fedipod-server 0.16.0 → 0.18.0

package/lib/core/publisher/index.mjs

@@ -76,6 +76,15 @@ export class Publisher {
   // republish button. Without it, an actor lost from the pod would match the
   // digest, be skipped, and leave the agent reporting success while nobody can
   // resolve it.
+  // The Gateway's outbox door for this account, when a Gateway is attached:
+  // beside its inbox door, or under the fronted actor.
+  gatewayOutbox() {
+    const gw = this.config.gateway;
+    if (!(gw && gw.url && gw.mode && gw.mode !== 'off')) return null;
+    if (gw.frontActor) return String(gw.frontActor).replace(/ap\/actor\/?$/u, 'ap/outbox');
+    return String(gw.url).replace(/ap\/inbox\/?$/u, 'ap/outbox');
+  }
+
   async publishProfile({ force = false } = {}) {
     const { urls } = this;
     const host = new URL(urls.base).host;
@@ -105,7 +114,8 @@ export class Publisher {
       inbox: gwActive ? gw.url : null,
       // The agent's own outbox endpoint, where it is reachable: a client
       // following the actor must arrive somewhere that will take a write.
-      outbox: this.clientOrigin ? `${this.clientOrigin}ap/outbox` : null,
+      // Otherwise the Gateway's outbox door, when one is attached.
+      outbox: this.clientOrigin ? `${this.clientOrigin}ap/outbox` : this.gatewayOutbox(),
       // How a client-to-server client finds the way in with nothing configured
       // by hand. Advertised only where the surface is publicly reachable.
       oauthAuthorize: this.clientOrigin ? `${this.clientOrigin}oauth/authorize` : null,
@@ -163,6 +173,8 @@ export class Publisher {
         actorUrl: urls.actor,
         accountName: `@${this.config.handle}@${host}`,
         kind: this.config.kind,
+        // Where a Solid client posts: dokieli reads `as:outbox` off the WebID.
+        outbox: this.clientOrigin ? `${this.clientOrigin}ap/outbox` : this.gatewayOutbox(),
       });
       if (wrote) this.log('WebID profile now lists the actor as a foaf:account');
     } catch (e) {
@@ -400,6 +412,7 @@ export class Publisher {
   reconcileFollowers(...a) { return restore.reconcileFollowers(this, ...a); }
   reconcileOutbox(...a) { return restore.reconcileOutbox(this, ...a); }
   rebuildStatuses(...a) { return restore.rebuildStatuses(this, ...a); }
+  healStatuses(...a) { return restore.healStatuses(this, ...a); }
 
   // notes.mjs
   ensureMediaContainer(...a) { return notes.ensureMediaContainer(this, ...a); }
@@ -408,6 +421,7 @@ export class Publisher {
   privateReady(...a) { return notes.privateReady(this, ...a); }
   _mentionsFor(...a) { return notes.mentionsFor(this, ...a); }
   publishNote(...a) { return notes.publishNote(this, ...a); }
+  publishObject(...a) { return notes.publishObject(this, ...a); }
   updateNote(...a) { return notes.updateNote(this, ...a); }
 
   // questions.mjs

package/lib/core/publisher/notes.mjs

@@ -99,7 +99,28 @@ export function assertDirectAddressed(content, mentions) {
   throw e;
 }
 
