@takosjp/yurucommu-core 3.4.0 → 3.4.3

package/src/backend/lib/strip-image-metadata.ts

@@ -10,9 +10,10 @@
  * re-encoding the pixels, so the visible image is unchanged.
  *
  * Pure byte-surgery (no native image library): it walks the container structure
- * and drops only metadata segments/chunks, copying everything else verbatim. It
- * NEVER corrupts: on any structural surprise it returns the original bytes
- * unchanged (the magic-byte validation has already confirmed the declared type).
+ * and drops only metadata segments/chunks, copying everything else verbatim.
+ * Supported containers fail closed on structural surprises: returning their
+ * original bytes would silently publish the metadata the parser failed to
+ * understand.
  *
  * Covered: JPEG (APP1 EXIF/XMP, APP13 IPTC, COM), PNG (tEXt/zTXt/iTXt/eXIf/tIME),
  * WebP (EXIF / XMP chunks). GIF and video are passed through unchanged (GIF
@@ -24,36 +25,37 @@ export function stripImageMetadata(
   bytes: Uint8Array,
   mimeType: string,
 ): Uint8Array {
-  try {
-    switch (mimeType) {
-      case "image/jpeg":
-        return stripJpeg(bytes);
-      case "image/png":
-        return stripPng(bytes);
-      case "image/webp":
-        return stripWebp(bytes);
-      default:
-        return bytes; // gif / video / unknown: unchanged
-    }
-  } catch {
-    // Never let a parsing surprise corrupt or drop the upload.
-    return bytes;
+  switch (mimeType) {
+    case "image/jpeg":
+      return stripJpeg(bytes);
+    case "image/png":
+      return stripPng(bytes);
+    case "image/webp":
+      return stripWebp(bytes);
+    default:
+      return bytes; // gif / video / unknown: unchanged
   }
 }
 
+function malformed(format: "JPEG" | "PNG" | "WebP"): never {
+  throw new Error(`Malformed ${format} image`);
+}
+
 // ---------------------------------------------------------------------------
 // JPEG: a stream of marker segments. Drop APP1 (EXIF + XMP), APP13 (IPTC /
 // Photoshop) and COM (comment); keep APP0 (JFIF), APP2 (ICC), APP14 (Adobe
 // color transform), the quantization/Huffman tables, and the scan data verbatim.
 // ---------------------------------------------------------------------------
 function stripJpeg(bytes: Uint8Array): Uint8Array {
-  if (bytes.length < 4 || bytes[0] !== 0xff || bytes[1] !== 0xd8) return bytes;
+  if (bytes.length < 4 || bytes[0] !== 0xff || bytes[1] !== 0xd8) {
+    return malformed("JPEG");
+  }
 
   const out: number[] = [0xff, 0xd8]; // SOI
   let i = 2;
 
   while (i + 1 < bytes.length) {
-    if (bytes[i] !== 0xff) return bytes; // not at a marker — bail unchanged
+    if (bytes[i] !== 0xff) return malformed("JPEG");
     const marker = bytes[i + 1];
 
     // Start of Scan: entropy-coded data runs to EOI — copy the rest verbatim.
@@ -72,9 +74,9 @@ function stripJpeg(bytes: Uint8Array): Uint8Array {
       i += 2;
       continue;
     }
-    if (i + 3 >= bytes.length) return bytes; // truncated length — bail unchanged
+    if (i + 3 >= bytes.length) return malformed("JPEG");
     const len = (bytes[i + 2] << 8) | bytes[i + 3]; // includes the 2 length bytes
-    if (len < 2 || i + 2 + len > bytes.length) return bytes; // malformed — bail
+    if (len < 2 || i + 2 + len > bytes.length) return malformed("JPEG");
 
     const drop =
       marker === 0xe1 || // APP1: EXIF + XMP (the GPS carriers)
@@ -85,7 +87,7 @@ function stripJpeg(bytes: Uint8Array): Uint8Array {
     }
     i += 2 + len;
   }
-  return Uint8Array.from(out);
+  return malformed("JPEG");
 }
 
