imapkit 5.0.0 → 5.1.0

package/dist/esm/server.js

@@ -7,11 +7,11 @@ import loadPlugins from './load-plugins.js';
 import { commands as builtinCommands } from './commands/index.js';
 import { getCommandOptions, commandOptions } from './command-states.js';
 import validateMailboxName from './mailbox-name.js';
-import { MONTHS, monthIndex, isRealDate } from './dates.js';
+import { MONTHS, monthIndex, isDateTime } from './dates.js';
 import fetchHandlers from './commands/handlers/fetch.js';
 import { hasSequenceSetKey } from './commands/handlers/search.js';
 import { isSequenceSet } from './numbers.js';
-import { restoreNilAtoms } from './arguments.js';
+import { restoreNilAtoms, isAtom } from './arguments.js';
 import { refuseMissingTarget } from './commands/append.js';
 import { DEFAULT_SESSION_TIMEOUT, storeError, expungeMessages, notifyFlagChanges } from './store-operations.js';
 import { Control } from './control.js';
@@ -19,6 +19,7 @@ import { resolveQuirks } from './quirks.js';
 import { validateStorage } from './storage-schema.js';
 import { createRestServer } from './rest.js';
 import * as bundledCert from './cert.js';
+import { createSocketPair } from './memory-socket.js';
 import { ServerScript, sendOutput, handleLine, handleQuiet, literalResponse, releaseDeferred } from './script.js';
 // longest command line (not counting literals) accepted from a client
 const MAX_LINE_LENGTH = 1024 * 1024;
@@ -64,6 +65,36 @@ function getResponseTag(line) {
 function stateError(command, state) {
     return command + ' is not allowed in the ' + state + ' state';
 }
+/**
+ * Checks if a queued notification changes message sequence numbers by removing messages: an EXPUNGE response, or the
+ * EXISTS that follows the EXPUNGE responses of another session (it carries the snapshot of the old message list)
+ *
+ * @param {Object} notification Queued notification
+ * @return {Boolean} true if the notification must wait while EXPUNGE responses are not allowed
+ */
+function isPendingExpunge(notification) {
+    return !!notification.mailboxCopy || isAtom(notification.attributes && notification.attributes[1], 'EXPUNGE');
+}
+/**
+ * Checks if a notification is an untagged EXISTS response
+ *
+ * @param {Object} [notification] Notification to send
+ * @return {Boolean} true for an EXISTS response
+ */
+function isExists(notification) {
+    return !!notification && !notification.command && isAtom(notification.attributes && notification.attributes[1], 'EXISTS');
+}
+/**
+ * Answers AUTHENTICATE with a mechanism no plugin supports: NO, not a syntax error (RFC 3501 section 6.2.2). It runs
+ * through the command queue, so the state check comes first (AUTHENTICATE is only valid in the Not Authenticated
+ * state, RFC 3501 section 6.2)
+ */
+// usesSequenceNumbers() of each running command
+const sequenceNumberUse = new WeakMap();
+const unsupportedMechanism = (connection, parsed, data, callback) => {
+    connection.sendStatus(parsed, data, 'NO', 'Unsupported authentication mechanism', false, 'UNKNOWN COMMAND');
+    callback();
+};
 /**
  * Creates a new IMAP server, call `listen()` on it to start accepting connections
  *
@@ -163,7 +194,7 @@ class IMAPServer extends Stream {
         // plugins register their control operations
         this.control = new Control(this);
         // a quirk preset can leave plugins out (no-move, no-uidplus)
-        loadPlugins(this, this.options.plugins, [...quirks.removePlugins]);
+        loadPlugins(this, this.options.plugins, quirks.removePlugins);
         if (this.options.storage) {
             // a typo in a fixture fails here with the path of the problem
             validateStorage(this.options.storage);
@@ -292,6 +323,8 @@ class IMAPServer extends Stream {
             this.smtpServer = null;
         }
         if (this.restServer) {
+            // event streams never end on their own, a graceful shutdown would wait for them forever
+            this.restServer.endStreams?.();
             this.restServer.close();
             // keep-alive connections would hold the server open
             if (force) {
@@ -327,6 +360,21 @@ class IMAPServer extends Stream {
             handler(connection);
         });
     }
+    /**
+     * Opens a connection to the server in memory, without a network socket (no `listen()` needed). This is how the
+     * server runs in a browser, see the README "Run in a browser"
+     *
+     * @param {Object} [options] `{ secure }`: false makes the connection a plaintext one, where STARTTLS turns on the
+     *   encryption (nothing is encrypted, the session only counts as encrypted). By default the connection counts as
+     *   one over TLS
+     * @return {MemorySocket} the client end, write commands to it and read the responses from its `data` events
