@takosjp/yurucommu-core 3.4.3 → 3.4.5

package/src/backend/runtime/call-signaling-do.ts

@@ -26,6 +26,7 @@ import {
   isTerminalCallState,
   parseRtcSignalEnvelope,
 } from "../../../packages/api/src/types/call.ts";
+import { consumeOneTimeTicket, mintOneTimeTicket } from "./one-time-ticket.ts";
 
 // --- Minimal Cloudflare DO + Hibernatable WebSocket surface ----------------
 interface DoWebSocket {
@@ -57,6 +58,7 @@ type CallDoEnv = EnvVars & {
 const ALARM_INTERVAL_MS = 15_000;
 const ACTOR_KEY = "actor";
 const CALL_PREFIX = "call:";
+const TICKET_PREFIX = "ticket:";
 
 export class CallSignalingDurableObject {
   private hub: CallHub | null = null;
@@ -73,20 +75,36 @@ export class CallSignalingDurableObject {
   async fetch(request: Request): Promise<Response> {
     const url = new URL(request.url);
     if (url.pathname === "/_ws") {
-      return this.handleUpgrade(request, url);
+      return this.handleUpgrade(request);
     }
     if (url.pathname === "/_ingest") {
       return this.handleIngest(request);
     }
+    if (url.pathname === "/_ticket") {
+      return this.handleMintTicket(request);
+    }
     return new Response("not found", { status: 404 });
   }
 
-  private async handleUpgrade(request: Request, url: URL): Promise<Response> {
+  private async handleUpgrade(request: Request): Promise<Response> {
     if (request.headers.get("Upgrade")?.toLowerCase() !== "websocket") {
       return new Response("expected websocket", { status: 426 });
     }
-    const actor =
-      request.headers.get("X-Call-Actor") ?? url.searchParams.get("actor");
+    const authMode = request.headers.get("X-Call-Auth");
+    if (authMode !== "ticket") {
+      return new Response("unauthorized", { status: 401 });
+    }
+    const ticket = request.headers.get("X-Call-Ticket") ?? "";
+    if (
+      !ticket ||
+      !(await consumeOneTimeTicket(this.state.storage, ticket, {
+        prefix: TICKET_PREFIX,
+      }))
+    ) {
+      return new Response("invalid ticket", { status: 401 });
+    }
+
+    const actor = request.headers.get("X-Call-Actor");
     if (!actor) return new Response("missing actor", { status: 400 });
     await this.setActor(actor);
 
@@ -102,6 +120,19 @@ export class CallSignalingDurableObject {
     } as unknown as ResponseInit);
   }
 
+  private async handleMintTicket(request: Request): Promise<Response> {
+    if (request.method !== "POST") {
+      return new Response("method not allowed", { status: 405 });
+    }
+    const actor = request.headers.get("X-Call-Actor");
+    if (!actor) return new Response("missing actor", { status: 400 });
+    await this.setActor(actor);
+    const ticket = await mintOneTimeTicket(this.state.storage, {
+      prefix: TICKET_PREFIX,
+    });
+    return Response.json({ ticket });
+  }
+
   private async handleIngest(request: Request): Promise<Response> {
     let body: unknown;
     try {

package/src/backend/runtime/cloudflare.ts

@@ -38,7 +38,7 @@ class CloudflareStorage implements IObjectStorage {
 
   async put(
     key: string,
-    value: ReadableStream | ArrayBuffer | string,
+    value: Blob | ReadableStream | ArrayBuffer | string,
     options?: {
       httpMetadata?: ObjectMetadata["httpMetadata"];
       customMetadata?: Record<string, string>;

package/src/backend/runtime/managed-runtime.ts

@@ -334,7 +334,7 @@ class ManagedRuntimeObjectStorage implements IObjectStorage {
 
   async put(
     key: string,
-    value: ReadableStream | ArrayBuffer | string,
+    value: Blob | ReadableStream | ArrayBuffer | string,
     options?: {
       httpMetadata?: ObjectMetadata["httpMetadata"];
       customMetadata?: Record<string, string>;

