imapkit 5.0.0 → 5.1.0

package/dist/cjs/commands/handlers/fetch.js

@@ -85,7 +85,8 @@ function getSection(data, query, global) {
     else if (query.section.length > 1) {
         throw new Error((key || 'Part number') + ' does not take any arguments');
     }
-    // RFC 3501 6.4.5: a part that does not exist is returned as an empty string
+    // a part that does not exist is returned as an empty string, like Dovecot does: RFC 3501 and RFC 9051 section
+    // 6.4.5 define no error for it, only an empty string for a partial range that starts beyond the end of the text
     const node = path ? (0, mimeparser_js_1.resolveNode)(data.tree, path, global) : data.tree;
     if (!node) {
         return '';

package/dist/cjs/commands/handlers/store.js

@@ -10,8 +10,8 @@ function setFlags(connection, message, flags) {
     [].concat(flags).forEach(flag => {
         flag = (0, flags_js_1.normalizeSystemFlag)(typeof flag === 'string' ? flag : String(flag.value || ''));
         (0, flags_js_1.checkSystemFlags)(connection.server, flag);
-        // Ignore if it is not in allowed list and only permament flags are allowed to use
-        if (mailbox.permanentFlags.indexOf(flag) < 0 && !mailbox.allowPermanentFlags) {
+        // a flag that is not in PERMANENTFLAGS is ignored (RFC 3501 section 7.1, RFC 9051 section 7.1)
+        if (!connection.server.isPermanentFlag(mailbox, flag)) {
             return;
         }
         if (messageFlags.indexOf(flag) < 0) {
@@ -26,8 +26,8 @@ function addFlags(connection, message, flags) {
     [].concat(flags).forEach(flag => {
         flag = (0, flags_js_1.normalizeSystemFlag)(typeof flag === 'string' ? flag : String(flag.value || ''));
         (0, flags_js_1.checkSystemFlags)(connection.server, flag);
-        // Ignore if it is not in allowed list and only permament flags are allowed to use
-        if (mailbox.permanentFlags.indexOf(flag) < 0 && !mailbox.allowPermanentFlags) {
+        // a flag that is not in PERMANENTFLAGS is ignored (RFC 3501 section 7.1, RFC 9051 section 7.1)
+        if (!connection.server.isPermanentFlag(mailbox, flag)) {
             return;
         }
         if (message.flags.indexOf(flag) < 0) {

package/dist/cjs/commands/list.js

@@ -22,8 +22,22 @@ function listCommand(connection, parsed, data, callback) {
         return callback();
     }
     if (!parsed.attributes[1].value) {
-        // empty reference lists separator only
-        const namespace = connection.server.storage[parsed.attributes[1].value || connection.server.referenceNamespace];
+        // RFC 3501 section 6.3.8: "An empty ("" string) mailbox name argument is a special request to return the
+        // hierarchy delimiter and the root name of the name given in the reference. The value returned as the root
+        // MAY be the empty string if the reference is non-rooted or is an empty string."
+        const server = connection.server;
+        const reference = parsed.attributes[0].value || '';
+        // the namespace of the reference, the personal one for a reference that is not a valid name
+        let key = server.referenceNamespace;
+        try {
+            key = server.getNamespace(connection.importMailboxName(reference)) || key;
+        }
+        catch {
+            // not a mailbox name, so not in another namespace
+        }
+        const namespace = key !== false ? server.storage[key] : undefined;
+        // the root of a name in another namespace is the prefix of that namespace, like "#news." in the RFC example
+        const root = key !== false && key !== server.referenceNamespace ? connection.exportMailboxName(key) : '';
         if (namespace) {
             connection.send({
                 tag: '*',
@@ -36,7 +50,7 @@ function listCommand(connection, parsed, data, callback) {
                         }
                     ],
                     namespace.separator,
-                    ''
+                    root
                 ]
             }, 'LIST ITEM', parsed, data);
         }

