@geekity/cms 0.29.0 → 0.31.0

package/dist/admin/store.js

@@ -1,1588 +0,0 @@
-import { createHash, randomBytes } from 'node:crypto';
-import { DatabaseSync } from 'node:sqlite';
-import { databaseFile, openDatabase } from '../cache.js';
-import { rsvpValue } from '../content/rsvp.js';
-import { REPLY_ACTIVITY_TYPE, replyIdOf, replyTargetOf } from '../federation/replies.js';
-import { repliesKey } from '../web/feed-source.js';
-import { replyGuid } from '../web/guids.js';
-/**
- * Which rows of the inbox log are replies: a `Create` that named something it
- * answers. Spelled once, because a count and a listing that disagreed about it
- * would show a post a number no page of comments could produce.
- */
-const IS_REPLY = `activity_type = '${REPLY_ACTIVITY_TYPE}' AND in_reply_to IS NOT NULL`;
-/** How long a session id is, in bytes. 32 is the 256 bits doc-5 asks for. */
-export const SESSION_ID_BYTES = 32;
-/** How one delivery of one activity to one follower ended. */
-export const DELIVERY_STATUSES = ['sent', 'queued', 'failed'];
-/** Where a relay subscription stands (FEP-ae0c). */
-export const RELAY_STATES = ['pending', 'accepted', 'rejected'];
-/** How one webmention this site sent to one page ended. */
-export const WEBMENTION_SEND_STATUSES = ['sent', 'none', 'failed'];
-/** Where a comment came from. */
-export const COMMENT_SOURCES = ['comment', 'webmention', 'activitypub'];
-/** What a comment is: something written, or a wordless pointer at the post. */
-export const COMMENT_KINDS = ['reply', 'like', 'boost', 'mention', 'repost'];
-/** Where a comment stands with the moderator. */
-export const COMMENT_STATUSES = ['pending', 'approved', 'spam'];
-/** What a comment can have had removed from it for privacy (TASK-135). */
-export const REDACTED_FIELDS = ['email', 'addressHash', 'author'];
-/** A comment's {@link CommentRecord.rsvp} as a record carries it: present only when there is one. */
-export function rsvpField(rsvp) {
-    return rsvp === undefined ? {} : { rsvp };
-}
-/** A comment's {@link CommentRecord.via} as a record carries it: present only when there is one. */
-export function viaField(via) {
-    return via === undefined || via === null || via === '' ? {} : { via };
-}
-/**
- * Open (and if needed create) the admin tables in `dataDir`, applying every
- * migration the package ships. Applying them is idempotent.
- *
- * The connection is its own; SQLite in WAL mode is happy with the content
- * index holding a second one on the same file.
- */
-export function openAdminStore(options) {
-    const file = databaseFile(options.dataDir);
-    const db = openDatabase({ dataDir: options.dataDir, ledger: LEDGER, migrations: MIGRATIONS });
-    const statements = {
-        deleteSessionsForUser: db.prepare('DELETE FROM sessions WHERE user_id = ? AND id IS NOT ?'),
-        insertSession: db.prepare(`
-      INSERT INTO sessions (id, user_id, csrf_token, created_at, expires_at)
-      VALUES (?, ?, ?, ?, ?)
-    `),
-        sessionById: db.prepare('SELECT * FROM sessions WHERE id = ?'),
-        deleteSession: db.prepare('DELETE FROM sessions WHERE id = ?'),
-        pruneSessions: db.prepare('DELETE FROM sessions WHERE expires_at <= ?'),
-        readFlash: db.prepare('SELECT flash FROM sessions WHERE id = ?'),
-        writeFlash: db.prepare('UPDATE sessions SET flash = ? WHERE id = ?'),
-        insertPasswordReset: db.prepare(`
-      INSERT INTO password_resets (token_hash, user_id, created_at, expires_at)
-      VALUES (?, ?, ?, ?)
-    `),
-        passwordResetByHash: db.prepare('SELECT * FROM password_resets WHERE token_hash = ?'),
-        deletePasswordReset: db.prepare('DELETE FROM password_resets WHERE token_hash = ?'),
-        deletePasswordResetsForUser: db.prepare('DELETE FROM password_resets WHERE user_id = ?'),
-        prunePasswordResets: db.prepare('DELETE FROM password_resets WHERE expires_at <= ?'),
-        spendToken: db.prepare(`
-      INSERT OR IGNORE INTO spent_tokens (token_hash, spent_at, expires_at) VALUES (?, ?, ?)
-    `),
-        pruneSpentTokens: db.prepare('DELETE FROM spent_tokens WHERE expires_at <= ?'),
-        getState: db.prepare('SELECT value FROM cms_state WHERE key = ?'),
-        putState: db.prepare(`
-      INSERT INTO cms_state (key, value, updated_at) VALUES (?, ?, ?)
-      ON CONFLICT (key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at
-    `),
-        // `?1 IS NULL` is how one statement answers both questions: naming a user
-        // counts theirs, naming nobody counts the site's.
-        countFollowers: db.prepare('SELECT COUNT(*) AS count FROM followers WHERE ?1 IS NULL OR username = ?1'),
-        listFollowers: db.prepare(`
-      SELECT * FROM followers
-      WHERE ?1 IS NULL OR username = ?1
-      ORDER BY followed_at DESC, actor_id DESC
-      LIMIT ?2 OFFSET ?3
-    `),
-        followerById: db.prepare('SELECT * FROM followers WHERE username = ? AND actor_id = ?'),
-        isAvatarSource: db.prepare(`
-      SELECT 1 FROM followers
-      WHERE icon_url = ?1 AND actor_id IN (SELECT actor_id FROM ap_inbox)
-      UNION ALL
-      SELECT 1 FROM actor_profiles
-      WHERE icon_url = ?1 AND actor_id IN (SELECT actor_id FROM ap_inbox)
-      UNION ALL
-      SELECT 1 FROM comments WHERE author_avatar = ?1 AND status = 'approved'
-      LIMIT 1
-    `),
-        listAvatarSources: db.prepare(`
-      SELECT icon_url AS url FROM followers
-      WHERE icon_url IS NOT NULL AND actor_id IN (SELECT actor_id FROM ap_inbox)
-      UNION
-      SELECT icon_url AS url FROM actor_profiles
-      WHERE icon_url IS NOT NULL AND actor_id IN (SELECT actor_id FROM ap_inbox)
-      UNION
-      SELECT author_avatar AS url FROM comments
-      WHERE author_avatar IS NOT NULL AND status = 'approved'
-    `),
-        actorProfileById: db.prepare('SELECT * FROM actor_profiles WHERE actor_id = ?'),
-        putActorProfile: db.prepare(`
-      INSERT INTO actor_profiles (actor_id, handle, name, icon_url, url, fetched_at)
-      VALUES (?, ?, ?, ?, ?, ?)
-      ON CONFLICT (actor_id) DO UPDATE SET
-        handle = excluded.handle,
-        name = excluded.name,
-        icon_url = excluded.icon_url,
-        url = excluded.url,
-        fetched_at = excluded.fetched_at
-    `),
-        listActorsToProfile: db.prepare(`
-      SELECT DISTINCT actor_id FROM ap_inbox
-      WHERE actor_id NOT IN (SELECT actor_id FROM followers)
-        AND actor_id NOT IN (SELECT actor_id FROM actor_profiles WHERE fetched_at >= ?)
-      ORDER BY actor_id
-    `),
-        putFollower: db.prepare(`
-      INSERT INTO followers (
-        username, actor_id, inbox_id, shared_inbox_id, handle, name, icon_url, url, followed_at
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (username, actor_id) DO UPDATE SET
-        inbox_id = excluded.inbox_id,
-        shared_inbox_id = excluded.shared_inbox_id,
-        handle = excluded.handle,
-        name = excluded.name,
-        icon_url = excluded.icon_url,
-        url = excluded.url
-    `),
-        deleteFollower: db.prepare('DELETE FROM followers WHERE username = ? AND actor_id = ?'),
-        clearFollowers: db.prepare('DELETE FROM followers'),
-        clearInboxActivities: db.prepare('DELETE FROM ap_inbox'),
-        resetInboxSequence: db.prepare("DELETE FROM sqlite_sequence WHERE name = 'ap_inbox'"),
-        countInboxActivities: db.prepare('SELECT COUNT(*) AS count FROM ap_inbox'),
-        deleteInboxActivity: db.prepare('DELETE FROM ap_inbox WHERE id = ? RETURNING *'),
-        listInboxActivities: db.prepare(`
-      SELECT * FROM ap_inbox
-      ORDER BY received_at DESC, id DESC
-      LIMIT ? OFFSET ?
