v4: what the server and the client both state is declared once — several rules were written out in two or more files, some already drifting apart. A link's site name (its host without www.) was computed in five places, now shared/url.ts's siteHost; dumpFileVersion, which the frontend and the server had to keep equal by hand, is one function in shared/dump.ts; the Markdown flattening of the chat's reply previews and the digest's quotes is shared/markdown.ts's markdownToPlainText, so the digest also keeps an image's alt text; an attachment's URL and how to find one in a text are shared/attachment.ts, which the editor, Markdown and attachment-service read, its id pattern the new UUID_RE that the file and thumbnail routes check ids with. On the server, the Bandcamp, YouTube playlist and link preview caches use one TtlCache (api/lib/ttl-cache.ts) instead of three copies of the same expiry and eviction; the link previews' theme-color and the emails' theme tokens read colours with one parser (api/lib/css-color.ts), and a transparent theme-color now gives no tint; the WebSocket route sends through ws-service's send, the welcome included, so it is type-checked; fetch.ts strips an IPv6 literal's brackets with public-address's bareHostname; and a category's slug is checked by the same validateSlug as a dump's, with its own length. The migrations keep their frozen copies, as they document. 272 backend tests and 677 frontend tests pass, and deno check, tsc, eslint and doc:lint are clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

shared/attachment.ts

@@ -0,0 +1,37 @@
+/**
+ * Says where an image pasted into a text lives, and how to find it again in
+ * the text. The editor uploads the image and writes a link to it into the
+ * Markdown; the server binds the attachments a saved text links to that text,
+ * and `Markdown` gives a private one the viewer's media token.
+ *
+ * @module
+ */
+
+import { UUID_RE } from "./validation.ts";
+
+/**
+ * Returned by `POST /api/attachments` to the text editor, which inserts the
+ * image into the body as a link to {@link attachmentPath}.
+ */
+export interface AttachmentResponse {
+  id: string;
+}
+
+/** Returns the API path of attachment `id`, to which the API's base is added. */
+export function attachmentPath(id: string): string {
+  return `/api/attachments/${id}`;
+}
+
+const ID = UUID_RE.source.slice(1, -1);
+const ATTACHMENT_LINK_RE = new RegExp(`/api/attachments/(${ID})`, "g");
+const ATTACHMENT_URL_RE = new RegExp(`/api/attachments/${ID}$`);
+
+/** Returns the ids of the attachments `text` links to, in order. */
+export function attachmentIdsIn(text: string): string[] {
+  return [...text.matchAll(ATTACHMENT_LINK_RE)].map((m) => m[1]);
+}
+
+/** Checks whether `url` is an attachment's, with no query yet. */
+export function isAttachmentUrl(url: string): boolean {
+  return ATTACHMENT_URL_RE.test(url);
+}