@takosjp/yurucommu-core 3.4.3 → 3.4.4

package/src/backend/routes/posts/routes.ts

@@ -1,15 +1,19 @@
 import { Hono } from "hono";
-import { actors, follows, objects } from "../../../db/index.ts";
+import {
+  actors,
+  follows,
+  objectRecipients,
+  objects,
+  runBatch,
+  type D1Statement,
+} from "../../../db/index.ts";
 import type { Database } from "../../../db/index.ts";
-import { OBJECT_CONTEXT } from "../../lib/ap-context.ts";
 import { and, desc, eq, gt, inArray, sql } from "drizzle-orm";
 import type { Actor, Env, Variables } from "../../types.ts";
 import {
   activityApId,
   formatUsername,
   generateId,
-  isLocal,
-  isSafeRemoteUrl,
   objectApId,
   parseLimit,
   safeJsonParse,
@@ -22,62 +26,51 @@ import {
 } from "./transformers.ts";
 import {
   AUTHOR_WITH,
-  buildAddressing,
-  buildCommunityObjectAddressing,
-  loadCachedAuthorMap,
   loadInteractionFlags,
-  mergeCc,
-  persistActivity,
-  persistAndFanout,
-  persistAndFanoutToCommunity,
+  preparePersistAndFanout,
+  preparePersistAndFanoutToCommunity,
   type PostDetailRow,
   postWhereByIdOrApId,
-  type PostWithAuthor,
   resolveAuthor,
   resolveAuthorWithCache,
   toPostRow,
 } from "./queries.ts";
-import { enqueueDeliveryToActor } from "../../lib/delivery/queue.ts";
-import { deleteObjectCascade, purgeMediaBlobs } from "./delete-cascade.ts";
+import {
+  prepareObjectDeleteCascade,
+  purgeMediaBlobs,
+} from "./delete-cascade.ts";
 import {
   checkCommunityPostPermission,
   deriveContentTags,
-  insertPostAndHandleReply,
-  processMentions,
-  REPLY_TARGET_NOT_FOUND,
+  preparePostInsertStatements,
   validateContentEdit,
   validateCreatePostBody,
   validateEditBody,
   validateSummaryEdit,
 } from "./post-helpers.ts";
-import { requireActor } from "../actors-helpers.ts";
+import { loadActorInfoMap, requireActor } from "../actors-helpers.ts";
 import { communityReadableApIds } from "../../lib/community-visibility.ts";
 import { encodeFeedCursor, feedCursorWhere } from "../../lib/feed-cursor.ts";
 import {
   actorIsBlockedBy,
   canViewerReadObjectFull,
+  passesPostVisibilitySync,
+  type ReadGateObject,
 } from "../../lib/post-visibility.ts";
-import { toApAttachments } from "../../lib/activitypub-helpers.ts";
 import { logger } from "../../lib/logger.ts";
+import { excludeModeratedActors } from "../../lib/feed-exclude.ts";
+import {
+  prepareCreatedPostFederation,
+  prepareDeletedPostFederation,
+} from "./federation.ts";
 
 const log = logger.child({ component: "posts.routes" });
 
-// `.batch` lives only on the concrete D1/libsql subclasses, not the Database
-// union; reach it through a narrow structural cast (matching the other routes).
-type Batchable = { batch: (stmts: unknown[]) => Promise<unknown> };
-
 const posts = new Hono<{ Bindings: Env; Variables: Variables }>();
 
-const PUBLIC_COLLECTION = "https://www.w3.org/ns/activitystreams#Public";
-
 /** Reply row shape needed for the visibility gate (subset of the object row). */
-type ReplyVisibilityRow = {
+type ReplyVisibilityRow = ReadGateObject & {
   apId: string;
-  attributedTo: string;
-  visibility: string;
-  toJson?: string | null;
-  audienceJson?: string | null;
-  communityApId?: string | null;
 };
 
