@takosjp/yurucommu-core 3.2.0 → 3.3.0

package/src/backend/routes/communities/messages.ts

@@ -18,9 +18,9 @@ import {
 } from "../../federation-helpers.ts";
 import { feedCursorWhere } from "../../lib/feed-cursor.ts";
 import {
-  MAX_ATTACHMENTS,
-  MAX_ATTACHMENTS_JSON_LENGTH,
-} from "../posts/transformers.ts";
+  type ChatAttachment,
+  validateChatAttachments,
+} from "../../lib/attachments.ts";
 import { communityRequiresMembership } from "../../lib/community-visibility.ts";
 import { rateLimit, RateLimitConfigs } from "../../middleware/rate-limit.ts";
 import {
@@ -38,30 +38,9 @@ import {
 
 const MAX_COMMUNITY_MESSAGE_LENGTH = 5000;
 const MAX_COMMUNITY_MESSAGES_LIMIT = 100;
-
-type ChatAttachment = Record<string, unknown>;
-
-/**
- * Validate a chat message's attachments array (mirrors the post-create and DM
- * bounds: records only, capped count + serialized size). Returns the validated
- * array ([] when absent) or an error message.
- */
-function validateAttachments(
-  raw: unknown,
-): ChatAttachment[] | { error: string } {
-  if (raw === undefined || raw === null) return [];
-  if (!Array.isArray(raw)) return { error: "attachments must be an array" };
-  if (raw.some((a) => !a || typeof a !== "object" || Array.isArray(a))) {
-    return { error: "attachments must be objects" };
-  }
-  if (raw.length > MAX_ATTACHMENTS) {
-    return { error: `Too many attachments (max ${MAX_ATTACHMENTS})` };
-  }
-  if (JSON.stringify(raw).length > MAX_ATTACHMENTS_JSON_LENGTH) {
-    return { error: "attachments payload too large" };
-  }
-  return raw as ChatAttachment[];
-}
+// Cap the per-member read receipts returned alongside a page so a very large
+// community's chat reader stays bounded regardless of local-member count.
+const MAX_COMMUNITY_READ_STATES = 200;
 
 // D1's batch() (atomic multi-statement) is only on the concrete D1/libsql
 // driver, not the shared `Database` union; reach it through a narrow cast.
@@ -220,7 +199,9 @@ messagesRouter.get("/:identifier/messages", async (c) => {
   // Per-member read positions (LOCAL-ONLY read receipts): rows exist only for
   // local members that marked the chat read — read state is never federated,
   // so remote members simply never appear here. Restricted to CURRENT members
-  // so a kicked member's stale row doesn't leak into the read count.
+  // so a kicked member's stale row doesn't leak into the read count, and capped
+  // (most-recently-read first) so a huge community can't return an unbounded
+  // receipt list on every page fetch.
   const readStates = await db
     .select({
       actorApId: dmCommunityReadStatus.actorApId,
@@ -234,7 +215,9 @@ messagesRouter.get("/:identifier/messages", async (c) => {
         eq(communityMembers.actorApId, dmCommunityReadStatus.actorApId),
       ),
     )
-    .where(eq(dmCommunityReadStatus.communityApId, community.apId));
+    .where(eq(dmCommunityReadStatus.communityApId, community.apId))
+    .orderBy(desc(dmCommunityReadStatus.lastReadAt))
+    .limit(MAX_COMMUNITY_READ_STATES);
 
   return c.json({
     messages: result,
@@ -264,11 +247,11 @@ messagesRouter.post(
       attachments?: unknown;
     }>();
 
-    const attachmentsOrError = validateAttachments(body.attachments);
-    if (!Array.isArray(attachmentsOrError)) {
-      return c.json({ error: attachmentsOrError.error }, 400);
+    const attachmentsResult = validateChatAttachments(body.attachments);
+    if (!attachmentsResult.ok) {
+      return c.json({ error: attachmentsResult.error }, 400);
     }
-    const attachments = attachmentsOrError;
+    const attachments = attachmentsResult.attachments;
 
     // Guard non-string content before .trim() (else TypeError → 500). An
     // attachment-only message (image send) carries no text.

