@geekity/cms 0.3.0 → 0.5.0

package/dist/admin/store.js

@@ -1,32 +1,27 @@
-import { randomBytes } from 'node:crypto';
-import { mkdirSync } from 'node:fs';
-import path from 'node:path';
+import { createHash, randomBytes } from 'node:crypto';
 import { DatabaseSync } from 'node:sqlite';
-import { DATABASE_FILE } from '../content/store.js';
-import { hashPassword, verifyPasswordHash } from './passwords.js';
-/** How long a session id is, in bytes. 32 is the 256 bits doc-5 asks for. */
-export const SESSION_ID_BYTES = 32;
+import { databaseFile, openDatabase } from '../cache.js';
+import { REPLY_ACTIVITY_TYPE, replyTargetOf } from '../federation/replies.js';
 /**
- * The two signature algorithms doc-4 asks a site actor to hold.
- *
- * `RSASSA-PKCS1-v1_5` signs HTTP Signatures, which is what Mastodon and most
- * of the fediverse verify; `Ed25519` signs FEP-8b32 object integrity proofs.
- * They are Fedify's own spellings, so a row round-trips into
- * `generateCryptoKeyPair` without translation.
+ * Which rows of the inbox log are replies: a `Create` that named something it
+ * answers. Spelled once, because a count and a listing that disagreed about it
+ * would show a post a number no page of comments could produce.
  */
-export const ACTOR_KEY_ALGORITHMS = ['RSASSA-PKCS1-v1_5', 'Ed25519'];
+const IS_REPLY = `activity_type = '${REPLY_ACTIVITY_TYPE}' AND in_reply_to IS NOT NULL`;
+/** How long a session id is, in bytes. 32 is the 256 bits doc-5 asks for. */
+export const SESSION_ID_BYTES = 32;
 /** How one delivery of one activity to one follower ended. */
 export const DELIVERY_STATUSES = ['sent', 'queued', 'failed'];
-/** Thrown when a username is already taken. Usernames are the login key. */
-export class DuplicateUsernameError extends Error {
-    name = 'DuplicateUsernameError';
-    /** The name that was already in use. */
-    username;
-    constructor(username) {
-        super(`A user named "${username}" already exists.`);
-        this.username = username;
-    }
-}
+/** Where a relay subscription stands (FEP-ae0c). */
+export const RELAY_STATES = ['pending', 'accepted', 'rejected'];
+/** How one webmention this site sent to one page ended. */
+export const WEBMENTION_SEND_STATUSES = ['sent', 'none', 'failed'];
+/** Where a comment came from. */
+export const COMMENT_SOURCES = ['comment', 'webmention'];
+/** What a comment is: something written, or a wordless pointer at the post. */
+export const COMMENT_KINDS = ['reply', 'like', 'boost', 'mention', 'repost'];
+/** Where a comment stands with the moderator. */
+export const COMMENT_STATUSES = ['pending', 'approved', 'spam'];
 /**
  * Open (and if needed create) the admin tables in `dataDir`, applying every
  * migration the package ships. Applying them is idempotent.
@@ -35,20 +30,9 @@ export class DuplicateUsernameError extends Error {
  * index holding a second one on the same file.
  */
 export function openAdminStore(options) {
-    const file = path.join(options.dataDir, DATABASE_FILE);
-    mkdirSync(options.dataDir, { recursive: true });
-    const db = new DatabaseSync(file);
-    db.exec('PRAGMA journal_mode = WAL');
-    db.exec('PRAGMA foreign_keys = ON');
-    migrate(db);
+    const file = databaseFile(options.dataDir);
+    const db = openDatabase({ dataDir: options.dataDir, ledger: LEDGER, migrations: MIGRATIONS });
     const statements = {
-        countUsers: db.prepare('SELECT COUNT(*) AS count FROM users'),
-        listUsers: db.prepare('SELECT id, username, created_at FROM users ORDER BY username'),
-        userByName: db.prepare('SELECT * FROM users WHERE username = ?'),
-        userById: db.prepare('SELECT id, username, created_at FROM users WHERE id = ?'),
-        insertUser: db.prepare('INSERT INTO users (username, password_hash, created_at) VALUES (?, ?, ?)'),
-        setPassword: db.prepare('UPDATE users SET password_hash = ? WHERE id = ?'),
-        deleteUser: db.prepare('DELETE FROM users WHERE id = ?'),
         deleteSessionsForUser: db.prepare('DELETE FROM sessions WHERE user_id = ? AND id IS NOT ?'),
         insertSession: db.prepare(`
       INSERT INTO sessions (id, user_id, csrf_token, created_at, expires_at)
@@ -59,33 +43,38 @@ export function openAdminStore(options) {
         pruneSessions: db.prepare('DELETE FROM sessions WHERE expires_at <= ?'),
         readFlash: db.prepare('SELECT flash FROM sessions WHERE id = ?'),
         writeFlash: db.prepare('UPDATE sessions SET flash = ? WHERE id = ?'),
-        countSettings: db.prepare('SELECT COUNT(*) AS count FROM settings'),
-        allSettings: db.prepare('SELECT key, value FROM settings'),
-        putSetting: db.prepare(`
-      INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)
-      ON CONFLICT (key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at
+        insertPasswordReset: db.prepare(`
+      INSERT INTO password_resets (token_hash, user_id, created_at, expires_at)
+      VALUES (?, ?, ?, ?)
     `),
-        actorKeys: db.prepare('SELECT * FROM actor_keys WHERE identifier = ?'),
-        putActorKey: db.prepare(`
-      INSERT INTO actor_keys (identifier, algorithm, private_jwk, public_jwk, created_at)
-      VALUES (?, ?, ?, ?, ?)
-      ON CONFLICT (identifier, algorithm) DO UPDATE SET
-        private_jwk = excluded.private_jwk,
-        public_jwk = excluded.public_jwk,
-        created_at = excluded.created_at
+        passwordResetByHash: db.prepare('SELECT * FROM password_resets WHERE token_hash = ?'),
+        deletePasswordReset: db.prepare('DELETE FROM password_resets WHERE token_hash = ?'),
+        deletePasswordResetsForUser: db.prepare('DELETE FROM password_resets WHERE user_id = ?'),
+        prunePasswordResets: db.prepare('DELETE FROM password_resets WHERE expires_at <= ?'),
+        spendToken: db.prepare(`
+      INSERT OR IGNORE INTO spent_tokens (token_hash, spent_at, expires_at) VALUES (?, ?, ?)
+    `),
+        pruneSpentTokens: db.prepare('DELETE FROM spent_tokens WHERE expires_at <= ?'),
+        getState: db.prepare('SELECT value FROM cms_state WHERE key = ?'),
+        putState: db.prepare(`
+      INSERT INTO cms_state (key, value, updated_at) VALUES (?, ?, ?)
+      ON CONFLICT (key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at
     `),
-        countFollowers: db.prepare('SELECT COUNT(*) AS count FROM followers'),
+        // `?1 IS NULL` is how one statement answers both questions: naming a user
+        // counts theirs, naming nobody counts the site's.
+        countFollowers: db.prepare('SELECT COUNT(*) AS count FROM followers WHERE ?1 IS NULL OR username = ?1'),
         listFollowers: db.prepare(`
       SELECT * FROM followers
+      WHERE ?1 IS NULL OR username = ?1
       ORDER BY followed_at DESC, actor_id DESC
-      LIMIT ? OFFSET ?