 /**
@@ -120,6 +113,27 @@ async function filterVisibleReplies<T extends ReplyVisibilityRow>(
     acceptedFollowing = new Set(rows.map((r) => r.followingApId));
   }
 
+  const projectedRecipientIds =
+    viewerApId && replies.length > 0
+      ? new Set(
+          (
+            await db
+              .select({ objectApId: objectRecipients.objectApId })
+              .from(objectRecipients)
+              .where(
+                and(
+                  eq(objectRecipients.recipientApId, viewerApId),
+                  eq(objectRecipients.type, "to"),
+                  inArray(
+                    objectRecipients.objectApId,
+                    replies.map((reply) => reply.apId),
+                  ),
+                ),
+              )
+          ).map((row) => row.objectApId),
+        )
+      : new Set<string>();
+
   // Pre-compute the community read-gate for every reply: a community-scoped
   // reply is stored "public" but carries an audience, so the per-visibility
   // checks below would let it through. Resolving membership here (rather than
@@ -136,18 +150,12 @@ async function filterVisibleReplies<T extends ReplyVisibilityRow>(
     // A private-community reply is hidden from anyone who is not an accepted
     // member, regardless of the (stored "public") visibility.
     if (!communityReadable.has(reply.apId)) return false;
-    if (reply.visibility === "followers") {
-      if (!viewerApId) return false;
-      if (reply.attributedTo === viewerApId) return true;
-      return acceptedFollowing.has(reply.attributedTo);
-    }
-    if (reply.visibility === "direct") {
-      if (!viewerApId) return false;
-      if (reply.attributedTo === viewerApId) return true;
-      const recipients = safeJsonParse<string[]>(reply.toJson, []);
-      return recipients.includes(viewerApId);
-    }
-    return true;
+    return passesPostVisibilitySync(
+      reply,
+      viewerApId,
+      (authorApId) => acceptedFollowing.has(authorApId),
+      (objectApId) => projectedRecipientIds.has(objectApId),
+    );
   });
 }
 
@@ -190,9 +198,11 @@ posts.post("/", async (c) => {
   // replyCount, sending them a reply notification, and publishing a public reply
   // whose inReplyTo discloses the restricted parent's existence (and bypassing a
   // block). Mirror the like/repost gates; 404 to avoid leaking existence.
+  let parentAuthor: string | null = null;
   if (body.in_reply_to) {
     const parent = await db
       .select({
+        apId: objects.apId,
         visibility: objects.visibility,
         attributedTo: objects.attributedTo,
         toJson: objects.toJson,
@@ -212,6 +222,7 @@ posts.post("/", async (c) => {
     ) {
       return c.json({ error: "Post not found" }, 404);
     }
+    parentAuthor = parent.attributedTo;
   }
 
   const baseUrl = c.env.APP_URL;
@@ -219,9 +230,25 @@ posts.post("/", async (c) => {
   const apId = objectApId(baseUrl, postId);
   const now = new Date().toISOString();
 
-  let parentAuthor: string | null = null;
+  let preparedFederation: Awaited<
+    ReturnType<typeof prepareCreatedPostFederation>
+  >;
   try {
-    parentAuthor = await insertPostAndHandleReply(db, {
+    preparedFederation = await prepareCreatedPostFederation({
+      db,
+      env: c.env,
+      actorApId: actor.ap_id,
+      objectApId: apId,
+      content,
+      summary: summary || null,
+      attachments: body.attachments,
+      inReplyTo: body.in_reply_to || null,
+      parentAuthor,
+      visibility,
+      community,
+      published: now,
+    });
+    const localStatements = preparePostInsertStatements(db, {
       apId,
       actorApId: actor.ap_id,
       content,
@@ -230,14 +257,16 @@ posts.post("/", async (c) => {
       inReplyTo: body.in_reply_to || null,
       visibility,
       communityId,
-      community,
+      to: preparedFederation.to,
+      cc: preparedFederation.cc,
+      audience: preparedFederation.audience,
+      tags: preparedFederation.tags,
+      parentAuthor,
       baseUrl,
       now,
     });
+    await runBatch(db, [...localStatements, ...preparedFederation.statements]);
   } catch (e) {
-    if (e instanceof Error && e.message === REPLY_TARGET_NOT_FOUND) {
-      return c.json({ error: "Reply target not found" }, 404);
-    }
     log.error("Failed to create post transaction", {
       event: "posts.create.transaction_failed",
       actor: actor.ap_id,
@@ -247,167 +276,14 @@ posts.post("/", async (c) => {
     return c.json({ error: "Failed to create post" }, 500);
   }
 
