proton-mail-bridge-client 2.0.2 → 2.0.3

package/dist/services/simple-imap-service.js

@@ -95,7 +95,20 @@ const BULK_BATCH_TIMEOUT_MS = 60_000;
 // single-message fetch.
 const LABEL_RESOLVE_PER_FOLDER_TIMEOUT_MS = 5_000;
 const LABEL_RESOLVE_BUDGET_MS = 15_000;
-const UID_VALIDITY_MISMATCH_ERROR = "UID validity mismatch - local index is stale, run sync_emails to refresh";
+// Deliberately not phrased like a generic integrity/checksum failure (that's
+// EMAIL_ID_INVALID_MESSAGE's job in helpers.ts, for a genuinely corrupted
+// id) — this is a *different* failure mode: the id's folder+uid are
+// internally consistent and correctly formed, they just no longer identify
+// a real message, because the mailbox they were minted against was
+// recreated (full recreation, some migration scenarios) between then and
+// now. "Stale index, re-sync" undersold the risk here: re-syncing doesn't
+// make the *old* id valid again, it can only mint new, current ones — the
+// old one must never be silently honored against the new generation.
+// Exported so index.ts's bulk-operation resolution path (getBulkNotFoundEmailIds)
+// can report a stale-generation id with the exact same wording a single-message
+// mutation would raise via assertMailboxUidValidity, rather than drifting into
+// two subtly different phrasings for what is the same underlying failure.
+export const UID_VALIDITY_MISMATCH_ERROR = "This email reference is from before the mailbox changed (folder was recreated or migrated) and no longer points to a valid message. Re-fetch the email (e.g. via search_emails or get_emails) to get a current reference.";
 function collectErrorText(error) {
     const values = [];
     if (error instanceof Error) {
@@ -895,6 +908,7 @@ export class SimpleIMAPService {
             if (total === 0 || offset >= total) {
                 return { folder, total, limit, offset, emails: [] };
             }
+            const uidValidity = (client.mailbox || undefined)?.uidValidity?.toString();
             const emails = [];
             const fetchQuery = input.includeSnippet ? FETCH_DETAIL_QUERY : FETCH_SUMMARY_QUERY;
             if (input.beforeUid !== undefined) {
@@ -917,7 +931,7 @@ export class SimpleIMAPService {
                 }
                 const uidSet = page.join(",");
                 for await (const message of client.fetch(uidSet, fetchQuery, { uid: true })) {
-                    const summary = this.toSummary(folder, message);
+                    const summary = this.toSummary(folder, message, uidValidity);
                     const enriched = input.includeSnippet && message.source
                         ? await this.enrichSummaryFromParsed(summary, await this.parseSource(message.source), false)
                         : summary;
@@ -946,7 +960,7 @@ export class SimpleIMAPService {
                     startSeq = Math.max(1, endSeq - limit + 1);
                 }
                 for await (const message of client.fetch(`${startSeq}:${endSeq}`, fetchQuery)) {
-                    const summary = this.toSummary(folder, message);
+                    const summary = this.toSummary(folder, message, uidValidity);
                     const enriched = input.includeSnippet && message.source
                         ? await this.enrichSummaryFromParsed(summary, await this.parseSource(message.source), false)
                         : summary;
@@ -977,51 +991,125 @@ export class SimpleIMAPService {
         const searchQuery = this.buildSearchQuery(input);
         const collected = [];
         let totalMatched = 0;
+        let anyCandidatesUnexamined = false;
+        // Local-only filters (hasAttachment/attachmentName/label/threadId/senderDomain/
+        // mailboxRole) are everything matchesLocalSearchFilters checks — IMAP SEARCH
+        // (buildSearchQuery above) can't express any of them server-side, so they can
+        // only be evaluated after a candidate's full data is fetched.
+        const hasLocalOnlyFilters = typeof input.hasAttachment === "boolean" ||
+            Boolean(input.threadId) ||
+            Boolean(input.label) ||
+            Boolean(input.attachmentName) ||
+            Boolean(input.senderDomain) ||
+            Boolean(input.mailboxRole);
         for (const folder of folders) {
-            const emails = await this.withMailbox(folder, true, async (client) => {
+            const { results: emails, moreRemain } = await this.withMailbox(folder, true, async (client) => {
                 const searchResult = await client.search(searchQuery, { uid: true });
                 const uids = searchResult || [];
                 totalMatched += uids.length;
                 if (uids.length === 0) {
-                    return [];
+                    return { results: [], moreRemain: false };
                 }
-                // UID order does not track date order (e.g. after a cross-provider import),
-                // so a naive slice(-limit) on UIDs can silently drop the newest messages.
