@blamejs/blamejs-shop 0.0.44

package/lib/vendor/blamejs/test/layer-0-primitives/mail-store-fts.test.js

@@ -0,0 +1,279 @@
+"use strict";
+/**
+ * b.mailStore.fts — sealed-token full-text search. Tests the
+ * tokenizer + vault-salted token hasher + FTS5 schema + the
+ * mailStore.search method that ties the index to a modseq window.
+ *
+ * Tokenization is deterministic given a fixed vault salt; the test
+ * boots b.vault in plaintext mode (same salt every appendMessage)
+ * and asserts on the resulting FTS5 row + MATCH results.
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+var nodeFs  = require("node:fs");
+var nodeOs  = require("node:os");
+var nodePath = require("node:path");
+
+function _msg(from, to, subject, body) {
+  return [
+    "From: " + from,
+    "To: " + to,
+    "Subject: " + subject,
+    "Message-Id: <" + Math.random().toString(36).slice(2) + "@x>",
+  ].join("\r\n") + "\r\n\r\n" + (body || "");
+}
+
+async function _setupStore(label) {
+  var dataDir = nodeFs.mkdtempSync(nodePath.join(nodeOs.tmpdir(), "mailfts-" + label + "-"));
+  if (typeof b.vault._resetForTest === "function") b.vault._resetForTest();
+  b.cryptoField.clearForTest();
+  await b.vault.init({ dataDir: dataDir, mode: "plaintext" });
+  var nodeSqlite = require("node:sqlite");
+  var db = new nodeSqlite.DatabaseSync(nodePath.join(dataDir, "store.db"));
+  return { dataDir: dataDir, db: db, prefix: "blamejs_mail" };
+}
+
+function _teardown(fx) {
+  try { if (fx.db && fx.db.close) fx.db.close(); } catch (_e) {}
+  if (typeof b.vault._resetForTest === "function") b.vault._resetForTest();
+  b.cryptoField.clearForTest();
+  try { nodeFs.rmSync(fx.dataDir, { recursive: true, force: true }); } catch (_e) {}
+}
+
+function testSurface() {
+  check("mailStore.fts surface present",
+        typeof b.mailStore.fts === "object" && b.mailStore.fts !== null);
+  check("fts.tokenize is fn",            typeof b.mailStore.fts.tokenize === "function");
+  check("fts.hashToken is fn",           typeof b.mailStore.fts.hashToken === "function");
+  check("fts.hashText is fn",            typeof b.mailStore.fts.hashText === "function");
+  check("fts.rowFromMessage is fn",      typeof b.mailStore.fts.rowFromMessage === "function");
+  check("fts.buildMatchExpression is fn", typeof b.mailStore.fts.buildMatchExpression === "function");
+  check("fts.createSql is fn",           typeof b.mailStore.fts.createSql === "function");
+  check("fts.columnAndFieldFor is fn",   typeof b.mailStore.fts.columnAndFieldFor === "function");
+}
+
+function testTokenizerBasic() {
+  var toks = b.mailStore.fts.tokenize("Hello world, this is a test.");
+  // 'a' and 'is' are stopwords. 'hello' / 'world' / 'this' / 'test' survive.
+  check("tokenizer drops stopwords",       toks.indexOf("a") === -1 && toks.indexOf("is") === -1);
+  check("tokenizer keeps content tokens",  toks.indexOf("hello") !== -1 && toks.indexOf("world") !== -1 && toks.indexOf("test") !== -1);
+  check("tokenizer lowercases",            toks.indexOf("hello") !== -1);
+  check("tokenizer dedupes within input",  b.mailStore.fts.tokenize("foo foo foo").length === 1);
+}
+
+function testTokenizerSplitsAddresses() {
+  // Email addresses MUST split on @ + . so a from-address search
+  // matches the canonical local-part + domain labels independently.
+  var toks = b.mailStore.fts.tokenize("alice@example.com");
+  check("address splits to local part",    toks.indexOf("alice") !== -1);
+  check("address splits to domain label",  toks.indexOf("example") !== -1);
+  check("address keeps tld (>= 2 chars)",  toks.indexOf("com") !== -1);
+}
+
+function testTokenizerNfcAndLength() {
+  // NFC normalization + min/max length filter.
