@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/mail-sieve.test.js

@@ -129,6 +129,310 @@ function testCreateHandle() {
     !v.ok && v.issues[0].ruleId === "safe-sieve/unknown-capability");
 }
 
+// ---- tests / adversarial input ------------------------------------------
+
+function testUnknownTestRefused() {
+  // A test identifier the parser accepts (any id is a test) but the
+  // interpreter never wired — must refuse, not silently pass/fail-open.
+  var threw = null;
+  try { b.mail.sieve.runScript('if bogustest "x" { keep; }', {}); }
+  catch (e) { threw = e; }
+  check("unknown test refused with typed error",
+    threw && threw.code === "mail-sieve/unknown-test");
+}
+
+function testUnknownActionRefused() {
+  var threw = null;
+  try { b.mail.sieve.runScript('frobnicate;', {}); } catch (e) { threw = e; }
+  check("unknown action refused with typed error",
+    threw && threw.code === "mail-sieve/unknown-action");
+}
+
+function testBadCommandKind() {
+  // Hand-built AST fed to the public run() entry — an unmodeled command
+  // kind must throw a typed refusal, never fall through.
+  var threw = null;
+  try {
+    b.mail.sieve.run({ kind: "script", commands: [{ kind: "weird" }] }, {});
+  } catch (e) { threw = e; }
+  check("unmodeled command kind refused",
+    threw && threw.code === "mail-sieve/bad-command");
+}
+
+function testFileintoMissingFolder() {
+  var threw = null;
+  try { b.mail.sieve.runScript('require ["fileinto"];\r\nfileinto;\r\n', {}); }
+  catch (e) { threw = e; }
+  check("fileinto without folder refused",
+    threw && threw.code === "mail-sieve/bad-fileinto");
+  // Empty string-list argument is equally malformed (v.v[0] → null).
+  var threw2 = null;
+  try { b.mail.sieve.runScript('require ["fileinto"];\r\nfileinto [];\r\n', {}); }
+  catch (e) { threw2 = e; }
+  check("fileinto with empty list refused",
+    threw2 && threw2.code === "mail-sieve/bad-fileinto");
+}
+
+function testRedirectMissingAddress() {
+  var threw = null;
+  try { b.mail.sieve.runScript('redirect;', {}); } catch (e) { threw = e; }
+  check("redirect without address refused",
+    threw && threw.code === "mail-sieve/bad-redirect");
+}
+
+function testNotTest() {
+  var rv = b.mail.sieve.runScript('if not exists "X-Missing" { discard; }',
+    { headers: [] });
+  check("`not` inverts the sub-test",
+    rv.actions[0].kind === "discard");
+}
+
+function testExists() {
+  var present = b.mail.sieve.runScript('if exists "Subject" { discard; }',
+    { headers: [{ name: "Subject", value: "hi" }] });
+  check("exists fires when header present", present.actions[0].kind === "discard");
+  var absent = b.mail.sieve.runScript('if exists "Subject" { discard; }',
+    { headers: [] });
+  check("exists false → implicit keep when header absent",
+    absent.actions[0].implicit === true);
+  // Header present but value null still counts as existing.
+  var nullVal = b.mail.sieve.runScript('if exists "X-Flag" { discard; }',
+    { headers: [{ name: "X-Flag", value: null }] });
+  check("exists treats null-valued header as present",
+    nullVal.actions[0].kind === "discard");
+}
+
+function testSizeUnderAndFallbacks() {
+  var under = b.mail.sieve.runScript('if size :under 1K { discard; }',
+    { sizeBytes: 512 });
+  check("size :under fires below threshold", under.actions[0].kind === "discard");
+  // Falls back to bodyBytes.length when sizeBytes absent.
+  var body = b.mail.sieve.runScript('if size :over 3 { discard; }',
+    { bodyBytes: Buffer.from("hello") });
+  check("size falls back to bodyBytes.length", body.actions[0].kind === "discard");
+  // No size info at all → 0 bytes, :under fires.
