@jant/core 0.6.16 → 0.7.1

package/src/client-site.ts

@@ -2,14 +2,21 @@
  * Static site client entry point (Hugo theme).
  *
  * Loaded on exported Hugo sites to enable reading-surface interactions —
- * media lightbox, feed video autoplay, audio waveform, and gallery scroll
- * hints. Does NOT include Datastar, auth, toast, or form plumbing; those
- * are runtime-only concerns for the authenticated app.
+ * media lightbox, feed video autoplay, audio waveform, gallery scroll hints,
+ * and the thread-context shell. Does NOT include Datastar, auth, toast, or
+ * form plumbing; those are runtime-only concerns for the authenticated app.
  */
 
 import "./client/audio-player.js";
 import "./client/feed-video-player.js";
 import "./client/media-scroll-hint.js";
 import "./client/site-header-nav.js";
+// A thread preview's ancestor context is server-rendered collapsed, and its
+// "Show more" is the only way back out of that. Off-site pages render the same
+// shell — the Hugo export's own thread-preview partial had to leave the shell
+// out entirely because this was missing — so the reading surface owes them the
+// script that makes it work. It binds on DOMContentLoaded to
+// `[data-thread-context-toggle]` and does nothing on a page carrying none.
+import "./client/thread-context.js";
 import "./client/components/jant-media-lightbox.js";
 import "./styles/site-media.css";

package/src/client.ts

@@ -11,8 +11,12 @@ import "./client/audio-player.js";
 import "./client/feed-video-player.js";
 import "./client/media-scroll-hint.js";
 import "./client/form-enter-submit.js";
+import "./client/copy-field.js";
 import "./client/components/jant-media-lightbox.js";
 import "./client/components/jant-text-preview.js";
+// First-run setup is a signed-out page, so the language picker it shares with
+// the settings page has to ship in the public bundle.
+import "./client/components/jant-locale-picker.js";
 import "./client/toast.js";
 import "./client/thread-context.js";
 import "./client/note-expand.js";

