/**
* ActivityPubService — Klonkt as a real ActivityPub actor (fediverse bridge).
*
* Phase 1 (this file): the PUBLISH/discoverable side.
* - per-site RSA keypair (Mastodon-compatible HTTP Signatures; separate from
* the Ed25519 keys used by the lighter Cirkels v1)
* - builders for the Actor document, Note objects and the Outbox collection
* - apWants(): HTTP content-negotiation helper (activity+json vs HTML)
*
* The interactive side (inbox: Follow/Accept, signature verify, delivery to
* followers) lands in the next step and is tested live against Mastodon.
*
* AP actor URLs live under /ap/* so they never clash with the human pages:
* actor = /ap/users/
* inbox = /inbox outbox = /outbox
* note = /ap/notes/
*/
import crypto from 'crypto';
import fs from 'fs';
import path from 'path';
import dns from 'dns';
import net from 'net';
import db from '../config/database.js';
import HtmlSanitizerService from './HtmlSanitizerService.js';
import AudioEmbedService from './AudioEmbedService.js';
import EmbedResolver from './EmbedResolver.js';
import Push from './PushService.js';
import { getTenancy } from './SettingsService.js';
import { t as i18nT } from './i18n.js';
import Blocklist from './BlocklistService.js';
import * as Guardianship from './guardianship/index.js';
const PUBLIC = 'https://www.w3.org/ns/activitystreams#Public';
// Full JSON-LD context for every AP object we emit: AS2 core + security (publicKey) + the
// extension terms we actually use (Mastodon/toot + schema.org), each with a term definition
// so a strict JSON-LD processor resolves them instead of dropping them → valid AS2/JSON-LD.
// This is the same context shape Mastodon publishes, so Mastodon sees no change.
const AP_CONTEXT = [
'https://www.w3.org/ns/activitystreams',
'https://w3id.org/security/v1',
{
toot: 'http://joinmastodon.org/ns#',
schema: 'http://schema.org#',
sensitive: 'as:sensitive',
Hashtag: 'as:Hashtag',
manuallyApprovesFollowers: 'as:manuallyApprovesFollowers',
discoverable: 'toot:discoverable',
featured: { '@id': 'toot:featured', '@type': '@id' },
PropertyValue: 'schema:PropertyValue',
value: 'schema:value',
embedUrl: { '@id': 'schema:embedUrl', '@type': '@id' },
// Poll (Question) extension: Question/oneOf/anyOf/endTime/closed are AS2 core, but the
// per-poll unique-voter count is a Mastodon (toot) term — declare it so the emitted
// Question stays valid JSON-LD (a strict processor would otherwise drop votersCount).
votersCount: 'toot:votersCount',
// FEP-633c (Guardians): the shaer namespace, owned by the guardianship
// module (src/services/guardianship/).
...Guardianship.SHAER_CONTEXT,
},
];
// Short random suffix so two activity ids minted in the same millisecond (e.g.
// parallel saves) don't collide and get deduped by a receiver.
const rid = () => crypto.randomBytes(4).toString('hex');
// Keep only http(s) URLs — drops javascript:/data:/etc so a remote actor can't
// smuggle a dangerous scheme into a stored href/src (rendered in owner-only views).
const safeUrl = (u) => { const s = String(u == null ? '' : u).trim(); return /^https?:\/\//i.test(s) ? s : ''; };
// ── SSRF guard for outbound fetches ───────────────────────────────
// Remote URLs (actor/keyId/webfinger/inbox/inReplyTo) are attacker-controlled, so
// every outbound fetch must refuse hosts that resolve to private/loopback ranges
// (cloud metadata, internal services) — on the initial host AND each redirect hop.
function isBlockedIp(ip) {
if (!ip) return true;
const v = net.isIP(ip);
if (v === 4) {
const o = ip.split('.').map(Number);
return o[0] === 127 || o[0] === 10 || o[0] === 0
|| (o[0] === 172 && o[1] >= 16 && o[1] <= 31)
|| (o[0] === 192 && o[1] === 168)
|| (o[0] === 169 && o[1] === 254)
|| (o[0] === 100 && o[1] >= 64 && o[1] <= 127); // CGNAT
}
if (v === 6) {
const s = ip.toLowerCase().replace(/^\[|\]$/g, '');
return s === '::1' || s === '::' || s.startsWith('fc') || s.startsWith('fd') || s.startsWith('fe80')
|| s.startsWith('::ffff:127.') || s.startsWith('::ffff:10.') || s.startsWith('::ffff:192.168.')
|| s.startsWith('::ffff:169.254.') || s.startsWith('::ffff:172.');
}
return true; // not an IP literal we recognise → refuse
}
async function assertPublicHost(hostname) {
if (net.isIP(hostname)) { if (isBlockedIp(hostname)) throw new Error('ssrf-blocked-ip'); return; }
const addrs = await dns.promises.lookup(hostname, { all: true });
if (!addrs.length || addrs.some((a) => isBlockedIp(a.address))) throw new Error('ssrf-blocked-host');
}
export async function safeFetch(url, opts = {}, maxRedirects = 3) {
let target = url;
for (let hop = 0; ; hop++) {
const u = new URL(target); // throws on malformed → caller's catch
if (u.protocol !== 'https:' && u.protocol !== 'http:') throw new Error('ssrf-bad-scheme');
await assertPublicHost(u.hostname);
const r = await fetch(target, { ...opts, redirect: 'manual', signal: AbortSignal.timeout(8000) });
const loc = (r.status >= 300 && r.status < 400) ? r.headers.get('location') : null;
if (loc && hop < maxRedirects) { target = new URL(loc, target).toString(); continue; }
return r;
}
}
const MAX_OUTBOX = 20;
// Cache-buster for the music listen-link → forces Mastodon to re-crawl a FRESH
// (square) player card. Bump this whenever the twitter:player card dimensions change.
const FEDI_CARD_VER = '2';
// ── RSA keys per actor (lazy, cached in DB) ───────────────────────
// Prepared lazily (NOT at module load) — the ap_keys table is created in
// initializeDatabase(), which runs after this module is imported.
let _sel, _ins;
function keyStmts() {
if (!_sel) {
_sel = db.prepare('SELECT public_pem, private_pem FROM ap_keys WHERE slug = ?');
_ins = db.prepare('INSERT OR IGNORE INTO ap_keys (slug, public_pem, private_pem, created_at) VALUES (?,?,?,CURRENT_TIMESTAMP)');
}
return { sel: _sel, ins: _ins };
}
export function getOrCreateKeys(slug) {
const { sel, ins } = keyStmts();
const row = sel.get(slug);
if (row) return row;
const { publicKey, privateKey } = crypto.generateKeyPairSync('rsa', {
modulusLength: 2048,
publicKeyEncoding: { type: 'spki', format: 'pem' },
privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
});
ins.run(slug, publicKey, privateKey);
return sel.get(slug) || { public_pem: publicKey, private_pem: privateKey };
}
// ── content negotiation ───────────────────────────────────────────
// True when the caller wants ActivityPub JSON rather than the HTML page.
export function apWants(req) {
const a = String(req.headers.accept || '').toLowerCase();
return a.includes('application/activity+json') ||
(a.includes('application/ld+json') && a.includes('activitystreams'));
}
const AP_CONTENT_TYPE = 'application/activity+json; charset=utf-8';
export function sendAP(res, obj, cacheControl) {
res.type(AP_CONTENT_TYPE);
// A per-caller (e.g. guardian-widened) view must not be publicly cached.
res.set('Cache-Control', cacheControl || 'public, max-age=120');
res.send(JSON.stringify(obj));
}
// ── document builders ─────────────────────────────────────────────
export function actorId(base, slug) { return `${base}/ap/users/${encodeURIComponent(slug)}`; }
export function noteId(base, postId) { return `${base}/ap/notes/${encodeURIComponent(postId)}`; }
export function buildActor(base, site) {
const id = actorId(base, site.slug);
const keys = getOrCreateKeys(site.slug);
// FEP-633c §5.3: a ward's follows are gated (guardians approve), so the actor
// MUST advertise manuallyApprovesFollowers:true — otherwise a follower's server
// (Mastodon) assumes auto-accept and shows "Following" while we hold it pending.
const isWard = (() => { try { return Guardianship.listGuardians(site.slug).length > 0; } catch { return false; } })();
const actor = {
'@context': AP_CONTEXT,
id,
type: 'Person',
preferredUsername: site.slug,
name: site.title || site.slug,
summary: site.tagline || site.description || '',
url: `${base}/${site.slug === site.primary_slug ? '' : 'user/' + encodeURIComponent(site.slug)}`,
manuallyApprovesFollowers: isWard,
discoverable: true,
inbox: `${id}/inbox`,
outbox: `${id}/outbox`,
followers: `${id}/followers`,
following: `${id}/following`,
featured: `${id}/featured`,
// AP §5.6: the private blocked collection (owner-only GET). The server
// list is the source of truth for Shaer's "in Orbit"; clients keep no
// separate state.
blocked: `${id}/blocked`,
// FEP-633c §2: shaer:guardians / shaer:isGuardian / shaer:queues
// (guardianship module owns these).
...Guardianship.guardianshipActorProps(id, site.slug),
// C2S clients (Shaer apps) discover auth + upload here — no hardcoded paths.
// All four are ActivityPub-spec `endpoints` terms. Dynamic client registration
// (RFC 7591) is discovered via /.well-known/oauth-authorization-server, not here.
endpoints: {
sharedInbox: `${base}/ap/inbox`,
oauthAuthorizationEndpoint: `${base}/oauth/authorize`,
oauthTokenEndpoint: `${base}/oauth/token`,
uploadMedia: `${id}/uploadMedia`,
},
publicKey: {
id: `${id}#main-key`,
owner: id,
publicKeyPem: keys.public_pem,
},
};
if (site.profile_photo) {
const u = /^https?:/.test(site.profile_photo) ? site.profile_photo : `${base}${site.profile_photo.startsWith('/') ? '' : '/'}${site.profile_photo}`;
actor.icon = { type: 'Image', url: u };
}
// Account creation date — shown by Mastodon + read by indexers (additive, standard AS2).
if (site.created_at) { try { actor.published = new Date(site.created_at).toISOString(); } catch { /* skip bad date */ } }
// Profile links → PropertyValue rows: Mastodon/PeerTube/WordPress-ActivityPub render these as
// profile metadata (rel=me enables link-back verification). Additive; ignored by simpler receivers.
try {
const links = JSON.parse(site.profile_links || '[]');
if (Array.isArray(links) && links.length) {
const esc = (s) => String(s).replace(/[<>&]/g, (c) => ({ '<': '<', '>': '>', '&': '&' }[c]));
const rows = links
.filter((l) => l && l.url && /^https?:/i.test(l.url))
.map((l) => ({
type: 'PropertyValue',
name: esc(l.platform || 'Link'),
value: `${esc(String(l.url).replace(/^https?:\/\//, ''))}`,
}));
if (rows.length) actor.attachment = rows;
}
} catch { /* skip malformed profile_links */ }
return actor;
}
// Does a post's audio shortcodes reference at least one PLAYABLE (file-backed)
// track? Link-only tracks (external Spotify/YouTube, media_id NULL) don't count —
// they have no Klonkt-hosted audio to embed, so no player card / cover-suppression.
export function hasPlayableAudio(content, siteId) {
if (!content || !/\[\[(track|album|playlist):/i.test(content)) return false;
try {
for (const m of content.matchAll(/\[\[track:([A-Za-z0-9_-]+)\]\]/g)) { const r = db.prepare('SELECT media_id FROM audio_tracks WHERE id = ?').get(m[1]); if (r && r.media_id) return true; }
for (const m of content.matchAll(/\[\[album:([^\]]+)\]\]/g)) { if (db.prepare('SELECT 1 FROM audio_tracks WHERE site_id = ? AND album = ? AND media_id IS NOT NULL LIMIT 1').get(siteId, m[1].trim())) return true; }
for (const m of content.matchAll(/\[\[playlist:([A-Za-z0-9_-]+)\]\]/g)) { if (db.prepare('SELECT 1 FROM playlist_tracks pt JOIN audio_tracks t ON t.id = pt.track_id WHERE pt.playlist_id = ? AND t.media_id IS NOT NULL LIMIT 1').get(m[1])) return true; }
} catch { /* non-fatal */ }
return false;
}
// A single post as an AS2 Note (the object), and as a Create activity (for outbox/delivery).
export function buildNote(base, site, post, opts = {}) {
// Replies are Notes too. buildNote is the single entry point for ALL Notes; a reply is
// (for now) the simple flavor: pre-baked content, no title/cover/image/audio/embed
// machinery, addressed to the parent actor + thread. This early branch keeps that output
// byte-identical to the old buildReplyNote. When rich replies land (images/audio/embeds),
// this branch collapses and replies flow through the full post pipeline below. `post` here
// is the ap_outbox reply row (id, in_reply_to, content, post_slug, created_at, to_actor).
if (opts.isReply) {
const meR = actorId(base, site.slug);
// Rich replies: attachments column (JSON [{url, mediaType, name}]) → AS2
// attachment array with absolute URLs and the matching object type.
let replyAtt;
try {
const list = post.attachments ? JSON.parse(post.attachments) : [];
if (Array.isArray(list) && list.length) {
replyAtt = list.map((a) => ({
type: a.mediaType.startsWith('image/') ? 'Image' : a.mediaType.startsWith('audio/') ? 'Audio' : 'Video',
mediaType: a.mediaType,
url: /^https?:/i.test(a.url) ? a.url : `${base}${a.url}`,
name: a.name || undefined,
}));
}
} catch { /* malformed attachments never block the Note */ }
return {
id: noteId(base, post.id),
type: 'Note',
attributedTo: meR,
inReplyTo: post.in_reply_to || undefined,
content: post.content,
// Reply language (rich replies): the AS2 language map next to `content`.
contentMap: post.language ? { [post.language]: post.content } : undefined,
attachment: replyAtt,
url: post.post_slug ? `${base}/${encodeURIComponent(post.post_slug)}` : undefined,
published: toISO(post.created_at),
// A direct note (private mention, shaer-tqc) addresses ONLY its
// recipients: no Public anywhere, so it cannot be boosted and never
// shows in public timelines (the Mastodon DM model).
to: post.visibility === 'direct'
? (JSON.parse(post.to_actors || '[]'))
: (post.to_actor ? [post.to_actor] : [PUBLIC]),
// Followers-only reply ('friends', shaer detail-view Reply): the parent
// author (in `to`) + our followers, but NO Public — it does not federate
// into open discovery. Default reply stays quiet-public (Public in cc).
cc: post.visibility === 'direct' ? []
: post.visibility === 'friends' ? [`${meR}/followers`]
: [PUBLIC, `${meR}/followers`],
// FEP-633c 5.2.1: a ward's call for help. Only ever on direct notes.
...Guardianship.helpRequestProps(post),
...Guardianship.waveProps(post),
...Guardianship.awayProps(post),
// FEP-633c §2.2: object hint that the author is a ward.
...Guardianship.hasGuardiansProps(site.slug),
tag: [
...mentionTags(post.content),
...hashtagTags(base, post.content),
],
};
}
const id = noteId(base, post.id);
const aId = actorId(base, site.slug);
const human = `${base}/${encodeURIComponent(post.slug)}`;
// Mastodon ignores a Note's `name`, so put the title INTO the content (bold
// first line) — the standard blog→fediverse convention. post.content is
// already sanitized HTML; the title is plain text, so escape it.
const escTitle = String(post.title || '').replace(/[<>&]/g, (c) => ({ '<': '<', '>': '>', '&': '&' }[c]));
const titleHtml = post.title ? `
${escTitle}
` : '';
// Paid post (klonkt-demo-aki): federate a PUBLIC teaser + link, never the full
// content, so nothing leaks past the paywall. No media attachments either.
if (post.paid) {
const esc = (x) => String(x || '').replace(/[<>&]/g, (c) => ({ '<': '<', '>': '>', '&': '&' }[c]));
const _firstP = (String(post.content || '').match(/]*>([\s\S]*?)<\/p>/i) || [null, ''])[1] || '';
const rawTeaser = String(post.excerpt || '').trim()
|| _firstP.replace(/<[^>]+>/g, ' ').replace(/&[a-z#0-9]+;/gi, ' ').replace(/\s+/g, ' ').trim().slice(0, 280);
return {
'@context': AP_CONTEXT,
id,
type: 'Note',
attributedTo: aId,
content: `${titleHtml}
`,
url: human,
published: toISO(post.published_at || post.created_at || Date.now()),
to: [PUBLIC],
cc: [`${aId}/followers`],
tag: [...hashtagTags(base, post.content)],
replies: `${id}/replies`,
...Guardianship.hasGuardiansProps(site.slug),
};
}
// Images travel as AP `attachment` (Mastodon strips from content). Collect
// the cover + any inline , make absolute, then strip from the content
// to avoid duplicate rendering on clients that DO keep them.
const abs = (u) => !u ? null : (/^https?:/i.test(u) ? u : `${base}${u.startsWith('/') ? '' : '/'}${u}`);
const mediaType = (u) => {
const e = ((u || '').split('?')[0].match(/\.(\w+)$/) || [])[1];
return ({ jpg: 'image/jpeg', jpeg: 'image/jpeg', png: 'image/png', gif: 'image/gif', webp: 'image/webp', avif: 'image/avif', mp4: 'video/mp4', webm: 'video/webm', mov: 'video/quicktime' })[(e || '').toLowerCase()] || 'image/jpeg';
};
const hadAudio = /\[\[(track|album|playlist):/i.test(post.content || '');
const playable = hasPlayableAudio(post.content || '', site && site.id);
// A post with an external embed (Spotify/YouTube/SoundCloud/Vimeo/Bandcamp/Apple) should let
// Mastodon render the embed's player CARD. Mastodon shows EITHER media attachments OR a link
// card, never both — so when the post has an embed link we skip the image attachments so the
// card wins. (On Klonkt nothing changes: the cover + the embed player still render.)
const hasEmbed = (() => {
const c = post.content || '';
if (/\[\[embed:/i.test(c)) return true;
for (const m of c.matchAll(/https?:\/\/[^\s"'<>]+/gi)) if (AudioEmbedService.detectProvider(m[0])) return true;
return false;
})();
// Link-only tracks (external Spotify/YouTube/SoundCloud, no hosted file): collect their links
// so we federate them — Mastodon cards the first (its player), the rest show as clickable links
// — instead of a bare "listen on site" link, and we suppress the cover so the card can show.
const trackEmbedLinks = (() => {
if (playable) return [];
const out = [];
try {
for (const m of (post.content || '').matchAll(/\[\[track:([A-Za-z0-9_-]+)\]\]/g)) {
const r = db.prepare('SELECT media_id, link_spotify, link_youtube, link_soundcloud FROM audio_tracks WHERE id = ?').get(m[1]);
if (r && !r.media_id) for (const u of [r.link_spotify, r.link_youtube, r.link_soundcloud]) if (u && /^https?:\/\//i.test(u)) out.push(u);
}
} catch { /* non-fatal */ }
return [...new Set(out)].slice(0, 6);
})();
const noImages = playable || hasEmbed || trackEmbedLinks.length > 0; // suppress images → let the player/embed card show
const urls = [];
// Posts with PLAYABLE hosted audio suppress image attachments so Mastodon renders
// the player CARD (twitter:player) instead of the cover — media attachment and
// link/player card are mutually exclusive on Mastodon. Link-only audio (external)
// keeps its cover (no player card to show).
