v4: what the server and the client both state is declared once — several rules were written out in two or more files, some already drifting apart. A link's site name (its host without www.) was computed in five places, now shared/url.ts's siteHost; dumpFileVersion, which the frontend and the server had to keep equal by hand, is one function in shared/dump.ts; the Markdown flattening of the chat's reply previews and the digest's quotes is shared/markdown.ts's markdownToPlainText, so the digest also keeps an image's alt text; an attachment's URL and how to find one in a text are shared/attachment.ts, which the editor, Markdown and attachment-service read, its id pattern the new UUID_RE that the file and thumbnail routes check ids with. On the server, the Bandcamp, YouTube playlist and link preview caches use one TtlCache (api/lib/ttl-cache.ts) instead of three copies of the same expiry and eviction; the link previews' theme-color and the emails' theme tokens read colours with one parser (api/lib/css-color.ts), and a transparent theme-color now gives no tint; the WebSocket route sends through ws-service's send, the welcome included, so it is type-checked; fetch.ts strips an IPv6 literal's brackets with public-address's bareHostname; and a category's slug is checked by the same validateSlug as a dump's, with its own length. The migrations keep their frozen copies, as they document. 272 backend tests and 677 frontend tests pass, and deno check, tsc, eslint and doc:lint are clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/routes/attachments.ts

@@ -20,7 +20,7 @@ import {
 import { authenticateMedia } from "../lib/auth.ts";
 import { type APIResponse } from "../../shared/api.ts";
 import { APIException } from "../lib/api-exception.ts";
-import type { AttachmentResponse } from "../../shared/dump.ts";
+import type { AttachmentResponse } from "../../shared/attachment.ts";
 import { serveUploadedFile, validateImageUpload } from "../lib/upload.ts";
 import { ATTACHMENTS_DIR } from "../config.ts";
 

api/routes/files.ts

@@ -16,18 +16,15 @@
 import { Router } from "@oak/oak";
 import { APIException } from "../lib/api-exception.ts";
 import type { APIResponse } from "../../shared/api.ts";
-import type { Dump } from "../../shared/dump.ts";
+import { type Dump, dumpFileVersion } from "../../shared/dump.ts";
 import { DUMPS_DIR } from "../config.ts";
+import { UUID_RE } from "../../shared/validation.ts";
 import { authenticateMedia } from "../lib/auth.ts";
 import { can } from "../lib/permissions.ts";
 import { serveFile } from "../lib/serve-file.ts";
 import { authMiddleware } from "../middleware/auth.ts";
 import { parseCategoryIds } from "../validators/dump.ts";
-import {
-  dumpFileVersion,
-  getDump,
-  replaceFileDump,
-} from "../services/dump-service.ts";
+import { getDump, replaceFileDump } from "../services/dump-service.ts";
 
 /**
  * Mounted by `api/main.ts` behind the error, Open Graph and CORS middleware.
@@ -71,7 +68,7 @@ router.get("/:dumpId/file", async (ctx) => {
   const { dumpId } = ctx.params;
 
   // The id names a file on disk: nothing but an id's characters gets through.
-  if (!/^[0-9a-f-]{36}$/.test(dumpId)) {
+  if (!UUID_RE.test(dumpId)) {
     throw new APIException(400, "Invalid dump ID");
   }
 

api/routes/thumbnails.ts

@@ -22,9 +22,8 @@
 import { Router } from "@oak/oak";
 import { APIException } from "../lib/api-exception.ts";
 import type { APIResponse } from "../../shared/api.ts";
-import type { Dump } from "../../shared/dump.ts";
+import { type Dump, dumpFileVersion } from "../../shared/dump.ts";
 import {
-  dumpFileVersion,
   getDump,
   getDumpThumbnailInfo,
   removeDumpThumbnail,
@@ -37,6 +36,7 @@ import {
   validateImageUpload,
 } from "../lib/upload.ts";
 import { DUMPS_DIR, THUMBNAILS_DIR } from "../config.ts";
+import { UUID_RE } from "../../shared/validation.ts";
 import { authenticateMedia } from "../lib/auth.ts";
 import { can } from "../lib/permissions.ts";
 import { type AuthContext, authMiddleware } from "../middleware/auth.ts";
@@ -190,7 +190,7 @@ router.get("/:dumpId/thumbnail", async (ctx) => {
   const { dumpId } = ctx.params;
 
   // The id names files on disk: nothing but an id's characters gets through.
-  if (!/^[0-9a-f-]{36}$/.test(dumpId)) {
+  if (!UUID_RE.test(dumpId)) {
     throw new APIException(400, "Invalid dump ID");
   }
 

api/routes/ws.ts

@@ -27,6 +27,7 @@ import {
   isUserChatOpen,
   type RateLimit,
   register,
+  send,
   sendToUser,
   setClientTyping,
   takeToken,
@@ -59,10 +60,7 @@ import {
 } from "../services/comment-like-service.ts";
 import { getUserById } from "../services/user-service.ts";
 import { APIException } from "../lib/api-exception.ts";
-import type {
-  ClientToServerMessage,
-  ServerToClientMessage,
-} from "../../shared/ws.ts";
+import type { ClientToServerMessage } from "../../shared/ws.ts";
 import type { User } from "../model/user.ts";
 
 /**
@@ -125,7 +123,7 @@ router.get("/ws", async (ctx) => {
       const myCommentLikes = user ? getUserCommentLikes(user.id) : [];
       const unreadNotificationCount = user ? getUnreadCount(user.id) : 0;
       const chatRead = user ? getChatReadState(user.id) : undefined;
-      socket.send(JSON.stringify({
+      send(socket, {
         type: "welcome",
         users: getOnlineUsers(),
         myVotes,
@@ -133,7 +131,7 @@ router.get("/ws", async (ctx) => {
         unreadNotificationCount,
         chatReadAt: chatRead?.readAt,
         unreadChatCount: chatRead?.unread ?? 0,
-      }));
+      });
     } catch (err) {
       console.error("[ws] welcome send failed:", err);
     }
@@ -223,11 +221,6 @@ function handleMessage(client: WsClient, data: unknown): void {
   }
 }
 
-/** Sends `data` unless the socket is closing, where `send` would throw. */
-function send(socket: WebSocket, data: ServerToClientMessage): void {
-  if (socket.readyState === WebSocket.OPEN) socket.send(JSON.stringify(data));
-}
-
 /**
  * Handles `vote_cast` and `vote_remove`. It acks the voter with `vote_ack` and
  * broadcasts `votes_update`. A failure goes back as an `error` naming the dump