feedkeeper 0.35.3 → 0.35.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "feedkeeper",
-  "version": "0.35.3",
+  "version": "0.35.5",
   "description": "A lightweight, self-hosted RSS reader and remote MCP server for your news, blogs, and AI workflows.",
   "keywords": [
     "rss",
@@ -44,7 +44,7 @@
     "cors": "^2.8.6",
     "dotenv": "^18.0.8",
     "express": "^5.2.1",
-    "express-rate-limit": "^8.7.1",
+    "express-rate-limit": "^8.7.2",
     "fast-xml-parser": "^5.11.2",
     "helmet": "^8.3.0",
     "ipaddr.js": "^2.5.0",
@@ -52,7 +52,7 @@
     "node-cron": "^4.6.0",
     "otpauth": "^9.5.2",
     "rss-parser": "^3.13.0",
-    "undici": "^8.12.2",
+    "undici": "^8.12.3",
     "web-push": "^3.6.7",
     "zod": "^4.6.5"
   }

package/server/dist/api/auth.js

@@ -161,7 +161,7 @@ authRouter.post("/signup", (req, res) => {
         return;
     }
     const user = createUser({ ...parsed.data, role: "user" });
-    req.session.userId = user.id;
+    req.session = { userId: user.id, securityVersion: securityVersion(user.id) };
     res.status(201).json(toPublicUser(user));
 });
 //# sourceMappingURL=auth.js.map

package/server/dist/api/feeds.js

@@ -54,7 +54,7 @@ feedsRouter.get("/:feedId/icon", iconLimiter, async (req, res) => {
 });
 feedsRouter.get("/opml", (req, res) => {
     const opml = generateOpml(req.user.id);
-    res.setHeader("Content-Type", "application/xml; charset=utf-8");
+    res.setHeader("Content-Type", "text/x-opml; charset=utf-8");
     res.setHeader("Content-Disposition", 'attachment; filename="feedkeeper-subscriptions.opml"');
     res.send(opml);
 });

package/server/dist/api/folders.js

@@ -19,11 +19,7 @@ foldersRouter.post("/", requireCapability("sync"), (req, res) => {
         return;
     }
     const folder = createFolder(req.user.id, parsed.data.name);
-    res.status(201).json({
-        ...folder,
-        feed_count: 0,
-        unread_count: 0,
-    });
+    res.status(201).json(listFoldersForUser(req.user.id).find((entry) => entry.id === folder.id));
 });
 foldersRouter.patch("/:folderId", (req, res) => {
     const folderId = Number(req.params.folderId);
@@ -37,15 +33,22 @@ foldersRouter.patch("/:folderId", (req, res) => {
         res.status(400).json({ error: "invalid_input", details: parsed.error.flatten() });
         return;
     }
-    const updated = updateFolder(req.user.id, folderId, parsed.data.name);
-    res.json(updated);
+    try {
+        const updated = updateFolder(req.user.id, folderId, parsed.data.name);
+        res.json(updated);
+    }
+    catch (error) {
+        if (!(error instanceof Error && "code" in error && error.code === "SQLITE_CONSTRAINT_UNIQUE"))
+            throw error;
+        res.status(409).json({ error: "folder_name_taken" });
+    }
 });
 foldersRouter.delete("/:folderId", (req, res) => {
     const folderId = Number(req.params.folderId);
     deleteFolder(req.user.id, folderId);
     res.json({ success: true });
 });
-foldersRouter.post("/:folderId/read", (req, res) => {
+foldersRouter.post("/:folderId/read", requireCapability("sync"), (req, res) => {
     const folderId = Number(req.params.folderId);
     const updatedCount = markAllRead(req.user.id, { folderId });
     res.json({ read: updatedCount });

package/server/dist/api/items.js

@@ -49,8 +49,8 @@ itemsRouter.get("/", (req, res) => {
     res.json(items.map(({ content_lead: _lead, lead_version: _leadVersion, ...item }) => ({
         ...item,
         content_snippet: cleanSnippet(item.content_snippet, item.title),
-        content_html: readerHtml(item.content_html, item.title, item.author),
-        full_content_html: readerHtml(item.full_content_html, item.title, item.author),
+        content_html: readerHtml(item.content_html, item.title, item.author, item.link),
+        full_content_html: readerHtml(item.full_content_html, item.title, item.author, item.link),
         read: Boolean(item.read),
         bookmarked: Boolean(item.bookmarked),
     })));
@@ -127,7 +127,7 @@ itemsRouter.post("/:itemId/extract-content", async (req, res) => {
     const [served] = withArchivedImages([{ id: result.id, link: currentItem?.link ?? null, full_content_html: result.fullContentHtml }], requestOrigin(req));
     res.json({
         id: result.id,
-        full_content_html: readerHtml(served.full_content_html, result.title ?? currentItem?.title, currentItem?.author),
+        full_content_html: readerHtml(served.full_content_html, result.title ?? currentItem?.title, currentItem?.author, currentItem?.link),
         ...(result.cached ? {} : { title: result.title, byline: result.byline }),
         cached: result.cached,
     });