package/src/backend/runtime/one-time-ticket.ts

@@ -0,0 +1,116 @@
+/**
+ * Small Durable-Object ticket primitive shared by realtime and call sockets.
+ *
+ * Browser WebSocket constructors cannot attach an Authorization header. The
+ * authenticated fetch path therefore mints an opaque, short-lived ticket in
+ * the exact per-user DO that will accept the upgrade. Only its SHA-256 hash is
+ * stored, and a consume attempt deletes it before returning a verdict.
+ */
+
+export interface OneTimeTicketStorage {
+  get<T = unknown>(key: string): Promise<T | undefined>;
+  put(key: string, value: unknown): Promise<void>;
+  delete(key: string): Promise<boolean>;
+  list<T = unknown>(options?: { prefix?: string }): Promise<Map<string, T>>;
+}
+
+export interface OneTimeTicketOptions {
+  prefix: string;
+  ttlMs?: number;
+  maxOutstanding?: number;
+  now?: () => number;
+}
+
+interface StoredTicket {
+  hash: string;
+  expiresAt: number;
+}
+
+const DEFAULT_TTL_MS = 60_000;
+const DEFAULT_MAX_OUTSTANDING = 8;
+
+async function sha256Hex(value: string): Promise<string> {
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(value),
+  );
+  return [...new Uint8Array(digest)]
+    .map((byte) => byte.toString(16).padStart(2, "0"))
+    .join("");
+}
+
+/** Compare strings through fixed-width digests using the Workers primitive. */
+async function timingSafeEqualStrings(a: string, b: string): Promise<boolean> {
+  const encoder = new TextEncoder();
+  const [aDigest, bDigest] = await Promise.all([
+    crypto.subtle.digest("SHA-256", encoder.encode(a)),
+    crypto.subtle.digest("SHA-256", encoder.encode(b)),
+  ]);
+  const subtle = crypto.subtle as SubtleCrypto & {
+    timingSafeEqual?: (left: BufferSource, right: BufferSource) => boolean;
+  };
+  if (typeof subtle.timingSafeEqual === "function") {
+    return subtle.timingSafeEqual(aDigest, bDigest);
+  }
+
+  // Bun/self-host portability fallback. Both values are SHA-256 digests, so
+  // their length is fixed and the loop never short-circuits on content.
+  const left = new Uint8Array(aDigest);
+  const right = new Uint8Array(bDigest);
+  let diff = 0;
+  for (let index = 0; index < left.length; index++) {
+    diff |= left[index]! ^ right[index]!;
+  }
+  return diff === 0;
+}
+
+export async function mintOneTimeTicket(
+  storage: OneTimeTicketStorage,
+  options: OneTimeTicketOptions,
+): Promise<string> {
+  const ticket =
+    crypto.randomUUID().replaceAll("-", "") +
+    crypto.randomUUID().replaceAll("-", "");
+  const hash = await sha256Hex(ticket);
+  const now = (options.now ?? Date.now)();
+  const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+  const maxOutstanding = options.maxOutstanding ?? DEFAULT_MAX_OUTSTANDING;
+
+  const stored = await storage.list<StoredTicket>({ prefix: options.prefix });
+  const live = [...stored.entries()]
+    .filter(([, value]) => value.expiresAt > now)
+    .sort((a, b) => a[1].expiresAt - b[1].expiresAt);
+
+  const liveKeys = new Set(live.map(([key]) => key));
+  for (const [key] of stored) {
+    if (!liveKeys.has(key)) await storage.delete(key);
+  }
+  while (live.length >= maxOutstanding) {
+    const [oldestKey] = live.shift()!;
+    await storage.delete(oldestKey);
+  }
+
+  await storage.put(`${options.prefix}${hash}`, {
+    hash,
+    expiresAt: now + ttlMs,
+  } satisfies StoredTicket);
+  return ticket;
+}
+
+export async function consumeOneTimeTicket(
+  storage: OneTimeTicketStorage,
+  ticket: string,
+  options: OneTimeTicketOptions,
+): Promise<boolean> {
+  const hash = await sha256Hex(ticket);
+  const key = `${options.prefix}${hash}`;
+  const stored = await storage.get<StoredTicket>(key);
+  if (!stored) return false;
+
+  // Delete before validating so expired or malformed replay attempts also
+  // consume the only matching record.
+  await storage.delete(key);
+  const now = (options.now ?? Date.now)();
+  if (stored.expiresAt <= now) return false;
+  return timingSafeEqualStrings(stored.hash, hash);
+}

