Merge branch 'main' of https://github.com/hyperlink-academy/minilink into update/thread-viewer

actions/publishToPublication.ts

···
   }
 
   // Determine the collection to use - preserve existing schema if updating
-  const existingCollection = existingDocUri ? new AtUri(existingDocUri).collection : undefined;
+  const existingCollection = existingDocUri
+    ? new AtUri(existingDocUri).collection
+    : undefined;
   const documentType = getDocumentType(existingCollection);
 
   // Build the pages array (used by both formats)
···
   if (documentType === "site.standard.document") {
     // site.standard.document format
     // For standalone docs, use HTTPS URL; for publication docs, use the publication AT-URI
-    const siteUri = publication_uri || `https://leaflet.pub/p/${credentialSession.did}`;
+    const siteUri =
+      publication_uri || `https://leaflet.pub/p/${credentialSession.did}`;
 
     record = {
       $type: "site.standard.document",
       title: title || "Untitled",
       site: siteUri,
-      path: rkey,
+      path: "/" + rkey,
       publishedAt:
         publishedAt || existingRecord.publishedAt || new Date().toISOString(),
       ...(description && { description }),

app/api/inngest/client.ts

···
       did: string;
     };
   };
+  "user/cleanup-expired-oauth-sessions": {
+    data: {};
+  };
+  "user/check-oauth-session": {
+    data: {
+      identityId: string;
+      did: string;
+      tokenCount: number;
+    };
+  };
+  "documents/fix-publication-references": {
+    data: {
+      documentUris: string[];
+    };
+  };
 };
 
 // Create a client to send and receive events

app/api/inngest/functions/cleanup_expired_oauth_sessions.ts

···
+import { supabaseServerClient } from "supabase/serverClient";
+import { inngest } from "../client";
+import { restoreOAuthSession } from "src/atproto-oauth";
+
+// Main function that fetches identities and publishes events for each one
+export const cleanup_expired_oauth_sessions = inngest.createFunction(
+  { id: "cleanup_expired_oauth_sessions" },
+  { event: "user/cleanup-expired-oauth-sessions" },
+  async ({ step }) => {
+    // Get all identities with an atp_did (OAuth users) that have at least one auth token
+    const identities = await step.run("fetch-oauth-identities", async () => {
+      const { data, error } = await supabaseServerClient
+        .from("identities")
+        .select("id, atp_did, email_auth_tokens(count)")
+        .not("atp_did", "is", null);
+
+      if (error) {
+        throw new Error(`Failed to fetch identities: ${error.message}`);
+      }
+
+      // Filter to only include identities with at least one auth token
+      return (data || [])
+        .filter((identity) => {
+          const tokenCount = identity.email_auth_tokens?.[0]?.count ?? 0;
+          return tokenCount > 0;
+        })
+        .map((identity) => ({
+          id: identity.id,
+          atp_did: identity.atp_did!,
+          tokenCount: identity.email_auth_tokens?.[0]?.count ?? 0,
+        }));
+    });
+
+    console.log(
+      `Found ${identities.length} OAuth identities with active sessions to check`,
+    );
+
+    // Publish events for each identity in batches
+    const BATCH_SIZE = 100;
+    let totalSent = 0;
+
+    for (let i = 0; i < identities.length; i += BATCH_SIZE) {
+      const batch = identities.slice(i, i + BATCH_SIZE);
+
+      await step.run(`send-events-batch-${i}`, async () => {
+        const events = batch.map((identity) => ({
+          name: "user/check-oauth-session" as const,
+          data: {
+            identityId: identity.id,
+            did: identity.atp_did,
+            tokenCount: identity.tokenCount,
+          },
+        }));
+
+        await inngest.send(events);
+        return events.length;
+      });
+
+      totalSent += batch.length;
+    }
+
+    console.log(`Published ${totalSent} check-oauth-session events`);
+
+    return {
+      success: true,
+      identitiesQueued: totalSent,
+    };
+  },
+);
+
+// Function that checks a single identity's OAuth session and cleans up if expired
+export const check_oauth_session = inngest.createFunction(
+  { id: "check_oauth_session" },
+  { event: "user/check-oauth-session" },
+  async ({ event, step }) => {
+    const { identityId, did, tokenCount } = event.data;
+
+    const result = await step.run("check-and-cleanup", async () => {
+      console.log(`Checking OAuth session for DID: ${did} (${tokenCount} tokens)`);
+
+      const sessionResult = await restoreOAuthSession(did);
+
+      if (sessionResult.ok) {
+        console.log(`  Session valid for ${did}`);
+        return { valid: true, tokensDeleted: 0 };
+      }
+
+      // Session is expired/invalid - delete associated auth tokens
+      console.log(
+        `  Session expired for ${did}: ${sessionResult.error.message}`,
+      );
+
+      const { error: deleteError } = await supabaseServerClient
+        .from("email_auth_tokens")
+        .delete()
+        .eq("identity", identityId);
+
+      if (deleteError) {
+        console.error(
+          `  Error deleting tokens for identity ${identityId}: ${deleteError.message}`,
+        );
+        return {
+          valid: false,
+          tokensDeleted: 0,
+          error: deleteError.message,
+        };
+      }
+
+      console.log(`  Deleted ${tokenCount} auth tokens for identity ${identityId}`);
+
+      return {
+        valid: false,
+        tokensDeleted: tokenCount,
+      };
+    });
+
+    return {
+      identityId,
+      did,
+      ...result,
+    };
+  },
+);

