@jant/core 0.6.10 → 0.6.12

package/src/services/__tests__/post-timeline.test.ts

@@ -464,8 +464,86 @@ describe("PostService - Timeline features", () => {
     });
   });
 
+  describe("listCollectionThreadRootIds", () => {
+    it("bumps a hidden collection thread when a non-quiet reply is published", async () => {
+      const collection = await collectionService.create({
+        slug: "thinking",
+        title: "Thinking",
+      });
+      const hiddenRoot = await postService.create({
+        format: "note",
+        bodyMarkdown: "Hidden root",
+        visibility: "latest_hidden",
+        publishedAt: 1000,
+      });
+      const newerRoot = await postService.create({
+        format: "note",
+        bodyMarkdown: "Newer root",
+        publishedAt: 2000,
+      });
+
+      await collectionService.addPost(collection.id, hiddenRoot.id);
+      await collectionService.addPost(collection.id, newerRoot.id);
+
+      await postService.create({
+        format: "note",
+        bodyMarkdown: "Normal reply",
+        replyToId: hiddenRoot.id,
+        publishedAt: 3000,
+      });
+
+      const rootIds = await postService.listCollectionThreadRootIds(
+        collection.id,
+        {
+          status: "published",
+          sortOrder: "newest",
+        },
+      );
+
+      expect(rootIds).toEqual([hiddenRoot.id, newerRoot.id]);
+    });
+
+    it("does not bump a collection thread when a reply is quiet", async () => {
+      const collection = await collectionService.create({
+        slug: "quiet",
+        title: "Quiet",
+      });
+      const olderRoot = await postService.create({
+        format: "note",
+        bodyMarkdown: "Older root",
+        publishedAt: 1000,
+      });
+      const newerRoot = await postService.create({
+        format: "note",
+        bodyMarkdown: "Newer root",
+        publishedAt: 2000,
+      });
+
+      await collectionService.addPost(collection.id, olderRoot.id);
+      await collectionService.addPost(collection.id, newerRoot.id);
+
+      await postService.create({
+        format: "note",
+        bodyMarkdown: "Quiet reply",
+        replyToId: olderRoot.id,
+        publishedAt: 3000,
+        quietReply: true,
+      });
+
+      const rootIds = await postService.listCollectionThreadRootIds(
+        collection.id,
+        {
+          status: "published",
+          sortOrder: "newest",
+        },
+      );
+
+      expect(rootIds).toEqual([newerRoot.id, olderRoot.id]);
+    });
+  });
+
   describe("listCollectionFeedEntries", () => {
-    it("orders collection feeds by publishedAt and returns thread roots", async () => {
+    it("orders collection feeds by thread activity and returns thread roots", async () => {
       const collection = await collectionService.create({
         slug: "reading",
         title: "Reading",
@@ -565,11 +643,50 @@ describe("PostService - Timeline features", () => {
       );
 
       expect(entries).toHaveLength(2);
-      // Sorted by publishedAt DESC: secondRoot created last has latest publishedAt
       expect(entries[0]?.post.id).toBe(secondRoot.id);
       expect(entries[0]?.collectedAt).toBe(200);
       expect(entries[1]?.post.id).toBe(sharedRoot.id);
       expect(entries[1]?.collectedAt).toBe(300);
     });
+
+    it("orders collection feeds by thread activity from non-quiet replies", async () => {
+      const collection = await collectionService.create({
+        slug: "activity",
+        title: "Activity",
+      });
+      const hiddenRoot = await postService.create({
+        format: "note",
+        bodyMarkdown: "Hidden root",
+        visibility: "latest_hidden",
+        publishedAt: 1000,
+      });
+      const newerRoot = await postService.create({
+        format: "note",
+        bodyMarkdown: "Newer root",
+        publishedAt: 2000,
+      });
+
+      await collectionService.addPost(collection.id, hiddenRoot.id);
+      await collectionService.addPost(collection.id, newerRoot.id);
+
+      await postService.create({
+        format: "note",
+        bodyMarkdown: "Normal reply",
+        replyToId: hiddenRoot.id,
+        publishedAt: 3000,
+      });
+
+      const entries = await postService.listCollectionFeedEntries(
+        collection.id,
+        {
+          status: "published",
+        },
+      );
+
+      expect(entries.map((entry) => entry.post.id)).toEqual([
+        hiddenRoot.id,
+        newerRoot.id,
+      ]);
+    });
   });
 });

