@takosjp/yurucommu-core 3.4.3 → 3.4.4

package/migrations/0023_delivery_resolution_outbox.sql

@@ -0,0 +1,33 @@
+-- Durable first-hop outbox for outbound recipients whose inbox endpoint is not
+-- yet known. Queue publication is not durable evidence: the producer RPC can
+-- fail after the Activity has committed and before delivery_queue has an
+-- endpoint job. Retain the (activity, recipient) intent until resolution has
+-- either produced that endpoint job or reached a bounded terminal state.
+--
+-- No foreign keys: Activity deletion owns explicit projection cleanup, matching
+-- delivery_queue and the rest of the production D1-safe federation ledger.
+CREATE TABLE IF NOT EXISTS delivery_resolutions (
+  id TEXT PRIMARY KEY,
+  activity_ap_id TEXT NOT NULL,
+  recipient_actor_ap_id TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending',
+  processing_token TEXT,
+  attempts INTEGER NOT NULL DEFAULT 0,
+  next_attempt_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  last_error TEXT,
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  resolved_at TEXT
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS delivery_resolutions_activity_actor_idx
+  ON delivery_resolutions(activity_ap_id, recipient_actor_ap_id);
+
+CREATE INDEX IF NOT EXISTS delivery_resolutions_status_next_idx
+  ON delivery_resolutions(status, next_attempt_at);
+
+CREATE INDEX IF NOT EXISTS delivery_resolutions_terminal_retention_idx
+  ON delivery_resolutions(status, updated_at);
+
+CREATE INDEX IF NOT EXISTS delivery_resolutions_activity_idx
+  ON delivery_resolutions(activity_ap_id);

package/migrations/0024_delivery_fanout_outbox.sql

@@ -0,0 +1,35 @@
+-- Durable first-hop outbox for follower/community fanout. The Activity is
+-- committed before the initial Queue RPC, so a producer outage must leave a
+-- recoverable intent instead of silently losing every recipient plan.
+--
+-- Queue messages are wakeups. Retain the intent through publication until the
+-- final fanout page completes; this also lets the Bun self-host rebuild its
+-- in-memory queue after a process restart.
+--
+-- No foreign keys: Activity deletion owns explicit projection cleanup, matching
+-- delivery_queue and delivery_resolutions on production D1.
+CREATE TABLE IF NOT EXISTS delivery_fanouts (
+  id TEXT PRIMARY KEY,
+  activity_ap_id TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  target_ap_id TEXT NOT NULL,
+  announce_activity_ap_id TEXT,
+  status TEXT NOT NULL DEFAULT 'pending',
+  publications INTEGER NOT NULL DEFAULT 0,
+  last_error TEXT,
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  completed_at TEXT
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS delivery_fanouts_intent_idx
+  ON delivery_fanouts(activity_ap_id, kind, target_ap_id, announce_activity_ap_id);
+
+CREATE INDEX IF NOT EXISTS delivery_fanouts_status_created_idx
+  ON delivery_fanouts(status, created_at);
+
+CREATE INDEX IF NOT EXISTS delivery_fanouts_terminal_retention_idx
+  ON delivery_fanouts(status, updated_at);
+
+CREATE INDEX IF NOT EXISTS delivery_fanouts_activity_idx
+  ON delivery_fanouts(activity_ap_id);

package/migrations/0025_delivery_endpoint_terminal_retention.sql

@@ -0,0 +1,6 @@
+-- Endpoint delivery jobs are a durable retry/idempotency ledger, but terminal
+-- rows for Activities that remain in history otherwise grow without bound.
+-- Retention keeps 30 days and deletes only bounded batches; index that scan
+-- without rewriting or resetting protected production data.
+CREATE INDEX IF NOT EXISTS delivery_queue_terminal_retention_idx
+  ON delivery_queue(status, created_at);

package/migrations/0026_remote_actor_fetch_failures.sql

@@ -0,0 +1,29 @@
+-- A missing actor_cache row can still be referenced by a durable remote
+-- Follow edge. Profile recovery must distinguish terminal Gone from transient
+-- network/remote failures without re-fetching the same hostile or unavailable
+-- actor on every local page view. Keep that negative-cache/backoff authority
+-- separate from actor_cache so a failure can never masquerade as an actor.
+--
+-- Additive only: protected existing data and prior migration history remain
+-- untouched. Remote actor IDs intentionally have no actors/actor_cache FK.
+CREATE TABLE IF NOT EXISTS remote_actor_fetch_failures (
+  actor_ap_id TEXT PRIMARY KEY,
+  kind TEXT NOT NULL,
+  reason TEXT NOT NULL,
+  http_status INTEGER,
+  failure_count INTEGER NOT NULL DEFAULT 1,
+  retry_at TEXT,
+  processing_token TEXT,
+  lease_expires_at TEXT,
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+);
+
+CREATE INDEX IF NOT EXISTS remote_actor_fetch_failures_retry_idx
+  ON remote_actor_fetch_failures(retry_at);
+
+CREATE INDEX IF NOT EXISTS remote_actor_fetch_failures_lease_idx
+  ON remote_actor_fetch_failures(lease_expires_at);
+
+CREATE INDEX IF NOT EXISTS remote_actor_fetch_failures_updated_idx
+  ON remote_actor_fetch_failures(updated_at);

