fedipod-server 0.11.0 → 0.13.0

package/lib/client/masto/statuses.mjs

@@ -0,0 +1,331 @@
+// statuses.mjs — a status and what a client does to one: compose (a note, a
+// poll, a scheduled post, a reply through a connected account), source and
+// history, read, edit and delete, context, who reacted, pin, bookmarks and
+// favourites, scheduled posts, poll votes, favourite and boost.
+
+import crypto from 'node:crypto';
+import * as social from '../../core/social.mjs';
+import { readBody, pollParams, htmlToText } from './body.mjs';
+import {
+  MAX_OPTIONS as POLL_MAX_OPTIONS, MAX_OPTION_CHARS as POLL_MAX_OPTION_CHARS,
+  MIN_SECONDS as POLL_MIN_SECONDS, MAX_SECONDS as POLL_MAX_SECONDS,
+} from '../../core/polls.mjs';
+
+export async function handle(api, ctx) {
+  const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
+
+  if (pathname === '/api/v1/statuses' && req.method === 'POST') {
+    const body = await readBody(req);
+    if (!body.status) return send(422, { error: 'status text required' });
+    const visibility = body.visibility || 'public';
+    if (!['public', 'unlisted', 'private', 'direct'].includes(visibility)) {
+      return send(422, { error: `unknown visibility "${visibility}"` });
+    }
+    const inReplyTo = body.in_reply_to_id ? api.store.urlFor(body.in_reply_to_id) : undefined;
+    // A reply to a mirrored Bluesky post goes out as a native Bluesky reply
+    // — the parent is not an AP object, so there is no AP note to make.
+    const bskyParent = inReplyTo && api.store.getStatuses().find(x => x.noteId === inReplyTo && x.kind === 'bsky');
+    if (bskyParent) return api.bskyReply(send, body, bskyParent, visibility);
+    // A reply to a post a connected account brought us goes out from that
+    // account, where the conversation already is.
+    const acctParent = inReplyTo && api.store.getStatuses().find(x => x.noteId === inReplyTo && x.kind === 'acct');
+    if (acctParent) return api.acctReply(send, body, acctParent, visibility);
+    // Private and direct posts live in an owner-only pod container — and
+    // only on a pod that provably enforces it.
+    if (visibility === 'private' || visibility === 'direct') {
+      const ready = await api.agent.publisher.privateReady();
+      if (ready !== true) return send(422, { error: ready });
+    }
+    const spoilerText = String(body.spoiler_text || '').trim() || null;
+    const mediaIds = [].concat(body.media_ids || body['media_ids[]'] || []).filter(Boolean);
+    const media = api.store.getMedia();
+    const attachments = mediaIds.map(id => media[id] && { id, ...media[id] }).filter(Boolean);
+
+    const asking = pollParams(body);
+    if (asking) {
+      // Mastodon's own rules, stated here rather than discovered inside the
+      // publisher, so a client gets the reason back on the request it made.
+      if (attachments.length) return send(422, { error: 'a poll cannot carry media' });
+      if (body.scheduled_at) return send(422, { error: 'a poll cannot be scheduled' });
+      if (asking.options.length < 2) return send(422, { error: 'a poll needs at least two options' });
+      if (asking.options.length > POLL_MAX_OPTIONS) {
+        return send(422, { error: `a poll takes at most ${POLL_MAX_OPTIONS} options` });
+      }
+      if (asking.options.some(o => o.length > POLL_MAX_OPTION_CHARS)) {
+        return send(422, { error: `a poll option is at most ${POLL_MAX_OPTION_CHARS} characters` });
+      }
+      if (new Set(asking.options).size !== asking.options.length) {
+        return send(422, { error: 'a poll\u2019s options must differ from one another' });
+      }
+      const seconds = asking.expiresIn ?? POLL_MAX_SECONDS;
+      if (!Number.isFinite(seconds) || seconds < POLL_MIN_SECONDS || seconds > POLL_MAX_SECONDS) {
+        return send(422, {
+          error: `a poll runs between ${POLL_MIN_SECONDS} and ${POLL_MAX_SECONDS} seconds`,
+        });
+      }
+      try {
+        const q = await api.agent.publisher.publishQuestion(body.status, {
+          options: asking.options, multiple: asking.multiple,
+          expiresAt: new Date(Date.now() + seconds * 1000).toISOString(),
+          inReplyTo, visibility, spoilerText,
+        });
+        return send(200, api.status(api.store.getStatuses().find(x => x.noteId === q.id)));
+      } catch (e) {
+        return send(422, { error: e.message });
+      }
+    }
+
+    if (body.scheduled_at) {
+      // Nothing here publishes it when the time comes (see `scheduling` in the
+      // constructor), so saying yes would be losing the post quietly.
