@takosjp/yurucommu-core 3.3.0 → 3.4.1

package/src/backend/lib/delivery/queue.ts

@@ -3,8 +3,12 @@
  * and the batch handler that dispatches to sub-modules.
  */
 
-import type { Message, MessageBatch, Queue } from "@cloudflare/workers-types";
 import type { Env } from "../../types.ts";
+import type {
+  IQueueBatch,
+  IQueueMessage,
+  IQueueProducer,
+} from "../../runtime/queue.ts";
 import type { Database } from "../../../db/index.ts";
 import { and, eq, notInArray, or, sql } from "drizzle-orm";
 import { actorCache, deliveryQueue } from "../../../db/index.ts";
@@ -119,8 +123,8 @@ export function nowIso(): string {
 }
 
 export type QueueEnv = Env & {
-  DELIVERY_QUEUE: Queue<DeliveryQueueMessageV1>;
-  DELIVERY_DLQ: Queue<DeliveryDlqMessageV1>;
+  DELIVERY_QUEUE: IQueueProducer<DeliveryQueueMessageV1>;
+  DELIVERY_DLQ: IQueueProducer<DeliveryDlqMessageV1>;
 };
 
 function queueAvailable(env: Env): env is QueueEnv {
@@ -130,7 +134,7 @@ function queueAvailable(env: Env): env is QueueEnv {
 export function requireQueue(
   env: Env,
   label: string,
-  message: Message<DeliveryQueueMessageV1>,
+  message: IQueueMessage<DeliveryQueueMessageV1>,
 ): env is QueueEnv {
   if (queueAvailable(env)) return true;
   log.warn("Missing DELIVERY_QUEUE/DELIVERY_DLQ bindings; dropping job", {
@@ -426,7 +430,7 @@ export async function enqueueFanoutToCommunity(
 // ---------------------------------------------------------------------------
 
 export async function handleDeliveryQueueBatch(
-  batch: MessageBatch<DeliveryQueueMessageV1>,
+  batch: IQueueBatch<DeliveryQueueMessageV1>,
   env: Env,
 ): Promise<void> {
   const db = env.DB_INSTANCE;
@@ -494,13 +498,13 @@ export async function handleDeliveryQueueBatch(
 
   // Deliver endpoint messages with bulkhead+concurrency.
   const deliveryMessages = batch.messages.filter(
-    (m: Message<DeliveryQueueMessageV1>) =>
+    (m: IQueueMessage<DeliveryQueueMessageV1>) =>
       isDeliveryQueueMessageV1(m.body) && m.body.type === "deliver_endpoint",
-  ) as Array<Message<DeliveryQueueMessageV1>>;
+  ) as Array<IQueueMessage<DeliveryQueueMessageV1>>;
   await runWithConcurrency(
     deliveryMessages,
     BULKHEAD_GLOBAL_CONCURRENCY,
-    async (m: Message<DeliveryQueueMessageV1>) => {
+    async (m: IQueueMessage<DeliveryQueueMessageV1>) => {
       try {
         await processDeliverEndpoint(
           db,
@@ -531,10 +535,14 @@ export async function handleDeliveryQueueBatch(
       error,
     });
   }
+  // Same choke point feeds the realtime stream (federated + fanout inserts).
+  const { sweepRealtimeNotifications } =
+    await import("../../runtime/realtime-hub.ts");
+  await sweepRealtimeNotifications(env);
 }
 
 export async function handleDeliveryDlqBatch(
-  batch: MessageBatch<DeliveryDlqMessageV1>,
+  batch: IQueueBatch<DeliveryDlqMessageV1>,
   env: Env,
 ): Promise<void> {
   for (const message of batch.messages) {

package/src/backend/lib/delivery/types.ts

@@ -5,6 +5,8 @@ export type DeliveryFanoutFollowersMessageV1 = {
   type: "fanout_followers";
   activityId: string;
   followeeApId: string;
+  /** Stable keyset cursor used when a large graph spans queue invocations. */
+  cursor?: string;
   scheduledAt: string; // ISO8601 UTC
 };
 
@@ -24,6 +26,10 @@ export type DeliveryFanoutCommunityMessageV1 = {
   // receive `activityId`. Absent for non-Create activities (edit/delete relay
   // the activity directly).
   announceActivityId?: string;
+  /** Current bounded fan-out phase; absent means start with local members. */
+  stage?: "local_members" | "remote_members" | "remote_followers";
+  /** Stable actor-id keyset cursor within `stage`. */
+  cursor?: string;
   scheduledAt: string; // ISO8601 UTC
 };
 