// An animated cover federates as the muted loop MP4 (→ a Video attachment): animated WebP is
// unreliable on Mastodon and its iOS apps; the MP4 plays everywhere. Else the still cover image.
// Each entry carries the media URL + its alt text (federated as the AS2 attachment `name`, for a11y).
if (post.cover_video_url && !noImages) urls.push({ url: abs(post.cover_video_url), name: post.cover_alt || '' });
else if (post.cover_image_url && !noImages) urls.push({ url: abs(post.cover_image_url), name: post.cover_alt || '' });
// Media a C2S composer attached (shaer-j3uh): federate with their REAL
// mediaType, because the extension map below knows no audio and would call
// an m4a an Image. Images also live inline in the content, so the dedupe
// by URL keeps them single.
try {
for (const a of JSON.parse(post.c2s_attachments || '[]')) {
if (a && a.url) urls.push({ url: abs(a.url), name: a.name || '', mt: a.mediaType, poster: a.poster ? abs(a.poster) : null });
}
} catch { /* malformed never blocks the Note */ }
let body = post.content || '';
// Only federate inline images we can actually serve: absolute http(s) URLs, or our own
// /media/ uploads. A relative path we don't host (e.g. a stale /images/... ref) would 404
// and show up as a black tile in Mastodon's attachment grid. Carry the through
// as the attachment description.
if (!noImages) for (const m of body.matchAll(/]*>/gi)) {
const tag = m[0];
const src = (tag.match(/\bsrc="([^"]+)"/i) || [])[1];
if (!src || !(/^https?:\/\//i.test(src) || src.startsWith('/media/'))) continue;
const alt = (tag.match(/\balt="([^"]*)"/i) || [])[1] || '';
urls.push({ url: abs(src), name: alt });
}
body = body.replace(/]*>/gi, '');
// Audio shortcodes: do NOT federate the raw audio file — Klonkt deliberately
// gates audio (the /audio/stream URL has friction), and shipping it as an AP
// audio attachment would hand Mastodon a plain, downloadable mp3 URL. Instead,
// replace the shortcodes with a "🎵 listen on the site" link so the post invites
// a click-through to the protected player (discovery without leaking the file).
const esc = (s) => String(s == null ? '' : s).replace(/[<>&]/g, (c) => ({ '<': '<', '>': '>', '&': '&' }[c]));
const audioLabels = [];
try {
for (const m of body.matchAll(/\[\[track:([A-Za-z0-9_-]+)\]\]/g)) { const r = db.prepare('SELECT title FROM audio_tracks WHERE id = ?').get(m[1]); if (r && r.title) audioLabels.push(r.title); }
for (const m of body.matchAll(/\[\[album:([^\]]+)\]\]/g)) audioLabels.push(m[1].trim());
} catch { /* non-fatal */ }
// fedi_open tracks → real AS2 Audio attachments (the actual file URL, served ungated) so
// EVERY client incl. the Mastodon apps plays them inline natively. Gated tracks (default)
// stay link/card-only — the file is never exposed for them. Resolve from post.content so a
// later body mutation can't affect it.
const openAudio = [];
if (hadAudio) {
const seenA = new Set();
const addRow = (r) => {
const fn = r.filename || (r.storage_path || '').split('/').pop();
if (!fn || seenA.has(fn)) return; seenA.add(fn);
const a = { type: 'Audio', mediaType: r.mime_type || 'audio/mpeg', url: `${base}/audio/stream/${encodeURIComponent(fn)}`, name: r.title || 'Audio' };
// Cover art on the Audio attachment (AS2 `icon`): track cover, else the post cover.
// Mastodon renders it as the artwork thumbnail on its native audio player.
const art = abs(r.cover_url || post.cover_image_url || null);
if (art) a.icon = { type: 'Image', mediaType: mediaType(art), url: art };
openAudio.push(a);
};
const SEL = 'SELECT t.title, t.cover_url, m.filename, m.storage_path, m.mime_type FROM audio_tracks t JOIN media m ON m.id = t.media_id WHERE t.fedi_open = 1 AND ';
try {
for (const mm of (post.content || '').matchAll(/\[\[track:([A-Za-z0-9_-]+)\]\]/g)) { const r = db.prepare(SEL + 't.id = ?').get(mm[1]); if (r) addRow(r); }
for (const mm of (post.content || '').matchAll(/\[\[album:([^\]]+)\]\]/g)) for (const r of db.prepare(SEL + 't.site_id = ? AND t.album = ? ORDER BY t.rowid').all(site.id, mm[1].trim())) addRow(r);
for (const mm of (post.content || '').matchAll(/\[\[playlist:([A-Za-z0-9_-]+)\]\]/g)) for (const r of db.prepare('SELECT t.title, t.cover_url, m.filename, m.storage_path, m.mime_type FROM playlist_tracks pt JOIN audio_tracks t ON t.id = pt.track_id JOIN media m ON m.id = t.media_id WHERE t.fedi_open = 1 AND pt.playlist_id = ? ORDER BY pt.position').all(mm[1])) addRow(r);
} catch { /* non-fatal */ }
}
body = body.replace(/\[\[(track|album|playlist):[^\]]+\]\]/gi, '');
// External embeds ([[embed:url]]) → emit the bare URL as a link so Mastodon
// renders its OWN preview/player card (YouTube/Spotify/SoundCloud/etc) instead
// of federating the raw shortcode text.
body = body.replace(/\[\[embed:([^\]]+)\]\]/gi, (mm, raw) => {
const u = esc(raw.trim().replace(/&/g, '&'));
return `
`;
});
if (hadAudio) {
const lbl = audioLabels.length ? esc(audioLabels.slice(0, 4).join(', ')) : '';
if (trackEmbedLinks.length) {
// Link-only track(s): emit the external link(s). Mastodon cards the first (Spotify → its
// player), the rest render as clickable links — the fediverse-native "embed + links".
body += `
🎵 ${lbl ? `${lbl}` : ''}
`;
for (const u of trackEmbedLinks) { const eu = esc(u); body += `
`; }
} else {
// For playable posts, append a version param to the listen-link so Mastodon
// sees a NEW card URL and re-crawls it (fresh SQUARE player card) instead of
// reusing the cached landscape one. Invisible: the link TEXT stays clean, the
// page ignores the param. Bump FEDI_CARD_VER when the card dimensions change.
const listenHref = playable ? `${human}?fc=${FEDI_CARD_VER}` : human;
body += `
`;
}
}
// Klonkt renders post content with white-space:pre-wrap, so raw newlines ARE line
// breaks on the site. Mastodon (plain HTML) collapses whitespace and would drop them,
// so convert newlines to for the federated copy (content already made with
// shift+enter uses and has no \n → this is a no-op there).
body = body.replace(/\r?\n/g, ' ');
body = linkHashtags(base, body); // link inline #hashtags in the post body too
body = linkUrls(body); // bare URLs → clickable links on the federated copy
// Append the tags-field hashtags to the content so Mastodon renders them as clickable
// hashtags (a Hashtag that's only in the `tag` array isn't shown inline). CamelCase
// multi-word tags; skip any already present inline in the body.
{
const inlineTags = new Set(hashtagTags(base, body).map((h) => h.name.slice(1).toLowerCase()));
const addSeen = new Set();
const tagLinks = normalizeTags(post.tags).map(tagParts).filter(Boolean)
.filter((p) => !inlineTags.has(p.slug) && !addSeen.has(p.slug) && addSeen.add(p.slug))
.map((p) => `#${p.label}`);
if (tagLinks.length) body += `
${tagLinks.join(' ')}
`;
}
const seen = new Set();
const attachment = urls.filter((x) => x && x.url)
.filter((x) => { if (seen.has(x.url)) return false; seen.add(x.url); return true; })
.map((x) => { const mt = x.mt || mediaType(x.url); // the stored type wins; the extension map is the fallback
const ty = /^image\//i.test(mt) ? 'Image' : /^video\//i.test(mt) ? 'Video' : /^audio\//i.test(mt) ? 'Audio' : 'Document';
const a = { type: ty, mediaType: mt, url: x.url };
if (x.name) a.name = String(x.name).slice(0, 1500); // alt text / description (AS2 `name`)
if (x.poster) a.icon = { type: 'Image', url: x.poster }; // the video's still (shaer-zowq)
return a; });
for (const a of openAudio) attachment.push(a); // fedi_open tracks → native Audio players
// Inline @user@host mentions: the Mention tag objects + the mentioned actor URIs. Only
// present when the content was already mention-linked (deliverCreate/Update resolve them
// at send time); a plain buildNote (outbox/notes) yields none.
const _mentionTags = mentionTags(body);
const _mentionCc = _mentionTags.map((t) => t.href);
const note = {
id,
type: 'Note',
attributedTo: aId,
content: titleHtml + body,
url: human,
published: new Date(post.published_at || post.created_at || Date.now()).toISOString(),
// fan_only = "fans only" → followers-only visibility (delivered to your followers
// but not addressed to Public, so Mastodon shows it only to them and can't boost it).
to: (post.fan_only || post.ap_visibility === 'quiet') ? [`${aId}/followers`] : [PUBLIC],
// Mentioned actors (from inline @user@host links the caller resolved) are addressed in cc
// so Mastodon notifies them; empty unless the content was mention-linked (delivery time).
cc: [...new Set([
...(post.ap_visibility === 'quiet' ? [PUBLIC] : []), // quiet public: Public in cc, not to
...((post.fan_only || post.ap_visibility === 'quiet') ? [] : [`${aId}/followers`]),
..._mentionCc])],
tag: [...buildHashtagList(base, post.tags, body), ..._mentionTags],
replies: `${id}/replies`,
// NSFW → Mastodon-style content warning: sensitive (blurs media) + a summary/spoiler
// (hides the whole post behind a "Gevoelige inhoud" button until the reader opens it).
sensitive: !!post.nsfw,
};
// FEP-633c §2.2: object hint that the author is a ward (safely ignorable).
Object.assign(note, Guardianship.hasGuardiansProps(site.slug));
// FEP-044f: this post quotes a fediverse object. Emit it the way the network
// actually reads it, and address the quoted author so they get told.
applyQuoteProps(note, post.quote_uri, post.quote_actor);
if (post.nsfw) note.summary = post.content_warning || 'Gevoelige inhoud';
if (attachment.length) note.attachment = attachment;
// When the cover attachment is suppressed (hosted audio OR an external embed/link-only track →
// so Mastodon shows the player/link card, not media), still expose the cover via AS2 `image` so
// card/grid consumers (the Klonkt Cirkel/News feed) can show it. Mastodon ignores a Note's
// `image`, so its card is unaffected — but a Klonkt receiver reads it (handleInbox o.image).
if (post.cover_image_url && noImages) {
const cov = abs(post.cover_image_url);
if (cov) { note.image = { type: 'Image', mediaType: mediaType(cov), url: cov }; if (post.cover_alt) note.image.name = String(post.cover_alt).slice(0, 1500); }
}
// Experiment (mirrors PeerTube / schema.org `embedUrl`): point at the GATED player page
// (/embed) so a client that honours embedUrl can show an inline player WITHOUT ever
// getting the audio file — the anti-steal posture is untouched. `embedUrl` is a real
// standard field name (not a Klonkt invention); if Mastodon's apps honour it on a Note we
// make it JSON-LD-clean with a context term, otherwise it degrades to the player card.
if (playable) note.embedUrl = `${base}/embed?post=${encodeURIComponent(post.slug)}`;
// Content language → AS2 contentMap (a BCP-47-keyed copy of the content). Mastodon reads the
// language from its key for the timeline language filter + the translate button. Emitted
// alongside `content` (Mastodon sends both); a plain receiver just uses `content`.
if (post.language && /^[a-z]{2,3}(-[A-Za-z]{2,4})?$/.test(post.language)) note.contentMap = { [post.language]: note.content };
// A hosted poll → federate as an AS2 Question (options + live tally). Do this last so it
// reuses the note's content/addressing/tags, then swaps the type and strips media.
const ownPoll = parseOwnPoll(post.poll_json);
if (ownPoll) applyPollToNote(note, post.id, ownPoll);
return note;
}
// All reply note URIs on a local post (inbound fediverse replies + our own
// outbound replies) — backs the Note's `replies` Collection so remote servers
// can fetch the whole thread.
export function getReplyUris(base, postId) {
const out = [];
try {
for (const r of db.prepare("SELECT object_uri FROM ap_interactions WHERE kind = 'reply' AND post_id = ? AND object_uri != '' ORDER BY created_at").all(postId)) out.push(r.object_uri);
for (const r of db.prepare('SELECT id FROM ap_outbox WHERE post_id = ? ORDER BY rowid').all(postId)) out.push(`${base}/ap/notes/${r.id}`);
} catch { /* non-fatal */ }
return out;
}
// Notifications "seen" tracking → a real bell badge. Stored per site in app_settings.
export function markNotificationsSeen(slug) {
try {
db.prepare("INSERT INTO app_settings (key, value, updated_at) VALUES (?, ?, CURRENT_TIMESTAMP) ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = CURRENT_TIMESTAMP")
.run(`fedi_notif_seen:${slug}`, new Date().toISOString());
} catch { /* non-fatal */ }
}
export function countUnseenNotifications(slug) {
try {
const row = db.prepare('SELECT value FROM app_settings WHERE key = ?').get(`fedi_notif_seen:${slug}`);
const seen = row ? Date.parse(row.value) : 0;
let n = 0;
for (const it of getNotifications(slug, 50)) { if (Date.parse(it.created_at) > seen) n++; }
return n;
} catch { return 0; }
}
// The seen-watermark itself (ms epoch, 0 = never marked) — the Messages page reads it
// BEFORE marking seen, so it can render unread dots on the items newer than last visit.
export function notificationsSeenAt(slug) {
try {
const row = db.prepare('SELECT value FROM app_settings WHERE key = ?').get(`fedi_notif_seen:${slug}`);
return row ? (Date.parse(row.value) || 0) : 0;
} catch { return 0; }
}
// Messages = the unified inbox (Reacties + Meldingen merged, decision Robin+Bart 2026-07-16):
// every notification PLUS your own outbound replies ('sent', with edit/delete via their
// outboxId), sorted as one stream. Consecutive likes/boosts on the same post collapse into
// one grouped item (actors list + count) so activity doesn't drown out conversations.
export function getMessages(slug, limit, offset) {
const off = Math.max(0, offset || 0);
const lim = limit || 60;
// The stream is grouped (consecutive likes/boosts collapse), so paging is done by
// recomputing the whole stream top-down and slicing [off, off+lim] — stable across
// pages. Fetch a buffer past off+lim so grouping-shrinkage can't hide a full page.
const need = off + lim + 100;
const items = getNotifications(slug, need);
try {
for (const m of listOutbox(slug).slice(0, need)) {
items.push({
type: 'sent', outboxId: m.id, to_handle: m.to_handle, in_reply_to: m.in_reply_to,
content: m.content, editable: m.editable, language: m.language, created_at: m.created_at,
});
}
} catch { /* ignore */ }
items.sort((a, b) => _msgTs(b) - _msgTs(a)); // NaN-safe (zie getNotifications)
const out = [];
for (const it of items) {
const prev = out[out.length - 1];
if ((it.type === 'like' || it.type === 'announce') && prev && prev.type === it.type
&& prev.post_slug === it.post_slug) {
prev.actors = prev.actors || [prev.name || prev.handle || '?'];
prev.actors.push(it.name || it.handle || '?');
prev.count = (prev.count || 1) + 1;
continue;
}
out.push(it);
}
return out.slice(off, off + lim);
}
export function buildCreate(base, site, post) {
const note = buildNote(base, site, post);
return {
'@context': AP_CONTEXT,
id: note.id + '#create',
type: 'Create',
actor: actorId(base, site.slug),
published: note.published,
to: note.to,
cc: note.cc,
object: note,
};
}
export function buildOutbox(base, site, posts) {
const id = `${actorId(base, site.slug)}/outbox`;
const items = (posts || []).slice(0, MAX_OUTBOX).map((p) => buildCreate(base, site, p));
return {
'@context': AP_CONTEXT,
id,
type: 'OrderedCollection',
totalItems: items.length,
orderedItems: items,
};
}
// Public callers get a count-only collection (privacy). The authenticated
// account owner (a C2S bearer scoped to this site) gets the real actor URIs via
// `items`, so their own client can build a friends list.