-export async function publishNote(publisher, content, { inReplyTo, attachments, visibility = 'public', spoilerText = null } = {}) {
+// A client may name the document it is creating (the Slug of a client-to-server
+// POST). Only a plain name is taken, and only when nothing is there already;
+// otherwise the agent mints one as it always has.
+const SLUG_OK = /^[A-Za-z0-9._-]{1,64}$/u;
+export const safeSlug = (s) => (typeof s === 'string' && SLUG_OK.test(s) && !/^\.+$/u.test(s) ? s : null);
+async function slugFor(publisher, container, wanted, published) {
+  const name = safeSlug(wanted);
+  if (name && !(await podNotes.read(publisher.remote, container + name).catch(() => null))) return name;
+  return published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
+}
+
+// What the author's own timeline shows for an object: its content, else its
+// text under one of the names other vocabularies use, else a link to it.
+export function rowContent(obj) {
+  if (typeof obj?.content === 'string' && obj.content.trim()) return wire.sanitizeHtml(obj.content);
+  const plain = [obj?.bodyValue, obj?.name, obj?.summary].find((v) => typeof v === 'string' && v.trim());
+  if (plain) return wire.contentHtml(plain);
+  const esc = (v) => String(v).replace(/[&<>"]/gu, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
+  return `<p><a href="${esc(obj?.id || '')}">${esc(obj?.type || 'object')}</a></p>`;
+}
+
+export async function publishNote(publisher, content, { inReplyTo, attachments, visibility = 'public', spoilerText = null, slug: wanted = null } = {}) {
   const { urls } = publisher;
   const priv = visibility === 'private' || visibility === 'direct';
   if (priv) {
@@ -107,7 +128,7 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
     if (ready !== true) throw new Error(ready);
   }
   const published = new Date().toISOString();
-  const slug = published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
+  const slug = await slugFor(publisher, priv ? urls.privateNotes : urls.notes, wanted, published);
   const mentions = await publisher._mentionsFor(content, inReplyTo);
   if (visibility === 'direct') assertDirectAddressed(content, mentions);
   const note = wire.noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions,
@@ -127,6 +148,11 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
     ...(attachments?.length ? { attachments } : {}),
     ...(note.tag?.length ? { mentions: note.tag.map(t => ({ href: t.href, name: t.name })) } : {}),
   });
+  // The row is what the author's own timeline reads. Land it before answering
+  // — the same PUT the debounce would send in 300 ms — so a worker killed or a
+  // write refused after the answer cannot leave a post that stands on the pod
+  // and reached followers but never shows to its author.
+  if (await publisher.store.commit?.() === false) publisher.log(`post published but its timeline row was refused: ${note.id}`);
 
   const create = wire.createActivity(note, urls);
   // Published as its own document: a group that carries this post wraps the
@@ -164,6 +190,62 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
 // edit's own stamp. The pod documents are overwritten in place — the Create
 // too, so a group's Announce resolves to the edited text — and an Update
 // goes everywhere the Create went.
+// Any object as a post: what a client-to-server Create carries when it is not
+// a Note or a Question — a Web Annotation, say. Stored as sent, with its own
+// context, under this actor; the Create around it is what followers receive.
+// Servers that know the type show it; the rest ignore it, which is the
+// expected outcome.
+//
+// An object already living on this pod (an id under it) is not copied: the
+// Create names it where it is. Anything else is written into the notes
+// container under the client's slug when it is free, else a minted one.
+export async function publishObject(publisher, object, { visibility = 'public', slug: wanted = null } = {}) {
+  const { urls } = publisher;
+  const priv = visibility === 'private' || visibility === 'direct';
+  if (priv) {
+    const ready = await publisher.privateReady();
+    if (ready !== true) throw new Error(ready);
+  }
+  const published = new Date().toISOString();
+  const container = priv ? urls.privateNotes : urls.notes;
+  const pod = publisher.config?.remotePod || urls.base;
+  const ownId = typeof object.id === 'string' && /^https?:\/\//u.test(object.id) && object.id.startsWith(pod)
+    ? object.id : null;
+  const name = await slugFor(publisher, container, wanted, published);
+  const addressed = wire.addressing(urls, visibility);
+  let doc = null;
+  const id = ownId || container + name;
+  if (!ownId) {
+    doc = { ...object, id, attributedTo: urls.actor, published: object.published || published, to: addressed.to, cc: addressed.cc };
+    if (!doc['@context']) doc['@context'] = wire.AS_CTX;
+    if (typeof doc.content === 'string') doc.content = wire.sanitizeHtml(doc.content);
+    await podNotes.write(publisher.remote, id, doc);
+  }
+  if (!priv) await publisher.recordOutbox(id);
+  const row = doc || object;
+  publisher.store.addStatus({
+    noteId: id, actor: urls.actor, content: rowContent(row), published: row.published || published,
+    kind: 'post', slug: name, visibility,
+  });
+  if (await publisher.store.commit?.() === false) publisher.log(`object published but its timeline row was refused: ${id}`);
+
+  // The Create sits beside the object; for an object living elsewhere on the
+  // pod it sits in the notes container, whose ACL is public Read.
+  const createId = doc ? wire.createActivityId(id) : wire.createActivityId(container + name);
+  const create = {
+    '@context': wire.AS_CTX, id: createId, type: 'Create', actor: urls.actor,
+    published: row.published || published, to: addressed.to, cc: addressed.cc,
+    object: doc || id,
+  };
+  await podNotes.writeCreate(publisher.remote, create.id, create);
+  const contacts = publisher.store.getContacts();
+  const inboxes = visibility === 'direct' ? []
+    : [...new Set(contacts.followers.map((f) => f.sharedInbox || f.inbox).filter(Boolean))];
+  await publisher.deliverer.deliverToAll(inboxes, create);
+  publisher.log(`${row.type || 'object'} published: ${id} → ${inboxes.length} inbox(es)`);
+  return { id, createId, copied: !ownId };
+}
+
 export async function updateNote(publisher, s, { content, spoilerText = null, attachments = null } = {}) {
   const { urls } = publisher;
   const updated = new Date().toISOString();