@@ -106,12 +112,18 @@ export function isDeliveryQueueMessageV1(
       return (
         typeof v.activityId === "string" &&
         typeof v.followeeApId === "string" &&
+        (v.cursor === undefined || typeof v.cursor === "string") &&
         typeof v.scheduledAt === "string"
       );
     case "fanout_community":
       return (
         typeof v.activityId === "string" &&
         typeof v.communityApId === "string" &&
+        (v.stage === undefined ||
+          v.stage === "local_members" ||
+          v.stage === "remote_members" ||
+          v.stage === "remote_followers") &&
+        (v.cursor === undefined || typeof v.cursor === "string") &&
         typeof v.scheduledAt === "string"
       );
     case "resolve_actor":

package/src/backend/lib/notification-push.ts

@@ -1,4 +1,4 @@
-import type { Message } from "@cloudflare/workers-types";
+import type { IQueueMessage } from "../runtime/queue.ts";
 import { and, asc, eq, exists, inArray, lte, ne, sql } from "drizzle-orm";
 
 import {
@@ -501,7 +501,7 @@ export async function purgeExpiredNotificationPushJobs(
 export async function processNotificationPushJob(
   env: Env,
   body: DeliveryNotificationPushMessageV1,
-  message: Message<DeliveryQueueMessageV1>,
+  message: IQueueMessage<DeliveryQueueMessageV1>,
 ): Promise<void> {
   const db = env.DB_INSTANCE;
   let job = await db

package/src/backend/lib/oauth-providers.ts

@@ -61,6 +61,15 @@ export function getOidcClientCredentials(env: Env): {
   };
 }
 
+/**
+ * Audience advertised to native clients and accepted by the host exchange.
+ * A Capsule has one public OIDC client with multiple exact redirect URIs; web
+ * and native clients must therefore converge on this same client id.
+ */
+export function getMobileOidcAudience(env: Env): string {
+  return getOidcClientCredentials(env).clientId;
+}
+
 export function issuerEndpoint(issuer: string, path: string): string {
   return `${issuer.replace(/\/$/, "")}${path}`;
 }

package/src/backend/lib/strip-image-metadata.ts

@@ -10,9 +10,10 @@
  * re-encoding the pixels, so the visible image is unchanged.
  *
  * Pure byte-surgery (no native image library): it walks the container structure
- * and drops only metadata segments/chunks, copying everything else verbatim. It
- * NEVER corrupts: on any structural surprise it returns the original bytes
- * unchanged (the magic-byte validation has already confirmed the declared type).
+ * and drops only metadata segments/chunks, copying everything else verbatim.
+ * Supported containers fail closed on structural surprises: returning their
+ * original bytes would silently publish the metadata the parser failed to
+ * understand.
  *
  * Covered: JPEG (APP1 EXIF/XMP, APP13 IPTC, COM), PNG (tEXt/zTXt/iTXt/eXIf/tIME),
  * WebP (EXIF / XMP chunks). GIF and video are passed through unchanged (GIF
@@ -24,36 +25,37 @@ export function stripImageMetadata(
   bytes: Uint8Array,
   mimeType: string,
 ): Uint8Array {
-  try {
-    switch (mimeType) {
-      case "image/jpeg":
-        return stripJpeg(bytes);
-      case "image/png":
-        return stripPng(bytes);
-      case "image/webp":
-        return stripWebp(bytes);
-      default:
-        return bytes; // gif / video / unknown: unchanged
-    }
-  } catch {
-    // Never let a parsing surprise corrupt or drop the upload.
-    return bytes;
+  switch (mimeType) {
+    case "image/jpeg":
+      return stripJpeg(bytes);
+    case "image/png":
+      return stripPng(bytes);
+    case "image/webp":
+      return stripWebp(bytes);
+    default:
+      return bytes; // gif / video / unknown: unchanged
   }
 }
 
