds nothing else, see parser()
+     * The numbers of an untagged SEARCH response (`* SEARCH 2 5 9`), set when the line holds
+     * nothing else but a CONDSTORE `(MODSEQ n)` list, which is then the only entry of
+     * `attributes`, see parser()
      */
     numbers?: number[] | undefined;
     /** Number of leading NUL bytes stripped from the line, if any */
@@ -79,6 +80,8 @@ export interface ParserOptions {
     literals?: Buffer[] | undefined;
     /** Maximum size in bytes of a literal parsed inline from the input */
     maxLiteralSize?: number | undefined;
+    /** Maximum number of tokens in the response, see MAX_RESPONSE_TOKENS */
+    maxResponseTokens?: number | undefined;
 }
 /**
  * One assembled response as pushed by ImapStream: the line payload, its literals and the