@takosjp/yurucommu-core 3.0.0

package/migrations/0003_activity_remote_object_edges.sql

@@ -0,0 +1,68 @@
+-- Activity records mirror ActivityPub payloads. actor_ap_id and object_ap_id
+-- can point at remote actors/objects, so they must remain plain AP-ID strings
+-- rather than local-table foreign keys.
+
+PRAGMA foreign_keys = OFF;
+
+CREATE TABLE IF NOT EXISTS activities (
+  ap_id TEXT PRIMARY KEY,
+  type TEXT NOT NULL,
+  actor_ap_id TEXT NOT NULL,
+  object_ap_id TEXT,
+  object_json TEXT,
+  target_ap_id TEXT,
+  raw_json TEXT NOT NULL,
+  direction TEXT,
+  processed INTEGER DEFAULT 0,
+  created_at TEXT DEFAULT (datetime('now'))
+);
+
+CREATE TABLE IF NOT EXISTS activities_new (
+  ap_id TEXT PRIMARY KEY,
+  type TEXT NOT NULL,
+  actor_ap_id TEXT NOT NULL,
+  object_ap_id TEXT,
+  object_json TEXT,
+  target_ap_id TEXT,
+  raw_json TEXT NOT NULL,
+  direction TEXT,
+  processed INTEGER NOT NULL DEFAULT 0,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+INSERT OR IGNORE INTO activities_new (
+  ap_id,
+  type,
+  actor_ap_id,
+  object_ap_id,
+  object_json,
+  target_ap_id,
+  raw_json,
+  direction,
+  processed,
+  created_at
+)
+SELECT
+  ap_id,
+  type,
+  actor_ap_id,
+  object_ap_id,
+  object_json,
+  target_ap_id,
+  raw_json,
+  direction,
+  COALESCE(processed, 0),
+  COALESCE(created_at, datetime('now'))
+FROM activities;
+
+DROP TABLE activities;
+ALTER TABLE activities_new RENAME TO activities;
+
+CREATE INDEX IF NOT EXISTS idx_activities_actor ON activities(actor_ap_id);
+CREATE INDEX IF NOT EXISTS idx_activities_object ON activities(object_ap_id);
+CREATE INDEX IF NOT EXISTS idx_activities_type ON activities(type);
+CREATE INDEX IF NOT EXISTS idx_activities_type_created ON activities(type, created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_activities_direction_processed ON activities(direction, processed);
+CREATE INDEX IF NOT EXISTS idx_activities_direction_processed_created ON activities(direction, processed, created_at);
+
+PRAGMA foreign_keys = ON;

package/migrations/0004_blocklist.sql

@@ -0,0 +1,26 @@
+-- Blocklist tables for federation moderation.
+--
+-- `blocked_domains` blocks every actor whose AP-ID hostname matches.
+-- `blocked_actors` blocks an individual remote actor (and is the authoritative
+-- record consulted by inbox content handlers).
+--
+-- Both tables are read on every inbound activity, so each lookup column has
+-- its own index (PRIMARY KEY for the natural identifier covers the lookup).
+
+CREATE TABLE IF NOT EXISTS blocked_domains (
+  domain TEXT PRIMARY KEY,
+  reason TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_blocked_domains_created
+  ON blocked_domains(created_at);
+
+CREATE TABLE IF NOT EXISTS blocked_actors (
+  actor_ap_id TEXT PRIMARY KEY,
+  reason TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_blocked_actors_created
+  ON blocked_actors(created_at);

package/migrations/0005_story_community_scope.sql

@@ -0,0 +1,13 @@
+-- B0.3 — give Stories a community scope dimension.
+--
+-- Stories are stored in the shared `objects` table (type='Story'). That table
+-- already carries `community_ap_id` (added in 0001 for community-scoped posts),
+-- so no column change is required: a community story simply sets it, a personal
+-- story leaves it NULL.
+--
+-- The new read path filters active community stories by
+--   (type='Story' AND community_ap_id=? AND end_time>?)
+-- so add a covering index for it. Idempotent: re-applying is a no-op.
+
+CREATE INDEX IF NOT EXISTS idx_objects_type_community_end
+  ON objects(type, community_ap_id, end_time);