package/server/dist/api/onboarding.js

@@ -2,6 +2,7 @@ import { Router } from "express";
 import { z } from "zod";
 import { hasAnyUser } from "../db/index.js";
 import { createUser } from "../auth/users.js";
+import { securityVersion } from "../auth/security.js";
 export const onboardingRouter = Router();
 onboardingRouter.get("/status", (_req, res) => {
     res.json({ needsOnboarding: !hasAnyUser() });
@@ -24,7 +25,7 @@ onboardingRouter.post("/", (req, res) => {
         return;
     }
     const user = createUser({ ...parsed.data, role: "admin" });
-    req.session.userId = user.id;
+    req.session = { userId: user.id, securityVersion: securityVersion(user.id) };
     res.status(201).json({ id: user.id, email: user.email, displayName: user.display_name, role: user.role });
 });
 //# sourceMappingURL=onboarding.js.map

package/server/dist/api/v1/resources.js

@@ -53,7 +53,7 @@ const subscribeSchema = z.object({
     label: z.string().max(200).nullable().optional(),
     folderId: z.number().int().positive().nullable().optional(),
 });
-resourcesRouter.post("/subscriptions", async (req, res) => {
+resourcesRouter.post("/subscriptions", requireCapability("sync"), async (req, res) => {
     const parsed = subscribeSchema.safeParse(req.body);
     if (!parsed.success)
         return invalid(res, parsed.error.flatten());
@@ -97,6 +97,9 @@ resourcesRouter.patch("/subscriptions/:id", async (req, res) => {
     if (!parsed.success)
         return invalid(res, parsed.error.flatten());
     const { url, ...settings } = parsed.data;
+    if (url && !hasUserCapability(req.user.id, "sync")) {
+        return void res.status(403).json(capabilityDenial(req.user.id, "sync"));
+    }
     try {
         let targetId = id;
         if (url)
@@ -132,13 +135,13 @@ async function refresh(userId, id) {
     const result = await pollFeed(feed);
     return { subscription: subscriptionOf(userId, id), ...result };
 }
-resourcesRouter.post("/subscriptions/:id/refresh", async (req, res) => {
+resourcesRouter.post("/subscriptions/:id/refresh", requireCapability("sync"), async (req, res) => {
     const result = await refresh(req.user.id, Number(req.params.id));
     if (!result)
         return void res.status(404).json({ error: "not_found" });
     res.json(result);
 });
-resourcesRouter.post("/refresh", async (req, res) => {
+resourcesRouter.post("/refresh", requireCapability("sync"), async (req, res) => {
     const subscriptions = listSubscriptionsForUser(req.user.id);
     const { newItems, errors, deferred } = await pollFeeds(subscriptions);
     res.json({ refreshed: subscriptions.length, newItems, errors, deferred });
@@ -166,7 +169,7 @@ resourcesRouter.get("/subscriptions/:id/icon", imageLimiter, async (req, res) =>
     res.setHeader("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox");
     res.type(icon.mime).send(icon.buffer);
 });
-resourcesRouter.post("/discover", async (req, res) => {
+resourcesRouter.post("/discover", requireCapability("sync"), async (req, res) => {
     const parsed = z.object({ url: urlField }).safeParse(req.body);
     if (!parsed.success)
         return invalid(res, parsed.error.flatten());
@@ -184,7 +187,7 @@ resourcesRouter.get("/opml", (req, res) => {
     res.setHeader("Content-Disposition", 'attachment; filename="feedkeeper-subscriptions.opml"');
     res.send(generateOpml(req.user.id));
 });
-resourcesRouter.post("/opml", async (req, res) => {
+resourcesRouter.post("/opml", requireCapability("sync"), async (req, res) => {
     const xml = typeof req.body === "string" ? req.body : typeof req.body?.opml === "string" ? req.body.opml : "";
     if (!xml.trim())
         return void res.status(400).json({ error: "missing_opml_content" });
@@ -233,19 +236,9 @@ resourcesRouter.post("/folders", (req, res) => {
     if (parsed.data.iconSymbol !== undefined && !hasUserCapability(req.user.id, "sync")) {
         return void res.status(403).json(capabilityDenial(req.user.id, "sync"));
     }
-    try {
-        const folder = createFolder(req.user.id, parsed.data.name, parsed.data.iconSymbol);
-        res.status(201).json({
-            id: folder.id,
-            name: folder.name,
-            iconSymbol: folder.icon_symbol ?? null,
-            subscriptionCount: 0,
-            unreadCount: 0,
-        });
-    }
-    catch {
-        res.status(409).json({ error: "folder_name_taken" });
-    }
+    const folder = createFolder(req.user.id, parsed.data.name, parsed.data.iconSymbol);
+    const detail = listFoldersForUser(req.user.id).find((entry) => entry.id === folder.id);
+    res.status(201).json(serializeFolder(detail));
 });
 resourcesRouter.patch("/folders/:id", (req, res) => {
     const id = Number(req.params.id);
@@ -260,7 +253,9 @@ resourcesRouter.patch("/folders/:id", (req, res) => {
     try {
         updateFolder(req.user.id, id, parsed.data);
     }
-    catch {
+    catch (error) {
+        if (!(error instanceof Error && "code" in error && error.code === "SQLITE_CONSTRAINT_UNIQUE"))
+            throw error;
         return void res.status(409).json({ error: "folder_name_taken" });
     }
     const folder = listFoldersForUser(req.user.id).find((item) => item.id === id);

