@geekity/cms 0.3.0

package/dist/admin/store.js

@@ -0,0 +1,704 @@
+import { randomBytes } from 'node:crypto';
+import { mkdirSync } from 'node:fs';
+import path from 'node:path';
+import { DatabaseSync } from 'node:sqlite';
+import { DATABASE_FILE } from '../content/store.js';
+import { hashPassword, verifyPasswordHash } from './passwords.js';
+/** How long a session id is, in bytes. 32 is the 256 bits doc-5 asks for. */
+export const SESSION_ID_BYTES = 32;
+/**
+ * The two signature algorithms doc-4 asks a site actor to hold.
+ *
+ * `RSASSA-PKCS1-v1_5` signs HTTP Signatures, which is what Mastodon and most
+ * of the fediverse verify; `Ed25519` signs FEP-8b32 object integrity proofs.
+ * They are Fedify's own spellings, so a row round-trips into
+ * `generateCryptoKeyPair` without translation.
+ */
+export const ACTOR_KEY_ALGORITHMS = ['RSASSA-PKCS1-v1_5', 'Ed25519'];
+/** How one delivery of one activity to one follower ended. */
+export const DELIVERY_STATUSES = ['sent', 'queued', 'failed'];
+/** Thrown when a username is already taken. Usernames are the login key. */
+export class DuplicateUsernameError extends Error {
+    name = 'DuplicateUsernameError';
+    /** The name that was already in use. */
+    username;
+    constructor(username) {
+        super(`A user named "${username}" already exists.`);
+        this.username = username;
+    }
+}
+/**
+ * Open (and if needed create) the admin tables in `dataDir`, applying every
+ * migration the package ships. Applying them is idempotent.
+ *
+ * The connection is its own; SQLite in WAL mode is happy with the content
+ * index holding a second one on the same file.
+ */
+export function openAdminStore(options) {
+    const file = path.join(options.dataDir, DATABASE_FILE);
+    mkdirSync(options.dataDir, { recursive: true });
+    const db = new DatabaseSync(file);
+    db.exec('PRAGMA journal_mode = WAL');
+    db.exec('PRAGMA foreign_keys = ON');
+    migrate(db);
+    const statements = {
+        countUsers: db.prepare('SELECT COUNT(*) AS count FROM users'),
+        listUsers: db.prepare('SELECT id, username, created_at FROM users ORDER BY username'),
+        userByName: db.prepare('SELECT * FROM users WHERE username = ?'),
+        userById: db.prepare('SELECT id, username, created_at FROM users WHERE id = ?'),
+        insertUser: db.prepare('INSERT INTO users (username, password_hash, created_at) VALUES (?, ?, ?)'),
+        setPassword: db.prepare('UPDATE users SET password_hash = ? WHERE id = ?'),
+        deleteUser: db.prepare('DELETE FROM users WHERE id = ?'),
+        deleteSessionsForUser: db.prepare('DELETE FROM sessions WHERE user_id = ? AND id IS NOT ?'),
+        insertSession: db.prepare(`
+      INSERT INTO sessions (id, user_id, csrf_token, created_at, expires_at)
+      VALUES (?, ?, ?, ?, ?)
+    `),
+        sessionById: db.prepare('SELECT * FROM sessions WHERE id = ?'),
+        deleteSession: db.prepare('DELETE FROM sessions WHERE id = ?'),
+        pruneSessions: db.prepare('DELETE FROM sessions WHERE expires_at <= ?'),
+        readFlash: db.prepare('SELECT flash FROM sessions WHERE id = ?'),
+        writeFlash: db.prepare('UPDATE sessions SET flash = ? WHERE id = ?'),
+        countSettings: db.prepare('SELECT COUNT(*) AS count FROM settings'),
+        allSettings: db.prepare('SELECT key, value FROM settings'),
+        putSetting: db.prepare(`
+      INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)
+      ON CONFLICT (key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at
+    `),
+        actorKeys: db.prepare('SELECT * FROM actor_keys WHERE identifier = ?'),
+        putActorKey: db.prepare(`
+      INSERT INTO actor_keys (identifier, algorithm, private_jwk, public_jwk, created_at)
+      VALUES (?, ?, ?, ?, ?)
