v4: what the server and the client both state is declared once — several rules were written out in two or more files, some already drifting apart. A link's site name (its host without www.) was computed in five places, now shared/url.ts's siteHost; dumpFileVersion, which the frontend and the server had to keep equal by hand, is one function in shared/dump.ts; the Markdown flattening of the chat's reply previews and the digest's quotes is shared/markdown.ts's markdownToPlainText, so the digest also keeps an image's alt text; an attachment's URL and how to find one in a text are shared/attachment.ts, which the editor, Markdown and attachment-service read, its id pattern the new UUID_RE that the file and thumbnail routes check ids with. On the server, the Bandcamp, YouTube playlist and link preview caches use one TtlCache (api/lib/ttl-cache.ts) instead of three copies of the same expiry and eviction; the link previews' theme-color and the emails' theme tokens read colours with one parser (api/lib/css-color.ts), and a transparent theme-color now gives no tint; the WebSocket route sends through ws-service's send, the welcome included, so it is type-checked; fetch.ts strips an IPv6 literal's brackets with public-address's bareHostname; and a category's slug is checked by the same validateSlug as a dump's, with its own length. The migrations keep their frozen copies, as they document. 272 backend tests and 677 frontend tests pass, and deno check, tsc, eslint and doc:lint are clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/components/editor/Markdown.tsx

@@ -12,6 +12,7 @@ import remarkGfm from "remark-gfm";
 import { useAuth } from "../../hooks/auth/useAuth.ts";
 import { userPath } from "../../../shared/paths.ts";
 import { EVERYONE } from "../../../shared/mention.ts";
+import { isAttachmentUrl } from "../../../shared/attachment.ts";
 
 /** Passed to {@link Markdown} by any component that shows a user's text. */
 export interface MarkdownProps {
@@ -154,8 +155,6 @@ function internalPath(href: string | undefined): string | null {
 
 type Components = React.ComponentProps<typeof ReactMarkdown>["components"];
 
-const ATTACHMENT_PATH_RE = /\/api\/attachments\/[0-9a-f-]{36}$/;
-
 /**
  * Renders an image of the text. An attachment gets the viewer's media token,
  * which the server asks for when the text linking it is private; any other
@@ -166,7 +165,7 @@ function MarkdownImage(
 ): React.JSX.Element {
   const { mediaToken } = useAuth();
   let url = typeof src === "string" ? src : undefined;
-  if (url && mediaToken && ATTACHMENT_PATH_RE.test(url)) {
+  if (url && mediaToken && isAttachmentUrl(url)) {
     url = `${url}?token=${encodeURIComponent(mediaToken)}`;
   }
   return <img src={url} alt={alt ?? ""} loading="lazy" decoding="async" />;

src/components/editor/TextEditor.tsx

@@ -27,6 +27,7 @@ import { useEmojiTrigger } from "../../hooks/editor/useEmojiTrigger.ts";
 import { useAnchoredFloat } from "../../hooks/shared/useAnchoredFloat.ts";
 import { useAuth } from "../../hooks/auth/useAuth.ts";
 import { API_URL } from "../../config/api.ts";
+import { attachmentPath } from "../../../shared/attachment.ts";
 
 /**
  * Exposed through the ref of {@link TextEditor}, so that the component that
@@ -342,7 +343,7 @@ export const TextEditor: React.ForwardRefExoticComponent<
           });
           const json = await res.json();
           if (!json.success) throw new Error(json.error?.message);
-          images.push(`![](${API_URL}/api/attachments/${json.data.id})`);
+          images.push(`![](${API_URL}${attachmentPath(json.data.id)})`);
         } catch {
           setNotice(
             files.length > 1