package/server/dist/api/v1/serialize.js

@@ -38,7 +38,7 @@ export function serializeItem(row, progress, withContent, hasNote = false) {
         imageUrl: row.image_url,
         hasFullText: Boolean(row.full_content_html),
         content: contentMetadata(row),
-        ...(withContent ? { contentHtml: readerHtml(row.content_html, row.title, row.author), fullTextHtml: readerHtml(row.full_content_html, row.title, row.author) } : {}),
+        ...(withContent ? { contentHtml: readerHtml(row.content_html, row.title, row.author, row.link), fullTextHtml: readerHtml(row.full_content_html, row.title, row.author, row.link) } : {}),
         state: {
             read: Boolean(row.read),
             saved: Boolean(row.bookmarked),

package/server/dist/auth/middleware.js

@@ -19,7 +19,7 @@ export function requireSession(req, res, next) {
 }
 function bearerToken(req) {
     const header = req.headers.authorization;
-    return header?.startsWith("Bearer ") ? header.slice("Bearer ".length) : undefined;
+    return header?.startsWith("Bearer ") ? header.slice("Bearer ".length).trim() : undefined;
 }
 // MCP auth: Bearer personal access token or OAuth access token (not a paired device), scopes the request to its owner.
 export function requireBearerToken(req, res, next) {
@@ -27,7 +27,7 @@ export function requireBearerToken(req, res, next) {
 }
 // Native app API: a paired device token or a hand-made token; the web UI may call it with its session.
 export function requireSessionOrDevice(req, res, next) {
-    if (bearerToken(req))
+    if (req.headers.authorization !== undefined)
         authenticateBearer(["api", "device"])(req, res, next);
     else
         requireSession(req, res, next);

package/server/dist/db/migrations/0041_sync_feed_metadata.sql

@@ -0,0 +1,16 @@
+-- Notify subscribers when a feed's URL, metadata, poll interval, or error state is updated
+DROP TRIGGER IF EXISTS trg_changes_feed_update;
+CREATE TRIGGER trg_changes_feed_update
+AFTER UPDATE OF url, title, site_url, poll_interval_minutes, last_error ON feeds
+WHEN OLD.url IS NOT NEW.url
+  OR OLD.title IS NOT NEW.title
+  OR OLD.site_url IS NOT NEW.site_url
+  OR OLD.poll_interval_minutes IS NOT NEW.poll_interval_minutes
+  OR OLD.last_error IS NOT NEW.last_error
+BEGIN
+  INSERT INTO changes (user_id, entity, entity_id, op, seq, changed_at)
+  SELECT s.user_id, 'subscription', NEW.id, 'upsert', (SELECT COALESCE(MAX(seq), 0) + 1 FROM changes WHERE user_id = s.user_id), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+  FROM subscriptions s
+  WHERE s.feed_id = NEW.id
+  ON CONFLICT (user_id, entity, entity_id) DO UPDATE SET op = excluded.op, seq = excluded.seq, changed_at = excluded.changed_at;
+END;

