@jant/core 0.6.7 → 0.6.8

package/src/lib/__tests__/view.test.ts

@@ -271,18 +271,123 @@ describe("toPostView", () => {
     );
   });
 
-  it("does not compute summaryHtml for posts without title", () => {
+  it("does not attach summaryHtml for short untitled notes", () => {
+    const body = JSON.stringify({
+      type: "doc",
+      content: [
+        { type: "paragraph", content: [{ type: "text", text: "Just a note" }] },
+      ],
+    });
     const view = toPostView(
       makePostWithMedia({
         title: null,
+        body,
         bodyHtml: "<p>Just a note</p>",
       }),
       EMPTY_CTX,
     );
+    // Untitled notes render their body in full unless it is long enough to
+    // truncate, so a short note carries no summary.
+    expect(view.summaryHtml).toBeUndefined();
+    expect(view.summaryHasMore).toBeUndefined();
+  });
+
+  it("marks the summary boundary on long untitled notes", () => {
+    const textA = "A".repeat(1000);
+    const textB = "B".repeat(1000);
+    const body = JSON.stringify({
+      type: "doc",
+      content: [
+        { type: "paragraph", content: [{ type: "text", text: textA }] },
+        { type: "paragraph", content: [{ type: "text", text: textB }] },
+      ],
+    });
+    const p1 = `<p>${textA}</p>`;
+    const p2 = `<p>${textB}</p>`;
+    const view = toPostView(
+      makePostWithMedia({ title: null, body, bodyHtml: p1 + p2 }),
+      EMPTY_CTX,
+    );
+    // Untitled notes carry no excerpt — the card renders the full body and the
+    // marker tells the feed where to clamp the tail for expand-in-place.
+    expect(view.summaryHtml).toBeUndefined();
+    expect(view.summaryHasMore).toBe(true);
+    expect(view.bodyHtml).toBe(`${p1}<span data-note-break></span>${p2}`);
+  });
+
+  it("uses the larger untitled limits before truncating", () => {
+    // Seven ~100-char blocks (700 chars) fit the note limits (10 blocks /
+    // 1500 chars) but would have exceeded the old article limits (5 / 500).
+    const texts = Array.from({ length: 7 }, (_, i) => `${i}`.padEnd(100, "x"));
+    const body = JSON.stringify({
+      type: "doc",
+      content: texts.map((text) => ({
+        type: "paragraph",
+        content: [{ type: "text", text }],
+      })),
+    });
+    const view = toPostView(
+      makePostWithMedia({
+        title: null,
+        body,
+        bodyHtml: texts.map((t) => `<p>${t}</p>`).join(""),
+      }),
+      EMPTY_CTX,
+    );
     expect(view.summaryHtml).toBeUndefined();
     expect(view.summaryHasMore).toBeUndefined();
   });
 
+  it("does not truncate an untitled note to hide a tiny tail", () => {
+    const body = JSON.stringify({
+      type: "doc",
+      content: [
+        {
+          type: "paragraph",
+          content: [{ type: "text", text: "A".repeat(1400) }],
+        },
+        {
+          type: "paragraph",
+          content: [{ type: "text", text: "B".repeat(150) }],
+        },
+      ],
+    });
+    const view = toPostView(
+      makePostWithMedia({
+        title: null,
+        body,
+        bodyHtml: `<p>${"A".repeat(1400)}</p><p>${"B".repeat(150)}</p>`,
+      }),
+      EMPTY_CTX,
+    );
+    expect(view.summaryHtml).toBeUndefined();
+    expect(view.summaryHasMore).toBeUndefined();
+  });
+
+  it("honors moreBreak on untitled notes regardless of tail size", () => {
+    const body = JSON.stringify({
+      type: "doc",
+      content: [
+        { type: "paragraph", content: [{ type: "text", text: "Lead" }] },
+        { type: "moreBreak" },
+        { type: "paragraph", content: [{ type: "text", text: "tiny" }] },
+      ],
+    });
+    const view = toPostView(
+      makePostWithMedia({
+        title: null,
+        body,
+        bodyHtml: "<p>Lead</p><!--more--><p>tiny</p>",
+      }),
+      EMPTY_CTX,
+    );
+    expect(view.summaryHtml).toBeUndefined();
+    expect(view.summaryHasMore).toBe(true);
+    expect(view.bodyHtml).toBe(
+      "<p>Lead</p><span data-note-break></span><!--more--><p>tiny</p>",
+    );
+  });
+
   it("does not compute summaryHtml for posts without body", () => {
     const view = toPostView(
       makePostWithMedia({
@@ -614,6 +719,68 @@ describe("toNavItemView", () => {
     expect(view.isActive).toBe(false);
   });
 