 // ---------------------------------------------------------------------------
@@ -96,8 +98,10 @@ const PNG_SIGNATURE = [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a];
 const PNG_DROP_CHUNKS = new Set(["tEXt", "zTXt", "iTXt", "eXIf", "tIME"]);
 
 function stripPng(bytes: Uint8Array): Uint8Array {
-  if (bytes.length < 8) return bytes;
-  for (let i = 0; i < 8; i++) if (bytes[i] !== PNG_SIGNATURE[i]) return bytes;
+  if (bytes.length < 8) return malformed("PNG");
+  for (let i = 0; i < 8; i++) {
+    if (bytes[i] !== PNG_SIGNATURE[i]) return malformed("PNG");
+  }
 
   const out: number[] = [...PNG_SIGNATURE];
   let i = 8;
@@ -107,7 +111,7 @@ function stripPng(bytes: Uint8Array): Uint8Array {
       (bytes[i + 1] << 16) |
       (bytes[i + 2] << 8) |
       bytes[i + 3];
-    if (len < 0) return bytes; // overflow / malformed — bail unchanged
+    if (len < 0) return malformed("PNG");
     const type = String.fromCharCode(
       bytes[i + 4],
       bytes[i + 5],
@@ -115,7 +119,7 @@ function stripPng(bytes: Uint8Array): Uint8Array {
       bytes[i + 7],
     );
     const chunkEnd = i + 12 + len; // length(4) + type(4) + data(len) + crc(4)
-    if (chunkEnd > bytes.length) return bytes; // truncated — bail unchanged
+    if (chunkEnd > bytes.length) return malformed("PNG");
 
     if (!PNG_DROP_CHUNKS.has(type)) {
       for (let k = i; k < chunkEnd; k++) out.push(bytes[k]);
@@ -123,9 +127,22 @@ function stripPng(bytes: Uint8Array): Uint8Array {
     i = chunkEnd;
     if (type === "IEND") break;
   }
+  if (i !== bytes.length || !containsPngChunk(out, "IEND")) {
+    return malformed("PNG");
+  }
   return Uint8Array.from(out);
 }
 
+function containsPngChunk(bytes: readonly number[], type: string): boolean {
+  const needle = [...type].map((character) => character.charCodeAt(0));
+  for (let i = 8; i + needle.length <= bytes.length; i++) {
+    if (needle.every((value, offset) => bytes[i + offset] === value)) {
+      return true;
+    }
+  }
+  return false;
+}
+
 // ---------------------------------------------------------------------------
 // WebP: a RIFF container ("RIFF" <size> "WEBP" <chunks>). Drop the "EXIF" and
 // "XMP " chunks, clear the matching VP8X feature-flag bits, and rewrite the RIFF
@@ -142,8 +159,10 @@ function fourCC(bytes: Uint8Array, off: number): string {
 }
 
 function stripWebp(bytes: Uint8Array): Uint8Array {
-  if (bytes.length < 16) return bytes;
-  if (fourCC(bytes, 0) !== "RIFF" || fourCC(bytes, 8) !== "WEBP") return bytes;
+  if (bytes.length < 16) return malformed("WebP");
+  if (fourCC(bytes, 0) !== "RIFF" || fourCC(bytes, 8) !== "WEBP") {
+    return malformed("WebP");
+  }
 
   const head: number[] = [];
   for (let k = 0; k < 12; k++) head.push(bytes[k]); // RIFF + size + WEBP
@@ -158,10 +177,10 @@ function stripWebp(bytes: Uint8Array): Uint8Array {
       (bytes[i + 5] << 8) |
       (bytes[i + 6] << 16) |
       (bytes[i + 7] << 24);
-    if (size < 0) return bytes; // overflow — bail unchanged
+    if (size < 0) return malformed("WebP");
     const padded = size + (size & 1); // chunks pad to an even length
     const chunkEnd = i + 8 + padded;
-    if (chunkEnd > bytes.length) return bytes; // truncated — bail unchanged
+    if (chunkEnd > bytes.length) return malformed("WebP");
 