package/migrations/0006_dm_community_read_status.sql

@@ -0,0 +1,19 @@
+-- Track per-viewer read position for community (group) chats so the DM contact
+-- list can show an unread badge for communities, mirroring `dm_read_status`
+-- for one-to-one DMs.
+--
+-- A row records the most recent moment `actor_ap_id` read messages in
+-- `community_ap_id`. Community unread = messages in the community published
+-- after `last_read_at` that the viewer did not author. Absence of a row means
+-- the viewer has never opened that community chat (treated as "read from epoch"
+-- on the read path so a brand-new join does not surface a stale badge — the
+-- contacts handler clamps the baseline to the join time). Idempotent.
+CREATE TABLE IF NOT EXISTS dm_community_read_status (
+  actor_ap_id TEXT NOT NULL,
+  community_ap_id TEXT NOT NULL,
+  last_read_at TEXT NOT NULL,
+  PRIMARY KEY (actor_ap_id, community_ap_id)
+);
+
+CREATE INDEX IF NOT EXISTS dm_community_read_status_actor_idx
+  ON dm_community_read_status(actor_ap_id);

package/migrations/0007_moderation_reports.sql

@@ -0,0 +1,22 @@
+-- Moderation reports for federation abuse handling.
+--
+-- Inbound `Flag` activities are persisted here so operators can review them
+-- via the moderation API instead of the report being lost to a log line.
+-- Rows are append-only at ingest; an operator marks a report handled by
+-- stamping `resolved_at`.
+
+CREATE TABLE IF NOT EXISTS reports (
+  id TEXT PRIMARY KEY,
+  reporter_ap_id TEXT NOT NULL,
+  target_ap_id TEXT,
+  content TEXT,
+  instance TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  resolved_at TEXT
+);
+
+CREATE INDEX IF NOT EXISTS reports_created_idx
+  ON reports(created_at);
+
+CREATE INDEX IF NOT EXISTS reports_resolved_idx
+  ON reports(resolved_at);

package/migrations/0008_actor_fields_aka.sql

@@ -0,0 +1,18 @@
+-- Mastodon-parity actor profile + account-migration fields.
+--
+-- `fields_json` holds the structured profile metadata rows (PropertyValue
+-- attachments) shown on a profile, stored as a JSON array of {name,value}.
+-- `also_known_as_json` holds the actor's declared aliases (other AP IDs the
+-- account claims), the prerequisite for an incoming Move that points here.
+-- `moved_to` records the target AP ID once this actor has migrated away; when
+-- set it is emitted as `movedTo` on the served actor document so remote
+-- servers can follow the Move.
+--
+-- All three default to portable, federation-safe values: empty arrays and a
+-- NULL (not yet moved) target.
+
+ALTER TABLE actors ADD COLUMN fields_json TEXT NOT NULL DEFAULT '[]';
+
+ALTER TABLE actors ADD COLUMN also_known_as_json TEXT NOT NULL DEFAULT '[]';
+
+ALTER TABLE actors ADD COLUMN moved_to TEXT;

package/migrations/0009_object_tags.sql

@@ -0,0 +1,13 @@
+-- Object-level ActivityPub `tag` array (Mentions, etc.).
+--
+-- Wave 1 made the outbound `Create` carry a `Mention` tag, but the served
+-- object at `GET /ap/objects/:id` could not emit `tag` because the `objects`
+-- table had no column for it (mentions lived only in the outbound Create's
+-- `activities.rawJson`). Persist the computed Mention tag array onto the
+-- object row so the object can be served faithfully (`tag` round-trips).
+--
+-- Stored as the JSON-encoded array of `{ type, href, name }` tag entries that
+-- also goes on the Create; defaults to an empty array for posts with no tags
+-- and for legacy rows created before this column existed.
+
+ALTER TABLE objects ADD COLUMN tags_json TEXT NOT NULL DEFAULT '[]';