app/api/inngest/functions/fix_standard_document_publications.ts

···
+import { supabaseServerClient } from "supabase/serverClient";
+import { inngest } from "../client";
+import { restoreOAuthSession } from "src/atproto-oauth";
+import { AtpBaseClient, SiteStandardDocument } from "lexicons/api";
+import { AtUri } from "@atproto/syntax";
+import { Json } from "supabase/database.types";
+
+async function createAuthenticatedAgent(did: string): Promise<AtpBaseClient> {
+  const result = await restoreOAuthSession(did);
+  if (!result.ok) {
+    throw new Error(`Failed to restore OAuth session: ${result.error.message}`);
+  }
+  const credentialSession = result.value;
+  return new AtpBaseClient(
+    credentialSession.fetchHandler.bind(credentialSession),
+  );
+}
+
+/**
+ * Fixes site.standard.document records that have stale pub.leaflet.publication
+ * references in their site field. Updates both the PDS record and database.
+ */
+export const fix_standard_document_publications = inngest.createFunction(
+  { id: "fix_standard_document_publications" },
+  { event: "documents/fix-publication-references" },
+  async ({ event, step }) => {
+    const { documentUris } = event.data as { documentUris: string[] };
+
+    const stats = {
+      documentsFixed: 0,
+      joinEntriesFixed: 0,
+      errors: [] as string[],
+    };
+
+    if (!documentUris || documentUris.length === 0) {
+      return { success: true, stats, message: "No documents to fix" };
+    }
+
+    // Group documents by DID (author) for efficient OAuth session handling
+    const docsByDid = new Map<string, string[]>();
+    for (const uri of documentUris) {
+      try {
+        const aturi = new AtUri(uri);
+        const did = aturi.hostname;
+        const existing = docsByDid.get(did) || [];
+        existing.push(uri);
+        docsByDid.set(did, existing);
+      } catch (e) {
+        stats.errors.push(`Invalid URI: ${uri}`);
+      }
+    }
+
+    // Process each DID's documents
+    for (const [did, uris] of docsByDid) {
+      // Verify OAuth session for this user
+      const oauthValid = await step.run(
+        `verify-oauth-${did.slice(-8)}`,
+        async () => {
+          const result = await restoreOAuthSession(did);
+          return result.ok;
+        },
+      );
+
+      if (!oauthValid) {
+        stats.errors.push(`No valid OAuth session for ${did}`);
+        continue;
+      }
+
+      // Fix each document
+      for (const docUri of uris) {
+        const result = await step.run(
+          `fix-doc-${docUri.slice(-12)}`,
+          async () => {
+            // Fetch the document
+            const { data: doc, error: fetchError } = await supabaseServerClient
+              .from("documents")
+              .select("uri, data")
+              .eq("uri", docUri)
+              .single();
+
+            if (fetchError || !doc) {
+              return {
+                success: false as const,
+                error: `Document not found: ${fetchError?.message || "no data"}`,
+              };
+            }
+
+            const data = doc.data as SiteStandardDocument.Record;
+            const oldSite = data?.site;
+
+            if (!oldSite || !oldSite.includes("/pub.leaflet.publication/")) {
+              return {
+                success: false as const,
+                error: "Document does not have a pub.leaflet.publication site reference",
+              };
+            }
+
+            // Convert to new publication URI
+            const oldPubAturi = new AtUri(oldSite);
+            const newSite = `at://${oldPubAturi.hostname}/site.standard.publication/${oldPubAturi.rkey}`;
+
+            // Update the record
+            const updatedRecord: SiteStandardDocument.Record = {
+              ...data,
+              site: newSite,
+            };
+
+            // Write to PDS