+function malformed(format: "JPEG" | "PNG" | "WebP"): never {
+  throw new Error(`Malformed ${format} image`);
+}
+
 // ---------------------------------------------------------------------------
 // JPEG: a stream of marker segments. Drop APP1 (EXIF + XMP), APP13 (IPTC /
 // Photoshop) and COM (comment); keep APP0 (JFIF), APP2 (ICC), APP14 (Adobe
 // color transform), the quantization/Huffman tables, and the scan data verbatim.
 // ---------------------------------------------------------------------------
 function stripJpeg(bytes: Uint8Array): Uint8Array {
-  if (bytes.length < 4 || bytes[0] !== 0xff || bytes[1] !== 0xd8) return bytes;
+  if (bytes.length < 4 || bytes[0] !== 0xff || bytes[1] !== 0xd8) {
+    return malformed("JPEG");
+  }
 
   const out: number[] = [0xff, 0xd8]; // SOI
   let i = 2;
 
   while (i + 1 < bytes.length) {
-    if (bytes[i] !== 0xff) return bytes; // not at a marker — bail unchanged
+    if (bytes[i] !== 0xff) return malformed("JPEG");
     const marker = bytes[i + 1];
 
     // Start of Scan: entropy-coded data runs to EOI — copy the rest verbatim.
@@ -72,9 +74,9 @@ function stripJpeg(bytes: Uint8Array): Uint8Array {
       i += 2;
       continue;
     }
-    if (i + 3 >= bytes.length) return bytes; // truncated length — bail unchanged
+    if (i + 3 >= bytes.length) return malformed("JPEG");
     const len = (bytes[i + 2] << 8) | bytes[i + 3]; // includes the 2 length bytes
-    if (len < 2 || i + 2 + len > bytes.length) return bytes; // malformed — bail
+    if (len < 2 || i + 2 + len > bytes.length) return malformed("JPEG");
 
     const drop =
       marker === 0xe1 || // APP1: EXIF + XMP (the GPS carriers)
@@ -85,7 +87,7 @@ function stripJpeg(bytes: Uint8Array): Uint8Array {
     }
     i += 2 + len;
   }
-  return Uint8Array.from(out);
+  return malformed("JPEG");
 }
 
 // ---------------------------------------------------------------------------
@@ -96,8 +98,10 @@ const PNG_SIGNATURE = [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a];
 const PNG_DROP_CHUNKS = new Set(["tEXt", "zTXt", "iTXt", "eXIf", "tIME"]);
 
 function stripPng(bytes: Uint8Array): Uint8Array {
-  if (bytes.length < 8) return bytes;
-  for (let i = 0; i < 8; i++) if (bytes[i] !== PNG_SIGNATURE[i]) return bytes;
+  if (bytes.length < 8) return malformed("PNG");
+  for (let i = 0; i < 8; i++) {
+    if (bytes[i] !== PNG_SIGNATURE[i]) return malformed("PNG");
+  }
 
   const out: number[] = [...PNG_SIGNATURE];
   let i = 8;
@@ -107,7 +111,7 @@ function stripPng(bytes: Uint8Array): Uint8Array {
       (bytes[i + 1] << 16) |
       (bytes[i + 2] << 8) |
       bytes[i + 3];
-    if (len < 0) return bytes; // overflow / malformed — bail unchanged
+    if (len < 0) return malformed("PNG");
     const type = String.fromCharCode(
       bytes[i + 4],
       bytes[i + 5],
@@ -115,7 +119,7 @@ function stripPng(bytes: Uint8Array): Uint8Array {
       bytes[i + 7],
     );
     const chunkEnd = i + 12 + len; // length(4) + type(4) + data(len) + crc(4)
-    if (chunkEnd > bytes.length) return bytes; // truncated — bail unchanged
+    if (chunkEnd > bytes.length) return malformed("PNG");
 
     if (!PNG_DROP_CHUNKS.has(type)) {
       for (let k = i; k < chunkEnd; k++) out.push(bytes[k]);
@@ -123,9 +127,22 @@ function stripPng(bytes: Uint8Array): Uint8Array {
     i = chunkEnd;
     if (type === "IEND") break;
   }
+  if (i !== bytes.length || !containsPngChunk(out, "IEND")) {
+    return malformed("PNG");
+  }
   return Uint8Array.from(out);
 }
 