package/src/services/about-page.ts

@@ -0,0 +1,143 @@
+/**
+ * About Page Service
+ *
+ * Treats `/about` as the standard site About page. The page itself remains a
+ * normal post; this service reads that convention and can create the page when
+ * the author follows the settings prompt.
+ */
+
+import { ValidationError } from "../lib/errors.js";
+import type { Visibility } from "../types.js";
+import type { CollectionService } from "./collection.js";
+import type { PathService } from "./path.js";
+import type { PostService } from "./post.js";
+
+export const ABOUT_PAGE_PATH = "/about";
+export const ABOUT_PAGE_SLUG = "about";
+
+export type AboutPageStatus =
+  | {
+      state: "missing";
+      path: typeof ABOUT_PAGE_PATH;
+    }
+  | {
+      state: "ready";
+      path: typeof ABOUT_PAGE_PATH;
+      post: {
+        id: string;
+        title: string | null;
+        status: "draft" | "published";
+        visibility: Visibility;
+      };
+    }
+  | {
+      state: "conflict";
+      path: typeof ABOUT_PAGE_PATH;
+      conflict: {
+        targetType: "collection" | "redirect" | "archive" | "post";
+        id: string | null;
+        title: string | null;
+      };
+    };
+
+export interface AboutPageService {
+  getStatus(): Promise<AboutPageStatus>;
+  ensurePage(): Promise<Extract<AboutPageStatus, { state: "ready" }>["post"]>;
+}
+
+export function createAboutPageService(deps: {
+  paths: PathService;
+  posts: PostService;
+  collections: CollectionService;
+}): AboutPageService {
+  async function readStatus(): Promise<AboutPageStatus> {
+    const resolved = await deps.paths.resolve(ABOUT_PAGE_SLUG);
+    const base = {
+      path: ABOUT_PAGE_PATH,
+    } as const;
+
+    if (!resolved) {
+      return { ...base, state: "missing" };
+    }
+
+    if (resolved.targetType === "post" && resolved.postId) {
+      const post = await deps.posts.getById(resolved.postId);
+      if (!post) {
+        return {
+          ...base,
+          state: "conflict",
+          conflict: {
+            targetType: "post",
+            id: resolved.postId,
+            title: null,
+          },
+        };
+      }
+
+      return {
+        ...base,
+        state: "ready",
+        post: {
+          id: post.id,
+          title: post.title,
+          status: post.status,
+          visibility: post.visibility,
+        },
+      };
+    }
+
+    if (resolved.targetType === "collection" && resolved.collectionId) {
+      const collection = await deps.collections.getById(resolved.collectionId);
+      return {
+        ...base,
+        state: "conflict",
+        conflict: {
+          targetType: "collection",
+          id: resolved.collectionId,
+          title: collection?.title ?? null,
+        },
+      };
+    }
+
+    return {
+      ...base,
+      state: "conflict",
+      conflict: {
+        targetType: resolved.targetType,
+        id: null,
+        title: null,
+      },
+    };
+  }
+
+  return {
+    getStatus: readStatus,
+
+    async ensurePage() {
+      const status = await readStatus();
+      if (status.state === "ready") {
+        return status.post;
+      }
+
+      if (status.state === "conflict") {
+        throw new ValidationError(
+          "/about is already used. Rename that item before creating an About page.",
+        );
+      }
+
+      const post = await deps.posts.create({
+        format: "note",
+        title: "About",
+        slug: ABOUT_PAGE_SLUG,
+        status: "published",
+        visibility: "latest_hidden",
+      });
+      return {
+        id: post.id,
+        title: post.title,
+        status: post.status,
+        visibility: post.visibility,
+      };
+    },
+  };
+}

package/src/services/export-theme/layouts/_default/rss.xml

@@ -23,7 +23,8 @@
         body    → Hugo-rendered .Content (stripped of <script>/<style>)
         rating  → <p>★★★★☆ 4/5</p>
         link    → trailing <p><a href=permalink> ★ </a></p>
-        replies → <hr/> + <p><small><time>{dt}</time></small></p> + content
+        replies → <hr/> + <p><small><time>{dt}</time></small></p>
+                  + inline title/link metadata + content
 
