imapkit 4.0.3 → 4.1.0

package/dist/cjs/server.js

@@ -0,0 +1,2597 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IMAPConnection = exports.IMAPServer = exports.TAG_REGEX = void 0;
+exports.default = server;
+const node_stream_1 = require("node:stream");
+const node_net_1 = __importDefault(require("node:net"));
+const node_tls_1 = __importDefault(require("node:tls"));
+const imap_handler_1 = __importDefault(require("imap-handler"));
+const formal_1 = __importDefault(require("imap-handler/lib/formal"));
+const load_plugins_js_1 = __importDefault(require("./load-plugins.js"));
+const index_js_1 = require("./commands/index.js");
+const command_states_js_1 = require("./command-states.js");
+const mailbox_name_js_1 = __importDefault(require("./mailbox-name.js"));
+const dates_js_1 = require("./dates.js");
+const fetch_js_1 = __importDefault(require("./commands/handlers/fetch.js"));
+const search_js_1 = require("./commands/handlers/search.js");
+const numbers_js_1 = require("./numbers.js");
+const arguments_js_1 = require("./arguments.js");
+const append_js_1 = require("./commands/append.js");
+const bundledCert = __importStar(require("./cert.js"));
+// longest command line (not counting literals) accepted from a client
+const MAX_LINE_LENGTH = 1024 * 1024;
+// largest literal accepted after login, override with the maxLiteralSize option
+const MAX_LITERAL_SIZE = 64 * 1024 * 1024;
+// largest literal accepted before login, enough for any user name or password
+const MAX_PREAUTH_LITERAL_SIZE = 64 * 1024;
+const LITERAL_TOO_LARGE = 'Literal too large';
+// status responses, their text must follow the RFC 3501 section 9 resp-text rules
+const STATUS_RESPONSES = new Set(['OK', 'NO', 'BAD', 'BYE', 'PREAUTH']);
+// RFC 3501 section 9: tag = 1*<any ASTRING-CHAR except "+">
+const TAG_REGEX = new RegExp('^[' + formal_1.default.tag().replace(/[\\\]^-]/g, '\\$&') + ']+$');
+exports.TAG_REGEX = TAG_REGEX;
+// RFC 3501 section 9: atom = 1*ATOM-CHAR
+const ATOM_CHARS = '[' + formal_1.default['ATOM-CHAR']().replace(/[\\\]^-]/g, '\\$&') + ']+';
+const ATOM_REGEX = new RegExp('^' + ATOM_CHARS + '$');
+// RFC 3501 section 9: a command name, and the second word of UID and AUTHENTICATE, is an atom
+const COMMAND_REGEX = new RegExp('^' + ATOM_CHARS + '( ' + ATOM_CHARS + ')?$');
+// RFC spelling of the mailbox attributes the server checks or computes (RFC 3501 section 7.2.2, RFC 3348
+// section 3, RFC 5258 section 3), keyed by lowercase name
+const MAILBOX_ATTRIBUTES = new Map(['\\Noinferiors', '\\Noselect', '\\Marked', '\\Unmarked', '\\HasChildren', '\\HasNoChildren', '\\NonExistent'].map(flag => [flag.toLowerCase(), flag]));
+/**
+ * Returns the tag to use when answering a raw command line that could not be parsed. A line
+ * without a valid tag is answered untagged, a client could not parse the invalid tag anyway.
+ *
+ * @param {String} line Raw command line
+ * @return {String} tag or "*"
+ */
+function getResponseTag(line) {
+    // only SP separates the tag (RFC 3501 section 9: command = tag SP ...)
+    const space = line.indexOf(' ');
+    const tag = space >= 0 ? line.substr(0, space) : line;
+    return tag && TAG_REGEX.test(tag) ? tag : '*';
+}
+/**
+ * Text for a command that is not valid in the current connection state
+ *
+ * @param {String} command Upper case command name
+ * @param {String} state Connection state
+ * @return {String} Error text
+ */
+function stateError(command, state) {
+    return command + ' is not allowed in the ' + state + ' state';
+}
+/**
+ * Creates an error for a failed mailbox operation, with a RFC 5530 response code
+ *
+ * @param {String} message Error message
+ * @param {String} code Response code, e.g. "ALREADYEXISTS"
+ * @return {Error} Error object
+ */
+function mailboxError(message, code) {
+    const err = new Error(message);
+    err.code = code;
+    return err;
+}
+/**
+ * Creates a new IMAP server, call `listen()` on it to start accepting connections
+ *
+ * @param options Server options, the mailbox tree comes from `options.storage`
+ * @return Server instance
+ */
+function server(options) {
+    return new IMAPServer(options);
+}
+class IMAPServer extends node_stream_1.Stream {
+    constructor(options) {
+        super();
+        // shallow copy, so that the caller's options object is never modified
+        this.options = Object.assign({}, options);
+        if (this.options.secureConnection) {
+            this.server = node_tls_1.default.createServer(this.getCredentials(), this.createClient.bind(this));
+        }
+        else {
+            this.server = node_net_1.default.createServer(this.createClient.bind(this));
+        }
+        // every connection listens to the notify event
+        this.setMaxListeners(0);
+        this.connections = new Set();
+        this.connectionHandlers = [];
+        // run when a connection returns to the Not Authenticated state (UNAUTHENTICATE), each one
+        // clears the per-session state its plugin keeps on the connection
+        this.resetHandlers = [];
+        this.outputHandlers = [];
+        this.messageHandlers = [];
+        this.fetchHandlers = {};
+        this.fetchFilters = [];
+        this.searchHandlers = {};
+        this.storeHandlers = {};
+        this.storeFilters = [];
+        // `filter(connection, notification)` functions, a notification only reaches connections they all accept
+        this.notifyFilters = [];
+        // run on every mailbox in processMailbox, like messageHandlers for messages
+        this.mailboxHandlers = [];
+        // consulted before messages are added to a mailbox by APPEND, COPY or MOVE, see IMAPConnection#checkAppend
+        this.appendChecks = [];
+        // carry properties over when a message is copied to another mailbox (COPY, MOVE, RENAME INBOX), see copyMessage
+        this.copyHandlers = [];
+        // append-data extensions such as CATENATE (RFC 4466 section 2.7), and checks that can refuse
+        // a synchronizing literal before it is read, see IMAPConnection#checkLiteral
+        this.appendDataHandlers = Object.create(null);
+        // APPEND and REPLACE to a mailbox that does not exist are refused before the message is sent
+        this.literalFilters = [append_js_1.refuseMissingTarget];
+        // can refuse IMAP URLs that read a mailbox (CATENATE), `(connection, mailbox, url)` returns `{ text }` to refuse
+        this.urlAccessChecks = [];
+        // can leave mailboxes out of a search of several mailboxes (ESEARCH of MULTISEARCH), `(connection, mailbox, named)`
+        // returns false for a mailbox that is skipped, `named` is true if the client gave its name
+        this.searchAccessChecks = [];
+        // run before a command handler, `(connection, parsed)` returns `{ command, code, text }` to refuse the command
+        // (e.g. commands with message sequence numbers after ENABLE UIDONLY), see IMAPConnection#processQueue
+        this.commandChecks = [];
+        // `(connection, parsed, range)` functions that can cut the messages that FETCH, STORE, COPY, MOVE and UID EXPUNGE
+        // (and the UID variants) operate on, e.g. MESSAGELIMIT. See IMAPConnection#limitRange
+        this.rangeLimits = [];
+        // `(connection, messages, query)` functions that can narrow down the messages a SEARCH (or SORT, THREAD) looks
+        // at by returning a shorter list, e.g. MESSAGELIMIT. See commands/handlers/search.ts
+        this.searchLimits = [];
+        // `check(connection)` functions, SELECT and EXAMINE send `* OK [CLOSED]` when they close the selected mailbox
+        // if any of them is true (CONDSTORE, RFC 7162 section 3.2.11, IMAP4rev2, RFC 9051 section 6.3.2)
+        this.closedChecks = [];
+        // set by MULTIAPPEND (RFC 3502), otherwise APPEND takes a single message
+        this.multiAppend = false;
+        // the built-in handlers, setCommandHandler replaces them. Without a prototype, a command name like
+        // "TOSTRING" never finds an inherited function
+        this.commandHandlers = Object.assign(Object.create(null), index_js_1.commands);
+        // options of commands that plugins add, core commands are listed in command-states.ts
+        this.commandOptions = Object.create(null);
+        this.capabilities = {};
+        this.allowedStatus = ['MESSAGES', 'RECENT', 'UIDNEXT', 'UIDVALIDITY', 'UNSEEN'];
+        // values of STATUS items that plugins add, consulted before the built-in items in commands/handlers/status.ts
+        this.statusHandlers = {};
+        // non-synchronizing literals {n+} are accepted when literalPlus is set (LITERAL+ and LITERAL-),
+        // up to nonSyncLiteralLimit octets (4096 for LITERAL-, RFC 7888 section 5)
+        this.literalPlus = false;
+        this.nonSyncLiteralLimit = Infinity;
+        // extra options for the imap-handler command parser, e.g. literal8 for BINARY
+        this.parserOptions = {
+            // items that take a [section] and <partial>, the imap-handler default
+            allowSection: ['BODY', 'BODY.PEEK']
+        };
+        this.referenceNamespace = false;
+        // the session whose command is running, see IMAPServer#notify
+        this.activeConnection = null;
+        // users and storage are deep copied, so that runtime changes never leak into
+        // the caller's objects or into other servers built from the same fixture.
+        // Without a prototype, user names like "__proto__" or "toString" are plain keys
+        this.users = Object.assign(Object.create(null), this.options.users
+            ? structuredClone(this.options.users)
+            : {
+                testuser: {
+                    password: 'testpass',
+                    xoauth2: {
+                        accessToken: 'testtoken',
+                        sessionTimeout: 3600 * 1000
+                    }
+                }
+            });
+        (0, load_plugins_js_1.default)(this, this.options.plugins);
+        this.systemFlags = [].concat(this.options.systemFlags || ['\\Answered', '\\Flagged', '\\Draft', '\\Deleted', '\\Seen']);
+        // indexFolders() below turns the storage option into namespaces and mailboxes in place
+        this.storage = (this.options.storage
+            ? structuredClone(this.options.storage)
+            : {
+                INBOX: {},
+                '': {}
+            });
+        this.uidvalidityCounter = 0; // highest UIDVALIDITY in use, new mailboxes get a higher one
+        // subscribed mailbox names (RFC 3501 section 6.3.6). Names, not mailboxes: a subscription outlives
+        // DELETE and stays with the old name on RENAME (RFC 9051 section 6.3.6), see trackSubscription
+        this.subscriptions = new Set();
+        this.folderCache = Object.create(null);
+        this.indexFolders(true);
+    }
+    listen(...args) {
+        this.server.listen.apply(this.server, args);
+    }
+    close(callback) {
+        this.server.close(callback);
+        // close() only completes once all connections are gone
+        this.connections.forEach((connection) => {
+            if (connection.socket) {
+                connection.socket.destroy();
+            }
+        });
+    }
+    /**
+     * Returns TLS key and certificate. Without credentials in the options the
+     * bundled self-signed certificate for localhost is used.
+     *
+     * @return {Object} TLS options
+     */
+    getCredentials() {
+        if (!this.options.credentials) {
+            this.options.credentials = {
+                key: bundledCert.key,
+                cert: bundledCert.cert
+            };
+        }
+        return this.options.credentials;
+    }
+    address() {
+        return this.server.address();
+    }
+    createClient(socket) {
+        const connection = new IMAPConnection(this, socket);
+        this.connectionHandlers.forEach(handler => {
+            handler(connection);
+        });
+    }
+    registerCapability(keyword, handler) {
+        this.capabilities[keyword] =
+            handler ||
+                function () {
+                    return true;
+                };
+    }
+    /**
+     * Sets the handler of a command
+     *
+     * @param {String} command Command name, e.g. "UID MOVE"
+     * @param {Function} handler Command handler `(connection, parsed, data, callback)`
+     * @param {Object|Array} [options] `{ states, noArguments, mailboxArguments, astringArguments, searchCriteria, sequenceSet,
+     *   noExpunge, literal8, noPipelining }`: the connection states the command is valid in (any state if not set), if it takes
+     *   no arguments, the positions of its mailbox name arguments and of its other astring arguments, the position where its search criteria start, the position of its argument
+     *   with message sequence numbers, if EXPUNGE responses
+     *   are not allowed while it runs, if it accepts literal8 arguments (true, or the name of the capability that
+     *   allows them), and if it is refused when the client sent more input after it. A list is read as the states.