+      LIMIT ?2 OFFSET ?3
     `),
-        followerById: db.prepare('SELECT * FROM followers WHERE actor_id = ?'),
+        followerById: db.prepare('SELECT * FROM followers WHERE username = ? AND actor_id = ?'),
         putFollower: db.prepare(`
       INSERT INTO followers (
-        actor_id, inbox_id, shared_inbox_id, handle, name, icon_url, url, followed_at
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (actor_id) DO UPDATE SET
+        username, actor_id, inbox_id, shared_inbox_id, handle, name, icon_url, url, followed_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (username, actor_id) DO UPDATE SET
         inbox_id = excluded.inbox_id,
         shared_inbox_id = excluded.shared_inbox_id,
         handle = excluded.handle,
@@ -93,7 +82,10 @@ export function openAdminStore(options) {
         icon_url = excluded.icon_url,
         url = excluded.url
     `),
-        deleteFollower: db.prepare('DELETE FROM followers WHERE actor_id = ?'),
+        deleteFollower: db.prepare('DELETE FROM followers WHERE username = ? AND actor_id = ?'),
+        clearFollowers: db.prepare('DELETE FROM followers'),
+        clearInboxActivities: db.prepare('DELETE FROM ap_inbox'),
+        resetInboxSequence: db.prepare("DELETE FROM sqlite_sequence WHERE name = 'ap_inbox'"),
         countInboxActivities: db.prepare('SELECT COUNT(*) AS count FROM ap_inbox'),
         listInboxActivities: db.prepare(`
       SELECT * FROM ap_inbox
@@ -101,37 +93,80 @@ export function openAdminStore(options) {
       LIMIT ? OFFSET ?
     `),
         logInboxActivity: db.prepare(`
-      INSERT INTO ap_inbox (activity_id, activity_type, actor_id, object_id, received_at, json)
-      VALUES (?, ?, ?, ?, ?, ?)
+      INSERT INTO ap_inbox (
+        activity_id, activity_type, actor_id, object_id, in_reply_to, recipient, received_at, json
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
       ON CONFLICT (activity_id) DO UPDATE SET
         activity_type = excluded.activity_type,
         actor_id = excluded.actor_id,
         object_id = excluded.object_id,
+        in_reply_to = excluded.in_reply_to,
+        recipient = excluded.recipient,
         received_at = excluded.received_at,
         json = excluded.json
       RETURNING *
     `),
-        countOutboundActivities: db.prepare('SELECT COUNT(*) AS count FROM ap_outbound'),
-        listOutboundActivities: db.prepare(`
-      SELECT * FROM ap_outbound
-      ORDER BY created_at DESC, rowid DESC
+        countReplies: db.prepare(`SELECT COUNT(*) AS count FROM ap_inbox WHERE ${IS_REPLY}`),
+        listReplies: db.prepare(`
+      SELECT * FROM ap_inbox WHERE ${IS_REPLY}
+      ORDER BY received_at DESC, id DESC
       LIMIT ? OFFSET ?
     `),
-        outboundActivityById: db.prepare('SELECT * FROM ap_outbound WHERE activity_id = ?'),
-        putOutboundActivity: db.prepare(`
-      INSERT INTO ap_outbound (activity_id, activity_type, object_id, slug, created_at, json)
-      VALUES (?, ?, ?, ?, ?, ?)
-      ON CONFLICT (activity_id) DO UPDATE SET
-        activity_type = excluded.activity_type,
-        object_id = excluded.object_id,
+        countRepliesTo: db.prepare(`
+      SELECT COUNT(*) AS count FROM ap_inbox WHERE ${IS_REPLY} AND in_reply_to = ?
+    `),
+        listRepliesTo: db.prepare(`
+      SELECT * FROM ap_inbox WHERE ${IS_REPLY} AND in_reply_to = ?
+      ORDER BY received_at DESC, id DESC
+      LIMIT ? OFFSET ?
+    `),
+        listCommentsFor: db.prepare(`
+      SELECT * FROM comments WHERE slug = ? ORDER BY submitted_at, id
+    `),
+        commentById: db.prepare('SELECT * FROM comments WHERE id = ?'),
+        countCommentsFor: db.prepare('SELECT COUNT(*) AS count FROM comments WHERE slug = ? AND status = ?'),
+        countCommentsByStatus: db.prepare('SELECT status, COUNT(*) AS count FROM comments GROUP BY status'),
+        hasApprovedAuthor: db.prepare(`
+      SELECT 1 FROM comments
+      WHERE status = 'approved' AND author_name = ? AND author_email IS ?
+      LIMIT 1
+    `),
+        putComment: db.prepare(`
+      INSERT INTO comments (
+        id, slug, permalink, source, kind, status,
+        author_name, author_url, author_email,
+        markdown, html, submitted_at, address_hash, in_reply_to, url, author_avatar, notify
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (id) DO UPDATE SET
         slug = excluded.slug,
-        json = excluded.json
-      RETURNING *
+        permalink = excluded.permalink,
+        source = excluded.source,
+        kind = excluded.kind,
+        status = excluded.status,
+        author_name = excluded.author_name,
+        author_url = excluded.author_url,
+        author_email = excluded.author_email,
+        markdown = excluded.markdown,
+        html = excluded.html,
+        submitted_at = excluded.submitted_at,
+        address_hash = excluded.address_hash,
+        in_reply_to = excluded.in_reply_to,
+        url = excluded.url,
+        author_avatar = excluded.author_avatar,
+        notify = excluded.notify
     `),
+        deleteComment: db.prepare('DELETE FROM comments WHERE id = ?'),
+        clearComments: db.prepare('DELETE FROM comments'),
         recordDelivery: db.prepare(`
-      INSERT INTO ap_deliveries (activity_id, actor_id, inbox_id, status, error, attempted_at)
-      VALUES (?, ?, ?, ?, ?, ?)
+      INSERT INTO ap_deliveries (
+        activity_id, activity_type, object_id, slug,
+        actor_id, inbox_id, status, error, attempted_at
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
       ON CONFLICT (activity_id, actor_id) DO UPDATE SET
+        activity_type = excluded.activity_type,
+        object_id = excluded.object_id,
+        slug = excluded.slug,
         inbox_id = excluded.inbox_id,
         status = excluded.status,
         error = excluded.error,
@@ -144,8 +179,68 @@ export function openAdminStore(options) {
         countDeliveriesByStatus: db.prepare(`
       SELECT status, COUNT(*) AS count FROM ap_deliveries WHERE activity_id = ? GROUP BY status
     `),
+        lastDeliveryToInbox: db.prepare(`
+      SELECT * FROM ap_deliveries WHERE inbox_id = ?
+      ORDER BY attempted_at DESC, rowid DESC
+      LIMIT 1
+    `),
+        lastDeliveryToObject: db.prepare(`
+      SELECT * FROM ap_deliveries WHERE object_id = ?