+      ON CONFLICT (identifier, algorithm) DO UPDATE SET
+        private_jwk = excluded.private_jwk,
+        public_jwk = excluded.public_jwk,
+        created_at = excluded.created_at
+    `),
+        countFollowers: db.prepare('SELECT COUNT(*) AS count FROM followers'),
+        listFollowers: db.prepare(`
+      SELECT * FROM followers
+      ORDER BY followed_at DESC, actor_id DESC
+      LIMIT ? OFFSET ?
+    `),
+        followerById: db.prepare('SELECT * FROM followers WHERE actor_id = ?'),
+        putFollower: db.prepare(`
+      INSERT INTO followers (
+        actor_id, inbox_id, shared_inbox_id, handle, name, icon_url, url, followed_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (actor_id) DO UPDATE SET
+        inbox_id = excluded.inbox_id,
+        shared_inbox_id = excluded.shared_inbox_id,
+        handle = excluded.handle,
+        name = excluded.name,
+        icon_url = excluded.icon_url,
+        url = excluded.url
+    `),
+        deleteFollower: db.prepare('DELETE FROM followers WHERE actor_id = ?'),
+        countInboxActivities: db.prepare('SELECT COUNT(*) AS count FROM ap_inbox'),
+        listInboxActivities: db.prepare(`
+      SELECT * FROM ap_inbox
+      ORDER BY received_at DESC, id DESC
+      LIMIT ? OFFSET ?
+    `),
+        logInboxActivity: db.prepare(`
+      INSERT INTO ap_inbox (activity_id, activity_type, actor_id, object_id, received_at, json)
+      VALUES (?, ?, ?, ?, ?, ?)
+      ON CONFLICT (activity_id) DO UPDATE SET
+        activity_type = excluded.activity_type,
+        actor_id = excluded.actor_id,
+        object_id = excluded.object_id,
+        received_at = excluded.received_at,
+        json = excluded.json
+      RETURNING *
+    `),
+        countOutboundActivities: db.prepare('SELECT COUNT(*) AS count FROM ap_outbound'),
+        listOutboundActivities: db.prepare(`
+      SELECT * FROM ap_outbound
+      ORDER BY created_at DESC, rowid DESC
+      LIMIT ? OFFSET ?
+    `),
+        outboundActivityById: db.prepare('SELECT * FROM ap_outbound WHERE activity_id = ?'),
+        putOutboundActivity: db.prepare(`
+      INSERT INTO ap_outbound (activity_id, activity_type, object_id, slug, created_at, json)
+      VALUES (?, ?, ?, ?, ?, ?)
+      ON CONFLICT (activity_id) DO UPDATE SET
+        activity_type = excluded.activity_type,
+        object_id = excluded.object_id,
+        slug = excluded.slug,
+        json = excluded.json
+      RETURNING *
+    `),
+        recordDelivery: db.prepare(`
+      INSERT INTO ap_deliveries (activity_id, actor_id, inbox_id, status, error, attempted_at)
+      VALUES (?, ?, ?, ?, ?, ?)
+      ON CONFLICT (activity_id, actor_id) DO UPDATE SET
+        inbox_id = excluded.inbox_id,
+        status = excluded.status,
+        error = excluded.error,
+        attempted_at = excluded.attempted_at
+      RETURNING *
+    `),
+        listDeliveries: db.prepare(`
+      SELECT * FROM ap_deliveries WHERE activity_id = ? ORDER BY actor_id
+    `),
+        countDeliveriesByStatus: db.prepare(`
+      SELECT status, COUNT(*) AS count FROM ap_deliveries WHERE activity_id = ? GROUP BY status
+    `),
+    };
+    let open = true;
+    /**
+     * The messages queued on a session. A column that will not parse is treated
+     * as empty: a flash is a convenience, and losing one is better than a 500 on
+     * every admin page until the row is cleaned up by hand.
