diff --git a/tests/library-search.test.mjs b/tests/library-search.test.mjs
new file mode 100644
index 0000000..f4c834d
--- /dev/null
+++ b/tests/library-search.test.mjs
@@ -0,0 +1,59 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import {
+ filterBookmarks,
+ safeURL,
+ escapeHTML,
+} from "../lib/library-search.mjs";
+const rows = [
+ {
+ tweet_id: "1",
+ full_text: "Claude Code 教程",
+ author: { name: "小明" },
+ folders: ["AI"],
+ media: [{ type: "photo" }],
+ status: "available",
+ created_at: "2026-01-01",
+ metrics: { likes: 9 },
+ },
+ {
+ tweet_id: "2",
+ full_text: "Claude tools",
+ folders: [],
+ media: [],
+ status: "unavailable",
+ created_at: "2026-02-01",
+ },
+];
+test("phrase, exclusions, author and combined facets", () => {
+ assert.deepEqual(
+ filterBookmarks(rows, { query: '"Claude Code" -广告' }).map(
+ (x) => x.tweet_id,
+ ),
+ ["1"],
+ );
+ assert.equal(
+ filterBookmarks(rows, { query: "小明", media: "photo", folder: "AI" })
+ .length,
+ 1,
+ );
+ assert.equal(
+ filterBookmarks(rows, { query: "Claude -Code" })[0].tweet_id,
+ "2",
+ );
+ assert.equal(
+ filterBookmarks(rows, { folder: "__unsorted", status: "unavailable" })
+ .length,
+ 1,
+ );
+});
+test("sorting does not mutate original archive", () => {
+ assert.equal(filterBookmarks(rows, { sort: "new" })[0].tweet_id, "2");
+ assert.equal(rows[0].tweet_id, "1");
+ assert.equal(filterBookmarks(rows, { sort: "likes" })[0].tweet_id, "1");
+});
+test("untrusted links and content cannot become executable HTML", () => {
+ assert.equal(safeURL("javascript:alert(1)"), "");
+ assert.equal(safeURL("data:text/html,test"), "");
+ assert.equal(escapeHTML("