@takosjp/yurucommu-core 3.0.0

package/src/backend/lib/auth-lockout.ts

@@ -0,0 +1,230 @@
+import type { IKeyValueStore } from "../runtime/types.ts";
+import { logger } from "./logger.ts";
+
+const log = logger.child({ component: "auth.lockout" });
+
+export interface LoginLockoutStatus {
+  locked: boolean;
+  failedAttempts: number;
+  retryAfterSeconds: number;
+}
+
+interface LoginLockoutRecord {
+  failedAttempts: number;
+  firstFailedAt: number;
+  lockoutUntil: number | null;
+}
+
+export const LOGIN_LOCKOUT_CONFIG = {
+  maxFailedAttempts: 5,
+  // How long a tripped lock holds.
+  lockoutMs: 15 * 60 * 1000,
+  // How long failed attempts accumulate toward the lock. This MUST be longer
+  // than lockoutMs: when it equalled lockoutMs (both 15m), a paced attacker who
+  // made <=4 failures then idled 15m got a fully-reset record (failedAttempts
+  // back to 0) and NEVER tripped the lock — repeatable forever, so the control
+  // contributed nothing against a low-and-slow brute force. A 60m window over a
+  // 5-attempt cap means idling no longer resets the counter, so the 5th failure
+  // within the hour actually engages the lock.
+  trackingWindowMs: 60 * 60 * 1000,
+} as const;
+
+const LOCKOUT_KEY_PREFIX = "auth-lockout:v1";
+const lockoutFallbackStore = new Map<string, LoginLockoutRecord>();
+
+function getLockoutStorageKey(clientKey: string): string {
+  return `${LOCKOUT_KEY_PREFIX}:${encodeURIComponent(clientKey)}`;
+}
+
+function isValidRecord(v: unknown): v is LoginLockoutRecord {
+  if (typeof v !== "object" || v === null) return false;
+  const entry = v as Record<string, unknown>;
+  return (
+    typeof entry.failedAttempts === "number" &&
+    typeof entry.firstFailedAt === "number" &&
+    (entry.lockoutUntil === null || typeof entry.lockoutUntil === "number")
+  );
+}
+
+function parseLockoutRecord(raw: string | null): LoginLockoutRecord | null {
+  if (!raw) return null;
+
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    return isValidRecord(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+function isRecordExpired(record: LoginLockoutRecord, now: number): boolean {
+  if (record.lockoutUntil !== null && record.lockoutUntil <= now) return true;
+  if (now - record.firstFailedAt > LOGIN_LOCKOUT_CONFIG.trackingWindowMs) {
+    return true;
+  }
+  return false;
+}
+
+function normalizeLockoutRecord(
+  record: LoginLockoutRecord | null,
+  now: number,
+): LoginLockoutRecord | null {
+  if (!record) return null;
+  return isRecordExpired(record, now) ? null : record;
+}
+
+const UNLOCKED_STATUS: LoginLockoutStatus = Object.freeze({
+  locked: false,
+  failedAttempts: 0,
+  retryAfterSeconds: 0,
+});
+
+function toStatus(
+  record: LoginLockoutRecord | null,
+  now: number,
+): LoginLockoutStatus {
+  if (!record) return UNLOCKED_STATUS;
+
+  const locked = record.lockoutUntil !== null && record.lockoutUntil > now;
+  return {
+    locked,
+    failedAttempts: record.failedAttempts,
+    retryAfterSeconds: locked
+      ? Math.max(1, Math.ceil((record.lockoutUntil! - now) / 1000))
+      : 0,
+  };
+}
+
+function fallbackRead(
+  storageKey: string,
+  now: number,
+): LoginLockoutRecord | null {
+  const record = normalizeLockoutRecord(
+    lockoutFallbackStore.get(storageKey) || null,
+    now,
+  );
+  if (!record) {
+    lockoutFallbackStore.delete(storageKey);
+  }
+  return record;
+}
+
+function fallbackWrite(storageKey: string, record: LoginLockoutRecord): void {
+  lockoutFallbackStore.set(storageKey, record);
+}
+
+async function readRecord(
+  kv: IKeyValueStore,
+  storageKey: string,
+  now: number,
+): Promise<LoginLockoutRecord | null> {
+  try {
+    const raw = await kv.get(storageKey);
+    const record = normalizeLockoutRecord(parseLockoutRecord(raw), now);
+    if (!record) {
+      await kv.delete(storageKey);
+    }
+    return record;
