@takosjp/yurucommu-core 3.0.0

package/src/backend/routes/actors.ts

@@ -0,0 +1,1311 @@
+import { Hono } from "hono";
+import { deleteCookie } from "hono/cookie";
+import {
+  and,
+  asc,
+  count,
+  desc,
+  eq,
+  inArray,
+  isNotNull,
+  isNull,
+  lt,
+  ne,
+  or,
+  sql,
+} from "drizzle-orm";
+import type { BatchItem } from "drizzle-orm/batch";
+import {
+  activities,
+  actorCache,
+  actors,
+  blocks,
+  communities,
+  deliveryQueue,
+  follows,
+  inbox,
+  mediaUploads,
+  mutes,
+  notDeleted,
+  nowIso,
+  objects,
+} from "../../db/index.ts";
+import type { Database } from "../../db/index.ts";
+import type { Env, Variables } from "../types.ts";
+import {
+  activityApId,
+  formatUsername,
+  generateId,
+  isSafeRemoteUrl,
+  parseLimit,
+  parseOffset,
+  safeJsonParse,
+} from "../federation-helpers.ts";
+import { enqueueFanoutToFollowers } from "../lib/delivery/queue.ts";
+import {
+  destinationDeclaresAlias,
+  resolveMoveTarget,
+} from "../lib/account-migration.ts";
+import { getInstanceFetchSigner } from "./activitypub/query-helpers.ts";
+import { severFollowEdge } from "./activitypub/handlers/inbox-interaction-handlers.ts";
+import { teardownActor } from "./account-teardown.ts";
+import { CacheTags, CacheTTL, withCache } from "../middleware/cache.ts";
+import {
+  actorExists,
+  createRelation,
+  deleteRelation,
+  isValidHttpUrl,
+  isValidProfileImageUrl,
+  listFollowRelation,
+  listRelation,
+  loadActorInfoMap,
+  loadPostInteractions,
+  MAX_ACTOR_POSTS_LIMIT,
+  MAX_PROFILE_NAME_LENGTH,
+  MAX_PROFILE_SUMMARY_LENGTH,
+  MAX_PROFILE_URL_LENGTH,
+  requireActor,
+  resolveActorApId,
+} from "./actors-helpers.ts";
+import { reapReplacedMediaUrl } from "./posts/delete-cascade.ts";
+import { safeUrlJoin } from "../lib/activitypub-helpers.ts";
+import { encodeFeedCursor, feedCursorWhere } from "../lib/feed-cursor.ts";
+import { chunkForInClause } from "../lib/chunk.ts";
+import { logger } from "../lib/logger.ts";
+
+const log = logger.child({ component: "actors" });
+
+// Mastodon-parity profile metadata limits. Mastodon caps profile fields at 4
+// rows with bounded name/value lengths; we mirror that to keep the served
+// actor document and federated Update(Person) bounded.
+const MAX_PROFILE_FIELDS = 4;
+const MAX_PROFILE_FIELD_NAME_LENGTH = 255;
+const MAX_PROFILE_FIELD_VALUE_LENGTH = 255;
+// Bound declared aliases (alsoKnownAs) so the actor document stays bounded.
+const MAX_ALSO_KNOWN_AS = 10;
+// Personal-portability export caps so a single archive request cannot OOM.
+const MAX_EXPORT_POSTS = 5000;
+const MAX_EXPORT_RELATIONS = 10000;
+const MAX_EXPORT_MEDIA = 10000;
+
+type ProfileField = { name: string; value: string };
+
+/**
+ * Sanitize a structured profile fields payload into a bounded array of
+ * { name, value } rows. Non-string / empty rows are dropped; the result is
+ * capped at MAX_PROFILE_FIELDS with trimmed, length-bounded values.
+ */
+function sanitizeProfileFields(input: unknown): ProfileField[] {
+  if (!Array.isArray(input)) return [];
+  const out: ProfileField[] = [];
+  for (const row of input) {
+    if (out.length >= MAX_PROFILE_FIELDS) break;
+    if (!row || typeof row !== "object") continue;
+    const name = (row as { name?: unknown }).name;
+    const value = (row as { value?: unknown }).value;
+    if (typeof name !== "string" || typeof value !== "string") continue;
+    const trimmedName = name.trim().slice(0, MAX_PROFILE_FIELD_NAME_LENGTH);
+    const trimmedValue = value.trim().slice(0, MAX_PROFILE_FIELD_VALUE_LENGTH);
+    if (trimmedName.length === 0 && trimmedValue.length === 0) continue;
+    out.push({ name: trimmedName, value: trimmedValue });
+  }
+  return out;
+}
+
+/**
+ * Render stored profile fields as PropertyValue attachments for the federated
+ * Person object (mirrors the served actor document in routes/activitypub.ts).
+ */
+function fieldsToAttachments(
+  fields: ProfileField[],
+): Array<{ type: "PropertyValue"; name: string; value: string }> {
+  return fields.map((f) => ({
+    type: "PropertyValue",
+    name: f.name,
+    value: f.value,
+  }));
+}
+
+// Tombstone reaper horizon. A deleted account's row is kept as a tombstone so
+// the queued Delete(actor) deliver_endpoint jobs can sign with the actor's
+// private key when they drain. Once those jobs have drained AND enough time has
+// passed that no further delivery attempts are possible, the tombstone (and its
+// signing material) can be hard-deleted. The horizon is comfortably past the
+// delivery backoff series (~4.3h total) so a still-retrying Delete is never
+// reaped out from under the signer; the no-pending-jobs check below is the
+// primary guard and this is a belt-and-braces lower bound.
+const TOMBSTONE_REAP_AFTER_MS = 24 * 60 * 60 * 1000;
+
+/**
+ * Hard-delete tombstoned local actors whose federation Delete has drained.
+ *
+ * A tombstone is only reaped when (a) its `deletedAt` is older than
+ * TOMBSTONE_REAP_AFTER_MS and (b) it has NO non-terminal (pending / processing
+ * / failed / retry_wait) delivery_queue rows for any of its Delete activities —
+ * i.e. nothing still needs the private key to sign a retry. The preserved Delete activity
+ * rows are removed alongside the actor so they do not accumulate forever.
+ *
+ * Returns the number of tombstones hard-deleted.