   Hugo's default RSS media-type override (`[outputFormats.RSS]`) makes this
   template produce application/atom+xml at /{section}/index.xml.

package/src/services/export-theme/layouts/partials/feed-post-content.xml

@@ -8,6 +8,8 @@
                      link-format "★" suffix)
     includeReplies — when true, appends each public reply separated by
                      <hr/> + <small><time></time></small>
+    inline         — when true, renders title/link metadata that top-level
+                     Atom entries expose through their entry fields
 
   Output is raw HTML suitable for embedding inside Atom
   <content type="html"><![CDATA[...]]></content>. Since CDATA ends at the
@@ -18,9 +20,31 @@
 {{- $post := .post -}}
 {{- $permalink := .permalink -}}
 {{- $includeReplies := .includeReplies -}}
+{{- $inline := false -}}
+{{- with .inline -}}{{- $inline = . -}}{{- end -}}
 {{- $format := $post.Params.format | default "note" -}}
 {{- $parts := slice -}}
 
+{{- /* --- Inline title/link metadata for thread replies --- */ -}}
+{{- if and $inline (ne $format "quote") -}}
+  {{- $title := $post.Title | default "" -}}
+  {{- $linkUrl := string ($post.Params.link_url | default "") -}}
+  {{- if eq $format "link" -}}
+    {{- if ne $linkUrl "" -}}
+      {{- $domain := $linkUrl -}}
+      {{- with urls.Parse $linkUrl -}}{{- if .Host -}}{{- $domain = replaceRE `^(www|m|mobile)\.` "" .Host -}}{{- end -}}{{- end -}}
+      {{- $parts = $parts | append (printf `<p><a href=%q>%s</a></p>` $linkUrl (transform.XMLEscape $domain)) -}}
+    {{- end -}}
+    {{- if ne $title "" -}}
+      {{- $titleHref := $permalink -}}
+      {{- if ne $linkUrl "" -}}{{- $titleHref = $linkUrl -}}{{- end -}}
+      {{- $parts = $parts | append (printf `<h2><a href=%q>%s</a></h2>` $titleHref (transform.XMLEscape $title)) -}}
+    {{- end -}}
+  {{- else if ne $title "" -}}
+    {{- $parts = $parts | append (printf `<h2><a href=%q>%s</a></h2>` $permalink (transform.XMLEscape $title)) -}}
+  {{- end -}}
+{{- end -}}
+
 {{- /* --- Quote block (format=quote) --- */ -}}
 {{- if eq $format "quote" -}}
   {{- $quoteText := string ($post.Params.quote_text | default "") -}}
@@ -100,7 +124,7 @@
     {{- $replyLabel := .Date.Format "Jan 2, 2006 15:04" -}}
     {{- $parts = $parts | append "<hr/>" -}}
     {{- $parts = $parts | append (printf `<p><small><time datetime=%q>%s</time></small></p>` $replyDatetime (transform.XMLEscape $replyLabel)) -}}
-    {{- $parts = $parts | append (partial "feed-post-content.xml" (dict "post" . "permalink" $replyPermalink "includeReplies" false)) -}}
+    {{- $parts = $parts | append (partial "feed-post-content.xml" (dict "post" . "permalink" $replyPermalink "includeReplies" false "inline" true)) -}}
   {{- end -}}
 {{- end -}}
 

package/src/services/export-theme/styles/main.css

@@ -84,13 +84,11 @@ h1 {
 
 h2 {
   font-size: var(--type-content-title);
-  font-style: italic;
   margin: 2.1rem 0 1.4rem;
 }
 
 h3 {
   font-size: var(--type-content-subtitle);
-  font-style: italic;
   margin: 2rem 0 1.4rem;
 }
 
