- Fix bug: post page was overriding og:image with 150x200 thumbnail
- og:type = "article" for posts (was always "website")
- article:published_time, article:modified_time, article:author, article:tag
- og:image:alt + twitter:image:alt (post headline)
- twitter:label1/data1 with reading time
- Remove thumbnail fallback from socialImage (falls back to site logo instead)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace direct post.isEvent/eventDate/eventLocation reads with
getPostEventInfo() helper that derives info from the resolved
calendarItem reference. Loaders now resolve "calendarItem" and request
that field instead of legacy flat properties.
Also regenerate iconify mdi subset (map-marker-outline, download,
google, calendar-search, refresh).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Palette: gray/zinc/slate/neutral → stein, red → fire, amber → erde,
sky → himmel, green → wald
- Footer: replaced raw rgb with stein tokens
- Radius: unified to rounded-xs across cards, buttons, inputs, pagination
- Buttons: .btn-primary/.btn-secondary now font-medium; added secondary
- Card hover: -translate-y-0.5 + shadow + wald-300 border
- Header active link: wald border-bottom + wald-700 text
- Mobile nav: bigger touch targets + wald active accent
- Pagination: prev/next text labels + wald-500 active state with
separated shape/color classes to avoid Tailwind conflicts
- Lead paragraph: scoped .markdown > p:first-child for top-level
MarkdownBlock only via [data-block-type="markdown"]
- Section dividers: subtle wald-200 gradient between content rows
- Global focus-visible ring (wald-500)
- Inline hex → palette tokens (Badge amber, Tag custom-color contrast)
- Font weights snapped to design system (300/400/500/600/700)
- transition-all → transition-colors where only color changes
- Removed em-dashes from user-visible templates
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Security:
- cms-images / cms-files now share resolveCmsSource (cms-source.server.ts)
which enforces an allowlist: asset filename, absolute path on the CMS
host, or full URL exact-matching the configured CMS host+protocol.
Foreign hosts, protocol-relative URLs and path traversal return 400.
- markdown-safe.ts is the single configured marked entrypoint; it
disables raw HTML rendering globally (renderer.html() returns ''),
removing the inline script/iframe injection vector via markdown.
All 8 marked imports across components and loaders now go through it.
- sanitize-blocks.server.ts walks resolved page/post content and runs
HtmlBlock html fields through sanitize-html with a tight allowlist
(no script/style/on*, only youtube/vimeo/spotify iframes, mailto/tel
plus http(s) schemes, target=_blank gets rel=noopener).
- Webhook tokens (revalidate, cache/clear) compared via
crypto.timingSafeEqual through auth-token.server.ts.
- cms.ts wraps every fetch in cmsFetch(): 5 s default timeout via
AbortSignal.timeout, override per call or globally via
PUBLIC_CMS_FETCH_TIMEOUT_MS. Stops slow CMS responses from pinning
SSR workers indefinitely.
Observability:
- log.server.ts gives logWarn / logError / logInfo with scope + context;
swallowed catch {} blocks in hooks, layout.server, +page.server,
[...slug]/+page.server and sitemap now log instead of going silent.
Routing:
- Legacy /blog, /blog/page/:n, /blog/tag/:t and /p/:slug stub routes
deleted; their 301 redirects moved into hooks.server.ts so the
request never enters the SvelteKit page pipeline.
Tests (vitest, server-side):
- auth-token.server.test.ts (6 cases for constant-time compare)
- cms-source.server.test.ts (8 cases for SSRF allowlist)
- sanitize-blocks.server.test.ts (9 cases for sanitizer + walker)
All 23 green.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
`?preview_draft=<sid>` on any page/post route forwards the signed
session id to the CMS, which renders the in-memory draft instead of
the persisted entry. Layout listens for `rustycms:reload` postMessages
from the admin iframe parent and re-runs `invalidateAll()` to pick up
fresh draft state. CSP `frame-ancestors` is set per-request when
`PUBLIC_PREVIEW_PARENT_ORIGIN` is configured so the admin iframe can
embed the response.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adopt RustyCMS' new resolve semantics (_depth, _fields,
POST /_batch) where they pay off:
- +layout.server.ts: 4 sequential GETs (navHeader, navSocial,
footer, page_config) collapsed into one batchFetch() call.
Legacy "default" page_config slug stays as fallback Single-
Batch only when the canonical slug is missing.
- New getPageStubs() / getPostStubs() use _fields= so the
Slug→Label/Slug→URL maps don't pull body/rows. Typically
10-50× smaller payload, eligible for the same TTL cache.
