fedipod-server 0.10.0 → 0.12.1

package/README.md

@@ -78,15 +78,24 @@ and stop with the server, and on the websocket handler list for the live feed.
 
 An identity is provisioned when its owner opts in: its name is the pod's
 subdomain label, and it publishes an actor, a signing key and WebFinger on the
-pod itself. Its state lives on the pod. Its signing key lives in
-`agentDataDir`, one directory per identity — and beside it,
-`door-secret.json`: the secret guarding that identity's own pages. Each
-identity has its own; one owner's secret opens nobody else's door.
+pod itself. Everything it is made of lives on its pod — its state, its private
+signing key, the secret guarding its own pages, and the credentials for any
+accounts its owner connects on other servers. Each identity has its own
+secret; one owner's opens nobody else's door. The opt-in reply is where the
+owner is given it.
+
+That is the difference from running FediPod on your own machine, where those
+credentials stay on the machine and never reach the pod. Here the machine is
+the pod's server, so a credential left on it is a connection its owner loses
+the day they take their pod elsewhere.
+
+`agentDataDir` holds what is left: one directory per identity, with the file
+naming the pod the identity runs on. Nothing private is in it.
 
 | Setting | What it is |
 |---|---|
 | `agentRuntimeOptIn` | Whether pod owners can sign up. With it off, nothing runs. |
-| `agentDataDir` | Where each identity keeps its signing key, credential and door secret; its log lines go to the server's own log. Required whenever sign-up is on. |
+| `agentDataDir` | Where each identity keeps the file naming its pod; its log lines go to the server's own log. Required whenever sign-up is on. |
 | `agentUiPath` | Where the owner's pages live on the pod's origin. `/fedipod/` by default; empty serves no pages. |
 | `agentRegistryContainer` | The internal container holding the sign-up rows. |
 | `runPage` | The HTML served at `/run`: the page where a pod owner opts in or out. The package's own `web/front/run.html` is served unless you set this. |
@@ -149,7 +158,7 @@ owner's door, with that identity's own door secret:
 
 ```
 curl -X POST https://mei.example.org/fedipod/config \
-  -H 'x-dk-token: THE_DOOR_SECRET_FROM_door-secret.json' -H 'content-type: application/json' \
+  -H 'x-dk-token: THE_DOOR_SECRET_FROM_THE_OPT_IN_REPLY' -H 'content-type: application/json' \
   -d '{"password":"the one you will type into your phone"}'
 ```
 

package/dist/claims.js

@@ -6,7 +6,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.claims = claims;
 exports.agentClaims = agentClaims;
-const FRONT_PATHS = new Set(['/', '/signup', '/new-account', '/run', '/admin',
+const FRONT_PATHS = new Set(['/', '/signup', '/new-account', '/run', '/roster',
     '/.well-known/webfinger', '/api/handle', '/api/attach', '/api/agent',
     '/api/roster', '/api/revoke',
     // What the pages load: the sign-in library the /run and /admin pages use, and

package/dist/handler.d.ts

@@ -18,7 +18,7 @@ export interface FediPodServerArgs {
     signupPage?: string;
     /** The run-your-identity page HTML served at /run. */
     runPage?: string;
-    /** The accounts-roster page HTML served at /admin. */
+    /** The accounts-roster page HTML served at /roster. */
     adminPage?: string;
     /** Directory holding each agent identity's signing key and log. Required when runtime opt-in is on. */
     agentDataDir?: string;
@@ -91,6 +91,12 @@ export declare class FediPodServerHandler extends HttpHandler implements Initial
     initialize(): Promise<void>;
     /** Stop every identity: timers cleared, state written, lease let go. */
     finalize(): Promise<void>;
+    /**
+     * One identity's door secret, in its own pod's state. `agentDataDir` is
+     * handed in as the place an identity set up before this kept it, so its
+     * owner's existing door link survives the move.
+     */
+    private doorSecretFor;
     private startIdentity;
     /**
      * When this server is also the door, give a running identity a