+     *   Without options, a command keeps its earlier settings
+     */
+    setCommandHandler(command, handler, options) {
+        command = (command || '').toString().toUpperCase();
+        this.commandHandlers[command] = handler;
+        if (options) {
+            this.commandOptions[command] = (0, command_states_js_1.commandOptions)(options);
+        }
+    }
+    /**
+     * Returns the options of a command, see setCommandHandler
+     *
+     * @param {String} command Command name
+     * @return {Object} the command options, see setCommandHandler, states is false if any state is fine
+     */
+    getCommandOptions(command) {
+        command = (command || '').toString().toUpperCase();
+        return this.commandOptions[command] || (0, command_states_js_1.getCommandOptions)(command) || (0, command_states_js_1.commandOptions)();
+    }
+    /**
+     * Returns the connection states a command may be used in. Public API for custom plugins (see README), the server
+     * itself reads getCommandOptions
+     *
+     * @param {String} command Command name
+     * @return {Array|Boolean} List of states, or false if any state is fine
+     */
+    getCommandStates(command) {
+        return this.getCommandOptions(command).states;
+    }
+    /**
+     * Returns a user account
+     *
+     * @param {String} username User name
+     * @return {Object|false} User data or false if there is no such user
+     */
+    getUser(username) {
+        return (typeof username === 'string' && this.users[username]) || false;
+    }
+    /**
+     * Returns a mailbox object from folderCache
+     *
+     * @param {String} path Pathname for the mailbox
+     * @return {Object} mailbox object or undefined
+     */
+    getMailbox(path) {
+        if (path.toUpperCase() === 'INBOX') {
+            return this.folderCache.INBOX;
+        }
+        return this.folderCache[path];
+    }
+    /**
+     * Schedules a notifying message
+     *
+     * @param {Object} command An object of untagged response message
+     * @param {Object|String} mailbox Mailbox the message is related to
+     * @param {Object} ignoreConnection if set the selected connection ignores this notification
+     * @param {Function} [filter] if set, only connections for which `filter(connection)` is true get the notification
+     */
+    notify(command, mailbox, ignoreConnection, filter) {
+        command.notification = true;
+        const event = {
+            command: command,
+            mailbox: mailbox,
+            ignoreConnection: ignoreConnection,
+            filter: filter,
+            // the session whose command caused the change, null for changes from outside (e.g. SMTP)
+            origin: this.activeConnection
+        };
+        this.emit('notify', event);
+    }
+    /**
+     * Tells plugins that a mailbox was created, deleted, renamed, subscribed or unsubscribed, with a
+     * `mailbox` event: `{ type, path, oldPath, mailbox, origin }`. `type` is "create", "delete", "rename",
+     * "subscribe" or "unsubscribe", `origin` is the session that made the change
+     *
+     * @param {String} type Kind of change
+     * @param {String} path Storage name of the mailbox
+     * @param {Object} [details] `{ oldPath, mailbox }`: the earlier name of a renamed mailbox, the mailbox
+     *   object that a DELETE removed
+     */
+    mailboxChanged(type, path, details) {
+        const event = Object.assign({ type, path, oldPath: null, mailbox: null }, details, { origin: this.activeConnection });
+        this.emit('mailbox', event);
+    }
+    /**
+     * Retrieves the handler of an IMAP command
+     *
+     * @param {String} command Command name
+     * @return {Function} handler for the specified command
+     */
+    getCommandHandler(command) {
+        return this.commandHandlers[(command || '').toString().toUpperCase()] || false;
+    }
+    /**
+     * Returns some useful information about a mailbox that can be used with STATUS, SELECT and EXAMINE
+     *
+     * @param {Object|String} mailbox Mailbox object or path
+     */
+    getStatus(path) {
+        const mailbox = typeof path === 'string' ? this.getMailbox(path) : path;
+        if (!mailbox) {
+            return false;
+        }
+        const flags = {};
+        let seen = 0;
+        let unseen = 0;
+        // flags stay defined in the mailbox once a message had them, see rememberFlags
+        const permanentFlags = [].concat(mailbox.permanentFlags || []);
+        (mailbox.knownFlags || []).forEach(flag => this.ensureFlag(permanentFlags, flag));
+        let recent = 0;
+        // \Recent sets of the sessions that have this mailbox selected
+        const recentSets = [];
+        this.connections.forEach(connection => {
+            if (connection.selectedMailbox === mailbox && connection.recent) {
+                recentSets.push(connection.recent);
+            }
+        });
+        mailbox.messages.forEach(message => {
+            if (message.flags.indexOf('\\Seen') < 0) {
+                unseen++;
+            }
+            else {
+                seen++;
+            }
+            if (message.recent || recentSets.some(set => set.has(message))) {
+                recent++;
+            }
+            message.flags.forEach(flag => {
+                if (!flags[flag]) {
+                    flags[flag] = 1;
+                }
+                else {
+                    flags[flag]++;
+                }
+                if (permanentFlags.indexOf(flag) < 0) {
+                    permanentFlags.push(flag);
+                }
+            });
+        });
+        return {
+            flags: flags,
+            seen: seen,
+            unseen: unseen,
+            recent: recent,
+            permanentFlags: permanentFlags
+        };
+    }
+    /**
+     * Validates a date value. Useful for validating APPEND dates
+     *
+     * @param {String} date Date value to be validated
+     * @return {Boolean} Returns true if the date string is in IMAP date-time format
+     */
+    validateInternalDate(date) {
+        if (!date || typeof date !== 'string') {
+            return false;
+        }
+        // date-time from RFC 3501 section 9, month names are case-insensitive like all ABNF strings
+        const match = date.match(/^( \d|\d\d)-(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)-(\d{4}) (\d{2}):(\d{2}):(\d{2}) [-+](\d{2})(\d{2})$/i);
+        if (!match) {
+            return false;
+        }
+        // the values must also make a real date and time
+        return ((0, dates_js_1.isRealDate)(match[1], (0, dates_js_1.monthIndex)(match[2]), match[3]) &&
+            Number(match[4]) < 24 &&
+            Number(match[5]) < 60 &&
+            Number(match[6]) < 61 &&
+            Number(match[8]) < 60);
+    }
+    /**
+     * Converts a date object to a valid date-time string format
+     *
+     * @param {Object} date Date object to be converted
+     * @return {String} Returns a valid date-time formatted string
+     */
+    formatInternalDate(date) {
+        const day = date.getDate();
+        const month = dates_js_1.MONTHS[date.getMonth()];
+        const year = date.getFullYear();
+        const hour = date.getHours();
+        const minute = date.getMinutes();
+        const second = date.getSeconds();
+        const tz = date.getTimezoneOffset();
+        const tzHours = Math.floor(Math.abs(tz) / 60);
+        const tzMins = Math.abs(tz) % 60;
+        return ((day < 10 ? '0' : '') +
+            day +
+            '-' +
+            month +
+            '-' +
+            year +
+            ' ' +
+            (hour < 10 ? '0' : '') +
+            hour +
+            ':' +
+            (minute < 10 ? '0' : '') +
+            minute +
+            ':' +
+            (second < 10 ? '0' : '') +
+            second +
+            ' ' +
+            (tz > 0 ? '-' : '+') +
+            (tzHours < 10 ? '0' : '') +
+            tzHours +
+            (tzMins < 10 ? '0' : '') +
+            tzMins);
+    }
+    /**
+     * Creates a mailbox with specified path
+     *
+     * @param {String} path Pathname for the mailbox
+     * @param {Object} [defaultMailbox] use this object as the mailbox to add instead of empty'
+     * @return {Object} the created mailbox
+     */
+    createMailbox(path, defaultMailbox) {
+        if (!path) {
+            throw mailboxError('Invalid mailbox name', 'CANNOT');
+        }
+        // Ensure case insensitive INBOX
+        if (path.toUpperCase() === 'INBOX') {
+            throw mailboxError('INBOX can not be modified', 'ALREADYEXISTS');
+        }
+        const { namespace, storage } = this.getPersonalNamespace(path);
+        path = this.stripSeparator(path, storage.separator);
+        if (this.folderCache[path] && this.folderCache[path].flags.indexOf('\\Noselect') < 0) {
+            throw mailboxError('Mailbox already exists', 'ALREADYEXISTS');
+        }
+        const folderPath = path.substr(namespace.length).split(storage.separator);
+        if (folderPath.some(name => !name)) {
+            // an empty hierarchy level ("foo//bar", "/foo", "foo//"). RFC 5530 section 3 has this very case as the
+            // example of CANNOT, Dovecot refuses it too
+            throw mailboxError('Mailbox names can not have empty hierarchy levels', 'CANNOT');
+        }
+        let parent = storage;
+        let curPath = namespace;
+        if (curPath) {
+            curPath = curPath.substr(0, curPath.length - storage.separator.length);
+        }
+        folderPath.forEach(folderName => {
+            curPath += (curPath.length ? storage.separator : '') + folderName;
+            let folder = this.getMailbox(curPath) || false;
+            if (folder && folder.flags && folder.flags.indexOf('\\Noinferiors') >= 0) {
+                throw mailboxError('Can not create subfolders for ' + folder.path, 'CANNOT');
+            }
+            // a \Noselect placeholder that is created again is replaced with a new mailbox that only keeps
+            // the children, nothing else of a deleted mailbox may come back (RFC 3501 section 6.3.3)
+            const isTarget = curPath === path;
+            const useDefault = isTarget && defaultMailbox;
+            if (!folder || useDefault || (isTarget && folder.flags.indexOf('\\Noselect') >= 0)) {
+                const children = folder && folder.folders;
+                // a recreated mailbox must never reuse an earlier UIDVALIDITY value
+                const created = useDefault ? defaultMailbox : { uidvalidity: ++this.uidvalidityCounter };
+                if (children) {
+                    created.folders = Object.assign({}, children, created.folders);
+                }
+                // a new mailbox is subscribed if its name is, a subscription is not part of the mailbox
+                this.trackSubscription(created);
+                this.processMailbox(curPath, created, namespace);
+                parent.folders = parent.folders || {};
+                parent.folders[folderName] = created;
+                this.folderCache[curPath] = created;
+                folder = created;
+            }
+            if (parent !== storage) {
+                // Remove \HasNoChildren and add \\HasChildren from parent. A \Noselect parent stays \Noselect,
+                // it already is the hierarchy level the new mailbox needs
+                this.setChildrenFlags(parent, true);
+            }
+            else if (folder.namespace === this.referenceNamespace && this.inboxHoldsNamespace()) {
+                this.setChildrenFlags(this.storage.INBOX, true);
+            }
+            parent = folder;
+        });
+        return this.folderCache[path];
+    }
+    /**
+     * Deletes a mailbox with specified path
+     *
+     * @param {String} path Pathname for the mailbox
+     * @param {boolean} keepContents If true do not delete messages
+     */
+    deleteMailbox(path, keepContents) {
+        // Ensure case insensitive INBOX
+        if (path.toUpperCase() === 'INBOX') {
+            throw mailboxError('INBOX can not be modified', 'CANNOT');
+        }
+        const { namespace, storage } = this.getPersonalNamespace(path);
+        const mailbox = this.folderCache[this.stripSeparator(path, storage.separator)];
+        if (!mailbox) {
+            throw mailboxError('Mailbox does not exist', 'NONEXISTENT');
+        }
+        if (mailbox.flags.indexOf('\\Noselect') >= 0 && Object.keys(mailbox.folders || {}).length) {
+            // RFC 9051 section 6.3.5: deleting a \Noselect name that has inferior names is an error, the RFC 5530
+            // section 3 HASCHILDREN response code tells the client to delete the children first
+            throw mailboxError('Mailbox has children, delete them first', 'HASCHILDREN');
+        }
+        const levels = mailbox.path.split(storage.separator);
+        const folderName = levels.pop();
+        const parentKey = levels.join(storage.separator);
+        const parent = (parentKey !== 'INBOX' && this.folderCache[parentKey]) || storage;
+        if (mailbox.folders && Object.keys(mailbox.folders).length && !keepContents) {
+            // Sessions that have the mailbox selected keep the old object, a new SELECT finds the
+            // placeholder. The placeholder only keeps the children. Plugin data (MAILBOXID, special-use, metadata, ACL,
+            // HIGHESTMODSEQ ...) belongs to the deleted mailbox and must not survive (RFC 3501 section 6.3.4)
+            const folder = {
+                flags: ['\\Noselect'],
+                folders: mailbox.folders
+            };
+            this.trackSubscription(folder);
+            this.processMailbox(mailbox.path, folder, mailbox.namespace);
+            parent.folders[folderName] = folder;
+            this.folderCache[mailbox.path] = folder;
+            return;
+        }
+        delete this.folderCache[mailbox.path];
+        delete parent.folders[folderName];
+        if (parent !== storage) {
+            if (parent.flags.indexOf('\\Noselect') >= 0 && !Object.keys(parent.folders || {}).length) {
+                this.deleteMailbox(parent.path);
+            }
+            else {
+                this.setChildrenFlags(parent, Object.keys(parent.folders || {}).length > 0);
+            }
+        }
+        else if (namespace === this.referenceNamespace && this.inboxHoldsNamespace()) {
+            this.setChildrenFlags(this.storage.INBOX, Object.keys(storage.folders || {}).length > 0);
+        }
+    }
+    /**
+     * Finds the personal namespace that a new or existing mailbox name belongs to, for CREATE and DELETE
+     *
+     * @param {String} path Mailbox path
+     * @return {Object} `{ namespace, storage }`, the namespace key and its storage object
+     * @throws {Error} CANNOT for a namespace prefix or a name in no namespace, NOPERM outside personal namespaces
+     */
+    getPersonalNamespace(path) {
+        let namespace = '';
+        Object.keys(this.storage).forEach(key => {
+            if (key === 'INBOX') {
+                return;
+            }
+            const prefix = key.length ? key.substr(0, key.length - this.storage[key].separator.length) : key;
+            if (key.length && (path === prefix || path.substr(0, key.length) === key)) {
+                if (path === prefix) {
+                    throw mailboxError('Used mailbox name is a namespace value', 'CANNOT');
+                }
+                namespace = key;
+            }
+            else if (!namespace && !key && this.storage[key].type === 'personal') {
+                namespace = key;
+            }
+        });
+        const storage = this.storage[namespace];
+        if (!storage) {
+            throw mailboxError('Unknown namespace', 'CANNOT');
+        }
+        if (storage.type !== 'personal') {
+            throw mailboxError('Permission denied', 'NOPERM');
+        }
+        return { namespace, storage };
+    }
+    /**
+     * Removes a trailing hierarchy separator from a mailbox name, "foo/" names the mailbox "foo"
+     *
+     * @param {String} path Mailbox path
+     * @param {String} separator Hierarchy separator
+     * @return {String} path without the separator at the end
+     */
+    stripSeparator(path, separator) {
+        return path.substr(-separator.length) === separator ? path.substr(0, path.length - separator.length) : path;
+    }
+    /**
+     * Checks if the personal namespace is below INBOX (e.g. "INBOX."), then the mailboxes of that namespace are
+     * the children of INBOX
+     *
+     * @return {Boolean} true if the reference namespace is INBOX followed by the separator
+     */
+    inboxHoldsNamespace() {
+        const reference = this.referenceNamespace;
+        if (reference === false) {
+            return false;
+        }
+        const namespace = this.storage[reference];
+        return !!namespace && reference.substr(0, reference.length - namespace.separator.length).toUpperCase() === 'INBOX';
+    }
+    /**
+     * Rebuilds folderCache and the path, namespace and flags of every mailbox from storage.
