@takosjp/yurucommu-core 3.2.1 → 3.4.0

package/src/backend/lib/rtc/provider.ts

@@ -0,0 +1,135 @@
+/**
+ * RtcProvider — media-plane configuration for the call feature.
+ *
+ * This is the seam that keeps calling vendor-neutral: 1:1 calls are pure P2P
+ * WebRTC over the operator-configured STUN/TURN servers (no SFU, no Cloudflare),
+ * and group calls (Phase 3) select a WHIP/WHEP SFU "focus" whose backend is any
+ * of `whip` / `livekit` / `cloudflare-realtime` — Cloudflare Realtime is one
+ * adapter among equals, never required.
+ *
+ * TURN credentials, when coturn's REST scheme is configured, are minted
+ * per-request as short-lived HMAC creds (RFC 8489 long-term-credential via the
+ * `turn-rest` `timestamp:name` username convention) — no static long-lived
+ * secret is ever handed to a client.
+ */
+
+import type {
+  CallMediaKind,
+  IceServerConfig,
+  SfuFocus,
+} from "../../../../packages/api/src/types/call.ts";
+import type { EnvVars } from "../../types.ts";
+import { bufferToBase64 } from "../base64.ts";
+import { logger } from "../logger.ts";
+
+const log = logger.child({ component: "rtc.provider" });
+
+const DEFAULT_TURN_TTL_SECONDS = 3600;
+
+export interface RtcProvider {
+  /** ICE (STUN/TURN) servers for a call. Fresh (short-lived) TURN creds. */
+  getIceServers(): Promise<IceServerConfig[]>;
+  /** Group-call SFU focus, or null for pure P2P (always null for 1:1). */
+  getSfuFocus(media: CallMediaKind): Promise<SfuFocus | null>;
+}
+
+function parseStaticIceServers(raw: string | undefined): IceServerConfig[] {
+  if (!raw?.trim()) return [];
+  try {
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) return [];
+    const out: IceServerConfig[] = [];
+    for (const entry of parsed) {
+      if (!entry || typeof entry !== "object") continue;
+      const urls = (entry as { urls?: unknown }).urls;
+      if (typeof urls !== "string" && !Array.isArray(urls)) continue;
+      const server: IceServerConfig = { urls: urls as string | string[] };
+      const username = (entry as { username?: unknown }).username;
+      const credential = (entry as { credential?: unknown }).credential;
+      if (typeof username === "string") server.username = username;
+      if (typeof credential === "string") server.credential = credential;
+      out.push(server);
+    }
+    return out;
+  } catch (err) {
+    log.warn("Invalid YURUCOMMU_RTC_ICE_SERVERS JSON", { error: String(err) });
+    return [];
+  }
+}
+
+async function mintTurnCredential(
+  uris: string[],
+  secret: string,
+  ttlSeconds: number,
+): Promise<IceServerConfig | null> {
+  if (uris.length === 0 || !secret) return null;
+  // coturn REST: username = "<unix-expiry>:<name>", credential = base64(HMAC-
+  // SHA1(secret, username)). A random name keeps creds unlinkable per call.
+  const expiry = Math.floor(Date.now() / 1000) + ttlSeconds;
+  const username = `${expiry}:yurucommu`;
+  try {
+    const key = await crypto.subtle.importKey(
+      "raw",
+      new TextEncoder().encode(secret),
+      { name: "HMAC", hash: "SHA-1" },
+      false,
+      ["sign"],
+    );
+    const mac = await crypto.subtle.sign(
+      "HMAC",
+      key,
+      new TextEncoder().encode(username),
+    );
+    return { urls: uris, username, credential: bufferToBase64(mac) };
+  } catch (err) {
+    log.error("Failed to mint TURN credential", { error: String(err) });
+    return null;
+  }
+}
+
+class ConfiguredRtcProvider implements RtcProvider {
+  constructor(private readonly env: EnvVars) {}
+
+  async getIceServers(): Promise<IceServerConfig[]> {
+    const servers = parseStaticIceServers(this.env.YURUCOMMU_RTC_ICE_SERVERS);
+    const uris = (this.env.YURUCOMMU_RTC_TURN_URIS ?? "")
+      .split(",")
+      .map((s) => s.trim())
+      .filter(Boolean);
+    const secret = this.env.YURUCOMMU_RTC_TURN_SECRET?.trim();
+    if (uris.length > 0 && secret) {
+      const ttl =
+        Number.parseInt(this.env.YURUCOMMU_RTC_TURN_TTL ?? "", 10) ||
+        DEFAULT_TURN_TTL_SECONDS;
+      const turn = await mintTurnCredential(uris, secret, ttl);
+      if (turn) servers.push(turn);
+    }
+    return servers;
+  }
+
+  async getSfuFocus(_media: CallMediaKind): Promise<SfuFocus | null> {
+    const adapter = (this.env.YURUCOMMU_RTC_SFU_ADAPTER ?? "p2p")
+      .trim()
+      .toLowerCase();
+    if (adapter === "" || adapter === "p2p") return null;
+    const url = this.env.YURUCOMMU_RTC_SFU_URL?.trim();
+    if (!url) {
+      log.warn("SFU adapter selected but YURUCOMMU_RTC_SFU_URL unset", {
+        adapter,
+      });
+      return null;
+    }
+    // WHIP/WHEP focus passthrough. Real per-room token minting (LiveKit JWT,
+    // Cloudflare Realtime app tokens) lands with group calls (Phase 3); today
+    // the shared/static token (if any) is advertised as-is.
+    return {
+      kind: adapter,
+      url,
+      token: this.env.YURUCOMMU_RTC_SFU_TOKEN?.trim() || undefined,
+    };
+  }
+}
+
+export function createRtcProvider(env: EnvVars): RtcProvider {
+  return new ConfiguredRtcProvider(env);
+}