package/dist/handler.js

@@ -25,9 +25,9 @@ const directory_1 = require("./directory");
 // Two layouts carry that tree: the published package ships its own copy of
 // lib/ beside dist/ (prepack puts it there), and a repo checkout reaches the
 // repo's lib/ three levels up. Prefer the package's own copy when it exists.
-const LIB_ROOT = (0, node_fs_1.existsSync)((0, node_path_1.join)(__dirname, '../lib/embed.mjs')) ? '../lib' : '../../../lib';
-const FRONT_CORE = `${LIB_ROOT}/front-core.mjs`;
-const EMBED = `${LIB_ROOT}/embed.mjs`;
+const LIB_ROOT = (0, node_fs_1.existsSync)((0, node_path_1.join)(__dirname, '../lib/server/embed.mjs')) ? '../lib' : '../../../lib';
+const FRONT_CORE = `${LIB_ROOT}/gateway/front-core.mjs`;
+const EMBED = `${LIB_ROOT}/server/embed.mjs`;
 const esmImport = new Function('s', 'return import(s)');
 // The front's pages and the files they load, carried in the same two layouts
 // as lib/. A missing file is not fatal: the route it feeds answers 404.
@@ -215,6 +215,20 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
             this.logger.info(`FediPod agent @${identity.handle} stopped`);
         }));
     }
+    /**
+     * One identity's door secret, in its own pod's state. `agentDataDir` is
+     * handed in as the place an identity set up before this kept it, so its
+     * owner's existing door link survives the move.
+     */
+    async doorSecretFor(podBase, session, opts = {}) {
+        const { ensureDoorSecret } = await esmImport(EMBED);
+        return ensureDoorSecret(session ?? (0, store_pod_1.makeStoreSession)(this.args.resourceStore, podBase), podBase, {
+            ...opts,
+            dataDir: this.args.agentDataDir,
+            handle: deriveHandle(podBase),
+            log: (message) => { this.logger.info(`@${deriveHandle(podBase)}: ${message}`); },
+        });
+    }
     async startIdentity(podBase) {
         if (this.starting.has(podBase) || this.identities.has(podBase))
             return;
@@ -224,13 +238,13 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         try {
             for (let attempt = 0; !this.stopping && !this.startCancelled.has(podBase); attempt++) {
                 try {
-                    const { startEmbeddedAgent, ensureDoorSecret } = await esmImport(EMBED);
+                    const { startEmbeddedAgent } = await esmImport(EMBED);
                     // The secret is in the map BEFORE the surface can exist, so the
                     // gate's resolver never comes up empty — empty would mean gate-off.
                     if (!this.doorSecrets.has(podBase)) {
-                        const door = ensureDoorSecret(this.args.agentDataDir, deriveHandle(podBase));
+                        const door = await this.doorSecretFor(podBase, session);
                         this.doorSecrets.set(podBase, door.secret);
-                        this.logger.info(`door secret for @${deriveHandle(podBase)} is at ${door.path}`);
+                        this.logger.info(`door secret for @${deriveHandle(podBase)} is in its pod at ${door.url}`);
                     }
                     const identity = await startEmbeddedAgent({
                         podBase,
@@ -344,11 +358,10 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         }
         const base = podBase.endsWith('/') ? podBase : `${podBase}/`;
         const handle = deriveHandle(base);
-        const { ensureDoorSecret } = await esmImport(EMBED);
         // Already running here from an earlier opt-in: proving pod
         // control again buys a fresh secret, nothing else.
         if (this.agentHandles.get(handle) === base) {
-            const door = ensureDoorSecret(this.args.agentDataDir, handle, { rotate: true });
+            const door = await this.doorSecretFor(base, undefined, { rotate: true });
             this.doorSecrets.set(base, door.secret);
             return { httpStatus: 201, ok: true, handle, host: new URL(base).host.toLowerCase(),