+ */
+export async function reapDrainedTombstones(db: Database): Promise<number> {
+  const cutoff = new Date(Date.now() - TOMBSTONE_REAP_AFTER_MS).toISOString();
+
+  const candidates = await db
+    .select({ apId: actors.apId })
+    .from(actors)
+    .where(
+      and(sql`${actors.deletedAt} IS NOT NULL`, lt(actors.deletedAt, cutoff)),
+    )
+    .limit(100);
+  if (candidates.length === 0) return 0;
+
+  let reaped = 0;
+  for (const { apId } of candidates) {
+    // Delete activities this actor authored (preserved through teardown for
+    // the delivery signer). Outbound by construction.
+    const deleteActivities = await db
+      .select({ apId: activities.apId })
+      .from(activities)
+      .where(
+        and(eq(activities.actorApId, apId), eq(activities.type, "Delete")),
+      );
+    const deleteActivityIds = deleteActivities.map((a) => a.apId);
+
+    if (deleteActivityIds.length > 0) {
+      // Any non-terminal delivery job for those Delete activities means the
+      // signer may still need this actor's key — skip reaping for now. Chunked:
+      // a prolific deleted actor can have >100 Delete activities, which would
+      // blow D1's 100-bound-param cap and 500 this fire-and-forget reap, leaking
+      // the tombstone (and its signing key) forever.
+      let hasPendingDelivery = false;
+      for (const chunk of chunkForInClause(deleteActivityIds)) {
+        const pending = await db
+          .select({ id: deliveryQueue.id })
+          .from(deliveryQueue)
+          .where(
+            and(
+              inArray(deliveryQueue.activityApId, chunk),
+              // Non-terminal delivery states (anything other than the terminal
+              // "delivered" / "dead_letter"). A "retry_wait" row is a Delete
+              // between attempts and will be re-sent, so reaping the tombstone
+              // (and its signing key) while one exists would strand the retry
+              // unsigned. queue-delivery.ts writes: pending / processing /
+              // failed / retry_wait / delivered / dead_letter.
+              inArray(deliveryQueue.status, [
+                "pending",
+                "processing",
+                "failed",
+                "retry_wait",
+              ]),
+            ),
+          )
+          .limit(1)
+          .get();
+        if (pending) {
+          hasPendingDelivery = true;
+          break;
+        }
+      }
+      if (hasPendingDelivery) continue;
+    }
+
+    // Drained: remove the terminal delivery_queue rows, the preserved Delete
+    // activities, then the tombstone row itself (chunked for D1's param cap).
+    if (deleteActivityIds.length > 0) {
+      for (const chunk of chunkForInClause(deleteActivityIds)) {
+        await db
+          .delete(deliveryQueue)
+          .where(inArray(deliveryQueue.activityApId, chunk));
+        await db.delete(activities).where(inArray(activities.apId, chunk));
+      }
+    }
+    await db.delete(actors).where(eq(actors.apId, apId));
+    reaped += 1;
+  }
+
+  return reaped;
+}
+
+/**
+ * Cancel the stranded outbound Delete(actor) for a tombstone that is about to be
+ * REVIVED (a freed handle re-registered onto the same deterministic apId).
+ *
+ * A tombstone keeps its OLD signing key precisely so the queued Delete(actor)
+ * delivery jobs can sign with it at send time (read live from the actor row).
+ * Re-registration rotates that row to a FRESH key + identity, which would make
+ * any still-pending Delete job sign with the wrong key (invalid signature) or
+ * target a now-live actor. So before reviving we cancel the stranded Delete:
+ * remove its non-terminal (pending / processing / failed / retry_wait)
+ * delivery_queue rows AND the preserved Delete activity rows, so re-registration
+ * starts clean and no half-signed Delete is sent.
+ *
+ * Mirrors the activity/queue cleanup `reapDrainedTombstones` performs, but is
+ * unconditional (the revive supersedes the Delete) and only scoped to non-
+ * terminal delivery rows; terminal rows are removed alongside the activity.
+ * Returns the number of Delete activities cancelled.
+ */
+// D1 has no interactive transactions, but both the D1 and libsql drivers expose
+// `db.batch([...])`, which commits a list of prepared statements atomically. The
+// shared `Database` union aliases the abstract `BaseSQLiteDatabase` base (which
+// does not surface `batch`), so we narrow to the concrete batch surface here
+// rather than weakening the shared type (mirrors inbox-interaction-handlers.ts).
+type BatchStatement = BatchItem<"sqlite">;
+interface BatchableDb {
+  batch(
+    statements: readonly [BatchStatement, ...BatchStatement[]],
+  ): Promise<unknown>;
+}
+
+export async function cancelTombstoneDelete(
+  db: Database,
+  apId: string,
+): Promise<number> {
+  const deleteActivities = await db
+    .select({ apId: activities.apId })
+    .from(activities)
+    .where(and(eq(activities.actorApId, apId), eq(activities.type, "Delete")));
+  const deleteActivityIds = deleteActivities.map((a) => a.apId);
+  if (deleteActivityIds.length === 0) return 0;
+
+  // Drop every delivery_queue row for those Delete activities (any status — the
+  // Delete is superseded, including in-flight retry_wait jobs) together with the
+  // preserved Delete activity rows, so no signer can pick up a job referencing
+  // an activity whose actor row has been rotated. Each chunk's two deletes stay
+  // paired in one atomic batch; chunked because a prolific actor can have >100
+  // Delete activities, which would blow D1's 100-bound-param cap and 500 the
+  // revive.
+  for (const chunk of chunkForInClause(deleteActivityIds)) {
+    await (db as unknown as BatchableDb).batch([
+      db
+        .delete(deliveryQueue)
+        .where(inArray(deliveryQueue.activityApId, chunk)),
+      db.delete(activities).where(inArray(activities.apId, chunk)),
+    ]);
+  }
+
+  return deleteActivityIds.length;
+}
+
+// Best-effort, opportunistic tombstone reaping on the read path. This Worker
+// has no `scheduled` handler, so (mirroring maybeCleanupExpiredStories) the
+// sweep is triggered probabilistically and guarded so at most one runs per
+// isolate at a time. Tombstones are already excluded from every serving query,
+// so a missed sweep only delays storage/key-material reclamation.
