@jant/core 0.6.14 → 0.6.15

package/src/lib/worker-response-cache.ts

@@ -1,5 +1,7 @@
 import type { Bindings } from "../types.js";
 import { getConfiguredSingleSitePathPrefix } from "./env.js";
+import { POST_BODY_HTML_VERSION } from "./post-body-html.js";
+import { isRssFeedPath } from "./feed-path.js";
 import { stripSitePathPrefix } from "./url.js";
 
 const TRACKING_QUERY_PARAMS = [
@@ -21,6 +23,7 @@ const TRACKING_QUERY_PARAMS = [
 
 const AUTH_COOKIE_PATTERN =
   /(?:^|;\s*)(?:__Host-)?(?:__Secure-)?better-auth[.-][^=]+=/;
+const BODY_HTML_CACHE_VERSION_PARAM = "__jant_body_html";
 
 type ExecutionContextLike = {
   waitUntil(promise: Promise<unknown>): void;
@@ -50,13 +53,7 @@ export interface WorkerResponseCacheOptions {
  * @returns `true` when the request should be eligible for Worker response caching
  */
 export function isWorkerResponseCachePath(path: string): boolean {
-  if (path === "/feed" || path.startsWith("/feed/")) {
-    return true;
-  }
-
-  if (path === "/archive/feed" || path.startsWith("/archive/feed/")) {
-    return true;
-  }
+  if (isRssFeedPath(path)) return true;
 
   if (path === "/sitemap.xml" || path === "/robots.txt") {
     return true;
@@ -66,16 +63,6 @@ export function isWorkerResponseCachePath(path: string): boolean {
     return true;
   }
 
-  if (
-    path.endsWith("/feed") &&
-    !path.startsWith("/api/") &&
-    !path.startsWith("/settings") &&
-    !path.startsWith("/compose") &&
-    !path.startsWith("/_")
-  ) {
-    return true;
-  }
-
   return false;
 }
 
@@ -83,7 +70,9 @@ export function isWorkerResponseCachePath(path: string): boolean {
  * Normalize a public request URL for Worker cache lookup.
  *
  * Tracking parameters are removed so equivalent feed requests converge on one
- * cache entry while functional filters like `format` remain intact.
+ * cache entry while functional filters like `format` remain intact. A private
+ * body-HTML contract version invalidates cached feed markup across renderer
+ * deployments; it is only used for Cache API lookup and never forwarded.
  *
  * @param requestUrl - Full public request URL
  * @returns Normalized cache key URL
@@ -95,6 +84,10 @@ export function normalizeWorkerCacheKeyUrl(requestUrl: string): string {
     url.searchParams.delete(param);
   }
 
+  url.searchParams.set(
+    BODY_HTML_CACHE_VERSION_PARAM,
+    String(POST_BODY_HTML_VERSION),
+  );
   url.searchParams.sort();
   return url.toString();
 }

