imapkit 0.0.0-stage → 4.0.1

package/lib/plugins/quota.js

@@ -0,0 +1,285 @@
+'use strict';
+
+const { states } = require('../command-states');
+const { normalizeLineBreaks } = require('../mimeparser');
+const { MAX_NUMBER64, isNumber } = require('../numbers');
+const { isAstring } = require('../arguments');
+
+// Resource types of RFC 9208 section 5 that can be counted. ANNOTATION-STORAGE is left out,
+// as there is no ANNOTATE support
+const RESOURCES = ['STORAGE', 'MESSAGE', 'MAILBOX'];
+const DEFAULT_ROOT = 'User quota';
+
+/**
+ * @help Adds QUOTA [RFC9208] capability with the STORAGE, MESSAGE and MAILBOX
+ * @help resources and SETQUOTA. All personal mailboxes share one quota root, set
+ * @help with the "quota" server option, eg. {"root": "User quota",
+ * @help "STORAGE": 10240, "MESSAGE": 1000, "MAILBOX": 100, "soft": false}.
+ * @help STORAGE is in units of 1024 octets. Hard limits make APPEND, COPY, MOVE
+ * @help and CREATE fail with NO [OVERQUOTA], soft limits only send a warning
+ *
+ * QUOTA: https://www.rfc-editor.org/rfc/rfc9208.txt
+ *
+ * Additional commands:
+ * - GETQUOTA, GETQUOTAROOT, SETQUOTA
+ *
+ * Additional STATUS items:
+ * - DELETED, DELETED-STORAGE
+ */
+module.exports = function (server) {
+    const config = server.options.quota || {};
+    const root = {
+        name: typeof config.root === 'string' ? config.root : DEFAULT_ROOT,
+        soft: !!config.soft,
+        limits: {}
+    };
+
+    RESOURCES.forEach(resource => {
+        if (config[resource] === undefined || config[resource] === null) {
+            return;
+        }
+        const limit = Number(config[resource]);
+        if (!Number.isSafeInteger(limit) || limit < 0) {
+            throw new Error('Invalid quota limit for ' + resource + ': ' + JSON.stringify(config[resource]));
+        }
+        root.limits[resource] = limit;
+    });
+
+    // RFC 9208 sections 3.1.1 and 5: every supported resource is advertised, SETQUOTA needs QUOTASET
+    server.registerCapability('QUOTA');
+    RESOURCES.forEach(resource => server.registerCapability('QUOTA=RES-' + resource));
+    server.registerCapability('QUOTASET');
+
+    // Personal mailboxes, INBOX included, belong to the quota root. Other namespaces have no quota root. A mailbox
+    // that does not exist yet belongs to the namespace of its prefix
+    const inRoot = path => server.isPersonal(path);
+
+    const isSelectable = mailbox => mailbox.flags.indexOf('\\Noselect') < 0;
+
+    // RFC822.SIZE, the message with CRLF line breaks
+    const totalSize = messages => messages.reduce((total, message) => total + normalizeLineBreaks(message.raw).length, 0);
+
+    const getUsage = () => {
+        const usage = { MESSAGE: 0, MAILBOX: 0, bytes: 0 };
+        Object.keys(server.folderCache).forEach(path => {
+            const mailbox = server.folderCache[path];
+            if (!isSelectable(mailbox) || !inRoot(mailbox)) {
+                return;
+            }
+            usage.MAILBOX++;
+            usage.MESSAGE += mailbox.messages.length;
+            usage.bytes += totalSize(mailbox.messages);
+        });
+        return usage;
+    };
+
+    // RFC 9208 section 4.2.1: quota-list, resources that are not listed are not limited
+    const sendQuota = (connection, parsed, data) => {
+        const usage = getUsage();
+        // RFC 9208 section 5.1: units of 1024 octets
+        usage.STORAGE = Math.ceil(usage.bytes / 1024);
+        const list = [];
+        RESOURCES.forEach(resource => {
+            if (resource in root.limits) {
+                list.push({ type: 'ATOM', value: resource }, usage[resource], root.limits[resource]);
+            }
+        });
+        connection.send(
+            {
+                tag: '*',
+                command: 'QUOTA',
+                attributes: [{ type: 'STRING', value: root.name }, list]
+            },
+            'QUOTA',
+            parsed,
+            data
+        );
+    };
+
+    /**
+     * Checks if adding to the quota root goes over a limit
+     *
+     * @param {Object} added Added amounts, `{ MESSAGE, MAILBOX, bytes }`
+     * @return {Object|undefined} `{ code, text, soft }` for IMAPConnection#checkAppend, or nothing if within limits
+     */
+    const checkLimits = added => {