+let tombstoneReapInFlight = false;
+
+export function maybeReapDrainedTombstones(db: Database): void {
+  if (tombstoneReapInFlight) return;
+  if (Math.random() >= 0.01) return; // ~1% of eligible requests per isolate
+
+  tombstoneReapInFlight = true;
+  reapDrainedTombstones(db)
+    .catch((err) => {
+      log.warn("Failed to reap drained tombstones", {
+        event: "actors.tombstone.reap_failed",
+        error: err,
+      });
+    })
+    .finally(() => {
+      tombstoneReapInFlight = false;
+    });
+}
+
+const actorsRoute = new Hono<{ Bindings: Env; Variables: Variables }>();
+
+// ---------------------------------------------------------------------------
+// Routes
+// ---------------------------------------------------------------------------
+
+// Get all local actors (cached 5 minutes)
+actorsRoute.get(
+  "/",
+  withCache({
+    ttl: CacheTTL.ACTOR_PROFILE,
+    cacheTag: CacheTags.ACTOR,
+  }),
+  async (c) => {
+    const db = c.get("db");
+    const limit = parseLimit(c.req.query("limit"), 100, 500);
+    const offset = parseOffset(c.req.query("offset"), 0, 10000);
+
+    const actorsList = await db
+      .select({
+        apId: actors.apId,
+        preferredUsername: actors.preferredUsername,
+        name: actors.name,
+        summary: actors.summary,
+        iconUrl: actors.iconUrl,
+        role: actors.role,
+        followerCount: actors.followerCount,
+        followingCount: actors.followingCount,
+        postCount: actors.postCount,
+        createdAt: actors.createdAt,
+      })
+      .from(actors)
+      .where(notDeleted(actors))
+      .orderBy(asc(actors.createdAt))
+      .limit(limit)
+      .offset(offset);
+
+    return c.json({
+      actors: actorsList.map((a) => ({
+        ap_id: a.apId,
+        preferred_username: a.preferredUsername,
+        name: a.name,
+        summary: a.summary,
+        icon_url: a.iconUrl,
+        role: a.role,
+        follower_count: a.followerCount,
+        following_count: a.followingCount,
+        post_count: a.postCount,
+        created_at: a.createdAt,
+        username: formatUsername(a.apId),
+      })),
+    });
+  },
+);
+
+// Get blocked users for current actor
+actorsRoute.get("/me/blocked", async (c) => {
+  return listRelation(
+    c,
+    (db, actorId, limit, offset) =>
+      db
+        .select({
+          blockedApId: blocks.blockedApId,
+          createdAt: blocks.createdAt,
+        })
+        .from(blocks)
+        .where(eq(blocks.blockerApId, actorId))
+        // createdAt is non-unique millisecond text; add the PK discriminator
+        // (blockedApId) so OFFSET paging is deterministic and same-ms ties are
+        // never skipped/duplicated across a page boundary.
+        .orderBy(desc(blocks.createdAt), desc(blocks.blockedApId))
+        .limit(limit)
+        .offset(offset),
+    "blockedApId",
+    "blocked",
+  );
+});
+
+// Block a user
+actorsRoute.post("/me/blocked", async (c) => {
+  return createRelation(
+    c,
+    "block",
+    async (db, actorId, targetId) => {
+      await db
+        .insert(blocks)
+        .values({ blockerApId: actorId, blockedApId: targetId })
+        .onConflictDoNothing();
+      // Sever BOTH follow edges + reconcile counts (mirrors the federated
+      // handleBlock). Without this a blocked actor who was an accepted follower
+      // stays in the fan-out set and keeps receiving the blocker's posts, and
+      // both actors' follower/following counts stay inflated — defeating the
+      // whole point of the block. severFollowEdge gates each decrement on an
+      // EXISTS(... status='accepted') subquery so a pending/absent edge is a
+      // clean no-op (no under-count). Pending follow-request rows are deleted by
+      // the edge delete inside severFollowEdge regardless of status.
+      await severFollowEdge(db, targetId, actorId); // target follows actor
+      await severFollowEdge(db, actorId, targetId); // actor follows target
+    },
+    async (db, actorId) =>
+      (
+        await db
+          .select({ n: count() })
+          .from(blocks)
+          .where(eq(blocks.blockerApId, actorId))
+          .get()
+      )?.n ?? 0,
+  );
+});
+
+// Unblock a user
+actorsRoute.delete("/me/blocked", async (c) => {
+  return deleteRelation(c, "block", (db, actorId, targetId) =>
+    db
+      .delete(blocks)
+      .where(
+        and(eq(blocks.blockerApId, actorId), eq(blocks.blockedApId, targetId)),
+      ),
+  );
+});
+
+// Get muted users for current actor
+actorsRoute.get("/me/muted", async (c) => {
+  return listRelation(
+    c,
+    (db, actorId, limit, offset) =>
+      db
+        .select({
+          mutedApId: mutes.mutedApId,
+          createdAt: mutes.createdAt,
+        })
+        .from(mutes)
+        .where(eq(mutes.muterApId, actorId))
+        // Deterministic tiebreaker on the PK discriminator (mutedApId); see the
+        // blocked list above.
+        .orderBy(desc(mutes.createdAt), desc(mutes.mutedApId))
+        .limit(limit)
+        .offset(offset),
+    "mutedApId",
+    "muted",
+  );
+});
+
+// Mute a user
+actorsRoute.post("/me/muted", async (c) => {
+  return createRelation(
+    c,
+    "mute",
+    (db, actorId, targetId) =>
+      db
+        .insert(mutes)
+        .values({ muterApId: actorId, mutedApId: targetId })
+        .onConflictDoNothing(),
+    async (db, actorId) =>
+      (
+        await db
+          .select({ n: count() })
+          .from(mutes)
+          .where(eq(mutes.muterApId, actorId))
+          .get()
+      )?.n ?? 0,
+  );
+});
+
+// Unmute a user
+actorsRoute.delete("/me/muted", async (c) => {
+  return deleteRelation(c, "mute", (db, actorId, targetId) =>
+    db
+      .delete(mutes)
+      .where(and(eq(mutes.muterApId, actorId), eq(mutes.mutedApId, targetId))),
+  );
+});
+
+// Delete own account (local only)
+actorsRoute.post("/me/delete", async (c) => {
+  const result = requireActor(c);
+  if (result instanceof Response) return result;
+  const actor = result;
+
+  const actorApIdVal = actor.ap_id;
+  const db = c.get("db");
+  const baseUrl = c.env.APP_URL;
+
+  try {
+    // Gather the owner's SUB-ACCOUNTS (profiles minted via /accounts + /switch)
+    // BEFORE the owner's own teardown. A sub-account is a first-class actor that
+    // can post / follow / like / join+own communities, so it needs the FULL
+    // cascade, not a mere tombstone. They are keyed by ownerActorApId === the
+    // owner's apId, which the owner teardown does NOT change (it only nulls the
+    // owner's own ownerActorApId field), so gathering them here is order-safe.
