@takosjp/yurucommu-core 3.4.0 → 3.4.3

package/src/backend/server.ts

@@ -19,7 +19,6 @@
  *   TAKOS_URL       - Optional Takos API base URL for proxy/tool integration
  */
 
-import type { Message, MessageBatch, Queue } from "@cloudflare/workers-types";
 import { mkdir, readdir, readFile, stat } from "node:fs/promises";
 import process from "node:process";
 import { and, inArray, lt, or } from "drizzle-orm";
@@ -33,6 +32,13 @@ import type {
 import { buildDeliverEndpointMessage } from "./lib/delivery/queue.ts";
 import { deliveryQueue, getDbSQLite } from "../db/index.ts";
 import { logger } from "./lib/logger.ts";
+import type {
+  IQueueBatch,
+  IQueueMessage,
+  IQueueProducer,
+  QueueBatchItem,
+  QueueSendOptions,
+} from "./runtime/queue.ts";
 
 const log = logger.child({ component: "server.bootstrap" });
 
@@ -111,21 +117,12 @@ function isTruthyEnv(value: string | undefined): boolean {
 
 type LocalQueueBody = DeliveryQueueMessageV1 | DeliveryDlqMessageV1;
 
-type LocalQueueSendOptions = {
-  delaySeconds?: number;
-};
-
-type LocalQueueBatchItem<T> = {
-  body: T;
-  delaySeconds?: number;
-};
-
 function createLocalMessageBatch<T extends LocalQueueBody>(
   queueName: string,
   bodies: T[],
   requeue: (body: T, delaySeconds?: number) => void,
-): MessageBatch<T> {
-  const messages = bodies.map((body): Message<T> => {
+): IQueueBatch<T> {
+  const messages = bodies.map((body): IQueueMessage<T> => {
     let settled = false;
     return {
       id: crypto.randomUUID(),
@@ -140,7 +137,7 @@ function createLocalMessageBatch<T extends LocalQueueBody>(
         settled = true;
         requeue(body, options?.delaySeconds);
       },
-    } as Message<T>;
+    };
   });
 
   return {
@@ -152,13 +149,13 @@ function createLocalMessageBatch<T extends LocalQueueBody>(
     retryAll: (options?: { delaySeconds?: number }) => {
       for (const message of messages) message.retry(options);
     },
-  } as unknown as MessageBatch<T>;
+  };
 }
 
 function createLocalQueue<T extends LocalQueueBody>(
   env: LocalServerEnv,
   queueName: string,
-): Queue<T> {
+): IQueueProducer<T> {
   const pending: T[] = [];
   let draining = false;
   let drainScheduled = false;
@@ -206,15 +203,15 @@ function createLocalQueue<T extends LocalQueueBody>(
   }
 
   return {
-    send: async (body: T, options?: LocalQueueSendOptions) => {
+    send: async (body: T, options?: QueueSendOptions) => {
       enqueue(body, options?.delaySeconds);
     },
-    sendBatch: async (messages: Array<LocalQueueBatchItem<T>>) => {
+    sendBatch: async (messages: readonly QueueBatchItem<T>[]) => {
       for (const message of messages) {
         enqueue(message.body, message.delaySeconds);
       }
     },
-  } as unknown as Queue<T>;
+  };
 }
 
 function attachLocalDeliveryQueues(env: LocalServerEnv): void {

package/src/backend/types.ts

@@ -4,6 +4,7 @@ import type {
   IObjectStorage,
   IStaticAssets,
 } from "./runtime/types.ts";
+import type { IQueueProducer } from "./runtime/queue.ts";
 import type {
   DeliveryDlqMessageV1,
   DeliveryQueueMessageV1,
@@ -34,8 +35,14 @@ export interface EnvVars {
   // Pins the OIDC/OAuth subject allowed to take the single owner slot. When set,
   // only a first-login whose subject equals this value becomes `owner`; any other
   // first-login is refused. Prevents an owner-slot race on an OIDC-seeded Capsule.
+  // Accepts either the bare issuer subject or the namespaced `<provider>:<sub>`.
   OIDC_OWNER_SUB?: string;
   TAKOSUMI_ACCOUNTS_OWNER_SUB?: string;
+  // Explicit opt-in to let an UNPINNED first OAuth/OIDC login take the owner
+  // slot. Without a pin and without this flag, owner creation over OAuth is
+  // refused. It exists because a pairwise subject cannot be known before the
+  // first login: enable it, sign in, then pin OIDC_OWNER_SUB and clear it.
+  ALLOW_UNPINNED_OWNER_CLAIM?: string;
   // Comma-separated allowlist of OAuth/OIDC subjects permitted to auto-provision
   // a NON-owner (member) account. Empty/unset = member auto-provisioning is
   // CLOSED (single-user default): once the owner exists, no new external subject
@@ -141,8 +148,8 @@ export type Env = {
   MEDIA?: IObjectStorage;
   KV: IKeyValueStore;
   ASSETS?: IStaticAssets;
-  DELIVERY_QUEUE?: Queue<DeliveryQueueMessageV1>;
-  DELIVERY_DLQ?: Queue<DeliveryDlqMessageV1>;
+  DELIVERY_QUEUE?: IQueueProducer<DeliveryQueueMessageV1>;
+  DELIVERY_DLQ?: IQueueProducer<DeliveryDlqMessageV1>;
   // Signaling hub for the call feature. Passes through wrapCloudflareBindings
   // untouched (it is not one of DB/MEDIA/KV/ASSETS). Optional: when unbound the
   // call routes 503 and the rest of the app serves normally.