+        const limited = (added.MESSAGE && 'MESSAGE' in root.limits) || (added.bytes && 'STORAGE' in root.limits) || (added.MAILBOX && 'MAILBOX' in root.limits);
+        if (!limited) {
+            return;
+        }
+        const usage = getUsage();
+        const over =
+            (added.MESSAGE && 'MESSAGE' in root.limits && usage.MESSAGE + added.MESSAGE > root.limits.MESSAGE) ||
+            (added.bytes && 'STORAGE' in root.limits && usage.bytes + added.bytes > root.limits.STORAGE * 1024) ||
+            (added.MAILBOX && 'MAILBOX' in root.limits && usage.MAILBOX + added.MAILBOX > root.limits.MAILBOX);
+        if (!over) {
+            return;
+        }
+        // RFC 9208 section 4.3.1 and RFC 5530 section 3
+        return root.soft ? { code: 'OVERQUOTA', text: 'Soft quota has been exceeded', soft: true } : { code: 'OVERQUOTA', text: 'Quota exceeded' };
+    };
+
+    // APPEND, COPY, MOVE and REPLACE
+    server.appendChecks.push((connection, mailbox, messages, options) => {
+        if (!messages.length || !inRoot(mailbox)) {
+            return;
+        }
+        if (options.move && options.source && inRoot(options.source)) {
+            // moving within the quota root does not change the usage
+            return;
+        }
+        const added = { MESSAGE: messages.length, bytes: totalSize(messages) };
+        // RFC 8508 section 3.4: REPLACE counts only the net usage, the replaced message is removed
+        if (options.replaced && connection.selectedMailbox && inRoot(connection.selectedMailbox)) {
+            added.MESSAGE--;
+            added.bytes -= totalSize([options.replaced]);
+        }
+        return checkLimits(added);
+    });
+
+    // Number of mailboxes that CREATE adds, missing parent mailboxes are created as well
+    const countNewMailboxes = path => {
+        const target = server.getMailbox(server.stripSeparator(path, server.getSeparator(path)));
+        let count = !target || !isSelectable(target) ? 1 : 0;
+        for (let parent = server.getParentPath(path); parent; parent = server.getParentPath(parent)) {
+            if (!server.getMailbox(parent)) {
+                count++;
+            }
+        }
+        return count;
+    };
+
+    // The MAILBOX resource limits CREATE and RENAME INBOX (which creates a mailbox)
+    const wrapCreate = (command, getPath) => {
+        const prevHandler = server.getCommandHandler(command);
+        server.setCommandHandler(command, (connection, parsed, data, callback) => {
+            const path = getPath(parsed.attributes);
+            if (
+                typeof path === 'string' &&
+                path.toUpperCase() !== 'INBOX' &&
+                inRoot(path) &&
+                !connection.applyChecks([checkLimits({ MAILBOX: countNewMailboxes(path) })], parsed, data, command + ' FAILED')
+            ) {
+                return callback();
+            }
+            prevHandler(connection, parsed, data, callback);
+        });
+    };
+
+    const argValue = (attributes, i) => isAstring((attributes || [])[i]) && attributes[i].value;
+
+    wrapCreate('CREATE', attributes => (attributes && attributes.length === 1 ? argValue(attributes, 0) : false));
+    wrapCreate('RENAME', attributes => {
+        const source = argValue(attributes, 0);
+        // only RENAME INBOX adds a mailbox, other renames keep the count (RFC 3501 section 6.3.5)
+        return attributes && attributes.length === 2 && typeof source === 'string' && source.toUpperCase() === 'INBOX' ? argValue(attributes, 1) : false;
+    });
+
+    // RFC 9208 section 4.1.1: GETQUOTA quota-root-name
+    server.setCommandHandler(
+        'GETQUOTA',
+        (connection, parsed, data, callback) => {
+            if (!parsed.attributes || parsed.attributes.length !== 1 || !isAstring(parsed.attributes[0])) {
+                connection.sendStatus(parsed, data, 'BAD', 'GETQUOTA expects a quota root name');
+                return callback();
+            }
+            if (parsed.attributes[0].value !== root.name) {
+                connection.sendStatus(parsed, data, 'NO', 'Quota root does not exist', 'NONEXISTENT');
+                return callback();
+            }
+            sendQuota(connection, parsed, data);
+            connection.sendStatus(parsed, data, 'OK', 'GETQUOTA completed');
+            return callback();
+        },
+        // quota-root = astring (RFC 9208 section 9)
