imapkit 4.3.1 → 5.0.1

package/dist/esm/server.js

@@ -7,14 +7,19 @@ import loadPlugins from './load-plugins.js';
 import { commands as builtinCommands } from './commands/index.js';
 import { getCommandOptions, commandOptions } from './command-states.js';
 import validateMailboxName from './mailbox-name.js';
-import { MONTHS, monthIndex, isRealDate } from './dates.js';
+import { MONTHS, monthIndex, isDateTime } from './dates.js';
 import fetchHandlers from './commands/handlers/fetch.js';
 import { hasSequenceSetKey } from './commands/handlers/search.js';
 import { isSequenceSet } from './numbers.js';
-import { restoreNilAtoms } from './arguments.js';
+import { restoreNilAtoms, isAtom } from './arguments.js';
 import { refuseMissingTarget } from './commands/append.js';
+import { DEFAULT_SESSION_TIMEOUT, storeError, expungeMessages, notifyFlagChanges } from './store-operations.js';
+import { Control } from './control.js';
+import { resolveQuirks } from './quirks.js';
+import { validateStorage } from './storage-schema.js';
+import { createRestServer } from './rest.js';
 import * as bundledCert from './cert.js';
-import { ServerScript, sendOutput, handleLine, literalResponse, releaseDeferred } from './script.js';
+import { ServerScript, sendOutput, handleLine, handleQuiet, literalResponse, releaseDeferred } from './script.js';
 // longest command line (not counting literals) accepted from a client
 const MAX_LINE_LENGTH = 1024 * 1024;
 // milliseconds between the last output and the RST of a script rule with `close: 'reset'`
@@ -60,17 +65,35 @@ function stateError(command, state) {
     return command + ' is not allowed in the ' + state + ' state';
 }
 /**
- * Creates an error for a failed mailbox operation, with a RFC 5530 response code
+ * Checks if a queued notification changes message sequence numbers by removing messages: an EXPUNGE response, or the
+ * EXISTS that follows the EXPUNGE responses of another session (it carries the snapshot of the old message list)
  *
- * @param {String} message Error message
- * @param {String} code Response code, e.g. "ALREADYEXISTS"
- * @return {Error} Error object
+ * @param {Object} notification Queued notification
+ * @return {Boolean} true if the notification must wait while EXPUNGE responses are not allowed
  */
-function mailboxError(message, code) {
-    const err = new Error(message);
-    err.code = code;
-    return err;
+function isPendingExpunge(notification) {
+    return !!notification.mailboxCopy || isAtom(notification.attributes && notification.attributes[1], 'EXPUNGE');
 }
+/**
+ * Checks if a notification is an untagged EXISTS response
+ *
+ * @param {Object} [notification] Notification to send
+ * @return {Boolean} true for an EXISTS response
+ */
+function isExists(notification) {
+    return !!notification && !notification.command && isAtom(notification.attributes && notification.attributes[1], 'EXISTS');
+}
+/**
+ * Answers AUTHENTICATE with a mechanism no plugin supports: NO, not a syntax error (RFC 3501 section 6.2.2). It runs
+ * through the command queue, so the state check comes first (AUTHENTICATE is only valid in the Not Authenticated
+ * state, RFC 3501 section 6.2)
+ */
+// usesSequenceNumbers() of each running command
+const sequenceNumberUse = new WeakMap();
+const unsupportedMechanism = (connection, parsed, data, callback) => {
+    connection.sendStatus(parsed, data, 'NO', 'Unsupported authentication mechanism', false, 'UNKNOWN COMMAND');
+    callback();
+};
 /**
  * Creates a new IMAP server, call `listen()` on it to start accepting connections
  *
@@ -159,11 +182,33 @@ class IMAPServer extends Stream {
         // the session whose command is running, see IMAPServer#notify
         this.activeConnection = null;
         this.sessionCounter = 0;
-        // rules that make the server misbehave on purpose, from the script option or server.script.add()
+        // rules that make the server misbehave on purpose, from the script option or server.script.add(), and the rules
+        // of the quirk presets after them
         this.script = new ServerScript(this, this.options.script);
-        // users and storage are deep copied, so that runtime changes never leak into
-        // the caller's objects or into other servers built from the same fixture.
-        // Without a prototype, user names like "__proto__" or "toString" are plain keys
+        const quirks = resolveQuirks(this.options.quirks);
+        if (quirks.rules.length) {
+            this.script.add(quirks.rules);
+        }
+        this.loadUsers();
+        // plugins register their control operations
+        this.control = new Control(this);
+        // a quirk preset can leave plugins out (no-move, no-uidplus)
+        loadPlugins(this, this.options.plugins, quirks.removePlugins);
+        if (this.options.storage) {
+            // a typo in a fixture fails here with the path of the problem
+            validateStorage(this.options.storage);
+        }
+        this.systemFlags = [].concat(this.options.systemFlags || ['\\Answered', '\\Flagged', '\\Draft', '\\Deleted', '\\Seen']);
+        this.loadStorage();
+        this.smtpServer = null;
+        this.restServer = null;
+    }
+    /**
+     * Sets the users from the `users` option, or the default user. The users are deep copied, so that runtime changes
+     * never leak into the caller's objects or into other servers built from the same fixture. Without a prototype,
+     * user names like "__proto__" or "toString" are plain keys
+     */
+    loadUsers() {
         this.users = Object.assign(Object.create(null), this.options.users
             ? structuredClone(this.options.users)
             : {
@@ -171,12 +216,16 @@ class IMAPServer extends Stream {
                     password: 'testpass',
                     xoauth2: {
                         accessToken: 'testtoken',
-                        sessionTimeout: 3600 * 1000
+                        sessionTimeout: DEFAULT_SESSION_TIMEOUT
                     }
                 }
             });
-        loadPlugins(this, this.options.plugins);
-        this.systemFlags = [].concat(this.options.systemFlags || ['\\Answered', '\\Flagged', '\\Draft', '\\Deleted', '\\Seen']);
+    }
+    /**
+     * Builds the mailboxes from the `storage` option, a deep copy of it. Message and mailbox handlers of plugins run
+     * on every message and mailbox
+     */
+    loadStorage() {
         // indexFolders() below turns the storage option into namespaces and mailboxes in place
         this.storage = (this.options.storage
             ? structuredClone(this.options.storage)
@@ -184,6 +233,7 @@ class IMAPServer extends Stream {
                 INBOX: {},
                 '': {}
             });
+        this.referenceNamespace = false;
         this.uidvalidityCounter = 0; // highest UIDVALIDITY in use, new mailboxes get a higher one
         // subscribed mailbox names (RFC 3501 section 6.3.6). Names, not mailboxes: a subscription outlives
         // DELETE and stays with the old name on RENAME (RFC 9051 section 6.3.6), see trackSubscription
@@ -191,10 +241,67 @@ class IMAPServer extends Stream {
         this.folderCache = Object.create(null);
         this.indexFolders(true);
     }
+    /**
+     * Starts accepting connections
+     *
+     * @param {Number} [port] Port to listen on, a free port if not set
+     * @param {String} [host] Address to listen on, all addresses if not set
+     * @return {Promise<Number>} resolves with the port the server listens on
