@jant/core 0.7.0 → 0.7.1

package/src/lib/timeline.ts

@@ -272,7 +272,7 @@ async function buildCuratedThreadItems(
 
   return orderedThreads.reduce<TimelineItemView[]>((items, thread) => {
     const rootEntry = thread.posts[0];
-    if (!rootEntry || rootEntry.position !== 0) {
+    if (!rootEntry || rootEntry.post.id !== rootEntry.post.threadId) {
       return items;
     }
 

package/src/lib/tiptap-to-markdown.ts

@@ -11,8 +11,14 @@ import { serializeMarkdownDocument } from "./markdown-manager.js";
 /**
  * Converts a Tiptap JSON document to a Markdown string.
  *
- * @param json - Tiptap JSON string or parsed document object
+ * Throws rather than returning an empty string: a caller writing the result
+ * somewhere (an export, a text attachment) would otherwise replace the
+ * content with nothing and say nothing.
+ *
+ * @param json - Tiptap JSON document string
  * @returns Markdown string
+ * @throws {SyntaxError} When `json` is not JSON
+ * @throws {Error} When the root node is not a `doc`
  *
  * @example
  * ```ts
@@ -21,11 +27,11 @@ import { serializeMarkdownDocument } from "./markdown-manager.js";
  * ```
  */
 export function tiptapJsonToMarkdown(json: string): string {
-  try {
-    const doc = JSON.parse(json) as JSONContent;
-    if (doc.type !== "doc") return "";
-    return serializeMarkdownDocument(doc).trimEnd();
-  } catch {
-    return "";
+  const doc = JSON.parse(json) as JSONContent;
+  if (doc.type !== "doc") {
+    throw new Error(
+      `A TipTap body's root must be a doc node, not ${JSON.stringify(doc.type)}.`,
+    );
   }
+  return serializeMarkdownDocument(doc).trimEnd();
 }

package/src/lib/url.ts

@@ -486,6 +486,26 @@ export function toPublicPath(path: string, sitePathPrefix = ""): string {
   return `${sitePathPrefix}${normalizedPath}`;
 }
 
+/**
+ * The internal path a Post is served at: its oldest custom path when it has
+ * one, else its slug.
+ *
+ * This is the Post's permalink before the site path prefix, and so the `<id>`
+ * of its Atom entry. The Hugo export writes that `<id>` into front matter so
+ * an exported feed keeps it, which is why the rule lives here rather than
+ * inside `toPostView`.
+ *
+ * @param slug - The Post's current slug
+ * @param aliasPath - Its oldest custom path, `paths.getPostAliases()`'s first
+ * @returns Internal path rooted at `/`
+ * @example
+ * getPostPath("xta29"); // "/xta29"
+ * getPostPath("links-4", "/blog/links/4"); // "/blog/links/4"
+ */
+export function getPostPath(slug: string, aliasPath?: string): string {
+  return aliasPath ?? `/${slug}`;
+}
+
 /**
  * Convert an app-local href to its public path while leaving external URLs
  * unchanged.

package/src/lib/view.ts

@@ -47,7 +47,7 @@ import {
 } from "./summary.js";
 import { renderTiptapDocumentAroundBoundary } from "./tiptap-render.js";
 import { highlightText } from "./search-snippet.js";
-import { isFullUrl, toPublicPath, toSameSitePath } from "./url.js";
+import { getPostPath, isFullUrl, toPublicPath, toSameSitePath } from "./url.js";
 
 // =============================================================================
 // Media Context
@@ -260,7 +260,7 @@ export function toPostView(
 ): PostView {
   const id = post.id;
   const permalink = toPublicPath(
-    aliasPath ?? `/${post.slug}`,
+    getPostPath(post.slug, aliasPath),
     ctx.sitePathPrefix,
   );
   const timeZone = ctx.timeZone ?? "UTC";