+  var toks = b.mailStore.fts.tokenize("café́ a aa hello supercalifragilisticexpialidocious " +
+                                     "thisisaverylongtokenoversixtyfourcodepointsxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx");
+  // café accent normalizes; aa is len 2 keeps; a (single codepoint) drops.
+  check("MIN_TOKEN_LEN filter drops 'a'",  toks.indexOf("a") === -1);
+  check("len 2 token 'aa' survives",       toks.indexOf("aa") !== -1);
+  check("long token under 64 cp survives", toks.indexOf("supercalifragilisticexpialidocious") !== -1);
+  check("long token over 64 cp drops",     !toks.some(function (t) { return t.indexOf("thisisaverylongtoken") === 0; }));
+}
+
+function testHashTokenDeterministic() {
+  var h1 = b.mailStore.fts.hashToken("t1", "subject", "kubernetes");
+  var h2 = b.mailStore.fts.hashToken("t1", "subject", "kubernetes");
+  var hDiffField = b.mailStore.fts.hashToken("t1", "body", "kubernetes");
+  var hDiffTable = b.mailStore.fts.hashToken("t2", "subject", "kubernetes");
+  check("same input → same hash",          h1 === h2);
+  check("different field → different hash", h1 !== hDiffField);
+  check("different table → different hash", h1 !== hDiffTable);
+  check("hash is 16 char hex",              /^[0-9a-f]{16}$/.test(h1));
+}
+
+function testHashEmptyAndNonString() {
+  check("empty string returns empty",      b.mailStore.fts.hashText("t", "subject", "") === "");
+  check("null returns empty",              b.mailStore.fts.hashText("t", "subject", null) === "");
+  check("non-string returns empty",        b.mailStore.fts.hashText("t", "subject", 42) === "");
+}
+
+function testBuildMatchExpressionEmptyTerm() {
+  check("empty term → null",               b.mailStore.fts.buildMatchExpression("t", "subject", "") === null);
+  check("stopword-only term → null",       b.mailStore.fts.buildMatchExpression("t", "subject", "the a") === null);
+}
+
+async function testStoreSearchHappyPath() {
+  var fx = await _setupStore("happy");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    store.appendMessage("INBOX", _msg("alice@example.com", "bob@example.com", "Kubernetes deploy plan",
+                                       "We should deploy on kubernetes next monday."));
+    store.appendMessage("INBOX", _msg("carol@example.com", "bob@example.com", "Lunch?",
+                                       "Wanna grab lunch this week?"));
+
+    var r1 = store.search("INBOX", { text: "kubernetes" });
+    check("text=kubernetes hits 1 row",      r1.rows.length === 1);
+    check("matchExpr surfaced for diag",     typeof r1.matchExpr === "string" && r1.matchExpr.length > 0);
+
+    var r2 = store.search("INBOX", { text: "lunch" });
+    check("text=lunch hits 1 row",           r2.rows.length === 1);
+
+    var r3 = store.search("INBOX", { from: "alice@example.com" });
+    check("from=alice hits 1 row",           r3.rows.length === 1);
+
+    var r4 = store.search("INBOX", { to: "bob@example.com" });
+    check("to=bob hits both rows (shared addr_toks)", r4.rows.length === 2);
+
+    var r5 = store.search("INBOX", { subject: "deploy" });
+    check("subject=deploy hits 1 row",       r5.rows.length === 1);
+
+    var r6 = store.search("INBOX", { body: "monday" });
+    check("body=monday hits 1 row",          r6.rows.length === 1);
+
+    var r7 = store.search("INBOX", { text: "antidisestablishment" });
+    check("no-match returns empty rows",     r7.rows.length === 0);
+
+    // No text-side filter → fall through to bare modseq cursor path.
+    var rFallback = store.search("INBOX", {});
+    check("empty filter returns all rows",   rFallback.rows.length === 2);
+
+    // Combined AND filter.
+    var rCombined = store.search("INBOX", { text: "deploy", from: "alice@example.com" });
+    check("combined text+from intersects",   rCombined.rows.length === 1);
+  } finally { _teardown(fx); }
+}
+
+async function testStoreSearchSinceModseqCursor() {
+  var fx = await _setupStore("cursor");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    var a = store.appendMessage("INBOX", _msg("a@x", "b@x", "First message", "alpha body"));
+    store.appendMessage("INBOX", _msg("a@x", "b@x", "Second message", "beta body"));
+    var c = store.appendMessage("INBOX", _msg("a@x", "b@x", "Third message", "gamma body"));
+
+    // Search past the first message.