package/src/backend/lib/rtc/signal-transport.ts

@@ -0,0 +1,125 @@
+/**
+ * Cross-instance call signaling transport (server-to-server).
+ *
+ * Signaling for a call between two self-hosted instances travels as an
+ * HTTP-Signature-signed POST to the peer instance's `/ap/rtc/signal` endpoint.
+ * This deliberately does NOT use the queued federation delivery path
+ * (`enqueueDeliveryToActor`, with its circuit-breaker + retry/backoff): an SDP
+ * offer or ICE candidate is ephemeral and latency-sensitive, so a stale retry is
+ * useless. We reuse the same low-level signing (`signRequest`) + SSRF-guarded
+ * fetch (`fetchWithTimeout`) primitives the delivery worker uses, but send
+ * synchronously and directly. It also does NOT go through the inbox activity
+ * pipeline (`claimActivityForDispatch` / `parseActivity`), which would both strip
+ * the SDP/ICE fields and pollute the `activities` ledger with ephemeral frames.
+ */
+
+import { eq } from "drizzle-orm";
+import type { Database } from "../../../db/index.ts";
+import { actorCache } from "../../../db/index.ts";
+import type { RtcSignalEnvelopeV1 } from "../../../../packages/api/src/types/call.ts";
+import { signRequest } from "../ap-signing.ts";
+import { fetchWithTimeout } from "../federation-fetch.ts";
+import { fetchAndUpsertActorCache } from "../activitypub-actor-cache.ts";
+import { isSafeRemoteUrl } from "../ssrf.ts";
+import { logger } from "../logger.ts";
+
+const log = logger.child({ component: "rtc.signal-transport" });
+
+const SIGNAL_PATH = "/ap/rtc/signal";
+const SIGNAL_TIMEOUT_MS = 8000;
+
+export interface CallSigner {
+  apId: string;
+  privateKeyPem: string;
+}
+
+/** Derive a peer's signaling endpoint from a cached actor row. */
+function endpointFromActorRow(row: {
+  inbox: string;
+  rawJson: string;
+}): string | null {
+  // Prefer an explicitly advertised endpoint (actor `endpoints.rtcSignal`).
+  try {
+    const doc = JSON.parse(row.rawJson) as {
+      endpoints?: { rtcSignal?: unknown };
+    };
+    const advertised = doc.endpoints?.rtcSignal;
+    if (typeof advertised === "string" && isSafeRemoteUrl(advertised)) {
+      return advertised;
+    }
+  } catch {
+    // fall through to inbox-origin derivation
+  }
+  // Fall back to `<inbox-origin>/ap/rtc/signal` (every yurucommu instance
+  // serves this path). Peers that are not yurucommu simply won't answer.
+  try {
+    const origin = new URL(row.inbox).origin;
+    const endpoint = `${origin}${SIGNAL_PATH}`;
+    return isSafeRemoteUrl(endpoint) ? endpoint : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Resolve (and cache) the peer instance's signaling endpoint URL. */
+export async function resolvePeerSignalEndpoint(
+  db: Database,
+  peerApId: string,
+): Promise<string | null> {
+  let row = await db.query.actorCache.findFirst({
+    where: eq(actorCache.apId, peerApId),
+    columns: { inbox: true, rawJson: true },
+  });
+  if (!row) {
+    const result = await fetchAndUpsertActorCache(db, peerApId, {});
+    if (result.ok) {
+      row = { inbox: result.row.inbox, rawJson: result.row.rawJson };
+    }
+  }
+  if (!row) return null;
+  return endpointFromActorRow(row);
+}
+
+/**
+ * Sign + POST a signaling envelope to the peer instance. Throws on any
+ * unreachable / non-2xx outcome so the caller can fail the call fast.
+ */
+export async function sendCallSignal(
+  db: Database,
+  signer: CallSigner,
+  envelope: RtcSignalEnvelopeV1,
+  peerSignalEndpoint?: string,
+): Promise<void> {
+  const endpoint =
+    peerSignalEndpoint ?? (await resolvePeerSignalEndpoint(db, envelope.to));
+  if (!endpoint) {
+    throw new Error(`no signaling endpoint for ${envelope.to}`);
+  }
+  const body = JSON.stringify(envelope);
+  const keyId = `${signer.apId}#main-key`;
+  const signed = await signRequest(
+    signer.privateKeyPem,
+    keyId,
+    "POST",
+    endpoint,
+    body,
+  );
+  const res = await fetchWithTimeout(endpoint, {
+    method: "POST",
+    headers: {
+      ...signed,
+      "Content-Type": "application/activity+json",
+      Accept: "application/json",
+    },
+    body,
+    timeout: SIGNAL_TIMEOUT_MS,
+  });
+  if (!res.ok) {
+    log.warn("Signaling POST rejected", {
+      callId: envelope.callId,
+      type: envelope.type,
+      status: res.status,
+    });
+    throw new Error(`signal POST ${res.status}`);
+  }
+}

