@jant/core 0.6.15 → 0.6.16

package/src/lib/translit.ts

@@ -0,0 +1,288 @@
+/**
+ * Dictionary-free transliteration helpers for slug generation.
+ *
+ * These converters cover the scripts limax handles poorly:
+ *
+ * - Korean hangul → Revised Romanization (limax strips hangul entirely)
+ * - Japanese kana → Hepburn romaji (limax mangles long vowels and digraphs)
+ *
+ * Both are pure algorithms over Unicode code points — no dictionaries — so
+ * they stay small enough for the Workers bundle and the lazy client chunk.
+ * Japanese kanji is intentionally out of scope: readings are context-dependent
+ * and need a morphological dictionary, which is why `slugify` falls back to a
+ * random ID for kanji-heavy Japanese titles instead of guessing.
+ */
+
+/** Matches hiragana, katakana, and the chōonpu (ー) long-vowel mark. */
+export const KANA_RE = /[ぁ-ゖァ-ヺー]/u;
+
+/** Matches precomposed hangul syllables and compatibility jamo. */
+export const HANGUL_RE = /[가-힣ㄱ-ㆎ]/u;
+
+/** Matches Han (CJK ideograph) characters. */
+export const HAN_RE = /\p{Script=Han}/u;
+
+// --- Korean: Revised Romanization ---------------------------------------
+
+const HANGUL_SYLLABLE_BASE = 0xac00;
+const HANGUL_SYLLABLE_END = 0xd7a3;
+const VOWEL_COUNT = 21;
+const FINAL_COUNT = 28;
+
+// prettier-ignore
+const RR_INITIALS = [
+  "g", "kk", "n", "d", "tt", "r", "m", "b", "pp", "s",
+  "ss", "", "j", "jj", "ch", "k", "t", "p", "h",
+];
+
+// prettier-ignore
+const RR_VOWELS = [
+  "a", "ae", "ya", "yae", "eo", "e", "yeo", "ye", "o", "wa",
+  "wae", "oe", "yo", "u", "wo", "we", "wi", "yu", "eu", "ui", "i",
+];
+
+// Finals use their phonetic (syllable-final) value, e.g. ㅅ → "t".
+// prettier-ignore
+const RR_FINALS = [
+  "", "k", "k", "k", "n", "n", "n", "t", "l", "k", "m", "l", "l", "l",
+  "p", "l", "m", "p", "p", "t", "t", "ng", "t", "t", "k", "t", "p", "t",
+];
+
+// Liaison: when the next syllable starts with the silent initial ㅇ, the
+// final consonant is pronounced as that syllable's initial instead
+// (한국어 → han-gu-geo, not han-guk-eo). Each entry is
+// [what remains as the final, what carries over as the next initial].
+// ㅎ is dropped when carried (좋아 → joa); final ㅇ (ng) never carries.
+// prettier-ignore
+const RR_LIAISON: readonly (readonly [string, string])[] = [
+  ["", ""], ["", "g"], ["", "kk"], ["k", "s"], ["", "n"], ["n", "j"],
+  ["n", ""], ["", "d"], ["", "r"], ["l", "g"], ["l", "m"], ["l", "b"],
+  ["l", "s"], ["l", "t"], ["l", "p"], ["l", ""], ["", "m"], ["", "b"],
+  ["p", "s"], ["", "s"], ["", "ss"], ["ng", ""], ["", "j"], ["", "ch"],
+  ["", "k"], ["", "t"], ["", "p"], ["", ""],
+];
+
+// Standalone compatibility jamo (ㅋㅋㅋ, ㅠㅠ) — common in informal titles.
