@takosjp/yurucommu-core 3.0.3 → 3.2.1

package/README.en.md

@@ -0,0 +1,92 @@
+日本語: [README.md](README.md)
+
+# Yurucommu Core
+
+Yurucommu Core is the shared **ActivityPub / API / DB / runtime engine library**
+for the yurucommu family. It is not the installable product repo and it does not
+own an OpenTofu Capsule.
+
+The deployable products are separate repositories:
+
+- `yurucommu` owns the feed / story / profile fullstack product, `yurucommu.com`,
+  its Worker artifact, and its OpenTofu Capsule.
+- `yurumeet` owns the talk-first fullstack product. `yurume` is the short client
+  id / abbreviation used in discovery and push registration.
+
+## Features
+
+- **ActivityPub federation** — follow, post, boost, like, and reply across
+  servers to link your communities and connections, with HTTP-signature
+  verification, SSRF-guarded fetches, and actor/domain blocklists.
+- **Server API** — actor, post, story, DM, community, media, notification, and
+  mobile-push routes.
+- **Client contract** — a typed SDK and discovery types for yurucommu,
+  yurumeet, mobile, and alternate clients.
+- **Search, notifications, recommendations** — discover people and content.
+- **Auth** — password, Google / X OAuth, and Takosumi Accounts OIDC consumer.
+- **Bilingual UI** — Japanese / English.
+
+## Deployment Boundary
+
+Do not install this repo as a Capsule. Install `yurucommu` or `yurumeet`
+instead. Those product repos bundle their own UI with this server engine, publish
+their own Worker artifact, and expose their own plain OpenTofu module.
+
+Client implementations should use `@takosjp/yurucommu-api`. Product Worker
+artifacts use `@takosjp/yurucommu-core/server` to create the Hono backend and
+`@takosjp/yurucommu-core/migrations` for D1 migration activation. They should
+not import unpublished source paths from this checkout.
+
+## Develop
+
+```bash
+cd yurucommu-core
+bun install
+bun run check   # tsc --noEmit
+bun test        # bun:test suite
+bun run lint    # type check
+bun run fmt     # prettier
+```
+
+The backend engine source lives in `src/backend` (Hono routes, ActivityPub
+federation, delivery pipeline), the shared npm API package in `packages/api`,
+and the database schema and migrations in `src/db/schema` and `migrations/`.
+
+API package commands:
+
+```bash
+bun run build:api  # build @takosjp/yurucommu-api
+bun run pack:api   # npm pack --dry-run for the API package
+```
+
+### Release order for notification support in 3.1.0
+
+The browser notification public API and `0019_notification_push_delivery.sql` become part of the core/API contract in
+`3.1.0`. Publish both packages from the same `v3.1.0` tag and require the packed-consumer gate to pass first. Only after
+that version is available from the npm registry may `yurucommu` and `yurumeet` update their dependency ranges and
+`bun.lock` files from the registry. Each product must then pass `bun run check:core-release` before releasing its Worker.
+Do not substitute unpublished source through a `file:`, `workspace:`, or Git dependency.
+
+Yurumeet and mobile clients live in separate repositories. They should depend on
+`@takosjp/yurucommu-api`, discover a server through Capsule outputs or
+`/.well-known/social-server`, and deploy their own static/runtime artifact
+through Takosumi, Cloudflare, or a self-host runtime. Local checkouts can be
+placed under `clients/` for debugging, but that directory is intentionally
+ignored so the server repo stays small.
+
+When a client runs on a separate origin, the yurucommu-server must include that
+origin in its CORS / CSRF allowlist.
+
+## Boundaries
+
+Yurucommu implements its own ActivityPub federation, content distribution, and
+user identity entirely at the app layer — it does not depend on Takos core
+services or on a platform-layer federation mechanism. When installed through
+Takosumi it is a normal Capsule a user can remove, and it is never absorbed into
+Takos core. See [`AGENTS.md`](AGENTS.md) for the full product boundary.
+
+## Documentation
+
+- [Deployment guide](https://yurucommu.com/help/deployment.html)
+- [Getting started](https://yurucommu.com/help/getting-started.html)
+- [Help site](https://yurucommu.com/help/)

package/README.md

@@ -1,41 +1,44 @@
 # Yurucommu Core
 
-Yurucommu Core is the shared **ActivityPub / API / DB / runtime engine library**
-for the yurucommu family. It is not the installable product repo and it does not
-own an OpenTofu Capsule.
+English: [README.en.md](README.en.md)
 