+      if (!api.scheduling) {
+        return send(422, { error: 'this instance cannot schedule posts — it has no process '
+          + 'running between now and then to publish one. Post it when you want it sent.' });
+      }
+      const at = Date.parse(body.scheduled_at);
+      if (!Number.isFinite(at) || at < Date.now() + 60_000) {
+        return send(422, { error: 'scheduled_at must be at least a minute from now' });
+      }
+      const sched = api.store.getScheduled();
+      const entry = {
+        id: crypto.randomBytes(8).toString('hex'), scheduledAt: new Date(at).toISOString(),
+        params: { status: body.status, visibility, spoilerText, inReplyTo, attachments },
+      };
+      sched.push(entry);
+      api.store.setScheduled(sched);
+      return send(200, api.scheduledJson(entry));
+    }
+    const note = await api.agent.publisher.publishNote(body.status,
+      { inReplyTo, attachments, visibility, spoilerText });
+    const s = api.store.getStatuses().find(x => x.noteId === note.id);
+    return send(200, api.status(s));
+  }
+
+  // The composer reads the raw text back before an edit.
+  const mSource = /^\/api\/v1\/statuses\/([a-f0-9]+)\/source$/.exec(pathname);
+  if (mSource && req.method === 'GET') {
+    const noteUrl = api.store.urlFor(mSource[1]);
+    const s = noteUrl && api.store.getStatuses().find(x => x.noteId === noteUrl);
+    if (!s) return send(404, { error: 'Record not found' });
+    return send(200, { id: mSource[1], text: s.text ?? htmlToText(s.content || ''), spoiler_text: s.spoiler || '' });
+  }
+
+  // One entry — the current version. Enough for the client's history view;
+  // past versions are not kept.
+  const mHistory = /^\/api\/v1\/statuses\/([a-f0-9]+)\/history$/.exec(pathname);
+  if (mHistory && req.method === 'GET') {
+    const noteUrl = api.store.urlFor(mHistory[1]);
+    const s = noteUrl && api.store.getStatuses().find(x => x.noteId === noteUrl);
+    if (!s) return send(404, { error: 'Record not found' });
+    return send(200, [{
+      content: s.content || '', spoiler_text: s.spoiler || '', sensitive: !!s.spoiler,
+      created_at: s.editedAt || s.published, account: api.account(s.actor),
+      media_attachments: (s.attachments || []).map(a => api.mediaJson(a)),
+      emojis: [], poll: null,
+    }]);
+  }
+
+  const mStatus = /^\/api\/v1\/statuses\/([a-f0-9]+)$/.exec(pathname);
+  if (mStatus && req.method === 'GET') {
+    const { s, wrapped } = api.lookup(mStatus[1]);
+    if (!s) return send(404, { error: 'Record not found' });
+    return send(200, wrapped ? api.statusOrBoost(s) : api.status(s));
+  }
+  if (mStatus && req.method === 'PUT') {
+    const noteUrl = api.store.urlFor(mStatus[1]);
+    const s = noteUrl && api.store.getStatuses().find(x => x.noteId === noteUrl);
+    if (!s) return send(404, { error: 'Record not found' });
+    if (s.actor !== api.urls.actor) return send(403, { error: 'not your status' });
+    const body = await readBody(req);
+    if (!body.status) return send(422, { error: 'status text required' });
+    const mediaIds = [].concat(body.media_ids || body['media_ids[]'] || []).filter(Boolean);
+    const media = api.store.getMedia();
+    const attachments = mediaIds.length
+      ? mediaIds.map(id => media[id] && { id, ...media[id] }).filter(Boolean)
+      : null;                                   // null: keep what the post has
+    const spoilerText = String(body.spoiler_text || '').trim() || null;
+    const patched = await api.agent.publisher.updateNote(s,
+      { content: body.status, spoilerText, attachments });
+    return send(200, api.status(patched || s));
+  }
+  if (mStatus && req.method === 'DELETE') {
+    const noteUrl = api.store.urlFor(mStatus[1]);
+    const s = noteUrl && api.store.getStatuses().find(x => x.noteId === noteUrl);
+    if (!s) return send(404, { error: 'Record not found' });
+    // A post the owner wrote on a connected account is theirs to delete too.
+    // It is deleted where it lives — an AP Delete of ours would address an
+    // object that was never ours to speak for.