package/server/dist/feeds/archive.js

@@ -12,6 +12,7 @@ import { ImageCache, ImageCacheBusyError } from "./imageCache.js";
 import { detectImageType, isVectorImageUrl } from "./imageTypes.js";
 export { detectImageType } from "./imageTypes.js";
 import { comparableImageKey } from "./heroImage.js";
+import { normalizeImageSources } from "./imageSources.js";
 const MAX_IMAGES_PER_ARTICLE = 30;
 const MAX_IMAGE_BYTES = 5 * 1024 * 1024;
 const FILE_NAME = /^\d+-[0-9a-f]{16}\.(jpg|png|webp|gif|avif)$/;
@@ -100,7 +101,7 @@ function resolveImageUrl(raw, baseUrl) {
 /** Image URLs an article shows, in order, without tracking pixels. */
 export function articleImageUrls(html, baseUrl) {
     const urls = new Set();
-    for (const [tag] of html.matchAll(/<img\b[^>]*>/gi)) {
+    for (const [tag] of normalizeImageSources(html).matchAll(/<img\b[^>]*>/gi)) {
         if (/\swidth\s*=\s*["']?1["'\s>]/i.test(tag) && /\sheight\s*=\s*["']?1["'\s>]/i.test(tag))
             continue;
         const src = srcAttribute(tag);
@@ -112,7 +113,7 @@ export function articleImageUrls(html, baseUrl) {
 }
 /** Replace the `src` of every image for which `replacement` knows a new address. */
 function rewriteImageSources(html, baseUrl, replacement) {
-    return html.replace(/<img\b[^>]*>/gi, (tag) => {
+    return normalizeImageSources(html).replace(/<img\b[^>]*>/gi, (tag) => {
         const src = srcAttribute(tag);
         const url = src && resolveImageUrl(src.value, baseUrl);
         const next = url ? replacement(url) : undefined;

package/server/dist/feeds/articleContent.js

@@ -21,14 +21,14 @@ const readerCache = new Map();
  * Article HTML as a reader shows it, without breadcrumbs, repeated headline and similar page chrome. Computed when
  * served and never stored, so the publisher's original stays intact and rule changes apply to old articles too.
  */
-export function readerHtml(html, title, author) {
+export function readerHtml(html, title, author, url) {
     if (!html)
         return html ?? null;
-    const key = createHash("sha1").update(title ?? "").update("\0").update(author ?? "").update("\0").update(html).digest("base64");
+    const key = createHash("sha1").update(title ?? "").update("\0").update(author ?? "").update("\0").update(url ?? "").update("\0").update(html).digest("base64");
     const cached = readerCache.get(key);
     if (cached !== undefined)
         return cached;
-    const cleaned = cleanReaderHtml(html, title, {}, author);
+    const cleaned = cleanReaderHtml(html, title, {}, author, url);
     if (readerCache.size >= READER_CACHE_LIMIT)
         readerCache.delete(readerCache.keys().next().value);
     readerCache.set(key, cleaned);

package/server/dist/feeds/content/index.js

@@ -1,3 +1,4 @@
+import { lazyImages } from "./noise/lazyImages.js";
 import { EMBED_RULES, resolveEmbeds } from "./embeds/index.js";
 import { embedHeadings } from "./embeds/headings.js";
 import { boilerplate } from "./noise/boilerplate.js";
@@ -10,7 +11,7 @@ import { teaserLinks } from "./noise/teaserLinks.js";
  * tags that are removed next), then the clutter around the story. The tests check each rule against its fixtures in
  * `test/fixtures/content/<rule name>` and that running it twice changes nothing. See `docs/content-rules.md`.
  */
-export const PAGE_RULES = [...EMBED_RULES, embedHeadings, sidebars, loadingPlaceholders, trackingPixels, boilerplate, teaserLinks];
+export const PAGE_RULES = [lazyImages, ...EMBED_RULES, embedHeadings, sidebars, loadingPlaceholders, trackingPixels, boilerplate, teaserLinks];
 export { resolveEmbeds };
 /** What a fetched page goes through before its scripts, frames and `noscript` blocks are removed. */
 export function cleanPage(root, stats = {}) {