     if (cc === "EXIF" || cc === "XMP ") {
       removed = true; // skip this chunk entirely
@@ -170,6 +189,7 @@ function stripWebp(bytes: Uint8Array): Uint8Array {
     }
     i = chunkEnd;
   }
+  if (i !== bytes.length) return malformed("WebP");
   if (!removed) return bytes; // nothing to strip — keep original bytes
 
   // Clear the EXIF (bit 3) / XMP (bit 2) feature flags in a VP8X header so the

package/src/backend/middleware/bearer-auth.ts

@@ -6,6 +6,8 @@ import {
   issuerEndpoint,
 } from "../lib/oauth-providers.ts";
 
+const INTROSPECTION_TIMEOUT_MS = 5_000;
+
 export function requireBearerAuth(
   requiredScope: string,
 ): MiddlewareHandler<{ Bindings: Env; Variables: Variables }> {
@@ -27,15 +29,28 @@ export function requireBearerAuth(
       );
     }
 
-    const res = await fetch(issuerEndpoint(issuer, "/oauth/introspect"), {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        token,
-        client_id: clientId,
-        client_secret: clientSecret,
-      }).toString(),
-    });
+    let res: Response;
+    try {
+      res = await fetch(issuerEndpoint(issuer, "/oauth/introspect"), {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          token,
+          client_id: clientId,
+          client_secret: clientSecret,
+        }).toString(),
+        signal: AbortSignal.timeout(INTROSPECTION_TIMEOUT_MS),
+      });
+    } catch {
+      c.header("Retry-After", "5");
+      return c.json(
+        {
+          error: "temporarily_unavailable",
+          error_description: "Introspection request failed",
+        },
+        503,
+      );
+    }
     if (!res.ok) {
       return c.json(
         {

package/src/backend/public.ts

@@ -9,10 +9,47 @@ export {
   type YurucommuBackendDiscoveryOptionsV1,
   type YurucommuBackendPluginV1,
 } from "./index.ts";
+export {
+  runYurucommuRetention,
+  YurucommuRetentionError,
+  type YurucommuRetentionResult,
+  type YurucommuRetentionStep,
+} from "./retention.ts";
 export { default } from "./index.ts";
 export { default as app } from "./index.ts";
 export { type Database, getDb, getDbSQLite } from "../db/index.ts";
-export { wrapCloudflareBindings } from "./runtime/cloudflare.ts";
+export {
+  wrapCloudflareBindings,
+  wrapCloudflareMessageBatch,
+  wrapCloudflareQueue,
+} from "./runtime/cloudflare.ts";
+export {
+  ManagedRuntimeGatewayError,
+  createManagedRuntimeKeyValueStore,
+  createManagedRuntimeObjectStorage,
+  createManagedRuntimeQueueProducer,
+  type ManagedRuntimeDataAdapterOptions,
+  type ManagedRuntimeGateway,
+  type ManagedRuntimeQueueProducerOptions,
+} from "./runtime/managed-runtime.ts";
+export {
+  createManagedRelationalDatabase,
+  type ManagedRelationalDatabaseOptions,
+} from "./runtime/managed-relational.ts";
+export type {
+  IKeyValueStore,
+  IObjectStorage,
+  ListObjectsResult,
+  ObjectMetadata,
+  StorageObject,
+} from "./runtime/types.ts";
+export type {
+  IQueueBatch,
+  IQueueMessage,
+  IQueueProducer,
+  QueueBatchItem,
+  QueueSendOptions,
+} from "./runtime/queue.ts";
 // Call feature: the signaling Durable Object class each product's generated
 // worker entry must re-export so Wrangler can bind CALL_SIGNALING to it.
 export { CallSignalingDurableObject } from "./runtime/call-signaling-do.ts";