package/migrations/0027_remote_actor_tombstones.sql

@@ -0,0 +1,12 @@
+-- A verified inbound Delete(Actor) is durable lifecycle authority, not a
+-- transient actor-document fetch failure. Keep it separate from both
+-- actor_cache and remote_actor_fetch_failures so a late successful fetch
+-- cannot recreate an identity after its teardown committed.
+--
+-- Additive only: protected existing data and prior migration history remain
+-- untouched. Remote actor IDs intentionally have no actors/actor_cache FK.
+CREATE TABLE IF NOT EXISTS remote_actor_tombstones (
+  actor_ap_id TEXT PRIMARY KEY,
+  delete_activity_ap_id TEXT NOT NULL,
+  deleted_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+);

package/migrations/0028_remote_actor_delivery_fence.sql

@@ -0,0 +1,30 @@
+-- A verified remote Actor Delete is durable recipient authority. Keep the
+-- fence at the delivery_resolutions write boundary so every caller, including
+-- a stale fanout page or endpoint-invalidation replay, converges under either
+-- serialization order:
+--   1. resolution INSERT first -> the Actor Delete batch removes it;
+--   2. tombstone first -> this trigger removes the inserted row atomically.
+--
+-- AFTER INSERT + targeted DELETE is deliberate. It applies independently to
+-- every row in a multi-row INSERT without aborting unrelated recipients that
+-- may share the same fanout page.
+CREATE TRIGGER IF NOT EXISTS delivery_resolutions_remote_tombstone_fence
+AFTER INSERT ON delivery_resolutions
+WHEN EXISTS (
+  SELECT 1
+  FROM remote_actor_tombstones
+  WHERE actor_ap_id = NEW.recipient_actor_ap_id
+)
+BEGIN
+  DELETE FROM delivery_resolutions WHERE id = NEW.id;
+END;
+
+-- Converge any row that was written after 0027 established a tombstone but
+-- before this fence was installed. These jobs must not contact a self-deleted
+-- identity; processResolveActor already treats that state as terminal.
+DELETE FROM delivery_resolutions
+WHERE EXISTS (
+  SELECT 1
+  FROM remote_actor_tombstones
+  WHERE actor_ap_id = delivery_resolutions.recipient_actor_ap_id
+);

package/migrations/0029_delivery_endpoint_recipients.sql

@@ -0,0 +1,47 @@
+-- Endpoint jobs aggregate by (Activity, inbox endpoint), especially when
+-- several remote actors share one inbox. Retain the recipient identities that
+-- justified each NEW job so a later verified Actor Delete can remove only that
+-- actor and cancel the endpoint job only when no live recipient remains.
+--
+-- Existing jobs predate this authority and cannot be reconstructed safely.
+-- Keep them explicitly unattributed (0); new materialization sets the flag to
+-- 1 only when it creates the job under the recipient-aware implementation.
+ALTER TABLE delivery_queue
+  ADD COLUMN recipient_attribution_complete INTEGER NOT NULL DEFAULT 0;
+
+CREATE TABLE IF NOT EXISTS delivery_endpoint_recipients (
+  delivery_job_id TEXT NOT NULL,
+  recipient_actor_ap_id TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  PRIMARY KEY (delivery_job_id, recipient_actor_ap_id)
+);
+
+CREATE INDEX IF NOT EXISTS delivery_endpoint_recipients_actor_idx
+  ON delivery_endpoint_recipients(recipient_actor_ap_id, delivery_job_id);
+
+-- Projection cleanup is owned by delivery_queue deletion. Avoid a foreign key:
+-- the engine's production D1 schema uses explicit projection cleanup so remote
+-- identities and migration rebuilds do not diverge between runtimes.
+CREATE TRIGGER IF NOT EXISTS delivery_endpoint_recipients_after_job_delete
+AFTER DELETE ON delivery_queue
+BEGIN
+  DELETE FROM delivery_endpoint_recipients
+  WHERE delivery_job_id = OLD.id;
+END;
+
+-- The attribution write is itself race-fenced. If Delete won before a stale
+-- planner/materializer batch, strip only the deleted actor's mapping; the
+-- materializer's final empty-job cleanup then decides whether the endpoint job
+-- still represents another recipient.
+CREATE TRIGGER IF NOT EXISTS delivery_endpoint_recipients_remote_tombstone_fence
+AFTER INSERT ON delivery_endpoint_recipients
+WHEN EXISTS (
+  SELECT 1
+  FROM remote_actor_tombstones
+  WHERE actor_ap_id = NEW.recipient_actor_ap_id
+)
+BEGIN
+  DELETE FROM delivery_endpoint_recipients
+  WHERE delivery_job_id = NEW.delivery_job_id
+    AND recipient_actor_ap_id = NEW.recipient_actor_ap_id;
+END;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@takosjp/yurucommu-core",
-  "version": "3.4.3",
+  "version": "3.4.4",
   "license": "AGPL-3.0-only",
   "type": "module",
   "workspaces": [
@@ -67,6 +67,7 @@
     "build:api": "cd packages/api && bun run build",
     "check:release-contents": "bun scripts/check-release-contents.mjs",
     "check:packed-consumer": "bun scripts/check-packed-consumer.mjs",
+    "deploy": "bun scripts/deploy.mjs",
     "prepublishOnly": "bun scripts/check-publish-version-discipline.mjs .",
     "pack:core": "npm pack --dry-run",
     "pack:api": "cd packages/api && bun run pack:dry",

