feedkeeper 0.35.4 → 0.35.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "feedkeeper",
-  "version": "0.35.4",
+  "version": "0.35.5",
   "description": "A lightweight, self-hosted RSS reader and remote MCP server for your news, blogs, and AI workflows.",
   "keywords": [
     "rss",
@@ -44,7 +44,7 @@
     "cors": "^2.8.6",
     "dotenv": "^18.0.8",
     "express": "^5.2.1",
-    "express-rate-limit": "^8.7.1",
+    "express-rate-limit": "^8.7.2",
     "fast-xml-parser": "^5.11.2",
     "helmet": "^8.3.0",
     "ipaddr.js": "^2.5.0",
@@ -52,7 +52,7 @@
     "node-cron": "^4.6.0",
     "otpauth": "^9.5.2",
     "rss-parser": "^3.13.0",
-    "undici": "^8.12.2",
+    "undici": "^8.12.3",
     "web-push": "^3.6.7",
     "zod": "^4.6.5"
   }

package/server/dist/api/auth.js

@@ -161,7 +161,7 @@ authRouter.post("/signup", (req, res) => {
         return;
     }
     const user = createUser({ ...parsed.data, role: "user" });
-    req.session.userId = user.id;
+    req.session = { userId: user.id, securityVersion: securityVersion(user.id) };
     res.status(201).json(toPublicUser(user));
 });
 //# sourceMappingURL=auth.js.map

package/server/dist/api/feeds.js

@@ -54,7 +54,7 @@ feedsRouter.get("/:feedId/icon", iconLimiter, async (req, res) => {
 });
 feedsRouter.get("/opml", (req, res) => {
     const opml = generateOpml(req.user.id);
-    res.setHeader("Content-Type", "application/xml; charset=utf-8");
+    res.setHeader("Content-Type", "text/x-opml; charset=utf-8");
     res.setHeader("Content-Disposition", 'attachment; filename="feedkeeper-subscriptions.opml"');
     res.send(opml);
 });

package/server/dist/api/folders.js

@@ -19,11 +19,7 @@ foldersRouter.post("/", requireCapability("sync"), (req, res) => {
         return;
     }
     const folder = createFolder(req.user.id, parsed.data.name);
-    res.status(201).json({
-        ...folder,
-        feed_count: 0,
-        unread_count: 0,
-    });
+    res.status(201).json(listFoldersForUser(req.user.id).find((entry) => entry.id === folder.id));
 });
 foldersRouter.patch("/:folderId", (req, res) => {
     const folderId = Number(req.params.folderId);
@@ -37,15 +33,22 @@ foldersRouter.patch("/:folderId", (req, res) => {
         res.status(400).json({ error: "invalid_input", details: parsed.error.flatten() });
         return;
     }
-    const updated = updateFolder(req.user.id, folderId, parsed.data.name);
-    res.json(updated);
+    try {
+        const updated = updateFolder(req.user.id, folderId, parsed.data.name);
+        res.json(updated);
+    }
+    catch (error) {
+        if (!(error instanceof Error && "code" in error && error.code === "SQLITE_CONSTRAINT_UNIQUE"))
+            throw error;
+        res.status(409).json({ error: "folder_name_taken" });
+    }
 });
 foldersRouter.delete("/:folderId", (req, res) => {
     const folderId = Number(req.params.folderId);
     deleteFolder(req.user.id, folderId);
     res.json({ success: true });
 });
-foldersRouter.post("/:folderId/read", (req, res) => {
+foldersRouter.post("/:folderId/read", requireCapability("sync"), (req, res) => {
     const folderId = Number(req.params.folderId);
     const updatedCount = markAllRead(req.user.id, { folderId });
     res.json({ read: updatedCount });

