@takosjp/yurucommu-core 3.4.3 → 3.4.4

package/src/backend/routes/posts/transformers.ts

@@ -1,15 +1,16 @@
 import { formatUsername, safeJsonParse } from "../../federation-helpers.ts";
+import {
+  boundAttachmentsJson,
+  MAX_ATTACHMENTS,
+  MAX_ATTACHMENTS_JSON_LENGTH,
+} from "../../lib/attachments.ts";
 
 export const MAX_POST_CONTENT_LENGTH = 5000;
 export const MAX_POST_SUMMARY_LENGTH = 500;
 // Attachment bounds live in lib/attachments.ts (shared with the DM and
 // community-chat validators); re-exported here for the existing post-route and
 // inbound-handler importers.
-export {
-  boundAttachmentsJson,
-  MAX_ATTACHMENTS,
-  MAX_ATTACHMENTS_JSON_LENGTH,
-} from "../../lib/attachments.ts";
+export { boundAttachmentsJson, MAX_ATTACHMENTS, MAX_ATTACHMENTS_JSON_LENGTH };
 
 /** Truncate a string to `max` characters (no-op when already within bounds). */
 export function truncate(s: string, max: number): string {
@@ -30,6 +31,60 @@ export function boundInboundSummary(summary: unknown): string | null {
     ? truncate(summary, MAX_POST_SUMMARY_LENGTH)
     : null;
 }
+
+/** Maximum persisted ActivityStreams tag objects on one inbound Note. */
+export const MAX_INBOUND_TAGS = 64;
+export const MAX_INBOUND_TAGS_JSON_LENGTH = 16 * 1024;
+
+function isJsonRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function normalizeBoundedRecordArray(
+  value: unknown,
+  maxItems: number,
+  maxJsonLength: number,
+): string {
+  const candidates =
+    value === undefined || value === null
+      ? []
+      : Array.isArray(value)
+        ? value
+        : [value];
+  const records: Record<string, unknown>[] = [];
+  for (const candidate of candidates) {
+    if (!isJsonRecord(candidate)) continue;
+    records.push(candidate);
+    if (records.length >= maxItems) break;
+  }
+  const json = JSON.stringify(records);
+  return json.length <= maxJsonLength ? json : "[]";
+}
+
+/**
+ * Normalize the AS2 `attachment` cardinality before it reaches the SQL/API
+ * projection. ActivityStreams permits a single object or an array, while the
+ * Yurucommu post contract is always an array. Invalid entries are ignored and
+ * both count and serialized size are bounded at the local post limits.
+ */
+export function boundInboundNoteAttachmentsJson(attachment: unknown): string {
+  return boundAttachmentsJson(
+    normalizeBoundedRecordArray(
+      attachment,
+      MAX_ATTACHMENTS,
+      MAX_ATTACHMENTS_JSON_LENGTH,
+    ),
+  );
+}
+
+/** Persist only a bounded array of object-shaped AS2 tag entries. */
+export function boundInboundTagsJson(tag: unknown): string {
+  return normalizeBoundedRecordArray(
+    tag,
+    MAX_INBOUND_TAGS,
+    MAX_INBOUND_TAGS_JSON_LENGTH,
+  );
+}
 // Capped at 90 (not 100): a page's object ids are re-queried via
 // `inArray(col, objectApIds)` for like/bookmark enrichment, and Cloudflare D1
 // allows at most 100 bound parameters per query. 90 leaves headroom for the
@@ -116,7 +171,7 @@ export function formatPost(
     type: p.type,
     author: {
       ap_id: p.attributed_to,
-      username: formatUsername(p.attributed_to),
+      username: formatUsername(p.attributed_to, p.author_username),
       preferred_username: p.author_username,
       name: p.author_name,
       icon_url: p.author_icon_url,