+    var r = store.search("INBOX", { text: "body", sinceModseq: a.modseq });
+    check("sinceModseq excludes anchor",      r.rows.length === 2);
+    check("nextModseq advances",              r.nextModseq === c.modseq);
+  } finally { _teardown(fx); }
+}
+
+async function testHardExpungeAlsoDeletesFtsRow() {
+  var fx = await _setupStore("expunge");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    var m = store.appendMessage("INBOX", _msg("a@x", "b@x", "FTS row marker", "uniquephrasetokenz"));
+
+    var before = store.search("INBOX", { text: "uniquephrasetokenz" });
+    check("FTS row hits pre-expunge",          before.rows.length === 1);
+
+    var result = store.hardExpunge("INBOX", [m.objectid]);
+    check("hardExpunge reports deleted",       result.deleted.length === 1);
+
+    // FTS row MUST also be gone — searching for the same term
+    // returns zero rows post-expunge.
+    var after = store.search("INBOX", { text: "uniquephrasetokenz" });
+    check("FTS row cleared by hardExpunge",    after.rows.length === 0);
+  } finally { _teardown(fx); }
+}
+
+async function testFtsRowIsSealed() {
+  // The FTS5 row MUST hold opaque hashes — no readable plaintext from
+  // the message subject / from / to / body must appear in the FTS5
+  // table. This is the sealed-at-rest invariant for the FTS index.
+  var fx = await _setupStore("sealed");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    store.appendMessage("INBOX", _msg("alice@example.com", "bob@example.com",
+                                       "CONFIDENTIAL Q3 financial results",
+                                       "Revenue increased 42% year-over-year"));
+
+    var ftsRow = fx.db.prepare("SELECT subject_toks, addr_toks, body_toks FROM \"" +
+                                fx.prefix + "_messages_fts\" LIMIT 1").get();
+    check("FTS row exists",                    !!ftsRow);
+    // None of the plaintext tokens leak.
+    var combined = ftsRow.subject_toks + " " + ftsRow.addr_toks + " " + ftsRow.body_toks;
+    check("no 'confidential' plaintext leak",  combined.toLowerCase().indexOf("confidential") === -1);
+    check("no 'revenue' plaintext leak",       combined.toLowerCase().indexOf("revenue") === -1);
+    check("no 'alice' plaintext leak",         combined.toLowerCase().indexOf("alice") === -1);
+    check("no '@' character (no addresses)",   combined.indexOf("@") === -1);
+    // Each token is a 16-char hex string separated by spaces.
+    check("subject_toks shape is hash-only",   /^([0-9a-f]{16}( [0-9a-f]{16})*)?$/.test(ftsRow.subject_toks));
+    check("body_toks shape is hash-only",      /^([0-9a-f]{16}( [0-9a-f]{16})*)?$/.test(ftsRow.body_toks));
+    check("addr_toks shape is hash-only",      /^([0-9a-f]{16}( [0-9a-f]{16})*)?$/.test(ftsRow.addr_toks));
+  } finally { _teardown(fx); }
+}
+
+async function testSearchRespectsLimitCap() {
+  var fx = await _setupStore("limit");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    for (var i = 0; i < 12; i += 1) {
+      store.appendMessage("INBOX", _msg("a@x", "b@x", "Message " + i, "shared body token"));
+    }
+    var r = store.search("INBOX", { text: "shared", limit: 5 });
+    check("explicit limit honoured",           r.rows.length === 5);
+
+    // Default limit (100) caps result count.
+    var rDefault = store.search("INBOX", { text: "shared" });
+    check("default limit returns up to 12",    rDefault.rows.length === 12);
+  } finally { _teardown(fx); }
+}
+
+async function testQueryKeyMapping() {
+  check("subject maps to subject_toks/subject",
+        b.mailStore.fts.columnAndFieldFor("subject").column === "subject_toks" &&
+        b.mailStore.fts.columnAndFieldFor("subject").field  === "subject");
+  check("body maps to body_toks/body",
+        b.mailStore.fts.columnAndFieldFor("body").column === "body_toks" &&
+        b.mailStore.fts.columnAndFieldFor("body").field  === "body");
+  check("from maps to addr_toks/addr",
+        b.mailStore.fts.columnAndFieldFor("from").column === "addr_toks" &&
+        b.mailStore.fts.columnAndFieldFor("from").field  === "addr");
+  check("to maps to addr_toks/addr (shared)",
+        b.mailStore.fts.columnAndFieldFor("to").column === "addr_toks" &&
+        b.mailStore.fts.columnAndFieldFor("to").field  === "addr");
+  check("unknown key returns null",
+        b.mailStore.fts.columnAndFieldFor("unknown") === null);
+}
+
+async function run() {
+  // One-time vault init for the sync tokenizer + hash tests — the
+  // hash routine reads vault.getDerivedHashSalt() so the salt MUST
+  // exist before any hashToken call runs. The per-test fixtures
+  // reset + re-init the vault for the async store-level tests.