- loadPostsList() now requests posts with _depth=2 and a
sparse fieldset that keeps card-level fields plus
postImage.* and postTag.{name,icon,color,_slug}. Body
Markdown stays out of the listing entirely.
- Page + post detail routes set _depth=3 as a cycle/blast-radius
cap (page → block → image → img reaches in three levels).
- cms.ts: ContentGetOptions gains depth/fields, getPageBySlug /
getPostBySlug / getPosts thread them through (cache key
extended). New batchFetch() / batchData<T>() helpers.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Hides Header / HeaderOverlay / Footer / TopBanner / Breadcrumbs and
the comment accordion when printing. Action toolbar already had
`print:hidden`.
- Adds @media print rules in app.css: 1.5cm page margins, 11pt body,
forced black-on-white, expand link URLs after anchor text inside
articles, keep images and headings together at page breaks.
- PostCard now renders the count pill whenever a value is known (incl.
zero); previously hidden for `count === 0`, so posts whose comments
are still pending always looked empty.
- Extracts the bulk-fetch helper to `lib/comment-counts.ts`
(`fetchCommentCounts` + `postSlugForComments`) and uses it from both
`BlogOverview` and `PostOverviewBlock`. Homepage / any page with a
post_overview block now shows the badges too — previously only the
paginated /posts/* routes did.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- PostActions: every item is a rounded-full pill with subtle border;
the three icon-only actions (share/copy/print) cluster in one
segmented control with divider lines, count + reading-time stand
alone left and right
- Share button only renders when `navigator.share` is available so
desktop doesn't get a duplicate of "Copy link"
- All action buttons drop their inline labels and use `title=` +
`aria-label` for tooltip-only access; copy still flips icon to a
checkmark for 1.5s on success
- Empty comment state stacks vertically on mobile (icon above), goes
horizontal + left-aligned on ≥sm
- Post header rebuilt: image fixed at 150x150 (no more mobile blow-up),
right column is `flex flex-col gap-3` so date/tags/actions share one
rhythm instead of ad-hoc margins
- Reading-time now also walks `row*Content` and pulls `content`/`body`/
`text` strings — Termin-Posts with empty body but markdown rows now
show a meaningful estimate
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
CommentCountBadge was a separate component rendered next to PostActions
— two adjacent strips of buttons that should have been one toolbar.
Merges the count fetch + click-to-scroll behaviour into PostActions
behind `commentPageId` / `commentTargetId` props. The standalone
CommentCountBadge.svelte is now redundant; deleted.
Layout under the post hero is now a single row:
[💬 3] [↗ Teilen] [📋 Link] [🖨️] [⏱ 4 min]
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds a small toolbar next to the comment-count badge with four actions:
- Share — uses `navigator.share()` on supporting devices, falls back
to copy-link otherwise
- Copy link — clipboard API with `<input>` + `execCommand` fallback,
flashes a checkmark for 1.5s on success
- Print — `window.print()`, hidden via `print:hidden` so it doesn't
show up in the printed output itself
- Reading time — server-computed from headline+body HTML at ~200 wpm,
hidden when 0
Reading time + canonical URL come from `+page.server.ts` so SSR
output is identical and shareable URLs render correctly.
All labels go through the translations layer (5 new
`post_action_*` keys).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Repositions the CommentCountBadge out of the date row into its own
container below the post image. Removes hover colour-change + the
prose underline (`no-underline\!`) so the badge sits flat with the
post chrome.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Drops the Cusdis embed (postCommentSlot in pageConfig) in favour of the
new RustyCMS comment plugin. New Comments.svelte renders the thread,
form, replies and inline edit/delete via /api/comments. Count-badge near
the post date links to the accordion and uses /api/comments/:id/count.
Accordion gets a `lazy` mode so the comment iframe / fetch happens only
on first open (avoids the previous "empty on first render" issue with
hidden details).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Browser caches /cms-images responses immutably for a year. When the
editor changes a focal point or alt text, the underlying transform
output changes too, but the URL stays the same — so the browser keeps
serving the previous bytes. Manual hard-reloads and /api/cache/clear
help once but not for visitors who already have the file.
- RustyImageTransformParams gains an optional `version` that
serializes as `_v` in the /cms-images URL.
- RustyImage.svelte takes a matching `version` prop and forwards it
through `baseParams`, so every <picture> source carries the tag.
- The post thumbnail passes `post._updated` (truncated to seconds)
as version. Each save bumps `_updated`, the URL changes, browsers
re-fetch.
`_v` is intentionally not consumed by `/cms-images` — its sole job is
to break the browser cache key. The server-side image-cache and the
RustyCMS transform cache key both ignore it, so disk usage doesn't
balloon when the version tag changes.