package/lib/core/publisher/questions.mjs

@@ -82,6 +82,7 @@ export async function publishQuestion(publisher, content, { options = [], multip
     ...(spoilerText ? { spoiler: spoilerText } : {}),
     ...(question.tag?.length ? { mentions: question.tag.map(t => ({ href: t.href, name: t.name })) } : {}),
   });
+  if (await publisher.store.commit?.() === false) publisher.log(`poll published but its timeline row was refused: ${question.id}`);
 
   const create = publisher._pollActivity('Create', question, wire.createActivityId(question.id));
   await podNotes.writeCreate(publisher.remote, create.id, create);

package/lib/core/publisher/restore.mjs

@@ -5,6 +5,7 @@
 import * as wire from '../wire.mjs';
 import * as podNotes from '../../pod/notes.mjs';
 import { readLenient } from '../as2.mjs';
+import { rowContent } from './notes.mjs';
 
 const ACCEPT_AP = 'application/activity+json, application/ld+json; profile="https://www.w3.org/ns/activitystreams"';
 const REBUILD_MAX_PER_RUN = 200;
@@ -151,13 +152,14 @@ export async function rebuildStatuses(publisher, { fromNotes = false } = {}) {
     if (have.has(id) || removed.has(id)) continue;
     budget--;
     const note = await podNotes.read(publisher.remote, id).catch(() => null);
-    if (note?.type !== 'Note' || note.id !== id || note.attributedTo !== urls.actor) continue;
+    // Any object of ours: a Note, a poll, or whatever a client posted.
+    if (!note?.type || note.id !== id || note.attributedTo !== urls.actor) continue;
     const attachments = wire.attachmentsOf(note);
     const mentions = (Array.isArray(note.tag) ? note.tag : [])
       .filter(t => t?.type === 'Mention' && t.href)
       .map(t => ({ href: t.href, name: t.name }));
     recovered.push({
-      noteId: note.id, actor: urls.actor, content: note.content || '',
+      noteId: note.id, actor: urls.actor, content: rowContent(note),
       published: note.published || null,
       ...(note.inReplyTo ? { inReplyTo: note.inReplyTo } : {}),
       kind: 'post', slug: note.id.slice(urls.notes.length),
@@ -197,3 +199,26 @@ export async function rebuildStatuses(publisher, { fromNotes = false } = {}) {
     dropped: Math.max(0, merged.length - kept.length),
   };
 }
+
+// Own posts the outbox records and the statuses index does not.
+//
+// The index row is the last thing a post writes, and it goes by a debounced
+// PUT: a worker killed or a write refused after the post was answered leaves a
+// post that stands on the pod and reached followers but never shows on its
+// author's own timeline. Run when an agent becomes active. Cheap when nothing
+// is wrong — two cached documents compared, no request — and the capped,
+// merge-only rebuild when something is.
+export async function healStatuses(publisher) {
+  const { urls, store } = publisher;
+  const own = store.read('outbox.json', [])
+    .map(i => (typeof i === 'string' ? i : null))
+    .filter(id => id && id.startsWith(urls.notes));
+  if (!own.length) return { missing: 0, recovered: 0 };
+  const have = new Set(store.getStatuses().map(s => s.noteId));
+  const removed = new Set(store.read('outbox-removed.json', []).map(r => r.id));
+  const missing = own.filter(id => !have.has(id) && !removed.has(id));
+  if (!missing.length) return { missing: 0, recovered: 0 };
+  const r = await rebuildStatuses(publisher);
+  publisher.log(`timeline index healed: ${missing.length} own post(s) were missing, ${r.recovered} recovered`);
+  return { missing: missing.length, recovered: r.recovered };
+}

package/lib/core/social.mjs

@@ -204,6 +204,7 @@ export async function reblog(agent, s) {
   // missing entry, a failed status write would let a retry announce twice.
   const updated = agent.store.updateStatus(s.noteId, { reblogged: true, announceActivity: act });
   await agent.publisher.recordOutbox(act);
+  if (await agent.store.commit?.() === false) agent.log(`boost sent but its timeline row was refused: ${s.noteId}`);
   return updated;
 }
 