+            const docAturi = new AtUri(docUri);
+            const agent = await createAuthenticatedAgent(did);
+            await agent.com.atproto.repo.putRecord({
+              repo: did,
+              collection: "site.standard.document",
+              rkey: docAturi.rkey,
+              record: updatedRecord,
+              validate: false,
+            });
+
+            // Update database
+            const { error: dbError } = await supabaseServerClient
+              .from("documents")
+              .update({ data: updatedRecord as Json })
+              .eq("uri", docUri);
+
+            if (dbError) {
+              return {
+                success: false as const,
+                error: `Database update failed: ${dbError.message}`,
+              };
+            }
+
+            return {
+              success: true as const,
+              oldSite,
+              newSite,
+            };
+          },
+        );
+
+        if (result.success) {
+          stats.documentsFixed++;
+
+          // Fix the documents_in_publications entry
+          const joinResult = await step.run(
+            `fix-join-${docUri.slice(-12)}`,
+            async () => {
+              // Find the publication URI that exists in the database
+              const { data: doc } = await supabaseServerClient
+                .from("documents")
+                .select("data")
+                .eq("uri", docUri)
+                .single();
+
+              const newSite = (doc?.data as any)?.site;
+              if (!newSite) {
+                return { success: false as const, error: "Could not read updated document" };
+              }
+
+              // Check which publication URI exists
+              const newPubAturi = new AtUri(newSite);
+              const oldPubUri = `at://${newPubAturi.hostname}/pub.leaflet.publication/${newPubAturi.rkey}`;
+
+              const { data: pubs } = await supabaseServerClient
+                .from("publications")
+                .select("uri")
+                .in("uri", [newSite, oldPubUri]);
+
+              const existingPubUri = pubs?.find((p) => p.uri === newSite)?.uri ||
+                pubs?.find((p) => p.uri === oldPubUri)?.uri;
+
+              if (!existingPubUri) {
+                return { success: false as const, error: "No matching publication found" };
+              }
+
+              // Delete any existing entries for this document
+              await supabaseServerClient
+                .from("documents_in_publications")
+                .delete()
+                .eq("document", docUri);
+
+              // Insert the correct entry
+              const { error: insertError } = await supabaseServerClient
+                .from("documents_in_publications")
+                .insert({
+                  document: docUri,
+                  publication: existingPubUri,
+                });
+
+              if (insertError) {
+                return { success: false as const, error: insertError.message };
+              }
+
+              return { success: true as const, publication: existingPubUri };
+            },
+          );
+
+          if (joinResult.success) {
+            stats.joinEntriesFixed++;
+          } else {
+            stats.errors.push(`Join table fix failed for ${docUri}: ${"error" in joinResult ? joinResult.error : "unknown error"}`);
+          }
+        } else {
+          stats.errors.push(`${docUri}: ${result.error}`);
+        }
+      }
+    }
+
+    return {
+      success: stats.errors.length === 0,
+      stats,
+    };
+  },
+);

app/api/inngest/functions/migrate_user_to_standard.ts

···
     const stats = {
       publicationsMigrated: 0,
       documentsMigrated: 0,
+      standardDocumentsFixed: 0,
       userSubscriptionsMigrated: 0,
       referencesUpdated: 0,
       errors: [] as string[],
     };
 