package/src/middleware/__tests__/public-content-access.test.ts

@@ -0,0 +1,91 @@
+import { describe, expect, it } from "vitest";
+import { createTestApp } from "../../__tests__/helpers/app.js";
+import { isRssFeedPath } from "../../lib/feed-path.js";
+import {
+  requirePublicApiAccess,
+  requirePublicApiEnabled,
+  requireRssFeedsEnabled,
+} from "../public-content-access.js";
+
+describe("public content access policies", () => {
+  it.each([
+    "/feed",
+    "/feed/latest",
+    "/feed/atom.xml",
+    "/latest/feed",
+    "/featured/feed/atom.xml",
+    "/archive/feed",
+    "/reading/feed",
+    "/settings-notes/feed",
+    "/collections/reading+movies/feed",
+  ])("recognizes %s as a feed path", (path) => {
+    expect(isRssFeedPath(path)).toBe(true);
+  });
+
+  it.each([
+    "/",
+    "/archive",
+    "/api/example/feed",
+    "/settings/feed",
+    "/compose/feed",
+    "/_/theme/feed",
+  ])("does not treat %s as a feed path", (path) => {
+    expect(isRssFeedPath(path)).toBe(false);
+  });
+
+  it("requires authentication for JSON reads when public access is off", async () => {
+    const { app, services } = createTestApp({ authenticated: false });
+    await services.settings.set("PUBLIC_API_ENABLED", "false");
+    app.get("/api/data", requirePublicApiAccess(), (c) => c.json({ ok: true }));
+
+    const response = await app.request("/api/data");
+
+    expect(response.status).toBe(401);
+  });
+
+  it("returns 404 for the dedicated public API even with a session", async () => {
+    const { app, services } = createTestApp({ authenticated: true });
+    await services.settings.set("PUBLIC_API_ENABLED", "false");
+    app.get("/api/public/data", requirePublicApiEnabled(), (c) =>
+      c.json({ ok: true }),
+    );
+
+    const response = await app.request("/api/public/data");
+
+    expect(response.status).toBe(404);
+  });
+
+  it("preserves session access when public JSON reads are off", async () => {
+    const { app, services } = createTestApp({ authenticated: true });
+    await services.settings.set("PUBLIC_API_ENABLED", "false");
+    app.get("/api/data", requirePublicApiAccess(), (c) => c.json({ ok: true }));
+
+    const response = await app.request("/api/data");
+
+    expect(response.status).toBe(200);
+  });
+
+  it("preserves Bearer-token access when public JSON reads are off", async () => {
+    const { app, services } = createTestApp({ authenticated: false });
+    await services.settings.set("PUBLIC_API_ENABLED", "false");
+    const { plaintext } = await services.apiTokens.create("Test client");
+    app.get("/api/data", requirePublicApiAccess(), (c) => c.json({ ok: true }));
+
+    const response = await app.request("/api/data", {
+      headers: { Authorization: `Bearer ${plaintext}` },
+    });
+
+    expect(response.status).toBe(200);
+  });
+
+  it("returns 404 for feed paths when feed publishing is off", async () => {
+    const { app, services } = createTestApp();
+    await services.settings.set("RSS_FEEDS_ENABLED", "false");
+    app.use("*", requireRssFeedsEnabled());
+    app.get("*", (c) => c.text("page"));
+
+    expect((await app.request("/settings-notes/feed")).status).toBe(404);
+    expect((await app.request("/settings/feed")).status).toBe(200);
+    expect((await app.request("/settings-notes")).status).toBe(200);
+  });
+});

package/src/middleware/config.ts

@@ -18,7 +18,7 @@ import {
 import { buildThemeStyle, resolveBuiltinTheme } from "../lib/theme.js";
 import {
   BUILTIN_FONT_THEMES,
-  getCjkSerifCssVariables,
+  getCjkFontCssVariables,
   getFontThemeCssVariables,
 } from "../ui/font-themes.js";
 
@@ -52,7 +52,7 @@ export function withConfig(): MiddlewareHandler<Env> {
       (f) => f.id === appConfig.fontThemeId,
     );
     const fontOverrides = {
-      ...getCjkSerifCssVariables(appConfig.cjkSerifFont),
+      ...getCjkFontCssVariables(appConfig.siteLanguage, appConfig.cjkSerifFont),
       ...(fontTheme ? getFontThemeCssVariables(fontTheme) : {}),
     };
 

package/src/middleware/public-content-access.ts

@@ -0,0 +1,87 @@
+/**
+ * Public machine-readable content access policies.
+ *
+ * These guards run after configuration has been resolved. They keep public
+ * HTML rendering independent from the optional JSON API and Atom surfaces.
+ */
+
+import type { MiddlewareHandler } from "hono";
+import type { Bindings } from "../types.js";
+import type { AppVariables } from "../types/app-context.js";
+import { isRssFeedPath } from "../lib/feed-path.js";
+import { requireAuthApi } from "./auth.js";
+
+type Env = { Bindings: Bindings; Variables: AppVariables };
+
+/**
+ * Return 404 when the dedicated public JSON API is disabled.
+ *
+ * Unlike shared read endpoints used by the dashboard, `/api/public/*` has an
+ * authenticated alternative under `/api/posts`, so session and token auth do
+ * not bypass this switch.
+ *
+ * @returns Hono middleware that makes the public API unavailable when disabled
+ * @example
+ * ```ts
+ * app.use("/api/public/*", requirePublicApiEnabled());
+ * ```
+ */
+export function requirePublicApiEnabled(): MiddlewareHandler<Env> {
+  return async (c, next) => {
+    if (
+      (c.req.method !== "GET" && c.req.method !== "HEAD") ||
+      c.var.appConfig.publicApiEnabled
+    ) {
+      return next();
+    }
+
+    return c.notFound();
+  };
+}
+
+/**
+ * Require normal authentication for shared JSON reads when public access is off.
+ *
+ * @returns Hono middleware that preserves session and Bearer-token access
+ * @example
+ * ```ts
+ * app.get("/api/search", requirePublicApiAccess(), searchHandler);
+ * ```
+ */
+export function requirePublicApiAccess(): MiddlewareHandler<Env> {
+  const requireAuthentication = requireAuthApi();
+
+  return async (c, next) => {
+    if (
+      (c.req.method !== "GET" && c.req.method !== "HEAD") ||
+      c.var.appConfig.publicApiEnabled
+    ) {
+      return next();
+    }
+
+    return requireAuthentication(c, next);
+  };
+}
+
+/**
+ * Return 404 for Atom endpoints when feed publishing is disabled.
+ *
+ * @returns Hono middleware that leaves non-feed requests unchanged
+ * @example
+ * ```ts
+ * app.use("*", requireRssFeedsEnabled());
+ * ```
+ */
+export function requireRssFeedsEnabled(): MiddlewareHandler<Env> {
+  return async (c, next) => {
+    if (
+      (c.req.method !== "GET" && c.req.method !== "HEAD") ||
+      c.var.appConfig.rssFeedsEnabled ||
+      !isRssFeedPath(new URL(c.req.url).pathname)
+    ) {
+      return next();
+    }
+
+    return c.notFound();
+  };
+}