+    const onAcct = s.actor !== api.urls.actor
+      ? (api.agent.fediaccts?.list() || []).find(r => r.actorUrl && r.actorUrl === s.actor)
+      : null;
+    if (s.actor !== api.urls.actor && !onAcct) return send(403, { error: 'not your status' });
+    const rendered = api.status(s);
+    if (onAcct) {
+      const held = (s.sourceAccts || []).find(v => v.acct === onAcct.id);
+      if (!held?.remoteId) return send(422, { error: `we do not know where ${onAcct.handle} keeps that post` });
+      try {
+        await api.agent.fediaccts.api(onAcct.id,
+          `/api/v1/statuses/${encodeURIComponent(held.remoteId)}`, { method: 'DELETE' });
+      } catch (e) { return send(502, { error: e.message }); }
+      api.store.removeStatus(s.noteId);
+      return send(200, { ...rendered, text: s.content || '' });
+    }
+    // 502, because the refusal is the pod's: the client asked correctly and
+    // the post is still up. Reporting 200 here is what let a deleted post
+    // stay publicly readable with nothing to show for it.
+    const gone = await social.deleteNote(api.agent, s);
+    if (!gone.ok) return send(502, { error: gone.error });
+    return send(200, { ...rendered, text: s.content || '' });
+  }
+
+  // Threads from the mirror's inReplyTo chains.
+  const mContext = /^\/api\/v1\/statuses\/([a-f0-9]+)\/context$/.exec(pathname);
+  if (mContext) {
+    const noteUrl = api.lookup(mContext[1]).s?.noteId;
+    const all = api.store.getStatuses();
+    const byId = new Map(all.map(s => [s.noteId, s]));
+    const ancestors = [];
+    let cur = noteUrl && byId.get(noteUrl)?.inReplyTo;
+    while (cur && byId.has(cur) && ancestors.length < 40) {
+      const s = byId.get(cur);
+      ancestors.unshift(s);
+      cur = s.inReplyTo;
+    }
+    const descendants = [];
+    const queue = noteUrl ? [noteUrl] : [];
+    while (queue.length && descendants.length < 60) {
+      const id = queue.shift();
+      for (const s of all) if (s.inReplyTo === id) { descendants.push(s); queue.push(s.noteId); }
+    }
+    return send(200, {
+      ancestors: ancestors.map(s => api.status(s, { all })),
+      descendants: descendants.map(s => api.status(s, { all })),
+    });
+  }
+
+  // Who reacted: only what our own store witnessed, so the lists are the
+  // reactions we were notified of, not the whole fediverse's count.
+  const mWho = /^\/api\/v1\/statuses\/([a-f0-9]+)\/(reblogged_by|favourited_by)$/.exec(pathname);
+  if (mWho && req.method === 'GET') {
+    const noteUrl = api.store.urlFor(mWho[1]);
+    if (!noteUrl) return send(404, { error: 'Record not found' });
+    const type = mWho[2] === 'reblogged_by' ? 'reblog' : 'favourite';
+    const actors = [...new Set(api.store.getNotifications()
+      .filter(n => n.noteId === noteUrl && n.type === type).map(n => n.actor))];
+    return send(200, actors.map(a => api.account(a)));
+  }
+
+  // Pinning republishes the featured collection, so a visitor's server
+  // shows the pins too; the actor document names the collection.
+  const mPin = /^\/api\/v1\/statuses\/([a-f0-9]+)\/(pin|unpin)$/.exec(pathname);
+  if (mPin && req.method === 'POST') {
+    const noteUrl = api.store.urlFor(mPin[1]);
+    const s = noteUrl && api.store.getStatuses().find(x => x.noteId === noteUrl);
+    if (!s) return send(404, { error: 'Record not found' });
+    if (s.actor !== api.urls.actor) return send(403, { error: 'not your status' });
+    const updated = await social.pinStatus(api.agent, s, mPin[2] === 'pin');
+    return send(200, api.status(updated));
+  }
+
+  if (pathname === '/api/v1/reports' && req.method === 'POST') {
+    return send(422, {
+      error: 'this is your own single-user server, so there is no moderation team to receive a report. Blocking the account is the action that takes effect here.',
+    });
+  }
+
+  // Bookmarks are this machine's own list: nothing federates, nothing is
+  // told, which is what a bookmark means everywhere.
