@takosjp/yurucommu-core 3.4.0 → 3.4.1

package/migrations/0022_inbound_dispatch_claims.sql

@@ -0,0 +1,17 @@
+-- Fence concurrent/retried ActivityPub inbox dispatches.
+--
+-- `activities.processed = 0` says an activity is retryable, but it does not say
+-- whether another Worker is actively dispatching it. Keeping the lease in a
+-- separate table preserves the public activities ledger shape and lets a
+-- crashed owner expire without allowing an old owner to commit over a newer
+-- retry.
+
+CREATE TABLE IF NOT EXISTS inbound_activity_claims (
+  activity_ap_id TEXT PRIMARY KEY,
+  processing_token TEXT,
+  lease_expires_at TEXT,
+  updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+);
+
+CREATE INDEX IF NOT EXISTS inbound_activity_claims_lease_idx
+  ON inbound_activity_claims(lease_expires_at);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@takosjp/yurucommu-core",
-  "version": "3.4.0",
+  "version": "3.4.1",
   "license": "AGPL-3.0-only",
   "type": "module",
   "workspaces": [
@@ -59,7 +59,7 @@
     "start": "bun src/backend/server.ts",
     "dev": "bun src/backend/server.ts",
     "dev:server": "bun src/backend/server.ts",
-    "check": "tsc --noEmit && bun run check:no-opentofu-artifacts",
+    "check": "bun run fmt:check && tsc --noEmit && bun run check:no-opentofu-artifacts && bun run test",
     "check:no-opentofu-artifacts": "bun scripts/check-no-opentofu-artifacts.mjs",
     "test": "bun run build:api && bun test test/ src/backend/ packages/api/src/ scripts/check-publish-version-discipline.test.ts scripts/publish-package-resumable.test.ts && bun run check:release-contents",
     "test:backend": "bun test src/backend/",
@@ -82,6 +82,7 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.971.0",
     "@libsql/client": "^0.17.0",
+    "@takosjp/takosumi-contract": "^1.0.0",
     "better-sqlite3": "^12.4.1",
     "drizzle-orm": "^0.45.1",
     "fdir": "^6.5.0",

package/packages/api/src/lib/api/notifications.ts

@@ -39,6 +39,7 @@ export async function fetchNotifications(options?: {
 
 export async function fetchUnreadCount(): Promise<number> {
   const res = await apiFetch("/api/notifications/unread/count");
+  await assertOk(res, "Failed to load unread notification count");
   const data = (await res.json()) as { count?: number };
   return data.count || 0;
 }

package/packages/api/src/lib/api/posts.ts

@@ -169,6 +169,7 @@ export async function fetchBookmarks(options?: {
   if (options?.before) params.set("before", options.before);
   const query = params.toString() ? `?${params}` : "";
   const res = await apiFetch(`/api/bookmarks${query}`);
+  await assertOk(res, "Failed to load bookmarks");
   const data = (await res.json()) as PostListResponse & {
     next_cursor?: string | null;
     has_more?: boolean;

package/src/backend/index.ts

@@ -4,8 +4,12 @@ import { NOTIFICATION_PUSHER_REGISTRATION_PATH } from "./lib/notification-pusher
 import type { Env, EnvVars, Variables } from "./types.ts";
 import { extractActorFromSession } from "./lib/session-actor.ts";
 import { isBackendPath } from "./lib/backend-paths.ts";
-import { wrapCloudflareBindings } from "./runtime/cloudflare.ts";
 import {
+  wrapCloudflareBindings,
+  wrapCloudflareMessageBatch,
+} from "./runtime/cloudflare.ts";
+import {
+  getMobileOidcAudience,
   getOidcClientCredentials,
   getOidcIssuerUrl,
 } from "./lib/oauth-providers.ts";
@@ -44,7 +48,15 @@ import { logger } from "./lib/logger.ts";
 
 const log = logger.child({ component: "backend.index" });
 let lastNotificationPushRecoverySweep = 0;
-import type { MessageBatch } from "@cloudflare/workers-types";
+import type { IQueueBatch } from "./runtime/queue.ts";
+import type {
+  D1Database,
+  Fetcher,
+  KVNamespace,
+  MessageBatch,
+  Queue,
+  R2Bucket,
+} from "@cloudflare/workers-types";
 import type {
   DeliveryDlqMessageV1,
   DeliveryQueueMessageV1,
@@ -74,6 +86,14 @@ export interface YurucommuBackendPluginV1 {
 export interface CreateYurucommuBackendAppOptionsV1 {
   plugins?: YurucommuBackendPluginV1[];
   discovery?: YurucommuBackendDiscoveryOptionsV1;
+  /**
+   * Browser capture capabilities required by this product shell. Both default
+   * to denied; a product must opt in to each capability it actually uses.
+   */
+  browserMedia?: {
+    camera?: boolean;
+    microphone?: boolean;
+  };
 }
 
