@takosjp/yurucommu-core 3.0.0

package/src/backend/lib/delivery/types.ts

@@ -0,0 +1,139 @@
+export const DELIVERY_QUEUE_MESSAGE_VERSION = 1 as const;
+
+export type DeliveryFanoutFollowersMessageV1 = {
+  version: typeof DELIVERY_QUEUE_MESSAGE_VERSION;
+  type: "fanout_followers";
+  activityId: string;
+  followeeApId: string;
+  scheduledAt: string; // ISO8601 UTC
+};
+
+/**
+ * Fan-out of an activity to a community's audience (members + community
+ * followers) rather than the author's personal follower graph. Used for
+ * community-scoped posts so reach == community, not author-followers.
+ */
+export type DeliveryFanoutCommunityMessageV1 = {
+  version: typeof DELIVERY_QUEUE_MESSAGE_VERSION;
+  type: "fanout_community";
+  activityId: string;
+  communityApId: string;
+  // The Group's Announce of the post (Announce-relay): delivered to REMOTE
+  // community followers in place of the raw author activity, so the post is
+  // attributed to the group (Lemmy/Mobilizon convention). Local members still
+  // receive `activityId`. Absent for non-Create activities (edit/delete relay
+  // the activity directly).
+  announceActivityId?: string;
+  scheduledAt: string; // ISO8601 UTC
+};
+
+export type DeliveryResolveActorMessageV1 = {
+  version: typeof DELIVERY_QUEUE_MESSAGE_VERSION;
+  type: "resolve_actor";
+  activityId: string;
+  recipientActorApId: string;
+  // How many resolve attempts this message represents. Each failed actor fetch
+  // re-enqueues with attempts+1; the handler gives up at a cap so a permanently
+  // unresolvable recipient does not generate a queue message forever. Absent on
+  // the initial enqueue (treated as 0).
+  attempts?: number;
+  scheduledAt: string; // ISO8601 UTC
+};
+
+export type DeliveryDeliverEndpointMessageV1 = {
+  version: typeof DELIVERY_QUEUE_MESSAGE_VERSION;
+  type: "deliver_endpoint";
+  jobId: string;
+  // How many reconcile cycles this job has already been through. Carried in-band
+  // (deliver_endpoint -> dlq -> reconcile_job -> deliver_endpoint) so the
+  // reconcile loop has a DURABLE-across-attempts terminal condition without a DB
+  // column. Absent on the initial delivery (treated as 0).
+  reconcileAttempt?: number;
+  scheduledAt: string; // ISO8601 UTC
+};
+
+export type DeliveryReconcileJobMessageV1 = {
+  version: typeof DELIVERY_QUEUE_MESSAGE_VERSION;
+  type: "reconcile_job";
+  jobId: string;
+  reconcileAttempt: number;
+  scheduledAt: string; // ISO8601 UTC
+};
+
+export type DeliveryQueueMessageV1 =
+  | DeliveryFanoutFollowersMessageV1
+  | DeliveryFanoutCommunityMessageV1
+  | DeliveryResolveActorMessageV1
+  | DeliveryDeliverEndpointMessageV1
+  | DeliveryReconcileJobMessageV1;
+
+export type DeliveryDlqMessageV1 = {
+  version: typeof DELIVERY_QUEUE_MESSAGE_VERSION;
+  type: "dlq";
+  jobId: string;
+  activityId: string;
+  endpoint: string;
+  attempts: number;
+  lastError: string | null;
+  // The reconcile-cycle count carried from the deliver_endpoint that
+  // dead-lettered, so the DLQ consumer can stop reconciling once it hits the cap.
+  reconcileAttempt?: number;
+  deadLetteredAt: string; // ISO8601 UTC
+};
+
+export function isDeliveryQueueMessageV1(
+  value: unknown,
+): value is DeliveryQueueMessageV1 {
+  if (!value || typeof value !== "object") return false;
+  const v = value as Record<string, unknown>;
+  if (v.version !== DELIVERY_QUEUE_MESSAGE_VERSION) return false;
+  if (typeof v.type !== "string") return false;
+
+  switch (v.type) {
+    case "fanout_followers":
+      return (
+        typeof v.activityId === "string" &&
+        typeof v.followeeApId === "string" &&
+        typeof v.scheduledAt === "string"
+      );
+    case "fanout_community":
+      return (
+        typeof v.activityId === "string" &&
+        typeof v.communityApId === "string" &&
+        typeof v.scheduledAt === "string"
+      );
+    case "resolve_actor":
+      return (
+        typeof v.activityId === "string" &&
+        typeof v.recipientActorApId === "string" &&
+        typeof v.scheduledAt === "string"
+      );
+    case "deliver_endpoint":
+      return typeof v.jobId === "string" && typeof v.scheduledAt === "string";
+    case "reconcile_job":
+      return (
+        typeof v.jobId === "string" &&
+        typeof v.reconcileAttempt === "number" &&
+        typeof v.scheduledAt === "string"
+      );
+    default:
+      return false;
+  }
+}
+
+export function isDeliveryDlqMessageV1(
+  value: unknown,
+): value is DeliveryDlqMessageV1 {
+  if (!value || typeof value !== "object") return false;
+  const v = value as Record<string, unknown>;
+  return (
+    v.version === DELIVERY_QUEUE_MESSAGE_VERSION &&
+    v.type === "dlq" &&
+    typeof v.jobId === "string" &&
+    typeof v.activityId === "string" &&
+    typeof v.endpoint === "string" &&
+    typeof v.attempts === "number" &&
+    (v.lastError === null || typeof v.lastError === "string") &&
+    typeof v.deadLetteredAt === "string"
+  );
+}