+  var zero = b.mail.sieve.runScript('if size :under 10 { discard; }', {});
+  check("size defaults to 0 bytes with no env info",
+    zero.actions[0].kind === "discard");
+}
+
+function testAddressPartsAndExtraction() {
+  // :localpart on a display-name address.
+  var lp = b.mail.sieve.runScript(
+    'if address :is :localpart "From" "alice" { keep; }',
+    { headers: [{ name: "From", value: "Alice Smith <alice@example.com>" }] });
+  check("address :localpart extracts local part before @",
+    lp.actions[0].kind === "keep" && !lp.actions[0].implicit);
+  // :all on a bracketed address returns the full addr-spec.
+  var all = b.mail.sieve.runScript(
+    'if address :is :all "From" "a@x.com" { keep; }',
+    { headers: [{ name: "From", value: "A <a@x.com>" }] });
+  check("address :all extracts full addr-spec from brackets",
+    all.actions[0].kind === "keep" && !all.actions[0].implicit);
+  // Address without an @: localpart is the whole token; domain is "".
+  var noAtLocal = b.mail.sieve.runScript(
+    'if address :is :localpart "From" "weird" { keep; }',
+    { headers: [{ name: "From", value: "weird" }] });
+  check("address :localpart of at-less token is the whole token",
+    !noAtLocal.actions[0].implicit);
+  var noAtDomain = b.mail.sieve.runScript(
+    'if address :is :domain "From" "" { keep; }',
+    { headers: [{ name: "From", value: "nodomain" }] });
+  check("address :domain of at-less token is empty string",
+    !noAtDomain.actions[0].implicit);
+}
+
+function testEnvelopeArrayAndBogusField() {
+  // Array-valued envelope recipient list — each entry compared.
+  var arr = b.mail.sieve.runScript('if envelope :is "to" "b@x.com" { keep; }',
+    { envelope: { to: ["a@x.com", "b@x.com"] } });
+  check("envelope matches any entry of an array value",
+    arr.actions[0].kind === "keep" && !arr.actions[0].implicit);
+  // Envelope field other than from/to is skipped per RFC 5228 §5.4.
+  var bogus = b.mail.sieve.runScript('if envelope :is "subject" "x" { discard; }',
+    { envelope: { from: "a@x.com" } });
+  check("envelope ignores fields other than from/to",
+    bogus.actions[0].implicit === true);
+  // No envelope object at all → no match.
+  var none = b.mail.sieve.runScript('if envelope :is "from" "a@x.com" { discard; }', {});
+  check("envelope with no env.envelope → implicit keep",
+    none.actions[0].implicit === true);
+}
+
+function testHeaderListsAndMultiValue() {
+  // List of header names + list of keys.
+  var lists = b.mail.sieve.runScript(
+    'if header :contains ["To","Cc"] ["vip"] { discard; }',
+    { headers: [{ name: "Cc", value: "vip@x.com" }] });
+  check("header test spans a list of names and keys",
+    lists.actions[0].kind === "discard");
+  // Two headers of the same name — both values considered.
+  var multi = b.mail.sieve.runScript('if header :is "Received" "b" { discard; }',
+    { headers: [{ name: "Received", value: "a" }, { name: "Received", value: "b" }] });
+  check("header test considers every value of a repeated header",
+    multi.actions[0].kind === "discard");
+}
+
+function testComparatorDefaultCaseInsensitive() {
+  // Default comparator is i;ascii-casemap → case-insensitive :is.
+  var ci = b.mail.sieve.runScript('if header :is "Subject" "hello" { discard; }',
+    { headers: [{ name: "Subject", value: "HELLO" }] });
+  check("default comparator is case-insensitive (i;ascii-casemap)",
+    ci.actions[0].kind === "discard");
+
+  // An explicit `:comparator "i;octet"` binds the comparator name to the tag
+  // (RFC 5228 §2.7.3), not into the positional stream -- so the header name and
+  // keys stay aligned and the test still matches (previously the comparator
+  // value was mis-read as the header name, silently disabling the test = a
+  // filter bypass). i;octet is case-SENSITIVE (unlike the default
+  // i;ascii-casemap): an exact-case key matches, a wrong-case key does not.