package/src/backend/runtime/realtime-stream-do.ts

@@ -60,40 +60,13 @@ const EVENT_PREFIX = "evt:";
 /** Ring buffer size: how many events a reconnect can replay before `resync`. */
 const EVENT_BUFFER_SIZE = 200;
 const TICKET_PREFIX = "ticket:";
-/** Outstanding one-time tickets per user (multiple tabs may mint at once). */
-const MAX_OUTSTANDING_TICKETS = 8;
-const TICKET_TTL_MS = 60_000;
-
-interface StoredTicket {
-  hash: string;
-  expiresAt: number;
-}
+import { consumeOneTimeTicket, mintOneTimeTicket } from "./one-time-ticket.ts";
 
 function eventKey(seq: number): string {
   // Fixed-width key so storage.list({prefix}) returns events in seq order.
   return `${EVENT_PREFIX}${String(seq).padStart(12, "0")}`;
 }
 
-async function sha256Hex(value: string): Promise<string> {
-  const digest = await crypto.subtle.digest(
-    "SHA-256",
-    new TextEncoder().encode(value),
-  );
-  return [...new Uint8Array(digest)]
-    .map((b) => b.toString(16).padStart(2, "0"))
-    .join("");
-}
-
-/** Constant-time hex-string comparison (both inputs are fixed-width hashes). */
-function timingSafeEqualHex(a: string, b: string): boolean {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++) {
-    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  }
-  return diff === 0;
-}
-
 export class RealtimeStreamDO {
   private seqCache: number | null = null;
 
@@ -122,45 +95,16 @@ export class RealtimeStreamDO {
     if (request.method !== "POST") {
       return new Response("method not allowed", { status: 405 });
     }
-    const ticket =
-      crypto.randomUUID().replaceAll("-", "") +
-      crypto.randomUUID().replaceAll("-", "");
-    const hash = await sha256Hex(ticket);
-    const now = Date.now();
-
-    const stored = await this.state.storage.list<StoredTicket>({
+    const ticket = await mintOneTimeTicket(this.state.storage, {
       prefix: TICKET_PREFIX,
     });
-    // Drop expired tickets; keep the newest few so parallel tabs still work.
-    const live = [...stored.entries()]
-      .filter(([, t]) => t.expiresAt > now)
-      .sort((a, b) => a[1].expiresAt - b[1].expiresAt);
-    for (const [key] of stored) {
-      if (!live.some(([liveKey]) => liveKey === key)) {
-        await this.state.storage.delete(key);
-      }
-    }
-    while (live.length >= MAX_OUTSTANDING_TICKETS) {
-      const [oldestKey] = live.shift()!;
-      await this.state.storage.delete(oldestKey);
-    }
-    await this.state.storage.put(`${TICKET_PREFIX}${hash}`, {
-      hash,
-      expiresAt: now + TICKET_TTL_MS,
-    } satisfies StoredTicket);
-
     return Response.json({ ticket });
   }
 
   private async consumeTicket(ticket: string): Promise<boolean> {
-    const hash = await sha256Hex(ticket);
-    const key = `${TICKET_PREFIX}${hash}`;
-    const stored = await this.state.storage.get<StoredTicket>(key);
-    if (!stored) return false;
-    // Single-use: consume before validating expiry so a replay always misses.
-    await this.state.storage.delete(key);
-    if (stored.expiresAt <= Date.now()) return false;
-    return timingSafeEqualHex(stored.hash, hash);
+    return consumeOneTimeTicket(this.state.storage, ticket, {
+      prefix: TICKET_PREFIX,
+    });
   }
 