-                // Fetch cheap INTERNALDATE-only headers first, sort by date, then pick the target UIDs.
-                let targetUids = uids;
-                if (uids.length > limit) {
-                    const dated = [];
-                    for await (const message of client.fetch(uids, FETCH_INDEX_QUERY, { uid: true })) {
-                        dated.push({ uid: message.uid, date: new Date(message.internalDate ?? 0).getTime() });
+                const fetchQuery = input.includeSnippet ? FETCH_DETAIL_QUERY : FETCH_SUMMARY_QUERY;
+                const uidValidity = (client.mailbox || undefined)?.uidValidity?.toString();
+                if (!hasLocalOnlyFilters) {
+                    // UID order does not track date order (e.g. after a cross-provider import),
+                    // so a naive slice(-limit) on UIDs can silently drop the newest messages.
+                    // Fetch cheap INTERNALDATE-only headers first, sort by date, then pick the target UIDs.
+                    let targetUids = uids;
+                    if (uids.length > limit) {
+                        const dated = [];
+                        for await (const message of client.fetch(uids, FETCH_INDEX_QUERY, { uid: true })) {
+                            dated.push({ uid: message.uid, date: new Date(message.internalDate ?? 0).getTime() });
+                        }
+                        targetUids = pickNewestUids(dated, limit);
+                    }
+                    else {
+                        targetUids = [...uids].reverse();
+                    }
+                    const results = [];
+                    for await (const message of client.fetch(targetUids, fetchQuery, { uid: true })) {
+                        const summary = this.toSummary(folder, message, uidValidity);
+                        const enriched = input.includeSnippet && message.source
+                            ? await this.enrichSummaryFromParsed(summary, await this.parseSource(message.source), false)
+                            : summary;
+                        results.push(enriched);
+                        this.messageCache.set(enriched.id, enriched);
+                        this.capMessageCache();
                     }
-                    targetUids = pickNewestUids(dated, limit);
+                    return { results, moreRemain: false };
                 }
-                else {
-                    targetUids = [...uids].reverse();
+                // A local-only filter narrows the FINAL result, not the IMAP-SEARCH candidate
+                // set — applying it after picking the newest `limit` UIDs (as the branch above
+                // does) can silently drop a genuine match that isn't among the newest `limit`
+                // candidates by date, because it never even gets fetched. E.g.: an older
+                // message with a real attachment, behind a newer attachment-less one, and
+                // limit:1 — the old newest-N selection would pick only the newer non-match and
+                // return nothing, even though a true match exists.
+                //
+                // Fix: order every candidate newest-first by INTERNALDATE (same cheap header
+                // fetch as above), then walk it in `limit`-sized bounded batches — fetch a
+                // batch, apply the FULL filter (matchesLocalSearchFilters included) to it, keep
+                // genuine matches, and continue to the next batch only if `limit` genuine
+                // matches haven't been found yet. This mirrors the bounded-batch/resume-cursor
+                // reasoning used for large incremental-sync gaps: bound the work done per call
+                // instead of fetching the entire broad candidate set regardless of `limit`.
