@bobfrankston/rmfmail 1.0.565 → 1.0.570

package/packages/mailx-store/db.ts

@@ -303,6 +303,31 @@ const SCHEMA = `
     );
     CREATE INDEX IF NOT EXISTS idx_audit_log_ts ON audit_log(ts);
     CREATE INDEX IF NOT EXISTS idx_audit_log_folder ON audit_log(account_id, folder_id);
+
+    -- Schema refactor: messages identity vs folder location.
+    -- Before: a messages row was identified by (account, folder, uid).
+    -- Server-side moves required deleting the old row and inserting a
+    -- new one (losing UUID, body cache, flags), or a fragile move-detect
+    -- rebind. A message in multiple Gmail labels needed multiple rows
+    -- with the same Message-ID.
+    -- After: a messages row is one logical email (identity = uuid;
+    -- semantic key = account + message_id). Folder membership lives in
+    -- message_folders. A move is delete-one-membership + add-another.
+    -- Body, UUID, flags, custom annotations all stay put. Multi-folder
+    -- messages just have multiple membership rows.
+    -- During the additive migration, messages.folder_id / messages.uid
+    -- stay populated as primary location so existing reads keep working.
+    -- Reads switch to JOIN with message_folders step by step.
+    CREATE TABLE IF NOT EXISTS message_folders (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        message_row_id INTEGER NOT NULL REFERENCES messages(id) ON DELETE CASCADE,
+        folder_id INTEGER NOT NULL,
+        uid INTEGER NOT NULL,
+        last_seen_at INTEGER NOT NULL,
+        UNIQUE(folder_id, uid)
+    );
+    CREATE INDEX IF NOT EXISTS idx_message_folders_msg ON message_folders(message_row_id);
+    CREATE INDEX IF NOT EXISTS idx_message_folders_folder_uid ON message_folders(folder_id, uid);
 `;
 
 export class MailxDB {
@@ -374,6 +399,31 @@ export class MailxDB {
             console.error(`  [migration] synthetic-UID cleanup failed: ${e?.message || e}`);
         }
 
+        // One-shot: backfill message_folders from existing messages rows.
+        // After this runs, every existing (account, folder, uid) row in
+        // messages has a corresponding membership row in message_folders.
+        // New writes (upsertMessage) will populate both during the
+        // additive migration. UNIQUE(folder_id, uid) on message_folders
+        // means INSERT OR IGNORE — the migration is idempotent if rerun.
+        try {
+            const flag = this.getKv("schema", "message_folders_v1");
+            if (!flag) {
+                const now = Date.now();
+                const r = this.db.prepare(
+                    `INSERT OR IGNORE INTO message_folders (message_row_id, folder_id, uid, last_seen_at)
+                     SELECT id, folder_id, uid, ? FROM messages`
+                ).run(now);
+                const count = (r as any).changes || 0;
+                if (count > 0) {
+                    console.log(`  [migration] message_folders_v1: backfilled ${count} membership rows from messages`);
+                    this.audit({ kind: "migration", count, reason: "message_folders_v1 — populate join table from existing messages.folder_id/uid", source: "MailxDB constructor" });
+                }
+                this.setKv("schema", "message_folders_v1", "1");
+            }
+        } catch (e: any) {
+            console.error(`  [migration] message_folders backfill failed: ${e?.message || e}`);
+        }
+
         // One-shot contacts table reset: the contacts schema's UNIQUE constraint
         // was widened from `(email)` to `(source, email, name)` so the same
         // address can carry multiple distinct (name, source) entries — Bob's
@@ -1044,26 +1094,70 @@ export class MailxDB {
     }
 
     deleteFolder(folderId: number): void {
-        const r = this.db.prepare("DELETE FROM messages WHERE folder_id = ?").run(folderId);
-        const count = (r as any).changes || 0;
-        if (count > 0) this.audit({ kind: "delete-bulk", folderId, count, reason: "folder deleted", source: "deleteFolder" });
+        // Drop memberships in this folder first, then GC any messages
+        // rows that are now orphaned (no remaining memberships). A
+        // multi-folder message (e.g. Gmail label = INBOX + Important)
+        // keeps its body intact when only one of its folders is deleted.
+        const orphans = this.gcMembershipsAndCollectOrphans(folderId);
+        if (orphans.count > 0) this.audit({ kind: "delete-bulk", folderId, count: orphans.count, reason: "folder deleted", source: "deleteFolder" });
         this.db.prepare("DELETE FROM folders WHERE id = ?").run(folderId);
     }
 
