feedkeeper 0.0.0-stage → 0.23.0

package/server/dist/db/migrations/0021_note_revisions.sql

@@ -0,0 +1,33 @@
+-- Keep note revisions after deletion so a stale device cannot overwrite a recreated note.
+CREATE TABLE item_note_revisions (
+  user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  item_id INTEGER NOT NULL REFERENCES items(id) ON DELETE CASCADE,
+  revision INTEGER NOT NULL,
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (user_id, item_id)
+);
+
+INSERT INTO item_note_revisions (user_id, item_id, revision, updated_at)
+SELECT user_id, item_id, revision, updated_at FROM item_notes;
+
+CREATE TRIGGER trg_note_revision_insert AFTER INSERT ON item_notes
+BEGIN
+  INSERT INTO item_note_revisions (user_id, item_id, revision, updated_at)
+  VALUES (NEW.user_id, NEW.item_id, NEW.revision, NEW.updated_at)
+  ON CONFLICT (user_id, item_id) DO UPDATE SET revision = excluded.revision, updated_at = excluded.updated_at;
+END;
+
+CREATE TRIGGER trg_note_revision_update AFTER UPDATE ON item_notes
+BEGIN
+  INSERT INTO item_note_revisions (user_id, item_id, revision, updated_at)
+  VALUES (NEW.user_id, NEW.item_id, NEW.revision, NEW.updated_at)
+  ON CONFLICT (user_id, item_id) DO UPDATE SET revision = excluded.revision, updated_at = excluded.updated_at;
+END;
+
+CREATE TRIGGER trg_note_revision_delete AFTER DELETE ON item_notes
+  WHEN EXISTS (SELECT 1 FROM items WHERE id = OLD.item_id)
+BEGIN
+  UPDATE item_note_revisions SET revision = OLD.revision + 1,
+    updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+  WHERE user_id = OLD.user_id AND item_id = OLD.item_id;
+END;

package/server/dist/db/migrations/0022_high_resolution_icons.sql

@@ -0,0 +1,2 @@
+-- Re-discover existing icons on the next feed poll; keep the last good image until then.
+UPDATE feeds SET icon_checked_at = NULL;