+  } catch (err) {
+    log.warn("Failed to read login lockout from KV, using local fallback", {
+      event: "auth.lockout.kv_read_failed",
+      error: err,
+    });
+    return fallbackRead(storageKey, now);
+  }
+}
+
+async function writeRecord(
+  kv: IKeyValueStore,
+  storageKey: string,
+  record: LoginLockoutRecord,
+  now: number,
+): Promise<void> {
+  const ttlMs = record.lockoutUntil
+    ? record.lockoutUntil - now
+    : LOGIN_LOCKOUT_CONFIG.trackingWindowMs - (now - record.firstFailedAt);
+  const expirationTtl = Math.max(60, Math.ceil(ttlMs / 1000) + 60);
+
+  try {
+    await kv.put(storageKey, JSON.stringify(record), { expirationTtl });
+  } catch (err) {
+    log.warn("Failed to write login lockout to KV, using local fallback", {
+      event: "auth.lockout.kv_write_failed",
+      error: err,
+    });
+    fallbackWrite(storageKey, record);
+  }
+}
+
+async function deleteRecord(
+  kv: IKeyValueStore,
+  storageKey: string,
+): Promise<void> {
+  lockoutFallbackStore.delete(storageKey);
+  try {
+    await kv.delete(storageKey);
+  } catch (err) {
+    log.warn("Failed to clear login lockout from KV", {
+      event: "auth.lockout.kv_delete_failed",
+      error: err,
+    });
+  }
+}
+
+export async function getLoginLockoutStatus(
+  kv: IKeyValueStore,
+  clientKey: string,
+  now = Date.now(),
+): Promise<LoginLockoutStatus> {
+  const storageKey = getLockoutStorageKey(clientKey);
+  const record = await readRecord(kv, storageKey, now);
+  return toStatus(record, now);
+}
+
+export async function recordFailedLoginAttempt(
+  kv: IKeyValueStore,
+  clientKey: string,
+  now = Date.now(),
+): Promise<LoginLockoutStatus> {
+  const storageKey = getLockoutStorageKey(clientKey);
+  const existing = await readRecord(kv, storageKey, now);
+
+  // Already locked out -- return current status without extending
+  if (
+    existing?.lockoutUntil !== null &&
+    existing?.lockoutUntil !== undefined &&
+    existing.lockoutUntil > now
+  ) {
+    return toStatus(existing, now);
+  }
+
+  // CONCURRENCY NOTE (accepted, bounded): this read-then-write of the KV record
+  // is not atomic — KV has no atomic increment and is eventually consistent — so
+  // many SIMULTANEOUS failed logins can lose increments (last-writer-wins),
+  // letting an attacker who fires concurrent attempts squeeze a few extra tries
+  // in before the lockout trips. The lockout still triggers; the race only
+  // slightly delays it within a narrow window. A strongly-atomic counter needs a
+  // Durable Object or the Workers Rate Limiting API; adopting one is the correct
+  // upgrade if brute-force pressure ever warrants it, but is out of scope for the
+  // current KV-backed control.
+  const failedAttempts = (existing?.failedAttempts ?? 0) + 1;
+  const firstFailedAt = existing?.firstFailedAt ?? now;
+  const shouldLock = failedAttempts >= LOGIN_LOCKOUT_CONFIG.maxFailedAttempts;
+
+  const next: LoginLockoutRecord = {
+    failedAttempts,
+    firstFailedAt,
+    lockoutUntil: shouldLock ? now + LOGIN_LOCKOUT_CONFIG.lockoutMs : null,
+  };
+
+  await writeRecord(kv, storageKey, next, now);
+  return toStatus(next, now);
+}
+
+export async function clearLoginLockout(
+  kv: IKeyValueStore,
+  clientKey: string,
+): Promise<void> {
+  const storageKey = getLockoutStorageKey(clientKey);
+  await deleteRecord(kv, storageKey);
+}

package/src/backend/lib/backend-paths.ts

@@ -0,0 +1,34 @@
+// Backend route prefixes (API, ActivityPub, well-known, nodeinfo, media, health,
+// tools, hosted). A request under one of these that reaches the static-asset /
+// SPA fallback means the backend router did NOT match it — that is a genuine
+// 404 for an API / AP / media client, NOT a candidate for the SPA HTML fallback
+// (which would return 200 text/html and break clients that expect JSON or an AP
+// document).