+     */
+    connect(options) {
+        const [serverSocket, clientSocket] = createSocketPair();
+        serverSocket.encrypted = clientSocket.encrypted = !options || options.secure !== false;
+        this.createClient(serverSocket);
+        return clientSocket;
+    }
     registerCapability(keyword, handler) {
         this.capabilities[keyword] =
             handler ||
@@ -470,8 +518,7 @@ class IMAPServer extends Stream {
         let seen = 0;
         let unseen = 0;
         // flags stay defined in the mailbox once a message had them, see rememberFlags
-        const permanentFlags = [].concat(mailbox.permanentFlags || []);
-        (mailbox.knownFlags || []).forEach(flag => this.ensureFlag(permanentFlags, flag));
+        const permanentFlags = this.permanentFlagList(mailbox);
         let recent = 0;
         // \Recent sets of the sessions that have this mailbox selected
         const recentSets = [];
@@ -517,20 +564,8 @@ class IMAPServer extends Stream {
      * @return {Boolean} Returns true if the date string is in IMAP date-time format
      */
     validateInternalDate(date) {
-        if (!date || typeof date !== 'string') {
-            return false;
-        }
-        // date-time from RFC 3501 section 9, month names are case-insensitive like all ABNF strings
-        const match = date.match(/^( \d|\d\d)-(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)-(\d{4}) (\d{2}):(\d{2}):(\d{2}) [-+](\d{2})(\d{2})$/i);
-        if (!match) {
-            return false;
-        }
-        // the values must also make a real date and time
-        return (isRealDate(match[1], monthIndex(match[2]), match[3]) &&
-            Number(match[4]) < 24 &&
-            Number(match[5]) < 60 &&
-            Number(match[6]) < 61 &&
-            Number(match[8]) < 60);
+        // date-time from RFC 3501 section 9
+        return isDateTime(date);
     }
     /**
      * Converts a date object to a valid date-time string format
@@ -961,6 +996,32 @@ class IMAPServer extends Stream {
         const knownFlags = (mailbox.knownFlags = mailbox.knownFlags || []);
         flags.forEach(flag => this.ensureFlag(knownFlags, flag));
     }
+    /**
+     * Checks if a flag can be stored on messages of a mailbox: any flag when the mailbox allows new keywords
+     * (PERMANENTFLAGS has `\*`), otherwise only a flag in the PERMANENTFLAGS list that getStatus() builds, the
+     * `permanentFlags` of the mailbox and every flag its messages had. RFC 3501 section 7.1 (RFC 9051 section 7.1):
+     * PERMANENTFLAGS "indicates which of the known flags the client can change permanently", STORE ignores the others
+     *
+     * @param {Object} mailbox Mailbox object
+     * @param {String} flag Normalized flag
+     * @return {Boolean} true if the flag is a permanent flag of the mailbox
+     */
+    isPermanentFlag(mailbox, flag) {
+        // the lists of permanentFlagList(), without building it: this runs for every flag STORE and APPEND set
+        return (mailbox.allowPermanentFlags || (mailbox.permanentFlags || []).indexOf(flag) >= 0 || (!!mailbox.knownFlags && mailbox.knownFlags.indexOf(flag) >= 0));
+    }
+    /**
+     * The flags of the PERMANENTFLAGS list (without `\*`): the `permanentFlags` of the mailbox and every flag its
+     * messages have or had (`knownFlags`, see rememberFlags)
+     *
+     * @param {Object} mailbox Mailbox object
+     * @return {Array} flags, a new list
+     */
+    permanentFlagList(mailbox) {
+        const list = [].concat(mailbox.permanentFlags || []);
+        (mailbox.knownFlags || []).forEach(flag => this.ensureFlag(list, flag));
+        return list;
+    }
     /**
      * The current time for dates the server sets itself (INTERNALDATE of a message without one, SAVEDATE). The `now`
      * option fixes it for repeatable tests: a Date, a timestamp, or a function that returns one
@@ -1032,9 +1093,10 @@ class IMAPServer extends Stream {
      */
     appendMessage(path, flags, internaldate, raw, ignoreConnection, properties) {
         const mailbox = typeof path === 'string' ? this.getMailbox(path) : path;
-        // processMessage() below sets the UID
+        // processMessage() below sets the UID. Flags the mailbox can not store are left out (APPEND, COPY: the flags
+        // SHOULD be set, RFC 3501 sections 6.3.11 and 6.4.7), as STORE ignores them (RFC 3501 section 7.1, PERMANENTFLAGS)
         const message = Object.assign({}, properties, {
-            flags: flags,
+            flags: flags.filter(flag => this.isPermanentFlag(mailbox, flag)),
             internaldate: internaldate,
             raw: raw,
             recent: true
@@ -1220,49 +1282,48 @@ class IMAPServer extends Stream {