-    `),
-        logInboxActivity: db.prepare(`
-      INSERT INTO ap_inbox (
-        activity_id, activity_type, actor_id, object_id, in_reply_to, reply_key, recipient,
-        received_at, fetched, json
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (activity_id) DO UPDATE SET
-        activity_type = excluded.activity_type,
-        actor_id = excluded.actor_id,
-        object_id = excluded.object_id,
-        in_reply_to = excluded.in_reply_to,
-        reply_key = excluded.reply_key,
-        recipient = excluded.recipient,
-        received_at = excluded.received_at,
-        fetched = excluded.fetched,
-        json = excluded.json
-      RETURNING *
-    `),
-        countReplies: db.prepare(`SELECT COUNT(*) AS count FROM ap_inbox WHERE ${IS_REPLY}`),
-        listReplies: db.prepare(`
-      SELECT * FROM ap_inbox WHERE ${IS_REPLY}
-      ORDER BY received_at DESC, id DESC
-      LIMIT ? OFFSET ?
-    `),
-        countRepliesTo: db.prepare(`
-      SELECT COUNT(*) AS count FROM ap_inbox WHERE ${IS_REPLY} AND in_reply_to = ?
-    `),
-        listRepliesTo: db.prepare(`
-      SELECT * FROM ap_inbox WHERE ${IS_REPLY} AND in_reply_to = ?
-      ORDER BY received_at DESC, id DESC
-      LIMIT ? OFFSET ?
-    `),
-        listCommentsFor: db.prepare(`
-      SELECT * FROM comments WHERE slug = ? ORDER BY submitted_at, id
-    `),
-        commentById: db.prepare('SELECT * FROM comments WHERE id = ?'),
-        commentsAt: db.prepare('SELECT * FROM comments WHERE url = ? ORDER BY submitted_at'),
-        commentsByRepliesKey: db.prepare('SELECT * FROM comments WHERE replies_key = ? ORDER BY submitted_at, id'),
-        staleCommentKeys: db.prepare('SELECT id, source FROM comments WHERE keys_base IS NOT ?'),
-        writeCommentKey: db.prepare('UPDATE comments SET replies_key = ?, keys_base = ? WHERE id = ?'),
-        repliesByKey: db.prepare(`
-      SELECT * FROM ap_inbox WHERE ${IS_REPLY} AND reply_key = ? ORDER BY received_at, id
-    `),
-        countCommentsByStatus: db.prepare('SELECT status, COUNT(*) AS count FROM comments GROUP BY status'),
-        hasApprovedAuthor: db.prepare(`
-      SELECT 1 FROM comments
-      WHERE status = 'approved' AND author_name = ? AND author_email IS ?
-        AND NOT EXISTS (SELECT 1 FROM json_each(comments.redacted) WHERE value = 'email')
-      LIMIT 1
-    `),
-        putComment: db.prepare(`
-      INSERT INTO comments (
-        id, slug, permalink, source, kind, status,
-        author_name, author_url, author_email,
-        markdown, html, submitted_at, address_hash, in_reply_to, url, author_avatar, notify,
-        redacted, rsvp, via, replies_key, keys_base
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (id) DO UPDATE SET
-        slug = excluded.slug,
-        permalink = excluded.permalink,
-        source = excluded.source,
-        kind = excluded.kind,
-        status = excluded.status,
-        author_name = excluded.author_name,
-        author_url = excluded.author_url,
-        author_email = excluded.author_email,
-        markdown = excluded.markdown,
-        html = excluded.html,
-        submitted_at = excluded.submitted_at,
-        address_hash = excluded.address_hash,
-        in_reply_to = excluded.in_reply_to,
-        url = excluded.url,
-        author_avatar = excluded.author_avatar,
-        notify = excluded.notify,
-        redacted = excluded.redacted,
-        rsvp = excluded.rsvp,
-        via = excluded.via,
-        replies_key = excluded.replies_key,
-        keys_base = excluded.keys_base
-    `),
-        deleteComment: db.prepare('DELETE FROM comments WHERE id = ?'),
-        clearComments: db.prepare('DELETE FROM comments'),
-        recordDelivery: db.prepare(`
-      INSERT INTO ap_deliveries (
-        activity_id, activity_type, object_id, slug,
-        actor_id, inbox_id, status, error, attempted_at
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (activity_id, actor_id) DO UPDATE SET
-        activity_type = excluded.activity_type,
-        object_id = excluded.object_id,
-        slug = excluded.slug,
-        inbox_id = excluded.inbox_id,
-        status = excluded.status,
-        error = excluded.error,
-        attempted_at = excluded.attempted_at
-      RETURNING *
-    `),
-        listDeliveries: db.prepare(`
-      SELECT * FROM ap_deliveries WHERE activity_id = ? ORDER BY actor_id
-    `),
-        countDeliveriesByStatus: db.prepare(`
-      SELECT status, COUNT(*) AS count FROM ap_deliveries WHERE activity_id = ? GROUP BY status
-    `),
-        lastDeliveryToInbox: db.prepare(`
-      SELECT * FROM ap_deliveries WHERE inbox_id = ?
-      ORDER BY attempted_at DESC, rowid DESC
-      LIMIT 1
-    `),
-        lastDeliveryToObject: db.prepare(`
-      SELECT * FROM ap_deliveries WHERE object_id = ?
-      ORDER BY attempted_at DESC, rowid DESC
-      LIMIT 1
-    `),
-        recordSentWebmention: db.prepare(`
-      INSERT INTO webmentions_sent (
-        slug, source, target, endpoint, status, error, attempted_at
-      ) VALUES (?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (slug, target) DO UPDATE SET
-        source = excluded.source,
-        endpoint = excluded.endpoint,
-        status = excluded.status,
-        error = excluded.error,
-        attempted_at = excluded.attempted_at
-      RETURNING *
-    `),
-        listSentWebmentions: db.prepare('SELECT * FROM webmentions_sent WHERE slug = ? ORDER BY target'),
-        listSentWebmentionSources: db.prepare('SELECT DISTINCT slug, source FROM webmentions_sent ORDER BY slug, source'),
-        copySentWebmentions: db.prepare(`
-      INSERT INTO webmentions_sent (
-        slug, source, target, endpoint, status, error, attempted_at
-      )
-      SELECT :to, source, target, endpoint, status, error, attempted_at
-      FROM webmentions_sent WHERE slug = :slug AND source = :source
-      ON CONFLICT (slug, target) DO UPDATE SET
-        source = excluded.source,
-        endpoint = excluded.endpoint,
-        status = excluded.status,
-        error = excluded.error,
-        attempted_at = excluded.attempted_at
-      WHERE excluded.attempted_at > webmentions_sent.attempted_at
-    `),
-        deleteSentWebmentions: db.prepare('DELETE FROM webmentions_sent WHERE slug = :slug AND source = :source'),
-        countSentWebmentionsByStatus: db.prepare(`
-      SELECT status, COUNT(*) AS count FROM webmentions_sent WHERE slug = ? GROUP BY status
-    `),
-        listRelays: db.prepare('SELECT * FROM ap_relays ORDER BY created_at, inbox_id'),
-        relayByInbox: db.prepare('SELECT * FROM ap_relays WHERE inbox_id = ?'),
-        relayByFollow: db.prepare('SELECT * FROM ap_relays WHERE follow_id = ?'),
-        putRelay: db.prepare(`
-      INSERT INTO ap_relays (
-        inbox_id, actor_id, state, reason, follow_id, created_at, updated_at
-      ) VALUES (?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (inbox_id) DO UPDATE SET
-        actor_id = excluded.actor_id,
-        state = excluded.state,
-        reason = excluded.reason,
-        follow_id = excluded.follow_id,
-        updated_at = excluded.updated_at
-      RETURNING *
-    `),
-        deleteRelay: db.prepare('DELETE FROM ap_relays WHERE inbox_id = ?'),
-    };
-    let open = true;
-    let readOnly = false;
-    /**
-     * Run a body with every write in it committed together, or none of them.
-     *
-     * The rebuilds are what need it: emptying an index and filling it again is
-     * one step to everything reading it, and a half-emptied `followers` is a
-     * site that has quietly stopped delivering to half its followers.
-     */
-    function inTransaction(body) {
-        db.exec('BEGIN');
-        try {
-            body();
-            db.exec('COMMIT');
-        }
-        catch (error) {
-            db.exec('ROLLBACK');
-            throw error;
-        }
-    }
-    /**
-     * The messages queued on a session. A column that will not parse is treated
-     * as empty: a flash is a convenience, and losing one is better than a 500 on
-     * every admin page until the row is cleaned up by hand.