package/src/db/__tests__/backfill-nav-label-mirrors.test.ts

@@ -0,0 +1,149 @@
+/**
+ * Executes the real 0006 backfill SQL against snapshot-shaped nav rows.
+ *
+ * The backfill runs on user data through `jant migrate`, and the same file is
+ * executed on both SQLite and Postgres, so it has to be portable and safe to
+ * rerun. These tests cover the SQLite side; the SQL avoids dialect-specific
+ * syntax (no `UPDATE ... FROM`, only correlated subqueries).
+ */
+
+import { readFileSync } from "fs";
+import { resolve } from "path";
+import type BetterSqlite3 from "better-sqlite3";
+import { beforeEach, describe, expect, it } from "vitest";
+import {
+  createTestDatabase,
+  DEFAULT_TEST_SITE_ID,
+} from "../../__tests__/helpers/db.js";
+
+const BACKFILL_SQL = readFileSync(
+  resolve(
+    import.meta.dirname,
+    "../backfills/0006_clear_mirrored_page_nav_labels.sql",
+  ),
+  "utf-8",
+);
+
+const POST_ID = "pst_backfill00000000000000001";
+const COLLECTION_ID = "col_backfill00000000000000001";
+
+describe("0006 backfill — clear nav labels that mirror their target", () => {
+  let sqlite: BetterSqlite3.Database;
+
+  function runBackfill() {
+    sqlite.exec(BACKFILL_SQL);
+  }
+
+  function labelOf(id: string): string {
+    const row = sqlite
+      .prepare(`SELECT label FROM nav_item WHERE id = ?`)
+      .get(id) as { label: string };
+    return row.label;
+  }
+
+  function insertNavItem(row: {
+    id: string;
+    type: "page" | "collection" | "link";
+    label: string;
+    position?: string;
+    postId?: string;
+    collectionId?: string;
+  }) {
+    sqlite
+      .prepare(
+        `INSERT INTO nav_item (
+           id, site_id, type, post_id, collection_id, label, url,
+           placement, position, created_at, updated_at
+         ) VALUES (?, ?, ?, ?, ?, ?, '/x', 'header', ?, 1, 1)`,
+      )
+      .run(
+        row.id,
+        DEFAULT_TEST_SITE_ID,
+        row.type,
+        row.postId ?? null,
+        row.collectionId ?? null,
+        row.label,
+        row.position ?? "a0",
+      );
+  }
+
+  beforeEach(() => {
+    sqlite = createTestDatabase().sqlite;
+    sqlite
+      .prepare(
+        `INSERT INTO post (
+           id, site_id, format, status, visibility, title, thread_id,
+           published_at, last_activity_at, created_at, updated_at
+         ) VALUES (?, ?, 'note', 'published', 'latest_hidden', 'About me', ?, 1, 1, 1, 1)`,
+      )
+      .run(POST_ID, DEFAULT_TEST_SITE_ID, POST_ID);
+    sqlite
+      .prepare(
+        `INSERT INTO collection (id, site_id, title, sort_order, created_at, updated_at)
+         VALUES (?, ?, 'Design Notes', 'newest', 1, 1)`,
+      )
+      .run(COLLECTION_ID, DEFAULT_TEST_SITE_ID);
+  });
+
+  it("clears a page label that only mirrors the post title", () => {
+    insertNavItem({
+      id: "nav_mirror0000000000000000001",
+      type: "page",
+      label: "About me",
+      postId: POST_ID,
+    });
+
+    runBackfill();
+
+    expect(labelOf("nav_mirror0000000000000000001")).toBe("");
+  });
+
+  it("clears a collection label that only mirrors the collection title", () => {
+    insertNavItem({
+      id: "nav_mirror0000000000000000002",
+      type: "collection",
+      label: "Design Notes",
+      collectionId: COLLECTION_ID,
+    });
+
+    runBackfill();
+
+    expect(labelOf("nav_mirror0000000000000000002")).toBe("");
+  });
+
+  it("keeps a label the author typed", () => {
+    insertNavItem({
+      id: "nav_custom0000000000000000001",
+      type: "page",
+      label: "Colophon",
+      postId: POST_ID,
+    });
+    insertNavItem({
+      id: "nav_custom0000000000000000002",
+      type: "link",
+      label: "About me",
+      position: "a1",
+    });
+
+    runBackfill();
+
+    expect(labelOf("nav_custom0000000000000000001")).toBe("Colophon");
+    // A free-form link has no target to follow, so its label is never cleared
+    // even when it happens to read like one.
+    expect(labelOf("nav_custom0000000000000000002")).toBe("About me");
+  });
+
+  it("is safe to rerun", () => {
+    insertNavItem({
+      id: "nav_mirror0000000000000000003",
+      type: "page",
+      label: "About me",
+      postId: POST_ID,
+    });
+
+    runBackfill();
+    runBackfill();
+
+    expect(labelOf("nav_mirror0000000000000000003")).toBe("");
+  });
+});

package/src/db/__tests__/d1-query.test.ts

@@ -1,3 +1,4 @@
+import { existsSync, readFileSync } from "node:fs";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const { runLocalWranglerMock } = vi.hoisted(() => ({
@@ -8,7 +9,7 @@ vi.mock("../../../bin/lib/wrangler-cli.js", () => ({
   runLocalWrangler: runLocalWranglerMock,
 }));
 
-const { executeD1, parseWranglerError, queryD1 } =
+const { exceedsInlineCommandLimit, executeD1, parseWranglerError, queryD1 } =
   await import("../../../bin/lib/d1-query.js");
 