+    const subAccounts = await db
+      .select({ apId: actors.apId, followersUrl: actors.followersUrl })
+      .from(actors)
+      .where(eq(actors.ownerActorApId, actorApIdVal));
+
+    // Full owner teardown through the SINGLE shared cascade: it federates a
+    // Delete(Actor) (snapshotting follower inboxes before the graph is dropped),
+    // reconciles every counterparty's denormalized counters, deletes the actor's
+    // edges / interactions / memberships / media / DM state, hands off sole-owned
+    // communities to an heir, hard-deletes its authored objects, and
+    // tombstones+scrubs the actor row. This is the EXACT cascade teardownActor
+    // applies to each sub-account below — one chokepoint instead of a ~440-line
+    // hand-rolled copy that had to be kept in sync.
+    await teardownActor(db, c.env, baseUrl, actorApIdVal, actor.followers_url);
+    // Now fully tear down each sub-account (same cascade the owner just received)
+    // so no "deleted" sub-account content / edge / counter / membership / sole
+    // ownership survives, and each federates its own Delete(Actor).
+    for (const sub of subAccounts) {
+      await teardownActor(db, c.env, baseUrl, sub.apId, sub.followersUrl);
+    }
+
+    deleteCookie(c, "session");
+
+    return c.json({ success: true });
+  } catch (error) {
+    log.error("Account deletion failed", {
+      event: "actors.account.delete_failed",
+      actor: actorApIdVal,
+      error,
+    });
+    return c.json({ error: "Account deletion failed" }, 500);
+  }
+});
+
+// Get posts for a specific actor
+actorsRoute.get("/:identifier/posts", async (c) => {
+  const currentActor = c.get("actor");
+  const identifier = c.req.param("identifier");
+  const db = c.get("db");
+
+  const apId = await resolveActorApId(db, c.env.APP_URL, identifier);
+  if (!apId) return c.json({ error: "Actor not found" }, 404);
+
+  if (!(await actorExists(db, apId))) {
+    return c.json({ error: "Actor not found" }, 404);
+  }
+
+  const limit = parseLimit(c.req.query("limit"), 20, MAX_ACTOR_POSTS_LIMIT);
+  const before = c.req.query("before");
+  const isOwnProfile = currentActor && currentActor.ap_id === apId;
+
+  const conditions = [
+    eq(objects.type, "Note"),
+    isNull(objects.inReplyTo),
+    eq(objects.attributedTo, apId),
+  ];
+  if (isOwnProfile) {
+    conditions.push(ne(objects.visibility, "direct"));
+    // Exclude community GROUP-CHAT messages from the profile post feed. A chat
+    // message is a Note addressed to a community audience (audienceJson !== "[]")
+    // with NO communityApId, whereas a personal post has an empty audience and a
+    // community FEED post has communityApId set. Without this, your own chat
+    // messages leak into your profile's posts list (they are correctly hidden
+    // from other viewers by the public/empty-audience guard below).
+    conditions.push(
+      or(eq(objects.audienceJson, "[]"), isNotNull(objects.communityApId))!,
+    );
+  } else {
+    // Non-own profile: only globally-public posts. `visibility = "public"`
+    // alone is insufficient because community-scoped and explicitly-addressed
+    // posts can carry public-ish visibility while their reach is the audience
+    // list; without the empty-audience guard those would leak to anyone
+    // viewing the author's profile. An empty `audienceJson` ("[]") marks a
+    // post with no community/addressed scope, i.e. truly public reach.
+    conditions.push(eq(objects.visibility, "public"));
+    conditions.push(eq(objects.audienceJson, "[]"));
+  }
+  // Composite (published, apId) cursor so posts sharing a published millisecond
+  // aren't skipped at a page boundary (see lib/feed-cursor.ts).
+  const profileCursor = feedCursorWhere(
+    objects.published,
+    objects.apId,
+    before,
+  );
+  if (profileCursor) conditions.push(profileCursor);
+
+  // Project only the columns the response below reads — the profile feed must
+  // not load the large `raw_json` blob (and other unused columns), mirroring the
+  // timeline's POST_FEED_COLUMNS optimization which this path had missed.