+     * INBOX has its own namespace
+     *
+     * @param {Boolean} [processMessages] If true, messages are prepared as well. Only needed for
+     *   messages from the initial storage, as message handlers must not run twice for a message
+     */
+    indexFolders(processMessages) {
+        const folders = Object.create(null);
+        const walkTree = (path, separator, branch, namespace) => {
+            Object.keys(branch).forEach(key => {
+                const curBranch = branch[key];
+                const curPath = (path ? path + (path.substr(-1) !== separator ? separator : '') : '') + key;
+                this.processMailbox(curPath, curBranch, namespace);
+                folders[curPath] = curBranch;
+                if (processMessages) {
+                    this.processMessages(curBranch);
+                }
+                if (curBranch.folders && Object.keys(curBranch.folders).length) {
+                    walkTree(curPath, separator, curBranch.folders, namespace);
+                }
+            });
+        };
+        // Ensure INBOX namespace always exists, processMailbox() below makes it a mailbox
+        if (!this.storage.INBOX) {
+            this.storage.INBOX = {};
+        }
+        Object.keys(this.storage).forEach(key => {
+            if (key !== 'INBOX') {
+                this.storage[key].folders = this.storage[key].folders || {};
+                // "INBOX." uses "." as the separator, but "#news" does not use "s"
+                this.storage[key].separator = this.storage[key].separator || (/[^a-z0-9]$/i.test(key) ? key.substr(-1) : '/');
+                this.storage[key].type = this.storage[key].type || 'personal';
+                if (this.storage[key].type === 'personal' && this.referenceNamespace === false) {
+                    this.referenceNamespace = key;
+                }
+                walkTree(key, this.storage[key].separator, this.storage[key].folders, key);
+            }
+        });
+        if (!this.referenceNamespace) {
+            // the keys are set below
+            this.storage[''] = this.storage[''] || {};
+            this.storage[''].folders = this.storage[''].folders || {};
+            this.storage[''].separator = this.storage[''].separator || '/';
+            this.storage[''].type = 'personal';
+            this.referenceNamespace = '';
+        }
+        // referenceNamespace is set by now
+        if (!this.storage.INBOX.separator) {
+            this.storage.INBOX.separator = this.storage[this.referenceNamespace].separator;
+        }
+        // INBOX is its own namespace, but its subfolders belong to the personal namespace
+        folders.INBOX = this.storage.INBOX;
+        this.processMailbox('INBOX', this.storage.INBOX, 'INBOX');
+        if (processMessages) {
+            this.processMessages(this.storage.INBOX);
+        }
+        if (this.storage.INBOX.folders && Object.keys(this.storage.INBOX.folders).length) {
+            walkTree('INBOX', this.storage.INBOX.separator, this.storage.INBOX.folders, this.referenceNamespace);
+        }
+        if (this.inboxHoldsNamespace()) {
+            this.setChildrenFlags(this.storage.INBOX, Object.keys(this.storage[this.referenceNamespace].folders || {}).length > 0);
+        }
+        this.folderCache = folders;
+    }
+    /**
+     * Ensures uid, flags and internaldate for every message of a mailbox and
+     * keeps the message list ordered by UID
+     *
+     * @param {Object} mailbox Mailbox object
+     */
+    processMessages(mailbox) {
+        const seen = new Set();
+        // messages from storage, before they are processed
+        const messages = mailbox.messages;
+        messages.forEach((entry, i) => {
+            // If the input was a raw message, convert it to an object
+            const message = typeof entry === 'string'
+                ? (messages[i] = {
+                    raw: entry
+                })
+                : entry;
+            this.processMessage(message, mailbox);
+            if (seen.has(message.uid)) {
+                throw new Error('Duplicate UID ' + message.uid + ' in mailbox ' + mailbox.path);
+            }
+            seen.add(message.uid);
+        });
+        mailbox.messages.sort((a, b) => a.uid - b.uid);
+    }
+    /**
+     * Sets the path, namespace, flags and counters of a mailbox from storage or a new one, and runs the
+     * mailbox handlers of plugins on it
+     *
+     * @param path Mailbox path
+     * @param mailbox Mailbox object, completed in place
+     * @param namespace Namespace key of the mailbox
+     */
+    processMailbox(path, mailbox, namespace) {
+        mailbox.path = path;
+        mailbox.namespace = namespace;
+        mailbox.uid = mailbox.uid || 1;
+        mailbox.uidvalidity = mailbox.uidvalidity || 1;
+        this.uidvalidityCounter = Math.max(this.uidvalidityCounter, mailbox.uidvalidity);
+        // mailbox attributes are case-insensitive (RFC 3501 section 9, note 1), storage may spell them in any case,
+        // the checks and responses use the RFC spelling
+        mailbox.flags = [].concat(mailbox.flags || []).map(flag => MAILBOX_ATTRIBUTES.get(String(flag).toLowerCase()) || flag);
+        mailbox.allowPermanentFlags = 'allowPermanentFlags' in mailbox ? mailbox.allowPermanentFlags : true;
+        mailbox.permanentFlags = [].concat(mailbox.permanentFlags || this.systemFlags);
+        // a mailbox from storage is subscribed unless it says otherwise
+        this.trackSubscription(mailbox, true);
+        // ensure message array
+        const messages = [].concat(mailbox.messages || []);
+        mailbox.messages = messages;
+        // ensure highest uidnext
+        mailbox.uidnext = Math.max(...[mailbox.uidnext || 1].concat(messages.map(message => {
+            // a raw message (string) has no UID yet
+            return ((typeof message === 'string' ? 0 : message.uid) || 0) + 1;
+        })));
+        const processed = mailbox;
+        this.setChildrenFlags(processed, Object.keys(processed.folders || {}).length > 0);
+        // Allow plugins to process mailboxes
+        this.mailboxHandlers.forEach(handler => {
+            handler(this, processed);
+        });
+    }
+    /**
+     * Makes `mailbox.subscribed` read and change the subscription of the mailbox name in
+     * `server.subscriptions`, so that the subscription stays with the name when the mailbox is deleted
+     * or renamed (RFC 3501 section 6.3.6, RFC 9051 section 6.3.6). A `subscribed` value the mailbox
+     * already has (from storage) is moved over to the subscription list.
+     *
+     * @param {Object} mailbox Mailbox object, its `path` is read whenever the subscription is used
+     * @param {Boolean} [defaultValue] Subscription of a mailbox without a `subscribed` value. If not
+     *   set, the subscription list is left as it is
+     */
+    trackSubscription(mailbox, defaultValue) {
+        const descriptor = Object.getOwnPropertyDescriptor(mailbox, 'subscribed');
+        if (descriptor && descriptor.get) {
+            return;
+        }
+        const value = descriptor ? !!descriptor.value : defaultValue;
+        Object.defineProperty(mailbox, 'subscribed', {
+            enumerable: true,
+            configurable: true,
+            get: () => this.subscriptions.has(mailbox.path),
+            set: (subscribed) => {
+                if (subscribed) {
+                    this.subscriptions.add(mailbox.path);
+                }
+                else {
+                    this.subscriptions.delete(mailbox.path);
+                }
+            }
+        });
+        if (typeof value === 'boolean') {
+            mailbox.subscribed = value;
+        }
+    }
+    /**
+     * Sets the stored children attribute of a mailbox (RFC 3348 section 3). A \Noinferiors mailbox gets
+     * neither, \Noinferiors already implies \HasNoChildren (RFC 5258 section 3.4)
+     *
+     * @param {Object} mailbox Mailbox object
+     * @param {Boolean} hasChildren true if the mailbox has child mailboxes
+     */
+    setChildrenFlags(mailbox, hasChildren) {
+        this.removeFlag(mailbox.flags, '\\HasChildren');
+        this.removeFlag(mailbox.flags, '\\HasNoChildren');
+        if (mailbox.flags.indexOf('\\Noinferiors') < 0) {
+            mailbox.flags.push(hasChildren ? '\\HasChildren' : '\\HasNoChildren');
+        }
+    }
+    /**
+     * Ensures that a list of flags includes selected flag
+     *
+     * @param {Array} flags An array of flags to check
+     * @param {String} flag If the flag is missing, add it
+     */
+    ensureFlag(flags, flag) {
+        if (flags.indexOf(flag) < 0) {
+            flags.push(flag);
+        }
+    }
+    /**
+     * Removes a flag from a list of flags
+     *
+     * @param {Array} flags An array of flags to check
+     * @param {String} flag If the flag is in the list, remove it
+     */
+    removeFlag(flags, flag) {
+        let i;
+        if (flags.indexOf(flag) >= 0) {
+            for (i = flags.length - 1; i >= 0; i--) {
+                if (flags[i] === flag) {
+                    flags.splice(i, 1);
+                }
+            }
+        }
+    }
+    /**
+     * Remembers the flags of a message as flags of the mailbox. A keyword stays in the FLAGS and
+     * PERMANENTFLAGS of the mailbox after the last message with it is expunged or loses it, like a
+     * keyword a client defined (RFC 3501 section 2.3.2, FLAGS lists the flags applicable for the
+     * mailbox, section 7.2.6)
+     *
+     * @param {Object} mailbox Mailbox object
+     * @param {Array} flags Flags of a message
+     */
+    rememberFlags(mailbox, flags) {
+        const knownFlags = (mailbox.knownFlags = mailbox.knownFlags || []);
+        flags.forEach(flag => this.ensureFlag(knownFlags, flag));
+    }
+    normalizeDateTime(value) {
+        if (value instanceof Date) {
+            return this.formatInternalDate(value);
+        }
+        if (typeof value === 'string') {
+            // month names are accepted in any case but always sent as "Jan", "Feb", ...