+        { states: states.AUTHENTICATED, astringArguments: [0] }
+    );
+
+    // RFC 9208 section 4.1.2: GETQUOTAROOT mailbox, the mailbox does not have to exist
+    server.setCommandHandler(
+        'GETQUOTAROOT',
+        (connection, parsed, data, callback) => {
+            if (!parsed.attributes || parsed.attributes.length !== 1 || !isAstring(parsed.attributes[0])) {
+                connection.sendStatus(parsed, data, 'BAD', 'GETQUOTAROOT expects a mailbox name');
+                return callback();
+            }
+            let path = parsed.attributes[0].value;
+            if (path.toUpperCase() === 'INBOX') {
+                path = 'INBOX';
+            }
+            const hasRoot = inRoot(path);
+            connection.send(
+                {
+                    tag: '*',
+                    command: 'QUOTAROOT',
+                    attributes: [{ type: 'MAILBOX', value: path }].concat(hasRoot ? { type: 'STRING', value: root.name } : [])
+                },
+                'QUOTAROOT',
+                parsed,
+                data
+            );
+            if (hasRoot) {
+                sendQuota(connection, parsed, data);
+            }
+            connection.sendStatus(parsed, data, 'OK', 'GETQUOTAROOT completed');
+            return callback();
+        },
+        { states: states.AUTHENTICATED, mailboxArguments: [0] }
+    );
+
+    // RFC 9208 section 4.1.3: SETQUOTA quota-root-name setquota-list, the new limits replace all earlier ones
+    server.setCommandHandler(
+        'SETQUOTA',
+        (connection, parsed, data, callback) => {
+            const list = parsed.attributes && parsed.attributes[1];
+            if (!parsed.attributes || parsed.attributes.length !== 2 || !isAstring(parsed.attributes[0]) || !Array.isArray(list) || list.length % 2) {
+                connection.sendStatus(parsed, data, 'BAD', 'SETQUOTA expects a quota root name and a list of resource limits');
+                return callback();
+            }
+
+            const limits = {};
+            for (let i = 0; i < list.length; i += 2) {
+                const name = list[i];
+                const limit = list[i + 1];
+                // setquota-resource = resource-name SP resource-limit, resource-limit = number64
+                if (!name || name.type !== 'ATOM' || !limit || limit.type !== 'ATOM' || !isNumber(limit.value, MAX_NUMBER64)) {
+                    connection.sendStatus(parsed, data, 'BAD', 'Invalid resource limit');
+                    return callback();
+                }
+                const resource = name.value.toUpperCase();
+                if (RESOURCES.indexOf(resource) < 0 || resource in limits) {
+                    connection.sendStatus(parsed, data, 'NO', 'Can not set a limit for ' + resource, 'CANNOT');
+                    return callback();
+                }
+                const value = Number(limit.value);
+                if (!Number.isSafeInteger(value)) {
+                    connection.sendStatus(parsed, data, 'NO', 'Limit is too large for ' + resource, 'LIMIT');
+                    return callback();
+                }
+                limits[resource] = value;
+            }
+
+            // new quota roots can not be created
+            if (parsed.attributes[0].value !== root.name) {
+                connection.sendStatus(parsed, data, 'NO', 'Quota root does not exist', 'NONEXISTENT');
+                return callback();
+            }
+
+            root.limits = limits;
+            sendQuota(connection, parsed, data);
+            connection.sendStatus(parsed, data, 'OK', 'SETQUOTA completed');
+            return callback();
+        },
+        // quota-root = astring (RFC 9208 section 9)
+        { states: states.AUTHENTICATED, astringArguments: [0] }
+    );
+
+    // RFC 9208 section 4.1.4: DELETED (the built-in item, required with QUOTA=RES-MESSAGE) and DELETED-STORAGE
+    // (required with QUOTA=RES-STORAGE), the storage EXPUNGE would free as the sum of RFC822.SIZE
+    ['DELETED', 'DELETED-STORAGE'].forEach(item => {
+        if (server.allowedStatus.indexOf(item) < 0) {
+            server.allowedStatus.push(item);
+        }
+    });
+    server.statusHandlers['DELETED-STORAGE'] = (connection, mailbox) => totalSize(mailbox.messages.filter(message => message.flags.indexOf('\\Deleted') >= 0));
+};