 export interface YurucommuBackendDiscoveryClientV1 {
@@ -343,7 +363,7 @@ function mountReadinessRoutes(
   ) => {
     const appUrl = normalizeOrigin(c.env.APP_URL, c.req.url);
     const issuer = getOidcIssuerUrl(c.env) ?? appUrl;
-    const { clientId } = getOidcClientCredentials(c.env);
+    const clientId = getMobileOidcAudience(c.env);
     return c.json(
       buildSocialServerDiscovery(appUrl, issuer, discovery, {
         oidcClientId: getOidcIssuerUrl(c.env)
@@ -504,7 +524,12 @@ function applyBodyLimits(app: YurucommuApp): void {
   });
 }
 
-function applyGlobalMiddleware(app: YurucommuApp): void {
+function applyGlobalMiddleware(
+  app: YurucommuApp,
+  browserMedia: NonNullable<
+    CreateYurucommuBackendAppOptionsV1["browserMedia"]
+  > = {},
+): void {
   app.onError(createErrorMiddleware());
 
   app.use("*", async (c, next) => {
@@ -562,11 +587,14 @@ function applyGlobalMiddleware(app: YurucommuApp): void {
     setSecurityHeader("X-Content-Type-Options", "nosniff");
     setSecurityHeader("X-Frame-Options", "DENY");
     setSecurityHeader("Referrer-Policy", "strict-origin-when-cross-origin");
-    // Allow the app's OWN origin to use camera + microphone (WebRTC calls);
-    // still deny geolocation and deny camera/mic to any cross-origin frame.
+    // Browser capture is product-specific and denied by default. Even when a
+    // capability is enabled, only this origin may use it; cross-origin frames
+    // and geolocation remain denied.
+    const camera = browserMedia.camera === true ? "(self)" : "()";
+    const microphone = browserMedia.microphone === true ? "(self)" : "()";
     setSecurityHeader(
       "Permissions-Policy",
-      "camera=(self), microphone=(self), geolocation=()",
+      `camera=${camera}, microphone=${microphone}, geolocation=()`,
     );
     // HSTS: once a client has reached this host over HTTPS, keep it on HTTPS
     // (defeats SSL-strip / downgrade). Sent unconditionally — browsers ignore it
@@ -901,7 +929,7 @@ export function createYurucommuBackendApp(
   // /healthz and /readyz stay reachable even when payload validation
   // misbehaves.
   applyBodyLimits(app);
-  applyGlobalMiddleware(app);
+  applyGlobalMiddleware(app, options.browserMedia);
   for (const plugin of plugins) {
     plugin.setup?.(pluginContext);
   }
@@ -923,7 +951,7 @@ const app = createYurucommuBackendApp();
 export const backendApp = app;
 
 export async function handleYurucommuQueueBatch(
-  batch: MessageBatch<DeliveryQueueMessageV1 | DeliveryDlqMessageV1>,
+  batch: IQueueBatch<DeliveryQueueMessageV1 | DeliveryDlqMessageV1>,
   env: Env,
 ): Promise<void> {
   const deliveryQueueName = env.DELIVERY_QUEUE_NAME ?? "yurucommu-delivery";
@@ -931,13 +959,13 @@ export async function handleYurucommuQueueBatch(
 
   if (batch.queue === deliveryQueueName) {
     return handleDeliveryQueueBatch(
-      batch as MessageBatch<DeliveryQueueMessageV1>,
+      batch as IQueueBatch<DeliveryQueueMessageV1>,
       env,
     );
   }
   if (batch.queue === deliveryDlqName) {
     return handleDeliveryDlqBatch(
-      batch as MessageBatch<DeliveryDlqMessageV1>,
+      batch as IQueueBatch<DeliveryDlqMessageV1>,
       env,
     );
   }
@@ -979,6 +1007,9 @@ export default {
     batch: MessageBatch<DeliveryQueueMessageV1 | DeliveryDlqMessageV1>,
     bindings: WorkerBindings,
   ): Promise<void> {
-    return handleYurucommuQueueBatch(batch, wrapCloudflareBindings(bindings));
+    return handleYurucommuQueueBatch(
+      wrapCloudflareMessageBatch(batch),
+      wrapCloudflareBindings(bindings),
+    );
   },
 };

