@jant/core 0.6.7 → 0.6.9

package/src/preset.css

@@ -315,9 +315,15 @@ html {
 
   /* Blockquotes — tinted background card with quote icon */
   blockquote {
+    --_blockquote-pad-x: 1rem;
     position: relative;
     margin: 1.4rem 0;
-    padding: 1.4rem 1rem 0.75rem;
+    padding: 1.4rem var(--_blockquote-pad-x) 0.75rem;
+    /* A footnote referenced inside a quote floats within this padded box, so its
+       gutter anchor is inset by the right padding and the note drifts left. Expose
+       that inset (same value as the padding, so the two can't drift) — the sidenote
+       rule in ui.css subtracts it to pull the note back out to the gutter. */
+    --sidenote-anchor-inset: var(--_blockquote-pad-x);
     border: none;
     background: var(--site-blockquote-bg);
     border-radius: 6px;

package/src/routes/api/__tests__/settings.test.ts

@@ -623,7 +623,7 @@ describe("Settings API Routes", () => {
       expect(res.status).toBe(401);
     });
 
-    it("removes avatar-related settings and deletes the apple-touch icon", async () => {
+    it("removes avatar-related settings", async () => {
       const storage = createMockStorage();
       const { app, services } = createTestApp({
         authenticated: true,
@@ -658,9 +658,6 @@ describe("Settings API Routes", () => {
         await services.settings.get("SITE_FAVICON_APPLE_TOUCH"),
       ).toBeNull();
       expect(await services.settings.get("SITE_FAVICON_VERSION")).toBeNull();
-      expect(storage.delete).toHaveBeenCalledWith(
-        "media/sit_test00000000000000000000000/assets/favicon/apple-touch-icon.png",
-      );
     });
   });
 });

package/src/routes/api/__tests__/upload.test.ts

@@ -118,6 +118,8 @@ describe("Upload API Routes", () => {
     expect(res.status).toBe(200);
     await expect(res.json()).resolves.toEqual({ success: true });
     expect(await services.media.getById(media.id)).toBeNull();
+    // This mock exposes no server-side copy, so the object is retired by
+    // deleting the original key immediately (no recycle window).
     expect(storage.delete).toHaveBeenCalledWith("media/photo.webp");
   });
 

package/src/routes/api/internal/__tests__/uploads.test.ts

@@ -62,6 +62,11 @@ function createMockStorage(): StorageDriver & {
     async delete(key) {
       files.delete(key);
     },
+
+    async copy(sourceKey, destKey) {
+      const file = files.get(sourceKey);
+      if (file) files.set(destKey, { ...file });
+    },
   };
 }
 
@@ -120,6 +125,8 @@ describe("Internal upload admin routes", () => {
     await expect(res.json()).resolves.toEqual({
       abortedMultipartUploads: 0,
       deletedSessions: 1,
+      deletedOrphanMedia: 0,
+      purgedStorageObjects: 0,
     });
 