-     */
-    function readFlash(sessionId) {
-        const row = statements.readFlash.get(sessionId);
-        const raw = row?.['flash'];
-        if (typeof raw !== 'string' || raw === '')
-            return [];
-        try {
-            const parsed = JSON.parse(raw);
-            return Array.isArray(parsed) ? parsed.filter(isFlashMessage) : [];
-        }
-        catch {
-            return [];
-        }
-    }
-    /** Work out again every comment key worked out against another base, or none. */
-    function refreshCommentKeys(baseUrl) {
-        inTransaction(() => {
-            for (const row of statements.staleCommentKeys.all(baseUrl)) {
-                const comment = {
-                    id: String(row['id']),
-                    source: oneOf(row['source'], COMMENT_SOURCES, 'comment'),
-                };
-                statements.writeCommentKey.run(...commentKey(comment, baseUrl), comment.id);
-            }
-        });
-    }
-    if (options.baseUrl !== undefined)
-        refreshCommentKeys(options.baseUrl);
-    const listeners = new Set();
-    const written = (change) => {
-        for (const listener of listeners)
-            listener(change);
-    };
-    return {
-        file,
-        onConversationWrite(listener) {
-            listeners.add(listener);
-            return () => listeners.delete(listener);
-        },
-        createSession(input) {
-            const now = input.now ?? new Date();
-            const session = {
-                id: randomToken(),
-                userId: input.userId,
-                csrfToken: randomToken(),
-                createdAt: now.toISOString(),
-                expiresAt: new Date(now.getTime() + input.lifetimeSeconds * 1000).toISOString(),
-            };
-            statements.insertSession.run(session.id, session.userId, session.csrfToken, session.createdAt, session.expiresAt);
-            return session;
-        },
-        getSession(id, now = new Date()) {
-            const row = statements.sessionById.get(id);
-            if (row === undefined)
-                return undefined;
-            const session = toSession(row);
-            // ISO 8601 in UTC sorts the way time runs, so string order is time order.
-            if (session.expiresAt <= now.toISOString()) {
-                statements.deleteSession.run(id);
-                return undefined;
-            }
-            return session;
-        },
-        deleteSession(id) {
-            return statements.deleteSession.run(id).changes > 0;
-        },
-        deleteSessionsForUser(userId, options = {}) {
-            // `IS NOT` rather than `<>`, so a missing `except` compares against NULL
-            // and spares nothing instead of matching nothing.
-            return Number(statements.deleteSessionsForUser.run(userId, options.except ?? null).changes);
-        },
-        createPasswordReset(input) {
-            const now = input.now ?? new Date();
-            const token = randomToken();
-            const reset = {
-                token,
-                userId: input.userId,
-                createdAt: now.toISOString(),
-                expiresAt: new Date(now.getTime() + input.lifetimeSeconds * 1000).toISOString(),
-            };
-            statements.insertPasswordReset.run(hashToken(token), reset.userId, reset.createdAt, reset.expiresAt);
-            return reset;
-        },
-        getPasswordReset(token, now = new Date()) {
-            const hash = hashToken(token);
-            const row = statements.passwordResetByHash.get(hash);
-            if (row === undefined)
-                return undefined;
-            const reset = {
-                userId: Number(row['user_id']),
-                createdAt: String(row['created_at']),
-                expiresAt: String(row['expires_at']),
-            };
-            // The same rule the sessions follow: an expired row is deleted rather
-            // than ignored, so a clock that goes backwards cannot revive a link.
-            if (reset.expiresAt <= now.toISOString()) {
-                statements.deletePasswordReset.run(hash);
-                return undefined;
-            }
-            return reset;
-        },
-        deletePasswordReset(token) {
-            return statements.deletePasswordReset.run(hashToken(token)).changes > 0;
-        },
-        deletePasswordResetsForUser(userId) {
-            return Number(statements.deletePasswordResetsForUser.run(userId).changes);
-        },
-        prunePasswordResets(now = new Date()) {
-            return Number(statements.prunePasswordResets.run(now.toISOString()).changes);
-        },
-        spendToken(token, expiresAt, now = new Date()) {
-            // `INSERT OR IGNORE` rather than a read then a write: two clicks on the
-            // same link arriving together must not both find nothing and both act.
-            const written = statements.spendToken.run(hashToken(token), now.toISOString(), expiresAt);
-            return Number(written.changes) > 0;
-        },
-        pruneSpentTokens(now = new Date()) {
-            return Number(statements.pruneSpentTokens.run(now.toISOString()).changes);
-        },
-        countFollowers(username) {
-            const row = statements.countFollowers.get(username ?? null);
-            return Number(row?.['count'] ?? 0);
-        },
-        listFollowers(username, options = {}) {
-            const rows = statements.listFollowers.all(username ?? null, options.limit ?? NO_LIMIT, options.offset ?? 0);
-            return rows.map(toFollower);
-        },
-        getFollower(username, actorId) {
-            const row = statements.followerById.get(username, actorId);
-            return row === undefined ? undefined : toFollower(row);
-        },
-        isAvatarSource(url) {
-            return statements.isAvatarSource.get(url) !== undefined;
-        },
-        listAvatarSources() {
-            return statements.listAvatarSources.all().map((row) => String(row['url']));
-        },
-        getActorProfile(actorId) {
-            const row = statements.actorProfileById.get(actorId);
-            return row === undefined ? undefined : toActorProfile(row);
-        },
-        putActorProfile(profile) {
-            statements.putActorProfile.run(profile.actorId, profile.handle, profile.name, profile.iconUrl, profile.url, profile.fetchedAt);
-        },
-        listActorsToProfile(fetchedBefore) {
-            return statements.listActorsToProfile.all(fetchedBefore).map((row) => String(row['actor_id']));
-        },
-        putFollower(follower) {
-            statements.putFollower.run(follower.username, follower.actorId, follower.inboxId, follower.sharedInboxId, follower.handle, follower.name, follower.iconUrl, follower.url, follower.followedAt ?? new Date().toISOString());
-            // Read back rather than returning what was written: the upsert leaves an
-            // existing `followed_at` alone, so the row is the only thing that knows
-            // when the follow really began.
-            const row = statements.followerById.get(follower.username, follower.actorId);
-            if (row === undefined) {
-                throw new Error(`The follower "${follower.actorId}" vanished between insert and read.`);
-            }
-            return toFollower(row);
-        },
-        deleteFollower(username, actorId) {
-            return statements.deleteFollower.run(username, actorId).changes > 0;
-        },
-        replaceFollowers(followers) {
-            inTransaction(() => {
-                statements.clearFollowers.run();
-                for (const follower of followers) {
-                    statements.putFollower.run(follower.username, follower.actorId, follower.inboxId, follower.sharedInboxId, follower.handle, follower.name, follower.iconUrl, follower.url, follower.followedAt ?? new Date().toISOString());
-                }
-            });
-        },
-        countInboxActivities() {
-            const row = statements.countInboxActivities.get();
-            return Number(row?.['count'] ?? 0);
-        },
-        listInboxActivities(options = {}) {
-            const rows = statements.listInboxActivities.all(options.limit ?? NO_LIMIT, options.offset ?? 0);
-            return rows.map(toInboxActivity);
-        },
-        logInboxActivity(activity) {
-            const row = statements.logInboxActivity.get(activity.activityId, activity.activityType, activity.actorId, activity.objectId, 
-            // Derived here rather than passed in, so the column cannot say
-            // something the stored activity does not.
-            replyTargetOf(activity.json), replyKeyOf(activity), activity.recipient ?? null, activity.receivedAt ?? new Date().toISOString(), activity.fetched === true ? 1 : 0, activity.json);
-            if (row === undefined) {
-                throw new Error(`The activity "${activity.activityType}" was not written to the log.`);
-            }
-            const logged = toInboxActivity(row);
-            written(activityWrite(logged));
-            return logged;
-        },
-        deleteInboxActivity(id) {
-            const row = statements.deleteInboxActivity.get(id);
-            if (row === undefined)
-                return false;
-            written(activityWrite(toInboxActivity(row)));
-            return true;
-        },
-        replaceInboxActivities(activities) {
-            inTransaction(() => {
-                statements.clearInboxActivities.run();
-                // The AUTOINCREMENT high-water mark goes with the rows, so the same
-                // log always produces the same ids however many times it is rebuilt.