package/src/backend/routes/dm/contacts.ts

@@ -23,6 +23,7 @@ import {
 } from "../../../db/index.ts";
 import { formatUsername } from "../../federation-helpers.ts";
 import { chunkForInClause } from "../../lib/chunk.ts";
+import { yurumeUnreadCounts } from "../../lib/unread-counts.ts";
 import {
   buildActorInfoMap,
   byTimeDesc,
@@ -476,50 +477,11 @@ contacts.get("/unread/count", async (c) => {
   const actor = c.get("actor");
   if (!actor) return c.json({ error: "Unauthorized" }, 401);
   const db = c.get("db");
-  const me = actor.ap_id;
-
-  const dmRow = await db.get<{ c: number }>(sql`
-    SELECT COUNT(*) AS c
-    FROM objects o
-    JOIN object_recipients orp
-      ON orp.object_ap_id = o.ap_id
-      AND orp.recipient_ap_id = ${me}
-      AND orp.type = 'to'
-    LEFT JOIN dm_read_status r
-      ON r.conversation_id = o.conversation
-      AND r.actor_ap_id = ${me}
-    WHERE o.visibility = 'direct'
-      AND o.type = 'Note'
-      AND o.conversation IS NOT NULL
-      AND o.attributed_to != ${me}
-      AND o.published > COALESCE(r.last_read_at, '1970-01-01T00:00:00Z')
-      AND o.conversation NOT IN (
-        SELECT conversation_id FROM dm_archived_conversations
-        WHERE actor_ap_id = ${me}
-      )
-  `);
-
-  const communityRow = await db.get<{ c: number }>(sql`
-    SELECT COUNT(*) AS c
-    FROM community_members cm
-    JOIN object_recipients orp
-      ON orp.recipient_ap_id = cm.community_ap_id
-      AND orp.type = 'audience'
-    JOIN objects o
-      ON o.ap_id = orp.object_ap_id
-      AND o.type = 'Note'
-      AND o.community_ap_id IS NULL
-      AND o.attributed_to != ${me}
-    LEFT JOIN dm_community_read_status r
-      ON r.community_ap_id = cm.community_ap_id
-      AND r.actor_ap_id = ${me}
-    WHERE cm.actor_ap_id = ${me}
-      AND o.published > COALESCE(r.last_read_at, cm.joined_at, '1970-01-01T00:00:00Z')
-  `);
-
-  const dm = Number(dmRow?.c ?? 0);
-  const community = Number(communityRow?.c ?? 0);
-  return c.json({ total: dm + community, dm, community });
+
+  // Single owner of the DM + community-chat unread SQL (lib/unread-counts.ts),
+  // shared with the notification push payload's badge so the two cannot drift.
+  const { total, dm, community } = await yurumeUnreadCounts(db, actor.ap_id);
+  return c.json({ total, dm, community });
 });
 
 export default contacts;

package/src/backend/routes/dm/messages.ts

@@ -37,10 +37,7 @@ import {
 import { enqueueDeliveryToActor } from "../../lib/delivery/queue.ts";
 import { feedCursorWhere } from "../../lib/feed-cursor.ts";
 import { toApAttachments } from "../../lib/activitypub-helpers.ts";
-import {
-  MAX_ATTACHMENTS,
-  MAX_ATTACHMENTS_JSON_LENGTH,
-} from "../posts/transformers.ts";
+import { validateChatAttachments } from "../../lib/attachments.ts";
 import { logger } from "../../lib/logger.ts";
 
 const log = logger.child({ component: "dm.messages" });
@@ -127,34 +124,6 @@ function validateContent(
   return content;
 }
 
-/**
- * Validate a chat message's attachments array (mirrors the post-create bounds:
- * records only, capped count + serialized size — the size cap bounds row and
- * federated-doc bloat regardless of internal shape). Returns the validated
- * array ([] when absent) or an error response.
- */
-function validateAttachments(
-  raw: unknown,
-): Attachment[] | { error: string; status: 400 } {
-  if (raw === undefined || raw === null) return [];
-  if (!Array.isArray(raw)) {
-    return { error: "attachments must be an array", status: 400 };
-  }
-  if (raw.some((a) => !a || typeof a !== "object" || Array.isArray(a))) {
-    return { error: "attachments must be objects", status: 400 };
-  }
-  if (raw.length > MAX_ATTACHMENTS) {
-    return {
-      error: `Too many attachments (max ${MAX_ATTACHMENTS})`,
-      status: 400,
-    };
-  }
-  if (JSON.stringify(raw).length > MAX_ATTACHMENTS_JSON_LENGTH) {
-    return { error: "attachments payload too large", status: 400 };
-  }
-  return raw as Attachment[];
-}
-
 /**
  * Resolve a `user@domain` handle for a DM recipient. Prefers the stored
  * preferredUsername paired with the recipient's host, falling back to
@@ -462,14 +431,11 @@ dm.post("/user/:encodedApId/messages", async (c) => {
   }>();
   const baseUrl = c.env.APP_URL;
 