package/server/dist/api/onboarding.js

@@ -2,6 +2,7 @@ import { Router } from "express";
 import { z } from "zod";
 import { hasAnyUser } from "../db/index.js";
 import { createUser } from "../auth/users.js";
+import { securityVersion } from "../auth/security.js";
 export const onboardingRouter = Router();
 onboardingRouter.get("/status", (_req, res) => {
     res.json({ needsOnboarding: !hasAnyUser() });
@@ -24,7 +25,7 @@ onboardingRouter.post("/", (req, res) => {
         return;
     }
     const user = createUser({ ...parsed.data, role: "admin" });
-    req.session.userId = user.id;
+    req.session = { userId: user.id, securityVersion: securityVersion(user.id) };
     res.status(201).json({ id: user.id, email: user.email, displayName: user.display_name, role: user.role });
 });
 //# sourceMappingURL=onboarding.js.map

package/server/dist/api/v1/resources.js

@@ -53,7 +53,7 @@ const subscribeSchema = z.object({
     label: z.string().max(200).nullable().optional(),
     folderId: z.number().int().positive().nullable().optional(),
 });
-resourcesRouter.post("/subscriptions", async (req, res) => {
+resourcesRouter.post("/subscriptions", requireCapability("sync"), async (req, res) => {
     const parsed = subscribeSchema.safeParse(req.body);
     if (!parsed.success)
         return invalid(res, parsed.error.flatten());
@@ -97,6 +97,9 @@ resourcesRouter.patch("/subscriptions/:id", async (req, res) => {
     if (!parsed.success)
         return invalid(res, parsed.error.flatten());
     const { url, ...settings } = parsed.data;
+    if (url && !hasUserCapability(req.user.id, "sync")) {
+        return void res.status(403).json(capabilityDenial(req.user.id, "sync"));
+    }
     try {
         let targetId = id;
         if (url)
@@ -132,13 +135,13 @@ async function refresh(userId, id) {
     const result = await pollFeed(feed);
     return { subscription: subscriptionOf(userId, id), ...result };
 }
-resourcesRouter.post("/subscriptions/:id/refresh", async (req, res) => {
+resourcesRouter.post("/subscriptions/:id/refresh", requireCapability("sync"), async (req, res) => {
     const result = await refresh(req.user.id, Number(req.params.id));
     if (!result)
         return void res.status(404).json({ error: "not_found" });
     res.json(result);
 });
-resourcesRouter.post("/refresh", async (req, res) => {
+resourcesRouter.post("/refresh", requireCapability("sync"), async (req, res) => {
     const subscriptions = listSubscriptionsForUser(req.user.id);
     const { newItems, errors, deferred } = await pollFeeds(subscriptions);
     res.json({ refreshed: subscriptions.length, newItems, errors, deferred });
@@ -166,7 +169,7 @@ resourcesRouter.get("/subscriptions/:id/icon", imageLimiter, async (req, res) =>
     res.setHeader("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox");
     res.type(icon.mime).send(icon.buffer);
 });
-resourcesRouter.post("/discover", async (req, res) => {
+resourcesRouter.post("/discover", requireCapability("sync"), async (req, res) => {
     const parsed = z.object({ url: urlField }).safeParse(req.body);
     if (!parsed.success)
         return invalid(res, parsed.error.flatten());
@@ -184,7 +187,7 @@ resourcesRouter.get("/opml", (req, res) => {
     res.setHeader("Content-Disposition", 'attachment; filename="feedkeeper-subscriptions.opml"');
     res.send(generateOpml(req.user.id));
 });
-resourcesRouter.post("/opml", async (req, res) => {
+resourcesRouter.post("/opml", requireCapability("sync"), async (req, res) => {
     const xml = typeof req.body === "string" ? req.body : typeof req.body?.opml === "string" ? req.body.opml : "";
     if (!xml.trim())
         return void res.status(400).json({ error: "missing_opml_content" });
@@ -233,19 +236,9 @@ resourcesRouter.post("/folders", (req, res) => {
     if (parsed.data.iconSymbol !== undefined && !hasUserCapability(req.user.id, "sync")) {
         return void res.status(403).json(capabilityDenial(req.user.id, "sync"));
     }
-    try {
-        const folder = createFolder(req.user.id, parsed.data.name, parsed.data.iconSymbol);
-        res.status(201).json({
-            id: folder.id,
-            name: folder.name,
-            iconSymbol: folder.icon_symbol ?? null,
-            subscriptionCount: 0,
-            unreadCount: 0,
-        });
-    }
-    catch {
-        res.status(409).json({ error: "folder_name_taken" });
-    }
+    const folder = createFolder(req.user.id, parsed.data.name, parsed.data.iconSymbol);
+    const detail = listFoldersForUser(req.user.id).find((entry) => entry.id === folder.id);
+    res.status(201).json(serializeFolder(detail));
 });
 resourcesRouter.patch("/folders/:id", (req, res) => {
     const id = Number(req.params.id);
@@ -260,7 +253,9 @@ resourcesRouter.patch("/folders/:id", (req, res) => {
     try {
         updateFolder(req.user.id, id, parsed.data);
     }
-    catch {
+    catch (error) {
+        if (!(error instanceof Error && "code" in error && error.code === "SQLITE_CONSTRAINT_UNIQUE"))
+            throw error;
         return void res.status(409).json({ error: "folder_name_taken" });
     }
     const folder = listFoldersForUser(req.user.id).find((item) => item.id === id);