package/lib/plugins/replace.js

@@ -0,0 +1,145 @@
+'use strict';
+
+const { prepareAppend, storeMessages } = require('../commands/append');
+const { states } = require('../command-states');
+const { isNzNumber } = require('../numbers');
+
+// RFC 8508 section 5 and RFC 3501 section 9: seq-number = nz-number / "*"
+const isSeqNumber = value => value === '*' || isNzNumber(value);
+
+/**
+ * @help Adds REPLACE [RFC8508] capability (REPLACE and UID REPLACE commands)
+ *
+ * REPLACE: https://www.rfc-editor.org/rfc/rfc8508
+ *
+ * Additional commands:
+ * - REPLACE
+ * - UID REPLACE
+ *
+ * The new message is appended and the old one expunged as a single action. With UIDPLUS the
+ * APPENDUID response code is sent in an untagged OK before the EXPUNGE. Works with CATENATE.
+ */
+module.exports = function (server) {
+    server.registerCapability('REPLACE');
+
+    const replaceHandler = function (uidMode, connection, parsed, data, callback) {
+        const command = uidMode ? 'UID REPLACE' : 'REPLACE';
+        const args = [].concat(parsed.attributes || []);
+        const id = args.shift();
+        const pathArg = args.shift();
+
+        // RFC 8508 section 5: replace = "REPLACE" SP seq-number SP mailbox append-message
+        if (!id || ['ATOM', 'SEQUENCE'].indexOf(id.type) < 0 || !isSeqNumber(String(id.value))) {
+            connection.sendStatus(parsed, data, 'BAD', command + ' expects a message number, a mailbox name and a message', false, 'INVALID COMMAND');
+            return callback();
+        }
+
+        const found = findMessage(connection, uidMode, id.value);
+        if (found.error) {
+            connection.sendStatus(
+                parsed,
+                data,
+                found.error.command,
+                found.error.text,
+                found.error.code || false,
+                found.error.command === 'BAD' ? 'INVALID COMMAND' : command + ' FAILED'
+            );
+            return callback();
+        }
+        const message = found.message;
+
+        // RFC 8508 section 4.7: REPLACE takes a single message even with MULTIAPPEND. Nothing is
+        // changed if the new message can not be appended (section 3.4)
+        const prepared = prepareAppend(connection, parsed, data, pathArg, args, { command, maxMessages: 1, replaced: message });
+        if (!prepared) {
+            return callback();
+        }
+
+        const result = storeMessages(connection, prepared);
+
+        // Hook for UIDPLUS to send APPENDUID in an untagged OK before the EXPUNGE
+        // (RFC 8508 section 4.3). If UIDPLUS is not loaded, this is not sent
+        connection.send(
+            {
+                tag: '*',
+                command: 'OK',
+                attributes: [
+                    {
+                        type: 'TEXT',
+                        value: 'Replacement message saved'
+                    }
+                ],
+                skipResponse: true
+            },
+            'REPLACE APPENDUID',
+            parsed,
+            data,
+            result
+        );
+
+        // only the replaced message is expunged, not every \Deleted message (RFC 8508 section 3.4).
+        // When the new message went to the selected mailbox, it was already announced with EXISTS
+        connection.expungeSpecificMessages(connection.selectedMailbox, [message], false, true);
+