+  var octet = b.mail.sieve.runScript(
+    'if header :comparator "i;octet" :is "Subject" "HELLO" { discard; }',
+    { headers: [{ name: "Subject", value: "HELLO" }] });
+  check("explicit :comparator :is exact-case matches (no filter bypass)",
+    octet.actions[0].kind === "discard");
+  var octetMiss = b.mail.sieve.runScript(
+    'if header :comparator "i;octet" :is "Subject" "hello" { discard; }',
+    { headers: [{ name: "Subject", value: "HELLO" }] });
+  check("explicit :comparator i;octet is case-sensitive (wrong case falls through to keep)",
+    octetMiss.actions[0].implicit === true);
+  // A `:comparator` with no following comparator-name string fails closed at parse.
+  var badComp = false;
+  try { b.mail.sieve.runScript('if header :comparator :is "Subject" "x" { discard; }', { headers: [] }); }
+  catch (e) { badComp = /parse-error/.test(e.code || e.message); }
+  check("explicit :comparator without a value is refused at parse", badComp);
+  // An unsupported comparator name is refused at parse (like the
+  // require ["comparator-<name>"] capability guard), not silently treated as
+  // octet exact-matching -- otherwise it would bypass the capability guard.
+  var badCompName = false;
+  try {
+    b.mail.sieve.runScript('if header :comparator "i;unicode-casemap" :is "Subject" "HELLO" { discard; }',
+      { headers: [{ name: "Subject", value: "HELLO" }] });
+  } catch (e) { badCompName = /unknown-capability|unimplemented-capability/.test(e.code || e.message); }
+  check("explicit :comparator with an unsupported name is refused (no capability-guard bypass)", badCompName);
+}
+
+function testWildcardEscaping() {
+  // `?` matches exactly one byte.
+  var q = b.mail.sieve.runScript('if header :matches "Subject" "a?c" { discard; }',
+    { headers: [{ name: "Subject", value: "abc" }] });
+  check("`:matches` ? matches a single byte", q.actions[0].kind === "discard");
+  // Regex metacharacters other than * / ? are escaped — `.` is literal.
+  var dot = b.mail.sieve.runScript('if header :matches "Subject" "a.c" { discard; }',
+    { headers: [{ name: "Subject", value: "axc" }] });
+  check("`:matches` escapes regex metachars (`.` is literal, not wildcard)",
+    dot.actions[0].implicit === true);
+}
+
+function testElsifElse() {
+  var script =
+    'if header :is "X" "1" { discard; }\r\n' +
+    'elsif header :is "X" "2" { redirect "a@b.com"; }\r\n' +
+    'else { keep; }\r\n';
+  var elif = b.mail.sieve.runScript(script, { headers: [{ name: "X", value: "2" }] });
+  check("elsif branch taken",
+    elif.actions[0].kind === "redirect" && elif.actions[0].address === "a@b.com");
+  var els = b.mail.sieve.runScript(script, { headers: [{ name: "X", value: "9" }] });
+  check("else branch taken when no if/elsif matches",
+    els.actions[0].kind === "keep" && !els.actions[0].implicit);
+}
+
+function testExplicitKeepAndStopSkips() {
+  var k = b.mail.sieve.runScript('keep;\r\n', {});
+  check("explicit keep is not marked implicit",
+    k.actions.length === 1 && k.actions[0].kind === "keep" && !k.actions[0].implicit);
+  // stop halts before a following action ever runs.