                 doorSecret: door.secret, doorPath: this.uiPath, status: 'rotated' };
@@ -371,10 +384,10 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         // until the agent registers its surface.
         this.agentHosts.add(host);
         this.agentHandles.set(handle, base);
-        const door = ensureDoorSecret(this.args.agentDataDir, handle, { rotate: true });
+        const door = await this.doorSecretFor(base, undefined, { rotate: true });
         this.doorSecrets.set(base, door.secret);
         void this.startIdentity(base);
-        this.logger.info(`runtime opt-in: @${handle} on ${base} (door secret at ${door.path})`);
+        this.logger.info(`runtime opt-in: @${handle} on ${base} (door secret in its pod at ${door.url})`);
         return { httpStatus: 201, ok: true, handle, host,
             doorSecret: door.secret, doorPath: this.uiPath, status: 'starting' };
     }
@@ -441,15 +454,48 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
             signupPage: this.args.signupPage || webFile('new-account.html'),
             runPage: this.args.runPage || webFile('run.html'),
             adminPage: this.args.adminPage || webFile('admin.html'),
-            // The /run and /admin pages load the sign-in library, and the signup page
+            // The /run and /roster pages load the sign-in library, and the signup page
             // hands out the installer command; without these the pages render but
             // cannot be used.
             authBundle: webFile('solid-oidc-client.js'),
+            // Each page's own script — inline until 2026-09-09, so that the pages can
+            // be served under `script-src 'self'` (see lib/front-core.mjs).
+            pageScripts: {
+                'new-account.js': webFile('new-account.js'),
+                'run.js': webFile('run.js'),
+                'admin.js': webFile('admin.js'),
+            },
             installScript: webFile('install.sh'),
             lookup: (h) => this.dir.lookup(h),
             putDirectory: (h, rec) => this.dir.putDirectory(h, rec),
             podPut: (_handle, url, body, ct) => this.podPut(url, body, ct),
-            podGet: async (url) => {
+            // Reads for the public proxy. `this.io.read` goes STRAIGHT into the
+            // resource store, which applies no access control of its own — so this is
+            // the one place that has to say what may be read, and it says: only
+            // inside the pod of the handle being served, and never a server-internal
+            // tree. Without it a row could name any location and this would fetch it
+            // (the directory, with every user's receipt secret, included).
+            //
+            // The front now refuses to attach such a row at all (podHomeProblem in
+            // lib/front-core.mjs); this is the same refusal at the other end, because
+            // a row can also arrive from a seed or an older deploy.
+            podGet: async (url, opts) => {
+                const denied = { status: 403, text: async () => '', headers: { get: () => null } };
+                let target;
+                try {
+                    target = new URL(url);
+                }
+                catch {
+                    return denied;
+                }
+                if (/(^|\/)\.internal(\/|$)/u.test(target.pathname))
+                    return denied;
+                // Which pod asked: routeFront reads `rec.podHome + rest` and passes
+                // that podHome here, so the confinement is a value on the call rather
+                // than state on the handler. No podHome, no read.
+                const home = opts?.podHome;
+                if (!home || !url.startsWith(home))
+                    return denied;
                 const raw = await this.io.read(url);
                 return raw == null
                     ? { status: 404, text: async () => '', headers: { get: () => null } }