         return flags;
     }
     matchFolders(referenceName, match, exportName, folders) {
-        let includeINBOX = false;
         const source = folders || this.folderCache;
         const toName = exportName || ((name) => name);
-        let reference = referenceName || '';
-        if (reference === '' && this.referenceNamespace !== false) {
-            reference = toName(this.referenceNamespace);
-            includeINBOX = true;
-        }
-        // the reference does not have to be a namespace, use the namespace it belongs to
-        let nsKey = false;
-        let nsName = '';
-        for (const key of Object.keys(this.storage)) {
-            const name = toName(key);
-            if (key !== 'INBOX' && reference.substr(0, name.length) === name && (nsKey === false || name.length > nsName.length)) {
-                nsKey = key;
-                nsName = name;
-            }
-        }
-        if (nsKey === false) {
-            return [];
-        }
-        const namespace = this.storage[nsKey];
-        const lookup = reference + match;
-        const result = [];
-        const pattern = '^' +
+        // RFC 3501 section 6.3.8 (RFC 9051 section 6.3.9): "An empty ("" string) reference name argument
+        // indicates that the mailbox name is interpreted as by SELECT", and without break out characters
+        // "the canonical form is normally the reference name appended with the mailbox name". The pattern
+        // matches full mailbox names, also in a personal namespace with a prefix such as "INBOX.". With the
+        // namespace convention "#" is a break out character "and must be treated as such" (RFC 3501 section 6.3.8,
+        // RFC 9051 section 6.3.9): a pattern that starts with it is a name of its own, the reference is ignored
+        const lookup = match.charAt(0) === '#' ? match : (referenceName || '') + match;
+        // "%" does not match the hierarchy delimiter, which is the one of the namespace a name belongs to
+        const toRegExp = (separator, flags = '') => new RegExp('^' +
             lookup
                 // escape regex symbols
                 .replace(/([\\^$+?!.():=[\]{}|,-])/g, '\\$1')
                 .replace(/[*]/g, '.*')
-                .replace(/[%]/g, '[^' + namespace.separator.replace(/([\\^$+*?!.():=[\]{}|,-])/g, '\\$1') + ']*') +
-            '$';
-        const query = new RegExp(pattern, '');
-        // INBOX is case-insensitive
-        if (includeINBOX && source.INBOX && ((reference ? reference + namespace.separator : '') + 'INBOX').match(new RegExp(pattern, 'i'))) {
+                .replace(/[%]/g, '[^' + separator.replace(/([\\^$+*?!.():=[\]{}|,-])/g, '\\$1') + ']*') +
+            '$', flags);
+        // RFC 3501 section 6.3.8 allows to "hide" otherwise accessible mailboxes from the wildcards: the
+        // mailboxes of namespaces other than the personal one are only matched when the pattern names
+        // the prefix of the namespace before any wildcard (LIST "" "user.%", LIST "#news." "*"). The pattern
+        // of every namespace that is matched, null for a hidden one
+        const fixedPrefix = lookup.replace(/[*%].*$/, '');
+        const queries = new Map();
+        Object.keys(this.storage).forEach(key => {
+            const name = toName(key);
+            const visible = key === this.referenceNamespace || fixedPrefix.substr(0, name.length) === name;
+            queries.set(key, visible ? toRegExp(this.storage[key].separator) : null);
+        });
+        const result = [];
+        // "The special name INBOX is included in the output from LIST, if [...] the uppercase string "INBOX"
+        // matches the interpreted reference and mailbox name arguments", INBOX is case-insensitive
+        if (source.INBOX && toRegExp((this.storage.INBOX && this.storage.INBOX.separator) || '/', 'i').test('INBOX')) {
             result.push(source.INBOX);
         }
         Object.keys(source).forEach(path => {
             const folder = source[path];
-            if (folder.namespace !== nsKey) {
+            const query = path !== 'INBOX' && folder.namespace !== false && folder.namespace !== 'INBOX' ? queries.get(folder.namespace) : null;
+            if (!query) {
                 return;
             }
             const name = toName(path);
-            if (name.match(query) && (folder.flags.indexOf('\\NonExistent') < 0 || name === match)) {
+            if (query.test(name) && (folder.flags.indexOf('\\NonExistent') < 0 || name === lookup)) {
                 result.push(folder);
             }
         });
@@ -1351,7 +1412,8 @@ class IMAPConnection {
         this._outputQueue = null;
         this._outputTimer = null;
         this._deferredOutput = null;