-The deployable products are separate repositories:
+Yurucommu Core は、yurucommu family の製品 (yurucommu / yurumeet など) が共通で使う
+**ActivityPub / API / DB / runtime エンジンのライブラリ** です。分散 SNS の連合・サーバー API・
+データベース層を 1 か所に実装しておくことで、各製品は UI に集中できます。
 
-- `yurucommu` owns the feed / story / profile fullstack product, `yurucommu.com`,
-  its Worker artifact, and its OpenTofu Capsule.
-- `yurumeet` owns the talk-first fullstack product. `yurume` is the short client
-  id / abbreviation used in discovery and push registration.
+これはインストールできる製品の repo ではなく、OpenTofu Capsule (Git URL から取り込む
+1 つのアプリ/インフラ単位) も持ちません。deploy できる製品は別の repo にあります。
 
-## Features
+- `yurucommu` — フィード / ストーリー / プロフィールの fullstack product。`yurucommu.com`・
+  Worker artifact・OpenTofu Capsule を持ちます
+- `yurumeet` — トーク中心の fullstack product。`yurume` は discovery と push 登録で使う
+  短い client id / 略称です
 
-- **ActivityPub federation** — follow, post, boost, like, and reply across
-  servers to link your communities and connections, with HTTP-signature
-  verification, SSRF-guarded fetches, and actor/domain blocklists.
-- **Server API** — actor, post, story, DM, community, media, notification, and
-  mobile-push routes.
-- **Client contract** — a typed SDK and discovery types for yurucommu,
-  Yurumeet, mobile, and alternate clients.
-- **Search, notifications, recommendations** — discover people and content.
-- **Auth** — password, Google / X OAuth, and Takosumi Accounts OIDC consumer.
-- **Bilingual UI** — Japanese / English.
+## できること
 
-## Deployment Boundary
+- **ActivityPub 連合** — フォロー・投稿・ブースト・いいね・返信をサーバーをまたいで行い、
+  コミュニティとつながりを結びます。HTTP-signature の検証、SSRF 対策済みの fetch、
+  actor / ドメインのブロックリストを備えます
+- **サーバー API** — actor・投稿・ストーリー・DM・コミュニティ・メディア・通知・
+  モバイル push の route を提供します
+- **クライアント契約** — yurucommu・yurumeet・モバイル・代替クライアント向けの型付き SDK と
+  discovery の型を提供します
+- **検索・通知・レコメンド** — 人とコンテンツを見つけられます
+- **認証** — パスワード、Google / X OAuth、Takosumi Accounts の OIDC クライアントに対応します
+- **二言語 UI** — 日本語 / 英語に対応します
 
-Do not install this repo as a Capsule. Install `yurucommu` or `yurumeet`
-instead. Those product repos bundle their own UI with this server engine, publish
-their own Worker artifact, and expose their own plain OpenTofu module.
+## 使い方の境界
 
-Client implementations should use `@takosjp/yurucommu-api`. Product Worker
-artifacts use `@takosjp/yurucommu-core/server` to create the Hono backend and
-`@takosjp/yurucommu-core/migrations` for D1 migration activation. They should
-not import unpublished source paths from this checkout.
+この repo を Capsule としてインストールしないでください。代わりに `yurucommu` または
+`yurumeet` をインストールします。これらの製品 repo が、自分の UI とこのサーバーエンジンを束ね、
+自分の Worker artifact を公開し、自分の plain OpenTofu module を持ちます。
 
-## Develop
+クライアント実装は `@takosjp/yurucommu-api` を使ってください。製品の Worker artifact は
+`@takosjp/yurucommu-core/server` で Hono backend を作成し、
+`@takosjp/yurucommu-core/migrations` で D1 migration を有効化します。この checkout の
+未公開 source path を import してはいけません。
+
+## 開発者向け
 
 ```bash
 cd yurucommu-core
@@ -46,36 +49,42 @@ bun run lint    # type check
 bun run fmt     # prettier
 ```
 