package/server/dist/db/migrations/0023_server_editions.sql

@@ -0,0 +1,81 @@
+-- Native presentation preferences never change the web folder order or stream.
+CREATE TABLE native_preferences (
+  user_id INTEGER PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
+  revision INTEGER NOT NULL DEFAULT 1,
+  settings TEXT NOT NULL CHECK (json_valid(settings)),
+  updated_at TEXT NOT NULL
+);
+
+CREATE TABLE native_requests (
+  user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  request_id TEXT NOT NULL,
+  fingerprint TEXT NOT NULL,
+  response TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (user_id, request_id)
+) WITHOUT ROWID;
+
+ALTER TABLE editions ADD COLUMN edition_id TEXT;
+ALTER TABLE editions ADD COLUMN source TEXT NOT NULL DEFAULT 'curated';
+ALTER TABLE editions ADD COLUMN status TEXT NOT NULL DEFAULT 'active';
+ALTER TABLE editions ADD COLUMN period TEXT;
+ALTER TABLE editions ADD COLUMN title TEXT;
+ALTER TABLE editions ADD COLUMN summary TEXT;
+ALTER TABLE editions ADD COLUMN preferences_revision INTEGER NOT NULL DEFAULT 0;
+UPDATE editions SET edition_id = lower(hex(randomblob(16))),
+  expires_at = COALESCE(expires_at, strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '+24 hours'));
+
+-- A retained slot keeps revisions monotonic, including expiry and dismissal.
+CREATE TABLE edition_history (
+  user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  edition_id TEXT NOT NULL,
+  item_ids TEXT NOT NULL CHECK (json_valid(item_ids)),
+  revision INTEGER NOT NULL,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (user_id, edition_id)
+) WITHOUT ROWID;
+INSERT INTO edition_history SELECT user_id, edition_id, item_ids, revision, created_at FROM editions;
+
+DROP TRIGGER trg_changes_edition_update;
+CREATE TRIGGER trg_changes_edition_update AFTER UPDATE ON editions
+BEGIN
+  INSERT INTO changes (user_id, entity, entity_id, op, seq, changed_at)
+  VALUES (NEW.user_id, 'edition', 1, CASE WHEN NEW.status = 'active' THEN 'upsert' ELSE 'delete' END,
+    (SELECT COALESCE(MAX(seq), 0) + 1 FROM changes WHERE user_id = NEW.user_id), NEW.updated_at)
+  ON CONFLICT (user_id, entity, entity_id) DO UPDATE SET op = excluded.op, seq = excluded.seq, changed_at = excluded.changed_at;
+END;
+
+CREATE TRIGGER trg_changes_native_preferences_insert AFTER INSERT ON native_preferences
+BEGIN
+  INSERT INTO changes (user_id, entity, entity_id, op, seq, changed_at)
+  VALUES (NEW.user_id, 'native_preferences', 1, 'upsert',
+    (SELECT COALESCE(MAX(seq), 0) + 1 FROM changes WHERE user_id = NEW.user_id), NEW.updated_at)
+  ON CONFLICT (user_id, entity, entity_id) DO UPDATE SET op = excluded.op, seq = excluded.seq, changed_at = excluded.changed_at;
+END;
+
+CREATE TRIGGER trg_changes_native_preferences_update AFTER UPDATE ON native_preferences
+BEGIN
+  INSERT INTO changes (user_id, entity, entity_id, op, seq, changed_at)
+  VALUES (NEW.user_id, 'native_preferences', 1, 'upsert',
+    (SELECT COALESCE(MAX(seq), 0) + 1 FROM changes WHERE user_id = NEW.user_id), NEW.updated_at)
+  ON CONFLICT (user_id, entity, entity_id) DO UPDATE SET op = excluded.op, seq = excluded.seq, changed_at = excluded.changed_at;
+END;
+
+-- Remove stale folder IDs atomically when any API deletes a folder. A new folder
+-- with the same name has a new identity and must not inherit old preferences.
+CREATE TRIGGER trg_native_preferences_folder_delete AFTER DELETE ON folders
+WHEN EXISTS (SELECT 1 FROM native_preferences WHERE user_id = OLD.user_id)
+BEGIN
+  UPDATE native_preferences SET
+    settings = json_set(settings,
+      '$.folderOrder', json(COALESCE((SELECT json_group_array(value) FROM json_each(settings, '$.folderOrder') WHERE value IS NULL OR value != OLD.id), '[]')),
+      '$.hiddenFolderIds', json(COALESCE((SELECT json_group_array(value) FROM json_each(settings, '$.hiddenFolderIds') WHERE value != OLD.id), '[]')),
+      '$.preferredFolderIds', json(COALESCE((SELECT json_group_array(value) FROM json_each(settings, '$.preferredFolderIds') WHERE value != OLD.id), '[]'))),
+    revision = revision + 1,
+    updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+  WHERE user_id = OLD.user_id AND (
+    EXISTS (SELECT 1 FROM json_each(settings, '$.folderOrder') WHERE value = OLD.id) OR
+    EXISTS (SELECT 1 FROM json_each(settings, '$.hiddenFolderIds') WHERE value = OLD.id) OR
+    EXISTS (SELECT 1 FROM json_each(settings, '$.preferredFolderIds') WHERE value = OLD.id)
+  );
+END;

package/server/dist/db/migrations/0024_inbox.sql

@@ -0,0 +1,5 @@
+-- Migration 0024: Universal Inbox ("Save to FeedKeeper")
+-- Creates a dedicated system feed for each user's saved web articles and inbound clippings.
+
+-- Mark feeds that are internal system inboxes rather than polled RSS sources.
+ALTER TABLE feeds ADD COLUMN is_system_inbox INTEGER NOT NULL DEFAULT 0;

package/server/dist/db/migrations/0025_edition_overview.sql

@@ -0,0 +1,2 @@
+-- Optional, provider-independent linked overviews for native editions.
+ALTER TABLE editions ADD COLUMN overview TEXT CHECK (overview IS NULL OR json_valid(overview));