     // Step 1: Verify OAuth session is valid
-    await step.run("verify-oauth-session", async () => {
+    const oauthValid = await step.run("verify-oauth-session", async () => {
       const result = await restoreOAuthSession(did);
       if (!result.ok) {
-        throw new Error(
-          `Failed to restore OAuth session: ${result.error.message}`,
-        );
+        // Mark identity as needing migration so we can retry later
+        await supabaseServerClient
+          .from("identities")
+          .update({
+            metadata: { needsStandardSiteMigration: true },
+          })
+          .eq("atp_did", did);
+
+        return { success: false, error: result.error.message };
       }
       return { success: true };
     });
+
+    if (!oauthValid.success) {
+      return {
+        success: false,
+        error: `Failed to restore OAuth session`,
+        stats,
+        publicationUriMap: {},
+        documentUriMap: {},
+        userSubscriptionUriMap: {},
+      };
+    }
 
     // Step 2: Get user's pub.leaflet.publication records
     const oldPublications = await step.run(
···
       })
       .filter((x) => x !== null);
 
-    // Run all PDS writes in parallel
-    const pubPdsResults = await Promise.all(
-      publicationsToMigrate.map(({ pub, rkey, newRecord }) =>
-        step.run(`pds-write-publication-${pub.uri}`, async () => {
+    // Run PDS + DB writes together for each publication
+    const pubResults = await Promise.all(
+      publicationsToMigrate.map(({ pub, rkey, normalized, newRecord }) =>
+        step.run(`migrate-publication-${pub.uri}`, async () => {
+          // PDS write
           const agent = await createAuthenticatedAgent(did);
           const putResult = await agent.com.atproto.repo.putRecord({
             repo: did,
···
             record: newRecord,
             validate: false,
           });
-          return { oldUri: pub.uri, newUri: putResult.data.uri };
-        }),
-      ),
-    );
+          const newUri = putResult.data.uri;
 
-    // Run all DB writes in parallel
-    const pubDbResults = await Promise.all(
-      publicationsToMigrate.map(({ pub, normalized, newRecord }, index) => {
-        const newUri = pubPdsResults[index].newUri;
-        return step.run(`db-write-publication-${pub.uri}`, async () => {
+          // DB write
           const { error: dbError } = await supabaseServerClient
             .from("publications")
             .upsert({
···
             };
           }
           return { success: true as const, oldUri: pub.uri, newUri };
-        });
-      }),
+        }),
+      ),
     );
 
     // Process results
-    for (const result of pubDbResults) {
+    for (const result of pubResults) {
       if (result.success) {
         publicationUriMap[result.oldUri] = result.newUri;
         stats.publicationsMigrated++;
···
           $type: "site.standard.document",
           title: normalized.title || "Untitled",
           site: siteValue,
-          path: rkey,
+          path: "/" + rkey,
           publishedAt: normalized.publishedAt || new Date().toISOString(),
           description: normalized.description,
           content: normalized.content,
···
       })
       .filter((x) => x !== null);
 