+  var s = b.mail.sieve.runScript('stop;\r\nfileinto "X";\r\n', {});
+  check("stop skips subsequent commands",
+    s.stopped === true &&
+    !s.actions.some(function (a) { return a.kind === "fileinto"; }));
+}
+
+function testFileintoListArg() {
+  var rv = b.mail.sieve.runScript('require ["fileinto"];\r\nfileinto ["A","B"];\r\n', {});
+  check("fileinto takes first element of a string-list arg",
+    rv.actions[0].kind === "fileinto" && rv.actions[0].folder === "A");
+}
+
+function testGasExhaustionInCommands() {
+  var threw = null;
+  try { b.mail.sieve.runScript('keep;\r\nkeep;\r\nkeep;\r\n', {}, { maxGas: 2 }); }
+  catch (e) { threw = e; }
+  check("gas exhausts across a command sequence",
+    threw && threw.code === "mail-sieve/gas-exhausted");
+}
+
+function testMaxGasOptValidation() {
+  var cases = [
+    ["zero", 0],
+    ["negative", -1],
+    ["Infinity", Infinity],
+    ["NaN", NaN],
+    ["string", "5"],
+    ["fractional", 1.5],
+    ["over-cap", b.mail.sieve.MAX_GAS_UNITS + 1],
+  ];
+  var allRefused = true;
+  for (var i = 0; i < cases.length; i++) {
+    var threw = null;
+    try { b.mail.sieve.runScript('keep;', {}, { maxGas: cases[i][1] }); }
+    catch (e) { threw = e; }
+    if (!threw || threw.code !== "mail-sieve/bad-opt") allRefused = false;
+  }
+  check("run() refuses every out-of-range/ill-typed maxGas", allRefused);
+}
+
+function testParseErrorsPropagate() {
+  // runScript surfaces the parser's typed refusals unchanged.
+  var badSyntax = null;
+  try { b.mail.sieve.runScript('if header :is', {}); } catch (e) { badSyntax = e; }
+  check("runScript propagates parse-error", badSyntax && badSyntax.code === "safe-sieve/parse-error");
+  var unimpl = null;
+  try { b.mail.sieve.runScript('require ["vacation"];\r\nkeep;\r\n', {}); }
+  catch (e) { unimpl = e; }
+  check("runScript propagates unimplemented-capability refusal",
+    unimpl && unimpl.code === "safe-sieve/unimplemented-capability");
+}
+
+function testCreateOptValidation() {
+  var badOpts = null;
+  try { b.mail.sieve.create(42); } catch (e) { badOpts = e; }
+  check("create refuses non-object opts", badOpts && badOpts.code === "mail-sieve/bad-opt");
+  var badGas = null;
+  try { b.mail.sieve.create({ maxGas: -1 }); } catch (e) { badGas = e; }
+  check("create refuses bad maxGas", badGas && badGas.code === "mail-sieve/bad-opt");
+  var overCap = null;
+  try { b.mail.sieve.create({ maxGas: b.mail.sieve.MAX_GAS_UNITS + 1 }); }
+  catch (e) { overCap = e; }
+  check("create refuses maxGas over cap", overCap && overCap.code === "mail-sieve/bad-opt");
+}
+
+function testCreateAuditEmissions() {
+  var events = [];
+  var sieve = b.mail.sieve.create({
+    audit: { safeEmit: function (e) { events.push(e.action + "/" + e.outcome); } },
+  });
+  sieve.runScript('keep;\r\n', {});
+  sieve.validateScript('require ["fileinto"];\r\nkeep;\r\n');
+  sieve.validateScript('require ["nonsense"];\r\nkeep;\r\n');
+  sieve.run(b.safeSieve.parse('keep;\r\n'), {});
+  check("create handle emits run + validate(success/failure) + run audit events",
+    events.length === 4 &&
+    events[0] === "mail.sieve.run/success" &&
+    events[1] === "mail.sieve.validate/success" &&
+    events[2] === "mail.sieve.validate/failure" &&
+    events[3] === "mail.sieve.run/success");
+}
+
+function testCreateAuditThrowDropSilent() {
+  var sieve = b.mail.sieve.create({
+    audit: { safeEmit: function () { throw new Error("audit sink exploded"); } },
+  });
+  var rv = sieve.runScript('keep;\r\n', {});
+  check("create handle survives a throwing audit sink (drop-silent)",
+    rv.actions[0].kind === "keep");
+}
+
 function run() {
   testSurface();
   testImplicitKeep();
@@ -143,6 +447,28 @@ function run() {
   testGasExhaustion();
   testBadAst();
   testCreateHandle();
+  testUnknownTestRefused();
+  testUnknownActionRefused();
+  testBadCommandKind();
+  testFileintoMissingFolder();
+  testRedirectMissingAddress();
+  testNotTest();
+  testExists();
+  testSizeUnderAndFallbacks();
+  testAddressPartsAndExtraction();
+  testEnvelopeArrayAndBogusField();
+  testHeaderListsAndMultiValue();
+  testComparatorDefaultCaseInsensitive();
+  testWildcardEscaping();
+  testElsifElse();
+  testExplicitKeepAndStopSkips();
+  testFileintoListArg();
+  testGasExhaustionInCommands();
+  testMaxGasOptValidation();
+  testParseErrorsPropagate();
+  testCreateOptValidation();
+  testCreateAuditEmissions();
+  testCreateAuditThrowDropSilent();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/mail-store-fts.test.js

@@ -102,6 +102,58 @@ function testHashEmptyAndNonString() {
   check("non-string returns empty",        b.mailStore.fts.hashText("t", "subject", 42) === "");
 }
 
+// ---- b.mailStore.fts.hashTokens — token-array → sealed FTS string ----
+//
+// hashTokens hashes each token under the (table, field) namespace and
+// joins the 16-hex digests with a space — the exact string inserted into
+// an FTS5 column. Empty + duplicate token-hashes drop on the way out.