package/src/backend/lib/delivery/queue-batching.ts

@@ -3,8 +3,8 @@
  * and batch dispatch of delivery messages.
  */
 
-import type { Message, MessageBatch } from "@cloudflare/workers-types";
 import type { Env } from "../../types.ts";
+import type { IQueueMessage } from "../../runtime/queue.ts";
 import type { Database } from "../../../db/index.ts";
 import { and, eq, or, sql } from "drizzle-orm";
 import {
@@ -117,12 +117,17 @@ export async function enqueueFollowerEndpointDeliveries(
   baseUrl: string,
   activityId: string,
   followeeApId: string,
-): Promise<{ processed: number; capped: boolean }> {
+  startCursor: string | null = null,
+): Promise<{
+  processed: number;
+  capped: boolean;
+  nextCursor: string | null;
+}> {
   // Page through accepted followers with a keyset cursor instead of loading
   // every row into memory at once. Each page is planned and dispatched in
   // ≤100-message chunks before the next page is read, bounding both memory
   // and per-call batch size.
-  let cursor: string | null = null;
+  let cursor: string | null = startCursor;
   let processed = 0;
   let capped = false;
 
@@ -184,7 +189,7 @@ export async function enqueueFollowerEndpointDeliveries(
     }
   }
 
-  return { processed, capped };
+  return { processed, capped, nextCursor: capped ? cursor : null };
 }
 
 /**
@@ -215,21 +220,27 @@ export async function snapshotAndEnqueueFollowerDeliveries(
     return;
   }
 
-  const { processed, capped } = await enqueueFollowerEndpointDeliveries(
-    db,
-    queue,
-    env.APP_URL,
-    activityId,
-    followeeApId,
-  );
+  let cursor: string | null = null;
+  let processed = 0;
+  do {
+    const page = await enqueueFollowerEndpointDeliveries(
+      db,
+      queue,
+      env.APP_URL,
+      activityId,
+      followeeApId,
+      cursor,
+    );
+    processed += page.processed;
+    cursor = page.nextCursor;
+  } while (cursor !== null);
 
-  if (capped) {
-    log.warn("Follower snapshot delivery capped at max followers", {
-      event: "delivery.fanout.snapshot_capped",
+  if (processed > FANOUT_MAX_FOLLOWERS) {
+    log.info("Follower snapshot continued across bounded pages", {
+      event: "delivery.fanout.snapshot_continued",
       followee: followeeApId,
       activityId,
       processed,
-      max: FANOUT_MAX_FOLLOWERS,
     });
   }
 }
@@ -238,32 +249,38 @@ export async function processFanoutFollowers(
   db: Database,
   env: Env,
   msg: DeliveryFanoutFollowersMessageV1,
-  message: Message<DeliveryQueueMessageV1>,
+  message: IQueueMessage<DeliveryQueueMessageV1>,
 ): Promise<void> {
   if (!requireQueue(env, "fanout", message)) return;
   const queueEnv = env as QueueEnv;
 
-  const { processed, capped } = await enqueueFollowerEndpointDeliveries(
-    db,
-    queueEnv.DELIVERY_QUEUE,
-    env.APP_URL,
-    msg.activityId,
-    msg.followeeApId,
-  );
+  const { processed, capped, nextCursor } =
+    await enqueueFollowerEndpointDeliveries(
+      db,
+      queueEnv.DELIVERY_QUEUE,
+      env.APP_URL,
+      msg.activityId,
+      msg.followeeApId,
+      msg.cursor ?? null,
+    );
 
-  if (capped) {
-    // Extremely large follower sets are capped per invocation to keep the
-    // Worker within CPU/time limits. Endpoint-deduped delivery jobs are
-    // idempotent (computeDeliveryJobId + upsertDeliveryJob), and the planner
-    // re-enqueues any still-unknown recipients on the next fanout, so capped
-    // followers are re-planned on the actor's next delivery rather than lost
-    // silently.
-    log.warn("Fanout capped at max followers for one invocation", {
-      event: "delivery.fanout.capped",
+  if (capped && nextCursor !== null) {
+    // Send the continuation before ACK. If this send fails, Cloudflare retries
+    // the current message; deterministic endpoint job ids make that safe.
+    await sendQueueMessage(env, {
+      version: DELIVERY_QUEUE_MESSAGE_VERSION,
+      type: "fanout_followers",
+      activityId: msg.activityId,
+      followeeApId: msg.followeeApId,
+      cursor: nextCursor,
+      scheduledAt: nowIso(),
+    });
+    log.info("Follower fanout continued from stable cursor", {
+      event: "delivery.fanout.continued",
       followee: msg.followeeApId,
       activityId: msg.activityId,
       processed,
-      max: FANOUT_MAX_FOLLOWERS,
+      cursor: nextCursor,
     });
   }
 