package/migrations/0010_object_recipients_drop_actor_fk.sql

@@ -0,0 +1,34 @@
+-- 0010: object_recipients.recipient_ap_id must NOT reference actors(ap_id).
+--
+-- object_recipients addresses an object to a recipient that is EITHER an actor
+-- (direct messages) OR a community (group-chat audience). The group-chat reader
+-- GET /api/communities/:id/messages selects rows where
+--   recipient_ap_id = community.apId AND type = 'audience'
+-- so a community apId is a legitimate recipient value. But a community is not an
+-- actor, so the original `REFERENCES actors(ap_id)` foreign key made every
+-- community group-chat send fail with a foreign-key violation (HTTP 500) on
+-- Cloudflare D1, where foreign keys are enforced. (The send handler tried to
+-- "bypass" the FK with raw SQL, which does not actually bypass enforcement.)
+--
+-- Rebuild the table keeping the objects FK (a recipient row always references a
+-- real object) + primary key + recipient index, dropping only the spurious
+-- actors FK. This matches the Drizzle schema, which already declares no FK on
+-- recipient_ap_id (the FK was schema drift inherited from 0001_init.sql).
+
+CREATE TABLE object_recipients_new (
+  object_ap_id TEXT NOT NULL REFERENCES objects(ap_id) ON DELETE CASCADE,
+  recipient_ap_id TEXT NOT NULL,
+  type TEXT NOT NULL,
+  created_at TEXT DEFAULT (datetime('now')),
+  PRIMARY KEY (object_ap_id, recipient_ap_id)
+);
+
+INSERT INTO object_recipients_new (object_ap_id, recipient_ap_id, type, created_at)
+  SELECT object_ap_id, recipient_ap_id, type, created_at FROM object_recipients;
+
+DROP TABLE object_recipients;
+
+ALTER TABLE object_recipients_new RENAME TO object_recipients;
+
+CREATE INDEX IF NOT EXISTS idx_object_recipients_recipient
+  ON object_recipients(recipient_ap_id, created_at DESC);