+     */
+    async start(port, host) {
+        const imapPort = await listenOn(this.server, port, host);
+        await Promise.all([this.options.smtp ? this.startSmtp() : null, this.options.rest ? this.startRest() : null]);
+        return imapPort;
+    }
+    /**
+     * Starts the REST API of the `rest` option, see src/rest.ts
+     *
+     * @return {Promise<Number>} resolves with the HTTP port
+     */
+    async startRest() {
+        const { port, host, token } = this.options.rest || {};
+        this.restServer = createRestServer(this, { host, token });
+        return listenOn(this.restServer, port, host || '127.0.0.1');
+    }
+    /**
+     * Starts the SMTP server of the `smtp` option. smtp-server is an optional dependency, loaded only here
+     *
+     * @return {Promise<Number>} resolves with the SMTP port
+     */
+    startSmtp() {
+        const { port, host } = this.options.smtp || {};
+        return this.loadSmtpListener().then(({ startSMTPServer }) => new Promise((resolve, reject) => {
+            const smtp = startSMTPServer(port || 0, this, smtpPort => {
+                smtp.removeListener('error', reject);
+                resolve(smtpPort);
+            }, host);
+            smtp.once('error', reject);
+            this.smtpServer = smtp;
+        }));
+    }
+    /**
+     * Loads the SMTP listener, which needs the smtp-server package
+     *
+     * @return {Promise<Object>} the smtp-listener module
+     */
+    loadSmtpListener() {
+        return import('./smtp-listener.js').catch((err) => {
+            throw new Error('The smtp option needs the smtp-server package, install it with: npm install smtp-server (' + err.message + ')');
+        });
+    }
+    /**
+     * Stops the server and closes every connection
+     *
+     * @return {Promise} resolves when the server is closed
+     */
+    stop() {
+        return this.control.shutdown({ graceful: false });
+    }
     listen(...args) {
         this.server.listen.apply(this.server, args);
     }
     close(callback) {
+        this.closeListeners(true);
         this.server.close(callback);
         // close() only completes once all connections are gone
         this.connections.forEach((connection) => {
@@ -203,6 +310,31 @@ class IMAPServer extends Stream {
             }
         });
     }
+    /**
+     * Stops the SMTP and REST listeners of `start()`
+     *
+     * @param {Boolean} force true closes the open REST connections too, otherwise only the idle ones (a request that
+     *   is answered, like POST /v1/shutdown, finishes first)
+     */
+    closeListeners(force) {
+        if (this.smtpServer) {
+            this.smtpServer.close(() => false);
+            this.smtpServer = null;
+        }
+        if (this.restServer) {
+            // event streams never end on their own, a graceful shutdown would wait for them forever
+            this.restServer.endStreams?.();
+            this.restServer.close();
+            // keep-alive connections would hold the server open
+            if (force) {
+                this.restServer.closeAllConnections?.();
+            }
+            else {
+                this.restServer.closeIdleConnections?.();
+            }
+            this.restServer = null;
+        }
+    }
     /**
      * Returns TLS key and certificate. Without credentials in the options the
      * bundled self-signed certificate for localhost is used.
@@ -322,13 +454,31 @@ class IMAPServer extends Stream {
      *
      * @param {String} type Kind of change
      * @param {String} path Storage name of the mailbox
-     * @param {Object} [details] `{ oldPath, mailbox }`: the earlier name of a renamed mailbox, the mailbox
-     *   object that a DELETE removed
+     * @param {Object} [details] `{ oldPath, mailbox, created }`: the earlier name of a renamed mailbox, the mailbox
+     *   object that a DELETE removed, the mailboxes a CREATE made (superior levels first)
      */
     mailboxChanged(type, path, details) {
         const event = Object.assign({ type, path, oldPath: null, mailbox: null }, details, { origin: this.activeConnection });
         this.emit('mailbox', event);
     }
+    /**
+     * Runs a change with `origin` as the session that caused it, the `origin` of the notifications and events it
+     * makes. Commands run with their session, the control API with null
+     *
+     * @param {Object|null} origin Session, or null for a change from outside
+     * @param {Function} fn Change
+     * @return {*} the result of fn
+     */
+    withOrigin(origin, fn) {
+        const previous = this.activeConnection;
+        this.activeConnection = origin;
+        try {
+            return fn();
+        }
+        finally {
+            this.activeConnection = previous;
+        }
+    }
     /**
      * Retrieves the handler of an IMAP command
      *
@@ -352,8 +502,7 @@ class IMAPServer extends Stream {
         let seen = 0;
         let unseen = 0;
         // flags stay defined in the mailbox once a message had them, see rememberFlags
-        const permanentFlags = [].concat(mailbox.permanentFlags || []);
-        (mailbox.knownFlags || []).forEach(flag => this.ensureFlag(permanentFlags, flag));
+        const permanentFlags = this.permanentFlagList(mailbox);
         let recent = 0;
         // \Recent sets of the sessions that have this mailbox selected
         const recentSets = [];
@@ -399,20 +548,8 @@ class IMAPServer extends Stream {
      * @return {Boolean} Returns true if the date string is in IMAP date-time format
      */
     validateInternalDate(date) {
-        if (!date || typeof date !== 'string') {
-            return false;
-        }
-        // date-time from RFC 3501 section 9, month names are case-insensitive like all ABNF strings
-        const match = date.match(/^( \d|\d\d)-(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)-(\d{4}) (\d{2}):(\d{2}):(\d{2}) [-+](\d{2})(\d{2})$/i);
-        if (!match) {
-            return false;
-        }
-        // the values must also make a real date and time
-        return (isRealDate(match[1], monthIndex(match[2]), match[3]) &&
-            Number(match[4]) < 24 &&
-            Number(match[5]) < 60 &&
-            Number(match[6]) < 61 &&
-            Number(match[8]) < 60);
+        // date-time from RFC 3501 section 9
+        return isDateTime(date);
     }
     /**
      * Converts a date object to a valid date-time string format
@@ -461,22 +598,22 @@ class IMAPServer extends Stream {
      */
     createMailbox(path, defaultMailbox) {
         if (!path) {
-            throw mailboxError('Invalid mailbox name', 'CANNOT');
+            throw storeError('Invalid mailbox name', 'CANNOT');
         }
         // Ensure case insensitive INBOX
         if (path.toUpperCase() === 'INBOX') {
-            throw mailboxError('INBOX can not be modified', 'ALREADYEXISTS');
+            throw storeError('INBOX can not be modified', 'ALREADYEXISTS');
         }
         const { namespace, storage } = this.getPersonalNamespace(path);
         path = this.stripSeparator(path, storage.separator);
         if (this.folderCache[path] && this.folderCache[path].flags.indexOf('\\Noselect') < 0) {
-            throw mailboxError('Mailbox already exists', 'ALREADYEXISTS');
+            throw storeError('Mailbox already exists', 'ALREADYEXISTS');
         }
         const folderPath = path.substr(namespace.length).split(storage.separator);
         if (folderPath.some(name => !name)) {