-    // Run all PDS writes in parallel
-    const docPdsResults = await Promise.all(
-      documentsToMigrate.map(({ doc, rkey, newRecord }) =>
-        step.run(`pds-write-document-${doc.uri}`, async () => {
+    // Run PDS + DB writes together for each document
+    const docResults = await Promise.all(
+      documentsToMigrate.map(({ doc, rkey, newRecord, oldPubUri }) =>
+        step.run(`migrate-document-${doc.uri}`, async () => {
+          // PDS write
           const agent = await createAuthenticatedAgent(did);
           const putResult = await agent.com.atproto.repo.putRecord({
             repo: did,
···
             record: newRecord,
             validate: false,
           });
-          return { oldUri: doc.uri, newUri: putResult.data.uri };
-        }),
-      ),
-    );
+          const newUri = putResult.data.uri;
 
-    // Run all DB writes in parallel
-    const docDbResults = await Promise.all(
-      documentsToMigrate.map(({ doc, newRecord, oldPubUri }, index) => {
-        const newUri = docPdsResults[index].newUri;
-        return step.run(`db-write-document-${doc.uri}`, async () => {
+          // DB write
           const { error: dbError } = await supabaseServerClient
             .from("documents")
             .upsert({
···
           }
 
           return { success: true as const, oldUri: doc.uri, newUri };
-        });
-      }),
+        }),
+      ),
     );
 
     // Process results
-    for (const result of docDbResults) {
+    for (const result of docResults) {
       if (result.success) {
         documentUriMap[result.oldUri] = result.newUri;
         stats.documentsMigrated++;
···
       }
     }
 
+    // Step 4b: Fix existing site.standard.document records that reference pub.leaflet.publication
+    // This handles the case where site.standard.document records were created pointing to
+    // pub.leaflet.publication URIs before the publication was migrated to site.standard.publication
+    const existingStandardDocs = await step.run(
+      "fetch-existing-standard-documents",
+      async () => {
+        const { data, error } = await supabaseServerClient
+          .from("documents")
+          .select("uri, data")
+          .like("uri", `at://${did}/site.standard.document/%`);
+
+        if (error)
+          throw new Error(
+            `Failed to fetch existing standard documents: ${error.message}`,
+          );
+        return data || [];
+      },
+    );
+
+    // Find documents that reference pub.leaflet.publication and need their site field updated
+    const standardDocsToFix = existingStandardDocs
+      .map((doc) => {
+        const data = doc.data as SiteStandardDocument.Record;
+        const site = data?.site;
+
+        // Check if site field references a pub.leaflet.publication
+        if (!site || !site.includes("/pub.leaflet.publication/")) {
+          return null;
+        }
+
+        try {
+          const oldPubAturi = new AtUri(site);
+          const newPubUri = `at://${oldPubAturi.hostname}/site.standard.publication/${oldPubAturi.rkey}`;
+
+          // Only fix if we have the new publication in our map (meaning it was migrated)
+          // or if the new publication exists (check against all migrated publications)
+          if (
+            publicationUriMap[site] ||
+            Object.values(publicationUriMap).includes(newPubUri)
+          ) {
+            const docAturi = new AtUri(doc.uri);
+            const updatedRecord: SiteStandardDocument.Record = {
+              ...data,
+              site: newPubUri,
+            };
+
+            return {
+              doc,
+              rkey: docAturi.rkey,
+              oldSite: site,
+              newSite: newPubUri,
+              updatedRecord,
+            };
+          }
+        } catch (e) {
+          stats.errors.push(`Invalid site URI in document ${doc.uri}: ${site}`);
+        }
+
+        return null;
+      })
+      .filter((x) => x !== null);
+
+    // Update these documents on PDS and in database
+    if (standardDocsToFix.length > 0) {
+      const fixResults = await Promise.all(
+        standardDocsToFix.map(({ doc, rkey, oldSite, newSite, updatedRecord }) =>
+          step.run(`fix-standard-document-${doc.uri}`, async () => {
+            // PDS write to update the site field
+            const agent = await createAuthenticatedAgent(did);
+            await agent.com.atproto.repo.putRecord({
+              repo: did,
+              collection: "site.standard.document",
+              rkey,
+              record: updatedRecord,
+              validate: false,
+            });
+
+            // DB write
+            const { error: dbError } = await supabaseServerClient
+              .from("documents")
+              .update({ data: updatedRecord as Json })
+              .eq("uri", doc.uri);
+
+            if (dbError) {
+              return {
+                success: false as const,
+                uri: doc.uri,
+                error: dbError.message,
+              };
+            }
+
+            // Update documents_in_publications to point to new publication URI
+            await supabaseServerClient
+              .from("documents_in_publications")
+              .upsert({
+                publication: newSite,
+                document: doc.uri,
+              });
+
+            // Remove old publication reference if different
+            if (oldSite !== newSite) {
+              await supabaseServerClient
+                .from("documents_in_publications")
+                .delete()
+                .eq("publication", oldSite)
+                .eq("document", doc.uri);
+            }
+
+            return { success: true as const, uri: doc.uri };
+          }),
+        ),
+      );
+
+      for (const result of fixResults) {
+        if (result.success) {
+          stats.standardDocumentsFixed++;
+        } else {
+          stats.errors.push(
+            `Fix standard document ${result.uri}: Database error: ${result.error}`,
+          );
+        }
+      }
+    }
+
     // Step 5: Update references in database tables (all in parallel)
     await step.run("update-references", async () => {
       const pubEntries = Object.entries(publicationUriMap);
···
       })
       .filter((x) => x !== null);
 
