@takosjp/yurucommu-core 3.4.3 → 3.4.4

package/src/db/d1-write.ts

@@ -88,31 +88,35 @@ function requireBatchable(db: Database, context: string): BatchableDb {
   return candidate as BatchableDb;
 }
 
-/**
- * Bound parameters Drizzle emits for one row of `rows`.
- *
- * Drizzle builds ONE column list for the whole `values([...])` call (the union
- * of the keys present across the rows) and binds a parameter per column per
- * row, so the budget must be divided by that union — not by the keys of the
- * first row.
- */
-function paramsPerRow(
+/** Reject row keys that do not belong to the target table. */
+function assertKnownRowKeys(
   table: SQLiteTable,
   rows: readonly Record<string, unknown>[],
-): number {
-  const keys = new Set<string>();
-  for (const row of rows) {
-    for (const key of Object.keys(row)) keys.add(key);
-  }
+): void {
   const known = new Set(Object.keys(getTableColumns(table)));
-  for (const key of keys) {
-    if (!known.has(key)) {
-      throw new D1WriteShapeError(
-        `insertMany: row key "${key}" is not a column of the target table`,
-      );
+  for (const row of rows) {
+    for (const key of Object.keys(row)) {
+      if (!known.has(key)) {
+        throw new D1WriteShapeError(
+          `insertMany: row key "${key}" is not a column of the target table`,
+        );
+      }
     }
   }
-  return keys.size;
+}
+
+/** Count the exact parameters Drizzle compiled into an insert statement. */
+function boundParameterCount(statement: D1Statement): number {
+  const candidate = statement as unknown as {
+    toSQL(): { readonly params: readonly unknown[] };
+  };
+  if (typeof candidate.toSQL !== "function") {
+    throw new D1WriteShapeError(
+      "insertMany: the active insert builder exposes no toSQL(); the D1 " +
+        "parameter budget cannot be proven before execution",
+    );
+  }
+  return candidate.toSQL().params.length;
 }
 
 /**
@@ -132,35 +136,47 @@ export function insertMany<TTable extends SQLiteTable>(
 ): readonly D1Statement[] {
   if (rows.length === 0) return [];
 
-  const perRow = paramsPerRow(
-    table,
-    rows as readonly Record<string, unknown>[],
-  );
-  if (perRow === 0) {
-    throw new D1WriteShapeError("insertMany: rows bind no columns");
-  }
-  if (perRow > D1_SAFE_PARAM_BUDGET) {
-    throw new D1WriteShapeError(
-      `insertMany: a single row binds ${perRow} parameters, over the D1 ` +
-        `budget of ${D1_SAFE_PARAM_BUDGET}; no chunking can make this fit`,
-    );
-  }
+  assertKnownRowKeys(table, rows as readonly Record<string, unknown>[]);
 
-  const chunkSize = Math.floor(D1_SAFE_PARAM_BUDGET / perRow);
-  const statements: D1Statement[] = [];
-  for (let offset = 0; offset < rows.length; offset += chunkSize) {
-    const chunk = rows.slice(offset, offset + chunkSize);
-    // Drizzle's insert builder is generic over the table; the concrete row type
-    // is already checked by the public signature, so the builder-local widening
-    // here is the narrowest cast that keeps the call site typed.
+  const buildStatement = (chunk: readonly TTable["$inferInsert"][]) => {
     const builder = db
       .insert(table)
       .values(chunk as TTable["$inferInsert"][]) as unknown as D1Statement & {
       onConflictDoNothing(): D1Statement;
     };
-    statements.push(
-      opts?.conflict === "ignore" ? builder.onConflictDoNothing() : builder,
-    );
+    return opts?.conflict === "ignore"
+      ? builder.onConflictDoNothing()
+      : builder;
+  };
+
+  const statements: D1Statement[] = [];
+  for (let offset = 0; offset < rows.length;) {
+    // Start at no more than the parameter budget in rows, then compile and
+    // shrink. Inspecting the actual query is essential: Drizzle fills omitted
+    // `$defaultFn`, primitive `.default(...)`, and on-update defaults at compile
+    // time, each of which can add a bound parameter that is absent from the
+    // caller's row keys. The former key-count heuristic under-budgeted those
+    // hidden values and emitted production-invalid 105/120-parameter inserts.
+    let chunkSize = Math.min(D1_SAFE_PARAM_BUDGET, rows.length - offset);
+    let statement: D1Statement;
+    while (true) {
+      statement = buildStatement(rows.slice(offset, offset + chunkSize));
+      const parameters = boundParameterCount(statement);
+      if (parameters <= D1_SAFE_PARAM_BUDGET) break;
+      if (chunkSize === 1) {
+        throw new D1WriteShapeError(
+          `insertMany: a single row compiles to ${parameters} parameters, ` +
+            `over the D1 budget of ${D1_SAFE_PARAM_BUDGET}; no chunking can ` +
+            `make this fit`,
+        );
+      }
+      const scaled = Math.floor(
+        (chunkSize * D1_SAFE_PARAM_BUDGET) / parameters,
+      );
+      chunkSize = Math.max(1, Math.min(chunkSize - 1, scaled));
+    }
+    statements.push(statement);
+    offset += chunkSize;
   }
 
