fedipod-server 0.11.0 → 0.13.0

package/README.md

@@ -9,6 +9,13 @@ account: it accepts follows, delivers their posts, and serves their Mastodon
 client at the pod's own address. Signing up is the only way an account is
 made, and opting out is the only way one ends.
 
+Every delivery to an account is checked as it arrives. The server that stores
+the inbox is the server the other side's POST reaches, so the request's
+signature is verified there and the result is written beside the activity. A
+delivery signed with the wrong key is dropped. One with no signature is kept
+and the account confirms the sender through the sender's own actor document
+before acting on it. There is nothing to configure.
+
 With nothing configured beyond the defaults, installing the component changes
 nothing about how the server serves pods. All pods, whether or not they opt-in
 to being a Fediverse account, behave as Solid pods.
@@ -78,15 +85,24 @@ and stop with the server, and on the websocket handler list for the live feed.
 
 An identity is provisioned when its owner opts in: its name is the pod's
 subdomain label, and it publishes an actor, a signing key and WebFinger on the
-pod itself. Its state lives on the pod. Its signing key lives in
-`agentDataDir`, one directory per identity — and beside it,
-`door-secret.json`: the secret guarding that identity's own pages. Each
-identity has its own; one owner's secret opens nobody else's door.
+pod itself. Everything it is made of lives on its pod — its state, its private
+signing key, the secret guarding its own pages, and the credentials for any
+accounts its owner connects on other servers. Each identity has its own
+secret; one owner's opens nobody else's door. The opt-in reply is where the
+owner is given it.
+
+That is the difference from running FediPod on your own machine, where those
+credentials stay on the machine and never reach the pod. Here the machine is
+the pod's server, so a credential left on it is a connection its owner loses
+the day they take their pod elsewhere.
+
+`agentDataDir` holds what is left: one directory per identity, with the file
+naming the pod the identity runs on. Nothing private is in it.
 
 | Setting | What it is |
 |---|---|
 | `agentRuntimeOptIn` | Whether pod owners can sign up. With it off, nothing runs. |
-| `agentDataDir` | Where each identity keeps its signing key, credential and door secret; its log lines go to the server's own log. Required whenever sign-up is on. |
+| `agentDataDir` | Where each identity keeps the file naming its pod; its log lines go to the server's own log. Required whenever sign-up is on. |
 | `agentUiPath` | Where the owner's pages live on the pod's origin. `/fedipod/` by default; empty serves no pages. |
 | `agentRegistryContainer` | The internal container holding the sign-up rows. |
 | `runPage` | The HTML served at `/run`: the page where a pod owner opts in or out. The package's own `web/front/run.html` is served unless you set this. |
@@ -149,7 +165,7 @@ owner's door, with that identity's own door secret:
 
 ```
 curl -X POST https://mei.example.org/fedipod/config \
-  -H 'x-dk-token: THE_DOOR_SECRET_FROM_door-secret.json' -H 'content-type: application/json' \
+  -H 'x-dk-token: THE_DOOR_SECRET_FROM_THE_OPT_IN_REPLY' -H 'content-type: application/json' \
   -d '{"password":"the one you will type into your phone"}'
 ```
 

package/dist/claims.d.ts

@@ -2,6 +2,13 @@ export declare function claims(input: {
     host?: string;
     pathname: string;
 }, frontHost: string): boolean;
+/**
+ * The inbox container of an identity this server runs, under the root the
+ * embedded credential uses (lib/server/embed.mjs). A delivery POSTed here is
+ * verified at the door before it is written, so the request is claimed from
+ * the LDP handler; every other method on the container is the pod's.
+ */
+export declare const INBOX_PATH = "/activitypods-js/ap/inbox/";
 /**
  * True when this request belongs to an identity's client surface.
  * `agentHosts` is keyed by host including port, as the Host header carries it.
@@ -9,4 +16,5 @@ export declare function claims(input: {
 export declare function agentClaims(input: {
     host?: string;
     pathname: string;
+    method?: string;
 }, agentHosts: Set<string>, uiPath?: string): boolean;