+     */
+    function readFlash(sessionId) {
+        const row = statements.readFlash.get(sessionId);
+        const raw = row?.['flash'];
+        if (typeof raw !== 'string' || raw === '')
+            return [];
+        try {
+            const parsed = JSON.parse(raw);
+            return Array.isArray(parsed) ? parsed.filter(isFlashMessage) : [];
+        }
+        catch {
+            return [];
+        }
+    }
+    function storedUser(username) {
+        const row = statements.userByName.get(username);
+        if (row === undefined)
+            return undefined;
+        return {
+            id: Number(row['id']),
+            username: String(row['username']),
+            passwordHash: String(row['password_hash']),
+            createdAt: String(row['created_at']),
+        };
+    }
+    return {
+        file,
+        countUsers() {
+            const row = statements.countUsers.get();
+            return Number(row?.['count'] ?? 0);
+        },
+        listUsers() {
+            return statements.listUsers.all().map((row) => ({
+                id: Number(row['id']),
+                username: String(row['username']),
+                createdAt: String(row['created_at']),
+            }));
+        },
+        getUser(username) {
+            return storedUser(username);
+        },
+        getUserById(id) {
+            const row = statements.userById.get(id);
+            if (row === undefined)
+                return undefined;
+            return {
+                id: Number(row['id']),
+                username: String(row['username']),
+                createdAt: String(row['created_at']),
+            };
+        },
+        createUser(input) {
+            const createdAt = new Date().toISOString();
+            const hash = hashPassword(input.password);
+            try {
+                statements.insertUser.run(input.username, hash, createdAt);
+            }
+            catch (error) {
+                if (isUniqueViolation(error))
+                    throw new DuplicateUsernameError(input.username);
+                throw error;
+            }
+            const created = storedUser(input.username);
+            if (created === undefined) {
+                throw new Error(`The user "${input.username}" vanished between insert and read.`);
+            }
+            return { id: created.id, username: created.username, createdAt: created.createdAt };
+        },
+        verifyPassword(username, password) {
+            const user = storedUser(username);
+            if (user === undefined) {
+                // Hash anyway, so a missing user and a wrong password take the same
+                // time and the login form does not become a user enumerator.
+                verifyPasswordHash(DUMMY_HASH, password);
+                return undefined;
+            }
+            if (!verifyPasswordHash(user.passwordHash, password))
+                return undefined;
+            return { id: user.id, username: user.username, createdAt: user.createdAt };
+        },
+        setPassword(userId, password) {
+            // Hashed before the update rather than inside it, so a hash that throws
+            // leaves the stored one alone.
+            const hash = hashPassword(password);
+            return statements.setPassword.run(hash, userId).changes > 0;
+        },
+        deleteUser(userId) {
+            return statements.deleteUser.run(userId).changes > 0;
+        },
+        createSession(input) {
+            const now = input.now ?? new Date();
+            const session = {
+                id: randomToken(),
+                userId: input.userId,
+                csrfToken: randomToken(),
+                createdAt: now.toISOString(),
+                expiresAt: new Date(now.getTime() + input.lifetimeSeconds * 1000).toISOString(),
+            };
+            statements.insertSession.run(session.id, session.userId, session.csrfToken, session.createdAt, session.expiresAt);
+            return session;
+        },
+        getSession(id, now = new Date()) {
+            const row = statements.sessionById.get(id);
+            if (row === undefined)
+                return undefined;
+            const session = toSession(row);
+            // ISO 8601 in UTC sorts the way time runs, so string order is time order.
+            if (session.expiresAt <= now.toISOString()) {
+                statements.deleteSession.run(id);
+                return undefined;
+            }
+            return session;
+        },
+        deleteSession(id) {
+            return statements.deleteSession.run(id).changes > 0;
+        },
+        deleteSessionsForUser(userId, options = {}) {
+            // `IS NOT` rather than `<>`, so a missing `except` compares against NULL
+            // and spares nothing instead of matching nothing.
+            return Number(statements.deleteSessionsForUser.run(userId, options.except ?? null).changes);
+        },
+        listActorKeys(identifier) {
+            const rows = statements.actorKeys.all(identifier);
+            const keys = rows
+                .map((row) => ({
+                identifier: String(row['identifier']),
+                algorithm: String(row['algorithm']),
+                privateJwk: String(row['private_jwk']),
+                publicJwk: String(row['public_jwk']),
+                createdAt: String(row['created_at']),
+            }))
+                // An algorithm this version has never heard of is a row a later
+                // version wrote; ignoring it is better than handing Fedify a key it
+                // cannot import.
