v3: api/ gets one layout rule and keeps to it, and whatever crosses the wire is defined once, in shared/ — api/model/interfaces.ts and src/model.ts declared the same 40 types by hand and had drifted: the error envelope, email required on one side and optional on the other, Invitee/InviteTreeEntry and LinkPreview/UrlPreviewResponse for one shape each. The validation limits, the role permissions, the chat length cap, the @mention pattern and the Bandcamp and YouTube player responses were copied too, behind "keep in sync" comments. shared/ now holds them once, one file per domain (api, category, chat, comment, dump, follow, mention, notification, permissions, player, playlist, search, user, validation, ws), and imports nothing from either half. The server sends Dates; the client reads Wire<T>, the same type with every Date an ISO string, and turns it back with src/utils/shared/deserialize.ts. APIErrorCode becomes a const object, since the frontend's erasableSyntaxOnly rejects an enum. The shared types showed two real gaps: the avatar upload and GET /api/users/me return the full self user and the frontend read them as public users, and a stored session may predate media tokens, so the client keeps it as its own Session type. The backend rule: each folder holds one kind of module, each file is named after its domain. routes/ parse and answer; services/ hold the logic and every SQL query (lib/auth.ts's token check moves to user-service); remote/ is the only place that fetches from other sites — the guarded fetch and the HTML scraping out of rich-content-service, public-address, the Bandcamp and YouTube resolvers, the link providers, the image proxy (fetch, checks and cache, out of routes/preview.ts) and the Twemoji glyphs (out of lib/site-icons.ts). model/ holds per table a row type, its guard and its mappers; validators/ the request guards; db/connection.ts the handle and transaction(), db/startup.ts the purges and default admin that db.ts ran on import, called at the same moment. Tests mirror the source one file per module, test/<layer>/<module>.test.ts, with shared/'s under shared/test/ (deno task test runs both); the test that covered the bandcamp and soundcloud providers together is two now, and the backend can() has its own, so 202 tests. deno lint src/ is clean too: window.* becomes globalThis.*, and test bodies and act() callbacks that never awaited lose their async. The README states the rule. No behaviour changes; the catalogues only move their source references.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/test/db/migrations/0005_drop_is_admin.test.ts

@@ -0,0 +1,28 @@
+import "../../setup.ts";
+import { assertEquals } from "@std/assert";
+import { DatabaseSync } from "node:sqlite";
+import { up as up0004 } from "../../../db/migrations/0004_user_roles.ts";
+import { up as up0005 } from "../../../db/migrations/0005_drop_is_admin.ts";
+
+Deno.test("0004/0005: is_admin becomes role, then goes", () => {
+  const db = new DatabaseSync(":memory:");
+  db.exec(
+    `CREATE TABLE users (id TEXT PRIMARY KEY, is_admin INTEGER NOT NULL DEFAULT 0);`,
+  );
+  db.exec(`INSERT INTO users (id, is_admin) VALUES ('a', 1), ('b', 0);`);
+  up0004(db);
+  up0004(db);
+  up0005(db);
+  up0005(db);
+  assertEquals(
+    db.prepare(`SELECT id, role FROM users ORDER BY id;`).all().map((r) => ({
+      ...r,
+    })),
+    [{ id: "a", role: "admin" }, { id: "b", role: "user" }],
+  );
+  const cols =
+    (db.prepare(`PRAGMA table_info(users);`).all() as { name: string }[])
+      .map((c) => c.name);
+  assertEquals(cols, ["id", "role"]);
+  db.close();
+});

