fedipod-server 0.21.0 → 0.28.0

package/README.md

@@ -4,7 +4,7 @@
 
 This is a CSS component. Install it in a fresh server instance or an instance
 you already run for pods, and turn sign-up on. A pod owner signs in at the
-server's `/run` page and opts in; from then on their pod is a full fediverse
+server's `/.fediverse-account` page and opts in; from then on their pod is a full fediverse
 account: it accepts follows, delivers their posts, and serves their Mastodon
 client at the pod's own address. Signing up is the only way an account is
 made, and opting out is the only way one ends.
@@ -110,7 +110,8 @@ naming the pod the identity runs on. Nothing private is in it.
 | `agentDataDir` | Where each identity keeps the file naming its pod; its log lines go to the server's own log. Required whenever sign-up is on. |
 | `agentUiPath` | Where the owner's pages live on the pod's origin. `/fp/` by default; empty serves no pages. On a suffix pod it is under the pod's path, e.g. `/aisha/fp/`. |
 | `agentRegistryContainer` | The internal container holding the sign-up rows. |
-| `runPage` | The HTML served at `/run`: the page where a pod owner opts in or out. The package's own `web/front/run.html` is served unless you set this. |
+| `runPage` | The HTML of the page where a pod owner opts in or out. The package's own `web/front/run.html` is served unless you set this. |
+| `runPath` | Where that page answers. `/.fediverse-account` unless you set it. The path it takes is one the pod no longer serves, so it is yours to name; the dot keeps it out of the way of anybody's data. |
 | `agentWebIdSuffix` | Path from a pod's base to its owner's WebID. Defaults to `profile/card#me`. |
 | `agentPollSeconds` | How often the inbox is swept. Deliveries also wake the sweep as they land, so this is the fallback. |
 | `agentAutoAcceptFollows` | Whether a newly provisioned identity accepts follows without review. On by default. |
@@ -122,7 +123,7 @@ naming the pod the identity runs on. Nothing private is in it.
 | `directoryContainer` | The internal container holding the handle directory. |
 | `agentAutoFront` | Whether every identity that starts also gets a `@handle@frontHost` address — an inbox-only directory row, written once. Off by default. |
 | `offersPods` | Whether the signup page offers to create pods here. |
-| `signupPage` | The signup page served at `/`, `/signup` and `/new-account`. The package's own is served unless you set this. |
+| `signupPage` | Unused on a pod server: making an account and a pod is the server's own, and this component does not answer `/`, `/signup` or `/new-account`. A gateway, which has no pod server behind it, serves this page. |
 | `gatewayWebId` | The WebID stamped on verification receipts. |
 
 `signupPage` and `runPage` are the page's HTML itself, not a path to a file.
@@ -195,7 +196,7 @@ as before.
 
 ## How sign-up works
 
-A pod owner opens the `/run` page, signs in with their pod,
+A pod owner opens the `/.fediverse-account` page, signs in with their pod,
 and opts in or out. Underneath it is one endpoint:
 
 ```

package/dist/claims.d.ts

@@ -1,7 +1,9 @@
+/** Where a pod owner opts their identity in, when the operator named it. */
+export declare const DEFAULT_RUN_PATH = "/.fediverse-account";
 export declare function claims(input: {
     host?: string;
     pathname: string;
-}, frontHost: string): boolean;
+}, frontHost: string, runPath?: string): boolean;
 export declare const isInboxPath: (pathname: string) => boolean;
 /**
  * True when this path belongs to an identity's client surface.