export function buildFollowers(base, site, count, items = null) {
const id = `${actorId(base, site.slug)}/followers`;
return {
'@context': AP_CONTEXT,
id,
type: 'OrderedCollection',
totalItems: items ? items.length : (count || 0),
orderedItems: items || [], // count-only for the public; full for the owner
};
}
// The accounts this site follows — count only, mirroring buildFollowers. The spec lists
// `following` as a standard actor property; Hubzilla/Friendica + crawlers expect it.
export function buildFollowing(base, site, count, items = null) {
const id = `${actorId(base, site.slug)}/following`;
return {
'@context': AP_CONTEXT,
id,
type: 'OrderedCollection',
totalItems: items ? items.length : (count || 0),
orderedItems: items || [], // count-only for the public; full for the owner
};
}
// Pinned posts → the actor's `featured` collection. Mastodon reads this and shows
// these as the "Featured" tab (pinned to the profile). Posts come ordered by pin
// rank; embedded as full Notes so a remote server doesn't need extra fetches.
export function buildFeatured(base, site, posts) {
const id = `${actorId(base, site.slug)}/featured`;
const items = (posts || []).map((p) => buildNote(base, site, p));
return {
'@context': AP_CONTEXT,
id,
type: 'OrderedCollection',
totalItems: items.length,
orderedItems: items,
};
}
// ── followers store (lazy stmts) ──────────────────────────────────
let _insF, _updFDisp, _delF, _listF, _cntF;
function fStmts() {
if (!_insF) {
_insF = db.prepare('INSERT OR IGNORE INTO ap_followers (slug, actor_uri, inbox, shared_inbox, name, handle, icon, created_at) VALUES (?,?,?,?,?,?,?,CURRENT_TIMESTAMP)');
_updFDisp = db.prepare('UPDATE ap_followers SET name = COALESCE(?, name), handle = COALESCE(?, handle), icon = COALESCE(?, icon) WHERE slug = ? AND actor_uri = ?');
_delF = db.prepare('DELETE FROM ap_followers WHERE slug = ? AND actor_uri = ?');
_listF = db.prepare('SELECT inbox, shared_inbox FROM ap_followers WHERE slug = ?');
_cntF = db.prepare('SELECT COUNT(*) n FROM ap_followers WHERE slug = ?');
}
return { ins: _insF, del: _delF, list: _listF, cnt: _cntF };
}
export function followerCount(slug) { return fStmts().cnt.get(slug).n; }
// Followers with delivery health, for the management list. Never-delivered accounts
// first, then oldest successful delivery first — i.e. the cleanup candidates on top.
export function listFollowers(slug) {
return db.prepare(
`SELECT id, actor_uri, inbox, shared_inbox, created_at, last_delivery_at, last_error_at
FROM ap_followers WHERE slug = ?
ORDER BY (last_delivery_at IS NULL) DESC, last_delivery_at ASC, created_at ASC`
).all(slug);
}
// Manually drop a follower after a check (a still-live account would have to re-follow).
export function removeFollower(slug, id) {
const info = db.prepare('DELETE FROM ap_followers WHERE slug = ? AND id = ?').run(slug, id);
return info.changes > 0;
}
// Best cached display for an actor URI, across the caches Klonkt already fills:
// followers (now with name/icon), following, interactions, timeline, mentions.
// Falls back to a handle derived from the URI. Display info is not sensitive.
export function actorDisplay(slug, uri) {
const ok = (r) => r && (r.name || r.icon);
try {
let r = db.prepare('SELECT name, handle, icon FROM ap_followers WHERE slug = ? AND actor_uri = ?').get(slug, uri);
if (ok(r)) return { name: r.name, handle: r.handle || deriveHandle(uri), icon: r.icon };
r = db.prepare('SELECT name, handle, icon FROM ap_following WHERE slug = ? AND actor_uri = ?').get(slug, uri);
if (ok(r)) return { name: r.name, handle: r.handle || deriveHandle(uri), icon: r.icon };
r = db.prepare('SELECT actor_name AS name, actor_handle AS handle, actor_icon AS icon FROM ap_interactions WHERE actor_uri = ? AND (actor_name IS NOT NULL OR actor_icon IS NOT NULL) ORDER BY created_at DESC LIMIT 1').get(uri);
if (ok(r)) return { name: r.name, handle: r.handle || deriveHandle(uri), icon: r.icon };
r = db.prepare('SELECT author_name AS name, author_handle AS handle, author_icon AS icon FROM ap_timeline WHERE author_uri = ? AND (author_name IS NOT NULL OR author_icon IS NOT NULL) LIMIT 1').get(uri);
if (ok(r)) return { name: r.name, handle: r.handle || deriveHandle(uri), icon: r.icon };
r = db.prepare('SELECT actor_name AS name, actor_handle AS handle, actor_icon AS icon FROM ap_mentions WHERE actor_uri = ? AND (actor_name IS NOT NULL OR actor_icon IS NOT NULL) ORDER BY created_at DESC LIMIT 1').get(uri);
if (ok(r)) return { name: r.name, handle: r.handle || deriveHandle(uri), icon: r.icon };
} catch { /* ignore */ }
return { name: null, handle: deriveHandle(uri), icon: null };
}
// FEP-9876: does this `Prefer` header ask for enriched (embedded) members?
// Pure and testable; the route sets the response headers around it.
export function prefersEnriched(preferHeader) {
return /(^|[,;\s])return=representation($|[,;\s])/i.test(String(preferHeader || ''));
}
// AS2 actor reference with display, for the owner C2S followers/following view.
// preferredUsername = the local part of the handle; name = the set display name.
export function buildActorRef(slug, uri) {
const d = actorDisplay(slug, uri);
const user = d.handle && d.handle[0] === '@' ? d.handle.slice(1).split('@')[0] : null;
const out = { id: uri, type: 'Person' };
if (d.name) out.name = d.name;
if (user) out.preferredUsername = user;
if (d.icon) out.icon = { type: 'Image', url: d.icon };
return out;
}
// Merge who-you-follow (ap_following, rich display) with who-follows-you (ap_followers,
// delivery health) into ONE connections list, keyed by actor_uri. Each entry gets a
// direction (following →, follower ←, mutual ↔) and, for accounts we deliver to, an
// `unreachable` flag (never delivered, or last attempt failed after the last success) so
// the view can split dead connections into their own section. Powers the Connect page.
export function listConnections(slug) {
const byUri = new Map();
for (const f of listFollowing(slug)) {
byUri.set(f.actor_uri, {
actor_uri: f.actor_uri, name: f.name || null, handle: f.handle || null,
icon: f.icon || null, url: f.url || null, auto_boost: f.auto_boost ? 1 : 0,
status: f.status || null, following: true, follower: false,
last_delivery_at: null, last_error_at: null, follower_id: null,
});
}
for (const fo of listFollowers(slug)) {
const e = byUri.get(fo.actor_uri);
if (e) { e.follower = true; e.last_delivery_at = fo.last_delivery_at; e.last_error_at = fo.last_error_at; e.follower_id = fo.id; }
else byUri.set(fo.actor_uri, {
actor_uri: fo.actor_uri, name: null, handle: null, icon: null, url: null,
auto_boost: 0, status: null, following: false, follower: true,
last_delivery_at: fo.last_delivery_at, last_error_at: fo.last_error_at, follower_id: fo.id,
});
}
return [...byUri.values()].map((e) => {
e.direction = (e.following && e.follower) ? 'mutual' : (e.following ? 'following' : 'follower');
e.unreachable = e.follower && (!e.last_delivery_at || (!!e.last_error_at && (!e.last_delivery_at || e.last_error_at > e.last_delivery_at)));
return e;
});
}
// ── inbound interactions store (replies / likes / boosts) + our outbound replies ──
let _insI, _delLA, _delReply, _listI, _getI, _insO, _listO, _getO;
// ── moderation tombstones (ap_rejected_objects) ───────────────────
// A reply the owner removed stays removed: its object URI is tombstoned and
// checked at ingest AND by the thread-crawler (else thread-filling would
// re-fetch it). Owner moderation acts on the LOCAL copy, so it also works for
// private notes that authorize_interaction can't fetch (401/404).
let _insRj, _hasRj;
function rjStmts() {
if (!_insRj) {
_insRj = db.prepare('INSERT OR IGNORE INTO ap_rejected_objects (object_uri, post_id, reason) VALUES (?,?,?)');
_hasRj = db.prepare('SELECT 1 FROM ap_rejected_objects WHERE object_uri = ?');
}
return { ins: _insRj, has: _hasRj };
}
export function isRejectedObject(uri) {
if (!uri) return false;
try { return !!rjStmts().has.get(String(uri)); } catch { return false; }
}
// Owner removes an incoming reply: tombstone + delete. Tenancy-scoped: the
// interaction's post must belong to the caller's site.
export function rejectInteraction(site, interactionId, reason) {
if (!site || !site.slug) return { error: 'forbidden' };
const row = iStmts().getI.get(interactionId);
if (!row) return { error: 'not_found' };
const owns = db.prepare('SELECT 1 FROM posts WHERE id = ? AND site_id = (SELECT id FROM sites WHERE slug = ?)')
.get(row.post_id, site.slug);
if (!owns) return { error: 'forbidden' };
if (row.object_uri) { try { rjStmts().ins.run(row.object_uri, row.post_id, reason || 'removed by site owner'); } catch { /* non-fatal */ } }
db.prepare('DELETE FROM ap_interactions WHERE id = ?').run(interactionId);
console.log('[AP] interaction removed by owner', site.slug, row.object_uri || row.actor_uri);
return { ok: true, object_uri: row.object_uri || null, actor_uri: row.actor_uri || null };
}
// Stored URIs of an interaction (tenancy-scoped) → feed sendReport for flagging
// from the local copy (works for private notes; no remote fetch needed to target).
export function interactionReportTarget(site, interactionId) {
if (!site || !site.slug) return null;
const row = iStmts().getI.get(interactionId);
if (!row) return null;
const owns = db.prepare('SELECT 1 FROM posts WHERE id = ? AND site_id = (SELECT id FROM sites WHERE slug = ?)')
.get(row.post_id, site.slug);
if (!owns) return null;
return { objectUri: row.object_uri || null, actorUri: row.actor_uri || null };
}
// AP addressing → visibility: 'public' | 'unlisted' | 'followers' | 'direct'.
// Mastodon-conventie: Public in `to` = public, Public in `cc` = unlisted, een
// followers-collectie zonder Public = followers-only, anders direct (DM). Public
// kan als volledige URI, 'as:Public' of 'Public' voorkomen (JSON-LD shorthands).
export function noteVisibility(o) {
const arr = (v) => (Array.isArray(v) ? v : (v ? [v] : []));
const isPub = (u) => u === PUBLIC || u === 'as:Public' || u === 'Public';
const to = arr(o && o.to).map(String);
const cc = arr(o && o.cc).map(String);
if (to.some(isPub)) return 'public';
if (cc.some(isPub)) return 'unlisted';
if ([...to, ...cc].some((u) => /\/followers\/?$/.test(u))) return 'followers';
return 'direct';
}
/**
* Does this note belong in the home timeline (de Krant)?
*
* Only if it is a POST. A direct note is addressed to named people, so it is a
* message: a plain DM, a ward's 🛟 help request (FEP-633c 5.2.1) or a
* guardian's wave. Those are stored as mentions instead and surface in
* Berichten and the Guardian PWA. A reply belongs to its thread, not the feed.
*/
export function belongsInTimeline(o) {
if (!o || !o.id || o.inReplyTo) return false;
return noteVisibility(o) !== 'direct';
}
function iStmts() {
if (!_insI) {
_insI = db.prepare('INSERT OR IGNORE INTO ap_interactions (kind, post_id, object_uri, actor_uri, actor_name, actor_handle, actor_url, actor_icon, content, published, parent_uri, visibility, emoji_json, actor_emoji_json, created_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,CURRENT_TIMESTAMP)');
_delLA = db.prepare('DELETE FROM ap_interactions WHERE kind = ? AND post_id = ? AND actor_uri = ?');
_delReply = db.prepare("DELETE FROM ap_interactions WHERE kind = 'reply' AND object_uri = ?");
_listI = db.prepare('SELECT id, kind, object_uri, parent_uri, actor_uri, actor_name, actor_handle, actor_url, actor_icon, content, published, created_at, acted_boost, acted_like, visibility, emoji_json, actor_emoji_json FROM ap_interactions WHERE post_id = ? ORDER BY created_at ASC');
_getI = db.prepare('SELECT * FROM ap_interactions WHERE id = ?');
_insO = db.prepare('INSERT INTO ap_outbox (id, site_slug, post_id, post_slug, in_reply_to, to_actor, to_handle, content, language, attachments, created_at) VALUES (?,?,?,?,?,?,?,?,?,?,CURRENT_TIMESTAMP)');
_listO = db.prepare('SELECT * FROM ap_outbox WHERE post_id = ? ORDER BY created_at ASC');
_getO = db.prepare('SELECT * FROM ap_outbox WHERE id = ?');
}
return { ins: _insI, delLA: _delLA, delReply: _delReply, list: _listI, getI: _getI, insO: _insO, listO: _listO, getO: _getO };
}
export function getInteractionById(id) { return iStmts().getI.get(id); }
export function setInteractionBoosted(id, on) {
db.prepare('UPDATE ap_interactions SET acted_boost = ? WHERE id = ?').run(on ? 1 : 0, id);
}
export function setInteractionLiked(id, on) {
db.prepare('UPDATE ap_interactions SET acted_like = ? WHERE id = ?').run(on ? 1 : 0, id);
}
// Your like/boost state on a REMOTE post (interact page toggles).
export function setMyReaction(slug, uri, kind, on) {
if (on) db.prepare('INSERT OR IGNORE INTO ap_my_reactions (site_slug, target_uri, kind) VALUES (?,?,?)').run(slug, uri, kind);
else db.prepare('DELETE FROM ap_my_reactions WHERE site_slug = ? AND target_uri = ? AND kind = ?').run(slug, uri, kind);
}
export function getMyReactions(slug, uri) {
const rows = (slug && uri) ? db.prepare('SELECT kind FROM ap_my_reactions WHERE site_slug = ? AND target_uri = ?').all(slug, uri) : [];
return { liked: rows.some((r) => r.kind === 'like'), boosted: rows.some((r) => r.kind === 'boost') };
}
const localPostExists = (id) => { try { return !!db.prepare('SELECT 1 FROM posts WHERE id = ?').get(id); } catch { return false; } };
// Extract our local post id from a note URL, but only if it's ours (base match).
function postIdFromNoteUrl(url, base) {
const s = String(url || '');
if (base && !s.startsWith(base)) return null;
const m = s.match(/\/ap\/notes\/([^/?#]+)/);
return m ? decodeURIComponent(m[1]) : null;
}
function deriveHandle(actorUri) {
try { const u = new URL(actorUri); const seg = u.pathname.split('/').filter(Boolean).pop() || ''; return `@${seg}@${u.host}`; } catch { return String(actorUri || ''); }
}
function actorInfo(doc, actorUri) {
let host = ''; try { host = new URL(actorUri).host; } catch { /* keep empty */ }
const handle = doc && doc.preferredUsername ? `@${doc.preferredUsername}@${host}` : deriveHandle(actorUri);
const icon = doc && doc.icon ? (doc.icon.url || (Array.isArray(doc.icon) && doc.icon[0] && doc.icon[0].url)) : null;
const name = (doc && (doc.name || doc.preferredUsername)) || handle;
return {
name,
handle,
url: safeUrl((doc && (doc.url || doc.id)) || actorUri) || null,
icon: safeUrl(icon) || null,
// FEP-9098 custom emojis in the display name (":shortcode:"), so the byline
// renders them. Only computed when the name actually has a shortcode.
emojis: /:[A-Za-z0-9_+-]+:/.test(name) ? actorNameEmojis(doc) : undefined,
};
}
// Map ":shortcode:" → image url from an actor doc's Emoji tags (for a custom-
// emoji display name). Undefined when there are none.
function actorNameEmojis(doc) {
const arr = doc && Array.isArray(doc.tag) ? doc.tag : (doc && doc.tag ? [doc.tag] : []);
const out = {};
for (const t of arr) {
if (!t || (Array.isArray(t.type) ? t.type[0] : t.type) !== 'Emoji' || typeof t.name !== 'string' || !t.icon) continue;
const u = t.icon.url || (Array.isArray(t.icon) && t.icon[0] && t.icon[0].url);
if (u) out[t.name] = u;
}
return Object.keys(out).length ? out : undefined;
}
// Given an inReplyTo note URL, find which local post the thread belongs to + the
// note being replied to (parent), so a reply-to-a-comment can be nested.
function findThreadTarget(inReplyTo, base) {
if (!inReplyTo) return null;
const seg = postIdFromNoteUrl(inReplyTo, base); // our /ap/notes/ segment (if ours)
if (seg && localPostExists(seg)) return { post_id: seg, parent_uri: inReplyTo };
if (seg) {
try { const o = db.prepare('SELECT post_id FROM ap_outbox WHERE id = ?').get(seg); if (o && o.post_id) return { post_id: o.post_id, parent_uri: inReplyTo }; } catch { /* ignore */ }
}
try { const row = db.prepare("SELECT post_id FROM ap_interactions WHERE object_uri = ? AND kind = 'reply' LIMIT 1").get(inReplyTo); if (row && row.post_id) return { post_id: row.post_id, parent_uri: inReplyTo }; } catch { /* ignore */ }
return null;
}
// Drop the leading @mention(s) a federated reply carries (the person being replied to),
// so a comment reads "dope tekening ouwe" instead of "@jason@jasonhacky.nl dope …".
// Keeps a leading
`;
}
const replyLang = /^[a-z]{2,3}(-[A-Za-z0-9-]+)?$/.test(String(language || '')) ? language : null;
// Dedup: skip if the exact same reply was already sent (double-submit guard).