+                const dated = [];
+                for await (const message of client.fetch(uids, FETCH_INDEX_QUERY, { uid: true })) {
+                    dated.push({ uid: message.uid, date: new Date(message.internalDate ?? 0).getTime() });
                 }
+                const orderedUids = pickNewestUids(dated, dated.length);
                 const results = [];
-                const fetchQuery = input.includeSnippet ? FETCH_DETAIL_QUERY : FETCH_SUMMARY_QUERY;
-                for await (const message of client.fetch(targetUids, fetchQuery, { uid: true })) {
-                    const summary = this.toSummary(folder, message);
-                    const enriched = input.includeSnippet && message.source
-                        ? await this.enrichSummaryFromParsed(summary, await this.parseSource(message.source), false)
-                        : summary;
-                    results.push(enriched);
-                    this.messageCache.set(enriched.id, enriched);
-                    this.capMessageCache();
+                let moreRemain = false;
+                for (let offset = 0; offset < orderedUids.length; offset += limit) {
+                    const batch = orderedUids.slice(offset, offset + limit);
+                    for await (const message of client.fetch(batch, fetchQuery, { uid: true })) {
+                        const summary = this.toSummary(folder, message, uidValidity);
+                        const enriched = input.includeSnippet && message.source
+                            ? await this.enrichSummaryFromParsed(summary, await this.parseSource(message.source), false)
+                            : summary;
+                        this.messageCache.set(enriched.id, enriched);
+                        this.capMessageCache();
+                        if (matchesLocalSearchFilters(enriched, input)) {
+                            results.push(enriched);
+                        }
+                    }
+                    if (results.length >= limit) {
+                        moreRemain = offset + limit < orderedUids.length;
+                        break;
+                    }
                 }
-                // FIX #3: verified — hasAttachment, attachmentName, label, threadId handled above
-                return results.filter((email) => matchesLocalSearchFilters(email, input));
+                return { results, moreRemain };
             });
             collected.push(...emails);
+            anyCandidatesUnexamined = anyCandidatesUnexamined || moreRemain;
         }
         const sorted = sortEmailsByNewest(dedupeEmails(collected)).slice(0, limit);
+        // totalMatched/hasMore mean different things depending on whether a local-only
+        // filter is present:
+        // - No local-only filters: every IMAP-SEARCH candidate is a genuine match (IMAP
+        //   already applied every requested filter), so the raw SEARCH count (totalMatched)
+        //   is exact, and totalMatched > sorted.length is an exact "more exist" signal.
+        // - A local-only filter is present: the raw SEARCH count is pre-filter and can be
+        //   wildly misleading here — e.g. this method's own repro (hasAttachment:true over
+        //   2 candidates where only 1 genuinely matches) would otherwise report
+        //   totalMatched:2 and hasMore:true for a query with nothing further to find.
+        //   Report the exact number of genuine matches found among the candidates actually
+        //   examined instead (not the full universe — an exact post-filter total would
+        //   require scanning every candidate in every folder regardless of `limit`, which
+        //   defeats the bounded-batch fix above), and derive hasMore from whether any
+        //   folder's bounded scan stopped early with candidates still unexamined, or the
+        //   combined cross-folder result was itself truncated to `limit`.
+        const totalMatchedForResponse = hasLocalOnlyFilters ? collected.length : totalMatched;
+        const hasMore = hasLocalOnlyFilters
+            ? anyCandidatesUnexamined || collected.length > sorted.length
+            : totalMatched > sorted.length;
         return {
             folders,
             limit,
             total: sorted.length,
-            totalMatched,
-            hasMore: totalMatched > sorted.length,
+            totalMatched: totalMatchedForResponse,
+            hasMore,
             emails: sorted,
         };
     }
@@ -1265,6 +1353,7 @@ export class SimpleIMAPService {
     async moveEmail(emailId, targetFolder, uidValidity) {
         const { folder, uid } = parseEmailId(emailId);
         let targetUid;
+        let targetFolderUidValidity;
         await this.withTimeout(this.withMailbox(folder, false, async (client) => {
             this.assertMailboxUidValidity(client, uidValidity);
             const moved = await client.messageMove(String(uid), targetFolder, { uid: true });
@@ -1287,10 +1376,25 @@ export class SimpleIMAPService {
             if (targetUid === undefined && client.capabilities.has("UIDPLUS")) {
                 throw new Error(`Email not found for id ${emailId}`);
             }
+            // targetEmailId (below) must embed the *target* folder's own
+            // UIDVALIDITY, not the source folder's — they're different mailboxes
+            // and can carry unrelated values. STATUS works against a
+            // non-selected mailbox (same primitive getFolderStats already uses),
+            // so this doesn't require a second SELECT/lock on targetFolder.
+            // Best-effort: a failure here shouldn't fail an otherwise-successful
+            // move, it just means the returned targetEmailId falls back to the
+            // no-uidValidity (still fully valid, just not staleness-checkable)
+            // format, same as it always did before this field existed.