package/src/node/__tests__/cli-export.test.ts

@@ -11,6 +11,8 @@ describe("jant export", () => {
   const tempDirs: string[] = [];
   const originalEnv = process.env.DATABASE_URL;
   const siteId = "sit_01jpyz1h3v4m7s2k8r5c9t0qbd";
+  const collectionId = "col_01jpyz1q6s4m8v2k5t9c3b7qdh";
+  const postId = "pst_01jpyz20kt5n9r3k8t6c4d2qhf";
 
   afterEach(async () => {
     if (originalEnv === undefined) {
@@ -44,6 +46,15 @@ describe("jant export", () => {
 
         INSERT INTO "site_setting" ("site_id", "key", "value", "updated_at")
         VALUES ('${siteId}', 'SITE_NAME', 'Test Site', 1773753605);
+
+        INSERT INTO "collection" ("id", "site_id", "title", "sort_order", "created_at", "updated_at")
+        VALUES ('${collectionId}', '${siteId}', 'Ideas', 'newest', 1773753606, 1773753606);
+
+        INSERT INTO "post" ("id", "site_id", "format", "status", "visibility", "thread_id", "created_at", "updated_at")
+        VALUES ('${postId}', '${siteId}', 'note', 'published', 'public', '${postId}', 1773753607, 1773753607);
+
+        INSERT INTO "thread_collection" ("site_id", "thread_id", "collection_id", "created_at", "position", "pinned_at")
+        VALUES ('${siteId}', '${postId}', '${collectionId}', 1773753608, 3, NULL);
       `);
     } finally {
       sqlite.close();
@@ -58,6 +69,9 @@ describe("jant export", () => {
     expect(output).toContain(
       `INSERT INTO "site_setting" ("site_id", "key", "value", "updated_at") VALUES('${siteId}', 'SITE_NAME', 'Test Site', 1773753605);`,
     );
+    expect(output).toContain(
+      `INSERT INTO "thread_collection" ("site_id", "thread_id", "collection_id", "created_at", "position", "pinned_at") VALUES('${siteId}', '${postId}', '${collectionId}', 1773753608, 3, NULL);`,
+    );
     expect(output).not.toContain("__drizzle_migrations");
     expect(logSpy).toHaveBeenCalledWith(
       `Exported Node database to ${exportPath}`,

package/src/node/__tests__/cli-migrate.test.ts

@@ -83,6 +83,12 @@ describe("jant migrate", () => {
     vi.doMock("../../../bin/lib/load-node-runtime.js", () => ({
       loadNodeRuntime: vi.fn(async () => ({ migrate })),
     }));
+    vi.doMock("../../../bin/lib/thread-collection-migration.js", () => ({
+      preflightThreadCollectionMigration: vi.fn(async () => ({
+        phase: "fresh",
+      })),
+      verifyThreadCollectionMigration: vi.fn(async () => undefined),
+    }));
 
     const logSpy = vi.spyOn(console, "log").mockImplementation(() => {});
 