package/src/backend/retention.ts

@@ -0,0 +1,78 @@
+import type { Env } from "./types.ts";
+import { enqueuePendingNotificationPushJobs } from "./lib/notification-push.ts";
+import { reapDrainedTombstones } from "./routes/actors.ts";
+import { cleanupExpiredStories } from "./routes/stories/query-helpers.ts";
+
+export type YurucommuRetentionStep =
+  "expired_stories" | "drained_tombstones" | "notification_push";
+
+export interface YurucommuRetentionResult {
+  readonly expiredStories: number;
+  readonly reapedTombstones: number;
+  readonly enqueuedNotificationPushJobs: number;
+}
+
+/**
+ * Identifies the exact bounded retention step that failed. Scheduled callers
+ * must reject the invocation instead of treating a partial or skipped sweep as
+ * success; the original database/runtime error remains available as `cause`.
+ */
+export class YurucommuRetentionError extends Error {
+  constructor(
+    readonly step: YurucommuRetentionStep,
+    cause: unknown,
+  ) {
+    super(`yurucommu retention failed at ${step}`, { cause });
+    this.name = "YurucommuRetentionError";
+  }
+}
+
+/**
+ * Run one bounded retention pass against the already-materialized runtime.
+ *
+ * This deliberately reuses the same race-safe cleanup paths as request/queue
+ * handling:
+ * - Story expiry uses the canonical object cascade and purges its media last.
+ * - Tombstones remain until every Delete delivery has drained.
+ * - Notification push performs bounded pusher/job retention, stale-job
+ *   recovery, and enqueues due durable outbox rows when a queue is available.
+ *
+ * Steps are awaited sequentially because D1 is the shared authority. Any
+ * failure rejects with its exact step; callers must retry the cron invocation
+ * rather than silently acknowledging incomplete retention.
+ */
+export async function runYurucommuRetention(
+  env: Env,
+): Promise<YurucommuRetentionResult> {
+  if (!env?.DB_INSTANCE) {
+    throw new TypeError("Yurucommu retention requires DB_INSTANCE");
+  }
+
+  const expiredStories = await retentionStep("expired_stories", () =>
+    cleanupExpiredStories(env.DB_INSTANCE, env.MEDIA),
+  );
+  const reapedTombstones = await retentionStep("drained_tombstones", () =>
+    reapDrainedTombstones(env.DB_INSTANCE),
+  );
+  const enqueuedNotificationPushJobs = await retentionStep(
+    "notification_push",
+    () => enqueuePendingNotificationPushJobs(env),
+  );
+
+  return {
+    expiredStories,
+    reapedTombstones,
+    enqueuedNotificationPushJobs,
+  };
+}
+
+async function retentionStep<T>(
+  step: YurucommuRetentionStep,
+  run: () => Promise<T>,
+): Promise<T> {
+  try {
+    return await run();
+  } catch (cause) {
+    throw new YurucommuRetentionError(step, cause);
+  }
+}

package/src/backend/routes/activitypub/handlers/actor-inbox-handlers.ts

@@ -59,6 +59,7 @@ export async function handleGroupFollow(
   actorApIdStr: string,
   baseUrl: string,
   activityId: string,
+  sourceActivityId: string = activityId,
 ) {
   const db = c.get("db");
   const followerKey = {
@@ -130,7 +131,7 @@ export async function handleGroupFollow(
     where: and(
       eq(activities.type, responseType),
       eq(activities.actorApId, group.apId),
-      eq(activities.objectApId, activityId),
+      eq(activities.objectApId, sourceActivityId),
     ),
   });
   if (existingResponse) {
@@ -144,14 +145,14 @@ export async function handleGroupFollow(
     id: responseId,
     type: responseType,
     actor: group.apId,
-    object: activityId,
+    object: sourceActivityId,
   };
 