+            return value.replace(/-([a-z]{3})-/i, (m, month) => '-' + (dates_js_1.MONTHS[(0, dates_js_1.monthIndex)(month)] || month) + '-');
+        }
+        return value;
+    }
+    /**
+     * Sets the UID, flags, internal date and source of a message from storage or a new one, and runs the
+     * message handlers of plugins on it
+     *
+     * @param message Message object, completed in place
+     * @param mailbox Mailbox of the message
+     */
+    processMessage(message, mailbox) {
+        message.internaldate = this.normalizeDateTime(message.internaldate || new Date());
+        message.flags = [].concat(message.flags || []);
+        if (message.flags.indexOf('\\Recent') >= 0) {
+            // \Recent is not a stored flag, it belongs to the first session that selects the mailbox
+            this.removeFlag(message.flags, '\\Recent');
+            message.recent = true;
+        }
+        this.rememberFlags(mailbox, message.flags);
+        message.uid = message.uid || mailbox.uidnext++;
+        if (message.uid >= mailbox.uidnext) {
+            mailbox.uidnext = message.uid + 1;
+        }
+        // message source is kept as a binary string (one character per octet)
+        if (message.raw instanceof Uint8Array) {
+            message.raw = Buffer.from(message.raw).toString('binary');
+        }
+        else if (typeof message.raw !== 'string') {
+            message.raw = message.raw ? String(message.raw) : '';
+        }
+        if (/[\u0100-\uffff]/.test(message.raw)) {
+            // characters outside Latin-1 can only come from a unicode string, so encode it as UTF-8
+            message.raw = Buffer.from(message.raw, 'utf-8').toString('binary');
+        }
+        // Allow plugins to process messages
+        const processed = message;
+        this.messageHandlers.forEach(handler => {
+            handler(this, processed, mailbox);
+        });
+    }
+    /**
+     * Appends a message to a mailbox
+     *
+     * @param {Object|String} mailbox Mailbox to append to
+     * @param {Array} flags Flags for the message
+     * @param {String|Date} internaldate Receive date-time for the message
+     * @param {String} raw Message source
+     * @param {Object} [ignoreConnection] To not advertise new message to selected connection
+     * @param {Object} [properties] More properties of the new message, set before message handlers run
+     * @return An object of the form { mailbox, message }
+     */
+    appendMessage(path, flags, internaldate, raw, ignoreConnection, properties) {
+        const mailbox = typeof path === 'string' ? this.getMailbox(path) : path;
+        // processMessage() below sets the UID
+        const message = Object.assign({}, properties, {
+            flags: flags,
+            internaldate: internaldate,
+            raw: raw,
+            recent: true
+        });
+        mailbox.messages.push(message);
+        this.processMessage(message, mailbox);
+        // a session that has the mailbox selected read-write sees the new message as \Recent
+        for (const connection of this.connections) {
+            if (connection.selectedMailbox === mailbox && !connection.readOnly && connection.recent) {
+                connection.recent.add(message);
+                delete message.recent;
+                break;
+            }
+        }
+        this.notify({
+            tag: '*',
+            attributes: [
+                mailbox.messages.length,
+                {
+                    type: 'ATOM',
+                    value: 'EXISTS'
+                }
+            ],
+            // the new message, for plugins that report more about it (e.g. NOTIFY)
+            message: message
+        }, mailbox, ignoreConnection);
+        return { mailbox: mailbox, message: message };
+    }
+    /**
+     * Copies a message to a mailbox (COPY, MOVE, RENAME INBOX). The copy is a new message that
+     * keeps the flags, internal date and content of the source. `copyHandlers` can carry over more
+     * properties of the source, they run before the message handlers see the copy
+     *
+     * @param {Object} mailbox Target mailbox
+     * @param {Object} source Message to copy
+     * @return An object of the form { mailbox, message }
+     */
+    copyMessage(mailbox, source) {
+        const properties = {};
+        this.copyHandlers.forEach(handler => {
+            handler(this, source, properties, mailbox);
+        });
+        return this.appendMessage(mailbox, [].concat(source.flags || []), source.internaldate, source.raw, false, properties);
+    }
+    /**
+     * Returns the namespace a mailbox path belongs to by its prefix, INBOX not included
+     *
+     * @param {String} path Mailbox path, it does not have to exist
+     * @return {String|Boolean} the longest matching namespace key, or false
+     */
+    getNamespace(path) {
+        let namespace = false;
+        Object.keys(this.storage).forEach(key => {
+            if (key !== 'INBOX' && path.substr(0, key.length) === key && (namespace === false || key.length > namespace.length)) {
+                namespace = key;
+            }
+        });
+        return namespace;
+    }
+    /**
+     * Checks if messages can be added to a mailbox (APPEND, COPY, MOVE). TRYCREATE tells the client that CREATE would
+     * help (RFC 3501 sections 6.3.11 and 6.4.7), also for a \\Noselect name, which CREATE turns into a mailbox (RFC 9051
+     * sections 6.3.12 and 6.4.7: unless it is certain that the target can not be created)
+     *
+     * @param {String} path Storage name of the target mailbox
+     * @return {Object|Boolean} `{ command, code, text }` of the refusal, or false if the mailbox can take messages
+     */
+    targetRefusal(path) {
+        const mailbox = this.getMailbox(path);
+        if (!mailbox) {
+            return { command: 'NO', code: 'TRYCREATE', text: 'Target mailbox does not exist' };
+        }
+        if (mailbox.flags.indexOf('\\Noselect') >= 0) {
+            return { command: 'NO', code: 'TRYCREATE', text: 'Target mailbox is not selectable' };
+        }
+        return false;
+    }
+    /**
+     * Returns the namespace of a mailbox name: "INBOX" for INBOX, the namespace of the mailbox if it
+     * exists (the children of INBOX belong to the personal namespace), otherwise the one of its prefix
+     *
+     * @param {String|Object} path Mailbox path, it does not have to exist, or a mailbox object
+     * @return {String|Boolean} namespace key, or false if the name is in no namespace
+     */
+    getMailboxNamespace(path) {
+        if (path && typeof path === 'object') {
+            return path.namespace;
+        }
+        if (path.toUpperCase() === 'INBOX') {
+            return 'INBOX';
+        }
+        const mailbox = this.getMailbox(path);
+        return mailbox ? mailbox.namespace : this.getNamespace(path);
+    }
+    /**
+     * Checks if a mailbox name is in a personal namespace, INBOX included
+     *
+     * @param {String|Object} path Mailbox path, it does not have to exist, or a mailbox object
+     * @return {Boolean} true for a personal mailbox
+     */
+    isPersonal(path) {
+        const key = this.getMailboxNamespace(path);
+        return key === 'INBOX' || (key !== false && !!this.storage[key] && this.storage[key].type === 'personal');
+    }
+    /**
+     * Returns the hierarchy separator of a mailbox name, from its namespace
+     *
+     * @param {String|Object} path Mailbox path, it does not have to exist, or a mailbox object
+     * @return {String} separator
+     */
+    getSeparator(path) {
+        const key = this.getMailboxNamespace(path);
+        const namespace = key === false ? undefined : this.storage[key];
+        return (namespace && namespace.separator) || this.storage.INBOX.separator || '/';
+    }
+    /**
+     * Returns the name one hierarchy level up from a mailbox name. A trailing separator is ignored, the
+     * prefix of a namespace (e.g. "#shared" of "#shared/") is not a mailbox name
+     *
+     * @param {String} path Mailbox path, it does not have to exist
+     * @return {String|Boolean} parent name, "INBOX" for the children of INBOX, or false at the top level
+     */
+    getParentPath(path) {
+        const separator = this.getSeparator(path);
+        path = this.stripSeparator(path, separator);
+        const index = path.lastIndexOf(separator);
+        if (index <= 0) {
+            return false;
+        }
+        const parent = path.substr(0, index);
+        if (parent.toUpperCase() === 'INBOX') {
+            return 'INBOX';
+        }
+        return this.storage[parent + separator] ? false : parent;
+    }
+    getDescendants(path, folders) {
+        const source = folders || this.folderCache;
+        const prefix = path + this.getSeparator(path);
+        return Object.keys(source)
+            .filter(key => key.substr(0, prefix.length) === prefix)
+            .map(key => source[key]);
+    }
+    /**
+     * Checks if any mailbox below a mailbox name passes a test, stops at the first one that does
+     *
+     * @param {String} path Mailbox path
+     * @param {Function} predicate `(mailbox)` returns true for a match
+     * @return {Boolean} true if a mailbox below the name matches
+     */
+    hasDescendant(path, predicate) {
+        const prefix = path + this.getSeparator(path);
+        for (const key of Object.keys(this.folderCache)) {
+            if (key.substr(0, prefix.length) === prefix && predicate(this.folderCache[key])) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * Returns the mailbox attributes of a LIST response with computed children attributes (RFC 3348, RFC 5258
+     * section 4), for extended and unsolicited LIST responses. The stored \HasChildren and \HasNoChildren are
+     * replaced, a name that does not exist is \NonExistent (RFC 5258 section 3, it implies \Noselect)
+     *
+     * @param {Object} [mailbox] Mailbox object, can be left out for a name that does not exist
+     * @param {Object} options `{ exists, subscribed, hasChildren, extra }`: false `exists` lists the name as
+     *   \NonExistent, `subscribed` adds \Subscribed, `extra` lists more attributes (e.g. \NoAccess)
+     * @return {Array} attribute names
+     */
+    listAttributes(mailbox, options) {
+        const exists = options.exists !== false;
+        const flags = ((mailbox && mailbox.flags) || []).filter(flag => flag !== '\\HasChildren' && flag !== '\\HasNoChildren' && (exists || flag !== '\\Noselect'));
+        if (!exists) {
+            flags.push('\\NonExistent');
+        }
+        if (options.subscribed) {
+            flags.push('\\Subscribed');
+        }
+        flags.push(...(options.extra || []));
+        // \Noinferiors implies \HasNoChildren (RFC 5258 section 3.4 and section 4 example 3)
+        if (flags.indexOf('\\Noinferiors') < 0) {
+            flags.push(options.hasChildren ? '\\HasChildren' : '\\HasNoChildren');
+        }
+        return flags;
+    }
+    matchFolders(referenceName, match, exportName, folders) {
+        let includeINBOX = false;
+        const source = folders || this.folderCache;
+        const toName = exportName || ((name) => name);
+        let reference = referenceName || '';
+        if (reference === '' && this.referenceNamespace !== false) {
+            reference = toName(this.referenceNamespace);
+            includeINBOX = true;
+        }
+        // the reference does not have to be a namespace, use the namespace it belongs to
+        let nsKey = false;
+        let nsName = '';
+        for (const key of Object.keys(this.storage)) {
+            const name = toName(key);
+            if (key !== 'INBOX' && reference.substr(0, name.length) === name && (nsKey === false || name.length > nsName.length)) {
+                nsKey = key;
+                nsName = name;
+            }
+        }
+        if (nsKey === false) {
+            return [];
+        }
+        const namespace = this.storage[nsKey];
+        const lookup = reference + match;
+        const result = [];
+        const pattern = '^' +
+            lookup
+                // escape regex symbols
+                .replace(/([\\^$+?!.():=[\]{}|,-])/g, '\\$1')
+                .replace(/[*]/g, '.*')
+                .replace(/[%]/g, '[^' + namespace.separator.replace(/([\\^$+*?!.():=[\]{}|,-])/g, '\\$1') + ']*') +
+            '$';
+        const query = new RegExp(pattern, '');
+        // INBOX is case-insensitive
+        if (includeINBOX && source.INBOX && ((reference ? reference + namespace.separator : '') + 'INBOX').match(new RegExp(pattern, 'i'))) {
+            result.push(source.INBOX);
+        }
+        Object.keys(source).forEach(path => {
+            const folder = source[path];
+            if (folder.namespace !== nsKey) {
+                return;
+            }
+            const name = toName(path);
+            if (name.match(query) && (folder.flags.indexOf('\\NonExistent') < 0 || name === match)) {
+                result.push(folder);
+            }
+        });
+        return result;
+    }
+    /**
+     * Returns the subscribed names with their superior hierarchy levels, for LSUB and LIST (SUBSCRIBED).