-The backend engine source lives in `src/backend` (Hono routes, ActivityPub
-federation, delivery pipeline), the shared npm API package in `packages/api`,
-and the database schema and migrations in `src/db/schema` and `migrations/`.
+backend エンジンの source は `src/backend` (Hono routes、ActivityPub 連合、配送 pipeline)、
+共有 npm API package は `packages/api`、データベースの schema と migration は
+`src/db/schema` と `migrations/` にあります。
 
-API package commands:
+API package のコマンド:
 
 ```bash
 bun run build:api  # build @takosjp/yurucommu-api
 bun run pack:api   # npm pack --dry-run for the API package
 ```
 
-Yurumeet and mobile clients live in separate repositories. They should depend on
-`@takosjp/yurucommu-api`, discover a server through Capsule outputs or
-`/.well-known/social-server`, and deploy their own static/runtime artifact
-through Takosumi, Cloudflare, or a self-host runtime. Local checkouts can be
-placed under `clients/` for debugging, but that directory is intentionally
-ignored so the server repo stays small.
+### 通知機能を含む 3.1.0 の release 順序
+
+ブラウザ通知の public API と `0019_notification_push_delivery.sql` は core / API `3.1.0` からの契約です。
+まずこの repo で両 package を同じ `v3.1.0` tag から npm に公開し、packaged consumer gate が通ることを確認します。
+その公開が registry から取得できるようになった後にだけ、`yurucommu` / `yurumeet` の dependency range と
+`bun.lock` を registry package から更新し、各 repo の `bun run check:core-release` を通してから製品版 Worker を
+release します。`file:` / `workspace:` / Git dependency で未公開 source を代用してはいけません。
+
+Yurumeet とモバイルクライアントは別 repo にあります。これらは `@takosjp/yurucommu-api` に依存し、
+Capsule の output または `/.well-known/social-server` でサーバーを見つけ、自分の静的/runtime
+artifact を Takosumi・Cloudflare・self-host の実行環境で deploy します。デバッグ用に
+`clients/` の下へローカル checkout を置けますが、このディレクトリは意図的に git 管理外に
+してあり、サーバー repo を小さく保ちます。
 
-When a client runs on a separate origin, the yurucommu-server must include that
-origin in its CORS / CSRF allowlist.
+クライアントが別 origin で動く場合、yurucommu サーバー側の CORS / CSRF の許可リストに
+その origin を含める必要があります。
 
-## Boundaries
+## 製品としての境界
 
-Yurucommu implements its own ActivityPub federation, content distribution, and
-user identity entirely at the app layer — it does not depend on Takos core
-services or on a platform-layer federation mechanism. When installed through
-Takosumi it is a normal Capsule a user can remove, and it is never absorbed into
-Takos core. See [`AGENTS.md`](AGENTS.md) for the full product boundary.
+Yurucommu は ActivityPub 連合・コンテンツ配送・ユーザー identity をすべてアプリ層で自前実装して
+います。Takos core のサービスにも、プラットフォーム層の連合の仕組みにも依存しません。Takosumi 経由で
+インストールされた場合もユーザーが削除できる通常の Capsule であり、Takos core に取り込まれることは
+ありません。詳しい境界は [`AGENTS.md`](AGENTS.md) を参照してください。
 
-## Documentation
+## ドキュメント
 
 - [Deployment guide](https://yurucommu.com/help/deployment.html)
 - [Getting started](https://yurucommu.com/help/getting-started.html)