   await db.insert(activities).values({
     apId: responseId,
     type: responseType,
     actorApId: group.apId,
-    objectApId: activityId,
+    objectApId: sourceActivityId,
     rawJson: JSON.stringify(responseActivity),
     direction: "outbound",
   });

package/src/backend/routes/activitypub/handlers/inbox-content-handlers.ts

@@ -1,5 +1,15 @@
 import type { Database } from "../../../../db/index.ts";
-import { and, count, eq, gt, inArray, isNotNull, or, sql } from "drizzle-orm";
+import {
+  and,
+  count,
+  eq,
+  gt,
+  inArray,
+  isNotNull,
+  isNull,
+  or,
+  sql,
+} from "drizzle-orm";
 import type { BatchItem } from "drizzle-orm/batch";
 import {
   activities,
@@ -8,6 +18,7 @@ import {
   announces,
   blocks,
   bookmarks,
+  communities,
   follows,
   inbox as inboxTable,
   likes,
@@ -45,6 +56,8 @@ import {
   fetchAndUpsertActorCache,
   getInstanceFetchSignerByDb,
 } from "../../../lib/activitypub-actor-cache.ts";
+import { fetchWithTimeout } from "../../../lib/federation-fetch.ts";
+import { signRequest } from "../../../lib/ap-signing.ts";
 import { enqueueDeliveryToActor } from "../../../lib/delivery/queue.ts";
 import { destinationDeclaresAlias } from "../../../lib/account-migration.ts";
 import { chunkForInClause } from "../../../lib/chunk.ts";
@@ -132,13 +145,13 @@ function isActorTypeUpdate(type: string | string[] | undefined): boolean {
 
 // The ActivityStreams public-collection magic value, including the legacy
 // short forms some implementations still emit.
-const PUBLIC_COLLECTION = new Set([
+export const PUBLIC_COLLECTION = new Set([
   "https://www.w3.org/ns/activitystreams#Public",
   "as:Public",
   "Public",
 ]);
 
-function addressesPublic(addresses: string[]): boolean {
+export function addressesPublic(addresses: string[]): boolean {
   return addresses.some((a) => PUBLIC_COLLECTION.has(a));
 }
 
@@ -146,7 +159,7 @@ function addressesPublic(addresses: string[]): boolean {
 // and NOT to Public is a followers-only post. We match any `/followers`
 // collection by suffix (mirrors isDirectNote), which covers the author's
 // collection without needing to resolve it.
-function addressesFollowers(addresses: string[]): boolean {
+export function addressesFollowers(addresses: string[]): boolean {
   return addresses.some((a) => a.endsWith("/followers"));
 }
 
@@ -194,7 +207,7 @@ function isDirectShapedNote(object: { to?: string[]; cc?: string[] }): boolean {
 // Cap persisted addressing arrays so a remote cannot bloat a row with a huge
 // to/cc list; 64 entries is far beyond any real audience and keeps the explicit-
 // recipient (mention) gate working.
-const MAX_ADDRESS_ENTRIES = 64;
+export const MAX_ADDRESS_ENTRIES = 64;
 function boundAddressJson(addresses: string[] | undefined): string {
   if (!Array.isArray(addresses) || addresses.length === 0) return "[]";
   return JSON.stringify(
@@ -204,6 +217,21 @@ function boundAddressJson(addresses: string[] | undefined): string {
   );
 }
 
+/**
+ * Normalize an AS2 addressing field (`to` / `cc` / `audience`) to a bounded list
+ * of strings. The field may be absent, a bare string, or an array mixing
+ * strings and embedded objects; only the string forms are usable as a
+ * collection id, and the same 64-entry cap applies so a remote cannot force a
+ * huge `IN (...)` lookup.
+ */
+function addressList(value: unknown): string[] {
+  if (typeof value === "string") return [value];
+  if (!Array.isArray(value)) return [];
+  return value
+    .filter((a): a is string => typeof a === "string")
+    .slice(0, MAX_ADDRESS_ENTRIES);
+}
+
 /**
  * Reject an inbound object whose `object.id` is asserted under a host the
  * delivering actor does not control (object-ID squatting / cross-origin
@@ -888,6 +916,35 @@ export async function handleCreateStory(
     storyDataJson = JSON.stringify({ ...attachmentData, overlays: undefined });
   }
 