+      ORDER BY attempted_at DESC, rowid DESC
+      LIMIT 1
+    `),
+        recordSentWebmention: db.prepare(`
+      INSERT INTO webmentions_sent (
+        slug, source, target, endpoint, status, error, attempted_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (slug, target) DO UPDATE SET
+        source = excluded.source,
+        endpoint = excluded.endpoint,
+        status = excluded.status,
+        error = excluded.error,
+        attempted_at = excluded.attempted_at
+      RETURNING *
+    `),
+        listSentWebmentions: db.prepare('SELECT * FROM webmentions_sent WHERE slug = ? ORDER BY target'),
+        countSentWebmentionsByStatus: db.prepare(`
+      SELECT status, COUNT(*) AS count FROM webmentions_sent WHERE slug = ? GROUP BY status
+    `),
+        listRelays: db.prepare('SELECT * FROM ap_relays ORDER BY created_at, inbox_id'),
+        relayByInbox: db.prepare('SELECT * FROM ap_relays WHERE inbox_id = ?'),
+        relayByFollow: db.prepare('SELECT * FROM ap_relays WHERE follow_id = ?'),
+        putRelay: db.prepare(`
+      INSERT INTO ap_relays (
+        inbox_id, actor_id, state, reason, follow_id, created_at, updated_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (inbox_id) DO UPDATE SET
+        actor_id = excluded.actor_id,
+        state = excluded.state,
+        reason = excluded.reason,
+        follow_id = excluded.follow_id,
+        updated_at = excluded.updated_at
+      RETURNING *
+    `),
+        deleteRelay: db.prepare('DELETE FROM ap_relays WHERE inbox_id = ?'),
     };
     let open = true;
+    /**
+     * Run a body with every write in it committed together, or none of them.
+     *
+     * The rebuilds are what need it: emptying an index and filling it again is
+     * one step to everything reading it, and a half-emptied `followers` is a
+     * site that has quietly stopped delivering to half its followers.
+     */
+    function inTransaction(body) {
+        db.exec('BEGIN');
+        try {
+            body();
+            db.exec('COMMIT');
+        }
+        catch (error) {
+            db.exec('ROLLBACK');
+            throw error;
+        }
+    }
     /**
      * The messages queued on a session. A column that will not parse is treated
      * as empty: a flash is a convenience, and losing one is better than a 500 on
@@ -164,81 +259,8 @@ export function openAdminStore(options) {
             return [];
         }
     }
-    function storedUser(username) {
-        const row = statements.userByName.get(username);
-        if (row === undefined)
-            return undefined;
-        return {
-            id: Number(row['id']),
-            username: String(row['username']),
-            passwordHash: String(row['password_hash']),
-            createdAt: String(row['created_at']),
-        };
-    }
     return {
         file,
-        countUsers() {
-            const row = statements.countUsers.get();
-            return Number(row?.['count'] ?? 0);
-        },
-        listUsers() {
-            return statements.listUsers.all().map((row) => ({
-                id: Number(row['id']),
-                username: String(row['username']),
-                createdAt: String(row['created_at']),
-            }));
-        },
-        getUser(username) {
-            return storedUser(username);
-        },
-        getUserById(id) {
-            const row = statements.userById.get(id);
-            if (row === undefined)
-                return undefined;
-            return {
-                id: Number(row['id']),
-                username: String(row['username']),
-                createdAt: String(row['created_at']),
-            };
-        },
-        createUser(input) {
-            const createdAt = new Date().toISOString();
-            const hash = hashPassword(input.password);
-            try {
-                statements.insertUser.run(input.username, hash, createdAt);
-            }
-            catch (error) {
-                if (isUniqueViolation(error))
-                    throw new DuplicateUsernameError(input.username);
-                throw error;
-            }
-            const created = storedUser(input.username);
-            if (created === undefined) {
-                throw new Error(`The user "${input.username}" vanished between insert and read.`);
-            }
-            return { id: created.id, username: created.username, createdAt: created.createdAt };
-        },
-        verifyPassword(username, password) {
-            const user = storedUser(username);
-            if (user === undefined) {
-                // Hash anyway, so a missing user and a wrong password take the same
-                // time and the login form does not become a user enumerator.
-                verifyPasswordHash(DUMMY_HASH, password);
-                return undefined;
-            }
-            if (!verifyPasswordHash(user.passwordHash, password))
-                return undefined;
-            return { id: user.id, username: user.username, createdAt: user.createdAt };
-        },
-        setPassword(userId, password) {
-            // Hashed before the update rather than inside it, so a hash that throws
-            // leaves the stored one alone.
-            const hash = hashPassword(password);
-            return statements.setPassword.run(hash, userId).changes > 0;
-        },
-        deleteUser(userId) {
-            return statements.deleteUser.run(userId).changes > 0;
-        },
         createSession(input) {
             const now = input.now ?? new Date();
             const session = {
@@ -271,52 +293,87 @@ export function openAdminStore(options) {
             // and spares nothing instead of matching nothing.
             return Number(statements.deleteSessionsForUser.run(userId, options.except ?? null).changes);
         },
-        listActorKeys(identifier) {
-            const rows = statements.actorKeys.all(identifier);
-            const keys = rows
-                .map((row) => ({
-                identifier: String(row['identifier']),
-                algorithm: String(row['algorithm']),
-                privateJwk: String(row['private_jwk']),
-                publicJwk: String(row['public_jwk']),
+        createPasswordReset(input) {
+            const now = input.now ?? new Date();
+            const token = randomToken();
+            const reset = {
+                token,
+                userId: input.userId,
+                createdAt: now.toISOString(),
+                expiresAt: new Date(now.getTime() + input.lifetimeSeconds * 1000).toISOString(),
+            };
+            statements.insertPasswordReset.run(hashToken(token), reset.userId, reset.createdAt, reset.expiresAt);
+            return reset;
+        },
+        getPasswordReset(token, now = new Date()) {
+            const hash = hashToken(token);
+            const row = statements.passwordResetByHash.get(hash);
+            if (row === undefined)
+                return undefined;
+            const reset = {
+                userId: Number(row['user_id']),
                 createdAt: String(row['created_at']),
-            }))
-                // An algorithm this version has never heard of is a row a later
-                // version wrote; ignoring it is better than handing Fedify a key it
-                // cannot import.
-                .filter((key) => ACTOR_KEY_ALGORITHMS.includes(key.algorithm));
-            return keys.sort((a, b) => ACTOR_KEY_ALGORITHMS.indexOf(a.algorithm) - ACTOR_KEY_ALGORITHMS.indexOf(b.algorithm));
-        },
-        putActorKey(key) {
-            const stored = { ...key, createdAt: new Date().toISOString() };
-            statements.putActorKey.run(stored.identifier, stored.algorithm, stored.privateJwk, stored.publicJwk, stored.createdAt);
-            return stored;
-        },
-        countFollowers() {
-            const row = statements.countFollowers.get();
+                expiresAt: String(row['expires_at']),
+            };
+            // The same rule the sessions follow: an expired row is deleted rather
+            // than ignored, so a clock that goes backwards cannot revive a link.
+            if (reset.expiresAt <= now.toISOString()) {
+                statements.deletePasswordReset.run(hash);
+                return undefined;
+            }
+            return reset;
+        },
+        deletePasswordReset(token) {
+            return statements.deletePasswordReset.run(hashToken(token)).changes > 0;
+        },
+        deletePasswordResetsForUser(userId) {
+            return Number(statements.deletePasswordResetsForUser.run(userId).changes);
+        },
+        prunePasswordResets(now = new Date()) {
+            return Number(statements.prunePasswordResets.run(now.toISOString()).changes);
+        },
+        spendToken(token, expiresAt, now = new Date()) {
+            // `INSERT OR IGNORE` rather than a read then a write: two clicks on the
+            // same link arriving together must not both find nothing and both act.