package/server/dist/db/migrations/0026_article_content.sql

@@ -0,0 +1,43 @@
+-- Shared reader content lifecycle; no client- or AI-specific state.
+ALTER TABLE items ADD COLUMN content_revision INTEGER NOT NULL DEFAULT 1;
+ALTER TABLE items ADD COLUMN extraction_status TEXT NOT NULL DEFAULT 'pending';
+ALTER TABLE items ADD COLUMN extraction_attempted_at TEXT;
+ALTER TABLE items ADD COLUMN extraction_retry_at TEXT;
+UPDATE items SET extraction_status = 'ready' WHERE full_content_html IS NOT NULL;
+CREATE TABLE full_text_jobs (
+  item_id INTEGER PRIMARY KEY REFERENCES items(id) ON DELETE CASCADE,
+  user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  priority INTEGER NOT NULL DEFAULT 0,
+  available_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+);
+CREATE INDEX idx_full_text_jobs_due ON full_text_jobs(available_at, priority);
+CREATE TRIGGER trg_content_revision AFTER UPDATE OF content_html, full_content_html, content_snippet, image_url, title, link ON items
+WHEN OLD.content_html IS NOT NEW.content_html OR OLD.full_content_html IS NOT NEW.full_content_html
+  OR OLD.content_snippet IS NOT NEW.content_snippet OR OLD.image_url IS NOT NEW.image_url OR OLD.title IS NOT NEW.title OR OLD.link IS NOT NEW.link
+BEGIN
+  UPDATE items SET content_revision = OLD.content_revision + 1,
+    extraction_status = CASE WHEN NEW.full_content_html IS NOT NULL THEN 'ready' WHEN OLD.extraction_status = 'feed_only' THEN 'pending' ELSE NEW.extraction_status END
+  WHERE id = NEW.id;
+END;
+CREATE TRIGGER trg_content_changes AFTER UPDATE OF content_revision, extraction_status, extraction_retry_at ON items
+WHEN OLD.content_revision IS NOT NEW.content_revision OR OLD.extraction_status IS NOT NEW.extraction_status OR OLD.extraction_retry_at IS NOT NEW.extraction_retry_at
+BEGIN
+  INSERT INTO changes(user_id, entity, entity_id, op, seq, changed_at)
+  SELECT owners.user_id, 'item_content', NEW.id, 'upsert',
+    (SELECT COALESCE(MAX(seq), 0) + 1 FROM changes WHERE user_id = owners.user_id), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+  FROM (SELECT user_id FROM subscriptions WHERE feed_id = NEW.feed_id
+    UNION SELECT user_id FROM item_bookmarks WHERE item_id = NEW.id
+    UNION SELECT user_id FROM item_notes WHERE item_id = NEW.id
+    UNION SELECT e.user_id FROM editions e, json_each(e.item_ids) selected
+      WHERE selected.value = NEW.id AND e.status = 'active' AND julianday(e.expires_at) > julianday('now')) owners WHERE 1
+  ON CONFLICT(user_id, entity, entity_id) DO UPDATE SET seq = excluded.seq, changed_at = excluded.changed_at, op = excluded.op;
+END;
+
+-- Metadata-only nested updates must not issue a second FTS delete for the new body.
+DROP TRIGGER trg_items_fts_update;
+CREATE TRIGGER trg_items_fts_update AFTER UPDATE OF title, content_snippet, content_html, full_content_html ON items BEGIN
+  INSERT INTO items_fts(items_fts, rowid, title, content_snippet, content_html, full_content_html)
+  VALUES ('delete', old.id, old.title, old.content_snippet, old.content_html, old.full_content_html);
+  INSERT INTO items_fts(rowid, title, content_snippet, content_html, full_content_html)
+  VALUES (new.id, new.title, new.content_snippet, new.content_html, new.full_content_html);
+END;

package/server/dist/db/migrations/0027_oauth.sql

@@ -0,0 +1,38 @@
+-- Migration 0027: OAuth 2.1 for the remote MCP endpoint (ChatGPT, Claude and other connectors).
+-- OAuth grants live apart from personal_access_tokens: they expire, rotate and only work on /mcp.
+
+CREATE TABLE oauth_clients (
+  client_id TEXT PRIMARY KEY,
+  client_name TEXT NOT NULL,
+  redirect_uris TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+);
+
+-- Single-use authorization codes (60 seconds), stored as hashes.
+CREATE TABLE oauth_codes (
+  code_hash TEXT PRIMARY KEY,
+  client_id TEXT NOT NULL REFERENCES oauth_clients(client_id) ON DELETE CASCADE,
+  user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  redirect_uri TEXT NOT NULL,
+  code_challenge TEXT NOT NULL,
+  scope TEXT NOT NULL CHECK (scope IN ('read', 'write')),
+  expires_at TEXT NOT NULL
+);
+
+-- One row per connected app: the current access token and its rotating refresh token.
+CREATE TABLE oauth_grants (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  client_id TEXT NOT NULL REFERENCES oauth_clients(client_id) ON DELETE CASCADE,
+  scope TEXT NOT NULL CHECK (scope IN ('read', 'write')),
+  access_hash TEXT NOT NULL UNIQUE,
+  access_expires_at TEXT NOT NULL,
+  refresh_hash TEXT NOT NULL UNIQUE,
+  -- The refresh token this one replaced: presenting it again means it leaked, so the grant is revoked.
+  previous_refresh_hash TEXT,
+  refresh_expires_at TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  last_used_at TEXT
+);
+CREATE INDEX idx_oauth_grants_user ON oauth_grants(user_id);
+CREATE INDEX idx_oauth_grants_client ON oauth_grants(client_id);