package/lib/core/store.mjs

@@ -74,6 +74,7 @@ export function dropFollower(contacts, actor, why) {
 
 export class PodStore {
   constructor({ storage = null, log = console.log } = {}) {
+    this.lastSkipped = [];        // what the last load could not read, as `name (HTTP n)`
     this.storage = storage;
     this.log = log;
     this.cache = new Map();        // name → parsed value
@@ -146,6 +147,9 @@ export class PodStore {
       try { this.cache.set(name, JSON.parse(r.body)); }
       catch (e) { this.log(`state load ${name}: unparsable (${e.message})`); }
     }
+    // Kept for /status: a document skipped here is a timeline or a contact
+    // list quietly missing, and the owner should be able to see that.
+    this.lastSkipped = skipped;
     if (skipped.length) this.log(`state load skipped ${skipped.length}: ${skipped.join(', ')}`);
     this.log(`state loaded: ${this.cache.size} doc(s) from ${this.base} (${fetched} re-fetched)`);
   }

package/lib/core/wire.mjs

@@ -20,7 +20,10 @@ export { webfingerHost } from '../pod/urls.mjs';
 // contains; the browser build states `fedipod/` on its own configs. A config
 // that names a root is always believed — this is only the answer for one that
 // does not.
-export const DEFAULT_ROOT = 'activitypods-js/';
+// Every build writes its data into a `fedipod/` container in the pod. This is
+// the answer for a config that names no root; a config that names one is always
+// believed. (`activitypods-js/` was an earlier name, now abandoned.)
+export const DEFAULT_ROOT = 'fedipod/';
 
 // The handle the fediverse sees: a fronted identity's name is the front's.
 export function publicHandle(config) {
@@ -602,29 +605,33 @@ export function contentHtml(text, mentions = []) {
   return '<p>' + html.replace(/\n+/g, '</p><p>') + '</p>';
 }
 
-export function noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions = [],
-  visibility = 'public', summary = null, updated = null, container = null }) {
-  const id = (container || urls.notes) + slug;
-  const who = mentions.map(m => m.actor);
-  // Mastodon's four shapes. Public and unlisted are world-readable; private
-  // (followers-only) and direct carry no Public address at all and belong in
-  // the owner-only container. Mastodon addresses mentions in cc (to, for a
-  // direct post) and will not notify anyone it does not find there or in the
-  // tags.
-  const addressing = {
+// Mastodon's four shapes. Public and unlisted are world-readable; private
+// (followers-only) and direct carry no Public address at all and belong in
+// the owner-only container. Mastodon addresses mentions in cc (to, for a
+// direct post) and will not notify anyone it does not find there or in the
+// tags.
+export function addressing(urls, visibility, who = []) {
+  return {
     public: { to: [PUBLIC], cc: [urls.followers, ...who] },
     unlisted: { to: [urls.followers], cc: [PUBLIC, ...who] },
     private: { to: [urls.followers], cc: who },
     direct: { to: who, cc: [] },
   }[visibility] || { to: [PUBLIC], cc: [urls.followers, ...who] };
+}
+
+export function noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions = [],
+  visibility = 'public', summary = null, updated = null, container = null }) {
+  const id = (container || urls.notes) + slug;
+  const who = mentions.map(m => m.actor);
+  const addressed = addressing(urls, visibility, who);
   const note = {
     '@context': AS_CTX,
     id, type: 'Note',
     attributedTo: urls.actor,
     content: contentHtml(content, mentions),
     published,
-    to: addressing.to,
-    cc: addressing.cc,
+    to: addressed.to,
+    cc: addressed.cc,
     replies: repliesId(id),
   };
   if (summary) note.summary = summary;      // the content warning

package/lib/device/admin/routes/gateway.mjs

@@ -47,7 +47,7 @@ export async function post(p, body, ctx, req, res) {   // eslint-disable-line no
       };
       const podActorId = () => {
         const base = cfg.remotePod.endsWith('/') ? cfg.remotePod : `${cfg.remotePod}/`;
-        const root = cfg.root ? (cfg.root.endsWith('/') ? cfg.root : `${cfg.root}/`) : 'activitypods-js/';
+        const root = cfg.root ? (cfg.root.endsWith('/') ? cfg.root : `${cfg.root}/`) : 'fedipod/';
         return `${base}${root}ap/actor`;
       };
       // The reply first, the restart a beat later — same shape as /update.