+  const mBookmark = /^\/api\/v1\/statuses\/([a-f0-9]+)\/(bookmark|unbookmark)$/.exec(pathname);
+  if (mBookmark && req.method === 'POST') {
+    const noteUrl = api.store.urlFor(mBookmark[1]);
+    const s = noteUrl && api.store.getStatuses().find(x => x.noteId === noteUrl);
+    if (!s) return send(404, { error: 'Record not found' });
+    const updated = api.store.updateStatus(s.noteId, { bookmarked: mBookmark[2] === 'bookmark' });
+    return send(200, api.status(updated || s));
+  }
+  if (pathname === '/api/v1/bookmarks' || pathname === '/api/v1/favourites') {
+    const key = pathname.endsWith('bookmarks') ? 'bookmarked' : 'favourited';
+    const all = api.store.getStatuses();
+    const items = all.filter(s => s[key])
+      .sort((a, b) => String(b.published || '').localeCompare(String(a.published || '')));
+    const { items: page, headers } = api.page(items, url);
+    return send(200, page.map(s => api.status(s, { all })), headers);
+  }
+
+  if (pathname === '/api/v1/scheduled_statuses' && req.method === 'GET') {
+    return send(200, api.store.getScheduled().map(e => api.scheduledJson(e)));
+  }
+  const mSched = /^\/api\/v1\/scheduled_statuses\/([a-f0-9]+)$/.exec(pathname);
+  if (mSched) {
+    const sched = api.store.getScheduled();
+    const e = sched.find(x => x.id === mSched[1]);
+    if (!e) return send(404, { error: 'Record not found' });
+    if (req.method === 'DELETE') {
+      api.store.setScheduled(sched.filter(x => x.id !== mSched[1]));
+      return send(200, {});
+    }
+    if (req.method === 'PUT') {
+      const body = await readBody(req);
+      const at = Date.parse(body.scheduled_at || '');
+      if (!Number.isFinite(at)) return send(422, { error: 'scheduled_at required' });
+      e.scheduledAt = new Date(at).toISOString();
+      api.store.setScheduled(sched);
+    }
+    return send(200, api.scheduledJson(e));
+  }
+
+  const mPoll = /^\/api\/v1\/polls\/([a-f0-9]+)(\/votes)?$/.exec(pathname);
+  if (mPoll) {
+    const noteUrl = api.store.urlFor(mPoll[1]);
+    const s = noteUrl && api.store.getStatuses().find(x => x.noteId === noteUrl);
+    if (!s?.poll) return send(404, { error: 'Record not found' });
+    if (mPoll[2] && req.method === 'POST') {
+      const body = await readBody(req);
+      const choices = [].concat(body.choices || body['choices[]'] || []).map(Number)
+        .filter(Number.isInteger);
+      if (!choices.length) return send(422, { error: 'choices required' });
+      const r = await social.votePoll(api.agent, s, choices);
+      if (!r.ok) return send(422, { error: r.error });
+      return send(200, api.pollJson(api.store.getStatuses().find(x => x.noteId === noteUrl)));
+    }
+    return send(200, api.pollJson(s));
+  }
+
+  const mAction = /^\/api\/v1\/statuses\/([a-f0-9]+)\/(favourite|unfavourite|reblog|unreblog)$/.exec(pathname);
+  if (mAction && req.method === 'POST') {
+    // Acting on a carried row acts on the post itself, as Mastodon does.
+    const { s } = api.lookup(mAction[1]);
+    if (!s) return send(404, { error: 'Record not found' });
+    // A mirrored Bluesky post is not an AP object — a Like or Announce has
+    // nothing to address. The interaction goes to Bluesky instead, as the
+    // native record every Bluesky app writes.
+    if (s.kind === 'bsky') {
+      const at = api.agent.atproto;
+      if (!at?.connected()) return send(422, { error: 'this is a Bluesky post — no Bluesky account is connected to act from' });
+      try {
+        let patch = null;
+        if (mAction[2] === 'favourite' && !s.favourited) {
+          patch = { favourited: true, bskyLike: (await at.like(s.noteId, s.cid || null)).uri };
+        } else if (mAction[2] === 'unfavourite' && s.favourited) {
+          if (s.bskyLike) await at.deleteCrossPost(s.bskyLike);
+          patch = { favourited: false, bskyLike: undefined };
+        } else if (mAction[2] === 'reblog' && !s.reblogged) {
+          patch = { reblogged: true, bskyRepost: (await at.repost(s.noteId, s.cid || null)).uri };
+        } else if (mAction[2] === 'unreblog' && s.reblogged) {
+          if (s.bskyRepost) await at.deleteCrossPost(s.bskyRepost);
+          patch = { reblogged: false, bskyRepost: undefined };
+        }
+        return send(200, api.status(patch ? (api.store.updateStatus(s.noteId, patch) || s) : s));
+      } catch (e) { return send(422, { error: e.message }); }
+    }
+    // A post that reached us through a connected account is not ours to
+    // address as the pod actor. Our own posts and our own inbox's timeline
+    // keep the AP path even when a connected account also saw them: where
+    // the pod identity has standing, it is the one that acts.