-  const attachmentsOrError = validateAttachments(body.attachments);
-  if (!Array.isArray(attachmentsOrError)) {
-    return c.json(
-      { error: attachmentsOrError.error },
-      attachmentsOrError.status,
-    );
+  const attachmentsResult = validateChatAttachments(body.attachments);
+  if (!attachmentsResult.ok) {
+    return c.json({ error: attachmentsResult.error }, 400);
   }
-  const attachments = attachmentsOrError;
+  const attachments = attachmentsResult.attachments as Attachment[];
 
   // An attachment-only message (LINE-style image send) carries no text.
   const contentOrError = validateContent(body.content, attachments.length > 0);

package/src/backend/routes/notifications.ts

@@ -6,13 +6,10 @@ import {
   count,
   desc,
   eq,
-  exists,
   inArray,
   isNotNull,
   isNull,
   lt,
-  ne,
-  notExists,
   or,
   type SQL,
 } from "drizzle-orm";
@@ -34,7 +31,10 @@ import { batchLoadActorInfo } from "./communities/membership-shared.ts";
 import { requireActor } from "./actors-helpers.ts";
 import { communityReadableApIds } from "../lib/community-visibility.ts";
 import { chunkForInClause } from "../lib/chunk.ts";
-import { excludeBlockedMutedAuthors } from "../lib/feed-exclude.ts";
+import {
+  NOTIFICATION_ACTIVITY_TYPES,
+  notificationEligibilityWhere,
+} from "../lib/notification-eligibility.ts";
 
 const notifications = new Hono<{ Bindings: Env; Variables: Variables }>();
 
@@ -53,7 +53,6 @@ const ARCHIVE_CREATE_BATCH_SIZE = 30;
 // the rest drains on later runs.
 const ARCHIVE_CLEANUP_BATCH = 200;
 const ARCHIVE_ALL_CAP = 1000;
-const NOTIFICATION_ACTIVITY_TYPES = ["Follow", "Like", "Announce", "Create"];
 
 /**
  * Tracks the last cleanup timestamp per actor so cleanup is throttled to one
@@ -241,6 +240,9 @@ function notificationTarget(
 ): {
   target_kind: "post" | "story" | "profile" | "notifications";
   target_id: string | null;
+  // Same-origin in-app path shaped for the yurucommu web client's routing.
+  // Other clients (e.g. yurume's distinct IA) must treat target_kind/target_id
+  // as authoritative and build their own path, not follow target_url blindly.
   target_url: string;
 } {
   if (type === "follow" || type === "follow_request") {
@@ -305,37 +307,22 @@ notifications.get("/", async (c) => {
       ? typeToActivityType[typeFilter]
       : NOTIFICATION_ACTIVITY_TYPES;
 