package/src/node/__tests__/cli-setup.test.ts

@@ -0,0 +1,163 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { Readable } from "node:stream";
+import Database from "better-sqlite3";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { run } from "../../../bin/commands/setup.js";
+import { verifyPassword } from "../../lib/password.js";
+import type { Bindings } from "../../types.js";
+import { migrate } from "../runtime.js";
+
+const SITE_ID = "sit_01kn8jq3t4famtyg9hjd074ckr";
+const ENV_KEYS = [
+  "DATABASE_URL",
+  "DATA_DIR",
+  "SITE_ORIGIN",
+  "SITE_RESOLUTION_MODE",
+] as const;
+
+function pipe(text: string) {
+  return { stdin: Readable.from([text]) };
+}
+
+describe("jant setup", () => {
+  const originalEnv = Object.fromEntries(
+    ENV_KEYS.map((key) => [key, process.env[key]]),
+  );
+  let root: string;
+  let databasePath: string;
+
+  beforeEach(async () => {
+    for (const key of ENV_KEYS) delete process.env[key];
+    root = await mkdtemp(join(tmpdir(), "jant-setup-"));
+    databasePath = join(root, "jant.sqlite");
+    await migrate({ DATABASE_URL: `file:${databasePath}` } as Bindings);
+    process.env.DATABASE_URL = `file:${databasePath}`;
+    vi.spyOn(console, "log").mockImplementation(() => {});
+  });
+
+  afterEach(async () => {
+    for (const [key, value] of Object.entries(originalEnv)) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+    await rm(root, { recursive: true, force: true });
+    vi.restoreAllMocks();
+  });
+
+  function readDatabase<T>(read: (sqlite: Database.Database) => T): T {
+    const sqlite = new Database(databasePath, { readonly: true });
+    try {
+      return read(sqlite);
+    } finally {
+      sqlite.close();
+    }
+  }
+
+  it("sets up the install with the piped password", async () => {
+    process.env.SITE_ORIGIN = "https://notes.example.com";
+
+    const result = await run(
+      [
+        "--email",
+        "Owner@Example.com",
+        "--password-stdin",
+        "--site-id",
+        SITE_ID,
+        "--site-name",
+        "Field Notes",
+      ],
+      // `echo` ends the password with a line break that is not part of it.
+      pipe("correct horse\n"),
+    );
+
+    expect(result).toEqual({ outcome: "created", siteId: SITE_ID });
+    expect(console.log).toHaveBeenCalledWith(`Set up site ${SITE_ID}.`);
+
+    const stored = readDatabase((sqlite) => ({
+      email: sqlite.prepare('SELECT email FROM "user"').pluck().get(),
+      hash: sqlite.prepare('SELECT password FROM "account"').pluck().get(),
+      host: sqlite.prepare('SELECT host FROM "site_domain"').pluck().get(),
+      status: sqlite
+        .prepare(
+          `SELECT value FROM "site_setting" WHERE "key" = 'ONBOARDING_STATUS'`,
+        )
+        .pluck()
+        .get(),
+    }));
+    expect(stored).toMatchObject({
+      email: "owner@example.com",
+      host: "notes.example.com",
+      status: "completed",
+    });
+    expect(
+      await verifyPassword({
+        hash: String(stored.hash),
+        password: "correct horse",
+      }),
+    ).toBe(true);
+  });
+
+  it("changes nothing when run again", async () => {
+    const args = ["--email", "owner@example.com", "--password-stdin"];
+    const first = await run(args, pipe("correct horse"));
+    const second = await run(args, pipe("a different password"));
+
+    expect(second).toEqual({
+      outcome: "already-set-up",
+      siteId: first.siteId,
+    });
+    expect(console.log).toHaveBeenLastCalledWith(
+      `Site ${first.siteId} was already set up. Nothing changed.`,
+    );
+  });
+
+  it("refuses a password passed any way but standard input", async () => {
+    await expect(
+      run(["--email", "owner@example.com"], pipe("correct horse")),
+    ).rejects.toThrow("Pass --password-stdin");
+  });
+
+  it("refuses to wait on a terminal for the password", async () => {
+    const stdin = Object.assign(Readable.from([]), { isTTY: true });
+
+    await expect(
+      run(["--email", "owner@example.com", "--password-stdin"], { stdin }),
+    ).rejects.toThrow("reads the password from a pipe");
+  });
+
+  it("rejects answers the setup screens would reject", async () => {
+    const args = ["--email", "owner@example.com", "--password-stdin"];
+
+    await expect(run(args, pipe("short"))).rejects.toThrow(
+      "Password must be at least 8 characters",
+    );
+    await expect(
+      run(
+        [...args, "--site-id", "pst_01kn8jq3t4famtyg9hjd074ckr"],
+        pipe("correct horse"),
+      ),
+    ).rejects.toThrow("Invalid ID");
+    await expect(
+      run([...args, "--time-zone", "Mars/Olympus"], pipe("correct horse")),
+    ).rejects.toThrow("Choose a valid time zone.");
+
+    expect(
+      readDatabase((sqlite) =>
+        sqlite.prepare('SELECT COUNT(*) FROM "user"').pluck().get(),
+      ),
+    ).toBe(0);
+  });
+
+  it("refuses to run without a Node database", async () => {
+    delete process.env.DATABASE_URL;
+
+    await expect(
+      run(
+        ["--email", "owner@example.com", "--password-stdin"],
+        pipe("correct horse"),
+      ),
+    ).rejects.toThrow("jant setup runs against a Node database");
+  });
+});