package/src/backend/routes/recommendations.ts

@@ -2,8 +2,8 @@ import { Hono } from "hono";
 import { sql } from "drizzle-orm";
 import type { Env, Variables } from "../types.ts";
 import { formatUsername } from "../federation-helpers.ts";
+import { operatorActorNotBlockedSql } from "../lib/blocklist.ts";
 import { logger } from "../lib/logger.ts";
-import { CacheTags, CacheTTL, withCache } from "../middleware/cache.ts";
 import { batchLoadActorInfo } from "./communities/membership-shared.ts";
 
 const recommendations = new Hono<{ Bindings: Env; Variables: Variables }>();
@@ -16,23 +16,16 @@ const log = logger.child({ component: "recommendations" });
  * Finds users followed by people the current user follows,
  * ranked by number of mutual connections.
  */
-recommendations.get(
-  "/users",
-  withCache({
-    ttl: CacheTTL.ACTOR_PROFILE,
-    varyByActor: true,
-    cacheTag: CacheTags.ACTOR,
-  }),
-  async (c) => {
-    const actor = c.get("actor");
-    if (!actor) return c.json({ error: "Unauthorized" }, 401);
+recommendations.get("/users", async (c) => {
+  const actor = c.get("actor");
+  if (!actor) return c.json({ error: "Unauthorized" }, 401);
 
-    const db = c.get("db");
-    const myApId = actor.ap_id;
+  const db = c.get("db");
+  const myApId = actor.ap_id;
 
-    try {
-      const candidates = await db.all<{ ap_id: string; mutual_count: number }>(
-        sql`
+  try {
+    const candidates = await db.all<{ ap_id: string; mutual_count: number }>(
+      sql`
         SELECT f2.following_ap_id AS ap_id, COUNT(DISTINCT f2.follower_ap_id) AS mutual_count
         FROM follows f1
         JOIN follows f2 ON f1.following_ap_id = f2.follower_ap_id AND f2.status = 'accepted'
@@ -59,41 +52,41 @@ recommendations.get(
             -- (actorCache) are unaffected, same scope as the other surfaces.
             SELECT ap_id FROM actors WHERE deleted_at IS NOT NULL OR is_private = 1
           )
+          AND ${operatorActorNotBlockedSql(sql.raw("f2.following_ap_id"))}
         GROUP BY f2.following_ap_id
         ORDER BY mutual_count DESC
         LIMIT 5
       `,
-      );
+    );
 
-      if (candidates.length === 0) return c.json({ users: [] });
+    if (candidates.length === 0) return c.json({ users: [] });
 
-      const actorMap = await batchLoadActorInfo(
-        db,
-        candidates.map((r) => r.ap_id),
-      );
+    const actorMap = await batchLoadActorInfo(
+      db,
+      candidates.map((r) => r.ap_id),
+    );
 
-      const users = candidates.map((row) => {
-        const info = actorMap.get(row.ap_id);
-        return {
-          ap_id: row.ap_id,
-          preferred_username: info?.preferredUsername ?? null,
-          name: info?.name ?? null,
-          icon_url: info?.iconUrl ?? null,
-          username: formatUsername(row.ap_id),
-          mutual_count: Number(row.mutual_count),
-        };
-      });
+    const users = candidates.map((row) => {
+      const info = actorMap.get(row.ap_id);
+      return {
+        ap_id: row.ap_id,
+        preferred_username: info?.preferredUsername ?? null,
+        name: info?.name ?? null,
+        icon_url: info?.iconUrl ?? null,
+        username: formatUsername(row.ap_id, info?.preferredUsername),
+        mutual_count: Number(row.mutual_count),
+      };
+    });
 