-        this.secureConnection = !!this.options.secureConnection;
+        // a TLS socket is encrypted, and so can be an in-memory connection of server.connect()
+        this.secureConnection = !!this.options.secureConnection || socket.encrypted === true;
         this._remainder = '';
         this._command = '';
         this._literalRemaining = 0;
@@ -1369,7 +1431,7 @@ class IMAPConnection {
         this.messageGlobal = false;
         this._commandQueue = [];
         this._processing = false;
-        if (this.options.debug) {
+        if (this.options.debug && typeof this.socket.pipe === 'function') {
             this.socket.pipe(process.stdout);
         }
         this.socket.on('data', this.receive.bind(this));
@@ -1608,7 +1670,8 @@ class IMAPConnection {
                 this.watchQuiet(quiet);
             }
         }, Math.max(0, next - (Date.now() - last)));
-        this._quietTimer.unref();
+        // browsers have no unref
+        this._quietTimer.unref?.();
     }
     /**
      * Handles data from the socket, through the transport layer if there is one
@@ -2119,7 +2182,7 @@ class IMAPConnection {
      * @return {Boolean} true if an EXPUNGE response is pending
      */
     hasPendingExpunge() {
-        return this.notificationQueue.some(notification => notification.attributes && (notification.attributes[1] || {}).value === 'EXPUNGE');
+        return this.notificationQueue.some(isPendingExpunge);
     }
     /**
      * Tells the other sessions that have the selected mailbox open about changed flags, they get
@@ -2278,6 +2341,16 @@ class IMAPConnection {
         // section 6.2.1). STARTTLS is refused when input is waiting (the noPipelining command option), this only
         // guards against plugins that upgrade the connection otherwise
         this.discardInput();
+        // STARTTLS runs on a live connection
+        const socket = this.socket;
+        if (typeof socket.startTls === 'function') {
+            // a socket without a TLS layer that can count as encrypted (MemorySocket of server.connect())
+            return socket.startTls(() => {
+                this.secureConnection = true;
+                this.upgrading = false;
+                callback();
+            });
+        }
         const secureContext = tls.createSecureContext(this.server.getCredentials());
         const socketOptions = {
             secureContext: secureContext,
@@ -2288,8 +2361,6 @@ class IMAPConnection {
                 cb(null, secureContext);
             }
         };
-        // STARTTLS runs on a live connection
-        const socket = this.socket;
         // the RST of a script rule goes to the TCP socket under the TLS layer, see resetSocket. Node also has it as the
         // _parent of the TLS socket, Bun does not
         this.tcpSocket = socket;
@@ -2326,22 +2397,52 @@ class IMAPConnection {
     prepareNotifications(queue) {
         return queue;
     }
-    processNotifications(data) {
-        const options = data && this.server.getCommandOptions(data.command);
-        if (options && (options.noExpunge || (options.searchCriteria !== false && this.usesSequenceNumbers(data)))) {
-            // EXPUNGE responses are not allowed during FETCH, STORE and SEARCH (RFC 3501 section 7.4.1), during
-            // the commands that extensions add to this list (see the noExpunge command option), nor during UID
-            // SEARCH with message numbers in the search criteria (RFC 7162 section 3.2.10.2 for VANISHED, EXPUNGE
-            // may wait as well, RFC 3501 only allows it during UID commands)
-            return;
-        }
+    /**
+     * Checks if EXPUNGE responses must wait while a command runs: during FETCH, STORE and SEARCH (RFC 3501 section
+     * 7.4.1), during the commands that extensions add to this list (see the noExpunge command option), and during UID
+     * SEARCH with message numbers in the search criteria (RFC 7162 section 3.2.10.2 for VANISHED, EXPUNGE may wait as
+     * well, RFC 3501 only allows it during UID commands)
+     *
+     * @param {Object} data Parsed command
+     * @return {Boolean} true if the command holds back EXPUNGE responses
+     */
+    holdsExpunge(data) {
+        const options = this.server.getCommandOptions(data.command);
+        return options.noExpunge || (options.searchCriteria !== false && this.usesSequenceNumbers(data));
+    }
+    /**
+     * Sends the queued notifications. During a command that holds back EXPUNGE responses (see holdsExpunge), or with
+     * `beforeCommand` before a command that refers to messages by sequence number, only the notifications queued before
+     * the first pending EXPUNGE go out: new messages (EXISTS) and flag changes. RFC 3501 section 5.2: "A server MUST send