package/src/node/__tests__/cli-site-snapshot.test.ts

@@ -780,6 +780,73 @@ describe("jant site snapshot export/import", () => {
     expect(await targetStorage.get(SNAPSHOT_MEDIA_KEY)).not.toBeNull();
   });
 
+  // The snapshot was exported where the bytes lived in R2; this import puts
+  // them in local storage. Rows left saying `r2` would look for R2_PUBLIC_URL,
+  // miss the avatar's existing row on replacement, and never purge their trash.
+  it("records imported media under the storage the import wrote it to", async () => {
+    const root = await mkdtemp(join(tmpdir(), "jant-site-snapshot-provider-"));
+    tempDirs.push(root);
+
+    const targetDbPath = join(root, "target.sqlite");
+    const targetStoragePath = join(root, "target-media");
+    const snapshotPath = join(root, "snapshot");
+
+    await migrate({ DATABASE_URL: `file:${targetDbPath}` } as Bindings);
+    const targetSqlite = new Database(targetDbPath);
+    try {
+      targetSqlite.exec(`
+        INSERT INTO "site" ("id", "key", "status", "created_at", "updated_at")
+        VALUES ('${SNAPSHOT_SITE_ID}', '${SNAPSHOT_SITE_KEY}', 'active', 1774009000, 1774009000);
+      `);
+    } finally {
+      targetSqlite.close();
+    }
+
+    await mkdir(
+      join(snapshotPath, "objects", "media", SNAPSHOT_SITE_ID, "files"),
+      {
+        recursive: true,
+      },
+    );
+    await writeFile(join(snapshotPath, "objects", SNAPSHOT_MEDIA_KEY), "png");
+    await writeFile(
+      join(snapshotPath, "meta.json"),
+      JSON.stringify({
+        format: "jant-site-snapshot",
+        version: 2,
+        dialect: "sqlite",
+        site: { id: SNAPSHOT_SITE_ID, key: SNAPSHOT_SITE_KEY },
+      }),
+    );
+    await writeFile(
+      join(snapshotPath, "db.sql"),
+      `INSERT INTO "media" ("id", "site_id", "post_id", "filename", "original_name", "mime_type", "size", "storage_key", "provider", "position", "media_kind", "created_at", "updated_at") VALUES('${SNAPSHOT_MEDIA_ID}', '${SNAPSHOT_SITE_ID}', NULL, '${SNAPSHOT_MEDIA_ID}.png', 'sample.png', 'image/png', 3, '${SNAPSHOT_MEDIA_KEY}', 'r2', 'a0', 'image', 1774009200, 1774009200);\n`,
+    );
+
+    useLocalSnapshotRuntime(`file:${targetDbPath}`, targetStoragePath);
+    vi.spyOn(console, "log").mockImplementation(() => {});
+    const { run: runImport } =
+      await import("../../../bin/commands/site/snapshot/import.js");
+    await runImport(["--path", snapshotPath, "--replace"]);
+
+    const verifySqlite = new Database(targetDbPath, { readonly: true });
+    try {
+      expect(
+        verifySqlite
+          .prepare(`SELECT "provider" FROM "media" WHERE "id" = ?`)
+          .pluck()
+          .get(SNAPSHOT_MEDIA_ID),
+      ).toBe("local");
+    } finally {
+      verifySqlite.close();
+    }
+    expect(
+      await createLocalDriver({ rootPath: targetStoragePath }).get(
+        SNAPSHOT_MEDIA_KEY,
+      ),
+    ).not.toBeNull();
+  });
+
   it("requires --replace for snapshot import", async () => {
     const root = await mkdtemp(join(tmpdir(), "jant-site-snapshot-replace-"));
     tempDirs.push(root);