package/src/backend/lib/errors.ts

@@ -0,0 +1,114 @@
+/**
+ * Standardized error handling for Yurucommu.
+ * All errors extend AppError with code, message, statusCode, and optional details.
+ */
+
+import { logger } from "./logger.ts";
+import { maskSensitiveData, maskSensitiveString } from "./log-mask.ts";
+
+const log = logger.child({ component: "errors" });
+
+const ErrorCodes = {
+  INTERNAL_ERROR: "INTERNAL_ERROR",
+  BAD_REQUEST: "BAD_REQUEST",
+} as const;
+
+export type ErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];
+
+// FLAT error envelope: `error` is the human-readable message STRING, matching
+// the ~357 per-route handlers (which all return `{ error: "..." }`) and the web
+// client parser (extractErrorMessage reads `data.error` as a string). A nested
+// `{ error: { code, message } }` here would render as "[object Object]" client-
+// side on every 500 / malformed-body 400. `code`/`correlation_id` ride alongside.
+interface ErrorResponse {
+  error: string;
+  code: string;
+  correlation_id?: string;
+  details?: unknown;
+}
+
+export class AppError extends Error {
+  public readonly code: ErrorCode;
+  public readonly statusCode: number;
+  public readonly details?: unknown;
+
+  constructor(
+    message: string,
+    code: ErrorCode = ErrorCodes.INTERNAL_ERROR,
+    statusCode = 500,
+    details?: unknown,
+  ) {
+    super(message);
+    this.name = this.constructor.name;
+    this.code = code;
+    this.statusCode = statusCode;
+    this.details = details;
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+
+  toResponse(): ErrorResponse {
+    return {
+      error: this.message,
+      code: this.code,
+      ...(this.details !== undefined && { details: this.details }),
+    };
+  }
+}
+
+// --- Concrete error classes ---
+// Each binds a fixed error code and HTTP status to AppError.
+// InternalError is the only subclass with an actual `new` site
+// (error-handler.ts resolveAppError fallback).
+
+export class InternalError extends AppError {
+  constructor(message = "Internal server error", details?: unknown) {
+    super(message, ErrorCodes.INTERNAL_ERROR, 500, details);
+  }
+}
+
+export class BadRequestError extends AppError {
+  constructor(message = "Bad request", details?: unknown) {
+    super(message, ErrorCodes.BAD_REQUEST, 400, details);
+  }
+}
+
+// --- Utility functions ---
+
+export function isAppError(error: unknown): error is AppError {
+  return error instanceof AppError;
+}
+
+export function logError(
+  error: unknown,
+  context?: Record<string, unknown>,
+): void {
+  // Pass message / stack / details through the PII masker before
+  // emitting. The logger applies the same masker again as a safety net,
+  // but masking here keeps the structured `details` shape (which may be
+  // a nested object) honest even if logger transports change.
+  const errorInfo = isAppError(error)
+    ? {
+        name: error.name,
+        code: error.code,
+        message: maskSensitiveString(error.message),
+        statusCode: error.statusCode,
+        details: maskSensitiveData(error.details),
+        stack: error.stack ? maskSensitiveString(error.stack) : undefined,
+      }
+    : {
+        message:
+          error instanceof Error
+            ? maskSensitiveString(error.message)
+            : maskSensitiveString(String(error)),
+        stack:
+          error instanceof Error && error.stack
+            ? maskSensitiveString(error.stack)
+            : undefined,
+      };
+
+  log.error("AppError", {
+    event: "app.error",
+    ...errorInfo,
+    context: context ? maskSensitiveData(context) : undefined,
+  });
+}