package/src/db/d1-write.ts

@@ -0,0 +1,270 @@
+/**
+ * D1-safe write primitives (yurucommu-core owner module).
+ *
+ * Cloudflare D1 rejects any statement that binds more than 100 parameters and
+ * has no interactive transactions (`BEGIN`/`COMMIT` cannot be composed across
+ * its stateless prepared-statement round-trips). Neither limit exists on the
+ * libsql / bun:sqlite engines the test suite runs on (~32k parameters, real
+ * transactions), so an unbounded multi-row INSERT is green in CI and throws
+ * "too many SQL variables" in production.
+ *
+ * The dangerous shape is not the throw itself: it is `DELETE` followed by a
+ * separate `INSERT`. The DELETE has already committed when the INSERT is
+ * rejected, so exceeding the ceiling is DATA LOSS rather than a 500.
+ *
+ * This module makes that shape unrepresentable:
+ *   - {@link insertMany} chunks by the real parameter budget and RETURNS
+ *     statements instead of executing them, so a caller cannot accidentally
+ *     issue a partial write;
+ *   - {@link replaceSet} is the only supported delete-then-insert and emits a
+ *     single `db.batch([...])`, which both drivers commit atomically — the
+ *     DELETE cannot survive a failed INSERT because there is no way to hand it
+ *     to the driver on its own.
+ *
+ * The same export surface exists in the other owner repos (takos, takosumi,
+ * takos-git, road-to-me); a root gate asserts the names and constants match.
+ * See `docs/quality/d1-write.md`.
+ */
+
+import { getTableColumns, sql, type SQL } from "drizzle-orm";
+import type { BatchItem } from "drizzle-orm/batch";
+import type { SQLiteColumn, SQLiteTable } from "drizzle-orm/sqlite-core";
+import type { Database } from "./index.ts";
+
+/**
+ * Bound-parameter budget for a single statement. D1's hard ceiling is 100; the
+ * remaining 10 are headroom for the WHERE / conflict-target parameters that
+ * share the statement with the row values.
+ */
+export const D1_SAFE_PARAM_BUDGET = 90;
+
+/**
+ * Statements per `db.batch([...])`. D1 accepts larger batches but degrades, and
+ * a batch this size already means the caller is writing an unbounded set in one
+ * shot — which is the pattern this module exists to stop.
+ */
+export const D1_MAX_BATCH_STATEMENTS = 50;
+
+/** A driver-executable statement, as accepted by `db.batch([...])`. */
+export type D1Statement = BatchItem<"sqlite">;
+
+/** The row shape or the caller's usage cannot be expressed within D1's limits. */
+export class D1WriteShapeError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "D1WriteShapeError";
+  }
+}
+
+/** The driver in use does not expose the atomic `batch()` surface. */
+export class D1BatchUnsupportedError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "D1BatchUnsupportedError";
+  }
+}
+
+/** The write needs more statements than one batch may carry. */
+export class D1BatchTooLargeError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "D1BatchTooLargeError";
+  }
+}
+
+interface BatchableDb {
+  batch(statements: readonly [D1Statement, ...D1Statement[]]): Promise<unknown>;
+}
+
+function requireBatchable(db: Database, context: string): BatchableDb {
+  const candidate = db as unknown as Partial<BatchableDb>;
+  if (typeof candidate.batch !== "function") {
+    throw new D1BatchUnsupportedError(
+      `${context}: the active driver exposes no batch(); a delete-then-insert ` +
+        `cannot be made atomic without it. Both the D1 and libsql drivers do — ` +
+        `a driver that does not is a test double that must gain one.`,
+    );
+  }
+  return candidate as BatchableDb;
+}
+
+/**
+ * Bound parameters Drizzle emits for one row of `rows`.
+ *
+ * Drizzle builds ONE column list for the whole `values([...])` call (the union
+ * of the keys present across the rows) and binds a parameter per column per
+ * row, so the budget must be divided by that union — not by the keys of the
+ * first row.
+ */
+function paramsPerRow(
+  table: SQLiteTable,
+  rows: readonly Record<string, unknown>[],
+): number {
+  const keys = new Set<string>();
+  for (const row of rows) {
+    for (const key of Object.keys(row)) keys.add(key);
+  }
+  const known = new Set(Object.keys(getTableColumns(table)));
+  for (const key of keys) {
+    if (!known.has(key)) {
+      throw new D1WriteShapeError(
+        `insertMany: row key "${key}" is not a column of the target table`,
+      );
+    }
+  }
+  return keys.size;
+}
+
+/**
+ * Build the INSERT statements for `rows`, chunked so no statement exceeds
+ * {@link D1_SAFE_PARAM_BUDGET} bound parameters.
+ *
+ * Returns statements; it deliberately does NOT execute them. Executing a
+ * multi-statement write is only safe inside one `db.batch([...])`, and making
+ * the caller pass the statements to a batch is what keeps a half-applied write
+ * from being expressible.
+ */
+export function insertMany<TTable extends SQLiteTable>(
+  db: Database,
+  table: TTable,
+  rows: readonly TTable["$inferInsert"][],
+  opts?: { readonly conflict?: "error" | "ignore" },
+): readonly D1Statement[] {
+  if (rows.length === 0) return [];
+
+  const perRow = paramsPerRow(
+    table,
+    rows as readonly Record<string, unknown>[],