-  // Process mentions: resolve @mentions (local + remote), build `Mention`
-  // tags, create local notifications, and collect the resolved recipient IRIs.
-  const {
-    failures: mentionFailures,
-    tags: mentionTags,
-    mentionedActorApIds,
-    remoteMentionedActorApIds,
-  } = await processMentions(db, {
-    content,
-    postApId: apId,
-    actorApId: actor.ap_id,
-    parentAuthor,
-    baseUrl,
-    now,
-  });
-
-  // A reply must reach the post it replies to. processMentions only addresses
-  // actors EXPLICITLY @-mentioned in the body, so a reply to a remote post that
-  // doesn't manually @-mention its author was delivered to the replier's own
-  // followers but NEVER to the upstream instance — it never landed in the
-  // original thread (whereas Like/Undo-repost already reach the remote object
-  // author). Auto-address the parent author of a NON-direct reply: add it to cc
-  // and a `Mention` tag (so the reply threads + notifies on the receiving
-  // server) and, when remote, deliver the Create to its inbox. Direct replies
-  // keep mentions-only addressing (no implicit parent disclosure). The local
-  // parent author is already notified by the reply path, so this only augments
-  // addressing/delivery, never a duplicate local notification.
-  const replyRecipients = [...mentionedActorApIds];
-  const replyRemoteRecipients = [...remoteMentionedActorApIds];
-  const replyTags = [...mentionTags];
-  if (
-    body.in_reply_to &&
-    parentAuthor &&
-    parentAuthor !== actor.ap_id &&
-    visibility !== "direct" &&
-    !replyRecipients.includes(parentAuthor)
-  ) {
-    replyRecipients.push(parentAuthor);
-    replyTags.push({
-      type: "Mention",
-      href: parentAuthor,
-      name: `@${formatUsername(parentAuthor)}`,
-    });
-    if (!isLocal(parentAuthor, baseUrl)) {
-      replyRemoteRecipients.push(parentAuthor);
-    }
-  }
-
-  // Federate when the post has follower/public/community reach OR when it has
-  // resolved mentions (a mention is an explicit recipient, so even a "direct"
-  // post must federate the Create to its remote mentioned actors).
-  //
-  // Community-scoped posts have reach == community: address the Create toward
-  // the community Group actor + its followers collection (NOT the author's
-  // personal followers), record the community in `audience`, and fan out to
-  // the community's members/followers. Non-community posts keep the existing
-  // author-follower addressing and fan-out. Mentioned actors are always added
-  // to `cc` so the post is addressed to them on the receiving server.
-  if (visibility !== "direct" || mentionedActorApIds.length > 0) {
-    let to: string[];
-    let cc: string[];
-    let audience: string[] | undefined;
-
-    if (visibility === "direct") {
-      // Direct post with mentions: no follower/public reach, only the
-      // mentioned actors are recipients.
-      to = [];
-      cc = [];
-    } else if (community) {
-      const objectAddressing = buildCommunityObjectAddressing(
-        visibility,