package/migrations/0011_drop_remote_actor_fks.sql

@@ -0,0 +1,205 @@
+-- 0011: drop the stale `REFERENCES actors(ap_id)` foreign keys that block
+-- INBOUND federation, WITHOUT cascade-deleting child rows.
+--
+-- Remote actors live ONLY in `actor_cache`, never in `actors`. The inbound
+-- handlers store a remote actor's Note in `objects` (attributed_to = remote),
+-- their Like in `likes`, their Announce in `announces`, story interactions in
+-- `story_*`, and the raw activity in `inbox` — all keyed by a remote actor that
+-- is absent from `actors`. 0001_init.sql declared these columns with
+-- `REFERENCES actors(ap_id)`; 0002/0003 stripped the equivalent FKs from
+-- follows/blocks/mutes/activities but missed these tables. Cloudflare D1
+-- ENFORCES foreign keys (the "D1 ignores FK" assumption is wrong), so every
+-- inbound remote post/like/boost/story insert fails with a foreign-key
+-- violation. The Drizzle schema declares NO foreign keys at all.
+--
+-- CRITICAL ordering: `objects` is referenced by likes / announces / bookmarks /
+-- object_recipients / story_views / story_votes / story_shares with
+-- `ON DELETE CASCADE`. On D1 (which will not honour `PRAGMA foreign_keys=OFF`)
+-- a DROP of `objects` performs an implicit DELETE that FIRES those cascades and
+-- wipes the child rows. So every child is rebuilt FIRST to drop its FK to
+-- `objects` (and its actor FK), and only then is `objects` itself rebuilt — by
+-- which point no surviving table has a cascade edge into it. All row data is
+-- copied through every rebuild. This matches the Drizzle schema (zero FKs);
+-- application code already manages cascades (routes/posts/delete-cascade.ts).
+
+PRAGMA defer_foreign_keys = TRUE;
+
+-- ---- children of objects: rebuilt first, dropping ALL their FKs ----
+
+-- likes
+CREATE TABLE likes_new (
+  actor_ap_id TEXT NOT NULL,
+  object_ap_id TEXT NOT NULL,
+  activity_ap_id TEXT,
+  created_at TEXT DEFAULT (datetime('now')),
+  PRIMARY KEY (actor_ap_id, object_ap_id)
+);
+INSERT INTO likes_new (actor_ap_id, object_ap_id, activity_ap_id, created_at)
+  SELECT actor_ap_id, object_ap_id, activity_ap_id, created_at FROM likes;
+DROP TABLE likes;
+ALTER TABLE likes_new RENAME TO likes;
+CREATE INDEX idx_likes_object ON likes(object_ap_id);
+CREATE INDEX idx_likes_actor ON likes(actor_ap_id);
+CREATE INDEX idx_likes_actor_object ON likes(actor_ap_id, object_ap_id);
+
+-- announces
+CREATE TABLE announces_new (
+  actor_ap_id TEXT NOT NULL,
+  object_ap_id TEXT NOT NULL,
+  activity_ap_id TEXT,
+  created_at TEXT DEFAULT (datetime('now')),
+  PRIMARY KEY (actor_ap_id, object_ap_id)
+);
+INSERT INTO announces_new (actor_ap_id, object_ap_id, activity_ap_id, created_at)
+  SELECT actor_ap_id, object_ap_id, activity_ap_id, created_at FROM announces;
+DROP TABLE announces;
+ALTER TABLE announces_new RENAME TO announces;
+CREATE INDEX idx_announces_object ON announces(object_ap_id);
+CREATE INDEX idx_announces_actor ON announces(actor_ap_id);
+CREATE INDEX idx_announces_actor_object ON announces(actor_ap_id, object_ap_id);
+
+-- bookmarks
+CREATE TABLE bookmarks_new (
+  actor_ap_id TEXT NOT NULL,
+  object_ap_id TEXT NOT NULL,
+  created_at TEXT DEFAULT (datetime('now')),
+  PRIMARY KEY (actor_ap_id, object_ap_id)
+);
+INSERT INTO bookmarks_new (actor_ap_id, object_ap_id, created_at)
+  SELECT actor_ap_id, object_ap_id, created_at FROM bookmarks;
+DROP TABLE bookmarks;
+ALTER TABLE bookmarks_new RENAME TO bookmarks;
+CREATE INDEX idx_bookmarks_actor ON bookmarks(actor_ap_id);
+
+-- story_views
+CREATE TABLE story_views_new (
+  actor_ap_id TEXT NOT NULL,
+  story_ap_id TEXT NOT NULL,
+  viewed_at TEXT DEFAULT (datetime('now')),
+  PRIMARY KEY (actor_ap_id, story_ap_id)
+);
+INSERT INTO story_views_new (actor_ap_id, story_ap_id, viewed_at)
+  SELECT actor_ap_id, story_ap_id, viewed_at FROM story_views;
+DROP TABLE story_views;
+ALTER TABLE story_views_new RENAME TO story_views;
+CREATE INDEX idx_story_views_actor ON story_views(actor_ap_id);
+CREATE INDEX idx_story_views_story ON story_views(story_ap_id);
+
+-- story_votes
+CREATE TABLE story_votes_new (
+  id TEXT PRIMARY KEY,
+  story_ap_id TEXT NOT NULL,
+  actor_ap_id TEXT NOT NULL,
+  option_index INTEGER NOT NULL,
+  created_at TEXT DEFAULT (datetime('now')),
+  UNIQUE(story_ap_id, actor_ap_id)
+);
+INSERT INTO story_votes_new (id, story_ap_id, actor_ap_id, option_index, created_at)
+  SELECT id, story_ap_id, actor_ap_id, option_index, created_at FROM story_votes;
+DROP TABLE story_votes;
+ALTER TABLE story_votes_new RENAME TO story_votes;
+CREATE INDEX idx_story_votes_story ON story_votes(story_ap_id);
+CREATE INDEX idx_story_votes_actor ON story_votes(actor_ap_id);