+const COMPAT_JAMO: Record<string, string> = {
+  ㄱ: "g",
+  ㄲ: "kk",
+  ㄴ: "n",
+  ㄷ: "d",
+  ㄸ: "tt",
+  ㄹ: "r",
+  ㅁ: "m",
+  ㅂ: "b",
+  ㅃ: "pp",
+  ㅅ: "s",
+  ㅆ: "ss",
+  ㅇ: "ng",
+  ㅈ: "j",
+  ㅉ: "jj",
+  ㅊ: "ch",
+  ㅋ: "k",
+  ㅌ: "t",
+  ㅍ: "p",
+  ㅎ: "h",
+  ㅏ: "a",
+  ㅐ: "ae",
+  ㅑ: "ya",
+  ㅒ: "yae",
+  ㅓ: "eo",
+  ㅔ: "e",
+  ㅕ: "yeo",
+  ㅖ: "ye",
+  ㅗ: "o",
+  ㅘ: "wa",
+  ㅙ: "wae",
+  ㅚ: "oe",
+  ㅛ: "yo",
+  ㅜ: "u",
+  ㅝ: "wo",
+  ㅞ: "we",
+  ㅟ: "wi",
+  ㅠ: "yu",
+  ㅡ: "eu",
+  ㅢ: "ui",
+  ㅣ: "i",
+};
+
+interface HangulSyllable {
+  initial: number;
+  vowel: number;
+  final: number;
+}
+
+function decomposeHangul(codePoint: number): HangulSyllable | null {
+  if (codePoint < HANGUL_SYLLABLE_BASE || codePoint > HANGUL_SYLLABLE_END) {
+    return null;
+  }
+  const index = codePoint - HANGUL_SYLLABLE_BASE;
+  return {
+    initial: Math.floor(index / (VOWEL_COUNT * FINAL_COUNT)),
+    vowel: Math.floor(index / FINAL_COUNT) % VOWEL_COUNT,
+    final: index % FINAL_COUNT,
+  };
+}
+
+/**
+ * Transliterates Korean hangul to Latin using Revised Romanization.
+ *
+ * Handles precomposed syllables with basic liaison (a final consonant before
+ * a silent-ㅇ syllable carries over as its initial) and standalone
+ * compatibility jamo. Assimilation sound rules (e.g. 종로 → "Jongno") are
+ * intentionally skipped — slugs need recognizable output, not phonetic
+ * perfection. Non-hangul characters pass through unchanged.
+ *
+ * @param text - Input text, possibly mixing hangul with other characters
+ * @returns Text with hangul replaced by its romanization
+ *
+ * @example
+ * ```ts
+ * hangulToLatin("안녕하세요"); // "annyeonghaseyo"
+ * hangulToLatin("한국어");     // "hangugeo" (liaison)
+ * hangulToLatin("개발 일지");  // "gaebal ilji"
+ * ```
+ */
+export function hangulToLatin(text: string): string {
+  const chars = [...text];
+  let out = "";
+  let carried: string | null = null;
+
+  for (const [i, char] of chars.entries()) {
+    const syllable = decomposeHangul(char.codePointAt(0) ?? 0);
+    if (!syllable) {
+      carried = null;
+      out += COMPAT_JAMO[char] ?? char;
+      continue;
+    }
+
+    const initial = carried ?? RR_INITIALS[syllable.initial] ?? "";
+    carried = null;
+    const next = decomposeHangul(chars[i + 1]?.codePointAt(0) ?? 0);
+    let final = RR_FINALS[syllable.final] ?? "";
+    if (syllable.final !== 0 && next && RR_INITIALS[next.initial] === "") {
+      const [remains, carry] = RR_LIAISON[syllable.final] ?? ["", ""];
+      final = remains;
+      carried = carry;
+    }
+    out += initial + (RR_VOWELS[syllable.vowel] ?? "") + final;
+  }
+  return out;
+}
+
+// --- Japanese: Hepburn romaji -------------------------------------------
+
+// prettier-ignore
+const KANA_BASE: Record<string, string> = {
+  あ: "a", い: "i", う: "u", え: "e", お: "o",
+  か: "ka", き: "ki", く: "ku", け: "ke", こ: "ko",
+  さ: "sa", し: "shi", す: "su", せ: "se", そ: "so",
+  た: "ta", ち: "chi", つ: "tsu", て: "te", と: "to",
+  な: "na", に: "ni", ぬ: "nu", ね: "ne", の: "no",
+  は: "ha", ひ: "hi", ふ: "fu", へ: "he", ほ: "ho",
+  ま: "ma", み: "mi", む: "mu", め: "me", も: "mo",
+  や: "ya", ゆ: "yu", よ: "yo",
+  ら: "ra", り: "ri", る: "ru", れ: "re", ろ: "ro",
+  わ: "wa", ゐ: "i", ゑ: "e", を: "o", ん: "n",
+  が: "ga", ぎ: "gi", ぐ: "gu", げ: "ge", ご: "go",
+  ざ: "za", じ: "ji", ず: "zu", ぜ: "ze", ぞ: "zo",
+  だ: "da", ぢ: "ji", づ: "zu", で: "de", ど: "do",
+  ば: "ba", び: "bi", ぶ: "bu", べ: "be", ぼ: "bo",
+  ぱ: "pa", ぴ: "pi", ぷ: "pu", ぺ: "pe", ぽ: "po",
+  ゔ: "vu",
+  ぁ: "a", ぃ: "i", ぅ: "u", ぇ: "e", ぉ: "o",
+  ゃ: "ya", ゅ: "yu", ょ: "yo", ゎ: "wa",
+};
+
+// Digraphs and extended katakana combos (ファ, ティ, チェ, …). Keys are the
+// hiragana-normalized two-character sequences.