   if (statements.length > D1_MAX_BATCH_STATEMENTS) {
@@ -215,6 +231,14 @@ export async function runBatch(
   db: Database,
   statements: readonly [D1Statement, ...D1Statement[]],
 ): Promise<void> {
+  if (statements.length > D1_MAX_BATCH_STATEMENTS) {
+    throw new D1BatchTooLargeError(
+      `runBatch: ${statements.length} statements exceed the atomic batch cap ` +
+        `of ${D1_MAX_BATCH_STATEMENTS}. Do not split a logical mutation across ` +
+        `batches; make the writes set-based or use the generational-replace ` +
+        `pattern in docs/quality/d1-write.md §3.`,
+    );
+  }
   await requireBatchable(db, "runBatch").batch(statements);
 }
 

package/src/db/schema/federation.ts

@@ -1,4 +1,4 @@
-import { index, sqliteTable, text } from "drizzle-orm/sqlite-core";
+import { index, integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
 import { nowIsoUtc } from "./date-utils.ts";
 
 /**
@@ -17,3 +17,44 @@ export const inboundActivityClaims = sqliteTable(
   },
   (t) => [index("inbound_activity_claims_lease_idx").on(t.leaseExpiresAt)],
 );
+
+/**
+ * Durable negative-cache/backoff state for a remote actor document fetch.
+ *
+ * This is deliberately separate from actor_cache: a failed fetch is not an
+ * actor and must never leak into actor search, signature verification, or
+ * delivery planning as if it were a partially valid cached identity.
+ */
+export const remoteActorFetchFailures = sqliteTable(
+  "remote_actor_fetch_failures",
+  {
+    actorApId: text("actor_ap_id").primaryKey(),
+    kind: text("kind").notNull(),
+    reason: text("reason").notNull(),
+    httpStatus: integer("http_status"),
+    failureCount: integer("failure_count").notNull().default(1),
+    retryAt: text("retry_at"),
+    processingToken: text("processing_token"),
+    leaseExpiresAt: text("lease_expires_at"),
+    createdAt: text("created_at").notNull().$defaultFn(nowIsoUtc),
+    updatedAt: text("updated_at").notNull().$defaultFn(nowIsoUtc),
+  },
+  (t) => [
+    index("remote_actor_fetch_failures_retry_idx").on(t.retryAt),
+    index("remote_actor_fetch_failures_lease_idx").on(t.leaseExpiresAt),
+    index("remote_actor_fetch_failures_updated_idx").on(t.updatedAt),
+  ],
+);
+
+/**
+ * Durable lifecycle authority established by a verified self-Delete(Actor).
+ *
+ * This is deliberately separate from actor_cache and fetch-failure backoff:
+ * cache data is disposable, a remote fetch can recover, but a signed deletion
+ * must fence late/concurrent cache writers and all subsequent inbound traffic.
+ */
+export const remoteActorTombstones = sqliteTable("remote_actor_tombstones", {
+  actorApId: text("actor_ap_id").primaryKey(),
+  deleteActivityApId: text("delete_activity_ap_id").notNull(),
+  deletedAt: text("deleted_at").notNull().$defaultFn(nowIsoUtc),
+});

package/src/db/schema/messaging.ts

@@ -1,6 +1,7 @@
 /**
- * Messaging/DM tables: activities, inbox, deliveryQueue, deliveryCircuit,
- * notificationArchived, dmTyping, dmReadStatus, dmArchivedConversations, mediaUploads
+ * Messaging/DM tables: activities, inbox, deliveryQueue,
+ * deliveryEndpointRecipients, deliveryCircuit, notificationArchived, dmTyping,
+ * dmReadStatus, dmArchivedConversations, mediaUploads
  */
 
 import {
@@ -9,6 +10,7 @@ import {
   primaryKey,
   sqliteTable,
   text,
+  uniqueIndex,
 } from "drizzle-orm/sqlite-core";
 import { nowIso, nowIsoUtc } from "./date-utils.ts";
 