+     * Names that are not mailboxes get a stand-in object with \Noselect, which LIST-EXTENDED reports as
+     * \NonExistent (RFC 5258 section 3), and `subscribed` false for a level that is only listed because
+     * of a subscribed name below it
+     *
+     * @return {Object} path to mailbox object or stand-in, usable as the `folders` of matchFolders
+     */
+    getSubscriptionTree() {
+        const tree = Object.create(null);
+        const add = (path, subscribed) => {
+            tree[path] = tree[path] || this.getMailbox(path) || { path, namespace: this.getNamespace(path), flags: ['\\Noselect'], subscribed };
+        };
+        const names = [...this.subscriptions].filter(path => path === 'INBOX' || this.getNamespace(path) !== false);
+        names.forEach(path => add(path, true));
+        names.forEach(path => {
+            // superior levels of the name within its namespace
+            for (let parent = this.getParentPath(path); parent; parent = this.getParentPath(parent)) {
+                add(parent, false);
+            }
+        });
+        return tree;
+    }
+    /**
+     * Retrieves an array of messages that fit in the specified range criteria
+     *
+     * @param {Object|String} mailbox Mailbox to look for the messages
+     * @param {String} range Message range (eg. "*:4,5,7:9")
+     * @param {Boolean} isUid If true, use UID values, not sequence indexes for comparison
+     * @return {Array} An array of messages in the form of [[seqIndex, message]]
+     */
+    getMessageRange(source, sequence, isUid) {
+        const range = (sequence || '').toString();
+        const mailbox = typeof source === 'string' ? this.getMailbox(source) : source;
+        // sequence-set from RFC 3501 and RFC 9051 section 9, numbers are nz-number values (32-bit), UIDs too
+        if (!(0, numbers_js_1.isSequenceSet)(range)) {
+            const err = new Error('Invalid sequence set');
+            err.imapResponse = 'BAD';
+            throw err;
+        }
+        const result = [];
+        const rangeParts = range.split(',');
+        const messages = Array.isArray(mailbox) ? mailbox : mailbox.messages;
+        let uid;
+        const totalMessages = messages.length;
+        let maxUid = 0;
+        const inRange = function (nr, ranges, total) {
+            for (let i = 0, len = ranges.length; i < len; i++) {
+                const to = ranges[i].split(':');
+                const first = to.shift();
+                const from = Number(first === '*' ? total : first) || 1;
+                const last = to.pop() || from;
+                const end = Number((last === '*' && total) || last) || from;
+                if (nr >= Math.min(from, end) && nr <= Math.max(from, end)) {
+                    return true;
+                }
+            }
+            return false;
+        };
+        messages.forEach(message => {
+            if (message.uid > maxUid) {
+                maxUid = message.uid;
+            }
+        });
+        for (let i = 0, len = messages.length; i < len; i++) {
+            uid = messages[i].uid || 1;
+            if (inRange(isUid ? uid : i + 1, rangeParts, isUid ? maxUid : totalMessages)) {
+                result.push([i + 1, messages[i]]);
+            }
+        }
+        return result;
+    }
+}
+exports.IMAPServer = IMAPServer;
+class IMAPConnection {
+    constructor(server, socket) {
+        this.server = server;
+        this.socket = socket;
+        this.options = this.server.options;
+        this.state = 'Not Authenticated';
+        this.secureConnection = !!this.options.secureConnection;
+        this._remainder = '';
+        this._command = '';
+        this._literalRemaining = 0;
+        this.inputHandler = false;
+        // a layer between the socket and the IMAP protocol, such as COMPRESS=DEFLATE (RFC 4978). It has
+        // the methods write(buffer), receive(chunk), end(callback) and destroy(), and passes data on with
+        // connection.writeRaw() and connection.onData(), so it always sits above TLS (RFC 4978 section 3)
+        this.transport = null;
+        // per connection options for the imap-handler parser and compiler, plugins can change these. The
+        // parser options go on top of server.parserOptions
+        this.parserOptions = {};
+        this.compilerOptions = {};
+        // message/global parts encapsulate a message like message/rfc822 parts in BODYSTRUCTURE and in section
+        // numbers. IMAP4rev2 sets it (RFC 9051 sections 6.4.5.1 and 7.5.2), IMAP4rev1 describes them as basic parts
+        this.messageGlobal = false;
+        this._commandQueue = [];
+        this._processing = false;
+        if (this.options.debug) {
+            this.socket.pipe(process.stdout);
+        }
+        this.socket.on('data', this.receive.bind(this));
+        this.socket.on('close', this.onClose.bind(this));
+        this.socket.on('error', this.onError.bind(this));
+        this.directNotifications = false;
+        this._notificationCallback = this.onNotify.bind(this);
+        this.notificationQueue = [];
+        this.server.on('notify', this._notificationCallback);
+        this.server.connections.add(this);
+        this.write('* OK ImapKit ready for rumble\r\n');
+    }
+    /**
+     * Writes protocol output to the client, through the transport layer if there is one
+     *
+     * @param {Buffer|String} data Data to send, a string is sent as a binary string
+     */
+    write(data) {
+        const buffer = typeof data === 'string' ? Buffer.from(data, 'binary') : data;
+        if (this.transport) {
+            this.transport.write(buffer);
+        }
+        else {
+            this.writeRaw(buffer);
+        }
+    }
+    /**
+     * Writes data to the socket, below the transport layer
+     *
+     * @param {Buffer} data Data to send
+     */
+    writeRaw(data) {
+        if (this.socket && !this.socket.destroyed) {
+            this.socket.write(data);
+        }
+    }
+    /**
+     * Handles data from the socket, through the transport layer if there is one
+     *
+     * @param {Buffer} chunk Received data
+     */
+    receive(chunk) {
+        if (this.transport) {
+            this.transport.receive(chunk);
+        }
+        else {
+            this.onData(chunk);
+        }
+    }
+    /**
+     * Closes the connection once everything sent so far, including data a transport layer still
+     * holds, is written out
+     */
+    end() {
+        const socket = this.socket;
+        if (!socket) {
+            return;
+        }
+        this._closing = true;
+        if (this.transport) {
+            this.transport.end(() => socket.end());
+        }
+        else {
+            socket.end();
+        }
+    }
+    /**
+     * Sends an untagged BYE, drops unprocessed input and closes the connection (RFC 3501 section 7.1.5)
+     *
+     * @param {String} text Human readable explanation
+     * @param {String} [description] Description for output handlers
+     */
+    bye(text, description) {
+        this.sendStatus({ tag: '*' }, null, 'BYE', text, false, description || 'BYE');
+        // the selected mailbox is left without expunging, queued notifications are dropped
+        this.closeMailbox();
+        this.state = 'Logout';
+        this.discardInput();
+        this.end();
+    }
+    /**
+     * Checks if the client sent anything after the command that is running, that is not processed yet
+     *
+     * @return {Boolean} true if there is unprocessed input or a queued command
+     */
+    hasPendingInput() {
+        return !!(this._remainder || this._command || this._literalRemaining || this._commandQueue.length);
+    }
+    /**
+     * Checks if a command is running or waiting, for checks that must not run ahead of earlier commands
+     *
+     * @return {Boolean} true if a command is running or queued
+     */
+    isBusy() {
+        return !!(this._processing || this._commandQueue.length);
+    }
+    /**
+     * Checks if a command was sent together with a command that was refused for the noPipelining option (STARTTLS,
+     * COMPRESS): it arrived in the same read, before the client could see the refusal
+     *
+     * @return {Boolean} true if the command must be refused
+     */
+    isPipelinedAfterRefusal() {
+        return !!this._pipelinedAfter && this._pipelinedAfter.read === this._readCount;
+    }
+    /**
+     * Refuses a command that was pipelined after a refused noPipelining command, without running it
+     *
+     * @param {Object} parsed Parsed command
+     * @param {String} data Raw command
+     */
+    refusePipelined(parsed, data) {
+        this.sendStatus(parsed, data, 'BAD', 'Commands must not be pipelined after ' + this._pipelinedAfter?.command, false, 'INVALID COMMAND');
+    }
+    /**
+     * Drops input that is not processed yet, including queued commands
+     */
+    discardInput() {
+        this._commandQueue = [];
+        this._remainder = '';
+        this._command = '';
+        this._literalRemaining = 0;
+        this._skipCommand = false;
+        this._earlyLiteral = false;
+    }
+    /**
+     * Returns the connection to the Not Authenticated state and resets everything but the TLS
+     * layer (RFC 8437 section 3): the selected mailbox is closed without EXPUNGE responses, and the
+     * plugins clear their session state (ENABLEd extensions, CONDSTORE, COMPRESS, ...) with
+     * server.resetHandlers. Call it after the response that ends the session was sent.
+     */
+    resetSession() {
+        this.closeMailbox();
+        this.state = 'Not Authenticated';
+        this.username = false;
+        this.everSelected = false;
+        this.directNotifications = false;
+        this.server.resetHandlers.forEach(handler => handler(this));
+    }
+    /**
+     * Closes the selected mailbox, if there is one, and returns to the Authenticated state (CLOSE, UNSELECT, a failed
+     * SELECT or EXAMINE, RFC 3501 section 6.3.1). The read-only mode, the \Recent set of the session and the
+     * notifications that were not sent yet are dropped. Sends nothing, the caller answers the command
+     */
+    closeMailbox() {
+        this.state = 'Authenticated';
+        this.selectedMailbox = false;
+        this.readOnly = false;
+        this.recent = null;
+        this.notificationQueue = [];
+    }
+    onClose() {
+        if (this.socket) {
+            this.socket.removeAllListeners();
+            this.socket = null;
+        }
+        if (this.transport) {
+            this.transport.destroy();
+            this.transport = null;
+        }
+        this.server.removeListener('notify', this._notificationCallback);
+        this.server.connections.delete(this);
+    }
+    onError(err) {
+        if (this.options.debug) {
+            console.log('Socket error event emitted, %s', Date());
+            console.log(err.stack);
+        }
+        try {
+            this.socket?.end();
+        }
+        catch (E) {
+            // socket is already gone
+        }
+    }
+    onData(chunk) {
+        let match;
+        let str;
+        // everything in one read arrived before anything this read causes to be sent
+        this._readCount = (this._readCount || 0) + 1;
+        str = (chunk || '').toString('binary');
+        if (this._discardLine) {
+            // skipping the rest of a command line that was too long
+            const lineEnd = str.indexOf('\n');
+            if (lineEnd < 0) {
+                return;
+            }
+            // the command was not executed, but its tag still gets an answer
+            const tag = this._discardLine;
+            this._discardLine = false;
+            str = str.substr(lineEnd + 1);
+            this.sendBad(tag, 'Command line too long', 'LINE TOO LONG');
+        }
+        if (this._literalRemaining) {
+            str = this.readLiteral(str);
+            if (this._literalRemaining) {
+                return;
+            }
+        }
+        // non-synchronizing literals are only valid when LITERAL+ or LITERAL- is advertised. A literal8 marker `~{n}`
+        // (RFC 3516) is matched always, so it is refused when BINARY is not loaded
+        const lineEndRegex = this.server.literalPlus
+            ? /(?<marker>(?<tilde>~)?\{(?<size>\d+)(?<plus>\+)?\})?(?<cr>\r?)\n/
+            : /(?<marker>(?<tilde>~)?\{(?<size>\d+)\})?(?<cr>\r?)\n/;
+        this._remainder = str = this._remainder + str;
+        while ((match = lineEndRegex.exec(str))) {
+            const { marker, tilde, size, plus, cr } = match.groups;
+            if (match.index > MAX_LINE_LENGTH) {
+                // the same limit as for a line that arrives in several reads (see the end of this method), so
+                // the outcome does not depend on how the input was split into reads (RFC 3501 section 7.1.3)
+                const tag = getResponseTag(this._command || str);
+                this.sendBad('*', 'Command line too long', 'LINE TOO LONG');
+                this.sendBad(tag, 'Command line too long', 'LINE TOO LONG');
+                this._remainder = str = str.substr(match.index + match[0].length);
+                this._command = '';
+                this._skipCommand = false;
+                continue;
+            }
+            if (!cr) {
+                // every command line ends with CRLF (RFC 3501 section 9), a bare LF is refused
+                const line = this._command + str.substr(0, match.index + match[0].length - 1);
+                this._remainder = str = str.substr(match.index + match[0].length);
+                this._command = '';
+                if (this._skipCommand) {
+                    this._skipCommand = false;
+                }
+                else {
+                    this.sendBad(this.inputHandler ? '*' : getResponseTag(line), 'Lines must end with CRLF', 'INVALID LINE ENDING', line);
+                }
+                continue;
+            }
+            if (!size || (this._skipCommand && !plus)) {
+                // the command is complete, or it was refused already and the client waits in vain
+                // for a continuation request
+                const line = this._command + str.substr(0, match.index);
+                this._remainder = str.substr(match.index + match[0].length);
+                this._command = '';
+                if (this._skipCommand) {
+                    this._skipCommand = false;
+                }
+                else if (this._earlyLiteral) {
+                    // the client sent literal data without waiting for the continuation request
+                    this._earlyLiteral = false;
+                    this.sendBad(getResponseTag(line), 'Literal data must wait for the continuation request', 'LITERAL TOO EARLY', line);
+                }
+                else if (this.inputHandler) {
+                    this.inputHandler(line);
+                }
+                else {
+                    this.scheduleCommand(line);
+                }
+                if (this.upgrading) {
+                    // STARTTLS was accepted, ignore any pipelined plaintext input
+                    return;
+                }
+                // a handler may have dropped the input that followed with discardInput()
+                str = this._remainder;
+                continue;
+            }
+            const literalSize = Number(size);
+            if (!this._skipCommand) {
+                const line = this._command + str.substr(0, match.index);
+                // the literal marker is part of the first word when it directly follows the tag
+                const tag = getResponseTag(line + marker);
+                const refusal = this.checkLiteral(line, literalSize, !plus, !!tilde);
+                if (refusal) {
+                    if (plus) {
+                        // the client is going to send the literal anyway, so there is no way to recover. A BYE
+                        // for a literal that is too large should carry TOOBIG (RFC 7888 section 5)
+                        this.sendStatus({ tag: '*' }, line, 'BYE', refusal.text, refusal.text === LITERAL_TOO_LARGE && 'TOOBIG', 'LITERAL REFUSED');
+                        this._remainder = this._command = '';
+                        this.end();
+                        return;
+                    }
+                    // refuse a synchronizing literal by not sending a continuation request
+                    this.sendStatus({ tag }, line, refusal.command, refusal.text, refusal.code || false, 'LITERAL REFUSED');
+                    this._remainder = str = str.substr(match.index + match[0].length);
+                    this._command = '';
+                    continue;
+                }
+                if (plus && literalSize > this.server.nonSyncLiteralLimit) {
+                    // RFC 7888 sections 4 and 5: the command is refused with TOOBIG, the literal and the
+                    // rest of the command are read and dropped
+                    this.sendStatus({ tag }, line, 'BAD', 'Non-synchronizing literals are limited to ' + this.server.nonSyncLiteralLimit + ' octets', 'TOOBIG', 'LITERAL TOO BIG');
+                    this._skipCommand = true;
+                    this._command = '';
+                }
+            }
+            if (!plus) {
+                if (str.length > match.index + match[0].length) {
+                    // RFC 3501 section 4.3: the client MUST wait for the continuation request
+                    // before sending the octets of a synchronizing literal
+                    this._earlyLiteral = true;
+                }
+                else if (!this._earlyLiteral) {
+                    this.write('+ Go ahead\r\n');
+                }
+            }
+            this._remainder = '';
+            if (!this._skipCommand) {
+                this._command += str.substr(0, match.index + match[0].length);
+            }
+            this._literalRemaining = literalSize;
+            str = this.readLiteral(str.substr(match.index + match[0].length));
+            if (this._literalRemaining) {
+                return;
+            }
+            this._remainder = str;
+        }
+        if (this._remainder.length > MAX_LINE_LENGTH) {
+            // RFC 3501 section 7.1.3
+            this.sendBad('*', 'Command line too long', 'LINE TOO LONG');
+            const tag = getResponseTag(this._command || this._remainder);
+            this._remainder = '';
+            this._command = '';
+            this._skipCommand = false;
+            this._discardLine = tag;
+        }
+    }
+    /**
+     * Reads literal data that the current command is waiting for. The data of a command that was
+     * refused is dropped.
+     *
+     * @param {String} str Received data
+     * @return {String} the data that follows the literal
+     */
+    readLiteral(str) {
+        const length = Math.min(this._literalRemaining, str.length);
+        if (!this._skipCommand) {
+            this._command += str.substr(0, length);
+        }
+        this._literalRemaining -= length;
+        return str.substr(length);
+    }
+    /**
+     * Sends a BAD response to input that did not make it to a command handler
+     *
+     * @param {String} tag Tag to answer with, "*" for an untagged response
+     * @param {String} text Human readable text
+     * @param {String} description Description for output handlers
+     * @param {String} [data] Raw input
+     */
+    sendBad(tag, text, description, data) {
+        this.sendStatus({ tag }, data, 'BAD', text, false, description);
+    }
+    /**
+     * Checks if a literal may be accepted for the command line received so far. Literals are
+     * refused before they are read when they are too large, or when the command is unknown or
+     * not allowed in the current state, so the client does not get a continuation request for
+     * a command that is going to fail anyway.