+//
+// This is the SINGLE source of truth shared by every runtime's static fallback
+// (the Bun BunAssets handler and the Cloudflare Workers `mountStaticFallback`),
+// so the two cannot diverge — they previously did: the Bun path guarded these
+// prefixes while the Cloudflare path forwarded everything to ASSETS, so an
+// unmatched /api/* returned the SPA HTML shell (200) on the production worker.
+export const NON_SPA_PREFIXES = [
+  "/api",
+  "/ap",
+  "/.well-known",
+  "/nodeinfo",
+  "/media",
+  "/hosted",
+  "/.takos",
+  "/healthz",
+  "/readyz",
+] as const;
+
+/**
+ * True when `pathname` is under a backend route prefix — exact match or a
+ * `/prefix/...` child. Used to refuse the SPA HTML fallback for unmatched
+ * backend routes so they 404 (JSON) instead of returning the app shell.
+ */
+export function isBackendPath(pathname: string): boolean {
+  return NON_SPA_PREFIXES.some(
+    (p) => pathname === p || pathname.startsWith(p + "/"),
+  );
+}

package/src/backend/lib/base64.ts

@@ -0,0 +1,30 @@
+/**
+ * Base64 helpers shared by federation signing/verification paths.
+ *
+ * `bufferToBase64` walks the buffer in fixed-size chunks rather than spreading
+ * the whole `Uint8Array` into `String.fromCharCode(...)`. The spread form
+ * throws a "Maximum call stack size exceeded" RangeError once the buffer is
+ * large enough (the spread becomes one argument per byte), so the chunked loop
+ * is the stack-safe variant for arbitrary-size inputs.
+ */
+export function bufferToBase64(buffer: ArrayBuffer): string {
+  const bytes = new Uint8Array(buffer);
+  const chunkSize = 8192;
+  let binary = "";
+  for (let i = 0; i < bytes.length; i += chunkSize) {
+    const chunk = bytes.subarray(i, Math.min(i + chunkSize, bytes.length));
+    for (const byte of chunk) {
+      binary += String.fromCharCode(byte);
+    }
+  }
+  return btoa(binary);
+}
+
+export function base64ToBytes(value: string): Uint8Array {
+  const binary = atob(value);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}

package/src/backend/lib/blocklist-purge.ts

@@ -0,0 +1,109 @@
+import { eq, inArray, like, or } from "drizzle-orm";
+import { activities, objects } from "../../db/index.ts";
+import type { Database } from "../../db/index.ts";
+import type { IObjectStorage } from "../runtime/types.ts";
+import { chunkForInClause } from "./chunk.ts";
+import { normalizeDomain } from "./blocklist.ts";
+import {
+  deleteObjectCascade,
+  purgeMediaBlobs,
+} from "../routes/posts/delete-cascade.ts";
+import { logger } from "./logger.ts";
+
+const log = logger.child({ component: "blocklist" });
+
+// Hard-delete a set of objects (with their child cascade + R2 blobs). Shared by
+// the actor / domain purge below. apIds are EXACTLY the objects to remove.
+async function purgeObjects(
+  db: Database,
+  apIds: string[],
+  media?: IObjectStorage,
+): Promise<void> {
+  if (apIds.length === 0) return;
+  const mediaKeys: string[] = [];
+  for (const apId of apIds) {
+    mediaKeys.push(...(await deleteObjectCascade(db, apId, media)));
+  }
+  for (const chunk of chunkForInClause(apIds)) {
+    await db.delete(objects).where(inArray(objects.apId, chunk));
+  }
+  await purgeMediaBlobs(media, mediaKeys);
+}
+
+/**
+ * Purge a blocked REMOTE actor's already-ingested content. The operator
+ * blocklist is otherwise ingest/delivery-only, so without this a defederated
+ * actor's prior posts/replies/stories stay live in timelines, search, and
+ * object serving — contradicting the operator's "they're gone" expectation.