+  var bootDir = nodeFs.mkdtempSync(nodePath.join(nodeOs.tmpdir(), "mailfts-boot-"));
+  if (typeof b.vault._resetForTest === "function") b.vault._resetForTest();
+  b.cryptoField.clearForTest();
+  await b.vault.init({ dataDir: bootDir, mode: "plaintext" });
+
+  testSurface();
+  testTokenizerBasic();
+  testTokenizerSplitsAddresses();
+  testTokenizerNfcAndLength();
+  testHashTokenDeterministic();
+  testHashEmptyAndNonString();
+  testBuildMatchExpressionEmptyTerm();
+  await testStoreSearchHappyPath();
+  await testStoreSearchSinceModseqCursor();
+  await testHardExpungeAlsoDeletesFtsRow();
+  await testFtsRowIsSealed();
+  await testSearchRespectsLimitCap();
+  await testQueryKeyMapping();
+
+  try { nodeFs.rmSync(bootDir, { recursive: true, force: true }); } catch (_e) {}
+
+  console.log("[mail-store-fts] OK — " + (require("../helpers/check").getChecks()) + " checks passed");
+}
+
+if (require.main === module) {
+  run().catch(function (e) {
+    console.error("[mail-store-fts] FAIL:", e);
+    process.exit(1);
+  });
+}
+
+module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/mail-store.test.js

@@ -0,0 +1,323 @@
+"use strict";
+/**
+ * b.mailStore — byte-level mail-store substrate. Tests the API
+ * surface + atomic append + sealed-column round-trip + CONDSTORE
+ * modseq + threading + quota + legal-hold.
+ *
+ * Uses an in-memory sqlite via b.localDbThin so the test doesn't
+ * depend on b.db's full init / vault setup. cryptoField sealing is
+ * exercised via b.vault.init({ mode: "plaintext" }).
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+var nodeFs  = require("node:fs");
+var nodeOs  = require("node:os");
+var nodePath = require("node:path");
+
+function _msg(headers, body) {
+  return headers.join("\r\n") + "\r\n\r\n" + (body || "");
+}
+
+async function _setupStore(label) {
+  var dataDir = nodeFs.mkdtempSync(nodePath.join(nodeOs.tmpdir(), "mailstore-" + label + "-"));
+  if (typeof b.vault._resetForTest === "function") b.vault._resetForTest();
+  b.cryptoField.clearForTest();
+  await b.vault.init({ dataDir: dataDir, mode: "plaintext" });
+  // Use node:sqlite directly via DatabaseSync — same shape as
+  // b.localDb.thin wraps. The store needs { prepare(sql) → { run,
+  // get, all } } which DatabaseSync provides directly.