+            if (targetUid !== undefined) {
+                const targetStatus = await client
+                    .status(targetFolder, { uidValidity: true })
+                    .catch(() => undefined);
+                targetFolderUidValidity = targetStatus?.uidValidity?.toString();
+            }
         }), BULK_ITEM_TIMEOUT_MS, `Timed out after ${BULK_ITEM_TIMEOUT_MS}ms moving email ${emailId} to ${targetFolder}`);
         const cached = this.messageCache.get(emailId);
         this.messageCache.delete(emailId);
-        const targetEmailId = targetUid ? createEmailId(targetFolder, targetUid) : undefined;
+        const targetEmailId = targetUid ? createEmailId(targetFolder, targetUid, targetFolderUidValidity) : undefined;
         if (cached && targetUid && targetEmailId) {
             this.messageCache.set(targetEmailId, {
                 ...cached,
@@ -1349,7 +1453,7 @@ export class SimpleIMAPService {
             deleted: true,
         };
     }
-    async updateMessageLabels(emailId, labelsToAdd, labelsToRemove) {
+    async updateMessageLabels(emailId, labelsToAdd, labelsToRemove, uidValidity) {
         const { folder, uid } = parseEmailId(emailId);
         const added = [];
         const removed = [];
@@ -1369,6 +1473,7 @@ export class SimpleIMAPService {
         let messageId;
         let sourceExists = false;
         await this.withTimeout(this.withMailbox(folder, true, async (client) => {
+            this.assertMailboxUidValidity(client, uidValidity);
             const msg = await client.fetchOne(String(uid), { uid: true, envelope: true }, { uid: true });
             if (msg !== false) {
                 sourceExists = true;
@@ -1495,11 +1600,26 @@ export class SimpleIMAPService {
             };
         });
     }
+    // Lightweight, lock-free UIDVALIDITY lookup — IMAP STATUS works against a
+    // mailbox that isn't currently SELECTed, so this doesn't need (and
+    // deliberately avoids) taking a getMailboxLock the way withMailbox does.
+    // Used at bulk-operation resolution time (resolveUidsForBulkOp) to learn
+    // the folder's *current* generation once, up front, so every id in the
+    // batch can be checked against that single point-in-time value rather than
+    // each mutation discovering staleness independently and inconsistently
+    // partway through the batch.
+    async getMailboxUidValidity(folder) {
+        const client = await this.ensureConnected();
+        const status = await client.status(folder, { uidValidity: true });
+        return status?.uidValidity?.toString();
+    }
     async emptyFolder(folder) {
         if (folder.toUpperCase() === "INBOX") {
             throw new Error("emptyFolder cannot be used on INBOX. Move messages to Trash first.");
         }
+        let folderUidValidity;
         const uids = await this.withTimeout(this.withMailbox(folder, true, async (client) => {
+            folderUidValidity = (client.mailbox || undefined)?.uidValidity?.toString();
             const found = await client.search({ all: true }, { uid: true });
             return Array.isArray(found) ? found : [];
         }), BULK_ITEM_TIMEOUT_MS, `Timed out after ${BULK_ITEM_TIMEOUT_MS}ms listing messages to empty in ${folder}`);
@@ -1510,9 +1630,11 @@ export class SimpleIMAPService {
         await this.withTimeout(this.withMailbox(folder, false, async (client) => {
             await client.messageDelete(uidSet, { uid: true });
         }), BULK_ITEM_TIMEOUT_MS, `Timed out after ${BULK_ITEM_TIMEOUT_MS}ms emptying folder ${folder}`);
-        // Purge from cache
+        // Purge from cache — must reconstruct the exact same id toSummary/etc.
+        // would have cached these messages under (including the folder's
+        // UIDVALIDITY at the time), or a stale cache entry survives this purge.
         for (const uid of uids) {
-            this.messageCache.delete(createEmailId(folder, uid));
+            this.messageCache.delete(createEmailId(folder, uid, folderUidValidity));
         }
         this.folderCache = undefined;
         return { folder, deleted: uids.length };
@@ -1528,7 +1650,18 @@ export class SimpleIMAPService {
     // maxBatchSize 1, a first resolution returned [1], a second (between the
     // dry-run check and the real run) returned [1,2], and the real run acted
     // on both — silently exceeding the limit.