package/server/dist/auth/middleware.js

@@ -19,7 +19,7 @@ export function requireSession(req, res, next) {
 }
 function bearerToken(req) {
     const header = req.headers.authorization;
-    return header?.startsWith("Bearer ") ? header.slice("Bearer ".length) : undefined;
+    return header?.startsWith("Bearer ") ? header.slice("Bearer ".length).trim() : undefined;
 }
 // MCP auth: Bearer personal access token or OAuth access token (not a paired device), scopes the request to its owner.
 export function requireBearerToken(req, res, next) {
@@ -27,7 +27,7 @@ export function requireBearerToken(req, res, next) {
 }
 // Native app API: a paired device token or a hand-made token; the web UI may call it with its session.
 export function requireSessionOrDevice(req, res, next) {
-    if (bearerToken(req))
+    if (req.headers.authorization !== undefined)
         authenticateBearer(["api", "device"])(req, res, next);
     else
         requireSession(req, res, next);

package/server/dist/db/migrations/0041_sync_feed_metadata.sql

@@ -0,0 +1,16 @@
+-- Notify subscribers when a feed's URL, metadata, poll interval, or error state is updated
+DROP TRIGGER IF EXISTS trg_changes_feed_update;
+CREATE TRIGGER trg_changes_feed_update
+AFTER UPDATE OF url, title, site_url, poll_interval_minutes, last_error ON feeds
+WHEN OLD.url IS NOT NEW.url
+  OR OLD.title IS NOT NEW.title
+  OR OLD.site_url IS NOT NEW.site_url
+  OR OLD.poll_interval_minutes IS NOT NEW.poll_interval_minutes
+  OR OLD.last_error IS NOT NEW.last_error
+BEGIN
+  INSERT INTO changes (user_id, entity, entity_id, op, seq, changed_at)
+  SELECT s.user_id, 'subscription', NEW.id, 'upsert', (SELECT COALESCE(MAX(seq), 0) + 1 FROM changes WHERE user_id = s.user_id), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+  FROM subscriptions s
+  WHERE s.feed_id = NEW.id
+  ON CONFLICT (user_id, entity, entity_id) DO UPDATE SET op = excluded.op, seq = excluded.seq, changed_at = excluded.changed_at;
+END;