package/dist/claims.js

@@ -4,6 +4,7 @@
 // front's apex the gateway answers the fediverse routes; a pod subdomain is a
 // real Solid pod and is never claimed.
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.INBOX_PATH = void 0;
 exports.claims = claims;
 exports.agentClaims = agentClaims;
 const FRONT_PATHS = new Set(['/', '/signup', '/new-account', '/run', '/roster',
@@ -35,6 +36,13 @@ const AGENT_PATHS = new Set([
     '/.well-known/oauth-authorization-server',
 ]);
 const AGENT_PREFIXES = ['/api/', '/oauth/'];
+/**
+ * The inbox container of an identity this server runs, under the root the
+ * embedded credential uses (lib/server/embed.mjs). A delivery POSTed here is
+ * verified at the door before it is written, so the request is claimed from
+ * the LDP handler; every other method on the container is the pod's.
+ */
+exports.INBOX_PATH = '/activitypods-js/ap/inbox/';
 /**
  * True when this request belongs to an identity's client surface.
  * `agentHosts` is keyed by host including port, as the Host header carries it.
@@ -47,6 +55,8 @@ function agentClaims(input, agentHosts, uiPath = '/fedipod/') {
     const { pathname } = input;
     if (AGENT_PATHS.has(pathname))
         return true;
+    if (pathname === exports.INBOX_PATH)
+        return String(input.method ?? '').toUpperCase() === 'POST';
     if (AGENT_PREFIXES.some((prefix) => pathname.startsWith(prefix)))
         return true;
     // The owner's door, when there is one: '' turns the pages off entirely.

package/dist/handler.d.ts

@@ -91,6 +91,12 @@ export declare class FediPodServerHandler extends HttpHandler implements Initial
     initialize(): Promise<void>;
     /** Stop every identity: timers cleared, state written, lease let go. */
     finalize(): Promise<void>;
+    /**
+     * One identity's door secret, in its own pod's state. `agentDataDir` is
+     * handed in as the place an identity set up before this kept it, so its
+     * owner's existing door link survives the move.
+     */
+    private doorSecretFor;
     private startIdentity;
     /**
      * When this server is also the door, give a running identity a
@@ -132,6 +138,13 @@ export declare class FediPodServerHandler extends HttpHandler implements Initial
     }): Promise<Record<string, unknown> & {
         httpStatus: number;
     }>;
+    /**
+     * A delivery to an identity's own inbox, verified here — the server that
+     * stores the inbox is the one the request reached, so the signature is
+     * checked while its headers exist and the receipt is written beside the
+     * activity. The same door code the front runs; nothing is renamed.
+     */
+    private deliverAtDoor;
     handle({ request, response }: HttpHandlerInput): Promise<void>;
 }
 export {};