package/lib/device/admin/surface.mjs

@@ -76,14 +76,14 @@ const ROUTES = [owner, setup, lifecycle, gateway, social, connections];
 // a fediverse instance must let strangers reach /api and /oauth, so the gate
 // guards the operator's door (basePath) instead of the whole surface.
 export function buildAdminSurface({ agent, gate, allowed, log = console.log,
-  port = null, handle = null, embedded = false, basePath = '/',
+  port = null, handle = null, embedded = false, basePath = '/', mount = '',
   publicOrigin = null, scheme = null,
   versionOnDisk = () => localVersion(projectRoot) }) {
   const json = (res, status, obj) => sendJson(res, status, obj, allowed);
-  const masto = new MastoApi({ agent, log, allowed, scheme, embedded });
+  const masto = new MastoApi({ agent, log, allowed, scheme, embedded, mount });
   // The spec's own write API (§6), beside the facade. Its bearer fallback is
   // the facade's token, so the two surfaces share one notion of the operator.
-  const c2s = new C2S({ agent, log, auth: makeC2sAuth({ agent, masto, log, scheme }) });
+  const c2s = new C2S({ agent, log, auth: makeC2sAuth({ agent, masto, log, scheme, mount }) });
   const streaming = new Streaming({ masto, log, allowed, gate, gateOptional: embedded });
   // Asked per request, not once here: startAdmin runs before connect, so the
   // kind is not known yet at mount time.
@@ -104,21 +104,29 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
     } catch (e) { log(`streaming broadcast: ${e.message}`); }
   };
 
-  // A path as the browser must ask for it: behind the door, prefixed with it.
-  const atPath = (p_) => (basePath === '/' ? p_ : basePath.slice(0, -1) + p_);
+  // A path as the browser must ask for it: under this identity's mount (a
+  // suffix pod's own path, or nothing) and behind the door, prefixed with it.
+  const atPath = (p_) => mount + (basePath === '/' ? p_ : basePath.slice(0, -1) + p_);
 
   // What every route may reach: the agent and the deployment's facts.
   const ctx = { agent, log, allowed, embedded, port, handle, publicOrigin, versionOnDisk, isGroup, json, setup: setup_ };
 
   const handler = async (req, res) => {
     const url = new URL(req.url, 'http://localhost');
+    // A suffix pod's surface answers under its mount (its own path on a shared
+    // host). Strip it once, here, so every route below is matched relative to
+    // the mount and a host-root/subdomain pod (empty mount) is unchanged. The
+    // full path stays on `url`/`req.url` for self-URLs that fold the mount back
+    // in themselves (the pagination base, the DPoP htu).
+    let p = url.pathname;
+    if (mount && (p === mount || p.startsWith(mount + '/'))) p = p.slice(mount.length) || '/';
     // Mastodon-style: the bearer-gated client API and the OAuth + nodeinfo
     // routes answer any origin — a browser client is served the way any
     // instance serves it. CORS headers and the preflight make that work; the
     // bearer stays the only credential, and the Host check below (which is
     // what stops DNS rebinding) still runs.
-    const apiPath = url.pathname.startsWith('/api/') || url.pathname.startsWith('/oauth/')
-      || url.pathname === '/.well-known/nodeinfo' || url.pathname === '/nodeinfo/2.0';
+    const apiPath = p.startsWith('/api/') || p.startsWith('/oauth/')
+      || p === '/.well-known/nodeinfo' || p === '/nodeinfo/2.0';
     if (apiPath) {
       res.setHeader('access-control-allow-origin', '*');
       res.setHeader('access-control-expose-headers', 'Link');
@@ -142,11 +150,11 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
       res.end('forbidden\n');
       return;
     }
-    let p = url.pathname;
-    // Embedded, the operator's door is one path on the pod's origin. Behind it
-    // is everything that was the admin server; in front of it are the protocol
-    // routes, which have to answer strangers because that is what makes the pod
-    // an instance other software can talk to.
+    // Embedded, the operator's door is one path on the pod's origin (under the
+    // mount, when there is one). Behind it is everything that was the admin
+    // server; in front of it are the protocol routes, which have to answer
+    // strangers because that is what makes the pod an instance other software
+    // can talk to.
     let atDoor = !embedded;
     if (embedded && basePath !== '/'
       && (p === basePath.slice(0, -1) || p.startsWith(basePath))) {
@@ -171,7 +179,7 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
       // above still decides who gets this far.
       if (p === '/.well-known/oauth-authorization-server') {
         const scheme = req.socket.encrypted || req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http';
-        return json(res, 200, masto.authorizationServerMetadata(`${scheme}://${req.headers.host}`));
+        return json(res, 200, masto.authorizationServerMetadata(`${scheme}://${req.headers.host}${mount}`));
       }
       if (atDoor && gate(req, res)) return;
       if (p === '/api/v1/streaming/health') {
@@ -180,7 +188,7 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
       // NodeInfo on the agent origin — clients probe it at login.
       if (p === '/.well-known/nodeinfo') {
         return json(res, 200, nodeinfoPointer(
-          `${req.socket.encrypted || req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http'}://${req.headers.host}/nodeinfo/2.0`));
+          `${req.socket.encrypted || req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http'}://${req.headers.host}${mount}/nodeinfo/2.0`));
       }
       if (p === '/nodeinfo/2.0') {
         return json(res, 200, nodeinfoDoc({
@@ -206,8 +214,8 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
         // Our own pages come before the group check: a group is set up in the
         // browser like anything else, and it has a record to edit. It still
         // serves no fediverse client — see the 404 two lines down.
-        const mount = webMount(p);
-        if (mount) {
+        const wmount = webMount(p);
+        if (wmount) {
           // Without the slash a page's own relative <script src> resolves one
           // level up and 404s — and that is true at any depth, so ask the
           // filesystem rather than only special-casing the mount itself.
@@ -217,7 +225,7 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
             res.end();
             return;
           }
-          return serveWeb(res, p, mount, allowed);
+          return serveWeb(res, p, wmount, allowed);
         }
         // The bare URL means "show me what this agent wants from me now".
         // Keyed on the credential FILE, never on configured(): a healthy