+// prettier-ignore
+const KANA_COMBO: Record<string, string> = {
+  きゃ: "kya", きゅ: "kyu", きょ: "kyo",
+  ぎゃ: "gya", ぎゅ: "gyu", ぎょ: "gyo",
+  しゃ: "sha", しゅ: "shu", しょ: "sho",
+  じゃ: "ja", じゅ: "ju", じょ: "jo",
+  ちゃ: "cha", ちゅ: "chu", ちょ: "cho",
+  ぢゃ: "ja", ぢゅ: "ju", ぢょ: "jo",
+  にゃ: "nya", にゅ: "nyu", にょ: "nyo",
+  ひゃ: "hya", ひゅ: "hyu", ひょ: "hyo",
+  びゃ: "bya", びゅ: "byu", びょ: "byo",
+  ぴゃ: "pya", ぴゅ: "pyu", ぴょ: "pyo",
+  みゃ: "mya", みゅ: "myu", みょ: "myo",
+  りゃ: "rya", りゅ: "ryu", りょ: "ryo",
+  ふぁ: "fa", ふぃ: "fi", ふぇ: "fe", ふぉ: "fo",
+  てぃ: "ti", でぃ: "di", とぅ: "tu", どぅ: "du",
+  うぃ: "wi", うぇ: "we", うぉ: "wo",
+  ゔぁ: "va", ゔぃ: "vi", ゔぇ: "ve", ゔぉ: "vo",
+  ちぇ: "che", しぇ: "she", じぇ: "je",
+  つぁ: "tsa", つぃ: "tsi", つぇ: "tse", つぉ: "tso",
+  いぇ: "ye",
+};
+
+const KATAKANA_START = 0x30a1;
+const KATAKANA_END = 0x30f6;
+const KATAKANA_TO_HIRAGANA_SHIFT = 0x60;
+const SOKUON = "っ";
+const CHOONPU = "ー";
+
+function normalizeToHiragana(char: string): string {
+  const codePoint = char.codePointAt(0) ?? 0;
+  if (codePoint >= KATAKANA_START && codePoint <= KATAKANA_END) {
+    return String.fromCodePoint(codePoint - KATAKANA_TO_HIRAGANA_SHIFT);
+  }
+  return char;
+}
+
+/**
+ * Transliterates Japanese kana to macron-less Hepburn romaji.
+ *
+ * Handles hiragana and katakana, digraphs (きゃ → "kya"), extended katakana
+ * loan combos (ファ → "fa"), sokuon gemination (まっちゃ → "matcha"), and
+ * drops the chōonpu long-vowel mark (ハンバーガー → "hanbaga"), matching how
+ * macrons are conventionally stripped in URLs. Kanji and other non-kana
+ * characters pass through unchanged.