package/src/node/__tests__/cli-site-snapshot.test.ts

@@ -16,6 +16,8 @@ const SNAPSHOT_COLLECTION_ID = "col_01jpyy08bc4w2h8r7m3q5t9kdn";
 const SNAPSHOT_NAV_ID = "nav_01jpyy0gqv4m7r2k8s5c1t9bdh";
 const SNAPSHOT_DIRECTORY_ITEM_ID = "cdi_01jpyy0r6s3m8v1k5t9q2b4gcn";
 const SNAPSHOT_POST_ID = "pst_01jpyy18fh4w2m7r8k3c5t9qdn";
+const SNAPSHOT_REPLY_ID = "pst_01jpyy1e6s4m8v2k5t9c3b7qdh";
+const SNAPSHOT_SECOND_COLLECTION_ID = "col_01jpyy0c4s7m8r1k5t9b3q6dgh";
 const SNAPSHOT_PATH_ID = "pth_01jpyy1k2v6m4s8r1t5c9b3qgh";
 const SNAPSHOT_MEDIA_ID = "med_01jpyy1vxh4m7s2k8r5c9t3qbn";
 const SNAPSHOT_AVATAR_MEDIA_ID = "med_01jpyy1zs6m4v8r2k5t9c3b7qh";
@@ -145,7 +147,7 @@ describe("jant site snapshot export/import", () => {
           '${SNAPSHOT_POST_ID}', 1774009200, 1774009200, 1774009200, 1774009200
         );
 
-        INSERT INTO "post_collection" ("site_id", "post_id", "collection_id", "created_at")
+        INSERT INTO "thread_collection" ("site_id", "thread_id", "collection_id", "created_at")
         VALUES ('${SNAPSHOT_SITE_ID}', '${SNAPSHOT_POST_ID}', '${SNAPSHOT_COLLECTION_ID}', 1774009200);
 
         INSERT INTO "path_registry" (
@@ -240,7 +242,7 @@ describe("jant site snapshot export/import", () => {
     );
     expect(meta).toEqual({
       format: "jant-site-snapshot",
-      version: 1,
+      version: 2,
       dialect: "sqlite",
       site: { id: SNAPSHOT_SITE_ID, key: SNAPSHOT_SITE_KEY },
     });
@@ -281,6 +283,16 @@ describe("jant site snapshot export/import", () => {
         poster_key: SNAPSHOT_POSTER_KEY,
       });
 
+      const collectionMembership = verifySqlite
+        .prepare(
+          `SELECT "thread_id", "collection_id" FROM "thread_collection" WHERE "site_id" = '${SNAPSHOT_SITE_ID}'`,
+        )
+        .get();
+      expect(collectionMembership).toEqual({
+        thread_id: SNAPSHOT_POST_ID,
+        collection_id: SNAPSHOT_COLLECTION_ID,
+      });
+
       const siteName = verifySqlite
         .prepare(
           `SELECT "value" FROM "site_setting" WHERE "site_id" = '${SNAPSHOT_SITE_ID}' AND "key" = 'SITE_NAME'`,
@@ -339,6 +351,197 @@ describe("jant site snapshot export/import", () => {
     );
   });
 