package/packages/api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@takosjp/yurucommu-api",
-  "version": "3.4.3",
+  "version": "3.4.4",
   "description": "Typed client SDK and public API contract for yurucommu-server clients.",
   "license": "AGPL-3.0-only",
   "type": "module",

package/packages/api/src/lib/api/communities.ts

@@ -36,6 +36,8 @@ export interface CommunityMember {
   icon_url: string | null;
   role: "owner" | "moderator" | "member";
   joined_at: string;
+  /** False for Follow-backed federated membership, which has no local role row. */
+  can_change_role?: boolean;
 }
 
 export interface CommunityMessage {

package/packages/api/src/lib/api/fetch.ts

@@ -14,9 +14,16 @@ import { getYurucommuApiTransport } from "../transport.ts";
  * Custom error class for API responses that includes the HTTP status code.
  */
 export class ApiError extends Error {
+  public readonly code: string | null;
+  public readonly retryAfterSeconds: number | null;
+
   constructor(
     public readonly status: number,
     message: string,
+    details: {
+      readonly code?: string | null;
+      readonly retryAfterSeconds?: number | null;
+    } = {},
   ) {
     // `message` is the human-facing server error (or a caller fallback); the
     // HTTP status lives on `.status`. Keep `.message` clean — many UI surfaces
@@ -24,40 +31,89 @@ export class ApiError extends Error {
     // reads as technical noise (e.g. "422: Add this account as an alias…").
     super(message);
     this.name = "ApiError";
+    this.code = details.code ?? null;
+    this.retryAfterSeconds = details.retryAfterSeconds ?? null;
   }
 }
 
-/**
- * Read an error message from a failed API response. Attempts to parse JSON
- * with an `error` field; falls back to `statusText`.
- */
-export async function extractErrorMessage(
+interface ApiErrorDetails {
+  readonly message: string;
+  readonly code: string | null;
+  readonly retryAfterSeconds: number | null;
+}
+
+function parseRetryAfterSeconds(
+  bodyValue: unknown,
+  headerValue: string | null,
+): number | null {
+  const bodySeconds =
+    typeof bodyValue === "number" && Number.isFinite(bodyValue) && bodyValue > 0
+      ? Math.ceil(bodyValue)
+      : null;
+  if (bodySeconds !== null) return bodySeconds;
+  if (!headerValue) return null;
+  const numeric = Number(headerValue);
+  if (Number.isFinite(numeric) && numeric > 0) return Math.ceil(numeric);
+  const dateMs = Date.parse(headerValue);
+  if (!Number.isFinite(dateMs) || dateMs <= Date.now()) return null;
+  return Math.ceil((dateMs - Date.now()) / 1000);
+}
+
+async function extractApiErrorDetails(
   res: Response,
   fallback: string,
-): Promise<string> {
+): Promise<ApiErrorDetails> {
   try {
     const data = (await res.json()) as {
       error?: string | { message?: string };
+      code?: unknown;
+      retry_after?: unknown;
     };
-    // The server uses a flat `{ error: "message" }` envelope. Defensively also
-    // unwrap a nested `{ error: { message } }` so a stray non-flat error never
-    // renders as the "[object Object]" stringification.
     const err = data.error;
     const message = typeof err === "string" ? err : err?.message;
-    return message || fallback;
+    const code =
+      typeof data.code === "string" && data.code.trim().length > 0
+        ? data.code.trim().slice(0, 100)
+        : null;
+    return {
+      message: message || fallback,
+      code,
+      retryAfterSeconds: parseRetryAfterSeconds(
+        data.retry_after,
+        res.headers.get("retry-after"),
+      ),
+    };
   } catch {
-    return res.statusText || fallback;
+    return {
+      message: res.statusText || fallback,
+      code: null,
+      retryAfterSeconds: parseRetryAfterSeconds(
+        null,
+        res.headers.get("retry-after"),
+      ),
+    };
   }
 }
 