+ * Removes the actor's authored objects (cascade) + their activity ledger rows.
+ * Best-effort; never throws into the operator's response path.
+ */
+export async function purgeActorContent(
+  db: Database,
+  blockedApId: string,
+  media?: IObjectStorage,
+): Promise<void> {
+  try {
+    const rows = await db
+      .select({ apId: objects.apId })
+      .from(objects)
+      .where(eq(objects.attributedTo, blockedApId));
+    await purgeObjects(
+      db,
+      rows.map((r) => r.apId),
+      media,
+    );
+    await db.delete(activities).where(eq(activities.actorApId, blockedApId));
+  } catch (err) {
+    log.warn("blocklist.purgeActorContent failed", {
+      event: "blocklist.purge_actor_failed",
+      actor: blockedApId,
+      error: err,
+    });
+  }
+}
+
+/**
+ * Purge already-ingested content authored by any actor on a blocked DOMAIN (the
+ * host itself OR a subdomain). Host-anchored LIKE so `evil.com` matches
+ * `https://evil.com/...` and `https://node1.evil.com/...` but NOT `notevil.com`.
+ * Best-effort. Local content is never matched (local objects carry the local
+ * host; the operator never blocks their own domain).
+ */
+export async function purgeDomainContent(
+  db: Database,
+  domainOrUrl: string,
+  media?: IObjectStorage,
+): Promise<void> {
+  const domain = normalizeDomain(domainOrUrl);
+  if (!domain) return;
+  try {
+    const hostMatch = or(
+      like(objects.attributedTo, `https://${domain}/%`),
+      like(objects.attributedTo, `https://%.${domain}/%`),
+    );
+    const rows = await db
+      .select({ apId: objects.apId })
+      .from(objects)
+      .where(hostMatch);
+    await purgeObjects(
+      db,
+      rows.map((r) => r.apId),
+      media,
+    );
+    await db
+      .delete(activities)
+      .where(
+        or(
+          like(activities.actorApId, `https://${domain}/%`),
+          like(activities.actorApId, `https://%.${domain}/%`),
+        ),
+      );
+  } catch (err) {
+    log.warn("blocklist.purgeDomainContent failed", {
+      event: "blocklist.purge_domain_failed",
+      domain,
+      error: err,
+    });
+  }
+}

package/src/backend/lib/blocklist.ts

@@ -0,0 +1,279 @@
+/**
+ * Federation moderation blocklist.
+ *
+ * Backed by two tables (`blocked_domains` and `blocked_actors`) populated by
+ * operators. Inbox content handlers consult both helpers at activity ingest
+ * so that blocked traffic is silently discarded (200/202 ACK, not 4xx) — a
+ * 4xx would cause sender instances to retry on a backoff, wasting their
+ * delivery budget and ours.
+ *
+ * The helpers return `false` when the underlying read fails so that a
+ * transient database error never causes federation traffic to be black-holed.
+ * Each call site logs the failure so that the operator can investigate.
+ */
+
+import { eq, inArray } from "drizzle-orm";
+
+import type { Database } from "../../db/index.ts";
+import { blockedActors, blockedDomains } from "../../db/index.ts";
+import { logger } from "./logger.ts";
+
+const log = logger.child({ component: "blocklist" });
+
+// Max ids per IN(...) lookup. Cloudflare D1 caps a query at 100 bound
+// parameters (libsql/better-sqlite3 — what the tests run on — allow ~32k, which
+// is why an over-large chunk passes CI but throws "too many SQL variables" on
+// production D1). Each chunk element binds one parameter, so keep this <=90 to
+// leave headroom: a large recipient set is queried in chunks rather than
+// throwing — and a throw here is swallowed by the fail-open catch below,
+// silently disabling the operator blocklist for the whole fan-out (a
+// defederation bypass we must not allow).
+const BLOCKLIST_IN_CHUNK = 90;
+
+/**
+ * Normalise an actor AP-ID hostname for blocklist lookups: lowercase and
+ * strip any trailing dot (DNS root form). Returns `null` when the input
+ * cannot be parsed.
+ */
+export function normalizeDomain(input: string): string | null {
+  try {
+    // Allow callers to pass either a bare hostname or a full URL.