// Attachments count toward "the same": two media-only replies share content.
const mediaJson = media.length ? JSON.stringify(media) : null;
const dup = db.prepare('SELECT 1 FROM ap_outbox WHERE site_slug = ? AND IFNULL(in_reply_to, \'\') = ? AND content = ? AND IFNULL(attachments, \'\') = IFNULL(?, \'\') LIMIT 1')
.get(site.slug, parent.object_uri || '', content, mediaJson);
if (dup) { console.log('[AP] outreply skipped (duplicate)'); return { duplicate: true, delivered: 0 }; }
const id = crypto.randomUUID();
iStmts().insO.run(id, site.slug, postId, postSlug || null, parent.object_uri || null, toActorUri, toHandle, content, replyLang, mediaJson);
// Followers-only reply (shaer detail-view): mark the row so buildNote drops
// Public from cc. Default (undefined/'public'/'quiet') stays quiet-public.
if (visibility === 'friends') { try { db.prepare('UPDATE ap_outbox SET visibility = ? WHERE id = ?').run('friends', id); } catch { /* ignore */ } }
const row = iStmts().getO.get(id);
const note = buildReplyNote(base, site, row);
const create = {
'@context': AP_CONTEXT,
id: note.id + '#create', type: 'Create', actor: me,
published: note.published, to: note.to, cc: note.cc, object: note,
};
const keys = getOrCreateKeys(site.slug);
const keyId = `${me}#main-key`;
const inboxes = new Set();
// Everyone the mentions bar kept gets pinged; legacy path = the parent only.
const mentionTargets = kept ? kept.map((k) => k.uri) : (parent.actor_uri ? [parent.actor_uri] : []);
for (const uri of mentionTargets) {
const a = await fetchActor(uri).catch(() => null);
if (a) inboxes.add((a.endpoints && a.endpoints.sharedInbox) || a.inbox);
}
if (parent.threadInbox) inboxes.add(parent.threadInbox); // back-compat (single)
(parent.threadInboxes || []).forEach((i) => inboxes.add(i)); // whole ancestor chain
for (const f of fStmts().list.all(site.slug)) inboxes.add(f.shared_inbox || f.inbox);
mres.inboxes.forEach((i) => inboxes.add(i)); // people @mentioned inline in the reply
inboxes.delete(`${me}/inbox`); // never deliver to ourselves (already in ap_outbox)
inboxes.delete(`${base}/ap/inbox`); // (our own shared inbox) → avoids a self-duplicate
let delivered = 0;
for (const inbox of [...inboxes].filter(Boolean)) {
let ok = false;
try { const st = await deliver(inbox, create, keyId, keys.private_pem); ok = st >= 200 && st < 300; } catch { ok = false; }
if (ok) delivered++;
else enqueueDelivery(site.slug, inbox, create); // durable: retry a briefly-offline recipient (was silently dropped)
}
console.log('[AP] outreply', site.slug, '→', parent.actor_uri, 'delivered', delivered);
return { id, content, delivered };
}
// attributedTo may be a string, an object {id}, or an ARRAY — e.g. a PeerTube Video is
// attributed to [Person (account), Group (channel)]. Pick a usable actor URI (prefer Person).
function actorUriOf(att) {
if (!att) return null;
if (typeof att === 'string') return att;
if (Array.isArray(att)) {
const person = att.find((a) => a && typeof a === 'object' && a.type === 'Person' && a.id);
if (person) return person.id;
for (const a of att) { if (typeof a === 'string') return a; if (a && a.id) return a.id; }
return null;
}
return att.id || null;
}
// Resolve a remote post URL (any fediverse/Klonkt post) into a reply target.
// Returns a parent-shaped object usable by deliverReply(), or null.
export async function resolveRemoteNote(url) {
if (!/^https?:\/\//i.test(String(url || ''))) return null;
const note = await fetchActor(url).catch(() => null); // AP GET (content-negotiates)
if (!note || !note.id) return null;
const att = note.attributedTo;
const actorUri = actorUriOf(att);
if (!actorUri) return null;
const actor = await fetchActor(actorUri).catch(() => null);
const ai = actorInfo(actor, actorUri);
// Is what we're replying to a post (or a comment) on one of OUR posts? If so,
// link our reply to that local post so it shows nested in the post thread.
const localTgt = findThreadTarget(note.id, (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, ''));
// Walk the WHOLE reply chain upward (comment → parent comment → … → root post)
// and collect every ancestor author's inbox, so each participant's server —
// including the original post's author — receives + threads our reply.
const threadInboxes = [];
const seenInbox = new Set();
let cursor = note.inReplyTo, guard = 0;
while (cursor && guard++ < 6) {
const url = typeof cursor === 'string' ? cursor : (cursor && cursor.id);
if (!url) break;
const pn = await fetchActor(url).catch(() => null);
if (!pn) break;
const pa = actorUriOf(pn.attributedTo);
if (pa && pa !== actorUri) {
const paDoc = await fetchActor(pa).catch(() => null);
const inbox = paDoc && ((paDoc.endpoints && paDoc.endpoints.sharedInbox) || paDoc.inbox);
if (inbox && !seenInbox.has(inbox)) { seenInbox.add(inbox); threadInboxes.push(inbox); }
}
cursor = pn.inReplyTo; // climb to the next ancestor
}
// For non-Note objects (PeerTube Video, Article, …) the meaningful label is `name` (the
// title); prepend it so the reply page shows what you're replying to (sanitize cleans it).
let rawHtml = String(note.content || '').replace(/\[\[(track|album|playlist):[^\]]+\]\]/gi, '');
if (note.name && note.type && note.type !== 'Note') rawHtml = `
${note.name}
` + rawHtml;
const images = (Array.isArray(note.attachment) ? note.attachment : [])
.filter((a) => a && a.url && (!a.mediaType || /^image\//i.test(a.mediaType)))
.map((a) => safeUrl(a.url)).filter(Boolean);
// A Klonkt hosted-audio post strips its cover from `attachment` (so Mastodon
// shows the player card, not a loose image) and puts it in `image` instead.
// Same fallback as mediaFromNote() so a boosted music post keeps its cover.
if (!images.length && note.image) {
const im = Array.isArray(note.image) ? note.image[0] : note.image;
const iu = safeUrl(typeof im === 'string' ? im : (im && im.url));
if (iu) images.push(iu);
}
return {
object_uri: safeUrl(note.id) || note.id,
actor_uri: actorUri,
actor_url: ai.url,
actor_handle: ai.handle,
actor_name: ai.name,
actor_icon: ai.icon,
url: note.url || url,
content: HtmlSanitizerService.sanitize(rawHtml), // full, sanitized
sensitive: !!note.sensitive, // remote CW → blur in the Cirkel
cw: note.summary || '',
images,
// Full typed media (incl. video/mp4) for the timeline cache. `images` above is
// image-only for the interact page preview; a boosted video-only post (Loops)
// lost its media entirely because upsertBoostedNote only saw `images`.
media: mediaFromNote(note),
threadInboxes, // every ancestor author's inbox
localPostId: localTgt ? localTgt.post_id : '', // our post this belongs to (if any)
poll: parsePoll(note), // a Question → its options/counts (else null)
preview: HtmlSanitizerService.toPlainText(note.content || '').slice(0, 240),
};
}
// List a site's own outbound fediverse replies (for the manage/delete view).
// The plain editable text of a stored reply (unwrap links → their text, → newline)
// so the manage view can prefill an edit box; the mention is re-added on save.
function outboxEditableText(content) {
return String(content || '')
.replace(//gi, '\n')
.replace(/]*>([\s\S]*?)<\/a>/gi, '$1')
.replace(/<[^>]+>/g, '')
.replace(/</g, '<').replace(/>/g, '>').replace(/&/g, '&')
.trim();
}
export function listOutbox(siteSlug) {
return db.prepare('SELECT id, content, to_handle, in_reply_to, language, created_at FROM ap_outbox WHERE site_slug = ? ORDER BY created_at DESC')
.all(siteSlug).map((r) => { const c = stripLeadingMentions(r.content); return { ...r, content: c, editable: outboxEditableText(c) }; });
}
// Delete one of our outbound replies: send Delete(Tombstone) to recipients + remove it.
export async function deliverOutboxDelete(site, outboxId) {
const row = iStmts().getO.get(outboxId);
if (!row || row.site_slug !== site.slug) return false;
const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
if (base) {
const me = actorId(base, site.slug);
const nid = noteId(base, row.id);
const del = { '@context': AP_CONTEXT, id: `${nid}#delete-${Date.now()}-${rid()}`, type: 'Delete', actor: me, to: [PUBLIC], object: { id: nid, type: 'Tombstone' } };
const keys = getOrCreateKeys(site.slug);
const inboxes = new Set();
if (row.to_actor) { const a = await fetchActor(row.to_actor).catch(() => null); if (a) inboxes.add((a.endpoints && a.endpoints.sharedInbox) || a.inbox); }
for (const f of fStmts().list.all(site.slug)) inboxes.add(f.shared_inbox || f.inbox);
for (const inbox of [...inboxes].filter(Boolean)) {
try { const st = await deliver(inbox, del, `${me}#main-key`, keys.private_pem); if (st >= 200 && st < 300) continue; } catch { /* queue below */ }
enqueueDelivery(site.slug, inbox, del); // durable: a failed comment-delete now retries (was silently dropped)
}
}
db.prepare('DELETE FROM ap_outbox WHERE id = ?').run(outboxId);
return true;
}
// Edit one of our outbound replies: rewrite the stored content (mention re-added + #tags
// re-linked) and send an Update(Note) so recipients refresh their cached copy.
export async function deliverOutboxUpdate(site, outboxId, newText, opts = {}) {
const row = iStmts().getO.get(outboxId);
if (!row || row.site_slug !== site.slug) return false;
const text = String(newText || '').trim();
// Rich edit: same sanitize + enrichment pipeline as deliverReply.
const richClean = opts.html ? HtmlSanitizerService.sanitize(String(opts.html)) : '';
const rich = richClean && HtmlSanitizerService.toPlainText(richClean).trim() ? richClean : '';
if (!text && !rich) return false;
const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
if (!base) return false;
const me = actorId(base, site.slug);
const toActor = row.to_actor ? await fetchActor(row.to_actor).catch(() => null) : null;
const toProfile = row.to_actor ? (actorInfo(toActor, row.to_actor).url || row.to_actor) : '';
const _h = row.to_handle || deriveHandle(row.to_actor);
const toHandle = _h && _h[0] === '@' ? _h : '@' + (_h || '');
// An edit must not drop co-mentions (u02): reuse the OLD content's leading
// mention anchors (the bar's kept list at send time) when present; only fall
// back to rebuilding the single to_actor mention for legacy rows.
const oldPrefix = (String(row.content || '')
.match(/^\s*(?:]*>)?\s*((?:]*class="u-url mention"[^>]*>\s*@[^<]+<\/a>[\s ]*)+)/i) || [])[1] || '';
const mention = oldPrefix || (row.to_actor
? `${escHtml(toHandle)} ` : '');
let content;
let mres;
if (rich) {
mres = await resolveMentionsInText(base, rich);
const processed = linkUrls(linkHashtags(base, mres.html));
if (processed.startsWith('
')) content = processed.replace('
', `
${mention}`);
else if (/^<(blockquote|ul|ol|pre|h[1-6]|div|hr)\b/i.test(processed)) content = `
`;
}
// Language may be updated with the edit; attachments always survive untouched.
const newLang = /^[a-z]{2,3}(-[A-Za-z0-9-]+)?$/.test(String(opts.language || '')) ? opts.language : null;
db.prepare('UPDATE ap_outbox SET content = ?, language = COALESCE(?, language) WHERE id = ?').run(content, newLang, outboxId);
const note = buildReplyNote(base, site, iStmts().getO.get(outboxId));
note.updated = new Date().toISOString();
const update = {
'@context': AP_CONTEXT,
id: `${note.id}#update-${Date.now()}-${rid()}`, type: 'Update', actor: me,
published: note.published, updated: note.updated, to: note.to, cc: note.cc, object: note,
};
const keys = getOrCreateKeys(site.slug);
const inboxes = new Set();
if (toActor) inboxes.add((toActor.endpoints && toActor.endpoints.sharedInbox) || toActor.inbox);
for (const f of fStmts().list.all(site.slug)) inboxes.add(f.shared_inbox || f.inbox);
mres.inboxes.forEach((i) => inboxes.add(i)); // people @mentioned inline in the edit
inboxes.delete(`${me}/inbox`); inboxes.delete(`${base}/ap/inbox`);
let delivered = 0;
for (const inbox of [...inboxes].filter(Boolean)) {
let ok = false;
try { const st = await deliver(inbox, update, `${me}#main-key`, keys.private_pem); ok = st >= 200 && st < 300; } catch { ok = false; }
if (ok) delivered++;
else enqueueDelivery(site.slug, inbox, update); // durable: retry the edit later (was silently dropped)
}
console.log('[AP] outreply edit', site.slug, 'delivered', delivered);
return { ok: true, content, delivered };
}
// ── Fediverse CLIENT: follow accounts + home timeline ─────────────
// Resolve an @user@domain handle to its actor URL via WebFinger.
export async function webfingerResolve(handle) {
const h = String(handle || '').trim().replace(/^@/, '');
const parts = h.split('@');
if (parts.length !== 2 || !parts[0] || !parts[1]) return null;
const acct = `${parts[0]}@${parts[1]}`;
try {
const r = await safeFetch(`https://${parts[1]}/.well-known/webfinger?resource=acct:${encodeURIComponent(acct)}`,
{ headers: { Accept: 'application/jrd+json, application/json' } });
if (!r.ok) return null;
const jrd = await r.json();
const link = (jrd.links || []).find((l) => l.rel === 'self' && /activity\+json|ld\+json/.test(l.type || ''));
return safeUrl(link ? link.href : '') || null;
} catch { return null; }
}
let _insFw, _delFw, _listFw, _accFw, _oneFw, _setAB;
function fwStmts() {
if (!_insFw) {
_insFw = db.prepare('INSERT OR REPLACE INTO ap_following (slug, actor_uri, handle, name, icon, url, inbox, follow_id, status, auto_boost, created_at) VALUES (?,?,?,?,?,?,?,?,?,?,CURRENT_TIMESTAMP)');
_delFw = db.prepare('DELETE FROM ap_following WHERE slug = ? AND actor_uri = ?');
_listFw = db.prepare('SELECT * FROM ap_following WHERE slug = ? ORDER BY created_at DESC');
_accFw = db.prepare("UPDATE ap_following SET status = 'accepted' WHERE follow_id = ?");
_oneFw = db.prepare('SELECT * FROM ap_following WHERE slug = ? AND actor_uri = ?');
_setAB = db.prepare('UPDATE ap_following SET auto_boost = ? WHERE slug = ? AND actor_uri = ?');
}
return { ins: _insFw, del: _delFw, list: _listFw, acc: _accFw, one: _oneFw, setAB: _setAB };
}
export function listFollowing(slug) { return fwStmts().list.all(slug); }
// Toggle auto-boost ("feature") on an account we already follow.
export function setAutoBoost(slug, actorUri, on) {
try { fwStmts().setAB.run(on ? 1 : 0, slug, actorUri); } catch { /* ignore */ }
// Featuring an account → AP-native catch-up so the Cirkel isn't empty until they next
// post (push doesn't backfill history-before-follow). Fire-and-forget pull, sends nothing.
if (on) backfillFromOutbox(slug, actorUri).catch(() => {});
return { ok: true };
}
let _insTl, _listTl, _delTl;
function tlStmts() {
if (!_insTl) {
_insTl = db.prepare('INSERT OR IGNORE INTO ap_timeline (id, slug, author_uri, author_name, author_handle, author_icon, author_url, content, url, published, media_json, nsfw, cw, created_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,CURRENT_TIMESTAMP)');
_listTl = db.prepare('SELECT * FROM ap_timeline WHERE slug = ? ORDER BY COALESCE(published, created_at) DESC LIMIT ? OFFSET ?');
_delTl = db.prepare('DELETE FROM ap_timeline WHERE id = ?');
}
return { ins: _insTl, list: _listTl, del: _delTl };
}
export function getTimeline(slug, limit, offset) { return tlStmts().list.all(slug, limit || 50, offset || 0); }
/**
* The direct notes addressed to this account: a plain DM, a guardian's wave
* (§5), a ward's 🛟 help request (§5.2.1). They live in ap_mentions and NOT in
* the timeline, because a note addressed to named people is a message and not a
* post (belongsInTimeline).
*
* A client that only reads the timeline therefore sees none of them, which is
* exactly what happened to Shaer: Berichten showed your own replies (those come
* from your outbox) and nothing that was said to you. The C2S inbox read serves
* both, so the app has one door for everything that arrives.
*
* A public mention from someone you follow is stored in both tables; those are
* skipped here and stay a post.
*/
export function getDirectMessages(slug, limit) {
try {
return db.prepare(`
SELECT m.object_uri, m.note_url, m.actor_uri, m.actor_name, m.actor_handle, m.actor_icon, m.actor_url,
m.content, m.published, m.created_at, m.wave, m.help_request,
m.emoji_json, m.actor_emoji_json, m.media_json, m.quote_json, m.embed_json
FROM ap_mentions m
WHERE m.slug = ?
AND NOT EXISTS (SELECT 1 FROM ap_timeline t WHERE t.slug = m.slug AND t.id = m.object_uri)
ORDER BY COALESCE(m.published, m.created_at) DESC LIMIT ?`).all(slug, limit || 60);
} catch { return []; }
}
/**
* A stored stamp as an ISO instant. SQLite's CURRENT_TIMESTAMP writes
* 'YYYY-MM-DD HH:MM:SS' in UTC, which Date.parse reads as LOCAL time; on a
* server two hours ahead that dated every message two hours early and put the
* conversation in the wrong order. A `published` from the wire is already ISO
* and passes through untouched.