+  var nodeSqlite = require("node:sqlite");
+  var dbPath = nodePath.join(dataDir, "store.db");
+  var dbHandle = new nodeSqlite.DatabaseSync(dbPath);
+  return { dataDir: dataDir, db: dbHandle };
+}
+
+function _teardown(fx) {
+  try { if (fx.db && fx.db.close) fx.db.close(); } catch (_e) { /* best-effort */ }
+  if (typeof b.vault._resetForTest === "function") b.vault._resetForTest();
+  b.cryptoField.clearForTest();
+  try { nodeFs.rmSync(fx.dataDir, { recursive: true, force: true }); } catch (_e) { /* best-effort */ }
+}
+
+function testSurface() {
+  check("mailStore.create is fn",      typeof b.mailStore.create === "function");
+  check("mailStore.DEFAULT_FOLDERS is array", Array.isArray(b.mailStore.DEFAULT_FOLDERS));
+  check("mailStore.MailStoreError is fn", typeof b.mailStore.MailStoreError === "function");
+}
+
+async function testBootstrap() {
+  var fx = await _setupStore("bootstrap");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    var folders = store.listFolders();
+    var names = folders.map(function (f) { return f.name; });
+    check("bootstrap: INBOX created",   names.indexOf("INBOX") !== -1);
+    check("bootstrap: Sent created",    names.indexOf("Sent") !== -1);
+    check("bootstrap: Drafts created",  names.indexOf("Drafts") !== -1);
+    check("bootstrap: Trash created",   names.indexOf("Trash") !== -1);
+    check("bootstrap: Junk created",    names.indexOf("Junk") !== -1);
+    check("bootstrap: Archive created", names.indexOf("Archive") !== -1);
+  } finally { _teardown(fx); }
+}
+
+async function testAppendFetchRoundtrip() {
+  var fx = await _setupStore("append");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    var msg = _msg([
+      "From: alice@example.com",
+      "To: bob@example.com",
+      "Subject: Hello",
+      "Message-Id: <m1@example.com>",
+      "Date: Wed, 14 May 2026 12:00:00 +0000",
+      "Content-Type: text/plain; charset=utf-8",
+    ], "Hello, world!");
+    var meta = store.appendMessage("INBOX", msg);
+    check("append: returns objectid",     typeof meta.objectid === "string" && meta.objectid.indexOf("obj_") === 0);
+    check("append: returns modseq",       meta.modseq === 1);
+    check("append: returns size",         meta.sizeBytes === Buffer.byteLength(msg));
+    check("append: threadRootId is self", meta.threadRootId === meta.objectid);
+
+    var fetched = store.fetchByObjectId("INBOX", meta.objectid);
+    check("fetch: round-trip subject",     fetched.subject === "Hello");
+    check("fetch: round-trip from",        fetched.from === "alice@example.com");
+    check("fetch: round-trip to",          fetched.to === "bob@example.com");
+    check("fetch: round-trip body text",   fetched.bodyText === "Hello, world!");
+    check("fetch: round-trip messageId",   fetched.messageId === "<m1@example.com>");
+    check("fetch: round-trip modseq",      fetched.modseq === 1);
+    check("fetch: flags empty initially",  Array.isArray(fetched.flags) && fetched.flags.length === 0);
+    check("fetch: legalHold false",        fetched.legalHold === false);
+  } finally { _teardown(fx); }
+}
+
+async function testCondstoreModseq() {
+  var fx = await _setupStore("condstore");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    var ids = [];
+    for (var i = 0; i < 3; i += 1) {
+      var meta = store.appendMessage("INBOX",
+        _msg(["From: a@x", "To: b@x", "Subject: M" + i, "Message-Id: <" + i + "@x>"], "body " + i));
+      ids.push(meta);
+    }
+    check("modseq: strictly monotonic", ids[0].modseq < ids[1].modseq && ids[1].modseq < ids[2].modseq);
+
+    // queryByModseq(sinceModseq=1) returns 2 + 3 only.
+    var sinceFirst = store.queryByModseq("INBOX", { sinceModseq: 1 });
+    check("queryByModseq: returns rows since modseq",
+          sinceFirst.length === 2 && sinceFirst[0].modseq === 2 && sinceFirst[1].modseq === 3);
+
+    // queryByModseq(sinceModseq=0) returns all 3.