+  it("imports v1 per-post Collection rows as a Thread union", async () => {
+    const root = await mkdtemp(join(tmpdir(), "jant-site-snapshot-v1-"));
+    tempDirs.push(root);
+    const targetDbPath = join(root, "target.sqlite");
+    const snapshotPath = join(root, "snapshot");
+    await migrate({ DATABASE_URL: `file:${targetDbPath}` } as Bindings);
+
+    const sqlite = new Database(targetDbPath);
+    try {
+      sqlite.exec(`
+        INSERT INTO "site" ("id", "key", "status", "created_at", "updated_at")
+        VALUES ('${SNAPSHOT_SITE_ID}', '${SNAPSHOT_SITE_KEY}', 'active', 1, 1);
+      `);
+    } finally {
+      sqlite.close();
+    }
+
+    await mkdir(snapshotPath, { recursive: true });
+    await writeFile(
+      join(snapshotPath, "meta.json"),
+      JSON.stringify({
+        format: "jant-site-snapshot",
+        version: 1,
+        dialect: "sqlite",
+        site: { id: SNAPSHOT_SITE_ID, key: SNAPSHOT_SITE_KEY },
+      }),
+    );
+    await writeFile(
+      join(snapshotPath, "db.sql"),
+      `
+        INSERT INTO "collection" ("id", "site_id", "title", "sort_order", "created_at", "updated_at") VALUES('${SNAPSHOT_COLLECTION_ID}', '${SNAPSHOT_SITE_ID}', 'Ideas', 'newest', 10, 10);
+        INSERT INTO "collection" ("id", "site_id", "title", "sort_order", "created_at", "updated_at") VALUES('${SNAPSHOT_SECOND_COLLECTION_ID}', '${SNAPSHOT_SITE_ID}', 'Walks', 'newest', 10, 10);
+        INSERT INTO "post" ("id", "site_id", "format", "status", "visibility", "reply_to_id", "thread_id", "created_at", "updated_at") VALUES('${SNAPSHOT_POST_ID}', '${SNAPSHOT_SITE_ID}', 'note', 'published', 'public', NULL, '${SNAPSHOT_POST_ID}', 10, 10);
+        INSERT INTO "post" ("id", "site_id", "format", "status", "visibility", "reply_to_id", "thread_id", "created_at", "updated_at") VALUES('${SNAPSHOT_REPLY_ID}', '${SNAPSHOT_SITE_ID}', 'note', 'published', 'public', '${SNAPSHOT_POST_ID}', '${SNAPSHOT_POST_ID}', 11, 11);
+        INSERT INTO "post_collection" ("site_id", "post_id", "collection_id", "created_at", "position", "pinned_at") VALUES('${SNAPSHOT_SITE_ID}', '${SNAPSHOT_POST_ID}', '${SNAPSHOT_COLLECTION_ID}', 20, 5, 30);
+        INSERT INTO "post_collection" ("site_id", "post_id", "collection_id", "created_at", "position", "pinned_at") VALUES('${SNAPSHOT_SITE_ID}', '${SNAPSHOT_REPLY_ID}', '${SNAPSHOT_COLLECTION_ID}', 40, 2, 35);
+        INSERT INTO "post_collection" ("site_id", "post_id", "collection_id", "created_at", "position", "pinned_at") VALUES('${SNAPSHOT_SITE_ID}', '${SNAPSHOT_REPLY_ID}', '${SNAPSHOT_SECOND_COLLECTION_ID}', 25, 7, NULL);
+      `,
+    );
+
+    useLocalSnapshotRuntime(`file:${targetDbPath}`, join(root, "target-media"));
+    vi.spyOn(console, "log").mockImplementation(() => {});
+    const { run: runImport } =
+      await import("../../../bin/commands/site/snapshot/import.js");
+    await runImport(["--path", snapshotPath, "--replace"]);
+
+    const verifySqlite = new Database(targetDbPath, { readonly: true });
+    try {
+      const rows = verifySqlite
+        .prepare(
+          `SELECT "thread_id", "collection_id", "created_at", "position", "pinned_at" FROM "thread_collection" ORDER BY "collection_id"`,
+        )
+        .all();
+      expect(rows).toEqual([
+        {
+          thread_id: SNAPSHOT_POST_ID,
+          collection_id: SNAPSHOT_COLLECTION_ID,
+          created_at: 40,
+          position: 2,
+          pinned_at: 35,
+        },
+        {
+          thread_id: SNAPSHOT_POST_ID,
+          collection_id: SNAPSHOT_SECOND_COLLECTION_ID,
+          created_at: 25,
+          position: 7,
+          pinned_at: null,
+        },
+      ]);
+    } finally {
+      verifySqlite.close();
+    }
+  });
+
+  it("rejects malformed v1 memberships before clearing target content", async () => {
+    const root = await mkdtemp(
+      join(tmpdir(), "jant-site-snapshot-v1-preflight-"),
+    );
+    tempDirs.push(root);
+    const targetDbPath = join(root, "target.sqlite");
+    const snapshotPath = join(root, "snapshot");
+    await migrate({ DATABASE_URL: `file:${targetDbPath}` } as Bindings);
+
+    const sqlite = new Database(targetDbPath);
+    try {
+      sqlite.exec(`
+        INSERT INTO "site" ("id", "key", "status", "created_at", "updated_at")