-                statements.resetInboxSequence.run();
-                for (const activity of activities) {
-                    statements.logInboxActivity.run(activity.activityId, activity.activityType, activity.actorId, activity.objectId, replyTargetOf(activity.json), replyKeyOf(activity), activity.recipient ?? null, activity.receivedAt ?? new Date().toISOString(), activity.fetched === true ? 1 : 0, activity.json);
-                }
-            });
-        },
-        countReplies() {
-            const row = statements.countReplies.get();
-            return Number(row?.['count'] ?? 0);
-        },
-        listReplies(options = {}) {
-            const rows = statements.listReplies.all(options.limit ?? NO_LIMIT, options.offset ?? 0);
-            return rows.map(toInboxActivity);
-        },
-        countRepliesTo(objectId) {
-            const row = statements.countRepliesTo.get(objectId);
-            return Number(row?.['count'] ?? 0);
-        },
-        listRepliesTo(objectId, options = {}) {
-            const rows = statements.listRepliesTo.all(objectId, options.limit ?? NO_LIMIT, options.offset ?? 0);
-            return rows.map(toInboxActivity);
-        },
-        listActivitiesAbout(objectIds) {
-            if (objectIds.length === 0)
-                return [];
-            // Prepared here rather than beside the others because the number of
-            // placeholders is the number of ids: a conversation asks about the post,
-            // then about the notes that answered it, and neither count is known when
-            // the statements are built.
-            const placeholders = objectIds.map(() => '?').join(', ');
-            const rows = db
-                .prepare(`SELECT * FROM ap_inbox
-           WHERE object_id IN (${placeholders}) OR in_reply_to IN (${placeholders})
-           ORDER BY id ASC`)
-                .all(...objectIds, ...objectIds);
-            return rows.map(toInboxActivity);
-        },
-        listCommentsFor(slug) {
-            return statements.listCommentsFor.all(slug).map(toComment);
-        },
-        listComments(options = {}) {
-            // Prepared here rather than beside the others because the `WHERE` is not
-            // fixed: the screen asks for one status and the site-wide feed asks for
-            // approved comments across every post.
-            const where = options.status === undefined ? '' : 'WHERE status = ?';
-            const parameters = options.status === undefined ? [] : [options.status];
-            const rows = db
-                .prepare(`SELECT * FROM comments ${where}
-           ORDER BY submitted_at DESC, id DESC
-           LIMIT ? OFFSET ?`)
-                .all(...parameters, options.limit ?? NO_LIMIT, options.offset ?? 0);
-            return rows.map(toComment);
-        },
-        getComment(id) {
-            const row = statements.commentById.get(id);
-            return row === undefined ? undefined : toComment(row);
-        },
-        listCommentsAt(url) {
-            return statements.commentsAt.all(url).map(toComment);
-        },
-        listCommentsByRepliesKey(key) {
-            return statements.commentsByRepliesKey.all(key).map(toComment);
-        },
-        listRepliesByKey(key) {
-            return statements.repliesByKey.all(key).map(toInboxActivity);
-        },
-        countCommentsByStatus() {
-            const counts = { pending: 0, approved: 0, spam: 0 };
-            for (const row of statements.countCommentsByStatus.all()) {
-                counts[commentStatus(row['status'])] += Number(row['count'] ?? 0);
-            }
-            return counts;
-        },
-        hasApprovedAuthor(name, email) {
-            // `IS` rather than `=`, so an author who gave no email is matched by the
-            // rows that gave none either instead of matching nothing.
-            return statements.hasApprovedAuthor.get(name, email) !== undefined;
-        },
-        putComment(comment) {
-            const before = statements.commentById.get(comment.id);
-            statements.putComment.run(comment.id, comment.slug, comment.permalink, comment.source, comment.kind, comment.status, comment.author.name, comment.author.url, comment.author.email, comment.content.markdown, comment.content.html, comment.submitted, comment.addressHash, comment.inReplyTo, comment.url, comment.author.avatar, comment.notify ? 1 : 0, redactedColumn(comment.redacted), comment.rsvp ?? null, comment.via ?? null, ...commentKey(comment, options.baseUrl));
-            written({
-                kind: 'comment',
-                slug: comment.slug,
-                id: comment.id,
-                approved: comment.status === 'approved' && before?.['status'] !== 'approved',
-            });
-            return comment;
-        },
-        deleteComment(id) {
-            const row = statements.commentById.get(id);
-            const slug = row === undefined ? undefined : String(row['slug']);
-            const deleted = statements.deleteComment.run(id).changes > 0;
-            if (slug !== undefined)
-                written({ kind: 'comment', slug, id, approved: false });
-            return deleted;
-        },
-        replaceComments(comments) {
-            inTransaction(() => {
-                statements.clearComments.run();
-                for (const comment of comments) {
-                    statements.putComment.run(comment.id, comment.slug, comment.permalink, comment.source, comment.kind, comment.status, comment.author.name, comment.author.url, comment.author.email, comment.content.markdown, comment.content.html, comment.submitted, comment.addressHash, comment.inReplyTo, comment.url, comment.author.avatar, comment.notify ? 1 : 0, redactedColumn(comment.redacted), comment.rsvp ?? null, comment.via ?? null, ...commentKey(comment, options.baseUrl));
-                }
-            });
-        },
-        recordDelivery(delivery) {
-            const row = statements.recordDelivery.get(delivery.activityId, delivery.activityType, delivery.objectId, delivery.slug, delivery.actorId, delivery.inboxId, delivery.status, delivery.error, delivery.attemptedAt ?? new Date().toISOString());
-            if (row === undefined) {
-                throw new Error(`The delivery of "${delivery.activityId}" to "${delivery.actorId}" was not recorded.`);
-            }
-            return toDelivery(row);
-        },
-        listDeliveries(activityId) {
-            const rows = statements.listDeliveries.all(activityId);
-            return rows.map(toDelivery);
-        },
-        countDeliveriesByStatus(activityId) {
-            const counts = { sent: 0, queued: 0, failed: 0 };
-            for (const row of statements.countDeliveriesByStatus.all(activityId)) {
-                const status = deliveryStatus(row['status']);
-                counts[status] += Number(row['count'] ?? 0);
-            }
-            return counts;
-        },
-        lastDeliveryToInbox(inboxId) {
-            const row = statements.lastDeliveryToInbox.get(inboxId);
-            return row === undefined ? undefined : toDelivery(row);
-        },
-        lastDeliveryToObject(objectId) {
-            const row = statements.lastDeliveryToObject.get(objectId);
-            return row === undefined ? undefined : toDelivery(row);
-        },
-        recordSentWebmention(sent) {
-            const row = statements.recordSentWebmention.get(sent.slug, sent.source, sent.target, sent.endpoint, sent.status, sent.error, sent.attemptedAt ?? new Date().toISOString());
-            if (row === undefined) {
-                throw new Error(`The webmention to ${sent.target} could not be recorded.`);
-            }
-            return toSentWebmention(row);
-        },
-        listSentWebmentions(slug) {
-            const rows = statements.listSentWebmentions.all(slug);
-            return rows.map(toSentWebmention);
-        },
-        listSentWebmentionSources() {
-            const rows = statements.listSentWebmentionSources.all();
-            return rows.map((row) => ({ slug: String(row['slug']), source: String(row['source']) }));
-        },
-        moveSentWebmentions(from, to) {
-            if (from.slug === to)
-                return;
-            inTransaction(() => {
-                statements.copySentWebmentions.run({ ...from, to });
-                statements.deleteSentWebmentions.run(from);
-            });
-        },
-        countSentWebmentionsByStatus(slug) {
-            const counts = { sent: 0, none: 0, failed: 0 };
-            const rows = statements.countSentWebmentionsByStatus.all(slug);
-            for (const row of rows) {
-                counts[webmentionSendStatus(row['status'])] = Number(row['count']);
-            }
-            return counts;
-        },
-        listRelays() {
-            return statements.listRelays.all().map(toRelay);
-        },
-        getRelay(inboxId) {
-            const row = statements.relayByInbox.get(inboxId);
-            return row === undefined ? undefined : toRelay(row);
-        },
-        getRelayByFollow(followId) {
-            const row = statements.relayByFollow.get(followId);
-            return row === undefined ? undefined : toRelay(row);
-        },
-        putRelay(relay) {
-            const now = new Date().toISOString();
-            const row = statements.putRelay.get(relay.inboxId, relay.actorId, relay.state, relay.reason, relay.followId, relay.createdAt ?? now, now);
-            if (row === undefined) {
-                throw new Error(`The relay subscription to "${relay.inboxId}" was not written.`);
-            }
-            return toRelay(row);
-        },
-        deleteRelay(inboxId) {
-            return statements.deleteRelay.run(inboxId).changes > 0;
-        },
-        pruneSessions(now = new Date()) {
-            return Number(statements.pruneSessions.run(now.toISOString()).changes);
-        },
-        legacySettings() {
-            // Prepared here rather than with the rest, because the table this reads
-            // is one that will not be there: a statement over a missing table throws
-            // when it is prepared, which would take the whole store down.