             // an empty hierarchy level ("foo//bar", "/foo", "foo//"). RFC 5530 section 3 has this very case as the
             // example of CANNOT, Dovecot refuses it too
-            throw mailboxError('Mailbox names can not have empty hierarchy levels', 'CANNOT');
+            throw storeError('Mailbox names can not have empty hierarchy levels', 'CANNOT');
         }
         let parent = storage;
         let curPath = namespace;
@@ -487,7 +624,7 @@ class IMAPServer extends Stream {
             curPath += (curPath.length ? storage.separator : '') + folderName;
             let folder = this.getMailbox(curPath) || false;
             if (folder && folder.flags && folder.flags.indexOf('\\Noinferiors') >= 0) {
-                throw mailboxError('Can not create subfolders for ' + folder.path, 'CANNOT');
+                throw storeError('Can not create subfolders for ' + folder.path, 'CANNOT');
             }
             // a \Noselect placeholder that is created again is replaced with a new mailbox that only keeps
             // the children, nothing else of a deleted mailbox may come back (RFC 3501 section 6.3.3)
@@ -529,17 +666,17 @@ class IMAPServer extends Stream {
     deleteMailbox(path, keepContents) {
         // Ensure case insensitive INBOX
         if (path.toUpperCase() === 'INBOX') {
-            throw mailboxError('INBOX can not be modified', 'CANNOT');
+            throw storeError('INBOX can not be modified', 'CANNOT');
         }
         const { namespace, storage } = this.getPersonalNamespace(path);
         const mailbox = this.folderCache[this.stripSeparator(path, storage.separator)];
         if (!mailbox) {
-            throw mailboxError('Mailbox does not exist', 'NONEXISTENT');
+            throw storeError('Mailbox does not exist', 'NONEXISTENT');
         }
         if (mailbox.flags.indexOf('\\Noselect') >= 0 && Object.keys(mailbox.folders || {}).length) {
             // RFC 9051 section 6.3.5: deleting a \Noselect name that has inferior names is an error, the RFC 5530
             // section 3 HASCHILDREN response code tells the client to delete the children first
-            throw mailboxError('Mailbox has children, delete them first', 'HASCHILDREN');
+            throw storeError('Mailbox has children, delete them first', 'HASCHILDREN');
         }
         const levels = mailbox.path.split(storage.separator);
         const folderName = levels.pop();
@@ -589,7 +726,7 @@ class IMAPServer extends Stream {
             const prefix = key.length ? key.substr(0, key.length - this.storage[key].separator.length) : key;
             if (key.length && (path === prefix || path.substr(0, key.length) === key)) {
                 if (path === prefix) {
-                    throw mailboxError('Used mailbox name is a namespace value', 'CANNOT');
+                    throw storeError('Used mailbox name is a namespace value', 'CANNOT');
                 }
                 namespace = key;
             }
@@ -599,10 +736,10 @@ class IMAPServer extends Stream {
         });
         const storage = this.storage[namespace];
         if (!storage) {
-            throw mailboxError('Unknown namespace', 'CANNOT');
+            throw storeError('Unknown namespace', 'CANNOT');
         }
         if (storage.type !== 'personal') {
-            throw mailboxError('Permission denied', 'NOPERM');
+            throw storeError('Permission denied', 'NOPERM');
         }
         return { namespace, storage };
     }
@@ -843,6 +980,43 @@ class IMAPServer extends Stream {
         const knownFlags = (mailbox.knownFlags = mailbox.knownFlags || []);
         flags.forEach(flag => this.ensureFlag(knownFlags, flag));
     }
+    /**
+     * Checks if a flag can be stored on messages of a mailbox: any flag when the mailbox allows new keywords
+     * (PERMANENTFLAGS has `\*`), otherwise only a flag in the PERMANENTFLAGS list that getStatus() builds, the
+     * `permanentFlags` of the mailbox and every flag its messages had. RFC 3501 section 7.1 (RFC 9051 section 7.1):
+     * PERMANENTFLAGS "indicates which of the known flags the client can change permanently", STORE ignores the others
+     *
+     * @param {Object} mailbox Mailbox object
+     * @param {String} flag Normalized flag
+     * @return {Boolean} true if the flag is a permanent flag of the mailbox
+     */
+    isPermanentFlag(mailbox, flag) {
+        // the lists of permanentFlagList(), without building it: this runs for every flag STORE and APPEND set
+        return (mailbox.allowPermanentFlags || (mailbox.permanentFlags || []).indexOf(flag) >= 0 || (!!mailbox.knownFlags && mailbox.knownFlags.indexOf(flag) >= 0));
+    }
+    /**
+     * The flags of the PERMANENTFLAGS list (without `\*`): the `permanentFlags` of the mailbox and every flag its
+     * messages have or had (`knownFlags`, see rememberFlags)
+     *
+     * @param {Object} mailbox Mailbox object
+     * @return {Array} flags, a new list
+     */
+    permanentFlagList(mailbox) {
+        const list = [].concat(mailbox.permanentFlags || []);
+        (mailbox.knownFlags || []).forEach(flag => this.ensureFlag(list, flag));
+        return list;
+    }
+    /**
+     * The current time for dates the server sets itself (INTERNALDATE of a message without one, SAVEDATE). The `now`
+     * option fixes it for repeatable tests: a Date, a timestamp, or a function that returns one
+     *
+     * @return {Date} current time
+     */
+    now() {
+        const now = this.options.now;
+        const value = typeof now === 'function' ? now() : now;
+        return value === undefined || value === null ? new Date() : new Date(value);
+    }
     normalizeDateTime(value) {
         if (value instanceof Date) {
             return this.formatInternalDate(value);
@@ -861,7 +1035,7 @@ class IMAPServer extends Stream {
      * @param mailbox Mailbox of the message
      */
     processMessage(message, mailbox) {
-        message.internaldate = this.normalizeDateTime(message.internaldate || new Date());
+        message.internaldate = this.normalizeDateTime(message.internaldate || this.now());
         message.flags = [].concat(message.flags || []);
         if (message.flags.indexOf('\\Recent') >= 0) {
             // \Recent is not a stored flag, it belongs to the first session that selects the mailbox
@@ -903,9 +1077,10 @@ class IMAPServer extends Stream {
      */
     appendMessage(path, flags, internaldate, raw, ignoreConnection, properties) {
         const mailbox = typeof path === 'string' ? this.getMailbox(path) : path;
-        // processMessage() below sets the UID
+        // processMessage() below sets the UID. Flags the mailbox can not store are left out (APPEND, COPY: the flags
+        // SHOULD be set, RFC 3501 sections 6.3.11 and 6.4.7), as STORE ignores them (RFC 3501 section 7.1, PERMANENTFLAGS)
         const message = Object.assign({}, properties, {
-            flags: flags,
+            flags: flags.filter(flag => this.isPermanentFlag(mailbox, flag)),
             internaldate: internaldate,
             raw: raw,
             recent: true
@@ -1091,49 +1266,48 @@ class IMAPServer extends Stream {
         return flags;
     }
     matchFolders(referenceName, match, exportName, folders) {
-        let includeINBOX = false;
         const source = folders || this.folderCache;
         const toName = exportName || ((name) => name);
-        let reference = referenceName || '';
-        if (reference === '' && this.referenceNamespace !== false) {
-            reference = toName(this.referenceNamespace);