 function createWranglerError(stderr) {
@@ -124,3 +125,57 @@ describe("d1-query Wrangler error parsing", () => {
     );
   });
 });
+
+/**
+ * Oversized statement batches.
+ *
+ * A batch travels to Wrangler as one `--command=` argument, and Linux caps a
+ * single argv entry at 128 KiB (`MAX_ARG_STRLEN`). macOS has no such cap, so
+ * the first snapshot whose `db.sql` grew past it imported fine on a Mac and
+ * failed CI with `E2BIG`. Anything that large has to go through `--file`.
+ */
+describe("d1-query oversized batches", () => {
+  beforeEach(() => {
+    runLocalWranglerMock.mockReset();
+  });
+
+  it("sends a small batch inline", () => {
+    runLocalWranglerMock.mockReturnValue(JSON.stringify([{ success: true }]));
+
+    executeD1("SELECT 1;", "d1-local", { quiet: true, retryAttempts: 1 });
+
+    expect(runLocalWranglerMock).toHaveBeenCalledWith(
+      expect.arrayContaining(["--command=SELECT 1;"]),
+      expect.anything(),
+    );
+  });
+
+  it("writes a batch too large for one argument to a file", () => {
+    const sql = `${"INSERT INTO t VALUES ('x');".repeat(8000)}\n`;
+    expect(exceedsInlineCommandLimit(sql)).toBe(true);
+
+    let seenPath: string | undefined;
+    let seenContents: string | undefined;
+    runLocalWranglerMock.mockImplementation((args: string[]) => {
+      const index = args.indexOf("--file");
+      seenPath = args[index + 1];
+      seenContents = readFileSync(seenPath as string, "utf8");
+      return JSON.stringify([{ success: true }]);
+    });
+
+    executeD1(sql, "d1-local", { quiet: true, retryAttempts: 1 });
+
+    const args = runLocalWranglerMock.mock.calls[0]?.[0] as string[];
+    expect(args).toContain("--file");
+    expect(args.some((arg) => arg.startsWith("--command="))).toBe(false);
+    expect(seenContents).toBe(sql);
+    // The temp file is Wrangler's to read and ours to clean up.
+    expect(existsSync(seenPath as string)).toBe(false);
+  });
+
+  it("keeps the threshold under the Linux single-argument cap", () => {
+    const MAX_ARG_STRLEN = 128 * 1024;
+    const justUnder = "a".repeat(MAX_ARG_STRLEN - 1);
+    expect(exceedsInlineCommandLimit(justUnder)).toBe(true);
+  });
+});

package/src/db/__tests__/schema-enum-sources.test.ts

@@ -0,0 +1,33 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { describe, expect, it } from "vitest";
+
+/**
+ * The schema files must not keep private copies of the value lists that
+ * `types/constants.ts` already owns.
+ *
+ * This is not a style rule. A CHECK constraint is generated from whatever list
+ * the schema file can see, so a private copy that stops matching the shared one
+ * produces a constraint that rejects rows the application considers valid — and
+ * the schema files are the one place where nothing else would catch it, because
+ * `drizzle-kit generate` happily emits the wrong constraint and the types still
+ * line up on both sides.
+ */
+const SCHEMA_FILES = ["../schema.ts", "../pg/schema.ts"];
+
+/** `const NAME = [...] as const`, the shape a value list is declared in. */
+const LOCAL_VALUE_LIST =
+  /const\s+([A-Z][A-Z0-9_]*)\s*=\s*\[[^\]]*\]\s*as const/g;
+
+describe("schema value lists", () => {
+  for (const file of SCHEMA_FILES) {
+    it(`${file} declares no value list of its own`, () => {
+      const source = readFileSync(resolve(__dirname, file), "utf8");
+      const declared = [...source.matchAll(LOCAL_VALUE_LIST)].map(
+        (match) => match[1],
+      );
+
+      expect(declared).toEqual([]);
+    });
+  }
+});