package/dist/handler.jsonld

@@ -106,7 +106,7 @@
               }
             ]
           },
-          "comment": "The accounts-roster page HTML served at /admin."
+          "comment": "The accounts-roster page HTML served at /roster."
         },
         {
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler_args_agentDataDir",
@@ -312,6 +312,10 @@
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_finalize",
           "memberFieldName": "finalize"
         },
+        {
+          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_doorSecretFor",
+          "memberFieldName": "doorSecretFor"
+        },
         {
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_startIdentity",
           "memberFieldName": "startIdentity"

package/dist/store-pod.js

@@ -28,11 +28,25 @@ function headerReader(init) {
         lower[k.toLowerCase()] = String(v);
     return (n) => lower[n.toLowerCase()] ?? null;
 }
-// Only Turtle needs asking for: a container's listing is quads until something
-// requests a syntax, and listContainer parses Turtle. Everything else is read
-// back exactly as it was written.
+// A container's listing is quads until something requests a syntax, and
+// listContainer parses Turtle, so Turtle has to be askable for. It must not be
+// the ONLY thing asked for: the state tree reads its own documents with
+// `text/turtle, application/json;q=0.9, */*;q=0.8`, and a JSON document
+// demanded as Turtle is refused outright — which is every state document an
+// identity has, the moment it starts on a pod that already holds some.
+// With no Turtle in the accept, no preference: read back as written.
 function preferencesFor(accept) {
-    return accept?.includes('text/turtle') ? { type: { 'text/turtle': 1 } } : {};
+    if (!accept?.includes('text/turtle'))
+        return {};
+    const type = {};
+    for (const part of accept.split(',')) {
+        const [media, ...params] = part.trim().split(';');
+        if (!media)
+            continue;
+        const q = params.map((p) => (/^\s*q=([\d.]+)\s*$/u).exec(p)).find(Boolean);
+        type[media.trim()] = q ? Number(q[1]) : 1;
+    }
+    return { type };
 }
 function isNotFound(e) {
     return community_server_1.NotFoundHttpError.isInstance?.(e) === true || e?.statusCode === 404;

package/lib/{c2s.mjs → client/c2s.mjs}

@@ -15,8 +15,9 @@
 // read their own inbox" is served from there, by this agent, to the owner
 // alone.
 
-import * as social from './social.mjs';
-import * as wire from './wire.mjs';
+import * as social from '../core/social.mjs';
+import * as wire from '../core/wire.mjs';
+import { readLenient } from '../core/as2.mjs';
 
 const MAX_BODY = 512 * 1024;          // same ceiling the inbox drain enforces
 
@@ -190,9 +191,13 @@ export class C2S {
       if (!took) return this.send(res, 503, { error: 'another agent is active for this pod — takeover failed, try again' });
     }
 
+    // Read as JSON-LD, so a client may send its activity with whatever context
+    // it likes and still be understood. One we cannot read that way is read as
+    // plain JSON rather than refused, which is what a client sending ordinary
+    // ActivityStreams has always got.
     let activity;
     try {
-      activity = JSON.parse(await readBody(req));
+      activity = (await readLenient(await readBody(req))).doc;
     } catch (e) {
       return this.send(res, 400, { error: `unreadable body: ${e.message}` });
     }

package/lib/{localapi.mjs → client/localapi.mjs}

@@ -12,8 +12,8 @@
 import https from 'node:https';
 import fs from 'node:fs';
 import path from 'node:path';
-import { rootOf, apRoot } from './home.mjs';
-import { certPaths } from './certs.mjs';
+import { rootOf, apRoot } from '../device/home.mjs';
+import { certPaths } from '../device/certs.mjs';
 
 /**
  * The authorities worth offering for a loopback call: this install's, and the