+                .filter((key) => ACTOR_KEY_ALGORITHMS.includes(key.algorithm));
+            return keys.sort((a, b) => ACTOR_KEY_ALGORITHMS.indexOf(a.algorithm) - ACTOR_KEY_ALGORITHMS.indexOf(b.algorithm));
+        },
+        putActorKey(key) {
+            const stored = { ...key, createdAt: new Date().toISOString() };
+            statements.putActorKey.run(stored.identifier, stored.algorithm, stored.privateJwk, stored.publicJwk, stored.createdAt);
+            return stored;
+        },
+        countFollowers() {
+            const row = statements.countFollowers.get();
+            return Number(row?.['count'] ?? 0);
+        },
+        listFollowers(options = {}) {
+            const rows = statements.listFollowers.all(options.limit ?? NO_LIMIT, options.offset ?? 0);
+            return rows.map(toFollower);
+        },
+        getFollower(actorId) {
+            const row = statements.followerById.get(actorId);
+            return row === undefined ? undefined : toFollower(row);
+        },
+        putFollower(follower) {
+            statements.putFollower.run(follower.actorId, follower.inboxId, follower.sharedInboxId, follower.handle, follower.name, follower.iconUrl, follower.url, follower.followedAt ?? new Date().toISOString());
+            // Read back rather than returning what was written: the upsert leaves an
+            // existing `followed_at` alone, so the row is the only thing that knows
+            // when the follow really began.
+            const row = statements.followerById.get(follower.actorId);
+            if (row === undefined) {
+                throw new Error(`The follower "${follower.actorId}" vanished between insert and read.`);
+            }
+            return toFollower(row);
+        },
+        deleteFollower(actorId) {
+            return statements.deleteFollower.run(actorId).changes > 0;
+        },
+        countInboxActivities() {
+            const row = statements.countInboxActivities.get();
+            return Number(row?.['count'] ?? 0);
+        },
+        listInboxActivities(options = {}) {
+            const rows = statements.listInboxActivities.all(options.limit ?? NO_LIMIT, options.offset ?? 0);
+            return rows.map(toInboxActivity);
+        },
+        logInboxActivity(activity) {
+            const row = statements.logInboxActivity.get(activity.activityId, activity.activityType, activity.actorId, activity.objectId, new Date().toISOString(), activity.json);
+            if (row === undefined) {
+                throw new Error(`The activity "${activity.activityType}" was not written to the log.`);
+            }
+            return toInboxActivity(row);
+        },
+        countOutboundActivities() {
+            const row = statements.countOutboundActivities.get();
+            return Number(row?.['count'] ?? 0);
+        },
+        listOutboundActivities(options = {}) {
+            const rows = statements.listOutboundActivities.all(options.limit ?? NO_LIMIT, options.offset ?? 0);
+            return rows.map(toOutboundActivity);
+        },
+        getOutboundActivity(activityId) {
+            const row = statements.outboundActivityById.get(activityId);
+            return row === undefined ? undefined : toOutboundActivity(row);
+        },
+        putOutboundActivity(activity) {
+            const row = statements.putOutboundActivity.get(activity.activityId, activity.activityType, activity.objectId, activity.slug, activity.createdAt ?? new Date().toISOString(), activity.json);
+            if (row === undefined) {
+                throw new Error(`The activity "${activity.activityId}" was not written to the outbox log.`);
+            }
+            return toOutboundActivity(row);
+        },
+        recordDelivery(delivery) {
+            const row = statements.recordDelivery.get(delivery.activityId, delivery.actorId, delivery.inboxId, delivery.status, delivery.error, delivery.attemptedAt ?? new Date().toISOString());
+            if (row === undefined) {
+                throw new Error(`The delivery of "${delivery.activityId}" to "${delivery.actorId}" was not recorded.`);
+            }
+            return toDelivery(row);
+        },
+        listDeliveries(activityId) {
+            const rows = statements.listDeliveries.all(activityId);
+            return rows.map(toDelivery);
+        },
+        countDeliveriesByStatus(activityId) {
+            const counts = { sent: 0, queued: 0, failed: 0 };
+            for (const row of statements.countDeliveriesByStatus.all(activityId)) {
+                const status = deliveryStatus(row['status']);
+                counts[status] += Number(row['count'] ?? 0);
+            }
+            return counts;
+        },
+        pruneSessions(now = new Date()) {
+            return Number(statements.pruneSessions.run(now.toISOString()).changes);
+        },
+        countSettings() {
+            const row = statements.countSettings.get();
+            return Number(row?.['count'] ?? 0);
+        },
+        allSettings() {
+            const settings = {};
+            for (const row of statements.allSettings.all()) {
+                settings[String(row['key'])] = String(row['value']);
+            }
+            return settings;
+        },
+        setSettings(values) {
+            const updatedAt = new Date().toISOString();
+            // One transaction, so a save that fails half way through leaves the
+            // stored settings as they were rather than as a mixture of two versions.