+function containsPngChunk(bytes: readonly number[], type: string): boolean {
+  const needle = [...type].map((character) => character.charCodeAt(0));
+  for (let i = 8; i + needle.length <= bytes.length; i++) {
+    if (needle.every((value, offset) => bytes[i + offset] === value)) {
+      return true;
+    }
+  }
+  return false;
+}
+
 // ---------------------------------------------------------------------------
 // WebP: a RIFF container ("RIFF" <size> "WEBP" <chunks>). Drop the "EXIF" and
 // "XMP " chunks, clear the matching VP8X feature-flag bits, and rewrite the RIFF
@@ -142,8 +159,10 @@ function fourCC(bytes: Uint8Array, off: number): string {
 }
 
 function stripWebp(bytes: Uint8Array): Uint8Array {
-  if (bytes.length < 16) return bytes;
-  if (fourCC(bytes, 0) !== "RIFF" || fourCC(bytes, 8) !== "WEBP") return bytes;
+  if (bytes.length < 16) return malformed("WebP");
+  if (fourCC(bytes, 0) !== "RIFF" || fourCC(bytes, 8) !== "WEBP") {
+    return malformed("WebP");
+  }
 
   const head: number[] = [];
   for (let k = 0; k < 12; k++) head.push(bytes[k]); // RIFF + size + WEBP
@@ -158,10 +177,10 @@ function stripWebp(bytes: Uint8Array): Uint8Array {
       (bytes[i + 5] << 8) |
       (bytes[i + 6] << 16) |
       (bytes[i + 7] << 24);
-    if (size < 0) return bytes; // overflow — bail unchanged
+    if (size < 0) return malformed("WebP");
     const padded = size + (size & 1); // chunks pad to an even length
     const chunkEnd = i + 8 + padded;
-    if (chunkEnd > bytes.length) return bytes; // truncated — bail unchanged
+    if (chunkEnd > bytes.length) return malformed("WebP");
 
     if (cc === "EXIF" || cc === "XMP ") {
       removed = true; // skip this chunk entirely
@@ -170,6 +189,7 @@ function stripWebp(bytes: Uint8Array): Uint8Array {
     }
     i = chunkEnd;
   }
+  if (i !== bytes.length) return malformed("WebP");
   if (!removed) return bytes; // nothing to strip — keep original bytes
 
   // Clear the EXIF (bit 3) / XMP (bit 2) feature flags in a VP8X header so the

package/src/backend/lib/unread-counts.ts

@@ -17,8 +17,14 @@
  *   own, after the later of the per-community read time and the join time.
  */
 
-import { sql } from "drizzle-orm";
-import type { Database } from "../../db/index.ts";
+import { and, count, eq, sql } from "drizzle-orm";
+import {
+  activities,
+  inbox as inboxTable,
+  objects,
+  type Database,
+} from "../../db/index.ts";
+import { notificationEligibilityWhere } from "./notification-eligibility.ts";
 
 export interface YurumeUnreadCounts {
   readonly dm: number;
@@ -77,3 +83,58 @@ export async function yurumeUnreadCounts(
   const community = Number(communityRow?.c ?? 0);
   return { dm, community, total: dm + community };
 }
+
+/**
+ * Unread social-notification count. SAME shared eligibility builder as the
+ * notifications list, the badge endpoint, and push delivery (not-self,
+ * user-facing types, archive exclusion, direct-DM exclusion, block/mute
+ * suppression) so a realtime-pushed badge can never drift from the badge the
+ * client fetches.
+ */
+export async function notificationUnreadCount(
+  db: Database,
+  actorApId: string,
+): Promise<number> {
+  const result = await db
+    .select({ count: count() })
+    .from(inboxTable)
+    .innerJoin(activities, eq(inboxTable.activityApId, activities.apId))
+    .leftJoin(objects, eq(activities.objectApId, objects.apId))
+    .where(
+      and(
+        eq(inboxTable.actorApId, actorApId),
+        eq(inboxTable.read, 0),
+        ...notificationEligibilityWhere(db, actorApId, { direct: "exclude" }),
+      ),
+    )
+    .get();
+  return Number(result?.count ?? 0);
+}
+
+export interface UnreadSnapshot {
+  readonly dm: number;
+  readonly community: number;
+  readonly talkTotal: number;
+  readonly notifications: number;
+}
+
+/**
+ * One authoritative unread snapshot (talk + notifications) for the realtime
+ * `unread` event. Server-computed on every emit so clients never derive or
+ * increment counters themselves.
+ */
+export async function computeUnreadSnapshot(
+  db: Database,
+  actorApId: string,
+): Promise<UnreadSnapshot> {
+  const [talk, notifications] = await Promise.all([
+    yurumeUnreadCounts(db, actorApId),
+    notificationUnreadCount(db, actorApId),
+  ]);
+  return {
+    dm: talk.dm,
+    community: talk.community,
+    talkTotal: talk.total,
+    notifications,
+  };
+}

package/src/backend/middleware/bearer-auth.ts

@@ -6,6 +6,8 @@ import {
   issuerEndpoint,
 } from "../lib/oauth-providers.ts";
 