package/lib/client/masto/accounts.mjs

@@ -0,0 +1,264 @@
+// accounts.mjs — the account endpoints: the owner's credentials and profile
+// editor, follow requests, markers, relationships, search and lookup, block
+// and mute, follow and unfollow, an account and its lists and statuses, and
+// the web-push subscription a client login holds.
+
+import crypto from 'node:crypto';
+import * as podMedia from '../../pod/media.mjs';
+import * as social from '../../core/social.mjs';
+import { readBody } from './body.mjs';
+import { readMultipart } from './media.mjs';
+
+export async function handle(api, ctx) {
+  const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
+
+  if (pathname === '/api/v1/accounts/verify_credentials') {
+    const cfg0 = api.store.getConfig() || {};
+    return send(200, {
+      ...api.selfAccount(),
+      // `source` is what the editor fills its inputs from: the raw text it
+      // will send back, not the HTML the profile renders.
+      source: {
+        privacy: 'public', sensitive: false, language: 'en',
+        note: cfg0.summary || '',
+        fields: (cfg0.fields || []).map(f => ({ name: f.name, value: f.value })),
+      },
+    });
+  }
+
+  // The profile editor. Everything it can send is carried: the name and bio,
+  // both pictures, and the extra fields. An avatar or header arrives as file
+  // bytes, so it goes to the pod's media container first and the actor gets
+  // the URL — the same path a posted attachment takes.
+  if (pathname === '/api/v1/accounts/update_credentials') {
+    if (req.method !== 'PATCH' && req.method !== 'POST') return send(405, { error: 'PATCH expected' });
+    const ct = String(req.headers['content-type'] || '');
+    // readBody already covers JSON and urlencoded; only the file case differs.
+    let form = {}, files = {};
+    if (ct.includes('multipart/form-data')) ({ fields: form, files } = await readMultipart(req));
+    else form = await readBody(req);
+
+    const cfg = { ...api.store.getConfig() };
+    const putImage = async (f) => {
+      const ext = (f.filename || '').includes('.')
+        ? f.filename.split('.').pop().replace(/[^\w]/g, '') : 'bin';
+      const slug = new Date().toISOString().slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex') + '.' + ext;
+      const url = api.urls.media + slug;
+      await api.agent.publisher.ensureMediaContainer();
+      await podMedia.write(api.agent.remote, url, f.data, f.contentType);
+      return url;
+    };
+
+    if ('display_name' in form) cfg.name = String(form.display_name).trim() || cfg.handle;
+    if ('note' in form) cfg.summary = String(form.note) || undefined;
+    if ('locked' in form) cfg.approveJoins = form.locked === 'true' || form.locked === true;
+    if (files.avatar?.data?.length) cfg.icon = await putImage(files.avatar);
+    if (files.header?.data?.length) cfg.image = await putImage(files.header);
+
+    // fields_attributes arrives as fields_attributes[0][name] etc. A row with
+    // no name is how the editor says "delete this one", so it is dropped.
+    const rows = [];
+    for (const [k, v] of Object.entries(form)) {
+      const m = /^fields_attributes\[(\d+)\]\[(name|value)\]$/.exec(k);
+      if (!m) continue;
+      (rows[Number(m[1])] ||= {})[m[2]] = String(v);
+    }
+    if (rows.length) cfg.fields = rows.filter(r => r && r.name?.trim())
+      .map(r => ({ name: r.name.trim(), value: (r.value || '').trim() }));
+
+    api.store.setConfig(cfg);
+    Object.assign(api.agent.publisher.config, {
+      name: cfg.name, summary: cfg.summary, icon: cfg.icon, image: cfg.image,
+      fields: cfg.fields, approveJoins: !!cfg.approveJoins,
+    });
+    await api.store.flush();
+    // publishProfile says whether the world can actually read the actor it
+    // just wrote. Discarding that reported success for a save that left the
+    // account undiscoverable — the one outcome the caller needed to hear.
+    const published = await api.agent.publisher.publishProfile();
+    const unreachable = published?.unreachable;
+    if (unreachable?.length) {
+      api.log(`profile saved but NOT publicly readable: ${unreachable.join(', ')}`);
+    }
+    api.log(`profile updated from a client: ${Object.keys(form).join(', ') || '(files only)'}`);
+    return send(200, api.selfAccount());
+  }
+
+  // Follow requests. The queue, and the two answers to it, have existed since