package/dist/claims.js

@@ -4,22 +4,35 @@
 // front's apex the gateway answers the fediverse routes; a pod subdomain is a
 // real Solid pod and is never claimed.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isInboxPath = void 0;
+exports.isInboxPath = exports.DEFAULT_RUN_PATH = void 0;
 exports.claims = claims;
 exports.agentClaims = agentClaims;
-const FRONT_PATHS = new Set(['/', '/signup', '/new-account', '/run', '/roster',
+// Signing up is CSS's, untouched: a person makes an account and a pod the way
+// this server already does it, and nothing here needs saying to them about
+// FediPod. Becoming a fediverse identity comes later and separately — they
+// have a pod, they are logged in, and they opt it in at /run. So none of '/',
+// '/signup' or '/new-account' is claimed on a pod server. A gateway is the
+// other case: it has no pod server behind it, arranging the pod IS its job,
+// and its own front keeps those pages.
+const FRONT_PATHS = new Set(['/roster',
     '/.well-known/webfinger', '/api/handle', '/api/attach', '/api/agent',
     '/api/roster', '/api/revoke',
-    // What the pages load: the sign-in library the /run and /admin pages use, and
-    // the installer the signup page hands every new user.
-    '/solid-oidc-client.js', '/install']);
-function claims(input, frontHost) {
+    // What the pages that remain load: the sign-in library the opt-in and
+    // roster pages use, and the installer, which is FediPod's own to hand out.
+    '/solid-oidc-client.js', '/install',
+    // Each page's own script, served beside it; a page without its script has
+    // buttons that never wake up.
+    '/new-account.js', '/run.js', '/admin.js']);
+/** Where a pod owner opts their identity in, when the operator named it. */
+exports.DEFAULT_RUN_PATH = '/.fediverse-account';
+function claims(input, frontHost, runPath = exports.DEFAULT_RUN_PATH) {
     if (!input.host || !frontHost)
         return false;
     const bare = String(input.host).split(':')[0].toLowerCase();
     if (bare !== String(frontHost).toLowerCase())
         return false; // a pod subdomain → not ours
-    return FRONT_PATHS.has(input.pathname) || input.pathname.startsWith('/u/')
+    return FRONT_PATHS.has(input.pathname) || input.pathname === runPath
+        || input.pathname.startsWith('/u/')
         || input.pathname.startsWith('/@'); // the short profile address
 }
 // What an identity answers on its own pod's origin: the protocol routes other

package/dist/components/context.jsonld

@@ -32,6 +32,9 @@
           "args_runPage": {
             "@id": "fps:dist/handler.jsonld#FediPodServerHandler_args_runPage"
           },
+          "args_runPath": {
+            "@id": "fps:dist/handler.jsonld#FediPodServerHandler_args_runPath"
+          },
           "args_adminPage": {
             "@id": "fps:dist/handler.jsonld#FediPodServerHandler_args_adminPage"
           },
@@ -86,6 +89,9 @@
           "runPage": {
             "@id": "fps:dist/handler.jsonld#FediPodServerHandler_args_runPage"
           },
+          "runPath": {
+            "@id": "fps:dist/handler.jsonld#FediPodServerHandler_args_runPath"
+          },
           "adminPage": {
             "@id": "fps:dist/handler.jsonld#FediPodServerHandler_args_adminPage"
           },

package/dist/handler.d.ts

@@ -16,8 +16,10 @@ export interface FediPodServerArgs {
     offersPods?: boolean;
     /** The new-account page HTML served at the root. */
     signupPage?: string;
-    /** The run-your-identity page HTML served at /run. */
+    /** The run-your-identity page HTML. */
     runPage?: string;
+    /** Where that page answers. Defaults to `/.fediverse-account`; the path it takes is one the pod server no longer serves, so an operator may name it. */
+    runPath?: string;
     /** The accounts-roster page HTML served at /roster. */
     adminPage?: string;
     /** Directory holding each agent identity's signing key and log. Required when runtime opt-in is on. */
@@ -63,6 +65,7 @@ export declare class FediPodServerHandler extends HttpHandler implements Initial
     private readonly args;
     private readonly io;
     readonly dir: Directory;
+    private readonly runPath;
     private readonly podPut;
     private readonly logger;
     private readonly claimed;
@@ -149,12 +152,37 @@ export declare class FediPodServerHandler extends HttpHandler implements Initial
      * reply and nowhere else. Re-opting-in rotates the secret — that is how a
      * lost one is recovered.