package/src/backend/lib/unread-counts.ts

@@ -17,8 +17,14 @@
  *   own, after the later of the per-community read time and the join time.
  */
 
-import { sql } from "drizzle-orm";
-import type { Database } from "../../db/index.ts";
+import { and, count, eq, sql } from "drizzle-orm";
+import {
+  activities,
+  inbox as inboxTable,
+  objects,
+  type Database,
+} from "../../db/index.ts";
+import { notificationEligibilityWhere } from "./notification-eligibility.ts";
 
 export interface YurumeUnreadCounts {
   readonly dm: number;
@@ -77,3 +83,58 @@ export async function yurumeUnreadCounts(
   const community = Number(communityRow?.c ?? 0);
   return { dm, community, total: dm + community };
 }
+
+/**
+ * Unread social-notification count. SAME shared eligibility builder as the
+ * notifications list, the badge endpoint, and push delivery (not-self,
+ * user-facing types, archive exclusion, direct-DM exclusion, block/mute
+ * suppression) so a realtime-pushed badge can never drift from the badge the
+ * client fetches.
+ */
+export async function notificationUnreadCount(
+  db: Database,
+  actorApId: string,
+): Promise<number> {
+  const result = await db
+    .select({ count: count() })
+    .from(inboxTable)
+    .innerJoin(activities, eq(inboxTable.activityApId, activities.apId))
+    .leftJoin(objects, eq(activities.objectApId, objects.apId))
+    .where(
+      and(
+        eq(inboxTable.actorApId, actorApId),
+        eq(inboxTable.read, 0),
+        ...notificationEligibilityWhere(db, actorApId, { direct: "exclude" }),
+      ),
+    )
+    .get();
+  return Number(result?.count ?? 0);
+}
+
+export interface UnreadSnapshot {
+  readonly dm: number;
+  readonly community: number;
+  readonly talkTotal: number;
+  readonly notifications: number;
+}
+
+/**
+ * One authoritative unread snapshot (talk + notifications) for the realtime
+ * `unread` event. Server-computed on every emit so clients never derive or
+ * increment counters themselves.
+ */
+export async function computeUnreadSnapshot(
+  db: Database,
+  actorApId: string,
+): Promise<UnreadSnapshot> {
+  const [talk, notifications] = await Promise.all([
+    yurumeUnreadCounts(db, actorApId),
+    notificationUnreadCount(db, actorApId),
+  ]);
+  return {
+    dm: talk.dm,
+    community: talk.community,
+    talkTotal: talk.total,
+    notifications,
+  };
+}