+     * mailbox size updates automatically if a mailbox size change is observed during the processing of a command",
+     * section 7.4.1 forbids only EXPUNGE during FETCH, STORE and SEARCH. What was queued after the EXPUNGE waits with it,
+     * an EXISTS sent before it would describe a list that the client can not know yet
+     *
+     * @param {Object} [data] Parsed command that runs, or null between commands
+     * @param {Boolean} [beforeCommand] true when the command has not run yet, then a command with message sequence
+     *     numbers (COPY, MOVE) also waits with the EXPUNGE responses, its numbers refer to the messages before them
+     */
+    processNotifications(data, beforeCommand) {
         if (!this.notificationQueue.length) {
             return;
         }
-        const queue = this.prepareNotifications(this.notificationQueue);
-        this.notificationQueue = [];
+        let queue = this.notificationQueue;
         // Flag updates use the sequence numbers this session knows: before the EXPUNGE responses of
         // the snapshot are sent, the snapshot, afterwards the current message list
+        const snapshot = queue.find(notification => notification.mailboxCopy);
+        let held = [];
+        if (data && (this.holdsExpunge(data) || (beforeCommand && this.usesSequenceNumbers(data)))) {
+            const first = queue.findIndex(isPendingExpunge);
+            if (first >= 0) {
+                held = queue.slice(first);
+                queue = queue.slice(0, first);
+            }
+            if (!queue.length) {
+                return;
+            }
+        }
+        this.notificationQueue = held;
+        queue = this.prepareNotifications(queue);
         const snapshotIndex = queue.findIndex(notification => notification.mailboxCopy);
         const sequenceMaps = new Map();
         const getSequence = (messages) => {
@@ -2355,16 +2456,58 @@ class IMAPConnection {
         const current = this.selectedMailbox ? this.selectedMailbox.messages : [];
         // a message changed several times is reported once, its FETCH response carries the current flags
         const reported = new Set();
+        // before the snapshot (or with all of it still held back, then the split at the first pending expunge leaves
+        // no snapshot in the queue) the session knows the old list
+        const sessionList = (i) => (snapshot && (snapshotIndex < 0 || i < snapshotIndex) ? snapshot.mailboxCopy : current);
+        // the last EXISTS response of a run of EXISTS responses, and if the run announces new messages
+        let lastExists = -1;
+        let newMessages = false;
         queue.forEach((notification, i) => {
             if (notification.flagUpdate) {
-                // i < snapshotIndex only when there is a snapshot
-                this.sendFlagUpdate(notification.flagUpdate, getSequence(i < snapshotIndex ? queue[snapshotIndex].mailboxCopy : current), reported);
+                this.sendFlagUpdate(notification.flagUpdate, getSequence(sessionList(i)), reported);
             }
             else {
                 this.send(notification);
             }
+            if (isExists(notification)) {
+                lastExists = i;
+                // the EXISTS after the EXPUNGE responses of another session carries the snapshot instead of a message
+                newMessages = newMessages || !!notification.message;
+            }
+            const next = queue[i + 1];
+            if (lastExists < 0 || isExists(next) || (next && next.fetchedMessage)) {
+                // not the end of a run of EXISTS responses (and the FETCH responses NOTIFY sends after them)
+                return;
+            }
+            // RFC 3501 section 7.3.2: the RECENT response "occurs as a result of a SELECT or EXAMINE command, and if the
+            // size of the mailbox changes (e.g., new messages)". One for consecutive EXISTS responses that announce new
+            // messages, with the number of \Recent messages among those the client was told about. After expunges the
+            // EXPUNGE responses report the change (RFC 3501 section 7.4.1). It goes after the FETCH responses that NOTIFY
+            // sends for new messages, RFC 5465 section 5.2: "an unsolicited EXISTS response, followed by an unsolicited
+            // FETCH response [...] The server MAY also send a RECENT response"
+            if (newMessages) {
+                this.sendRecent(Number(queue[lastExists].attributes[0]), getSequence(sessionList(lastExists)));
+            }
+            lastExists = -1;
+            newMessages = false;
         });
     }
+    /**
+     * Sends an untagged RECENT response with the number of \Recent messages among the first `count` messages
