feedkeeper 0.27.0 → 0.27.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "feedkeeper",
-  "version": "0.27.0",
+  "version": "0.27.2",
   "description": "A lightweight, self-hosted RSS reader and remote MCP server for your news, blogs, and AI workflows.",
   "keywords": [
     "rss",

package/server/dist/api/items.js

@@ -123,10 +123,11 @@ itemsRouter.post("/:itemId/extract-content", async (req, res) => {
         res.status(FULL_TEXT_STATUS[result.error]).json({ error: result.error, ...(result.message ? { message: result.message } : {}) });
         return;
     }
-    const [served] = withArchivedImages([{ id: result.id, link: findItemById(result.id)?.link ?? null, full_content_html: result.fullContentHtml }], requestOrigin(req));
+    const currentItem = findItemById(result.id);
+    const [served] = withArchivedImages([{ id: result.id, link: currentItem?.link ?? null, full_content_html: result.fullContentHtml }], requestOrigin(req));
     res.json({
         id: result.id,
-        full_content_html: readerHtml(served.full_content_html, result.title ?? findItemById(result.id)?.title, findItemById(result.id)?.author),
+        full_content_html: readerHtml(served.full_content_html, result.title ?? currentItem?.title, currentItem?.author),
         ...(result.cached ? {} : { title: result.title, byline: result.byline }),
         cached: result.cached,
     });

package/server/dist/api/v1/resources.js

@@ -11,7 +11,7 @@ import { loadFullText } from "../../feeds/fullText.js";
 import { generateOpml, importOpmlFeeds } from "../../feeds/opml.js";
 import { pollFeed, pollFeeds } from "../../feeds/poller.js";
 import { canAccessFeed, loadFeedIcon } from "../../feeds/feedIcon.js";
-import { addMutedKeyword, canAccessItem, createFolder, deleteFolder, deleteItemNote, findFeedById, findFolderById, findItemForUser, findItemNote, noteConflictState, isUserSubscribed, itemsWithNotes, listFoldersForUser, listItemsForUser, listMutedKeywords, listNotesForUser, listSubscriptionsForUser, markAllRead, removeMutedKeyword, reorderSubscriptions, searchItemsForUser, setItemNote, updateFolder, } from "../../feeds/repository.js";
+import { addMutedKeyword, canAccessItem, createFolder, deleteFolder, deleteItemNote, findFeedById, findFolderById, findItemForUser, findItemsForUser, findSubscriptionForUser, findItemNote, noteConflictState, isUserSubscribed, itemsWithNotes, listFoldersForUser, listItemsForUser, listMutedKeywords, listNotesForUser, listSubscriptionsForUser, markAllRead, removeMutedKeyword, reorderSubscriptions, searchItemsForUser, setItemNote, updateFolder, } from "../../feeds/repository.js";
 import { saveToInbox, deleteInboxItem } from "../../feeds/inbox.js";
 import { changeFeedUrl, FeedError, MultipleFeedsFoundError, subscribeToFeed, unsubscribeFromFeed, updateFeedSettings } from "../../feeds/service.js";
 import { SsrfBlockedError, normalizeUrlCandidate } from "../../feeds/ssrfGuard.js";
@@ -29,7 +29,7 @@ const imageLimiter = rateLimit({ windowMs: 60 * 1000, limit: 600, standardHeader
 const urlField = z.preprocess((val) => (typeof val === "string" ? normalizeUrlCandidate(val) : val), z.string().url());
 const invalid = (res, details) => void res.status(400).json({ error: "invalid_input", ...(details ? { details } : {}) });
 function subscriptionOf(userId, id) {
-    const subscription = listSubscriptionsForUser(userId).find((entry) => entry.id === id);
+    const subscription = findSubscriptionForUser(userId, id);
     return subscription ? serializeSubscriptionDetail(subscription) : null;
 }
 // ---- Account -------------------------------------------------------------
@@ -302,9 +302,9 @@ const itemsQuery = z.object({
     images: z.enum(["original", "proxy"]).default("original"),
 });
 /** Rows ready for a native client: images served by this server where it keeps copies. */
-function prepare(rows, req, images) {
-    const archived = withArchivedImages(rows, origin(req), API_BASE);
-    return images === "proxy" ? withProxiedImages(archived, origin(req), API_BASE) : archived;
+function prepare(rows, req, images, withContent = true) {
+    const archived = withArchivedImages(rows, origin(req), API_BASE, withContent);
+    return images === "proxy" ? withProxiedImages(archived, origin(req), API_BASE, withContent) : archived;
 }
 const searchQuery = z.object({
     q: z.string().trim().min(1).max(200),
@@ -340,7 +340,7 @@ resourcesRouter.get("/search", requireCapability("search.fts"), (req, res) => {
     res.json({
         query: query.q,
         total,
-        items: prepare(rows, req, query.images).map((row) => serializeItem(row, progress, withContent, hasNotes.has(row.id))),
+        items: prepare(rows, req, query.images, withContent).map((row) => serializeItem(row, progress, withContent, hasNotes.has(row.id))),
     });
 });
 resourcesRouter.get("/items", (req, res) => {
@@ -374,7 +374,7 @@ resourcesRouter.get("/items", (req, res) => {
     const progress = readingPositions(req.user.id, page.map((row) => row.id));
     const hasNotes = itemsWithNotes(req.user.id, page.map((row) => row.id));
     res.json({
-        items: prepare(page, req, query.images).map((row) => serializeItem(row, progress, withContent, hasNotes.has(row.id))),
+        items: prepare(page, req, query.images, withContent).map((row) => serializeItem(row, progress, withContent, hasNotes.has(row.id))),
         newestCursor: page[0] ? encodeCursor(page[0]) : null,
         nextCursor: hasMore && page.length ? encodeCursor(page[page.length - 1]) : null,
     });
@@ -385,10 +385,11 @@ resourcesRouter.get("/items/bundle", (req, res) => {
     if (!parsed.success)
         return invalid(res, "ids: up to 50 comma separated article ids");
     const ids = [...new Set(parsed.data.ids.split(",").map(Number))];
-    const rows = ids.map((id) => findItemForUser(req.user.id, id)).filter((row) => Boolean(row));
+    const byId = new Map(findItemsForUser(req.user.id, ids).map((row) => [row.id, row]));
+    const rows = ids.map((id) => byId.get(id)).filter((row) => Boolean(row));
     const progress = readingPositions(req.user.id, rows.map((row) => row.id));
     const hasNotes = itemsWithNotes(req.user.id, rows.map((row) => row.id));
-    res.json({ items: prepare(rows, req, parsed.data.images).map((row) => serializeItem(row, progress, true, hasNotes.has(row.id))) });
+    res.json({ items: prepare(rows, req, parsed.data.images, true).map((row) => serializeItem(row, progress, true, hasNotes.has(row.id))) });
 });
 // Explicit extraction side effect; read-only devices continue to consume the shared cache.
 resourcesRouter.post("/items/prepare", requireCapability("fulltext"), async (req, res) => {
@@ -515,12 +516,13 @@ resourcesRouter.get("/notes/export", (req, res) => {
 });
 // ---- Curated Edition ("Deine Zeitung") ------------------------------------
 function editionResponse(req, edition) {
+    const byId = new Map(findItemsForUser(req.user.id, edition.itemIds).map((row) => [row.id, row]));
     const rows = edition.itemIds
-        .map((id) => findItemForUser(req.user.id, id))
+        .map((id) => byId.get(id))
         .filter((row) => Boolean(row));
     const progress = readingPositions(req.user.id, rows.map((r) => r.id));
     const hasNotes = itemsWithNotes(req.user.id, rows.map((r) => r.id));
-    const prepared = prepare(rows, req, req.query.images === "proxy" ? "proxy" : "original");
+    const prepared = prepare(rows, req, req.query.images === "proxy" ? "proxy" : "original", false);
     return {
         ...edition,
         items: prepared.map((row) => serializeItem(row, progress, false, hasNotes.has(row.id))),

package/server/dist/auth/tokens.js

@@ -38,9 +38,16 @@ export function resolveToken(token) {
     if (stored.length !== provided.length || !timingSafeEqual(stored, provided)) {
         return null;
     }
-    db.prepare("UPDATE personal_access_tokens SET last_used_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = ?").run(row.id);
+    const now = Date.now();
+    const lastTouch = tokenLastTouch.get(row.id) ?? 0;
+    if (!row.last_used_at || now - lastTouch >= TOKEN_TOUCH_INTERVAL_MS) {
+        tokenLastTouch.set(row.id, now);
+        db.prepare("UPDATE personal_access_tokens SET last_used_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = ?").run(row.id);
+    }
     return { userId: row.user_id, scope: row.scope, kind: row.kind, tokenId: row.id };
 }
+const tokenLastTouch = new Map();
+const TOKEN_TOUCH_INTERVAL_MS = 5 * 60 * 1000;
 /** Hand-made tokens only; paired devices are listed separately. */
 export function listTokensForUser(userId) {
     return db
@@ -49,6 +56,7 @@ export function listTokensForUser(userId) {
         .map(({ token_hash, ...rest }) => rest);
 }
 export function deleteToken(userId, tokenId) {
+    tokenLastTouch.delete(tokenId);
     db.prepare("DELETE FROM personal_access_tokens WHERE id = ? AND user_id = ? AND kind = 'api'").run(tokenId, userId);
 }
 export function listDevicesForUser(userId) {
@@ -59,6 +67,7 @@ export function listDevicesForUser(userId) {
 }
 /** Revokes a device; its token stops working immediately. Returns whether one was removed. */
 export function deleteDevice(userId, deviceId) {
+    tokenLastTouch.delete(deviceId);
     return db.prepare("DELETE FROM personal_access_tokens WHERE id = ? AND user_id = ? AND kind = 'device'").run(deviceId, userId).changes > 0;
 }
 //# sourceMappingURL=tokens.js.map