package/server/dist/db/migrations/0028_user_intro.sql

@@ -0,0 +1,2 @@
+-- The short introduction to the app is shown to every account once; this is when the person closed it (NULL: not yet).
+ALTER TABLE users ADD COLUMN intro_dismissed_at TEXT;

package/server/dist/db/migrations/0029_account_security.sql

@@ -0,0 +1,35 @@
+-- Account security is independent of the client used to sign in.
+CREATE TABLE account_security (
+  user_id INTEGER PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
+  user_handle TEXT NOT NULL UNIQUE,
+  version INTEGER NOT NULL DEFAULT 0,
+  totp_secret TEXT,
+  totp_last_step INTEGER NOT NULL DEFAULT -1
+);
+CREATE TABLE passkeys (
+  id TEXT PRIMARY KEY,
+  user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  public_key BLOB NOT NULL,
+  counter INTEGER NOT NULL DEFAULT 0,
+  transports TEXT NOT NULL,
+  name TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  last_used_at TEXT
+);
+CREATE INDEX passkeys_user ON passkeys(user_id);
+CREATE TABLE security_challenges (
+  id_hash TEXT PRIMARY KEY,
+  purpose TEXT NOT NULL,
+  user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
+  binding TEXT NOT NULL,
+  version INTEGER NOT NULL,
+  payload TEXT NOT NULL,
+  expires_at INTEGER NOT NULL,
+  attempts INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX security_challenges_expiry ON security_challenges(expires_at);
+CREATE TABLE recovery_codes (
+  user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  code_hash TEXT NOT NULL,
+  PRIMARY KEY (user_id, code_hash)
+);

package/server/dist/db/migrations/0030_feed_poll_jobs.sql

@@ -0,0 +1,15 @@
+-- One application process owns polling. Pending work is durable; running locks are memory-only.
+CREATE TABLE feed_poll_jobs (
+  feed_id INTEGER PRIMARY KEY REFERENCES feeds(id) ON DELETE CASCADE,
+  host TEXT NOT NULL,
+  enqueued_at INTEGER NOT NULL,
+  available_at INTEGER NOT NULL,
+  attempts INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX idx_feed_poll_jobs_due ON feed_poll_jobs(available_at, enqueued_at, feed_id);
+CREATE INDEX idx_feed_poll_jobs_host ON feed_poll_jobs(host);
+CREATE TABLE feed_poll_hosts (
+  host TEXT PRIMARY KEY,
+  retry_at INTEGER NOT NULL
+) WITHOUT ROWID;
+CREATE INDEX idx_feed_poll_jobs_fifo ON feed_poll_jobs(enqueued_at, feed_id);

package/server/dist/db/migrations/0031_push_outbox.sql

@@ -0,0 +1,19 @@
+-- One event per committed feed update, not one waiting task per recipient.
+-- Cursors are durable; one application process dispatches device deliveries.
+CREATE TABLE push_outbox (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  feed_id INTEGER NOT NULL REFERENCES feeds(id) ON DELETE CASCADE,
+  max_item_id INTEGER NOT NULL,
+  item_count INTEGER NOT NULL,
+  subscription_ceiling INTEGER NOT NULL,
+  subscription_cursor INTEGER NOT NULL DEFAULT 0,
+  current_subscription INTEGER NOT NULL DEFAULT 0,
+  device_cursor INTEGER NOT NULL DEFAULT 0,
+  device_ceiling INTEGER NOT NULL DEFAULT 0,
+  target_device INTEGER NOT NULL DEFAULT 0,
+  attempts INTEGER NOT NULL DEFAULT 0,
+  available_at INTEGER NOT NULL,
+  created_at INTEGER NOT NULL
+);
+CREATE INDEX idx_push_outbox_due ON push_outbox(available_at, id);
+CREATE INDEX idx_push_outbox_feed ON push_outbox(feed_id, id);