+    if (s.kind === 'acct') return api.acctAction(send, s, mAction[2]);
+    const updated = await social[mAction[2]](api.agent, s);
+    return send(200, api.status(updated || s));
+  }
+
+  return false;
+}

package/lib/client/masto/timelines.mjs

@@ -0,0 +1,316 @@
+// timelines.mjs — what a client reads by the page: the home and public
+// timelines, hashtags and the tag feed, lists and their timelines, the v2
+// filters, conversations, notifications, and search.
+
+import crypto from 'node:crypto';
+import * as social from '../../core/social.mjs';
+import { sanitizeHtml } from '../../core/wire.mjs';
+import { authorOf } from '../../core/intake/index.mjs';
+import { readBody } from './body.mjs';
+
+export async function handle(api, ctx) {
+  const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
+
+  // home + public = everything known (follows, boosts, tag feed, own);
+  // public?local=true = own posts; trends/statuses = the same activity (a
+  // single-actor instance has no firehose — what it knows IS its public
+  // face). Sorted by publish time so tag-feed backfill interleaves.
+  if (pathname === '/api/v1/timelines/home' || pathname === '/api/v1/timelines/public'
+    || pathname === '/api/v1/trends/statuses') {
+    const localOnly = pathname === '/api/v1/timelines/public' && url.searchParams.get('local') === 'true';
+    // The UNFILTERED list, both as the source and as the reply-count corpus:
+    // a reply can be a mention, and mentions are filtered out of timelines
+    // below — counting against the filtered set would undercount them.
+    const all = api.store.getStatuses();
+    const muted = new Set(api.store.getMuted().actors);
+    let items = all
+      // search ingests and strangers' mentions stay out of the timelines
+      // (mentions remain in notifications and /api/v1/statuses); direct
+      // posts belong to the conversations view, not a timeline; and the
+      // local/public view shows only what is actually public-facing.
+      .filter(s => s.kind !== 'remote' && s.kind !== 'mention')
+      .filter(s => !s.direct && s.visibility !== 'direct')
+      .filter(s => !muted.has(s.actor) && !muted.has(s.via))
+      .filter(s => !localOnly || (s.kind === 'post' && s.visibility !== 'private'))
+      .sort((a, b) => String(b.published || '').localeCompare(String(a.published || '')));
+    const { items: page, headers } = api.page(items, url);
+    return send(200, page.map(s => api.statusOrBoost(s, { all })), headers);
+  }
+
+  // --- hashtags: the client's Followed Hashtags surface drives the tag feed ---
+  // followed_tags is what the feed currently pulls; follow/unfollow add and
+  // remove a hashtag (unfollow the last and the topical feed goes quiet); the
+  // tag timeline is the mirrored notes carrying that tag.
+  if (pathname === '/api/v1/followed_tags') {
+    const tags = api.agent.tagfeed?.config().tags || [];
+    return send(200, tags.map(t => api.tagObject(t, true, req)));
+  }
+  const mTagFollow = pathname.match(/^\/api\/v1\/tags\/([^/]+)\/(follow|unfollow)$/);
+  if (mTagFollow && req.method === 'POST') {
+    const name = decodeURIComponent(mTagFollow[1]).replace(/^#/, '').toLowerCase();
+    const follow = mTagFollow[2] === 'follow';
+    const tf = api.agent.tagfeed;
+    if (tf) {
+      const cur = tf.config().tags;
+      tf.setConfig({ tags: follow ? [...new Set([...cur, name])] : cur.filter(t => t !== name) });
+    }
+    return send(200, api.tagObject(name, follow, req));
+  }
+  const mTagGet = pathname.match(/^\/api\/v1\/tags\/([^/]+)$/);
+  if (mTagGet && req.method === 'GET') {
+    const name = decodeURIComponent(mTagGet[1]).replace(/^#/, '').toLowerCase();
+    const following = (api.agent.tagfeed?.config().tags || []).includes(name);
+    return send(200, api.tagObject(name, following, req));
+  }
+  const mTagTl = pathname.match(/^\/api\/v1\/timelines\/tag\/([^/]+)$/);
+  if (mTagTl && req.method === 'GET') {
+    const name = decodeURIComponent(mTagTl[1]).replace(/^#/, '').toLowerCase();
+    const all = api.store.getStatuses();
+    const items = all.filter(s => s.kind === 'tag' && s.tag === name)
+      .sort((a, b) => String(b.published || '').localeCompare(String(a.published || '')));
+    const { items: page, headers } = api.page(items, url);
+    return send(200, page.map(s => api.statusOrBoost(s, { all })), headers);
+  }
+
+  // Lists, filters and scheduled posts are the client's own arrangements —
+  // kept in local state, nothing federates.