+     *
+     * @param {Number} count Number of messages the client was told about
+     * @param {Map} sequence Message to the sequence number this session knows it by
+     */
+    sendRecent(count, sequence) {
+        let recent = 0;
+        (this.recent || new Set()).forEach(message => {
+            const seq = sequence.get(message);
+            if (seq && seq <= count) {
+                recent++;
+            }
+        });
+        this.send({ tag: '*', notification: true, attributes: [recent, { type: 'ATOM', value: 'RECENT' }] }, 'RECENT NOTIFICATION');
+    }
     /**
      * Compile a command object to a response string and write it to socket.
      * If the command object has a skipResponse property, the command is
@@ -2407,10 +2550,11 @@ class IMAPConnection {
             response.tag === parsed.tag &&
             response.command === 'OK' &&
             this.hasPendingExpunge() &&
-            this.server.getCommandOptions(parsed.command).noExpunge &&
+            this.holdsExpunge(parsed) &&
             !(Array.isArray(response.attributes) && response.attributes.some(attr => attr && attr.type === 'SECTION'))) {
             // After the output handlers, they might add a response code of their own (MODIFIED of CONDSTORE).
-            // FETCH, STORE, SEARCH and the like can not report the EXPUNGE of another session (RFC 3501 section 7.4.1),
+            // FETCH, STORE, SEARCH and the like can not report the EXPUNGE of another session (RFC 3501 section 7.4.1), nor
+            // can UID SEARCH with message numbers in the criteria (see holdsExpunge),
             // EXPUNGEISSUED tells the client to issue NOOP soon (RFC 5530 section 3, RFC 9051 section 7.1)
             response.attributes = [{ type: 'SECTION', section: [{ type: 'ATOM', value: 'EXPUNGEISSUED' }] }].concat(response.attributes || []);
         }
@@ -2554,6 +2698,15 @@ class IMAPConnection {
      * @return {Boolean} true if the command uses message sequence numbers
      */
     usesSequenceNumbers(parsed) {
+        // the notification checks ask several times per command, the answer does not change
+        let cached = sequenceNumberUse.get(parsed);
+        if (cached === undefined) {
+            cached = this.findSequenceNumbers(parsed);
+            sequenceNumberUse.set(parsed, cached);
+        }
+        return cached;
+    }
+    findSequenceNumbers(parsed) {
         const { sequenceSet, searchCriteria } = this.server.getCommandOptions(parsed.command);
         if (sequenceSet !== false) {
             // other forms of sequence sets, like "$" of SEARCHRES (RFC 5182 section 2.3), do not use numbers
@@ -2732,12 +2885,14 @@ class IMAPConnection {
             this.refusePipelined(parsed, data);
             return;
         }
-        if (this.server.getCommandHandler(parsed.command)) {
+        // an unknown SASL mechanism is answered by its own handler, after the central checks (state, script rules)
+        const fallback = /^AUTHENTICATE /i.test(parsed.command) && !this.server.getCommandHandler(parsed.command) ? unsupportedMechanism : undefined;
+        if (fallback || this.server.getCommandHandler(parsed.command)) {
             if (this.isAmbiguous(parsed)) {
                 this.sendStatus(parsed, data, 'BAD', 'Commands with message sequence numbers must wait for the completion of earlier commands');
                 return;
             }
-            const element = { parsed, data };
+            const element = { parsed, data, handler: fallback };
             if (scripted) {
                 // processQueue runs it once the script rule released the queue
                 this._commandQueue.unshift(element);
@@ -2747,19 +2902,6 @@ class IMAPConnection {
             }
             this.processQueue();
         }
-        else if (/^AUTHENTICATE /i.test(parsed.command)) {
-            // an unsupported mechanism is a NO, not a syntax error (RFC 3501 section 6.2.2)
-            this.send({
-                tag: parsed.tag,
-                command: 'NO',
-                attributes: [
-                    {
-                        type: 'TEXT',
-                        value: 'Unsupported authentication mechanism'
-                    }
-                ]
-            }, 'UNKNOWN COMMAND', parsed, data);
-        }
         else {
             this.send({
                 tag: parsed.tag,
@@ -2927,19 +3069,25 @@ class IMAPConnection {
                 return next();
             }
         }
-        if (command.substr(0, 4) === 'UID ' && this.hasPendingExpunge()) {
-            // EXPUNGE responses may be sent during UID commands (RFC 3501 section 7.4.1). The expunges of other sessions