   // -------------------------------------------------------------------------

package/src/backend/runtime/signaling-hub.ts

@@ -23,7 +23,13 @@ const log = logger.child({ component: "rtc.hub" });
 
 export interface ISignalingHub {
   /** Handle a browser WebSocket upgrade for `actorApId` (returns 101). */
-  upgrade(request: Request, actorApId: string): Promise<Response>;
+  upgrade(
+    request: Request,
+    actorApId: string,
+    ticket: string,
+  ): Promise<Response>;
+  /** Mint a one-time short-lived WS ticket inside the user's call DO. */
+  mintTicket(actorApId: string): Promise<string | null>;
   /** Push an inbound cross-instance signal to `actorApId`'s live sockets. */
   deliver(actorApId: string, envelope: RtcSignalEnvelopeV1): Promise<void>;
 }
@@ -38,9 +44,15 @@ class CloudflareSignalingHub implements ISignalingHub {
     return this.ns.get(this.ns.idFromName(actorApId));
   }
 
-  async upgrade(request: Request, actorApId: string): Promise<Response> {
+  async upgrade(
+    request: Request,
+    actorApId: string,
+    ticket: string,
+  ): Promise<Response> {
     const headers = new Headers(request.headers);
     headers.set("X-Call-Actor", actorApId);
+    headers.set("X-Call-Auth", "ticket");
+    headers.set("X-Call-Ticket", ticket);
     const forwarded = new Request("https://call-do/_ws", {
       method: "GET",
       headers,
@@ -50,6 +62,19 @@ class CloudflareSignalingHub implements ISignalingHub {
     ) as unknown as Promise<Response>;
   }
 
+  async mintTicket(actorApId: string): Promise<string | null> {
+    const response = await this.stub(actorApId).fetch(
+      "https://call-do/_ticket",
+      {
+        method: "POST",
+        headers: { "X-Call-Actor": actorApId },
+      },
+    );
+    if (!response.ok) return null;
+    const body = (await response.json()) as { ticket?: unknown };
+    return typeof body.ticket === "string" ? body.ticket : null;
+  }
+
   async deliver(
     actorApId: string,
     envelope: RtcSignalEnvelopeV1,
@@ -143,7 +168,11 @@ class LocalSignalingHub implements ISignalingHub {
     );
   }
 
-  async upgrade(_request: Request, _actorApId: string): Promise<Response> {
+  async upgrade(
+    _request: Request,
+    _actorApId: string,
+    _ticket: string,
+  ): Promise<Response> {
     // The Bun runtime upgrades WebSockets at the server boundary (server.upgrade)
     // and drives attach()/message()/detach() directly, so this Hono-level path is
     // never used there. Reaching it means a runtime without Durable Objects and
@@ -157,6 +186,10 @@ class LocalSignalingHub implements ISignalingHub {
     );
   }
 
+  async mintTicket(): Promise<string | null> {
+    return null;
+  }
+
   async deliver(
     actorApId: string,
     envelope: RtcSignalEnvelopeV1,

package/src/backend/runtime/types.ts

@@ -115,7 +115,7 @@ export interface ListObjectsResult {
 export interface IObjectStorage {
   put(
     key: string,
-    value: ReadableStream | ArrayBuffer | string,
+    value: Blob | ReadableStream | ArrayBuffer | string,
     options?: {
       httpMetadata?: ObjectMetadata["httpMetadata"];
       customMetadata?: Record<string, string>;