package/lib/device/cli/commands/setup.mjs

@@ -18,7 +18,7 @@ export async function setup() {
   if (process.stdin.isTTY && !has('cli') && !IDENTITY_FLAGS.some(f => args.includes('--' + f))) {
     return runBrowserSetup();
   }
-const root = flag('root');
+const root = flag('root') || 'fedipod/';   // new installs default to the fedipod/ container
 const kind = has('group') ? 'group' : 'person';
 const approveJoins = has('group') && has('approve-joins');
 const summary = flag('summary');
@@ -48,6 +48,14 @@ if (!newAccount && !pod) {
   }
 }
 if (!newAccount && !pod) { console.error('no pod given'); process.exit(2); }
+if (!newAccount) {
+  const { resourceExists } = await import(new URL('../../../../lib/pod/root.mjs', import.meta.url));
+  const { apUrls, DEFAULT_ROOT: DR } = await import(new URL('../../../../lib/core/wire.mjs', import.meta.url));
+  if (await resourceExists(fetch, apUrls(pod, DR).actor)) {
+    console.error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
+    process.exit(2);
+  }
+}
 
 const issuer = flag('issuer') || await ask('Solid identity provider', 'https://solidcommunity.net');
 // Before the password is asked for, let alone sent. The issuer is where it

package/lib/device/setup.mjs

@@ -19,6 +19,7 @@ import { hashPassword } from '../client/masto/index.mjs';
 import { webfingerHost, apUrls, DEFAULT_ROOT } from '../core/wire.mjs';
 import { rootOf, recordLastUsed, writeJsonAtomic } from './home.mjs';
 import { insecureUrlReason } from '../shared/safefetch.mjs';
+import { resourceExists } from '../pod/root.mjs';
 import { CURRENT_LAYOUT, isCurrent } from './migrate.mjs';
 
 const SOLID = $rdf.Namespace('http://www.w3.org/ns/solid/terms#');
@@ -222,6 +223,8 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
     gateway = null, shape = 'pod', gatewayOrigin = 'https://fedipod.net',
   } = answers;
   let { pod, root } = answers;
+  if (!root) root = 'fedipod/';   // new installs default to the fedipod/ container; a
+  // resuming run overwrites this with the credential's own root below.
   let accountWebId = null;   // what createAccountWithPod reported, when it ran
   // The private half always starts here, beside the credential and the keys —
   // not on the pod. Every activity you receive would otherwise cost the pod
@@ -263,6 +266,9 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       // reachable, and no silent 401 later on a pod whose profile is empty.
       const usable = await checkPod(pod);
       if (!usable.ok) throw new Error(usable.error);
+      if (await (deps.resourceExists || resourceExists)(deps.fetch || fetch, apUrls(pod, root || DEFAULT_ROOT).actor)) {
+        throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
+      }
       skip('account', 'using the pod you already have');
     }
 

package/lib/gateway/front-core.mjs

@@ -16,10 +16,11 @@
 // HTTPS box is another. UN-DEPLOYED — nothing in FediPod runs it.
 