-  // Archive partition pushed INTO SQL as a correlated EXISTS / NOT EXISTS, not a
-  // post-query filter. Filtering archived rows out in the result loop made two
-  // bugs: (1) `has_more` under-reported — a page whose limit+1 probe rows were
-  // mostly the wrong archive state returned < limit items yet there were older
-  // pages, so the client stopped loading; (2) every archived id for the actor
-  // was loaded into an unbounded in-memory Set per request. As an SQL predicate
-  // the limit+1 probe counts only rows that actually belong on the page.
-  const archivedCorrelation = and(
-    eq(notificationArchived.actorApId, inboxTable.actorApId),
-    eq(notificationArchived.activityApId, inboxTable.activityApId),
-  );
-  const archivedSubquery = db
-    .select({ activityApId: notificationArchived.activityApId })
-    .from(notificationArchived)
-    .where(archivedCorrelation);
-  const archiveCondition = showArchived
-    ? exists(archivedSubquery)
-    : notExists(archivedSubquery);
-
-  // Build inbox query with JOIN to activities. A direct (DM) Note is delivered
-  // as a `Create` inbox row just like a mention, so without excluding it every
-  // DM would double-surface here as a "mention" (with its body) AND inflate the
-  // unread badge independently of the DM view. LEFT JOIN the object and drop
-  // direct-visibility Creates; the join is LEFT because Follow's object is an
-  // actor (no `objects` row) → NULL visibility must be kept.
+  // Build inbox query with JOIN to activities. Shared eligibility predicate
+  // (lib/notification-eligibility.ts) — the SAME builder used by the unread
+  // badge and push delivery — supplies: not-self, user-facing types, the
+  // archive partition (pushed into SQL as a correlated EXISTS/NOT EXISTS so the
+  // limit+1 probe counts only rows that belong on the page, not a post-query
+  // filter), the direct-DM exclusion (a DM's `Create` inbox row must not
+  // double-surface here as a mention), and block/mute suppression. Direct
+  // Creates are dropped via LEFT JOIN + NULL-visibility keep (Follow's object
+  // is an actor, no `objects` row).
   const conditions = [
     eq(inboxTable.actorApId, actor.ap_id),
-    ne(activities.actorApId, actor.ap_id),
-    inArray(activities.type, activityTypes),
-    or(isNull(objects.visibility), ne(objects.visibility, "direct"))!,
-    archiveCondition,
+    ...notificationEligibilityWhere(db, actor.ap_id, {
+      direct: "exclude",
+      archived: showArchived ? "only" : "exclude",
+      activityTypes,
+    }),
   ];
   // reply vs mention both map to a Create; the split is whether the Create's
   // object is a reply (`inReplyTo` set). Pushed into SQL too so a type-filtered
@@ -348,17 +335,6 @@ notifications.get("/", async (c) => {
   if (before) {
     conditions.push(notifCursorPredicate(decodeNotifCursor(before)));
   }
-  // Suppress notifications whose actor the recipient has blocked or muted. This
-  // is the read-time choke point: mutes are read-only everywhere, and not every
-  // notify WRITE path block-checks, so gating here covers like/repost/follow/
-  // reply/mention (local AND federated) for both blocks and mutes. Keyed on the
-  // activity actor (subquery-scoped → D1-param-safe).
-  const listBlockMute = excludeBlockedMutedAuthors(
-    db,
-    actor.ap_id,
-    activities.actorApId,
-  );
-  if (listBlockMute) conditions.push(listBlockMute);
 
   const inboxEntries = await db
     .select({
@@ -504,7 +480,7 @@ notifications.get("/", async (c) => {
       icon_url: string | null;
     };
     object_content: string;
-    target_kind: "post" | "story" | "profile" | "community" | "notifications";
+    target_kind: "post" | "story" | "profile" | "notifications";
     target_id: string | null;
     target_url: string;
   }> = [];
@@ -578,23 +554,10 @@ notifications.get("/unread/count", async (c) => {
   const db = c.get("db");
   await maybeCleanupArchivedNotifications(db, actor.ap_id);
 
-  // Mirror the list query's DM exclusion (see GET /): a direct Note's Create
-  // inbox row must not count toward the notification badge — the DM has its own
-  // unread badge, and marking it read never clears this inbox row.
-  // Mirror the default list view's archive exclusion: an archived notification
-  // is hidden from the inbox list, so it must NOT count toward the badge either —
-  // otherwise archiving an UNREAD notification (read stays 0) leaves a phantom
-  // count the client can never clear (its mark-read sweep only touches rows the
-  // inbox view returns, which no longer include the archived one).
-  const archivedSubquery = db
-    .select({ activityApId: notificationArchived.activityApId })
-    .from(notificationArchived)
-    .where(
-      and(
-        eq(notificationArchived.actorApId, inboxTable.actorApId),
-        eq(notificationArchived.activityApId, inboxTable.activityApId),
-      ),
-    );
+  // SAME shared eligibility builder as the list and push delivery: not-self,
+  // user-facing types, archive exclusion (an archived UNREAD notification must
+  // not leave a phantom count the client can never clear), the direct-DM
+  // exclusion (a DM has its own badge), and block/mute suppression.
   const result = await db
     .select({ count: count() })
     .from(inboxTable)
@@ -604,13 +567,7 @@ notifications.get("/unread/count", async (c) => {
       and(
         eq(inboxTable.actorApId, actor.ap_id),
         eq(inboxTable.read, 0),
-        ne(activities.actorApId, actor.ap_id),
-        inArray(activities.type, NOTIFICATION_ACTIVITY_TYPES),
-        or(isNull(objects.visibility), ne(objects.visibility, "direct"))!,
-        notExists(archivedSubquery),
-        // Mirror the list query: don't count notifications from blocked/muted
-        // actors toward the unread badge.
-        excludeBlockedMutedAuthors(db, actor.ap_id, activities.actorApId),
+        ...notificationEligibilityWhere(db, actor.ap_id, { direct: "exclude" }),
       ),
     )
     .get();