+     *
+     * @param {String} line The command received so far (with earlier literals), up to the literal size marker
+     * @param {Number} literalSize Size of the literal in octets
+     * @param {Boolean} [synchronizing] true if the literal can still be refused without reading it
+     * @param {Boolean} [literal8] The literal is a literal8 `~{n}`
+     * @return {Object|Boolean} `{ command, code, text }` for the response that refuses the literal, or false.
+     *   Responses from `server.literalFilters` have the same form
+     */
+    checkLiteral(line, literalSize, synchronizing, literal8) {
+        const refuse = (text) => ({ command: 'BAD', text });
+        const maxLiteralSize = this.getMaxLiteralSize();
+        if (literalSize > maxLiteralSize || line.length + literalSize > maxLiteralSize + MAX_LINE_LENGTH) {
+            return refuse(LITERAL_TOO_LARGE);
+        }
+        if (this.isPipelinedAfterRefusal()) {
+            return refuse('Commands must not be pipelined after ' + this._pipelinedAfter?.command);
+        }
+        if (this.inputHandler) {
+            // not a command, e.g. a SASL response
+            return literal8 ? refuse('Literal8 is not allowed here') : false;
+        }
+        // tag SP command, and for UID and AUTHENTICATE the word that follows
+        const words = line.match(/^[^ ]* ([^ ]*)(?: ([^ ]*))?/);
+        let command = ((words && words[1]) || '').toUpperCase();
+        if (command === 'UID' || command === 'AUTHENTICATE') {
+            command += ' ' + ((words && words[2]) || '').toUpperCase();
+        }
+        if (!COMMAND_REGEX.test(command) || !this.server.getCommandHandler(command)) {
+            return refuse('Unknown command');
+        }
+        const options = this.server.getCommandOptions(command);
+        if (options.states && options.states.indexOf(this.state) < 0) {
+            return refuse(stateError(command, this.state));
+        }
+        // RFC 3516 section 7: literal8 is only valid where an extension allows it, like BINARY for the APPEND
+        // message or METADATA for entry values (RFC 5464 section 5)
+        if (literal8 && !(options.literal8 === true || (options.literal8 && Object.hasOwn(this.server.capabilities, options.literal8)))) {
+            return refuse('Literal8 is not allowed in ' + command);
+        }
+        // plugins can refuse a synchronizing literal, e.g. a message that is too large for APPEND.
+        // A non-synchronizing literal is read anyway, the command handler refuses it later
+        if (synchronizing) {
+            for (const filter of this.server.literalFilters) {
+                const refusal = filter(this, command, line, literalSize);
+                if (refusal) {
+                    return refusal;
+                }
+            }
+        }
+        return false;
+    }
+    /**
+     * Returns the largest literal the client may send in its current state. Before
+     * authentication only small literals (user names, passwords) make sense.
+     *
+     * @return {Number} Size in bytes
+     */
+    getMaxLiteralSize() {
+        if (this.state === 'Not Authenticated') {
+            return MAX_PREAUTH_LITERAL_SIZE;
+        }
+        return Number(this.options.maxLiteralSize) || MAX_LITERAL_SIZE;
+    }
+    /**
+     * Returns the message list of the selected mailbox as this session currently
+     * sees it. When another session has expunged messages that this session has
+     * not been told about yet, sequence numbers must still refer to the old list.
+     *
+     * @return {Array} List of messages
+     */
+    getSessionMessages() {
+        for (let i = 0, len = this.notificationQueue.length; i < len; i++) {
+            const mailboxCopy = this.notificationQueue[i].mailboxCopy;
+            if (mailboxCopy) {
+                return mailboxCopy;
+            }
+        }
+        return this.selectedMailbox ? this.selectedMailbox.messages : [];
+    }
+    /**
+     * Resolves the sequence set argument of a command to messages of the selected mailbox, as this
+     * session sees it. Plugins can replace it per connection to support other forms of sequence sets
+     * (e.g. "$" of SEARCHRES)
+     *
+     * @param {String} range Sequence set
+     * @param {Boolean} isUid If true, the set lists UIDs instead of sequence numbers
+     * @return {Array} An array of messages in the form of [[seqIndex, message]]
+     */
+    getMessageRange(range, isUid) {
+        return this.server.getMessageRange(this.getSessionMessages(), range, isUid);
+    }
+    /**
+     * Lets `server.rangeLimits` cut the messages a command operates on, after its sequence set argument was resolved.
+     * A limit that returns the messages from the highest UID down sets `parsed.highestFirst`, then MOVE and UID EXPUNGE
+     * send their EXPUNGE responses in that order too
+     *
+     * @param {Object} parsed Parsed command
+     * @param {Array} range Messages of the sequence set, in the form of [[seqIndex, message]]
+     * @return {Array} the messages to operate on, in the same form
+     */
+    limitRange(parsed, range) {
+        return this.server.rangeLimits.reduce((result, limit) => limit(this, parsed, result) || result, range);
+    }
+    /**
+     * Resolves the sequence set argument of a command like getMessageRange, but refuses message sequence
+     * numbers past the end of the selected mailbox, as this session sees it. RFC 3501 and RFC 9051 section 9
+     * (seq-number): "The server should respond with a tagged BAD response to a command that uses a message
+     * sequence number greater than the number of messages in the selected mailbox. This includes "*" if the
+     * selected mailbox is empty." For the sequence set argument of FETCH, STORE, COPY and MOVE, SEARCH keys
+     * use getMessageRange
+     *
+     * @param {String} range Sequence set
+     * @param {Boolean} isUid If true, the set lists UIDs, these can point past the end
+     * @return {Array} An array of messages in the form of [[seqIndex, message]], see getMessageRange
+     * @throws {Error} BAD error if a sequence number is out of range
+     */
+    getCommandRange(range, isUid) {
+        const result = this.getMessageRange(range, isUid);
+        if (isUid) {
+            return result;
+        }
+        const total = this.getSessionMessages().length;
+        String(range)
+            .split(/[,:]/)
+            .forEach(value => {
+            if (value === '*' ? !total : Number(value) > total) {
+                const err = new Error(total ? 'Message sequence number ' + value + ' is greater than the number of messages (' + total + ')' : 'The mailbox is empty');
+                err.imapResponse = 'BAD';
+                throw err;
+            }
+        });
+        return result;
+    }
+    /**
+     * Checks if this session has EXPUNGE notifications that it has not been told about yet
+     *
+     * @return {Boolean} true if an EXPUNGE response is pending
+     */
+    hasPendingExpunge() {
+        return this.notificationQueue.some(notification => notification.attributes && (notification.attributes[1] || {}).value === 'EXPUNGE');
+    }
+    /**
+     * Tells the other sessions that have the selected mailbox open about changed flags, they get
+     * an untagged FETCH with the new flags (RFC 3501 section 5.2)
+     *
+     * @param {Array} messages Messages with changed flags
+     */
+    notifyFlagChanges(messages) {
+        if (messages.length && this.selectedMailbox) {
+            this.server.notify({ tag: '*', flagUpdate: messages }, this.selectedMailbox, this);
+        }
+    }
+    /**
+     * Sends unsolicited FETCH responses with the flags another session changed. The UID is always
+     * included, RFC 9051 section 6.3.13 requires it for unsolicited FETCH responses and it is valid
+     * in IMAP4rev1 as well.
+     *
+     * @param {Array} messages Messages with changed flags
+     * @param {Map} sequence Message to the sequence number this session knows it by
+     * @param {Set} [reported] Messages already reported, these are skipped and the sent ones are added
+     */
+    sendFlagUpdate(messages, sequence, reported) {
+        const getFlags = this.server.fetchHandlers.FLAGS || fetch_js_1.default.FLAGS;
+        messages.forEach(message => {
+            if (!sequence.has(message) || message.ghost) {
+                // the message is gone, its EXPUNGE response tells the rest
+                return;
+            }
+            if (reported) {
+                if (reported.has(message)) {
+                    return;
+                }
+                reported.add(message);
+            }
+            this.send({
+                tag: '*',
+                notification: true,
+                attributes: [
+                    sequence.get(message),
+                    {
+                        type: 'ATOM',
+                        value: 'FETCH'
+                    },
+                    [
+                        {
+                            type: 'ATOM',
+                            value: 'UID'
+                        },
+                        message.uid,
+                        {
+                            type: 'ATOM',
+                            value: 'FLAGS'
+                        },
+                        getFlags(this, message, { type: 'ATOM', value: 'FLAGS' })
+                    ]
+                ]
+            }, 'FLAG NOTIFICATION', null, null, message);
+        });
+    }
+    /**
+     * Checks if a message has the \Recent flag in this session
+     *
+     * @param {Object} message Message object
+     * @return {Boolean} true if the message is recent for this session
+     */
+    isRecent(message) {
+        return !!(this.recent && this.recent.has(message));
+    }
+    /**
+     * Returns the flags of a message as seen by this session, including \Recent
+     *
+     * @param {Object} message Message object
+     * @return {Array} List of flags
+     */
+    getFlags(message) {
+        return this.isRecent(message) ? message.flags.concat('\\Recent') : message.flags;
+    }
+    /**
+     * Checks if FETCH may set the \Seen flag in the selected mailbox (RFC 3501 section 6.4.5).
+     * Plugins can override it for a connection, e.g. ACL without the "s" right
+     *
+     * @return {Boolean} true if \Seen may be set
+     */
+    canSetSeen() {
+        return !this.readOnly;
+    }
+    /**
+     * The refusal of a command that would change a mailbox selected read-only (EXAMINE, or SELECT answered with
+     * [READ-ONLY], RFC 3501 sections 6.3.1 and 6.3.2): STORE, EXPUNGE, UID EXPUNGE, MOVE and REPLACE. RFC 5530 section 3:
+     * CLIENTBUG, the client was told that the mailbox is read-only
+     *
+     * @return {Object|Boolean} `{ command, code, text }` if the selected mailbox is read-only, otherwise false
+     */
+    readOnlyRefusal() {
+        return this.readOnly ? { command: 'NO', code: 'CLIENTBUG', text: 'Mailbox is read-only' } : false;
+    }
+    /**
+     * Sends the refusal of readOnlyRefusal() if the selected mailbox is read-only
+     *
+     * @param {Object} parsed Parsed command
+     * @param {String} data Raw command
+     * @param {String} description Description for output handlers
+     * @return {Boolean} true if the command was refused
+     */
+    refuseReadOnly(parsed, data, description) {
+        const refusal = this.readOnlyRefusal();
+        if (refusal) {
+            this.sendStatus(parsed, data, refusal.command, refusal.text, refusal.code, description);
+        }
+        return !!refusal;
+    }
+    /**
+     * Checks if CLOSE may expunge the selected mailbox (RFC 3501 section 6.4.2). Plugins can
+     * override it for a connection, e.g. ACL without the "e" right
+     *
+     * @return {Boolean} true if messages may be expunged
+     */
+    canExpunge() {
+        return !this.readOnly;
+    }
+    onNotify(notification) {
+        if (notification.ignoreConnection === this ||
+            (notification.filter && !notification.filter(this)) ||
+            !this.server.notifyFilters.every(filter => filter(this, notification))) {
+            return;
+        }
+        const mailbox = typeof notification.mailbox === 'string' ? this.server.getMailbox(notification.mailbox) : notification.mailbox;
+        if (!notification.mailbox || (this.selectedMailbox && this.selectedMailbox === mailbox)) {
+            let command = notification.command;
+            if (command.mailboxCopy && this.notificationQueue.some(queued => queued.mailboxCopy)) {
+                // Only the oldest snapshot describes what this session currently sees,
+                // so do not keep another copy of the message list around
+                command = Object.assign({}, command);
+                delete command.mailboxCopy;
+            }
+            this.queueNotification(command, notification);
+        }
+    }
+    /**
+     * Queues a notification for this session, it is sent before the next tagged response that allows it, or
+     * right away while notifications are direct (IDLE). Plugins can replace it per connection to drop
+     * notifications or send them at other times (e.g. NOTIFY)
+     *
+     * @param {Object} command Untagged response
+     * @param {Object} notification The `notify` event, `{ command, mailbox, ignoreConnection, filter, origin }`
+     */
+    queueNotification(command, notification) {
+        this.notificationQueue.push(command);
+        if (this.directNotifications) {
+            this.processNotifications();
+        }
+    }
+    upgradeConnection(callback) {
+        this.upgrading = true;
+        // Anything the client sent after STARTTLS in plaintext must not be executed after the upgrade (RFC 9051
+        // section 6.2.1). STARTTLS is refused when input is waiting (the noPipelining command option), this only
+        // guards against plugins that upgrade the connection otherwise
+        this.discardInput();
+        const secureContext = node_tls_1.default.createSecureContext(this.server.getCredentials());
+        const socketOptions = {
+            secureContext: secureContext,
+            isServer: true,
+            server: this.server.server,
+            // throws if SNICallback is missing, so we set a default callback
+            SNICallback: function (servername, cb) {
+                cb(null, secureContext);
+            }
+        };
+        // STARTTLS runs on a live connection
+        const socket = this.socket;
+        // remove all listeners from the original socket besides the error handler
+        socket.removeAllListeners();
+        socket.on('error', this.onError.bind(this));
+        // upgrade connection
+        const secureSocket = new node_tls_1.default.TLSSocket(socket, socketOptions);
+        const onTLSError = (err) => {
+            // a failed handshake leaves nothing to talk to, so drop the connection
+            if (this.options.debug) {
+                console.log('TLS error: %s', err.message);
+            }
+            secureSocket.destroy();
+        };
+        secureSocket.on('close', this.onClose.bind(this));
+        secureSocket.on('error', onTLSError);
+        secureSocket.on('clientError', onTLSError);
+        secureSocket.on('secure', () => {
+            this.secureConnection = true;
+            this.socket = secureSocket;
+            this.upgrading = false;
+            secureSocket.on('data', this.receive.bind(this));
+            callback();
+        });
+    }
+    /**
+     * Turns the queued notifications into the responses to send. Plugins can replace it per connection
+     * to report changes in another form (e.g. VANISHED instead of EXPUNGE with QRESYNC)
+     *
+     * @param {Array} queue Queued notifications
+     * @return {Array} Notifications to send
+     */
+    prepareNotifications(queue) {
+        return queue;
+    }
+    processNotifications(data) {
+        const options = data && this.server.getCommandOptions(data.command);
+        if (options && (options.noExpunge || (options.searchCriteria !== false && this.usesSequenceNumbers(data)))) {
+            // EXPUNGE responses are not allowed during FETCH, STORE and SEARCH (RFC 3501 section 7.4.1), during
+            // the commands that extensions add to this list (see the noExpunge command option), nor during UID
+            // SEARCH with message numbers in the search criteria (RFC 7162 section 3.2.10.2 for VANISHED, EXPUNGE
+            // may wait as well, RFC 3501 only allows it during UID commands)
+            return;
+        }
+        if (!this.notificationQueue.length) {
+            return;
+        }
+        const queue = this.prepareNotifications(this.notificationQueue);
+        this.notificationQueue = [];
+        // Flag updates use the sequence numbers this session knows: before the EXPUNGE responses of
+        // the snapshot are sent, the snapshot, afterwards the current message list
+        const snapshotIndex = queue.findIndex(notification => notification.mailboxCopy);
+        const sequenceMaps = new Map();
+        const getSequence = (messages) => {
+            let sequence = sequenceMaps.get(messages);
+            if (!sequence) {
+                sequence = new Map(messages.map((message, i) => [message, i + 1]));
+                sequenceMaps.set(messages, sequence);
+            }
+            return sequence;
+        };
+        const current = this.selectedMailbox ? this.selectedMailbox.messages : [];
+        // a message changed several times is reported once, its FETCH response carries the current flags
+        const reported = new Set();
+        queue.forEach((notification, i) => {
+            if (notification.flagUpdate) {
+                // i < snapshotIndex only when there is a snapshot
+                this.sendFlagUpdate(notification.flagUpdate, getSequence(i < snapshotIndex ? queue[snapshotIndex].mailboxCopy : current), reported);
+            }
+            else {
+                this.send(notification);
+            }
+        });
+    }
+    /**
+     * Compile a command object to a response string and write it to socket.