-    // Run all PDS writes in parallel
-    const subPdsResults = await Promise.all(
+    // Run PDS + DB writes together for each subscription
+    const subResults = await Promise.all(
       subscriptionsToMigrate.map(({ sub, rkey, newRecord }) =>
-        step.run(`pds-write-subscription-${sub.uri}`, async () => {
+        step.run(`migrate-subscription-${sub.uri}`, async () => {
+          // PDS write
           const agent = await createAuthenticatedAgent(did);
           const putResult = await agent.com.atproto.repo.putRecord({
             repo: did,
···
             record: newRecord,
             validate: false,
           });
-          return { oldUri: sub.uri, newUri: putResult.data.uri };
-        }),
-      ),
-    );
+          const newUri = putResult.data.uri;
 
-    // Run all DB writes in parallel
-    const subDbResults = await Promise.all(
-      subscriptionsToMigrate.map(({ sub, newRecord }, index) => {
-        const newUri = subPdsResults[index].newUri;
-        return step.run(`db-write-subscription-${sub.uri}`, async () => {
+          // DB write
           const { error: dbError } = await supabaseServerClient
             .from("publication_subscriptions")
             .update({
···
             };
           }
           return { success: true as const, oldUri: sub.uri, newUri };
-        });
-      }),
+        }),
+      ),
     );
 
     // Process results
-    for (const result of subDbResults) {
+    for (const result of subResults) {
       if (result.success) {
         userSubscriptionUriMap[result.oldUri] = result.newUri;
         stats.userSubscriptionsMigrated++;
···
     // 2. External references (e.g., from other AT Proto apps) to old URIs continue to work
     // 3. The normalization layer handles both schemas transparently for reads
     // Old records are also kept on the user's PDS so existing AT-URI references remain valid.
+
+    // Clear the migration flag on success
+    if (stats.errors.length === 0) {
+      await step.run("clear-migration-flag", async () => {
+        await supabaseServerClient
+          .from("identities")
+          .update({ metadata: null })
+          .eq("atp_did", did);
+      });
+    }
 
     return {
       success: stats.errors.length === 0,

app/api/inngest/route.tsx

···
 import { batched_update_profiles } from "./functions/batched_update_profiles";
 import { index_follows } from "./functions/index_follows";
 import { migrate_user_to_standard } from "./functions/migrate_user_to_standard";
+import { fix_standard_document_publications } from "./functions/fix_standard_document_publications";
+import {
+  cleanup_expired_oauth_sessions,
+  check_oauth_session,
+} from "./functions/cleanup_expired_oauth_sessions";
 
 export const { GET, POST, PUT } = serve({
   client: inngest,
···
     batched_update_profiles,
     index_follows,
     migrate_user_to_standard,
+    fix_standard_document_publications,
+    cleanup_expired_oauth_sessions,
+    check_oauth_session,
   ],
 });