package/src/backend/routes/posts/transformers.ts

@@ -2,12 +2,14 @@ import { formatUsername, safeJsonParse } from "../../federation-helpers.ts";
 
 export const MAX_POST_CONTENT_LENGTH = 5000;
 export const MAX_POST_SUMMARY_LENGTH = 500;
-// Bound the attachments payload. PostAttachment is an open-ended record, so cap
-// both the COUNT and the serialized SIZE — the size cap bounds row/federated-doc
-// bloat regardless of internal shape (key count / field length). 16 KiB is ample
-// for MAX_ATTACHMENTS media descriptors with alt text + blurhash.
-export const MAX_ATTACHMENTS = 8;
-export const MAX_ATTACHMENTS_JSON_LENGTH = 16 * 1024;
+// Attachment bounds live in lib/attachments.ts (shared with the DM and
+// community-chat validators); re-exported here for the existing post-route and
+// inbound-handler importers.
+export {
+  boundAttachmentsJson,
+  MAX_ATTACHMENTS,
+  MAX_ATTACHMENTS_JSON_LENGTH,
+} from "../../lib/attachments.ts";
 
 /** Truncate a string to `max` characters (no-op when already within bounds). */
 export function truncate(s: string, max: number): string {
@@ -28,10 +30,6 @@ export function boundInboundSummary(summary: unknown): string | null {
     ? truncate(summary, MAX_POST_SUMMARY_LENGTH)
     : null;
 }
-/** Drop an oversized inbound attachments blob to "[]" rather than store it. */
-export function boundAttachmentsJson(json: string): string {
-  return json.length > MAX_ATTACHMENTS_JSON_LENGTH ? "[]" : json;
-}
 // Capped at 90 (not 100): a page's object ids are re-queried via
 // `inArray(col, objectApIds)` for like/bookmark enrichment, and Cloudflare D1
 // allows at most 100 bound parameters per query. 90 leaves headroom for the