@@ -288,7 +305,7 @@ export async function processFanoutCommunity(
   db: Database,
   env: Env,
   msg: DeliveryFanoutCommunityMessageV1,
-  message: Message<DeliveryQueueMessageV1>,
+  message: IQueueMessage<DeliveryQueueMessageV1>,
 ): Promise<void> {
   const baseUrl = env.APP_URL;
 
@@ -456,7 +473,7 @@ export async function processResolveActor(
   db: Database,
   env: Env,
   msg: DeliveryResolveActorMessageV1,
-  message: Message<DeliveryQueueMessageV1>,
+  message: IQueueMessage<DeliveryQueueMessageV1>,
 ): Promise<void> {
   if (!requireQueue(env, "resolve_actor", message)) return;
 
@@ -554,7 +571,7 @@ export async function processReconcileJob(
   db: Database,
   env: Env,
   msg: DeliveryReconcileJobMessageV1,
-  message: Message<DeliveryQueueMessageV1>,
+  message: IQueueMessage<DeliveryQueueMessageV1>,
 ): Promise<void> {
   if (!requireQueue(env, "reconcile", message)) return;
 

package/src/backend/lib/delivery/queue-delivery.ts

@@ -3,7 +3,7 @@
  * Includes signing, circuit breaker checks, retry logic, and dead-letter handling.
  */
 
-import type { Message } from "@cloudflare/workers-types";
+import type { IQueueMessage } from "../../runtime/queue.ts";
 import type { Env } from "../../types.ts";
 import type { Database } from "../../../db/index.ts";
 import { and, eq, lt, notInArray, or, sql } from "drizzle-orm";
@@ -186,7 +186,7 @@ async function failJob(
   db: Database,
   jobId: string,
   error: string,
-  message: Message<DeliveryQueueMessageV1>,
+  message: IQueueMessage<DeliveryQueueMessageV1>,
 ): Promise<void> {
   await db
     .update(deliveryQueue)
@@ -286,7 +286,7 @@ export async function processDeliverEndpoint(
   db: Database,
   env: Env,
   msg: DeliveryDeliverEndpointMessageV1,
-  message: Message<DeliveryQueueMessageV1>,
+  message: IQueueMessage<DeliveryQueueMessageV1>,
   bulkhead: Bulkhead,
 ): Promise<void> {
   if (!requireQueue(env, "deliver_endpoint", message)) return;

package/src/backend/lib/delivery/queue.ts

@@ -3,8 +3,12 @@
  * and the batch handler that dispatches to sub-modules.
  */
 
-import type { Message, MessageBatch, Queue } from "@cloudflare/workers-types";
 import type { Env } from "../../types.ts";
+import type {
+  IQueueBatch,
+  IQueueMessage,
+  IQueueProducer,
+} from "../../runtime/queue.ts";
 import type { Database } from "../../../db/index.ts";
 import { and, eq, notInArray, or, sql } from "drizzle-orm";
 import { actorCache, deliveryQueue } from "../../../db/index.ts";
@@ -119,8 +123,8 @@ export function nowIso(): string {
 }
 
 export type QueueEnv = Env & {
-  DELIVERY_QUEUE: Queue<DeliveryQueueMessageV1>;
-  DELIVERY_DLQ: Queue<DeliveryDlqMessageV1>;
+  DELIVERY_QUEUE: IQueueProducer<DeliveryQueueMessageV1>;
+  DELIVERY_DLQ: IQueueProducer<DeliveryDlqMessageV1>;
 };
 
 function queueAvailable(env: Env): env is QueueEnv {
@@ -130,7 +134,7 @@ function queueAvailable(env: Env): env is QueueEnv {
 export function requireQueue(
   env: Env,
   label: string,
-  message: Message<DeliveryQueueMessageV1>,
+  message: IQueueMessage<DeliveryQueueMessageV1>,
 ): env is QueueEnv {
   if (queueAvailable(env)) return true;
   log.warn("Missing DELIVERY_QUEUE/DELIVERY_DLQ bindings; dropping job", {
@@ -426,7 +430,7 @@ export async function enqueueFanoutToCommunity(
 // ---------------------------------------------------------------------------
 
 export async function handleDeliveryQueueBatch(
-  batch: MessageBatch<DeliveryQueueMessageV1>,
+  batch: IQueueBatch<DeliveryQueueMessageV1>,
   env: Env,
 ): Promise<void> {
   const db = env.DB_INSTANCE;
@@ -494,13 +498,13 @@ export async function handleDeliveryQueueBatch(
 