package/server/dist/feedkeeper.js

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { HELP, UsageError, parseArgs, prepareEnvironment } from "./cli.js";
+import { APP_VERSION } from "./version.js";
+// Everything that reads the settings is imported only after the environment is complete: the configuration
+// module validates SESSION_SECRET the moment it loads.
+async function main() {
+    const options = parseArgs(process.argv.slice(2));
+    if (options.action === "help")
+        return void console.log(HELP);
+    if (options.action === "version")
+        return void console.log(APP_VERSION);
+    const envFile = resolve(process.cwd(), ".env");
+    if (existsSync(envFile))
+        process.loadEnvFile(envFile);
+    const prepared = prepareEnvironment(options, process.env);
+    if (options.action === "backup" || options.action === "restore") {
+        process.argv.splice(2, process.argv.length, ...options.forwarded);
+        await import("./backup-cli.js");
+        return;
+    }
+    console.log(`[feedkeeper] version ${APP_VERSION}, data in ${prepared.dataDir}`);
+    if (prepared.secretCreated)
+        console.log(`[feedkeeper] created a session secret at ${prepared.secretPath}; keep it with your backups`);
+    await import("./server.js");
+}
+main().catch((error) => {
+    if (error instanceof UsageError) {
+        console.error(`feedkeeper: ${error.message}\nRun "feedkeeper --help" for usage.`);
+        process.exitCode = 2;
+    }
+    else {
+        console.error(error instanceof Error ? error.message : error);
+        process.exitCode = 1;
+    }
+});
+//# sourceMappingURL=feedkeeper.js.map