api/test/db/migrations/0010_youtube_embed_start.test.ts

@@ -0,0 +1,67 @@
+import "../../setup.ts";
+import { assertEquals } from "@std/assert";
+import { DatabaseSync } from "node:sqlite";
+import { up as up0010 } from "../../../db/migrations/0010_youtube_embed_start.ts";
+
+const SCHEMA = Deno.readTextFileSync(
+  new URL("../../../db/schema.sql", import.meta.url),
+);
+
+function freshDb(): DatabaseSync {
+  const db = new DatabaseSync(":memory:");
+  db.exec(SCHEMA);
+  return db;
+}
+
+function insertRich(db: DatabaseSync, id: string, url: string, rich: unknown) {
+  db.prepare(
+    `INSERT INTO users (id, username, password_hash, created_at, email)
+     VALUES ('u', 'u', 'x', 'now', 'u@x') ON CONFLICT DO NOTHING;`,
+  ).run();
+  db.prepare(
+    `INSERT INTO dumps (id, kind, title, user_id, created_at, url, rich_content)
+     VALUES (?, 'url', 't', 'u', 'now', ?, ?);`,
+  ).run(id, url, typeof rich === "string" ? rich : JSON.stringify(rich));
+}
+
+function richOf(db: DatabaseSync, id: string): Record<string, unknown> {
+  return JSON.parse(
+    (db.prepare(`SELECT rich_content FROM dumps WHERE id = ?;`).get(id) as {
+      rich_content: string;
+    }).rich_content,
+  );
+}
+
+Deno.test("0010: adds the start offset to YouTube embeds that lost it", () => {
+  const db = freshDb();
+  const embed = "https://www.youtube.com/embed/abc?rel=0";
+  insertRich(db, "hms", "https://youtu.be/abc?t=1h2m3s", {
+    type: "youtube",
+    embedUrl: embed,
+  });
+  insertRich(db, "plain", "https://youtu.be/abc?start=42", {
+    type: "youtube",
+    embedUrl: embed,
+  });
+  insertRich(db, "none", "https://youtu.be/abc", {
+    type: "youtube",
+    embedUrl: embed,
+  });
+  insertRich(db, "has", "https://youtu.be/abc?t=5", {
+    type: "youtube",
+    embedUrl: `${embed}&start=9`,
+  });
+  insertRich(db, "other", "https://example.com/?t=5", {
+    type: "generic",
+    embedUrl: embed,
+  });
+  insertRich(db, "bad", "https://youtu.be/abc?t=5", "{not json");
+  up0010(db);
+  up0010(db);
+  assertEquals(richOf(db, "hms").embedUrl, `${embed}&start=3723`);
+  assertEquals(richOf(db, "plain").embedUrl, `${embed}&start=42`);
+  assertEquals(richOf(db, "none").embedUrl, embed);
+  assertEquals(richOf(db, "has").embedUrl, `${embed}&start=9`);
+  assertEquals(richOf(db, "other").embedUrl, embed);
+  db.close();
+});