package/server/dist/feeds/archive.js

@@ -12,6 +12,7 @@ import { ImageCache, ImageCacheBusyError } from "./imageCache.js";
 import { detectImageType, isVectorImageUrl } from "./imageTypes.js";
 export { detectImageType } from "./imageTypes.js";
 import { comparableImageKey } from "./heroImage.js";
+import { normalizeImageSources } from "./imageSources.js";
 const MAX_IMAGES_PER_ARTICLE = 30;
 const MAX_IMAGE_BYTES = 5 * 1024 * 1024;
 const FILE_NAME = /^\d+-[0-9a-f]{16}\.(jpg|png|webp|gif|avif)$/;
@@ -100,7 +101,7 @@ function resolveImageUrl(raw, baseUrl) {
 /** Image URLs an article shows, in order, without tracking pixels. */
 export function articleImageUrls(html, baseUrl) {
     const urls = new Set();
-    for (const [tag] of html.matchAll(/<img\b[^>]*>/gi)) {
+    for (const [tag] of normalizeImageSources(html).matchAll(/<img\b[^>]*>/gi)) {
         if (/\swidth\s*=\s*["']?1["'\s>]/i.test(tag) && /\sheight\s*=\s*["']?1["'\s>]/i.test(tag))
             continue;
         const src = srcAttribute(tag);
@@ -112,7 +113,7 @@ export function articleImageUrls(html, baseUrl) {
 }
 /** Replace the `src` of every image for which `replacement` knows a new address. */
 function rewriteImageSources(html, baseUrl, replacement) {
-    return html.replace(/<img\b[^>]*>/gi, (tag) => {
+    return normalizeImageSources(html).replace(/<img\b[^>]*>/gi, (tag) => {
         const src = srcAttribute(tag);
         const url = src && resolveImageUrl(src.value, baseUrl);
         const next = url ? replacement(url) : undefined;

package/server/dist/feeds/content/noise/lazyImages.js

@@ -1,16 +1,17 @@
-/** A script accidentally parsed as a URL is never an image, even after it was made absolute. */
-export const SCRIPT_IMAGE_SOURCE = /\bthis\.src\s*=/i;
+import { firstSrcsetSource, imageSource, usableImageSource } from "../../imageSources.js";
 export const lazyImages = {
     name: "lazy-images",
     description: "Lazy image addresses replace missing, data placeholders or script fragments parsed as image URLs.",
     apply(root, stats) {
         let changed = false;
         for (const image of root.querySelectorAll("img")) {
-            const current = image.getAttribute("src") ?? "";
-            if (current && !/^data:/i.test(current) && !SCRIPT_IMAGE_SOURCE.test(current))
+            if (usableImageSource(image.getAttribute("src")))
                 continue;
-            const source = image.getAttribute("data-lazy-src") || image.getAttribute("data-src") || image.getAttribute("data-original");
-            if (!source || !/^(?:https?:\/\/|\/)/i.test(source) || SCRIPT_IMAGE_SOURCE.test(source))
+            let source = imageSource((name) => image.getAttribute(name));
+            for (const candidate of image.closest("picture")?.querySelectorAll("source") ?? []) {
+                source ??= firstSrcsetSource(candidate.getAttribute("data-lazy-srcset") ?? candidate.getAttribute("data-srcset") ?? candidate.getAttribute("srcset"));
+            }
+            if (!source)
                 continue;
             image.setAttribute("src", source);
             stats["lazy-images"] = (stats["lazy-images"] ?? 0) + 1;

package/server/dist/feeds/extractor.js

@@ -1,4 +1,4 @@
-import { SCRIPT_IMAGE_SOURCE } from "./content/noise/lazyImages.js";
+import { SCRIPT_IMAGE_SOURCE } from "./imageSources.js";
 import { Readability } from "@mozilla/readability";
 import { JSDOM } from "jsdom";
 import { fetch as undiciFetch } from "undici";