+  // Carry the community scope across the federation boundary. A story that
+  // arrived through community fanout is addressed to the community's followers
+  // collection, not the author's; storing it with no scope made the local read
+  // gate treat it as a personal story and serve it to every local follower of
+  // the author, member or not. Resolve the addressed collection against the
+  // communities this instance actually knows and only then mark the scope —
+  // an unresolvable audience is left unscoped rather than trusted, and the
+  // membership gate is still evaluated locally against `community_members`.
+  const addressedCollections = [
+    ...addressList((activity as { audience?: unknown }).audience),
+    ...addressList(object.to),
+    ...addressList((object as { audience?: unknown }).audience),
+  ];
+  const community = addressedCollections.length
+    ? await db
+        .select({ apId: communities.apId })
+        .from(communities)
+        .where(
+          and(
+            or(
+              inArray(communities.followersUrl, addressedCollections),
+              inArray(communities.apId, addressedCollections),
+            ),
+            isNull(communities.deletedAt),
+          ),
+        )
+        .get()
+    : undefined;
+
   const inserted = await db
     .insert(objects)
     .values({
@@ -896,6 +953,12 @@ export async function handleCreateStory(
       attributedTo: actor,
       content: "",
       attachmentsJson: storyDataJson,
+      ...(community
+        ? {
+            communityApId: community.apId,
+            audienceJson: JSON.stringify([community.apId]),
+          }
+        : {}),
       endTime,
       published: publishedAt,
       isLocal: 0,
@@ -907,6 +970,142 @@ export async function handleCreateStory(
   if (!inserted) return; // duplicate
 }
 