-            includeINBOX = true;
-        }
-        // the reference does not have to be a namespace, use the namespace it belongs to
-        let nsKey = false;
-        let nsName = '';
-        for (const key of Object.keys(this.storage)) {
-            const name = toName(key);
-            if (key !== 'INBOX' && reference.substr(0, name.length) === name && (nsKey === false || name.length > nsName.length)) {
-                nsKey = key;
-                nsName = name;
-            }
-        }
-        if (nsKey === false) {
-            return [];
-        }
-        const namespace = this.storage[nsKey];
-        const lookup = reference + match;
-        const result = [];
-        const pattern = '^' +
+        // RFC 3501 section 6.3.8 (RFC 9051 section 6.3.9): "An empty ("" string) reference name argument
+        // indicates that the mailbox name is interpreted as by SELECT", and without break out characters
+        // "the canonical form is normally the reference name appended with the mailbox name". The pattern
+        // matches full mailbox names, also in a personal namespace with a prefix such as "INBOX.". With the
+        // namespace convention "#" is a break out character "and must be treated as such" (RFC 3501 section 6.3.8,
+        // RFC 9051 section 6.3.9): a pattern that starts with it is a name of its own, the reference is ignored
+        const lookup = match.charAt(0) === '#' ? match : (referenceName || '') + match;
+        // "%" does not match the hierarchy delimiter, which is the one of the namespace a name belongs to
+        const toRegExp = (separator, flags = '') => new RegExp('^' +
             lookup
                 // escape regex symbols
                 .replace(/([\\^$+?!.():=[\]{}|,-])/g, '\\$1')
                 .replace(/[*]/g, '.*')
-                .replace(/[%]/g, '[^' + namespace.separator.replace(/([\\^$+*?!.():=[\]{}|,-])/g, '\\$1') + ']*') +
-            '$';
-        const query = new RegExp(pattern, '');
-        // INBOX is case-insensitive
-        if (includeINBOX && source.INBOX && ((reference ? reference + namespace.separator : '') + 'INBOX').match(new RegExp(pattern, 'i'))) {
+                .replace(/[%]/g, '[^' + separator.replace(/([\\^$+*?!.():=[\]{}|,-])/g, '\\$1') + ']*') +
+            '$', flags);
+        // RFC 3501 section 6.3.8 allows to "hide" otherwise accessible mailboxes from the wildcards: the
+        // mailboxes of namespaces other than the personal one are only matched when the pattern names
+        // the prefix of the namespace before any wildcard (LIST "" "user.%", LIST "#news." "*"). The pattern
+        // of every namespace that is matched, null for a hidden one
+        const fixedPrefix = lookup.replace(/[*%].*$/, '');
+        const queries = new Map();
+        Object.keys(this.storage).forEach(key => {
+            const name = toName(key);
+            const visible = key === this.referenceNamespace || fixedPrefix.substr(0, name.length) === name;
+            queries.set(key, visible ? toRegExp(this.storage[key].separator) : null);
+        });
+        const result = [];
+        // "The special name INBOX is included in the output from LIST, if [...] the uppercase string "INBOX"
+        // matches the interpreted reference and mailbox name arguments", INBOX is case-insensitive
+        if (source.INBOX && toRegExp((this.storage.INBOX && this.storage.INBOX.separator) || '/', 'i').test('INBOX')) {
             result.push(source.INBOX);
         }
         Object.keys(source).forEach(path => {
             const folder = source[path];
-            if (folder.namespace !== nsKey) {
+            const query = path !== 'INBOX' && folder.namespace !== false && folder.namespace !== 'INBOX' ? queries.get(folder.namespace) : null;
+            if (!query) {
                 return;
             }
             const name = toName(path);
-            if (name.match(query) && (folder.flags.indexOf('\\NonExistent') < 0 || name === match)) {
+            if (query.test(name) && (folder.flags.indexOf('\\NonExistent') < 0 || name === lookup)) {
                 result.push(folder);
             }
         });
@@ -1251,6 +1425,7 @@ class IMAPConnection {
         this.notificationQueue = [];
         this.server.on('notify', this._notificationCallback);
         this.server.connections.add(this);
+        this.emitSession('open');
         this.scriptOutput('greeting', '* OK ImapKit ready for rumble\r\n', {});
     }
     /**
@@ -1285,7 +1460,7 @@ class IMAPConnection {
         }
         this._outputQueue = this._outputQueue || [];
         this._outputQueue.push(Object.assign({}, operation, { transport: this.transport }));
-        if (!this._outputTimer) {
+        if (!this._outputTimer && !this._outputWaiting) {
             this.flushOutput();
         }
     }
@@ -1306,10 +1481,28 @@ class IMAPConnection {
                 return;
             }
             if (operation.data && operation.chunk && operation.data.length > operation.chunk) {
-                // the rest waits for chunkDelay, like a delay of its own
-                this.writeLayer(operation.data.subarray(0, operation.chunk), operation.transport || null);
+                // the rest waits for chunkDelay, like a delay of its own. Without a delay each piece waits for the next
+                // event loop turn, and Nagle's algorithm must not hold it back to merge it with the next one
+                const piece = operation.data.subarray(0, operation.chunk);
                 operation.data = operation.data.subarray(operation.chunk);
+                if (!operation.chunkDelay || operation.chunkDelay === 'tick') {
+                    // the next piece waits until this one was handed to the system, and one more event loop turn, so
+                    // the pieces leave as separate segments without a wall clock delay (#89)
+                    this.socket?.setNoDelay?.(true);
+                    this._outputWaiting = true;
+                    this.writeLayer(piece, operation.transport || null, () => {
+                        if (this._outputWaiting && this._outputQueue === queue) {
+                            this._outputTimer = nextTurn(() => {
+                                this._outputTimer = null;
+                                this._outputWaiting = false;
+                                this.flushOutput();
+                            });
+                        }
+                    });
+                    return;
+                }
                 operation.delay = operation.chunkDelay;
+                this.writeLayer(piece, operation.transport || null);
                 continue;
             }
             if (operation.data) {
@@ -1329,8 +1522,10 @@ class IMAPConnection {
     clearOutputQueue() {
         if (this._outputTimer) {
             clearTimeout(this._outputTimer);
+            clearImmediate(this._outputTimer);
             this._outputTimer = null;
         }
+        this._outputWaiting = false;
         this._outputQueue = null;
         this._deferredOutput = null;
     }
@@ -1339,13 +1534,17 @@ class IMAPConnection {
      *
      * @param {Buffer} data Output
      * @param {Object|null} transport Transport layer
+     * @param {Function} [callback] Called once the data was handed to the system (a transport: on the next turn)
      */
-    writeLayer(data, transport) {
+    writeLayer(data, transport, callback) {
         if (transport) {
             transport.write(data);
+            if (callback) {