*/
export function isoStamp(v) {
if (!v) return undefined;
const s = String(v);
if (/^\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}:\d{2}$/.test(s)) return `${s.replace(' ', 'T')}Z`;
const t = Date.parse(s);
return Number.isFinite(t) ? new Date(t).toISOString() : undefined;
}
// Inbox C2S read: a timeline row's media_json ([{url, type}], written on the
// inbound Create) → AS2 `attachment` array, so a client (Shaer) can render a
// friend's images/audio/video natively, exactly like own outbox posts. The
// stored `type` is the mediaType and may be ''. Malformed JSON yields
// undefined and never blocks the item.
export function timelineAttachments(mediaJson) {
try {
const list = mediaJson ? JSON.parse(mediaJson) : [];
const rows = (Array.isArray(list) ? list : [])
.filter((m) => m && m.url)
.map((m) => {
const a = { type: 'Document', mediaType: m.type || undefined, url: m.url };
if (m.poster) a.icon = { type: 'Image', url: m.poster }; // the video's still (shaer-zowq)
return a;
});
return rows.length ? rows : undefined;
} catch { return undefined; }
}
// FEP-9098 custom emojis. Inbound: keep the note's Emoji tags (as JSON) so we
// can serve them back. `extractEmojiTags` returns the JSON to store (or null);
// `timelineEmojis` turns the stored JSON back into an AS2 `tag` array for the
// C2S inbox read, so a client (Shaer) can render :shortcode: as an image.
export function extractEmojiTags(tag) {
const arr = Array.isArray(tag) ? tag : (tag ? [tag] : []);
const emojis = arr.filter((t) => t && (Array.isArray(t.type) ? t.type[0] : t.type) === 'Emoji'
&& typeof t.name === 'string' && t.icon);
return emojis.length ? JSON.stringify(emojis) : null;
}
export function timelineEmojis(emojiJson) {
try { const arr = emojiJson ? JSON.parse(emojiJson) : null; return (Array.isArray(arr) && arr.length) ? arr : undefined; }
catch { return undefined; }
}
// FEP-e232 object links (quotes / inline references). Inbound: keep the note's
// Link tags whose mediaType marks an AP object (the AS2-profiled ld+json, or
// activity+json as its equivalent) as JSON, so the C2S inbox read can serve
// them back and a client (Shaer) can render the quote/reference. Mirrors
// extractEmojiTags. Plain hyperlinks (text/html) and Mentions are dropped.
export function extractObjectLinkTags(tag) {
const arr = Array.isArray(tag) ? tag : (tag ? [tag] : []);
const links = arr.filter((t) => {
if (!t || (Array.isArray(t.type) ? t.type[0] : t.type) !== 'Link') return false;
if (typeof t.href !== 'string' || !t.href) return false;
const mt = String(t.mediaType || '').toLowerCase();
return (mt.startsWith('application/ld+json') && mt.includes('activitystreams'))
|| mt.startsWith('application/activity+json');
});
return links.length ? JSON.stringify(links) : null;
}
export function timelineObjectLinks(linkJson) {
try { const arr = linkJson ? JSON.parse(linkJson) : null; return (Array.isArray(arr) && arr.length) ? arr : undefined; }
catch { return undefined; }
}
// FEP-044f quote posts: a quote is usually NOT an FEP-e232 tag but an
// object-level property. FEP-044f §"how to recognise" lists them all:
// `quote` (the FEP property, a string or an embedded Link/object), and the
// de-facto `quoteUrl` (as:), `quoteUri` (fedibird), `_misskey_quote` (misskey).
// This returns the quoted object's URL from whichever is present.
export function extractQuoteUrl(note) {
if (!note || typeof note !== 'object') return null;
const q = note.quote ?? note.quoteUrl ?? note.quoteUri ?? note['_misskey_quote'];
if (!q) return null;
if (typeof q === 'string') return q || null;
if (typeof q === 'object') return (typeof q.id === 'string' && q.id) || (typeof q.href === 'string' && q.href) || null;
return null;
}
// The note's object-link tags for storage: real FEP-e232 Link tags PLUS any
// FEP-044f object-level quote, normalised to one FEP-e232-shaped Link (rel
// _misskey_quote) so the client's single object-link path renders them all.
// Deduped by href. Returns the JSON to store (or null if the note has neither).
export function extractLinkJson(note) {
const links = [];
const fromTag = extractObjectLinkTags(note && note.tag);
if (fromTag) { try { links.push(...JSON.parse(fromTag)); } catch { /* ignore */ } }
const qUrl = extractQuoteUrl(note);
if (qUrl && !links.some((l) => l && l.href === qUrl)) {
links.push({ type: 'Link', mediaType: 'application/activity+json', href: qUrl,
rel: ['https://misskey-hub.net/ns#_misskey_quote'], name: qUrl });
}
return links.length ? JSON.stringify(links) : null;
}
// The URL of the quoted post, from either an object-level quote (FEP-044f) or a
// quote-rel FEP-e232 Link tag. Used to resolve the embedded quote card.
export function quoteHrefOf(note) {
const direct = extractQuoteUrl(note);
if (direct) return direct;
const arr = Array.isArray(note && note.tag) ? note.tag : (note && note.tag ? [note.tag] : []);
for (const t of arr) {
if (!t || (Array.isArray(t.type) ? t.type[0] : t.type) !== 'Link' || typeof t.href !== 'string') continue;
const rel = Array.isArray(t.rel) ? t.rel : (t.rel ? [t.rel] : []);
if (rel.some((r) => /quote/i.test(String(r)))) return t.href;
}
return null;
}
// Turn the stored quote snapshot back into the object the C2S inbox read serves
// as `shaer:quote`, so the client can render the embedded quote card.
export function timelineQuote(quoteJson) {
try { const q = quoteJson ? JSON.parse(quoteJson) : null; return (q && typeof q === 'object') ? q : undefined; }
catch { return undefined; }
}
// Store the author's display-name emoji map (from actorInfo().emojis) on a
// timeline row, so the byline can render a ":shortcode:" name. No-op when the
// name has no custom emoji (the common case).
function storeAuthorEmoji(id, slug, ai) {
if (!ai || !ai.emojis || !Object.keys(ai.emojis).length) return;
try { db.prepare('UPDATE ap_timeline SET author_emoji_json = ? WHERE id = ? AND slug = ?').run(JSON.stringify(ai.emojis), id, slug); } catch { /* ignore */ }
}
// A display-name emoji map (actorInfo().emojis) → JSON to store, or null.
function emojiJsonOf(map) { return (map && Object.keys(map).length) ? JSON.stringify(map) : null; }
// ── Cirkel = posts from the accounts you auto-boost ("feature an artist") ──
let _abCount, _cirkelPosts, _cirkelMembers;
export function autoBoostCount(slug) {
try { if (!_abCount) _abCount = db.prepare('SELECT COUNT(*) AS n FROM ap_following WHERE slug = ? AND auto_boost = 1'); return _abCount.get(slug).n; } catch { return 0; }
}
export function getCirkelPosts(slug, limit, offset) {
try {
// Cirkel = posts from featured (auto_boost) accounts + posts you boosted
// (t.boosted), mixed by date. One row per note in ap_timeline → no duplicates.
if (!_cirkelPosts) _cirkelPosts = db.prepare(`
SELECT t.id, t.author_uri, t.author_name, t.author_handle, t.author_icon, t.author_url,
t.content, t.url, t.published, t.media_json, t.boosted, t.nsfw, t.cw
FROM ap_timeline t
LEFT JOIN ap_following f ON f.slug = t.slug AND f.actor_uri = t.author_uri
WHERE t.slug = ? AND (f.auto_boost = 1 OR t.boosted = 1)
ORDER BY COALESCE(t.published, t.created_at) DESC, t.rowid DESC
LIMIT ? OFFSET ?`);
return _cirkelPosts.all(slug, limit || 60, offset || 0);
} catch { return []; }
}
export function getCirkelMembers(slug) {
try { if (!_cirkelMembers) _cirkelMembers = db.prepare('SELECT name, url, icon FROM ap_following WHERE slug = ? AND auto_boost = 1 ORDER BY name'); return _cirkelMembers.all(slug); } catch { return []; }
}
// Mark a timeline post as boosted so it shows in the Cirkel (mixed by date).
let _markBoost, _unmarkBoost, _boostedCount;
export function markBoosted(slug, noteId) {
try { if (!_markBoost) _markBoost = db.prepare('UPDATE ap_timeline SET boosted = 1 WHERE slug = ? AND id = ?'); _markBoost.run(slug, noteId); } catch { /* ignore */ }
}
export function unmarkBoosted(slug, noteId) {
try { if (!_unmarkBoost) _unmarkBoost = db.prepare('UPDATE ap_timeline SET boosted = 0 WHERE slug = ? AND id = ?'); _unmarkBoost.run(slug, noteId); } catch { /* ignore */ }
}
let _markLike, _unmarkLike;
export function markLiked(slug, noteId) {
try { if (!_markLike) _markLike = db.prepare('UPDATE ap_timeline SET liked = 1 WHERE slug = ? AND id = ?'); _markLike.run(slug, noteId); } catch { /* ignore */ }
}
export function unmarkLiked(slug, noteId) {
try { if (!_unmarkLike) _unmarkLike = db.prepare('UPDATE ap_timeline SET liked = 0 WHERE slug = ? AND id = ?'); _unmarkLike.run(slug, noteId); } catch { /* ignore */ }
}
export function getTimelineReaction(slug, noteId) {
try { const r = db.prepare('SELECT liked, boosted FROM ap_timeline WHERE slug = ? AND id = ?').get(slug, noteId); return { liked: !!(r && r.liked), boosted: !!(r && r.boosted) }; } catch { return { liked: false, boosted: false }; }
}
// Boost a REMOTE post that may not be in your timeline (you don't follow the author):
// store it in ap_timeline (INSERT OR IGNORE → no dup for followed posts) so it shows in
// the Cirkel with a Boost badge, then flag it boosted.
export function upsertBoostedNote(slug, note) {
if (!slug || !note || !note.object_uri) return;
const id = note.object_uri;
// Prefer the full typed media (incl. video/mp4 — a Loops boost is video-only and
// rendered a bare text tile); fall back to the image-only list for older callers.
const media = (note.media && note.media !== '[]')
? note.media
: JSON.stringify((note.images || []).map((u) => ({ url: u, type: 'image/jpeg' })));
try {
const r = tlStmts().ins.run(id, slug, note.actor_uri || '', note.actor_name || '', note.actor_handle || '',
note.actor_icon || '', note.actor_url || '', note.content || '', note.url || null,
new Date().toISOString(), media, note.sensitive ? 1 : 0, note.cw || null);
if (!r.changes) {
// Row already cached (INSERT OR IGNORE) → refresh it with the freshly
// resolved note. Without this a row cached without its cover (or with
// stale content) stayed stale forever — even boosting again didn't heal it.
// Keep the CACHED media when the resolve yielded none: an empty re-resolve
// used to clobber a good media_json (the followed copy had the video, the
// boost wiped it to []).
db.prepare(`UPDATE ap_timeline SET content = ?, media_json = CASE WHEN ? = '[]' THEN media_json ELSE ? END,
nsfw = ?, cw = ?, url = COALESCE(?, url) WHERE slug = ? AND id = ?`)
.run(note.content || '', media, media, note.sensitive ? 1 : 0, note.cw || null, note.url || null, slug, id);
}
} catch { /* ignore */ }
markBoosted(slug, id);
}
export function boostedCount(slug) {
try { if (!_boostedCount) _boostedCount = db.prepare('SELECT COUNT(*) AS n FROM ap_timeline WHERE slug = ? AND boosted = 1'); return _boostedCount.get(slug).n; } catch { return 0; }
}
// Resolve a Klonkt/AP actor URL from a site root: a Klonkt site's root 302s to
// /ap/users/ (content negotiation; Location may be relative). Used by
// followActor for bare-domain follows.
// NB: the old auto-migration of legacy Cirkels (circle_links -> AP follows) was
// REMOVED on 2026-06-26 — it auto-sent Follows on boot, which violates "the code
// never throws anything into the fediverse automatically" (would surprise-Follow
// for some operators at scale). The dead circle_links table stays as harmless dead
// data; an operator restores an old cirkel by re-following in /following (their click).
async function resolveApActor(siteUrl) {
try {
const r = await fetch(siteUrl, { headers: { Accept: 'application/activity+json' }, redirect: 'manual' });
if (r.status >= 300 && r.status < 400) { const loc = r.headers.get('location'); if (loc) return new URL(loc, siteUrl).href; }
if (r.ok) return siteUrl;
} catch { /* unreachable */ }
return null;
}
// ── Self-heal: re-sync the fediverse cache (ap_timeline) after a DRASTIC update ──
// Runs ONCE per SELFHEAL_VERSION bump — NOT on every boot. Re-fetches each cached
// note and refreshes content + media (recovers covers/edits that were delivered
// during a flux window, e.g. a fleet-wide update), and drops notes that are gone
// (404/410). Bump SELFHEAL_VERSION only on a release that warrants a re-sync.
const SELFHEAL_VERSION = 21; // v21: drop direct notes (🛟 help requests, waves) that were cached as timeline posts
async function fetchNoteAP(url) {
try {
const r = await fetch(url, { headers: { Accept: 'application/activity+json' } });
if (r.status === 404 || r.status === 410) return 404;
if (r.ok) return await r.json();
} catch { /* unreachable */ }
return null;
}
function mediaFromNote(note) {
const atts = (Array.isArray(note.attachment) ? note.attachment : []).map((a) => {
const m = { url: safeUrl(a && a.url), type: (a && a.mediaType) || '' };
// A federated video may carry its poster as an AS2 icon (shaer-zowq).
const iconUrl = a && a.icon && safeUrl(typeof a.icon === 'string' ? a.icon : a.icon.url);
if (iconUrl && /^video\//i.test(m.type)) m.poster = iconUrl;
return m;
}).filter((m) => m.url);
if (!atts.some((m) => !m.type || /image/i.test(m.type)) && note.image) {
const im = Array.isArray(note.image) ? note.image[0] : note.image;
const iu = safeUrl(typeof im === 'string' ? im : (im && im.url));
if (iu) atts.push({ url: iu, type: (im && im.mediaType) || 'image/jpeg' });
}
return JSON.stringify(atts);
}
// FEP-044f, emit side. The mirror of extractQuoteUrl (ingest): when one of our
// own posts quotes a fediverse object, say so in the shapes the network really
// reads. `quote` is the FEP property; quoteUrl / _misskey_quote are the de-facto
// ones Mastodon and Misskey look at, and the FEP-e232 `Link` in `tag` is the
// third form. All three point at the same object, which is what every reader
// expects. The quoted author goes in `cc`, because being quoted without being
// told is exactly the rudeness this FEP is trying to design away.
export function applyQuoteProps(note, quoteUri, quoteActor) {
if (!note || typeof quoteUri !== 'string' || !/^https?:\/\//i.test(quoteUri)) return note;
note.quote = quoteUri;
note.quoteUrl = quoteUri;
note['_misskey_quote'] = quoteUri;
note.tag = [...(note.tag || []), {
type: 'Link',
mediaType: 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"',
href: quoteUri,
rel: ['https://misskey-hub.net/ns#_misskey_quote'],
name: quoteUri,
}];
if (typeof quoteActor === 'string' && /^https?:\/\//i.test(quoteActor)) {
note.cc = [...new Set([...(note.cc || []), quoteActor])];
}
return note;
}
// The first external (non-fediverse) link in a note, resolved to the same card
// shape as a quote: THUMBNAIL ONLY, never the provider's iframe. An arbitrary
// third-party frame inside a kid-safe app is a hole you cannot close again, so
// the embed carries an image and a title and nothing executable.
// Returns the JSON to store, or null when there is nothing worth showing.
export async function resolveExternalEmbed(html) {
const first = firstExternalUrl(html);
if (!first) return null;
const io = EmbedResolver.liveIO({
safeFetch,
detectProvider: (u) => AudioEmbedService.detectProvider(u),
fetchActor,
actorInfo,
});
const card = await EmbedResolver.resolveEmbed(first, io).catch(() => null);
// 'ap' is handled by the quote path; a bare 'link' is not worth a card.
if (!card || card.kind === 'ap' || card.kind === 'link') return null;
const thumb = (card.media || []).find((m) => m && m.url);
if (!thumb && !card.title) return null;
// Title, provider and author name come from a third party. Store them as
// PLAIN TEXT (tags stripped, length-capped), so no renderer downstream has to
// be the one that remembers to escape. A card is a card, not an essay.
const plain = (v) => (v ? HtmlSanitizerService.toPlainText(String(v)).trim().slice(0, 200) : null);
return JSON.stringify({
url: card.url,
kind: card.kind, // 'provider' | 'oembed'
provider: plain(card.provider),
title: plain(card.title),
author: card.author ? { ...card.author, name: plain(card.author.name), handle: plain(card.author.handle) } : null,
media: thumb ? [thumb] : [], // thumbnail only, no html/iframe
});
}
/**
* Does our own post link to a fediverse object? Returns { uri, actor } when the
* first external link resolves to a quotable AP object, else null. Runs once at
* publish time; the answer is stored on the post.