package/src/backend/lib/federation-fetch.ts

@@ -0,0 +1,296 @@
+import {
+  assertSafeRemoteUrlResolved,
+  isTakosTestHostname,
+  localSubstrateRemoteFetchesEnabled,
+  nodeLookupAll,
+  normalizeHostname,
+  resolveRemoteHostnameIPs,
+} from "./ssrf.ts";
+
+const DEFAULT_FETCH_TIMEOUT_MS = 30_000;
+
+// Upper bound on the body of any remote federation fetch (actor / object /
+// WebFinger documents). These are small JSON documents in practice, so a
+// couple of MiB is generous; the cap exists to stop a malicious or buggy
+// remote from streaming a multi-GB / never-ending body into memory on the
+// attacker-reachable, pre-auth fetchActorPublicKey hot path. Env-overridable
+// for operators that federate with peers shipping unusually large actor docs.
+const DEFAULT_MAX_FEDERATION_BODY_BYTES = 2 * 1024 * 1024;
+const MAX_FEDERATION_BODY_BYTES_ENV = "YURUCOMMU_MAX_FEDERATION_BODY_BYTES";
+
+function maxFederationBodyBytes(): number {
+  const processEnv = (
+    globalThis as {
+      process?: { env?: Record<string, string | undefined> };
+    }
+  ).process?.env;
+  const raw = processEnv?.[MAX_FEDERATION_BODY_BYTES_ENV];
+  if (!raw) return DEFAULT_MAX_FEDERATION_BODY_BYTES;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return DEFAULT_MAX_FEDERATION_BODY_BYTES;
+  }
+  return Math.floor(parsed);
+}
+
+export class FederationBodyTooLargeError extends Error {
+  constructor(
+    public readonly url: string,
+    public readonly limit: number,
+  ) {
+    super(`Remote federation response body exceeded ${limit} bytes: ${url}`);
+    this.name = "FederationBodyTooLargeError";
+  }
+}
+
+/**
+ * Read `response`'s body fully into a byte buffer while enforcing a hard byte
+ * cap and keeping the read under `signal` (so the request timeout still bounds
+ * the body, not just the headers). Rejects early on an oversized Content-Length
+ * and otherwise streams the body counting bytes, aborting once the cap is
+ * exceeded.
+ *
+ * Mirrors the capped-reader discipline used elsewhere for tenant-influenced
+ * fetches (e.g. the inbox MAX_PAYLOAD_BYTES guard and the node-postgres /
+ * git-fetch capped readers).
+ */
+async function readBodyBytesWithCap(
+  response: Response,
+  url: string,
+  limit: number,
+  signal: AbortSignal,
+): Promise<Uint8Array> {
+  // Short-circuit on an honest, oversized Content-Length before reading.
+  const contentLengthHeader = response.headers.get("content-length");
+  if (contentLengthHeader) {
+    const declared = Number(contentLengthHeader);
+    if (Number.isFinite(declared) && declared > limit) {
+      // Drain/cancel so the connection isn't left half-read.
+      try {
+        await response.body?.cancel();
+      } catch {
+        /* ignore cancel failures */
+      }
+      throw new FederationBodyTooLargeError(url, limit);
+    }
+  }
+
+  // A consumed/absent body (e.g. 204) reads as empty bytes.
+  if (!response.body) {
+    return new Uint8Array(0);
+  }
+
+  if (signal.aborted) {
+    try {
+      await response.body.cancel();
+    } catch {
+      /* ignore */
+    }
+    throw signal.reason instanceof Error ? signal.reason : new Error("Aborted");
+  }
+
+  const reader = response.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+
+  const onAbort = () => {
+    void reader.cancel(signal.reason).catch(() => {});
+  };
+  signal.addEventListener("abort", onAbort, { once: true });
+
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (value) {
+        total += value.byteLength;
+        if (total > limit) {
+          await reader.cancel().catch(() => {});