+                setImmediate(callback);
+            }
         }
         else {
-            this.writeRaw(data);
+            this.writeRaw(data, callback);
         }
     }
     /**
@@ -1399,17 +1598,70 @@ class IMAPConnection {
      *
      * @param {Buffer} data Data to send
      */
-    writeRaw(data) {
+    writeRaw(data, callback) {
         if (this.socket && !this.socket.destroyed) {
-            this.socket.write(data);
+            this.socket.write(data, callback);
+            this.touch();
+        }
+    }
+    /**
+     * Notes input or output for the quiet events of script rules (#88)
+     */
+    touch() {
+        if (!this.server.script.watches('quiet')) {
+            // nothing waits for quiet sessions, a rule added later counts from then on
+            this._lastActivity = undefined;
+            return;
+        }
+        this._lastActivity = Date.now();
+        if (!this._quietTimer) {
+            this.watchQuiet();
         }
     }
+    /**
+     * Starts waiting for the next quiet event, if a rule waits for one and the session is not waiting already. When
+     * the time is up, the first rule that matches handles the event (`send`, `close`), the output it sends starts
+     * the next quiet time
+     *
+     * @param {Number} [checked] Quiet time the rules were checked for already, only longer ones are waited for
+     */
+    watchQuiet(checked = 0) {
+        if (this._quietTimer || !this.socket || this._closing) {
+            return;
+        }
+        const last = this._lastActivity || Date.now();
+        this._lastActivity = last;
+        // the time is measured from the last activity, a rule whose time is up already fires right away
+        const next = this.server.script.nextQuiet(checked);
+        if (next === null) {
+            return;
+        }
+        this._quietTimer = setTimeout(() => {
+            this._quietTimer = null;
+            if (!this.isOpen() || this._lastActivity !== last) {
+                // there was activity in between, it started a new wait
+                return this.watchQuiet();
+            }
+            // a timer can fire a millisecond before Date.now() says the time is up
+            const quiet = Math.max(Date.now() - last, next);
+            const found = this.server.script.check(this, 'quiet', { data: '', quiet });
+            if (found) {
+                handleQuiet(this, found.rule, found.context);
+            }
+            if (this._lastActivity === last) {
+                // nothing was sent, wait for the rules with a longer quiet time
+                this.watchQuiet(quiet);
+            }
+        }, Math.max(0, next - (Date.now() - last)));
+        this._quietTimer.unref();
+    }
     /**
      * Handles data from the socket, through the transport layer if there is one
      *
      * @param {Buffer} chunk Received data
      */
     receive(chunk) {
+        this.touch();
         if (this.transport) {
             this.transport.receive(chunk);
         }
@@ -1542,11 +1794,15 @@ class IMAPConnection {
      * notifications that were not sent yet are dropped. Sends nothing, the caller answers the command
      */
     closeMailbox() {
+        const wasSelected = !!this.selectedMailbox;
         this.state = 'Authenticated';
         this.selectedMailbox = false;
         this.readOnly = false;
         this.recent = null;
         this.notificationQueue = [];
+        if (wasSelected) {
+            this.emitSession('unselect');
+        }
     }
     onClose() {
         if (this.socket) {
@@ -1558,8 +1814,14 @@ class IMAPConnection {
             this.transport = null;
         }
         this.clearOutputQueue();
+        if (this._quietTimer) {
+            clearTimeout(this._quietTimer);
+            this._quietTimer = null;
+        }
         this.server.removeListener('notify', this._notificationCallback);
-        this.server.connections.delete(this);
+        if (this.server.connections.delete(this)) {
+            this.emitSession('close');
+        }
     }
     onError(err) {
         if (this.options.debug) {
@@ -1902,7 +2164,7 @@ class IMAPConnection {
      * @return {Boolean} true if an EXPUNGE response is pending
      */
     hasPendingExpunge() {
-        return this.notificationQueue.some(notification => notification.attributes && (notification.attributes[1] || {}).value === 'EXPUNGE');
+        return this.notificationQueue.some(isPendingExpunge);
     }
     /**
      * Tells the other sessions that have the selected mailbox open about changed flags, they get
@@ -1911,8 +2173,8 @@ class IMAPConnection {
      * @param {Array} messages Messages with changed flags
      */
     notifyFlagChanges(messages) {
-        if (messages.length && this.selectedMailbox) {
-            this.server.notify({ tag: '*', flagUpdate: messages }, this.selectedMailbox, this);
+        if (this.selectedMailbox) {
+            notifyFlagChanges(this.server, this.selectedMailbox, messages, this);
         }
     }
     /**
@@ -2109,22 +2371,52 @@ class IMAPConnection {
     prepareNotifications(queue) {
         return queue;
     }
-    processNotifications(data) {
-        const options = data && this.server.getCommandOptions(data.command);
-        if (options && (options.noExpunge || (options.searchCriteria !== false && this.usesSequenceNumbers(data)))) {
-            // EXPUNGE responses are not allowed during FETCH, STORE and SEARCH (RFC 3501 section 7.4.1), during
-            // the commands that extensions add to this list (see the noExpunge command option), nor during UID
-            // SEARCH with message numbers in the search criteria (RFC 7162 section 3.2.10.2 for VANISHED, EXPUNGE
-            // may wait as well, RFC 3501 only allows it during UID commands)
-            return;
-        }
+    /**
+     * Checks if EXPUNGE responses must wait while a command runs: during FETCH, STORE and SEARCH (RFC 3501 section
+     * 7.4.1), during the commands that extensions add to this list (see the noExpunge command option), and during UID
+     * SEARCH with message numbers in the search criteria (RFC 7162 section 3.2.10.2 for VANISHED, EXPUNGE may wait as
+     * well, RFC 3501 only allows it during UID commands)
+     *
+     * @param {Object} data Parsed command
+     * @return {Boolean} true if the command holds back EXPUNGE responses
+     */
+    holdsExpunge(data) {
+        const options = this.server.getCommandOptions(data.command);
+        return options.noExpunge || (options.searchCriteria !== false && this.usesSequenceNumbers(data));
+    }
+    /**
+     * Sends the queued notifications. During a command that holds back EXPUNGE responses (see holdsExpunge), or with
+     * `beforeCommand` before a command that refers to messages by sequence number, only the notifications queued before
+     * the first pending EXPUNGE go out: new messages (EXISTS) and flag changes. RFC 3501 section 5.2: "A server MUST send
+     * mailbox size updates automatically if a mailbox size change is observed during the processing of a command",
+     * section 7.4.1 forbids only EXPUNGE during FETCH, STORE and SEARCH. What was queued after the EXPUNGE waits with it,
+     * an EXISTS sent before it would describe a list that the client can not know yet
+     *
+     * @param {Object} [data] Parsed command that runs, or null between commands
+     * @param {Boolean} [beforeCommand] true when the command has not run yet, then a command with message sequence