package/server/dist/db/index.js

@@ -8,7 +8,11 @@ const MIGRATIONS_DIR = join(__dirname, "migrations");
 mkdirSync(dirname(config.databasePath), { recursive: true });
 export const db = new Database(config.databasePath);
 db.pragma("journal_mode = WAL");
+db.pragma("synchronous = NORMAL");
 db.pragma("foreign_keys = ON");
+db.pragma("busy_timeout = 5000");
+db.pragma("temp_store = MEMORY");
+db.pragma("cache_size = -65536");
 function ensureMigrationsTable() {
     db.exec(`CREATE TABLE IF NOT EXISTS _migrations (
       name TEXT PRIMARY KEY,

package/server/dist/db/migrations/0038_author_revision.sql

@@ -0,0 +1,7 @@
+-- A client that already holds an item learns of a later author through the content revision. Only the revision
+-- moves: the extraction status stays, so no full text is fetched again for it.
+CREATE TRIGGER trg_author_revision AFTER UPDATE OF author ON items
+WHEN OLD.author IS NOT NEW.author
+BEGIN
+  UPDATE items SET content_revision = OLD.content_revision + 1 WHERE id = NEW.id;
+END;

package/server/dist/db/migrations/0039_performance_indexes.sql

@@ -0,0 +1,96 @@
+-- Foreign key and cascade delete indexes
+CREATE INDEX IF NOT EXISTS idx_item_reads_item ON item_reads(item_id);
+CREATE INDEX IF NOT EXISTS idx_item_progress_item ON item_progress(item_id);
+CREATE INDEX IF NOT EXISTS idx_item_note_revisions_item ON item_note_revisions(item_id);
+CREATE INDEX IF NOT EXISTS idx_full_text_jobs_user ON full_text_jobs(user_id);
+CREATE INDEX IF NOT EXISTS idx_oauth_codes_user ON oauth_codes(user_id);
+CREATE INDEX IF NOT EXISTS idx_oauth_codes_client ON oauth_codes(client_id);
+CREATE INDEX IF NOT EXISTS idx_security_challenges_user ON security_challenges(user_id);
+
+-- Housekeeping and retention cleanup indexes
+CREATE INDEX IF NOT EXISTS idx_native_requests_created ON native_requests(created_at);
+CREATE INDEX IF NOT EXISTS idx_applied_mutations_applied ON applied_mutations(applied_at);
+CREATE INDEX IF NOT EXISTS idx_items_feed_eff_pub ON items(
+  feed_id,
+  COALESCE(julianday(published_at), julianday(created_at)) DESC,
+  id DESC
+);
+
+-- Item listing, cursor pagination, lead backfill, and full-text candidate indexes
+CREATE INDEX IF NOT EXISTS idx_items_feed_created ON items(feed_id, created_at DESC, id DESC);
+CREATE INDEX IF NOT EXISTS idx_bookmarks_user_created ON item_bookmarks(user_id, created_at DESC, item_id DESC);
+CREATE INDEX IF NOT EXISTS idx_items_lead_version ON items(lead_version);
+CREATE INDEX IF NOT EXISTS idx_items_fulltext_candidates ON items(feed_id, created_at DESC)
+  WHERE link IS NOT NULL AND full_content_html IS NULL AND extraction_status != 'feed_only';
+
+-- Avoid rebuilding FTS5 entries when non-indexed item columns change during polling or extraction
+DROP TRIGGER IF EXISTS trg_items_fts_update;
+CREATE TRIGGER trg_items_fts_update AFTER UPDATE ON items
+WHEN OLD.title IS NOT NEW.title
+  OR OLD.content_snippet IS NOT NEW.content_snippet
+  OR OLD.content_html IS NOT NEW.content_html
+  OR OLD.full_content_html IS NOT NEW.full_content_html
+BEGIN
+  INSERT INTO items_fts(items_fts, rowid, title, content_snippet, content_html, full_content_html)
+  VALUES ('delete', old.id, old.title, old.content_snippet, old.content_html, old.full_content_html);
+  INSERT INTO items_fts(rowid, title, content_snippet, content_html, full_content_html)
+  VALUES (new.id, new.title, new.content_snippet, new.content_html, new.full_content_html);
+END;
+
+-- Monotonic per-user sync sequence high-water mark across change log pruning
+ALTER TABLE sync_state ADD COLUMN last_seq INTEGER NOT NULL DEFAULT 0;
+UPDATE sync_state
+SET last_seq = MAX(
+  pruned_through,
+  COALESCE((SELECT MAX(seq) FROM changes WHERE changes.user_id = sync_state.user_id), 0)
+);
+
+DROP TRIGGER IF EXISTS trg_changes_seq_insert;
+CREATE TRIGGER trg_changes_seq_insert
+AFTER INSERT ON changes
+WHEN NEW.seq <= COALESCE((SELECT MAX(last_seq, pruned_through) FROM sync_state WHERE user_id = NEW.user_id), 0)
+BEGIN
+  UPDATE changes
+  SET seq = MAX(
+    COALESCE((SELECT MAX(seq) FROM changes WHERE user_id = NEW.user_id), 0),
+    COALESCE((SELECT MAX(last_seq, pruned_through) FROM sync_state WHERE user_id = NEW.user_id), 0)
+  ) + 1
+  WHERE user_id = NEW.user_id AND entity = NEW.entity AND entity_id = NEW.entity_id;
+END;
+
+DROP TRIGGER IF EXISTS trg_changes_seq_update;
+CREATE TRIGGER trg_changes_seq_update
+AFTER UPDATE OF seq ON changes
+WHEN NEW.seq <= COALESCE((SELECT MAX(last_seq, pruned_through) FROM sync_state WHERE user_id = NEW.user_id), 0)
+BEGIN
+  UPDATE changes
+  SET seq = MAX(
+    COALESCE((SELECT MAX(seq) FROM changes WHERE user_id = NEW.user_id), 0),
+    COALESCE((SELECT MAX(last_seq, pruned_through) FROM sync_state WHERE user_id = NEW.user_id), 0)
+  ) + 1
+  WHERE user_id = NEW.user_id AND entity = NEW.entity AND entity_id = NEW.entity_id;
+END;
+
+-- Record old feed deletion when a subscription moves to a different feed
+DROP TRIGGER IF EXISTS trg_changes_subscription_move;
+CREATE TRIGGER trg_changes_subscription_move
+AFTER UPDATE OF feed_id ON subscriptions
+WHEN OLD.feed_id IS NOT NEW.feed_id
+BEGIN
+  INSERT INTO changes (user_id, entity, entity_id, op, seq, changed_at)
+  VALUES (OLD.user_id, 'subscription', OLD.feed_id, 'delete', (SELECT COALESCE(MAX(seq), 0) + 1 FROM changes WHERE user_id = OLD.user_id), strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+  ON CONFLICT (user_id, entity, entity_id) DO UPDATE SET op = excluded.op, seq = excluded.seq, changed_at = excluded.changed_at;
+END;
+
+-- Notify subscribers when a feed's URL or poll interval is updated in place
+DROP TRIGGER IF EXISTS trg_changes_feed_update;
+CREATE TRIGGER trg_changes_feed_update
+AFTER UPDATE OF url, poll_interval_minutes ON feeds
+WHEN OLD.url IS NOT NEW.url OR OLD.poll_interval_minutes IS NOT NEW.poll_interval_minutes
+BEGIN
+  INSERT INTO changes (user_id, entity, entity_id, op, seq, changed_at)
+  SELECT s.user_id, 'subscription', NEW.id, 'upsert', (SELECT COALESCE(MAX(seq), 0) + 1 FROM changes WHERE user_id = s.user_id), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+  FROM subscriptions s
+  WHERE s.feed_id = NEW.id
+  ON CONFLICT (user_id, entity, entity_id) DO UPDATE SET op = excluded.op, seq = excluded.seq, changed_at = excluded.changed_at;
+END;