+  // groups did — `agent.store.getRequests()`, `admitRequest`, `refuseRequest`,
+  // all driven from the record page — but the facade stubbed the list to `[]`
+  // and offered no authorize/reject. So a locked account could see and answer
+  // its requests in FediPod's own page and in NO Mastodon client: Phanpy,
+  // Tuba and Whalebird all showed nothing waiting.
+  if (pathname === '/api/v1/follow_requests' && req.method === 'GET') {
+    const limit = Math.min(Number(url.searchParams.get('limit')) || 40, 80);
+    return send(200, api.store.getRequests().slice(0, limit)
+      .map((r) => api.account(r.actor)));
+  }
+  const mReq = /^\/api\/v1\/follow_requests\/([a-f0-9]+)\/(authorize|reject)$/.exec(pathname);
+  if (mReq && req.method === 'POST') {
+    // The client addresses an account by the id it was given for it, which is
+    // this store's own hash of the actor URL — the same one every other
+    // account route here uses.
+    const actorUrl = api.store.urlFor(mReq[1]);
+    if (!actorUrl) return send(404, { error: 'Record not found' });
+    if (!api.store.getRequests().some((r) => r.actor === actorUrl)) {
+      return send(404, { error: 'Record not found' });
+    }
+    try {
+      if (mReq[2] === 'authorize') await social.admitRequest(api.agent, actorUrl);
+      else await social.refuseRequest(api.agent, actorUrl);
+    } catch (e) { return send(422, { error: e.message }); }
+    await api.store.flush();
+    return send(200, api.relationship(actorUrl));
+  }
+
+  if (pathname === '/api/v1/markers') {
+    if (req.method === 'POST') {
+      const body = await readBody(req);
+      const markers = api.store.read('masto-markers.json', {});
+      for (const [k, v] of Object.entries(body)) {
+        const lastId = v?.last_read_id || v;
+        if (typeof lastId === 'string') {
+          markers[k] = { last_read_id: lastId, version: (markers[k]?.version || 0) + 1, updated_at: new Date().toISOString() };
+        }
+      }
+      api.store.write('masto-markers.json', markers);
+      return send(200, markers);
+    }
+    return send(200, api.store.read('masto-markers.json', {}));
+  }
+
+  if (pathname === '/api/v1/accounts/relationships') {
+    const ids = [...url.searchParams.getAll('id[]'), ...url.searchParams.getAll('id')];
+    const rels = ids.map(id => api.store.urlFor(id)).filter(Boolean).map(u => api.relationship(u));
+    return send(200, rels);
+  }
+
+  if (pathname === '/api/v1/accounts/search') {
+    return send(200, await api.accountSearch(url.searchParams.get('q')));
+  }
+
+  if (pathname === '/api/v1/accounts/lookup') {
+    const acct = String(url.searchParams.get('acct') || '').replace(/^@/, '');
+    const cfg = api.store.getConfig();
+    if (acct === cfg?.handle || acct === `${cfg?.handle}@${api.host}`) {
+      return send(200, api.selfAccount());
+    }
+    const hit = Object.entries(api.store.getActors()).find(([u, a]) => {
+      try { return `${a.preferredUsername}@${new URL(u).host}` === acct; } catch { return false; }
+    });
+    return hit ? send(200, api.account(hit[0])) : send(404, { error: 'Record not found' });
+  }
+
+  // Block and mute, from where the trouble is seen. A block also unfollows —
+  // intake refuses a blocked author already — and a mute is view-only: their
+  // posts stay out of the timelines, nothing federates.
+  const mRel = /^\/api\/v1\/accounts\/([a-f0-9]+)\/(block|unblock|mute|unmute)$/.exec(pathname);
+  if (mRel && req.method === 'POST') {
+    const actorUrl = api.store.urlFor(mRel[1]);
+    if (!actorUrl) return send(404, { error: 'Record not found' });
+    if (mRel[2] === 'block' || mRel[2] === 'unblock') {
+      if (mRel[2] === 'block') await social.blockActor(api.agent, actorUrl);
+      else await social.unblockActor(api.agent, actorUrl);
+    } else {
+      const m = api.store.getMuted();
+      if (mRel[2] === 'mute' && !m.actors.includes(actorUrl)) m.actors.push(actorUrl);
+      if (mRel[2] === 'unmute') m.actors = m.actors.filter(a => a !== actorUrl);
+      api.store.setMuted(m);
+    }
+    return send(200, api.relationship(actorUrl));
+  }
+
+  const mFollow = /^\/api\/v1\/accounts\/([a-f0-9]+)\/(follow|unfollow)$/.exec(pathname);
+  if (mFollow && req.method === 'POST') {
+    const actorUrl = api.store.urlFor(mFollow[1]);
+    if (!actorUrl) return send(404, { error: 'Record not found' });