+     *     numbers (COPY, MOVE) also waits with the EXPUNGE responses, its numbers refer to the messages before them
+     */
+    processNotifications(data, beforeCommand) {
         if (!this.notificationQueue.length) {
             return;
         }
-        const queue = this.prepareNotifications(this.notificationQueue);
-        this.notificationQueue = [];
+        let queue = this.notificationQueue;
         // Flag updates use the sequence numbers this session knows: before the EXPUNGE responses of
         // the snapshot are sent, the snapshot, afterwards the current message list
+        const snapshot = queue.find(notification => notification.mailboxCopy);
+        let held = [];
+        if (data && (this.holdsExpunge(data) || (beforeCommand && this.usesSequenceNumbers(data)))) {
+            const first = queue.findIndex(isPendingExpunge);
+            if (first >= 0) {
+                held = queue.slice(first);
+                queue = queue.slice(0, first);
+            }
+            if (!queue.length) {
+                return;
+            }
+        }
+        this.notificationQueue = held;
+        queue = this.prepareNotifications(queue);
         const snapshotIndex = queue.findIndex(notification => notification.mailboxCopy);
         const sequenceMaps = new Map();
         const getSequence = (messages) => {
@@ -2138,15 +2430,57 @@ class IMAPConnection {
         const current = this.selectedMailbox ? this.selectedMailbox.messages : [];
         // a message changed several times is reported once, its FETCH response carries the current flags
         const reported = new Set();
+        // before the snapshot (or with all of it still held back, then the split at the first pending expunge leaves
+        // no snapshot in the queue) the session knows the old list
+        const sessionList = (i) => (snapshot && (snapshotIndex < 0 || i < snapshotIndex) ? snapshot.mailboxCopy : current);
+        // the last EXISTS response of a run of EXISTS responses, and if the run announces new messages
+        let lastExists = -1;
+        let newMessages = false;
         queue.forEach((notification, i) => {
             if (notification.flagUpdate) {
-                // i < snapshotIndex only when there is a snapshot
-                this.sendFlagUpdate(notification.flagUpdate, getSequence(i < snapshotIndex ? queue[snapshotIndex].mailboxCopy : current), reported);
+                this.sendFlagUpdate(notification.flagUpdate, getSequence(sessionList(i)), reported);
             }
             else {
                 this.send(notification);
             }
+            if (isExists(notification)) {
+                lastExists = i;
+                // the EXISTS after the EXPUNGE responses of another session carries the snapshot instead of a message
+                newMessages = newMessages || !!notification.message;
+            }
+            const next = queue[i + 1];
+            if (lastExists < 0 || isExists(next) || (next && next.fetchedMessage)) {
+                // not the end of a run of EXISTS responses (and the FETCH responses NOTIFY sends after them)
+                return;
+            }
+            // RFC 3501 section 7.3.2: the RECENT response "occurs as a result of a SELECT or EXAMINE command, and if the
+            // size of the mailbox changes (e.g., new messages)". One for consecutive EXISTS responses that announce new
+            // messages, with the number of \Recent messages among those the client was told about. After expunges the
+            // EXPUNGE responses report the change (RFC 3501 section 7.4.1). It goes after the FETCH responses that NOTIFY
+            // sends for new messages, RFC 5465 section 5.2: "an unsolicited EXISTS response, followed by an unsolicited
+            // FETCH response [...] The server MAY also send a RECENT response"
+            if (newMessages) {
+                this.sendRecent(Number(queue[lastExists].attributes[0]), getSequence(sessionList(lastExists)));
+            }
+            lastExists = -1;
+            newMessages = false;
+        });
+    }
+    /**
+     * Sends an untagged RECENT response with the number of \Recent messages among the first `count` messages
+     *
+     * @param {Number} count Number of messages the client was told about
+     * @param {Map} sequence Message to the sequence number this session knows it by
+     */
+    sendRecent(count, sequence) {
+        let recent = 0;
+        (this.recent || new Set()).forEach(message => {
+            const seq = sequence.get(message);
+            if (seq && seq <= count) {
+                recent++;
+            }
         });
+        this.send({ tag: '*', notification: true, attributes: [recent, { type: 'ATOM', value: 'RECENT' }] }, 'RECENT NOTIFICATION');
     }
     /**
      * Compile a command object to a response string and write it to socket.
@@ -2168,7 +2502,7 @@ class IMAPConnection {
      */
     send(response, description, parsed, data, ...extra) {
         // nothing goes out once the connection is closing (RFC 3501 section 7.1.5)
-        if (!this.socket || this.socket.destroyed || this._closing) {
+        if (!this.isOpen()) {
             return;
         }
         if (!response.notification && response.tag !== '*') {
@@ -2178,6 +2512,9 @@ class IMAPConnection {
         this.server.outputHandlers.forEach(handler => {
             handler(this, response, description, parsed, data, ...extra);
         });
+        if (this._commandStart && parsed && response.tag === this._commandStart.tag && parsed.tag === response.tag) {
+            this.commandCompleted(String(response.command || '').toUpperCase());
+        }
         // No need to display this response to user
         if (response.skipResponse) {
             return;
@@ -2187,10 +2524,11 @@ class IMAPConnection {
             response.tag === parsed.tag &&
             response.command === 'OK' &&
             this.hasPendingExpunge() &&
-            this.server.getCommandOptions(parsed.command).noExpunge &&
+            this.holdsExpunge(parsed) &&
             !(Array.isArray(response.attributes) && response.attributes.some(attr => attr && attr.type === 'SECTION'))) {
             // After the output handlers, they might add a response code of their own (MODIFIED of CONDSTORE).
-            // FETCH, STORE, SEARCH and the like can not report the EXPUNGE of another session (RFC 3501 section 7.4.1),
+            // FETCH, STORE, SEARCH and the like can not report the EXPUNGE of another session (RFC 3501 section 7.4.1), nor
+            // can UID SEARCH with message numbers in the criteria (see holdsExpunge),
             // EXPUNGEISSUED tells the client to issue NOOP soon (RFC 5530 section 3, RFC 9051 section 7.1)
             response.attributes = [{ type: 'SECTION', section: [{ type: 'ATOM', value: 'EXPUNGEISSUED' }] }].concat(response.attributes || []);
         }
@@ -2334,6 +2672,15 @@ class IMAPConnection {
      * @return {Boolean} true if the command uses message sequence numbers
      */
     usesSequenceNumbers(parsed) {
+        // the notification checks ask several times per command, the answer does not change
+        let cached = sequenceNumberUse.get(parsed);
+        if (cached === undefined) {
+            cached = this.findSequenceNumbers(parsed);
+            sequenceNumberUse.set(parsed, cached);
+        }
+        return cached;
+    }
+    findSequenceNumbers(parsed) {
         const { sequenceSet, searchCriteria } = this.server.getCommandOptions(parsed.command);