package/dist/handler.js

@@ -25,9 +25,9 @@ const directory_1 = require("./directory");
 // Two layouts carry that tree: the published package ships its own copy of
 // lib/ beside dist/ (prepack puts it there), and a repo checkout reaches the
 // repo's lib/ three levels up. Prefer the package's own copy when it exists.
-const LIB_ROOT = (0, node_fs_1.existsSync)((0, node_path_1.join)(__dirname, '../lib/embed.mjs')) ? '../lib' : '../../../lib';
-const FRONT_CORE = `${LIB_ROOT}/front-core.mjs`;
-const EMBED = `${LIB_ROOT}/embed.mjs`;
+const LIB_ROOT = (0, node_fs_1.existsSync)((0, node_path_1.join)(__dirname, '../lib/server/embed.mjs')) ? '../lib' : '../../../lib';
+const FRONT_CORE = `${LIB_ROOT}/gateway/front-core.mjs`;
+const EMBED = `${LIB_ROOT}/server/embed.mjs`;
 const esmImport = new Function('s', 'return import(s)');
 // The front's pages and the files they load, carried in the same two layouts
 // as lib/. A missing file is not fatal: the route it feeds answers 404.
@@ -215,6 +215,20 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
             this.logger.info(`FediPod agent @${identity.handle} stopped`);
         }));
     }
+    /**
+     * One identity's door secret, in its own pod's state. `agentDataDir` is
+     * handed in as the place an identity set up before this kept it, so its
+     * owner's existing door link survives the move.
+     */
+    async doorSecretFor(podBase, session, opts = {}) {
+        const { ensureDoorSecret } = await esmImport(EMBED);
+        return ensureDoorSecret(session ?? (0, store_pod_1.makeStoreSession)(this.args.resourceStore, podBase), podBase, {
+            ...opts,
+            dataDir: this.args.agentDataDir,
+            handle: deriveHandle(podBase),
+            log: (message) => { this.logger.info(`@${deriveHandle(podBase)}: ${message}`); },
+        });
+    }
     async startIdentity(podBase) {
         if (this.starting.has(podBase) || this.identities.has(podBase))
             return;
@@ -224,13 +238,13 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         try {
             for (let attempt = 0; !this.stopping && !this.startCancelled.has(podBase); attempt++) {
                 try {
-                    const { startEmbeddedAgent, ensureDoorSecret } = await esmImport(EMBED);
+                    const { startEmbeddedAgent } = await esmImport(EMBED);
                     // The secret is in the map BEFORE the surface can exist, so the
                     // gate's resolver never comes up empty — empty would mean gate-off.
                     if (!this.doorSecrets.has(podBase)) {
-                        const door = ensureDoorSecret(this.args.agentDataDir, deriveHandle(podBase));
+                        const door = await this.doorSecretFor(podBase, session);
                         this.doorSecrets.set(podBase, door.secret);
-                        this.logger.info(`door secret for @${deriveHandle(podBase)} is at ${door.path}`);
+                        this.logger.info(`door secret for @${deriveHandle(podBase)} is in its pod at ${door.url}`);
                     }
                     const identity = await startEmbeddedAgent({
                         podBase,
@@ -311,7 +325,7 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         // starting, and then stop being served once it has.
         if ((0, claims_1.claims)({ host, pathname }, this.frontHost))
             return;
-        if ((0, claims_1.agentClaims)({ host, pathname }, this.agentHosts, this.uiPath))
+        if ((0, claims_1.agentClaims)({ host, pathname, method: request.method }, this.agentHosts, this.uiPath))
             return;
         throw new Error('not a gateway route'); // reject → CSS's LDP handler takes it
     }
@@ -344,11 +358,10 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         }
         const base = podBase.endsWith('/') ? podBase : `${podBase}/`;
         const handle = deriveHandle(base);
-        const { ensureDoorSecret } = await esmImport(EMBED);
         // Already running here from an earlier opt-in: proving pod
         // control again buys a fresh secret, nothing else.
         if (this.agentHandles.get(handle) === base) {
-            const door = ensureDoorSecret(this.args.agentDataDir, handle, { rotate: true });
+            const door = await this.doorSecretFor(base, undefined, { rotate: true });
             this.doorSecrets.set(base, door.secret);
             return { httpStatus: 201, ok: true, handle, host: new URL(base).host.toLowerCase(),
                 doorSecret: door.secret, doorPath: this.uiPath, status: 'rotated' };
@@ -371,10 +384,10 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         // until the agent registers its surface.
         this.agentHosts.add(host);
         this.agentHandles.set(handle, base);
-        const door = ensureDoorSecret(this.args.agentDataDir, handle, { rotate: true });
+        const door = await this.doorSecretFor(base, undefined, { rotate: true });
         this.doorSecrets.set(base, door.secret);
         void this.startIdentity(base);
-        this.logger.info(`runtime opt-in: @${handle} on ${base} (door secret at ${door.path})`);
+        this.logger.info(`runtime opt-in: @${handle} on ${base} (door secret in its pod at ${door.url})`);
         return { httpStatus: 201, ok: true, handle, host,
             doorSecret: door.secret, doorPath: this.uiPath, status: 'starting' };
     }
@@ -400,6 +413,33 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         this.logger.info(`runtime opt-out: @${row.handle} on ${base} — the pod serves plain LDP again`);
         return { httpStatus: 200, ok: true, stopped: Boolean(identity) };
     }
+    /**
+     * A delivery to an identity's own inbox, verified here — the server that
+     * stores the inbox is the one the request reached, so the signature is
+     * checked while its headers exist and the receipt is written beside the
+     * activity. The same door code the front runs; nothing is renamed.
+     */
+    async deliverAtDoor(identity, request, response) {
+        const { deliverToInbox } = await esmImport(EMBED);
+        let whatwg;
+        try {
+            // The pod's own origin: the signature covers the path and the Host header, and both are the pod's.
+            whatwg = await (0, adapt_1.nodeToWhatwg)(request, new URL(identity.podHome).origin);
+        }
+        catch (e) {
+            const status = e.statusCode === 413 ? 413 : 400;
+            response.writeHead(status, { 'content-type': 'application/json' });
+            response.end(JSON.stringify({ error: e.message }));
+            return;
+        }
+        const out = await deliverToInbox(identity.agent, whatwg, {
+            podPut: (url, body, ct) => this.podPut(url, body, ct),
+            gatewayWebId: this.args.gatewayWebId ?? null,
+        });
+        this.logger.info(`FediPod: delivery for @${identity.handle} at the door — ${out.reason} (${out.status})`);
+        response.writeHead(out.status, { 'content-type': 'application/json' });
+        response.end(JSON.stringify({ reason: out.reason }));
+    }
     async handle({ request, response }) {
         const host = String(request.headers.host ?? '').toLowerCase();
         if (this.agentHosts.has(host)) {
@@ -419,6 +459,11 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
                 response.end(JSON.stringify({ error: 'this identity is still starting' }));
                 return;
             }
+            const pathname = new URL(request.url ?? '/', `https://${host}`).pathname;
+            if (pathname === claims_1.INBOX_PATH && String(request.method).toUpperCase() === 'POST') {
+                await this.deliverAtDoor(identity, request, response);
+                return;
+            }
             await identity.surface.handler(request, response);
             return;
         }