-      return c.json({ users });
-    } catch (error) {
-      log.warn("Recommendations failed; returning empty suggestions", {
-        event: "recommendations.failed",
-        actorApId: myApId,
-        error,
-      });
-      return c.json({ users: [] });
-    }
-  },
-);
+    return c.json({ users });
+  } catch (error) {
+    log.warn("Recommendations failed; returning empty suggestions", {
+      event: "recommendations.failed",
+      actorApId: myApId,
+      error,
+    });
+    return c.json({ users: [] });
+  }
+});
 
 export default recommendations;

package/src/backend/routes/rtc/index.ts

@@ -2,6 +2,7 @@
  * Call feature routes (WebRTC voice + video).
  *
  *   POST /ap/rtc/signal    server-to-server signaling ingest (HTTP-Signature)
+ *   POST /api/rtc/ticket   mint a one-time short-lived WS ticket
  *   GET  /api/rtc/socket   browser WebSocket upgrade -> per-user signaling hub
  *   GET  /api/rtc/ice      mint short-lived ICE (STUN/TURN) servers
  *   POST /api/rtc/calls    start a call (block-list gate + callId + ICE)
@@ -23,7 +24,7 @@ import {
   isActorMismatch,
   signingActorFromKeyId,
 } from "../activitypub/inbox.ts";
-import { isActorBlocked } from "../../lib/blocklist.ts";
+import { isActorBlockedStrict } from "../../lib/blocklist.ts";
 import {
   getSignalingHub,
   isSignalingAvailable,
@@ -75,20 +76,37 @@ rtc.post("/ap/rtc/signal", async (c) => {
   if (!local) return c.json({ error: "unknown_recipient" }, 404);
 
   // Never ring for a sender the local owner has blocked; drop silently.
-  if (await isActorBlocked(db, envelope.from)) return c.body(null, 204);
+  if (await isActorBlockedStrict(db, envelope.from)) return c.body(null, 204);
 
   await getSignalingHub(c.env).deliver(envelope.to, envelope);
   return c.body(null, 204);
 });
 
-// --- Browser WebSocket upgrade ---------------------------------------------
-rtc.get("/api/rtc/socket", async (c) => {
+// --- Browser WebSocket ticket + upgrade ------------------------------------
+rtc.post("/api/rtc/ticket", async (c) => {
   const actor = c.get("actor");
   if (!actor) return c.json({ error: "unauthorized" }, 401);
   if (!isSignalingAvailable(c.env)) {
     return c.json({ error: "signaling_unavailable" }, 503);
   }
-  return getSignalingHub(c.env).upgrade(c.req.raw, actor.ap_id);
+  const ticket = await getSignalingHub(c.env).mintTicket(actor.ap_id);
+  if (!ticket) return c.json({ error: "ticket_mint_failed" }, 500);
+  return c.json({ ticket, actor_ap_id: actor.ap_id });
+});
+
+rtc.get("/api/rtc/socket", async (c) => {
+  if (!isSignalingAvailable(c.env)) {
+    return c.json({ error: "signaling_unavailable" }, 503);
+  }
+  const hub = getSignalingHub(c.env);
+  const actorParam = c.req.query("actor")?.trim();
+  const ticket = c.req.query("ticket")?.trim();
+  if (actorParam && ticket) {
+    // The actor only selects which per-user DO validates and consumes the
+    // ticket. A forged actor value reaches a DO that never minted it.
+    return hub.upgrade(c.req.raw, actorParam, ticket);
+  }
+  return c.json({ error: "unauthorized" }, 401);
 });
 
 // --- ICE servers ------------------------------------------------------------
@@ -118,7 +136,9 @@ rtc.post("/api/rtc/calls", async (c) => {
   const media = normalizeMedia(payload.media);
 