+// ---------------------------------------------------------------------------
+// Announce target resolution (fetch-and-store a boosted remote Note)
+// ---------------------------------------------------------------------------
+
+// Upper bound on the fetch of a boosted remote object. Mirrors the actor-cache
+// fetch timeout; the body size is already capped by fetchWithTimeout's wrapper.
+const ANNOUNCED_OBJECT_FETCH_TIMEOUT_MS = 15_000;
+
+/**
+ * Resolve an inbound Announce whose target this instance has never seen: fetch
+ * the boosted object from its origin, validate it, and persist it as a remote
+ * Note so the announce edge recorded by handleAnnounce surfaces in feeds
+ * ("reposted by X") instead of dangling on an unknown ap_id.
+ *
+ * Reuses the SSRF-guarded federation fetch discipline end to end:
+ * `fetchWithTimeout` (resolver-pinned DNS validation, no redirects, capped +
+ * time-bounded body) with the GET signed as the instance actor so a
+ * secure-mode remote serves the document (mirrors fetchAndUpsertActorCache).
+ *
+ * Validation mirrors the inbound Create(Note) gates:
+ *   - the document's `id` must equal the fetched URL (no id squatting);
+ *   - `attributedTo` must be same-origin with the object id (a remote author
+ *     may only own objects under its own host — mirrors
+ *     isObjectIdOriginMismatch, and a local-origin object is never fetched);
+ *   - type must include "Note"; direct/DM-shaped addressing is refused;
+ *   - only world-readable classifications (public / unlisted) are persisted —
+ *     a boost must never widen a followers-only/direct object's audience, and
+ *     this instance cannot verify a remote author's follower audience.
+ *
+ * Depth cap: the object's `inReplyTo` is stored verbatim but NEVER resolved —
+ * a single Announce triggers at most one object fetch (plus a best-effort
+ * author-profile cache fill), not a thread walk.
+ *
+ * Best-effort by contract: every failure returns false and the Announce is
+ * dropped exactly as it was before this path existed.
+ */
+export async function fetchAndPersistAnnouncedNote(
+  db: Database,
+  objectId: string,
+  baseUrl: string,
+): Promise<boolean> {
+  // Never fetch a local id (a local object that does not exist is just gone)
+  // and never fetch an unsafe URL (non-http(s), credentials, blocked host…).
+  if (isLocal(objectId, baseUrl) || !isSafeRemoteUrl(objectId)) return false;
+
+  let note: ActivityObject & { attributedTo?: unknown };
+  try {
+    const headers: Record<string, string> = {
+      Accept: "application/activity+json, application/ld+json",
+    };
+    const signer = await getInstanceFetchSignerByDb(db);
+    if (signer) {
+      Object.assign(
+        headers,
+        await signRequest(signer.privateKeyPem, signer.keyId, "GET", objectId),
+      );
+    }
+    const res = await fetchWithTimeout(objectId, {
+      headers,
+      timeout: ANNOUNCED_OBJECT_FETCH_TIMEOUT_MS,
+    });
+    if (!res.ok) return false;
+    const raw: unknown = await res.json();
+    if (!raw || typeof raw !== "object") return false;
+    note = raw as ActivityObject & { attributedTo?: unknown };
+  } catch {
+    // Unresolvable / oversized / timed-out fetch: drop silently (the caller
+    // logs at debug level), matching the pre-existing unknown-object behavior.
+    return false;
+  }
+
+  if (note.id !== objectId) return false;
+  if (!typeIncludes(note.type, "Note")) return false;
+
+  const attributedTo =
+    typeof note.attributedTo === "string" ? note.attributedTo : null;
+  if (!attributedTo || !isSafeRemoteUrl(attributedTo)) return false;
+  try {
+    if (getDomain(attributedTo) !== getDomain(objectId)) return false;
+  } catch {
+    return false;
+  }
+
+  // Addressing gates: a DM-shaped object must never be stored world-readable,
+  // and a non-public classification is refused outright (see doc comment).
+  if (isDirectShapedNote(note)) return false;
+  const visibility = classifyInboundNoteVisibility(note);
+  if (visibility !== "public" && visibility !== "unlisted") return false;
+
+  // Best-effort author profile fill so the surfaced boost renders with the
+  // author's name/icon. Cache-when-absent; a failure never blocks the persist.
+  const cachedAuthor = await db
+    .select({ apId: actorCache.apId })
+    .from(actorCache)
+    .where(eq(actorCache.apId, attributedTo))
+    .get();
+  if (!cachedAuthor) {
+    try {
+      await fetchAndUpsertActorCache(db, attributedTo, {
+        timeout: ANNOUNCED_OBJECT_FETCH_TIMEOUT_MS,
+        mode: "insert",
+        signer: (await getInstanceFetchSignerByDb(db)) ?? undefined,
+      });
+    } catch {
+      /* best-effort */
+    }
+  }
+
+  const attachments = note.attachment ? JSON.stringify(note.attachment) : "[]";
+  await db
+    .insert(objects)
+    .values({
+      apId: objectId,
+      type: "Note",
+      attributedTo,
+      content: boundInboundContent(note.content),
+      summary: boundInboundSummary(note.summary),
+      attachmentsJson: boundAttachmentsJson(attachments),
+      // Stored verbatim, never resolved (depth cap): a boosted reply keeps its
+      // honest thread link even though the parent may stay unknown here.
+      inReplyTo: note.inReplyTo || null,
+      visibility,
+      toJson: boundAddressJson(note.to),
+      ccJson: boundAddressJson(note.cc),
+      communityApId: null,
+      published: normalizeInboundTimestamp(
+        note.published,
+        new Date().toISOString(),
+      ),
+      isLocal: 0,
+    })
+    .onConflictDoNothing();
+
+  return true;
+}
+
 // ---------------------------------------------------------------------------
 // Delete handler
 // ---------------------------------------------------------------------------