-            if (!hasTable(db, 'settings'))
-                return undefined;
-            return db.prepare('SELECT key, value, updated_at FROM settings').all().map((row) => ({
-                key: String(row['key']),
-                value: String(row['value']),
-                updatedAt: String(row['updated_at']),
-            }));
-        },
-        legacyActorKeys() {
-            // Prepared here for the same reason `legacySettings` is: the table is one
-            // that will not be there, and a statement over a missing table throws
-            // when it is prepared rather than when it is run.
-            if (!hasTable(db, 'actor_keys'))
-                return undefined;
-            return db.prepare('SELECT identifier, algorithm, private_jwk FROM actor_keys').all().map((row) => ({
-                identifier: String(row['identifier']),
-                algorithm: String(row['algorithm']),
-                privateJwk: String(row['private_jwk']),
-            }));
-        },
-        legacyUsers() {
-            // Prepared here for the same reason `legacySettings` is: the table is
-            // one that will not be there, and a statement over a missing table
-            // throws when it is prepared rather than when it is run.
-            if (!hasTable(db, 'users'))
-                return undefined;
-            return db
-                .prepare('SELECT id, username, password_hash, created_at FROM users ORDER BY id')
-                .all().map((row) => ({
-                id: Number(row['id']),
-                username: String(row['username']),
-                passwordHash: String(row['password_hash']),
-                createdAt: String(row['created_at']),
-            }));
-        },
-        dropLegacyTable(name) {
-            // The name is never a caller's to invent: it is one of this file's own
-            // shipped table names, so quoting it is enough.
-            db.exec(`DROP TABLE IF EXISTS "${name.replace(/"/g, '""')}"`);
-        },
-        getState(key) {
-            const row = statements.getState.get(key);
-            return row === undefined ? undefined : String(row['value']);
-        },
-        setState(key, value) {
-            statements.putState.run(key, value, new Date().toISOString());
-        },
-        pushFlash(sessionId, entry) {
-            const queued = [...readFlash(sessionId), entry];
-            statements.writeFlash.run(JSON.stringify(queued), sessionId);
-        },
-        takeFlash(sessionId) {
-            const queued = readFlash(sessionId);
-            if (!readOnly)
-                statements.writeFlash.run(null, sessionId);
-            return queued;
-        },
-        setReadOnly(on) {
-            db.exec(`PRAGMA query_only = ${on ? 'ON' : 'OFF'}`);
-            readOnly = on;
-        },
-        close() {
-            if (!open)
-                return;
-            open = false;
-            db.close();
-        },
-    };
-}
-function isFlashMessage(value) {
-    if (typeof value !== 'object' || value === null)
-        return false;
-    const entry = value;
-    return ((entry['kind'] === 'notice' || entry['kind'] === 'warning' || entry['kind'] === 'error') &&
-        typeof entry['message'] === 'string');
-}
-/**
- * What a `LIMIT` means when the caller named none. SQLite reads a negative
- * limit as "every row", which is what an unpaged list asks for.
- */
-const NO_LIMIT = -1;
-/**
- * A `TEXT` column that may be `NULL`, as a string or `null`.
- *
- * Anything that is not text is read as `null` rather than stringified: every
- * column this is used on is declared `TEXT`, so a value of another shape is a
- * row somebody else wrote, and `[object Object]` is a worse answer than none.
- */
-function nullableText(value) {
-    return typeof value === 'string' ? value : null;
-}
-function toFollower(row) {
-    return {
-        username: String(row['username']),
-        actorId: String(row['actor_id']),
-        inboxId: String(row['inbox_id']),
-        sharedInboxId: nullableText(row['shared_inbox_id']),
-        handle: nullableText(row['handle']),
-        name: nullableText(row['name']),
-        iconUrl: nullableText(row['icon_url']),
-        url: nullableText(row['url']),
-        followedAt: String(row['followed_at']),
-    };
-}
-function toActorProfile(row) {
-    return {
-        actorId: String(row['actor_id']),
-        handle: nullableText(row['handle']),
-        name: nullableText(row['name']),
-        iconUrl: nullableText(row['icon_url']),
-        url: nullableText(row['url']),
-        fetchedAt: String(row['fetched_at']),
-    };
-}
-function toInboxActivity(row) {
-    return {
-        id: Number(row['id']),
-        activityId: nullableText(row['activity_id']),
-        activityType: String(row['activity_type']),
-        actorId: String(row['actor_id']),
-        objectId: nullableText(row['object_id']),
-        inReplyTo: nullableText(row['in_reply_to']),
-        recipient: nullableText(row['recipient']),
-        receivedAt: String(row['received_at']),
-        fetched: Number(row['fetched']) === 1,
-        json: String(row['json']),
-    };
-}
-function toDelivery(row) {
-    return {
-        activityId: String(row['activity_id']),
-        activityType: String(row['activity_type']),
-        objectId: String(row['object_id']),
-        slug: nullableText(row['slug']),
-        actorId: String(row['actor_id']),
-        inboxId: String(row['inbox_id']),
-        status: deliveryStatus(row['status']),
-        error: nullableText(row['error']),
-        attemptedAt: String(row['attempted_at']),
-    };
-}
-function toSentWebmention(row) {
-    return {
-        slug: String(row['slug']),
-        source: String(row['source']),
-        target: String(row['target']),
-        endpoint: nullableText(row['endpoint']),
-        status: webmentionSendStatus(row['status']),
-        error: nullableText(row['error']),
-        attemptedAt: String(row['attempted_at']),
-    };
-}
-/** A stored send status, or `failed` for one this version does not know. */
-function webmentionSendStatus(value) {
-    return oneOf(value, WEBMENTION_SEND_STATUSES, 'failed');
-}
-function toComment(row) {
-    return {
-        id: String(row['id']),
-        slug: String(row['slug']),
-        permalink: String(row['permalink']),
-        source: oneOf(row['source'], COMMENT_SOURCES, 'comment'),
-        kind: oneOf(row['kind'], COMMENT_KINDS, 'reply'),
-        status: commentStatus(row['status']),
-        author: {
-            name: String(row['author_name']),
-            url: nullableText(row['author_url']),
-            email: nullableText(row['author_email']),
-            avatar: nullableText(row['author_avatar']),
-        },
-        content: { markdown: String(row['markdown']), html: String(row['html']) },
-        submitted: String(row['submitted_at']),
-        addressHash: nullableText(row['address_hash']),
-        inReplyTo: nullableText(row['in_reply_to']),
-        url: nullableText(row['url']),
-        notify: Number(row['notify'] ?? 0) === 1,
-        ...redactedOf(row['redacted']),
-        ...rsvpField(rsvpValue(row['rsvp'])),
-        ...viaField(nullableText(row['via'])),
-    };
-}
-/** A comment's {@link CommentRecord.redacted} as its column holds it: JSON, or `NULL`. */
-function redactedColumn(redacted) {
-    return redacted === undefined || redacted.length === 0 ? null : JSON.stringify(redacted);
-}
-/** The column read back, as the key a record carries only when something was removed. */
-function redactedOf(value) {
-    if (typeof value !== 'string')
-        return {};
-    let parsed;
-    try {
-        parsed = JSON.parse(value);
-    }
-    catch {
-        return {};
-    }
-    const fields = Array.isArray(parsed)
-        ? REDACTED_FIELDS.filter((field) => parsed.includes(field))
-        : [];
-    return fields.length === 0 ? {} : { redacted: fields };
-}
-/**
- * A stored comment status, or `pending` for one this version does not know.
- *
- * Pending is the safe reading: showing a comment nobody approved is the one
- * mistake a moderation queue cannot make, and the screen is right there for
- * the row.
- */
-function commentStatus(value) {
-    return oneOf(value, COMMENT_STATUSES, 'pending');
-}
-/** A stored enumeration value, or the fallback for one this version does not know. */
-function oneOf(value, allowed, fallback) {
-    return allowed.includes(value) ? value : fallback;
-}
-function toRelay(row) {
-    return {
-        inboxId: String(row['inbox_id']),
-        actorId: nullableText(row['actor_id']),
-        state: relayState(row['state']),
-        reason: nullableText(row['reason']),
-        followId: nullableText(row['follow_id']),
-        createdAt: String(row['created_at']),
-        updatedAt: String(row['updated_at']),
-    };
-}
-/**
- * A stored relay state, or `pending` for one this version does not know.
- *
- * Pending is the safe reading of an unknown state: a subscription this version
- * cannot make sense of is one it should not be delivering public posts to, and
- * Retry is on the screen for exactly that row.
- */
-function relayState(value) {
-    return RELAY_STATES.includes(value) ? value : 'pending';
-}
-/**
- * A stored status, or `failed` for one this version does not know.
- *
- * An unreadable status is reported as the pessimistic one: an admin screen
- * showing a delivery as failed when it was not is a nuisance, and showing one
- * as sent when nobody knows is a lie.