+            db.exec('BEGIN');
+            try {
+                for (const [key, value] of Object.entries(values)) {
+                    statements.putSetting.run(key, value, updatedAt);
+                }
+                db.exec('COMMIT');
+            }
+            catch (error) {
+                db.exec('ROLLBACK');
+                throw error;
+            }
+        },
+        pushFlash(sessionId, entry) {
+            const queued = [...readFlash(sessionId), entry];
+            statements.writeFlash.run(JSON.stringify(queued), sessionId);
+        },
+        takeFlash(sessionId) {
+            const queued = readFlash(sessionId);
+            // The clear runs whether or not anything was queued; a row whose column
+            // is already null costs one write and stays simple.
+            statements.writeFlash.run(null, sessionId);
+            return queued;
+        },
+        close() {
+            if (!open)
+                return;
+            open = false;
+            db.close();
+        },
+    };
+}
+/**
+ * A well-formed hash of a password nobody has, verified against when the
+ * username is unknown so that both failures cost the same.
+ */
+const DUMMY_HASH = hashPassword('a password no user has, hashed once so that verification is constant time');
+function isFlashMessage(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const entry = value;
+    return ((entry['kind'] === 'notice' || entry['kind'] === 'error') &&
+        typeof entry['message'] === 'string');
+}
+/**
+ * What a `LIMIT` means when the caller named none. SQLite reads a negative
+ * limit as "every row", which is what an unpaged list asks for.
+ */
+const NO_LIMIT = -1;
+/**
+ * A `TEXT` column that may be `NULL`, as a string or `null`.
+ *
+ * Anything that is not text is read as `null` rather than stringified: every
+ * column this is used on is declared `TEXT`, so a value of another shape is a
+ * row somebody else wrote, and `[object Object]` is a worse answer than none.
+ */
+function nullableText(value) {
+    return typeof value === 'string' ? value : null;
+}
+function toFollower(row) {
+    return {
+        actorId: String(row['actor_id']),
+        inboxId: String(row['inbox_id']),
+        sharedInboxId: nullableText(row['shared_inbox_id']),
+        handle: nullableText(row['handle']),
+        name: nullableText(row['name']),
+        iconUrl: nullableText(row['icon_url']),
+        url: nullableText(row['url']),
+        followedAt: String(row['followed_at']),
+    };
+}
+function toInboxActivity(row) {
+    return {
+        id: Number(row['id']),
+        activityId: nullableText(row['activity_id']),
+        activityType: String(row['activity_type']),
+        actorId: String(row['actor_id']),
+        objectId: nullableText(row['object_id']),
+        receivedAt: String(row['received_at']),
+        json: String(row['json']),
+    };
+}
+function toOutboundActivity(row) {
+    return {
+        activityId: String(row['activity_id']),
+        activityType: String(row['activity_type']),
+        objectId: String(row['object_id']),
+        slug: nullableText(row['slug']),
+        createdAt: String(row['created_at']),
+        json: String(row['json']),
+    };
+}
+function toDelivery(row) {
+    return {
+        activityId: String(row['activity_id']),
+        actorId: String(row['actor_id']),
+        inboxId: String(row['inbox_id']),
+        status: deliveryStatus(row['status']),
+        error: nullableText(row['error']),
+        attemptedAt: String(row['attempted_at']),
+    };
+}
+/**
+ * A stored status, or `failed` for one this version does not know.