+ *
+ * @param text - Input text, possibly mixing kana with other characters
+ * @returns Text with kana replaced by romaji
+ *
+ * @example
+ * ```ts
+ * kanaToRomaji("カタカナタイトル"); // "katakanataitoru"
+ * kanaToRomaji("ハンバーガー");     // "hanbaga"
+ * kanaToRomaji("まっちゃ");         // "matcha"
+ * ```
+ */
+export function kanaToRomaji(text: string): string {
+  const chars = [...text].map(normalizeToHiragana);
+  let out = "";
+  let geminate = false;
+
+  for (let i = 0; i < chars.length; i++) {
+    const char = chars[i] ?? "";
+    if (char === SOKUON) {
+      geminate = true;
+      continue;
+    }
+    if (char === CHOONPU) {
+      geminate = false;
+      continue;
+    }
+
+    const combo = KANA_COMBO[char + (chars[i + 1] ?? "")];
+    const romaji = combo ?? KANA_BASE[char];
+    if (combo) i++;
+    if (romaji === undefined) {
+      geminate = false;
+      out += char;
+      continue;
+    }
+    if (geminate) {
+      geminate = false;
+      if (/^[^aeiou]/.test(romaji)) {
+        out += romaji.startsWith("ch") ? "t" : (romaji[0] ?? "");
+      }
+    }
+    out += romaji;
+  }
+  return out;
+}

package/src/lib/url.ts

@@ -4,6 +4,14 @@
 
 import limax from "limax";
 
+import {
+  HAN_RE,
+  HANGUL_RE,
+  KANA_RE,
+  hangulToLatin,
+  kanaToRomaji,
+} from "./translit.js";
+
 function normalizeSitePathname(pathname: string): string {
   if (pathname === "/" || pathname === "") return "";
   const trimmed = pathname.replace(/\/+$/, "");
@@ -133,14 +141,66 @@ export function toSameSitePath(url: string, siteOrigin: string): string | null {
   return `${parsed.pathname}${parsed.search}${parsed.hash}` || "/";
 }
 
+const HAN_GLOBAL_RE = /\p{Script=Han}/gu;
+const CONTENT_CHAR_RE = /[\p{L}\p{N}]/u;
+const ASCII_ALNUM_RE = /[a-zA-Z0-9]/;
+
+/**
+ * Minimum fraction of a title's letters/digits the transliteration pipeline
+ * must handle for the result to be usable. Below this, too much meaning is
+ * lost (e.g. mixed kanji+kana Japanese where the semantic core is kanji, or
+ * scripts limax drops entirely) and `slugify` returns "" so callers fall back
+ * to their random-ID path instead of shipping a garbled slug.
+ */
+const SLUG_COVERAGE_THRESHOLD = 0.75;
+
+/** Per-character limax probe cache: does this char transliterate to anything? */
+const charCoverageCache = new Map<string, boolean>();
+
+function isCharCovered(char: string): boolean {
+  if (ASCII_ALNUM_RE.test(char)) return true;
+  let covered = charCoverageCache.get(char);
+  if (covered === undefined) {
+    covered = limax(char, { tone: false }).length > 0;
+    charCoverageCache.set(char, covered);
+  }
+  return covered;
+}
+
+function slugCoverage(text: string, japanese: boolean): number {
+  let content = 0;
+  let covered = 0;
+  for (const char of text) {
+    if (!CONTENT_CHAR_RE.test(char)) continue;
+    content++;
+    if (KANA_RE.test(char) || HANGUL_RE.test(char)) {
+      covered++;
+    } else if (japanese && HAN_RE.test(char)) {
+      // Kanji in a kana-containing title is dropped, never pinyin-read.
+    } else if (isCharCovered(char)) {
+      covered++;
+    }
+  }
+  return content === 0 ? 0 : covered / content;
+}
+
 /**
  * Converts text to a URL-friendly slug.
  *
- * Transforms text into a lowercase, hyphen-separated slug using limax for
- * i18n-aware transliteration (CJK → Pinyin, Japanese → Romaji, accented → ASCII).
+ * Transliterates i18n text to Latin before slugifying: Korean hangul via
+ * Revised Romanization, Japanese kana via Hepburn romaji (both in-house, see
+ * `translit.ts`), everything else (Han → pinyin, Cyrillic, accents, …) via
+ * limax. When the title contains kana it is treated as Japanese and Han
+ * characters are dropped rather than misread as Chinese pinyin; Han without
+ * kana is treated as Chinese.