     const remaining = sqlite
@@ -128,4 +135,83 @@ describe("Internal upload admin routes", () => {
     expect(remaining).toBeUndefined();
     expect(storage.files.has(row.tempStorageKey)).toBe(false);
   });
+
+  it("deletes orphaned media past the grace window and keeps fresh orphans", async () => {
+    const storage = createMockStorage();
+    const { app, services, sqlite } = createTestApp({
+      authenticated: false,
+      internalAdminToken: "internal-secret",
+      storage,
+    });
+    app.route("/api/internal/uploads", internalUploadsRoutes);
+
+    const oldStorageKey = "media/old-orphan.jpg";
+    const freshStorageKey = "media/fresh-orphan.jpg";
+    await storage.put(oldStorageKey, createFakeWebpBytes(), {
+      contentType: "image/jpeg",
+    });
+    await storage.put(freshStorageKey, createFakeWebpBytes(), {
+      contentType: "image/jpeg",
+    });
+
+    const oldOrphan = await services.media.create({
+      filename: "old.jpg",
+      originalName: "old.jpg",
+      mimeType: "image/jpeg",
+      size: 1024,
+      storageKey: oldStorageKey,
+    });
+    const freshOrphan = await services.media.create({
+      filename: "fresh.jpg",
+      originalName: "fresh.jpg",
+      mimeType: "image/jpeg",
+      size: 1024,
+      storageKey: freshStorageKey,
+    });
+
+    // Backdate the first orphan beyond the 7-day grace window.
+    sqlite
+      .prepare("update media set created_at = 0 where id = ?")
+      .run(oldOrphan.id);
+
+    const res = await app.request("/api/internal/uploads/cleanup", {
+      method: "POST",
+      headers: {
+        Authorization: "Bearer internal-secret",
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({ limit: 10 }),
+    });
+
+    expect(res.status).toBe(200);
+    await expect(res.json()).resolves.toEqual({
+      abortedMultipartUploads: 0,
+      deletedSessions: 0,
+      deletedOrphanMedia: 1,
+      // The reaped orphan's object is freshly enqueued (30 days out), so the
+      // same sweep purges nothing yet.
+      purgedStorageObjects: 0,
+    });
+
+    // Old orphan: DB row gone, original key freed immediately, bytes moved to
+    // a trash/ key recorded in storage_purge (recoverable within the window).
+    expect(
+      sqlite.prepare("select id from media where id = ?").get(oldOrphan.id),
+    ).toBeUndefined();
+    expect(storage.files.has(oldStorageKey)).toBe(false);
+    expect([...storage.files.keys()].some((k) => k.startsWith("trash/"))).toBe(
+      true,
+    );
+    expect(
+      sqlite
+        .prepare("select id from storage_purge where original_key = ?")
+        .get(oldStorageKey),
+    ).toBeDefined();
+
+    // Fresh orphan: untouched.
+    expect(
+      sqlite.prepare("select id from media where id = ?").get(freshOrphan.id),
+    ).toBeDefined();
+    expect(storage.files.has(freshStorageKey)).toBe(true);
+  });
 });

package/src/routes/api/internal/sites.ts

@@ -3,7 +3,10 @@ import { z } from "zod";
 import { requireInternalAdminApi } from "../../../middleware/auth.js";
 import { ConflictError } from "../../../lib/errors.js";
 import { parseValidated } from "../../../lib/schemas.js";
-import { getSiteResolutionMode } from "../../../lib/env.js";
+import {
+  getConfiguredStorageDriver,
+  getSiteResolutionMode,
+} from "../../../lib/env.js";
 import type { Bindings } from "../../../types.js";
 import type { AppVariables } from "../../../types/app-context.js";
 
@@ -46,6 +49,10 @@ const SitePostCountsSchema = z.object({
   siteIds: z.array(z.string().trim().min(1)).max(200),
 });
 
+const CleanupSiteUploadsSchema = z.object({
+  limit: z.number().int().positive().max(500).optional(),
+});
+
 const ManagedSiteDomainSchema = z.object({
   host: z
     .string()
@@ -156,6 +163,42 @@ internalSitesRoutes.get(
   },
 );
 
+// Clean up a single managed site's expired upload sessions and orphaned media
+// (uploaded during compose but never published). Invoked per-site by the
+// hosted control plane's scheduled maintenance. Self-hosted operators use the
+// host-scoped `POST /api/internal/uploads/cleanup` route / `jant uploads
+// cleanup` CLI instead.
+internalSitesRoutes.post(
+  "/:siteId/uploads/cleanup",
+  requireInternalAdminApi(),
+  async (c) => {
+    assertHostBasedMode(c.env);
+
+    const storage = c.var.storage;
+    if (!storage) {
+      return c.json(
+        { error: "File storage isn't set up. Check your server config." },
+        500,
+      );
+    }
+
+    const contentType = c.req.header("Content-Type") || "";
+    const rawBody = contentType.includes("application/json")
+      ? await c.req.json().catch(() => ({}))
+      : {};
+    const body = parseValidated(CleanupSiteUploadsSchema, rawBody);
+
+    const services = c.var.servicesForSite(c.req.param("siteId"));
+    const result = await services.uploads.cleanupExpired({
+      storage,
+      storageDriver: getConfiguredStorageDriver(c.env),
+      limit: body.limit,
+    });
+
+    return c.json(result);
+  },
+);
+
 internalSitesRoutes.get(
   "/:siteId/export",
   requireInternalAdminApi(),

package/src/routes/api/public/__tests__/archive.test.ts

@@ -143,6 +143,72 @@ describe("Public Archive API Routes", () => {
       expect(noMediaBody.posts).toHaveLength(2);
     });
 