package/dist/handler.jsonld

@@ -312,6 +312,10 @@
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_finalize",
           "memberFieldName": "finalize"
         },
+        {
+          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_doorSecretFor",
+          "memberFieldName": "doorSecretFor"
+        },
         {
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_startIdentity",
           "memberFieldName": "startIdentity"
@@ -340,6 +344,10 @@
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_optOutPod",
           "memberFieldName": "optOutPod"
         },
+        {
+          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_deliverAtDoor",
+          "memberFieldName": "deliverAtDoor"
+        },
         {
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_handle",
           "memberFieldName": "handle"

package/dist/store-pod.js

@@ -28,11 +28,25 @@ function headerReader(init) {
         lower[k.toLowerCase()] = String(v);
     return (n) => lower[n.toLowerCase()] ?? null;
 }
-// Only Turtle needs asking for: a container's listing is quads until something
-// requests a syntax, and listContainer parses Turtle. Everything else is read
-// back exactly as it was written.
+// A container's listing is quads until something requests a syntax, and
+// listContainer parses Turtle, so Turtle has to be askable for. It must not be
+// the ONLY thing asked for: the state tree reads its own documents with
+// `text/turtle, application/json;q=0.9, */*;q=0.8`, and a JSON document
+// demanded as Turtle is refused outright — which is every state document an
+// identity has, the moment it starts on a pod that already holds some.
+// With no Turtle in the accept, no preference: read back as written.
 function preferencesFor(accept) {
-    return accept?.includes('text/turtle') ? { type: { 'text/turtle': 1 } } : {};
+    if (!accept?.includes('text/turtle'))
+        return {};
+    const type = {};
+    for (const part of accept.split(',')) {
+        const [media, ...params] = part.trim().split(';');
+        if (!media)
+            continue;
+        const q = params.map((p) => (/^\s*q=([\d.]+)\s*$/u).exec(p)).find(Boolean);
+        type[media.trim()] = q ? Number(q[1]) : 1;
+    }
+    return { type };
 }
 function isNotFound(e) {
     return community_server_1.NotFoundHttpError.isInstance?.(e) === true || e?.statusCode === 404;

package/lib/{c2s.mjs → client/c2s.mjs}

@@ -15,8 +15,9 @@
 // read their own inbox" is served from there, by this agent, to the owner
 // alone.
 