-        community,
-      );
-      to = objectAddressing.to;
-      cc = objectAddressing.cc;
-      audience = objectAddressing.audience;
-    } else {
-      const followersUrl = `${actor.ap_id}/followers`;
-      ({ to, cc } = buildAddressing(visibility, followersUrl));
-    }
-
-    // Add every mentioned actor IRI — plus an auto-addressed reply parent — to
-    // cc (de-duplicated).
-    cc = mergeCc(cc, replyRecipients);
-
-    const tag = replyTags.length > 0 ? replyTags : undefined;
-
-    const createActivity = {
-      "@context": OBJECT_CONTEXT,
-      id: activityApId(baseUrl, generateId()),
-      type: "Create",
-      actor: actor.ap_id,
-      published: now,
-      to,
-      cc,
-      ...(audience ? { audience } : {}),
-      ...(tag ? { tag } : {}),
-      object: {
-        "@context": OBJECT_CONTEXT,
-        id: apId,
-        type: "Note",
-        attributedTo: actor.ap_id,
-        content,
-        summary: summary || null,
-        // A non-empty summary is a content warning; Mastodon-compatible peers
-        // gate rendering on BOTH `summary` (the CW text) and `sensitive`. The
-        // served object doc (routes/activitypub/outbox.ts) already sets this, so
-        // the delivered Create must match or the CW federates inconsistently.
-        ...(summary ? { sensitive: true } : {}),
-        // Media is stored as an app-relative /media path; absolutize for the
-        // federated copy so remote servers can fetch the image.
-        attachment: toApAttachments(body.attachments || [], baseUrl),
-        inReplyTo: body.in_reply_to || null,
-        published: now,
-        to,
-        cc,
-        ...(audience ? { audience } : {}),
-        ...(tag ? { tag } : {}),
-      },
-    };
-
-    if (visibility === "direct") {
-      // No follower/community fanout for a direct post — persist only, then
-      // direct-deliver to the remote mentioned actors below.
-      await persistActivity(db, createActivity, apId);
-    } else if (community) {
-      await persistAndFanoutToCommunity(
-        db,
-        c.env,
-        createActivity,
-        apId,
-        community.apId,
-      );
-    } else {
-      await persistAndFanout(db, c.env, createActivity, apId);
-    }
-
-    // Deliver the Create directly to each remote mentioned actor's inbox — plus
-    // the remote parent author of a reply (auto-addressed above). Community/
-    // follower fanout does not include arbitrary remote actors, so this is the
-    // only path that reaches a remote @user@domain mention or reply target.
-    for (const recipient of replyRemoteRecipients) {
-      try {
-        await enqueueDeliveryToActor(c.env, createActivity.id, recipient);
-      } catch (err) {
-        log.error("Failed to enqueue mention delivery", {
-          event: "posts.mention.delivery_enqueue_failed",
-          activityId: createActivity.id,
-          recipient,
-          error: err,
-        });
-      }
-    }
-  }
+  const { mentionFailures } = await preparedFederation.complete();
 