-            // are reported first, then the command runs on the current mailbox, where the UIDs of the expunged messages
-            // do not exist and are ignored (RFC 3501 section 6.4.8), so the ghost handling of STORE, COPY and MOVE (RFC 2180
-            // section 4) only applies to their sequence number forms. Not for UID SEARCH with message numbers in the
-            // criteria, processNotifications knows when EXPUNGE must wait
-            this.processNotifications(element.parsed);
+        if (this.state === 'Selected' &&
+            (command.startsWith('UID ') || options.noExpunge || options.sequenceSet !== false || options.searchCriteria !== false)) {
+            // A command that refers to messages runs on the message list the client was told about. Only these: CLOSE
+            // must not send pending EXPUNGE responses (RFC 3501 section 6.4.2) and SELECT leaves the old mailbox. RFC 3501 section 5.2:
+            // "A server MUST send mailbox size updates automatically if a mailbox size change is observed during the
+            // processing of a command", so the new messages and flag changes of other sessions are reported first,
+            // before the command resolves its sequence set or search criteria.
+            // EXPUNGE responses may be sent during UID commands (RFC 3501 section 7.4.1), so these report the expunges of
+            // other sessions first as well, then the command runs on the current mailbox, where the UIDs of the expunged
+            // messages do not exist and are ignored (RFC 3501 section 6.4.8). The ghost handling of STORE, COPY and MOVE
+            // (RFC 2180 section 4) only applies to their sequence number forms, these and UID SEARCH with message numbers
+            // in the criteria keep the EXPUNGE responses for later, see processNotifications
+            this.processNotifications(element.parsed, true);
         }
         // changes made while the handler runs are attributed to this session (the `origin` of notifications)
         this.server.withOrigin(this, () => {
             try {
                 const inputHandler = this.inputHandler;
-                this.server.getCommandHandler(element.parsed.command)(this, element.parsed, element.data, next);
+                (element.handler || this.server.getCommandHandler(element.parsed.command))(this, element.parsed, element.data, next);
                 if (this.inputHandler && this.inputHandler !== inputHandler) {
                     // the command reads the lines that follow (IDLE, AUTHENTICATE), script rules match them with it
                     this.inputCommand = { tag: element.parsed.tag, command: element.parsed.command };

package/dist/esm/storage-schema.js

@@ -5,6 +5,7 @@
  * messages (acl, metadata, MODSEQ ...), so other keys are allowed, only the types of the known keys are checked
  */
 import { MAX_NUMBER } from './numbers.js';
+import { isDateTime } from './dates.js';
 // keys of plugins, an unknown key that looks like a typo of a known key is refused unless a plugin uses it
 const PLUGIN_KEYS = [
     'acl',
@@ -147,11 +148,17 @@ export function validateStorage(storage) {
         if (message.flags !== undefined && typeof message.flags !== 'string' && !isFlagList(message.flags)) {
             fail(path + '.flags', 'must be a flag or a list of flags');
         }
-        if (message.internaldate !== undefined &&
-            message.internaldate !== false &&
-            typeof message.internaldate !== 'string' &&
-            !(message.internaldate instanceof Date)) {
-            fail(path + '.internaldate', 'must be a date-time string or a Date');
+        // FETCH sends the internal date as it is and SORT ARRIVAL reads it, so it must be a date-time of RFC 3501
+        // section 9 (month names in any case, they are sent as "Jan", "Feb", ...) or a valid Date. The save date
+        // of the SAVEDATE plugin is a date-time too (RFC 8514 section 4.2)
+        for (const key of ['internaldate', 'SAVEDATE']) {
+            const value = message[key];
+            if (value === undefined || value === false || (key === 'SAVEDATE' && value === null)) {
+                continue;
+            }
+            if (value instanceof Date ? isNaN(value.getTime()) : !isDateTime(value)) {
+                fail(path + '.' + key, 'must be a date-time string like "14-Sep-2013 21:22:28 -0300" or a Date, not ' + JSON.stringify(value));
+            }
         }
         if (message.recent !== undefined && typeof message.recent !== 'boolean') {
             fail(path + '.recent', 'must be true or false');

package/dist/esm/store-operations.d.ts

@@ -6,7 +6,10 @@
  * what is specific to a session: argument checks, the selected mailbox, read-only state and the responses.