package/src/db/__tests__/smart-collection-placement.test.ts

@@ -0,0 +1,402 @@
+import { beforeEach, describe, expect, it } from "vitest";
+import type Database from "better-sqlite3";
+import {
+  createTestDatabase,
+  DEFAULT_TEST_SITE_ID,
+} from "../../__tests__/helpers/db.js";
+
+/**
+ * The three tables a smart collection can be placed in, checked by inserting
+ * real rows.
+ *
+ * Reading a CHECK constraint and believing it is not the same as running it.
+ * The last time these constraints were written by hand, a test shaped exactly
+ * like this one found three bugs in a single pass: a branch that forgot to
+ * require its own foreign key, a branch that allowed two of them at once, and a
+ * unique index whose partial predicate never matched.
+ *
+ * Each case states the row it inserts and what the schema promises about it, so
+ * a failure names the rule rather than the constraint.
+ */
+
+const SITE = DEFAULT_TEST_SITE_ID;
+const NOW = 1_700_000_000;
+
+function ids(prefix: string, n: number): string[] {
+  return Array.from(
+    { length: n },
+    (_, i) => `${prefix}_0000000000000000000000000${i}`,
+  );
+}
+
+describe("smart collection placement constraints", () => {
+  let sqlite: Database.Database;
+  let smartA: string;
+  let smartB: string;
+  let collectionA: string;
+  let postA: string;
+
+  beforeEach(() => {
+    ({ sqlite } = createTestDatabase());
+    [smartA, smartB] = ids("smc", 2) as [string, string];
+    [collectionA] = ids("col", 1) as [string];
+    [postA] = ids("pst", 1) as [string];
+
+    sqlite
+      .prepare(
+        `INSERT INTO collection (id, site_id, title, sort_order, created_at, updated_at)
+         VALUES (?, ?, 'Books', 'newest', ?, ?)`,
+      )
+      .run(collectionA, SITE, NOW, NOW);
+
+    for (const id of [smartA, smartB]) {
+      sqlite
+        .prepare(
+          `INSERT INTO smart_collection (id, site_id, title, sort, created_at, updated_at)
+           VALUES (?, ?, 'Quotes', 'newest', ?, ?)`,
+        )
+        .run(id, SITE, NOW, NOW);
+    }
+
+    sqlite
+      .prepare(
+        `INSERT INTO post (
+           id, site_id, thread_id, format, status, visibility,
+           body_html, body_text, created_at, updated_at
+         ) VALUES (?, ?, ?, 'note', 'published', 'public', '', '', ?, ?)`,
+      )
+      .run(postA, SITE, postA, NOW, NOW);
+  });
+
+  function insertPath(values: Record<string, unknown>) {
+    const row = {
+      id: `pth_${Math.random().toString(36).slice(2, 12)}`,
+      site_id: SITE,
+      path: `p-${Math.random().toString(36).slice(2, 8)}`,
+      kind: "slug",
+      post_id: null,
+      collection_id: null,
+      smart_collection_id: null,
+      redirect_to_path: null,
+      redirect_type: null,
+      archive_query: null,
+      created_at: NOW,
+      updated_at: NOW,
+      ...values,
+    };
+    const keys = Object.keys(row);
+    sqlite
+      .prepare(
+        `INSERT INTO path_registry (${keys.join(", ")})
+         VALUES (${keys.map(() => "?").join(", ")})`,
+      )
+      .run(...keys.map((key) => row[key]));
+  }
+
+  function insertDirectoryItem(values: Record<string, unknown>) {
+    const row = {
+      id: `cdi_${Math.random().toString(36).slice(2, 12)}`,
+      site_id: SITE,
+      type: "smart_collection",
+      collection_id: null,
+      smart_collection_id: null,
+      label: null,
+      url: null,
+      description: null,
+      position: `a${Math.random().toString(36).slice(2, 8)}`,
+      created_at: NOW,
+      updated_at: NOW,
+      ...values,
+    };
+    const keys = Object.keys(row);
+    sqlite
+      .prepare(
+        `INSERT INTO collection_directory_item (${keys.join(", ")})
+         VALUES (${keys.map(() => "?").join(", ")})`,
+      )
+      .run(...keys.map((key) => row[key]));
+  }
+
+  function insertNavItem(values: Record<string, unknown>) {
+    const row = {
+      id: `nav_${Math.random().toString(36).slice(2, 12)}`,
+      site_id: SITE,
+      type: "smart_collection",
+      system_key: null,
+      collection_id: null,
+      smart_collection_id: null,
+      post_id: null,
+      label: "",
+      url: "/quotes",
+      placement: "header",
+      position: `a${Math.random().toString(36).slice(2, 8)}`,
+      created_at: NOW,
+      updated_at: NOW,
+      ...values,
+    };
+    const keys = Object.keys(row);
+    sqlite
+      .prepare(