+ *
+ * Returns `""` when transliteration would lose too much of the title (see
+ * `SLUG_COVERAGE_THRESHOLD`) — every caller treats an empty base as "no
+ * usable title" and falls back to a random ID, which beats publishing a
+ * garbled slug.
  *
  * @param text - The text to convert to a slug
- * @returns The slugified string
+ * @returns The slugified string, or `""` when no usable slug can be derived
  *
  * @example
  * ```ts
@@ -149,10 +209,29 @@ export function toSameSitePath(url: string, siteOrigin: string): string | null {
  *
  * slugify("书评");
  * // Returns: "shu-ping"
+ *
+ * slugify("안녕하세요 세계");
+ * // Returns: "annyeonghaseyo-segye"
+ *
+ * slugify("ハンバーガー");
+ * // Returns: "hanbaga"
+ *
+ * slugify("日本語のタイトルです");
+ * // Returns: "" (kanji carries the meaning and can't be transliterated)
  * ```
  */
 export function slugify(text: string): string {
-  return limax(text, { tone: false }).replace(/_/g, "-");
+  const japanese = KANA_RE.test(text);
+  let pre = text;
+  if (japanese) {
+    pre = kanaToRomaji(pre.replace(HAN_GLOBAL_RE, " "));
+  }
+  if (HANGUL_RE.test(pre)) {
+    pre = hangulToLatin(pre);
+  }
+  const base = limax(pre, { tone: false }).replace(/_/g, "-");
+  if (!base) return "";
+  return slugCoverage(text, japanese) >= SLUG_COVERAGE_THRESHOLD ? base : "";
 }
 
 /**
@@ -183,6 +262,25 @@ export function extractDisplayDomain(url: string): string | null {
 }
 
 const SAFE_URL_PROTOCOLS = new Set(["http:", "https:", "mailto:"]);
+const SAFE_RICH_TEXT_HREF_PROTOCOLS = new Set([
+  ...SAFE_URL_PROTOCOLS,
+  "tel:",
+  "sms:",
+]);
+
+function sanitizeUrlWithProtocols(
+  url: string,
+  protocols: ReadonlySet<string>,
+): string {
+  try {
+    const parsed = new URL(url, "https://placeholder.invalid");
+    // Relative URLs resolve against the placeholder and get https: — allow them
+    if (protocols.has(parsed.protocol)) return url;
+    return "";
+  } catch {
+    return "";
+  }
+}
 
 /**
  * Checks whether a string is a safe absolute URL.
@@ -231,14 +329,27 @@ export function isSafeAbsoluteUrl(url: string): boolean {
  * ```
  */
 export function sanitizeUrl(url: string): string {
-  try {
-    const parsed = new URL(url, "https://placeholder.invalid");
-    // Relative URLs resolve against the placeholder and get https: — allow them
-    if (SAFE_URL_PROTOCOLS.has(parsed.protocol)) return url;
-    return "";
-  } catch {
-    return "";
-  }
+  return sanitizeUrlWithProtocols(url, SAFE_URL_PROTOCOLS);
+}
+
+/**
+ * Sanitizes a rich-text link destination.
+ *
+ * In addition to safe web and email URLs, rich-text links may launch the
+ * device's phone or messaging app through `tel:` and `sms:`. Relative links
+ * remain valid, while executable and resource-only protocols are rejected.
+ *
+ * @param url - The link destination to sanitize
+ * @returns The original URL if safe for an anchor, or an empty string otherwise
+ *
+ * @example
+ * ```ts
+ * sanitizeRichTextHref("sms:+15551234567"); // "sms:+15551234567"
+ * sanitizeRichTextHref("javascript:alert(1)"); // ""
+ * ```
+ */
+export function sanitizeRichTextHref(url: string): string {
+  return sanitizeUrlWithProtocols(url, SAFE_RICH_TEXT_HREF_PROTOCOLS);
 }
 
 /**

package/src/lib/view.ts

@@ -406,6 +406,34 @@ export function toPostView(
   };
 }
 
+/**
+ * Resolves the unpublished draft sitting at the end of a Thread, if any.