+  const listJson = (l) => ({ id: l.id, title: l.title, replies_policy: l.repliesPolicy || 'list', exclusive: false });
+  if (pathname === '/api/v1/lists' && req.method === 'GET') {
+    return send(200, api.store.getLists().map(listJson));
+  }
+  if (pathname === '/api/v1/lists' && req.method === 'POST') {
+    const body = await readBody(req);
+    const title = String(body.title || '').trim();
+    if (!title) return send(422, { error: 'a title is required' });
+    const lists = api.store.getLists();
+    const l = { id: crypto.randomBytes(8).toString('hex'), title, repliesPolicy: body.replies_policy || 'list', members: [] };
+    lists.push(l);
+    api.store.setLists(lists);
+    return send(200, listJson(l));
+  }
+  const mList = /^\/api\/v1\/lists\/([a-f0-9]+)$/.exec(pathname);
+  if (mList) {
+    const lists = api.store.getLists();
+    const l = lists.find(x => x.id === mList[1]);
+    if (!l) return send(404, { error: 'Record not found' });
+    if (req.method === 'DELETE') {
+      api.store.setLists(lists.filter(x => x.id !== mList[1]));
+      return send(200, {});
+    }
+    if (req.method === 'PUT') {
+      const body = await readBody(req);
+      if (body.title) l.title = String(body.title);
+      if (body.replies_policy) l.repliesPolicy = body.replies_policy;
+      api.store.setLists(lists);
+    }
+    return send(200, listJson(l));
+  }
+  const mListAcc = /^\/api\/v1\/lists\/([a-f0-9]+)\/accounts$/.exec(pathname);
+  if (mListAcc) {
+    const lists = api.store.getLists();
+    const l = lists.find(x => x.id === mListAcc[1]);
+    if (!l) return send(404, { error: 'Record not found' });
+    if (req.method === 'GET') return send(200, (l.members || []).map(a => api.account(a)));
+    const body = await readBody(req).catch(() => ({}));
+    const ids = [].concat(body.account_ids || body['account_ids[]'] || url.searchParams.getAll('account_ids[]')).filter(Boolean);
+    const actors = ids.map(id => api.store.urlFor(id)).filter(Boolean);
+    if (req.method === 'POST') l.members = [...new Set([...(l.members || []), ...actors])];
+    if (req.method === 'DELETE') l.members = (l.members || []).filter(a => !actors.includes(a));
+    api.store.setLists(lists);
+    return send(200, {});
+  }
+  const mListTl = /^\/api\/v1\/timelines\/list\/([a-f0-9]+)$/.exec(pathname);
+  if (mListTl) {
+    const l = api.store.getLists().find(x => x.id === mListTl[1]);
+    if (!l) return send(404, { error: 'Record not found' });
+    const members = new Set(l.members || []);
+    const all = api.store.getStatuses();
+    const items = all.filter(s => members.has(s.actor) || members.has(s.via))
+      .sort((a, b) => String(b.published || '').localeCompare(String(a.published || '')));
+    const { items: page, headers } = api.page(items, url);
+    return send(200, page.map(s => api.statusOrBoost(s, { all })), headers);
+  }
+
+  // v2 filters: stored, served, and APPLIED — every status carries what it
+  // matched in `filtered` (see filtersFor), because no client matches
+  // keywords for itself.