+  );
+  if (perRow === 0) {
+    throw new D1WriteShapeError("insertMany: rows bind no columns");
+  }
+  if (perRow > D1_SAFE_PARAM_BUDGET) {
+    throw new D1WriteShapeError(
+      `insertMany: a single row binds ${perRow} parameters, over the D1 ` +
+        `budget of ${D1_SAFE_PARAM_BUDGET}; no chunking can make this fit`,
+    );
+  }
+
+  const chunkSize = Math.floor(D1_SAFE_PARAM_BUDGET / perRow);
+  const statements: D1Statement[] = [];
+  for (let offset = 0; offset < rows.length; offset += chunkSize) {
+    const chunk = rows.slice(offset, offset + chunkSize);
+    // Drizzle's insert builder is generic over the table; the concrete row type
+    // is already checked by the public signature, so the builder-local widening
+    // here is the narrowest cast that keeps the call site typed.
+    const builder = db
+      .insert(table)
+      .values(chunk as TTable["$inferInsert"][]) as unknown as D1Statement & {
+      onConflictDoNothing(): D1Statement;
+    };
+    statements.push(
+      opts?.conflict === "ignore" ? builder.onConflictDoNothing() : builder,
+    );
+  }
+
+  if (statements.length > D1_MAX_BATCH_STATEMENTS) {
+    throw new D1BatchTooLargeError(
+      `insertMany: ${rows.length} rows need ${statements.length} statements, ` +
+        `over the batch cap of ${D1_MAX_BATCH_STATEMENTS}. Do not split the ` +
+        `batch — that reintroduces the partial-write window this module ` +
+        `exists to remove. Page the source set instead, or apply the ` +
+        `generational-replace pattern in docs/quality/d1-write.md §3.`,
+    );
+  }
+  return statements;
+}
+
+/**
+ * Atomically replace the rows matching `where` with `rows`.
+ *
+ * The DELETE and every chunked INSERT go to the driver as ONE batch, so a
+ * rejected INSERT rolls the DELETE back. There is no overload that returns the
+ * DELETE on its own.
+ */
+export async function replaceSet<TTable extends SQLiteTable>(args: {
+  readonly db: Database;
+  readonly table: TTable;
+  readonly where: SQL;
+  readonly rows: readonly TTable["$inferInsert"][];
+  readonly conflict?: "error" | "ignore";
+}): Promise<void> {
+  const { db, table, where, rows, conflict } = args;
+  const batch = requireBatchable(db, "replaceSet");
+  const inserts = insertMany(db, table, rows, { conflict });
+
+  if (inserts.length + 1 > D1_MAX_BATCH_STATEMENTS) {
+    throw new D1BatchTooLargeError(
+      `replaceSet: ${rows.length} rows need ${inserts.length + 1} statements, ` +
+        `over the batch cap of ${D1_MAX_BATCH_STATEMENTS}. See ` +
+        `docs/quality/d1-write.md §3.`,
+    );
+  }
+
+  const del = db.delete(table).where(where) as unknown as D1Statement;
+  await batch.batch([del, ...inserts] as [D1Statement, ...D1Statement[]]);
+}
+
+/**
+ * Execute `statements` as ONE atomic batch. Both the D1 and libsql drivers
+ * commit a batch all-or-nothing; this is the only atomicity primitive D1 has,
+ * since `BEGIN`/`COMMIT` cannot be composed across its stateless
+ * prepared-statement round-trips.
+ */
+export async function runBatch(
+  db: Database,
+  statements: readonly [D1Statement, ...D1Statement[]],
+): Promise<void> {
+  await requireBatchable(db, "runBatch").batch(statements);
+}
+
+/**
+ * Run `run` once per chunk of at most {@link D1_SAFE_PARAM_BUDGET} ids and
+ * concatenate the results. Use for an `inArray(col, ids)` whose ids only exist
+ * as an in-memory array; prefer {@link notInSubquery} / a `db.select()`
+ * subquery when the ids are themselves a query result (zero bound parameters).
+ */
+export async function inChunks<T, R>(
+  ids: readonly T[],
+  run: (chunk: readonly T[]) => Promise<R[]>,
+): Promise<R[]> {
+  if (ids.length === 0) return [];
+  if (ids.length <= D1_SAFE_PARAM_BUDGET) return await run(ids);
+  const out: R[] = [];
+  for (let i = 0; i < ids.length; i += D1_SAFE_PARAM_BUDGET) {
+    out.push(...(await run(ids.slice(i, i + D1_SAFE_PARAM_BUDGET))));
+  }
+  return out;
+}
+
+/**
+ * `col NOT IN (<subquery>)` with zero per-element bound parameters.
+ *
+ * There is deliberately no `notInChunks`: NOT IN does not decompose over
+ * chunks (the per-chunk results must be INTERSECTED, not concatenated), and
+ * every attempt to write one has been wrong. Express the excluded set as a
+ * subquery instead.
+ */
+export function notInSubquery(col: SQLiteColumn, subquery: SQL | unknown): SQL {
+  return sql`${col} NOT IN ${subquery}`;
+}
+
+/**
+ * Escape hatch for a statement whose parameter count is bounded by something
+ * the type system cannot see (a fixed-arity literal list, a `LIMIT`ed page).
+ *
+ * `reason.boundedBy` must name the concrete bound, and this call is what a
+ * reviewer greps for. It performs no work at runtime; its whole value is that
+ * an unchunked statement cannot be written without saying why.
+ */
+export function unsafeUnchunkedStatement(
+  stmt: D1Statement,
+  reason: { readonly why: string; readonly boundedBy: string },
+): D1Statement {
+  if (!reason.why.trim() || !reason.boundedBy.trim()) {
+    throw new D1WriteShapeError(
+      "unsafeUnchunkedStatement: both `why` and `boundedBy` must be stated",
+    );
+  }
+  return stmt;
+}