+ *
+ * An unreadable status is reported as the pessimistic one: an admin screen
+ * showing a delivery as failed when it was not is a nuisance, and showing one
+ * as sent when nobody knows is a lie.
+ */
+function deliveryStatus(value) {
+    return DELIVERY_STATUSES.includes(value) ? value : 'failed';
+}
+function toSession(row) {
+    const userId = row['user_id'];
+    return {
+        id: String(row['id']),
+        userId: userId === null || userId === undefined ? null : Number(userId),
+        csrfToken: String(row['csrf_token']),
+        createdAt: String(row['created_at']),
+        expiresAt: String(row['expires_at']),
+    };
+}
+/** 256 unguessable bits, hex encoded. Session ids and CSRF tokens are both this. */
+function randomToken() {
+    return randomBytes(SESSION_ID_BYTES).toString('hex');
+}
+function isUniqueViolation(error) {
+    return error instanceof Error && /UNIQUE constraint failed/i.test(error.message);
+}
+/**
+ * Schema versions for the admin tables, applied in order. They keep their own
+ * ledger so their numbering never collides with the content index's.
+ *
+ * Never edit a migration that has shipped; append a new one.
+ */
+const MIGRATIONS = [
+    {
+        version: 1,
+        sql: `
+      CREATE TABLE users (
+        id            INTEGER PRIMARY KEY AUTOINCREMENT,
+        username      TEXT NOT NULL,
+        password_hash TEXT NOT NULL,
+        created_at    TEXT NOT NULL
+      );
+
+      CREATE UNIQUE INDEX users_username ON users (username);
+
+      CREATE TABLE sessions (
+        id         TEXT PRIMARY KEY,
+        user_id    INTEGER REFERENCES users (id) ON DELETE CASCADE,
+        csrf_token TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        expires_at TEXT NOT NULL
+      );
+
+      CREATE INDEX sessions_expires_at ON sessions (expires_at);
+      CREATE INDEX sessions_user_id ON sessions (user_id);
+    `,
+    },
+    {
+        // Flash messages: a JSON array of {kind, message}, queued by the request
+        // that redirects and cleared by the one that renders them. They hang off
+        // the session rather than a cookie so they cannot be forged or replayed,
+        // and so they go when the session does.
+        version: 2,
+        sql: `ALTER TABLE sessions ADD COLUMN flash TEXT`,
+    },
+    {
+        // Site settings: doc-1's "data that lives only in SQLite", mirrored to
+        // content/_data/site.json on every save. Key and value rather than one
+        // row per site, so the federation settings M3 adds cost a row rather than
+        // a migration each.
+        version: 3,
+        sql: `
+      CREATE TABLE settings (
+        key        TEXT PRIMARY KEY,
+        value      TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      );
+    `,
+    },
+    {
+        // The site actor's signing keys (doc-4). They are generated on the first
+        // boot that federates and never again: an actor whose key changes is an
+        // actor every follower has to re-verify, so this is the one table in the
+        // database that a site really cannot afford to lose. Keyed by identifier
+        // rather than by handle, so renaming `@blog@example.com` keeps the keys.
+        version: 4,
+        sql: `
+      CREATE TABLE actor_keys (
+        identifier  TEXT NOT NULL,
+        algorithm   TEXT NOT NULL,
+        private_jwk TEXT NOT NULL,
+        public_jwk  TEXT NOT NULL,
+        created_at  TEXT NOT NULL,
+        PRIMARY KEY (identifier, algorithm)
+      );
+    `,
+    },
+    {
+        // The site's followers (doc-4). Fedify's KV store is a cache and may be
+        // thrown away; a follower may not, because an actor that followed and was
+        // forgotten simply stops hearing from the site. Keyed by actor id, which
+        // is what a `Follow`, an `Undo(Follow)` and an actor's own `Delete` all
+        // name, so all three find the same row.