+            const written = statements.spendToken.run(hashToken(token), now.toISOString(), expiresAt);
+            return Number(written.changes) > 0;
+        },
+        pruneSpentTokens(now = new Date()) {
+            return Number(statements.pruneSpentTokens.run(now.toISOString()).changes);
+        },
+        countFollowers(username) {
+            const row = statements.countFollowers.get(username ?? null);
             return Number(row?.['count'] ?? 0);
         },
-        listFollowers(options = {}) {
-            const rows = statements.listFollowers.all(options.limit ?? NO_LIMIT, options.offset ?? 0);
+        listFollowers(username, options = {}) {
+            const rows = statements.listFollowers.all(username ?? null, options.limit ?? NO_LIMIT, options.offset ?? 0);
             return rows.map(toFollower);
         },
-        getFollower(actorId) {
-            const row = statements.followerById.get(actorId);
+        getFollower(username, actorId) {
+            const row = statements.followerById.get(username, actorId);
             return row === undefined ? undefined : toFollower(row);
         },
         putFollower(follower) {
-            statements.putFollower.run(follower.actorId, follower.inboxId, follower.sharedInboxId, follower.handle, follower.name, follower.iconUrl, follower.url, follower.followedAt ?? new Date().toISOString());
+            statements.putFollower.run(follower.username, follower.actorId, follower.inboxId, follower.sharedInboxId, follower.handle, follower.name, follower.iconUrl, follower.url, follower.followedAt ?? new Date().toISOString());
             // Read back rather than returning what was written: the upsert leaves an
             // existing `followed_at` alone, so the row is the only thing that knows
             // when the follow really began.
-            const row = statements.followerById.get(follower.actorId);
+            const row = statements.followerById.get(follower.username, follower.actorId);
             if (row === undefined) {
                 throw new Error(`The follower "${follower.actorId}" vanished between insert and read.`);
             }
             return toFollower(row);
         },
-        deleteFollower(actorId) {
-            return statements.deleteFollower.run(actorId).changes > 0;
+        deleteFollower(username, actorId) {
+            return statements.deleteFollower.run(username, actorId).changes > 0;
+        },
+        replaceFollowers(followers) {
+            inTransaction(() => {
+                statements.clearFollowers.run();
+                for (const follower of followers) {
+                    statements.putFollower.run(follower.username, follower.actorId, follower.inboxId, follower.sharedInboxId, follower.handle, follower.name, follower.iconUrl, follower.url, follower.followedAt ?? new Date().toISOString());
+                }
+            });
         },
         countInboxActivities() {
             const row = statements.countInboxActivities.get();
@@ -327,33 +384,110 @@ export function openAdminStore(options) {
             return rows.map(toInboxActivity);
         },
         logInboxActivity(activity) {
-            const row = statements.logInboxActivity.get(activity.activityId, activity.activityType, activity.actorId, activity.objectId, new Date().toISOString(), activity.json);
+            const row = statements.logInboxActivity.get(activity.activityId, activity.activityType, activity.actorId, activity.objectId, 
+            // Derived here rather than passed in, so the column cannot say
+            // something the stored activity does not.
+            replyTargetOf(activity.json), activity.recipient ?? null, activity.receivedAt ?? new Date().toISOString(), activity.json);
             if (row === undefined) {
                 throw new Error(`The activity "${activity.activityType}" was not written to the log.`);
             }
             return toInboxActivity(row);
         },
-        countOutboundActivities() {
-            const row = statements.countOutboundActivities.get();
+        replaceInboxActivities(activities) {
+            inTransaction(() => {
+                statements.clearInboxActivities.run();
+                // The AUTOINCREMENT high-water mark goes with the rows, so the same
+                // log always produces the same ids however many times it is rebuilt.
+                statements.resetInboxSequence.run();
+                for (const activity of activities) {
+                    statements.logInboxActivity.run(activity.activityId, activity.activityType, activity.actorId, activity.objectId, replyTargetOf(activity.json), activity.recipient ?? null, activity.receivedAt ?? new Date().toISOString(), activity.json);
+                }
+            });
+        },
+        countReplies() {
+            const row = statements.countReplies.get();
             return Number(row?.['count'] ?? 0);
         },
-        listOutboundActivities(options = {}) {
-            const rows = statements.listOutboundActivities.all(options.limit ?? NO_LIMIT, options.offset ?? 0);
-            return rows.map(toOutboundActivity);
+        listReplies(options = {}) {
+            const rows = statements.listReplies.all(options.limit ?? NO_LIMIT, options.offset ?? 0);
+            return rows.map(toInboxActivity);
         },
-        getOutboundActivity(activityId) {
-            const row = statements.outboundActivityById.get(activityId);
-            return row === undefined ? undefined : toOutboundActivity(row);
+        countRepliesTo(objectId) {
+            const row = statements.countRepliesTo.get(objectId);
+            return Number(row?.['count'] ?? 0);
         },
-        putOutboundActivity(activity) {
-            const row = statements.putOutboundActivity.get(activity.activityId, activity.activityType, activity.objectId, activity.slug, activity.createdAt ?? new Date().toISOString(), activity.json);
-            if (row === undefined) {
-                throw new Error(`The activity "${activity.activityId}" was not written to the outbox log.`);
+        listRepliesTo(objectId, options = {}) {
+            const rows = statements.listRepliesTo.all(objectId, options.limit ?? NO_LIMIT, options.offset ?? 0);
+            return rows.map(toInboxActivity);
+        },
+        listActivitiesAbout(objectIds) {
+            if (objectIds.length === 0)
+                return [];
+            // Prepared here rather than beside the others because the number of
+            // placeholders is the number of ids: a conversation asks about the post,
+            // then about the notes that answered it, and neither count is known when
+            // the statements are built.
+            const placeholders = objectIds.map(() => '?').join(', ');
+            const rows = db
+                .prepare(`SELECT * FROM ap_inbox
+           WHERE object_id IN (${placeholders}) OR in_reply_to IN (${placeholders})
+           ORDER BY id ASC`)
+                .all(...objectIds, ...objectIds);
+            return rows.map(toInboxActivity);
+        },
+        listCommentsFor(slug) {
+            return statements.listCommentsFor.all(slug).map(toComment);
+        },
+        listComments(options = {}) {
+            // Prepared here rather than beside the others because the `WHERE` is not
+            // fixed: the screen asks for one status and the site-wide feed asks for
+            // approved comments across every post.
+            const where = options.status === undefined ? '' : 'WHERE status = ?';
+            const parameters = options.status === undefined ? [] : [options.status];
+            const rows = db
+                .prepare(`SELECT * FROM comments ${where}
+           ORDER BY submitted_at DESC, id DESC
+           LIMIT ? OFFSET ?`)
+                .all(...parameters, options.limit ?? NO_LIMIT, options.offset ?? 0);
+            return rows.map(toComment);
+        },
+        countCommentsFor(slug, status) {
+            const row = statements.countCommentsFor.get(slug, status);
+            return Number(row?.['count'] ?? 0);
+        },
+        getComment(id) {
+            const row = statements.commentById.get(id);
+            return row === undefined ? undefined : toComment(row);
+        },
+        countCommentsByStatus() {
+            const counts = { pending: 0, approved: 0, spam: 0 };
+            for (const row of statements.countCommentsByStatus.all()) {
+                counts[commentStatus(row['status'])] += Number(row['count'] ?? 0);
             }
-            return toOutboundActivity(row);
+            return counts;
+        },
+        hasApprovedAuthor(name, email) {
+            // `IS` rather than `=`, so an author who gave no email is matched by the
+            // rows that gave none either instead of matching nothing.