package/src/node/__tests__/cli-snapshot-meta.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it } from "vitest";
 import {
   assertSnapshotDialectMatches,
   assertSnapshotMeta,
+  buildMediaProviderSql,
   buildSnapshotMeta,
   getSnapshotDialect,
   SNAPSHOT_VERSION,
@@ -183,3 +184,22 @@ describe("assertSnapshotDialectMatches", () => {
     expect(() => assertSnapshotDialectMatches({}, "pg")).not.toThrow();
   });
 });
+
+describe("buildMediaProviderSql", () => {
+  it("records the site's media under the given storage driver", () => {
+    expect(buildMediaProviderSql("sit_o'brien", "s3")).toBe(
+      `UPDATE "media" SET "provider" = 's3' WHERE "site_id" = 'sit_o''brien';`,
+    );
+  });
+
+  // The value is written into SQL and read back as where the bytes live, so
+  // anything but a real driver is refused rather than quoted.
+  it("refuses anything that is not a storage driver", () => {
+    expect(() => buildMediaProviderSql("sit_test", "gcs")).toThrow(
+      'Snapshot import cannot record media under storage driver "gcs".',
+    );
+    expect(() => buildMediaProviderSql("sit_test", "s3' OR '1")).toThrow(
+      "cannot record media under storage driver",
+    );
+  });
+});

package/src/node/__tests__/runtime.test.ts

@@ -12,6 +12,7 @@ import {
   resolveDatabasePath,
   resolvePublicRequestUrl,
 } from "../runtime.js";
+import type { App } from "../../types/app-context.js";
 import type { Bindings } from "../../types.js";
 
 const tempDirs: string[] = [];
@@ -204,6 +205,43 @@ describe("resolveNodeAssetRoot", () => {
     ).rejects.toThrow("single-site mode found multiple sites in the database:");
   });
 
+  // A deploy check tells a container that just started from one a rollback
+  // left running by this stamp, so it has to be the handler's start and not a
+  // time taken per request.
+  it("stamps the bindings with when the handler started serving", async () => {
+    const root = await mkdtemp(join(tmpdir(), "jant-node-started-at-"));
+    tempDirs.push(root);
+    const databasePath = join(root, "data", "jant.sqlite");
+    await migrate({ DATABASE_URL: `file:${databasePath}` } as Bindings);
+
+    const before = Math.floor(Date.now() / 1000);
+    const handler = await createNodeRequestHandler({
+      assetRoot: null,
+      env: { DATABASE_URL: `file:${databasePath}` } as Bindings,
+      app: {
+        fetch: (_request: Request, env: Bindings) =>
+          Response.json({ startedAt: env.NODE_STARTED_AT }),
+      } as unknown as App,
+    });
+    const after = Math.floor(Date.now() / 1000);
+
+    try {
+      const read = async () =>
+        (
+          (await (
+            await handler.fetch(new Request("http://127.0.0.1:3000/readyz"))
+          ).json()) as { startedAt: number }
+        ).startedAt;
+      const first = await read();
+
+      expect(first).toBeGreaterThanOrEqual(before);
+      expect(first).toBeLessThanOrEqual(after);
+      expect(await read()).toBe(first);
+    } finally {
+      await handler.close();
+    }
+  });
+
   // The single-site readiness check blames SITE_RESOLUTION_MODE for extra
   // sites, which on a hosted database are just its tenants.
   it("starts in host-based mode when the database holds several sites", async () => {

package/src/node/index.ts

@@ -6,10 +6,12 @@ export { createNodeRequestHandler } from "./request-handler.js";
 export {
   createNodeCliRuntime,
   createNodeRequestRuntime,
+  setUpNodeInstance,
 } from "../runtime/node.js";
 export type { CliSiteSelector } from "../runtime/site.js";
 export { createExportService } from "../services/export.js";
 export { createStorageDriver } from "../lib/storage.js";
+export { getConfiguredStorageDriver } from "../lib/env.js";
 export { resolveConfig } from "../lib/resolve-config.js";
 export { buildThemeStyle } from "../lib/theme.js";
 export { BUILTIN_COLOR_THEMES } from "../ui/color-themes.js";