+  it("treats a self-referential absolute URL as an internal link", () => {
+    const view = toNavItemView(
+      makeNavItem({ url: "https://example.com/about" }),
+      "/about",
+      "latest",
+      false,
+      "",
+      undefined,
+      "https://example.com",
+    );
+    expect(view.isExternal).toBe(false);
+    expect(view.url).toBe("/about");
+    expect(view.isActive).toBe(true);
+  });
+
+  it("keeps absolute URLs on other origins external", () => {
+    const view = toNavItemView(
+      makeNavItem({ url: "https://other.com/about" }),
+      "/about",
+      "latest",
+      false,
+      "",
+      undefined,
+      "https://example.com",
+    );
+    expect(view.isExternal).toBe(true);
+    expect(view.url).toBe("https://other.com/about");
+    expect(view.isActive).toBe(false);
+  });
+
+  it("treats a same-host URL as internal despite scheme/port differences", () => {
+    // Dev serves over http://host:<port> while the nav stores the canonical
+    // https URL — same site to the user, so no external-link affordances.
+    const view = toNavItemView(
+      makeNavItem({ url: "https://jant.example/about" }),
+      "/about",
+      "latest",
+      false,
+      "",
+      undefined,
+      "http://jant.example:8787",
+    );
+    expect(view.isExternal).toBe(false);
+    expect(view.url).toBe("/about");
+    expect(view.isActive).toBe(true);
+  });
+
+  it("normalizes a same-origin absolute URL under a site path prefix", () => {
+    const view = toNavItemView(
+      makeNavItem({ url: "https://example.com/blog/about" }),
+      "/blog/about",
+      "latest",
+      false,
+      "/blog",
+      undefined,
+      "https://example.com",
+    );
+    expect(view.isExternal).toBe(false);
+    expect(view.url).toBe("/blog/about");
+    expect(view.isActive).toBe(true);
+  });
+
   it("includes type in view", () => {
     const view = toNavItemView(
       makeNavItem({ type: "system", systemKey: "rss", url: "/feed" }),

package/src/lib/navigation.ts

@@ -116,6 +116,7 @@ export async function getNavigationData(
     isAuthenticated,
     appConfig.sitePathPrefix,
     collectionFreshness,
+    appConfig.siteOrigin,
   );
 
   // Only load collections when authenticated (for compose dialog)

package/src/lib/resolve-config.ts

@@ -174,8 +174,8 @@ export function resolveConfig(
 
     // Upload (ENV only)
     uploadMaxFileSize:
-      parseInt(getEnvString(env, "UPLOAD_MAX_FILE_SIZE_MB") ?? "500", 10) ||
-      500,
+      parseInt(getEnvString(env, "UPLOAD_MAX_FILE_SIZE_MB") ?? "1024", 10) ||
+      1024,
 