package/src/backend/server.ts

@@ -21,16 +21,20 @@
 
 import { mkdir, readdir, readFile, stat } from "node:fs/promises";
 import process from "node:process";
-import { and, inArray, lt, or } from "drizzle-orm";
 import { BunAssets, BunDatabase, BunStorage } from "./runtime/bun.ts";
 import { MemoryKV } from "./runtime/memory-kv.ts";
-import type { Env } from "./types.ts";
+import type { Env, EnvVars } from "./types.ts";
 import type {
   DeliveryDlqMessageV1,
   DeliveryQueueMessageV1,
 } from "./lib/delivery/types.ts";
-import { buildDeliverEndpointMessage } from "./lib/delivery/queue.ts";
-import { deliveryQueue, getDbSQLite } from "../db/index.ts";
+import {
+  buildDeliverEndpointMessage,
+  enqueuePendingDeliveryEndpointJobs,
+} from "./lib/delivery/queue.ts";
+import { enqueuePendingDeliveryResolutionJobs } from "./lib/delivery/resolution-outbox.ts";
+import { enqueuePendingDeliveryFanoutJobs } from "./lib/delivery/fanout-outbox.ts";
+import { getDbSQLite } from "../db/index.ts";
 import { logger } from "./lib/logger.ts";
 import type {
   IQueueBatch,
@@ -78,37 +82,75 @@ const APP_URL = process.env.APP_URL ?? `http://localhost:${PORT}`;
 // Create Cloudflare-compatible environment from the local runtime
 // ---------------------------------------------------------------------------
 