+     * If the command object has a skipResponse property, the command is
+     * ignored
+     *
+     * @param {Object} response Response IMAP command object to be compiled.
+     * @param {String} description
+     *   An upper-case string uniquely identifying the response for the benefit of
+     *   output handlers that wish to augment/replace the given response.
+     * @param {Object} parsed
+     *   Original parsed IMAP command that this is in response to.
+     * @param {String} data
+     *   Original raw IMAP command as a binary string.
+     * @param {Object} extra
+     *   Response-specific payload, usually the subject of the response.  For
+     *   example, the STORE command will pass the impacted message for each updated
+     *   FETCH result.  (This may have other names when used, like "affected".)
+     */
+    send(response, description, parsed, data, ...extra) {
+        // nothing goes out once the connection is closing (RFC 3501 section 7.1.5)
+        if (!this.socket || this.socket.destroyed || this._closing) {
+            return;
+        }
+        if (!response.notification && response.tag !== '*') {
+            // arguments[2] should be the original command
+            this.processNotifications(parsed);
+        }
+        this.server.outputHandlers.forEach(handler => {
+            handler(this, response, description, parsed, data, ...extra);
+        });
+        // No need to display this response to user
+        if (response.skipResponse) {
+            return;
+        }
+        if (this.notificationQueue.length &&
+            parsed &&
+            response.tag === parsed.tag &&
+            response.command === 'OK' &&
+            this.hasPendingExpunge() &&
+            this.server.getCommandOptions(parsed.command).noExpunge &&
+            !(Array.isArray(response.attributes) && response.attributes.some(attr => attr && attr.type === 'SECTION'))) {
+            // After the output handlers, they might add a response code of their own (MODIFIED of CONDSTORE).
+            // FETCH, STORE, SEARCH and the like can not report the EXPUNGE of another session (RFC 3501 section 7.4.1),
+            // EXPUNGEISSUED tells the client to issue NOOP soon (RFC 5530 section 3, RFC 9051 section 7.1)
+            response.attributes = [{ type: 'SECTION', section: [{ type: 'ATOM', value: 'EXPUNGEISSUED' }] }].concat(response.attributes || []);
+        }
+        // a { type: 'MAILBOX', value } attribute holds a storage name, sent in the form this session uses. It
+        // can also be in a list, like the MAILBOX correlator of an ESEARCH response (RFC 7377 section 4)
+        const isMailbox = (attr) => attr && attr.type === 'MAILBOX';
+        const hasMailbox = (list) => list.some((attr) => isMailbox(attr) || (Array.isArray(attr) && hasMailbox(attr)));
+        const exportList = (list) => list.map((attr) => isMailbox(attr) ? mailboxAttribute(this.exportMailboxName(attr.value)) : Array.isArray(attr) ? exportList(attr) : attr);
+        if (Array.isArray(response.attributes) && hasMailbox(response.attributes)) {
+            response = Object.assign({}, response, { attributes: exportList(response.attributes) });
+        }
+        // RFC 3501 section 9: TEXT-CHAR is 7-bit (CHAR = %x01-7F), so client input echoed in the
+        // human readable text of a status response must not carry 8-bit or control octets
+        if (STATUS_RESPONSES.has((response.command || '').toString().toUpperCase()) && Array.isArray(response.attributes)) {
+            const isUnsafe = (attr) => attr && attr.type === 'TEXT' && typeof attr.value === 'string' && /[^\x20-\x7e]/.test(attr.value);
+            if (response.attributes.some(isUnsafe)) {
+                response = Object.assign({}, response, {
+                    attributes: response.attributes.map((attr) => isUnsafe(attr) ? Object.assign({}, attr, { value: attr.value.replace(/[^\x20-\x7e]/g, '?') }) : attr)
+                });
+            }
+        }
+        let compiled;
+        try {
+            compiled = imap_handler_1.default.compiler(response, this.compilerOptions);
+        }
+        catch (err) {
+            // the compiler refuses unsafe output, like line breaks in a TEXT value
+            if (this.options.debug) {
+                console.log('Failed to compile response: %s', err.message);
+            }
+            if (response.tag === '*') {
+                return;
+            }
+            compiled = response.tag + ' NO [SERVERBUG] Failed to compile response';
+        }
+        if (this.options.debug) {
+            console.log('SEND: %s', compiled);
+        }
+        this.write(compiled + '\r\n');
+    }
+    /**
+     * Sends a tagged status response to a command
+     *
+     * @param {Object} parsed Parsed command
+     * @param {String} data Raw command
+     * @param {String} command Response type: OK, NO or BAD
+     * @param {String} text Human readable text
+     * @param {String|Array} [code] Response code, eg. "TRYCREATE", sent as [TRYCREATE], or a list of
+     *   atoms like ["METADATA", "MAXSIZE", 1024], sent as [METADATA MAXSIZE 1024]
+     * @param {String} [description] Description for output handlers, defaults to the command name,
+     *   with " FAILED" appended for NO and BAD
+     */
+    sendStatus(parsed, data, command, text, code, description) {
+        const attributes = [];
+        if (code) {
+            attributes.push({
+                type: 'SECTION',
+                section: [].concat(code).map(value => ({
+                    type: 'ATOM',
+                    value: String(value)
+                }))
+            });
+        }
+        attributes.push({
+            type: 'TEXT',
+            value: text
+        });
+        if (!description) {
+            description = (parsed.command || '').toString().toUpperCase() + (command === 'OK' ? '' : ' FAILED');
+        }
+        this.send({
+            tag: parsed.tag,
+            command,
+            attributes
+        }, description, parsed, data);
+    }
+    /**
+     * Checks if a command was sent without waiting for an earlier command in a way that RFC 3501
+     * section 5.5 forbids: after any command other than FETCH, STORE or SEARCH (or another command with
+     * the noExpunge option, like SORT and THREAD from RFC 5256) the client must
+     * wait for the completion result before it sends a command with message sequence numbers,
+     * because an EXPUNGE response could change what the numbers refer to. A command was sent
+     * without waiting if such a command is still queued or running, or if it completed in the
+     * same read as this command arrived in.
+     *
+     * @param {Object} parsed Parsed command
+     * @return {Boolean} true if the command is ambiguous
+     */
+    isAmbiguous(parsed) {
+        if (!this.usesSequenceNumbers(parsed)) {
+            return false;
+        }
+        if (this._unsafeCompletedRead === this._readCount) {
+            return true;
+        }
+        const isUnsafe = (element) => !!element && !this.server.getCommandOptions(element.parsed.command).noExpunge;
+        return isUnsafe(this._runningCommand) || this._commandQueue.some(isUnsafe);
+    }
+    /**
+     * Checks if a command refers to messages by sequence number (RFC 3501 section 5.5)
+     *
+     * @param {Object} parsed Parsed command
+     * @return {Boolean} true if the command uses message sequence numbers
+     */
+    usesSequenceNumbers(parsed) {
+        const { sequenceSet, searchCriteria } = this.server.getCommandOptions(parsed.command);
+        if (sequenceSet !== false) {
+            // other forms of sequence sets, like "$" of SEARCHRES (RFC 5182 section 2.3), do not use numbers
+            const value = parsed.attributes && parsed.attributes[sequenceSet];
+            return !value || /^[\d*]/.test(String(value.value));
+        }
+        if (searchCriteria !== false) {
+            return (0, search_js_1.hasSequenceSetKey)(this.server, (parsed.attributes || []).slice(searchCriteria));
+        }
+        return false;
+    }
+    /**
+     * Decodes a SASL client response. It must be valid base64 by the RFC 3501 section 9 grammar,
+     * "=" stands for an empty initial response (RFC 4959 section 3).
+     *
+     * @param {String} str Client response
+     * @return {Buffer|Boolean} Decoded value, or false if the input is not valid base64
+     */
+    decodeSaslResponse(str) {
+        if (str === '=') {
+            return Buffer.alloc(0);
+        }
+        if (typeof str !== 'string' || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(str)) {
+            return false;
+        }
+        return Buffer.from(str, 'base64');
+    }
+    /**
+     * Returns the target mailbox of APPEND, COPY or MOVE. If messages can not be added
+     * to it, a tagged NO is sent and false is returned
+     *
+     * @param {String} path Mailbox path
+     * @param {Object} parsed Parsed command
+     * @param {String} data Raw command
+     * @param {String} description Description for the failure response
+     * @return {Object|false} Mailbox object
+     */
+    getTargetMailbox(path, parsed, data, description) {
+        const refusal = this.server.targetRefusal(path);
+        if (refusal) {
+            this.sendStatus(parsed, data, refusal.command, refusal.text, refusal.code, description);
+            return false;
+        }
+        // targetRefusal() found it
+        return this.server.getMailbox(path);
+    }
+    /**
+     * Runs the checks of `server.appendChecks` before messages are added to a mailbox. A check
+     * returns nothing if the messages may be added, or `{ code, text, soft }`: a hard failure is
+     * sent as a tagged NO with the response code and false is returned, a soft one (`soft: true`)
+     * only as an untagged NO warning, e.g. `* NO [OVERQUOTA] ...` (RFC 9208 section 4.3.1).
+     *
+     * @param {Object} mailbox Target mailbox
+     * @param {Array} messages Messages to add, objects with the message source as `raw`
+     * @param {Object} parsed Parsed command
+     * @param {String} data Raw command
+     * @param {String} description Description for the failure response
+     * @param {Object} [options] `{ move, source }`, set for MOVE with the source mailbox, or `{ command, replaced }`
+     *   for APPEND like commands (APPEND, REPLACE), `replaced` is the message that REPLACE removes
+     * @return {Boolean} true if the messages may be added
+     */
+    checkAppend(mailbox, messages, parsed, data, description, options) {
+        return this.applyChecks(this.server.appendChecks.map(check => check(this, mailbox, messages, options || {})), parsed, data, description);
+    }
+    /**
+     * Reports the results of checks like `server.appendChecks`: the first hard failure as a tagged
+     * NO, or soft ones as untagged NO warnings
+     *
+     * @param {Array} results Check results, `{ code, text, soft }` or nothing
+     * @param {Object} parsed Parsed command
+     * @param {String} data Raw command
+     * @param {String} description Description for the failure response
+     * @return {Boolean} false if the command failed
+     */
+    applyChecks(results, parsed, data, description) {
+        const found = results.filter((result) => !!result);
+        const failure = found.find(result => !result.soft);
+        if (failure) {
+            this.sendStatus(parsed, data, 'NO', failure.text, failure.code, description);
+            return false;
+        }
+        found.forEach(result => {
+            this.send({
+                tag: '*',
+                command: 'NO',
+                attributes: [
+                    { type: 'SECTION', section: [{ type: 'ATOM', value: result.code }] },
+                    { type: 'TEXT', value: result.text }
+                ]
+            }, 'CHECK WARNING', parsed, data);
+        });
+        return true;
+    }
+    /**
+     * Converts a mailbox name from a command to the name used in storage, which is modified UTF-7
+     * (RFC 3501 section 5.1.3). A plugin can replace this per connection, e.g. UTF8=ACCEPT.