api/test/db/migrations/0012_fix_favicon_reclassification.test.ts

@@ -0,0 +1,91 @@
+import "../../setup.ts";
+import { assertEquals } from "@std/assert";
+import { DatabaseSync } from "node:sqlite";
+import { up as up0011 } from "../../../db/migrations/0011_split_favicon_thumbnail.ts";
+import { up as up0012 } from "../../../db/migrations/0012_fix_favicon_reclassification.ts";
+
+const SCHEMA = Deno.readTextFileSync(
+  new URL("../../../db/schema.sql", import.meta.url),
+);
+
+function freshDb(): DatabaseSync {
+  const db = new DatabaseSync(":memory:");
+  db.exec(SCHEMA);
+  return db;
+}
+
+function insertRich(db: DatabaseSync, id: string, url: string, rich: unknown) {
+  db.prepare(
+    `INSERT INTO users (id, username, password_hash, created_at, email)
+     VALUES ('u', 'u', 'x', 'now', 'u@x') ON CONFLICT DO NOTHING;`,
+  ).run();
+  db.prepare(
+    `INSERT INTO dumps (id, kind, title, user_id, created_at, url, rich_content)
+     VALUES (?, 'url', 't', 'u', 'now', ?, ?);`,
+  ).run(id, url, typeof rich === "string" ? rich : JSON.stringify(rich));
+}
+
+function richOf(db: DatabaseSync, id: string): Record<string, unknown> {
+  return JSON.parse(
+    (db.prepare(`SELECT rich_content FROM dumps WHERE id = ?;`).get(id) as {
+      rich_content: string;
+    }).rich_content,
+  );
+}
+
+Deno.test("0011 then 0012: icons move to faviconUrl, artwork stays or comes back", () => {
+  const db = freshDb();
+  const cases: Record<
+    string,
+    [string, string | undefined, string | undefined]
+  > = {
+    // id: [thumbnailUrl before, thumbnailUrl after, faviconUrl after]
+    ico: [
+      "https://a.test/favicon.ico",
+      undefined,
+      "https://a.test/favicon.ico",
+    ],
+    touch: [
+      "https://a.test/apple-touch-icon.png",
+      undefined,
+      "https://a.test/apple-touch-icon.png",
+    ],
+    art: ["https://a.test/cover.jpg", "https://a.test/cover.jpg", undefined],
+    // 0011 mistook these for icons; 0012 puts them back.
+    logoFavicon: [
+      "https://a.test/uploads/mir-logo-favicon.png",
+      "https://a.test/uploads/mir-logo-favicon.png",
+      undefined,
+    ],
+    svgArt: [
+      "https://a.test/art/poster.svg",
+      "https://a.test/art/poster.svg",
+      undefined,
+    ],
+    // 0011 missed this one; 0012 catches it.
+    iconName: [
+      "https://a.test/img/icon_SEARCH.png",
+      undefined,
+      "https://a.test/img/icon_SEARCH.png",
+    ],
+  };
+  for (const [id, [thumbnailUrl]] of Object.entries(cases)) {
+    insertRich(db, id, "https://a.test/", {
+      type: "generic",
+      url: "u",
+      thumbnailUrl,
+    });
+  }
+  up0011(db);
+  up0011(db);
+  up0012(db);
+  up0012(db);
+  for (const [id, [, thumbnailUrl, faviconUrl]] of Object.entries(cases)) {
+    const rich = richOf(db, id);
+    assertEquals([rich.thumbnailUrl, rich.faviconUrl], [
+      thumbnailUrl,
+      faviconUrl,
+    ], id);
+  }
+  db.close();
+});

api/test/db/migrations/0013_dump_url_canonical.test.ts

@@ -0,0 +1,31 @@
+import "../../setup.ts";
+import { assertEquals } from "@std/assert";
+import { canonicalizeUrl } from "../../../lib/canonical-url.ts";
+import { up as up0013 } from "../../../db/migrations/0013_dump_url_canonical.ts";
+import { DatabaseSync } from "node:sqlite";
+
+// Migration 0013 carries a frozen copy of the canonicalizer to backfill old
+// rows. Until the rules change on purpose (with a new backfill migration), the
+// two must agree, or rows from before and after the migration won't match.
+Deno.test("migration 0013 backfills the same keys canonicalizeUrl computes", () => {
+  const urls = [
+    "http://www.example.com/a/?utm_source=x&b=2&a=1#top",
+    "https://youtu.be/abc123?t=5",
+    "https://www.youtube.com/playlist?list=PLx",
+    "https://app.example.com/#/route",
+  ];
+  const db = new DatabaseSync(":memory:");
+  db.exec(`CREATE TABLE dumps (id TEXT PRIMARY KEY, url TEXT);`);
+  urls.forEach((url, i) =>
+    db.prepare(`INSERT INTO dumps (id, url) VALUES (?, ?);`).run(String(i), url)
+  );
+  up0013(db);
+  up0013(db); // idempotent
+  const rows = db.prepare(`SELECT id, url_canonical FROM dumps ORDER BY id;`)
+    .all() as { id: string; url_canonical: string }[];
+  assertEquals(
+    rows.map((r) => r.url_canonical),
+    urls.map(canonicalizeUrl),
+  );
+  db.close();
+});