         if (sequenceSet !== false) {
             // other forms of sequence sets, like "$" of SEARCHRES (RFC 5182 section 2.3), do not use numbers
@@ -2512,12 +2859,14 @@ class IMAPConnection {
             this.refusePipelined(parsed, data);
             return;
         }
-        if (this.server.getCommandHandler(parsed.command)) {
+        // an unknown SASL mechanism is answered by its own handler, after the central checks (state, script rules)
+        const fallback = /^AUTHENTICATE /i.test(parsed.command) && !this.server.getCommandHandler(parsed.command) ? unsupportedMechanism : undefined;
+        if (fallback || this.server.getCommandHandler(parsed.command)) {
             if (this.isAmbiguous(parsed)) {
                 this.sendStatus(parsed, data, 'BAD', 'Commands with message sequence numbers must wait for the completion of earlier commands');
                 return;
             }
-            const element = { parsed, data };
+            const element = { parsed, data, handler: fallback };
             if (scripted) {
                 // processQueue runs it once the script rule released the queue
                 this._commandQueue.unshift(element);
@@ -2527,19 +2876,6 @@ class IMAPConnection {
             }
             this.processQueue();
         }
-        else if (/^AUTHENTICATE /i.test(parsed.command)) {
-            // an unsupported mechanism is a NO, not a syntax error (RFC 3501 section 6.2.2)
-            this.send({
-                tag: parsed.tag,
-                command: 'NO',
-                attributes: [
-                    {
-                        type: 'TEXT',
-                        value: 'Unsupported authentication mechanism'
-                    }
-                ]
-            }, 'UNKNOWN COMMAND', parsed, data);
-        }
         else {
             this.send({
                 tag: parsed.tag,
@@ -2553,6 +2889,64 @@ class IMAPConnection {
             }, 'UNKNOWN COMMAND', parsed, data);
         }
     }
+    /**
+     * Emits the `command` event when the tagged response of a command goes out, and the `session` events "login"
+     * (the command authenticated the session) and "logout" (back to Not Authenticated, UNAUTHENTICATE). Every command
+     * that changes these does so before its tagged response. "select" and "unselect" come from SELECT and
+     * closeMailbox(). Tests wait for these instead of polling
+     *
+     * @param {String} status OK, NO or BAD
+     */
+    commandCompleted(status) {
+        const start = this._commandStart;
+        this._commandStart = null;
+        const server = this.server;
+        if (!server.listenerCount('command') && !server.listenerCount('session')) {
+            return;
+        }
+        server.emit('command', { session: this.sessionNumber, tag: start.tag, command: start.command, status, user: this.username || null });
+        const authenticated = (state) => state === 'Authenticated' || state === 'Selected';
+        if (authenticated(start.state) !== authenticated(this.state) && this.state !== 'Logout') {
+            this.emitSession(authenticated(this.state) ? 'login' : 'logout');
+        }
+    }
+    /**
+     * Emits a `session` event, `{ type, session, ...fields }`
+     *
+     * @param {String} type Event type
+     * @param {Object} [fields] More fields of the event
+     */
+    emitSession(type, fields) {
+        if (this.server.listenerCount('session')) {
+            this.server.emit('session', Object.assign({ type, session: this.describe() }, fields));
+        }
+    }
+    /**
+     * Describes the session without credentials or sockets, for the control API and the `session` events
+     *
+     * @return {Object} `{ session, user, state, mailbox, readOnly, enabled, secure, compressed, remoteAddress }`
+     */
+    describe() {
+        return {
+            session: this.sessionNumber,
+            user: this.username || null,
+            state: this.state,
+            mailbox: this.selectedMailbox ? this.selectedMailbox.path : null,
+            readOnly: !!this.selectedMailbox && !!this.readOnly,
+            enabled: Array.isArray(this.enabled) ? this.enabled.slice() : [],
+            secure: !!this.secureConnection,
+            compressed: !!this.transport,
+            remoteAddress: (this.socket && this.socket.remoteAddress) || null
+        };
+    }
+    /**
+     * Checks if output can still be sent: the socket is open and the connection is not closing (BYE, LOGOUT)
+     *
+     * @return {Boolean} true for a live session
+     */
+    isOpen() {
+        return !!this.socket && !this.socket.destroyed && !this._closing;
+    }
     /**
      * Handles a command line with the script rule that matched it, after the rule's delay. With `run` the line
      * goes through the parser and the command handler as usual afterwards
@@ -2593,6 +2987,8 @@ class IMAPConnection {
         const command = element.parsed.command.toUpperCase();
         this._runningCommand = element;
         const options = this.server.getCommandOptions(command);
+        // the session events of the command are worked out when its tagged response goes out, see commandCompleted
+        this._commandStart = { tag: element.parsed.tag, command, state: this.state };
         let done = false;
         const next = () => {
             if (done) {
@@ -2647,61 +3043,66 @@ class IMAPConnection {
                 return next();
             }
         }
-        if (command.substr(0, 4) === 'UID ' && this.hasPendingExpunge()) {
-            // EXPUNGE responses may be sent during UID commands (RFC 3501 section 7.4.1). The expunges of other sessions
-            // are reported first, then the command runs on the current mailbox, where the UIDs of the expunged messages
-            // do not exist and are ignored (RFC 3501 section 6.4.8), so the ghost handling of STORE, COPY and MOVE (RFC 2180
-            // section 4) only applies to their sequence number forms. Not for UID SEARCH with message numbers in the
-            // criteria, processNotifications knows when EXPUNGE must wait
-            this.processNotifications(element.parsed);
-        }
-        try {
-            // changes made while the handler runs are attributed to this session (the `origin` of notifications)
-            this.server.activeConnection = this;
-            const inputHandler = this.inputHandler;
-            this.server.getCommandHandler(element.parsed.command)(this, element.parsed, element.data, next);
-            if (this.inputHandler && this.inputHandler !== inputHandler) {
-                // the command reads the lines that follow (IDLE, AUTHENTICATE), script rules match them with it
-                this.inputCommand = { tag: element.parsed.tag, command: element.parsed.command };
+        if (this.state === 'Selected' &&
+            (command.startsWith('UID ') || options.noExpunge || options.sequenceSet !== false || options.searchCriteria !== false)) {
+            // A command that refers to messages runs on the message list the client was told about. Only these: CLOSE
+            // must not send pending EXPUNGE responses (RFC 3501 section 6.4.2) and SELECT leaves the old mailbox. RFC 3501 section 5.2:
+            // "A server MUST send mailbox size updates automatically if a mailbox size change is observed during the
+            // processing of a command", so the new messages and flag changes of other sessions are reported first,
+            // before the command resolves its sequence set or search criteria.