@@ -119,6 +117,12 @@ kbd,
 samp {
   font-family: var(--font-mono);
   font-size: var(--type-code);
+  line-height: 1.42;
+}
+
+code {
+  color: var(--site-code-text);
+  overflow-wrap: break-word;
 }
 
 pre {
@@ -127,23 +131,26 @@ pre {
   line-height: 1.5;
   padding: 1rem;
   overflow-x: auto;
-  background-color: var(--site-feed-card-bg);
-  border: 1px solid var(--site-feed-card-border);
-  border-radius: 0.375rem;
+  color: var(--site-code-text);
+  background-color: var(--site-code-block-bg);
+  border: 1px solid var(--site-code-block-border);
+  border-radius: 6px;
 }
 
 pre code {
   padding: 0;
   background: transparent;
   border: 0;
+  color: inherit;
   font-size: inherit;
 }
 
 :not(pre) > code {
-  padding: 0.1em 0.35em;
-  background-color: var(--site-feed-card-bg);
-  border: 1px solid var(--site-feed-card-border);
-  border-radius: 0.25rem;
+  padding: 0.08em 0.28em;
+  background-color: var(--site-code-bg);
+  border-radius: 0.22em;
+  box-decoration-break: clone;
+  -webkit-box-decoration-break: clone;
 }
 
 /* Blockquotes — tinted background card with quote icon (matches main site). */
@@ -217,13 +224,13 @@ blockquote cite {
 
 ul,
 ol {
-  padding-left: 1.625em;
+  padding-left: 1.4em;
   margin: 1.25em 0;
 }
 
 li {
-  margin-top: 1.2em;
-  margin-bottom: 1.2em;
+  margin-top: 0.65em;
+  margin-bottom: 0.65em;
 }
 
 /* Normalize li > p so list spacing is controlled by li alone,
@@ -850,6 +857,31 @@ hr.feed-divider {
   color: var(--site-reading-body);
 }
 
+.post-card > .post-card-summary :is(h1, h2),
+.post-card > .post-card-quote-commentary :is(h1, h2) {
+  font-size: calc(var(--type-content-body) * 1.12);
+  font-weight: var(--fw-medium);
+  margin-top: 1.45rem;
+  margin-bottom: 0.55rem;
+}
+
+.post-card > .post-card-summary :is(h3, h4),
+.post-card > .post-card-quote-commentary :is(h3, h4) {
+  font-size: var(--type-content-body);
+  font-weight: var(--fw-medium);
+  margin-top: 1.2rem;
+  margin-bottom: 0.45rem;
+}
+
+.post-card > .post-card-summary :is(h5, h6),
+.post-card > .post-card-quote-commentary :is(h5, h6) {
+  font-size: var(--type-secondary);
+  font-weight: var(--fw-medium);
+  color: var(--site-text-secondary);
+  margin-top: 1rem;
+  margin-bottom: 0.35rem;
+}
+
 /* Link card domain row — shown ABOVE the title (matches main site's
    `.feed-link-domain` pattern). Inline flex with icon + host text. */
 .post-card-link-domain,
@@ -1009,8 +1041,8 @@ hr.feed-divider {
 .post-card-quote-content {
   font-family: var(--font-serif);
   color: var(--site-text-primary);
-  font-size: var(--type-content-subtitle);
-  line-height: var(--type-heading-leading);
+  font-size: var(--type-content-quote);
+  line-height: var(--type-content-quote-leading);
   white-space: pre-line;
   text-wrap: pretty;
   margin: 0;