-    async resolveUidsForBulkOp(folder, emailIds, match) {
+    async resolveUidsForBulkOp(folder, emailIds, match, 
+    // Pre-fetched current UIDVALIDITY for `folder`, from a single shared
+    // getMailboxUidValidity call at the top of the caller's bulk handler
+    // (see index.ts's bulk_delete/bulk_update_flags/bulk_update_labels
+    // cases) — reused here instead of resolveUidsForBulkOp fetching its own,
+    // so the exact same point-in-time value backs both the uid resolution
+    // below and index.ts's own stale-id reporting (getBulkNotFoundEmailIds).
+    // Callers with no pre-fetched value (e.g. bulkMove's internal call,
+    // which has no resolve-once wiring of its own) leave this undefined and
+    // resolveUidsForBulkOp fetches it itself, so the staleness check below
+    // still applies uniformly to every bulk entry point.
+    currentUidValidity) {
         if (emailIds !== undefined && match !== undefined) {
             throw new Error("Provide either emailIds or match, not both");
         }
@@ -1536,6 +1669,7 @@ export class SimpleIMAPService {
             throw new Error("Provide either emailIds or match");
         }
         if (emailIds !== undefined) {
+            const uidValidity = currentUidValidity ?? (await this.getMailboxUidValidity(folder));
             // parseEmailId throws on anything malformed. index.ts's
             // getBulkNotFoundEmailIds already expects a bad/wrong-folder id to be
             // silently excluded here and reported separately as notFound — but a
@@ -1543,6 +1677,16 @@ export class SimpleIMAPService {
             // live: bulk_move with 10 valid ids and one malformed one threw
             // "Invalid emailId" and moved none of the 10 valid ones, instead of
             // moving them and reporting just the bad one as notFound.
+            //
+            // Same exclude-not-throw treatment now applies to a *stale* id (one
+            // whose embedded uidValidity doesn't match the folder's current
+            // generation) — excluded from the uids this batch actually acts on,
+            // rather than either silently resolving against the wrong-generation
+            // UID or failing the whole batch over one stale entry. An id with no
+            // embedded uidValidity at all (pre-this-fix format) is unverifiable,
+            // not stale — same "can't check it, so don't block on it" stance
+            // assertMailboxUidValidity already takes for the single-message
+            // mutation path.
             return emailIds
                 .map((id) => {
                 try {
@@ -1552,7 +1696,9 @@ export class SimpleIMAPService {
                     return undefined;
                 }
             })
-                .filter((parsed) => parsed !== undefined && parsed.folder === folder)
+                .filter((parsed) => parsed !== undefined &&
+                parsed.folder === folder &&
+                (parsed.uidValidity === undefined || parsed.uidValidity === uidValidity))
                 .map((parsed) => parsed.uid);
         }
         // match path
@@ -1611,10 +1757,17 @@ export class SimpleIMAPService {
         const results = [];
         if (uids.length > 0) {
             const uidSet = uids.join(",");
+            // Captured for the source-folder emailIds built below — these
+            // identify the *pre-move* message (source folder + uid), matching
+            // sourceEmailId's role in the single-email moveEmail, not a
+            // resolvable post-move reference, so the source folder's own
+            // UIDVALIDITY (not the target's) is the correct one to embed.
+            let sourceUidValidity;
             try {
                 let uidMap;
                 let hasUidPlus = false;
                 await this.withTimeout(this.withMailbox(folder, false, async (client) => {
+                    sourceUidValidity = (client.mailbox || undefined)?.uidValidity?.toString();
                     const moved = await client.messageMove(uidSet, input.targetFolder, { uid: true });
                     if (moved === false) {
                         throw new Error(`Server did not move uid set ${uidSet}`);
@@ -1623,7 +1776,7 @@ export class SimpleIMAPService {
                     hasUidPlus = client.capabilities.has("UIDPLUS");
                 }), BULK_BATCH_TIMEOUT_MS, `Timed out after ${BULK_BATCH_TIMEOUT_MS}ms moving uid set ${uidSet}`);
                 for (const uid of uids) {
-                    const emailId = createEmailId(folder, uid);
+                    const emailId = createEmailId(folder, uid, sourceUidValidity);
                     // `moved === false` above only catches an empty/invalid range,
                     // not a syntactically valid UID that doesn't match any message —
                     // IMAP's MOVE silently succeeds with nothing moved in that case
@@ -1646,7 +1799,7 @@ export class SimpleIMAPService {
             }
             catch (err) {
                 for (const uid of uids) {
-                    const emailId = createEmailId(folder, uid);
+                    const emailId = createEmailId(folder, uid, sourceUidValidity);
                     results.push({ uid, emailId, ok: false, error: String(err) });
                     failed++;
                 }
@@ -1682,6 +1835,7 @@ export class SimpleIMAPService {
         const results = [];
         if (uids.length > 0) {
             const uidSet = uids.join(",");
+            let folderUidValidity;
             try {
                 let existingUids;
                 if (input.permanent || !trashFolder) {
@@ -1694,6 +1848,7 @@ export class SimpleIMAPService {
                     // after the fact. Found live: bulk_delete with one real id and
                     // one deliberately fake one reported ok:true for both.