package/server/dist/feeds/archive.js

@@ -22,6 +22,7 @@ const archiveWrites = new Set();
 async function storeArchivedImage(destination, image) {
     const temporary = `${destination}.tmp`;
     archiveWrites.add(temporary);
+    archiveWrites.add(destination);
     try {
         await unlink(temporary).catch((error) => { if (error.code !== "ENOENT")
             throw error; });
@@ -164,13 +165,18 @@ export async function archiveItem(itemId) {
                 continue;
             const fileName = `${itemId}-${createHash("sha256").update(url).digest("hex").slice(0, 16)}.${type.ext}`;
             const destination = join(archiveDir(), fileName);
-            await storeArchivedImage(destination, image);
-            // The last bookmark or article may have disappeared while the image was loading.
-            if (!hasBookmark(itemId) || !findItemById(itemId)) {
-                unlinkSync(destination);
-                continue;
+            try {
+                await storeArchivedImage(destination, image);
+                // The last bookmark or article may have disappeared while the image was loading.
+                if (!hasBookmark(itemId) || !findItemById(itemId)) {
+                    unlinkSync(destination);
+                    continue;
+                }
+                insert.run(itemId, url, fileName, type.mime, buffer.length);
+            }
+            finally {
+                archiveWrites.delete(destination);
             }
-            insert.run(itemId, url, fileName, type.mime, buffer.length);
         }
         catch (error) {
             // Leave the durable bookmark pending so startup can finish it later.
@@ -276,7 +282,7 @@ export function findArchivedImage(userId, imageId) {
     return { path: join(archiveDir(), row.file_name), mime: row.mime_type };
 }
 /** Swap image URLs of archived articles for their local copies before sending them to the browser. */
-export function withArchivedImages(items, origin, apiBase = "/api") {
+export function withArchivedImages(items, origin, apiBase = "/api", withContent = true) {
     const archived = archivedImagesFor(items.map((item) => item.id));
     return items.map((item) => {
         const images = archived.get(item.id);
@@ -286,8 +292,8 @@ export function withArchivedImages(items, origin, apiBase = "/api") {
         return {
             ...item,
             image_url: hero && images.has(hero) ? archivedImageUrl(origin, images.get(hero), apiBase) : item.image_url,
-            content_html: item.content_html ? rewriteArchivedImages(item.content_html, item.link, images, origin, apiBase) : item.content_html,
-            full_content_html: item.full_content_html ? rewriteArchivedImages(item.full_content_html, item.link, images, origin, apiBase) : item.full_content_html,
+            content_html: withContent && item.content_html ? rewriteArchivedImages(item.content_html, item.link, images, origin, apiBase) : item.content_html,
+            full_content_html: withContent && item.full_content_html ? rewriteArchivedImages(item.full_content_html, item.link, images, origin, apiBase) : item.full_content_html,
         };
     });
 }
@@ -303,7 +309,7 @@ function proxiedImageUrl(origin, itemId, imageUrl, apiBase = "/api") {
  * For offline copies: point the first images of articles that are not archived at an endpoint
  * of this server, so the browser can store them without cross-origin requests.
  */
-export function withProxiedImages(items, origin, apiBase = "/api") {
+export function withProxiedImages(items, origin, apiBase = "/api", withContent = true) {
     const own = `${origin.replace(/\/$/, "")}/api/`;
     return items.map((item) => {
         const urls = new Set(itemImageUrls(item).filter((url) => !url.startsWith(own)));
@@ -314,20 +320,26 @@ export function withProxiedImages(items, origin, apiBase = "/api") {
         return {
             ...item,
             image_url: hero && urls.has(hero) ? proxiedImageUrl(origin, item.id, hero, apiBase) : item.image_url,
-            content_html: item.content_html ? rewriteImageSources(item.content_html, item.link, replace) : item.content_html,
-            full_content_html: item.full_content_html ? rewriteImageSources(item.full_content_html, item.link, replace) : item.full_content_html,
+            content_html: withContent && item.content_html ? rewriteImageSources(item.content_html, item.link, replace) : item.content_html,
+            full_content_html: withContent && item.full_content_html ? rewriteImageSources(item.full_content_html, item.link, replace) : item.full_content_html,
         };
     });
 }
 /** Download one of an article's own images for the offline copy, or null when it is not one of them. */
 export async function fetchItemImage(userId, itemId, imageUrl) {
     const item = findItemForUser(userId, itemId);
-    if (!item || !itemImageUrls(item).includes(imageUrl))
+    if (!item)
+        return "forbidden";
+    const isMatch = (it) => {
+        const hero = it.image_url ? resolveImageUrl(it.image_url, it.link) : null;
+        return hero === imageUrl || itemImageUrls(it).includes(imageUrl);
+    };
+    if (!isMatch(item))
         return "forbidden";
     const image = await sharedImage(item, imageUrl);
     // Access or the article's image list can change while a shared download is running.
     const current = findItemForUser(userId, itemId);
-    if (!current || !itemImageUrls(current).includes(imageUrl))
+    if (!current || !isMatch(current))
         return "forbidden";
     return image;
 }

package/server/dist/feeds/cleanup.js

@@ -91,8 +91,8 @@ export function runCleanup(custom) {
          WHERE i.id NOT IN (SELECT item_id FROM item_bookmarks)
            AND i.id NOT IN (SELECT item_id FROM item_notes)
            AND i.feed_id NOT IN (SELECT id FROM feeds WHERE is_system_inbox = 1)
-           AND NOT EXISTS (SELECT 1 FROM editions e, json_each(e.item_ids) selected
-             WHERE selected.value = i.id AND e.source = 'curated' AND e.status <> 'dismissed')
+           AND i.id NOT IN (SELECT CAST(selected.value AS INTEGER) FROM editions e, json_each(e.item_ids) selected
+             WHERE e.source = 'curated' AND e.status <> 'dismissed')
            AND i.id IN (SELECT item_id FROM item_reads)
            AND NOT EXISTS (
              SELECT 1 FROM subscriptions s
@@ -109,8 +109,8 @@ export function runCleanup(custom) {
        WHERE id NOT IN (SELECT item_id FROM item_bookmarks)
          AND id NOT IN (SELECT item_id FROM item_notes)
          AND feed_id NOT IN (SELECT id FROM feeds WHERE is_system_inbox = 1)
-         AND NOT EXISTS (SELECT 1 FROM editions e, json_each(e.item_ids) selected
-           WHERE selected.value = items.id AND e.source = 'curated' AND e.status <> 'dismissed')
+         AND id NOT IN (SELECT CAST(selected.value AS INTEGER) FROM editions e, json_each(e.item_ids) selected
+           WHERE e.source = 'curated' AND e.status <> 'dismissed')
          AND COALESCE(julianday(published_at), julianday(created_at)) <= julianday('now', '-' || ? || ' days')`).run(settings.retentionMaxDays);
         deletedOldItems = res.changes;
     }
@@ -120,8 +120,8 @@ export function runCleanup(custom) {
        WHERE id NOT IN (SELECT item_id FROM item_bookmarks)
          AND id NOT IN (SELECT item_id FROM item_notes)
          AND feed_id NOT IN (SELECT id FROM feeds WHERE is_system_inbox = 1)
-         AND NOT EXISTS (SELECT 1 FROM editions e, json_each(e.item_ids) selected
-           WHERE selected.value = items.id AND e.source = 'curated' AND e.status <> 'dismissed')
+         AND id NOT IN (SELECT CAST(selected.value AS INTEGER) FROM editions e, json_each(e.item_ids) selected
+           WHERE e.source = 'curated' AND e.status <> 'dismissed')
          AND id IN (
            SELECT id FROM (
              SELECT id, ROW_NUMBER() OVER (
@@ -139,11 +139,14 @@ export function runCleanup(custom) {
     pruneArchive();
     pruneChangeLog();
     const totalDeleted = deletedReadItems + deletedOldItems + deletedPerFeedExcess;
-    // Optimize query planning; rebuild storage only when this run freed rows.
+    // Optimize query planning; rebuild storage only when this run freed substantial pages.
     db.exec("PRAGMA optimize;");
     if (totalDeleted > 0) {
         try {
-            db.exec("VACUUM;");
+            const freelist = db.pragma("freelist_count", { simple: true }) ?? 0;
+            if (freelist > 500) {
+                db.exec("VACUUM;");
+            }
         }
         catch (err) {
             console.warn("[cleanup] VACUUM skipped or could not run:", err);