+// (Requires the vault salt, which run() primes before the sync tests.)
+function testHashTokensBehavior() {
+  var out = b.mailStore.fts.hashTokens("t", "subject", ["hello", "world"]);
+  var parts = out.split(" ");
+  check("hashTokens: two tokens → two space-joined hashes", parts.length === 2);
+  check("hashTokens: each part is a 16-char hex hash",
+    /^[0-9a-f]{16}$/.test(parts[0]) && /^[0-9a-f]{16}$/.test(parts[1]));
+  // Each part equals the per-token hashToken under the same namespace.
+  check("hashTokens: parts match hashToken() per token in order",
+    parts[0] === b.mailStore.fts.hashToken("t", "subject", "hello") &&
+    parts[1] === b.mailStore.fts.hashToken("t", "subject", "world"));
+
+  // Duplicate tokens collapse to a single hash.
+  var dup = b.mailStore.fts.hashTokens("t", "subject", ["foo", "foo", "foo"]);
+  check("hashTokens: duplicate tokens collapse to one hash",
+    dup === b.mailStore.fts.hashToken("t", "subject", "foo"));
+
+  // Empty-string tokens contribute no hash and are dropped.
+  var withEmpty = b.mailStore.fts.hashTokens("t", "subject", ["hello", "", "world"]);
+  check("hashTokens: empty-string tokens drop (2 hashes, not 3)",
+    withEmpty.split(" ").length === 2);
+
+  // Order of first appearance is preserved.
+  var ordered = b.mailStore.fts.hashTokens("t", "subject", ["bravo", "alpha"]);
+  check("hashTokens: preserves first-seen token order",
+    ordered.split(" ")[0] === b.mailStore.fts.hashToken("t", "subject", "bravo"));
+}
+
+function testHashTokensNamespaceScoping() {
+  var base  = b.mailStore.fts.hashTokens("t1", "subject", ["kubernetes"]);
+  var field = b.mailStore.fts.hashTokens("t1", "body",    ["kubernetes"]);
+  var table = b.mailStore.fts.hashTokens("t2", "subject", ["kubernetes"]);
+  check("hashTokens: different field → different hash", base !== field);
+  check("hashTokens: different table → different hash", base !== table);
+}
+
+function testHashTokensEmptyAndNonArray() {
+  check("hashTokens: empty array → empty string",
+    b.mailStore.fts.hashTokens("t", "subject", []) === "");
+  check("hashTokens: non-array (string) → empty string",
+    b.mailStore.fts.hashTokens("t", "subject", "notanarray") === "");
+  check("hashTokens: null → empty string",
+    b.mailStore.fts.hashTokens("t", "subject", null) === "");
+  check("hashTokens: array of only empty strings → empty string",
+    b.mailStore.fts.hashTokens("t", "subject", ["", ""]) === "");
+}
+
 function testBuildMatchExpressionEmptyTerm() {
   check("empty term → null",               b.mailStore.fts.buildMatchExpression("t", "subject", "") === null);
   check("stopword-only term → null",       b.mailStore.fts.buildMatchExpression("t", "subject", "the a") === null);
@@ -464,6 +516,9 @@ async function run() {
   testTokenizerNfcAndLength();
   testHashTokenDeterministic();
   testHashEmptyAndNonString();
+  testHashTokensBehavior();
+  testHashTokensNamespaceScoping();
+  testHashTokensEmptyAndNonArray();
   testBuildMatchExpressionEmptyTerm();
   await testStoreSearchHappyPath();
   await testStoreSearchSinceModseqCursor();

package/lib/vendor/blamejs/test/layer-0-primitives/mail-store.test.js

@@ -389,7 +389,249 @@ async function testByteCapMultibyte() {
   } finally { _teardown(fx); }
 }
 
+async function testBadTablePrefix() {
+  var fx = await _setupStore("badprefix");
+  try {
+    var threw = null;
+    try { b.mailStore.create({ backend: fx.db, tablePrefix: "bad-prefix!;DROP" }); }
+    catch (e) { threw = e; }