+            return statements.hasApprovedAuthor.get(name, email) !== undefined;
+        },
+        putComment(comment) {
+            statements.putComment.run(comment.id, comment.slug, comment.permalink, comment.source, comment.kind, comment.status, comment.author.name, comment.author.url, comment.author.email, comment.content.markdown, comment.content.html, comment.submitted, comment.addressHash, comment.inReplyTo, comment.url, comment.author.avatar, comment.notify ? 1 : 0);
+            return comment;
+        },
+        deleteComment(id) {
+            return statements.deleteComment.run(id).changes > 0;
+        },
+        replaceComments(comments) {
+            inTransaction(() => {
+                statements.clearComments.run();
+                for (const comment of comments) {
+                    statements.putComment.run(comment.id, comment.slug, comment.permalink, comment.source, comment.kind, comment.status, comment.author.name, comment.author.url, comment.author.email, comment.content.markdown, comment.content.html, comment.submitted, comment.addressHash, comment.inReplyTo, comment.url, comment.author.avatar, comment.notify ? 1 : 0);
+                }
+            });
         },
         recordDelivery(delivery) {
-            const row = statements.recordDelivery.get(delivery.activityId, delivery.actorId, delivery.inboxId, delivery.status, delivery.error, delivery.attemptedAt ?? new Date().toISOString());
+            const row = statements.recordDelivery.get(delivery.activityId, delivery.activityType, delivery.objectId, delivery.slug, delivery.actorId, delivery.inboxId, delivery.status, delivery.error, delivery.attemptedAt ?? new Date().toISOString());
             if (row === undefined) {
                 throw new Error(`The delivery of "${delivery.activityId}" to "${delivery.actorId}" was not recorded.`);
             }
@@ -371,35 +505,108 @@ export function openAdminStore(options) {
             }
             return counts;
         },
-        pruneSessions(now = new Date()) {
-            return Number(statements.pruneSessions.run(now.toISOString()).changes);
+        lastDeliveryToInbox(inboxId) {
+            const row = statements.lastDeliveryToInbox.get(inboxId);
+            return row === undefined ? undefined : toDelivery(row);
         },
-        countSettings() {
-            const row = statements.countSettings.get();
-            return Number(row?.['count'] ?? 0);
+        lastDeliveryToObject(objectId) {
+            const row = statements.lastDeliveryToObject.get(objectId);
+            return row === undefined ? undefined : toDelivery(row);
         },
-        allSettings() {
-            const settings = {};
-            for (const row of statements.allSettings.all()) {
-                settings[String(row['key'])] = String(row['value']);
+        recordSentWebmention(sent) {
+            const row = statements.recordSentWebmention.get(sent.slug, sent.source, sent.target, sent.endpoint, sent.status, sent.error, sent.attemptedAt ?? new Date().toISOString());
+            if (row === undefined) {
+                throw new Error(`The webmention to ${sent.target} could not be recorded.`);
             }
-            return settings;
-        },
-        setSettings(values) {
-            const updatedAt = new Date().toISOString();
-            // One transaction, so a save that fails half way through leaves the
-            // stored settings as they were rather than as a mixture of two versions.
-            db.exec('BEGIN');
-            try {
-                for (const [key, value] of Object.entries(values)) {
-                    statements.putSetting.run(key, value, updatedAt);
-                }
-                db.exec('COMMIT');
+            return toSentWebmention(row);
+        },
+        listSentWebmentions(slug) {
+            const rows = statements.listSentWebmentions.all(slug);
+            return rows.map(toSentWebmention);
+        },
+        countSentWebmentionsByStatus(slug) {
+            const counts = { sent: 0, none: 0, failed: 0 };
+            const rows = statements.countSentWebmentionsByStatus.all(slug);
+            for (const row of rows) {
+                counts[webmentionSendStatus(row['status'])] = Number(row['count']);
             }
-            catch (error) {
-                db.exec('ROLLBACK');
-                throw error;
+            return counts;
+        },
+        listRelays() {
+            return statements.listRelays.all().map(toRelay);
+        },
+        getRelay(inboxId) {
+            const row = statements.relayByInbox.get(inboxId);
+            return row === undefined ? undefined : toRelay(row);
+        },
+        getRelayByFollow(followId) {
+            const row = statements.relayByFollow.get(followId);
+            return row === undefined ? undefined : toRelay(row);
+        },
+        putRelay(relay) {
+            const now = new Date().toISOString();
+            const row = statements.putRelay.get(relay.inboxId, relay.actorId, relay.state, relay.reason, relay.followId, relay.createdAt ?? now, now);
+            if (row === undefined) {
+                throw new Error(`The relay subscription to "${relay.inboxId}" was not written.`);
             }
+            return toRelay(row);
+        },
+        deleteRelay(inboxId) {
+            return statements.deleteRelay.run(inboxId).changes > 0;
+        },
+        pruneSessions(now = new Date()) {
+            return Number(statements.pruneSessions.run(now.toISOString()).changes);
+        },
+        legacySettings() {
+            // Prepared here rather than with the rest, because the table this reads
+            // is one that will not be there: a statement over a missing table throws
+            // when it is prepared, which would take the whole store down.
+            if (!hasTable(db, 'settings'))
+                return undefined;
+            return db.prepare('SELECT key, value, updated_at FROM settings').all().map((row) => ({
+                key: String(row['key']),
+                value: String(row['value']),
+                updatedAt: String(row['updated_at']),
+            }));
+        },
+        legacyActorKeys() {
+            // Prepared here for the same reason `legacySettings` is: the table is one
+            // that will not be there, and a statement over a missing table throws
+            // when it is prepared rather than when it is run.
+            if (!hasTable(db, 'actor_keys'))
+                return undefined;
+            return db.prepare('SELECT identifier, algorithm, private_jwk FROM actor_keys').all().map((row) => ({
+                identifier: String(row['identifier']),
+                algorithm: String(row['algorithm']),
+                privateJwk: String(row['private_jwk']),
+            }));
+        },
+        legacyUsers() {
+            // Prepared here for the same reason `legacySettings` is: the table is
+            // one that will not be there, and a statement over a missing table
+            // throws when it is prepared rather than when it is run.
+            if (!hasTable(db, 'users'))
+                return undefined;
+            return db
+                .prepare('SELECT id, username, password_hash, created_at FROM users ORDER BY id')
+                .all().map((row) => ({
+                id: Number(row['id']),
+                username: String(row['username']),
+                passwordHash: String(row['password_hash']),
+                createdAt: String(row['created_at']),
+            }));
+        },
+        dropLegacyTable(name) {
+            // The name is never a caller's to invent: it is one of this file's own
+            // shipped table names, so quoting it is enough.
+            db.exec(`DROP TABLE IF EXISTS "${name.replace(/"/g, '""')}"`);
+        },
+        getState(key) {
+            const row = statements.getState.get(key);
+            return row === undefined ? undefined : String(row['value']);
+        },
+        setState(key, value) {
+            statements.putState.run(key, value, new Date().toISOString());
         },
         pushFlash(sessionId, entry) {
             const queued = [...readFlash(sessionId), entry];
@@ -420,11 +627,6 @@ export function openAdminStore(options) {
         },
     };
 }
-/**
- * A well-formed hash of a password nobody has, verified against when the
- * username is unknown so that both failures cost the same.