+     *
+     * @param {String} name Mailbox name as a binary string
+     * @return {String} Storage name
+     * @throws {Error} BAD error if the name is not valid
+     */
+    importMailboxName(name) {
+        const error = (0, mailbox_name_js_1.default)(name);
+        if (error) {
+            const err = new Error(error);
+            err.imapResponse = 'BAD';
+            throw err;
+        }
+        return name;
+    }
+    /**
+     * Converts a mailbox name from storage to the form sent to the client. Every response that
+     * includes a mailbox name must use this. A plugin can replace this per connection.
+     *
+     * @param {String} path Storage name
+     * @return {String} Mailbox name as a binary string
+     */
+    exportMailboxName(path) {
+        return path;
+    }
+    scheduleCommand(data) {
+        let parsed;
+        const tag = getResponseTag(data);
+        try {
+            // server.parserOptions are the defaults of plugins, connection.parserOptions win
+            parsed = imap_handler_1.default.parser(data, Object.assign({ literalPlus: this.server.literalPlus }, this.server.parserOptions, this.parserOptions));
+        }
+        catch (E) {
+            const error = E;
+            this.send({
+                tag: '*',
+                command: 'BAD',
+                attributes: [
+                    {
+                        type: 'SECTION',
+                        section: [
+                            {
+                                type: 'ATOM',
+                                value: 'SYNTAX'
+                            }
+                        ]
+                    },
+                    {
+                        type: 'TEXT',
+                        value: error.message
+                    }
+                ]
+            }, 'ERROR MESSAGE', null, data, error);
+            this.send({
+                tag: tag,
+                command: 'BAD',
+                attributes: [
+                    {
+                        type: 'TEXT',
+                        value: 'Error parsing command'
+                    }
+                ]
+            }, 'ERROR RESPONSE', null, data, error);
+            return;
+        }
+        if (this.isPipelinedAfterRefusal()) {
+            this.refusePipelined(parsed, data);
+            return;
+        }
+        if (this.server.getCommandHandler(parsed.command)) {
+            if (this.isAmbiguous(parsed)) {
+                this.sendStatus(parsed, data, 'BAD', 'Commands with message sequence numbers must wait for the completion of earlier commands');
+                return;
+            }
+            this._commandQueue.push({
+                parsed: parsed,
+                data: data
+            });
+            this.processQueue();
+        }
+        else if (/^AUTHENTICATE /i.test(parsed.command)) {
+            // an unsupported mechanism is a NO, not a syntax error (RFC 3501 section 6.2.2)
+            this.send({
+                tag: parsed.tag,
+                command: 'NO',
+                attributes: [
+                    {
+                        type: 'TEXT',
+                        value: 'Unsupported authentication mechanism'
+                    }
+                ]
+            }, 'UNKNOWN COMMAND', parsed, data);
+        }
+        else {
+            this.send({
+                tag: parsed.tag,
+                command: 'BAD',
+                attributes: [
+                    {
+                        type: 'TEXT',
+                        value: 'Invalid command ' + parsed.command + ''
+                    }
+                ]
+            }, 'UNKNOWN COMMAND', parsed, data);
+        }
+    }
+    processQueue(force) {
+        if (!force && this._processing) {
+            return;
+        }
+        if (!this._commandQueue.length) {
+            this._processing = false;
+            return;
+        }
+        this._processing = true;
+        const element = this._commandQueue.shift();
+        const command = element.parsed.command.toUpperCase();
+        this._runningCommand = element;
+        const options = this.server.getCommandOptions(command);
+        let done = false;
+        const next = () => {
+            if (done) {
+                // a handler must release the queue only once
+                return;
+            }
+            done = true;
+            this._runningCommand = null;
+            if (!options.noExpunge) {
+                // commands with sequence numbers that arrive in the same read did not wait for this one
+                this._unsafeCompletedRead = this._readCount;
+            }
+            if (!this._commandQueue.length) {
+                this._processing = false;
+            }
+            else {
+                this.processQueue(true);
+            }
+        };
+        if (options.states && options.states.indexOf(this.state) < 0) {
+            this.sendStatus(element.parsed, element.data, 'BAD', stateError(command, this.state));
+            return next();
+        }
+        if (element.parsed.attributes && options.noArguments) {
+            this.sendStatus(element.parsed, element.data, 'BAD', command + ' does not take any arguments');
+            return next();
+        }
+        if (options.noPipelining && this.hasPendingInput()) {
+            // the layer change is not made. The commands that follow were meant to run in the new layer (under TLS, or
+            // compressed), so none of them runs: they are refused like this command, see refusePipelined
+            this.sendStatus(element.parsed, element.data, 'BAD', 'Commands must not be pipelined after ' + command);
+            this._pipelinedAfter = { command, read: this._readCount };
+            this._commandQueue.splice(0).forEach(queued => this.refusePipelined(queued.parsed, queued.data));
+            return next();
+        }
+        // the parser reads every NIL atom as nil, but in an astring NIL is just a name (e.g. SELECT NIL)
+        (0, arguments_js_1.restoreNilAtoms)(element.parsed, element.data, path => (path.length === 1 && (options.mailboxArguments.includes(path[0]) || options.astringArguments.includes(path[0]))) ||
+            (options.searchCriteria !== false && path[0] >= options.searchCriteria));
+        const nameError = importMailboxArguments(this, element.parsed, options.mailboxArguments);
+        if (nameError) {
+            this.sendStatus(element.parsed, element.data, 'BAD', nameError);
+            return next();
+        }
+        for (const check of this.server.commandChecks) {
+            const refusal = check(this, element.parsed);
+            if (refusal) {
+                this.sendStatus(element.parsed, element.data, refusal.command || 'BAD', refusal.text, refusal.code);
+                return next();
+            }
+        }
+        if (command.substr(0, 4) === 'UID ' && this.hasPendingExpunge()) {
+            // EXPUNGE responses may be sent during UID commands (RFC 3501 section 7.4.1). The expunges of other sessions
+            // are reported first, then the command runs on the current mailbox, where the UIDs of the expunged messages
+            // do not exist and are ignored (RFC 3501 section 6.4.8), so the ghost handling of STORE, COPY and MOVE (RFC 2180
+            // section 4) only applies to their sequence number forms. Not for UID SEARCH with message numbers in the
+            // criteria, processNotifications knows when EXPUNGE must wait
+            this.processNotifications(element.parsed);
+        }
+        try {
+            // changes made while the handler runs are attributed to this session (the `origin` of notifications)
+            this.server.activeConnection = this;
+            this.server.getCommandHandler(element.parsed.command)(this, element.parsed, element.data, next);
+        }
+        catch (E) {
+            const ex = E;
+            const badInput = ex.imapResponse === 'BAD';
+            if (!badInput && this.options.debug) {
+                console.error('Error processing command:', ex, '\n', ex.stack);
+            }
+            this.send({
+                tag: element.parsed.tag,
+                command: badInput ? 'BAD' : 'NO',
+                attributes: [].concat(badInput
+                    ? []
+                    : {
+                        type: 'SECTION',
+                        section: [
+                            {
+                                type: 'ATOM',
+                                value: 'SERVERBUG'
+                            }
+                        ]
+                    }, {
+                    type: 'TEXT',
+                    value: badInput ? ex.message : 'Server error: ' + ex.message
+                })
+            }, badInput ? 'INVALID COMMAND' : 'SERVER ERROR', element.parsed, element.data);
+            // keep the connection usable, otherwise every later command would hang
+            next();
+        }
+        finally {
+            this.server.activeConnection = null;
+        }
+    }
+    /**
+     * Removes messages with \Deleted flag
+     *
+     * @param {Object} mailbox Mailbox to check for
+     * @param {Boolean} [ignoreSelf] If set to true, does not send any notices to itself
+     * @param {Boolean} [ignoreSelf] If set to true, does not send EXISTS notice to itself
+     */
+    expungeDeleted(mailbox, ignoreSelf, ignoreExists) {
+        this.expungeSpecificMessages(mailbox, (message) => {
+            return message.flags.indexOf('\\Deleted') >= 0;
+        }, ignoreSelf, ignoreExists);
+    }
+    /**
+     * Given a set of messages in a mailbox (possibly via getMessageRange), remove
+     * them from the mailbox and generate EXPUNGE notifications.
+     *
+     * @param {Object} mailbox Mailbox to check for
+     * @param {Function|Array} messagesOrFilterFunc An Array of messages in the
+     *     folder that should be removed or a filtering function that indicates
+     *     messages to be removed by returning true.
+     * @param {Boolean} [ignoreSelf] If set to true, does not send any notices to itself
+     * @param {Boolean} [ignoreSelf] If set to true, does not send EXISTS notice to itself
+     * @param {Boolean} [highestFirst] If set to true, the EXPUNGE responses go from the highest UID to the lowest
+     *     (MESSAGELIMIT, RFC 9738 section 3.1), otherwise from the lowest
+     */
+    expungeSpecificMessages(mailbox, messagesOrFilterFunc, ignoreSelf, ignoreExists, highestFirst) {
+        let filterFunc;
+        if (Array.isArray(messagesOrFilterFunc)) {
+            const messageSet = new Set(messagesOrFilterFunc);
+            filterFunc = (message) => messageSet.has(message);
+        }
+        else {
+            filterFunc = messagesOrFilterFunc;
+        }
+        // sequence numbers of the removed messages, each one as it is after the earlier EXPUNGE responses. From the
+        // highest message down, the earlier responses do not change the sequence numbers of the later ones
+        const expunged = [];
+        const kept = [];
+        mailbox.messages.forEach((message, i) => {
+            if (filterFunc(message)) {
+                message.ghost = true;
+                expunged.push({ seq: highestFirst ? i + 1 : kept.length + 1, message });
+            }
+            else {
+                kept.push(message);
+            }
+        });
+        if (!expunged.length) {
+            return;
+        }
+        // old copy is required for those sessions that run FETCH before
+        // displaying the EXPUNGE notice
+        const mailboxCopy = mailbox.messages.slice();
+        // update the list in place, other code might hold a reference to it
+        kept.forEach((message, i) => {
+            mailbox.messages[i] = message;
+        });
+        mailbox.messages.length = kept.length;
+        // lets plugins track the removal (e.g. mod-sequences of CONDSTORE and QRESYNC) before any notification
+        this.server.emit('expunge', mailbox, expunged.map(entry => entry.message), this);
+        (highestFirst ? expunged.slice().reverse() : expunged).forEach(entry => {
+            this.server.notify({
+                tag: '*',
+                attributes: [
+                    entry.seq,
+                    {
+                        type: 'ATOM',
+                        value: 'EXPUNGE'
+                    }
+                ],
+                // the removed message, for plugins that report it differently (e.g. VANISHED of QRESYNC)
+                message: entry.message
+            }, mailbox, ignoreSelf ? this : false);
+        });
+        this.server.notify({
+            tag: '*',
+            attributes: [
+                mailbox.messages.length,
+                {
+                    type: 'ATOM',
+                    value: 'EXISTS'
+                }
+            ],
+            // distribute the old mailbox data with the notification
+            mailboxCopy: mailboxCopy
+        }, mailbox, ignoreSelf || ignoreExists ? this : false);
+    }
+}
+exports.IMAPConnection = IMAPConnection;
+/**
+ * Formats a mailbox name for a response: an atom when possible, otherwise a string. NIL and names
+ * like \\Foo would not read back as mailbox names, so these are strings as well
+ *
+ * @param {String} name Mailbox name as sent to the client
+ * @return {Object} Response attribute
+ */
+function mailboxAttribute(name) {
+    return { type: ATOM_REGEX.test(name) && !/^NIL$/i.test(name) ? 'ATOM' : 'STRING', value: name };
+}
+/**
+ * Checks the mailbox name arguments of a command and replaces them with the storage names.
+ * Arguments that are not strings are left to the command handler.
+ *
+ * @param {Object} connection IMAP connection
+ * @param {Object} parsed Parsed command
+ * @param {Array} positions Argument positions that hold mailbox names
+ * @return {String|Boolean} Description of the problem, or false if the names are valid
+ */
+function importMailboxArguments(connection, parsed, positions) {
+    for (const position of positions) {
+        const attr = (parsed.attributes || [])[position];
+        if (attr && ['STRING', 'ATOM', 'LITERAL'].indexOf(attr.type) >= 0) {
+            try {
+                attr.value = connection.importMailboxName(attr.value);
+            }
+            catch (err) {
+                return err.message;
+            }
+        }
+    }
+    return false;
+}
+{
+    const defaultExport = exports.default;
+    if (defaultExport && (typeof defaultExport === 'function' || typeof defaultExport === 'object')) {
+        for (const key of Object.keys(exports)) {
+            if (key !== 'default' && !(key in defaultExport)) {
+                defaultExport[key] = exports[key];
+            }
+        }
+        Object.defineProperty(defaultExport, 'default', { value: defaultExport, enumerable: false, writable: true, configurable: true });
+        module.exports = defaultExport;
+    }
+}