     markFolderRead(folderId: number): void {
+        // Mark seen for messages currently in this folder (membership-scoped,
+        // not legacy folder_id) so a message that lives in multiple folders
+        // becomes seen everywhere — which matches IMAP semantics: \Seen is
+        // a per-message flag, not per-folder. (When the day comes that we
+        // want truly per-folder read-state, this needs `flag_overrides`.)
         this.db.prepare(
-            `UPDATE messages SET flags_json = REPLACE(flags_json, '[]', '["\\\\Seen"]') WHERE folder_id = ? AND flags_json NOT LIKE '%\\\\Seen%'`
+            `UPDATE messages SET flags_json = REPLACE(flags_json, '[]', '["\\\\Seen"]')
+             WHERE id IN (SELECT message_row_id FROM message_folders WHERE folder_id = ?)
+             AND flags_json NOT LIKE '%\\\\Seen%'`
         ).run(folderId);
         this.recalcFolderCounts(folderId);
     }
 
     deleteAllMessages(accountId: string, folderId: number): void {
-        const r = this.db.prepare("DELETE FROM messages WHERE account_id = ? AND folder_id = ?").run(accountId, folderId);
-        const count = (r as any).changes || 0;
-        if (count > 0) this.audit({ kind: "delete-bulk", accountId, folderId, count, reason: "deleteAllMessages (emptyFolder)", source: "deleteAllMessages" });
+        const orphans = this.gcMembershipsAndCollectOrphans(folderId, accountId);
+        if (orphans.count > 0) this.audit({ kind: "delete-bulk", accountId, folderId, count: orphans.count, reason: "deleteAllMessages (emptyFolder)", source: "deleteAllMessages" });
         this.recalcFolderCounts(folderId);
     }
 
+    /** Drop every `message_folders` row in `folderId` (optionally scoped to an
+     *  account) and GC any `messages` rows that no longer have ANY memberships.
+     *  Returns count of memberships removed (so callers can audit "I deleted N
+     *  things"). The messages-row delete cascades to FTS / sync_actions /
+     *  message_folders (CASCADE) so this is the safe single op for "clear
+     *  this folder" without nuking multi-folder messages. */
+    private gcMembershipsAndCollectOrphans(folderId: number, accountId?: string): { count: number } {
+        // Find membership rows we're about to delete
+        const membershipQ = accountId
+            ? `SELECT mf.id, mf.message_row_id FROM message_folders mf
+               JOIN messages m ON m.id = mf.message_row_id
+               WHERE mf.folder_id = ? AND m.account_id = ?`
+            : `SELECT mf.id, mf.message_row_id FROM message_folders mf WHERE mf.folder_id = ?`;
+        const memberships = (accountId
+            ? this.db.prepare(membershipQ).all(folderId, accountId)
+            : this.db.prepare(membershipQ).all(folderId)) as { id: number; message_row_id: number }[];
+        if (memberships.length === 0) return { count: 0 };
+
+        // Drop them
+        const delMemb = this.db.prepare("DELETE FROM message_folders WHERE id = ?");
+        for (const m of memberships) delMemb.run(m.id);
+
+        // GC any messages rows that now have zero remaining memberships.
+        // Use a Set so a multi-membership row only gets one orphan check.
+        const touched = Array.from(new Set(memberships.map(m => m.message_row_id)));
+        const isOrphan = this.db.prepare("SELECT COUNT(*) AS c FROM message_folders WHERE message_row_id = ?");
+        const delMsg = this.db.prepare("DELETE FROM messages WHERE id = ?");
+        for (const rowId of touched) {
+            if (((isOrphan.get(rowId) as any)?.c | 0) === 0) {
+                delMsg.run(rowId);
+            }
+        }
+        return { count: memberships.length };
+    }
+
     updateFolderCounts(folderId: number, total: number, unread: number): void {
         this.db.prepare(
             "UPDATE folders SET total_count = ?, unread_count = ? WHERE id = ?"
@@ -1085,6 +1179,126 @@ export class MailxDB {
 