package/src/backend/routes/rtc/index.ts

@@ -0,0 +1,147 @@
+/**
+ * Call feature routes (WebRTC voice + video).
+ *
+ *   POST /ap/rtc/signal    server-to-server signaling ingest (HTTP-Signature)
+ *   GET  /api/rtc/socket   browser WebSocket upgrade -> per-user signaling hub
+ *   GET  /api/rtc/ice      mint short-lived ICE (STUN/TURN) servers
+ *   POST /api/rtc/calls    start a call (block-list gate + callId + ICE)
+ *   GET  /api/rtc/calls    call history (missed / recent)
+ *   GET  /api/rtc/calls/:id current state of one call
+ *
+ * Signaling is intentionally OUTSIDE the ActivityPub inbox pipeline: the
+ * `/ap/rtc/signal` endpoint bypasses `claimActivityForDispatch` /
+ * `parseActivity` (which would strip SDP/ICE and persist ephemeral frames to the
+ * `activities` ledger). It reuses the same HTTP-Signature auth every inbox uses.
+ */
+
+import { Hono } from "hono";
+import { eq } from "drizzle-orm";
+import type { Env, Variables } from "../../types.ts";
+import { actors } from "../../../db/index.ts";
+import { verifyHttpSignature } from "../../lib/ap-verify.ts";
+import {
+  isActorMismatch,
+  signingActorFromKeyId,
+} from "../activitypub/inbox.ts";
+import { isActorBlocked } from "../../lib/blocklist.ts";
+import {
+  getSignalingHub,
+  isSignalingAvailable,
+} from "../../runtime/signaling-hub.ts";
+import { createRtcProvider } from "../../lib/rtc/provider.ts";
+import { getCallSession, listCallSessions } from "../../lib/rtc/call-store.ts";
+import type {
+  CallMediaKind,
+  StartCallRequest,
+} from "../../../../packages/api/src/types/call.ts";
+import { parseRtcSignalEnvelope } from "../../../../packages/api/src/types/call.ts";
+
+const rtc = new Hono<{ Bindings: Env; Variables: Variables }>();
+
+function normalizeMedia(input: unknown): CallMediaKind {
+  if (input && typeof input === "object") {
+    const m = input as Partial<CallMediaKind>;
+    return { audio: m.audio !== false, video: Boolean(m.video) };
+  }
+  return { audio: true, video: false };
+}
+
+// --- Server-to-server signaling ingest -------------------------------------
+rtc.post("/ap/rtc/signal", async (c) => {
+  const db = c.get("db");
+  const body = await c.req.text();
+  const sig = await verifyHttpSignature(c.req.raw, db, body);
+  if (!sig.valid) return c.json({ error: "invalid_signature" }, 401);
+
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return c.json({ error: "bad_json" }, 400);
+  }
+  const envelope = parseRtcSignalEnvelope(parsed);
+  if (!envelope) return c.json({ error: "bad_envelope" }, 400);
+
+  // The HTTP-Signature signer must own the claimed `from` actor.
+  if (isActorMismatch(signingActorFromKeyId(sig.keyId), envelope.from)) {
+    return c.json({ error: "signer_mismatch" }, 403);
+  }
+
+  // The recipient must be a local actor served by this instance.
+  const local = await db.query.actors.findFirst({
+    where: eq(actors.apId, envelope.to),
+    columns: { apId: true },
+  });
+  if (!local) return c.json({ error: "unknown_recipient" }, 404);
+
+  // Never ring for a sender the local owner has blocked; drop silently.
+  if (await isActorBlocked(db, envelope.from)) return c.body(null, 204);
+
+  await getSignalingHub(c.env).deliver(envelope.to, envelope);
+  return c.body(null, 204);
+});
+
+// --- Browser WebSocket upgrade ---------------------------------------------
+rtc.get("/api/rtc/socket", async (c) => {
+  const actor = c.get("actor");
+  if (!actor) return c.json({ error: "unauthorized" }, 401);
+  if (!isSignalingAvailable(c.env)) {
+    return c.json({ error: "signaling_unavailable" }, 503);
+  }
+  return getSignalingHub(c.env).upgrade(c.req.raw, actor.ap_id);
+});
+
+// --- ICE servers ------------------------------------------------------------
+rtc.get("/api/rtc/ice", async (c) => {
+  const actor = c.get("actor");
+  if (!actor) return c.json({ error: "unauthorized" }, 401);
+  const iceServers = await createRtcProvider(c.env).getIceServers();
+  return c.json({ iceServers });
+});
+
+// --- Start a call -----------------------------------------------------------
+rtc.post("/api/rtc/calls", async (c) => {
+  const actor = c.get("actor");
+  if (!actor) return c.json({ error: "unauthorized" }, 401);
+  if (!isSignalingAvailable(c.env)) {
+    return c.json({ error: "signaling_unavailable" }, 503);
+  }
+  const db = c.get("db");
+  let payload: Partial<StartCallRequest>;
+  try {
+    payload = (await c.req.json()) as Partial<StartCallRequest>;
+  } catch {
+    return c.json({ error: "bad_json" }, 400);
+  }
+  const to = typeof payload.to === "string" ? payload.to.trim() : "";
+  if (!to || to === actor.ap_id) return c.json({ error: "bad_target" }, 400);
+  const media = normalizeMedia(payload.media);
+
+  // Do not let the local owner place a call to a contact they have blocked.
+  if (await isActorBlocked(db, to)) return c.json({ error: "blocked" }, 403);
+
+  const provider = createRtcProvider(c.env);
+  const [iceServers, sfuFocus] = await Promise.all([
+    provider.getIceServers(),
+    provider.getSfuFocus(media),
+  ]);
+  return c.json({ callId: crypto.randomUUID(), iceServers, sfuFocus });
+});
+
+// --- Call history + state ---------------------------------------------------
+rtc.get("/api/rtc/calls", async (c) => {
+  const actor = c.get("actor");
+  if (!actor) return c.json({ error: "unauthorized" }, 401);
+  const calls = await listCallSessions(c.get("db"), actor.ap_id);
+  return c.json({ calls });
+});
+
+rtc.get("/api/rtc/calls/:id", async (c) => {
+  const actor = c.get("actor");
+  if (!actor) return c.json({ error: "unauthorized" }, 401);
+  const call = await getCallSession(c.get("db"), actor.ap_id, c.req.param("id"));
+  if (!call) return c.json({ error: "not_found" }, 404);
+  return c.json({ call });
+});
+
+export default rtc;