      */
+    /**
+     * The WebIDs behind the account session in the request, or none. The server
+     * keeps that session in a `css-account` cookie; its own account API is what
+     * says which WebIDs the session owns, and it takes the same cookie. Nothing
+     * here trusts the cookie's presence — the account API does the deciding, and
+     * the caller picks the WebID that owns the pod being claimed.
+     */
+    webIdsFromSession(request: {
+        headers: {
+            get(name: string): string | null;
+        };
+    }): Promise<string[]>;
     optInPod({ podBase, webId }: {
         podBase: string;
         webId: string;
     }): Promise<Record<string, unknown> & {
         httpStatus: number;
     }>;
+    /**
+     * What a pod would be as an identity here, without changing anything: its
+     * handle, the host its address carries, and whether it runs here already.
+     */
+    describePod({ podBase }: {
+        podBase: string;
+    }): Promise<{
+        handle: string;
+        host: string;
+        address: string;
+        running: boolean;
+        manage: string;
+    }>;
     /** The reverse: stop the identity and let the pod be plain LDP again. */
     optOutPod({ podBase }: {
         podBase: string;

package/dist/handler.js

@@ -58,6 +58,13 @@ function deriveHandle(podBase) {
     const segments = u.pathname.split('/').filter((seg) => seg.length > 0);
     return segments.length > 0 ? segments[segments.length - 1] : u.hostname.split('.')[0];
 }
+/** The opt-in page's path: leading slash, no trailing one, the default when unset. */
+function normalizeRunPath(raw) {
+    const said = String(raw ?? '').trim().replace(/\/+$/u, '');
+    if (!said)
+        return claims_1.DEFAULT_RUN_PATH;
+    return said.startsWith('/') ? said : `/${said}`;
+}
 /** A door path always has both slashes, so claiming and stripping agree. */
 function normalizeUiPath(raw) {
     if (raw === '')
@@ -69,6 +76,7 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
     args;
     io;
     dir;
+    runPath;
     podPut;
     logger = (0, community_server_1.getLoggerFor)(this);
     // Every pod whose routes this server claims, keyed by pod base. A claim
@@ -107,6 +115,9 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         // hostname, not host: the claim check compares bare hostnames, so a port
         // carried here would stop the front matching its own requests.
         this.frontHost = args.frontHost || new URL(args.frontOrigin).hostname;
+        // One answer for both the claim and the route, so a server cannot answer
+        // at one path and refuse at another.
+        this.runPath = normalizeRunPath(args.runPath);
         this.uiPath = normalizeUiPath(args.agentUiPath);
         this.registry = args.agentRuntimeOptIn
             ? (0, directory_1.makeAgentRegistry)(this.io, absolute(args.agentRegistryContainer ?? '/.internal/fedipod/agents/'))
@@ -391,7 +402,7 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         // The front's own routes win first, so a suffix pod can never shadow the
         // door's dispatch, its WebFinger or its API even where its mount would
         // otherwise contain that path.
-        if ((0, claims_1.claims)({ host, pathname }, this.frontHost))
+        if ((0, claims_1.claims)({ host, pathname }, this.frontHost, this.runPath))
             return;
         // Claimed from the opt-in roster, never from what is running: a pod resource
         // must not be served by CSS for the seconds before an identity finishes
@@ -432,6 +443,37 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
      * reply and nowhere else. Re-opting-in rotates the secret — that is how a
      * lost one is recovered.
      */
+    /**
+     * The WebIDs behind the account session in the request, or none. The server
+     * keeps that session in a `css-account` cookie; its own account API is what
+     * says which WebIDs the session owns, and it takes the same cookie. Nothing
+     * here trusts the cookie's presence — the account API does the deciding, and
+     * the caller picks the WebID that owns the pod being claimed.