   // Do not let the local owner place a call to a contact they have blocked.
-  if (await isActorBlocked(db, to)) return c.json({ error: "blocked" }, 403);
+  if (await isActorBlockedStrict(db, to)) {
+    return c.json({ error: "blocked" }, 403);
+  }
 
   const provider = createRtcProvider(c.env);
   const [iceServers, sfuFocus] = await Promise.all([

package/src/backend/routes/search.ts

@@ -19,14 +19,17 @@ import {
   notDeleted,
   objects,
 } from "../../db/index.ts";
-import {
-  parseWebFinger,
-  tryParseRemoteActor,
-} from "../lib/activitypub-validators.ts";
+import { parseWebFinger } from "../lib/activitypub-validators.ts";
+import { cacheRemoteActorDocument } from "../lib/activitypub-actor-cache.ts";
 import { logger } from "../lib/logger.ts";
 import { chunkForInClause } from "../lib/chunk.ts";
+import {
+  filterBlockedActorApIds,
+  isActorBlocked,
+  isDomainBlocked,
+} from "../lib/blocklist.ts";
 import { type ActorInfo, loadActorInfoMap } from "./actors-helpers.ts";
-import { excludeBlockedMutedAuthors } from "../lib/feed-exclude.ts";
+import { excludeModeratedActors } from "../lib/feed-exclude.ts";
 import { withCache } from "../middleware/cache.ts";
 
 const log = logger.child({ component: "search" });
@@ -259,7 +262,7 @@ function formatPost(
     ap_id: post.apId,
     author: {
       ap_id: post.attributedTo,
-      username: formatUsername(post.attributedTo),
+      username: formatUsername(post.attributedTo, author?.preferredUsername),
       preferred_username: author?.preferredUsername ?? null,
       name: author?.name ?? null,
       icon_url: author?.iconUrl ?? null,
@@ -371,6 +374,10 @@ search.get("/actors", async (c) => {
       )
       .limit(ACTOR_SEARCH_SCAN_CAP),
   ]);
+  const blockedCachedApIds = await filterBlockedActorApIds(
+    db,
+    cachedRows.map((actor) => actor.apId),
+  );
 
   // UNION local + cached, with local taking priority on apId collision.
   const seen = new Set(localRows.map((a) => a.apId));
@@ -385,7 +392,7 @@ search.get("/actors", async (c) => {
   }[] = [
     ...localRows,
     ...cachedRows
-      .filter((a) => !seen.has(a.apId))
+      .filter((a) => !seen.has(a.apId) && !blockedCachedApIds.has(a.apId))
       .map((a) => ({
         apId: a.apId,
         preferredUsername: a.preferredUsername,
@@ -430,7 +437,7 @@ search.get("/actors", async (c) => {
     summary: a.summary,
     follower_count: a.followerCount,
     created_at: a.createdAt,
-    username: formatUsername(a.apId),
+    username: formatUsername(a.apId, a.preferredUsername),
   }));
 
   return c.json({ actors: result, limit, offset, has_more });
@@ -466,7 +473,7 @@ search.get("/posts", async (c) => {
         // Suppress blocked/muted authors so keyword search honors the same
         // moderation filter the home/timeline/notifications feeds apply
         // (undefined for an anonymous viewer → and() drops it).
-        excludeBlockedMutedAuthors(db, actor?.ap_id ?? ""),
+        excludeModeratedActors(actor?.ap_id ?? ""),
       ),
     )
     .orderBy(...postOrderByDrizzle(sort))
@@ -498,6 +505,14 @@ search.get("/remote", async (c) => {
   const [, username, domain] = match;
   const safeDomain = normalizeRemoteDomain(domain);
   if (!safeDomain) return c.json({ actors: [] });
+  const db = c.get("db");
+
+  // Remote search is an active federation fetch, not a passive local lookup.
+  // A domain the operator defederated must never be contacted through this
+  // convenience endpoint after ingress and delivery have already been cut.
+  if (await isDomainBlocked(db, safeDomain)) {
+    return c.json({ actors: [] });
+  }
 
   try {
     // WebFinger lookup
@@ -521,6 +536,12 @@ search.get("/remote", async (c) => {
     if (!actorLink?.href || !isSafeRemoteUrl(actorLink.href)) {
       return c.json({ actors: [] });
     }
+    // WebFinger may redirect discovery authority to a different actor host.
+    // Re-check the resolved actor before the signed GET so an allowed alias
+    // cannot bypass an actor or domain block and repopulate the local cache.
+    if (await isActorBlocked(db, actorLink.href)) {
+      return c.json({ actors: [] });
+    }
 