     // Summary extraction (ENV only)
     summaryMaxParagraphs:

package/src/lib/summary.ts

@@ -214,6 +214,12 @@ export function extractSummary(
  * @param bodyJson - Tiptap JSON string
  * @param maxBlocks - Maximum number of top-level blocks to include
  * @param maxChars - Maximum total plain-text character count
+ * @param minHiddenChars - Tolerance for limit-based truncation: when > 0 and a
+ *   block/char limit would hide a tail shorter than this many plain-text
+ *   characters, the truncation is cancelled — all remaining content blocks are
+ *   included and `hasMore` is `false`. Avoids a "read more" that reveals only a
+ *   sliver of text. Explicit `moreBreak` markers reflect author intent and are
+ *   never subject to this tolerance.
  * @returns HTML summary, whether content was truncated, and the index in
  *   `doc.content` where the content after the summary boundary begins, or null.
  *   `breakAtIndex` lets callers align the summary with the full-body rendering
@@ -229,6 +235,7 @@ export function extractSummaryHtml(
   bodyJson: string,
   maxBlocks: number = 5,
   maxChars: number = 500,
+  minHiddenChars: number = 0,
 ): { html: string; hasMore: boolean; breakAtIndex: number } | null {
   let doc: TiptapNode;
   try {
@@ -265,7 +272,19 @@ export function extractSummaryHtml(
     };
   }
 
-  // No moreBreak — accumulate blocks up to limits
+  // No moreBreak — accumulate blocks up to limits.
+  // Pre-extract plain text per content node so the tolerance check below can
+  // measure the hidden tail without a second extraction pass.
+  const contentText = new Map<number, string>();
+  let totalContentChars = 0;
+  for (let i = 0; i < nodes.length; i++) {
+    const node = nodes[i];
+    if (!node || !SUMMARY_BLOCK_TYPES.has(node.type)) continue;
+    const text = extractPlainText(node).trim();
+    contentText.set(i, text);
+    totalContentChars += text.length;
+  }
+
   const selected: TiptapNode[] = [];
   let totalChars = 0;
   let lastSelectedIdx = -1;
@@ -274,7 +293,7 @@ export function extractSummaryHtml(
     const node = nodes[i];
     if (!node || !SUMMARY_BLOCK_TYPES.has(node.type)) continue;
 
-    const text = extractPlainText(node).trim();
+    const text = contentText.get(i) ?? "";
     if (
       (selected.length >= maxBlocks || totalChars + text.length > maxChars) &&
       selected.length > 0
@@ -288,13 +307,33 @@ export function extractSummaryHtml(
 
   if (selected.length === 0) return null;
 
+  let hasMore = selected.length < totalContentNodes;
+
+  // Tolerance: don't truncate just to hide a tiny tail. When a block/char limit
+  // triggered the cut and the hidden content is shorter than `minHiddenChars`,
+  // include the remaining content blocks instead. `moreBreak` is handled above
+  // and never reaches this path.
+  if (
+    hasMore &&
+    minHiddenChars > 0 &&
+    totalContentChars - totalChars < minHiddenChars
+  ) {
+    for (let i = lastSelectedIdx + 1; i < nodes.length; i++) {
+      const node = nodes[i];
+      if (!node || !SUMMARY_BLOCK_TYPES.has(node.type)) continue;
+      selected.push(node);
+      lastSelectedIdx = i;
+    }
+    hasMore = false;
+  }
+
   const subDoc: JSONContent = {
     type: "doc",
     content: selected as JSONContent[],
   };
   return {
     html: renderTiptapDocument(subDoc),
-    hasMore: selected.length < totalContentNodes,
+    hasMore,
     breakAtIndex: lastSelectedIdx + 1,
   };
 }

package/src/lib/tiptap-render.ts

@@ -113,9 +113,13 @@ function renderSidenoteReference(
     ? stripSingleParagraph(context.renderChildren(definitionNode.content))
     : "";
 