+     */
+    async webIdsFromSession(request) {
+        const cookie = request.headers.get('cookie');
+        if (!cookie || !/(?:^|;\s*)css-account=/u.test(cookie))
+            return [];
+        const base = this.args.frontOrigin.replace(/\/$/u, '');
+        const asJson = { cookie, accept: 'application/json' };
+        try {
+            const index = await fetch(`${base}/.account/`, { headers: asJson });
+            if (!index.ok)
+                return [];
+            const controls = (await index.json()).controls;
+            const webIdLink = controls?.account?.webId;
+            if (!webIdLink)
+                return [];
+            const linked = await fetch(webIdLink, { headers: asJson });
+            if (!linked.ok)
+                return [];
+            const links = (await linked.json()).webIdLinks ?? {};
+            return Object.keys(links);
+        }
+        catch {
+            return [];
+        }
+    }
     async optInPod({ podBase, webId }) {
         if (!this.registry)
             return { httpStatus: 501, error: 'this server does not offer runtime opt-in' };
@@ -474,6 +516,39 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         return { httpStatus: 201, ok: true, handle, host,
             doorSecret: door.secret, doorPath: this.uiPath, status: 'starting' };
     }
+    /**
+     * What a pod would be as an identity here, without changing anything: its
+     * handle, the host its address carries, and whether it runs here already.
+     */
+    async describePod({ podBase }) {
+        const base = podBase.endsWith('/') ? podBase : `${podBase}/`;
+        const handle = deriveHandle(base);
+        let host;
+        try {
+            host = this.validateAgentPod(base).host;
+        }
+        catch {
+            host = new URL(base).host.toLowerCase();
+        }
+        const running = this.agentHandles.get(handle) === base;
+        // The management page's door takes its key once in the address and keeps
+        // the browser in with a cookie. Only the owner's own page ever asks for
+        // this description, so the key rides on the link for a running account.
+        // Read from the pod, where the key always is, rather than from what this
+        // process happens to hold: an account still starting has none in memory.
+        let key;
+        if (running) {
+            try {
+                key = (await this.doorSecretFor(base)).secret;
+            }
+            catch {
+                key = this.doorSecrets.get(base);
+            }
+        }
+        const door = base.replace(/\/$/u, '') + this.uiPath;
+        return { handle, host, address: `@${handle}@${host}`, running,
+            manage: key ? `${door}?dk-token=${encodeURIComponent(key)}` : door };
+    }
     /** The reverse: stop the identity and let the pod be plain LDP again. */
     async optOutPod({ podBase }) {
         if (!this.registry)
@@ -530,7 +605,7 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         // The front's own routes win first — its dispatch, WebFinger and API sit at
         // the apex above every suffix pod — so a claim is consulted only where the
         // front does not answer.
-        const claimed = (0, claims_1.claims)({ host, pathname }, this.frontHost) ? null : this.resolveClaim(host, pathname);
+        const claimed = (0, claims_1.claims)({ host, pathname }, this.frontHost, this.runPath) ? null : this.resolveClaim(host, pathname);
         if (claimed) {
             const identity = this.surfaces.get(claimed.podBase);
             if (!identity) {
@@ -572,13 +647,21 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         const out = await routeFront(whatwg, {
             host: this.frontHost,
             frontOrigin: this.args.frontOrigin,
+            // This server issued the session the reader is already using, so it can
+            // read it rather than sending them to an identity provider that has just
+            // told them who they are. Same-origin only; front-core decides that.
+            webIdsFromSession: (req) => this.webIdsFromSession(req),
             gatewayWebId: this.args.gatewayWebId,
             offersPods: !!this.args.offersPods,
             signupPage: this.args.signupPage || webFile('new-account.html'),
             runPage: this.args.runPage || webFile('run.html'),
+            runPath: this.runPath,
             adminPage: this.args.adminPage || webFile('admin.html'),
-            // The /run and /roster pages load the sign-in library, and the signup page
-            // hands out the installer command; without these the pages render but
+            // The notices page renders here too, and says the server keeps none:
+            // a notices store is the Netlify front's, not this component's.