+
+-- story_shares
+CREATE TABLE story_shares_new (
+  id TEXT PRIMARY KEY,
+  story_ap_id TEXT NOT NULL,
+  actor_ap_id TEXT NOT NULL,
+  shared_at TEXT DEFAULT (datetime('now')),
+  UNIQUE(story_ap_id, actor_ap_id)
+);
+INSERT INTO story_shares_new (id, story_ap_id, actor_ap_id, shared_at)
+  SELECT id, story_ap_id, actor_ap_id, shared_at FROM story_shares;
+DROP TABLE story_shares;
+ALTER TABLE story_shares_new RENAME TO story_shares;
+CREATE INDEX idx_story_shares_story ON story_shares(story_ap_id);
+CREATE INDEX idx_story_shares_actor ON story_shares(actor_ap_id);
+
+-- object_recipients (0010 already dropped its actors FK; drop the objects FK too
+-- so it is not a cascade edge into objects)
+CREATE TABLE object_recipients_new (
+  object_ap_id TEXT NOT NULL,
+  recipient_ap_id TEXT NOT NULL,
+  type TEXT NOT NULL,
+  created_at TEXT DEFAULT (datetime('now')),
+  PRIMARY KEY (object_ap_id, recipient_ap_id)
+);
+INSERT INTO object_recipients_new (object_ap_id, recipient_ap_id, type, created_at)
+  SELECT object_ap_id, recipient_ap_id, type, created_at FROM object_recipients;
+DROP TABLE object_recipients;
+ALTER TABLE object_recipients_new RENAME TO object_recipients;
+CREATE INDEX idx_object_recipients_recipient
+  ON object_recipients(recipient_ap_id, created_at DESC);
+
+-- ---- objects: rebuilt last, now that no surviving table cascades into it ----
+-- drop attributed_to -> actors; keep community_ap_id -> communities.
+CREATE TABLE objects_new (
+  ap_id TEXT PRIMARY KEY,
+  type TEXT NOT NULL DEFAULT 'Note',
+  attributed_to TEXT NOT NULL,
+  content TEXT NOT NULL DEFAULT '',
+  summary TEXT,
+  attachments_json TEXT DEFAULT '[]',
+  in_reply_to TEXT,
+  conversation TEXT,
+  visibility TEXT DEFAULT 'public',
+  to_json TEXT DEFAULT '[]',
+  cc_json TEXT DEFAULT '[]',
+  audience_json TEXT DEFAULT '[]',
+  community_ap_id TEXT REFERENCES communities(ap_id) ON DELETE SET NULL,
+  end_time TEXT,
+  like_count INTEGER DEFAULT 0,
+  reply_count INTEGER DEFAULT 0,
+  announce_count INTEGER DEFAULT 0,
+  share_count INTEGER DEFAULT 0,
+  published TEXT DEFAULT (datetime('now')),
+  updated TEXT,
+  is_local INTEGER DEFAULT 1,
+  raw_json TEXT,
+  deleted_at TEXT,
+  tags_json TEXT NOT NULL DEFAULT '[]'
+);
+INSERT INTO objects_new (
+  ap_id, type, attributed_to, content, summary, attachments_json, in_reply_to,
+  conversation, visibility, to_json, cc_json, audience_json, community_ap_id,
+  end_time, like_count, reply_count, announce_count, share_count, published,
+  updated, is_local, raw_json, deleted_at, tags_json
+)
+SELECT
+  ap_id, type, attributed_to, content, summary, attachments_json, in_reply_to,
+  conversation, visibility, to_json, cc_json, audience_json, community_ap_id,
+  end_time, like_count, reply_count, announce_count, share_count, published,
+  updated, is_local, raw_json, deleted_at, tags_json
+FROM objects;
+DROP TABLE objects;
+ALTER TABLE objects_new RENAME TO objects;
+CREATE INDEX idx_objects_attributed_to ON objects(attributed_to);
+CREATE INDEX idx_objects_in_reply_to ON objects(in_reply_to);
+CREATE INDEX idx_objects_community_ap_id ON objects(community_ap_id);
+CREATE INDEX idx_objects_published ON objects(published DESC);
+CREATE INDEX idx_objects_visibility ON objects(visibility);
+CREATE INDEX idx_objects_end_time ON objects(end_time);
+CREATE INDEX idx_objects_deleted_at ON objects(deleted_at);
+CREATE INDEX idx_objects_attributed_to_published ON objects(attributed_to, published DESC);
+CREATE INDEX idx_objects_visibility_published ON objects(visibility, published DESC);
+CREATE INDEX idx_objects_type_visibility_published ON objects(type, visibility, published DESC);
+CREATE INDEX idx_objects_conversation ON objects(conversation);
+CREATE INDEX idx_objects_community_published ON objects(community_ap_id, published DESC);
+CREATE INDEX idx_objects_is_local ON objects(is_local);
+CREATE INDEX idx_objects_type_community_end ON objects(type, community_ap_id, end_time);
+
+-- inbox: references activities (not objects); drop only the actors FK.
+CREATE TABLE inbox_new (
+  actor_ap_id TEXT NOT NULL,
+  activity_ap_id TEXT NOT NULL REFERENCES activities(ap_id) ON DELETE CASCADE,
+  read INTEGER DEFAULT 0,
+  created_at TEXT DEFAULT (datetime('now')),
+  PRIMARY KEY (actor_ap_id, activity_ap_id)
+);
+INSERT INTO inbox_new (actor_ap_id, activity_ap_id, read, created_at)
+  SELECT actor_ap_id, activity_ap_id, read, created_at FROM inbox;
+DROP TABLE inbox;
+ALTER TABLE inbox_new RENAME TO inbox;
+CREATE INDEX idx_inbox_actor_read ON inbox(actor_ap_id, read, created_at DESC);
+CREATE INDEX idx_inbox_activity ON inbox(activity_ap_id);