     // ── Messages ──
 
+    /** Record that a message row currently lives at (folder, uid). Idempotent
+     *  via UNIQUE(folder_id, uid) — re-inserting the same membership just
+     *  refreshes last_seen_at. A message in N Gmail labels has N rows.
+     *  A server-side move is "delete one membership row, insert another";
+     *  the messages row is untouched. Called from upsertMessage on every
+     *  insert / move-detect / existing-row upsert during the additive
+     *  migration. Reconcile is the only path that DELETES from this table
+     *  (when the server stops listing a UID in a folder). */
+    upsertMessageFolder(messageRowId: number, folderId: number, uid: number): void {
+        const now = Date.now();
+        // INSERT OR REPLACE on (folder_id, uid) — if some other message_row_id
+        // somehow had this slot, replace it. In practice this happens after
+        // an EXPUNGE+reinsert: a UID gets reused by the server for a different
+        // message. The new message wins; the old's membership entry goes away.
+        this.db.prepare(
+            `INSERT INTO message_folders (message_row_id, folder_id, uid, last_seen_at)
+             VALUES (?, ?, ?, ?)
+             ON CONFLICT(folder_id, uid) DO UPDATE SET
+                 message_row_id = excluded.message_row_id,
+                 last_seen_at = excluded.last_seen_at`
+        ).run(messageRowId, folderId, uid, now);
+    }
+
+    /** Drop a membership row when reconcile finds the UID is no longer
+     *  on the server in this folder. The messages row itself is NOT
+     *  touched — it may still exist in other folders, or the deferred-
+     *  cleanup pass (later) handles orphan messages with no memberships. */
+    removeMessageFolder(folderId: number, uid: number): boolean {
+        const r = this.db.prepare(
+            "DELETE FROM message_folders WHERE folder_id = ? AND uid = ?"
+        ).run(folderId, uid);
+        return ((r as any).changes || 0) > 0;
+    }
+
+    /** Reconcile-driven membership drop. Called when the server's UID list
+     *  for a folder no longer contains a UID we have locally. Drops the
+     *  membership row; if the messages row has no other memberships AND
+     *  no other folder claims it via the legacy folder_id column, deletes
+     *  the messages row + unlinks the body file. Returns true if any
+     *  cleanup happened (so the caller can skip the legacy delete path).
+     *
+     *  During the additive migration we ALSO have to handle the legacy
+     *  case where the row's folder_id matches but no message_folders row
+     *  was migrated for it (race during initial population, etc.) — we
+     *  fall back to the messages.folder_id check to clean up consistently. */
+    dropFolderMembership(accountId: string, folderId: number, uid: number, folderPath?: string): boolean {
+        // First find the messages row this membership pointed at.
+        const mf = this.db.prepare(
+            "SELECT message_row_id FROM message_folders WHERE folder_id = ? AND uid = ?"
+        ).get(folderId, uid) as { message_row_id: number } | undefined;
+
+        let rowId: number | null = null;
+        if (mf) {
+            // Drop the membership.
+            this.db.prepare(
+                "DELETE FROM message_folders WHERE folder_id = ? AND uid = ?"
+            ).run(folderId, uid);
+            rowId = mf.message_row_id;
+        } else {
+            // Legacy fallback: the row exists in messages.folder_id/uid but
+            // not in message_folders (pre-migration data, or a row that
+            // somehow skipped the dual-write). Use the legacy lookup.
+            const legacy = this.db.prepare(
+                "SELECT id FROM messages WHERE account_id = ? AND folder_id = ? AND uid = ?"
+            ).get(accountId, folderId, uid) as { id: number } | undefined;
+            rowId = legacy?.id ?? null;
+        }
+        if (rowId === null) {
+            console.log(`  [reconcile-skip] ${accountId} folder=${folderId} uid=${uid}: no row to drop (already gone or moved)`);
+            return false;
+        }
+
+        // Check if any other memberships exist for this row.
+        const remaining = this.db.prepare(
+            "SELECT COUNT(*) AS cnt FROM message_folders WHERE message_row_id = ?"
+        ).get(rowId) as { cnt: number };
+
+        if (remaining.cnt > 0) {
+            // Message lives in another folder still — preserve everything.
+            // The messages.folder_id column may still point at the dropped
+            // location; sync the primary location to one of the remaining
+            // memberships so legacy reads stay consistent.
+            const next = this.db.prepare(
+                "SELECT folder_id, uid FROM message_folders WHERE message_row_id = ? ORDER BY id LIMIT 1"
+            ).get(rowId) as { folder_id: number; uid: number } | undefined;
+            if (next) {
+                this.db.prepare(
+                    "UPDATE messages SET folder_id = ?, uid = ? WHERE id = ?"
+                ).run(next.folder_id, next.uid, rowId);
+            }
+            console.log(`  [reconcile-membership] ${accountId} ${folderPath || folderId}/${uid}: dropped — message still in ${remaining.cnt} other folder(s)`);
+            this.audit({
+                kind: "delete-membership",
+                accountId, folderId, uid,
+                reason: `reconcile dropped folder membership; ${remaining.cnt} other location(s) remain`,
+                source: `dropFolderMembership (${folderPath || ""})`,
+            });
+            return true;
+        }
+
+        // No other memberships — message is truly gone. Delete the row.
+        // Capture context for audit before delete.
+        const env = this.db.prepare(
+            "SELECT message_id, subject, body_path FROM messages WHERE id = ?"
+        ).get(rowId) as { message_id: string; subject: string; body_path: string } | undefined;
+        this.db.prepare("DELETE FROM messages WHERE id = ?").run(rowId);
+        if (env) {
+            this.audit({
+                kind: "delete-msg",
+                accountId, folderId, uid,
+                messageId: env.message_id || undefined,
+                subject: env.subject || undefined,
+                reason: "reconcile: server missing this UID after grace, no other folder memberships",
+                source: `dropFolderMembership (${folderPath || ""})`,
+            });
+            console.log(`  [reconcile-delete] ${accountId} ${folderPath || folderId}/${uid} msgid=${env.message_id || "?"} (no other memberships) — body ${env.body_path || "(none)"}`);
+        }
+        return true;
+    }
+
     upsertMessage(msg: {
         accountId: string;
         folderId: number;
@@ -1130,6 +1344,11 @@ export class MailxDB {
                     WHERE id = ?
                 `).run(JSON.stringify(msg.flags), Date.now(), existing.id);
             }
+            // Refresh membership last_seen_at — server confirmed this UID
+            // is still in this folder. No-op if migration already populated
+            // it; defensive INSERT-OR-UPDATE handles the race where the row
+            // was created without a corresponding membership.
+            this.upsertMessageFolder(existing.id, msg.folderId, msg.uid);
             return existing.id;
         }
 
