v4: what the server and the client both state is declared once — several rules were written out in two or more files, some already drifting apart. A link's site name (its host without www.) was computed in five places, now shared/url.ts's siteHost; dumpFileVersion, which the frontend and the server had to keep equal by hand, is one function in shared/dump.ts; the Markdown flattening of the chat's reply previews and the digest's quotes is shared/markdown.ts's markdownToPlainText, so the digest also keeps an image's alt text; an attachment's URL and how to find one in a text are shared/attachment.ts, which the editor, Markdown and attachment-service read, its id pattern the new UUID_RE that the file and thumbnail routes check ids with. On the server, the Bandcamp, YouTube playlist and link preview caches use one TtlCache (api/lib/ttl-cache.ts) instead of three copies of the same expiry and eviction; the link previews' theme-color and the emails' theme tokens read colours with one parser (api/lib/css-color.ts), and a transparent theme-color now gives no tint; the WebSocket route sends through ws-service's send, the welcome included, so it is type-checked; fetch.ts strips an IPv6 literal's brackets with public-address's bareHostname; and a category's slug is checked by the same validateSlug as a dump's, with its own length. The migrations keep their frozen copies, as they document. 272 backend tests and 677 frontend tests pass, and deno check, tsc, eslint and doc:lint are clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/lib/canonical-url.ts

@@ -13,6 +13,8 @@
  * @module
  */
 
+import { siteHostOf } from "../../shared/url.ts";
+
 const TRACKING_PARAMS = new Set([
   "fbclid",
   "gclid",
@@ -52,7 +54,7 @@ const YOUTUBE_HOSTS = new Set([
  * uses it too, so both agree on what a YouTube link is.
  */
 export function youtubeHost(u: URL): string | null {
-  const host = u.hostname.toLowerCase().replace(/^www\./, "");
+  const host = siteHostOf(u);
   return YOUTUBE_HOSTS.has(host) ? host : null;
 }
 
@@ -90,7 +92,7 @@ export function canonicalizeUrl(raw: string): string | null {
   }
   if (u.protocol !== "http:" && u.protocol !== "https:") return null;
 
-  const host = u.hostname.toLowerCase().replace(/^www\./, "");
+  const host = siteHostOf(u);
   if (!host) return null;
 
   const videoId = youtubeVideoId(host, u.pathname, u.searchParams);