+    const candidate = input.includes("://") ? new URL(input).hostname : input;
+    const trimmed = candidate.trim().replace(/\.$/, "").toLowerCase();
+    return trimmed.length > 0 ? trimmed : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The hostname plus each of its parent suffixes that has ≥2 labels, e.g.
+ * `a.b.attacker.net` → [`a.b.attacker.net`, `b.attacker.net`, `attacker.net`].
+ * A domain block must cover subdomains (the near-universal fediverse
+ * convention) — otherwise blocking `attacker.net` is trivially evaded by
+ * federating from `node1.attacker.net`. Bounded by the label count (index-
+ * friendly inArray), and excludes the bare TLD so a TLD is never an implied
+ * match. A single-label host (e.g. `localhost`) yields just itself.
+ */
+export function domainSuffixCandidates(domain: string): string[] {
+  const labels = domain.split(".");
+  const out: string[] = [];
+  for (let i = 0; i <= labels.length - 2; i++) {
+    out.push(labels.slice(i).join("."));
+  }
+  if (out.length === 0) out.push(domain);
+  return out;
+}
+
+/**
+ * Returns `true` when the operator has blocked the given hostname OR any parent
+ * domain of it. Accepts both bare hostnames (`example.org`) and full actor URLs.
+ */
+export async function isDomainBlocked(
+  db: Database,
+  hostnameOrUrl: string,
+): Promise<boolean> {
+  const domain = normalizeDomain(hostnameOrUrl);
+  if (!domain) return false;
+
+  try {
+    const row = await db.query.blockedDomains.findFirst({
+      where: inArray(blockedDomains.domain, domainSuffixCandidates(domain)),
+      columns: { domain: true },
+    });
+    return !!row;
+  } catch (err) {
+    log.warn("blocklist.isDomainBlocked failed", {
+      event: "blocklist.domain_lookup_failed",
+      domain,
+      error: err,
+    });
+    return false;
+  }
+}
+
+/**
+ * Returns `true` when the operator has blocked the given actor AP-ID, or
+ * (transitively) when the actor's hostname is blocked.
+ */
+export async function isActorBlocked(
+  db: Database,
+  actorApId: string,
+): Promise<boolean> {
+  if (typeof actorApId !== "string" || actorApId.length === 0) {
+    return false;
+  }
+
+  try {
+    const row = await db.query.blockedActors.findFirst({
+      where: eq(blockedActors.actorApId, actorApId),
+      columns: { actorApId: true },
+    });
+    if (row) return true;
+  } catch (err) {
+    log.warn("blocklist.isActorBlocked failed", {
+      event: "blocklist.actor_lookup_failed",
+      actor: actorApId,
+      error: err,
+    });
+    return false;
+  }
+
+  const domain = normalizeDomain(actorApId);
+  if (!domain) return false;
+  return await isDomainBlocked(db, domain);
+}
+
+/**
+ * Batched blocklist filter for a list of recipient actor AP-IDs: returns the
+ * SUBSET that is blocked (by actor OR transitively by hostname) using exactly
+ * two queries (blocked_actors + blocked_domains) instead of two-per-recipient.
+ * Replaces an O(recipients) serial `isActorBlocked` loop on the delivery
+ * fan-out hot path. Fail-open like the singular helpers: a read error yields an
+ * empty blocked set so a transient DB error never black-holes federation.
+ */
+export async function filterBlockedActorApIds(
+  db: Database,
+  actorApIds: string[],
+): Promise<Set<string>> {
+  const blocked = new Set<string>();
+  const uniqueIds = [...new Set(actorApIds.filter((id) => id.length > 0))];
+  if (uniqueIds.length === 0) return blocked;
+
+  try {
+    // Chunk the IN(...) lookups so a very large recipient set (e.g. a big
+    // community fan-out, tens of thousands of unique actors/domains) cannot
+    // exceed SQLite's bound-parameter ceiling and throw — which, under the
+    // fail-open catch below, would silently DISABLE the operator blocklist for
+    // that whole fan-out (a defederation bypass).