package/dist/cjs/control.d.ts

@@ -4,7 +4,7 @@
  * unsolicited FETCH, BYE, NOTIFY events, CONDSTORE mod-sequences), with no session as its origin. The API is the
  * operator: ACL does not apply, but every argument is checked. Mailboxes are addressed by their storage name
  * (modified UTF-7), messages by mailbox and UID. Methods return plain data and throw an ImapKitError with a `code`:
- * NONEXISTENT, ALREADYEXISTS, INVALID, or a RFC 5530 code of a failed mailbox operation (CANNOT, HASCHILDREN ...)
+ * NONEXISTENT, ALREADYEXISTS, INVALID, or the response code of a failed mailbox operation (CANNOT, HASCHILDREN ...)
  */
 import { ImapKitError } from './store-operations.js';
 import type { FlagMode, UidValidityOptions } from './store-operations.js';
@@ -22,7 +22,7 @@ interface MailboxInfo {
     unseen: number;
     uidnext: number;
     uidvalidity: number;
-    /** flags that can be stored, \* when new keywords are allowed */
+    /** the flags of the FLAGS response, SELECT adds \* to PERMANENTFLAGS when new keywords are allowed */
     permanentFlags: string[];
     /** only with CONDSTORE */
     highestModseq?: number;
@@ -67,13 +67,8 @@ interface NewMessage {
     /** a Date or a RFC 3501 date-time string, the current time if not set */
     internaldate?: Date | string | undefined;
 }
-interface UserOptions {
-    password?: string | undefined;
-    xoauth2?: {
-        accessToken?: string | undefined;
-        sessionTimeout?: number | undefined;
-    } | undefined;
-}
+/** The credentials of a user, see UserData */
+type UserOptions = Pick<UserData, 'password' | 'xoauth2'>;
 /** What a REST route handler gets, see src/rest.ts */
 interface RouteRequest {
     params: Record<string, string>;

package/dist/cjs/control.js

@@ -5,7 +5,7 @@
  * unsolicited FETCH, BYE, NOTIFY events, CONDSTORE mod-sequences), with no session as its origin. The API is the
  * operator: ACL does not apply, but every argument is checked. Mailboxes are addressed by their storage name
  * (modified UTF-7), messages by mailbox and UID. Methods return plain data and throw an ImapKitError with a `code`:
- * NONEXISTENT, ALREADYEXISTS, INVALID, or a RFC 5530 code of a failed mailbox operation (CANNOT, HASCHILDREN ...)
+ * NONEXISTENT, ALREADYEXISTS, INVALID, or the response code of a failed mailbox operation (CANNOT, HASCHILDREN ...)
  */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };

package/dist/cjs/dates.d.ts

@@ -36,6 +36,14 @@ declare function isRealDate(day: number | string | undefined, month: number, yea
  * @return {String|Boolean} the date, or false for an impossible date
  */
 declare function dateKey(day: number | string, month: number, year: number | string): string | false;
+/**
+ * Checks a date-time string of RFC 3501 section 9, like an INTERNALDATE ("14-Sep-2013 21:22:28 -0300"):
+ * date-time = DQUOTE date-day-fixed "-" date-month "-" date-year SP time SP zone DQUOTE
+ *
+ * @param {String} value Value to check
+ * @return {Boolean} true if the value is a date-time string of a real date and time
+ */
+declare function isDateTime(value: unknown): boolean;
 /**
  * Parses a date-time value of the RFC 3501 section 9 form, like an INTERNALDATE ("14-Sep-2013 21:22:28 -0300").
  * A value with only the date part is accepted as well, its time fields are left undefined
@@ -61,4 +69,4 @@ declare function parseHeaderDate(header: string | undefined): DateParts | null;
  * @return {Number} timestamp
  */
 declare function toTimestamp(date: DateParts): number;
-export { MONTHS, monthIndex, isRealDate, dateKey, parseDateTime, parseHeaderDate, toTimestamp };
+export { MONTHS, monthIndex, isRealDate, isDateTime, dateKey, parseDateTime, parseHeaderDate, toTimestamp };