+    check("create: invalid tablePrefix refused",
+          threw && (threw.code || "").indexOf("mail-store/bad-table-prefix") !== -1);
+  } finally { _teardown(fx); }
+}
+
+async function testBadHeaderIds() {
+  var fx = await _setupStore("badids");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+
+    // Unbracketed Message-Id is refused under the strict default profile.
+    var t1 = null;
+    try { store.appendMessage("INBOX", _msg(["From: a@x", "Subject: s", "Message-Id: bareid@example.com"], "body")); }
+    catch (e) { t1 = e; }
+    check("append: bad Message-Id refused",
+          t1 && (t1.code || "").indexOf("mail-store/bad-message-id") !== -1);
+
+    // Valid Message-Id but unbracketed In-Reply-To.
+    var t2 = null;
+    try {
+      store.appendMessage("INBOX",
+        _msg(["From: a@x", "Subject: s", "Message-Id: <ok1@x>", "In-Reply-To: notbracketed@x"], "body"));
+    } catch (e) { t2 = e; }
+    check("append: bad In-Reply-To refused",
+          t2 && (t2.code || "").indexOf("mail-store/bad-in-reply-to") !== -1);
+
+    // Valid Message-Id but a References entry that fails the msg-id grammar.
+    var t3 = null;
+    try {
+      store.appendMessage("INBOX",
+        _msg(["From: a@x", "Subject: s", "Message-Id: <ok2@x>", "References: <good@x> notbracketed@x"], "body"));
+    } catch (e) { t3 = e; }
+    check("append: bad References entry refused",
+          t3 && (t3.code || "").indexOf("mail-store/bad-references") !== -1);
+  } finally { _teardown(fx); }
+}
+
+async function testOversizeMessageDirect() {
+  var fx = await _setupStore("oversize");
+  try {
+    var store = b.mailStore.create({ backend: fx.db, maxMessageBytes: 10 });
+    var threw = null;
+    try { store.appendMessage("INBOX", _msg(["From: a@x", "Subject: big", "Message-Id: <big@x>"], "way over ten bytes of body")); }
+    catch (e) { threw = e; }
+    check("append: message over maxMessageBytes refused",
+          threw && threw.code === "mail-store/oversize-message");
+  } finally { _teardown(fx); }
+}
+
+async function testMissingFolderEveryReader() {
+  var fx = await _setupStore("nofolder");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    function noFolder(label, fn) {
+      var threw = null;
+      try { fn(); } catch (e) { threw = e; }
+      check(label + ": missing folder refused",
+            threw && (threw.code || "").indexOf("mail-store/no-folder") !== -1);
+    }
+    noFolder("search",        function () { store.search("Ghost", { text: "x" }); });
+    noFolder("queryByModseq", function () { store.queryByModseq("Ghost", {}); });
+    noFolder("quota",         function () { store.quota("Ghost"); });
+    noFolder("fetchByObjectId", function () { store.fetchByObjectId("Ghost", "obj_x"); });
+    noFolder("hardExpunge",   function () { store.hardExpunge("Ghost", ["obj_x"]); });
+    noFolder("moveMessages/from", function () { store.moveMessages("Ghost", "INBOX", []); });
+    noFolder("moveMessages/to",   function () { store.moveMessages("INBOX", "Ghost", []); });
+  } finally { _teardown(fx); }
+}
+
+async function testMoveBadObjectids() {
+  var fx = await _setupStore("movebad");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    var threw = null;
+    try { store.moveMessages("INBOX", "Archive", "not-an-array"); }
+    catch (e) { threw = e; }
+    check("moveMessages: non-array objectids refused",
+          threw && (threw.code || "").indexOf("mail-store/bad-input") !== -1);
+  } finally { _teardown(fx); }
+}
+