   const createdPost = {
     ap_id: apId,
     type: "Note",
     author: {
       ap_id: actor.ap_id,
-      username: formatUsername(actor.ap_id),
+      username: formatUsername(actor.ap_id, actor.preferred_username),
       preferred_username: actor.preferred_username,
       name: actor.name,
       icon_url: actor.icon_url,
@@ -451,6 +327,24 @@ posts.get("/:id", async (c) => {
   });
 
   if (!post) return c.json({ error: "Post not found" }, 404);
+  if (currentActor) {
+    // Drizzle's relational query aliases every embedded column reference to the
+    // outer table, so keep the moderation CTE in this ordinary select instead
+    // of injecting it into findFirst({ with: ... }).
+    const moderationReadable = await db
+      .select({ apId: objects.apId })
+      .from(objects)
+      .where(
+        and(
+          eq(objects.apId, post.apId),
+          excludeModeratedActors(currentActor.ap_id),
+        ),
+      )
+      .get();
+    if (!moderationReadable) {
+      return c.json({ error: "Post not found" }, 404);
+    }
+  }
 
   // Resolve author and interaction flags in parallel
   const [author, { likedIds, bookmarkedIds }] = await Promise.all([
@@ -497,7 +391,12 @@ posts.get("/:id/replies", async (c) => {
       endTime: objects.endTime,
     })
     .from(objects)
-    .where(postWhereByIdOrApId(baseUrl, postId)!)
+    .where(
+      and(
+        postWhereByIdOrApId(baseUrl, postId),
+        excludeModeratedActors(currentActor?.ap_id ?? ""),
+      ),
+    )
     .get();
 
   if (!parentPost) return c.json({ error: "Post not found" }, 404);
@@ -524,14 +423,18 @@ posts.get("/:id/replies", async (c) => {
   // last readable one) means unreadable replies are skipped without ever
   // skipping a readable one — so load-more reaches every readable reply, and
   // the gate dropping rows can only make a page short, never lose a reply.
-  const scanned = await db.query.objects.findMany({
-    where: cursorPredicate
-      ? and(eq(objects.inReplyTo, parentPost.apId), cursorPredicate)
-      : eq(objects.inReplyTo, parentPost.apId),
-    with: AUTHOR_WITH,
-    orderBy: [desc(objects.published), desc(objects.apId)],
-    limit: limit + 1,
-  });
+  const scanned = await db
+    .select()
+    .from(objects)
+    .where(
+      and(
+        eq(objects.inReplyTo, parentPost.apId),
+        cursorPredicate,
+        excludeModeratedActors(currentActor?.ap_id ?? ""),
+      ),
+    )
+    .orderBy(desc(objects.published), desc(objects.apId))
+    .limit(limit + 1);
   const hasMore = scanned.length > limit;
   const page = hasMore ? scanned.slice(0, limit) : scanned;
   const lastScanned = page[page.length - 1];
@@ -548,18 +451,18 @@ posts.get("/:id/replies", async (c) => {
 
   // Batch load cached authors and interaction flags in parallel
   const replyApIds = replies.map((r) => r.apId);
-  const [cachedAuthorMap, { likedIds }] = await Promise.all([
-    loadCachedAuthorMap(db, replies as PostWithAuthor[]),
+  const [authorMap, { likedIds }] = await Promise.all([
+    loadActorInfoMap(
+      db,
+      [...new Set(replies.map((reply) => reply.attributedTo))],
+      "author",
+    ),
     loadInteractionFlags(db, currentActor?.ap_id, replyApIds),
   ]);
 
   const result = replies.map((reply) => {
-    const author = resolveAuthor(
-      reply.author,
-      reply.attributedTo,
-      cachedAuthorMap,
-    );
-    const postRow = toPostRow(reply as PostWithAuthor, author, {
+    const author = resolveAuthor(undefined, reply.attributedTo, authorMap);
+    const postRow = toPostRow(reply, author, {
       liked: likedIds.has(reply.apId),
     });
     return formatPost(postRow, currentActor?.ap_id);
@@ -647,8 +550,6 @@ posts.patch("/:id", async (c) => {
     updateData.tagsJson = JSON.stringify(nextTags);
   }
 