package/dist/cjs/dates.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.MONTHS = void 0;
 exports.monthIndex = monthIndex;
 exports.isRealDate = isRealDate;
+exports.isDateTime = isDateTime;
 exports.dateKey = dateKey;
 exports.parseDateTime = parseDateTime;
 exports.parseHeaderDate = parseHeaderDate;
@@ -50,6 +51,25 @@ function dateKey(day, month, year) {
     }
     return String(year).padStart(4, '0') + '-' + String(month + 1).padStart(2, '0') + '-' + String(day).padStart(2, '0');
 }
+/**
+ * Checks a date-time string of RFC 3501 section 9, like an INTERNALDATE ("14-Sep-2013 21:22:28 -0300"):
+ * date-time = DQUOTE date-day-fixed "-" date-month "-" date-year SP time SP zone DQUOTE
+ *
+ * @param {String} value Value to check
+ * @return {Boolean} true if the value is a date-time string of a real date and time
+ */
+function isDateTime(value) {
+    if (!value || typeof value !== 'string') {
+        return false;
+    }
+    // month names are case-insensitive like all ABNF strings
+    const match = value.match(/^( \d|\d\d)-(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)-(\d{4}) (\d{2}):(\d{2}):(\d{2}) [-+](\d{2})(\d{2})$/i);
+    if (!match) {
+        return false;
+    }
+    // the values must also make a real date and time
+    return (isRealDate(match[1], monthIndex(match[2]), match[3]) && Number(match[4]) < 24 && Number(match[5]) < 60 && Number(match[6]) < 61 && Number(match[8]) < 60);
+}
 /**
  * Parses a date-time value of the RFC 3501 section 9 form, like an INTERNALDATE ("14-Sep-2013 21:22:28 -0300").
  * A value with only the date part is accepted as well, its time fields are left undefined

package/dist/cjs/envelope.d.ts

@@ -1,7 +1,7 @@
 import type { ParsedAddress } from './addressparser.js';
 import type { ParsedHeader } from './mimeparser.js';
 /** An address of the ENVELOPE (RFC 3501 section 9): name, source route, mailbox and host, all NIL for a group end */
-export type EnvelopeAddress = [name: string | null, adl: null, mailbox: string | null, host: string | null];
+export type EnvelopeAddress = [name: string | null, adl: string | null, mailbox: string | null, host: string | null];
 /** The fields of the ENVELOPE (RFC 3501 section 7.4.2), in order */
 export type Envelope = [
     date: string | null,

package/dist/cjs/envelope.js

@@ -3,6 +3,29 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = envelope;
 exports.processAddress = processAddress;
+// RFC 5322 section 4.4: obs-angle-addr = [CFWS] "<" obs-route addr-spec ">" [CFWS], obs-route = obs-domain-list ":",
+// obs-domain-list = *(CFWS / ",") "@" domain *("," [CFWS] ["@" domain]). A domain-literal can hold a colon
+const OBS_ROUTE = /^[\s,]*(@(?:[^:[]|\[[^\]]*\])*):/;
+/**
+ * Splits an obsolete source route from an address: the route goes to addr-adl, the rest is the addr-spec
+ * (RFC 9051 section 7.5.2: the at-domain-list is the "source route and obs-route ABNF production from [RFC5322]",
+ * the mailbox name the "local-part ABNF production"). The route is sent like Dovecot does, "@a,@b"
+ *
+ * @param {String} address Address from the angle brackets
+ * @return {Array} [route or null, addr-spec]
+ */
+function splitRoute(address) {
+    const match = address.match(OBS_ROUTE);
+    if (!match) {
+        return [null, address];
+    }
+    const route = match[1]
+        .split(',')
+        .map(domain => domain.trim())
+        .filter(domain => domain)
+        .join(',');
+    return [route, address.substr(match[0].length).trim()];
+}
 /**
  * Convert a message object to an ENVELOPE object
  *
@@ -61,12 +84,14 @@ function processAddress(arr, def) {
         if (!address) {
             return;
         }
+        const [route, addrSpec] = splitRoute(address);
+        address = addrSpec;
         const at = address.lastIndexOf('@');
         const user = at >= 0 ? address.substr(0, at) : address;
         // RFC 3501 7.4.2 reserves a NIL host for group markers, so an address without a domain gets
         // the placeholder host that Dovecot uses for the same input
         const domain = (at >= 0 ? address.substr(at + 1) : '') || 'MISSING_DOMAIN';
-        result.push([name, null, user || null, domain]);
+        result.push([name, route, user || null, domain]);
     });
     // env-from = "(" 1*address ")", there is no SP between the addresses (RFC 3501 section 9)
     Object.defineProperty(result, 'adjacentLists', { value: true });