- */
-const DUMMY_HASH = hashPassword('a password no user has, hashed once so that verification is constant time');
 function isFlashMessage(value) {
     if (typeof value !== 'object' || value === null)
         return false;
@@ -449,6 +651,7 @@ function nullableText(value) {
 }
 function toFollower(row) {
     return {
+        username: String(row['username']),
         actorId: String(row['actor_id']),
         inboxId: String(row['inbox_id']),
         sharedInboxId: nullableText(row['shared_inbox_id']),
@@ -466,23 +669,18 @@ function toInboxActivity(row) {
         activityType: String(row['activity_type']),
         actorId: String(row['actor_id']),
         objectId: nullableText(row['object_id']),
+        inReplyTo: nullableText(row['in_reply_to']),
+        recipient: nullableText(row['recipient']),
         receivedAt: String(row['received_at']),
         json: String(row['json']),
     };
 }
-function toOutboundActivity(row) {
+function toDelivery(row) {
     return {
         activityId: String(row['activity_id']),
         activityType: String(row['activity_type']),
         objectId: String(row['object_id']),
         slug: nullableText(row['slug']),
-        createdAt: String(row['created_at']),
-        json: String(row['json']),
-    };
-}
-function toDelivery(row) {
-    return {
-        activityId: String(row['activity_id']),
         actorId: String(row['actor_id']),
         inboxId: String(row['inbox_id']),
         status: deliveryStatus(row['status']),
@@ -490,6 +688,78 @@ function toDelivery(row) {
         attemptedAt: String(row['attempted_at']),
     };
 }
+function toSentWebmention(row) {
+    return {
+        slug: String(row['slug']),
+        source: String(row['source']),
+        target: String(row['target']),
+        endpoint: nullableText(row['endpoint']),
+        status: webmentionSendStatus(row['status']),
+        error: nullableText(row['error']),
+        attemptedAt: String(row['attempted_at']),
+    };
+}
+/** A stored send status, or `failed` for one this version does not know. */
+function webmentionSendStatus(value) {
+    return oneOf(value, WEBMENTION_SEND_STATUSES, 'failed');
+}
+function toComment(row) {
+    return {
+        id: String(row['id']),
+        slug: String(row['slug']),
+        permalink: String(row['permalink']),
+        source: oneOf(row['source'], COMMENT_SOURCES, 'comment'),
+        kind: oneOf(row['kind'], COMMENT_KINDS, 'reply'),
+        status: commentStatus(row['status']),
+        author: {
+            name: String(row['author_name']),
+            url: nullableText(row['author_url']),
+            email: nullableText(row['author_email']),
+            avatar: nullableText(row['author_avatar']),
+        },
+        content: { markdown: String(row['markdown']), html: String(row['html']) },
+        submitted: String(row['submitted_at']),
+        addressHash: nullableText(row['address_hash']),
+        inReplyTo: nullableText(row['in_reply_to']),
+        url: nullableText(row['url']),
+        notify: Number(row['notify'] ?? 0) === 1,
+    };
+}
+/**
+ * A stored comment status, or `pending` for one this version does not know.
+ *
+ * Pending is the safe reading: showing a comment nobody approved is the one
+ * mistake a moderation queue cannot make, and the screen is right there for
+ * the row.
+ */
+function commentStatus(value) {
+    return oneOf(value, COMMENT_STATUSES, 'pending');
+}
+/** A stored enumeration value, or the fallback for one this version does not know. */
+function oneOf(value, allowed, fallback) {
+    return allowed.includes(value) ? value : fallback;
+}
+function toRelay(row) {
+    return {
+        inboxId: String(row['inbox_id']),
+        actorId: nullableText(row['actor_id']),
+        state: relayState(row['state']),
+        reason: nullableText(row['reason']),
+        followId: nullableText(row['follow_id']),
+        createdAt: String(row['created_at']),
+        updatedAt: String(row['updated_at']),
+    };
+}
+/**
+ * A stored relay state, or `pending` for one this version does not know.
+ *
+ * Pending is the safe reading of an unknown state: a subscription this version
+ * cannot make sense of is one it should not be delivering public posts to, and
+ * Retry is on the screen for exactly that row.
+ */
+function relayState(value) {
+    return RELAY_STATES.includes(value) ? value : 'pending';
+}
 /**
  * A stored status, or `failed` for one this version does not know.
  *
@@ -510,13 +780,33 @@ function toSession(row) {
         expiresAt: String(row['expires_at']),
     };
 }
-/** 256 unguessable bits, hex encoded. Session ids and CSRF tokens are both this. */
+/**
+ * 256 unguessable bits, hex encoded. Session ids, CSRF tokens and password
+ * reset tokens are all this.
+ */
 function randomToken() {
     return randomBytes(SESSION_ID_BYTES).toString('hex');
 }
-function isUniqueViolation(error) {
-    return error instanceof Error && /UNIQUE constraint failed/i.test(error.message);
+/**
+ * A reset token as the database keeps it: its SHA-256, hex encoded.
+ *
+ * Plain SHA-256 rather than argon2 on purpose. What argon2 buys is time
+ * against somebody guessing a password people chose, and there is nothing to
+ * guess here: the token is 256 bits out of `randomBytes`, so the only way to
+ * hold a valid one is to have been sent it. What the hash is for is that a
+ * copy of `geekity.db` — a backup, a stray file — is not a stack of working
+ * reset links.
+ */
+function hashToken(token) {
+    return createHash('sha256').update(token, 'utf8').digest('hex');
+}
+/** Whether the database has a table by that name. */
+function hasTable(db, name) {
+    return (db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?").all(name)
+        .length > 0);
 }
+/** The table this store's applied versions are recorded in. */
+const LEDGER = 'admin_migrations';
 /**
  * Schema versions for the admin tables, applied in order. They keep their own
  * ledger so their numbering never collides with the content index's.
@@ -525,6 +815,13 @@ function isUniqueViolation(error) {
  */
 const MIGRATIONS = [
     {
+        // Users and sessions, when SQLite still held both. decision-9 moved the
+        // accounts into `data/users.json`, so nothing reads the users table any
+        // more: `migrateUsersToFile` writes its rows out on the first boot of that
+        // version and drops it. The migration stays exactly as it shipped, because
+        // a shipped migration is never edited — which does mean a brand new
+        // database creates the table here and drops it a moment later. Migration
+        // 11 is where sessions lose the foreign key into it.
         version: 1,
         sql: `
       CREATE TABLE users (
@@ -557,10 +854,12 @@ const MIGRATIONS = [
         sql: `ALTER TABLE sessions ADD COLUMN flash TEXT`,
     },
     {
-        // Site settings: doc-1's "data that lives only in SQLite", mirrored to
-        // content/_data/site.json on every save. Key and value rather than one
-        // row per site, so the federation settings M3 adds cost a row rather than
-        // a migration each.
+        // Site settings, when SQLite was still the source of them. decision-9
+        // moved them into content/_data/site.json, so nothing reads this table
+        // any more: `migrateSettingsToFile` writes its rows out on the first boot
+        // of that version and drops it. The migration stays exactly as it shipped,
+        // because a shipped migration is never edited — which does mean a brand
+        // new database creates the table here and drops it a moment later.
         version: 3,
         sql: `
       CREATE TABLE settings (
@@ -571,11 +870,12 @@ const MIGRATIONS = [
     `,
     },
     {
-        // The site actor's signing keys (doc-4). They are generated on the first
-        // boot that federates and never again: an actor whose key changes is an
-        // actor every follower has to re-verify, so this is the one table in the
-        // database that a site really cannot afford to lose. Keyed by identifier
-        // rather than by handle, so renaming `@blog@example.com` keeps the keys.