package/src/services/index.ts

@@ -35,6 +35,7 @@ import {
   createSiteProfileService,
   type SiteProfileService,
 } from "./site-profile.js";
+import { createAboutPageService, type AboutPageService } from "./about-page.js";
 import {
   createUploadSessionService,
   type UploadSessionService,
@@ -64,6 +65,7 @@ export interface Services {
   siteAdmin: SiteAdminService;
   siteMembers: SiteMemberService;
   siteProfile: SiteProfileService;
+  aboutPage: AboutPageService;
   githubAppInstallations: GitHubAppInstallationsService;
   telegram: TelegramService;
 }
@@ -88,6 +90,23 @@ export function createServices(
   const settings = createSettingsService(db, siteId, databaseSchema, dialect);
   const paths = createPathService(db, siteId, databaseSchema);
   const navItems = createNavItemService(db, siteId, databaseSchema);
+  const posts = createPostService(
+    db,
+    {
+      slugIdLength: config?.slugIdLength ?? 5,
+      databaseDialect: dialect,
+    },
+    siteId,
+    paths,
+    databaseSchema,
+  );
+  const collections = createCollectionService(
+    db,
+    siteId,
+    paths,
+    databaseSchema,
+    dialect,
+  );
   const media = createMediaService(db, siteId, databaseSchema, dialect, {
     enforceHostedQuota: config?.enforceHostedMediaQuota ?? false,
     hostedControlPlane: config?.hostedControlPlane ?? null,
@@ -97,26 +116,11 @@ export function createServices(
     settings,
     site,
     paths,
-    posts: createPostService(
-      db,
-      {
-        slugIdLength: config?.slugIdLength ?? 5,
-        databaseDialect: dialect,
-      },
-      siteId,
-      paths,
-      databaseSchema,
-    ),
+    posts,
     customUrls: createCustomUrlService(db, siteId, paths, databaseSchema),
     media,
     uploads: createUploadSessionService(db, siteId, media, databaseSchema),
-    collections: createCollectionService(
-      db,
-      siteId,
-      paths,
-      databaseSchema,
-      dialect,
-    ),
+    collections,
     search: createSearchService(rawQuery, siteId, dialect),
     navItems,
     auth: createAuthService(
@@ -148,6 +152,11 @@ export function createServices(
         );
       },
     }),
+    aboutPage: createAboutPageService({
+      paths,
+      posts,
+      collections,
+    }),
     githubAppInstallations: createGitHubAppInstallationsService(
       db,
       databaseSchema,
@@ -166,6 +175,7 @@ export type { UploadSessionService } from "./upload-session.js";
 export type { CollectionService } from "./collection.js";
 export type { SearchService, SearchResult, SearchOptions } from "./search.js";
 export type { NavItemService } from "./navigation.js";
+export type { AboutPageService, AboutPageStatus } from "./about-page.js";
 export type { AuthService, DeleteAccountDeps } from "./auth.js";
 export type { ApiTokenService } from "./api-token.js";
 export type {

package/src/services/media.ts

@@ -32,10 +32,18 @@ import { renderTiptapJson } from "../lib/tiptap-render.js";
 import { tiptapJsonToMarkdown } from "../lib/tiptap-to-markdown.js";
 import {
   generateStorageKey,
+  imageExtensionForMimeType,
+  isAllowedSideloadImageType,
   SITE_ASSET_STORAGE_KEY_LIKE_PATTERN,
+  sniffImageMimeType,
   toMediaKind,
   validateUploadFileMetadata,
 } from "../lib/upload.js";
+import {
+  IMAGE_DIMENSION_PEEK_BYTES,
+  parseImageDimensions,
+} from "../lib/image-dimensions.js";
+import { assertPublicHttpUrl, fetchImageBytes } from "../lib/url-fetch.js";
 import type {
   Media,
   MediaKind,
@@ -57,6 +65,26 @@ import type { HostedControlPlaneClient } from "../lib/hosted-control-plane.js";
 
 const DEFAULT_MEDIA_POSITION = "a0";
 
+/**
+ * Derive a display filename from a remote image URL, falling back to
+ * `image.<ext>` when the path has no usable basename.
+ *
+ * @param url - The remote image URL
+ * @param ext - Extension to use when the URL path lacks one
+ * @returns A sanitized original filename
+ */
+function remoteImageName(url: URL, ext: string): string {
+  let base: string;
+  try {
+    base = decodeURIComponent(url.pathname.split("/").pop() ?? "");
+  } catch {
+    base = url.pathname.split("/").pop() ?? "";
+  }
+  base = base.trim().replace(/[\r\n"\\]+/g, "");
+  if (!base) return `image.${ext}`;
+  return base.includes(".") ? base : `${base}.${ext}`;
+}
+
 /**
  * Recycle-window length for deleted media storage objects. On delete we
  * hard-remove the DB row but defer deleting the underlying storage object
@@ -187,6 +215,12 @@ export interface TextAttachmentDeps {
   maxFileSizeMB: number;
 }
 