     // Fetch actor profile. Sign the GET as the instance actor so a remote in
     // authorized-fetch / secure mode (which 401s the unsigned actor GET while
@@ -542,55 +563,18 @@ search.get("/remote", async (c) => {
     if (!actorRes.ok) return c.json({ actors: [] });
 
     const actorRaw: unknown = await actorRes.json();
-    const actorData = tryParseRemoteActor(actorRaw);
-    if (!actorData) return c.json({ actors: [] });
-
-    if (actorData.id !== actorLink.href || !isSafeRemoteUrl(actorData.id)) {
-      return c.json({ actors: [] });
-    }
-
-    // Cache the actor (upsert: check if exists, then insert or update)
-    const db = c.get("db");
-    const cacheFields = {
-      type: actorData.type || "Person",
-      preferredUsername: actorData.preferredUsername || null,
-      name: actorData.name || null,
-      summary: actorData.summary || null,
-      iconUrl: actorData.icon?.url || null,
-      inbox: actorData.inbox || "",
-      outbox: actorData.outbox || null,
-      publicKeyId: actorData.publicKey?.id || null,
-      publicKeyPem: actorData.publicKey?.publicKeyPem || null,
-      rawJson: JSON.stringify(actorRaw),
-    };
-
-    const existing = await db
-      .select({ apId: actorCache.apId })
-      .from(actorCache)
-      .where(eq(actorCache.apId, actorData.id))
-      .get();
-
-    if (existing) {
-      await db
-        .update(actorCache)
-        .set(cacheFields)
-        .where(eq(actorCache.apId, actorData.id));
-    } else {
-      await db.insert(actorCache).values({
-        apId: actorData.id,
-        ...cacheFields,
-      });
-    }
+    const cached = await cacheRemoteActorDocument(db, actorLink.href, actorRaw);
+    if (!cached.ok) return c.json({ actors: [] });
 
     return c.json({
       actors: [
         {
-          ap_id: actorData.id,
-          username: `${actorData.preferredUsername}@${safeDomain}`,
-          preferred_username: actorData.preferredUsername,
-          name: actorData.name,
-          summary: actorData.summary,
-          icon_url: actorData.icon?.url,
+          ap_id: cached.row.apId,
+          username: `${cached.row.preferredUsername ?? username}@${safeDomain}`,
+          preferred_username: cached.row.preferredUsername,
+          name: cached.row.name,
+          summary: cached.row.summary,
+          icon_url: cached.row.iconUrl,
         },
       ],
     });
@@ -625,7 +609,7 @@ search.get("/hashtag/:tag", async (c) => {
   const postWhere = publicSearchableWhere(
     sql`instr(lower(${objects.content}), lower(${hashtagPattern})) > 0`,
     // Same block/mute moderation filter as the feeds (see /search/posts).
-    excludeBlockedMutedAuthors(db, actor?.ap_id ?? ""),
+    excludeModeratedActors(actor?.ap_id ?? ""),
   );
 
   // `LIKE '%#tag%'` is a SUPERSET prefilter: it also matches longer tags that

package/src/backend/routes/stories/interactions.ts

@@ -31,6 +31,8 @@ import { actorIsBlockedBy } from "../../lib/post-visibility.ts";
 import { rateLimit, RateLimitConfigs } from "../../middleware/rate-limit.ts";
 import { logger } from "../../lib/logger.ts";
 import { isUniqueConstraintError } from "../../lib/parse-helpers.ts";
+import { excludeModeratedActors } from "../../lib/feed-exclude.ts";
+import { activityDeleteCascadeStatements } from "../../lib/activity-delete-cascade.ts";
 
 const log = logger.child({ component: "stories.interactions" });
 
