@takosjp/yurucommu-core 3.0.0

package/migrations/README.md

@@ -0,0 +1,122 @@
+# yurucommu migrations
+
+SQL migrations for the yurucommu social engine. Deployable product repos
+(`yurucommu` and `yurumeet`) apply these migrations from the published
+`@takosjp/yurucommu-core` package.
+
+- **Substrate**: libSQL (single-host) or Cloudflare D1 (managed edge).
+- **Ledger table**: `yurucommu_migrations(name TEXT PRIMARY KEY, applied_at)`.
+  This is yurucommu-owned product state; it does **not** carry a checksum
+  column.
+- **Runner sources**:
+  - `bun run app:activate` in this package for direct migration helper tests
+  - `bun run takosumi:release` in a deployable product repo for Takosumi
+    activation
+  - `wrangler d1 migrations apply` for operator-managed Cloudflare D1 paths
+
+## Naming convention
+
+Files use a zero-padded 4-digit prefix:
+
+```
+NNNN_short_description.sql
+```
+
+Order is determined by lexicographic sort on the prefix. The runner records the
+file name (not the numeric version) in `yurucommu_migrations`.
+
+## Operator runbook
+
+1. **Apply** (libSQL / single-host):
+
+   ```bash
+   cd yurucommu
+   bun run start
+   ```
+
+   Migrations run lazily on the first DB connect.
+
+2. **Apply** (Cloudflare D1):
+
+   ```bash
+   cd yurucommu
+   npx wrangler d1 migrations apply <DB-NAME> --env <env>
+   ```
+
+3. **Apply migrations only** (Takosumi-compatible helper):
+
+   `bun run app:activate` is the core package migration helper. Takosumi does
+   not parse migrations, talk to the database, or provide a DB-specific API for
+   this path; it only records the activation result when a product repo invokes
+   the helper through its release hook. The operator activation environment must
+   provide the SQL execution command.
+
+   Prefix mode appends `<resource> <sql>`:
+
+   ```bash
+   YURUCOMMU_SQL_COMMAND_JSON='["operator-sql-cli","query"]' \
+   YURUCOMMU_SQL_RESOURCE=database \
+   bun run app:activate
+   ```
+
+   Template mode substitutes `{resource}` and `{sql}`:
+
+   ```bash
+   YURUCOMMU_SQL_COMMAND_TEMPLATE_JSON='["bunx","wrangler","d1","execute","{resource}","--remote","--json","--command={sql}"]' \
+   YURUCOMMU_SQL_WRAP_TRANSACTIONS=false \
+   YURUCOMMU_SQL_RESOURCE=DB \
+   bun run app:activate
+   ```
+
+   Remote Cloudflare D1 rejects explicit `BEGIN` / `SAVEPOINT` statements through
+   this API, so the Takosumi release path disables transaction wrappers while
+   keeping the local/libSQL path wrapped by default.
+
+4. **Post-apply activation**:
+
+   In the OpenTofu-managed Worker path, the product repo's
+   `takosumi_release.post_apply` runs
+   `bun run takosumi:release -- --migrations-only` as an opaque runner command.
+   It reads non-secret outputs from `TAKOSUMI_OUTPUTS_JSON`, writes a temporary
+   Wrangler config, and applies these core migrations through
+   `wrangler d1 execute` without explicit SQL transaction wrappers. Provider
+   credentials come from the same reviewed Provider Connection used by the
+   OpenTofu run.
+
+   In the fallback path where the Worker script is not managed by OpenTofu,
+   `takosumi_release.post_apply` runs `bun run takosumi:release` as an opaque
+   operator release command. It reads non-secret outputs from `TAKOSUMI_OUTPUTS_JSON`,
+   writes a temporary Wrangler config, runs `bun install --frozen-lockfile`,
+   runs `bun run build:takos-worker`, applies D1 migrations through
+   `wrangler d1 execute` without explicit SQL transaction wrappers, and deploys
+   with `wrangler deploy`.
+   Provider credentials and app-specific secrets come from the selected
+   operator release activator boundary through
+   `TAKOSUMI_RELEASE_COMMAND_ENV_ALLOWLIST`.
+
+   Common operator env names:
+
+   ```bash
+   YURUCOMMU_ENCRYPTION_KEY=...
+   YURUCOMMU_AUTH_PASSWORD_HASH=...
+   TAKOSUMI_ACCOUNTS_ISSUER_URL=https://app.takosumi.com
+   TAKOSUMI_ACCOUNTS_CLIENT_ID=...
+   ```
+
+5. **Forensics**:
+
+   ```sql
+   SELECT name, applied_at FROM yurucommu_migrations ORDER BY applied_at;
+   ```
+
+## Product-local ledger note
+
+The `yurucommu_migrations` ledger is yurucommu-family product state. The
+Takosumi-managed path invokes product-owned `takosumi_release.post_apply`
+commands and records activation status/logs; it does not expose a Takosumi DB
+migration API. A future core migration may add `checksum TEXT` and store
+`sha256:<hex>` per applied migration, but that requires coordination with
+production data in both yurucommu and Yurumeet installations.
+
+For restore / disaster-recovery procedures, see the operator runbooks under
+[`takosumi/docs/operations/`](../../takosumi/docs/operations/).