+        connection.sendStatus(parsed, data, 'OK', command + ' completed', false, command);
+        callback();
+    };
+
+    // Refuse the literal of the new message when the message to replace is already known to be
+    // invalid, unless earlier commands are still running and could change the selected mailbox
+    server.literalFilters.push((connection, command, line) => {
+        if ((command !== 'REPLACE' && command !== 'UID REPLACE') || connection.isBusy()) {
+            return false;
+        }
+        const match = line.match(/^\S+ (?:UID )?REPLACE ([^ ]+) /i);
+        return (match && isSeqNumber(match[1]) && findMessage(connection, command === 'UID REPLACE', match[1]).error) || false;
+    });
+
+    // RFC 8508 section 3.5: valid only in the selected state, the second argument is the target mailbox
+    // the message can be a literal8 with BINARY: RFC 8508 section 6 uses append-message, whose append-data
+    // is a literal8 too (RFC 4466 section 2.7)
+    // REPLACE takes a message sequence number, UID REPLACE a UID
+    const options = { states: states.SELECTED, mailboxArguments: [1], literal8: 'BINARY', appendMessage: true };
+    server.setCommandHandler('REPLACE', replaceHandler.bind(null, false), Object.assign({ sequenceSet: 0 }, options));
+    server.setCommandHandler('UID REPLACE', replaceHandler.bind(null, true), options);
+};
+
+/**
+ * Finds the message to replace in the selected mailbox
+ *
+ * @param {Object} connection IMAPConnection
+ * @param {Boolean} uidMode If true, the value is a UID, otherwise a sequence number
+ * @param {String} value seq-number, a number or "*"
+ * @return {Object} `{ message }`, or `{ error: { command, text } }` if there is no such message
+ */
+function findMessage(connection, uidMode, value) {
+    // sequence numbers refer to the message list this session knows about
+    const messages = connection.getSessionMessages();
+    let message;
+    if (uidMode) {
+        // "*" is the UID of the last message (RFC 3501 section 9, seq-number)
+        const uid = value === '*' ? (messages.length ? messages[messages.length - 1].uid : 0) : Number(value);
+        message = messages.find(item => item.uid === uid);
+    } else {
+        const seq = value === '*' ? messages.length : Number(value);
+        // RFC 3501 section 9, seq-number: a sequence number greater than the number of messages
+        // (or "*" in an empty mailbox) gets a tagged BAD
+        if (!seq || seq > messages.length) {
+            return { error: { command: 'BAD', text: 'Invalid message sequence number' } };
+        }
+        message = messages[seq - 1];
+    }
+
+    // RFC 8508 section 3.2: NO - can't remove specified message
+    if (!message || message.ghost) {
+        return { error: { command: 'NO', text: 'No such message' } };
+    }
+
+    // the old message is expunged, which is not allowed after EXAMINE
+    const readOnly = connection.readOnlyRefusal();
+    if (readOnly) {
+        return { error: readOnly };
+    }
+
+    return { message };
+}

package/lib/plugins/sasl-ir.js

@@ -0,0 +1,12 @@
+'use strict';
+
+/**
+ * @help Enables SASL-IR [RFC4959] capability
+ */
+
+module.exports = function (server) {
+    // Register capability, usable for non authenticated users
+    server.registerCapability('SASL-IR', connection => {
+        return connection.state === 'Not Authenticated';
+    });
+};