-  await db.update(objects).set(updateData).where(eq(objects.apId, post.apId));
-
   // Mirror the stored post's addressing onto the Update so its audience matches
   // the ORIGINAL post (like the Delete path). Without this the Update carried no
   // to/cc/audience and — combined with the community branch below — fanned out
@@ -678,7 +579,10 @@ posts.patch("/:id", async (c) => {
       sensitive: Boolean(nextSummary),
       // Carry the re-derived tags so a receiver updating the Note keeps its
       // Hashtag/Mention tags instead of dropping them on edit.
-      ...(nextTags.length > 0 ? { tag: nextTags } : {}),
+      // Always carry the projection. `[]` is an explicit clear; omission is
+      // reserved for partial third-party Updates that ask receivers to preserve
+      // their existing tag projection.
+      tag: nextTags,
       to: updateTo,
       cc: updateCc,
       ...(updateAudience.length > 0 ? { audience: updateAudience } : {}),
@@ -689,17 +593,28 @@ posts.patch("/:id", async (c) => {
   // A community-scoped post's Update must reach the COMMUNITY (the members who
   // got the Create), NOT the author's personal followers — who never received
   // the Create. Mirror the create path's community-vs-personal fan-out branch.
-  if (post.communityApId) {
-    await persistAndFanoutToCommunity(
-      db,
-      c.env,
-      updateActivity,
-      post.apId,
-      post.communityApId,
-    );
-  } else {
-    await persistAndFanout(db, c.env, updateActivity, post.apId);
-  }
+  const preparedFanout = post.communityApId
+    ? await preparePersistAndFanoutToCommunity(
+        db,
+        c.env,
+        updateActivity,
+        post.apId,
+        post.communityApId,
+      )
+    : await preparePersistAndFanout(db, c.env, updateActivity, post.apId);
+
+  // The edited object and its outbound Update/fanout intent are one mutation.
+  // If the durable intent cannot be stored, the old content/tags stay visible
+  // and the client can safely retry instead of receiving 500 after a local-only
+  // edit already committed.
+  await runBatch(db, [
+    db
+      .update(objects)
+      .set(updateData)
+      .where(eq(objects.apId, post.apId)) as D1Statement,
+    ...preparedFanout.statements,
+  ]);
+  await preparedFanout.publish();
 
   return c.json({
     success: true,
@@ -730,11 +645,15 @@ posts.delete("/:id", async (c) => {
     return c.json({ error: "Forbidden" }, 403);
   }
 
-  // D1 doesn't support interactive transactions; use sequential operations.
-  // FK ON DELETE CASCADE is not reliably enforced (PRAGMA foreign_keys is not
-  // guaranteed on every runtime/connection, and D1 ignores it), so delete the
-  // object's child rows explicitly before the object row to avoid orphans.
-  const mediaKeys = await deleteObjectCascade(db, post.apId, c.env.MEDIA);
+  const [cascade, preparedFederation] = await Promise.all([
+    prepareObjectDeleteCascade(db, post.apId, c.env.MEDIA),
+    prepareDeletedPostFederation({
+      db,
+      env: c.env,
+      actorApId: actor.ap_id,
+      post,
+    }),
+  ]);
 
   // Co-commit the object delete + author postCount-- + parent replyCount in ONE
   // batch (mirrors the federated handleDelete): a crash between separate
@@ -748,16 +667,19 @@ posts.delete("/:id", async (c) => {
     .set({ postCount: sql`${actors.postCount} - 1` })
     .where(
       and(eq(actors.apId, actor.ap_id), gt(actors.postCount, 0), objectExists),
-    );
-  const deleteObject = db.delete(objects).where(eq(objects.apId, post.apId));
+    ) as D1Statement;
+  const deleteObject = db
+    .delete(objects)
+    .where(eq(objects.apId, post.apId)) as D1Statement;
   // DM notes (`visibility="direct"`, created by createDmNote) are NOT counted in
   // postCount on send, so deleting one here must NOT decrement it — otherwise a
   // DM deleted through this generic endpoint (the dedicated DELETE
   // /dm/messages/:id correctly skips the count) under-counts the author's
   // postCount (floored at 0). Keep create/delete symmetric: only regular posts
   // (which incremented) decrement.
-  const ops: unknown[] = [];
+  const ops: D1Statement[] = [...cascade.statements];
   if (post.visibility !== "direct") ops.push(decPostCount);
+  ops.push(...preparedFederation.statements);
   ops.push(deleteObject);
   if (post.inReplyTo) {
     const parentId = post.inReplyTo;
@@ -767,97 +689,15 @@ posts.delete("/:id", async (c) => {
         .set({
           replyCount: sql`(SELECT COUNT(*) FROM ${objects} WHERE ${objects.inReplyTo} = ${parentId})`,
         })
-        .where(eq(objects.apId, parentId)),
+        .where(eq(objects.apId, parentId)) as D1Statement,
     );
   }
-  await (db as unknown as Batchable).batch(ops);
+  await runBatch(db, ops as [D1Statement, ...D1Statement[]]);
 