-import * as social from './social.mjs';
-import * as wire from './wire.mjs';
+import * as social from '../core/social.mjs';
+import * as wire from '../core/wire.mjs';
+import { readLenient } from '../core/as2.mjs';
 
 const MAX_BODY = 512 * 1024;          // same ceiling the inbox drain enforces
 
@@ -190,9 +191,15 @@ export class C2S {
       if (!took) return this.send(res, 503, { error: 'another agent is active for this pod — takeover failed, try again' });
     }
 
+    // Read as JSON-LD, so a client may send its activity with whatever context
+    // it likes and still be understood. What is read is the GRAPH: `dispatch`
+    // takes decisions from it and the publisher builds the document that is
+    // actually posted, so nothing a client sent is republished verbatim and a
+    // term it aliased still means what it says.
     let activity;
     try {
-      activity = JSON.parse(await readBody(req));
+      const read = await readLenient(await readBody(req));
+      activity = read.view ?? read.doc;
     } catch (e) {
       return this.send(res, 400, { error: `unreadable body: ${e.message}` });
     }

package/lib/{localapi.mjs → client/localapi.mjs}

@@ -12,8 +12,8 @@
 import https from 'node:https';
 import fs from 'node:fs';
 import path from 'node:path';
-import { rootOf, apRoot } from './home.mjs';
-import { certPaths } from './certs.mjs';
+import { rootOf, apRoot } from '../device/home.mjs';
+import { certPaths } from '../device/certs.mjs';
 
 /**
  * The authorities worth offering for a loopback call: this install's, and the