package/src/backend/public.ts

@@ -13,6 +13,12 @@ export { default } from "./index.ts";
 export { default as app } from "./index.ts";
 export { type Database, getDb, getDbSQLite } from "../db/index.ts";
 export { wrapCloudflareBindings } from "./runtime/cloudflare.ts";
+// Call feature: the signaling Durable Object class each product's generated
+// worker entry must re-export so Wrangler can bind CALL_SIGNALING to it.
+export { CallSignalingDurableObject } from "./runtime/call-signaling-do.ts";
+// Realtime stream: the per-user fanout Durable Object class each product's
+// generated worker entry must re-export so Wrangler can bind REALTIME_STREAM.
+export { RealtimeStreamDO } from "./runtime/realtime-stream-do.ts";
 export type { Env, EnvVars } from "./types.ts";
 export type {
   DeliveryDlqMessageV1,

package/src/backend/routes/activitypub.ts

@@ -440,9 +440,13 @@ ap.get(
       following: showCollections ? actor.followingUrl : undefined,
       // Advertise sharedInbox so remote servers can deduplicate fan-out
       // delivery (Mastodon convention). The endpoint accepts signed
-      // activities just like the per-actor inbox.
+      // activities just like the per-actor inbox. `rtcSignal` advertises the
+      // call-signaling ingest so a caller's instance can reach this user
+      // directly (yurucommu extension; peers that don't recognize it just fall
+      // back to deriving it from the inbox origin).
       endpoints: {
         sharedInbox: `${baseUrl}/ap/inbox`,
+        rtcSignal: `${baseUrl}/ap/rtc/signal`,
       },
       publicKey: buildPublicKey(actor.apId, actor.publicKeyPem),
       discoverable: !actor.isPrivate,

package/src/backend/routes/auth.ts

@@ -63,6 +63,12 @@ const auth = new Hono<{ Bindings: Env; Variables: Variables }>();
 // abuse even from the legitimate owner session (#23).
 const MAX_SUB_ACCOUNTS = 20;
 
+function parsePassword(value: unknown): string | null {
+  // Passwords are opaque credentials. Trimming changes a valid secret and can
+  // make the native and browser login behavior diverge from the stored hash.
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+
 // 認証設定取得
 auth.get("/providers", async (c) => {
   const config = getAuthConfig(c.env);
@@ -151,7 +157,7 @@ auth.post("/login", async (c) => {
     return c.json({ error: "Invalid request body", code: "BAD_REQUEST" }, 400);
   }
 
-  const password = parseNonEmptyString(body.password);
+  const password = parsePassword(body.password);
   if (!password) {
     return c.json({ error: "password is required", code: "BAD_REQUEST" }, 400);
   }
@@ -233,7 +239,7 @@ auth.post("/mobile/login", async (c) => {
   }
 
   const body = await parseJsonObject(c);
-  const password = body ? parseNonEmptyString(body.password) : undefined;
+  const password = body ? parsePassword(body.password) : null;
   if (!password) {
     return c.json({ error: "password is required", code: "BAD_REQUEST" }, 400);
   }

package/src/backend/routes/communities/messages.ts

@@ -23,6 +23,12 @@ import {
 } from "../../lib/attachments.ts";
 import { communityRequiresMembership } from "../../lib/community-visibility.ts";
 import { rateLimit, RateLimitConfigs } from "../../middleware/rate-limit.ts";
+import {
+  emitRealtimeBestEffort,
+  emitUnreadSnapshot,
+  isRealtimeAvailable,
+  runRealtimeAfterResponse,
+} from "../../runtime/realtime-hub.ts";
 import {
   deleteObjectCascade,
   purgeMediaBlobs,
@@ -408,24 +414,54 @@ messagesRouter.post(
       ...pushJobStatements,
     ]);
 