+  const posts = await db
+    .select({
+      apId: objects.apId,
+      type: objects.type,
+      attributedTo: objects.attributedTo,
+      content: objects.content,
+      summary: objects.summary,
+      attachmentsJson: objects.attachmentsJson,
+      inReplyTo: objects.inReplyTo,
+      visibility: objects.visibility,
+      communityApId: objects.communityApId,
+      likeCount: objects.likeCount,
+      replyCount: objects.replyCount,
+      announceCount: objects.announceCount,
+      published: objects.published,
+      updated: objects.updated,
+    })
+    .from(objects)
+    .where(and(...conditions))
+    .orderBy(desc(objects.published), desc(objects.apId))
+    .limit(limit + 1);
+
+  const hasMore = posts.length > limit;
+  if (hasMore) posts.pop();
+  const lastPost = posts[posts.length - 1];
+  const nextCursor =
+    hasMore && lastPost
+      ? encodeFeedCursor(lastPost.published, lastPost.apId)
+      : null;
+
+  const postApIds = posts.map((p) => p.apId);
+  const authorApIds = [...new Set(posts.map((p) => p.attributedTo))];
+
+  const [authorMap, interactions] = await Promise.all([
+    loadActorInfoMap(db, authorApIds, "author"),
+    loadPostInteractions(db, currentActor?.ap_id ?? null, postApIds),
+  ]);
+
+  const resultList = posts.map((p) => {
+    const author = authorMap.get(p.attributedTo);
+    return {
+      ap_id: p.apId,
+      type: p.type,
+      author: {
+        ap_id: p.attributedTo,
+        username: formatUsername(p.attributedTo),
+        preferred_username: author?.preferredUsername || null,
+        name: author?.name || null,
+        icon_url: author?.iconUrl || null,
+      },
+      content: p.content,
+      summary: p.summary,
+      attachments: safeJsonParse(p.attachmentsJson, []),
+      in_reply_to: p.inReplyTo,
+      visibility: p.visibility,
+      community_ap_id: p.communityApId,
+      like_count: p.likeCount,
+      reply_count: p.replyCount,
+      announce_count: p.announceCount,
+      published: p.published,
+      edited_at: p.updated && p.updated !== p.published ? p.updated : null,
+      liked: interactions.likedIds.has(p.apId),
+      bookmarked: interactions.bookmarkedIds.has(p.apId),
+      reposted: interactions.repostedIds.has(p.apId),
+    };
+  });
+
+  return c.json({
+    posts: resultList,
+    has_more: hasMore,
+    next_cursor: nextCursor,
+  });
+});
+
+// Get actor by AP ID or username
+actorsRoute.get("/:identifier", async (c) => {
+  const currentActor = c.get("actor");
+  const identifier = c.req.param("identifier");
+  const baseUrl = c.env.APP_URL;
+  const db = c.get("db");
+
+  // For @user@remote-domain, we may need to return cached data directly
+  // (resolveActorApId only returns an apId when the cache has a match)
+  const apId = await resolveActorApId(db, baseUrl, identifier);
+  if (!apId) return c.json({ error: "Actor not found" }, 404);
+
+  // Try local actor first
+  const localActor = await db
+    .select({
+      apId: actors.apId,
+      preferredUsername: actors.preferredUsername,
+      name: actors.name,
+      summary: actors.summary,
+      iconUrl: actors.iconUrl,
+      headerUrl: actors.headerUrl,
+      role: actors.role,
+      followerCount: actors.followerCount,
+      followingCount: actors.followingCount,
+      postCount: actors.postCount,
+      isPrivate: actors.isPrivate,
+      createdAt: actors.createdAt,
+      fieldsJson: actors.fieldsJson,
+      alsoKnownAsJson: actors.alsoKnownAsJson,
+      movedTo: actors.movedTo,
+    })
+    .from(actors)
+    // Exclude tombstoned local actors so a deleted handle is not served as a
+    // live profile (consistent with the notDeleted filter used by the actor
+    // list and federation-serving queries).
+    .where(and(eq(actors.apId, apId), notDeleted(actors)))
+    .get();
+
+  if (!localActor) {
+    const cachedActor = await db
+      .select()
+      .from(actorCache)
+      .where(eq(actorCache.apId, apId))
+      .get();
+    if (!cachedActor) return c.json({ error: "Actor not found" }, 404);
+
+    // Project the remote actor's AS Person document (cached `rawJson`) so the
+    // client banner/fields work for REMOTE actors too: `attachment` ->
+    // PropertyValue fields, `alsoKnownAs` -> also_known_as, `movedTo` ->
+    // moved_to. Mirrors the local-actor projection below.
+    const raw = safeJsonParse<Record<string, unknown>>(cachedActor.rawJson, {});
+    const rawAttachment = Array.isArray(raw?.attachment) ? raw.attachment : [];
+    const rawAlsoKnownAs = Array.isArray(raw?.alsoKnownAs)
+      ? raw.alsoKnownAs.filter((a): a is string => typeof a === "string")
+      : [];
+    const rawMovedTo = typeof raw?.movedTo === "string" ? raw.movedTo : null;
+
+    return c.json({
+      actor: {
+        ap_id: cachedActor.apId,
+        preferred_username: cachedActor.preferredUsername,
+        name: cachedActor.name,
+        summary: cachedActor.summary,
+        icon_url: cachedActor.iconUrl,
+        username: formatUsername(cachedActor.apId),
+        fields: sanitizeProfileFields(rawAttachment),
+        also_known_as: rawAlsoKnownAs.slice(0, MAX_ALSO_KNOWN_AS),
+        moved_to: rawMovedTo,
+        is_following: false,
+        is_followed_by: false,
+      },
+    });
+  }
+
+  // Check follow status if logged in and viewing a different actor
+  let is_following = false;
+  let is_followed_by = false;
+
+  if (currentActor && currentActor.ap_id !== apId) {
+    const [followingStatus, followedByStatus] = await Promise.all([
+      db
+        .select({ followerApId: follows.followerApId })
+        .from(follows)
+        .where(
+          and(
+            eq(follows.followerApId, currentActor.ap_id),
+            eq(follows.followingApId, apId),
+            eq(follows.status, "accepted"),
+          ),
+        )
+        .get(),
+      db
+        .select({ followerApId: follows.followerApId })
+        .from(follows)
+        .where(
+          and(
+            eq(follows.followerApId, apId),
+            eq(follows.followingApId, currentActor.ap_id),
+            eq(follows.status, "accepted"),
+          ),
+        )
+        .get(),
+    ]);
+    is_following = !!followingStatus;
+    is_followed_by = !!followedByStatus;
+  }
+
+  return c.json({
+    actor: {
+      ap_id: localActor.apId,
+      preferred_username: localActor.preferredUsername,
+      name: localActor.name,
+      summary: localActor.summary,
+      icon_url: localActor.iconUrl,
+      header_url: localActor.headerUrl,
+      role: localActor.role,
+      follower_count: localActor.followerCount,
+      following_count: localActor.followingCount,
+      post_count: localActor.postCount,
+      is_private: localActor.isPrivate,
+      created_at: localActor.createdAt,
+      username: formatUsername(localActor.apId),
+      fields: sanitizeProfileFields(safeJsonParse(localActor.fieldsJson, [])),
+      also_known_as: safeJsonParse<string[]>(localActor.alsoKnownAsJson, []),
+      moved_to: localActor.movedTo,
+      is_following,
+      is_followed_by,
+    },
+  });
+});
+
+// Update own profile
+actorsRoute.put("/me", async (c) => {
+  const result = requireActor(c);
+  if (result instanceof Response) return result;
+  const actor = result;
+
+  const body = await c.req.json<{
+    name?: string;
+    summary?: string;
+    icon_url?: string;
+    header_url?: string;
+    is_private?: boolean;
+    fields?: Array<{ name?: unknown; value?: unknown }>;
+    also_known_as?: unknown;
+  }>();
+
+  const updates: Record<string, string | number | null> = {};
+
+  if (body.name !== undefined) {
+    // The json<{...}>() cast is compile-time only; a client can send a non-string
+    // (number/object/array), so guard before .trim() (else TypeError → 500).