package/server/dist/feeds/archive.js

@@ -0,0 +1,334 @@
+import { createHash } from "node:crypto";
+import { mkdirSync, readdirSync, unlinkSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { link, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { config } from "../config.js";
+import { db } from "../db/index.js";
+import { fetchImage } from "./fetcher.js";
+import { loadFullText } from "./fullText.js";
+import { canAccessItem, findItemById, findItemForUser } from "./repository.js";
+import { decodeEntities } from "./text.js";
+import { ImageCache, ImageCacheBusyError } from "./imageCache.js";
+import { detectImageType } from "./imageTypes.js";
+export { detectImageType } from "./imageTypes.js";
+const MAX_IMAGES_PER_ARTICLE = 30;
+const MAX_IMAGE_BYTES = 5 * 1024 * 1024;
+const FILE_NAME = /^\d+-[0-9a-f]{16}\.(jpg|png|webp|gif|avif)$/;
+let imageCache;
+let imageCacheTimer;
+let imageCacheStopping = false;
+let imageCachePruning = false;
+const archiveWrites = new Set();
+async function storeArchivedImage(destination, image) {
+    const temporary = `${destination}.tmp`;
+    archiveWrites.add(temporary);
+    try {
+        await unlink(temporary).catch((error) => { if (error.code !== "ENOENT")
+            throw error; });
+        if (image.path)
+            await link(image.path, temporary).catch(() => writeFile(temporary, image.buffer, { mode: 0o600 }));
+        else
+            await writeFile(temporary, image.buffer, { mode: 0o600 });
+        await rename(temporary, destination);
+    }
+    finally {
+        archiveWrites.delete(temporary);
+    }
+}
+function sharedImages() {
+    if (!imageCache) {
+        imageCache = new ImageCache(config.imageCache);
+        imageCacheTimer = setInterval(() => {
+            if (imageCachePruning)
+                return;
+            imageCachePruning = true;
+            void imageCache.prune().catch(() => undefined).then(() => {
+                console.log(JSON.stringify({ event: "image_cache", ...imageCache.metrics() }));
+            }).finally(() => { imageCachePruning = false; });
+        }, 60_000);
+        imageCacheTimer.unref();
+    }
+    return imageCache;
+}
+export async function stopImageCache() {
+    imageCacheStopping = true;
+    if (imageCacheTimer)
+        clearInterval(imageCacheTimer);
+    await imageCache?.close();
+}
+function sharedImage(item, url) {
+    if (imageCacheStopping)
+        return Promise.reject(new ImageCacheBusyError());
+    const archived = db.prepare("SELECT file_name FROM archived_images WHERE item_id = ? AND source_url = ?").get(item.id, url);
+    // An old saved snapshot must not replace a newer article's image at the same URL.
+    const scope = archived ? `${item.feed_id}:archive:${item.id}` : item.feed_id;
+    return sharedImages().get(scope, url, async (signal) => {
+        if (archived) {
+            const path = join(archiveDir(), archived.file_name);
+            try {
+                const buffer = await readFile(path);
+                if (buffer.length <= MAX_IMAGE_BYTES && detectImageType(buffer))
+                    return { buffer, path };
+            }
+            catch { /* Recover a missing archived file from its source. */ }
+        }
+        return fetchImage(url, MAX_IMAGE_BYTES, signal);
+    });
+}
+function archiveDir() {
+    return resolve(config.archivePath);
+}
+function srcAttribute(tag) {
+    const match = /\ssrc\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/i.exec(tag);
+    if (!match)
+        return null;
+    const value = match[1] ?? match[2] ?? match[3] ?? "";
+    const start = match.index + match[0].indexOf(value, match[0].indexOf("="));
+    return { value, start, end: start + value.length };
+}
+function resolveImageUrl(raw, baseUrl) {
+    try {
+        const url = new URL(decodeEntities(raw.trim()), baseUrl ?? undefined);
+        return url.protocol === "https:" || url.protocol === "http:" ? url.toString() : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Image URLs an article shows, in order, without tracking pixels. */
+export function articleImageUrls(html, baseUrl) {
+    const urls = new Set();
+    for (const [tag] of html.matchAll(/<img\b[^>]*>/gi)) {
+        if (/\swidth\s*=\s*["']?1["'\s>]/i.test(tag) && /\sheight\s*=\s*["']?1["'\s>]/i.test(tag))
+            continue;
+        const src = srcAttribute(tag);
+        const url = src && resolveImageUrl(src.value, baseUrl);
+        if (url)
+            urls.add(url);
+    }
+    return [...urls];
+}
+/** Replace the `src` of every image for which `replacement` knows a new address. */
+function rewriteImageSources(html, baseUrl, replacement) {
+    return html.replace(/<img\b[^>]*>/gi, (tag) => {
+        const src = srcAttribute(tag);
+        const url = src && resolveImageUrl(src.value, baseUrl);
+        const next = url ? replacement(url) : undefined;
+        return src && next ? `${tag.slice(0, src.start)}${next}${tag.slice(src.end)}` : tag;
+    });
+}
+/** Point archived images in article HTML at their local copies under `origin`. */
+export function rewriteArchivedImages(html, baseUrl, images, origin, apiBase = "/api") {
+    if (images.size === 0)