package/package.json

@@ -0,0 +1,75 @@
+{
+  "name": "@takosjp/yurucommu-core",
+  "version": "3.0.0",
+  "license": "AGPL-3.0-only",
+  "type": "module",
+  "workspaces": [
+    "packages/*"
+  ],
+  "files": [
+    "src/backend",
+    "src/db",
+    "src/plugin",
+    "src/runtime",
+    "!src/backend/**/__tests__/**",
+    "!packages/api/src/**/*.test.ts",
+    "scripts/apply-takosumi-migrations.ts",
+    "migrations",
+    "packages/api/src",
+    "packages/api/package.json",
+    "packages/api/LICENSE"
+  ],
+  "exports": {
+    ".": "./src/backend/public.ts",
+    "./server": "./src/backend/public.ts",
+    "./client-api": "./packages/api/src/index.ts",
+    "./migrations": "./scripts/apply-takosumi-migrations.ts",
+    "./plugins": "./src/plugin/public.ts"
+  },
+  "imports": {
+    "#test/assert": "./shims/std/assert.ts",
+    "#test/mock": "./shims/std/mock.ts",
+    "#test/time": "./shims/std/time.ts"
+  },
+  "scripts": {
+    "start": "bun src/backend/server.ts",
+    "dev": "bun src/backend/server.ts",
+    "dev:server": "bun src/backend/server.ts",
+    "check": "tsc --noEmit",
+    "test": "bun run build:api && bun test test/ src/backend/ packages/api/src/",
+    "test:backend": "bun test src/backend/",
+    "build": "bun run build:api",
+    "build:api": "cd packages/api && bun run build",
+    "pack:core": "npm pack --dry-run",
+    "pack:api": "cd packages/api && bun run pack:dry",
+    "app:activate": "bun scripts/apply-takosumi-migrations.ts",
+    "lint": "bun run check",
+    "fmt": "bunx prettier --write src test packages/api",
+    "fmt:check": "bunx prettier --check src test packages/api",
+    "db:generate": "bunx drizzle-kit generate",
+    "db:push": "bunx drizzle-kit push",
+    "db:migrate": "bunx drizzle-kit migrate",
+    "db:studio": "bunx drizzle-kit studio"
+  },
+  "dependencies": {
+    "@aws-sdk/client-s3": "^3.971.0",
+    "@libsql/client": "^0.17.0",
+    "better-sqlite3": "^12.4.1",
+    "drizzle-orm": "^0.45.1",
+    "fdir": "^6.5.0",
+    "hono": "^4.12.9",
+    "picomatch": "^4.0.4",
+    "tinyglobby": "^0.2.16"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "^4.20260420.1",
+    "@types/better-sqlite3": "^7.6.11",
+    "@types/bun": "latest",
+    "@types/node": "^22.0.0",
+    "drizzle-kit": "^0.31.9",
+    "typescript": "^5.7.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/packages/api/LICENSE

@@ -0,0 +1,16 @@
+SPDX-License-Identifier: AGPL-3.0-only
+
+GNU Affero General Public License v3.0 only
+
+Copyright (c) 2026 Takos Contributors
+
+This program is free software: you can redistribute it and/or modify it under
+the terms of the GNU Affero General Public License as published by the Free
+Software Foundation, version 3 of the License.
+
+This program is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License along
+with this program. If not, see <https://www.gnu.org/licenses/agpl-3.0.html>.