-    return c.json(
-      {
-        message: {
-          id: objectApId,
-          sender: {
-            ap_id: actor.ap_id,
-            username: formatUsername(actor.ap_id),
-            preferred_username: actor.preferred_username,
-            name: actor.name,
-            icon_url: actor.icon_url,
-          },
-          content,
-          attachments,
-          created_at: now,
-        },
+    const messagePayload = {
+      id: objectApId,
+      sender: {
+        ap_id: actor.ap_id,
+        username: formatUsername(actor.ap_id),
+        preferred_username: actor.preferred_username,
+        name: actor.name,
+        icon_url: actor.icon_url,
       },
-      201,
-    );
+      content,
+      attachments,
+      created_at: now,
+    };
+
+    // Realtime fanout to LOCAL members (best-effort, after the response).
+    // Community talk has no inbox row, so the shared notification sweep never
+    // sees it — this direct emit is the only realtime path. Membership rows
+    // exist only for local members (remote membership is a follows edge), and
+    // the fanout is capped so a huge community cannot stall the writer.
+    if (isRealtimeAvailable(c.env)) {
+      const communityApIdForEmit = community.apId;
+      await runRealtimeAfterResponse(c, async () => {
+        const members = await db
+          .select({ actorApId: communityMembers.actorApId })
+          .from(communityMembers)
+          .where(eq(communityMembers.communityApId, communityApIdForEmit))
+          .limit(200);
+        await emitRealtimeBestEffort(
+          c.env,
+          members.map(({ actorApId }) => ({
+            actorApId,
+            type: "talk.message",
+            data: {
+              kind: "community",
+              community_ap_id: communityApIdForEmit,
+              message: messagePayload,
+            },
+          })),
+        );
+        await Promise.all(
+          members
+            .filter(({ actorApId }) => actorApId !== actor.ap_id)
+            .map(({ actorApId }) => emitUnreadSnapshot(c.env, actorApId)),
+        );
+      });
+    }
+
+    return c.json({ message: messagePayload }, 201);
   },
 );
 

package/src/backend/routes/dm/messages.ts

@@ -35,6 +35,10 @@ import {
   resolveConversationId,
 } from "./query-helpers.ts";
 import { enqueueDeliveryToActor } from "../../lib/delivery/queue.ts";
+import {
+  emitRealtimeBestEffort,
+  runRealtimeAfterResponse,
+} from "../../runtime/realtime-hub.ts";
 import { feedCursorWhere } from "../../lib/feed-cursor.ts";
 import { toApAttachments } from "../../lib/activitypub-helpers.ts";
 import { validateChatAttachments } from "../../lib/attachments.ts";
@@ -600,15 +604,51 @@ dm.post("/user/:encodedApId/messages", async (c) => {
     await enqueueDeliveryToActor(c.env, deliveryActivityId, otherApId);
   }
 
+  const messagePayload = {
+    id: apId,
+    sender: buildSenderFromActor(actor),
+    content,
+    attachments,
+    created_at: now,
+  };
+
+  // Realtime fanout (best-effort, after the response): the recipient's open
+  // thread gets the message body without polling; the sender's OTHER tabs and
+  // devices stay in sync too. `other_ap_id` is per-recipient (each side sees
+  // the counterpart). Unread counters flow via the shared post-response sweep
+  // (the inbox trigger wrote a push job for the local recipient).
+  await runRealtimeAfterResponse(c, () =>
+    emitRealtimeBestEffort(c.env, [
+      ...(isRecipientLocal
+        ? [
+            {
+              actorApId: otherApId,
+              type: "talk.message",
+              data: {
+                kind: "dm",
+                other_ap_id: actor.ap_id,
+                conversation_id: conversationId,
+                message: messagePayload,
+              },
+            },
+          ]
+        : []),
+      {
+        actorApId: actor.ap_id,
+        type: "talk.message",
+        data: {
+          kind: "dm",
+          other_ap_id: otherApId,
+          conversation_id: conversationId,
+          message: messagePayload,
+        },
+      },
+    ]),
+  );
+
   return c.json(
     {
-      message: {
-        id: apId,
-        sender: buildSenderFromActor(actor),
-        content,
-        attachments,
-        created_at: now,
-      },
+      message: messagePayload,
       conversation_id: conversationId,
     },
     201,

package/src/backend/routes/dm/read-archive.ts

@@ -11,6 +11,11 @@ import {
   objects,
 } from "../../../db/index.ts";
 import { resolveConversationId } from "./query-helpers.ts";
+import {
+  emitRealtimeBestEffort,
+  emitUnreadSnapshot,
+  runRealtimeAfterResponse,
+} from "../../runtime/realtime-hub.ts";
 import {
   buildActorInfoMap,
   byTimeDesc,
@@ -54,6 +59,23 @@ readArchive.post("/user/:encodedApId/read", async (c) => {
       set: { lastReadAt: now },
     });
 