-const ENV_PASSTHROUGH_KEYS = [
-  "AUTH_PASSWORD_HASH",
-  "ENCRYPTION_KEY",
-  "GOOGLE_CLIENT_ID",
-  "GOOGLE_CLIENT_SECRET",
-  "X_CLIENT_ID",
-  "X_CLIENT_SECRET",
-  "OIDC_ISSUER_URL",
-  "OIDC_CLIENT_ID",
-  "OIDC_CLIENT_SECRET",
-  "OAUTH_ISSUER_URL",
-  "TAKOSUMI_ACCOUNTS_ISSUER_URL",
-  "TAKOSUMI_ACCOUNTS_CLIENT_ID",
-  "TAKOSUMI_ACCOUNTS_CLIENT_SECRET",
-  "TAKOS_URL",
-  "AUTH_MODE",
-  "CSRF_ALLOWED_ORIGINS",
-  "ENABLE_TAKOS_TOOLS",
-  "DELIVERY_SHADOW_PROBE_HOSTS",
-  "DELIVERY_SHADOW_PROBE_SAMPLE_RATE",
-  "DELIVERY_QUEUE_NAME",
-  "DELIVERY_DLQ_NAME",
-  "YURUCOMMU_ENABLE_LOCAL_SUBSTRATE_REMOTE_FETCHES",
-  "YURUCOMMU_ENABLE_LOCAL_DELIVERY_QUEUE",
-  "YURUCOMMU_NOTIFICATION_PUSH_GATEWAY_ALLOWED_HOSTS",
-  "YURUCOMMU_NOTIFICATION_PUSH_GATEWAY_URL",
-  "YURUCOMMU_NOTIFICATION_PUSH_GATEWAY_TOKEN",
-  "YURUCOMMU_NOTIFICATION_PUSH_GATEWAY_TIMEOUT_MS",
-  "YURUCOMMU_NOTIFICATION_PUSH_ALLOW_INSECURE_LOOPBACK",
-  "YURUCOMMU_NOTIFICATION_PUSH_WEB_PUSH_PUBLIC_KEY",
-] as const;
+type LocalRuntimeEnvKey = Exclude<keyof EnvVars, "APP_URL">;
+
+// Keep the Bun self-host adapter wire-equivalent to Worker bindings. Using a
+// complete Record makes TypeScript fail whenever EnvVars gains a new runtime
+// setting without an explicit local-runtime decision, instead of silently
+// dropping authority/security configuration such as OIDC_OWNER_SUB.
+const ENV_PASSTHROUGH_KEY_SET: Record<LocalRuntimeEnvKey, true> = {
+  ENABLE_TAKOS_TOOLS: true,
+  AUTH_PASSWORD_HASH: true,
+  GOOGLE_CLIENT_ID: true,
+  GOOGLE_CLIENT_SECRET: true,
+  X_CLIENT_ID: true,
+  X_CLIENT_SECRET: true,
+  OIDC_ISSUER_URL: true,
+  OIDC_CLIENT_ID: true,
+  OIDC_CLIENT_SECRET: true,
+  OAUTH_ISSUER_URL: true,
+  TAKOSUMI_ACCOUNTS_ISSUER_URL: true,
+  TAKOSUMI_ACCOUNTS_CLIENT_ID: true,
+  TAKOSUMI_ACCOUNTS_CLIENT_SECRET: true,
+  OIDC_OWNER_SUB: true,
+  TAKOSUMI_ACCOUNTS_OWNER_SUB: true,
+  ALLOW_UNPINNED_OWNER_CLAIM: true,
+  OIDC_ALLOWED_SUBS: true,
+  TAKOS_URL: true,
+  AUTH_MODE: true,
+  ENCRYPTION_KEY: true,
+  YURUCOMMU_SESSION_HASH_SALT: true,
+  DELIVERY_SHADOW_PROBE_HOSTS: true,
+  DELIVERY_SHADOW_PROBE_SAMPLE_RATE: true,
+  DELIVERY_QUEUE_NAME: true,
+  DELIVERY_DLQ_NAME: true,
+  YURUCOMMU_STRICT_READINESS: true,
+  YURUCOMMU_ENABLE_LOCAL_SUBSTRATE_REMOTE_FETCHES: true,
+  YURUCOMMU_ENABLE_LOCAL_DELIVERY_QUEUE: true,
+  YURUCOMMU_SOFTWARE_VERSION: true,
+  YURUCOMMU_NOTIFICATION_PUSH_GATEWAY_ALLOWED_HOSTS: true,
+  YURUCOMMU_NOTIFICATION_PUSH_GATEWAY_URL: true,
+  YURUCOMMU_NOTIFICATION_PUSH_GATEWAY_TOKEN: true,
+  YURUCOMMU_NOTIFICATION_PUSH_GATEWAY_TIMEOUT_MS: true,
+  YURUCOMMU_NOTIFICATION_PUSH_ALLOW_INSECURE_LOOPBACK: true,
+  YURUCOMMU_NOTIFICATION_PUSH_WEB_PUSH_PUBLIC_KEY: true,
+  CSRF_ALLOWED_ORIGINS: true,
+  YURUCOMMU_RTC_ICE_SERVERS: true,
+  YURUCOMMU_RTC_TURN_URIS: true,
+  YURUCOMMU_RTC_TURN_SECRET: true,
+  YURUCOMMU_RTC_TURN_TTL: true,
+  YURUCOMMU_RTC_SFU_ADAPTER: true,
+  YURUCOMMU_RTC_SFU_URL: true,
+  YURUCOMMU_RTC_SFU_TOKEN: true,
+  YURUCOMMU_RTC_SFU_APP_ID: true,
+  YURUCOMMU_RTC_SFU_APP_SECRET: true,
+  TAKOS_TRUST_PROXY: true,
+};
+
+const ENV_PASSTHROUGH_KEYS = Object.keys(
+  ENV_PASSTHROUGH_KEY_SET,
+) as LocalRuntimeEnvKey[];
+
+export function buildLocalRuntimeEnvPassthrough(
+  source: Readonly<Record<string, string | undefined>>,
+): Partial<Record<LocalRuntimeEnvKey, string | undefined>> {
+  const passthrough: Partial<Record<LocalRuntimeEnvKey, string | undefined>> =
+    {};
+  for (const key of ENV_PASSTHROUGH_KEYS) {
+    passthrough[key] = source[key];
+  }
+  return passthrough;
+}
 
 function isTruthyEnv(value: string | undefined): boolean {
   if (!value) return false;
@@ -255,21 +297,9 @@ function attachLocalDeliveryQueues(env: LocalServerEnv): void {
 // the platform persists in-flight messages and re-delivers them itself, so the
 // sweep must not run there.
 