package/packages/api/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@takosjp/yurucommu-api",
+  "version": "3.0.0",
+  "description": "Typed client SDK and public API contract for yurucommu-server clients.",
+  "license": "AGPL-3.0-only",
+  "type": "module",
+  "sideEffects": false,
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "types": "./dist/index.d.ts",
+  "scripts": {
+    "check": "tsc --noEmit -p tsconfig.json",
+    "build": "rm -rf dist && bun build src/index.ts --target browser --format esm --outfile dist/index.js && bunx tsc -p tsconfig.build.json && bun scripts/rewrite-dts-imports.mjs",
+    "pack:dry": "npm pack --dry-run"
+  },
+  "devDependencies": {
+    "typescript": "^5.7.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/packages/api/src/index.ts

@@ -0,0 +1,4 @@
+export * from "./lib/api.ts";
+export * from "./lib/transport.ts";
+export * from "./social-server.ts";
+export * from "./types/index.ts";

package/packages/api/src/lib/api/account.ts

@@ -0,0 +1,20 @@
+import { apiFetch, apiPost, apiPut, assertOk } from "./fetch.ts";
+
+export async function fetchAlsoKnownAs(identifier: string): Promise<string[]> {
+  const res = await apiFetch(`/api/actors/${encodeURIComponent(identifier)}`);
+  if (!res.ok) return [];
+  const data = (await res.json()) as { also_known_as?: unknown };
+  return Array.isArray(data.also_known_as)
+    ? data.also_known_as.filter((a): a is string => typeof a === "string")
+    : [];
+}
+
+export async function setAlsoKnownAs(aliases: string[]): Promise<void> {
+  const res = await apiPut("/api/actors/me", { also_known_as: aliases });
+  await assertOk(res, "Failed to update aliases");
+}
+
+export async function moveAccount(target: string): Promise<void> {
+  const res = await apiPost("/api/actors/me/move", { target });
+  await assertOk(res, "Failed to move account");
+}