 import crypto from 'node:crypto';
-import { handleDelivery } from './gateway-core.mjs';
+import { handleDelivery, handleOwnerPost } from './gateway-core.mjs';
 import { readCapped, safeFetch, isLoopbackHost } from '../shared/safefetch.mjs';
 import * as podRoot from '../pod/root.mjs';
 import * as podPolicy from '../pod/policy.mjs';
+import { podBaseOfWebId } from '../pod/urls.mjs';
 
 // The one WebFinger document, spelled out here rather than imported from
 // wire.mjs: wire drags the agent's whole HTML pipeline (sanitize-html and
@@ -513,20 +514,31 @@ async function route(request, ctx) {
     if (!/^https?:\/\/\S+\/$/.test(podBase)) {
       return j(400, { error: 'podBase must be a URL ending in /' });
     }
-    // An identity needs an origin of its own, so only an origin root may opt
-    // in. Anything deeper would also let one path-pod user claim an ancestor
-    // of another's pod.
-    try {
-      if (new URL(podBase).pathname !== '/') {
-        return j(403, { error: 'podBase must be a pod origin root, like https://mei.example.org/' });
-      }
-    } catch { return j(400, { error: 'podBase is not a URL' }); }
+    let podUrl;
+    try { podUrl = new URL(podBase); } catch { return j(400, { error: 'podBase is not a URL' }); }
+    // A pod may be host-root (its own origin) or on a PATH of a shared host — a
+    // suffix pod, which the Server runs at `https://server/aisha/`. What is
+    // refused is the gateway's own origin root itself: that is where the
+    // gateway lives, not a pod, and admitting it would (with the ownership
+    // fallback below) let a co-tenant claim the whole origin.
+    if (ctx.frontOrigin) {
+      try {
+        if (podUrl.origin === new URL(ctx.frontOrigin).origin && podUrl.pathname === '/') {
+          return j(403, { error: 'that is this gateway, not a pod — name the pod that holds your data' });
+        }
+      } catch { /* no usable frontOrigin: the checks below still apply */ }
+    }
+    if (/(^|\/)\.internal(\/|$)/u.test(podUrl.pathname) || /(^|\/)\.\.(\/|$)/u.test(podUrl.pathname)) {
+      return j(403, { error: 'that is not a pod address' });
+    }
     const webid = await verifyPodToken(request, pathname, ctx.verifier);
     if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
-    // The pod's own server names its owner when it can. Where it does, that is
-    // the proof; where it does not, the WebID must at least live under the pod.
+    // The pod's own server names its owner when it can, and where it does that
+    // is the proof. Where it does not, the WebID must live in EXACTLY this pod
+    // — its own pod base equal to podBase, not merely starting with it, which on
+    // a path server an ancestor of another's pod would.
     const owners = await podOwners(podBase, ctx.fetchImpl || fetch);
-    const proven = owners.length ? owners.includes(webid) : webid.startsWith(podBase);
+    const proven = owners.length ? owners.includes(webid) : podBaseOfWebId(webid) === podBase;
     if (!proven) {
       return j(403, { error: 'the token proves a different pod than the one you listed' });
     }
@@ -607,6 +619,48 @@ async function route(request, ctx) {
     return { status, headers: {}, body: '' };
   }
 