package/server/dist/feeds/contentNoise.js

@@ -54,7 +54,7 @@ const TIME_OF_DAY = "(?:[,\\s•·|-]+\\d{1,2}[:.]\\d{2}(?::\\d{2})?(?:\\s?(?:Uh
 const DATE_PART = `(?:\\d{1,2}\\.\\s?\\d{1,2}\\.\\s?\\d{2,4}|\\d{1,2}\\.?\\s(?:${MONTHS})\\.?\\s\\d{4}|(?:${MONTHS})\\.?\\s\\d{1,2},?\\s\\d{4})`;
 const DATE_ONLY = new RegExp(`^${DATE_PART}${TIME_OF_DAY}$`, "iu");
 /** The date at the end of a byline (`von Michael Bartl I 15.10.2026 - 11:41`): the author stays, the date is in the reader's head. */
-const BYLINE = /^(von|by|text|autor(in)?|author|written by)\b/i;
+const BYLINE = /^(von|by|text|autor(in)?|author|written by|words by|story by|report(ed)? by|posted by|photo(s)? by)\b/i;
 const BYLINE_DATE_TAIL = new RegExp(`(?:^|\\s)[|•·–—I-]\\s*${DATE_PART}${TIME_OF_DAY}\\s*$`, "iu");
 function stripBylineDate(block) {
     const walker = block.ownerDocument.createTreeWalker(block, 4);
@@ -139,6 +139,7 @@ function removeReaderNoise(root, title, stats, author) {
     const authorKeys = (author ?? "").split(",").map(name => normalized(name)).filter(Boolean);
     let leading = 0;
     let reachedText = false;
+    let pastStart = false;
     for (const block of leafBlocks(root)) {
         const text = flat(block.textContent);
         if (!text)
@@ -161,23 +162,29 @@ function removeReaderNoise(root, title, stats, author) {
             }
         }
         // Near the start, a line that is only a date or a reading time repeats what the reader shows in its own head.
-        if (text.length <= 60 && charsBefore(root, block) <= 800) {
-            if (DATE_ONLY.test(text)) {
-                drop(block, "dateline");
-                continue;
-            }
-            if (READING_TIME_ONLY.test(text)) {
-                drop(block, "reading-time");
-                continue;
+        if (!pastStart && text.length <= 60) {
+            const before = charsBefore(root, block);
+            if (before > 800) {
+                pastStart = true;
             }
-            // When the feed names the author, the reader shows the name in its head: a byline that only says that goes.
-            if (BYLINE.test(text) && authorKeys.length > 0 && authorKeys.every(name => normalized(text).includes(name))) {
-                drop(block, "byline");
-                continue;
-            }
-            if (BYLINE.test(text) && stripBylineDate(block)) {
-                stats["byline-date"] = (stats["byline-date"] ?? 0) + 1;
-                changed = true;
+            else {
+                if (DATE_ONLY.test(text)) {
+                    drop(block, "dateline");
+                    continue;
+                }
+                if (READING_TIME_ONLY.test(text)) {
+                    drop(block, "reading-time");
+                    continue;
+                }
+                // When the feed names the author, the reader shows the name in its head: a byline that only says that goes.
+                if (BYLINE.test(text) && authorKeys.length > 0 && authorKeys.every(name => normalized(text).includes(name))) {
+                    drop(block, "byline");
+                    continue;
+                }
+                if (BYLINE.test(text) && stripBylineDate(block)) {
+                    stats["byline-date"] = (stats["byline-date"] ?? 0) + 1;
+                    changed = true;
+                }
             }
         }
         if (headline && normalized(text) === headline && (position < 4 || (heading && position < 14))) {
@@ -196,7 +203,7 @@ function removeReaderNoise(root, title, stats, author) {
             drop(block, "player");
             continue;
         }
-        if (text.length <= 70 && block.querySelector("time") && charsBefore(root, block) <= 600) {
+        if (!pastStart && text.length <= 70 && block.querySelector("time") && charsBefore(root, block) <= 600) {
             const rest = flat(text.replace(flat(block.querySelector("time")?.textContent), ""));
             if (/^(stand|zuletzt aktualisiert|aktualisiert|ver(ö|oe)ffentlicht|updated|published|posted)?\s*[:·|•-]*\s*$/i.test(rest)) {
                 drop(block, "dateline");
@@ -582,8 +589,8 @@ const COMMENT_PATTERNS = [
     /\b(let us know|tell us) .{0,40}in the comments\b/i,
     /\bNur angemeldete Benutzer können kommentieren\b/i,
 ];
-const AD_LABEL = /^(Anzeige|Werbung|Advertisement|Advertorial|Sponsored|Gesponsert|Promoted)\s*:?$/i;
-const COMMENT_RULES_HEADING = /^(Regeln für Kommentare|Kommentarregeln|Kommentar-Richtlinien|Comment(ing)? (rules|guidelines|policy)|Community[- ]Richtlinien)\s*:?$/i;
+const AD_LABEL = /^(Anzeige|Werbung|Advertisement|Advertising|Advertorial|Ads?|Sponsored( content| post)?|Paid (content|post)|Gesponsert|Promoted)\s*:?$/i;
+const COMMENT_RULES_HEADING = /^(Regeln für Kommentare|Kommentarregeln|Kommentar-Richtlinien|Community[- ]Richtlinien|(Comment(ing)?|Community|Discussion|House) (rules|guidelines|policy|policies)|Rules for comments|Commenting rules)\s*:?$/i;
 const TAG_LABEL = /^(Schlagw(ö|oe)rter|Schlagworte|Tags?|Keywords|Themen|Topics)\s*:?$/i;
 const VIDEO_CARD = /^\d{1,2}:\d{2}(:\d{2})?(?=\D)\s*\S/;
 const SECTION_LABEL = /^(Auch interessant|Das könnte (dich|Sie|euch) (auch )?interessieren|Mehr zum Thema|Lesen Sie auch|Lies auch|Lest auch|Aktuelle News|Weitere (Artikel|Meldungen|News)|Popular Stories|Related (Stories|Articles|Posts|Reading)|More (Stories|from)|Top Stories|Meistgelesen|Topaktuell|Regeln für Kommentare|Kommentare|Comments?)\b\s*:?/i;

package/server/dist/feeds/extractor.js

@@ -151,7 +151,7 @@ async function fetchArticleHtml(rawUrl, signal, dispatcher, fetchImpl, ownerSign
             }
             chunks.push(value);
         }
-        const html = new TextDecoder().decode(Buffer.concat(chunks.map((chunk) => Buffer.from(chunk))));
+        const html = new TextDecoder().decode(Buffer.concat(chunks, total));
         return { html, url: safeUrl.toString() };
     }
     return null;
@@ -169,14 +169,12 @@ export async function extractArticle(rawUrl, fetchImpl = defaultFetch, priority
     }, priority);
 }
 async function extractArticleContent(rawUrl, fetchImpl, signal) {
-    signal.throwIfAborted();
-    const safeUrl = await assertPublicHttpUrl(rawUrl);
     signal.throwIfAborted();
     const dispatcher = createPublicDispatcher();
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
     try {
-        const fetched = await fetchArticleHtml(safeUrl.toString(), AbortSignal.any([signal, controller.signal]), dispatcher, fetchImpl, signal);
+        const fetched = await fetchArticleHtml(rawUrl, AbortSignal.any([signal, controller.signal]), dispatcher, fetchImpl, signal);
         if (!fetched)
             return { status: "failed" };
         const cleanedHtml = stripHeavyTags(fetched.html);

package/server/dist/feeds/fullTextQueue.js

@@ -229,6 +229,8 @@ function pump() {
     if (timer)
         clearTimeout(timer);
     const pool = configureFullTextPool();
+    if (active.size >= pool.limits.concurrency)
+        return;
     if (seedTimer && db.prepare("SELECT COUNT(*) n FROM full_text_jobs").get().n < pool.limits.concurrency * 2)
         scheduleFullTexts();
     const jobs = db.prepare(`SELECT j.*, i.link FROM full_text_jobs j JOIN items i ON i.id=j.item_id
@@ -258,8 +260,10 @@ function pump() {
         const work = execute(job, host).finally(() => { active.delete(job.item_id); wake(); });
         active.set(job.item_id, work);
     }
-    if (db.prepare("SELECT COUNT(*) n FROM full_text_jobs").get().n) {
-        timer = setTimeout(wake, 250);
+    const nextJob = db.prepare("SELECT MIN(available_at) AS next_at FROM full_text_jobs").get();
+    if (nextJob?.next_at) {
+        const delay = Math.max(250, Math.min(30_000, Date.parse(nextJob.next_at) - Date.now()));
+        timer = setTimeout(wake, delay);
         timer.unref();
     }
 }
@@ -272,7 +276,7 @@ async function execute(job, host) {
             attemptErrors++;
             errorCounts[result.error] = (errorCounts[result.error] ?? 0) + 1;
         }
-        if (!result.ok && result.error === "source_busy") {
+        if (!result.ok && result.error === "source_busy" && !result.deferred) {
             throttled++;
             deferFullTextHost(result.host ?? host, result.retryAt);
         }

package/server/dist/feeds/imageCache.js

@@ -36,6 +36,16 @@ export class ImageCache {
         if (this.stopping)
             throw new ImageCacheBusyError();
         const key = createHash("sha256").update(`${scope}\0${url}`).digest("hex");
+        const missing = this.negative.get(key);
+        if (missing) {
+            if (missing.expires > this.now()) {
+                this.counters.negativeHits++;
+                if (missing.result === "unsupported")
+                    return "unsupported";
+                throw new FeedHttpError(missing.result, undefined, "");
+            }
+            this.negative.delete(key);
+        }
         const shared = this.running.get(key);
         if (shared) {
             this.counters.shared++;