                     existingUids = await this.withMailbox(folder, true, async (client) => {
+                        folderUidValidity = (client.mailbox || undefined)?.uidValidity?.toString();
                         const found = await client.search({ uid: uidSet }, { uid: true });
                         return new Set(Array.isArray(found) ? found : []);
                     });
@@ -1707,6 +1862,7 @@ export class SimpleIMAPService {
                     let uidMap;
                     let hasUidPlus = false;
                     await this.withMailbox(folder, false, async (client) => {
+                        folderUidValidity = (client.mailbox || undefined)?.uidValidity?.toString();
                         const moved = await client.messageMove(uidSet, trashFolder, { uid: true });
                         if (moved === false)
                             throw new Error(`Server did not move uid set ${uidSet} to trash`);
@@ -1718,7 +1874,7 @@ export class SimpleIMAPService {
                     existingUids = hasUidPlus && uidMap ? new Set(uidMap.keys()) : new Set(uids);
                 }
                 for (const uid of uids) {
-                    const emailId = createEmailId(folder, uid);
+                    const emailId = createEmailId(folder, uid, folderUidValidity);
                     if (!existingUids.has(uid)) {
                         results.push({ uid, emailId, ok: false, error: `Email not found for uid ${uid}` });
                         failed++;
@@ -1731,7 +1887,7 @@ export class SimpleIMAPService {
             }
             catch (err) {
                 for (const uid of uids) {
-                    const emailId = createEmailId(folder, uid);
+                    const emailId = createEmailId(folder, uid, folderUidValidity);
                     results.push({ uid, emailId, ok: false, error: String(err) });
                     failed++;
                 }
@@ -1766,9 +1922,11 @@ export class SimpleIMAPService {
         const results = [];
         if (uids.length > 0) {
             const uidSet = uids.join(",");
+            let folderUidValidity;
             try {
                 const notAppliedByUid = new Map();
                 await this.withMailbox(folder, false, async (client) => {
+                    folderUidValidity = (client.mailbox || undefined)?.uidValidity?.toString();
                     if (flagsToAdd.length > 0) {
                         await client.messageFlagsAdd(uidSet, flagsToAdd, { uid: true });
                     }
@@ -1785,7 +1943,7 @@ export class SimpleIMAPService {
                     }
                 });
                 for (const uid of uids) {
-                    const emailId = createEmailId(folder, uid);
+                    const emailId = createEmailId(folder, uid, folderUidValidity);
                     // A UID absent from the fetch loop above (never got a
                     // notAppliedByUid entry) means the IMAP FETCH found no message
                     // for it — the earlier STORE call already silently no-op'd for
@@ -1805,7 +1963,7 @@ export class SimpleIMAPService {
             }
             catch (err) {
                 for (const uid of uids) {
-                    const emailId = createEmailId(folder, uid);
+                    const emailId = createEmailId(folder, uid, folderUidValidity);
                     results.push({ uid, emailId, ok: false, error: String(err) });
                     failed++;
                 }
@@ -1837,8 +1995,16 @@ export class SimpleIMAPService {
         let succeeded = 0;
         let failed = 0;
         const results = [];
+        // Fetched once for the whole batch rather than inside the per-uid loop
+        // below — resolveUidsForBulkOp already validated every uid against this
+        // exact generation at resolution time; re-passing that same value into
+        // each updateMessageLabels call below is a cheap, no-extra-round-trip
+        // defense-in-depth recheck (updateMessageLabels's own withMailbox call
+        // re-verifies it against the *live* mailbox at execution time), not a
+        // second independent resolution.