+  // The `footref` / `footref-toggle` classes are not styled by us; they mark the
+  // Tufte sidenote trio as an Org-mode-style footnote so HTML-to-Markdown readers
+  // (Defuddle, used by Obsidian Web Clipper) recover `[^n]` references instead of
+  // silently dropping `span.sidenote`. See docs/internal/markdown-contract.md.
   return (
-    `<label for="sn-${escapeHtml(footnoteId)}" class="margin-toggle sidenote-number"></label>` +
-    `<input type="checkbox" id="sn-${escapeHtml(footnoteId)}" class="margin-toggle"/>` +
+    `<label for="sn-${escapeHtml(footnoteId)}" class="margin-toggle sidenote-number footref"></label>` +
+    `<input type="checkbox" id="sn-${escapeHtml(footnoteId)}" class="margin-toggle footref-toggle"/>` +
     `<span class="sidenote">${bodyHtml}</span>`
   );
 }

package/src/lib/upload.ts

@@ -278,7 +278,7 @@ export interface ValidateUploadOptions {
  * @returns null if valid, error message string if invalid
  * @example
  * ```ts
- * const error = validateUploadFile(file, { maxFileSizeMB: 500 });
+ * const error = validateUploadFile(file, { maxFileSizeMB: 1024 });
  * if (error) return dsToast(error, "error");
  * ```
  */
@@ -300,7 +300,7 @@ export function validateUploadFile(
  * @returns null if valid, error message string if invalid
  * @example
  * ```ts
- * const error = validateUploadFileMetadata("image/jpeg", 1024000, { maxFileSizeMB: 500 });
+ * const error = validateUploadFileMetadata("image/jpeg", 1024000, { maxFileSizeMB: 1024 });
  * ```
  */
 export function validateUploadFileMetadata(

package/src/lib/url.ts

@@ -92,6 +92,47 @@ export function isFullUrl(str: string): boolean {
   return str.startsWith("http://") || str.startsWith("https://");
 }
 
+/**
+ * If a full URL points at the site's own host, return its same-site path
+ * (`pathname` + `search` + `hash`). Returns `null` when the input is not a full
+ * URL, is unparseable, or points at a different host.
+ *
+ * Self-referential absolute links — e.g. a nav item set to
+ * `https://example.com/about` on `example.com` — should behave like the
+ * internal path `/about`: no external-link icon, no `target="_blank"`.
+ *
+ * Matching is by **hostname**, not full origin: scheme and port differences are
+ * treated as same-site. This keeps the check intuitive ("same domain") and
+ * robust in dev, where the site is often served over `http://host:<port>` while
+ * a nav link stores the canonical `https://host` URL. In production (canonical
+ * https + default port) hostname match is equivalent to origin match.
+ *
+ * @param url - Candidate URL (full URL or relative path)
+ * @param siteOrigin - The site's own origin, e.g. `https://example.com`
+ * @returns The same-site path, or `null` when the URL is external/non-absolute
+ *
+ * @example
+ * ```ts
+ * toSameSitePath("https://example.com/about", "https://example.com");    // "/about"
+ * toSameSitePath("https://example.com/about", "http://example.com:8787"); // "/about"
+ * toSameSitePath("https://other.com/about", "https://example.com");      // null
+ * toSameSitePath("/about", "https://example.com");                       // null
+ * ```
+ */
+export function toSameSitePath(url: string, siteOrigin: string): string | null {
+  if (!siteOrigin || !isFullUrl(url)) return null;
+  let parsed: URL;
+  let reference: URL;
+  try {
+    parsed = new URL(url);
+    reference = new URL(siteOrigin);
+  } catch {
+    return null;
+  }
+  if (parsed.hostname !== reference.hostname) return null;
+  return `${parsed.pathname}${parsed.search}${parsed.hash}` || "/";
+}
+
 /**
  * Converts text to a URL-friendly slug.
  *

package/src/lib/view.ts

@@ -38,7 +38,7 @@ import { getMediaUrl, getImageUrl, getPublicUrlForProvider } from "./image.js";
 import { extractSummaryHtml, extractBodyText } from "./summary.js";
 import { renderTiptapDocument } from "./tiptap-render.js";
 import { highlightText } from "./search-snippet.js";
-import { toPublicPath } from "./url.js";
+import { isFullUrl, toPublicPath, toSameSitePath } from "./url.js";
 