-/** Statuses that still represent work the local queue must (re)drive. */
-const RECONCILE_PENDING_STATUSES = ["pending", "retry_wait"] as const;
-
-/**
- * Matches queue-delivery.ts STALE_PROCESSING_MS: a row marked `processing`
- * older than this lost its owning worker and is safe to re-enqueue.
- */
-const RECONCILE_STALE_PROCESSING_MS = 2 * 60 * 1000;
-
 /** How often the periodic reconciliation sweep runs. */
 const RECONCILE_SWEEP_INTERVAL_MS = 60 * 1000;
 
-/** How many rows to re-enqueue per sweep pass. */
-const RECONCILE_SWEEP_BATCH = 500;
-
 /**
  * Select non-terminal delivery_queue rows and re-enqueue them onto the local
  * delivery queue. Returns the number of rows re-enqueued.
@@ -277,34 +307,12 @@ const RECONCILE_SWEEP_BATCH = 500;
 export async function reconcileLocalDeliveryQueue(
   env: LocalServerEnv,
 ): Promise<number> {
-  const queue = env.DELIVERY_QUEUE;
-  if (!queue) return 0;
-
-  const db = env.DB_INSTANCE;
-  const staleBefore = new Date(
-    Date.now() - RECONCILE_STALE_PROCESSING_MS,
-  ).toISOString();
-
-  const rows = await db
-    .select({ id: deliveryQueue.id })
-    .from(deliveryQueue)
-    .where(
-      or(
-        inArray(deliveryQueue.status, [...RECONCILE_PENDING_STATUSES]),
-        and(
-          inArray(deliveryQueue.status, ["processing"]),
-          lt(deliveryQueue.processingStartedAt, staleBefore),
-        ),
-      ),
-    )
-    .limit(RECONCILE_SWEEP_BATCH);
-
-  if (rows.length === 0) return 0;
-
-  for (const row of rows) {
-    await queue.send(buildDeliverEndpointMessage(row.id));
-  }
-  return rows.length;
+  return await enqueuePendingDeliveryEndpointJobs(env, new Date(), {
+    // The local queue is process memory. Recreate even future retry timers now;
+    // processDeliverEndpoint will defer them to their stored nextAttemptAt.
+    includeDeferred: true,
+    includeFreshPending: true,
+  });
 }
 
 /**
@@ -315,12 +323,22 @@ export async function reconcileLocalDeliveryQueue(
 function startLocalDeliveryQueueReconciler(env: LocalServerEnv): void {
   const runSweep = async (trigger: "startup" | "interval") => {
     try {
-      const requeued = await reconcileLocalDeliveryQueue(env);
+      const fanoutJobs = await enqueuePendingDeliveryFanoutJobs(env, {
+        // The local Queue is process memory. At startup, accepted-but-not-yet-
+        // completed wakeups disappeared with the previous process.
+        includePublished: trigger === "startup",
+      });
+      const endpointJobs = await reconcileLocalDeliveryQueue(env);
+      const resolutionJobs = await enqueuePendingDeliveryResolutionJobs(env);
+      const requeued = fanoutJobs + endpointJobs + resolutionJobs;
       if (requeued > 0) {
         log.info("Reconciled local delivery queue", {
           event: "server.local_delivery_queue.reconciled",
           trigger,
           requeued,
+          fanoutJobs,
+          endpointJobs,
+          resolutionJobs,
         });
       }
     } catch (error) {
@@ -351,10 +369,7 @@ async function createLocalServerEnv(config: {
   const assets = BunAssets.create(config.assetsPath);
   const media = await BunStorage.create(config.storagePath);
 
-  const passthrough: Record<string, string | undefined> = {};
-  for (const key of ENV_PASSTHROUGH_KEYS) {
-    passthrough[key] = process.env[key];
-  }
+  const passthrough = buildLocalRuntimeEnvPassthrough(process.env);
 
   const dbInstance = await getDbSQLite(config.databasePath);
   const env: LocalServerEnv = {