+  const filterJson = (f) => ({
+    id: f.id, title: f.title, context: f.context || ['home'],
+    expires_at: f.expiresAt || null, filter_action: f.action || 'warn',
+    keywords: (f.keywords || []).map((k, i) => ({ id: `${f.id}-${i}`, keyword: k.keyword, whole_word: !!k.wholeWord })),
+    statuses: [],
+  });
+  const keywordsOf = (attrs) => [].concat(attrs || [])
+    .filter(k => k?.keyword && !(k._destroy === true || k._destroy === 'true'))
+    .map(k => ({ keyword: String(k.keyword), wholeWord: k.whole_word === true || k.whole_word === 'true' }));
+  if (pathname === '/api/v2/filters' && req.method === 'GET') {
+    return send(200, api.store.getFilters().map(filterJson));
+  }
+  if (pathname === '/api/v2/filters' && req.method === 'POST') {
+    const body = await readBody(req);
+    const title = String(body.title || '').trim();
+    if (!title) return send(422, { error: 'a title is required' });
+    const filters = api.store.getFilters();
+    const f = {
+      id: crypto.randomBytes(8).toString('hex'), title,
+      context: [].concat(body.context || ['home']),
+      action: body.filter_action || 'warn', expiresAt: null,
+      keywords: keywordsOf(body.keywords_attributes),
+    };
+    filters.push(f);
+    api.store.setFilters(filters);
+    return send(200, filterJson(f));
+  }
+  const mFilter = /^\/api\/v2\/filters\/([a-f0-9]+)$/.exec(pathname);
+  if (mFilter) {
+    const filters = api.store.getFilters();
+    const f = filters.find(x => x.id === mFilter[1]);
+    if (!f) return send(404, { error: 'Record not found' });
+    if (req.method === 'DELETE') {
+      api.store.setFilters(filters.filter(x => x.id !== mFilter[1]));
+      return send(200, {});
+    }
+    if (req.method === 'PUT') {
+      const body = await readBody(req);
+      if (body.title) f.title = String(body.title);
+      if (body.context) f.context = [].concat(body.context);
+      if (body.filter_action) f.action = body.filter_action;
+      if (body.keywords_attributes) f.keywords = keywordsOf(body.keywords_attributes);
+      api.store.setFilters(filters);
+    }
+    return send(200, filterJson(f));
+  }
+
+  // Conversations: direct posts, grouped by who is in them.
+  if (pathname === '/api/v1/conversations' && req.method === 'GET') {
+    const all = api.store.getStatuses();
+    const me = api.urls.actor;
+    const convos = new Map();
+    for (const s of all) {
+      if (!(s.direct || s.visibility === 'direct')) continue;
+      const others = [...new Set([
+        ...(s.actor !== me ? [s.actor] : []),
+        ...((s.mentions || []).map(m => m.href).filter(a => a && a !== me)),
+      ])];
+      const key = others.sort().join(' ') || me;
+      const c = convos.get(key) || { accounts: new Set(), last: s };
+      for (const o of others) c.accounts.add(o);
+      if (String(s.published || '') > String(c.last.published || '')) c.last = s;
+      convos.set(key, c);
+    }
+    const items = [...convos.entries()]
+      .sort((a, b) => String(b[1].last.published || '').localeCompare(String(a[1].last.published || '')));
+    return send(200, items.map(([key, c]) => ({
+      id: api.store.idFor('conversation:' + key),
+      unread: false,
+      accounts: [...(c.accounts.size ? c.accounts : [me])].map(a => api.account(a)),
+      last_status: api.status(c.last, { all }),
+    })));
+  }
+
+  if (pathname === '/api/v1/notifications') {
+    const limit = Math.min(Number(url.searchParams.get('limit')) || 30, 60);
+    const q = url.searchParams;
+    // Newest first, which is what every id rule below assumes.
+    let items = api.store.getNotifications();
+
+    // Which KINDS. A client that asks for mentions and is handed favourites
+    // and boosts renders them as mentions — Phanpy's Mentions column did
+    // exactly that, and re-pilled on every poll. Both spellings: clients send
+    // `types[]=mention` and some send bare `types=mention`.
+    const listParam = (name) => {
+      const all = [...q.getAll(`${name}[]`), ...q.getAll(name)]
+        .flatMap((v) => String(v).split(',')).map((v) => v.trim()).filter(Boolean);
+      return all.length ? new Set(all) : null;
+    };
+    const want = listParam('types');
+    const skip = listParam('exclude_types');
+    // Mastodon spells the type with an underscore; ours is stored with a
+    // hyphen, and notification() translates on the way out — so match on what
+    // the client would have been given, not on what is on disk.
+    const shown = (n) => api.notificationType(n.type);
+    if (want) items = items.filter((n) => want.has(shown(n)));
+    if (skip) items = items.filter((n) => !skip.has(shown(n)));
+
+    // Which SLICE. `max_id` walks backwards into history; `since_id` and
+    // `min_id` both mean "newer than this", which is how a client asks
+    // "anything since I last looked?". Ignoring them meant every poll
+    // returned the whole list, so the client always saw unread items and the
+    // bell never went out.