package/dist/cjs/index.d.ts

@@ -6,7 +6,9 @@ export { TAG_REGEX, IMAPServer, IMAPConnection, ImapKitError, quirks, storageSch
 export type { Attribute, ParsedCommand, IMAPResponse, Notification, Callback, CommandHandler, CommandOptions, Plugin, IMAPError, Message, Mailbox, StorageNamespace, UserData, IMAPServerOptions } from './types.js';
 export type { ScriptRule, ScriptContext, ScriptEvent, ScriptBytes, ScriptHandle } from './script.js';
 export type { Quirk } from './quirks.js';
-export type { Control, MailboxInfo, MessageInfo, SessionInfo, NewMessage, UserOptions, SessionFilter } from './control.js';
+export type { MemorySocket } from './memory-socket.js';
+export type { Control, MailboxInfo, MessageInfo, SessionInfo, NewMessage, UserOptions, SessionFilter, ControlRoute, RouteRequest } from './control.js';
+export type { FlagMode, UidMode, UidValidityOptions } from './store-operations.js';
 declare const imapkit: typeof createServer & {
     TAG_REGEX: RegExp;
     IMAPServer: typeof IMAPServer;

package/dist/cjs/load-plugins.d.ts

@@ -15,7 +15,9 @@ declare function listPlugins(): string[];
  *
  * @param {Object} server IMAPServer instance
  * @param {Array|String|Function} plugins List of plugins to load
+ * @param {Map} [exclude] Plugins a quirk preset leaves out, plugin name to quirk name
+ * @throws {Error} when a loaded plugin requires an excluded one
  */
-declare function loadPlugins(server: IMAPServer, plugins: (string | Plugin)[] | string | Plugin | null | undefined, exclude?: string[]): void;
+declare function loadPlugins(server: IMAPServer, plugins: (string | Plugin)[] | string | Plugin | null | undefined, exclude?: Map<string, string>): void;
 export default loadPlugins;
 export { listPlugins };

package/dist/cjs/load-plugins.js

@@ -49,12 +49,21 @@ function resolvePlugin(name) {
  *
  * @param {Object} server IMAPServer instance
  * @param {Array|String|Function} plugins List of plugins to load
+ * @param {Map} [exclude] Plugins a quirk preset leaves out, plugin name to quirk name
+ * @throws {Error} when a loaded plugin requires an excluded one
  */
 function loadPlugins(server, plugins, exclude) {
     const loaded = new Set();
-    // plugins a quirk preset leaves out (no-move), they are not loaded even when listed
-    const excluded = new Set((exclude || []).map(name => resolvePlugin(name)).flatMap(name => (name ? [index_js_1.plugins[name]] : [])));
-    const load = (entry) => {
+    // plugins a quirk preset leaves out (no-move), they are not loaded even when listed, and the quirk that removes them
+    const excluded = new Map();
+    (exclude || new Map()).forEach((quirk, name) => {
+        const resolved = resolvePlugin(name);
+        if (resolved) {
+            excluded.set(index_js_1.plugins[resolved], quirk);
+        }
+    });
+    // `requiredBy` names the plugin whose `requires` lists this one
+    const load = (entry, requiredBy) => {
         let plugin = entry;
         if (typeof plugin === 'string') {
             const name = resolvePlugin(plugin);
@@ -69,14 +78,24 @@ function loadPlugins(server, plugins, exclude) {
         if (typeof plugin !== 'function') {
             throw new TypeError('Invalid plugin, expecting a plugin name or a function');
         }
-        if (loaded.has(plugin) || excluded.has(plugin)) {
+        const quirk = excluded.get(plugin);
+        if (quirk) {
+            if (requiredBy) {
+                // the plugin can not work without it (IMAP4rev2 folds in MOVE and UIDPLUS, RFC 9051 Appendix E), so
+                // advertising it without the required plugin would break its RFC
+                throw new Error(requiredBy + ' requires ' + entry + ', which the "' + quirk + '" quirk removes');
+            }
+            return;
+        }
+        if (loaded.has(plugin)) {
             return;
         }
         loaded.add(plugin);
-        [].concat(plugin.requires || []).forEach(load);
+        const name = typeof entry === 'string' ? entry.trim() : plugin.name;
+        [].concat(plugin.requires || []).forEach(required => load(required, name));
         plugin(server);
     };
-    [].concat(plugins || []).forEach(load);
+    [].concat(plugins || []).forEach(entry => load(entry));
     server.emit('pluginsLoaded');
 }
 exports.default = loadPlugins;