+          throw new FederationBodyTooLargeError(url, limit);
+        }
+        chunks.push(value);
+      }
+    }
+  } catch (err) {
+    if (signal.aborted && !(err instanceof FederationBodyTooLargeError)) {
+      throw signal.reason instanceof Error ? signal.reason : err;
+    }
+    throw err;
+  } finally {
+    signal.removeEventListener("abort", onAbort);
+  }
+
+  const merged = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    merged.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return merged;
+}
+
+/**
+ * Wrap a `Response` so `.json()` / `.text()` (and the other body accessors)
+ * read the body under a LIVE timeout + a hard size cap, instead of the raw
+ * `Response` whose body read is unbounded once the headers arrive. The wrapper
+ * delegates every non-body member (`ok`, `status`, `headers`, `url`, ...) to
+ * the underlying response, so all callers keep their existing `res.ok` /
+ * `res.status` / `res.json()` / `res.text()` usage with no signature churn.
+ */
+function wrapResponseWithCap(
+  response: Response,
+  url: string,
+  timeout: number,
+): Response {
+  const limit = maxFederationBodyBytes();
+  let bodyConsumed = false;
+
+  const readBytes = async (): Promise<Uint8Array> => {
+    if (bodyConsumed) {
+      // Surface the native "Body already consumed" failure mode by reading the
+      // (already-locked) underlying body.
+      return new Uint8Array(await response.arrayBuffer());
+    }
+    bodyConsumed = true;
+    // Fresh timeout covering ONLY the body read, so a slow/never-ending body
+    // is bounded even though the headers already arrived.
+    const bodyAbort = AbortSignal.timeout(timeout);
+    try {
+      return await readBodyBytesWithCap(response, url, limit, bodyAbort);
+    } catch (err) {
+      if (err instanceof Error && err.name === "TimeoutError") {
+        throw new Error(
+          `Response body read timed out after ${
+            timeout / 1000
+          } seconds: ${url}`,
+        );
+      }
+      throw err;
+    }
+  };
+
+  const readText = async (): Promise<string> =>
+    new TextDecoder().decode(await readBytes());
+
+  return new Proxy(response, {
+    get(target, prop, _receiver) {
+      if (prop === "text") {
+        return () => readText();
+      }
+      if (prop === "json") {
+        return async () => JSON.parse(await readText());
+      }
+      if (prop === "arrayBuffer") {
+        return async () => {
+          const bytes = await readBytes();
+          // Return a standalone ArrayBuffer copy (the merged buffer may be a
+          // view into a larger allocation in some runtimes).
+          return bytes.slice().buffer;
+        };
+      }
+      const value = Reflect.get(target, prop, target);
+      return typeof value === "function" ? value.bind(target) : value;
+    },
+  }) as Response;
+}
+
+/**
+ * Resolve a remote hostname using the SAME resolver `fetch` will use on this
+ * runtime, so the SSRF validation in `assertSafeRemoteUrlResolved` is not
+ * split from the resolution the actual connection performs.
+ *
+ * DNS-rebinding TOCTOU has two distinct vectors here:
+ *
+ *  1. Resolver split — validating via Cloudflare DoH while `fetch` connects
+ *     using the host OS resolver. An attacker who controls authoritative DNS
+ *     can deterministically serve a public IP to DoH and a private IP to the
+ *     OS resolver. On a Bun/Node host, we close this deterministic split by
+ *     validating with the host resolver instead of DoH, so validation and the
+ *     connection both go through the