 // =============================================================================
 // Media Context
@@ -140,6 +140,59 @@ export function toMediaView(media: Media, ctx: MediaContext): MediaView {
 // Post Conversions
 // =============================================================================
 
+/** Feed summary limits for titled, article-style posts (the excerpt is a teaser). */
+const ARTICLE_SUMMARY_MAX_BLOCKS = 5;
+const ARTICLE_SUMMARY_MAX_CHARS = 500;
+/** Larger feed summary limits for untitled notes — the body itself is the content. */
+const NOTE_SUMMARY_MAX_BLOCKS = 10;
+const NOTE_SUMMARY_MAX_CHARS = 1500;
+/** Don't truncate an untitled note just to hide a tail under this many chars. */
+const NOTE_SUMMARY_MIN_HIDDEN_CHARS = 200;
+
+/**
+ * Splice a zero-width marker into rendered body HTML at a summary boundary.
+ *
+ * The summary HTML is not a byte-prefix of `bodyHtml` — structural nodes
+ * (horizontalRule, moreBreak, image) appear in `bodyHtml` but are excluded from
+ * the summary, so slicing `bodyHtml` by summary length lands mid-tag and
+ * corrupts the markup. Instead we render the pre-boundary doc slice and splice
+ * the marker at that exact block boundary.
+ *
+ * @param bodyJson - Tiptap JSON string for the post body
+ * @param bodyHtml - Rendered body HTML to splice the marker into
+ * @param breakAtIndex - Index in `doc.content` where the post-summary content begins
+ * @param markerHtml - Inert marker to insert at the boundary (e.g. an anchor span)
+ * @returns `bodyHtml` with the marker inserted, or null when the split can't be
+ *   computed safely (caller should fall back to the untouched body)
+ */
+function spliceAtSummaryBoundary(
+  bodyJson: string,
+  bodyHtml: string,
+  breakAtIndex: number,
+  markerHtml: string,
+): string | null {
+  try {
+    const doc = JSON.parse(bodyJson) as { type?: string; content?: unknown[] };
+    if (
+      doc.type !== "doc" ||
+      !Array.isArray(doc.content) ||
+      breakAtIndex <= 0 ||
+      breakAtIndex > doc.content.length
+    ) {
+      return null;
+    }
+    const beforeHtml = renderTiptapDocument({
+      type: "doc",
+      content: doc.content.slice(0, breakAtIndex) as never[],
+    });
+    if (!bodyHtml.startsWith(beforeHtml)) return null;
+    return beforeHtml + markerHtml + bodyHtml.slice(beforeHtml.length);
+  } catch {
+    // Better an untouched body than corrupted markup.
+    return null;
+  }
+}
+
 function normalizePreviewText(
   text: string | null | undefined,
 ): string | undefined {
@@ -215,49 +268,50 @@ export function toPostView(
   // Pre-compute excerpt from the unified plain-text summary.
   const excerpt = clipPreviewText(summary, 160);
 