package/lib/client/masto/accounts.mjs

@@ -0,0 +1,264 @@
+// accounts.mjs — the account endpoints: the owner's credentials and profile
+// editor, follow requests, markers, relationships, search and lookup, block
+// and mute, follow and unfollow, an account and its lists and statuses, and
+// the web-push subscription a client login holds.
+
+import crypto from 'node:crypto';
+import * as podMedia from '../../pod/media.mjs';
+import * as social from '../../core/social.mjs';
+import { readBody } from './body.mjs';
+import { readMultipart } from './media.mjs';
+
+export async function handle(api, ctx) {
+  const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
+
+  if (pathname === '/api/v1/accounts/verify_credentials') {
+    const cfg0 = api.store.getConfig() || {};
+    return send(200, {
+      ...api.selfAccount(),
+      // `source` is what the editor fills its inputs from: the raw text it
+      // will send back, not the HTML the profile renders.
+      source: {
+        privacy: 'public', sensitive: false, language: 'en',
+        note: cfg0.summary || '',
+        fields: (cfg0.fields || []).map(f => ({ name: f.name, value: f.value })),
+      },
+    });
+  }
+
+  // The profile editor. Everything it can send is carried: the name and bio,
+  // both pictures, and the extra fields. An avatar or header arrives as file
+  // bytes, so it goes to the pod's media container first and the actor gets
+  // the URL — the same path a posted attachment takes.
+  if (pathname === '/api/v1/accounts/update_credentials') {
+    if (req.method !== 'PATCH' && req.method !== 'POST') return send(405, { error: 'PATCH expected' });
+    const ct = String(req.headers['content-type'] || '');
+    // readBody already covers JSON and urlencoded; only the file case differs.
+    let form = {}, files = {};
+    if (ct.includes('multipart/form-data')) ({ fields: form, files } = await readMultipart(req));
+    else form = await readBody(req);
+
+    const cfg = { ...api.store.getConfig() };
+    const putImage = async (f) => {
+      const ext = (f.filename || '').includes('.')
+        ? f.filename.split('.').pop().replace(/[^\w]/g, '') : 'bin';
+      const slug = new Date().toISOString().slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex') + '.' + ext;
+      const url = api.urls.media + slug;
+      await api.agent.publisher.ensureMediaContainer();
+      await podMedia.write(api.agent.remote, url, f.data, f.contentType);
+      return url;
+    };
+
+    if ('display_name' in form) cfg.name = String(form.display_name).trim() || cfg.handle;
+    if ('note' in form) cfg.summary = String(form.note) || undefined;
+    if ('locked' in form) cfg.approveJoins = form.locked === 'true' || form.locked === true;
+    if (files.avatar?.data?.length) cfg.icon = await putImage(files.avatar);
+    if (files.header?.data?.length) cfg.image = await putImage(files.header);
+
+    // fields_attributes arrives as fields_attributes[0][name] etc. A row with
+    // no name is how the editor says "delete this one", so it is dropped.
+    const rows = [];
+    for (const [k, v] of Object.entries(form)) {
+      const m = /^fields_attributes\[(\d+)\]\[(name|value)\]$/.exec(k);
+      if (!m) continue;
+      (rows[Number(m[1])] ||= {})[m[2]] = String(v);
+    }
+    if (rows.length) cfg.fields = rows.filter(r => r && r.name?.trim())
+      .map(r => ({ name: r.name.trim(), value: (r.value || '').trim() }));
+
+    api.store.setConfig(cfg);
+    Object.assign(api.agent.publisher.config, {
+      name: cfg.name, summary: cfg.summary, icon: cfg.icon, image: cfg.image,
+      fields: cfg.fields, approveJoins: !!cfg.approveJoins,
+    });
+    await api.store.flush();
+    // publishProfile says whether the world can actually read the actor it
+    // just wrote. Discarding that reported success for a save that left the
+    // account undiscoverable — the one outcome the caller needed to hear.
+    const published = await api.agent.publisher.publishProfile();
+    const unreachable = published?.unreachable;
+    if (unreachable?.length) {
+      api.log(`profile saved but NOT publicly readable: ${unreachable.join(', ')}`);
+    }
+    api.log(`profile updated from a client: ${Object.keys(form).join(', ') || '(files only)'}`);
+    return send(200, api.selfAccount());
+  }
+
+  // Follow requests. The queue, and the two answers to it, have existed since