+ *     host's configured DNS rather than two different trust domains. (This
+ *     removes the resolver-split exploit; it does not by itself guarantee
+ *     fetch reuses the identical IP — see vector 2.) On Workers `fetch`
+ *     resolves at the edge with no host-OS resolver to diverge from, so DoH
+ *     and the connection resolve in the same trust domain.
+ *  2. Low-TTL flip — the record changes between validation and connection.
+ *     Neither Workers' nor host `fetch` exposes a hook to pin the
+ *     connection to an already-resolved IP, so we cannot eliminate this
+ *     sub-resolution window through `fetch`; we minimize it by resolving
+ *     immediately before the request with no other awaited work in between.
+ */
+async function resolveConnectionResolverIPs(
+  hostname: string,
+): Promise<string[]> {
+  const processLike = (globalThis as { process?: unknown }).process;
+  if (processLike) return await nodeLookupAll(hostname);
+  return resolveRemoteHostnameIPs(hostname);
+}
+
+export async function fetchWithTimeout(
+  url: string,
+  options: RequestInit & { timeout?: number; skipSafetyCheck?: boolean } = {},
+): Promise<Response> {
+  const {
+    timeout = DEFAULT_FETCH_TIMEOUT_MS,
+    skipSafetyCheck = false,
+    ...fetchOptions
+  } = options;
+
+  if (!skipSafetyCheck) {
+    // Validate using the resolver that `fetch` itself will use on this
+    // runtime (closes the resolver-split rebinding vector — see
+    // resolveConnectionResolverIPs). The local-substrate path keeps its own
+    // resolver logic, so only override the remote-resolver default here.
+    const parsed = new URL(url);
+    const hostname = normalizeHostname(parsed.hostname);
+    const allowLocalSubstrate = localSubstrateRemoteFetchesEnabled();
+    const useConnectionResolver = !(
+      allowLocalSubstrate && isTakosTestHostname(hostname)
+    );
+
+    await assertSafeRemoteUrlResolved(
+      url,
+      useConnectionResolver
+        ? { remoteResolver: resolveConnectionResolverIPs }
+        : {},
+    );
+  }
+
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), timeout);
+
+  try {
+    const response = await fetch(url, {
+      ...fetchOptions,
+      signal: controller.signal,
+      redirect: "manual", // Prevent redirect-based SSRF bypassing DNS safety checks
+    });
+    // Reject redirects to prevent SSRF via open redirects on remote servers
+    if (response.status >= 300 && response.status < 400) {
+      throw new Error(
+        `Redirect not allowed from remote URL: ${url} -> ${response.headers.get(
+          "location",
+        )}`,
+      );
+    }
+    // The headers-phase timer is cleared in `finally` below, but a raw
+    // `Response` then reads its body with NO time bound and NO size bound — on
+    // the attacker-reachable, pre-auth federation ingress (fetchActorPublicKey
+    // runs on every inbound activity) a malicious remote can stream a
+    // multi-GB / never-ending body and exhaust memory. Wrap the response so
+    // `.json()` / `.text()` read the body under a fresh timeout and a hard
+    // byte cap. Callers keep their `res.ok` / `res.status` / `res.json()` /
+    // `res.text()` usage unchanged; paths that never touch the body (outbound
+    // POST delivery) simply never trigger the capped read.
+    return wrapResponseWithCap(response, url, timeout);
+  } catch (err) {
+    if (err instanceof Error && err.name === "AbortError") {
+      throw new Error(
+        `Request timed out after ${timeout / 1000} seconds: ${url}`,
+      );
+    }
+    throw err;
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}