+    const blockedActorSet = new Set<string>();
+    for (let i = 0; i < uniqueIds.length; i += BLOCKLIST_IN_CHUNK) {
+      const rows = await db
+        .select({ actorApId: blockedActors.actorApId })
+        .from(blockedActors)
+        .where(
+          inArray(
+            blockedActors.actorApId,
+            uniqueIds.slice(i, i + BLOCKLIST_IN_CHUNK),
+          ),
+        );
+      for (const r of rows) blockedActorSet.add(r.actorApId);
+    }
+
+    // Expand each actor's hostname to its parent-domain candidates so a domain
+    // block covers subdomains (see domainSuffixCandidates) — querying the union
+    // of all candidates and matching an actor if ANY of its candidates is
+    // blocked.
+    const idToCandidates = new Map<string, string[]>();
+    const candidateUnion = new Set<string>();
+    for (const id of uniqueIds) {
+      const d = normalizeDomain(id);
+      const candidates = d ? domainSuffixCandidates(d) : [];
+      idToCandidates.set(id, candidates);
+      for (const c of candidates) candidateUnion.add(c);
+    }
+
+    const blockedDomainSet = new Set<string>();
+    const domainList = [...candidateUnion];
+    for (let i = 0; i < domainList.length; i += BLOCKLIST_IN_CHUNK) {
+      const blockedDomainRows = await db
+        .select({ domain: blockedDomains.domain })
+        .from(blockedDomains)
+        .where(
+          inArray(
+            blockedDomains.domain,
+            domainList.slice(i, i + BLOCKLIST_IN_CHUNK),
+          ),
+        );
+      for (const r of blockedDomainRows) blockedDomainSet.add(r.domain);
+    }
+
+    for (const id of uniqueIds) {
+      const candidates = idToCandidates.get(id) ?? [];
+      if (
+        blockedActorSet.has(id) ||
+        candidates.some((c) => blockedDomainSet.has(c))
+      ) {
+        blocked.add(id);
+      }
+    }
+  } catch (err) {
+    log.warn("blocklist.filterBlockedActorApIds failed", {
+      event: "blocklist.batch_lookup_failed",
+      error: err,
+    });
+    return new Set(); // fail-open
+  }
+  return blocked;
+}
+
+/**
+ * Insert (or update) a domain blocklist entry. Idempotent: re-blocking the
+ * same domain refreshes the recorded reason but keeps the original
+ * `created_at`.
+ */
+export async function blockDomain(
+  db: Database,
+  hostnameOrUrl: string,
+  reason: string | null,
+): Promise<void> {
+  const domain = normalizeDomain(hostnameOrUrl);
+  if (!domain) {
+    throw new Error(`blocklist.blockDomain: invalid input "${hostnameOrUrl}"`);
+  }
+
+  await db
+    .insert(blockedDomains)
+    .values({ domain, reason })
+    .onConflictDoUpdate({
+      target: blockedDomains.domain,
+      set: { reason },
+    });
+}
+
+/**
+ * Remove a domain from the blocklist. No-op when the domain was not blocked.
+ */
+export async function unblockDomain(
+  db: Database,
+  hostnameOrUrl: string,
+): Promise<void> {
+  const domain = normalizeDomain(hostnameOrUrl);
+  if (!domain) {
+    throw new Error(
+      `blocklist.unblockDomain: invalid input "${hostnameOrUrl}"`,
+    );
+  }
+  await db.delete(blockedDomains).where(eq(blockedDomains.domain, domain));
+}
+
+/**
+ * Insert (or update) an actor blocklist entry. Idempotent.
+ */
+export async function blockActor(
+  db: Database,
+  actorApId: string,
+  reason: string | null,
+): Promise<void> {
+  if (typeof actorApId !== "string" || actorApId.length === 0) {
+    throw new Error("blocklist.blockActor: actorApId is required");
+  }
+  await db
+    .insert(blockedActors)
+    .values({ actorApId, reason })
+    .onConflictDoUpdate({
+      target: blockedActors.actorApId,
+      set: { reason },
+    });
+}
+
+/**
+ * Remove an actor from the blocklist. No-op when the actor was not blocked.
+ */
+export async function unblockActor(
+  db: Database,
+  actorApId: string,
+): Promise<void> {
+  if (typeof actorApId !== "string" || actorApId.length === 0) return;
+  await db.delete(blockedActors).where(eq(blockedActors.actorApId, actorApId));
+}