package/server/dist/feeds/inbox.js

@@ -5,8 +5,8 @@ import { hasUserCapability } from "../auth/capabilities.js";
 import { configureFullTextPool, deferFullTextHost } from "./fullTextQueue.js";
 import { extractArticle } from "./extractor.js";
 import { assertPublicHttpUrl, normalizeUrlCandidate } from "./ssrfGuard.js";
-import { articleImageUrls, scheduleArchive } from "./archive.js";
-import { findFeedById, findFeedByUrl, isUserSubscribed, listSubscriptionsForUser, subscribe, bookmarkItem, findItemById, findItemForUser, setItemNote, } from "./repository.js";
+import { articleImageUrls, pruneArchive, scheduleArchive } from "./archive.js";
+import { findFeedById, findFeedByUrl, isUserSubscribed, findSubscriptionForUser, subscribe, bookmarkItem, findItemById, findItemForUser, setItemNote, } from "./repository.js";
 function escapeHtml(str) {
     return str
         .replace(/&/g, "&")
@@ -31,7 +31,7 @@ export function ensureUserInbox(userId) {
     if (!isUserSubscribed(userId, feed.id)) {
         subscribe(userId, feed.id, "Inbox");
     }
-    const sub = listSubscriptionsForUser(userId).find((s) => s.id === feed.id);
+    const sub = findSubscriptionForUser(userId, feed.id);
     if (!sub) {
         throw new Error("Failed to ensure user inbox subscription");
     }
@@ -53,7 +53,7 @@ export async function saveToInbox(userId, input) {
             try {
                 configureFullTextPool();
                 const extracted = await extractArticle(targetUrl, undefined, 5, () => hasUserCapability(userId, "fulltext"));
-                if (extracted.status === "throttled")
+                if (extracted.status === "throttled" && !extracted.deferred)
                     deferFullTextHost(extracted.host, extracted.retryAt);
                 if (extracted.status === "ok" || extracted.status === "partial") {
                     extractionStatus = extracted.status === "ok" ? "ready" : "partial";
@@ -130,6 +130,7 @@ export function deleteInboxItem(userId, itemId) {
         db.prepare("DELETE FROM item_notes WHERE item_id = ?").run(itemId);
         db.prepare("DELETE FROM items WHERE id = ?").run(itemId);
     })();
+    pruneArchive();
     return true;
 }
 //# sourceMappingURL=inbox.js.map

package/server/dist/feeds/pollQueue.js

@@ -190,8 +190,17 @@ export class PollQueue {
                 continue;
             }
             // A URL may have been changed since enqueue. Do not dispatch under its old host budget.
-            if (sourceHost(feed.url) !== job.host) {
-                db.prepare("UPDATE feed_poll_jobs SET host = ? WHERE feed_id = ?").run(sourceHost(feed.url), feed.id);
+            let currentHost;
+            try {
+                currentHost = sourceHost(feed.url);
+            }
+            catch {
+                db.prepare("DELETE FROM feed_poll_jobs WHERE feed_id = ?").run(job.feed_id);
+                this.resolve(job.feed_id, { newItems: 0, error: "invalid_feed_url" });
+                continue;
+            }
+            if (currentHost !== job.host) {
+                db.prepare("UPDATE feed_poll_jobs SET host = ? WHERE feed_id = ?").run(currentHost, feed.id);
                 continue;
             }
             const waiter = this.waiters.get(feed.id);

package/server/dist/feeds/poller.js

@@ -132,10 +132,10 @@ async function pollAttempt(feed, signal) {
     try {
         signal.throwIfAborted();
         if (iconCheckDue(feed.icon_checked_at)) {
+            updateFeedIcon(feed.id, feed.icon_url);
             const siteUrl = parsed?.link || feed.site_url;
             const urls = siteUrl ? await discoverIconUrls(siteUrl, signal) : [];
             signal.throwIfAborted();
-            updateFeedIcon(feed.id, feed.icon_url);
             await refreshFeedIcon(feed.id, siteUrl, urls, signal);
         }
     }