*/
export async function resolveOwnQuote(html) {
const first = firstExternalUrl(html);
if (!first) return null;
const io = EmbedResolver.liveIO({ safeFetch, detectProvider: () => null, fetchActor, actorInfo });
const card = await EmbedResolver.resolveEmbed(first, io).catch(() => null);
if (!card || card.kind !== 'ap' || !card.id) return null;
return { uri: card.id, actor: card.attributedTo || null };
}
/** The first http(s) link in sanitized note HTML that is not a mention/hashtag. */
export function firstExternalUrl(html) {
if (!html || typeof html !== 'string') return null;
for (const m of html.matchAll(/]*href=["']([^"']+)["'][^>]*>/gi)) {
const tag = m[0];
if (/\b(mention|hashtag|u-url)\b/i.test(tag) && /mention|hashtag/i.test(tag)) continue;
const href = m[1];
if (/^https?:\/\//i.test(href)) return href;
}
return null;
}
/** The stored external-embed card, for the C2S read. */
export function timelineEmbed(embedJson, { playback = false } = {}) {
try {
const e = embedJson ? JSON.parse(embedJson) : null;
if (!e || typeof e !== 'object' || !e.url) return undefined;
// The player URL is served ONLY when the playback gate is open (FEP-633c
// 5.6). Deciding it here keeps the provider knowledge in one place: the
// client never needs a list of hosts, it just plays what it is handed.
// Privacy-enhanced variants only: nocookie for YouTube, the instance's own
// player for PeerTube. Without one the card stays a thumbnail.
const player = playback ? playerUrlFor(e.url) : null;
if (player) return { ...e, 'shaer:playerUrl': player };
// The gate is shut and there IS something behind it. Saying so costs
// nothing (the card already shows a video thumbnail) and saves the child
// from tapping a card that will never answer: the app can explain instead
// of doing nothing. It stays a statement of fact, never a way in.
return playerUrlFor(e.url) ? { ...e, 'shaer:playable': true } : e;
} catch { return undefined; }
}
/** The embeddable player for a URL, or null when we will not frame it. */
export function playerUrlFor(url) {
if (typeof url !== 'string') return null;
let p = null;
try { p = AudioEmbedService.detectProvider(url); } catch { p = null; }
if (p && p.provider === 'youtube' && p.id) return `https://www.youtube-nocookie.com/embed/${p.id}?rel=0&modestbranding=1&playsinline=1`;
if (p && p.provider === 'vimeo' && p.id) return `https://player.vimeo.com/video/${p.id}`;
// PeerTube is decentralised, so it is matched by its watch-URL shape rather
// than a provider list. Host chars are validated before it is inlined.
const pt = url.match(/^https?:\/\/([\w.-]+(?::\d+)?)\/(?:w|videos\/watch)\/([\w-]{6,})/i);
if (pt) return `https://${pt[1]}/videos/embed/${pt[2]}`;
return null;
}
// FEP-044f embedded quote card: resolve the quoted post to a compact, sanitised
// snapshot { url, author{name,handle,icon}, content, published, media } so the
// client can render it as a nested card instead of a bare link. Best-effort and
// SSRF-safe (apGetJson): returns null on any failure, and the client falls back
// to the object-link chip. The content goes through the same sanitiser as every
// other note, so the kid-safe guarantees hold.
async function resolveQuote(note) {
const url = quoteHrefOf(note);
if (!url) return null;
const q = await apGetJson(url);
if (!q || typeof q !== 'object') return null;
const authorUri = typeof q.attributedTo === 'string' ? q.attributedTo
: (q.attributedTo && typeof q.attributedTo.id === 'string' ? q.attributedTo.id : null);
const ai = authorUri ? actorInfo(await fetchActor(authorUri), authorUri) : null;
// The quoted post's own FEP-9098 emojis, so :shortcode: renders in the card.
const emojis = {};
try {
for (const e of JSON.parse(extractEmojiTags(q.tag) || '[]')) {
const u = e.icon && (e.icon.url || (Array.isArray(e.icon) && e.icon[0] && e.icon[0].url));
if (typeof e.name === 'string' && u) emojis[e.name] = u;
}
} catch { /* ignore */ }
let media = []; try { media = JSON.parse(mediaFromNote(q)); } catch { /* ignore */ }
const snapshot = {
url: safeUrl(q.url || q.id || url) || url,
author: ai ? { name: ai.name, handle: ai.handle, icon: ai.icon } : null,
content: HtmlSanitizerService.sanitize(q.content || ''),
published: q.published || null,
media,
emojis: Object.keys(emojis).length ? emojis : undefined,
};
return JSON.stringify(snapshot);
}
/**
* The card under a post: a fediverse quote (FEP-044f) when the note has one,
* otherwise an external link preview. Both render as the SAME card, so only one
* of the two is ever stored. Returns {column, json} or null.
*
* Both halves reach out over the network, which is why every caller runs this
* out of band: an inbox answer must never wait on a third party.
*/
async function resolveCard(o) {
if (quoteHrefOf(o)) {
const qj = await resolveQuote(o);
return qj ? { column: 'quote_json', json: qj } : null;
}
const ej = await resolveExternalEmbed(o && o.content);
return ej ? { column: 'embed_json', json: ej } : null;
}
// A generic SSRF-safe AP GET (collections / pages).
async function apGetJson(url) {
try {
const r = await safeFetch(url, { headers: { Accept: 'application/activity+json' } });
if (!r.ok) return null;
const len = Number(r.headers.get('content-length') || 0);
if (len > 3_000_000) return null;
return await r.json();
} catch { return null; }
}
// AP-native catch-up: pull an actor's standard `outbox` collection and merge their recent
// top-level posts into the timeline for `slug`. Push (Create delivery) cannot backfill
// history-from-before-you-followed or a delivery that was missed while you were down;
// reading the outbox is the spec-conform way to catch up. PULL ONLY — sends nothing.
export async function backfillFromOutbox(slug, actorUri, limit = 20) {
try {
if (!slug || !actorUri) return 0;
const actor = await fetchActor(actorUri);
if (!actor || !actor.outbox) return 0;
let page = await apGetJson(typeof actor.outbox === 'string' ? actor.outbox : actor.outbox.id);
let items = (page && (page.orderedItems || page.items)) || [];
if (!items.length && page && page.first) {
page = await apGetJson(typeof page.first === 'string' ? page.first : page.first.id);
items = (page && (page.orderedItems || page.items)) || [];
}
if (!Array.isArray(items) || !items.length) return 0;
const ai = actorInfo(actor, actorUri);
let added = 0;
for (const it of items.slice(0, limit)) {
// Each item is usually a Create wrapping a Note, or sometimes the Note itself.
const o = (it && typeof it.object === 'object' && it.object) ? it.object : it;
if (!o || !o.id) continue;
if (o.type && o.type !== 'Note' && o.type !== 'Article' && o.type !== 'Question') continue; // skip boosts/other
if (o.inReplyTo) continue; // top-level only
const auth = actorUriOf(o.attributedTo);
if (auth && auth !== actorUri) continue; // their OWN posts only
const html = HtmlSanitizerService.sanitize(o.content || '');
const poll = parsePoll(o); // a Question (poll) → carry its options/counts on backfill too
try {
const r = tlStmts().ins.run(o.id, slug, actorUri, ai.name, ai.handle, ai.icon, ai.url, html, o.url || null, o.published || null, mediaFromNote(o), o.sensitive ? 1 : 0, o.summary || null);
if (r && r.changes > 0) added++;
// FEP-9098: keep custom-emoji tags from backfilled posts too.
{ const ej = extractEmojiTags(o.tag); if (ej) { try { db.prepare('UPDATE ap_timeline SET emoji_json = ? WHERE id = ? AND slug = ?').run(ej, o.id, slug); } catch { /* ignore */ } } }
storeAuthorEmoji(o.id, slug, ai); // custom-emoji display name for the byline
// FEP-e232 + FEP-044f: keep object-link/quote tags from backfilled posts too.
{ const lj = extractLinkJson(o); if (lj) { try { db.prepare('UPDATE ap_timeline SET link_json = ? WHERE id = ? AND slug = ?').run(lj, o.id, slug); } catch { /* ignore */ } } }
// FEP-044f: resolve the embedded quote card for backfilled posts too.
if (quoteHrefOf(o)) { const qj = await resolveQuote(o); if (qj) { try { db.prepare('UPDATE ap_timeline SET quote_json = ? WHERE id = ? AND slug = ?').run(qj, o.id, slug); } catch { /* ignore */ } } }
// Set poll_json if this is a poll and we don't already have it (COALESCE preserves a vote).
if (poll) { try { db.prepare('UPDATE ap_timeline SET poll_json = COALESCE(poll_json, ?) WHERE id = ? AND slug = ?').run(JSON.stringify(poll), o.id, slug); } catch { /* ignore */ } }
} catch { /* ignore */ }
}
if (added) console.log('[AP] outbox backfill', actorUri, '→', slug, '+' + added);
return added;
} catch { return 0; }
}
// ── Remote thread crawl (fill the gaps in a local post's conversation) ────────────
// Most replies reach us by delivery, but replies-to-replies that live on other servers and
// aren't addressed to us are missed. This pulls the AS2 `replies` collections of the replies
// we DO have, caching any newly-found ones in ap_interactions.
//
// Matches Mastodon's behaviour: ONE level per crawl (like its FetchRepliesService), not a deep
// recursive walk. Deeper levels fill in incrementally across crawls — once a fetched reply is
// cached it becomes a seed itself, so its own replies are pulled on a later view (Mastodon's
// per-status cascade). Bounded + polite (serial), PULL only, and stale-while-revalidate: it
// never runs in a page request — the view renders from cache; a stale post kicks off a
// background refresh for the NEXT view.
const THREAD_TTL_MS = 15 * 60 * 1000; // don't re-crawl a post more than ~4×/hour
const THREAD_MAX_DEPTH = 1; // one hop per crawl (like Mastodon); deeper fills in over crawls
const THREAD_MAX_FETCHES = 30; // hard cap on remote GETs per crawl (be a good peer)
const _crawlingThreads = new Set(); // per-post in-flight lock (no stampede across views)
function threadCrawlTs(postId) {
try { const r = db.prepare('SELECT value FROM app_settings WHERE key = ?').get('thread_crawl:' + postId); return r ? (Number(r.value) || 0) : 0; }
catch { return 0; }
}
function setThreadCrawlTs(postId, ts) {
try { db.prepare('INSERT INTO app_settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value').run('thread_crawl:' + postId, String(ts)); }
catch { /* ignore */ }
}
// Read a note's `replies` (string ref / Collection with `first` / paged CollectionPages) →
// child note URIs. Every remote GET goes through `budget` so the whole crawl stays capped.
async function collectReplyItems(repliesRef, maxPages, budget) {
const uris = [];
let node = typeof repliesRef === 'string' ? await budget.get(repliesRef) : repliesRef;
if (node && node.first) node = typeof node.first === 'string' ? await budget.get(node.first) : node.first;
let pages = 0;
while (node && pages++ < maxPages) {
for (const it of (node.items || node.orderedItems || [])) {
const u = typeof it === 'string' ? it : (it && it.id);
if (u && /^https?:\/\//i.test(u)) uris.push(u);
}
if (!node.next) break;
node = typeof node.next === 'string' ? await budget.get(node.next) : node.next;
}
return uris;
}
async function crawlThread(postId) {
const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
if (!base) return;
// Seed frontier = the remote reply note URIs we already have; also the dedup set.
let known;
try { known = new Set(db.prepare("SELECT object_uri FROM ap_interactions WHERE post_id = ? AND kind = 'reply' AND object_uri != ''").all(postId).map((r) => r.object_uri)); }
catch { return; }
const seeds = [...known].filter((u) => /^https?:\/\//i.test(u));
if (!seeds.length) return; // nothing remote to expand
// Owner-removed replies (tombstones) join the dedup set AFTER seeding, so the
// crawler never re-adds them via thread-filling (they're gone from the seeds
// already because rejectInteraction deleted their ap_interactions row).
try { for (const r of db.prepare('SELECT object_uri FROM ap_rejected_objects WHERE post_id = ?').all(postId)) known.add(r.object_uri); }
catch { /* table always exists after boot migration */ }
let fetches = 0;
const budget = { get: async (u) => { if (fetches >= THREAD_MAX_FETCHES) return null; fetches++; return apGetJson(u); } };
const visited = new Set(); // notes whose replies collection we've already expanded
let frontier = seeds.slice();
let added = 0;
for (let depth = 0; depth < THREAD_MAX_DEPTH && frontier.length && fetches < THREAD_MAX_FETCHES; depth++) {
const nextFrontier = [];
for (const noteUri of frontier) {
if (visited.has(noteUri) || fetches >= THREAD_MAX_FETCHES) continue;
visited.add(noteUri);
const note = await budget.get(noteUri);
if (!note || !note.replies) continue;
const childUris = await collectReplyItems(note.replies, 2, budget);
for (const cu of childUris) {
if (known.has(cu) || fetches >= THREAD_MAX_FETCHES) continue;
known.add(cu);
const child = await budget.get(cu);
if (!child || !child.id || (child.type !== 'Note' && child.type !== 'Article')) continue;
if (isRejectedObject(child.id)) continue; // note id can differ from the collection URI (redirects)
const actorUri = actorUriOf(child.attributedTo);
if (!actorUri || isBlockedAny(actorUri)) continue; // skip blocked authors
const actor = await budget.get(actorUri); // may be null if budget spent → fallback handle
const ai = actorInfo(actor, actorUri);
const html = HtmlSanitizerService.sanitize(child.content || '');
// The child replies to `note` by construction (it's in note's replies collection).
try { iStmts().ins.run('reply', postId, child.id, actorUri, ai.name, ai.handle, ai.url, ai.icon, html, child.published || null, note.id || noteUri, noteVisibility(child), extractEmojiTags(child.tag), emojiJsonOf(ai.emojis)); added++; } catch { /* ignore */ }
nextFrontier.push(child.id); // expand this reply's own replies next depth
}
}
frontier = nextFrontier;
}
if (added) console.log('[AP] thread crawl', postId, '+' + added, 'remote replies (' + fetches + ' fetches)');
}
// Stale-while-revalidate entry point: call from the post view. Renders nothing, blocks nothing —
// fires a background crawl only if this post hasn't been crawled within the TTL.
export function maybeCrawlThread(postId) {
if (!postId || _crawlingThreads.has(postId)) return;
if (Date.now() - threadCrawlTs(postId) < THREAD_TTL_MS) return;
_crawlingThreads.add(postId);
setThreadCrawlTs(postId, Date.now()); // optimistic mark so concurrent/next views don't re-fire
crawlThread(postId).catch((e) => console.warn('[AP] thread crawl failed:', e && e.message)).finally(() => _crawlingThreads.delete(postId));
}
let _selfHealing = false;
export async function selfHealTimeline() {
if (_selfHealing) return; _selfHealing = true;
try {
let cur = 0;
try { const r = db.prepare('SELECT value FROM app_settings WHERE key = ?').get('selfheal_version'); cur = r ? (parseInt(r.value, 10) || 0) : 0; } catch { return; }
if (cur >= SELFHEAL_VERSION) return; // already healed for this version — skip on normal boots
// v21: direct notes used to land in the timeline as if they were posts, so a
// ward's 🛟 help request showed up in the guardian's Krant. The insert now
// refuses them; drop the ones already cached. Scoped to the two kinds we can
// still recognise afterwards (help request, wave) — a plain public mention
// from someone you follow IS a timeline post and must stay.
try {
const r = db.prepare(`DELETE FROM ap_timeline WHERE EXISTS (
SELECT 1 FROM ap_mentions m
WHERE m.object_uri = ap_timeline.id AND m.slug = ap_timeline.slug
AND (m.help_request = 1 OR m.wave = 1))`).run();
if (r.changes) console.log(`[AP] self-heal v21: ${r.changes} direct note(s) removed from the timeline`);
} catch { /* table may predate the columns */ }
let rows = [];
try { rows = db.prepare('SELECT id, slug, content, media_json, nsfw, cw, url, emoji_json, link_json, quote_json, author_uri, author_name, author_emoji_json, reblog_name, reblog_handle, reblog_emoji_json, embed_json FROM ap_timeline ORDER BY rowid DESC LIMIT 200').all(); } catch { /* no table */ }
let healed = 0, failed = 0;
for (const r of rows) {
// Link previews first, and deliberately BEFORE the note re-fetch. A
// preview is resolved from the content we already hold, so hanging it
// behind a remote fetch meant one unreachable origin skipped the whole
// row (`continue` below) and the card never appeared. It needs nothing
// from the origin, so it must not depend on it.
if (!r.quote_json && !r.embed_json) {
try {
const ej = await resolveExternalEmbed(r.content);
if (ej) db.prepare('UPDATE ap_timeline SET embed_json = ? WHERE id = ?').run(ej, r.id);
} catch { /* best-effort, never blocks the heal */ }
}
try {
const note = await fetchNoteAP(r.id);
if (note === 404) { db.prepare('DELETE FROM ap_timeline WHERE id = ?').run(r.id); healed++; continue; }
if (!note || typeof note !== 'object') { failed++; continue; } // origin unreachable right now
const html = HtmlSanitizerService.sanitize(note.content || '');
const media = mediaFromNote(note);
const nsfw = note.sensitive ? 1 : 0; // re-sync NSFW/sensitive + CW onto already-cached posts
const cw = note.summary || null;
const url = note.url || null; // re-sync the human url (catches a remote slug rename)
const emoji = extractEmojiTags(note.tag); // FEP-9098: re-capture custom-emoji tags (v8)
const link = extractLinkJson(note); // FEP-e232 + FEP-044f: re-capture object-link/quote tags (v9)
// FEP-044f: resolve the embedded quote card (v11). COALESCE-style: keep a
// cached snapshot if the quoted post is momentarily unreachable now.
const quote = quoteHrefOf(note) ? (await resolveQuote(note)) || r.quote_json || null : null;
if ((html && html !== r.content) || media !== (r.media_json || '[]') || nsfw !== (r.nsfw || 0) || (cw || '') !== (r.cw || '') || (url && url !== r.url) || (emoji || '') !== (r.emoji_json || '') || (link || '') !== (r.link_json || '') || (quote || '') !== (r.quote_json || '')) {
db.prepare('UPDATE ap_timeline SET content = ?, media_json = ?, nsfw = ?, cw = ?, url = COALESCE(?, url), emoji_json = ?, link_json = ?, quote_json = ? WHERE id = ?').run(html || r.content, media, nsfw, cw, url, emoji, link, quote, r.id);
healed++;
}
// v13: a custom-emoji display name needs the author's emoji map. Fetch
// the actor once, only for rows whose name has a shortcode and no map yet.