+/**
+ * Read an error message from a failed API response. Attempts to parse JSON
+ * with an `error` field; falls back to `statusText`.
+ */
+export async function extractErrorMessage(
+  res: Response,
+  fallback: string,
+): Promise<string> {
+  return (await extractApiErrorDetails(res, fallback)).message;
+}
+
 /**
  * Assert that a response is OK. Throws an `ApiError` with the status code
  * and a message extracted from the response body when it is not.
  */
 export async function assertOk(res: Response, fallback: string): Promise<void> {
   if (!res.ok) {
-    const message = await extractErrorMessage(res, fallback);
-    throw new ApiError(res.status, message);
+    const details = await extractApiErrorDetails(res, fallback);
+    throw new ApiError(res.status, details.message, details);
   }
 }
 

package/packages/api/src/lib/api/normalize.ts

@@ -11,35 +11,57 @@ import { resolveNotificationTarget } from "./notification-target.ts";
 type ActorLike = {
   ap_id: string;
   username?: string;
-  preferred_username?: string;
+  preferred_username?: string | null;
+};
+
+type NormalizedActor<T extends ActorLike> = Omit<
+  T,
+  "username" | "preferred_username"
+> & {
+  username: string;
+  preferred_username: string;
 };
 
 function formatUsernameFromApId(
   apId: string,
-  preferred?: string,
+  preferred?: string | null,
 ): string | null {
   try {
     const url = new URL(apId);
-    const match = apId.match(/\/(users|groups)\/([^/]+)$/);
-    if (match) return `${match[2]}@${url.host}`;
     if (preferred) return `${preferred}@${url.host}`;
+    const match = url.pathname.match(/\/(users|groups)\/([^/]+)\/?$/u);
+    if (match) return `${match[2]}@${url.host}`;
   } catch {
     // Ignore malformed URLs and fallback to existing fields.
   }
   return null;
 }
 
-export function normalizeActor<T extends ActorLike>(actor: T): T {
-  if (!actor || !actor.ap_id) return actor;
+export function normalizeActor<T extends ActorLike>(
+  actor: T,
+): NormalizedActor<T> {
   const rawUsername = actor.username?.trim();
+  const declaredPreferred = actor.preferred_username?.trim() || null;
+  const rawSeparator = rawUsername?.lastIndexOf("@") ?? -1;
+  const rebasedRawUsername =
+    declaredPreferred &&
+    rawUsername &&
+    !rawUsername.includes("://") &&
+    rawSeparator > 0 &&
+    rawSeparator < rawUsername.length - 1
+      ? `${declaredPreferred}@${rawUsername.slice(rawSeparator + 1)}`
+      : null;
   const formatted =
-    rawUsername ||
-    formatUsernameFromApId(actor.ap_id, actor.preferred_username) ||
-    actor.preferred_username ||
+    rebasedRawUsername ||
+    (declaredPreferred
+      ? formatUsernameFromApId(actor.ap_id, declaredPreferred)
+      : rawUsername) ||
+    formatUsernameFromApId(actor.ap_id) ||
+    declaredPreferred ||
     actor.username ||
     actor.ap_id;
   const preferred =
-    actor.preferred_username?.trim() ||
+    declaredPreferred ||
     (formatted.includes("@") ? formatted.split("@")[0] : formatted);
 
   return {

package/packages/api/src/lib/api/notifications.ts

@@ -45,7 +45,10 @@ export async function fetchUnreadCount(): Promise<number> {
 }
 
 export async function markNotificationsRead(ids?: string[]): Promise<void> {
-  const res = await apiPost("/api/notifications/read", { ids });
+  const res = await apiPost(
+    "/api/notifications/read",
+    ids === undefined ? { read_all: true } : { ids },
+  );
   await assertOk(res, "Failed to mark as read");
 }