@@ -1147,11 +1366,19 @@ export class MailxDB {
             ).get(msg.accountId, msg.messageId) as { id: number; folder_id: number; uid: number } | undefined;
             if (moved) {
                 console.log(`  [move-detect] ${msg.accountId} ${msg.messageId}: rebinding row ${moved.id} (folder ${moved.folder_id}/uid ${moved.uid} → folder ${msg.folderId}/uid ${msg.uid})`);
-                // Update folder_id + uid; preserve uuid, body_path, flags
-                // (server flags will catch up on the next full sync).
+                // Update folder_id + uid on the messages row (additive
+                // migration: keeps the "primary location" columns valid for
+                // existing reads). The new schema's source of truth is
+                // message_folders — see below.
                 this.db.prepare(
                     "UPDATE messages SET folder_id = ?, uid = ?, cached_at = ? WHERE id = ?"
                 ).run(msg.folderId, msg.uid, Date.now(), moved.id);
+                // Add the new membership row. The OLD membership (source
+                // folder + old uid) stays — reconcile in the source folder
+                // is what eventually drops it (when the server stops
+                // listing the UID there). For Gmail multi-label messages,
+                // both memberships persist legitimately.
+                this.upsertMessageFolder(moved.id, msg.folderId, msg.uid);
                 // Notify subscribers so e.g. the reconciler can cancel any
                 // pending deferred-delete for the original (folder, uid) —
                 // otherwise the reconcile-delete grace timer fires for a
@@ -1205,6 +1432,12 @@ export class MailxDB {
 
         const rowId = Number(result.lastInsertRowid);
 