package/server/dist/feeds/repository.js

@@ -43,8 +43,8 @@ export function removeFeedIfUnused(feedId) {
     if (countFeedSubscribers(feedId) > 0)
         return;
     db.prepare(`DELETE FROM items WHERE feed_id = ? AND id NOT IN (SELECT item_id FROM item_bookmarks) AND id NOT IN (SELECT item_id FROM item_notes)
-      AND NOT EXISTS (SELECT 1 FROM editions e, json_each(e.item_ids) selected
-        WHERE selected.value = items.id AND e.source = 'curated' AND e.status <> 'dismissed')`).run(feedId);
+      AND id NOT IN (SELECT CAST(selected.value AS INTEGER) FROM editions e, json_each(e.item_ids) selected
+        WHERE e.source = 'curated' AND e.status <> 'dismissed')`).run(feedId);
     db.prepare("DELETE FROM feeds WHERE id = ? AND is_system_inbox = 0 AND NOT EXISTS (SELECT 1 FROM items WHERE feed_id = ?)").run(feedId, feedId);
 }
 /** Feeds kept only for saved articles or annotated articles whose last bookmark and note are gone. */
@@ -54,8 +54,10 @@ export function removeUnusedFeeds() {
        AND NOT EXISTS (SELECT 1 FROM subscriptions s WHERE s.feed_id = feeds.id)
        AND NOT EXISTS (SELECT 1 FROM items i JOIN item_bookmarks b ON b.item_id = i.id WHERE i.feed_id = feeds.id)
        AND NOT EXISTS (SELECT 1 FROM items i JOIN item_notes n ON n.item_id = i.id WHERE i.feed_id = feeds.id)
-       AND NOT EXISTS (SELECT 1 FROM items i, editions e, json_each(e.item_ids) selected
-         WHERE i.feed_id = feeds.id AND selected.value = i.id AND e.source = 'curated' AND e.status <> 'dismissed')`).run().changes;
+       AND NOT EXISTS (SELECT 1 FROM items i WHERE i.feed_id = feeds.id AND i.id IN (
+         SELECT CAST(selected.value AS INTEGER) FROM editions e, json_each(e.item_ids) selected
+         WHERE e.source = 'curated' AND e.status <> 'dismissed'
+       ))`).run().changes;
 }
 /** Subscribers can open every item of their feeds; anyone can open what they saved or added a note to. */
 export function canAccessItem(userId, itemId) {
@@ -168,7 +170,7 @@ export function upsertItems(feedId, items) {
                 refreshLead(Number(result.lastInsertRowid));
             }
             else {
-                const previous = db.prepare("SELECT id, title, content_snippet, content_html, full_content_html, lead_version FROM items WHERE feed_id = ? AND guid = ?").get(feedId, row.guid);
+                const previous = db.prepare("SELECT id, title, link, image_url, content_snippet, content_html, full_content_html, lead_version FROM items WHERE feed_id = ? AND guid = ?").get(feedId, row.guid);
                 const next = row.contentHtml;
                 // Some publishers replace complete feed bodies with short teasers on a later poll.
                 const retained = previous?.content_html && next && next.length < previous.content_html.length * 0.9 &&
@@ -176,14 +178,27 @@ export function upsertItems(feedId, items) {
                 // The summary belongs to the body it was sent with: keeping the longer body keeps its summary too, or
                 // a feed that alternates between two variants would change the content on every poll.
                 const keptPrevious = retained !== null && next !== retained;
-                update.run(row.title ?? null, row.link ?? null, keptPrevious ? null : row.contentSnippet ?? null, retained, row.publishedAt ?? null, row.imageUrl ?? null, row.author ?? null, feedId, row.guid);
-                // Polling rewrites every item; only a change of what the lead is made from needs it derived again.
+                const nextSnippet = keptPrevious ? null : row.contentSnippet ?? null;
+                const nextImage = largerHeroImage(row.imageUrl, retained, row.link ?? previous?.link ?? null) ?? previous?.image_url ?? row.imageUrl ?? null;
                 if (previous) {
-                    const changed = (retained !== null && retained !== previous.content_html) ||
-                        (row.title !== undefined && row.title !== previous.title) ||
-                        (!keptPrevious && row.contentSnippet !== undefined && row.contentSnippet !== previous.content_snippet);
-                    if (previous.lead_version !== LEAD_VERSION || (changed && !previous.full_content_html))
+                    const changed = (row.title !== undefined && row.title !== previous.title) ||
+                        (row.link !== undefined && row.link !== previous.link) ||
+                        (!keptPrevious && row.contentSnippet !== undefined && row.contentSnippet !== previous.content_snippet) ||
+                        (retained !== null && retained !== previous.content_html) ||
+                        (row.publishedAt !== undefined && row.publishedAt !== null) ||
+                        (nextImage !== previous.image_url) ||
+                        (row.author !== undefined);
+                    if (changed) {
+                        update.run(row.title ?? null, row.link ?? null, nextSnippet, retained, row.publishedAt ?? null, nextImage, row.author ?? null, feedId, row.guid);
+                        const leadChanged = (retained !== null && retained !== previous.content_html) ||
+                            (row.title !== undefined && row.title !== previous.title) ||
+                            (!keptPrevious && row.contentSnippet !== undefined && row.contentSnippet !== previous.content_snippet);
+                        if (previous.lead_version !== LEAD_VERSION || (leadChanged && !previous.full_content_html))
+                            refreshLead(previous.id);
+                    }
+                    else if (previous.lead_version !== LEAD_VERSION && !previous.full_content_html) {
                         refreshLead(previous.id);
+                    }
                 }
             }
         }
@@ -193,7 +208,13 @@ export function upsertItems(feedId, items) {
 }
 export function listItemsForUser(userId, opts = {}) {
     // Saved articles stay visible without a subscription (e.g. after unsubscribing).
-    const conditions = ["(s.id IS NOT NULL OR b.item_id IS NOT NULL)"];
+    const conditions = [];
+    if (opts.bookmarkedOnly) {
+        conditions.push("b.item_id IS NOT NULL");
+    }
+    else {
+        conditions.push("(s.id IS NOT NULL OR b.item_id IS NOT NULL)");
+    }
     const params = [];
     if (opts.feedId) {
         conditions.push("i.feed_id = ?");
@@ -297,6 +318,51 @@ export function findItemForUser(userId, itemId) {
        EXISTS (SELECT 1 FROM editions e, json_each(e.item_ids) selected WHERE e.user_id = ?
          AND selected.value = i.id AND e.source = 'curated' AND e.status <> 'dismissed'))`).get(userId, userId, userId, userId, itemId, userId);
 }
+export function findItemsForUser(userId, itemIds) {
+    if (!itemIds.length)
+        return [];
+    const unique = [...new Set(itemIds)];
+    return db.prepare(`SELECT i.*, COALESCE(NULLIF(TRIM(s.label), ''), NULLIF(TRIM(f.title), ''), f.url) AS feed_title,
+            f.site_url AS feed_site_url, f.url AS feed_url, s.full_text_mode AS feed_full_text_mode, f.icon_url AS feed_icon_url,
+            (r.item_id IS NOT NULL) AS read, (b.item_id IS NOT NULL) AS bookmarked, b.created_at AS bookmarked_at
+     FROM items i
+     JOIN feeds f ON f.id = i.feed_id
+     LEFT JOIN subscriptions s ON s.feed_id = i.feed_id AND s.user_id = ?
+     LEFT JOIN item_reads r ON r.item_id = i.id AND r.user_id = ?
+     LEFT JOIN item_bookmarks b ON b.item_id = i.id AND b.user_id = ?
+     LEFT JOIN item_notes n ON n.item_id = i.id AND n.user_id = ?
+     WHERE i.id IN (SELECT CAST(value AS INTEGER) FROM json_each(?))
+       AND (s.id IS NOT NULL OR b.item_id IS NOT NULL OR n.item_id IS NOT NULL OR
+         EXISTS (SELECT 1 FROM editions e, json_each(e.item_ids) selected WHERE e.user_id = ?
+           AND selected.value = i.id AND e.source = 'curated' AND e.status <> 'dismissed'))`).all(userId, userId, userId, userId, JSON.stringify(unique), userId);
+}
+export function findSubscriptionForUser(userId, feedId) {
+    return db
+        .prepare(`SELECT
+         f.*,
+         fi.hash AS icon_hash,
+         s.id AS subscription_id,
+         NULLIF(TRIM(s.label), '') AS label,
+         s.folder_id AS folder_id,
+         fo.name AS folder_name,
+         s.position AS position,
+         s.full_text_mode AS full_text_mode,
+         s.notify AS notify,
+         s.badge AS badge,
+         (
+           SELECT COUNT(*) FROM items i
+           WHERE i.feed_id = f.id
+             AND NOT EXISTS (
+               SELECT 1 FROM item_reads r WHERE r.item_id = i.id AND r.user_id = ?
+             )
+         ) AS unread_count
+       FROM subscriptions s
+       JOIN feeds f ON f.id = s.feed_id
+       LEFT JOIN feed_icons fi ON fi.feed_id = f.id
+       LEFT JOIN folders fo ON fo.id = s.folder_id
+       WHERE s.user_id = ? AND s.feed_id = ?`)
+        .get(userId, userId, feedId) ?? null;
+}
 export function updateSubscriptionLabel(userId, feedId, label) {
     db.prepare("UPDATE subscriptions SET label = ? WHERE user_id = ? AND feed_id = ?").run(label?.trim() || null, userId, feedId);
 }
@@ -678,9 +744,24 @@ export function searchItemsForUser(userId, opts) {
     }
     const ranked = opts.sort !== "date" && fts;
     // Materialize once: a virtual-table MATCH in the LEFT JOIN repeats the full ranking scan for each article.
+    // Page IDs before loading HTML to avoid copying large content blobs into temporary B-trees during sorting.
     const querySql = `
-    ${ranked ? "WITH ranked_matches AS MATERIALIZED (SELECT rowid, rank FROM items_fts WHERE items_fts MATCH ?)" : ""}
-    SELECT DISTINCT i.*,
+    ${ranked ? "WITH ranked_matches AS MATERIALIZED (SELECT rowid, rank FROM items_fts WHERE items_fts MATCH ?)," : "WITH"}
+    page AS (
+      SELECT i.id
+      FROM items i
+      JOIN feeds f ON f.id = i.feed_id
+      LEFT JOIN subscriptions s ON s.feed_id = i.feed_id AND s.user_id = ?
+      LEFT JOIN item_reads r ON r.item_id = i.id AND r.user_id = ?
+      LEFT JOIN item_bookmarks b ON b.item_id = i.id AND b.user_id = ?
+      LEFT JOIN item_notes n ON n.item_id = i.id AND n.user_id = ?
+      ${ranked ? "LEFT JOIN ranked_matches fts ON fts.rowid = i.id" : ""}
+      WHERE ${conditions.join(" AND ")}
+      GROUP BY i.id
+      ORDER BY ${orderBy}
+      LIMIT ? OFFSET ?
+    )
+    SELECT i.*,
            COALESCE(NULLIF(TRIM(s.label), ''), NULLIF(TRIM(f.title), ''), f.url) AS feed_title,
            f.site_url AS feed_site_url,
            f.url AS feed_url,
@@ -689,16 +770,15 @@ export function searchItemsForUser(userId, opts) {
            (r.item_id IS NOT NULL) AS read,
            (b.item_id IS NOT NULL) AS bookmarked,
            b.created_at AS bookmarked_at
-    FROM items i
+    FROM page
+    JOIN items i ON i.id = page.id
     JOIN feeds f ON f.id = i.feed_id
     LEFT JOIN subscriptions s ON s.feed_id = i.feed_id AND s.user_id = ?
     LEFT JOIN item_reads r ON r.item_id = i.id AND r.user_id = ?
     LEFT JOIN item_bookmarks b ON b.item_id = i.id AND b.user_id = ?
     LEFT JOIN item_notes n ON n.item_id = i.id AND n.user_id = ?
     ${ranked ? "LEFT JOIN ranked_matches fts ON fts.rowid = i.id" : ""}
-    WHERE ${conditions.join(" AND ")}
     ORDER BY ${orderBy}
-    LIMIT ? OFFSET ?
   `;
     const queryParams = [
         ...(ranked ? [fts] : []),
@@ -709,6 +789,10 @@ export function searchItemsForUser(userId, opts) {
         ...params,
         limit,
         offset,
+        userId,
+        userId,
+        userId,
+        userId,
     ];
     const items = db.prepare(querySql).all(...queryParams);
     return { items, total };

package/server/dist/feeds/service.js

@@ -1,5 +1,5 @@
 import { config } from "../config.js";
-import { createFeed, findFeedByUrl, isUserSubscribed, subscribe, unsubscribe as unsubscribeRepo, listSubscriptionsForUser, updateSubscriptionLabel, updateSubscriptionFolder, updateFeedPollInterval, updateSubscriptionFullTextMode, updateSubscriptionNotify, updateSubscriptionBadge, findFolderById, findFeedById, countFeedSubscribers, replaceFeedUrl, moveSubscription, } from "./repository.js";
+import { createFeed, findFeedByUrl, isUserSubscribed, subscribe, unsubscribe as unsubscribeRepo, findSubscriptionForUser, updateSubscriptionLabel, updateSubscriptionFolder, updateFeedPollInterval, updateSubscriptionFullTextMode, updateSubscriptionNotify, updateSubscriptionBadge, findFolderById, findFeedById, countFeedSubscribers, replaceFeedUrl, moveSubscription, } from "./repository.js";
 import { pollFeed, probeFeed } from "./poller.js";
 import { assertPublicHttpUrl } from "./ssrfGuard.js";
 import { discoverFeeds } from "./discovery.js";
@@ -66,7 +66,7 @@ export async function subscribeToFeed(userId, inputUrl, label = null, folderId =
         unsubscribeRepo(userId, feed.id);
         throw new NoFeedsFoundError();
     }
-    const subscription = listSubscriptionsForUser(userId).find((s) => s.id === feed.id);
+    const subscription = findSubscriptionForUser(userId, feed.id);
     if (!subscription)
         throw new FeedError("subscription_lookup_failed");
     return subscription;
@@ -109,7 +109,7 @@ export function updateFeedSettings(userId, feedId, settings) {
         const minutes = Math.max(settings.pollIntervalMinutes, config.minPollIntervalMinutes);
         updateFeedPollInterval(feedId, minutes);
     }
-    const subscription = listSubscriptionsForUser(userId).find((s) => s.id === feedId);
+    const subscription = findSubscriptionForUser(userId, feedId);
     if (!subscription)
         throw new FeedError("subscription_lookup_failed");
     return subscription;
@@ -127,7 +127,7 @@ export async function changeFeedUrl(userId, feedId, inputUrl) {
     const { url } = await resolveFeedUrl(inputUrl);
     let target = feedId;
     const lookup = () => {
-        const subscription = listSubscriptionsForUser(userId).find((s) => s.id === target);
+        const subscription = findSubscriptionForUser(userId, target);
         if (!subscription)
             throw new FeedError("subscription_lookup_failed");
         return subscription;