@@ -61,12 +63,118 @@ export const deliveryQueue = sqliteTable(
     nextAttemptAt: text("next_attempt_at").notNull().$defaultFn(nowIso),
     deliveredAt: text("delivered_at"),
     error: text("error"),
+    recipientAttributionComplete: integer("recipient_attribution_complete")
+      .notNull()
+      .default(0),
     createdAt: text("created_at").notNull().$defaultFn(nowIso),
   },
   (t) => [
     index("delivery_queue_activity_idx").on(t.activityApId),
     index("delivery_queue_next_attempt_idx").on(t.nextAttemptAt),
     index("delivery_queue_status_next_idx").on(t.status, t.nextAttemptAt),
+    index("delivery_queue_terminal_retention_idx").on(t.status, t.createdAt),
+  ],
+);
+
+/**
+ * Recipient attribution for endpoint-aggregated jobs created after migration
+ * 0029. Legacy delivery_queue rows deliberately remain unattributed rather
+ * than pretending an incomplete reconstruction is authoritative.
+ */
+export const deliveryEndpointRecipients = sqliteTable(
+  "delivery_endpoint_recipients",
+  {
+    deliveryJobId: text("delivery_job_id").notNull(),
+    recipientActorApId: text("recipient_actor_ap_id").notNull(),
+    createdAt: text("created_at").notNull().$defaultFn(nowIsoUtc),
+  },
+  (t) => [
+    primaryKey({ columns: [t.deliveryJobId, t.recipientActorApId] }),
+    index("delivery_endpoint_recipients_actor_idx").on(
+      t.recipientActorApId,
+      t.deliveryJobId,
+    ),
+  ],
+);
+
+// ---------------------------------------------------------------------------
+// DELIVERY_RESOLUTIONS
+// ---------------------------------------------------------------------------
+
+/**
+ * Durable first-hop outbox for an outbound Activity whose recipient endpoint
+ * is not yet known. Queue messages are only wakeups; this row remains the
+ * retry authority until actor resolution creates a deliveryQueue endpoint job.
+ */
+export const deliveryResolutions = sqliteTable(
+  "delivery_resolutions",
+  {
+    id: text("id").primaryKey(),
+    activityApId: text("activity_ap_id").notNull(),
+    recipientActorApId: text("recipient_actor_ap_id").notNull(),
+    status: text("status").notNull().default("pending"),
+    processingToken: text("processing_token"),
+    attempts: integer("attempts").notNull().default(0),
+    nextAttemptAt: text("next_attempt_at").notNull().$defaultFn(nowIsoUtc),
+    lastError: text("last_error"),
+    createdAt: text("created_at").notNull().$defaultFn(nowIsoUtc),
+    updatedAt: text("updated_at")
+      .notNull()
+      .$defaultFn(nowIsoUtc)
+      .$onUpdateFn(nowIsoUtc),
+    resolvedAt: text("resolved_at"),
+  },
+  (t) => [
+    uniqueIndex("delivery_resolutions_activity_actor_idx").on(
+      t.activityApId,
+      t.recipientActorApId,
+    ),
+    index("delivery_resolutions_status_next_idx").on(t.status, t.nextAttemptAt),
+    index("delivery_resolutions_terminal_retention_idx").on(
+      t.status,
+      t.updatedAt,
+    ),
+    index("delivery_resolutions_activity_idx").on(t.activityApId),
+  ],
+);
+
+// ---------------------------------------------------------------------------
+// DELIVERY_FANOUTS
+// ---------------------------------------------------------------------------
+
+/**
+ * Durable first-hop outbox for follower/community fanout. Queue messages only
+ * wake the planner; the row remains authoritative until the final page has
+ * completed so a failed producer RPC or Bun process restart can replay it.
+ */
+export const deliveryFanouts = sqliteTable(
+  "delivery_fanouts",
+  {
+    id: text("id").primaryKey(),
+    activityApId: text("activity_ap_id").notNull(),
+    kind: text("kind").notNull(),
+    targetApId: text("target_ap_id").notNull(),
+    announceActivityApId: text("announce_activity_ap_id"),
+    status: text("status").notNull().default("pending"),
+    publications: integer("publications").notNull().default(0),
+    lastError: text("last_error"),
+    createdAt: text("created_at").notNull().$defaultFn(nowIsoUtc),
+    updatedAt: text("updated_at")
+      .notNull()
+      .$defaultFn(nowIsoUtc)
+      .$onUpdateFn(nowIsoUtc),
+    completedAt: text("completed_at"),
+  },
+  (t) => [
+    uniqueIndex("delivery_fanouts_intent_idx").on(
+      t.activityApId,
+      t.kind,
+      t.targetApId,
+      t.announceActivityApId,
+    ),
+    index("delivery_fanouts_status_created_idx").on(t.status, t.createdAt),
+    index("delivery_fanouts_terminal_retention_idx").on(t.status, t.updatedAt),
+    index("delivery_fanouts_activity_idx").on(t.activityApId),
   ],
 );
 

package/src/db/schema.ts

@@ -8,7 +8,7 @@
  * - schema/social.ts: follows, blocks, mutes
  * - schema/communities.ts: communities, communityMembers, communityJoinRequests, communityInvites
  * - schema/stories.ts: storyViews, storyVotes, storyShares
- * - schema/messaging.ts: activities, deliveryQueue, deliveryCircuit, inbox, notificationArchived, dm*, dmCommunityReadStatus, mediaUploads
+ * - schema/messaging.ts: activities, deliveryQueue, deliveryEndpointRecipients, deliveryResolutions, deliveryFanouts, deliveryCircuit, inbox, notificationArchived, dm*, dmCommunityReadStatus, mediaUploads
  * - schema/relations.ts: all Drizzle relation definitions
  */