+        // Record the (folder, uid) membership for the new row. New schema
+        // source of truth — old folder_id/uid columns above are kept in
+        // sync during the additive migration but reads will move to JOIN
+        // with message_folders.
+        this.upsertMessageFolder(rowId, msg.folderId, msg.uid);
+
         // Index for full-text search
         try {
             this.db.prepare(
@@ -1215,6 +1448,12 @@ export class MailxDB {
         return rowId;
     }
 
+    /** List view: messages currently in (account, folder).
+     *  Joins through `message_folders` so the UID + folder location come
+     *  from membership rows, not from the legacy messages.folder_id /
+     *  messages.uid columns. After a server-side move (Sieve filter,
+     *  webmail action, etc.), the membership row is the truth — the
+     *  legacy columns are frozen at first-sight values. */
     getMessages(query: MessageQuery): PagedResult<MessageEnvelope> {
         const page = query.page || 1;
         const pageSize = query.pageSize || 50;
@@ -1222,43 +1461,43 @@ export class MailxDB {
         const sort = query.sort || "date";
         const sortDir = query.sortDir || "desc";
 
-        const sortCol = sort === "from" ? "from_name" : sort === "subject" ? "subject" : "date";
+        const sortCol = sort === "from" ? "m.from_name" : sort === "subject" ? "m.subject" : "m.date";
 
-        let where = "account_id = ? AND folder_id = ?";
+        let where = "m.account_id = ? AND mf.folder_id = ?";
         const params: (string | number)[] = [query.accountId, query.folderId];
 
         if (query.search) {
-            where += " AND (subject LIKE ? OR from_name LIKE ? OR from_address LIKE ?)";
+            where += " AND (m.subject LIKE ? OR m.from_name LIKE ? OR m.from_address LIKE ?)";
             const term = `%${query.search}%`;
             params.push(term, term, term);
         }
 
         if (query.flaggedOnly) {
-            // flags_json is a JSON array like ["\\Seen","\\Flagged"]. A plain
-            // LIKE on the serialized form is sufficient to find rows with the
-            // \Flagged flag without decoding every row.
-            where += " AND flags_json LIKE '%\\\\Flagged%'";
+            where += " AND m.flags_json LIKE '%\\\\Flagged%'";
         }
 
         const total = (this.db.prepare(
-            `SELECT COUNT(*) as cnt FROM messages WHERE ${where}`
+            `SELECT COUNT(*) as cnt
+             FROM messages m
+             JOIN message_folders mf ON mf.message_row_id = m.id
+             WHERE ${where}`
         ).get(...params) as any).cnt;
 
-        // LEFT JOIN sync_actions so each row carries a `pending` flag —
-        // true when the user has a queued local action (move/flag/delete)
-        // not yet acknowledged by the server. UI renders these in pink so
-        // local-only state is visible (Slice C of S1). The optimistic-Sent
-        // negative-UID convention was retired — Sent now reflects only what
-        // the server has; pending sends live in the Outbox view.
+        // pending = user has a queued local action against (account, uid).
+        // uid here is the membership uid (mf.uid), not m.uid — sync_actions
+        // were also keyed against the at-action-time uid, so this match
+        // remains stable across server-side moves of the SAME message
+        // (the action gets re-targeted to the new uid by the reconciler).
         const rows = this.db.prepare(
-            `SELECT m.*, (
+            `SELECT m.*, mf.uid AS uid, mf.folder_id AS folder_id,
                 EXISTS(
                     SELECT 1 FROM sync_actions sa
-                    WHERE sa.account_id = m.account_id AND sa.uid = m.uid
-                )
-            ) AS pending
-            FROM messages m WHERE ${where.replace(/\b(account_id|folder_id|uid|date|subject|from_name|from_address|flags_json)\b/g, "m.$1")}
-            ORDER BY m.${sortCol} ${sortDir} LIMIT ? OFFSET ?`
+                    WHERE sa.account_id = m.account_id AND sa.uid = mf.uid
+                ) AS pending
+            FROM messages m
+            JOIN message_folders mf ON mf.message_row_id = m.id
+            WHERE ${where}
+            ORDER BY ${sortCol} ${sortDir} LIMIT ? OFFSET ?`
         ).all(...params, pageSize, offset) as any[];
 