package/src/backend/lib/feed-cursor.ts

@@ -0,0 +1,57 @@
+// Shared keyset cursor for `(published, apId)`-ordered feeds.
+//
+// Several list endpoints (replies, bookmarks, profile posts, DM + community
+// chat, the MCP timeline) page back through rows ordered `desc(published),
+// desc(apId)`. `published`/`created_at` is NOT unique (many rows can share a
+// millisecond — local writes collide, and federated inbound timestamps are
+// remote-controlled), so a cursor on the timestamp alone would skip the rows on
+// either side of a page boundary that share the boundary's millisecond. The
+// unique `apId` is the tiebreaker that makes the ordering total.
+//
+// The cursor is encoded as "<published> <apId>". A SPACE separator is used (NOT
+// a raw NUL — typing a single-char separator in a string literal has repeatedly
+// landed as a raw 0x00 byte, which corrupts the source file): a space sorts
+// strictly below every character that can appear in an ISO-8601 timestamp or an
+// https:// ap_id, so the concatenated lexical order matches the (published,
+// apId) tuple order, and neither field can contain a space to break the split.
+// The actual SQL comparison is a real column tuple predicate, so even a
+// variable-width `published` is compared correctly.
+
+import { and, eq, lt, or } from "drizzle-orm";
+import type { SQL } from "drizzle-orm";
+import type { AnyColumn } from "drizzle-orm";
+
+export const FEED_CURSOR_SEP = " ";
+
+/**
+ * Encode a row's `(sortKey, tiebreaker)` into an opaque `before` cursor string.
+ * `sortKey` is the published/created timestamp; `tiebreaker` is the unique id
+ * (apId / objectApId) that makes the ordering total.
+ */
+export function encodeFeedCursor(sortKey: string, tiebreaker: string): string {
+  return `${sortKey}${FEED_CURSOR_SEP}${tiebreaker}`;
+}
+
+/**
+ * Build the WHERE predicate for "rows strictly older than `before`" against the
+ * given published/apId columns. A composite `before` ("<published> <apId>")
+ * yields the tuple predicate `published < p OR (published = p AND apId < a)`; a
+ * legacy bare-published `before` (no separator) falls back to `published < before`
+ * so older clients/cursors keep working. Returns `undefined` when `before` is
+ * absent (no cursor → no predicate).
+ */
+export function feedCursorWhere(
+  publishedCol: AnyColumn,
+  apIdCol: AnyColumn,
+  before: string | undefined | null,
+): SQL | undefined {
+  if (!before) return undefined;
+  const sepIdx = before.indexOf(FEED_CURSOR_SEP);
+  if (sepIdx < 0) return lt(publishedCol, before);
+  const cPublished = before.slice(0, sepIdx);
+  const cApId = before.slice(sepIdx + FEED_CURSOR_SEP.length);
+  return or(
+    lt(publishedCol, cPublished),
+    and(eq(publishedCol, cPublished), lt(apIdCol, cApId)),
+  );
+}

package/src/backend/lib/feed-exclude.ts

@@ -0,0 +1,48 @@
+import { and, type AnyColumn, eq, notInArray, type SQL } from "drizzle-orm";
+import type { Database } from "../../db/index.ts";
+import { blocks, mutes, objects } from "../../db/index.ts";
+
+/**
+ * Predicate excluding posts authored by anyone the viewer has blocked or muted.
+ *
+ * Expressed as `objects.attributed_to NOT IN (SELECT blocked) AND ... NOT IN
+ * (SELECT muted)` — i.e. `NOT IN (blocked ∪ muted)` — using db.select
+ * SUBQUERIES rather than materialising the id lists into an `inArray`. Each
+ * subquery binds a single bound parameter (the viewer) regardless of how many
+ * accounts the viewer has blocked/muted, so it never approaches Cloudflare D1's
+ * 100-bound-parameter-per-query ceiling. (The previous `notInArray(attributedTo,
+ * [...blocked, ...muted])` materialised up to ~2000 ids — fine on the libsql the
+ * tests run on, but a "too many SQL variables" 500 on production D1 for a heavy
+ * moderator.)
+ *
+ * Returns `undefined` for an empty viewer (anonymous) so callers can skip it.
+ * Applying it unconditionally for a logged-in viewer is correct even with zero
+ * blocks/mutes: `NOT IN (empty set)` is true for every row.
+ *
+ * `column` defaults to the post author (`objects.attributedTo`) for feeds, but
+ * can be any actor-id column — e.g. `activities.actorApId` so the notifications
+ * list/count can suppress activity from blocked/muted accounts the same way.
+ */
+export function excludeBlockedMutedAuthors(
+  db: Database,
+  viewerApId: string,
+  column: AnyColumn = objects.attributedTo,
+): SQL | undefined {
+  if (!viewerApId) return undefined;
+  return and(
+    notInArray(
+      column,
+      db
+        .select({ id: blocks.blockedApId })
+        .from(blocks)
+        .where(eq(blocks.blockerApId, viewerApId)),
+    ),
+    notInArray(
+      column,
+      db
+        .select({ id: mutes.mutedApId })
+        .from(mutes)
+        .where(eq(mutes.muterApId, viewerApId)),
+    ),
+  );
+}

package/src/backend/lib/hex.ts

@@ -0,0 +1,8 @@
+/**
+ * Lowercase hex encoding of a byte array (each byte → 2 hex chars).
+ */
+export function bytesToHex(bytes: Uint8Array): string {
+  return Array.from(bytes)
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("");
+}