+    var all = store.queryByModseq("INBOX", { sinceModseq: 0 });
+    check("queryByModseq: all when sinceModseq=0", all.length === 3);
+  } finally { _teardown(fx); }
+}
+
+async function testThreading() {
+  var fx = await _setupStore("thread");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    var root = store.appendMessage("INBOX",
+      _msg(["From: a@x", "Subject: Original", "Message-Id: <root@x>"], "first"));
+    var reply1 = store.appendMessage("INBOX",
+      _msg(["From: b@x", "Subject: Re: Original",
+            "Message-Id: <r1@x>", "In-Reply-To: <root@x>",
+            "References: <root@x>"], "reply 1"));
+    var reply2 = store.appendMessage("INBOX",
+      _msg(["From: c@x", "Subject: Re: Original",
+            "Message-Id: <r2@x>", "In-Reply-To: <r1@x>",
+            "References: <root@x> <r1@x>"], "reply 2"));
+    check("thread: root is self",     root.threadRootId === root.objectid);
+    check("thread: reply1 → root",    reply1.threadRootId === root.objectid);
+    check("thread: reply2 → root",    reply2.threadRootId === root.objectid);
+
+    var threadIds = store.threadFor(reply2.objectid);
+    check("thread: lists all 3 in chronological order",
+          threadIds.length === 3 && threadIds[0] === root.objectid);
+  } finally { _teardown(fx); }
+}
+
+async function testFlags() {
+  var fx = await _setupStore("flags");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    var meta = store.appendMessage("INBOX",
+      _msg(["From: a@x", "Subject: F", "Message-Id: <f@x>"], "body"));
+    store.setFlags("INBOX", [meta.objectid], { set: ["\\Seen", "\\Flagged"] });
+    var fetched = store.fetchByObjectId("INBOX", meta.objectid);
+    check("flags: \\Seen set",     fetched.flags.indexOf("\\Seen") !== -1);
+    check("flags: \\Flagged set",  fetched.flags.indexOf("\\Flagged") !== -1);
+
+    store.setFlags("INBOX", [meta.objectid], { unset: ["\\Seen"] });
+    var fetched2 = store.fetchByObjectId("INBOX", meta.objectid);
+    check("flags: \\Seen unset",   fetched2.flags.indexOf("\\Seen") === -1);
+    check("flags: \\Flagged still set",
+                                   fetched2.flags.indexOf("\\Flagged") !== -1);
+  } finally { _teardown(fx); }
+}
+
+async function testQuota() {
+  var fx = await _setupStore("quota");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    store.appendMessage("INBOX", _msg(["From: a@x", "Subject: 1", "Message-Id: <1@x>"], "body1"));
+    store.appendMessage("INBOX", _msg(["From: a@x", "Subject: 2", "Message-Id: <2@x>"], "body22"));
+    var q = store.quota("INBOX");
+    check("quota: usedCount = 2", q.usedCount === 2);
+    check("quota: usedBytes > 0", q.usedBytes > 0);
+  } finally { _teardown(fx); }
+}
+
+async function testLegalHold() {
+  var fx = await _setupStore("legal");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    var meta = store.appendMessage("INBOX",
+      _msg(["From: a@x", "Subject: H", "Message-Id: <h@x>"], "body"));
+    store.setLegalHold([meta.objectid], { hold: true });
+    var fetched = store.fetchByObjectId("INBOX", meta.objectid);
+    check("legalHold: flag set", fetched.legalHold === true);
+    store.setLegalHold([meta.objectid], { hold: false });
+    var fetched2 = store.fetchByObjectId("INBOX", meta.objectid);
+    check("legalHold: flag cleared", fetched2.legalHold === false);
+  } finally { _teardown(fx); }
+}
+
+async function testSealedColumnsActuallySealed() {
+  var fx = await _setupStore("sealed");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    store.appendMessage("INBOX",
+      _msg(["From: alice@example.com", "Subject: secret-subject",
+            "Message-Id: <s@x>"], "secret-body-content"));
+
+    // Inspect raw row — sealed columns must NOT appear as plaintext.
+    var raw = fx.db.prepare(
+      "SELECT subject, from_addr, body_text FROM " + store._tablePrefix + "_messages LIMIT 1"
+    ).get();
+    check("sealed: subject column starts with vault:",
+          typeof raw.subject === "string" && raw.subject.indexOf("vault:") === 0);
+    check("sealed: from_addr column starts with vault:",
+          typeof raw.from_addr === "string" && raw.from_addr.indexOf("vault:") === 0);
+    check("sealed: body_text column starts with vault:",
+          typeof raw.body_text === "string" && raw.body_text.indexOf("vault:") === 0);
+
+    // Inspect plaintext column — must NOT be sealed.