   // Deliver endpoint messages with bulkhead+concurrency.
   const deliveryMessages = batch.messages.filter(
-    (m: Message<DeliveryQueueMessageV1>) =>
+    (m: IQueueMessage<DeliveryQueueMessageV1>) =>
       isDeliveryQueueMessageV1(m.body) && m.body.type === "deliver_endpoint",
-  ) as Array<Message<DeliveryQueueMessageV1>>;
+  ) as Array<IQueueMessage<DeliveryQueueMessageV1>>;
   await runWithConcurrency(
     deliveryMessages,
     BULKHEAD_GLOBAL_CONCURRENCY,
-    async (m: Message<DeliveryQueueMessageV1>) => {
+    async (m: IQueueMessage<DeliveryQueueMessageV1>) => {
       try {
         await processDeliverEndpoint(
           db,
@@ -538,7 +542,7 @@ export async function handleDeliveryQueueBatch(
 }
 
 export async function handleDeliveryDlqBatch(
-  batch: MessageBatch<DeliveryDlqMessageV1>,
+  batch: IQueueBatch<DeliveryDlqMessageV1>,
   env: Env,
 ): Promise<void> {
   for (const message of batch.messages) {

package/src/backend/lib/delivery/types.ts

@@ -5,6 +5,8 @@ export type DeliveryFanoutFollowersMessageV1 = {
   type: "fanout_followers";
   activityId: string;
   followeeApId: string;
+  /** Stable keyset cursor used when a large graph spans queue invocations. */
+  cursor?: string;
   scheduledAt: string; // ISO8601 UTC
 };
 
@@ -24,6 +26,10 @@ export type DeliveryFanoutCommunityMessageV1 = {
   // receive `activityId`. Absent for non-Create activities (edit/delete relay
   // the activity directly).
   announceActivityId?: string;
+  /** Current bounded fan-out phase; absent means start with local members. */
+  stage?: "local_members" | "remote_members" | "remote_followers";
+  /** Stable actor-id keyset cursor within `stage`. */
+  cursor?: string;
   scheduledAt: string; // ISO8601 UTC
 };
 
@@ -106,12 +112,18 @@ export function isDeliveryQueueMessageV1(
       return (
         typeof v.activityId === "string" &&
         typeof v.followeeApId === "string" &&
+        (v.cursor === undefined || typeof v.cursor === "string") &&
         typeof v.scheduledAt === "string"
       );
     case "fanout_community":
       return (
         typeof v.activityId === "string" &&
         typeof v.communityApId === "string" &&
+        (v.stage === undefined ||
+          v.stage === "local_members" ||
+          v.stage === "remote_members" ||
+          v.stage === "remote_followers") &&
+        (v.cursor === undefined || typeof v.cursor === "string") &&
         typeof v.scheduledAt === "string"
       );
     case "resolve_actor":

package/src/backend/lib/notification-push.ts

@@ -1,4 +1,4 @@
-import type { Message } from "@cloudflare/workers-types";
+import type { IQueueMessage } from "../runtime/queue.ts";
 import { and, asc, eq, exists, inArray, lte, ne, sql } from "drizzle-orm";
 
 import {
@@ -501,7 +501,7 @@ export async function purgeExpiredNotificationPushJobs(
 export async function processNotificationPushJob(
   env: Env,
   body: DeliveryNotificationPushMessageV1,
-  message: Message<DeliveryQueueMessageV1>,
+  message: IQueueMessage<DeliveryQueueMessageV1>,
 ): Promise<void> {
   const db = env.DB_INSTANCE;
   let job = await db

package/src/backend/lib/oauth-providers.ts

@@ -61,6 +61,15 @@ export function getOidcClientCredentials(env: Env): {
   };
 }
 
+/**
+ * Audience advertised to native clients and accepted by the host exchange.
+ * A Capsule has one public OIDC client with multiple exact redirect URIs; web
+ * and native clients must therefore converge on this same client id.
+ */
+export function getMobileOidcAudience(env: Env): string {
+  return getOidcClientCredentials(env).clientId;
+}
+
 export function issuerEndpoint(issuer: string, path: string): string {
   return `${issuer.replace(/\/$/, "")}${path}`;
 }