+  // groups did — `agent.store.getRequests()`, `admitRequest`, `refuseRequest`,
+  // all driven from the record page — but the facade stubbed the list to `[]`
+  // and offered no authorize/reject. So a locked account could see and answer
+  // its requests in FediPod's own page and in NO Mastodon client: Phanpy,
+  // Tuba and Whalebird all showed nothing waiting.
+  if (pathname === '/api/v1/follow_requests' && req.method === 'GET') {
+    const limit = Math.min(Number(url.searchParams.get('limit')) || 40, 80);
+    return send(200, api.store.getRequests().slice(0, limit)
+      .map((r) => api.account(r.actor)));
+  }
+  const mReq = /^\/api\/v1\/follow_requests\/([a-f0-9]+)\/(authorize|reject)$/.exec(pathname);
+  if (mReq && req.method === 'POST') {
+    // The client addresses an account by the id it was given for it, which is
+    // this store's own hash of the actor URL — the same one every other
+    // account route here uses.
+    const actorUrl = api.store.urlFor(mReq[1]);
+    if (!actorUrl) return send(404, { error: 'Record not found' });
+    if (!api.store.getRequests().some((r) => r.actor === actorUrl)) {
+      return send(404, { error: 'Record not found' });
+    }
+    try {
+      if (mReq[2] === 'authorize') await social.admitRequest(api.agent, actorUrl);
+      else await social.refuseRequest(api.agent, actorUrl);
+    } catch (e) { return send(422, { error: e.message }); }
+    await api.store.flush();
+    return send(200, api.relationship(actorUrl));
+  }
+
+  if (pathname === '/api/v1/markers') {
+    if (req.method === 'POST') {
+      const body = await readBody(req);
+      const markers = api.store.read('masto-markers.json', {});
+      for (const [k, v] of Object.entries(body)) {
+        const lastId = v?.last_read_id || v;
+        if (typeof lastId === 'string') {
+          markers[k] = { last_read_id: lastId, version: (markers[k]?.version || 0) + 1, updated_at: new Date().toISOString() };
+        }
+      }
+      api.store.write('masto-markers.json', markers);
+      return send(200, markers);
+    }
+    return send(200, api.store.read('masto-markers.json', {}));
+  }
+
+  if (pathname === '/api/v1/accounts/relationships') {
+    const ids = [...url.searchParams.getAll('id[]'), ...url.searchParams.getAll('id')];
+    const rels = ids.map(id => api.store.urlFor(id)).filter(Boolean).map(u => api.relationship(u));
+    return send(200, rels);
+  }
+
+  if (pathname === '/api/v1/accounts/search') {
+    return send(200, await api.accountSearch(url.searchParams.get('q')));
+  }
+
+  if (pathname === '/api/v1/accounts/lookup') {
+    const acct = String(url.searchParams.get('acct') || '').replace(/^@/, '');
+    const cfg = api.store.getConfig();
+    if (acct === cfg?.handle || acct === `${cfg?.handle}@${api.host}`) {
+      return send(200, api.selfAccount());
+    }
+    const hit = Object.entries(api.store.getActors()).find(([u, a]) => {
+      try { return `${a.preferredUsername}@${new URL(u).host}` === acct; } catch { return false; }
+    });
+    return hit ? send(200, api.account(hit[0])) : send(404, { error: 'Record not found' });
+  }
+
+  // Block and mute, from where the trouble is seen. A block also unfollows —
+  // intake refuses a blocked author already — and a mute is view-only: their
+  // posts stay out of the timelines, nothing federates.
+  const mRel = /^\/api\/v1\/accounts\/([a-f0-9]+)\/(block|unblock|mute|unmute)$/.exec(pathname);
+  if (mRel && req.method === 'POST') {
+    const actorUrl = api.store.urlFor(mRel[1]);
+    if (!actorUrl) return send(404, { error: 'Record not found' });
+    if (mRel[2] === 'block' || mRel[2] === 'unblock') {
+      if (mRel[2] === 'block') await social.blockActor(api.agent, actorUrl);
+      else await social.unblockActor(api.agent, actorUrl);
+    } else {
+      const m = api.store.getMuted();
+      if (mRel[2] === 'mute' && !m.actors.includes(actorUrl)) m.actors.push(actorUrl);
+      if (mRel[2] === 'unmute') m.actors = m.actors.filter(a => a !== actorUrl);
+      api.store.setMuted(m);
+    }
+    return send(200, api.relationship(actorUrl));
+  }
+
+  const mFollow = /^\/api\/v1\/accounts\/([a-f0-9]+)\/(follow|unfollow)$/.exec(pathname);
+  if (mFollow && req.method === 'POST') {
+    const actorUrl = api.store.urlFor(mFollow[1]);
+    if (!actorUrl) return send(404, { error: 'Record not found' });