Three CI typecheck failures from the previous microformat patch:
- post.created is the only date field in the schema (no _created on the
generated PostEntry). Drop the _created fallback.
- postTag items can be a slug string OR a tag object. Type narrowing
with `'name' in tag` widened to `never`; pull the name through an
explicit `{ name?: string }` cast in @const so the iteration stays
honest about the runtime shape.
- author isn't on PostEntry either; cast at the use-site for the
hidden h-card author block.
Posts whose row*Content contains a `youtube_video` block now ship a
schema.org VideoObject per video alongside the existing BlogPosting /
Event JSON-LD. Lets Google attach a video rich-result to the post URL
(thumbnail, duration where available, embed/content URLs) instead of
treating the page as plain text whose body happens to be a single
iframe.
Thumbnail uses YouTube's predictable maxresdefault + hqdefault URLs;
upload date falls back to post.created when the embed has none.
Microformats:
- Wrap the post <article> in h-entry with p-name on the headline,
p-summary on the subheadline (or sr-only fallback from excerpt),
e-content on the rendered body, dt-published on the created date
(hidden time element) and an invisible p-author h-card. Tag names
are mirrored as hidden p-category entries so crawlers see them
even though the visual Tags component already links them.
- itemscope/itemtype maps to schema.org BlogPosting (or Event when
`isEvent`), aligning the invisible microdata with the existing
JSON-LD.
Keywords:
- When post.seoKeywords is empty, fall back to the comma-joined tag
names so <meta name="keywords"> still ships something meaningful.
The article template only rendered the H1 it could pluck from the
markdown body (`contentHeadlineHtml`). Posts whose body opens with H2
(or no heading) silently lost both the schema-level `headline` and
`subheadline` — they were used in SEO/JSON-LD/breadcrumb only.
Fall back to the structured fields when no inline H1 is present.
- Added support for a preview mode in the CMS, allowing draft content to be viewed without being indexed.
- Updated hooks and server logic to handle preview parameters, adjusting cache control and robots tags accordingly.
- Enhanced layout to display a preview notification when in preview mode, improving user experience for content editors.
- Extracted headline and body content from the post's HTML, allowing for distinct rendering of the headline and body in the post page.
- Updated the Svelte component to display the extracted headline and body content separately, enhancing the layout and readability of posts.
- Added `executeScripts` function to handle script elements within the comment slot, ensuring proper execution of inline scripts.
- Updated the comment slot container to utilize the new script execution functionality, enhancing dynamic content handling.
Auto-mode deadline_banner now resolves to the next future event across
all calendar_items in the CMS instead of requiring a manually-curated
items[] pool. Server load hooks (+page.server.ts for /, /[...slug],
/post/[slug]) call resolveDeadlineBannerBlocks which fetches the
global calendar_item list once and attaches it as items[] when mode
is "auto" and items[] is not already resolved. Component logic
unchanged — it still picks the soonest future entry.
Also:
- cms.ts: getCalendarItems() bulk list fetcher
- PostOverviewBlock.svelte: design defaults to "cards" when value is
empty string (not just null/undefined) so existing entries with
design: "" render
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Introduced keywords property in layout and page server files to enhance SEO capabilities.
- Updated relevant components to include keywords in meta tags for better search engine visibility.
- Changed site URLs in docker-compose and deployment configurations to remove "www" prefix for consistency.
- Improved image handling by introducing warmPostCardImages function for pre-fetching images in posts and tags.
- Enhanced PostCard component with responsive image sizes for better performance.
- Updated layout to include robots meta tag and JSON-LD structured data for improved SEO.
- Added loading state for images in TopBanner component to enhance user experience.
- Updated PostEntry type to include _rawImageUrl and _imageFocal for improved image management.
- Refactored image handling in various components to utilize the new properties, ensuring better focal point support and responsive image rendering.
- Introduced warmResponsiveImage function for pre-fetching image variants to optimize loading performance.
- Replaced CmsImage component with RustyImage in multiple blocks for consistent image processing.
- Added support for extracting focal points and alt text from CMS image fields.
- Introduced responsive image handling in TopBanner component, allowing for AVIF/WebP sources and LQIP placeholders.
- Updated image transformation functions to accommodate focal point parameters for better cropping.
- Refactored image URL resolution logic across various components and routes to utilize new image field structure.
- Set trailingSlash='always' globally via root layout.
- Update postHref, pageHref, Pagination, tag/breadcrumb hrefs, blog→posts
redirects to emit trailing slash.
- Match old Astro canonical so indexed URLs hit 200 directly instead of
308-redirect.
Peter Meier