package/src/db/index.ts

@@ -96,3 +96,20 @@ export function notDeleted(
 
 export { nowIso } from "./schema.ts";
 export * from "./schema.ts";
+
+// D1-safe write primitives. Re-exported here so a writer reaching for the DB
+// module finds the chunking/batch surface without knowing the file name.
+export {
+  D1_MAX_BATCH_STATEMENTS,
+  D1_SAFE_PARAM_BUDGET,
+  D1BatchTooLargeError,
+  D1BatchUnsupportedError,
+  D1WriteShapeError,
+  inChunks,
+  insertMany,
+  notInSubquery,
+  replaceSet,
+  runBatch,
+  unsafeUnchunkedStatement,
+  type D1Statement,
+} from "./d1-write.ts";

package/src/db/schema/federation.ts

@@ -0,0 +1,19 @@
+import { index, sqliteTable, text } from "drizzle-orm/sqlite-core";
+import { nowIsoUtc } from "./date-utils.ts";
+
+/**
+ * Short-lived fencing leases for inbound ActivityPub dispatch.
+ *
+ * The durable activity remains in `activities`; this table only identifies the
+ * Worker currently allowed to apply and commit its effects.
+ */
+export const inboundActivityClaims = sqliteTable(
+  "inbound_activity_claims",
+  {
+    activityApId: text("activity_ap_id").primaryKey(),
+    processingToken: text("processing_token"),
+    leaseExpiresAt: text("lease_expires_at"),
+    updatedAt: text("updated_at").notNull().$defaultFn(nowIsoUtc),
+  },
+  (t) => [index("inbound_activity_claims_lease_idx").on(t.leaseExpiresAt)],
+);

package/src/db/schema/index.ts

@@ -16,4 +16,5 @@ export * from "./notes.ts";
 export * from "./messaging.ts";
 export * from "./mobile.ts";
 export * from "./calls.ts";
+export * from "./federation.ts";
 export * from "./relations.ts";