+ *
+ * Both maps come from the same ordering over the same rows, differing only in
+ * whether drafts are eligible — so when they disagree, the draft-inclusive
+ * answer is by definition unpublished. No status lookup needed.
+ *
+ * @param threadId - Thread root ID to look up
+ * @param publishedTails - Tails from `getThreadTailIds(ids)`
+ * @param draftInclusiveTails - Tails from `getThreadTailIds(ids, { includeDrafts: true })`
+ * @returns The trailing draft's Post ID, or undefined when the Thread ends
+ *   on a published Post
+ * @example
+ * ```ts
+ * const draftTailId = resolveDraftTailId(post.threadId, tails, draftTails);
+ * if (draftTailId) view.draftTailId = draftTailId;
+ * ```
+ */
+export function resolveDraftTailId(
+  threadId: string,
+  publishedTails: Map<string, string>,
+  draftInclusiveTails: Map<string, string>,
+): string | undefined {
+  const withDrafts = draftInclusiveTails.get(threadId);
+  if (!withDrafts) return undefined;
+  return withDrafts === publishedTails.get(threadId) ? undefined : withDrafts;
+}
+
 /**
  * Batch converts PostWithMedia[] to PostView[].
  *

package/src/routes/api/__tests__/palette.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, it } from "vitest";
+import { createTestApp } from "../../../__tests__/helpers/app.js";
+import { paletteApiRoutes } from "../palette.js";
+
+describe("Command palette API", () => {
+  it("includes post status so clients can route drafts to preview", async () => {
+    const { app, services } = createTestApp({ authenticated: true });
+    app.route("/api/palette", paletteApiRoutes);
+
+    const draft = await services.posts.create({
+      format: "note",
+      title: "Draft destination",
+      bodyMarkdown: "Not published yet.",
+      status: "draft",
+    });
+    const published = await services.posts.create({
+      format: "note",
+      title: "Published destination",
+      bodyMarkdown: "Already published.",
+      status: "published",
+    });
+
+    const response = await app.request("/api/palette");
+    const body = (await response.json()) as {
+      items: Array<Record<string, unknown>>;
+    };
+
+    expect(response.status).toBe(200);
+    expect(body.items).toContainEqual({
+      title: "Draft destination",
+      path: draft.slug,
+      type: "post",
+      format: "note",
+      status: "draft",
+    });
+    expect(body.items).toContainEqual({
+      title: "Published destination",
+      path: published.slug,
+      type: "post",
+      format: "note",
+      status: "published",
+    });
+  });
+});

package/src/routes/api/posts.ts

@@ -131,12 +131,15 @@ postsApiRoutes.get("/:id/content", requireAuthApi(), async (c) => {
 postsApiRoutes.get("/:id", requireAuthApi(), async (c) => {
   const id = parseIdParam(c.req.param("id"), ID_PREFIX.post);
 
-  // Fetch post, media, and collections in parallel (all keyed by the same id)
-  const [post, mediaList, threadCollections] = await Promise.all([
-    c.var.services.posts.getById(id),
-    c.var.services.media.getByPostId(id),
-    c.var.services.collections.getCollectionsByPostId(id),
-  ]);
+  // Fetch post, media, collections and thread position in parallel (all keyed
+  // by the same id)
+  const [post, mediaList, threadCollections, threadPosition] =
+    await Promise.all([
+      c.var.services.posts.getById(id),
+      c.var.services.media.getByPostId(id),
+      c.var.services.collections.getCollectionsByPostId(id),
+      c.var.services.posts.getThreadPosition(id),
+    ]);
   const foundPost = assertFound(post, "Post");
   const {
     r2PublicUrl,
@@ -147,8 +150,8 @@ postsApiRoutes.get("/:id", requireAuthApi(), async (c) => {
   } = c.var.appConfig;
   const collectionIds = threadCollections.map((col) => col.id);
 
-  return c.json(
-    toApiPost(foundPost, {
+  return c.json({
+    ...toApiPost(foundPost, {
       collectionIds,
       attachments: mediaList.map((m) =>
         toApiAttachment(
@@ -161,7 +164,8 @@ postsApiRoutes.get("/:id", requireAuthApi(), async (c) => {
         ),
       ),
     }),
-  );
+    threadPosition,
+  });
 });
 
 // Create post (requires auth)

package/src/routes/api/public/__tests__/posts.test.ts

@@ -53,6 +53,44 @@ describe("Public Posts API Routes", () => {
       expect(body.posts[0]).not.toHaveProperty("body");
     });
 
+    // Consumers need both axes: `lastActivityAt` answers "when was this
+    // announced", `threadUpdatedAt` answers "when did it actually change".