package/dist/cjs/memory-socket.d.ts

@@ -0,0 +1,69 @@
+import { EventEmitter } from 'node:events';
+/**
+ * One end of an in-memory connection, see `server.connect()`. It has the parts of `net.Socket` that the server and a
+ * client use: `write(data, [encoding], [callback])`, `end()`, `destroy()`, `pause()`, `resume()`, `setEncoding()`,
+ * the `data`, `end`, `close` and `error` events, and `encrypted`, which makes the server treat the connection like
+ * one over TLS (as `tls.TLSSocket#encrypted` does). Written data reaches the other end on a later event loop turn,
+ * one `data` event per write
+ */
+export declare class MemorySocket extends EventEmitter {
+    /** the other end of the connection */
+    peer: MemorySocket | null;
+    destroyed: boolean;
+    /** true if the connection counts as encrypted (implicit TLS, or after STARTTLS) */
+    encrypted: boolean;
+    _paused: boolean;
+    _ending: boolean;
+    _encoding: BufferEncoding | null;
+    /** received data that waits while the socket is paused */
+    _received: Buffer[];
+    constructor();
+    /**
+     * Sends data to the other end
+     *
+     * @param data Data to send, a string is encoded with `encoding` (utf8 by default)
+     * @param encoding Encoding of a string, or the callback
+     * @param callback Called once the other end received the data
+     * @return true, there is no backpressure
+     */
+    write(data: Buffer | Uint8Array | string, encoding?: BufferEncoding | (() => void), callback?: () => void): boolean;
+    /**
+     * Ends the connection after the data written so far reached the other end, both ends close then
+     *
+     * @param data Data to send before the end
+     */
+    end(data?: Buffer | Uint8Array | string): this;
+    /**
+     * Closes both ends right away, data that did not reach the other end yet is lost
+     *
+     * @param error Error to emit on this end
+     */
+    destroy(error?: Error): this;
+    /**
+     * Closes the connection like a TCP RST: the other end gets an ECONNRESET error (`close: 'reset'` of script rules)
+     */
+    resetAndDestroy(): this;
+    /**
+     * STARTTLS without TLS: both ends count as encrypted from now on (`upgradeConnection` in src/server.ts)
+     *
+     * @param callback Called once the connection counts as encrypted
+     */
+    startTls(callback: () => void): void;
+    pause(): this;
+    resume(): this;
+    /**
+     * Makes the `data` events carry strings instead of Buffers
+     *
+     * @param encoding Encoding of the strings, e.g. "utf8" or "binary"
+     */
+    setEncoding(encoding: BufferEncoding): this;
+    deliver(chunk: Buffer): void;
+    private emitData;
+    close(error?: Error): void;
+}
+/**
+ * Creates the two ends of an in-memory connection
+ *
+ * @return `[serverSocket, clientSocket]`
+ */
+export declare function createSocketPair(): [MemorySocket, MemorySocket];