+            // EXPUNGE responses may be sent during UID commands (RFC 3501 section 7.4.1), so these report the expunges of
+            // other sessions first as well, then the command runs on the current mailbox, where the UIDs of the expunged
+            // messages do not exist and are ignored (RFC 3501 section 6.4.8). The ghost handling of STORE, COPY and MOVE
+            // (RFC 2180 section 4) only applies to their sequence number forms, these and UID SEARCH with message numbers
+            // in the criteria keep the EXPUNGE responses for later, see processNotifications
+            this.processNotifications(element.parsed, true);
+        }
+        // changes made while the handler runs are attributed to this session (the `origin` of notifications)
+        this.server.withOrigin(this, () => {
+            try {
+                const inputHandler = this.inputHandler;
+                (element.handler || this.server.getCommandHandler(element.parsed.command))(this, element.parsed, element.data, next);
+                if (this.inputHandler && this.inputHandler !== inputHandler) {
+                    // the command reads the lines that follow (IDLE, AUTHENTICATE), script rules match them with it
+                    this.inputCommand = { tag: element.parsed.tag, command: element.parsed.command };
+                    this.emitSession('waiting', { command });
+                }
             }
-        }
-        catch (E) {
-            const ex = E;
-            const badInput = ex.imapResponse === 'BAD';
-            if (!badInput && this.options.debug) {
-                console.error('Error processing command:', ex, '\n', ex.stack);
+            catch (E) {
+                const ex = E;
+                const badInput = ex.imapResponse === 'BAD';
+                if (!badInput && this.options.debug) {
+                    console.error('Error processing command:', ex, '\n', ex.stack);
+                }
+                this.send({
+                    tag: element.parsed.tag,
+                    command: badInput ? 'BAD' : 'NO',
+                    attributes: [].concat(badInput
+                        ? []
+                        : {
+                            type: 'SECTION',
+                            section: [
+                                {
+                                    type: 'ATOM',
+                                    value: 'SERVERBUG'
+                                }
+                            ]
+                        }, {
+                        type: 'TEXT',
+                        value: badInput ? ex.message : 'Server error: ' + ex.message
+                    })
+                }, badInput ? 'INVALID COMMAND' : 'SERVER ERROR', element.parsed, element.data);
+                // keep the connection usable, otherwise every later command would hang
+                next();
             }
-            this.send({
-                tag: element.parsed.tag,
-                command: badInput ? 'BAD' : 'NO',
-                attributes: [].concat(badInput
-                    ? []
-                    : {
-                        type: 'SECTION',
-                        section: [
-                            {
-                                type: 'ATOM',
-                                value: 'SERVERBUG'
-                            }
-                        ]
-                    }, {
-                    type: 'TEXT',
-                    value: badInput ? ex.message : 'Server error: ' + ex.message
-                })
-            }, badInput ? 'INVALID COMMAND' : 'SERVER ERROR', element.parsed, element.data);
-            // keep the connection usable, otherwise every later command would hang
-            next();
-        }
-        finally {
-            this.server.activeConnection = null;
-        }
+        });
     }
     /**
      * Removes messages with \Deleted flag
      *
      * @param {Object} mailbox Mailbox to check for
      * @param {Boolean} [ignoreSelf] If set to true, does not send any notices to itself
-     * @param {Boolean} [ignoreSelf] If set to true, does not send EXISTS notice to itself
+     * @param {Boolean} [ignoreExists] If set to true, does not send EXISTS notice to itself
      */
     expungeDeleted(mailbox, ignoreSelf, ignoreExists) {
         this.expungeSpecificMessages(mailbox, (message) => {
@@ -2710,80 +3111,55 @@ class IMAPConnection {
     }
     /**
      * Given a set of messages in a mailbox (possibly via getMessageRange), remove
-     * them from the mailbox and generate EXPUNGE notifications.
+     * them from the mailbox and generate EXPUNGE notifications, see expungeMessages() in store-operations.ts
      *
      * @param {Object} mailbox Mailbox to check for
      * @param {Function|Array} messagesOrFilterFunc An Array of messages in the
      *     folder that should be removed or a filtering function that indicates
      *     messages to be removed by returning true.
      * @param {Boolean} [ignoreSelf] If set to true, does not send any notices to itself
-     * @param {Boolean} [ignoreSelf] If set to true, does not send EXISTS notice to itself
+     * @param {Boolean} [ignoreExists] If set to true, does not send EXISTS notice to itself
      * @param {Boolean} [highestFirst] If set to true, the EXPUNGE responses go from the highest UID to the lowest
      *     (MESSAGELIMIT, RFC 9738 section 3.1), otherwise from the lowest
      */
     expungeSpecificMessages(mailbox, messagesOrFilterFunc, ignoreSelf, ignoreExists, highestFirst) {
-        let filterFunc;
-        if (Array.isArray(messagesOrFilterFunc)) {
-            const messageSet = new Set(messagesOrFilterFunc);
-            filterFunc = (message) => messageSet.has(message);
-        }
-        else {
-            filterFunc = messagesOrFilterFunc;
-        }
-        // sequence numbers of the removed messages, each one as it is after the earlier EXPUNGE responses. From the
-        // highest message down, the earlier responses do not change the sequence numbers of the later ones
-        const expunged = [];
-        const kept = [];
-        mailbox.messages.forEach((message, i) => {
-            if (filterFunc(message)) {
-                message.ghost = true;
-                expunged.push({ seq: highestFirst ? i + 1 : kept.length + 1, message });
-            }
-            else {
-                kept.push(message);
-            }
-        });
-        if (!expunged.length) {
-            return;
-        }
-        // old copy is required for those sessions that run FETCH before
-        // displaying the EXPUNGE notice
-        const mailboxCopy = mailbox.messages.slice();
-        // update the list in place, other code might hold a reference to it
-        kept.forEach((message, i) => {
-            mailbox.messages[i] = message;
-        });
-        mailbox.messages.length = kept.length;
-        // lets plugins track the removal (e.g. mod-sequences of CONDSTORE and QRESYNC) before any notification
-        this.server.emit('expunge', mailbox, expunged.map(entry => entry.message), this);
-        (highestFirst ? expunged.slice().reverse() : expunged).forEach(entry => {
-            this.server.notify({
-                tag: '*',
-                attributes: [
-                    entry.seq,
-                    {
-                        type: 'ATOM',
-                        value: 'EXPUNGE'
-                    }
-                ],
-                // the removed message, for plugins that report it differently (e.g. VANISHED of QRESYNC)
-                message: entry.message
-            }, mailbox, ignoreSelf ? this : false);
+        expungeMessages(this.server, mailbox, messagesOrFilterFunc, {
+            origin: this,
+            skip: ignoreSelf ? this : null,
+            skipExists: ignoreExists ? this : null,
+            highestFirst: !!highestFirst
         });
-        this.server.notify({
-            tag: '*',
-            attributes: [
-                mailbox.messages.length,
-                {
-                    type: 'ATOM',
-                    value: 'EXISTS'
-                }
-            ],
-            // distribute the old mailbox data with the notification
-            mailboxCopy: mailboxCopy
-        }, mailbox, ignoreSelf || ignoreExists ? this : false);
     }
 }
+// setImmediate does not let Deno send what sockets were given, see nextTurn
+const IS_DENO = 'Deno' in globalThis;
+/**
+ * Runs a function on the next event loop turn that also handles network I/O: setImmediate on Node and Bun, a zero
+ * timer on Deno, where setImmediate runs before the sockets send what was written (#89)
+ *
+ * @param {Function} fn Function to run
+ * @return {Object} the timer, clearOutputQueue clears it
+ */
+function nextTurn(fn) {
+    return IS_DENO ? setTimeout(fn, 0) : setImmediate(fn);
+}
+/**
+ * Starts listening, resolves with the port or rejects with the listen error (EADDRINUSE)
+ *
+ * @param {Object} server net, tls or http server
+ * @param {Number} [port] Port, a free one if not set
+ * @param {String} [host] Address, all addresses if not set
+ * @return {Promise<Number>} the port
+ */
+function listenOn(server, port, host) {
+    return new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen({ port: port || 0, host }, () => {
+            server.removeListener('error', reject);
+            resolve(server.address().port);
+        });
+    });
+}
 /**
  * Destroys a socket with a TCP RST (`close: 'reset'` of a script rule). resetAndDestroy (Node 16.17) needs a socket with
  * a TCP handle, a TLS socket throws ERR_INVALID_HANDLE_TYPE (#84), so the RST goes to the TCP socket under the TLS