+    if (mFollow[2] === 'follow') await social.followActor(api.agent, actorUrl);
+    else await social.unfollowActor(api.agent, actorUrl).catch(() => {});   // already-gone is fine
+    return send(200, api.relationship(actorUrl));
+  }
+
+  const mAccount = /^\/api\/v1\/accounts\/([a-f0-9]+)$/.exec(pathname);
+  if (mAccount && req.method === 'GET') {
+    const actorUrl = api.store.urlFor(mAccount[1]);
+    return actorUrl ? send(200, api.account(actorUrl)) : send(404, { error: 'Record not found' });
+  }
+
+  // Web push: one subscription per client login. The agent pushes payloads
+  // to the browser's push service itself, so a closed client still hears.
+  if (pathname === '/api/v1/push/subscription') {
+    const token = (/^Bearer (.+)$/.exec(req.headers.authorization || '') || [])[1];
+    if (!token) return send(401, { error: 'The access token is invalid' });
+    // A client that ignores the missing `vapid` and subscribes anyway must
+    // not be told it worked — a stored subscription nothing ever pushes to is
+    // the same silent nothing the toggle was.
+    if (!api.webPush) return send(422, { error: 'this instance does not send web push' });
+    if (req.method === 'GET') {
+      const sub = api.push.get(token);
+      return sub ? send(200, api.push.json(token, sub)) : send(404, { error: 'Record not found' });
+    }
+    if (req.method === 'POST') {
+      const body = await readBody(req);
+      const sub = api.push.set(token, {
+        endpoint: body.subscription?.endpoint,
+        keys: body.subscription?.keys,
+        alerts: body.data?.alerts,
+      });
+      if (!sub) return send(422, { error: 'a https endpoint and p256dh/auth keys are required' });
+      return send(200, api.push.json(token, sub));
+    }
+    if (req.method === 'PUT') {
+      const body = await readBody(req);
+      const sub = api.push.setAlerts(token, body.data?.alerts);
+      return sub ? send(200, api.push.json(token, sub)) : send(404, { error: 'Record not found' });
+    }
+    if (req.method === 'DELETE') {
+      api.push.drop(token);
+      return send(200, {});
+    }
+  }
+
+  if (/^\/api\/v1\/accounts\/[a-f0-9]+\/featured_tags$/.test(pathname)) return send(200, []);
+
+  // The counts these back are rendered from the same two arrays (see
+  // `account`), so a client that shows a number here can always open it.
+  const mAccList = /^\/api\/v1\/accounts\/([a-f0-9]+)\/(following|followers)$/.exec(pathname);
+  if (mAccList && req.method === 'GET') {
+    const actorUrl = api.store.urlFor(mAccList[1]);
+    if (!actorUrl) return send(404, { error: 'Record not found' });
+    // Only our own lists are known. A remote actor's collections live on its
+    // own server, and opening a profile is not worth a fetch of a stranger's
+    // pod — an empty list, not an error, is what the API can honestly say.
+    const mine = actorUrl === api.urls?.actor;
+    const c = api.store.getContacts();
+    // Reversed: the contact arrays append, and page()'s cursors read
+    // newest-first — fed as stored, since_id answered with its complement.
+    const recs = (!mine ? []
+      : mAccList[2] === 'followers' ? c.followers
+        : c.following.filter(f => f.accepted))   // pending is not following
+      .slice().reverse();
+    const { items, headers } = api.page(recs, url,
+      { limit: 40, max: 80, idOf: (r) => api.store.idFor(r.actor) });
+    return send(200, items.map(r => api.account(r.actor)), headers);
+  }
+
+  // Who among the people I follow also follows THEM — a graph we do not hold,
+  // and the shape is an entry per requested account, not a bare list.
+  if (pathname === '/api/v1/accounts/familiar_followers') {
+    const ids = [...url.searchParams.getAll('id[]'), ...url.searchParams.getAll('id')];
+    return send(200, ids.map(id => ({ id, accounts: [] })));
+  }
+
+  const mAccStatuses = /^\/api\/v1\/accounts\/([a-f0-9]+)\/statuses$/.exec(pathname);
+  if (mAccStatuses) {
+    const actorUrl = api.store.urlFor(mAccStatuses[1]);
+    const all = api.store.getStatuses();
+    const pinnedOnly = url.searchParams.get('pinned') === 'true';
+    const { items, headers } = api.page(
+      all.filter(s => s.actor === actorUrl && (!pinnedOnly || s.pinned)), url);
+    return send(200, items.map(s => api.statusOrBoost(s, { all })), headers);
+  }
+
+  return false;
+}