+    it("filters by title and media presence words", async () => {
+      const { app, services } = createTestApp({ authenticated: false });
+      app.route("/api/public/archive", publicArchiveApiRoutes);
+
+      const titled = await services.posts.create({
+        format: "note",
+        title: "Has title",
+        bodyMarkdown: "body",
+      });
+      const untitled = await services.posts.create({
+        format: "note",
+        bodyMarkdown: "body without title",
+      });
+
+      const withTitle = await app.request("/api/public/archive?title=any");
+      const withTitleBody = await withTitle.json();
+      expect(withTitleBody.posts.map((p: { id: string }) => p.id)).toEqual([
+        titled.id,
+      ]);
+
+      const noTitle = await app.request("/api/public/archive?title=none");
+      const noTitleBody = await noTitle.json();
+      expect(noTitleBody.posts.map((p: { id: string }) => p.id)).toEqual([
+        untitled.id,
+      ]);
+
+      const noMedia = await app.request("/api/public/archive?media=none");
+      const noMediaBody = await noMedia.json();
+      expect(noMediaBody.posts).toHaveLength(2);
+
+      const anyMedia = await app.request("/api/public/archive?media=any");
+      const anyMediaBody = await anyMedia.json();
+      expect(anyMediaBody.posts).toHaveLength(0);
+    });
+
+    it("filters threads and single posts via replies", async () => {
+      const { app, services } = createTestApp({ authenticated: false });
+      app.route("/api/public/archive", publicArchiveApiRoutes);
+
+      const threadRoot = await services.posts.create({
+        format: "note",
+        bodyMarkdown: "thread root",
+      });
+      await services.posts.create({
+        format: "note",
+        bodyMarkdown: "reply",
+        replyToId: threadRoot.id,
+      });
+      const standalone = await services.posts.create({
+        format: "note",
+        bodyMarkdown: "standalone",
+      });
+
+      const threads = await app.request("/api/public/archive?replies=any");
+      const threadsBody = await threads.json();
+      expect(threadsBody.posts.map((p: { id: string }) => p.id)).toEqual([
+        threadRoot.id,
+      ]);
+
+      const singles = await app.request("/api/public/archive?replies=none");
+      const singlesBody = await singles.json();
+      expect(singlesBody.posts.map((p: { id: string }) => p.id)).toEqual([
+        standalone.id,
+      ]);
+    });
+
     it("filters by media kind", async () => {
       const { app, services } = createTestApp({ authenticated: false });
       app.route("/api/public/archive", publicArchiveApiRoutes);

package/src/routes/api/public/archive.ts

@@ -12,20 +12,26 @@ export const publicArchiveApiRoutes = new Hono<Env>();
 
 const MediaKindSchema = z.enum(MEDIA_KINDS);
 const MEDIA_KIND_LIST = MEDIA_KINDS.join(", ");
-const INVALID_MEDIA_KIND_MESSAGE =
-  "Invalid media kind. Allowed: " + MEDIA_KIND_LIST;
+const INVALID_MEDIA_MESSAGE =
+  "Invalid media value. Allowed: any, none, or kinds: " + MEDIA_KIND_LIST;
 
 const BoolFlagSchema = z.enum(["0", "1"]).transform((value) => value === "1");
+const PresenceSchema = z
+  .enum(["any", "none"])
+  .transform((value) => value === "any");
 