+    if (mFollow[2] === 'follow') await social.followActor(api.agent, actorUrl);
+    else await social.unfollowActor(api.agent, actorUrl).catch(() => {});   // already-gone is fine
+    return send(200, api.relationship(actorUrl));
+  }
+
+  const mAccount = /^\/api\/v1\/accounts\/([a-f0-9]+)$/.exec(pathname);
+  if (mAccount && req.method === 'GET') {
+    const actorUrl = api.store.urlFor(mAccount[1]);
+    return actorUrl ? send(200, api.account(actorUrl)) : send(404, { error: 'Record not found' });
+  }
+
+  // Web push: one subscription per client login. The agent pushes payloads
+  // to the browser's push service itself, so a closed client still hears.
+  if (pathname === '/api/v1/push/subscription') {
+    const token = (/^Bearer (.+)$/.exec(req.headers.authorization || '') || [])[1];
+    if (!token) return send(401, { error: 'The access token is invalid' });
+    // A client that ignores the missing `vapid` and subscribes anyway must
+    // not be told it worked — a stored subscription nothing ever pushes to is
+    // the same silent nothing the toggle was.
+    if (!api.webPush) return send(422, { error: 'this instance does not send web push' });
+    if (req.method === 'GET') {
+      const sub = api.push.get(token);
+      return sub ? send(200, api.push.json(token, sub)) : send(404, { error: 'Record not found' });
+    }
+    if (req.method === 'POST') {
+      const body = await readBody(req);
+      const sub = api.push.set(token, {
+        endpoint: body.subscription?.endpoint,
+        keys: body.subscription?.keys,
+        alerts: body.data?.alerts,
+      });
+      if (!sub) return send(422, { error: 'a https endpoint and p256dh/auth keys are required' });
+      return send(200, api.push.json(token, sub));
+    }
+    if (req.method === 'PUT') {
+      const body = await readBody(req);
+      const sub = api.push.setAlerts(token, body.data?.alerts);
+      return sub ? send(200, api.push.json(token, sub)) : send(404, { error: 'Record not found' });
+    }
+    if (req.method === 'DELETE') {
+      api.push.drop(token);
+      return send(200, {});
+    }
+  }
+
+  if (/^\/api\/v1\/accounts\/[a-f0-9]+\/featured_tags$/.test(pathname)) return send(200, []);
+
+  // The counts these back are rendered from the same two arrays (see
+  // `account`), so a client that shows a number here can always open it.
+  const mAccList = /^\/api\/v1\/accounts\/([a-f0-9]+)\/(following|followers)$/.exec(pathname);
+  if (mAccList && req.method === 'GET') {
+    const actorUrl = api.store.urlFor(mAccList[1]);
+    if (!actorUrl) return send(404, { error: 'Record not found' });
+    // Only our own lists are known. A remote actor's collections live on its
+    // own server, and opening a profile is not worth a fetch of a stranger's
+    // pod — an empty list, not an error, is what the API can honestly say.
+    const mine = actorUrl === api.urls?.actor;
+    const c = api.store.getContacts();
+    // Reversed: the contact arrays append, and page()'s cursors read
+    // newest-first — fed as stored, since_id answered with its complement.
+    const recs = (!mine ? []
+      : mAccList[2] === 'followers' ? c.followers
+        : c.following.filter(f => f.accepted))   // pending is not following
+      .slice().reverse();
+    const { items, headers } = api.page(recs, url,
+      { limit: 40, max: 80, idOf: (r) => api.store.idFor(r.actor) });
+    return send(200, items.map(r => api.account(r.actor)), headers);
+  }
+
+  // Who among the people I follow also follows THEM — a graph we do not hold,
+  // and the shape is an entry per requested account, not a bare list.
+  if (pathname === '/api/v1/accounts/familiar_followers') {
+    const ids = [...url.searchParams.getAll('id[]'), ...url.searchParams.getAll('id')];
+    return send(200, ids.map(id => ({ id, accounts: [] })));
+  }
+
+  const mAccStatuses = /^\/api\/v1\/accounts\/([a-f0-9]+)\/statuses$/.exec(pathname);
+  if (mAccStatuses) {
+    const actorUrl = api.store.urlFor(mAccStatuses[1]);
+    const all = api.store.getStatuses();
+    const pinnedOnly = url.searchParams.get('pinned') === 'true';
+    const { items, headers } = api.page(
+      all.filter(s => s.actor === actorUrl && (!pinnedOnly || s.pinned)), url);
+    return send(200, items.map(s => api.statusOrBoost(s, { all })), headers);
+  }
+
+  return false;
+}