package/server/dist/feeds/content/noise/lazyImages.js

@@ -0,0 +1,23 @@
+import { firstSrcsetSource, imageSource, usableImageSource } from "../../imageSources.js";
+export const lazyImages = {
+    name: "lazy-images",
+    description: "Lazy image addresses replace missing, data placeholders or script fragments parsed as image URLs.",
+    apply(root, stats) {
+        let changed = false;
+        for (const image of root.querySelectorAll("img")) {
+            if (usableImageSource(image.getAttribute("src")))
+                continue;
+            let source = imageSource((name) => image.getAttribute(name));
+            for (const candidate of image.closest("picture")?.querySelectorAll("source") ?? []) {
+                source ??= firstSrcsetSource(candidate.getAttribute("data-lazy-srcset") ?? candidate.getAttribute("data-srcset") ?? candidate.getAttribute("srcset"));
+            }
+            if (!source)
+                continue;
+            image.setAttribute("src", source);
+            stats["lazy-images"] = (stats["lazy-images"] ?? 0) + 1;
+            changed = true;
+        }
+        return changed;
+    },
+};
+//# sourceMappingURL=lazyImages.js.map

package/server/dist/feeds/content/noise/videoPages.js

@@ -0,0 +1,67 @@
+import { flat, linkParagraph } from "../shared.js";
+import de from "../patterns/video-pages/de.js";
+import en from "../patterns/video-pages/en.js";
+import ja from "../patterns/video-pages/ja.js";
+const labels = new Set([...de, ...en, ...ja].map(value => value.toLowerCase()));
+const date = /\b\d{1,2}\.\d{1,2}\.\d{4}\b|\b[A-Za-z]{3,9} \d{1,2},? \d{4}\b|\d{4}年\d{1,2}月\d{1,2}日/;
+/** A video landing page with a poster and metadata, but no editorial paragraphs. */
+export function cleanVideoPage(root, url, title, stats) {
+    if (!url)
+        return false;
+    try {
+        const address = new URL(url);
+        if (!/^https?:$/.test(address.protocol) || !/(^|\/)(videos?|mediathek|watch|clips?)(\/|$|[-.])/i.test(address.pathname))
+            return false;
+    }
+    catch {
+        return false;
+    }
+    const mains = root.querySelectorAll("main");
+    if (mains.length !== 1)
+        return false;
+    const main = mains[0];
+    const images = main.querySelectorAll("img");
+    if (images.length !== 1 || main.querySelector("article, blockquote, table, a[data-media]"))
+        return false;
+    for (const link of main.querySelectorAll("a[href]")) {
+        if (link.closest("nav, ul, ol") || link.querySelector("img"))
+            continue;
+        // A home link is navigation; a transcript or another editorial link is content and must survive.
+        try {
+            const target = new URL(link.getAttribute("href"), url);
+            if (target.origin !== new URL(url).origin || target.pathname !== "/" || target.search || target.hash)
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    const copy = main.cloneNode(true);
+    copy.querySelectorAll("nav, ul, ol, form, img, picture, a, h1").forEach(element => element.remove());
+    const blocks = [...copy.querySelectorAll("p")].filter(element => flat(element.textContent));
+    if (!blocks.some(element => labels.has(flat(element.textContent).toLowerCase())))
+        return false;
+    // All remaining words must be short metadata lines containing an explicit date.
+    for (const block of blocks) {
+        const text = flat(block.textContent);
+        if (!labels.has(text.toLowerCase()) && (text.length > 160 || !date.test(text)))
+            return false;
+        block.remove();
+    }
+    if (flat(copy.textContent))
+        return false;
+    const document = main.ownerDocument;
+    const poster = document.createElement("p");
+    poster.append(images[0].cloneNode(true));
+    const card = linkParagraph(document, url, flat(title) || "Video");
+    card.querySelector("a").setAttribute("data-media", "video");
+    // Preserve attribution/broadcast metadata; omit the repeated publication timestamp and kind label.
+    const credits = [...main.querySelectorAll("p")].filter(element => {
+        const text = flat(element.textContent);
+        return date.test(text) && /[,、]/.test(text) && text.length <= 160 && !element.querySelector("a, img");
+    }).map(element => element.cloneNode(true));
+    root.replaceChildren(poster, card, ...credits);
+    stats["video-page"] = (stats["video-page"] ?? 0) + 1;
+    return true;
+}
+//# sourceMappingURL=videoPages.js.map