package/src/node/request-handler.ts

@@ -31,6 +31,7 @@ import {
   shouldTrustProxy,
 } from "../lib/env.js";
 import { getHostBasedStartupConfigurationIssues } from "../lib/startup-config.js";
+import { now } from "../lib/time.js";
 import { createSiteService } from "../services/site.js";
 import type { App } from "../types/app-context.js";
 import type { Bindings } from "../types/bindings.js";
@@ -616,7 +617,8 @@ export async function createNodeRequestHandler(options?: {
       `Host-based startup configuration is invalid:\n- ${hostBasedStartupIssues.map((issue) => issue.message).join("\n- ")}`,
     );
   }
-  const { bindings, close } = await createNodeBindings(env);
+  const { bindings: databaseBindings, close } = await createNodeBindings(env);
+  const bindings: Bindings = { ...databaseBindings, NODE_STARTED_AT: now() };
   try {
     await assertNodeSiteResolutionReady(bindings);
 

package/src/routes/api/__tests__/posts.test.ts

@@ -449,6 +449,30 @@ describe("Posts API Routes", () => {
       expect(body.attachments).toEqual([]);
     });
 
+    it("keeps the creation and edit times a restore sends", async () => {
+      const { app } = createTestApp({ authenticated: true });
+      app.route("/api/posts", postsApiRoutes);
+
+      const res = await app.request("/api/posts", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          format: "note",
+          bodyMarkdown: "Moved from another site",
+          publishedAt: 1700000500,
+          createdAt: 1700000000,
+          updatedAt: 1700009000,
+        }),
+      });
+
+      expect(res.status).toBe(201);
+      expect(await res.json()).toMatchObject({
+        publishedAt: 1700000500,
+        createdAt: 1700000000,
+        updatedAt: 1700009000,
+      });
+    });
+
     it("creates a post with bodyMarkdown", async () => {
       const { app } = createTestApp({ authenticated: true });
       app.route("/api/posts", postsApiRoutes);

package/src/routes/api/__tests__/upload.test.ts

@@ -46,6 +46,40 @@ describe("Upload API Routes", () => {
     });
   });
 
+  it("pages the media list with nextCursor", async () => {
+    const { app, services } = createTestApp({ authenticated: true });
+    app.route("/api/upload", uploadApiRoutes);
+
+    for (const name of ["a", "b", "c"]) {
+      await services.media.create({
+        filename: `${name}.webp`,
+        originalName: `${name}.webp`,
+        mimeType: "image/webp",
+        size: 1024,
+        storageKey: `media/${name}.webp`,
+      });
+    }
+
+    const seen: string[] = [];
+    let cursor: string | null = null;
+    for (let page = 0; page < 4; page += 1) {
+      const res = await app.request(
+        `/api/upload?limit=2${cursor ? `&cursor=${cursor}` : ""}`,
+      );
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as {
+        media: { filename: string }[];
+        nextCursor: string | null;
+      };
+      seen.push(...body.media.map((media) => media.filename));
+      cursor = body.nextCursor;
+      if (!cursor) break;
+    }
+
+    expect(seen.sort()).toEqual(["a.webp", "b.webp", "c.webp"]);
+    expect(cursor).toBeNull();
+  });
+
   it("returns a single media item", async () => {
     const { app, services } = createTestApp({ authenticated: true });
     app.route("/api/upload", uploadApiRoutes);

package/src/routes/api/export.ts

@@ -57,12 +57,12 @@ exportApiRoutes.post("/hugo", requireAuthApi(), async (c) => {
       storage: c.var.storage,
     },
   );
-  const zip = await exportService.generateHugoSite();
-  return new Response(zip, {
+  // Streamed: stored media is read as the archive goes out, so the response
+  // starts at once and memory stays flat whatever the site's size.
+  return new Response(await exportService.generateHugoSite(), {
     headers: {
       "Content-Type": "application/zip",
       "Content-Disposition": 'attachment; filename="jant-export.zip"',
-      "Content-Length": String(zip.byteLength),
     },
   });
 });

package/src/routes/api/internal/sites.ts

@@ -240,7 +240,6 @@ internalSitesRoutes.get(
     return new Response(archive.zip, {
       headers: {
         "Content-Disposition": `attachment; filename="${archive.filename}"`,
-        "Content-Length": String(archive.zip.byteLength),
         "Content-Type": "application/zip",
       },
     });