+        const folderUidValidity = await this.getMailboxUidValidity(folder).catch(() => undefined);
         for (const uid of uids) {
-            const emailId = createEmailId(folder, uid);
+            const emailId = createEmailId(folder, uid, folderUidValidity);
             try {
                 // updateMessageLabels never throws for a failed COPY/removal — it
                 // catches per-label and reports failures via its own return value
@@ -1850,7 +2016,7 @@ export class SimpleIMAPService {
                 // adding a brand-new label reported ok:true for an item whose label
                 // folder was never actually created — get_folders afterward showed
                 // no such folder at all.
-                const result = await this.withTimeout(this.updateMessageLabels(emailId, labelsToAdd, labelsToRemove), BULK_ITEM_TIMEOUT_MS, `Timed out after ${BULK_ITEM_TIMEOUT_MS}ms updating labels for ${emailId}`);
+                const result = await this.withTimeout(this.updateMessageLabels(emailId, labelsToAdd, labelsToRemove, folderUidValidity), BULK_ITEM_TIMEOUT_MS, `Timed out after ${BULK_ITEM_TIMEOUT_MS}ms updating labels for ${emailId}`);
                 if (result.failedLabels && result.failedLabels.length > 0) {
                     results.push({
                         uid,
@@ -1953,8 +2119,10 @@ export class SimpleIMAPService {
         }
         for (const folder of foldersToSearch) {
             try {
+                let folderUidValidity;
                 const [byMsgId, byRefs] = await Promise.all([
                     this.withMailbox(folder, true, async (client) => {
+                        folderUidValidity = (client.mailbox || undefined)?.uidValidity?.toString();
                         const found = await client.search({ header: { "Message-ID": messageId } }, { uid: true });
                         return Array.isArray(found) ? found : [];
                     }).catch(() => []),
@@ -1967,7 +2135,7 @@ export class SimpleIMAPService {
                 for (const uid of [...byMsgId, ...byRefs]) {
                     if (!seen.has(uid)) {
                         seen.add(uid);
-                        results.push({ folder, uid, emailId: createEmailId(folder, uid) });
+                        results.push({ folder, uid, emailId: createEmailId(folder, uid, folderUidValidity) });
                     }
                 }
             }
@@ -2165,7 +2333,7 @@ export class SimpleIMAPService {
             const fetchQuery = needsFullDetail ? FETCH_INDEX_DETAIL_QUERY : FETCH_INDEX_QUERY;
             const emails = [];
             for await (const message of client.fetch(`${plan.startUid}:${plan.endUid}`, fetchQuery, { uid: true })) {
-                const summary = this.toSummary(folder, message);
+                const summary = this.toSummary(folder, message, uidValidity);
                 const enriched = message.source
                     ? this.enrichSummaryFromParsed(summary, await this.parseSource(message.source), input.includeAttachmentText)
                     : summary;
@@ -2211,17 +2379,17 @@ export class SimpleIMAPService {
             };
         });
     }
-    async archiveEmail(emailId) {
+    async archiveEmail(emailId, uidValidity) {
         const targetFolder = await this.resolveSpecialFolder("\\Archive", ["Archive", "All Mail"]);
-        return this.moveEmail(emailId, targetFolder);
+        return this.moveEmail(emailId, targetFolder, uidValidity);
     }
-    async trashEmail(emailId) {
+    async trashEmail(emailId, uidValidity) {
         const targetFolder = await this.resolveSpecialFolder("\\Trash", ["Trash"]);
-        return this.moveEmail(emailId, targetFolder);
+        return this.moveEmail(emailId, targetFolder, uidValidity);
     }
-    async restoreEmail(emailId, targetFolder) {
+    async restoreEmail(emailId, targetFolder, uidValidity) {
         const destination = targetFolder?.trim() || (await this.resolveSpecialFolder("\\Inbox", ["INBOX"]));
-        return this.moveEmail(emailId, destination);
+        return this.moveEmail(emailId, destination, uidValidity);
     }
     async getAnalyticsSample(days = 30, limitPerFolder = 100) {
         const dateFrom = new Date(Date.now() - days * 24 * 60 * 60 * 1000).toISOString();
@@ -2260,6 +2428,15 @@ export class SimpleIMAPService {
         if (!uid) {
             uid = await this.findUidByHeader(folder, "message-id", input.messageId);
         }
+        // STATUS works against a mailbox that isn't currently SELECTed (same
+        // reasoning as getMailboxUidValidity/getFolderStats) — append() above
+        // doesn't guarantee `folder` is selected on this client, so this can't
+        // just read client.mailbox.uidValidity the way a withMailbox callback
+        // would. Best-effort: a failure here shouldn't fail an otherwise-
+        // successful append, it just means the returned emailId falls back to
+        // the no-uidValidity format, same as it always did before this field
+        // existed.