+            noticesPage: webFile('notices.html'),
+            // The opt-in and roster pages load the sign-in library, and the installer
+            // command is handed out with it; without these the pages render but
             // cannot be used.
             authBundle: webFile('solid-oidc-client.js'),
             // Each page's own script — inline until 2026-09-09, so that the pages can
@@ -587,6 +670,7 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
                 'new-account.js': webFile('new-account.js'),
                 'run.js': webFile('run.js'),
                 'admin.js': webFile('admin.js'),
+                'notices.js': webFile('notices.js'),
             },
             installScript: webFile('install.sh'),
             lookup: (h) => this.dir.lookup(h),
@@ -628,6 +712,7 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
                 ? {
                     optIn: (a) => this.optInPod(a),
                     optOut: (a) => this.optOutPod(a),
+                    describe: (a) => this.describePod(a),
                 }
                 : undefined,
         });

package/dist/handler.jsonld

@@ -93,7 +93,20 @@
               }
             ]
           },
-          "comment": "The run-your-identity page HTML served at /run."
+          "comment": "The run-your-identity page HTML."
+        },
+        {
+          "@id": "fps:dist/handler.jsonld#FediPodServerHandler_args_runPath",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "xsd:string",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          },
+          "comment": "Where that page answers. Defaults to `/.fediverse-account`; the path it takes is one the pod server no longer serves, so an operator may name it."
         },
         {
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler_args_adminPage",
@@ -240,6 +253,10 @@
           "memberFieldName": "dir",
           "range": "fps:dist/directory.jsonld#Directory"
         },
+        {
+          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_runPath",
+          "memberFieldName": "runPath"
+        },
         {
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_podPut",
           "memberFieldName": "podPut"
@@ -344,10 +361,18 @@
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_matchIdentity",
           "memberFieldName": "matchIdentity"
         },
+        {
+          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_webIdsFromSession",
+          "memberFieldName": "webIdsFromSession"
+        },
         {
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_optInPod",
           "memberFieldName": "optInPod"
         },
+        {
+          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_describePod",
+          "memberFieldName": "describePod"
+        },
         {
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_optOutPod",
           "memberFieldName": "optOutPod"
@@ -413,6 +438,12 @@
                 "@id": "fps:dist/handler.jsonld#FediPodServerHandler_args_runPage"
               }
             },
+            {
+              "keyRaw": "runPath",
+              "value": {
+                "@id": "fps:dist/handler.jsonld#FediPodServerHandler_args_runPath"
+              }
+            },
             {
               "keyRaw": "adminPage",
               "value": {
@@ -515,6 +546,10 @@
           "@id": "fps:dist/handler.jsonld#FediPodServerArgs__member_runPage",
           "memberFieldName": "runPage"
         },
+        {
+          "@id": "fps:dist/handler.jsonld#FediPodServerArgs__member_runPath",
+          "memberFieldName": "runPath"
+        },
         {
           "@id": "fps:dist/handler.jsonld#FediPodServerArgs__member_adminPage",
           "memberFieldName": "adminPage"

package/lib/client/c2s.mjs

@@ -5,8 +5,12 @@
 // SAME helper the facade and admin surfaces use — this module re-implements
 // no persistence and no delivery, so one write path stays one.
 //
-// GETs on the actor and outbox are redirects: the pod's documents are the
-// canonical ones, and a second renderer here would only drift from them.
+// GETs on the actor and outbox are redirects to the pod's documents wherever
+// those are reachable, which is the Server. Standalone they are not: the actor
+// published there names no address a local client could write to, and on a
+// fronted account the published outbox address is the Gateway's write door,
+// which does not answer a read. So on that build both are served here, to the
+// client already talking to this agent.