+        `INSERT INTO nav_item (${keys.join(", ")})
+         VALUES (${keys.map(() => "?").join(", ")})`,
+      )
+      .run(...keys.map((key) => row[key]));
+  }
+
+  describe("path_registry", () => {
+    it("accepts a slug pointing at a smart collection", () => {
+      expect(() =>
+        insertPath({ smart_collection_id: smartA, path: "quotes" }),
+      ).not.toThrow();
+    });
+
+    it("accepts an alias pointing at a smart collection", () => {
+      expect(() =>
+        insertPath({
+          kind: "alias",
+          smart_collection_id: smartA,
+          path: "old-quotes",
+        }),
+      ).not.toThrow();
+    });
+
+    it("refuses a slug that points at two things at once", () => {
+      expect(() =>
+        insertPath({ smart_collection_id: smartA, collection_id: collectionA }),
+      ).toThrow();
+      expect(() =>
+        insertPath({ smart_collection_id: smartA, post_id: postA }),
+      ).toThrow();
+    });
+
+    it("refuses a redirect or archive row that names a smart collection", () => {
+      expect(() =>
+        insertPath({
+          kind: "redirect",
+          smart_collection_id: smartA,
+          redirect_to_path: "quotes",
+          redirect_type: 301,
+        }),
+      ).toThrow();
+      expect(() =>
+        insertPath({
+          kind: "archive",
+          smart_collection_id: smartA,
+          archive_query: "format=quote",
+        }),
+      ).toThrow();
+    });
+
+    it("allows only one slug per smart collection", () => {
+      insertPath({ smart_collection_id: smartA, path: "quotes" });
+      expect(() =>
+        insertPath({ smart_collection_id: smartA, path: "quotes-2" }),
+      ).toThrow();
+
+      // An alias is not a second slug, so it is still allowed.
+      expect(() =>
+        insertPath({
+          kind: "alias",
+          smart_collection_id: smartA,
+          path: "old-quotes",
+        }),
+      ).not.toThrow();
+    });
+
+    it("keeps smart collections in the same address space as everything else", () => {
+      insertPath({ smart_collection_id: smartA, path: "quotes" });
+      expect(() =>
+        insertPath({ collection_id: collectionA, path: "quotes" }),
+      ).toThrow();
+      expect(() => insertPath({ post_id: postA, path: "quotes" })).toThrow();
+    });
+  });
+
+  describe("collection_directory_item", () => {
+    it("accepts a smart collection row", () => {
+      expect(() =>
+        insertDirectoryItem({ smart_collection_id: smartA }),
+      ).not.toThrow();
+    });
+
+    it("refuses a smart collection row with no target", () => {
+      expect(() => insertDirectoryItem({})).toThrow();
+    });
+
+    it("refuses a smart collection row carrying a label or url", () => {
+      expect(() =>
+        insertDirectoryItem({ smart_collection_id: smartA, label: "Quotes" }),
+      ).toThrow();
+      expect(() =>
+        insertDirectoryItem({ smart_collection_id: smartA, url: "/quotes" }),
+      ).toThrow();
+    });
+
+    it("refuses every other row type carrying a smart collection", () => {
+      expect(() =>
+        insertDirectoryItem({
+          type: "collection",
+          collection_id: collectionA,
+          smart_collection_id: smartA,
+        }),
+      ).toThrow();
+      expect(() =>
+        insertDirectoryItem({ type: "divider", smart_collection_id: smartA }),
+      ).toThrow();
+      expect(() =>
+        insertDirectoryItem({
+          type: "link",
+          label: "Elsewhere",
+          url: "https://example.com",
+          smart_collection_id: smartA,
+        }),
+      ).toThrow();
+    });
+
+    it("places a smart collection at most once", () => {
+      insertDirectoryItem({ smart_collection_id: smartA });
+      expect(() =>
+        insertDirectoryItem({ smart_collection_id: smartA }),
+      ).toThrow();
+      expect(() =>
+        insertDirectoryItem({ smart_collection_id: smartB }),
+      ).not.toThrow();
+    });
+  });
+
+  describe("nav_item", () => {
+    it("accepts a smart collection nav item", () => {
+      expect(() =>
+        insertNavItem({ smart_collection_id: smartA }),
+      ).not.toThrow();
+    });
+
+    it("refuses a smart collection nav item with no target", () => {
+      expect(() => insertNavItem({})).toThrow();
+    });
+
+    it("refuses every other nav type carrying a smart collection", () => {
+      expect(() =>
+        insertNavItem({