package/lib/plugins/savedate.js

@@ -0,0 +1,59 @@
+'use strict';
+
+const { getDateKey } = require('../commands/handlers/search');
+
+/**
+ * @help Adds SAVEDATE [RFC8514] capability
+ * @help Every message gets a save date when it is added to a mailbox (APPEND,
+ * @help COPY, MOVE, and when the storage is loaded), messages in storage can
+ * @help set it with a "SAVEDATE" value. A mailbox with "SAVEDATE": false in
+ * @help storage does not support save dates, FETCH returns NIL for its messages
+ *
+ * SAVEDATE: https://www.rfc-editor.org/rfc/rfc8514.txt
+ *
+ * Additional FETCH items:
+ * - SAVEDATE
+ *
+ * Additional SEARCH keys:
+ * - SAVEDBEFORE, SAVEDON, SAVEDSINCE, SAVEDATESUPPORTED
+ */
+module.exports = function (server) {
+    server.registerCapability('SAVEDATE');
+
+    // RFC 8514 section 3: storage may lack save dates for some mailboxes
+    const isSupported = mailbox => !!mailbox && mailbox.SAVEDATE !== false;
+
+    // RFC 8514 section 3: the save date is the current time when the message is saved in a mailbox, it is
+    // never copied from the source message. Messages from storage may bring their own value.
+    server.messageHandlers.push((server, message, mailbox) => {
+        if (!isSupported(mailbox)) {
+            delete message.SAVEDATE;
+            return;
+        }
+
+        const savedate = server.normalizeDateTime(message.SAVEDATE || new Date());
+        if (!server.validateInternalDate(savedate)) {
+            throw new Error('Invalid SAVEDATE value ' + JSON.stringify(savedate) + ' in mailbox ' + mailbox.path);
+        }
+        message.SAVEDATE = savedate;
+    });
+
+    // RFC 8514 section 4.2: date-time, or NIL if the mailbox does not support save dates
+    server.fetchHandlers.SAVEDATE = (connection, message) => message.SAVEDATE || null;
+
+    const dateKey = (name, compare) => {
+        const handler = (connection, message, index, date) => {
+            // RFC 8514 section 4.3: without save dates the internal date is used instead
+            const saved = getDateKey(message.SAVEDATE || message.internaldate);
+            return !!saved && compare(saved, date);
+        };
+        handler.argumentTypes = () => ['date'];
+        server.searchHandlers[name] = handler;
+    };
+
+    dateKey('SAVEDBEFORE', (saved, date) => saved < date);
+    dateKey('SAVEDON', (saved, date) => saved === date);
+    dateKey('SAVEDSINCE', (saved, date) => saved >= date);
+
+    server.searchHandlers.SAVEDATESUPPORTED = connection => isSupported(connection.selectedMailbox);
+};

package/lib/plugins/savelimit.js

@@ -0,0 +1,18 @@
+'use strict';
+
+const { getLimit, addSaveLimit } = require('./messagelimit');
+
+/**
+ * @help Adds SAVELIMIT [RFC9738] capability, advertised as SAVELIMIT=<n>
+ * @help Server option "messageLimit" sets n (default 1000). COPY and APPEND (MULTIAPPEND)
+ * @help of more messages fail with NO [MESSAGELIMIT ...], other commands are not limited.
+ * @help Can not be loaded with MESSAGELIMIT
+ *
+ * SAVELIMIT: https://www.rfc-editor.org/rfc/rfc9738
+ */
+module.exports = function (server) {
+    // RFC 9738 section 3: a server that only limits COPY and APPEND (and their UID variants) advertises SAVELIMIT
+    const limit = getLimit(server, 'SAVELIMIT');
+    server.registerCapability('SAVELIMIT=' + limit);
+    addSaveLimit(server, limit);
+};