 const ListPublicArchiveQuerySchema = z.object({
   format: FormatSchema.optional(),
   collection: z.string().optional(),
   year: z.coerce.number().int().min(1971).optional(),
+  // Kinds list (image,video,...) or presence words: any = posts with any
+  // attachment, none = posts without attachments.
   media: z
     .string()
     .optional()
     .transform((value, ctx) => {
       if (!value) return undefined;
+      if (value === "any" || value === "none") return value;
       const parts = value
         .split(",")
         .map((part) => part.trim())
@@ -35,12 +41,15 @@ const ListPublicArchiveQuerySchema = z.object({
       if (!result.success) {
         ctx.addIssue({
           code: z.ZodIssueCode.custom,
-          message: INVALID_MEDIA_KIND_MESSAGE,
+          message: INVALID_MEDIA_MESSAGE,
         });
         return z.NEVER;
       }
       return result.data;
     }),
+  title: PresenceSchema.optional(),
+  replies: PresenceSchema.optional(),
+  // Deprecated: use media=any|none and title=any|none instead.
   hasMedia: BoolFlagSchema.optional(),
   hasTitle: BoolFlagSchema.optional(),
   cursor: z.string().optional(),
@@ -54,6 +63,8 @@ publicArchiveApiRoutes.get("/", async (c) => {
     collection,
     year,
     media,
+    title,
+    replies,
     hasMedia,
     hasTitle,
     cursor,
@@ -61,6 +72,10 @@ publicArchiveApiRoutes.get("/", async (c) => {
     content,
   } = parseValidated(ListPublicArchiveQuerySchema, c.req.query());
 
+  const mediaKinds = Array.isArray(media) ? media : undefined;
+  const mediaPresence =
+    media === "any" ? true : media === "none" ? false : undefined;
+
   let collectionIds: string[] | undefined;
   if (collection) {
     // Accept both "tech,art" and "tech+art", matching the page URL convention.
@@ -89,9 +104,10 @@ publicArchiveApiRoutes.get("/", async (c) => {
     excludeReplies: true,
     publishedAfter,
     publishedBefore,
-    mediaKinds: media,
-    hasMedia,
-    hasTitle,
+    mediaKinds,
+    hasMedia: mediaPresence ?? hasMedia,
+    hasTitle: title ?? hasTitle,
+    hasReplies: replies,
   });
 
   const postIds = posts.map((post) => post.id);

package/src/routes/api/settings.ts

@@ -195,7 +195,8 @@ settingsApiRoutes.post("/avatar", requireAuthApi(), async (c) => {
 
 // Remove site avatar (requires auth)
 settingsApiRoutes.delete("/avatar", requireAuthApi(), async (c) => {
-  await c.var.services.settings.removeAvatar(c.var.storage, {
+  await c.var.services.settings.removeAvatar({
+    storage: c.var.storage,
     media: c.var.services.media,
     storageProvider: c.var.appConfig.storageDriver,
   });

package/src/routes/api/telegram.ts

@@ -66,7 +66,8 @@ function uploadConfigFromEnv(env: Bindings): {
   maxFileSizeMB: number;
 } {
   const maxFileSizeMB =
-    parseInt(getEnvString(env, "UPLOAD_MAX_FILE_SIZE_MB") ?? "500", 10) || 500;
+    parseInt(getEnvString(env, "UPLOAD_MAX_FILE_SIZE_MB") ?? "1024", 10) ||
+    1024;
   return {
     storageDriver: getConfiguredStorageDriver(env),
     maxFileSizeMB,

package/src/routes/auth/__tests__/setup.test.ts

@@ -79,6 +79,20 @@ describe("Setup bootstrap logic", () => {
     );
   });
 
+  it("pins the dashboard language to the detected catalog locale", async () => {
+    await runSetupBootstrap(services, { siteLanguage: "zh-TW" });
+
+    const rows = await services.db.select().from(settings);
+    // Content language stays verbatim; the dashboard locale is the resolved
+    // catalog (zh-Hant) so it is stable if content language later changes.
+    expect(rows.find((row) => row.key === "SITE_LANGUAGE")?.value).toBe(
+      "zh-TW",
+    );
+    expect(rows.find((row) => row.key === "DASHBOARD_LANGUAGE")?.value).toBe(
+      "zh-Hant",
+    );
+  });
+
   it("is idempotent when default navigation already exists", async () => {
     const timestamp = Math.floor(Date.now() / 1000);
     await services.db.run(sql`

package/src/routes/dash/__tests__/settings-avatar.test.ts

@@ -215,29 +215,47 @@ describe("Settings - Avatar Upload Logic", () => {
       expect(await settingsService.get("SITE_FAVICON_VERSION")).toBeNull();
     });
 