  */
 import type { IMAPConnection, IMAPServer, Mailbox, Message } from './types.js';
-/** the XOAUTH2 session timeout of the default user, and of a user the control API adds without one */
+/**
+ * the deprecated XOAUTH2 session timeout of the default user, and of a user the control API adds without one. It is
+ * stored and listed but never used, access tokens do not expire
+ */
 declare const DEFAULT_SESSION_TIMEOUT: number;
 /** An error of a failed store operation or control API call, `code` is a RFC 5530 response code or INVALID */
 declare class ImapKitError extends Error {
@@ -94,7 +97,7 @@ declare function createMailbox(server: IMAPServer, path: string): Mailbox;
  *
  * @param {Object} server IMAP server
  * @param {String} path Storage name of the mailbox
- * @throws {Error} with a RFC 5530 `code` (NONEXISTENT, CANNOT, HASCHILDREN ...)
+ * @throws {Error} with a response `code` (NONEXISTENT, CANNOT, HASCHILDREN ...)
  */
 declare function deleteMailbox(server: IMAPServer, path: string): void;
 /**

package/dist/esm/store-operations.js

@@ -8,7 +8,10 @@
 import { normalizeSystemFlag, checkSystemFlags } from './commands/handlers/flags.js';
 import { seededRandom } from './random.js';
 import { MAX_NUMBER } from './numbers.js';
-/** the XOAUTH2 session timeout of the default user, and of a user the control API adds without one */
+/**
+ * the deprecated XOAUTH2 session timeout of the default user, and of a user the control API adds without one. It is
+ * stored and listed but never used, access tokens do not expire
+ */
 const DEFAULT_SESSION_TIMEOUT = 3600 * 1000;
 /** An error of a failed store operation or control API call, `code` is a RFC 5530 response code or INVALID */
 class ImapKitError extends Error {
@@ -144,7 +147,7 @@ function checkFlags(server, mailbox, flags, stored) {
         catch (err) {
             throw storeError(err.message, 'INVALID');
         }
-        if (stored && mailbox.permanentFlags.indexOf(flag) < 0 && !mailbox.allowPermanentFlags) {
+        if (stored && !server.isPermanentFlag(mailbox, flag)) {
             throw storeError('Flag ' + flag + ' is not a permanent flag of ' + mailbox.path, 'INVALID');
         }
         if (list.indexOf(flag) < 0) {
@@ -218,7 +221,7 @@ function createMailbox(server, path) {
  *
  * @param {Object} server IMAP server
  * @param {String} path Storage name of the mailbox
- * @throws {Error} with a RFC 5530 `code` (NONEXISTENT, CANNOT, HASCHILDREN ...)
+ * @throws {Error} with a response `code` (NONEXISTENT, CANNOT, HASCHILDREN ...)
  */
 function deleteMailbox(server, path) {
     const mailbox = server.getMailbox(path);

package/dist/esm/types.d.ts

@@ -212,6 +212,10 @@ export interface UserData {
     password?: string | undefined;
     xoauth2?: {
         accessToken?: string | undefined;
+        /**
+         * @deprecated kept from hoodiecrow and ignored: access tokens never expire. Change the token with
+         * `control.updateUser()` to test a client against an expired one
+         */
         sessionTimeout?: number | undefined;
     } | undefined;
     [key: string]: any;