+    if (typeof body.name !== "string") {
+      return c.json({ error: "Invalid name" }, 400);
+    }
+    const name = body.name.trim();
+    if (name.length > MAX_PROFILE_NAME_LENGTH) {
+      return c.json(
+        {
+          error: `Name too long (max ${MAX_PROFILE_NAME_LENGTH} chars)`,
+        },
+        400,
+      );
+    }
+    updates.name = name;
+  }
+  if (body.summary !== undefined) {
+    if (typeof body.summary !== "string") {
+      return c.json({ error: "Invalid summary" }, 400);
+    }
+    const summary = body.summary.trim();
+    if (summary.length > MAX_PROFILE_SUMMARY_LENGTH) {
+      return c.json(
+        {
+          error: `Summary too long (max ${MAX_PROFILE_SUMMARY_LENGTH} chars)`,
+        },
+        400,
+      );
+    }
+    updates.summary = summary.length > 0 ? summary : null;
+  }
+  for (const [bodyKey, dbKey, label] of [
+    ["icon_url", "iconUrl", "Icon URL"],
+    ["header_url", "headerUrl", "Header URL"],
+  ] as const) {
+    const raw = body[bodyKey];
+    if (raw !== undefined) {
+      if (typeof raw !== "string") {
+        return c.json({ error: `Invalid ${bodyKey}` }, 400);
+      }
+      const trimmed = raw.trim();
+      if (trimmed.length > MAX_PROFILE_URL_LENGTH) {
+        return c.json(
+          {
+            error: `${label} too long (max ${MAX_PROFILE_URL_LENGTH} chars)`,
+          },
+          400,
+        );
+      }
+      if (trimmed.length > 0 && !isValidProfileImageUrl(trimmed)) {
+        return c.json({ error: `Invalid ${bodyKey}` }, 400);
+      }
+      updates[dbKey] = trimmed.length > 0 ? trimmed : null;
+    }
+  }
+  if (body.is_private !== undefined) {
+    updates.isPrivate = body.is_private ? 1 : 0;
+  }
+
+  // Structured profile metadata (PropertyValue). Sanitized + capped so the
+  // served actor document and federated Update(Person) stay bounded.
+  let nextFields: ProfileField[] | undefined;
+  if (body.fields !== undefined) {
+    nextFields = sanitizeProfileFields(body.fields);
+    updates.fieldsJson = JSON.stringify(nextFields);
+  }
+
+  // Account-migration aliases (alsoKnownAs). Accept an array of AP-ID URLs the
+  // account claims; bound + validate so a Move target can reference us.
+  let nextAlsoKnownAs: string[] | undefined;
+  if (body.also_known_as !== undefined) {
+    if (!Array.isArray(body.also_known_as)) {
+      return c.json({ error: "also_known_as must be an array" }, 400);
+    }
+    const aliases: string[] = [];
+    for (const raw of body.also_known_as) {
+      if (aliases.length >= MAX_ALSO_KNOWN_AS) break;
+      if (typeof raw !== "string") continue;
+      const trimmed = raw.trim();
+      if (trimmed.length === 0) continue;
+      if (!isValidHttpUrl(trimmed)) {
+        return c.json({ error: `Invalid alsoKnownAs entry: ${trimmed}` }, 400);
+      }
+      if (!aliases.includes(trimmed)) aliases.push(trimmed);
+    }
+    nextAlsoKnownAs = aliases;
+    updates.alsoKnownAsJson = JSON.stringify(aliases);
+  }
+
+  if (Object.keys(updates).length === 0) {
+    return c.json({ error: "No fields to update" }, 400);
+  }
+
+  const db = c.get("db");
+  await db.update(actors).set(updates).where(eq(actors.apId, actor.ap_id));
+
+  // A replaced avatar/header is attached to no object, so no GC path reclaims
+  // the prior blob — reap it now if the old URL is a local /media upload no
+  // longer referenced anywhere (best-effort; never fails the update).
+  for (const [dbKey, oldUrl] of [
+    ["iconUrl", actor.icon_url],
+    ["headerUrl", actor.header_url],
+  ] as const) {
+    if (updates[dbKey] !== undefined && oldUrl && oldUrl !== updates[dbKey]) {
+      await reapReplacedMediaUrl(db, oldUrl, actor.ap_id, c.env.MEDIA);
+    }
+  }
+
+  // The `actor` context snapshot predates the new columns, so to federate a
+  // faithful Person we read the current persisted values when the request did
+  // not itself supply them.
+  if (nextFields === undefined || nextAlsoKnownAs === undefined) {
+    const persisted = await db
+      .select({
+        fieldsJson: actors.fieldsJson,
+        alsoKnownAsJson: actors.alsoKnownAsJson,
+      })
+      .from(actors)
+      .where(eq(actors.apId, actor.ap_id))
+      .get();
+    if (nextFields === undefined) {
+      nextFields = sanitizeProfileFields(
+        safeJsonParse(persisted?.fieldsJson, []),
+      );
+    }
+    if (nextAlsoKnownAs === undefined) {
+      const parsed = safeJsonParse<string[]>(persisted?.alsoKnownAsJson, []);
+      nextAlsoKnownAs = Array.isArray(parsed)
+        ? parsed.filter((a): a is string => typeof a === "string")
+        : [];
+    }
+  }
+
+  // Federate the profile change so remote followers do not see a stale
+  // Person. Every field this route can mutate (name / summary / icon /
+  // header / is_private) is part of the published actor document, so any
+  // applied update is federated-visible: build a fresh Update(Person) from
+  // the post-update values and fan it out to followers.