package/server/dist/native/editions.js

@@ -214,19 +214,23 @@ export function editionCandidates(userId, now = new Date(), limit = 200) {
     const previousItemIds = db.prepare("SELECT item_ids FROM edition_history WHERE user_id = ? AND created_at >= ?").all(userId, new Date(now.getTime() - 72 * 3_600_000).toISOString()).flatMap((row) => JSON.parse(row.item_ids));
     const previous = new Set(previousItemIds);
     // Fetch bounded candidates per source, so a busy feed cannot hide the others.
-    const rows = db.prepare(`SELECT * FROM (
-      SELECT i.id, i.feed_id, s.folder_id, i.title, i.link, i.content_snippet, i.image_url,
-        coalesce(s.label, f.title) AS source_name, folders.name AS folder_name,
-        strftime('%Y-%m-%dT%H:%M:%fZ', coalesce(julianday(i.published_at), julianday(i.created_at))) AS published,
-        length(coalesce(i.full_content_html, i.content_html, i.content_snippet, '')) AS content_chars,
-        row_number() OVER (PARTITION BY i.feed_id ORDER BY coalesce(julianday(i.published_at), julianday(i.created_at)) DESC, i.id DESC) AS source_rank
-      FROM items i JOIN subscriptions s ON s.feed_id = i.feed_id AND s.user_id = ?
-      JOIN feeds f ON f.id = i.feed_id LEFT JOIN folders ON folders.id = s.folder_id
-      WHERE NOT EXISTS (SELECT 1 FROM item_reads r WHERE r.item_id = i.id AND r.user_id = ?)
-        AND NOT EXISTS (SELECT 1 FROM user_muted_keywords m WHERE m.user_id = ? AND
-          (instr(lower(coalesce(i.title, '')), lower(m.keyword)) > 0 OR instr(lower(coalesce(i.content_snippet, '')), lower(m.keyword)) > 0))
-        AND coalesce(julianday(i.published_at), julianday(i.created_at)) BETWEEN julianday(?) AND julianday(?)
-    ) WHERE source_rank <= 40 ORDER BY source_rank, published DESC, id DESC LIMIT 4000`)
+    const rows = db.prepare(`SELECT r.id, r.feed_id, r.folder_id, r.title, r.link, r.content_snippet, r.image_url,
+        r.source_name, r.folder_name, r.published, r.source_rank,
+        length(coalesce(full_item.full_content_html, full_item.content_html, r.content_snippet, '')) AS content_chars
+      FROM (
+        SELECT i.id, i.feed_id, s.folder_id, i.title, i.link, i.content_snippet, i.image_url,
+          coalesce(s.label, f.title) AS source_name, folders.name AS folder_name,
+          strftime('%Y-%m-%dT%H:%M:%fZ', coalesce(julianday(i.published_at), julianday(i.created_at))) AS published,
+          row_number() OVER (PARTITION BY i.feed_id ORDER BY coalesce(julianday(i.published_at), julianday(i.created_at)) DESC, i.id DESC) AS source_rank
+        FROM items i JOIN subscriptions s ON s.feed_id = i.feed_id AND s.user_id = ?
+        JOIN feeds f ON f.id = i.feed_id LEFT JOIN folders ON folders.id = s.folder_id
+        WHERE NOT EXISTS (SELECT 1 FROM item_reads r WHERE r.item_id = i.id AND r.user_id = ?)
+          AND NOT EXISTS (SELECT 1 FROM user_muted_keywords m WHERE m.user_id = ? AND
+            (instr(lower(coalesce(i.title, '')), lower(m.keyword)) > 0 OR instr(lower(coalesce(i.content_snippet, '')), lower(m.keyword)) > 0))
+          AND coalesce(julianday(i.published_at), julianday(i.created_at)) BETWEEN julianday(?) AND julianday(?)
+      ) r
+      JOIN items full_item ON full_item.id = r.id
+      WHERE r.source_rank <= 40 ORDER BY r.source_rank, r.published DESC, r.id DESC LIMIT 4000`)
         .all(userId, userId, userId, new Date(now.getTime() - 7 * 86_400_000).toISOString(), now.toISOString());
     const scored = rows.filter((row) => row.folder_id === null ? prefs.showUnfiled : !prefs.hiddenFolderIds.includes(row.folder_id))
         .map((row) => ({

package/server/dist/oauth/store.js

@@ -72,13 +72,20 @@ export function rotateGrant(refreshToken, clientId) {
         return { ok: true, scope: grant.scope, tokens: { accessToken, refreshToken: newRefresh, expiresIn: ACCESS_TTL_MS / 1000 } };
     })();
 }
+const grantLastTouch = new Map();
+const GRANT_TOUCH_INTERVAL_MS = 5 * 60 * 1000;
 export function resolveAccessToken(token) {
     const row = db
         .prepare("SELECT * FROM oauth_grants WHERE access_hash = ?")
         .get(hash(token));
     if (!row || row.access_expires_at <= now())
         return null;
-    db.prepare("UPDATE oauth_grants SET last_used_at = ? WHERE id = ?").run(now(), row.id);
+    const nowMs = Date.now();
+    const lastTouch = grantLastTouch.get(row.id) ?? 0;
+    if (!row.last_used_at || nowMs - lastTouch >= GRANT_TOUCH_INTERVAL_MS) {
+        grantLastTouch.set(row.id, nowMs);
+        db.prepare("UPDATE oauth_grants SET last_used_at = ? WHERE id = ?").run(now(), row.id);
+    }
     return { userId: row.user_id, scope: row.scope, grantId: row.id };
 }
 /** Revokes by either token. Returns whether a grant was removed. */
@@ -89,6 +96,7 @@ export function revokeByToken(token, clientId) {
         .get(tokenHash, tokenHash);
     if (!grant || (clientId && grant.client_id !== clientId))
         return false;
+    grantLastTouch.delete(grant.id);
     return db.prepare("DELETE FROM oauth_grants WHERE id = ?").run(grant.id).changes > 0;
 }
 export function listGrantsForUser(userId) {