+        return html;
+    return rewriteImageSources(html, baseUrl, (url) => {
+        const id = images.get(url);
+        return id ? archivedImageUrl(origin, id, apiBase) : undefined;
+    });
+}
+/** Absolute, so the web app treats archived images like any other image URL. */
+export function archivedImageUrl(origin, imageId, apiBase = "/api") {
+    return `${origin.replace(/\/$/, "")}${apiBase}/archive/images/${imageId}`;
+}
+function hasBookmark(itemId) {
+    return db.prepare("SELECT user_id FROM item_bookmarks WHERE item_id = ? LIMIT 1").get(itemId)?.user_id;
+}
+/** Keep a saved article readable for good: fetch its full text and store its images locally. */
+export async function archiveItem(itemId) {
+    const userId = hasBookmark(itemId);
+    if (userId === undefined)
+        return;
+    // Respects per-feed full-text settings and consent walls; falls back to the feed content.
+    await loadFullText(userId, itemId).catch(() => undefined);
+    const item = findItemById(itemId);
+    if (!item)
+        return;
+    const html = item.full_content_html ?? item.content_html ?? "";
+    const heroUrl = item.image_url ? resolveImageUrl(item.image_url, item.link) : null;
+    const urls = [...new Set([...(heroUrl ? [heroUrl] : []), ...articleImageUrls(html, item.link)])].slice(0, MAX_IMAGES_PER_ARTICLE);
+    const known = new Set(db.prepare("SELECT source_url FROM archived_images WHERE item_id = ?").all(itemId).map((row) => row.source_url));
+    const insert = db.prepare("INSERT INTO archived_images (item_id, source_url, file_name, mime_type, byte_size) VALUES (?, ?, ?, ?, ?) ON CONFLICT (item_id, source_url) DO NOTHING");
+    mkdirSync(archiveDir(), { recursive: true });
+    for (const url of urls) {
+        if (imageCacheStopping)
+            return;
+        if (known.has(url))
+            continue;
+        try {
+            const image = await sharedImage(item, url);
+            if (image === "unsupported")
+                continue;
+            const { buffer } = image;
+            const type = detectImageType(buffer);
+            if (!type)
+                continue;
+            const fileName = `${itemId}-${createHash("sha256").update(url).digest("hex").slice(0, 16)}.${type.ext}`;
+            const destination = join(archiveDir(), fileName);
+            await storeArchivedImage(destination, image);
+            // The last bookmark or article may have disappeared while the image was loading.
+            if (!hasBookmark(itemId) || !findItemById(itemId)) {
+                unlinkSync(destination);
+                continue;
+            }
+            insert.run(itemId, url, fileName, type.mime, buffer.length);
+        }
+        catch (error) {
+            // Leave the durable bookmark pending so startup can finish it later.
+            if (error instanceof ImageCacheBusyError || imageCacheStopping)
+                return;
+            // A missing image should not stop the rest of the article from being archived.
+        }
+    }
+    if (!imageCacheStopping)
+        db.prepare("UPDATE items SET archived_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = ?").run(itemId);
+}
+const queue = [];
+let draining = false;
+async function drain() {
+    if (draining)
+        return;
+    draining = true;
+    try {
+        while (queue.length > 0) {
+            const itemId = queue.shift();
+            await archiveItem(itemId).catch((error) => console.warn(`[archive] item ${itemId}:`, error));
+        }
+    }
+    finally {
+        draining = false;
+    }
+}
+/** Archive in the background, one article at a time, so saving stays instant. */
+export function scheduleArchive(itemId) {
+    if (!queue.includes(itemId))
+        queue.push(itemId);
+    void drain();
+}
+/** Catch up on saved articles that were never archived, e.g. saved before this feature. */
+export function scheduleMissingArchives() {
+    const rows = db.prepare("SELECT DISTINCT i.id FROM items i JOIN item_bookmarks b ON b.item_id = i.id WHERE i.archived_at IS NULL ORDER BY i.id").all();
+    rows.forEach((row) => scheduleArchive(row.id));
+    return rows.length;
+}
+/** Wait until queued archiving is done (used by tests and shutdown). */
+export async function archiveIdle() {
+    while (draining || queue.length > 0)
+        await new Promise((resolve) => setTimeout(resolve, 20));
+}
+/** Delete archived images of articles nobody has saved anymore, plus stray files. */
+export function pruneArchive() {
+    const stale = db.prepare("SELECT a.id, a.item_id, a.file_name FROM archived_images a WHERE NOT EXISTS (SELECT 1 FROM item_bookmarks b WHERE b.item_id = a.item_id)").all();
+    db.transaction(() => {
+        for (const row of stale) {
+            db.prepare("DELETE FROM archived_images WHERE id = ?").run(row.id);
+            db.prepare("UPDATE items SET archived_at = NULL WHERE id = ?").run(row.item_id);
+        }
+        db.prepare("UPDATE items SET archived_at = NULL WHERE archived_at IS NOT NULL AND id NOT IN (SELECT item_id FROM item_bookmarks)").run();
+    })();
+    let removed = 0;
+    let files;
+    try {
+        files = readdirSync(archiveDir());