+  // Outbox: the owner's own post, from any client that speaks ActivityPub
+  // client-to-server (dokieli, say). Cross-origin by nature — such a client is
+  // a page on another site — so this route answers a preflight and carries
+  // CORS headers; the owner's pod token is the credential, so any origin may
+  // ask. GET stays a read: the pod's document for a fronted account, sent on
+  // to the pod for a door account whose documents live at their own address.
+  if (up.rest === 'ap/outbox') {
+    const cors = {
+      'access-control-allow-origin': '*',
+      'access-control-allow-methods': 'GET, POST, OPTIONS',
+      'access-control-allow-headers': 'Authorization, DPoP, Content-Type, Slug, Link',
+      'access-control-expose-headers': 'Location, Accept-Post',
+      'access-control-max-age': '86400',
+    };
+    if (request.method === 'OPTIONS') {
+      // Accept-Post names JSON only: a client that reads it (dokieli) sends
+      // JSON-LD when HTML is not offered.
+      // body null, not '': a Response refuses any body on a 204, and the
+      // function adapter hands `body` straight to one.
+      return { status: 204, headers: { ...cors, allow: 'GET, POST, OPTIONS',
+        'accept-post': 'application/ld+json, application/activity+json' }, body: null };
+    }
+    if (request.method === 'POST') {
+      const json = (status, obj, extra = {}) => ({ status,
+        headers: { ...cors, 'content-type': 'application/json', 'cache-control': 'no-store', ...extra },
+        body: JSON.stringify(obj) });
+      const webid = await verifyPodToken(request, pathname, ctx.verifier);
+      if (!webid) return json(401, { error: 'a Solid-OIDC token proving this account\'s owner is required' });
+      const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
+      if (!owner) return json(403, { error: 'this outbox belongs to its owner alone' });
+      const { status, reason, location } = await handleOwnerPost(request, identFor(rec),
+        { podPut: (u, b, ct) => ctx.podPut(up.handle, u, b, ct), ownerWebId: webid });
+      console.log(`door @${up.handle}: owner post → ${status} (${reason})`);
+      if (status !== 202) return json(status, { error: reason });
+      return json(202, { accepted: true, ...(location ? { object: location } : {}),
+        note: 'it goes out when your FediPod agent next runs' }, location ? { location } : {});
+    }
+    if (rec.inboxOnly && (request.method === 'GET' || request.method === 'HEAD')) {
+      return { status: 303, headers: { ...cors, location: rec.podHome + 'ap/outbox', 'cache-control': 'no-store' }, body: '' };
+    }
+  }
+
   // Everything else is a public GET, served by reading the user's pod and
   // rewriting pod ids to the front. The actor also gets its handle and inbox
   // fixed to the front so a consumer cross-checks it consistently.

package/lib/gateway/gateway-core.mjs

@@ -110,4 +110,44 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
   return { status: 202, reason: v.verified ? 'verified' : 'buffered-unverified' };
 }
 
+// The outbox door: the owner's own post, taken on their behalf.
+//
+// A client such as dokieli POSTs an activity — or a bare object — to the
+// outbox address the actor advertises. The door holds no key and mints nothing:
+// it checks that the token proves the account's owner (the caller has already
+// done that and hands in `owner`), writes the bytes into the pod inbox exactly
+// as verified mail is written, and stamps them with a receipt whose method is
+// `c2s` and whose actor is this account. The drain hands such an item to the
+// client-to-server dispatcher, which publishes and delivers it — so the post
+// goes out when the agent next runs, the same way inbound mail is read.
+//
+// `slug` is the name the client asked for its new document. It rides in the
+// receipt so the dispatcher can use it, and it is what lets the door answer a
+// Location before anything exists: the object will live at notesPrefix+slug
+// unless that name is taken, in which case the agent mints another.
+export const SLUG_OK = /^[A-Za-z0-9._-]{1,64}$/u;
+export const safeSlug = (s) => (typeof s === 'string' && SLUG_OK.test(s) && !/^\.+$/u.test(s) ? s : null);
+
+export async function handleOwnerPost(request, ident, { podPut, ownerWebId, maxBytes = DEFAULT_MAX_BYTES } = {}) {
+  if (!ident.hmacSecret) return { status: 409, reason: 'this account has no door secret — attach it again' };
+  let raw;
+  try { raw = await request.text(); } catch { return { status: 400, reason: 'unreadable body' }; }
+  if (Buffer.byteLength(raw) > maxBytes) return { status: 413, reason: 'too large' };
+  let doc;
+  try { doc = JSON.parse(raw); } catch { return { status: 400, reason: 'unparsable JSON' }; }
+  if (!doc || typeof doc !== 'object' || Array.isArray(doc) || !doc.type) {
+    return { status: 400, reason: 'a typed ActivityStreams object is required' };
+  }
+  const slug = safeSlug(request.headers.get('slug'));
+  const receipt = signReceipt({
+    v: 1, verified: true, method: 'c2s', keyId: ownerWebId || null, actor: ident.actorUrl,
+    checks: ['owner-token'], reason: 'owner', gateway: ident.gatewayWebId, ...(slug ? { slug } : {}),
+  }, ident.hmacSecret);
+  const hash = sha256hex(raw);
+  const okA = await inbox.appendVerifiedDelivery(podPut, ident.inboxUrl, hash, raw);
+  if (!okA) return { status: 502, reason: 'pod inbox write failed' };
+  await inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt);
+  return { status: 202, reason: 'accepted', location: slug && ident.notesPrefix ? ident.notesPrefix + slug : null };
+}
+
 export const _internal = { isBlocked, concernsUsAtEdge, httpUrl, sha256hex };