package/server/dist/sync/changeLog.js

@@ -1,8 +1,7 @@
-import { contentMetadata } from "../feeds/articleContent.js";
-import { canAccessItem, findItemById } from "../feeds/repository.js";
+import { canAccessItem } from "../feeds/repository.js";
 import { db } from "../db/index.js";
-import { findItemNote, listFoldersForUser, listMutedKeywords, listSubscriptionsForUser, } from "../feeds/repository.js";
-import { getEditionState } from "../native/editions.js";
+import { listFoldersForUser, listMutedKeywords, listSubscriptionsForUser, } from "../feeds/repository.js";
+import { getEdition, getEditionState } from "../native/editions.js";
 import { getNativePreferences } from "../native/preferences.js";
 const TOMBSTONE_DAYS = 90;
 const MAX_PAGE = 500;
@@ -26,21 +25,59 @@ export function serializeSubscription(subscription) {
             : `/api/v1/subscriptions/${subscription.id}/icon`,
     };
 }
-function itemState(userId, itemId) {
-    const exists = db.prepare("SELECT 1 FROM items WHERE id = ?").get(itemId);
-    if (!exists)
-        return null;
-    const row = db
-        .prepare(`SELECT EXISTS (SELECT 1 FROM item_reads WHERE user_id = ? AND item_id = ?) AS read,
-              (SELECT created_at FROM item_bookmarks WHERE user_id = ? AND item_id = ?) AS saved_at,
-              (SELECT position FROM item_progress WHERE user_id = ? AND item_id = ?) AS progress`)
-        .get(userId, itemId, userId, itemId, userId, itemId);
-    return {
-        read: Boolean(row.read),
-        saved: row.saved_at !== null,
-        savedAt: row.saved_at,
-        progress: row.progress,
-    };
+function loadItemStates(userId, itemIds) {
+    const result = new Map();
+    if (!itemIds.length)
+        return result;
+    const rows = db
+        .prepare(`SELECT i.id,
+              r.item_id IS NOT NULL AS read,
+              b.created_at AS saved_at,
+              p.position AS progress
+       FROM items i
+       LEFT JOIN item_reads r ON r.user_id = ? AND r.item_id = i.id
+       LEFT JOIN item_bookmarks b ON b.user_id = ? AND b.item_id = i.id
+       LEFT JOIN item_progress p ON p.user_id = ? AND p.item_id = i.id
+       WHERE i.id IN (SELECT CAST(value AS INTEGER) FROM json_each(?))`)
+        .all(userId, userId, userId, JSON.stringify(itemIds));
+    for (const row of rows) {
+        result.set(row.id, {
+            read: Boolean(row.read),
+            saved: row.saved_at !== null,
+            savedAt: row.saved_at,
+            progress: row.progress,
+        });
+    }
+    return result;
+}
+function loadItemContents(userId, itemIds) {
+    const result = new Map();
+    if (!itemIds.length)
+        return result;
+    const rows = db
+        .prepare(`SELECT i.id,
+              i.content_revision,
+              CASE WHEN i.full_content_html IS NOT NULL AND i.full_content_html != '' THEN 'reader'
+                   WHEN i.content_html IS NOT NULL AND i.content_html != '' THEN 'feed'
+                   ELSE 'snippet' END AS source,
+              i.extraction_status,
+              i.extraction_attempted_at,
+              i.extraction_retry_at
+       FROM items i
+       WHERE i.id IN (SELECT CAST(value AS INTEGER) FROM json_each(?))`)
+        .all(JSON.stringify(itemIds));
+    for (const row of rows) {
+        if (!canAccessItem(userId, row.id))
+            continue;
+        result.set(row.id, {
+            revision: row.content_revision,
+            source: row.source,
+            status: row.extraction_status,
+            attemptedAt: row.extraction_attempted_at,
+            retryAt: row.extraction_retry_at,
+        });
+    }
+    return result;
 }
 /**
  * Add the data a user already had before the log existed. Everything that is in the log
@@ -83,7 +120,12 @@ export class ResyncRequired extends Error {
     }
 }
 export function currentSeq(userId) {
-    return db.prepare("SELECT COALESCE(MAX(seq), 0) AS seq FROM changes WHERE user_id = ?").get(userId).seq;
+    return db
+        .prepare(`SELECT MAX(
+         COALESCE((SELECT MAX(seq) FROM changes WHERE user_id = ?), 0),
+         COALESCE((SELECT MAX(last_seq, pruned_through) FROM sync_state WHERE user_id = ?), 0)
+       ) AS seq`)
+        .get(userId, userId).seq;
 }
 /** Everything that changed after `since`, oldest first, with the current data of each object. */
 export function listChanges(userId, since, limit = 200) {
@@ -101,29 +143,63 @@ export function listChanges(userId, since, limit = 200) {
         .all(userId, since, page + 1);
     const hasMore = rows.length > page;
     const slice = rows.slice(0, page);
-    const subscriptions = new Map(listSubscriptionsForUser(userId).map((subscription) => [subscription.id, subscription]));
-    const folders = new Map(listFoldersForUser(userId).map((folder) => [folder.id, folder]));
-    const keywords = new Map(listMutedKeywords(userId).map((keyword) => [keyword.id, keyword]));
+    const hasUpsert = (entity) => slice.some((row) => row.entity === entity && row.op !== "delete");
+    const subscriptions = hasUpsert("subscription")
+        ? new Map(listSubscriptionsForUser(userId).map((subscription) => [subscription.id, subscription]))
+        : new Map();
+    const folders = hasUpsert("folder")
+        ? new Map(listFoldersForUser(userId).map((folder) => [folder.id, folder]))
+        : new Map();
+    const keywords = hasUpsert("muted_keyword")
+        ? new Map(listMutedKeywords(userId).map((keyword) => [keyword.id, keyword]))
+        : new Map();
+    const stateIds = [...new Set(slice.filter((row) => row.entity === "item_state" && row.op !== "delete").map((row) => row.entity_id))];
+    const itemStates = loadItemStates(userId, stateIds);
+    const contentIds = [...new Set(slice.filter((row) => row.entity === "item_content" && row.op !== "delete").map((row) => row.entity_id))];
+    const itemContents = loadItemContents(userId, contentIds);
+    const noteUpsertIds = [...new Set(slice.filter((row) => row.entity === "note" && row.op !== "delete").map((row) => row.entity_id))];
+    const notes = new Map();
+    if (noteUpsertIds.length) {
+        const noteRows = db
+            .prepare(`SELECT n.item_id, n.content, COALESCE(r.revision, 1) AS revision, n.created_at, n.updated_at
+         FROM item_notes n
+         LEFT JOIN item_note_revisions r ON r.user_id = n.user_id AND r.item_id = n.item_id
+         WHERE n.user_id = ? AND n.item_id IN (SELECT CAST(value AS INTEGER) FROM json_each(?))`)
+            .all(userId, JSON.stringify(noteUpsertIds));
+        for (const note of noteRows)
+            notes.set(note.item_id, note);
+    }
+    const noteDeleteIds = [...new Set(slice.filter((row) => row.entity === "note" && row.op === "delete").map((row) => row.entity_id))];
+    const noteRevisions = new Map();
+    if (noteDeleteIds.length) {
+        const revRows = db
+            .prepare(`SELECT item_id, revision FROM item_note_revisions
+         WHERE user_id = ? AND item_id IN (SELECT CAST(value AS INTEGER) FROM json_each(?))`)
+            .all(userId, JSON.stringify(noteDeleteIds));
+        for (const rev of revRows)
+            noteRevisions.set(rev.item_id, rev.revision);
+    }
     const changes = slice.map((row) => {
         const change = { seq: row.seq, entity: row.entity, id: row.entity_id, op: row.op };
         if (row.entity === "edition") {
             const state = getEditionState(userId);
-            return state.edition ? { ...change, op: "upsert", data: { ...state.edition } } :
+            const edition = getEdition(userId);
+            return edition ? { ...change, op: "upsert", data: { ...edition } } :
                 { ...change, op: "delete", data: { revision: state.revision, status: state.status } };
         }
         if (row.entity === "note" && row.op === "delete") {
-            const version = db.prepare("SELECT revision FROM item_note_revisions WHERE user_id = ? AND item_id = ?").get(userId, row.entity_id);
-            return version ? { ...change, data: { revision: version.revision } } : change;
+            const revision = noteRevisions.get(row.entity_id);
+            return revision !== undefined ? { ...change, data: { revision } } : change;
         }
         if (row.op === "delete")
             return change;
         let data;
         if (row.entity === "item_content") {
-            const item = findItemById(row.entity_id);
-            data = item && canAccessItem(userId, row.entity_id) ? contentMetadata(item) : null;
+            data = itemContents.get(row.entity_id) ?? null;
+        }
+        else if (row.entity === "item_state") {
+            data = itemStates.get(row.entity_id) ?? null;
         }
-        else if (row.entity === "item_state")
-            data = itemState(userId, row.entity_id);
         else if (row.entity === "subscription") {
             const subscription = subscriptions.get(row.entity_id);
             data = subscription && serializeSubscription(subscription);
@@ -137,7 +213,7 @@ export function listChanges(userId, since, limit = 200) {
             data = keyword && { keyword: keyword.keyword };
         }
         else if (row.entity === "note") {
-            const note = findItemNote(userId, row.entity_id);
+            const note = notes.get(row.entity_id);
             data = note && {
                 itemId: note.item_id,
                 content: note.content,
@@ -158,8 +234,11 @@ export function listChanges(userId, since, limit = 200) {
 export function pruneChangeLog() {
     const cutoff = new Date(Date.now() - TOMBSTONE_DAYS * 86_400_000).toISOString();
     return db.transaction(() => {
-        db.prepare(`UPDATE sync_state SET pruned_through = MAX(pruned_through, COALESCE(
-         (SELECT MAX(seq) FROM changes WHERE changes.user_id = sync_state.user_id AND op = 'delete' AND changed_at < ?), 0))`).run(cutoff);
+        db.prepare(`UPDATE sync_state SET
+         last_seq = MAX(last_seq, pruned_through, COALESCE(
+           (SELECT MAX(seq) FROM changes WHERE changes.user_id = sync_state.user_id), 0)),
+         pruned_through = MAX(pruned_through, COALESCE(
+           (SELECT MAX(seq) FROM changes WHERE changes.user_id = sync_state.user_id AND op = 'delete' AND changed_at < ?), 0))`).run(cutoff);
         const old = db.prepare("DELETE FROM changes WHERE op = 'delete' AND changed_at < ?").run(cutoff).changes;
         const gone = db.prepare("DELETE FROM changes WHERE entity IN ('item_state', 'item_content') AND entity_id NOT IN (SELECT id FROM items)").run().changes;
         const goneNotes = db.prepare("DELETE FROM changes WHERE entity = 'note' AND entity_id NOT IN (SELECT id FROM items)").run().changes;

package/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feedkeeper/server",
-  "version": "0.27.0",
+  "version": "0.27.2",
   "private": true,
   "type": "module"
 }