package/migrations/0012_objects_content_fts.sql

@@ -0,0 +1,39 @@
+-- Full-text index for post-content search (GET /api/search/posts).
+--
+-- The content search used `content LIKE '%query%'`, a leading-wildcard scan of
+-- every object on each query. This adds an FTS5 index over objects.content using
+-- the `trigram` tokenizer, which (unlike the default unicode61) matches arbitrary
+-- substrings of spaceless CJK text — confirmed on D1 and the in-memory test
+-- engine. The route uses MATCH for queries >= 3 chars (trigram's minimum) and
+-- keeps LIKE only as a fallback for 1-2 char queries.
+--
+-- External-content table: the FTS index stores only the inverted index and reads
+-- the text back from `objects` by rowid, kept in sync by the trigger trio below
+-- (the canonical SQLite external-content pattern; DELETE/UPDATE use the special
+-- 'delete' command with the OLD content so the right terms are removed). All
+-- statements are idempotent so a direct re-apply is safe.
+
+CREATE VIRTUAL TABLE IF NOT EXISTS objects_fts USING fts5(
+  content,
+  content='objects',
+  content_rowid='rowid',
+  tokenize='trigram'
+);
+
+CREATE TRIGGER IF NOT EXISTS objects_fts_ai AFTER INSERT ON objects BEGIN
+  INSERT INTO objects_fts(rowid, content) VALUES (new.rowid, new.content);
+END;
+
+CREATE TRIGGER IF NOT EXISTS objects_fts_ad AFTER DELETE ON objects BEGIN
+  INSERT INTO objects_fts(objects_fts, rowid, content)
+    VALUES ('delete', old.rowid, old.content);
+END;
+
+CREATE TRIGGER IF NOT EXISTS objects_fts_au AFTER UPDATE OF content ON objects BEGIN
+  INSERT INTO objects_fts(objects_fts, rowid, content)
+    VALUES ('delete', old.rowid, old.content);
+  INSERT INTO objects_fts(rowid, content) VALUES (new.rowid, new.content);
+END;
+
+-- Backfill the index from existing rows (no-op on a fresh database).
+INSERT INTO objects_fts(objects_fts) VALUES ('rebuild');

package/migrations/0013_efficiency_indexes.sql

@@ -0,0 +1,13 @@
+-- Efficiency indexes (2026-06-22).
+
+-- Composite (conversation, published) so the ~4s-polled DM message reader
+-- (WHERE conversation = ? ORDER BY published DESC) reads in index order instead
+-- of filesorting the conversation's rows on every poll.
+CREATE INDEX IF NOT EXISTS objects_conversation_published_idx
+  ON objects (conversation, published);
+
+-- Mirror of follows_following_created_idx for the FOLLOWING-list direction
+-- (WHERE follower_ap_id = ? ORDER BY created_at) — previously only the followers
+-- direction (following_ap_id, created_at) had a created-at covering index.
+CREATE INDEX IF NOT EXISTS follows_follower_created_idx
+  ON follows (follower_ap_id, created_at);