+async function testCreateFolderBadName() {
+  var fx = await _setupStore("badfolder");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    var threw = null;
+    try { store.createFolder("Bad Name With Spaces"); }
+    catch (e) { threw = e; }
+    check("createFolder: name outside [A-Za-z0-9_.-]+ refused",
+          threw && (threw.code || "").indexOf("mail-store/bad-folder-name") !== -1);
+  } finally { _teardown(fx); }
+}
+
+async function testQuotaAndThreadEmptyStates() {
+  var fx = await _setupStore("empty");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    // A freshly-created folder has no quota row yet — quota() returns
+    // zeroed defaults rather than throwing.
+    store.createFolder("EmptyBox");
+    var q = store.quota("EmptyBox");
+    check("quota: fresh folder returns zeroed defaults",
+          q.usedBytes === 0 && q.usedCount === 0 && q.capBytes === null && q.capCount === null);
+
+    // threadFor on an unknown objectid returns an empty array.
+    check("threadFor: unknown objectid → []",
+          Array.isArray(store.threadFor("obj_missing")) && store.threadFor("obj_missing").length === 0);
+
+    // fetchByObjectId on a present folder but missing id returns null.
+    check("fetchByObjectId: unknown id → null",
+          store.fetchByObjectId("INBOX", "obj_missing") === null);
+  } finally { _teardown(fx); }
+}
+
+async function testHardExpungeEdgeCases() {
+  var fx = await _setupStore("expungeedge");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+
+    // Empty objectid set — no-op result shape.
+    var e0 = store.hardExpunge("INBOX", []);
+    check("hardExpunge: empty set → empty result",
+          e0.rows.length === 0 && e0.deleted.length === 0 && e0.refused.length === 0);
+
+    // Non-array objectids — same no-op result shape.
+    var eNull = store.hardExpunge("INBOX", null);
+    check("hardExpunge: non-array set → empty result",
+          eNull.rows.length === 0 && eNull.deleted.length === 0 && eNull.refused.length === 0);
+
+    // Unknown id — refused with not-in-folder, nothing deleted.
+    var eMiss = store.hardExpunge("INBOX", ["obj_notthere"]);
+    check("hardExpunge: unknown id refused not-in-folder",
+          eMiss.deleted.length === 0 && eMiss.refused.length === 1 &&
+          eMiss.refused[0].reason === "not-in-folder");
+
+    // Duplicate ids must be deduplicated so quota is not driven negative.
+    var meta = store.appendMessage("INBOX",
+      _msg(["From: a@x", "Subject: dup", "Message-Id: <dup@x>"], "dup body"));
+    var eDup = store.hardExpunge("INBOX", [meta.objectid, meta.objectid]);
+    check("hardExpunge: duplicate id collapses to one delete",
+          eDup.deleted.length === 1 && eDup.deleted[0] === meta.objectid);
+    var qAfter = store.quota("INBOX");
+    check("hardExpunge: dedup keeps quota non-negative",
+          qAfter.usedCount === 0 && qAfter.usedBytes === 0);
+  } finally { _teardown(fx); }
+}
+
+async function testSearchColumnFiltersAndPagination() {
+  var fx = await _setupStore("searchcols");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    var m1 = store.appendMessage("INBOX",
+      _msg(["From: alice@example.com", "To: dave@example.com",
+            "Subject: quarterly report", "Message-Id: <c1@x>"],
+           "the pipeline throughput doubled"));
+    store.appendMessage("INBOX",
+      _msg(["From: erin@example.com", "To: frank@example.com",
+            "Subject: lunch", "Message-Id: <c2@x>"],
+           "grab a sandwich"));
+
+    // body-column MATCH.