package/server/dist/feeds/content/patterns/snippet-metadata/de.js

@@ -0,0 +1,3 @@
+/** Whole bylines with an explicit timestamp, only ahead of the first editorial line. */
+export default [/^von\s+[^.!?\n]{2,60}\s+[I|·–—-]\s+\d{1,2}\.\d{1,2}\.\d{2,4}\s*[-–|·]\s*\d{1,2}:\d{2}$/iu];
+//# sourceMappingURL=de.js.map

package/server/dist/feeds/content/patterns/snippet-metadata/en.js

@@ -0,0 +1,3 @@
+/** Whole bylines with an explicit timestamp, only ahead of the first editorial line. */
+export default [/^(?:by|written by)\s+[^.!?\n]{2,60}\s+[I|·–—-]\s+(?:[A-Za-z]{3,9}\s+\d{1,2},?\s+\d{4}|\d{4}-\d{2}-\d{2})\s*[-–|·]\s*\d{1,2}:\d{2}(?:\s*[ap]m)?$/iu];
+//# sourceMappingURL=en.js.map

package/server/dist/feeds/content/patterns/snippet-metadata/index.js

@@ -0,0 +1,10 @@
+import de from "./de.js";
+import en from "./en.js";
+import ja from "./ja.js";
+export const SNIPPET_BYLINES = [...de, ...en, ...ja];
+/** File names and copyright notices are metadata only when they stand alone before the text. */
+export const SNIPPET_IMAGE_METADATA = [
+    /^[\p{L}\p{N}_. -]{3,120}\.(?:jpe?g|png|webp|gif|avif)$/iu,
+    /^(?:©|\(c\)|copyright(?:\s*©)?)\s*[^.!?\n]{1,100}$/iu,
+];
+//# sourceMappingURL=index.js.map

package/server/dist/feeds/content/patterns/snippet-metadata/ja.js

@@ -0,0 +1,3 @@
+/** Whole bylines with an explicit timestamp, only ahead of the first editorial line. */
+export default [/^(?:著者|執筆|文)[:：]\s*[^。！？\n]{1,40}\s+[I|·–—-]\s*\d{4}年\d{1,2}月\d{1,2}日\s*[-–|·]\s*\d{1,2}:\d{2}$/u];
+//# sourceMappingURL=ja.js.map

package/server/dist/feeds/content/patterns/video-pages/de.js

@@ -0,0 +1,3 @@
+/** Whole metadata labels of video landing pages, never words inside prose. */
+export default ["Video", "Videobeitrag"];
+//# sourceMappingURL=de.js.map

package/server/dist/feeds/content/patterns/video-pages/en.js

@@ -0,0 +1,3 @@
+/** Whole metadata labels of video landing pages, never words inside prose. */
+export default ["Video", "Video report"];
+//# sourceMappingURL=en.js.map

package/server/dist/feeds/content/patterns/video-pages/ja.js

@@ -0,0 +1,3 @@
+/** Whole metadata labels of video landing pages, never words inside prose. */
+export default ["動画", "映像", "動画ニュース"];
+//# sourceMappingURL=ja.js.map