package/lib/plugins/searchres.js

@@ -0,0 +1,82 @@
+'use strict';
+
+/**
+ * @help Adds SEARCHRES [RFC5182] capability, loads ESEARCH as well
+ * @help SEARCH RETURN (SAVE) stores the result, "$" refers to it in place of a sequence set
+ */
+
+const esearch = require('./esearch');
+const { selectReturned } = require('../esearch');
+
+// Commands after which the search result variable is empty (RFC 5182 section 2.1). After CLOSE and
+// UNSELECT no mailbox is selected, so "$" can not be used until the next SELECT or EXAMINE anyway
+const RESET_COMMANDS = new Set(['SELECT', 'EXAMINE', 'CLOSE', 'UNSELECT']);
+
+// SAVE also applies to commands based on SEARCH, like SORT (RFC 5182 section 1) with ESORT
+// and to the ESEARCH command of MULTISEARCH, which leaves the messages to save in `parsed.searchresFound`
+const isSearch = command => ['SEARCH', 'UID SEARCH', 'SORT', 'UID SORT', 'ESEARCH'].includes(command);
+
+module.exports = function (server) {
+    // a SEARCHRES server MUST also implement ESEARCH (RFC 5182 section 2.1)
+    esearch(server);
+
+    server.registerCapability('SEARCHRES');
+    // SAVE adds no data to the ESEARCH response
+    server.searchReturnOptions.set('SAVE', { data: false });
+
+    server.connectionHandlers.push(connection => {
+        // RFC 5182 section 3: sequence-set =/ seq-last-command, seq-last-command = "$". Dovecot only accepts
+        // "$" as the whole sequence set, not combined with numbers like "1,$", and neither does ImapKit
+        const getMessageRange = connection.getMessageRange;
+        connection.getMessageRange = function (range, isUid) {
+            if (range !== '$') {
+                return getMessageRange.call(this, range, isUid);
+            }
+            // The search result variable holds message objects, so expunged messages drop out of it without
+            // renumbering, and it is the same set for UID and sequence number commands (RFC 5182 section 2.1).
+            // As "$" holds no sequence numbers, core lets it be pipelined (RFC 5182 section 2.3)
+            const saved = this.searchResult || new Set();
+            const result = [];
+            this.getSessionMessages().forEach((message, i) => {
+                if (saved.has(message)) {
+                    result.push([i + 1, message]);
+                }
+            });
+            return result;
+        };
+    });
+
+    // RFC 8437 section 4.1: after UNAUTHENTICATE "$" represents the empty set
+    server.resetHandlers.push(connection => {
+        connection.searchResult = null;
+    });
+
+    server.outputHandlers.push((connection, response, description, parsed, data, extra) => {
+        if (!parsed || !response || (response.tag !== parsed.tag && response.command !== 'SEARCH' && response.command !== 'SORT')) {
+            return;
+        }
+        const command = (parsed.command || '').toUpperCase();
+        const save = isSearch(command) && parsed.searchReturn && parsed.searchReturn.has('SAVE');
+
+        // the result of SEARCH, with MIN and/or MAX only these messages are saved (RFC 5182 section 2.4).
+        // It is stored once the tagged response tells if the command succeeded
+        if (save && response.tag === '*' && ['SEARCH', 'SORT'].includes(response.command) && description === command && extra && Array.isArray(extra.list)) {
+            parsed.searchresFound = selectReturned(extra.sorted || extra.list, parsed.searchReturn);
+            return;
+        }
+
+        if (response.tag !== parsed.tag) {
+            return;
+        }
+
+        if (RESET_COMMANDS.has(command)) {
+            connection.searchResult = null;
+            return;
+        }
+
+        // RFC 5182 section 2.1: an OK sets the variable, a NO empties it and a BAD leaves it as it was
+        if (save && response.command !== 'BAD') {
+            connection.searchResult = new Set(response.command === 'OK' ? parsed.searchresFound : []);
+        }
+    });
+};

package/lib/plugins/sort-display.js

@@ -0,0 +1,23 @@
+'use strict';
+
+const { collationKey, displayAddress } = require('../sorting');
+const sort = require('./sort');
+
+/**
+ * @help Adds SORT=DISPLAY [RFC5957] capability, also loads SORT
+ *
+ * SORT=DISPLAY: https://tools.ietf.org/html/rfc5957
+ *
+ * Additional sort keys for SORT and UID SORT:
+ * - DISPLAYFROM
+ * - DISPLAYTO
+ */
+module.exports = function (server) {
+    // RFC 5957 section 1: SORT=DISPLAY means the full SORT extension plus both sort keys
+    sort(server);
+    server.registerCapability('SORT=DISPLAY');
+
+    // RFC 5957 section 4: the DISPLAY sort value of the first address of env-from and env-to
+    server.sortKeys.DISPLAYFROM = message => collationKey(displayAddress(message, 'from'));
+    server.sortKeys.DISPLAYTO = message => collationKey(displayAddress(message, 'to'));
+};