- */
-function deliveryStatus(value) {
-    return DELIVERY_STATUSES.includes(value) ? value : 'failed';
-}
-function toSession(row) {
-    const userId = row['user_id'];
-    return {
-        id: String(row['id']),
-        userId: userId === null || userId === undefined ? null : Number(userId),
-        csrfToken: String(row['csrf_token']),
-        createdAt: String(row['created_at']),
-        expiresAt: String(row['expires_at']),
-    };
-}
-/**
- * 256 unguessable bits, hex encoded. Session ids, CSRF tokens and password
- * reset tokens are all this.
- */
-function randomToken() {
-    return randomBytes(SESSION_ID_BYTES).toString('hex');
-}
-/**
- * A reset token as the database keeps it: its SHA-256, hex encoded.
- *
- * Plain SHA-256 rather than argon2 on purpose. What argon2 buys is time
- * against somebody guessing a password people chose, and there is nothing to
- * guess here: the token is 256 bits out of `randomBytes`, so the only way to
- * hold a valid one is to have been sent it. What the hash is for is that a
- * copy of `geekity.db` — a backup, a stray file — is not a stack of working
- * reset links.
- */
-function hashToken(token) {
-    return createHash('sha256').update(token, 'utf8').digest('hex');
-}
-/** Whether the database has a table by that name. */
-function hasTable(db, name) {
-    return (db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?").all(name)
-        .length > 0);
-}
-/** The table this store's applied versions are recorded in. */
-const LEDGER = 'admin_migrations';
-/**
- * Schema versions for the admin tables, applied in order. They keep their own
- * ledger so their numbering never collides with the content index's.
- *
- * Never edit a migration that has shipped; append a new one.
- */
-const MIGRATIONS = [
-    {
-        // Users and sessions, when SQLite still held both. decision-9 moved the
-        // accounts into `data/users.json`, so nothing reads the users table any
-        // more: `migrateUsersToFile` writes its rows out on the first boot of that
-        // version and drops it. The migration stays exactly as it shipped, because
-        // a shipped migration is never edited — which does mean a brand new
-        // database creates the table here and drops it a moment later. Migration
-        // 11 is where sessions lose the foreign key into it.
-        version: 1,
-        sql: `
-      CREATE TABLE users (
-        id            INTEGER PRIMARY KEY AUTOINCREMENT,
-        username      TEXT NOT NULL,
-        password_hash TEXT NOT NULL,
-        created_at    TEXT NOT NULL
-      );
-
-      CREATE UNIQUE INDEX users_username ON users (username);
-
-      CREATE TABLE sessions (
-        id         TEXT PRIMARY KEY,
-        user_id    INTEGER REFERENCES users (id) ON DELETE CASCADE,
-        csrf_token TEXT NOT NULL,
-        created_at TEXT NOT NULL,
-        expires_at TEXT NOT NULL
-      );
-
-      CREATE INDEX sessions_expires_at ON sessions (expires_at);
-      CREATE INDEX sessions_user_id ON sessions (user_id);
-    `,
-    },
-    {
-        // Flash messages: a JSON array of {kind, message}, queued by the request
-        // that redirects and cleared by the one that renders them. They hang off
-        // the session rather than a cookie so they cannot be forged or replayed,
-        // and so they go when the session does.
-        version: 2,
-        sql: `ALTER TABLE sessions ADD COLUMN flash TEXT`,
-    },
-    {
-        // Site settings, when SQLite was still the source of them. decision-9
-        // moved them into content/_data/site.json, so nothing reads this table
-        // any more: `migrateSettingsToFile` writes its rows out on the first boot
-        // of that version and drops it. The migration stays exactly as it shipped,
-        // because a shipped migration is never edited — which does mean a brand
-        // new database creates the table here and drops it a moment later.
-        version: 3,
-        sql: `
-      CREATE TABLE settings (
-        key        TEXT PRIMARY KEY,
-        value      TEXT NOT NULL,
-        updated_at TEXT NOT NULL
-      );
-    `,
-    },
-    {
-        // The site actor's signing keys, when SQLite still held them. decision-9
-        // moved them into JWK files under `data/keys`, so nothing reads this table
-        // any more: `migrateActorKeysToFiles` writes its rows out on the first boot
-        // of that version and drops it. The migration stays exactly as it shipped,
-        // because a shipped migration is never edited — which does mean a brand new
-        // database creates the table here and drops it a moment later.
-        version: 4,
-        sql: `
-      CREATE TABLE actor_keys (
-        identifier  TEXT NOT NULL,
-        algorithm   TEXT NOT NULL,
-        private_jwk TEXT NOT NULL,
-        public_jwk  TEXT NOT NULL,
-        created_at  TEXT NOT NULL,
-        PRIMARY KEY (identifier, algorithm)
-      );
-    `,
-    },
-    {
-        // The site's followers (doc-4). Fedify's KV store is a cache and may be
-        // thrown away; a follower may not, because an actor that followed and was
-        // forgotten simply stops hearing from the site. Keyed by actor id, which
-        // is what a `Follow`, an `Undo(Follow)` and an actor's own `Delete` all
-        // name, so all three find the same row.
-        version: 5,
-        sql: `
-      CREATE TABLE followers (
-        actor_id        TEXT PRIMARY KEY,
-        inbox_id        TEXT NOT NULL,
-        shared_inbox_id TEXT,
-        handle          TEXT,
-        name            TEXT,
-        icon_url        TEXT,
-        url             TEXT,
-        followed_at     TEXT NOT NULL
-      );
-
-      CREATE INDEX followers_followed_at ON followers (followed_at);
-    `,
-    },
-    {
-        // Inbound activities that are recorded rather than acted on: likes,
-        // boosts and replies, which a later phase surfaces. The raw JSON-LD is
-        // kept because what that phase wants out of an activity is not knowable
-        // yet. The unique index on the activity id is what makes a redelivery an
-        // update rather than a second like; SQLite counts NULLs as distinct, so
-        // an activity that arrived without an id is always its own row.
-        version: 6,
-        sql: `
-      CREATE TABLE ap_inbox (
-        id            INTEGER PRIMARY KEY AUTOINCREMENT,
-        activity_id   TEXT,
-        activity_type TEXT NOT NULL,
-        actor_id      TEXT NOT NULL,
-        object_id     TEXT,
-        received_at   TEXT NOT NULL,
-        json          TEXT NOT NULL
-      );
-
-      CREATE UNIQUE INDEX ap_inbox_activity_id ON ap_inbox (activity_id);
-      CREATE INDEX ap_inbox_received_at ON ap_inbox (received_at);
-      CREATE INDEX ap_inbox_actor_id ON ap_inbox (actor_id);
-    `,
-    },
-    {
-        // Outbound delivery (doc-4, decision-5). Two tables, because an activity
-        // is one thing and its fate at each follower is another: keeping the
-        // JSON-LD once rather than once per follower is what makes a redelivery to
-        // a thousand followers a single read, and one row per (activity, follower)
-        // is what lets the admin see which follower did not get it.
-        //
-        // The activity's own id is the key. It is derived from the post's object
-        // id — `#create`, `#update/{hash}`, `#delete/{time}` — so re-sending the
-        // same announcement updates the row it belongs to instead of writing a
-        // second one that says the same thing.
-        version: 7,
-        sql: `
-      CREATE TABLE ap_outbound (
-        activity_id   TEXT PRIMARY KEY,
-        activity_type TEXT NOT NULL,
-        object_id     TEXT NOT NULL,
-        slug          TEXT,
-        created_at    TEXT NOT NULL,
-        json          TEXT NOT NULL
-      );
-
-      CREATE INDEX ap_outbound_created_at ON ap_outbound (created_at);
-      CREATE INDEX ap_outbound_object_id ON ap_outbound (object_id);
-
-      CREATE TABLE ap_deliveries (
-        activity_id  TEXT NOT NULL REFERENCES ap_outbound (activity_id) ON DELETE CASCADE,
-        actor_id     TEXT NOT NULL,
-        inbox_id     TEXT NOT NULL,
-        status       TEXT NOT NULL,
-        error        TEXT,
-        attempted_at TEXT NOT NULL,
-        PRIMARY KEY (activity_id, actor_id)
-      );
-
-      CREATE INDEX ap_deliveries_attempted_at ON ap_deliveries (attempted_at);
-      CREATE INDEX ap_deliveries_status ON ap_deliveries (status);
-    `,
-    },
-    {
-        // What a logged reply answers, so a post's comments can be counted and
-        // listed without reading every activity the site was ever sent.