package/server/dist/feeds/contentNoise.js

@@ -1,4 +1,7 @@
+import { cleanVideoPage } from "./content/noise/videoPages.js";
+import { lazyImages } from "./content/noise/lazyImages.js";
 import { JSDOM } from "jsdom";
+import { SNIPPET_BYLINES, SNIPPET_IMAGE_METADATA } from "./content/patterns/snippet-metadata/index.js";
 import { CONSENT_ANCHORS, CONSENT_COMPANIONS } from "./content/patterns/consent/index.js";
 import { SIDEBAR_HEADINGS } from "./content/patterns/sidebars/index.js";
 import { resolveEmbeds } from "./content/embeds/index.js";
@@ -186,7 +189,7 @@ function removeReaderNoise(root, title, stats, author) {
     let pastStart = false;
     for (const block of leafBlocks(root)) {
         const text = flat(block.textContent);
-        if (!text)
+        if (!text || block.querySelector("a[data-media]"))
             continue;
         const position = leading++;
         const heading = /^H[1-3]$/.test(block.tagName);
@@ -245,7 +248,7 @@ function removeReaderNoise(root, title, stats, author) {
         }
         if (!pastStart && text.length <= 70 && block.querySelector("time") && charsBefore(root, block) <= 600) {
             const rest = flat(text.replace(flat(block.querySelector("time")?.textContent), ""));
-            if (/^(stand|zuletzt aktualisiert|aktualisiert|ver(ö|oe)ffentlicht|updated|published|posted)?\s*[:·|•-]*\s*$/i.test(rest)) {
+            if (/^(news|ニュース|nachrichten|stand|zuletzt aktualisiert|aktualisiert|ver(ö|oe)ffentlicht|updated|published|posted)?\s*[:·|•-]*\s*$/i.test(rest)) {
                 drop(block, "dateline");
                 continue;
             }
@@ -452,17 +455,19 @@ function serialize(root) {
     return holder.innerHTML;
 }
 /** The article HTML as a reader should show it. Unchanged input is returned as is. */
-export function cleanReaderHtml(html, title, stats = {}, author) {
+export function cleanReaderHtml(html, title, stats = {}, author, url) {
     if (!html)
         return html;
     const root = JSDOM.fragment(html);
+    const videoPage = cleanVideoPage(root, url, title, stats);
+    const lazy = lazyImages.apply(root, stats);
     const images = resolveCustomImages(root, stats);
     const duplicates = collapseAdjacentImages(root, stats);
     const variants = collapseImageVariants(root, stats);
     const embeds = resolveEmbeds(root, stats);
     const noise = removeReaderNoise(root, title, stats, author);
     const typography = removeTypography(root, stats);
-    return images || duplicates || variants || embeds || noise || typography ? serialize(root) : html;
+    return videoPage || lazy || images || duplicates || variants || embeds || noise || typography ? serialize(root) : html;
 }
 /**
  * Some publishers wrap a picture in their own element and let a script fill the image: `<a-img src="/imgs/…">`
@@ -780,12 +785,23 @@ export function cleanSnippet(snippet, title) {
     for (const pattern of SNIPPET_INLINE_PATTERNS)
         text = text.replace(pattern, "");
     const headline = normalized(title ?? "");
+    let inMetadata = true;
+    text = text.split("\n").filter(line => {
+        const value = line.trim();
+        if (!value)
+            return false;
+        if (inMetadata && (matchesAny(value, SNIPPET_BYLINES) || matchesAny(value, SNIPPET_IMAGE_METADATA) ||
+            (headline && normalized(value) === headline)))
+            return false;
+        inMetadata = false;
+        return true;
+    }).join("\n");
     const lines = text.split("\n").map(line => line.trim()).filter((line, index) => line && !SNIPPET_LINE_PATTERNS.some(pattern => pattern.test(line)) && !isSocialList(line) &&
         !(index === 0 && headline && normalized(line) === headline));
     return lines.join("\n").trim();
 }
 /** Raised whenever the rules above change what they remove, so stored leads are derived again. */
-export const LEAD_VERSION = 2;
+export const LEAD_VERSION = 3;
 const LEAD_LENGTH = 600;
 function shorten(text, max) {
     if (text.length <= max)

package/server/dist/feeds/extractor.js

@@ -1,3 +1,4 @@
+import { SCRIPT_IMAGE_SOURCE } from "./imageSources.js";
 import { Readability } from "@mozilla/readability";
 import { JSDOM } from "jsdom";
 import { fetch as undiciFetch } from "undici";
@@ -44,7 +45,7 @@ function resolveLazyImages(doc) {
             img.getAttribute("data-original") ||
             img.getAttribute("data-actualsrc");
         const src = img.getAttribute("src");
-        if (lazySrc && (!src || src.startsWith("data:") || src.length < 10)) {
+        if (lazySrc && (!src || src.startsWith("data:") || src.length < 10 || SCRIPT_IMAGE_SOURCE.test(src))) {
             img.setAttribute("src", lazySrc);
         }
         const lazySrcset = img.getAttribute("data-lazy-srcset") || img.getAttribute("data-srcset");