package/server/dist/feeds/feedIcon.js

@@ -24,12 +24,14 @@ export function detectIconType(buffer) {
     const head = Buffer.from(buffer.subarray(0, 512)).toString("utf8").trimStart();
     return /^(<\?xml[^>]*>\s*)?(<!--[\s\S]*?-->\s*)?<svg[\s>]/i.test(head) ? "image/svg+xml" : null;
 }
-/** Whether the user subscribes to the feed or has saved or annotated one of its articles. */
+/** Whether the user subscribes to the feed or has saved, annotated, or curated one of its articles. */
 export function canAccessFeed(userId, feedId) {
     return Boolean(db.prepare(`SELECT 1 FROM feeds f WHERE f.id = ?
          AND (EXISTS (SELECT 1 FROM subscriptions s WHERE s.feed_id = f.id AND s.user_id = ?)
            OR EXISTS (SELECT 1 FROM items i JOIN item_bookmarks b ON b.item_id = i.id WHERE i.feed_id = f.id AND b.user_id = ?)
-           OR EXISTS (SELECT 1 FROM items i JOIN item_notes n ON n.item_id = i.id WHERE i.feed_id = f.id AND n.user_id = ?))`).get(feedId, userId, userId, userId));
+           OR EXISTS (SELECT 1 FROM items i JOIN item_notes n ON n.item_id = i.id WHERE i.feed_id = f.id AND n.user_id = ?)
+           OR EXISTS (SELECT 1 FROM items i, editions e, json_each(e.item_ids) selected WHERE i.feed_id = f.id AND e.user_id = ?
+             AND selected.value = i.id AND e.source = 'curated' AND e.status <> 'dismissed'))`).get(feedId, userId, userId, userId, userId));
 }
 /**
  * Declared icons first, then the stored one, then the well-known files of the site, and last the feed's own logo (`<image>` of an RSS channel):

package/server/dist/feeds/imageSources.js

@@ -0,0 +1,69 @@
+/** A script accidentally parsed as a URL is never an image, even after it was made absolute. */
+export const SCRIPT_IMAGE_SOURCE = /\bthis\.src\s*=/i;
+export function usableImageSource(raw) {
+    const source = raw?.trim();
+    if (!source || SCRIPT_IMAGE_SOURCE.test(source))
+        return null;
+    try {
+        const url = new URL(source, "https://image-source.invalid/");
+        return url.protocol === "https:" || url.protocol === "http:" ? source : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** URLs may contain commas (notably data placeholders); descriptors end at the next comma. */
+export function firstSrcsetSource(srcset) {
+    let rest = srcset?.trim() ?? "";
+    while (rest) {
+        const match = /^([^\s]+)\s*/.exec(rest);
+        const source = match[1].replace(/,+$/, "");
+        rest = rest.slice(match[0].length);
+        if (!match[1].endsWith(",")) {
+            const comma = rest.indexOf(",");
+            rest = comma < 0 ? "" : rest.slice(comma + 1).trim();
+        }
+        const usable = usableImageSource(source);
+        if (usable)
+            return usable;
+    }
+    return null;
+}
+export function imageSource(attribute) {
+    for (const name of ["src", "data-lazy-src", "data-src", "data-original", "data-actualsrc"]) {
+        const source = usableImageSource(attribute(name));
+        if (source)
+            return source;
+    }
+    for (const name of ["data-lazy-srcset", "data-srcset", "srcset"]) {
+        const source = firstSrcsetSource(attribute(name));
+        if (source)
+            return source;
+    }
+    return null;
+}
+function attribute(tag, name) {
+    const match = new RegExp(`\\s${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s>]+))`, "i").exec(tag);
+    return match ? match[1] ?? match[2] ?? match[3] : null;
+}
+/** Keep one fallback image before archive/proxy rewriting, including raw HTML stored by older versions. */
+export function normalizeImageSources(html) {
+    const normalize = (tag, fallback = null) => {
+        const source = imageSource((name) => attribute(tag, name)) ?? fallback;
+        if (!source)
+            return tag;
+        const escaped = source.replace(/"/g, "&quot;");
+        const withoutSources = tag.replace(/\s+(?:(?:data-(?:lazy-)?)?src(?:set)?|sizes|data-sizes|data-original|data-actualsrc)\s*=\s*(?:"[^"]*"|'[^']*'|[^\s"'>]+)/gi, "");
+        return withoutSources.replace(/\s*\/?>$/, (end) => ` src="${escaped}"${end}`);
+    };
+    const pictures = html.replace(/<picture\b[^>]*>[\s\S]*?<\/picture\s*>/gi, (picture) => {
+        let fallback = null;
+        const withoutSources = picture.replace(/<source\b[^>]*>/gi, (tag) => {
+            fallback ??= firstSrcsetSource(attribute(tag, "data-lazy-srcset") ?? attribute(tag, "data-srcset") ?? attribute(tag, "srcset"));
+            return "";
+        });
+        return withoutSources.replace(/<img\b[^>]*>/gi, (tag) => normalize(tag, fallback));
+    });
+    return pictures.replace(/<img\b[^>]*>/gi, (tag) => normalize(tag));
+}
+//# sourceMappingURL=imageSources.js.map