         const items: MessageEnvelope[] = rows.map(r => ({
@@ -1300,17 +1539,22 @@ export class MailxDB {
         const folderIds = inboxRows.map((r: any) => r.id);
 
         const total = (this.db.prepare(
-            `SELECT COUNT(*) as cnt FROM messages WHERE folder_id IN (${placeholders})`
+            `SELECT COUNT(*) as cnt
+             FROM message_folders mf
+             WHERE mf.folder_id IN (${placeholders})`
         ).get(...folderIds) as any).cnt;
 
         const rows = this.db.prepare(
-            `SELECT m.*, EXISTS(
-                SELECT 1 FROM sync_actions sa
-                WHERE sa.account_id = m.account_id AND sa.uid = m.uid
-            ) AS pending,
-            (SELECT COUNT(DISTINCT account_id) FROM messages m2
-             WHERE m2.message_id = m.message_id AND m.message_id != '') AS dupeCount
-            FROM messages m WHERE m.folder_id IN (${placeholders})
+            `SELECT m.*, mf.uid AS uid, mf.folder_id AS folder_id,
+                EXISTS(
+                    SELECT 1 FROM sync_actions sa
+                    WHERE sa.account_id = m.account_id AND sa.uid = mf.uid
+                ) AS pending,
+                (SELECT COUNT(DISTINCT account_id) FROM messages m2
+                 WHERE m2.message_id = m.message_id AND m.message_id != '') AS dupeCount
+            FROM messages m
+            JOIN message_folders mf ON mf.message_row_id = m.id
+            WHERE mf.folder_id IN (${placeholders})
             ORDER BY m.date DESC LIMIT ? OFFSET ?`
         ).all(...folderIds, pageSize, offset) as any[];
 
@@ -1372,10 +1616,24 @@ export class MailxDB {
         } as MessageEnvelope;
     }
 
+    /** Look up a message by (account, uid) and optionally folder.
+     *  Joins through `message_folders` so the message is found at its
+     *  CURRENT location, not whatever messages.folder_id was at first
+     *  sight. After server-side moves, that's the difference between
+     *  hitting the message in `_Spam` (correct) and hitting nothing
+     *  because the legacy messages.folder_id still points at INBOX. */
     getMessageByUid(accountId: string, uid: number, folderId?: number): MessageEnvelope {
         const sql = folderId != null
-            ? "SELECT * FROM messages WHERE account_id = ? AND uid = ? AND folder_id = ?"
-            : "SELECT * FROM messages WHERE account_id = ? AND uid = ?";
+            ? `SELECT m.*, mf.uid AS uid
+               FROM messages m
+               JOIN message_folders mf ON mf.message_row_id = m.id
+               WHERE m.account_id = ? AND mf.uid = ? AND mf.folder_id = ?
+               LIMIT 1`
+            : `SELECT m.*, mf.uid AS uid
+               FROM messages m
+               JOIN message_folders mf ON mf.message_row_id = m.id
+               WHERE m.account_id = ? AND mf.uid = ?
+               LIMIT 1`;
         const params = folderId != null ? [accountId, uid, folderId] : [accountId, uid];
         const r = this.db.prepare(sql).get(...params) as any;
         if (!r) return null as any;
@@ -1448,32 +1706,49 @@ export class MailxDB {
         ).all(accountId, limit) as any[];
     }
 
-    getHighestUid(accountId: string, folderId: number): number {
+    /** Highest server UID we've seen in this folder. After the
+     *  message_folders refactor, this reads from the membership table
+     *  rather than messages.uid — a server-side move from this folder
+     *  drops the membership row, so the high-water mark correctly
+     *  decreases when the message left. account_id is implicit
+     *  (folder_id is account-scoped). */
+    getHighestUid(_accountId: string, folderId: number): number {
         const r = this.db.prepare(
-            "SELECT MAX(uid) as maxUid FROM messages WHERE account_id = ? AND folder_id = ?"
-        ).get(accountId, folderId) as any;
+            "SELECT MAX(uid) as maxUid FROM message_folders WHERE folder_id = ?"
+        ).get(folderId) as any;
         return r?.maxUid || 0;
     }
 