package/server/dist/feeds/feedIcon.js

@@ -24,12 +24,14 @@ export function detectIconType(buffer) {
     const head = Buffer.from(buffer.subarray(0, 512)).toString("utf8").trimStart();
     return /^(<\?xml[^>]*>\s*)?(<!--[\s\S]*?-->\s*)?<svg[\s>]/i.test(head) ? "image/svg+xml" : null;
 }
-/** Whether the user subscribes to the feed or has saved or annotated one of its articles. */
+/** Whether the user subscribes to the feed or has saved, annotated, or curated one of its articles. */
 export function canAccessFeed(userId, feedId) {
     return Boolean(db.prepare(`SELECT 1 FROM feeds f WHERE f.id = ?
          AND (EXISTS (SELECT 1 FROM subscriptions s WHERE s.feed_id = f.id AND s.user_id = ?)
            OR EXISTS (SELECT 1 FROM items i JOIN item_bookmarks b ON b.item_id = i.id WHERE i.feed_id = f.id AND b.user_id = ?)
-           OR EXISTS (SELECT 1 FROM items i JOIN item_notes n ON n.item_id = i.id WHERE i.feed_id = f.id AND n.user_id = ?))`).get(feedId, userId, userId, userId));
+           OR EXISTS (SELECT 1 FROM items i JOIN item_notes n ON n.item_id = i.id WHERE i.feed_id = f.id AND n.user_id = ?)
+           OR EXISTS (SELECT 1 FROM items i, editions e, json_each(e.item_ids) selected WHERE i.feed_id = f.id AND e.user_id = ?
+             AND selected.value = i.id AND e.source = 'curated' AND e.status <> 'dismissed'))`).get(feedId, userId, userId, userId, userId));
 }
 /**
  * Declared icons first, then the stored one, then the well-known files of the site, and last the feed's own logo (`<image>` of an RSS channel):

package/server/dist/feeds/imageSources.js

@@ -0,0 +1,69 @@
+/** A script accidentally parsed as a URL is never an image, even after it was made absolute. */
+export const SCRIPT_IMAGE_SOURCE = /\bthis\.src\s*=/i;
+export function usableImageSource(raw) {
+    const source = raw?.trim();
+    if (!source || SCRIPT_IMAGE_SOURCE.test(source))
+        return null;
+    try {
+        const url = new URL(source, "https://image-source.invalid/");
+        return url.protocol === "https:" || url.protocol === "http:" ? source : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** URLs may contain commas (notably data placeholders); descriptors end at the next comma. */
+export function firstSrcsetSource(srcset) {
+    let rest = srcset?.trim() ?? "";
+    while (rest) {
+        const match = /^([^\s]+)\s*/.exec(rest);
+        const source = match[1].replace(/,+$/, "");
+        rest = rest.slice(match[0].length);
+        if (!match[1].endsWith(",")) {
+            const comma = rest.indexOf(",");
+            rest = comma < 0 ? "" : rest.slice(comma + 1).trim();
+        }
+        const usable = usableImageSource(source);
+        if (usable)
+            return usable;
+    }
+    return null;
+}
+export function imageSource(attribute) {
+    for (const name of ["src", "data-lazy-src", "data-src", "data-original", "data-actualsrc"]) {
+        const source = usableImageSource(attribute(name));
+        if (source)
+            return source;
+    }
+    for (const name of ["data-lazy-srcset", "data-srcset", "srcset"]) {
+        const source = firstSrcsetSource(attribute(name));
+        if (source)
+            return source;
+    }
+    return null;
+}
+function attribute(tag, name) {
+    const match = new RegExp(`\\s${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s>]+))`, "i").exec(tag);
+    return match ? match[1] ?? match[2] ?? match[3] : null;
+}
+/** Keep one fallback image before archive/proxy rewriting, including raw HTML stored by older versions. */
+export function normalizeImageSources(html) {
+    const normalize = (tag, fallback = null) => {
+        const source = imageSource((name) => attribute(tag, name)) ?? fallback;
+        if (!source)
+            return tag;
+        const escaped = source.replace(/"/g, "&quot;");
+        const withoutSources = tag.replace(/\s+(?:(?:data-(?:lazy-)?)?src(?:set)?|sizes|data-sizes|data-original|data-actualsrc)\s*=\s*(?:"[^"]*"|'[^']*'|[^\s"'>]+)/gi, "");
+        return withoutSources.replace(/\s*\/?>$/, (end) => ` src="${escaped}"${end}`);
+    };
+    const pictures = html.replace(/<picture\b[^>]*>[\s\S]*?<\/picture\s*>/gi, (picture) => {
+        let fallback = null;
+        const withoutSources = picture.replace(/<source\b[^>]*>/gi, (tag) => {
+            fallback ??= firstSrcsetSource(attribute(tag, "data-lazy-srcset") ?? attribute(tag, "data-srcset") ?? attribute(tag, "srcset"));
+            return "";
+        });
+        return withoutSources.replace(/<img\b[^>]*>/gi, (tag) => normalize(tag, fallback));
+    });
+    return pictures.replace(/<img\b[^>]*>/gi, (tag) => normalize(tag));
+}
+//# sourceMappingURL=imageSources.js.map