package/migrations/0014_inbox_actor_created_idx.sql

@@ -0,0 +1,15 @@
+-- Notification-list index (2026-06-23).
+--
+-- GET /api/notifications (the most-polled endpoint — list + badge) drives from
+-- `inbox` with WHERE actor_ap_id = ? (no constraint on `read`) ORDER BY
+-- created_at DESC, activity_ap_id DESC. The only inbox index
+-- (actor_ap_id, read, created_at) cannot serve that ORDER BY: the unconstrained
+-- `read` column sits BETWEEN the equality prefix and the sort key, so SQLite can
+-- only use the actor_ap_id = prefix and must then FILESORT the matched rows
+-- (a near-full inbox scan + temp B-tree on every poll). The unread COUNT query
+-- (which DOES constrain read = 0) keeps using the existing index and is unaffected.
+--
+-- This composite covers the equality + both sort columns so the list query seeks
+-- by actor and reads in (created_at, activity_ap_id) order with no filesort.
+CREATE INDEX IF NOT EXISTS inbox_actor_created_idx
+  ON inbox (actor_ap_id, created_at, activity_ap_id);

package/migrations/0015_community_bans.sql

@@ -0,0 +1,16 @@
+-- Durable per-community bans. Removing a member only deleted their membership
+-- state, with no record — so a kicked user could immediately re-join an OPEN
+-- community (local re-POST /join, or a remote re-Follow that auto-Accepts). A
+-- ban row makes a removal stick: the local join route and the inbound Group
+-- Follow handler consult it, and explicit re-admission (approve / invite / add)
+-- clears it. No FK to actors (a banned actor may be REMOTE, with no local
+-- actors row — same rationale as the other remote-actor-referencing tables).
+CREATE TABLE IF NOT EXISTS community_bans (
+  community_ap_id TEXT NOT NULL,
+  banned_ap_id TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (community_ap_id, banned_ap_id)
+);
+
+CREATE INDEX IF NOT EXISTS community_bans_banned_idx
+  ON community_bans (banned_ap_id);

package/migrations/0016_namespace_takos_oidc_subject.sql

@@ -0,0 +1,19 @@
+-- DEEP round-2 #11: the `takos` OIDC subject was stored verbatim in
+-- actors.takos_user_id while every OTHER identity source is namespaced
+-- (password:owner, local:<name>, google:<id>, x:<id>). A trusted-but-
+-- misconfigured/compromised issuer that emitted a subject equal to a reserved
+-- key (e.g. "password:owner" / "local:tako") would resolve the OIDC
+-- get-or-create to that pre-existing higher-privileged account instead of
+-- provisioning a fresh actor. findOrCreateOAuthActor now stores the takos
+-- subject as "takos:<sub>"; prefix existing un-namespaced takos rows to match.
+--
+-- A takos row is any non-null takos_user_id that does NOT already carry a known
+-- namespace prefix. The "takos:" guard keeps this idempotent.
+UPDATE actors
+SET takos_user_id = 'takos:' || takos_user_id
+WHERE takos_user_id IS NOT NULL
+  AND takos_user_id NOT LIKE 'takos:%'
+  AND takos_user_id NOT LIKE 'password:%'
+  AND takos_user_id NOT LIKE 'local:%'
+  AND takos_user_id NOT LIKE 'google:%'
+  AND takos_user_id NOT LIKE 'x:%';

package/migrations/0017_mobile_push_registrations.sql

@@ -0,0 +1,22 @@
+CREATE TABLE IF NOT EXISTS mobile_push_registrations (
+  id TEXT PRIMARY KEY,
+  actor_ap_id TEXT NOT NULL,
+  product TEXT NOT NULL,
+  token TEXT NOT NULL,
+  token_hash TEXT NOT NULL,
+  environment TEXT NOT NULL DEFAULT 'production',
+  host_url TEXT,
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  last_seen_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  FOREIGN KEY (actor_ap_id) REFERENCES actors(ap_id) ON DELETE CASCADE
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS mobile_push_registrations_actor_product_token_idx
+  ON mobile_push_registrations(actor_ap_id, product, token_hash);
+
+CREATE INDEX IF NOT EXISTS mobile_push_registrations_actor_idx
+  ON mobile_push_registrations(actor_ap_id);
+
+CREATE INDEX IF NOT EXISTS mobile_push_registrations_last_seen_idx
+  ON mobile_push_registrations(last_seen_at);