package/migrations/0019_notification_push_delivery.sql

@@ -0,0 +1,103 @@
+-- NO foreign keys on these tables. Cloudflare D1 ENFORCES declared FKs (see
+-- 0010/0011, which dropped the actors FKs for exactly that reason), local
+-- libsql runs with enforcement OFF, and the trigger below fires on EVERY
+-- unread inbox insert — an actors FK here would let a single missing actors
+-- row abort unrelated inbox writes in production only. Referential cleanup is
+-- app-level, like everywhere else (routes/account-teardown.ts).
+CREATE TABLE IF NOT EXISTS notification_pushers (
+  id TEXT PRIMARY KEY,
+  actor_ap_id TEXT NOT NULL,
+  product TEXT NOT NULL,
+  scope TEXT,
+  kind TEXT NOT NULL DEFAULT 'http',
+  app_id TEXT NOT NULL,
+  pushkey TEXT NOT NULL,
+  pushkey_hash TEXT NOT NULL,
+  app_display_name TEXT,
+  device_display_name TEXT,
+  profile_tag TEXT,
+  lang TEXT,
+  data_json TEXT NOT NULL DEFAULT '{}',
+  gateway_url TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  last_seen_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+);
+
+-- Device uniqueness is (product, app_id, pushkey_hash) — strictly stronger
+-- than any actor-scoped variant, so no second unique index is declared.
+CREATE INDEX IF NOT EXISTS notification_pushers_actor_product_idx
+  ON notification_pushers(actor_ap_id, product);
+
+CREATE UNIQUE INDEX IF NOT EXISTS notification_pushers_device_idx
+  ON notification_pushers(product, app_id, pushkey_hash);
+
+CREATE INDEX IF NOT EXISTS notification_pushers_last_seen_idx
+  ON notification_pushers(last_seen_at);
+
+CREATE TABLE IF NOT EXISTS notification_push_jobs (
+  id TEXT PRIMARY KEY,
+  actor_ap_id TEXT NOT NULL,
+  activity_ap_id TEXT NOT NULL,
+  product TEXT,
+  status TEXT NOT NULL DEFAULT 'pending',
+  processing_token TEXT,
+  attempts INTEGER NOT NULL DEFAULT 0,
+  pending_pusher_ids_json TEXT,
+  next_attempt_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  last_error TEXT,
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  delivered_at TEXT
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS notification_push_jobs_actor_activity_idx
+  ON notification_push_jobs(actor_ap_id, activity_ap_id);
+
+CREATE INDEX IF NOT EXISTS notification_push_jobs_status_next_idx
+  ON notification_push_jobs(status, next_attempt_at);
+
+CREATE INDEX IF NOT EXISTS notification_push_jobs_terminal_retention_idx
+  ON notification_push_jobs(status, updated_at);
+
+CREATE INDEX IF NOT EXISTS notification_push_jobs_actor_idx
+  ON notification_push_jobs(actor_ap_id);
+
+-- Durable notification outbox: every unread inbox insert gets exactly one job.
+-- The deterministic id contains only row identifiers and is never exposed to a
+-- client. Delivery Queue messages carry this id, not pushkeys or content.
+CREATE TRIGGER IF NOT EXISTS notification_push_jobs_after_inbox_insert
+AFTER INSERT ON inbox
+WHEN NEW.read = 0
+BEGIN
+  INSERT OR IGNORE INTO notification_push_jobs (
+    id,
+    actor_ap_id,
+    activity_ap_id,
+    product,
+    status,
+    attempts,
+    next_attempt_at,
+    created_at,
+    updated_at
+  ) VALUES (
+    NEW.actor_ap_id || char(10) || NEW.activity_ap_id,
+    NEW.actor_ap_id,
+    NEW.activity_ap_id,
+    NULL,
+    'pending',
+    0,
+    strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
+    strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
+    strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+  );
+END;
+
+CREATE TRIGGER IF NOT EXISTS notification_push_jobs_after_inbox_delete
+AFTER DELETE ON inbox
+BEGIN
+  DELETE FROM notification_push_jobs
+  WHERE actor_ap_id = OLD.actor_ap_id
+    AND activity_ap_id = OLD.activity_ap_id
+    AND status IN ('pending', 'queued', 'retry_wait');
+END;

package/migrations/README.md

@@ -69,14 +69,15 @@ file name (not the numeric version) in `yurucommu_migrations`.
    ```
 
    Remote Cloudflare D1 rejects explicit `BEGIN` / `SAVEPOINT` statements through
-   this API, so the Takosumi release path disables transaction wrappers while
+   this API, so the Takosumi lifecycle-action path disables transaction wrappers while
    keeping the local/libSQL path wrapped by default.
 