+export interface IngestFromUrlDeps {
+  storage: StorageDriver;
+  storageDriver: string;
+  maxFileSizeMB: number;
+}
+
 export interface MediaService {
   assertCanWriteBytes(additionalBytes: number): Promise<void>;
   getById(id: string): Promise<Media | null>;
@@ -195,6 +229,24 @@ export interface MediaService {
   getByPostIds(postIds: string[]): Promise<Map<string, Media[]>>;
   list(filters?: MediaFilters): Promise<Media[]>;
   create(data: CreateMediaData): Promise<Media>;
+  /**
+   * Fetch a remote image URL server-side and store it as the site's own media.
+   *
+   * Used to rehost images pasted from external articles: the server downloads
+   * the bytes (bypassing browser CORS), verifies they are a real image format,
+   * and stores them. The created row has `postId = null` like other compose
+   * uploads (reaped by the orphan sweep if the post is never published).
+   *
+   * @param input.url - The remote http(s) image URL
+   * @param input.alt - Optional alt text
+   * @param deps - Storage driver, provider name, and the max file size
+   * @returns The created media row
+   * @throws {ValidationError} For unsafe URLs, non-image content, or oversize files
+   */
+  ingestFromUrl(
+    input: { url: string; alt?: string },
+    deps: IngestFromUrlDeps,
+  ): Promise<Media>;
   /**
    * Validate media IDs: checks count limit and verifies all IDs exist in the database.
    * No-op when the array is empty.
@@ -788,6 +840,65 @@ export function createMediaService(
       return toMedia(result[0]!);
     },
 
+    async ingestFromUrl(input, deps) {
+      const url = assertPublicHttpUrl(input.url);
+      const maxBytes = deps.maxFileSizeMB * 1024 * 1024;
+
+      const { bytes } = await fetchImageBytes(url, {
+        maxBytes,
+        timeoutMs: 15000,
+      });
+
+      // Trust the bytes, not the server's content-type header: only store data
+      // we can positively identify as a supported image format. This blocks
+      // content-type spoofing (e.g. an HTML/script payload served as an image).
+      const sniffed = sniffImageMimeType(bytes);
+      const mimeType =
+        sniffed && isAllowedSideloadImageType(sniffed) ? sniffed : null;
+      if (!mimeType) {
+        throw new ValidationError(
+          "That URL didn't return a supported image. Try a different image.",
+        );
+      }
+
+      await assertCanWriteBytes(bytes.byteLength);
+
+      const dimensions = parseImageDimensions(
+        mimeType,
+        bytes.subarray(0, IMAGE_DIMENSION_PEEK_BYTES),
+      );
+      const ext = imageExtensionForMimeType(mimeType) ?? "bin";
+      const { id, filename, storageKey } = generateStorageKey(
+        siteId,
+        `image.${ext}`,
+      );
+      const originalName = remoteImageName(url, ext);
+
+      // SVG can carry scripts. Display still works via <img> (browsers disable
+      // scripting there), and attachment disposition makes direct navigation to
+      // the raw object download instead of render — neutralizing the XSS vector.
+      await deps.storage.put(storageKey, bytes, {
+        contentType: mimeType,
+        contentDisposition:
+          mimeType === "image/svg+xml" ? "attachment" : "inline",
+        cacheControl: "public, max-age=31536000, immutable",
+      });
+
+      return this.create({
+        id,
+        filename,
+        originalName,
+        mimeType,
+        size: bytes.byteLength,
+        storageKey,
+        provider: deps.storageDriver,
+        mediaKind: "image",
+        width: dimensions?.width,
+        height: dimensions?.height,
+        alt: input.alt?.trim() || undefined,
+      });
+    },
+
     async createTextAttachment(data, deps) {
       if (!deps.storage) {
         throw new ConfigurationError(