package/src/routes/api/posts.ts

@@ -203,6 +203,8 @@ postsApiRoutes.post("/", requireAuthApi(), async (c) => {
       language: body.language,
       translationOfId: body.translationOfId,
       publishedAt: body.publishedAt,
+      createdAt: body.createdAt,
+      updatedAt: body.updatedAt,
     },
     body.attachments,
     {

package/src/routes/api/public/posts.ts

@@ -109,6 +109,24 @@ export type PublicPostMarkdownResponse = PublicPostBaseResponse & {
 export type PublicPostResponse =
   PublicPostRenderedResponse | PublicPostMarkdownResponse;
 
+/**
+ * The public Markdown for a post, or null for a historical body that isn't
+ * TipTap JSON. One unreadable row answers null and is logged, rather than
+ * failing the whole listing; `bodyHtml` still falls back to stored HTML.
+ */
+function toPublicBodyMarkdown(postId: string, body: string): string | null {
+  try {
+    return tiptapJsonToMarkdown(body);
+  } catch (error) {
+    // eslint-disable-next-line no-console -- A skipped body must leave a trace
+    console.error(
+      `Couldn't convert the body of post ${postId} to Markdown`,
+      error,
+    );
+    return null;
+  }
+}
+
 function isPublicDetailVisible(post: Post | null): post is Post {
   return (
     post !== null &&
@@ -196,7 +214,9 @@ export function toPublicPost(
   const contentFields =
     options?.content === "markdown"
       ? {
-          bodyMarkdown: post.body ? tiptapJsonToMarkdown(post.body) : null,
+          bodyMarkdown: post.body
+            ? toPublicBodyMarkdown(post.id, post.body)
+            : null,
         }
       : {
           bodyHtml: post.bodyHtml,

package/src/routes/api/upload.ts

@@ -39,7 +39,7 @@ import {
 } from "../../lib/errors.js";
 import { getI18n } from "../../i18n/index.js";
 import { ID_PREFIX } from "../../lib/ids.js";
-import { parseValidated } from "../../lib/schemas.js";
+import { MediaIdSchema, parseValidated } from "../../lib/schemas.js";
 import { toApiMedia } from "../../lib/api-media.js";
 
 type Env = { Bindings: Bindings; Variables: AppVariables };
@@ -49,6 +49,7 @@ export const uploadApiRoutes = new Hono<Env>();
 const ListMediaQuerySchema = z.object({
   limit: z.coerce.number().int().min(1).max(200).optional().default(50),
   mimePrefix: z.string().trim().min(1).optional(),
+  cursor: MediaIdSchema.optional(),
 });
 
 const UpdateMediaSchema = z.object({
@@ -421,14 +422,20 @@ uploadApiRoutes.post("/", async (c) => {
 
 // List uploaded files (JSON only)
 uploadApiRoutes.get("/", async (c) => {
-  const { limit, mimePrefix } = parseValidated(
+  const { limit, mimePrefix, cursor } = parseValidated(
     ListMediaQuerySchema,
     c.req.query(),
   );
-  const mediaList = await c.var.services.media.list({ limit, mimePrefix });
+  const mediaList = await c.var.services.media.list({
+    limit,
+    mimePrefix,
+    cursor,
+  });
 
   return c.json({
     media: mediaList.map((media) => toApiMedia(media, c.var.appConfig)),
+    nextCursor:
+      mediaList.length === limit ? (mediaList.at(-1)?.id ?? null) : null,
   });
 });
 

package/src/routes/compose.tsx

@@ -92,6 +92,8 @@ composeRoutes.post("/", async (c) => {
       language: data.language,
       translationOfId: data.translationOfId,
       publishedAt: data.publishedAt,
+      createdAt: data.createdAt,
+      updatedAt: data.updatedAt,
     },
     data.attachments,
     {
@@ -239,6 +241,8 @@ composeRoutes.post("/thread", async (c) => {
         // Replies may carry their own date; when they don't, the service
         // inherits the root's rather than stamping "now".
         publishedAt: data.publishedAt,
+        createdAt: data.createdAt,
+        updatedAt: data.updatedAt,
       },
       attachments: data.attachments,
     })),