+  // Live read receipt for the partner's open thread + refreshed unread badge
+  // for the reader's OTHER tabs/devices.
+  await runRealtimeAfterResponse(c, async () => {
+    await emitRealtimeBestEffort(c.env, [
+      {
+        actorApId: otherApId,
+        type: "talk.read",
+        data: {
+          other_ap_id: actor.ap_id,
+          conversation_id: conversationId,
+          last_read_at: now,
+        },
+      },
+    ]);
+    await emitUnreadSnapshot(c.env, actor.ap_id);
+  });
+
   return c.json({ success: true, last_read_at: now });
 });
 
@@ -108,6 +130,11 @@ readArchive.post("/community/:encodedApId/read", async (c) => {
       set: { lastReadAt: now },
     });
 
+  // Refresh the reader's unread badge on their other tabs/devices.
+  await runRealtimeAfterResponse(c, () =>
+    emitUnreadSnapshot(c.env, actor.ap_id),
+  );
+
   return c.json({ success: true, last_read_at: now });
 });
 

package/src/backend/routes/dm/typing.ts

@@ -3,6 +3,10 @@
 import { Hono } from "hono";
 import { and, eq } from "drizzle-orm";
 import { dmTyping } from "../../../db/index.ts";
+import {
+  emitRealtimeBestEffort,
+  runRealtimeAfterResponse,
+} from "../../runtime/realtime-hub.ts";
 import { type HonoEnv, parseOtherApId } from "./conversations-helpers.ts";
 
 const typing = new Hono<HonoEnv>();
@@ -28,6 +32,18 @@ typing.post("/user/:encodedApId/typing", async (c) => {
       set: { lastTypedAt: now },
     });
 
+  // Push the indicator to the partner's live sockets; the GET endpoint stays
+  // as the fallback-polling read.
+  await runRealtimeAfterResponse(c, () =>
+    emitRealtimeBestEffort(c.env, [
+      {
+        actorApId: otherApId,
+        type: "talk.typing",
+        data: { other_ap_id: actor.ap_id, is_typing: true, typed_at: now },
+      },
+    ]),
+  );
+
   return c.json({ success: true, typed_at: now });
 });
 

package/src/backend/routes/notifications.ts

@@ -35,6 +35,10 @@ import {
   NOTIFICATION_ACTIVITY_TYPES,
   notificationEligibilityWhere,
 } from "../lib/notification-eligibility.ts";
+import {
+  emitUnreadSnapshot,
+  runRealtimeAfterResponse,
+} from "../runtime/realtime-hub.ts";
 
 const notifications = new Hono<{ Bindings: Env; Variables: Variables }>();
 
@@ -622,6 +626,11 @@ notifications.post("/read", async (c) => {
     );
   }
 
+  // Sync the reader's OTHER tabs/devices: push the fresh authoritative badge.
+  await runRealtimeAfterResponse(c, () =>
+    emitUnreadSnapshot(c.env, actor.ap_id),
+  );
+
   return c.json({ success: true });
 });
 
@@ -681,6 +690,11 @@ notifications.post("/archive", async (c) => {
     ARCHIVE_CREATE_BATCH_SIZE,
   );
 
+  // Archiving an unread notification removes it from the badge count.
+  await runRealtimeAfterResponse(c, () =>
+    emitUnreadSnapshot(c.env, actor.ap_id),
+  );
+
   return c.json({ success: true, archived_count });
 });
 
@@ -716,6 +730,11 @@ notifications.delete("/archive", async (c) => {
       ),
     );
 
+  // Unarchiving can resurface unread rows into the badge count.
+  await runRealtimeAfterResponse(c, () =>
+    emitUnreadSnapshot(c.env, actor.ap_id),
+  );
+
   return c.json({ success: true });
 });
 
@@ -758,6 +777,12 @@ notifications.post("/archive/all", async (c) => {
     rows,
     ARCHIVE_CREATE_BATCH_SIZE,
   );
+
+  // Archive-all clears the whole badge; sync the reader's other tabs/devices.
+  await runRealtimeAfterResponse(c, () =>
+    emitUnreadSnapshot(c.env, actor.ap_id),
+  );
+
   return c.json({ success: true, archived_count });
 });