 //
 // `dispatch` takes an activity and answers with { status, body, headers }; it
 // touches no request or response. The HTTP handler below is one caller. The
@@ -32,6 +36,9 @@ const MAX_BODY = 512 * 1024;          // same ceiling the inbox drain enforces
 // the pod an unbounded read; the log says when that happened.
 const MAX_INBOX_PAGE = 500;
 
+// How many recorded activities one page of the locally-served outbox carries.
+const MAX_OUTBOX_PAGE = 50;
+
 // §6 names activities; anything else with a type is an object to wrap.
 const ACTIVITY_TYPES = new Set([
   'Create', 'Update', 'Delete', 'Follow', 'Like', 'Announce', 'Undo',
@@ -56,10 +63,15 @@ function readBody(req) {
 }
 
 export class C2S {
-  constructor({ agent, log = console.log, auth }) {
+  constructor({ agent, log = console.log, auth, scheme = null, mount = '' }) {
     this.agent = agent;
     this.log = log;
     this.auth = auth;
+    // What this agent calls itself, for the actor it serves a local client.
+    // The same two values oidc-auth rebuilds the DPoP `htu` from, so the two
+    // surfaces agree on the address a client just used.
+    this.scheme = scheme;
+    this.mount = mount;
   }
 
   get store() { return this.agent.store; }
@@ -157,6 +169,85 @@ export class C2S {
     });
   }
 
+  // The actor a client-to-server client on this machine reads. The same
+  // document the pod holds, but for the fields naming where a write goes —
+  // the outbox and the two OAuth endpoints — and for `id`, which names this
+  // address so the client files its credential here and comes back. The pod's
+  // id stays on as an alias; the two are one identity.
+  // What this agent calls itself, to the client that just asked. The Host
+  // passed the Authorities firewall before any route ran, so whichever alias
+  // the client used is one this agent answers on. The scheme is read off the
+  // connection unless the caller named one: only the Server passes a scheme,
+  // and standalone this listener is its own TLS.
+  localOrigin(req) {
+    const host = req.headers.host;
+    if (!host) return null;
+    const scheme = this.scheme
+      || (req.socket?.encrypted || req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http');
+    return `${scheme}://${host}${this.mount}/`;
+  }
+
+  /**
+   * The owner's own outbox, from what this agent recorded. The pod holds the
+   * published copy and it stays the canonical one; this is served only where
+   * that copy cannot be read by the client asking.
+   */
+  sendLocalOutbox(res, url, origin) {
+    const id = `${origin}ap/outbox`;
+    const outbox = this.store.read('outbox.json', []);     // newest first
+    const page = url?.searchParams?.get('page') || null;
+    const ct = { 'content-type': 'application/activity+json; charset=utf-8' };
+    if (!page) {
+      return this.send(res, 200, {
+        '@context': wire.AS_CTX, id, type: 'OrderedCollection', totalItems: outbox.length,
+        ...(outbox.length ? { first: `${id}?page=1` } : { orderedItems: [] }),
+      }, ct);
+    }
+    const n = Number(page);
+    if (!Number.isInteger(n) || n < 1) {
+      return this.send(res, 400, { error: 'page is a whole number from 1' });
+    }
+    const start = (n - 1) * MAX_OUTBOX_PAGE;
+    const items = outbox.slice(start, start + MAX_OUTBOX_PAGE);
+    return this.send(res, 200, {
+      '@context': wire.AS_CTX,
+      id: `${id}?page=${n}`,
+      type: 'OrderedCollectionPage',
+      partOf: id,
+      ...(start + items.length < outbox.length ? { next: `${id}?page=${n + 1}` } : {}),
+      // A post is recorded by its object id and published as the Create beside
+      // it — the same mapping the pod's copy uses, from the same helper.