+        VALUES ('${SNAPSHOT_SITE_ID}', '${SNAPSHOT_SITE_KEY}', 'active', 1, 1);
+        INSERT INTO "post" ("id", "site_id", "format", "status", "visibility", "thread_id", "created_at", "updated_at")
+        VALUES ('${SNAPSHOT_OLD_POST_ID}', '${SNAPSHOT_SITE_ID}', 'note', 'published', 'public', '${SNAPSHOT_OLD_POST_ID}', 1, 1);
+      `);
+    } finally {
+      sqlite.close();
+    }
+
+    await mkdir(snapshotPath, { recursive: true });
+    await writeFile(
+      join(snapshotPath, "meta.json"),
+      JSON.stringify({
+        format: "jant-site-snapshot",
+        version: 1,
+        dialect: "sqlite",
+        site: { id: SNAPSHOT_SITE_ID, key: SNAPSHOT_SITE_KEY },
+      }),
+    );
+    await writeFile(
+      join(snapshotPath, "db.sql"),
+      `INSERT INTO "post_collection" ("site_id", "post_id", "collection_id", "created_at", "position", "pinned_at") VALUES('${SNAPSHOT_SITE_ID}', 'pst_missing', '${SNAPSHOT_COLLECTION_ID}', 10, 0, NULL);`,
+    );
+
+    useLocalSnapshotRuntime(`file:${targetDbPath}`, join(root, "target-media"));
+    const { run: runImport } =
+      await import("../../../bin/commands/site/snapshot/import.js");
+    await expect(
+      runImport(["--path", snapshotPath, "--replace"]),
+    ).rejects.toThrow(/references missing post pst_missing/);
+
+    const verifySqlite = new Database(targetDbPath, { readonly: true });
+    try {
+      expect(
+        verifySqlite
+          .prepare(
+            `SELECT COUNT(*) FROM "post" WHERE "id" = '${SNAPSHOT_OLD_POST_ID}'`,
+          )
+          .pluck()
+          .get(),
+      ).toBe(1);
+    } finally {
+      verifySqlite.close();
+    }
+  });
+
+  it("rolls back a Node snapshot replacement when SQL replay fails", async () => {
+    const root = await mkdtemp(
+      join(tmpdir(), "jant-site-snapshot-atomic-replace-"),
+    );
+    tempDirs.push(root);
+    const targetDbPath = join(root, "target.sqlite");
+    const snapshotPath = join(root, "snapshot");
+    await migrate({ DATABASE_URL: `file:${targetDbPath}` } as Bindings);
+
+    const sqlite = new Database(targetDbPath);
+    try {
+      sqlite.exec(`
+        INSERT INTO "site" ("id", "key", "status", "created_at", "updated_at")
+        VALUES ('${SNAPSHOT_SITE_ID}', '${SNAPSHOT_SITE_KEY}', 'active', 1, 1);
+        INSERT INTO "post" ("id", "site_id", "format", "status", "visibility", "thread_id", "created_at", "updated_at")
+        VALUES ('${SNAPSHOT_OLD_POST_ID}', '${SNAPSHOT_SITE_ID}', 'note', 'published', 'public', '${SNAPSHOT_OLD_POST_ID}', 1, 1);
+      `);
+    } finally {
+      sqlite.close();
+    }
+
+    await mkdir(snapshotPath, { recursive: true });
+    await writeFile(
+      join(snapshotPath, "meta.json"),
+      JSON.stringify({
+        format: "jant-site-snapshot",
+        version: 2,
+        dialect: "sqlite",
+        site: { id: SNAPSHOT_SITE_ID, key: SNAPSHOT_SITE_KEY },
+      }),
+    );
+    await writeFile(
+      join(snapshotPath, "db.sql"),
+      `
+        INSERT INTO "post" ("id", "site_id", "format", "status", "visibility", "thread_id", "created_at", "updated_at")
+        VALUES ('${SNAPSHOT_POST_ID}', '${SNAPSHOT_SITE_ID}', 'note', 'published', 'public', '${SNAPSHOT_POST_ID}', 2, 2);
+        INSERT INTO "thread_collection" ("site_id", "thread_id", "collection_id", "created_at")
+        VALUES ('${SNAPSHOT_SITE_ID}', '${SNAPSHOT_POST_ID}', '${SNAPSHOT_COLLECTION_ID}', 2);
+      `,
+    );
+
+    useLocalSnapshotRuntime(`file:${targetDbPath}`, join(root, "target-media"));
+    const { run: runImport } =
+      await import("../../../bin/commands/site/snapshot/import.js");
+    await expect(
+      runImport(["--path", snapshotPath, "--replace"]),
+    ).rejects.toThrow(/FOREIGN KEY constraint failed/);
+
+    const verifySqlite = new Database(targetDbPath, { readonly: true });
+    try {
+      const postIds = verifySqlite
+        .prepare(`SELECT "id" FROM "post" WHERE "site_id" = ? ORDER BY "id"`)
+        .all(SNAPSHOT_SITE_ID);
+      expect(postIds).toEqual([{ id: SNAPSHOT_OLD_POST_ID }]);
+    } finally {
+      verifySqlite.close();
+    }
+  });
+
   it("skips downloading storage objects when --skip-objects is passed", async () => {
     const root = await mkdtemp(
       join(tmpdir(), "jant-site-snapshot-skip-objects-"),