+const INTROSPECTION_TIMEOUT_MS = 5_000;
+
 export function requireBearerAuth(
   requiredScope: string,
 ): MiddlewareHandler<{ Bindings: Env; Variables: Variables }> {
@@ -27,15 +29,28 @@ export function requireBearerAuth(
       );
     }
 
-    const res = await fetch(issuerEndpoint(issuer, "/oauth/introspect"), {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        token,
-        client_id: clientId,
-        client_secret: clientSecret,
-      }).toString(),
-    });
+    let res: Response;
+    try {
+      res = await fetch(issuerEndpoint(issuer, "/oauth/introspect"), {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          token,
+          client_id: clientId,
+          client_secret: clientSecret,
+        }).toString(),
+        signal: AbortSignal.timeout(INTROSPECTION_TIMEOUT_MS),
+      });
+    } catch {
+      c.header("Retry-After", "5");
+      return c.json(
+        {
+          error: "temporarily_unavailable",
+          error_description: "Introspection request failed",
+        },
+        503,
+      );
+    }
     if (!res.ok) {
       return c.json(
         {

package/src/backend/public.ts

@@ -12,10 +12,34 @@ export {
 export { default } from "./index.ts";
 export { default as app } from "./index.ts";
 export { type Database, getDb, getDbSQLite } from "../db/index.ts";
-export { wrapCloudflareBindings } from "./runtime/cloudflare.ts";
+export {
+  wrapCloudflareBindings,
+  wrapCloudflareMessageBatch,
+  wrapCloudflareQueue,
+} from "./runtime/cloudflare.ts";
+export {
+  ManagedRuntimeGatewayError,
+  createManagedRuntimeQueueProducer,
+  type ManagedRuntimeGateway,
+  type ManagedRuntimeQueueProducerOptions,
+} from "./runtime/managed-runtime.ts";
+export {
+  createManagedRelationalDatabase,
+  type ManagedRelationalDatabaseOptions,
+} from "./runtime/managed-relational.ts";
+export type {
+  IQueueBatch,
+  IQueueMessage,
+  IQueueProducer,
+  QueueBatchItem,
+  QueueSendOptions,
+} from "./runtime/queue.ts";
 // Call feature: the signaling Durable Object class each product's generated
 // worker entry must re-export so Wrangler can bind CALL_SIGNALING to it.
 export { CallSignalingDurableObject } from "./runtime/call-signaling-do.ts";
+// Realtime stream: the per-user fanout Durable Object class each product's
+// generated worker entry must re-export so Wrangler can bind REALTIME_STREAM.
+export { RealtimeStreamDO } from "./runtime/realtime-stream-do.ts";
 export type { Env, EnvVars } from "./types.ts";
 export type {
   DeliveryDlqMessageV1,

package/src/backend/routes/activitypub/handlers/actor-inbox-handlers.ts

@@ -59,6 +59,7 @@ export async function handleGroupFollow(
   actorApIdStr: string,
   baseUrl: string,
   activityId: string,
+  sourceActivityId: string = activityId,
 ) {
   const db = c.get("db");
   const followerKey = {
@@ -130,7 +131,7 @@ export async function handleGroupFollow(
     where: and(
       eq(activities.type, responseType),
       eq(activities.actorApId, group.apId),
-      eq(activities.objectApId, activityId),
+      eq(activities.objectApId, sourceActivityId),
     ),
   });
   if (existingResponse) {
@@ -144,14 +145,14 @@ export async function handleGroupFollow(
     id: responseId,
     type: responseType,
     actor: group.apId,
-    object: activityId,
+    object: sourceActivityId,
   };
 
   await db.insert(activities).values({
     apId: responseId,
     type: responseType,
     actorApId: group.apId,
-    objectApId: activityId,
+    objectApId: sourceActivityId,
     rawJson: JSON.stringify(responseActivity),
     direction: "outbound",
   });