package/server/dist/feeds/inbox.js

@@ -119,18 +119,13 @@ export async function saveToInbox(userId, input) {
     return { itemId, item, hasNote };
 }
 export function deleteInboxItem(userId, itemId) {
-    const inbox = ensureUserInbox(userId);
+    const inbox = findFeedByUrl(`feedkeeper://inbox/${userId}`);
     const item = findItemById(itemId);
-    if (!item || item.feed_id !== inbox.id) {
+    if (!inbox || !item || item.feed_id !== inbox.id) {
         return false;
     }
-    db.transaction(() => {
-        db.prepare("DELETE FROM item_bookmarks WHERE item_id = ?").run(itemId);
-        db.prepare("DELETE FROM item_reads WHERE item_id = ?").run(itemId);
-        db.prepare("DELETE FROM item_progress WHERE item_id = ?").run(itemId);
-        db.prepare("DELETE FROM item_notes WHERE item_id = ?").run(itemId);
-        db.prepare("DELETE FROM items WHERE id = ?").run(itemId);
-    })();
+    // Cascades run after the parent disappears, so state/note triggers do not announce stale updates.
+    db.prepare("DELETE FROM items WHERE id = ?").run(itemId);
     pruneArchive();
     return true;
 }

package/server/dist/feeds/opml.js

@@ -1,11 +1,13 @@
 import { XMLParser } from "fast-xml-parser";
 import { z } from "zod";
 import { config } from "../config.js";
-import { listSubscriptionsForUser, findFeedByUrl, createFeed, isUserSubscribed, subscribe, createFolder, } from "./repository.js";
-import { SsrfBlockedError } from "./ssrfGuard.js";
+import { listSubscriptionsForUser, findFeedByUrl, createFeed, seedFeedMetadata, isUserSubscribed, subscribe, createFolder, } from "./repository.js";
+import { SsrfBlockedError, normalizeUrlCandidate } from "./ssrfGuard.js";
 import { assertPublicFeedUrl } from "./blockedHosts.js";
 import { requestFeedPoll } from "./poller.js";
-import { decodeEntities } from "./text.js";
+import { decodeEntities, plainTitle } from "./text.js";
+const MAX_FOLDER_NAME_LENGTH = 100;
+const MAX_FEED_LABEL_LENGTH = 200;
 function escapeXml(unsafe) {
     return unsafe.replace(/[<>&'"]/g, (char) => {
         switch (char) {
@@ -26,9 +28,10 @@ function escapeXml(unsafe) {
 }
 function feedToOutlineXml(s, indent = "    ") {
     const text = escapeXml(s.label || s.title || s.url);
+    const title = escapeXml(s.title || s.label || s.url);
     const xmlUrl = escapeXml(s.url);
     const htmlUrl = s.site_url ? ` htmlUrl="${escapeXml(s.site_url)}"` : "";
-    return `${indent}<outline text="${text}" title="${text}" type="rss" xmlUrl="${xmlUrl}"${htmlUrl} />`;
+    return `${indent}<outline text="${text}" title="${title}" type="rss" xmlUrl="${xmlUrl}"${htmlUrl} />`;
 }
 /**
  * Generates standard OPML 2.0 XML representation of all subscribed feeds for a user.
@@ -74,7 +77,26 @@ ${outlines}
 `;
 }
 /**
- * Recursively extracts outline elements containing an xmlUrl attribute from parsed OPML.
+ * Reads an attribute from a parsed XML node case-insensitively in priority order.
+ */
+function getAttr(record, ...names) {
+    const entries = Object.entries(record);
+    for (const name of names) {
+        const target = `@_${name.toLowerCase()}`;
+        for (const [key, value] of entries) {
+            if (key.toLowerCase() === target) {
+                if (typeof value === "string")
+                    return value;
+                if (typeof value === "number" || typeof value === "boolean")
+                    return String(value);
+            }
+        }
+    }
+    return undefined;
+}
+/**
+ * Recursively extracts outline elements containing a feed URL from parsed OPML.
+ * Nested subfolders are flattened to the top level so each subfolder becomes its own folder.
  */
 function extractOutlines(node, items = [], currentFolder) {