-    it("deletes apple-touch-icon from storage when storage is provided", async () => {
+    it("removes the apple-touch-icon media row and retires its object", async () => {
       const storage = createMockStorage();
-      await settingsService.set(
-        "SITE_FAVICON_APPLE_TOUCH",
-        `media/${DEFAULT_TEST_SITE_ID}/assets/favicon/apple-touch-icon.png`,
-      );
-
-      await settingsService.removeAvatar(storage);
-
-      expect(storage.delete).toHaveBeenCalledWith(
-        `media/${DEFAULT_TEST_SITE_ID}/assets/favicon/apple-touch-icon.png`,
-      );
+      const appleTouchKey = `media/${DEFAULT_TEST_SITE_ID}/assets/favicon/apple-touch-icon.png`;
+      const media = await mediaService.create({
+        filename: "apple-touch-icon.png",
+        originalName: "apple-touch-icon.png",
+        mimeType: "image/png",
+        size: 1234,
+        storageKey: appleTouchKey,
+        provider: "r2",
+      });
+      await settingsService.set("SITE_FAVICON_APPLE_TOUCH", appleTouchKey);
+
+      await settingsService.removeAvatar({
+        storage,
+        media: mediaService,
+        storageProvider: "r2",
+      });
+
+      // Row removed and setting cleared; the object is retired via storage
+      // (this mock has no server-side copy, so it's deleted outright).
+      expect(await mediaService.getById(media.id)).toBeNull();
+      expect(await settingsService.get("SITE_FAVICON_APPLE_TOUCH")).toBeNull();
+      expect(storage.delete).toHaveBeenCalledWith(appleTouchKey);
     });
 
-    it("skips storage delete when no apple-touch-icon key exists", async () => {
-      const storage = createMockStorage();
+    it("is a no-op for media when no apple-touch-icon key exists", async () => {
+      await settingsService.set(
+        "SITE_AVATAR",
+        `media/${DEFAULT_TEST_SITE_ID}/assets/avatar/some-id.png`,
+      );
 
-      await settingsService.removeAvatar(storage);
+      await settingsService.removeAvatar({
+        media: mediaService,
+        storageProvider: "r2",
+      });
 
-      expect(storage.delete).not.toHaveBeenCalled();
+      expect(await settingsService.get("SITE_AVATAR")).toBeNull();
     });
 
-    it("handles null storage gracefully", async () => {
+    it("clears settings even without a media service", async () => {
       await settingsService.set(
         "SITE_AVATAR",
         `media/${DEFAULT_TEST_SITE_ID}/assets/avatar/some-id.png`,
@@ -247,7 +265,7 @@ describe("Settings - Avatar Upload Logic", () => {
         `media/${DEFAULT_TEST_SITE_ID}/assets/favicon/apple-touch-icon.png`,
       );
 
-      await settingsService.removeAvatar(null);
+      await settingsService.removeAvatar();
 
       expect(await settingsService.get("SITE_AVATAR")).toBeNull();
       expect(await settingsService.get("SITE_FAVICON_APPLE_TOUCH")).toBeNull();

package/src/routes/dash/custom-urls.tsx

@@ -507,7 +507,7 @@ function NewCustomUrlContent({
             type="text"
             data-bind="archiveQuery"
             class="input"
-            placeholder="format=note&hasTitle=0&visibility=public&view=list"
+            placeholder="format=note&title=none&visibility=public&view=list"
           />
           <p class="text-xs text-muted-foreground mt-1">
             {i18n._(

package/src/routes/dash/settings.tsx

@@ -13,7 +13,7 @@ import { z } from "zod";
 import type { Bindings } from "../../types.js";
 import type { AppVariables } from "../../types/app-context.js";
 import { sse, dsRedirect, dsToast } from "../../lib/sse.js";
-import { getI18n } from "../../i18n/index.js";
+import { getI18n, isLocale, resolveCatalogLocale } from "../../i18n/index.js";
 import { renderPublicPage } from "../../lib/render.js";
 import { getNavigationData } from "../../lib/navigation.js";
 import { buildPageTitle } from "../../lib/page-title.js";
@@ -57,6 +57,7 @@ import {
   getHostedControlPlaneAccountUrl,
   getHostedControlPlaneProviderLabel,
   getHostedControlPlaneSiteDeleteUrl,
+  getHostedControlPlaneSiteSettingsUrl,
 } from "../../lib/hosted-signin.js";
 import { syncHostedControlPlaneSiteAvatar } from "../../lib/hosted-control-plane-sync.js";
 import {
@@ -93,6 +94,9 @@ export const settingsRoutes = new Hono<Env>();
 