+    var plain = fx.db.prepare(
+      "SELECT modseq, size_bytes FROM " + store._tablePrefix + "_messages LIMIT 1"
+    ).get();
+    check("plaintext: modseq plain (forensic-queryable)",
+          typeof plain.modseq === "number");
+    check("plaintext: size_bytes plain (forensic-queryable)",
+          typeof plain.size_bytes === "number");
+  } finally { _teardown(fx); }
+}
+
+async function testRefusesBadInput() {
+  var fx = await _setupStore("bad");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    var threw = null;
+    try { store.appendMessage("INBOX", 42); }
+    catch (e) { threw = e; }
+    check("refuses non-Buffer/string",
+          threw && (threw.code || "").indexOf("mail-store/bad-input") !== -1);
+
+    // Tight maxMessageBytes via store-level opt — verify safeMime gate fires
+    var smallStore = b.mailStore.create({
+      backend: fx.db, tablePrefix: "tinystore", maxMessageBytes: 1000,
+      safeMimeOpts: { maxMessageBytes: 10 },
+    });
+    var threw2 = null;
+    try { smallStore.appendMessage("INBOX", "From: a@x\r\nMessage-Id: <z@x>\r\n\r\nbody"); }
+    catch (e) { threw2 = e; }
+    check("refuses oversize via safeMime opts",
+          threw2 && ((threw2.code || "").indexOf("safe-mime/") !== -1 || (threw2.code || "").indexOf("mail-store/") !== -1));
+
+    var threw3 = null;
+    try { store.appendMessage("NoSuchFolder", _msg(["From: a@x", "Message-Id: <x@x>"], "body")); }
+    catch (e) { threw3 = e; }
+    check("refuses missing folder",
+          threw3 && (threw3.code || "").indexOf("mail-store/no-folder") !== -1);
+  } finally { _teardown(fx); }
+}
+
+async function testCustomFolder() {
+  var fx = await _setupStore("custom");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    var f = store.createFolder("Projects.Acme", { role: null });
+    check("custom: folder exists", f && f.name === "Projects.Acme");
+    var meta = store.appendMessage("Projects.Acme",
+      _msg(["From: a@x", "Subject: Proj", "Message-Id: <p@x>"], "body"));
+    check("custom: append works", typeof meta.objectid === "string");
+  } finally { _teardown(fx); }
+}
+
+async function testMoveMessages() {
+  var fx = await _setupStore("move");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    var msg = _msg(["From: a@x", "To: b@y", "Subject: hi", "Message-Id: <m@x>",
+                    "Date: Wed, 14 May 2026 12:00:00 +0000"], "body");
+    var meta = store.appendMessage("INBOX", msg);
+
+    // Pre-move quota: INBOX has 1 message + its bytes; Archive has 0.
+    var qInbox0 = store.quota("INBOX");
+    var qArch0  = store.quota("Archive");
+    check("move-pre: INBOX count = 1", qInbox0.usedCount === 1);
+    check("move-pre: Archive count = 0", qArch0.usedCount === 0);
+    check("move-pre: INBOX bytes = msg size", qInbox0.usedBytes === meta.sizeBytes);
+
+    // Move INBOX → Archive. Per RFC 7162 each folder owns its own
+    // modseq; moved row joins destination's sequence at dstModseq.
+    var r = store.moveMessages("INBOX", "Archive", [meta.objectid]);
+    check("move: 1 changed", r.changed === 1);
+    check("move: fromModseq bumped", typeof r.fromModseq === "number" && r.fromModseq > 0);
+    check("move: toModseq bumped",   typeof r.toModseq === "number"   && r.toModseq > 0);
+
+    // Post-move quota: INBOX zeroed, Archive carries the bytes.
+    var qInbox1 = store.quota("INBOX");
+    var qArch1  = store.quota("Archive");
+    check("move-post: INBOX count = 0", qInbox1.usedCount === 0);
+    check("move-post: Archive count = 1", qArch1.usedCount === 1);
+    check("move-post: bytes moved", qArch1.usedBytes === meta.sizeBytes && qInbox1.usedBytes === 0);
+
+    // Moved row's modseq should match destination's modseq_max (joined dest sequence).
+    var fetched = store.fetchByObjectId("Archive", meta.objectid);
+    check("move: row modseq matches dst", fetched.modseq === r.toModseq);
+  } finally { _teardown(fx); }
+}
+
+async function testRefusesBadBackend() {
+  var threw = null;
+  try { b.mailStore.create({ backend: {} }); }
+  catch (e) { threw = e; }
+  check("refuses backend without .prepare",
+        threw && (threw.code || "").indexOf("mail-store/bad-backend") !== -1);
+}
+
+async function run() {
+  testSurface();
+  await testBootstrap();
+  await testAppendFetchRoundtrip();
+  await testCondstoreModseq();
+  await testThreading();
+  await testFlags();
+  await testQuota();
+  await testLegalHold();
+  await testSealedColumnsActuallySealed();
+  await testRefusesBadInput();
+  await testCustomFolder();
+  await testMoveMessages();
+  await testRefusesBadBackend();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e); process.exit(1); });
+}