+  const baseUrl = c.env.APP_URL;
+  const nextName =
+    "name" in updates ? (updates.name as string | null) : actor.name;
+  const nextSummary =
+    "summary" in updates ? (updates.summary as string | null) : actor.summary;
+  const nextIconUrl =
+    "iconUrl" in updates ? (updates.iconUrl as string | null) : actor.icon_url;
+  const nextHeaderUrl =
+    "headerUrl" in updates
+      ? (updates.headerUrl as string | null)
+      : actor.header_url;
+  const nextIsPrivate =
+    "isPrivate" in updates ? (updates.isPrivate as number) : actor.is_private;
+
+  // Mirror the actor document served at the federation actor endpoint
+  // (routes/activitypub.ts) so remote servers receive a consistent Person.
+  const personObject: Record<string, unknown> = {
+    id: actor.ap_id,
+    type: actor.type,
+    preferredUsername: actor.preferred_username,
+    name: nextName,
+    summary: nextSummary,
+    inbox: actor.inbox,
+    outbox: actor.outbox,
+    followers: actor.followers_url,
+    following: actor.following_url,
+    endpoints: {
+      sharedInbox: `${baseUrl}/ap/inbox`,
+    },
+    publicKey: {
+      id: `${actor.ap_id}#main-key`,
+      owner: actor.ap_id,
+      publicKeyPem: actor.public_key_pem,
+    },
+    discoverable: !nextIsPrivate,
+    manuallyApprovesFollowers: Boolean(nextIsPrivate),
+  };
+  if (nextIconUrl) {
+    // Relative `/media/...` upload paths must be absolutized so remote servers
+    // can dereference the avatar; absolute URLs pass through unchanged.
+    personObject.icon = {
+      type: "Image",
+      url: safeUrlJoin(baseUrl, nextIconUrl),
+    };
+  }
+  if (nextHeaderUrl) {
+    personObject.image = {
+      type: "Image",
+      url: safeUrlJoin(baseUrl, nextHeaderUrl),
+    };
+  }
+  if (nextFields && nextFields.length > 0) {
+    personObject.attachment = fieldsToAttachments(nextFields);
+  }
+  if (nextAlsoKnownAs && nextAlsoKnownAs.length > 0) {
+    personObject.alsoKnownAs = nextAlsoKnownAs;
+  }
+
+  const updateActivityId = activityApId(baseUrl, generateId());
+  const updateActivity = {
+    "@context": [
+      "https://www.w3.org/ns/activitystreams",
+      "https://w3id.org/security/v1",
+      {
+        schema: "http://schema.org#",
+        PropertyValue: "schema:PropertyValue",
+        value: "schema:value",
+        toot: "http://joinmastodon.org/ns#",
+        alsoKnownAs: { "@id": "as:alsoKnownAs", "@type": "@id" },
+        movedTo: { "@id": "as:movedTo", "@type": "@id" },
+        manuallyApprovesFollowers: "as:manuallyApprovesFollowers",
+      },
+    ],
+    id: updateActivityId,
+    type: "Update",
+    actor: actor.ap_id,
+    to: ["https://www.w3.org/ns/activitystreams#Public"],
+    cc: [actor.followers_url],
+    object: personObject,
+  };
+
+  try {
+    await db.insert(activities).values({
+      apId: updateActivityId,
+      type: "Update",
+      actorApId: actor.ap_id,
+      objectApId: actor.ap_id,
+      rawJson: JSON.stringify(updateActivity),
+      direction: "outbound",
+    });
+    await enqueueFanoutToFollowers(c.env, updateActivityId, actor.ap_id);
+  } catch (err) {
+    // Federation is best-effort; the local profile update already succeeded.
+    log.error("Failed to enqueue profile Update federation", {
+      event: "actors.profile.update_federation_failed",
+      actor: actor.ap_id,
+      error: err,
+    });
+  }
+
+  return c.json({ success: true });
+});
+
+// Initiate an account migration: declare the destination and federate a
+// Move(actor -> target) to followers. The destination must already list this
+// account in its own `alsoKnownAs` (verified by remote servers); we persist
+// `moved_to` so the served actor document advertises the migration and emit
+// the Move so followers can re-follow the target.
+actorsRoute.post("/me/move", async (c) => {
+  const result = requireActor(c);
+  if (result instanceof Response) return result;
+  const actor = result;
+
+  const body = await c.req
+    .json<{ target?: unknown }>()
+    .catch(() => ({}) as { target?: unknown });
+  const rawTarget = typeof body.target === "string" ? body.target.trim() : "";
+  if (rawTarget.length === 0) {
+    return c.json({ error: "target is required" }, 400);
+  }
+  // Accept either a full actor URL or a @user@domain fediverse handle (the
+  // latter is WebFinger-resolved to its actor URL — what the move field's
+  // placeholder shows and what users actually know).
+  const target = await resolveMoveTarget(rawTarget);
+  if (!target || !isValidHttpUrl(target)) {
+    return c.json({ error: "Invalid move target" }, 400);
+  }
+  if (target === actor.ap_id) {
+    return c.json({ error: "Cannot move an account to itself" }, 400);
+  }
+  if (!isSafeRemoteUrl(target)) {
+    return c.json({ error: "Invalid move target" }, 400);
+  }
+
+  // Refuse to advertise a migration the destination has not consented to. A
+  // compliant receiver (Mastodon, and our own inbound handleMove) REJECTS a
+  // Move whose destination does not list this account in its `alsoKnownAs`, so
+  // without this check the move would silently no-op on every follower's server
+  // while appearing successful locally. Verifying here gives the user an
+  // actionable error: add this account as an alias on the destination first.
+  if (
+    !(await destinationDeclaresAlias(
+      target,
+      actor.ap_id,
+      await getInstanceFetchSigner(c),
+    ))
+  ) {
+    return c.json(
+      {
+        error:
+          "The destination account must list this account in its aliases (alsoKnownAs) before migrating. Add this account as an alias there, then retry.",
+      },
+      422,
+    );
+  }
+
+  const db = c.get("db");
+  const baseUrl = c.env.APP_URL;
+
+  await db
+    .update(actors)
+    .set({ movedTo: target })
+    .where(eq(actors.apId, actor.ap_id));
+
+  // Federate Move(actor) addressed to followers so they migrate their follow.