 const UpdateLocaleSettingsSchema = z.object({
   siteLanguage: z.string(),
+  // Optional for back-compat: absent = leave the dashboard language untouched,
+  // "" = clear it (follow content language).
+  dashboardLanguage: z.string().optional(),
   cjkSerifFont: z.string(),
   timeZone: z.string(),
 });
@@ -265,6 +269,11 @@ function demoRestrictionResponse(c: Context<Env>, message: string): Response {
 
 settingsRoutes.get("/", async (c) => {
   const navData = await getNavigationData(c);
+  const hostedControlPlaneSiteSettingsUrl =
+    getHostedControlPlaneSiteSettingsUrl(c.env, c.var.currentSite.id);
+  const hostedControlPlaneProviderLabel = getHostedControlPlaneProviderLabel(
+    c.env,
+  );
 
   return renderPublicPage(c, {
     title: buildPageTitle("Settings", navData.siteName),
@@ -274,6 +283,8 @@ settingsRoutes.get("/", async (c) => {
         <SettingsRootContent
           sitePathPrefix={c.var.appConfig.sitePathPrefix}
           demoMode={c.var.appConfig.demoMode}
+          hostedControlPlaneSiteSettingsUrl={hostedControlPlaneSiteSettingsUrl}
+          hostedControlPlaneProviderLabel={hostedControlPlaneProviderLabel}
         />
       </div>
     ),
@@ -310,6 +321,11 @@ settingsRoutes.get("/general", async (c) => {
           siteName={dbSiteName || ""}
           siteDescription={dbSiteDescription || ""}
           siteLanguage={appConfig.siteLanguage}
+          dashboardLanguage={
+            isLocale(appConfig.dashboardLanguage)
+              ? appConfig.dashboardLanguage
+              : resolveCatalogLocale(appConfig.siteLanguage)
+          }
           cjkSerifFont={appConfig.cjkSerifFont}
           siteNameFallback={appConfig.fallbacks.siteName}
           siteDescriptionFallback={appConfig.fallbacks.siteDescription}
@@ -419,6 +435,7 @@ settingsRoutes.post("/general/language-time", async (c) => {
     await c.var.services.settings.updateLocaleSettings(body, {
       oldLanguage: c.var.appConfig.siteLanguage,
       oldCjkSerifFont: c.var.appConfig.cjkSerifFont,
+      oldDashboardLanguage: c.var.appConfig.dashboardLanguage,
     });
 
   const wantsJson = c.req.header("accept")?.includes("application/json");
@@ -643,7 +660,11 @@ settingsRoutes.post("/avatar", async (c) => {
 });
 
 settingsRoutes.post("/avatar/remove", async (c) => {
-  await c.var.services.settings.removeAvatar(c.var.storage);
+  await c.var.services.settings.removeAvatar({
+    storage: c.var.storage,
+    media: c.var.services.media,
+    storageProvider: c.var.appConfig.storageDriver,
+  });
   try {
     await syncHostedControlPlaneSiteAvatar({
       appConfig: c.var.appConfig,
@@ -990,10 +1011,6 @@ settingsRoutes.get("/account", async (c) => {
   const hostedControlPlaneProviderLabel = getHostedControlPlaneProviderLabel(
     c.env,
   );
-  const hostedControlPlaneSiteDeleteUrl = getHostedControlPlaneSiteDeleteUrl(
-    c.env,
-    c.var.currentSite.id,
-  );
 
   return renderPublicPage(c, {
     title: buildPageTitle("Account", navData.siteName),
@@ -1010,7 +1027,6 @@ settingsRoutes.get("/account", async (c) => {
           demoMode={c.var.appConfig.demoMode}
           hostedControlPlaneAccountUrl={hostedControlPlaneAccountUrl}
           hostedControlPlaneProviderLabel={hostedControlPlaneProviderLabel}
-          hostedControlPlaneSiteDeleteUrl={hostedControlPlaneSiteDeleteUrl}
         />
       </>
     ),