     if (!node || typeof node !== "object")
@@ -86,19 +108,30 @@ function extractOutlines(node, items = [], currentFolder) {
         return items;
     }
     const record = node;
-    const xmlUrl = (typeof record["@_xmlUrl"] === "string" ? record["@_xmlUrl"] : undefined) ??
-        (typeof record["@_xmlurl"] === "string" ? record["@_xmlurl"] : undefined);
-    const rawLabel = (typeof record["@_text"] === "string" ? record["@_text"] : undefined) ??
-        (typeof record["@_title"] === "string" ? record["@_title"] : undefined);
-    if (xmlUrl) {
-        const label = rawLabel?.trim() ? decodeEntities(rawLabel.trim()) : undefined;
-        items.push({ url: xmlUrl.trim(), label, folder: currentFolder });
+    const hasChildren = Boolean(record.outline);
+    // Leaf outlines without xmlUrl may use url="..." in older OPML 1.0 exports.
+    const rawXmlUrl = getAttr(record, "xmlUrl") ?? (!hasChildren ? getAttr(record, "url") : undefined);
+    const rawText = getAttr(record, "text");
+    const rawTitle = getAttr(record, "title");
+    const rawHtmlUrl = getAttr(record, "htmlUrl");
+    const label = plainTitle(rawText ?? rawTitle)?.slice(0, MAX_FEED_LABEL_LENGTH);
+    const title = plainTitle(rawTitle ?? rawText)?.slice(0, MAX_FEED_LABEL_LENGTH);
+    const siteUrl = rawHtmlUrl?.trim() ? decodeEntities(rawHtmlUrl.trim()) : undefined;
+    let childFolder = currentFolder;
+    if (rawXmlUrl && rawXmlUrl.trim()) {
+        const url = decodeEntities(rawXmlUrl.trim());
+        const item = { url, label, folder: currentFolder };
+        if (title && title !== label)
+            item.title = title;
+        if (siteUrl)
+            item.siteUrl = siteUrl;
+        items.push(item);
     }
-    else if (rawLabel && record.outline) {
-        currentFolder = decodeEntities(rawLabel.trim());
+    else if (label && hasChildren) {
+        childFolder = label.slice(0, MAX_FOLDER_NAME_LENGTH);
     }
-    if (record.outline) {
-        extractOutlines(record.outline, items, currentFolder);
+    if (hasChildren) {
+        extractOutlines(record.outline, items, childFolder);
     }
     return items;
 }
@@ -107,22 +140,77 @@ export const MAX_OPML_FEEDS = 2000;
  * Parses an OPML document string and returns a list of feed URLs and their labels.
  */
 export function parseOpml(xmlContent) {
+    const cleanedXml = xmlContent.replace(/^\uFEFF/, "").trim();
+    if (!cleanedXml) {
+        throw new Error("invalid_opml_format");
+    }
     const parser = new XMLParser({
         ignoreAttributes: false,
         attributeNamePrefix: "@_",
         trimValues: true,
     });
-    const parsed = parser.parse(xmlContent);
-    if (!parsed || !parsed.opml || !parsed.opml.body) {
+    const parsed = parser.parse(cleanedXml);
+    if (!parsed || typeof parsed.opml !== "object" || parsed.opml === null || !("body" in parsed.opml)) {
         throw new Error("invalid_opml_format");
     }
-    const feeds = extractOutlines(parsed.opml.body.outline);
+    const body = parsed.opml.body;
+    const outlineRoot = body && typeof body === "object" ? body.outline : undefined;
+    const feeds = extractOutlines(outlineRoot);
     if (feeds.length > MAX_OPML_FEEDS) {
         throw new Error("too_many_opml_feeds");
     }
     return feeds;
 }
 const urlSchema = z.string().url();
+function normalizeOpmlUrl(rawUrl) {
+    const trimmed = rawUrl.trim();
+    if (/^feeds?:https?:\/\//i.test(trimmed)) {
+        return trimmed.replace(/^feeds?:/i, "");
+    }
+    if (/^feeds?:\/\//i.test(trimmed)) {
+        const rest = trimmed.replace(/^feeds?:\/\//i, "");
+        return /^https?:\/\//i.test(rest) ? rest : `https://${rest}`;
+    }
+    if (trimmed.startsWith("//"))
+        return `https:${trimmed}`;