+          type: "link",
+          smart_collection_id: smartA,
+          label: "Elsewhere",
+        }),
+      ).toThrow();
+      expect(() =>
+        insertNavItem({
+          type: "system",
+          system_key: "latest",
+          smart_collection_id: smartA,
+        }),
+      ).toThrow();
+      expect(() =>
+        insertNavItem({
+          type: "collection",
+          collection_id: collectionA,
+          smart_collection_id: smartA,
+        }),
+      ).toThrow();
+      expect(() =>
+        insertNavItem({
+          type: "page",
+          post_id: postA,
+          smart_collection_id: smartA,
+        }),
+      ).toThrow();
+    });
+
+    it("adds a smart collection to navigation at most once", () => {
+      insertNavItem({ smart_collection_id: smartA });
+      expect(() => insertNavItem({ smart_collection_id: smartA })).toThrow();
+      expect(() =>
+        insertNavItem({ smart_collection_id: smartB }),
+      ).not.toThrow();
+    });
+  });
+
+  describe("smart_collection", () => {
+    it("refuses a private visibility condition", () => {
+      // The one value a published page can never name. Enforced in the column,
+      // not only in Zod, so no import path or backfill can slip one in.
+      expect(() =>
+        sqlite
+          .prepare(
+            `INSERT INTO smart_collection (id, site_id, title, visibility, sort, created_at, updated_at)
+             VALUES (?, ?, 'Private', 'private', 'newest', ?, ?)`,
+          )
+          .run(`smc_private0000000000000000000`, SITE, NOW, NOW),
+      ).toThrow();
+    });
+
+    it("refuses a sort or layout it cannot render", () => {
+      expect(() =>
+        sqlite
+          .prepare(
+            `INSERT INTO smart_collection (id, site_id, title, sort, created_at, updated_at)
+             VALUES (?, ?, 'Bad sort', 'rating_asc', ?, ?)`,
+          )
+          .run(`smc_badsort00000000000000000000`, SITE, NOW, NOW),
+      ).toThrow();
+      expect(() =>
+        sqlite
+          .prepare(
+            `INSERT INTO smart_collection (id, site_id, title, sort, layout, created_at, updated_at)
+             VALUES (?, ?, 'Bad layout', 'newest', 'carousel', ?, ?)`,
+          )
+          .run(`smc_badlayout00000000000000000`, SITE, NOW, NOW),
+      ).toThrow();
+    });
+
+    it("leaves a deleted collection's id in place rather than widening", () => {
+      sqlite
+        .prepare(`UPDATE smart_collection SET collection_id = ? WHERE id = ?`)
+        .run(collectionA, smartA);
+
+      // No foreign key on this column, alone in the schema. RESTRICT would fail
+      // anonymously and make every bulk delete an ordering rule; SET NULL would
+      // turn a curated page into the whole archive. The refusal an author sees
+      // is `smartCollections.assertCollectionUnused()`, and what is left if
+      // something reaches around it is a condition naming a collection that no
+      // longer exists — which matches nothing.
+      expect(() =>
+        sqlite.prepare(`DELETE FROM collection WHERE id = ?`).run(collectionA),
+      ).not.toThrow();
+
+      const row = sqlite
+        .prepare(`SELECT collection_id FROM smart_collection WHERE id = ?`)
+        .get(smartA) as { collection_id: string | null };
+      expect(row.collection_id).toBe(collectionA);
+    });
+
+    it("refuses a year no timestamp could carry", () => {
+      // `Date.UTC` returns NaN past year 275760, and a NaN bound is a
+      // comparison every row fails with nothing to report.
+      for (const year of [1970, 10000]) {
+        expect(() =>
+          sqlite
+            .prepare(
+              `INSERT INTO smart_collection (id, site_id, title, year, sort, created_at, updated_at)
+               VALUES (?, ?, 'Bad year', ?, 'newest', ?, ?)`,
+            )
+            .run(
+              `smc_year${year}000000000000000000`.slice(0, 30),
+              SITE,
+              year,
+              NOW,
+              NOW,
+            ),
+        ).toThrow();
+      }
+
+      expect(() =>
+        sqlite
+          .prepare(
+            `INSERT INTO smart_collection (id, site_id, title, year, sort, created_at, updated_at)
+             VALUES (?, ?, 'Edge years', 9999, 'newest', ?, ?)`,
+          )
+          .run(`smc_year9999000000000000000000`.slice(0, 30), SITE, NOW, NOW),
+      ).not.toThrow();
+    });
+  });
+});