if (/:[A-Za-z0-9_+-]+:/.test(r.author_name || '') && !r.author_emoji_json && r.author_uri) {
const ai = actorInfo(await fetchActor(r.author_uri), r.author_uri);
if (ai.emojis) { try { db.prepare('UPDATE ap_timeline SET author_emoji_json = ? WHERE id = ?').run(JSON.stringify(ai.emojis), r.id); } catch { /* ignore */ } }
}
// v14: same for the booster's display name ("X boosted"). The row stores
// no booster URI, so resolve it from the handle via webfinger. Scoped to
// this exact row (slug) since a note can be boosted by different people.
if (/:[A-Za-z0-9_+-]+:/.test(r.reblog_name || '') && !r.reblog_emoji_json && r.reblog_handle) {
const bUri = await webfingerResolve(r.reblog_handle);
const em = bUri ? actorNameEmojis(await fetchActor(bUri)) : undefined;
if (em) { try { db.prepare('UPDATE ap_timeline SET reblog_emoji_json = ? WHERE id = ? AND slug = ?').run(JSON.stringify(em), r.id, r.slug); } catch { /* ignore */ } }
}
} catch { failed++; /* per-note best-effort */ }
}
// Only mark this version DONE after a clean pass. Some origins are briefly
// offline exactly when we heal (phone-hosted instances!): skipping them and
// consuming the version would leave those rows stale forever. Instead retry
// on the next boots, giving up after a few attempts (permanently-dead
// origins answer 404/410 and are deleted above, so they don't loop).
const setSetting = (k, v) => { try { db.prepare('INSERT OR REPLACE INTO app_settings (key, value) VALUES (?, ?)').run(k, String(v)); } catch { /* ignore */ } };
let attempts = 0;
try { const a = db.prepare('SELECT value FROM app_settings WHERE key = ?').get('selfheal_attempts'); attempts = a ? (parseInt(a.value, 10) || 0) : 0; } catch { /* ignore */ }
if (failed === 0 || attempts >= 4) {
setSetting('selfheal_version', SELFHEAL_VERSION);
setSetting('selfheal_attempts', 0);
} else {
setSetting('selfheal_attempts', attempts + 1);
}
if (rows.length) console.log(`[AP] self-heal v${SELFHEAL_VERSION}: ${healed}/${rows.length} timeline notes${failed ? ` (${failed} unreachable — will retry next boot)` : ''}`);
} catch { /* never block boot */ } finally { _selfHealing = false; }
}
// Follow a fediverse account by @handle (WebFinger → actor → signed Follow).
export async function followActor(site, handle, autoBoost = false) {
const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
if (!base || !site || !site.slug) return { error: 'config' };
// Accept any of: a profile/actor URL, an @user@host handle (WebFinger), or a
// bare site domain (site.com) — for a single-actor site (Klonkt etc.) the root
// resolves to its AP actor, so you can follow a site by just its domain.
const s = String(handle || '').trim();
let actorUrl;
if (/^https?:\/\//i.test(s)) actorUrl = safeUrl(s) || null;
else if (s.includes('@')) actorUrl = await webfingerResolve(s);
else if (/^[a-z0-9.-]+\.[a-z]{2,}/i.test(s)) actorUrl = await resolveApActor('https://' + s.replace(/^\/+|\/+$/g, ''));
else actorUrl = null;
if (!actorUrl) return { error: 'not_found' };
const actor = await fetchActor(actorUrl).catch(() => null);
if (!actor || !actor.id || !actor.inbox) return { error: 'unreachable' };
const ai = actorInfo(actor, actor.id);
const me = actorId(base, site.slug);
const keys = getOrCreateKeys(site.slug);
const followId = `${me}#follow-${Date.now()}-${rid()}`;
fwStmts().ins.run(site.slug, actor.id, ai.handle, ai.name, ai.icon, ai.url, actor.inbox, followId, 'pending', autoBoost ? 1 : 0);
const follow = { '@context': AP_CONTEXT, id: followId, type: 'Follow', actor: me, object: actor.id };
// Deliver via the retry queue: a Follow that fails the first attempt (peer down,
// timeout, transient 5xx) is retried with backoff instead of staying stuck on
// 'pending' forever — the Accept can only come back once the Follow lands.
await deliverWithRetry(site.slug, actor.inbox, follow, `${me}#main-key`, keys.private_pem);
console.log('[AP] follow', site.slug, '→', actor.id);
// Follow + feature in one step → backfill their recent posts into the Cirkel right away.
if (autoBoost) backfillFromOutbox(site.slug, actor.id).catch(() => {});
return { ok: true, name: ai.name, handle: ai.handle, actor: actor.id };
}
// Resolve a profile URL or @handle to a followable remote actor (for the
// authorize_interaction "Follow" flow). Returns display fields + inbox, or null
// when it isn't a reachable actor (e.g. the input was a post, not a profile).
export async function resolveRemoteActor(input) {
const s = String(input || '').trim();
const actorUrl = /^https?:\/\//i.test(s) ? (safeUrl(s) || null) : await webfingerResolve(s);
if (!actorUrl) return null;
const actor = await fetchActor(actorUrl).catch(() => null);
if (!actor || !actor.id || !actor.inbox) return null;
const ai = actorInfo(actor, actor.id);
return { actor_uri: actor.id, actor_name: ai.name, actor_handle: ai.handle, actor_url: ai.url, actor_icon: ai.icon, inbox: actor.inbox };
}
export async function unfollowActor(site, actorUri) {
const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
const me = actorId(base, site.slug);
const keys = getOrCreateKeys(site.slug);
const row = fwStmts().one.get(site.slug, actorUri);
// Undo(Follow) MUST reference the original Follow's real id so the remote can correlate it
// and drop the follow. The old `${me}#follow` fallback never matched anything → the unfollow
// silently failed on the remote. With no stored follow id (legacy row), skip the network Undo
// rather than send an unmatchable one. Deliver durably via the retry queue.
if (row && row.inbox && row.follow_id) {
const undo = { '@context': AP_CONTEXT, id: `${me}/undo/${Date.now()}-${rid()}`, type: 'Undo', actor: me, object: { id: row.follow_id, type: 'Follow', actor: me, object: actorUri } };
deliverWithRetry(site.slug, row.inbox, undo, `${me}#main-key`, keys.private_pem);
} else if (row && row.inbox) {
console.warn('[AP] unfollow', site.slug, '→', actorUri, '— no stored follow id; removed locally only (legacy follow, remote may keep it)');
}
fwStmts().del.run(site.slug, actorUri);
return { ok: true };
}
// FEP-633c §5.3 note (authorized fetch): true when `actorUri` is a committed
// guardian of the local ward `wardSlug` — so a signed GET from it may read the
// ward's non-public history without the guardian appearing as a follower.
export function isWardGuardian(wardSlug, actorUri) {
try { return !!Guardianship.getRelation(wardSlug, 'ward', actorUri); } catch { return false; }
}
// FEP-633c §5.3: the guardians approved a gated follow of their ward. Send the
// Accept to the follower and record them, so delivery (incl. followers-only)
// begins. `pending` is a row from ap_pending_follows.
export async function acceptGatedFollow(pending) {
const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
const slug = pending.ward_slug;
const me = actorId(base, slug);
const keys = getOrCreateKeys(slug);
fStmts().ins.run(slug, pending.follower_uri, pending.follower_inbox, pending.follower_shared_inbox, pending.follower_name, pending.follower_handle, pending.follower_icon);
const original = pending.activity_json ? JSON.parse(pending.activity_json) : { type: 'Follow', actor: pending.follower_uri, object: me };
const accept = { '@context': AP_CONTEXT, id: `${me}#accept-${Date.now()}-${rid()}`, type: 'Accept', actor: me, object: original };
await deliverWithRetry(slug, pending.follower_inbox, accept, `${me}#main-key`, keys.private_pem);
const filled = pending.follower_shared_inbox &&
db.prepare('SELECT 1 FROM ap_followers WHERE slug = ? AND shared_inbox = ? AND actor_uri != ? LIMIT 1').get(slug, pending.follower_shared_inbox, pending.follower_uri);
if (!filled) backfillNewFollower(base, slug, pending.follower_shared_inbox || pending.follower_inbox).catch(() => {});
console.log('[AP] gated Follow accepted', pending.follower_uri, '→ ward', slug);
return { ok: true };
}
// The guardians denied the follow: send a Reject so the follower's server clears
// its pending state, then the caller drops the record.
export async function rejectGatedFollow(pending) {
const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
const slug = pending.ward_slug;
const me = actorId(base, slug);
const keys = getOrCreateKeys(slug);
const original = pending.activity_json ? JSON.parse(pending.activity_json) : { type: 'Follow', actor: pending.follower_uri, object: me };
const reject = { '@context': AP_CONTEXT, id: `${me}#reject-${Date.now()}-${rid()}`, type: 'Reject', actor: me, object: original };
if (pending.follower_inbox) await deliverWithRetry(slug, pending.follower_inbox, reject, `${me}#main-key`, keys.private_pem).catch(() => {});
console.log('[AP] gated Follow rejected', pending.follower_uri, '→ ward', slug);
return { ok: true };
}
// ── Cross-instance follow-approval (FEP-633c §5.3, modelled on the guardian
// offer). Inbound: an Offer(Follow) forwarded by a ward to a guardian (leg
// 2), or a guardian's Accept/Reject coming back to the ward (leg 4). ──────
async function handleFollowApprovalInbox(act, slugParam) {
const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
const type = Array.isArray(act.type) ? act.type[0] : act.type;
const actorUri = typeof act.actor === 'string' ? act.actor : (act.actor && act.actor.id);
// Leg 2: I am a guardian; the object is the Follow to approve. The Offer is
// signed by the ward, so act.actor is the ward.
if (type === 'Offer') {
const fo = (act.object && typeof act.object === 'object') ? act.object : null;
const foType = fo && (Array.isArray(fo.type) ? fo.type[0] : fo.type);
if (!fo || foType !== 'Follow') return false;
const followId = fo.id;
const follower = typeof fo.actor === 'string' ? fo.actor : (fo.actor && fo.actor.id);
const wardUri = actorUri;
if (!followId || !follower || !wardUri) return false;
const recips = (Array.isArray(act.to) ? act.to : (act.to ? [act.to] : [])).filter((x) => typeof x === 'string');
if (slugParam) recips.push(actorId(base, slugParam));
let stored = false;
for (const r of new Set(recips)) {
const gslug = slugFromActorUrl(r);
if (!gslug) continue;
if (!Guardianship.getRelation(gslug, 'guardian', wardUri)) continue; // must actually guard this ward
const wardDoc = await fetchActor(wardUri).catch(() => null);
const fai = actorInfo(await fetchActor(follower).catch(() => null), follower);
Guardianship.follows.recordReview(gslug, { id: followId, wardUri, wardInbox: wardDoc && wardDoc.inbox, follower, followerHandle: fai.handle, followerIcon: fai.icon, followJson: JSON.stringify(fo) });
const L = pushLang(gslug);
pushEvent(gslug, { type: 'guardian', title: i18nT(L, 'push.n_guard_cog_t'), body: i18nT(L, 'push.n_guard_cog_b', { who: fai.name || fai.handle || i18nT(L, 'notif.someone') }), url: `${pushPrefix(gslug)}/guardian` });
stored = true;
}
return stored;
}
// Leg 4: I am the ward; a guardian decided. object is the Follow (id).
const fo = act.object;
const followId = typeof fo === 'string' ? fo : (fo && fo.id);
if (!followId) return false;
const pending = Guardianship.follows.getPending(followId);
if (!pending) return false;
const allGuardians = Guardianship.listGuardians(pending.ward_slug).map((g) => g.other_uri);
if (!allGuardians.includes(actorUri)) return false; // only a real guardian of this ward decides
const decision = type === 'Reject' ? 'reject' : 'approve';
// §3.5: the quorum runs over the AVAILABLE set. The voter itself was
// restored by the one-answer rule when its activity arrived, so answering
// is exactly what counts a guardian back in.
const guardians = Guardianship.availability.availableSet(pending.ward_slug, allGuardians, Date.now());
const r = Guardianship.follows.decide(followId, actorUri, decision, guardians);
try {
if (r.outcome === 'approved') { await acceptGatedFollow(r.follow); Guardianship.follows.remove(followId); }
else if (r.outcome === 'rejected') { await rejectGatedFollow(r.follow); Guardianship.follows.remove(followId); }
} catch { /* delivery is retried */ }
return true;
}
// Leg 3: a guardian in /guardian decides on a forwarded follow; send the
// Accept/Reject back to the ward's inbox (signed by the guardian).
export async function sendFollowDecision(guardianSite, review, decision) {
const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
const me = actorId(base, guardianSite.slug);
const keys = getOrCreateKeys(guardianSite.slug);
const fo = review.follow_json ? JSON.parse(review.follow_json) : { id: review.id, type: 'Follow', actor: review.follower_uri, object: review.ward_uri };
const activity = { '@context': AP_CONTEXT, id: `${me}#followdec-${Date.now()}-${rid()}`, type: decision === 'reject' ? 'Reject' : 'Accept', actor: me, to: [review.ward_uri], object: fo, 'shaer:followApproval': true };
if (review.ward_inbox) await deliverWithRetry(guardianSite.slug, review.ward_inbox, activity, `${me}#main-key`, keys.private_pem);
return { ok: true };
}
// Send a Like or Announce (boost) on a remote note FROM this site.
export async function sendInteraction(site, kind, targetNoteId, authorUri) {
const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
if (!base || !site || !site.slug || !targetNoteId) return { error: 'config' };
const me = actorId(base, site.slug);
const keys = getOrCreateKeys(site.slug);
// 'unboost' = Undo(Announce): retracts a boost so followers' servers remove the
// reblog (matched on actor+object — no record of the original Announce needed).
const fanout = (kind === 'boost' || kind === 'unboost'); // also goes to our followers
const followersCol = `${me}/followers`;
// Address the original author in cc so their server (Mastodon, WordPress/ActivityPub, …)
// attributes the boost to their post and notifies them — without this, a shared-inbox
// receiver has nothing to route the Announce to. Non-fragment activity ids + a `published`
// stamp keep us aligned with what Mastodon emits.
const audience = authorUri ? [followersCol, authorUri] : [followersCol];
let act;
if (kind === 'unboost' || kind === 'unlike') {
// Undo(Announce) retracts a boost; Undo(Like) un-favourites (matched on actor+object,
// no record of the original activity needed — Mastodon honours both).
const inner = kind === 'unboost' ? 'Announce' : 'Like';
act = {
'@context': AP_CONTEXT,
id: `${me}/undo/${Date.now()}-${rid()}`, type: 'Undo', actor: me,
object: { id: `${me}/${inner.toLowerCase()}/${Date.now()}-${rid()}`, type: inner, actor: me, object: targetNoteId },
};
if (kind === 'unboost') { act.to = [PUBLIC]; act.cc = audience; }
} else {
const type = kind === 'boost' ? 'Announce' : 'Like';
act = {
'@context': AP_CONTEXT,
id: `${me}/${type.toLowerCase()}/${Date.now()}-${rid()}`,
type, actor: me, object: targetNoteId,
};
if (type === 'Announce') { act.published = new Date().toISOString(); act.to = [PUBLIC]; act.cc = audience; }
}
const inboxes = new Set();
// Author first, via their PERSONAL inbox (not the shared one) so a multi-user receiver
// routes the Announce/Like to the right post unambiguously.
if (authorUri) { const a = await fetchActor(authorUri).catch(() => null); if (a) inboxes.add(a.inbox || (a.endpoints && a.endpoints.sharedInbox)); }
if (fanout) { for (const f of fStmts().list.all(site.slug)) inboxes.add(f.shared_inbox || f.inbox); }
// Queue each delivery (immediate attempt + backoff retries on failure via ap_delivery)
// instead of a single fire-and-forget POST, so a transient hiccup at the receiver doesn't
// silently lose the boost — same durability a new post (deliverCreate) already gets.
let queued = 0;
for (const inbox of [...inboxes].filter(Boolean)) { deliverWithRetry(site.slug, inbox, act, `${me}#main-key`, keys.private_pem); queued++; }
console.log('[AP]', kind, site.slug, '→', targetNoteId, 'queued', queued, 'inbox(es)');
return { ok: true, delivered: queued };
}
// Notifications inbox: new followers + replies/likes/boosts on this site's posts.
export function getNotifications(slug, limit) {
// Per-source cap scales with the requested limit so Messages can page deep
// (Load more). Bounded so a huge offset can't ask for unbounded rows.
const L = Math.min(1000, Math.max(80, limit || 60));
const out = [];
try {
for (const f of db.prepare('SELECT actor_uri, created_at FROM ap_followers WHERE slug = ? ORDER BY created_at DESC LIMIT ?').all(slug, L)) {
out.push({ type: 'follow', handle: deriveHandle(f.actor_uri), url: f.actor_uri, created_at: f.created_at });
}
} catch { /* ignore */ }
try {
const rows = db.prepare(`
SELECT i.kind, i.actor_name, i.actor_handle, i.actor_url, i.actor_icon, i.content, i.created_at, i.published, i.visibility,
i.emoji_json, i.actor_emoji_json, i.media_json, i.quote_json, i.embed_json,
p.slug AS post_slug, p.title AS post_title
FROM ap_interactions i LEFT JOIN posts p ON p.id = i.post_id
WHERE p.site_id = (SELECT id FROM sites WHERE slug = ?)
ORDER BY i.created_at DESC LIMIT ?