@@ -354,11 +356,14 @@ stories.delete("/:id/like", async (c) => {
   // time and the re-like dedup guard only checks the `likes` edge (removed here),
   // so without this a like→unlike→like cycle would leave the first inbox/activity
   // rows behind and add new ones — duplicate "X liked your story" + a phantom
-  // unread +1. Mirrors the post-path unlike reap.
+  // unread +1. Remove all activity-keyed push/delivery projections too; mirrors
+  // the post-path unlike reap.
   const reapLikeNotification = like.activityApId
     ? [
-        db.delete(inbox).where(eq(inbox.activityApId, like.activityApId)),
-        db.delete(activities).where(eq(activities.apId, like.activityApId)),
+        ...activityDeleteCascadeStatements(
+          db,
+          eq(activities.apId, like.activityApId),
+        ),
       ]
     : [];
   await (db as unknown as Batchable).batch([
@@ -602,11 +607,17 @@ stories.get("/:id/views", async (c) => {
     return c.json({ error: "Story has expired" }, 410);
   }
 
-  // True total (uncapped) — stays accurate even when the list below is capped.
+  // True eligible total (uncapped) — stays accurate even when the list below is
+  // capped, while retained operator/personal-blocked viewers stay suppressed.
   const totalRow = await db
     .select({ value: count() })
     .from(storyViews)
-    .where(eq(storyViews.storyApId, apId))
+    .where(
+      and(
+        eq(storyViews.storyApId, apId),
+        excludeModeratedActors(actor.ap_id, storyViews.actorApId),
+      ),
+    )
     .get();
   const view_count = totalRow?.value ?? 0;
 
@@ -617,7 +628,12 @@ stories.get("/:id/views", async (c) => {
       viewedAt: storyViews.viewedAt,
     })
     .from(storyViews)
-    .where(eq(storyViews.storyApId, apId))
+    .where(
+      and(
+        eq(storyViews.storyApId, apId),
+        excludeModeratedActors(actor.ap_id, storyViews.actorApId),
+      ),
+    )
     .orderBy(desc(storyViews.viewedAt))
     .limit(STORY_VIEWERS_LIMIT);
 

package/src/backend/routes/stories/query-helpers.ts

@@ -3,10 +3,8 @@ import type { Database } from "../../../db/index.ts";
 import {
   actorCache,
   actors,
-  blocks,
   communityMembers,
   follows,
-  mutes,
   objects,
   storyVotes,
 } from "../../../db/index.ts";
@@ -17,10 +15,14 @@ import {
   safeJsonParse,
 } from "../../federation-helpers.ts";
 import {
-  deleteObjectCascade,
+  deleteObjectsCascade,
   purgeMediaBlobs,
 } from "../posts/delete-cascade.ts";
 import { chunkForInClause } from "../../lib/chunk.ts";
+import {
+  isActorBlockedStrict,
+  operatorActorNotBlockedSql,
+} from "../../lib/blocklist.ts";
 
 // Bound the per-run expired-story reap. The cleanup is opportunistic (fired,
 // unawaited, from the hot story-read path), so a hostile followed host that
@@ -108,6 +110,9 @@ export async function canViewerReadStory(
   viewerApId: string | null | undefined,
 ): Promise<boolean> {
   if (!viewerApId) return false;
+  // Retained rows from a failed/partial purge are unreadable and cannot be
+  // interacted with while their author is instance-operator blocked.
+  if (await isActorBlockedStrict(db, story.attributedTo)) return false;
   if (story.attributedTo === viewerApId) return true;
   if (story.communityApId) {
     const member = await db
@@ -136,32 +141,6 @@ export async function canViewerReadStory(
   return Boolean(follow);
 }
 