 4. **Post-apply activation**:
 
-   In the OpenTofu-managed Worker path, the product repo's
-   `takosumi_release.post_apply` runs
-   `bun run takosumi:release -- --migrations-only` as an opaque runner command.
+   In the OpenTofu-managed Worker path, the operator stores a versioned
+   `post_apply` lifecycle action in Takosumi's service-side InstallConfig. It
+   runs `bun run takosumi:release -- --migrations-only` as an opaque runner
+   command; no OpenTofu Output declares or selects it.
    It reads non-secret outputs from `TAKOSUMI_OUTPUTS_JSON`, writes a temporary
    Wrangler config, and applies these core migrations through
    `wrangler d1 execute` without explicit SQL transaction wrappers. Provider
@@ -101,8 +102,8 @@ file name (not the numeric version) in `yurucommu_migrations`.
 ## Product-local ledger note
 
 The `yurucommu_migrations` ledger is yurucommu-family product state. The
-Takosumi-managed path invokes product-owned `takosumi_release.post_apply`
-commands and records activation status/logs; it does not expose a Takosumi DB
+Takosumi-managed path invokes product-owned service-side lifecycle actions and
+records activation status/logs; it does not expose a Takosumi DB
 migration API. A future core migration may add `checksum TEXT` and store
 `sha256:<hex>` per applied migration, but that requires coordination with
 production data in both yurucommu and Yurumeet installations.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@takosjp/yurucommu-core",
-  "version": "3.0.3",
+  "version": "3.2.1",
   "license": "AGPL-3.0-only",
   "type": "module",
   "workspaces": [
@@ -23,6 +23,7 @@
     "packages/api/src/lib/api/account.ts",
     "packages/api/src/lib/api/actors.ts",
     "packages/api/src/lib/api/auth.ts",
+    "packages/api/src/lib/api/browser-push.ts",
     "packages/api/src/lib/api/communities.ts",
     "packages/api/src/lib/api/dm.ts",
     "packages/api/src/lib/api/fetch.ts",
@@ -31,8 +32,10 @@
     "packages/api/src/lib/api/moderation.ts",
     "packages/api/src/lib/api/notes.ts",
     "packages/api/src/lib/api/normalize.ts",
+    "packages/api/src/lib/api/notification-target.ts",
     "packages/api/src/lib/api/notifications.ts",
     "packages/api/src/lib/api/posts.ts",
+    "packages/api/src/lib/api/push-config.ts",
     "packages/api/src/lib/api/recommendations.ts",
     "packages/api/src/lib/api/search.ts",
     "packages/api/src/lib/api/stories.ts",
@@ -55,18 +58,21 @@
     "start": "bun src/backend/server.ts",
     "dev": "bun src/backend/server.ts",
     "dev:server": "bun src/backend/server.ts",
-    "check": "tsc --noEmit",
-    "test": "bun run build:api && bun test test/ src/backend/ packages/api/src/",
+    "check": "tsc --noEmit && bun run check:no-opentofu-artifacts",
+    "check:no-opentofu-artifacts": "bun scripts/check-no-opentofu-artifacts.mjs",
+    "test": "bun run build:api && bun test test/ src/backend/ packages/api/src/ scripts/check-publish-version-discipline.test.ts scripts/publish-package-resumable.test.ts && bun run check:release-contents",
     "test:backend": "bun test src/backend/",
     "build": "bun run build:api",
     "build:api": "cd packages/api && bun run build",
+    "check:release-contents": "bun scripts/check-release-contents.mjs",
+    "check:packed-consumer": "bun scripts/check-packed-consumer.mjs",
     "prepublishOnly": "bun scripts/check-publish-version-discipline.mjs .",
     "pack:core": "npm pack --dry-run",
     "pack:api": "cd packages/api && bun run pack:dry",
     "app:activate": "bun scripts/apply-takosumi-migrations.ts",
     "lint": "bun run check",
-    "fmt": "bunx prettier --write src test packages/api",
-    "fmt:check": "bunx prettier --check src test packages/api",
+    "fmt": "bunx prettier --write src test packages/api scripts",
+    "fmt:check": "bunx prettier --check src test packages/api scripts",
     "db:generate": "bunx drizzle-kit generate",
     "db:push": "bunx drizzle-kit push",
     "db:migrate": "bunx drizzle-kit migrate",

package/packages/api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@takosjp/yurucommu-api",
-  "version": "3.0.3",
+  "version": "3.2.1",
   "description": "Typed client SDK and public API contract for yurucommu-server clients.",
   "license": "AGPL-3.0-only",
   "type": "module",