+    // Exposing only the first left no way to tell a quiet addition happened.
+    it("reports both thread activity timestamps", async () => {
+      const { app, services } = createTestApp({ authenticated: false });
+      app.route("/api/public/posts", publicPostsApiRoutes);
+
+      const root = await services.posts.create({
+        format: "note",
+        title: "Quietly extended",
+        bodyMarkdown: "root",
+        publishedAt: 1000,
+      });
+      await services.posts.create({
+        format: "note",
+        bodyMarkdown: "quiet addendum",
+        replyToId: root.id,
+        publishedAt: 3000,
+        quietReply: true,
+      });
+
+      const res = await app.request("/api/public/posts");
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as {
+        posts: {
+          title: string | null;
+          quietReply: boolean;
+          lastActivityAt: number;
+          threadUpdatedAt: number;
+        }[];
+      };
+
+      const entry = body.posts.find((p) => p.title === "Quietly extended");
+      expect(entry?.lastActivityAt).toBe(1000);
+      expect(entry?.threadUpdatedAt).toBe(3000);
+      expect(entry?.quietReply).toBe(false);
+    });
+
     it("supports format and limit filters", async () => {
       const { app, services } = createTestApp({ authenticated: false });
       app.route("/api/public/posts", publicPostsApiRoutes);

package/src/routes/api/public/posts.ts

@@ -61,10 +61,15 @@ export type PublicPostBaseResponse = {
   previewImageUrl: string | null;
   replyToId: string | null;
   threadId: string;
+  /** Reply published without announcing its Thread. Always false on roots. */
+  quietReply: boolean;
   pinnedAt: number | null;
   featuredAt: number | null;
   publishedAt: number | null;
+  /** Root only: newest post in the Thread, quiet replies excluded. */
   lastActivityAt: number;
+  /** Root only: newest post in the Thread, quiet replies included. */
+  threadUpdatedAt: number;
   createdAt: number;
   updatedAt: number;
   attachments: ReturnType<typeof toApiAttachment>[];
@@ -146,10 +151,12 @@ export function toPublicPost(
     previewImageUrl,
     replyToId: post.replyToId,
     threadId: post.threadId,
+    quietReply: post.quietReply,
     pinnedAt: post.pinnedAt,
     featuredAt: post.featuredAt,
     publishedAt: post.publishedAt,
     lastActivityAt: post.lastActivityAt,
+    threadUpdatedAt: post.threadUpdatedAt,
     createdAt: post.createdAt,
     updatedAt: post.updatedAt,
     attachments: mediaList.map((media) =>

package/src/routes/compose.tsx

@@ -211,7 +211,9 @@ composeRoutes.post("/thread", async (c) => {
     postSchemas.map((data, index) => ({
       data: {
         format: data.format,
-        slug: index === 0 ? data.slug || undefined : undefined,
+        // Every post may carry its own permalink; blank means the service
+        // generates one (title-derived for the root, random id for replies).
+        slug: data.slug || undefined,
         title:
           data.format === "quote"
             ? data.sourceName || undefined
@@ -229,7 +231,9 @@ composeRoutes.post("/thread", async (c) => {
         collectionIds: index === 0 ? data.collectionIds : undefined,
         replyToId: index === 0 ? data.replyToId : undefined,
         quietReply: data.quietReply,
-        publishedAt: index === 0 ? data.publishedAt : undefined,
+        // Replies may carry their own date; when they don't, the service
+        // inherits the root's rather than stamping "now".
+        publishedAt: data.publishedAt,
       },
       attachments: data.attachments,
     })),