+    return trimmed;
+}
+function sanitizeHttpUrl(raw) {
+    if (!raw)
+        return null;
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return null;
+    try {
+        const parsed = new URL(trimmed.startsWith("//") ? `https:${trimmed}` : trimmed);
+        if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+            return null;
+        return parsed.toString();
+    }
+    catch {
+        return null;
+    }
+}
+function isUrlFallbackLabel(label, rawUrl, normalizedUrl) {
+    if (!label)
+        return true;
+    const trimmed = label.trim();
+    if (!trimmed)
+        return true;
+    if (trimmed === rawUrl || trimmed === normalizedUrl)
+        return true;
+    try {
+        return new URL(normalizeOpmlUrl(trimmed)).toString() === normalizedUrl;
+    }
+    catch {
+        try {
+            return new URL(normalizeUrlCandidate(trimmed)).toString() === normalizedUrl;
+        }
+        catch {
+            return false;
+        }
+    }
+}
 /**
  * Imports feeds from an OPML document string for the given user.
  */
@@ -139,7 +227,8 @@ export async function importOpmlFeeds(userId, xmlContent) {
     for (const item of feedItems) {
         if (!item.url)
             continue;
-        const urlCheck = urlSchema.safeParse(item.url);
+        const candidateUrl = normalizeOpmlUrl(item.url);
+        const urlCheck = urlSchema.safeParse(candidateUrl);
         if (!urlCheck.success) {
             result.failed++;
             result.errors.push({ url: item.url, reason: "invalid_url_format" });
@@ -147,7 +236,7 @@ export async function importOpmlFeeds(userId, xmlContent) {
         }
         let normalizedUrl;
         try {
-            const validated = await assertPublicFeedUrl(item.url);
+            const validated = await assertPublicFeedUrl(candidateUrl);
             normalizedUrl = validated.toString();
         }
         catch (error) {
@@ -161,22 +250,28 @@ export async function importOpmlFeeds(userId, xmlContent) {
             if (!feed) {
                 feed = createFeed(normalizedUrl, Math.max(config.minPollIntervalMinutes, 15));
             }
+            const rawTitle = item.title ?? item.label;
+            const seedTitle = isUrlFallbackLabel(rawTitle, item.url, normalizedUrl) ? null : (rawTitle ?? null);
+            const seedSiteUrl = sanitizeHttpUrl(item.siteUrl);
+            seedFeedMetadata(feed.id, { title: seedTitle, siteUrl: seedSiteUrl });
             if (isUserSubscribed(userId, feed.id)) {
                 result.skipped++;
                 continue;
             }
             let folderId = null;
-            if (item.folder) {
-                if (folderCache.has(item.folder)) {
-                    folderId = folderCache.get(item.folder);
+            const folderName = item.folder?.trim().slice(0, MAX_FOLDER_NAME_LENGTH);
+            if (folderName) {
+                if (folderCache.has(folderName)) {
+                    folderId = folderCache.get(folderName);
                 }
                 else {
-                    const folder = createFolder(userId, item.folder);
+                    const folder = createFolder(userId, folderName);
                     folderId = folder.id;
-                    folderCache.set(item.folder, folder.id);
+                    folderCache.set(folderName, folder.id);
                 }
             }
-            subscribe(userId, feed.id, item.label ?? null, folderId);
+            const customLabel = isUrlFallbackLabel(item.label, item.url, normalizedUrl) ? null : (item.label ?? null);
+            subscribe(userId, feed.id, customLabel, folderId);
             result.imported++;
             feedsToPoll.push(feed);
         }