+  const moveActivityId = activityApId(baseUrl, generateId());
+  const moveActivity = {
+    "@context": "https://www.w3.org/ns/activitystreams",
+    id: moveActivityId,
+    type: "Move",
+    actor: actor.ap_id,
+    object: actor.ap_id,
+    target,
+    to: ["https://www.w3.org/ns/activitystreams#Public"],
+    cc: [actor.followers_url],
+  };
+
+  try {
+    await db.insert(activities).values({
+      apId: moveActivityId,
+      type: "Move",
+      actorApId: actor.ap_id,
+      objectApId: actor.ap_id,
+      rawJson: JSON.stringify(moveActivity),
+      direction: "outbound",
+    });
+    await enqueueFanoutToFollowers(c.env, moveActivityId, actor.ap_id);
+  } catch (err) {
+    // Federation is best-effort; the local moved_to marker already persisted.
+    log.error("Failed to enqueue account Move federation", {
+      event: "actors.account.move_federation_failed",
+      actor: actor.ap_id,
+      error: err,
+    });
+  }
+
+  return c.json({ success: true, moved_to: target });
+});
+
+// Personal-portability data export: a bounded JSON archive of the actor's
+// profile + authored posts (outbox-style) + follow graph + media manifest.
+// Every collection is capped so a single request cannot OOM the worker; this
+// is a portability aid, not a streaming full backup.
+actorsRoute.get("/me/export", async (c) => {
+  const result = requireActor(c);
+  if (result instanceof Response) return result;
+  const actor = result;
+  const db = c.get("db");
+  const actorApIdVal = actor.ap_id;
+
+  const profileRow = await db
+    .select({
+      apId: actors.apId,
+      type: actors.type,
+      preferredUsername: actors.preferredUsername,
+      name: actors.name,
+      summary: actors.summary,
+      iconUrl: actors.iconUrl,
+      headerUrl: actors.headerUrl,
+      isPrivate: actors.isPrivate,
+      role: actors.role,
+      createdAt: actors.createdAt,
+      fieldsJson: actors.fieldsJson,
+      alsoKnownAsJson: actors.alsoKnownAsJson,
+      movedTo: actors.movedTo,
+    })
+    .from(actors)
+    .where(eq(actors.apId, actorApIdVal))
+    .get();
+
+  if (!profileRow) return c.json({ error: "Actor not found" }, 404);
+
+  const [authoredPosts, following, followers, media] = await Promise.all([
+    db
+      .select()
+      .from(objects)
+      .where(and(eq(objects.attributedTo, actorApIdVal), notDeleted(objects)))
+      .orderBy(desc(objects.published))
+      .limit(MAX_EXPORT_POSTS),
+    db
+      .select({
+        followingApId: follows.followingApId,
+        status: follows.status,
+        createdAt: follows.createdAt,
+      })
+      .from(follows)
+      .where(eq(follows.followerApId, actorApIdVal))
+      .orderBy(desc(follows.createdAt))
+      .limit(MAX_EXPORT_RELATIONS),
+    db
+      .select({
+        followerApId: follows.followerApId,
+        status: follows.status,
+        createdAt: follows.createdAt,
+      })
+      .from(follows)
+      .where(eq(follows.followingApId, actorApIdVal))
+      .orderBy(desc(follows.createdAt))
+      .limit(MAX_EXPORT_RELATIONS),
+    db
+      .select({
+        id: mediaUploads.id,
+        r2Key: mediaUploads.r2Key,
+        contentType: mediaUploads.contentType,
+        size: mediaUploads.size,
+        createdAt: mediaUploads.createdAt,
+      })
+      .from(mediaUploads)
+      .where(eq(mediaUploads.uploaderApId, actorApIdVal))
+      .orderBy(desc(mediaUploads.createdAt))
+      .limit(MAX_EXPORT_MEDIA),
+  ]);
+
+  const archive = {
+    "@context": "https://www.w3.org/ns/activitystreams",
+    exported_at: new Date().toISOString(),
+    actor: {
+      ap_id: profileRow.apId,
+      type: profileRow.type,
+      preferred_username: profileRow.preferredUsername,
+      name: profileRow.name,
+      summary: profileRow.summary,
+      icon_url: profileRow.iconUrl,
+      header_url: profileRow.headerUrl,
+      is_private: profileRow.isPrivate,
+      role: profileRow.role,
+      created_at: profileRow.createdAt,
+      fields: sanitizeProfileFields(safeJsonParse(profileRow.fieldsJson, [])),
+      also_known_as: safeJsonParse<string[]>(profileRow.alsoKnownAsJson, []),
+      moved_to: profileRow.movedTo,
+      username: formatUsername(profileRow.apId),
+    },
+    outbox: {
+      type: "OrderedCollection",
+      total_items: authoredPosts.length,
+      truncated: authoredPosts.length >= MAX_EXPORT_POSTS,
+      ordered_items: authoredPosts.map((p) => ({
+        ap_id: p.apId,
+        type: p.type,
+        content: p.content,
+        summary: p.summary,
+        attachments: safeJsonParse(p.attachmentsJson, []),
+        in_reply_to: p.inReplyTo,
+        visibility: p.visibility,
+        community_ap_id: p.communityApId,
+        published: p.published,
+        updated: p.updated,
+      })),
+    },
+    following: {
+      total_items: following.length,
+      truncated: following.length >= MAX_EXPORT_RELATIONS,
+      items: following.map((f) => ({
+        ap_id: f.followingApId,
+        status: f.status,
+        created_at: f.createdAt,
+      })),
+    },
+    followers: {
+      total_items: followers.length,
+      truncated: followers.length >= MAX_EXPORT_RELATIONS,
+      items: followers.map((f) => ({
+        ap_id: f.followerApId,
+        status: f.status,
+        created_at: f.createdAt,
+      })),
+    },
+    media: {
+      total_items: media.length,
+      truncated: media.length >= MAX_EXPORT_MEDIA,
+      items: media.map((m) => ({
+        id: m.id,
+        key: m.r2Key,
+        content_type: m.contentType,
+        size: m.size,
+        created_at: m.createdAt,
+      })),
+    },
+  };
+
+  c.header(
+    "Content-Disposition",
+    `attachment; filename="${profileRow.preferredUsername}-export.json"`,
+  );
+  return c.json(archive);
+});
+
+// Get actor's followers
+actorsRoute.get("/:identifier/followers", async (c) =>
+  listFollowRelation(c, "followers"),
+);
+
+// Get actor's following
+actorsRoute.get("/:identifier/following", async (c) =>
+  listFollowRelation(c, "following"),
+);
+
+export default actorsRoute;