app/api/oauth/[route]/route.ts

···
   ActionAfterSignIn,
   parseActionFromSearchParam,
 } from "./afterSignInActions";
+import { inngest } from "app/api/inngest/client";
 
 type OauthRequestClientState = {
   redirect: string | null;
···
             .single();
           identity = data;
         }
+
+        // Trigger migration if identity needs it
+        const metadata = identity?.metadata as Record<string, unknown> | null;
+        if (metadata?.needsStandardSiteMigration) {
+          await inngest.send({
+            name: "user/migrate-to-standard",
+            data: { did: session.did },
+          });
+        }
+
         let { data: token } = await supabaseServerClient
           .from("email_auth_tokens")
           .insert({

app/lish/[did]/[publication]/.well-known/site.standard.publication/route.ts

···
+import { publicationNameOrUriFilter } from "src/utils/uriHelpers";
+import { supabaseServerClient } from "supabase/serverClient";
+
+export async function GET(
+  req: Request,
+  props: {
+    params: Promise<{ publication: string; did: string }>;
+  },
+) {
+  let params = await props.params;
+  let did = decodeURIComponent(params.did);
+  let publication_name = decodeURIComponent(params.publication);
+  let [{ data: publications }] = await Promise.all([
+    supabaseServerClient
+      .from("publications")
+      .select(
+        `*,
+        publication_subscriptions(*),
+        documents_in_publications(documents(
+          *,
+          comments_on_documents(count),
+          document_mentions_in_bsky(count)
+        ))
+      `,
+      )
+      .eq("identity_did", did)
+      .or(publicationNameOrUriFilter(did, publication_name))
+      .order("uri", { ascending: false })
+      .limit(1),
+  ]);
+  let publication = publications?.[0];
+  if (!did || !publication) return new Response(null, { status: 404 });
+  return new Response(publication.uri);
+}

app/lish/[did]/[publication]/[rkey]/page.tsx

···
         sizes: "32x32",
         type: "image/png",
       },
-      other: {
-        rel: "alternate",
-        url: document.uri,
-      },
+      other: [
+        {
+          rel: "alternate",
+          url: document.uri,
+        },
+        { rel: "site.standard.document", url: document.uri },
+      ],
     },
     title:
       docRecord.title +

app/lish/createPub/updatePublication.ts

···
   return withPublicationUpdate(uri, async ({ normalizedPub, existingBasePath, publicationType, agent }) => {
     // Build theme object
     const themeData = {
+      $type: "pub.leaflet.publication#theme" as const,
       backgroundImage: theme.backgroundImage
         ? {
             $type: "pub.leaflet.theme.backgroundImage",

app/p/[didOrHandle]/[rkey]/page.tsx

···
 
   return {
     icons: {
-      other: {
-        rel: "alternate",
-        url: document.uri,
-      },
+      other: [
+        {
+          rel: "alternate",
+          url: document.uri,
+        },
+        { rel: "site.standard.document", url: document.uri },
+      ],
     },
     title: docRecord.title,
     description: docRecord?.description || "",

drizzle/schema.ts

···
 	email: text("email"),
 	atp_did: text("atp_did"),
 	interface_state: jsonb("interface_state"),
+	metadata: jsonb("metadata"),
 },
 (table) => {
 	return {

lexicons/api/lexicons.ts

···
               type: 'ref',
             },
             theme: {
-              type: 'ref',
-              ref: 'lex:pub.leaflet.publication#theme',
+              type: 'union',
+              refs: ['lex:pub.leaflet.publication#theme'],
             },
             description: {
               maxGraphemes: 300,

lexicons/api/types/site/standard/publication.ts

···
 export interface Record {
   $type: 'site.standard.publication'
   basicTheme?: SiteStandardThemeBasic.Main
-  theme?: PubLeafletPublication.Theme
+  theme?: $Typed<PubLeafletPublication.Theme> | { $type: string }
   description?: string
   icon?: BlobRef
   name: string