+    var rb = store.search("INBOX", { body: "throughput" });
+    check("search: body filter hits only m1",
+          rb.rows.length === 1 && rb.rows[0].objectid === m1.objectid);
+
+    // to-address MATCH (addr_toks shared by from/to).
+    var rt = store.search("INBOX", { to: "dave@example.com" });
+    check("search: to filter hits only m1",
+          rt.rows.length === 1 && rt.rows[0].objectid === m1.objectid);
+
+    // Stopword-only term → no surviving tokens → falls back to the modseq
+    // cursor (distinct from the empty-FTS-result branch) and carries a
+    // nextModseq.
+    var rs = store.search("INBOX", { subject: "the" });
+    check("search: stopword-only term falls back to modseq cursor",
+          rs.rows.length === 2 && typeof rs.nextModseq === "number" && rs.matchExpr === undefined);
+
+    // Garbage limit floors to the default page size; oversized limit caps
+    // at 1000 — neither throws through b.sql's integer-only limit().
+    var rGarbage = store.search("INBOX", { text: "sandwich", limit: "not-a-number" });
+    check("search: garbage limit tolerated", rGarbage.rows.length === 1);
+    var rHuge = store.search("INBOX", { body: "throughput", limit: 999999 });
+    check("search: oversized limit capped without throw", rHuge.rows.length === 1);
+  } finally { _teardown(fx); }
+}
+
+async function testSearchPaginationSinceModseq() {
+  var fx = await _setupStore("searchpage");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    for (var i = 0; i < 3; i += 1) {
+      store.appendMessage("INBOX",
+        _msg(["From: a@x", "Subject: report " + i, "Message-Id: <p" + i + "@x>"],
+             "shared keyword body content"));
+    }
+    // Page 1 — one row via the FTS MATCH path, nextModseq advances.
+    var page1 = store.search("INBOX", { body: "keyword", limit: 1 });
+    check("search: FTS page 1 returns one row",
+          page1.rows.length === 1 && typeof page1.nextModseq === "number");
+    // Page 2 — resume from nextModseq, the FTS window excludes page 1.
+    var page2 = store.search("INBOX", { body: "keyword", sinceModseq: page1.nextModseq, limit: 10 });
+    check("search: FTS pagination resumes past page 1",
+          page2.rows.length === 2 && page2.rows[0].modseq > page1.nextModseq);
+  } finally { _teardown(fx); }
+}
+
+async function testSearchFtsUnavailableFallback() {
+  var fx = await _setupStore("ftsunavail");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    store.appendMessage("INBOX",
+      _msg(["From: a@x", "Subject: indexed subject", "Message-Id: <u1@x>"], "indexed body"));
+
+    // Corrupt the on-disk FTS format marker so _ftsIndexUsable() reads
+    // the index as non-final. search() must fall back to the modseq
+    // cursor and flag ftsUnavailable rather than returning partial /
+    // wrong-scheme FTS hits.
+    fx.db.prepare("UPDATE " + store._tablePrefix + "_meta SET value = 'rebuilding' WHERE key = 'fts_format'").run();
+
+    var r = store.search("INBOX", { subject: "indexed" });
+    check("search: stale FTS marker falls back to modseq cursor",
+          r.ftsUnavailable === true && r.rows.length === 1 && typeof r.nextModseq === "number");
+  } finally { _teardown(fx); }
+}
+
 async function run() {
+  await testBadTablePrefix();
+  await testBadHeaderIds();
+  await testOversizeMessageDirect();
+  await testMissingFolderEveryReader();
+  await testMoveBadObjectids();
+  await testCreateFolderBadName();
+  await testQuotaAndThreadEmptyStates();
+  await testHardExpungeEdgeCases();
+  await testSearchColumnFiltersAndPagination();
+  await testSearchPaginationSinceModseq();
+  await testSearchFtsUnavailableFallback();
   await testByteCapMultibyte();
   testSurface();
   await testBootstrap();