+    const cut = (id, keepNewer) => {
+      const i = items.findIndex((n) => n.id === id);
+      if (i < 0) return;
+      items = keepNewer ? items.slice(0, i) : items.slice(i + 1);
+    };
+    const maxId = q.get('max_id');
+    if (maxId) cut(maxId, false);
+    const sinceId = q.get('since_id') || q.get('min_id');
+    if (sinceId) cut(sinceId, true);
+    // min_id asks for the ones IMMEDIATELY newer, i.e. the oldest end of
+    // what is newer; since_id asks for the newest. Only the window differs.
+    const page = q.get('min_id') && !q.get('since_id')
+      ? items.slice(Math.max(0, items.length - limit))
+      : items.slice(0, limit);
+
+    // A client pages by following these rather than by guessing ids.
+    if (page.length) {
+      const base = `${api.scheme || (req.socket?.encrypted ? 'https' : 'http')}://${req.headers.host}${pathname}`;
+      const link = (params) => {
+        const u = new URL(base);
+        for (const [k, v] of q) if (k !== 'max_id' && k !== 'since_id' && k !== 'min_id') u.searchParams.append(k, v);
+        for (const [k, v] of Object.entries(params)) u.searchParams.set(k, v);
+        return u.href;
+      };
+      return send(200, page.map((n) => api.notification(n)), {
+        link: `<${link({ max_id: page[page.length - 1].id })}>; rel="next", `
+          + `<${link({ min_id: page[0].id })}>; rel="prev"`,
+      });
+    }
+    return send(200, []);
+  }
+
+  // Search: @user@host → webfinger resolve; URL → actor or note ingest;
+  // plain text → local mirror + actor-cache scan.
+  if (pathname === '/api/v2/search' || pathname === '/api/v1/search') {
+    const q = String(url.searchParams.get('q') || '').trim();
+    const type = url.searchParams.get('type');
+    const out = { accounts: [], statuses: [], hashtags: [] };
+    const asHandle = /^@?[^@\s]+@[^@\s.]+\.[^@\s]+$/.test(q);
+    if (asHandle && type !== 'statuses') {
+      try {
+        const doc = await social.resolveHandle(api.agent, q);
+        out.accounts.push(api.account(doc.id));
+      } catch (e) { api.log(`search resolve ${q}: ${e.message}`); }
+    } else if (/^https?:\/\//.test(q)) {
+      const doc = await api.agent.intake.fetchAP(q).catch(() => null);
+      if (doc?.type === 'Person' && doc.id) out.accounts.push(api.account(doc.id));
+      else if (doc?.type === 'Note' && doc.id) {
+        let s = api.store.getStatuses().find(x => x.noteId === doc.id);
+        // Third site of the same rule: the note's own origin has to vouch for
+        // the author before we store one. The owner chose the URL, but the
+        // document at it still names whoever it likes.
+        const author = authorOf(doc);
+        if (!s && author) {
+          s = {
+            noteId: doc.id, actor: author, content: sanitizeHtml(doc.content),
+            published: doc.published, inReplyTo: doc.inReplyTo, kind: 'remote',
+          };
+          api.store.addStatus(s);
+        }
+        if (s) out.statuses.push(api.status(s));
+      }
+    } else if (q) {
+      const needle = q.toLowerCase();
+      if (type !== 'accounts') {
+        const all = api.store.getStatuses();
+        out.statuses = all
+          .filter(s => (s.content || '').toLowerCase().includes(needle)).slice(0, 20)
+          .map(s => api.status(s, { all }));
+      }
+      if (type !== 'statuses') out.accounts = await api.accountSearch(q);
+    }
+    return send(200, out);
+  }
+
+  return false;
+}

package/lib/{streaming.mjs → client/streaming.mjs}

@@ -16,7 +16,7 @@ const WS_MAGIC = '258EAFA5-E914-47DA-95CA-C5AB0DC85B11';
 const MAX_SOCKETS = 20;                       // matches the client-token cap
 const MAX_BUFFERED_BYTES = 1024 * 1024;       // a consumer this far behind is gone
 
-import { checkRequest } from './guard.mjs';
+import { checkRequest } from '../shared/guard.mjs';
 
 export class Streaming {
   constructor({ masto, log = console.log, allowed = null, gate = null, gateOptional = false }) {

package/lib/{acctfeed.mjs → connections/acctfeed.mjs}

@@ -11,7 +11,7 @@
 //
 // Config in fediacctfeed.json: { intervalMin, accounts: { <id>: marks } }.
 
-import { sanitizeHtml } from './wire.mjs';
+import { sanitizeHtml } from '../core/wire.mjs';
 
 const DEFAULTS = { intervalMin: 5 };
 const PER_SWEEP = 40;