`).all(slug, L);
for (const r of rows) out.push({
type: r.kind, name: r.actor_name, handle: r.actor_handle, url: r.actor_url, icon: r.actor_icon,
content: stripLeadingMentions(r.content), post_slug: r.post_slug, post_title: r.post_title, created_at: r.created_at,
// When the post was written, for display. created_at (when it reached us)
// stays the sort key and the unread watermark: a note that federated late
// is still new to you.
published: r.published,
emoji_json: r.emoji_json, actor_emoji_json: r.actor_emoji_json, // FEP-9098 (messages render)
media_json: r.media_json, quote_json: r.quote_json, embed_json: r.embed_json, // rendered like a Krant post
// followers/direct = a private message to the owner (not on the public thread) → 🔒 in Messages
visibility: r.visibility || 'public',
});
} catch { /* ignore */ }
try {
for (const r of db.prepare('SELECT actor_uri, actor_name, actor_handle, actor_icon, content, objects, created_at FROM ap_reports WHERE slug = ? ORDER BY created_at DESC LIMIT ?').all(slug, L)) {
// The reported objects: our own notes resolve to post links so the owner
// sees WHICH post the report is about; other URIs (e.g. the actor itself)
// are skipped — the report row already names the account.
const about = [];
try {
for (const u of JSON.parse(r.objects || '[]')) {
const m = String(u).match(/\/ap\/notes\/([^/?#]+)/);
if (!m) continue;
const p = db.prepare('SELECT slug, title FROM posts WHERE id = ?').get(decodeURIComponent(m[1]));
if (p) about.push({ slug: p.slug, title: p.title || p.slug });
}
} catch { /* malformed objects json → no links */ }
out.push({ type: 'report', name: r.actor_name, handle: r.actor_handle, url: r.actor_uri, icon: r.actor_icon, content: r.content, objects: about, created_at: r.created_at });
}
} catch { /* ignore */ }
try {
for (const r of db.prepare(`SELECT object_uri, note_url, actor_uri, actor_name, actor_handle, actor_icon, actor_url, content, wave, help_request, created_at, published,
emoji_json, actor_emoji_json, media_json, quote_json, embed_json
FROM ap_mentions WHERE slug = ? ORDER BY created_at DESC LIMIT ?`).all(slug, L)) {
out.push({ type: 'mention', name: r.actor_name, handle: r.actor_handle, url: r.actor_url || r.actor_uri, icon: r.actor_icon, content: stripLeadingMentions(r.content), note_url: r.note_url || r.object_uri, wave: r.wave ? 1 : 0, help_request: r.help_request ? 1 : 0, actorUri: r.actor_uri, created_at: r.created_at, published: r.published,
// Same trimmings a Krant row has, so Berichten renders the post identically.
emoji_json: r.emoji_json, actor_emoji_json: r.actor_emoji_json, media_json: r.media_json, quote_json: r.quote_json, embed_json: r.embed_json });
}
} catch { /* ignore */ }
// Your own polls that have closed → a "results are in" item, derived read-time
// from poll_json (Scheduler marks closed=1) with the tally via ownPollView.
try {
const site = db.prepare('SELECT id FROM sites WHERE slug = ?').get(slug);
if (site) {
const polls = db.prepare(`
SELECT id, slug, title, poll_json FROM posts
WHERE site_id = ? AND poll_json IS NOT NULL
AND json_extract(poll_json, '$.closed') = 1
AND json_extract(poll_json, '$.endTime') IS NOT NULL
ORDER BY json_extract(poll_json, '$.endTime') DESC LIMIT 20`).all(site.id);
for (const p of polls) {
const view = ownPollView(p);
if (!view) continue;
let endTime = null; try { endTime = JSON.parse(p.poll_json).endTime; } catch { /* keep null */ }
out.push({ type: 'poll_done', post_slug: p.slug, post_title: p.title, poll: view, created_at: endTime || null });
}
}
} catch { /* ignore */ }
// NaN-safe sort: one row with a missing/garbled created_at would otherwise make the
// comparator return NaN and scramble the WHOLE ordering (seen live: follow rows landing
// between likes, which also broke Messages' like-grouping).
out.sort((a, b) => _msgTs(b) - _msgTs(a));
return out.slice(0, limit || 60);
}
function _msgTs(x) { const t = Date.parse((x && x.created_at) || ''); return Number.isFinite(t) ? t : 0; }
// ── Blocking / defederation ───────────────────────────────────────
// Extracted to BlocklistService (shared: Klonkt's Block tab + Shaer's "in
// Orbit"). Thin delegations keep every existing caller working.
export function listBlocks(slug) { return Blocklist.listBlocks(slug); }
// True if an actor (or its whole domain) is blocked anywhere on this instance.
// Vote on a remote fediverse poll (a cached Question). A ballot = a Create(Note) carrying only a
// `name` (the chosen option) + inReplyTo the Question, addressed to the poll's author — the
// Mastodon-standard vote. Records our choice locally + optimistically bumps the counts; the
// author's Update(Question) refreshes the authoritative totals when it arrives.
export async function voteOnPoll(site, questionId, choices) {
const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
if (!base || !site || !site.slug || !questionId) return { error: 'config' };
let row; try { row = db.prepare('SELECT author_uri, poll_json FROM ap_timeline WHERE id = ? AND slug = ? LIMIT 1').get(questionId, site.slug); } catch { /* ignore */ }
if (!row || !row.poll_json) return { error: 'not_found' };
let poll; try { poll = JSON.parse(row.poll_json); } catch { return { error: 'not_found' }; }
if (poll.closed) return { error: 'closed' };
if (poll.voted) return { error: 'already' };
const valid = new Set(poll.options.map((o) => o.name));
const picks = (Array.isArray(choices) ? choices : [choices]).map(String).filter((c) => valid.has(c));
if (!picks.length) return { error: 'invalid' };
const chosen = poll.multiple ? [...new Set(picks)] : [picks[0]];
const me = actorId(base, site.slug);
const keys = getOrCreateKeys(site.slug);
const authorUri = row.author_uri || null;
const author = authorUri ? await fetchActor(authorUri).catch(() => null) : null;
const inbox = author && (author.inbox || (author.endpoints && author.endpoints.sharedInbox));
if (!inbox) return { error: 'unreachable' };
for (const name of chosen) {
const nid = `${me}/votes/${Date.now()}-${rid()}`;
const note = { id: nid, type: 'Note', attributedTo: me, to: authorUri ? [authorUri] : [], name, inReplyTo: questionId, published: new Date().toISOString() };
const create = { '@context': AP_CONTEXT, id: `${nid}/activity`, type: 'Create', actor: me, to: note.to, object: note };
deliverWithRetry(site.slug, inbox, create, `${me}#main-key`, keys.private_pem);
}
// Local optimistic update (authoritative counts arrive via the author's Update(Question)).
poll.voted = poll.multiple ? chosen : chosen[0];
for (const o of poll.options) if (chosen.includes(o.name)) o.count = (o.count || 0) + 1;
if (poll.voters != null) poll.voters += 1;
try { db.prepare('UPDATE ap_timeline SET poll_json = ? WHERE id = ? AND slug = ?').run(JSON.stringify(poll), questionId, site.slug); } catch { /* ignore */ }
return { ok: true };
}
// Vote on ANY fediverse poll by URL (the interact page) — no timeline cache needed. Fetches
// the Question fresh, validates the choice(s), and casts the Mastodon-standard ballot (a
// Create(Note) with `name` + inReplyTo) straight to the poll's author. Used for polls you find
// by URL, not just ones from accounts you follow (which go through voteOnPoll via /news).
export async function voteOnRemotePoll(site, questionUrl, choices) {
const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
if (!base || !site || !site.slug || !/^https?:\/\//i.test(String(questionUrl || ''))) return { error: 'config' };
const q = await fetchActor(questionUrl).catch(() => null); // AP GET (SSRF-guarded)
if (!q || q.type !== 'Question' || !q.id) return { error: 'not_found' };
const poll = parsePoll(q);
if (!poll) return { error: 'not_found' };
if (poll.closed) return { error: 'closed' };
const valid = new Set(poll.options.map((o) => o.name));
const picks = (Array.isArray(choices) ? choices : [choices]).map(String).filter((c) => valid.has(c));
if (!picks.length) return { error: 'invalid' };
const chosen = poll.multiple ? [...new Set(picks)] : [picks[0]];
const authorUri = actorUriOf(q.attributedTo);
const author = authorUri ? await fetchActor(authorUri).catch(() => null) : null;
const inbox = author && (author.inbox || (author.endpoints && author.endpoints.sharedInbox));
if (!inbox) return { error: 'unreachable' };
const me = actorId(base, site.slug);
const keys = getOrCreateKeys(site.slug);
for (const name of chosen) {
const nid = `${me}/votes/${Date.now()}-${rid()}`;
const note = { id: nid, type: 'Note', attributedTo: me, to: [authorUri], name, inReplyTo: q.id, published: new Date().toISOString() };
const create = { '@context': AP_CONTEXT, id: `${nid}/activity`, type: 'Create', actor: me, to: note.to, object: note };
deliverWithRetry(site.slug, inbox, create, `${me}#main-key`, keys.private_pem);
}
return { ok: true };
}
// Report a remote post or account to its home instance (moderation). Sends the Mastodon-standard
// AS2 `Flag`: object = [reported account, reported status?], content = the reason, delivered to the
// reported account's inbox so their instance's moderators receive it. objectUri = a post URL (its
// author is resolved + included) OR pass actorUri to report an account directly.
export async function sendReport(site, { objectUri, actorUri, reason }) {
const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
if (!base || !site || !site.slug) return { error: 'config' };
let targetActor = actorUri || null;
let noteUri = null;
if (objectUri && /^https?:\/\//i.test(objectUri)) {
const note = await apGetJson(objectUri).catch(() => null);
if (note && note.id) { noteUri = note.id; if (!targetActor) targetActor = actorUriOf(note.attributedTo); }
else if (!targetActor) return { error: 'not_found' };
}
if (!targetActor || !/^https?:\/\//i.test(targetActor)) return { error: 'not_found' };
const actor = await fetchActor(targetActor).catch(() => null);
const inbox = actor && (actor.inbox || (actor.endpoints && actor.endpoints.sharedInbox)); // personal inbox → their moderators
if (!inbox) return { error: 'unreachable' };
const me = actorId(base, site.slug);
const keys = getOrCreateKeys(site.slug);
const object = [targetActor];
if (noteUri && noteUri !== targetActor) object.push(noteUri);
const flag = {
'@context': AP_CONTEXT,
id: `${me}#report-${Date.now()}-${rid()}`,
type: 'Flag',
actor: me,
content: String(reason == null ? '' : reason).slice(0, 3000),
object, // [account, status?] — Mastodon's Flag shape
to: [targetActor],
};
deliverWithRetry(site.slug, inbox, flag, `${me}#main-key`, keys.private_pem);
return { ok: true };
}
export function isBlockedAny(actorUri) { return Blocklist.isBlockedAny(actorUri); }
// Block an actor (@handle or actor URL) or a whole domain; purges their content.
// The handle resolver is ours; the storage/purge lives in BlocklistService.
export async function blockTarget(site, input) { return Blocklist.blockTarget(site, input, webfingerResolve); }
export function unblock(site, target) { return Blocklist.unblock(site, target); }
// ── Guardianship module wiring (src/services/guardianship/) ────────
// The module owns FEP-633c (context, relations, handshake, queues, the
// direct-note leg); we hand it our AP helpers ONCE and delegate. It never
// imports us back.
function selfActorId(slug) {
const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
return actorId(base, slug);
}
// Deliver one activity to one actor's inbox, signed; queued + retried on any
// hiccup so a slow or briefly-down ward server never loses the offer. Returns
// { delivered, inbox }: delivered=false means the account could not be
// resolved at all (a bad handle) — the offer stays recorded regardless.
export async function deliverToActor(site, actorUri, activity) {
const me = selfActorId(site.slug);
const keys = getOrCreateKeys(site.slug);
const payload = { '@context': AP_CONTEXT, ...activity };
// Co-location is a TRANSPORT detail, never a decision path (Robins regel,
// 29-7). An inbox on this machine is not reachable over HTTP from this
// machine, and should not be, so a local recipient is handed the activity
// straight into the same inbox handler the wire would reach. Everything
// above this line therefore behaves as if every Klonkt were remote: one code
// path, exercised by every deployment, including the checks. Two bugs in one
// day came from having a second, local-only path that hid a broken remote
// one.
const localSlug = localSlugOf(actorUri);
if (localSlug && db.prepare('SELECT 1 FROM sites WHERE slug = ?').get(localSlug)) {
const host = (() => { try { return new URL(selfActorId(site.slug)).host; } catch { return ''; } })();
const req = { body: payload, ip: 'loopback', protocol: 'https', get: () => host, headers: {} };
// The signer is us, and we say so: the actor-versus-signer check runs
// exactly as it does over the wire, so a mismatch fails here too.
const status = await handleInbox(req, localSlug, { id: me }).catch(() => 500);
const ok = status >= 200 && status < 300;
console.log('[AP]', activity.type, ok ? 'delivered (loopback) →' : `got ${status} (loopback) from`, actorUri);
return { delivered: ok, inbox: `${actorUri}/inbox`, loopback: true, status };
}
const a = await fetchActor(actorUri).catch(() => null);
const inbox = a && (a.inbox || (a.endpoints && a.endpoints.sharedInbox));
if (!inbox) {
console.warn('[AP] guardianship: could not resolve an inbox for', actorUri, '(offer recorded, not sent)');
return { delivered: false, inbox: null };
}
try {
const st = await deliver(inbox, payload, `${me}#main-key`, keys.private_pem);
if (st >= 200 && st < 300) { console.log('[AP] guardianship', activity.type, 'delivered →', inbox, st); return { delivered: true, inbox }; }
console.warn('[AP] guardianship', activity.type, 'got', st, 'from', inbox, '→ queued for retry');
} catch (e) { console.warn('[AP] guardianship', activity.type, 'to', inbox, 'failed:', e.message, '→ queued for retry'); }
enqueueDelivery(site.slug, inbox, payload);
return { delivered: true, inbox }; // queued: the retry worker gets it there
}
Guardianship.wireDelivery({
actorId, fetchActor, localActor, deliverTo: deliverToActor, deriveHandle, escHtml, linkUrls, linkHashtags,
getOutboxRow: (id) => iStmts().getO.get(id),
buildReplyNote, AP_CONTEXT, getOrCreateKeys, deliver, enqueueDelivery,
});
/**
* The actor document of a site WE host, read straight from the database.
* Same shape fetchActor returns for anyone else, plus `local: true` so the
* caller can take the loopback instead of a POST to our own hostname.
* Null for an actor we do not host: that one really is fetched.
*/
function localActor(actorUri) {
const slug = localSlugOf(actorUri);
if (!slug) return null;
const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
const site = db.prepare('SELECT * FROM sites WHERE slug = ?').get(slug);
if (!site) return null;
// primary_slug is what buildActor uses to pick '/' over '/user/'; the
// actor route sets it the same way before building.
const p = db.prepare('SELECT slug FROM sites WHERE is_primary = 1').get();
try { return { ...buildActor(base, { ...site, primary_slug: p && p.slug }), local: true }; } catch { return null; }
}
// Which local site (if any) hosts this actor URI — used by the handshake to
// apply the local side of a commit and to derive a ward's existing guardians.
function localSlugOf(actorUri) {
const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
if (!actorUri || !actorUri.startsWith(`${base}/ap/users/`)) return null;
const slug = slugFromActorUrl(actorUri);
if (!slug) return null;
try { return db.prepare('SELECT slug FROM sites WHERE slug = ?').get(slug) ? slug : null; }
catch { return null; }
}
Guardianship.wireHandshake({
selfId: selfActorId,
localSlug: localSlugOf,
deliverTo: deliverToActor,
deriveHandle,
fetchActor,
// Guardian PWA / Berichten push. The kid answers an incoming offer in its
// own Berichten; an existing guardian and a commit land in the PWA.
onEvent: (slug, ev) => {
const L = pushLang(slug);
const texts = {
offer_received: ['push.n_guard_offer_t', 'push.n_guard_offer_b'], // I am the ward
offer_for_ward: ['push.n_guard_cog_t', 'push.n_guard_cog_b'], // I co-guard this ward
committed: ['push.n_guard_ward_t', 'push.n_guard_ward_b'],
// §3.2: a guardian ended the relation. The ward hears that someone who
// was looking after them has gone; a co-guardian hears they are one fewer.
guardian_left: ['push.n_guard_left_t', 'push.n_guard_left_b'],
coguardian_left: ['push.n_guard_cogleft_t', 'push.n_guard_cogleft_b'],
}[ev.kind];
if (!texts) return;
const who = deriveHandle(ev.candidate || ev.guardian || ev.ward || '') || '?';
const url = (ev.kind === 'offer_received' || ev.kind === 'guardian_left') ? `${pushPrefix(slug)}/messages` : '/guardian';
pushEvent(slug, { type: 'guardian', title: i18nT(L, texts[0]), body: i18nT(L, texts[1], { who }), url });
},
});
// The notification duty of FEP-633c 3.6.2, wired once for every place a
// dormancy promotion can happen (queue reads, fan-outs, tallies): marking a
// guardian dormant MUST notify it, in protocol AND over the §6 handle. The
// one-answer rule is worthless to someone who does not know an answer is
// wanted. The handle of a committed guardian is its inbox (§6 minimum), which
// is the same door this delivery knocks on; both attempts are logged.
Guardianship.wireAvailability({
onDormant: (wardSlug, guardianUri) => {
const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
const site = db.prepare('SELECT * FROM sites WHERE slug = ?').get(wardSlug);
if (!base || !site) return;
const me = selfActorId(wardSlug);
const note = {
id: `${me}/dormant/${Date.now().toString(36)}${rid()}`,
type: 'Note', attributedTo: me, to: [guardianUri],
'shaer:dormant': true,
content: '
You have been observed dormant as a guardian. Nothing is wrong and nothing is held against you: one answer restores everything (FEP-633c 3.6.2).