package/dist/cjs/memory-socket.js

@@ -0,0 +1,187 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MemorySocket = void 0;
+exports.createSocketPair = createSocketPair;
+const node_events_1 = require("node:events");
+/**
+ * One end of an in-memory connection, see `server.connect()`. It has the parts of `net.Socket` that the server and a
+ * client use: `write(data, [encoding], [callback])`, `end()`, `destroy()`, `pause()`, `resume()`, `setEncoding()`,
+ * the `data`, `end`, `close` and `error` events, and `encrypted`, which makes the server treat the connection like
+ * one over TLS (as `tls.TLSSocket#encrypted` does). Written data reaches the other end on a later event loop turn,
+ * one `data` event per write
+ */
+class MemorySocket extends node_events_1.EventEmitter {
+    constructor() {
+        super();
+        this.peer = null;
+        this.destroyed = false;
+        this.encrypted = false;
+        this._paused = false;
+        this._ending = false;
+        this._encoding = null;
+        this._received = [];
+    }
+    /**
+     * Sends data to the other end
+     *
+     * @param data Data to send, a string is encoded with `encoding` (utf8 by default)
+     * @param encoding Encoding of a string, or the callback
+     * @param callback Called once the other end received the data
+     * @return true, there is no backpressure
+     */
+    write(data, encoding, callback) {
+        if (typeof encoding === 'function') {
+            callback = encoding;
+            encoding = undefined;
+        }
+        if (this.destroyed || this._ending) {
+            return false;
+        }
+        // no copy, like a real socket the data is not changed after it was written
+        const chunk = typeof data === 'string' ? Buffer.from(data, encoding || 'utf8') : Buffer.from(data.buffer, data.byteOffset, data.byteLength);
+        nextTurn(() => {
+            this.peer?.deliver(chunk);
+            callback?.();
+        });
+        return true;
+    }
+    /**
+     * Ends the connection after the data written so far reached the other end, both ends close then
+     *
+     * @param data Data to send before the end
+     */
+    end(data) {
+        if (data !== undefined) {
+            this.write(data);
+        }
+        if (this.destroyed || this._ending) {
+            return this;
+        }
+        this._ending = true;
+        // queued after the writes, so the other end gets all data first
+        nextTurn(() => {
+            const peer = this.peer;
+            if (peer && !peer.destroyed) {
+                peer.emit('end');
+                peer.close();
+            }
+            this.close();
+        });
+        return this;
+    }
+    /**
+     * Closes both ends right away, data that did not reach the other end yet is lost
+     *
+     * @param error Error to emit on this end
+     */
+    destroy(error) {
+        if (this.destroyed) {
+            return this;
+        }
+        const peer = this.peer;
+        this.close(error);
+        if (peer && !peer.destroyed) {
+            peer.close();
+        }
+        return this;
+    }
+    /**
+     * Closes the connection like a TCP RST: the other end gets an ECONNRESET error (`close: 'reset'` of script rules)
+     */
+    resetAndDestroy() {
+        const peer = this.peer;
+        this.destroy();
+        if (peer) {
+            const error = new Error('read ECONNRESET');
+            error.code = 'ECONNRESET';
+            nextTurn(() => peer.emit('error', error));
+        }
+        return this;
+    }
+    /**
+     * STARTTLS without TLS: both ends count as encrypted from now on (`upgradeConnection` in src/server.ts)
+     *
+     * @param callback Called once the connection counts as encrypted
+     */
+    startTls(callback) {
+        this.encrypted = true;
+        if (this.peer) {
+            this.peer.encrypted = true;
+        }
+        callback();
+    }
+    pause() {
+        this._paused = true;
+        return this;
+    }
+    resume() {
+        this._paused = false;
+        while (this._received.length && !this._paused && !this.destroyed) {
+            this.emitData(this._received.shift());
+        }
+        return this;
+    }
+    /**
+     * Makes the `data` events carry strings instead of Buffers
+     *
+     * @param encoding Encoding of the strings, e.g. "utf8" or "binary"
+     */
+    setEncoding(encoding) {
+        this._encoding = encoding;
+        return this;
+    }
+    deliver(chunk) {
+        if (this.destroyed) {
+            return;
+        }
+        if (this._paused) {
+            this._received.push(chunk);
+            return;
+        }
+        this.emitData(chunk);
+    }
+    emitData(chunk) {
+        this.emit('data', this._encoding ? chunk.toString(this._encoding) : chunk);
+    }
+    close(error) {
+        if (this.destroyed) {
+            return;
+        }
+        this.destroyed = true;
+        this._received = [];
+        nextTurn(() => {
+            if (error) {
+                this.emit('error', error);
+            }
+            this.emit('close', !!error);
+        });
+    }
+}
+exports.MemorySocket = MemorySocket;
+/**
+ * Creates the two ends of an in-memory connection
+ *
+ * @return `[serverSocket, clientSocket]`
+ */
+function createSocketPair() {
+    const serverSocket = new MemorySocket();
+    const clientSocket = new MemorySocket();
+    serverSocket.peer = clientSocket;
+    clientSocket.peer = serverSocket;
+    return [serverSocket, clientSocket];
+}
+// one ordered queue for both ends, so the data and events of a connection keep the order they were sent in
+const queue = [];
+function nextTurn(fn) {
+    queue.push(fn);
+    if (queue.length === 1) {
+        setImmediate(runQueue);
+    }
+}
+function runQueue() {
+    // what runs now may queue more, that waits for the next turn
+    const batch = queue.splice(0, queue.length);
+    for (const fn of batch) {
+        fn();
+    }
+}