+        const uidValidity = uid ? await this.getMailboxUidValidity(folder).catch(() => undefined) : undefined;
         this.folderCache = undefined;
         this.lastSyncAt = new Date().toISOString();
         // Build the result BEFORE attempting to clean up the superseded old
@@ -2276,7 +2453,7 @@ export class SimpleIMAPService {
         const result = {
             folder,
             uid,
-            emailId: uid ? createEmailId(folder, uid) : undefined,
+            emailId: uid ? createEmailId(folder, uid, uidValidity) : undefined,
             messageId: input.messageId,
             syncedAt: this.lastSyncAt,
         };
@@ -2426,11 +2603,11 @@ export class SimpleIMAPService {
             return [...result].sort((left, right) => right - left)[0];
         });
     }
-    toSummary(folder, message) {
+    toSummary(folder, message, uidValidity) {
         const flags = [...(message.flags ?? [])];
         const attachments = extractAttachments(message.bodyStructure);
         return {
-            id: createEmailId(folder, message.uid),
+            id: createEmailId(folder, message.uid, uidValidity),
             folder,
             uid: message.uid,
             seq: message.seq,
@@ -2494,7 +2671,7 @@ export class SimpleIMAPService {
             if (!message || !message.source) {
                 throw new Error(`Email not found for id ${emailId}`);
             }
-            const summary = this.toSummary(folder, message);
+            const summary = this.toSummary(folder, message, (client.mailbox || undefined)?.uidValidity?.toString());
             const parsed = await this.parseSource(message.source);
             const enriched = this.enrichSummaryFromParsed(summary, parsed, true);
             return { enriched, parsed };
@@ -3034,12 +3211,14 @@ export class SimpleIMAPService {
             // Best-effort — an unparseable message still gets imported below.
         }
         if (messageId) {
+            let existingFolderUidValidity;
             const existingUid = await this.withTimeout(this.withMailbox(folder, true, async (client) => {
+                existingFolderUidValidity = (client.mailbox || undefined)?.uidValidity?.toString();
                 const uids = await client.search({ header: { "Message-ID": messageId } }, { uid: true });
                 return Array.isArray(uids) && uids.length > 0 ? uids[uids.length - 1] : undefined;
             }), BULK_ITEM_TIMEOUT_MS, `Timed out after ${BULK_ITEM_TIMEOUT_MS}ms checking for an existing import of ${messageId} in ${folder}`).catch(() => undefined);
             if (existingUid !== undefined) {
-                const existingEmailId = createEmailId(folder, existingUid);
+                const existingEmailId = createEmailId(folder, existingUid, existingFolderUidValidity);
                 return { folder, uid: existingUid, emailId: existingEmailId, alreadyExists: true, existingEmailId };
             }
         }
@@ -3052,9 +3231,15 @@ export class SimpleIMAPService {
         if (!uid && messageId) {
             uid = await this.findUidByHeader(folder, "message-id", messageId);
         }
+        // Best-effort, same reasoning as upsertRemoteDraft's identical lookup —
+        // append() doesn't guarantee `folder` stays selected on this client, so
+        // STATUS (works on a non-selected mailbox) is used instead of trusting
+        // client.mailbox here. A failure just falls back to the no-uidValidity
+        // format, same as before this field existed.
+        const uidValidity = uid ? await this.getMailboxUidValidity(folder).catch(() => undefined) : undefined;
         this.folderCache = undefined;
         this.lastSyncAt = new Date().toISOString();
-        return { folder, uid, emailId: uid ? createEmailId(folder, uid) : undefined };
+        return { folder, uid, emailId: uid ? createEmailId(folder, uid, uidValidity) : undefined };
     }
 }
 //# sourceMappingURL=simple-imap-service.js.map