lexicons/site/standard/publication.json

···
             "type": "ref"
           },
           "theme": {
-            "type": "ref",
-            "ref": "pub.leaflet.publication#theme"
+            "type": "union",
+            "refs": ["pub.leaflet.publication#theme"]
           },
           "description": {
             "maxGraphemes": 300,

lexicons/src/normalize.ts

···
  */
 
 import type * as PubLeafletDocument from "../api/types/pub/leaflet/document";
-import type * as PubLeafletPublication from "../api/types/pub/leaflet/publication";
+import * as PubLeafletPublication from "../api/types/pub/leaflet/publication";
 import type * as PubLeafletContent from "../api/types/pub/leaflet/content";
 import type * as SiteStandardDocument from "../api/types/site/standard/document";
 import type * as SiteStandardPublication from "../api/types/site/standard/publication";
···
 };
 
 // Normalized publication type - uses the generated site.standard.publication type
-export type NormalizedPublication = SiteStandardPublication.Record;
+// with the theme narrowed to only the valid pub.leaflet.publication#theme type
+// (isTheme validates that $type is present, so we use $Typed)
+// Note: We explicitly list fields rather than using Omit because the generated Record type
+// has an index signature [k: string]: unknown that interferes with property typing
+export type NormalizedPublication = {
+  $type: "site.standard.publication";
+  name: string;
+  url: string;
+  description?: string;
+  icon?: SiteStandardPublication.Record["icon"];
+  basicTheme?: SiteStandardThemeBasic.Main;
+  theme?: $Typed<PubLeafletPublication.Theme>;
+  preferences?: SiteStandardPublication.Preferences;
+};
 
 /**
  * Checks if the record is a pub.leaflet.document
···
 ): NormalizedPublication | null {
   if (!record || typeof record !== "object") return null;
 
-  // Pass through site.standard records directly
+  // Pass through site.standard records directly, but validate the theme
   if (isStandardPublication(record)) {
-    return record;
+    // Validate theme - only keep if it's a valid pub.leaflet.publication#theme
+    const theme = PubLeafletPublication.isTheme(record.theme)
+      ? (record.theme as $Typed<PubLeafletPublication.Theme>)
+      : undefined;
+    return {
+      ...record,
+      theme,
+    };
   }
 
   if (isLeafletPublication(record)) {
···
 
     const basicTheme = leafletThemeToBasicTheme(record.theme);
 
+    // Validate theme - only keep if it's a valid pub.leaflet.publication#theme with $type set
+    // For legacy records without $type, add it during normalization
+    let theme: $Typed<PubLeafletPublication.Theme> | undefined;
+    if (record.theme) {
+      if (PubLeafletPublication.isTheme(record.theme)) {
+        theme = record.theme as $Typed<PubLeafletPublication.Theme>;
+      } else {
+        // Legacy theme without $type - add it
+        theme = {
+          ...record.theme,
+          $type: "pub.leaflet.publication#theme",
+        };
+      }
+    }
+
     // Convert preferences to site.standard format (strip/replace $type)
     const preferences: SiteStandardPublication.Preferences | undefined =
       record.preferences
···
       description: record.description,
       icon: record.icon,
       basicTheme,
-      theme: record.theme,
+      theme,
       preferences,
     };
   }

supabase/database.types.ts

···
           home_page: string
           id: string
           interface_state: Json | null
+          metadata: Json | null
         }
         Insert: {
           atp_did?: string | null
···
           home_page?: string
           id?: string
           interface_state?: Json | null
+          metadata?: Json | null
         }
         Update: {
           atp_did?: string | null
···
           home_page?: string
           id?: string
           interface_state?: Json | null
+          metadata?: Json | null
         }
         Relationships: [
           {

supabase/migrations/20260123000000_add_metadata_to_identities.sql

···
+alter table "public"."identities" add column "metadata" jsonb;