+    }
+    catch {
+        return 0;
+    }
+    const kept = new Set(db.prepare("SELECT file_name FROM archived_images").all().map((row) => row.file_name));
+    for (const file of files) {
+        if (file.endsWith(".tmp") && FILE_NAME.test(file.slice(0, -4)) && !archiveWrites.has(join(archiveDir(), file))) {
+            try {
+                unlinkSync(join(archiveDir(), file));
+                removed++;
+            }
+            catch { /* Already gone. */ }
+            continue;
+        }
+        if (!FILE_NAME.test(file) || kept.has(file))
+            continue;
+        try {
+            unlinkSync(join(archiveDir(), file));
+            removed++;
+        }
+        catch {
+            // Already gone.
+        }
+    }
+    return removed;
+}
+/** Local copies for the given items, keyed by original URL. */
+export function archivedImagesFor(itemIds) {
+    const result = new Map();
+    if (itemIds.length === 0)
+        return result;
+    const rows = db.prepare(`SELECT id, item_id, source_url FROM archived_images WHERE item_id IN (${itemIds.map(() => "?").join(",")})`).all(...itemIds);
+    for (const row of rows) {
+        if (!result.has(row.item_id))
+            result.set(row.item_id, new Map());
+        result.get(row.item_id).set(row.source_url, row.id);
+    }
+    return result;
+}
+/** An archived image the user may see (they subscribe to or saved its article). */
+export function findArchivedImage(userId, imageId) {
+    const row = db.prepare("SELECT item_id, file_name, mime_type FROM archived_images WHERE id = ?").get(imageId);
+    if (!row || !canAccessItem(userId, row.item_id))
+        return null;
+    return { path: join(archiveDir(), row.file_name), mime: row.mime_type };
+}
+/** Swap image URLs of archived articles for their local copies before sending them to the browser. */
+export function withArchivedImages(items, origin, apiBase = "/api") {
+    const archived = archivedImagesFor(items.map((item) => item.id));
+    return items.map((item) => {
+        const images = archived.get(item.id);
+        if (!images)
+            return item;
+        const hero = item.image_url ? resolveImageUrl(item.image_url, item.link) : null;
+        return {
+            ...item,
+            image_url: hero && images.has(hero) ? archivedImageUrl(origin, images.get(hero), apiBase) : item.image_url,
+            content_html: item.content_html ? rewriteArchivedImages(item.content_html, item.link, images, origin, apiBase) : item.content_html,
+            full_content_html: item.full_content_html ? rewriteArchivedImages(item.full_content_html, item.link, images, origin, apiBase) : item.full_content_html,
+        };
+    });
+}
+/** Every image address an article shows: the lead image first, then those in the text. */
+export function itemImageUrls(item) {
+    const hero = item.image_url ? resolveImageUrl(item.image_url, item.link) : null;
+    return [...new Set([...(hero ? [hero] : []), ...articleImageUrls(item.full_content_html ?? "", item.link), ...articleImageUrls(item.content_html ?? "", item.link)])];
+}
+function proxiedImageUrl(origin, itemId, imageUrl, apiBase = "/api") {
+    return `${origin.replace(/\/$/, "")}${apiBase}/items/${itemId}/image?src=${encodeURIComponent(imageUrl).replace(/[!'()*]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`)}`;
+}
+/**
+ * For offline copies: point the first images of articles that are not archived at an endpoint
+ * of this server, so the browser can store them without cross-origin requests.
+ */
+export function withProxiedImages(items, origin, apiBase = "/api") {
+    const own = `${origin.replace(/\/$/, "")}/api/`;
+    return items.map((item) => {
+        const urls = new Set(itemImageUrls(item).filter((url) => !url.startsWith(own)));
+        if (urls.size === 0)
+            return item;
+        const replace = (url) => (urls.has(url) ? proxiedImageUrl(origin, item.id, url, apiBase) : undefined);
+        const hero = item.image_url ? resolveImageUrl(item.image_url, item.link) : null;
+        return {
+            ...item,
+            image_url: hero && urls.has(hero) ? proxiedImageUrl(origin, item.id, hero, apiBase) : item.image_url,
+            content_html: item.content_html ? rewriteImageSources(item.content_html, item.link, replace) : item.content_html,
+            full_content_html: item.full_content_html ? rewriteImageSources(item.full_content_html, item.link, replace) : item.full_content_html,
+        };
+    });
+}
+/** Download one of an article's own images for the offline copy, or null when it is not one of them. */
+export async function fetchItemImage(userId, itemId, imageUrl) {
+    const item = findItemForUser(userId, itemId);
+    if (!item || !itemImageUrls(item).includes(imageUrl))
+        return "forbidden";
+    const image = await sharedImage(item, imageUrl);
+    // Access or the article's image list can change while a shared download is running.
+    const current = findItemForUser(userId, itemId);
+    if (!current || !itemImageUrls(current).includes(imageUrl))
+        return "forbidden";
+    return image;
+}
+//# sourceMappingURL=archive.js.map