package/lib/client/masto/body.mjs

@@ -0,0 +1,69 @@
+// body.mjs — reading what a client sent: JSON or form-encoded bodies, the
+// poll a compose request carries, and the text of a post back out of its
+// HTML.
+
+
+
+/**
+ * A poll out of a compose request, or null when there is none. A JSON client
+ * sends a `poll` object; a form-encoded one spells the same thing out in
+ * Rails's bracket notation, which is the shape the option list arrives in.
+ */
+export function pollParams(body) {
+  const nested = body?.poll && typeof body.poll === 'object' ? body.poll : null;
+  const options = [].concat(nested?.options ?? body?.['poll[options][]'] ?? [])
+    .map(o => String(o ?? '').trim()).filter(Boolean);
+  const rawExpiry = nested?.expires_in ?? body?.['poll[expires_in]'];
+  const rawMultiple = nested?.multiple ?? body?.['poll[multiple]'];
+  if (!options.length && rawExpiry === undefined) return null;
+  return {
+    options,
+    expiresIn: rawExpiry === undefined || rawExpiry === null || rawExpiry === ''
+      ? null : Number(rawExpiry),
+    multiple: rawMultiple === true || rawMultiple === 'true' || rawMultiple === '1',
+  };
+}
+
+// Accepts JSON or form-encoded bodies (OAuth posts are often form-encoded).
+// The source of a post that predates raw-text storage: its HTML back to
+// typed text, near enough to edit.
+export function htmlToText(html) {
+  return String(html)
+    .replace(/<br\s*\/?>/gi, '\n')
+    .replace(/<\/p>\s*<p[^>]*>/gi, '\n\n')
+    .replace(/<[^>]+>/g, '')
+    .replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"').replace(/&#39;/g, "'")
+    .trim();
+}
+
+export function readBody(req) {
+  return new Promise((resolve, reject) => {
+    let data = '';
+    req.on('data', c => {
+      data += c;
+      // Destroying the socket without settling left the awaiting handler
+      // pending for the life of the process and the client waiting on a
+      // response that would never come.
+      if (data.length > 1e6) { req.destroy(); reject(new Error('request body too large')); }
+    });
+    req.on('end', () => {
+      const ct = String(req.headers['content-type'] || '');
+      try {
+        if (ct.includes('application/json')) return resolve(data ? JSON.parse(data) : {});
+        // A form-encoded list is the same key repeated, spelled with a
+        // trailing `[]`. Reading it as a plain object kept only the last one,
+        // so a client sending its poll or its media that way lost all but the
+        // final value. Only the `[]` keys become lists: everything else keeps
+        // the single value the rest of this file reads.
+        const form = new URLSearchParams(data);
+        const out = {};
+        for (const key of new Set(form.keys())) {
+          out[key] = key.endsWith('[]') ? form.getAll(key) : form.get(key);
+        }
+        resolve(out);
+      } catch (e) { reject(e); }
+    });
+    req.on('error', reject);
+  });
+}