-    getOldestDate(accountId: string, folderId: number): number {
+    /** Oldest message date in this folder. Joins through message_folders
+     *  so a message that LEFT this folder via server-side move stops
+     *  influencing the date window for incremental backfill. */
+    getOldestDate(_accountId: string, folderId: number): number {
         const r = this.db.prepare(
-            "SELECT MIN(date) as minDate FROM messages WHERE account_id = ? AND folder_id = ?"
-        ).get(accountId, folderId) as any;
+            `SELECT MIN(m.date) as minDate
+             FROM messages m
+             JOIN message_folders mf ON mf.message_row_id = m.id
+             WHERE mf.folder_id = ?`
+        ).get(folderId) as any;
         return r?.minDate || 0;
     }
 
-    getMessageCount(accountId: string, folderId: number): number {
+    /** Number of messages currently IN this folder (server-side membership,
+     *  not whatever messages.folder_id happens to say after a move). */
+    getMessageCount(_accountId: string, folderId: number): number {
         const r = this.db.prepare(
-            "SELECT count(*) as cnt FROM messages WHERE account_id = ? AND folder_id = ?"
-        ).get(accountId, folderId) as any;
+            "SELECT count(*) as cnt FROM message_folders WHERE folder_id = ?"
+        ).get(folderId) as any;
         return r?.cnt || 0;
     }
 
-    /** Get all UIDs for a folder */
-    getUidsForFolder(accountId: string, folderId: number): number[] {
+    /** All UIDs the server has confirmed in this folder. Used by
+     *  reconcile to diff against the server's UID list — anything in
+     *  here but NOT on the server gets its membership dropped (which
+     *  may then GC the messages row if it has no other folders). */
+    getUidsForFolder(_accountId: string, folderId: number): number[] {
         const rows = this.db.prepare(
-            "SELECT uid FROM messages WHERE account_id = ? AND folder_id = ?"
-        ).all(accountId, folderId) as any[];
+            "SELECT uid FROM message_folders WHERE folder_id = ?"
+        ).all(folderId) as any[];
         return rows.map(r => r.uid);
     }
 
@@ -2011,7 +2286,7 @@ export class MailxDB {
     // ── Search ──
 
     /** Full-text search across all messages. Supports qualifiers: from:, to:, subject: */
-    searchMessages(query: string, page = 1, pageSize = 50, accountId?: string, folderId?: number): PagedResult<MessageEnvelope> {
+    searchMessages(query: string, page = 1, pageSize = 50, accountId?: string, folderId?: number, includeTrashSpam = false): PagedResult<MessageEnvelope> {
         query = (query || "").trim();
         // Parse qualifiers (C45: extended set — date:, has:, is:, folder:).
         let ftsQuery = "";
@@ -2111,13 +2386,24 @@ export class MailxDB {
                 scopeWhere = " AND m.account_id = ?";
                 scopeParams.push(accountId);
             }
+            // Global / account-wide search excludes trash + junk unless the
+            // user opted in. A user typing "invoice" in the search box almost
+            // never wants the deleted/spam copy that's already filtered out
+            // of every other view. When the user IS explicitly scoped to
+            // trash/junk via folderId, this guard is skipped.
+            if (!includeTrashSpam && !folderId) {
+                scopeWhere += " AND (f.special_use IS NULL OR f.special_use NOT IN ('trash','junk'))";
+            }
             if (extraWhere.length > 0) {
                 scopeWhere += " AND " + extraWhere.join(" AND ");
                 scopeParams.push(...extraParams);
             }
 
             const countRow = this.db.prepare(
-                `SELECT COUNT(*) as cnt FROM messages m JOIN messages_fts fts ON m.id = fts.rowid WHERE messages_fts MATCH ?${scopeWhere}`
+                `SELECT COUNT(*) as cnt FROM messages m
+                 JOIN messages_fts fts ON m.id = fts.rowid
+                 LEFT JOIN folders f ON f.id = m.folder_id AND f.account_id = m.account_id
+                 WHERE messages_fts MATCH ?${scopeWhere}`
             ).get(ftsQuery, ...scopeParams) as any;
             const total = countRow?.cnt || 0;
 

package/packages/mailx-store/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-store",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",