-// ---------------------------------------------------------------------------
-// Blocked / muted helpers
-// ---------------------------------------------------------------------------
-
-/** Fetch blocked and muted ap_ids for the given actor. */
-export async function fetchBlockedAndMutedIds(
-  db: Database,
-  actorApId: string,
-): Promise<{ blockedIds: string[]; mutedIds: string[] }> {
-  const [blockRows, muteRows] = await Promise.all([
-    db
-      .select({ blockedApId: blocks.blockedApId })
-      .from(blocks)
-      .where(eq(blocks.blockerApId, actorApId)),
-    db
-      .select({ mutedApId: mutes.mutedApId })
-      .from(mutes)
-      .where(eq(mutes.muterApId, actorApId)),
-  ]);
-
-  return {
-    blockedIds: blockRows.map((b) => b.blockedApId),
-    mutedIds: muteRows.map((m) => m.mutedApId),
-  };
-}
-
 // ---------------------------------------------------------------------------
 // Vote helpers
 // ---------------------------------------------------------------------------
@@ -177,7 +156,12 @@ export async function getVoteCounts(
       count: count(),
     })
     .from(storyVotes)
-    .where(eq(storyVotes.storyApId, storyApId))
+    .where(
+      and(
+        eq(storyVotes.storyApId, storyApId),
+        operatorActorNotBlockedSql(sql`${storyVotes.actorApId}`),
+      ),
+    )
     .groupBy(storyVotes.optionIndex);
 
   return Object.fromEntries(votes.map((v) => [v.optionIndex, v.count]));
@@ -211,7 +195,12 @@ export async function fetchBatchVotes(
       count: count(),
     })
     .from(storyVotes)
-    .where(inArray(storyVotes.storyApId, storyApIds))
+    .where(
+      and(
+        inArray(storyVotes.storyApId, storyApIds),
+        operatorActorNotBlockedSql(sql`${storyVotes.actorApId}`),
+      ),
+    )
     .groupBy(storyVotes.storyApId, storyVotes.optionIndex);
 
   const allVotes: Record<string, VoteResults> = {};
@@ -232,6 +221,7 @@ export async function fetchBatchVotes(
         and(
           inArray(storyVotes.storyApId, storyApIds),
           eq(storyVotes.actorApId, actorApId),
+          operatorActorNotBlockedSql(sql`${storyVotes.actorApId}`),
         ),
       );
     userVotes = Object.fromEntries(
@@ -311,7 +301,7 @@ export function buildAuthor(
 ): StoryAuthor {
   return {
     ap_id: apId,
-    username: formatUsername(apId),
+    username: formatUsername(apId, data?.preferredUsername),
     preferred_username: data?.preferredUsername || null,
     name: data?.name || null,
     icon_url: data?.iconUrl || null,
@@ -338,17 +328,14 @@ export async function cleanupExpiredStories(
 
   const expiredApIds = expiredStories.map((s) => s.apId);
 
-  // Reap every child edge for each expired story through the shared object
+  // Reap every child edge for the expired set through the shared batched object
   // cascade (likes / announces / bookmarks / object_recipients / story_views /
   // story_votes / story_shares + attached media_uploads), so expiry can't
-  // orphan rows the hand-rolled list previously missed (announces, bookmarks,
-  // media). The helper reads each object row, so run it before deleting them.
-  // When a `media` binding is threaded in, the backing R2 blobs are best-effort
-  // purged too so expired-story storage does not leak.
-  const mediaKeys: string[] = [];
-  for (const apId of expiredApIds) {
-    mediaKeys.push(...(await deleteObjectCascade(db, apId, media)));
-  }
+  // orphan rows the hand-rolled list previously missed or make one D1 round
+  // trip per child table per story. The helper reads the object rows, so run it
+  // before deleting them. When a `media` binding is threaded in, the backing R2
+  // blobs are best-effort purged too so expired-story storage does not leak.
+  const mediaKeys = await deleteObjectsCascade(db, expiredApIds, media);
 
   // Delete EXACTLY the cascaded set (chunked for D1's 100-bound-param cap), not a
   // broad `endTime < now` — with the per-run limit a broad delete could remove a