   // Irreversible R2 purge LAST — only now that the objects row is gone. A
   // failure here degrades to a leaked blob, not a live post with a deleted blob.
-  await purgeMediaBlobs(c.env.MEDIA, mediaKeys);
-
-  // The Delete must reach everyone the original object reached, not just the
-  // author's current followers: mirror the object's stored to/cc, and emit a
-  // Tombstone object (per AP) instead of a bare IRI so receivers can render
-  // the deletion correctly.
-  const originalTo = safeJsonParse<string[]>(post.toJson, []);
-  const originalCc = safeJsonParse<string[]>(post.ccJson, []);
-
-  // For a reply, the parent author's instance must also be told (it counts the
-  // reply); for a direct post, the DM recipients are exactly the addressed
-  // actors. Collect explicit (actor-IRI) recipients for direct per-actor
-  // delivery — anything that is not a Public/collection IRI is treated as an
-  // actor inbox target if it is a safe remote URL.
-  const explicitRecipients = new Set<string>();
-  for (const iri of [...originalTo, ...originalCc]) {
-    if (
-      iri &&
-      iri !== PUBLIC_COLLECTION &&
-      !iri.endsWith("/followers") &&
-      isLocal(iri, baseUrl) === false &&
-      isSafeRemoteUrl(iri)
-    ) {
-      explicitRecipients.add(iri);
-    }
-  }
-
-  // Parent author's instance (replies): ensure the reply deletion propagates
-  // to the thread root's host even if it was not in the object's to/cc.
-  if (post.inReplyTo) {
-    const parent = await db
-      .select({ attributedTo: objects.attributedTo })
-      .from(objects)
-      .where(eq(objects.apId, post.inReplyTo))
-      .get();
-    if (
-      parent?.attributedTo &&
-      !isLocal(parent.attributedTo, baseUrl) &&
-      isSafeRemoteUrl(parent.attributedTo)
-    ) {
-      explicitRecipients.add(parent.attributedTo);
-    }
-  }
-
-  const deleteActivity = {
-    "@context": "https://www.w3.org/ns/activitystreams",
-    id: activityApId(baseUrl, generateId()),
-    type: "Delete",
-    actor: actor.ap_id,
-    to: originalTo,
-    cc: originalCc,
-    object: {
-      id: post.apId,
-      type: "Tombstone",
-    },
-  };
-
-  // Fan out matching the original create reach (community → the community, not
-  // the author's personal followers) and additionally deliver directly to each
-  // explicitly-addressed remote actor.
-  if (post.communityApId) {
-    await persistAndFanoutToCommunity(
-      db,
-      c.env,
-      deleteActivity,
-      post.apId,
-      post.communityApId,
-    );
-  } else {
-    await persistAndFanout(db, c.env, deleteActivity, post.apId);
-  }
-
-  for (const recipient of explicitRecipients) {
-    try {
-      await enqueueDeliveryToActor(c.env, deleteActivity.id, recipient);
-    } catch (err) {
-      log.error("Failed to enqueue delete delivery", {
-        event: "posts.delete.delivery_enqueue_failed",
-        activityId: deleteActivity.id,
-        recipient,
-        error: err,
-      });
-    }
-  }
+  await purgeMediaBlobs(c.env.MEDIA, cascade.mediaKeys);
+  await preparedFederation.complete();
 
   return c.json({ success: true });
 });