+        version: 5,
+        sql: `
+      CREATE TABLE followers (
+        actor_id        TEXT PRIMARY KEY,
+        inbox_id        TEXT NOT NULL,
+        shared_inbox_id TEXT,
+        handle          TEXT,
+        name            TEXT,
+        icon_url        TEXT,
+        url             TEXT,
+        followed_at     TEXT NOT NULL
+      );
+
+      CREATE INDEX followers_followed_at ON followers (followed_at);
+    `,
+    },
+    {
+        // Inbound activities that are recorded rather than acted on: likes,
+        // boosts and replies, which a later phase surfaces. The raw JSON-LD is
+        // kept because what that phase wants out of an activity is not knowable
+        // yet. The unique index on the activity id is what makes a redelivery an
+        // update rather than a second like; SQLite counts NULLs as distinct, so
+        // an activity that arrived without an id is always its own row.
+        version: 6,
+        sql: `
+      CREATE TABLE ap_inbox (
+        id            INTEGER PRIMARY KEY AUTOINCREMENT,
+        activity_id   TEXT,
+        activity_type TEXT NOT NULL,
+        actor_id      TEXT NOT NULL,
+        object_id     TEXT,
+        received_at   TEXT NOT NULL,
+        json          TEXT NOT NULL
+      );
+
+      CREATE UNIQUE INDEX ap_inbox_activity_id ON ap_inbox (activity_id);
+      CREATE INDEX ap_inbox_received_at ON ap_inbox (received_at);
+      CREATE INDEX ap_inbox_actor_id ON ap_inbox (actor_id);
+    `,
+    },
+    {
+        // Outbound delivery (doc-4, decision-5). Two tables, because an activity
+        // is one thing and its fate at each follower is another: keeping the
+        // JSON-LD once rather than once per follower is what makes a redelivery to
+        // a thousand followers a single read, and one row per (activity, follower)
+        // is what lets the admin see which follower did not get it.
+        //
+        // The activity's own id is the key. It is derived from the post's object
+        // id — `#create`, `#update/{hash}`, `#delete/{time}` — so re-sending the
+        // same announcement updates the row it belongs to instead of writing a
+        // second one that says the same thing.
+        version: 7,
+        sql: `
+      CREATE TABLE ap_outbound (
+        activity_id   TEXT PRIMARY KEY,
+        activity_type TEXT NOT NULL,
+        object_id     TEXT NOT NULL,
+        slug          TEXT,
+        created_at    TEXT NOT NULL,
+        json          TEXT NOT NULL
+      );
+
+      CREATE INDEX ap_outbound_created_at ON ap_outbound (created_at);
+      CREATE INDEX ap_outbound_object_id ON ap_outbound (object_id);
+
+      CREATE TABLE ap_deliveries (
+        activity_id  TEXT NOT NULL REFERENCES ap_outbound (activity_id) ON DELETE CASCADE,
+        actor_id     TEXT NOT NULL,
+        inbox_id     TEXT NOT NULL,
+        status       TEXT NOT NULL,
+        error        TEXT,
+        attempted_at TEXT NOT NULL,
+        PRIMARY KEY (activity_id, actor_id)
+      );
+
+      CREATE INDEX ap_deliveries_attempted_at ON ap_deliveries (attempted_at);
+      CREATE INDEX ap_deliveries_status ON ap_deliveries (status);
+    `,
+    },
+];
+function migrate(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS admin_migrations (
+      version    INTEGER PRIMARY KEY,
+      applied_at TEXT NOT NULL
+    )
+  `);
+    const applied = new Set(db
+        .prepare('SELECT version FROM admin_migrations')
+        .all()
+        .map((row) => Number(row['version'])));
+    const record = db.prepare('INSERT INTO admin_migrations (version, applied_at) VALUES (?, ?)');
+    for (const migration of MIGRATIONS) {
+        if (applied.has(migration.version))
+            continue;
+        db.exec('BEGIN');
+        try {
+            db.exec(migration.sql);
+            record.run(migration.version, new Date().toISOString());
+            db.exec('COMMIT');
+        }
+        catch (error) {
+            db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+}
+//# sourceMappingURL=store.js.map