-        //
-        // It is an index of the JSON beside it rather than a fact of its own: the
-        // backfill runs the very function the writer runs, so a database rebuilt
-        // from the inbox log (TASK-32) holds what this one holds.
-        version: 8,
-        sql: `
-      ALTER TABLE ap_inbox ADD COLUMN in_reply_to TEXT;
-      CREATE INDEX ap_inbox_in_reply_to ON ap_inbox (in_reply_to);
-    `,
-        run(db) {
-            const rows = db.prepare('SELECT id, json FROM ap_inbox').all();
-            const update = db.prepare('UPDATE ap_inbox SET in_reply_to = ? WHERE id = ?');
-            for (const row of rows) {
-                update.run(replyTargetOf(String(row['json'])), Number(row['id']));
-            }
-        },
-    },
-    {
-        // Relay subscriptions (FEP-ae0c, TASK-40). The list of relays is a
-        // setting mirrored to site.json; this is where each handshake stands,
-        // which is operational state and derivable again from the file — a relay
-        // in the list with no row here is simply followed again on the next boot.
-        //
-        // Keyed by the inbox rather than by the relay's actor id, because the
-        // inbox is the only thing known when the `Follow` goes out: the actor id
-        // arrives with the `Accept`, days later if a human has to approve it.
-        version: 9,
-        sql: `
-      CREATE TABLE ap_relays (
-        inbox_id   TEXT PRIMARY KEY,
-        actor_id   TEXT,
-        state      TEXT NOT NULL,
-        reason     TEXT,
-        follow_id  TEXT,
-        created_at TEXT NOT NULL,
-        updated_at TEXT NOT NULL
-      );
-
-      CREATE INDEX ap_relays_follow_id ON ap_relays (follow_id);
-      CREATE INDEX ap_relays_actor_id ON ap_relays (actor_id);
-    `,
-    },
-    {
-        // The CMS's own operational state, as opposed to the site's settings. It
-        // is a table of its own rather than more rows in `settings` because the
-        // number of settings is what decides whether a site is seeded from
-        // content/_data/site.json, and because nothing here belongs in that file.
-        version: 10,
-        sql: `
-      CREATE TABLE cms_state (
-        key        TEXT PRIMARY KEY,
-        value      TEXT NOT NULL,
-        updated_at TEXT NOT NULL
-      );
-    `,
-    },
-    {
-        // Sessions without the foreign key into `users`, because there is no users
-        // table any more: decision-9 moved the accounts into `data/users.json` and
-        // `migrateUsersToFile` drops the table on the boot after this migration
-        // runs. The constraint could not survive that either way — with
-        // `foreign_keys` on, dropping the parent cascades every login away, and an
-        // insert afterwards fails with "no such table: main.users" — and SQLite
-        // cannot drop a constraint in place, so the table is rebuilt. Every row is
-        // copied across, so a site upgrading keeps the logins it had. What the key
-        // was doing is done in the admin guard instead: a session naming a user
-        // the file no longer holds is not a session.
-        version: 11,
-        sql: `
-      CREATE TABLE sessions_without_users (
-        id         TEXT PRIMARY KEY,
-        user_id    INTEGER,
-        csrf_token TEXT NOT NULL,
-        created_at TEXT NOT NULL,
-        expires_at TEXT NOT NULL,
-        flash      TEXT
-      );
-
-      INSERT INTO sessions_without_users (
-        id, user_id, csrf_token, created_at, expires_at, flash
-      )
-      SELECT id, user_id, csrf_token, created_at, expires_at, flash FROM sessions;
-
-      DROP TABLE sessions;
-      ALTER TABLE sessions_without_users RENAME TO sessions;
-
-      CREATE INDEX sessions_expires_at ON sessions (expires_at);
-      CREATE INDEX sessions_user_id ON sessions (user_id);
-    `,
-    },
-    {
-        // The outcomes without the payloads. decision-9 replaces "send this stored
-        // activity again" with "send this post as it now reads", so nothing needs
-        // the JSON-LD any more and `ap_outbound` goes: an activity rebuilt from
-        // the file is the current answer, and a copy of what went out last time
-        // could only ever be a staler one.
-        //
-        // What that table held about an activity that an outcome cannot do
-        // without — its type, the object it was about and the slug — moves onto
-        // the outcome row, which is now the whole of what SQLite remembers about
-        // anything the site has sent. The foreign key has to go with the parent,
-        // and SQLite cannot drop a constraint in place, so `ap_deliveries` is
-        // rebuilt the way migration 11 rebuilt `sessions`. Every row that has an
-        // activity to name is carried across as a courtesy: this table is a cache
-        // and is allowed to be empty, so a row whose activity is somehow missing
-        // is dropped rather than invented a type for.
-        version: 12,
-        sql: `
-      CREATE TABLE ap_deliveries_standalone (
-        activity_id   TEXT NOT NULL,
-        activity_type TEXT NOT NULL,
-        object_id     TEXT NOT NULL,
-        slug          TEXT,
-        actor_id      TEXT NOT NULL,
-        inbox_id      TEXT NOT NULL,
-        status        TEXT NOT NULL,
-        error         TEXT,
-        attempted_at  TEXT NOT NULL,
-        PRIMARY KEY (activity_id, actor_id)
-      );
-
-      INSERT INTO ap_deliveries_standalone (
-        activity_id, activity_type, object_id, slug,
-        actor_id, inbox_id, status, error, attempted_at
-      )
-      SELECT
-        ap_deliveries.activity_id,
-        ap_outbound.activity_type,
-        ap_outbound.object_id,
-        ap_outbound.slug,
-        ap_deliveries.actor_id,
-        ap_deliveries.inbox_id,
-        ap_deliveries.status,
-        ap_deliveries.error,
-        ap_deliveries.attempted_at
-      FROM ap_deliveries
-      JOIN ap_outbound ON ap_outbound.activity_id = ap_deliveries.activity_id;
-
-      DROP TABLE ap_deliveries;
-      ALTER TABLE ap_deliveries_standalone RENAME TO ap_deliveries;
-
-      CREATE INDEX ap_deliveries_attempted_at ON ap_deliveries (attempted_at);
-      CREATE INDEX ap_deliveries_status ON ap_deliveries (status);
-      CREATE INDEX ap_deliveries_object_id ON ap_deliveries (object_id, attempted_at);
-
-      DROP TABLE ap_outbound;
-    `,
-    },
-    {
-        // What a post's conversation is read by (TASK-49). `in_reply_to` already
-        // had an index because a post's replies are counted on every feed; the
-        // object an activity is about had none, and that is the column a like, a
-        // boost, a `Delete` of a reply and an `Undo` of a like are all found by.
-        version: 13,
-        sql: `
-      CREATE INDEX ap_inbox_object_id ON ap_inbox (object_id);
-    `,
-    },
-    {
-        // Native comments (TASK-50), which are files under
-        // `content/_data/comments/` and nothing else: this table is an index of
-        // them, emptied and read back on every boot exactly as `followers` and
-        // `ap_inbox` are. Nothing here is a fact the files do not carry.
-        //
-        // The id is the comment's own name rather than a row number, because it is
-        // what a reply names, what a moderation form posts and what the page
-        // anchors on — all three have to survive a rebuilt index. The author's
-        // name and email are indexed together because that pair is the whole of
-        // WordPress's auto-approval rule.
-        version: 14,
-        sql: `
-      CREATE TABLE comments (
-        id           TEXT PRIMARY KEY,
-        slug         TEXT NOT NULL,
-        permalink    TEXT NOT NULL,
-        source       TEXT NOT NULL,
-        kind         TEXT NOT NULL,
-        status       TEXT NOT NULL,
-        author_name  TEXT NOT NULL,
-        author_url   TEXT,
-        author_email TEXT,
-        markdown     TEXT NOT NULL,
-        html         TEXT NOT NULL,
-        submitted_at TEXT NOT NULL,
-        address_hash TEXT,
-        in_reply_to  TEXT
-      );
-
-      CREATE INDEX comments_slug ON comments (slug, submitted_at);
-      CREATE INDEX comments_status ON comments (status, submitted_at);
-      CREATE INDEX comments_author ON comments (author_name, author_email, status);
-    `,
-    },
-    {
-        // Webmentions (TASK-51), which are two different things and so two changes.
-        //
-        // A comment may now say where it lives, because a webmention lives on
-        // somebody else's page: it is what a later webmention from that page is
-        // recognised by, and what the thread's permalink points at for an entry
-        // this site did not host. Its author may now have a face, out of the source
-        // page's `h-card`. Both columns are an index of the comment files like
-        // every other column of this table, so nothing backfills them — the rebuild
-        // on the next boot does.