package/packages/api/src/lib/api/actors.ts

@@ -0,0 +1,149 @@
+import type { Actor, Post } from "../../types/index.ts";
+import { normalizeActor, normalizePost } from "./normalize.ts";
+import { apiDelete, apiFetch, apiPost, apiPut, assertOk } from "./fetch.ts";
+
+export async function fetchActor(identifier: string): Promise<Actor> {
+  const res = await apiFetch(`/api/actors/${encodeURIComponent(identifier)}`);
+  await assertOk(res, "Actor not found");
+  const data = (await res.json()) as { actor: Actor };
+  return normalizeActor(data.actor);
+}
+
+export async function updateProfile(data: {
+  name?: string;
+  summary?: string;
+  icon_url?: string;
+  header_url?: string;
+  is_private?: boolean;
+  // Structured PropertyValue profile fields. PUT /me replaces the stored set
+  // with this array (backend caps it at 4 and sanitizes name/value).
+  fields?: { name: string; value: string }[];
+}): Promise<void> {
+  const res = await apiPut("/api/actors/me", data);
+  await assertOk(res, "Failed to update profile");
+}
+
+export interface ActorPostsPage {
+  posts: Post[];
+  nextCursor: string | null;
+  hasMore: boolean;
+}
+
+export async function fetchActorPosts(
+  identifier: string,
+  options?: { limit?: number; before?: string },
+): Promise<ActorPostsPage> {
+  const params = new URLSearchParams();
+  if (options?.limit) params.set("limit", String(options.limit));
+  if (options?.before) params.set("before", options.before);
+  const query = params.toString() ? `?${params}` : "";
+  const res = await apiFetch(
+    `/api/actors/${encodeURIComponent(identifier)}/posts${query}`,
+  );
+  await assertOk(res, "Failed to fetch actor posts");
+  const data = (await res.json()) as {
+    posts?: Post[];
+    next_cursor?: string | null;
+    has_more?: boolean;
+  };
+  return {
+    posts: (data.posts || []).map(normalizePost),
+    nextCursor: data.next_cursor ?? null,
+    hasMore: data.has_more ?? false,
+  };
+}
+
+export interface FollowListPage {
+  actors: Actor[];
+  hasMore: boolean;
+  total: number;
+}
+
+function followListQuery(options?: {
+  limit?: number;
+  offset?: number;
+}): string {
+  const params = new URLSearchParams();
+  if (options?.limit) params.set("limit", String(options.limit));
+  if (options?.offset) params.set("offset", String(options.offset));
+  return params.toString() ? `?${params}` : "";
+}
+
+export async function fetchFollowers(
+  identifier: string,
+  options?: { limit?: number; offset?: number },
+): Promise<FollowListPage> {
+  const res = await apiFetch(
+    `/api/actors/${encodeURIComponent(identifier)}/followers${followListQuery(options)}`,
+  );
+  await assertOk(res, "Failed to fetch followers");
+  const data = (await res.json()) as {
+    followers?: Actor[];
+    has_more?: boolean;
+    total?: number;
+  };
+  return {
+    actors: (data.followers || []).map(normalizeActor),
+    hasMore: data.has_more ?? false,
+    total: data.total ?? 0,
+  };
+}
+
+export async function fetchFollowing(
+  identifier: string,
+  options?: { limit?: number; offset?: number },
+): Promise<FollowListPage> {
+  const res = await apiFetch(
+    `/api/actors/${encodeURIComponent(identifier)}/following${followListQuery(options)}`,
+  );
+  await assertOk(res, "Failed to fetch following");
+  const data = (await res.json()) as {
+    following?: Actor[];
+    has_more?: boolean;
+    total?: number;
+  };
+  return {
+    actors: (data.following || []).map(normalizeActor),
+    hasMore: data.has_more ?? false,
+    total: data.total ?? 0,
+  };
+}
+
+export async function fetchBlockedUsers(): Promise<Actor[]> {
+  const res = await apiFetch("/api/actors/me/blocked");
+  await assertOk(res, "Failed to fetch blocked users");
+  const data = (await res.json()) as { blocked?: Actor[] };
+  return (data.blocked || []).map(normalizeActor);
+}
+
+export async function blockUser(apId: string): Promise<void> {
+  const res = await apiPost("/api/actors/me/blocked", { ap_id: apId });
+  await assertOk(res, "Failed to block user");
+}
+
+export async function unblockUser(apId: string): Promise<void> {
+  const res = await apiDelete("/api/actors/me/blocked", { ap_id: apId });
+  await assertOk(res, "Failed to unblock user");
+}
+
+export async function fetchMutedUsers(): Promise<Actor[]> {
+  const res = await apiFetch("/api/actors/me/muted");
+  await assertOk(res, "Failed to fetch muted users");
+  const data = (await res.json()) as { muted?: Actor[] };
+  return (data.muted || []).map(normalizeActor);
+}
+
+export async function muteUser(apId: string): Promise<void> {
+  const res = await apiPost("/api/actors/me/muted", { ap_id: apId });
+  await assertOk(res, "Failed to mute user");
+}
+
+export async function unmuteUser(apId: string): Promise<void> {
+  const res = await apiDelete("/api/actors/me/muted", { ap_id: apId });
+  await assertOk(res, "Failed to unmute user");
+}
+
+export async function deleteAccount(): Promise<void> {
+  const res = await apiPost("/api/actors/me/delete");
+  await assertOk(res, "Failed to delete account");
+}

package/packages/api/src/lib/api/auth.ts

@@ -0,0 +1,46 @@
+import { apiFetch, apiPost, assertOk } from "./fetch.ts";
+
+export async function login(
+  password: string,
+): Promise<{ success: boolean; error?: string }> {
+  const res = await apiPost("/api/auth/login", { password });
+  return (await res.json()) as { success: boolean; error?: string };
+}
+
+export async function logout(): Promise<void> {
+  await apiPost("/api/auth/logout");
+}
+
+export interface AccountInfo {
+  ap_id: string;
+  preferred_username: string;
+  name: string | null;
+  icon_url: string | null;
+}
+
+export async function fetchAccounts(): Promise<{
+  accounts: AccountInfo[];
+  current_ap_id: string;
+}> {
+  const res = await apiFetch("/api/auth/accounts");
+  await assertOk(res, "Failed to fetch accounts");
+  return (await res.json()) as {
+    accounts: AccountInfo[];
+    current_ap_id: string;
+  };
+}
+
+export async function switchAccount(apId: string): Promise<void> {
+  const res = await apiPost("/api/auth/switch", { ap_id: apId });
+  await assertOk(res, "Failed to switch account");
+}
+
+export async function createAccount(
+  username: string,
+  name?: string,
+): Promise<AccountInfo> {
+  const res = await apiPost("/api/auth/accounts", { username, name });
+  await assertOk(res, "Failed to create account");
+  const data = (await res.json()) as { account: AccountInfo };
+  return data.account;
+}