+        // The site actor's signing keys, when SQLite still held them. decision-9
+        // moved them into JWK files under `data/keys`, so nothing reads this table
+        // any more: `migrateActorKeysToFiles` writes its rows out on the first boot
+        // of that version and drops it. The migration stays exactly as it shipped,
+        // because a shipped migration is never edited — which does mean a brand new
+        // database creates the table here and drops it a moment later.
         version: 4,
         sql: `
       CREATE TABLE actor_keys (
@@ -673,32 +973,327 @@ const MIGRATIONS = [
       CREATE INDEX ap_deliveries_status ON ap_deliveries (status);
     `,
     },
+    {
+        // What a logged reply answers, so a post's comments can be counted and
+        // listed without reading every activity the site was ever sent.
+        //
+        // It is an index of the JSON beside it rather than a fact of its own: the
+        // backfill runs the very function the writer runs, so a database rebuilt
+        // from the inbox log (TASK-32) holds what this one holds.
+        version: 8,
+        sql: `
+      ALTER TABLE ap_inbox ADD COLUMN in_reply_to TEXT;
+      CREATE INDEX ap_inbox_in_reply_to ON ap_inbox (in_reply_to);
+    `,
+        run(db) {
+            const rows = db.prepare('SELECT id, json FROM ap_inbox').all();
+            const update = db.prepare('UPDATE ap_inbox SET in_reply_to = ? WHERE id = ?');
+            for (const row of rows) {
+                update.run(replyTargetOf(String(row['json'])), Number(row['id']));
+            }
+        },
+    },
+    {
+        // Relay subscriptions (FEP-ae0c, TASK-40). The list of relays is a
+        // setting mirrored to site.json; this is where each handshake stands,
+        // which is operational state and derivable again from the file — a relay
+        // in the list with no row here is simply followed again on the next boot.
+        //
+        // Keyed by the inbox rather than by the relay's actor id, because the
+        // inbox is the only thing known when the `Follow` goes out: the actor id
+        // arrives with the `Accept`, days later if a human has to approve it.
+        version: 9,
+        sql: `
+      CREATE TABLE ap_relays (
+        inbox_id   TEXT PRIMARY KEY,
+        actor_id   TEXT,
+        state      TEXT NOT NULL,
+        reason     TEXT,
+        follow_id  TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      );
+
+      CREATE INDEX ap_relays_follow_id ON ap_relays (follow_id);
+      CREATE INDEX ap_relays_actor_id ON ap_relays (actor_id);
+    `,
+    },
+    {
+        // The CMS's own operational state, as opposed to the site's settings. It
+        // is a table of its own rather than more rows in `settings` because the
+        // number of settings is what decides whether a site is seeded from
+        // content/_data/site.json, and because nothing here belongs in that file.
+        version: 10,
+        sql: `
+      CREATE TABLE cms_state (
+        key        TEXT PRIMARY KEY,
+        value      TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      );
+    `,
+    },
+    {
+        // Sessions without the foreign key into `users`, because there is no users
+        // table any more: decision-9 moved the accounts into `data/users.json` and
+        // `migrateUsersToFile` drops the table on the boot after this migration
+        // runs. The constraint could not survive that either way — with
+        // `foreign_keys` on, dropping the parent cascades every login away, and an
+        // insert afterwards fails with "no such table: main.users" — and SQLite
+        // cannot drop a constraint in place, so the table is rebuilt. Every row is
+        // copied across, so a site upgrading keeps the logins it had. What the key
+        // was doing is done in the admin guard instead: a session naming a user
+        // the file no longer holds is not a session.
+        version: 11,
+        sql: `
+      CREATE TABLE sessions_without_users (
+        id         TEXT PRIMARY KEY,
+        user_id    INTEGER,
+        csrf_token TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        expires_at TEXT NOT NULL,
+        flash      TEXT
+      );
+
+      INSERT INTO sessions_without_users (
+        id, user_id, csrf_token, created_at, expires_at, flash
+      )
+      SELECT id, user_id, csrf_token, created_at, expires_at, flash FROM sessions;
+
+      DROP TABLE sessions;
+      ALTER TABLE sessions_without_users RENAME TO sessions;
+
+      CREATE INDEX sessions_expires_at ON sessions (expires_at);
+      CREATE INDEX sessions_user_id ON sessions (user_id);
+    `,
+    },
+    {
+        // The outcomes without the payloads. decision-9 replaces "send this stored
+        // activity again" with "send this post as it now reads", so nothing needs
+        // the JSON-LD any more and `ap_outbound` goes: an activity rebuilt from
+        // the file is the current answer, and a copy of what went out last time
+        // could only ever be a staler one.
+        //
+        // What that table held about an activity that an outcome cannot do
+        // without — its type, the object it was about and the slug — moves onto
+        // the outcome row, which is now the whole of what SQLite remembers about
+        // anything the site has sent. The foreign key has to go with the parent,
+        // and SQLite cannot drop a constraint in place, so `ap_deliveries` is
+        // rebuilt the way migration 11 rebuilt `sessions`. Every row that has an
+        // activity to name is carried across as a courtesy: this table is a cache
+        // and is allowed to be empty, so a row whose activity is somehow missing
+        // is dropped rather than invented a type for.
+        version: 12,
+        sql: `
+      CREATE TABLE ap_deliveries_standalone (
+        activity_id   TEXT NOT NULL,
+        activity_type TEXT NOT NULL,
+        object_id     TEXT NOT NULL,
+        slug          TEXT,
+        actor_id      TEXT NOT NULL,
+        inbox_id      TEXT NOT NULL,
+        status        TEXT NOT NULL,
+        error         TEXT,
+        attempted_at  TEXT NOT NULL,
+        PRIMARY KEY (activity_id, actor_id)
+      );
+
+      INSERT INTO ap_deliveries_standalone (
+        activity_id, activity_type, object_id, slug,
+        actor_id, inbox_id, status, error, attempted_at
+      )
+      SELECT
+        ap_deliveries.activity_id,
+        ap_outbound.activity_type,
+        ap_outbound.object_id,
+        ap_outbound.slug,
+        ap_deliveries.actor_id,
+        ap_deliveries.inbox_id,
+        ap_deliveries.status,
+        ap_deliveries.error,
+        ap_deliveries.attempted_at
+      FROM ap_deliveries
+      JOIN ap_outbound ON ap_outbound.activity_id = ap_deliveries.activity_id;
+
+      DROP TABLE ap_deliveries;
+      ALTER TABLE ap_deliveries_standalone RENAME TO ap_deliveries;
+
+      CREATE INDEX ap_deliveries_attempted_at ON ap_deliveries (attempted_at);
+      CREATE INDEX ap_deliveries_status ON ap_deliveries (status);
+      CREATE INDEX ap_deliveries_object_id ON ap_deliveries (object_id, attempted_at);
+
+      DROP TABLE ap_outbound;
+    `,
+    },
+    {
+        // What a post's conversation is read by (TASK-49). `in_reply_to` already
+        // had an index because a post's replies are counted on every feed; the
+        // object an activity is about had none, and that is the column a like, a
+        // boost, a `Delete` of a reply and an `Undo` of a like are all found by.
+        version: 13,
+        sql: `
+      CREATE INDEX ap_inbox_object_id ON ap_inbox (object_id);
+    `,
+    },
+    {
+        // Native comments (TASK-50), which are files under
+        // `content/_data/comments/` and nothing else: this table is an index of
+        // them, emptied and read back on every boot exactly as `followers` and
+        // `ap_inbox` are. Nothing here is a fact the files do not carry.