package/dist/cjs/plugins/binary.js

@@ -109,7 +109,8 @@ function getDecodedSection(connection, message, query) {
     }
     const node = (0, mimeparser_js_1.resolveNode)((0, mimeparser_js_1.getMessageData)(message).tree, section[0].value, connection.messageGlobal);
     if (!node) {
-        // like BODY[<section>], a part that does not exist is empty
+        // like BODY[<section>], a part that does not exist is empty: RFC 3516 and RFC 9051 section 6.4.5 define no
+        // error for it, and BINARY follows the semantics of BODY (RFC 3516 section 4.2)
         return '';
     }
     if (!isLeaf(node, connection.messageGlobal)) {

package/dist/cjs/plugins/context-search.js

@@ -252,8 +252,8 @@ function contextSearchPlugin(server) {
         // knows the current message list, so new matches can be reported after their EXISTS and FETCH responses
         // (RFC 5267 section 4.3.2). A command that closes the mailbox gets no updates, its tagged response ends them
         const processNotifications = connection.processNotifications;
-        connection.processNotifications = function (data) {
-            processNotifications.call(this, data);
+        connection.processNotifications = function (data, beforeCommand) {
+            processNotifications.call(this, data, beforeCommand);
             const command = ((data && data.command) || '').toUpperCase();
             if (this.searchContexts && this.searchContexts.size && !this.notificationQueue.length && !CLOSING_COMMANDS.has(command)) {
                 checkContexts(this);

package/dist/cjs/plugins/create-special-use.d.ts

@@ -1,7 +1,2 @@
 import type { IMAPServer } from '../types.js';
-/**
- * @help Enables CREATE-SPECIAL-USE [RFC6154] capability
- * @help Allowed special flags can be set with server
- * @help option "special-use"
- */
 export default function createSpecialUsePlugin(server: IMAPServer): void;

package/dist/cjs/plugins/create-special-use.js

@@ -1,11 +1,18 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = createSpecialUsePlugin;
+const formal_1 = __importDefault(require("imap-handler/lib/formal"));
+const arguments_js_1 = require("../arguments.js");
 /**
  * @help Enables CREATE-SPECIAL-USE [RFC6154] capability
  * @help Allowed special flags can be set with server
  * @help option "special-use"
  */
+// use-attr-ext = "\" atom (RFC 6154 section 6), with the ATOM-CHAR of the imap-handler grammar (RFC 3501 section 9)
+const USE_ATTR = new RegExp('^\\\\[' + formal_1.default['ATOM-CHAR']().replace(/[\\\]^-]/g, '\\$&') + ']+$');
 function createSpecialUsePlugin(server) {
     // Register capability
     server.registerCapability('CREATE-SPECIAL-USE');
@@ -34,7 +41,10 @@ function createSpecialUsePlugin(server) {
         }
         if (specialUseList) {
             for (i = 0, len = specialUseList.length; i < len; i++) {
-                if (['ATOM', 'STRING', 'LITERAL'].indexOf(specialUseList[i].type) < 0) {
+                // RFC 6154 section 6: use-attr-ext = "\" atom, so every entry is an atom that starts with a backslash,
+                // not NIL, a string, a literal, a number or a list
+                const entry = specialUseList[i];
+                if (!(0, arguments_js_1.isAtom)(entry) || !USE_ATTR.test(entry.value)) {
                     connection.send({
                         tag: parsed.tag,
                         command: 'BAD',

package/dist/cjs/plugins/idle.js

@@ -23,8 +23,8 @@ function idlePlugin(server) {
                 connection.end();
             }
         }, 30 * 60 * 1000);
-        // An idling client should not keep the process alive
-        idleTimer.unref();
+        // An idling client should not keep the process alive (browsers have no unref)
+        idleTimer.unref?.();
         const clearIdleTimer = () => clearTimeout(idleTimer);
         const socket = connection.socket;
         if (socket) {

package/dist/cjs/plugins/imap4rev2.js

@@ -128,6 +128,11 @@ function imap4rev2Plugin(server) {
         }, 'SELECT LIST', parsed, data, mailbox);
     };
     server.outputHandlers.push((connection, response, description, parsed, data) => {
+        if (description === 'RECENT NOTIFICATION' && isRev2(connection)) {
+            // Appendix E item 12: no RECENT response after the EXISTS of new messages either
+            response.skipResponse = true;
+            return;
+        }
         if (!parsed || !response || !isRev2(connection)) {
             return;
         }