-  // Pre-compute HTML summary for article-style posts (with title)
+  // Pre-compute feed/list truncation. The two formats differ:
+  //
+  // - Titled (article-style) posts get an excerpt teaser (`summaryHtml`) and a
+  //   "Continue" link to the full page; a `#continue` anchor is spliced into the
+  //   body for scroll targeting on that page.
+  // - Untitled notes render their body in full and expand in place. When the
+  //   body is long enough to truncate (larger limit + tolerance guard) we splice
+  //   a `data-note-break` marker at the boundary so the feed can clamp the tail
+  //   with CSS and reveal it on click — no excerpt, no extra fetch. We do NOT
+  //   set `summaryHtml` for notes (the card renders the full marked body), and
+  //   only flag `summaryHasMore` when the split actually succeeds.
   let summaryHtml: string | undefined;
   let summaryHasMore: boolean | undefined;
   let bodyHtmlWithAnchor = post.bodyHtml;
-  if (post.title && post.body) {
-    const result = extractSummaryHtml(post.body);
-    if (result) {
+  if (post.body) {
+    const isArticle = !!post.title;
+    const result = extractSummaryHtml(
+      post.body,
+      isArticle ? ARTICLE_SUMMARY_MAX_BLOCKS : NOTE_SUMMARY_MAX_BLOCKS,
+      isArticle ? ARTICLE_SUMMARY_MAX_CHARS : NOTE_SUMMARY_MAX_CHARS,
+      isArticle ? 0 : NOTE_SUMMARY_MIN_HIDDEN_CHARS,
+    );
+    if (result && isArticle) {
       summaryHtml = result.html;
       summaryHasMore = result.hasMore;
-
-      // Inject #continue anchor at the excerpt boundary for scroll targeting.
-      // The summary HTML is NOT a byte-prefix of bodyHtml — structural nodes
-      // like `horizontalRule` and `moreBreak` appear in bodyHtml but are
-      // excluded from the summary, so slicing bodyHtml by summary.length lands
-      // mid-tag and corrupts the markup. Instead, render the pre-boundary
-      // doc slice and splice the anchor at that exact block boundary.
       if (result.hasMore && post.bodyHtml) {
-        try {
-          const doc = JSON.parse(post.body) as {
-            type?: string;
-            content?: unknown[];
-          };
-          if (
-            doc.type === "doc" &&
-            Array.isArray(doc.content) &&
-            result.breakAtIndex > 0 &&
-            result.breakAtIndex <= doc.content.length
-          ) {
-            const beforeHtml = renderTiptapDocument({
-              type: "doc",
-              content: doc.content.slice(0, result.breakAtIndex) as never[],
-            });
-            if (post.bodyHtml.startsWith(beforeHtml)) {
-              bodyHtmlWithAnchor =
-                beforeHtml +
-                '<span id="continue"></span>' +
-                post.bodyHtml.slice(beforeHtml.length);
-            }
-          }
-        } catch {
-          // Fallback: leave bodyHtml untouched if the split can't be computed
-          // safely. Better no anchor than a broken document.
-        }
+        const spliced = spliceAtSummaryBoundary(
+          post.body,
+          post.bodyHtml,
+          result.breakAtIndex,
+          '<span id="continue"></span>',
+        );
+        if (spliced) bodyHtmlWithAnchor = spliced;
+      }
+    } else if (result && result.hasMore && post.bodyHtml) {
+      const spliced = spliceAtSummaryBoundary(
+        post.body,
+        post.bodyHtml,
+        result.breakAtIndex,
+        "<span data-note-break></span>",
+      );
+      if (spliced) {
+        bodyHtmlWithAnchor = spliced;
+        summaryHasMore = true;
       }
     }
   }
@@ -424,6 +478,7 @@ export function toNavItemView(
   isAuthenticated = false,
   sitePathPrefix = "",
   collectionFreshness?: Map<string, number>,
+  siteOrigin = "",
 ): NavItemView {
   let url = item.url;
   let label = item.label;
@@ -453,8 +508,13 @@ export function toNavItemView(
     }
   }
 
-  const isExternal = url.startsWith("http://") || url.startsWith("https://");
-  const publicUrl = isExternal ? url : toPublicPath(url, sitePathPrefix);
+  // A full URL pointing at this site's own origin is really an internal link,
+  // so strip it back to a path and skip external-link affordances.
+  const sameSitePath = toSameSitePath(url, siteOrigin);
+  const isExternal = sameSitePath === null && isFullUrl(url);
+  const publicUrl = isExternal
+    ? url
+    : toPublicPath(sameSitePath ?? url, sitePathPrefix);
 
   let isActive = false;
   if (!isExternal) {
@@ -501,6 +561,7 @@ export function toNavItemViews(
   isAuthenticated = false,
   sitePathPrefix = "",
   collectionFreshness?: Map<string, number>,
+  siteOrigin = "",
 ): NavItemView[] {
   return items.map((item) =>
     toNavItemView(
@@ -510,6 +571,7 @@ export function toNavItemViews(
       isAuthenticated,
       sitePathPrefix,
       collectionFreshness,
+      siteOrigin,
     ),
   );
 }