+        //
+        // The id is the comment's own name rather than a row number, because it is
+        // what a reply names, what a moderation form posts and what the page
+        // anchors on — all three have to survive a rebuilt index. The author's
+        // name and email are indexed together because that pair is the whole of
+        // WordPress's auto-approval rule.
+        version: 14,
+        sql: `
+      CREATE TABLE comments (
+        id           TEXT PRIMARY KEY,
+        slug         TEXT NOT NULL,
+        permalink    TEXT NOT NULL,
+        source       TEXT NOT NULL,
+        kind         TEXT NOT NULL,
+        status       TEXT NOT NULL,
+        author_name  TEXT NOT NULL,
+        author_url   TEXT,
+        author_email TEXT,
+        markdown     TEXT NOT NULL,
+        html         TEXT NOT NULL,
+        submitted_at TEXT NOT NULL,
+        address_hash TEXT,
+        in_reply_to  TEXT
+      );
+
+      CREATE INDEX comments_slug ON comments (slug, submitted_at);
+      CREATE INDEX comments_status ON comments (status, submitted_at);
+      CREATE INDEX comments_author ON comments (author_name, author_email, status);
+    `,
+    },
+    {
+        // Webmentions (TASK-51), which are two different things and so two changes.
+        //
+        // A comment may now say where it lives, because a webmention lives on
+        // somebody else's page: it is what a later webmention from that page is
+        // recognised by, and what the thread's permalink points at for an entry
+        // this site did not host. Its author may now have a face, out of the source
+        // page's `h-card`. Both columns are an index of the comment files like
+        // every other column of this table, so nothing backfills them — the rebuild
+        // on the next boot does.
+        //
+        // What the site has sent is the other half, and it is a cache of outcomes
+        // exactly as `ap_deliveries` is: no payload, one row per (post, target),
+        // and a resend moves the row rather than adding to it. It is a table of
+        // its own rather than a use of `ap_deliveries` because the federation
+        // screen counts that table per activity, and a webmention is not one.
+        version: 15,
+        sql: `
+      ALTER TABLE comments ADD COLUMN url TEXT;
+      ALTER TABLE comments ADD COLUMN author_avatar TEXT;
+
+      CREATE TABLE webmentions_sent (
+        slug         TEXT NOT NULL,
+        source       TEXT NOT NULL,
+        target       TEXT NOT NULL,
+        endpoint     TEXT,
+        status       TEXT NOT NULL,
+        error        TEXT,
+        attempted_at TEXT NOT NULL,
+        PRIMARY KEY (slug, target)
+      );
+
+      CREATE INDEX webmentions_sent_attempted_at ON webmentions_sent (attempted_at);
+    `,
+    },
+    {
+        // Password reset tokens (TASK-54). They sit beside the sessions, and for
+        // the same reason: a reset link is a second, shorter-lived way of proving
+        // you are somebody, and it is a cache — losing one costs the person
+        // nothing but a second click on Forgot password. So `data/users.json`
+        // stays the whole of what a site must back up, and a restart, a rebuild or
+        // a `geekity rebuild` invalidates every link in flight, which is the safe
+        // direction to fail in.
+        //
+        // The key is the token's SHA-256 rather than the token, so the database
+        // holds nothing a working link could be rebuilt from: somebody who reads
+        // this table — a backup, a stray copy of the file — learns that a reset
+        // was asked for and nothing else. It is a plain hash rather than argon2
+        // because the token is 256 random bits and there is no guess to slow down;
+        // what argon2 buys on a password it cannot buy here.
+        version: 16,
+        sql: `
+      CREATE TABLE password_resets (
+        token_hash TEXT PRIMARY KEY,
+        user_id    INTEGER NOT NULL,
+        created_at TEXT NOT NULL,
+        expires_at TEXT NOT NULL
+      );
+
+      CREATE INDEX password_resets_expires_at ON password_resets (expires_at);
+      CREATE INDEX password_resets_user_id ON password_resets (user_id);
+    `,
+    },
+    {
+        // The two halves of a notification's one-click links (TASK-55).
+        //
+        // `spent_tokens` is what makes such a link single use. The link itself is
+        // not stored — it is an HMAC-signed claim, so that a moderation link in an
+        // inbox goes on working across a rebuilt or restored cache, which is a
+        // thing decision-9 says a site may do whenever it likes. Only the fact
+        // that one has been used is written down, keyed by its SHA-256 for the
+        // reason `password_resets` is, and swept once the signature has expired.
+        // Losing this table forgets which links were spent, and that costs a site
+        // nothing: every action a link performs is idempotent, so doing it a
+        // second time is doing it once.
+        //
+        // `comments.notify` is the commenter's "tell me about replies", which the
+        // file says and this column indexes like every other column of that table.
+        // Nothing backfills it: the rebuild on the next boot does, and a comment
+        // written before this shipped never asked to be told.
+        version: 17,
+        sql: `
+      CREATE TABLE spent_tokens (
+        token_hash TEXT PRIMARY KEY,
+        spent_at   TEXT NOT NULL,
+        expires_at TEXT NOT NULL
+      );
+
+      CREATE INDEX spent_tokens_expires_at ON spent_tokens (expires_at);
+
+      ALTER TABLE comments ADD COLUMN notify INTEGER NOT NULL DEFAULT 0;
+    `,
+    },
+    {
+        // Followers belong to a user, and the inbox log says who was told
+        // (decision-14, TASK-68). The site actor is gone, so there is nothing to
+        // backfill: the `followers` table is rebuilt on every boot from the files
+        // under `content/_data/federation/{username}/`, and the rows a site
+        // carried for the site actor name nobody. The table is therefore dropped
+        // and made again with the new key rather than altered — `actor_id` was its
+        // primary key, and one actor may follow two of this site's users.
+        version: 18,
+        sql: `
+      DROP TABLE followers;
+
+      CREATE TABLE followers (
+        username        TEXT NOT NULL,
+        actor_id        TEXT NOT NULL,
+        inbox_id        TEXT NOT NULL,
+        shared_inbox_id TEXT,
+        handle          TEXT,
+        name            TEXT,
+        icon_url        TEXT,
+        url             TEXT,
+        followed_at     TEXT NOT NULL,
+        PRIMARY KEY (username, actor_id)
+      );
+
+      CREATE INDEX followers_followed_at ON followers (followed_at);
+      CREATE INDEX followers_actor_id ON followers (actor_id);
+
+      ALTER TABLE ap_inbox ADD COLUMN recipient TEXT;
+
+      CREATE INDEX ap_inbox_recipient ON ap_inbox (recipient);
+    `,
+    },
 ];
-function migrate(db) {
-    db.exec(`
-    CREATE TABLE IF NOT EXISTS admin_migrations (
-      version    INTEGER PRIMARY KEY,
-      applied_at TEXT NOT NULL
-    )
-  `);
-    const applied = new Set(db
-        .prepare('SELECT version FROM admin_migrations')
-        .all()
-        .map((row) => Number(row['version'])));
-    const record = db.prepare('INSERT INTO admin_migrations (version, applied_at) VALUES (?, ?)');
-    for (const migration of MIGRATIONS) {
-        if (applied.has(migration.version))
-            continue;
-        db.exec('BEGIN');
-        try {
-            db.exec(migration.sql);
-            record.run(migration.version, new Date().toISOString());
-            db.exec('COMMIT');
-        }
-        catch (error) {
-            db.exec('ROLLBACK');
-            throw error;
-        }
-    }
-}
 //# sourceMappingURL=store.js.map