-        //
-        // What the site has sent is the other half, and it is a cache of outcomes
-        // exactly as `ap_deliveries` is: no payload, one row per (post, target),
-        // and a resend moves the row rather than adding to it. It is a table of
-        // its own rather than a use of `ap_deliveries` because the federation
-        // screen counts that table per activity, and a webmention is not one.
-        version: 15,
-        sql: `
-      ALTER TABLE comments ADD COLUMN url TEXT;
-      ALTER TABLE comments ADD COLUMN author_avatar TEXT;
-
-      CREATE TABLE webmentions_sent (
-        slug         TEXT NOT NULL,
-        source       TEXT NOT NULL,
-        target       TEXT NOT NULL,
-        endpoint     TEXT,
-        status       TEXT NOT NULL,
-        error        TEXT,
-        attempted_at TEXT NOT NULL,
-        PRIMARY KEY (slug, target)
-      );
-
-      CREATE INDEX webmentions_sent_attempted_at ON webmentions_sent (attempted_at);
-    `,
-    },
-    {
-        // Password reset tokens (TASK-54). They sit beside the sessions, and for
-        // the same reason: a reset link is a second, shorter-lived way of proving
-        // you are somebody, and it is a cache — losing one costs the person
-        // nothing but a second click on Forgot password. So `data/users.json`
-        // stays the whole of what a site must back up, and a restart, a rebuild or
-        // a `geekity rebuild` invalidates every link in flight, which is the safe
-        // direction to fail in.
-        //
-        // The key is the token's SHA-256 rather than the token, so the database
-        // holds nothing a working link could be rebuilt from: somebody who reads
-        // this table — a backup, a stray copy of the file — learns that a reset
-        // was asked for and nothing else. It is a plain hash rather than argon2
-        // because the token is 256 random bits and there is no guess to slow down;
-        // what argon2 buys on a password it cannot buy here.
-        version: 16,
-        sql: `
-      CREATE TABLE password_resets (
-        token_hash TEXT PRIMARY KEY,
-        user_id    INTEGER NOT NULL,
-        created_at TEXT NOT NULL,
-        expires_at TEXT NOT NULL
-      );
-
-      CREATE INDEX password_resets_expires_at ON password_resets (expires_at);
-      CREATE INDEX password_resets_user_id ON password_resets (user_id);
-    `,
-    },
-    {
-        // The two halves of a notification's one-click links (TASK-55).
-        //
-        // `spent_tokens` is what makes such a link single use. The link itself is
-        // not stored — it is an HMAC-signed claim, so that a moderation link in an
-        // inbox goes on working across a rebuilt or restored cache, which is a
-        // thing decision-9 says a site may do whenever it likes. Only the fact
-        // that one has been used is written down, keyed by its SHA-256 for the
-        // reason `password_resets` is, and swept once the signature has expired.
-        // Losing this table forgets which links were spent, and that costs a site
-        // nothing: every action a link performs is idempotent, so doing it a
-        // second time is doing it once.
-        //
-        // `comments.notify` is the commenter's "tell me about replies", which the
-        // file says and this column indexes like every other column of that table.
-        // Nothing backfills it: the rebuild on the next boot does, and a comment
-        // written before this shipped never asked to be told.
-        version: 17,
-        sql: `
-      CREATE TABLE spent_tokens (
-        token_hash TEXT PRIMARY KEY,
-        spent_at   TEXT NOT NULL,
-        expires_at TEXT NOT NULL
-      );
-
-      CREATE INDEX spent_tokens_expires_at ON spent_tokens (expires_at);
-
-      ALTER TABLE comments ADD COLUMN notify INTEGER NOT NULL DEFAULT 0;
-    `,
-    },
-    {
-        // Followers belong to a user, and the inbox log says who was told
-        // (decision-14, TASK-68). The site actor is gone, so there is nothing to
-        // backfill: the `followers` table is rebuilt on every boot from the files
-        // under `content/_data/federation/{username}/`, and the rows a site
-        // carried for the site actor name nobody. The table is therefore dropped
-        // and made again with the new key rather than altered — `actor_id` was its
-        // primary key, and one actor may follow two of this site's users.
-        version: 18,
-        sql: `
-      DROP TABLE followers;
-
-      CREATE TABLE followers (
-        username        TEXT NOT NULL,
-        actor_id        TEXT NOT NULL,
-        inbox_id        TEXT NOT NULL,
-        shared_inbox_id TEXT,
-        handle          TEXT,
-        name            TEXT,
-        icon_url        TEXT,
-        url             TEXT,
-        followed_at     TEXT NOT NULL,
-        PRIMARY KEY (username, actor_id)
-      );
-
-      CREATE INDEX followers_followed_at ON followers (followed_at);
-      CREATE INDEX followers_actor_id ON followers (actor_id);
-
-      ALTER TABLE ap_inbox ADD COLUMN recipient TEXT;
-
-      CREATE INDEX ap_inbox_recipient ON ap_inbox (recipient);
-    `,
-    },
-    {
-        // The avatar proxy asks, per request for a picture, whether its URL is one
-        // the site has recorded (TASK-134). Both columns are indexed so that
-        // question is a lookup rather than a scan of every follower and comment.
-        version: 19,
-        sql: `
-      CREATE INDEX followers_icon_url ON followers (icon_url);
-      CREATE INDEX comments_author_avatar ON comments (author_avatar);
-    `,
-    },
-    {
-        // What a comment has had removed for privacy (TASK-135), as the JSON list
-        // its file carries. Nothing backfills it: the rebuild on the next boot
-        // does, and a comment nothing was removed from leaves it `NULL`.
-        version: 20,
-        sql: `ALTER TABLE comments ADD COLUMN redacted TEXT;`,
-    },
-    {
-        // The profiles of actors who are not followers (TASK-184): whoever liked,
-        // boosted, answered or quoted a post, as their actor document named them.
-        // A cache and nothing else (decision-9). Nothing backfills it here: the
-        // profile sweep fetches every actor the inbox log names that has none.
-        version: 21,
-        sql: `
-      CREATE TABLE actor_profiles (
-        actor_id   TEXT PRIMARY KEY,
-        handle     TEXT,
-        name       TEXT,
-        icon_url   TEXT,
-        url        TEXT,
-        fetched_at TEXT NOT NULL
-      );
-
-      CREATE INDEX actor_profiles_icon_url ON actor_profiles (icon_url);
-    `,
-    },
-    {
-        version: 22,
-        sql: `ALTER TABLE comments ADD COLUMN rsvp TEXT;`,
-    },
-    {
-        // What a \`/replies/\` key names (TASK-327), so resolving one is a lookup
-        // rather than a walk of every comment and logged reply. A note's key is
-        // its id's and is backfilled here; a native comment's hangs off the base
-        // URL, which a migration does not know, so those rows are filled when the
-        // store is opened with one, as they are whenever that base changes.
-        version: 23,
-        sql: `
-      ALTER TABLE comments ADD COLUMN replies_key TEXT;
-      ALTER TABLE comments ADD COLUMN keys_base TEXT;
-      CREATE INDEX comments_replies_key ON comments (replies_key);
-      ALTER TABLE ap_inbox ADD COLUMN reply_key TEXT;
-      CREATE INDEX ap_inbox_reply_key ON ap_inbox (reply_key);
-    `,
-        run(db) {
-            const rows = db.prepare('SELECT id, activity_type, object_id, json FROM ap_inbox').all();
-            const update = db.prepare('UPDATE ap_inbox SET reply_key = ? WHERE id = ?');
-            for (const row of rows) {
-                const key = replyKeyOf({
-                    activityType: String(row['activity_type']),
-                    objectId: nullableText(row['object_id']),
-                    json: String(row['json']),
-                });
-                update.run(key, Number(row['id']));
-            }
-        },
-    },
-    {
-        version: 24,
-        sql: `ALTER TABLE comments ADD COLUMN via TEXT;`,
-    },
-    {
-        version: 25,
-        sql: `ALTER TABLE ap_inbox ADD COLUMN fetched INTEGER NOT NULL DEFAULT 0;`,
-    },
-];
-/** What {@link AdminStore.onConversationWrite} hears about one logged activity. */
-function activityWrite(activity) {
-    return {
-        kind: 'activity',
-        about: [activity.objectId, activity.inReplyTo].filter((id) => id !== null),
-    };
-}
-/** The `/replies/` key of a logged reply's note, or `null` for anything else. */
-function replyKeyOf(activity) {
-    const id = replyIdOf(activity);
-    return id === null ? null : repliesKey(id);
-}
-/** A comment's `/replies/` key and the base it was worked out against, as columns. */
-function commentKey(comment, baseUrl) {
-    return baseUrl === undefined ? [null, null] : [repliesKey(replyGuid(comment, baseUrl)), baseUrl];
-}
-//# sourceMappingURL=store.js.map