package/src/preset.css

@@ -315,9 +315,15 @@ html {
 
   /* Blockquotes — tinted background card with quote icon */
   blockquote {
+    --_blockquote-pad-x: 1rem;
     position: relative;
     margin: 1.4rem 0;
-    padding: 1.4rem 1rem 0.75rem;
+    padding: 1.4rem var(--_blockquote-pad-x) 0.75rem;
+    /* A footnote referenced inside a quote floats within this padded box, so its
+       gutter anchor is inset by the right padding and the note drifts left. Expose
+       that inset (same value as the padding, so the two can't drift) — the sidenote
+       rule in ui.css subtracts it to pull the note back out to the gutter. */
+    --sidenote-anchor-inset: var(--_blockquote-pad-x);
     border: none;
     background: var(--site-blockquote-bg);
     border-radius: 6px;

package/src/routes/api/internal/__tests__/uploads.test.ts

@@ -120,6 +120,7 @@ describe("Internal upload admin routes", () => {
     await expect(res.json()).resolves.toEqual({
       abortedMultipartUploads: 0,
       deletedSessions: 1,
+      deletedOrphanMedia: 0,
     });
 
     const remaining = sqlite
@@ -128,4 +129,71 @@ describe("Internal upload admin routes", () => {
     expect(remaining).toBeUndefined();
     expect(storage.files.has(row.tempStorageKey)).toBe(false);
   });
+
+  it("deletes orphaned media past the grace window and keeps fresh orphans", async () => {
+    const storage = createMockStorage();
+    const { app, services, sqlite } = createTestApp({
+      authenticated: false,
+      internalAdminToken: "internal-secret",
+      storage,
+    });
+    app.route("/api/internal/uploads", internalUploadsRoutes);
+
+    const oldStorageKey = "media/old-orphan.jpg";
+    const freshStorageKey = "media/fresh-orphan.jpg";
+    await storage.put(oldStorageKey, createFakeWebpBytes(), {
+      contentType: "image/jpeg",
+    });
+    await storage.put(freshStorageKey, createFakeWebpBytes(), {
+      contentType: "image/jpeg",
+    });
+
+    const oldOrphan = await services.media.create({
+      filename: "old.jpg",
+      originalName: "old.jpg",
+      mimeType: "image/jpeg",
+      size: 1024,
+      storageKey: oldStorageKey,
+    });
+    const freshOrphan = await services.media.create({
+      filename: "fresh.jpg",
+      originalName: "fresh.jpg",
+      mimeType: "image/jpeg",
+      size: 1024,
+      storageKey: freshStorageKey,
+    });
+
+    // Backdate the first orphan beyond the 7-day grace window.
+    sqlite
+      .prepare("update media set created_at = 0 where id = ?")
+      .run(oldOrphan.id);
+
+    const res = await app.request("/api/internal/uploads/cleanup", {
+      method: "POST",
+      headers: {
+        Authorization: "Bearer internal-secret",
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({ limit: 10 }),
+    });
+
+    expect(res.status).toBe(200);
+    await expect(res.json()).resolves.toEqual({
+      abortedMultipartUploads: 0,
+      deletedSessions: 0,
+      deletedOrphanMedia: 1,
+    });
+
+    // Old orphan: DB row and storage object both gone.
+    expect(
+      sqlite.prepare("select id from media where id = ?").get(oldOrphan.id),
+    ).toBeUndefined();
+    expect(storage.files.has(oldStorageKey)).toBe(false);
+
+    // Fresh orphan: untouched.
+    expect(
+      sqlite.prepare("select id from media where id = ?").get(freshOrphan.id),
+    ).toBeDefined();
+    expect(storage.files.has(freshStorageKey)).toBe(true);
+  });
 });