+      orderedItems: items.map(wire.outboxWireItem),
+    }, ct);
+  }
+
+  sendLocalActor(req, res, origin) {
+    const pub = this.agent.publisher;
+    const cfg = pub.config || {};
+    const gw = cfg.gateway;
+    const gwActive = gw && gw.url && gw.mode && gw.mode !== 'off';
+    const doc = pub.actorDocFor({
+      inbox: gwActive ? gw.url : (cfg.inboxUrl || null),
+      clientOrigin: origin,
+    });
+    // A client files its credential under the id it reads here and comes back
+    // to that address for everything after, so this document has to name
+    // itself. The pod's id stays on as an alias rather than being dropped —
+    // the two are one identity. Nothing published ever carries this id: every
+    // activity the dispatcher builds names the pod's actor.
+    const canonical = doc.id;
+    doc.id = `${origin}ap/actor`;
+    doc.alsoKnownAs = [...new Set([...(doc.alsoKnownAs || []), canonical])];
+    const body = JSON.stringify(doc);
+    res.writeHead(200, {
+      'content-type': 'application/activity+json; charset=utf-8',
+      'cache-control': 'no-store',
+      'content-length': Buffer.byteLength(body),
+    });
+    res.end(req.method === 'HEAD' ? undefined : body);
+    return true;
+  }
+
   async handle(req, res, pathname, url) {   // eslint-disable-line no-unused-vars
     if (pathname !== '/ap/outbox' && pathname !== '/ap/actor' && pathname !== '/ap/inbox') return false;
     if (req.method === 'OPTIONS') {
@@ -179,6 +270,12 @@ export class C2S {
       return this.sendInbox(res, url);
     }
     if (req.method === 'GET' || req.method === 'HEAD') {
+      // Where the client surface answers on an address a stranger can reach,
+      // the pod's copies already name it and are the documents. Standalone
+      // they are not reachable by the client asking, so it is answered here.
+      const local = this.agent.publisher?.clientOrigin ? null : this.localOrigin(req);
+      if (local && pathname === '/ap/actor') return this.sendLocalActor(req, res, local);
+      if (local && pathname === '/ap/outbox') return this.sendLocalOutbox(res, url, local);
       // The pod's copy is the document; send the reader there.
       const target = pathname === '/ap/actor' ? this.urls.actor : this.urls.outbox;
       res.writeHead(303, { location: target, 'cache-control': 'no-store' });

package/lib/client/masto/accounts.mjs

@@ -6,8 +6,7 @@
 import crypto from 'node:crypto';
 import * as podMedia from '../../pod/media.mjs';
 import * as social from '../../core/social.mjs';
-import { readBody } from './body.mjs';
-import { readMultipart } from './media.mjs';
+import { readBody, readMultipart } from './body.mjs';
 
 export async function handle(api, ctx) {
   const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
@@ -226,6 +225,39 @@ export async function handle(api, ctx) {
 
   if (/^\/api\/v1\/accounts\/[a-f0-9]+\/featured_tags$/.test(pathname)) return send(200, []);
 
+  // The instance's own directory is its one account; there is nothing to
+  // suggest and nothing trending, so those screens are empty rather than 404.
+  if (pathname === '/api/v1/directory') return send(200, api.urls?.actor ? [api.account(api.urls.actor)] : []);
+  if (pathname === '/api/v1/suggestions') return send(200, []);
+
+  // The lists this account is on — what "add to list" from a profile reads.
+  const mAccLists = /^\/api\/v1\/accounts\/([a-f0-9]+)\/lists$/.exec(pathname);
+  if (mAccLists && req.method === 'GET') {
+    const actorUrl = api.store.urlFor(mAccLists[1]);
+    if (!actorUrl) return send(404, { error: 'Record not found' });
+    return send(200, api.store.getLists().filter(l => (l.members || []).includes(actorUrl))
+      .map(l => ({ id: l.id, title: l.title, replies_policy: l.repliesPolicy || 'list', exclusive: false })));
+  }
+
+  // The people muted and blocked, as accounts; the domains blocked, as names.
+  if (pathname === '/api/v1/mutes' && req.method === 'GET') {
+    return send(200, (api.store.getMuted().actors || []).map(a => api.account(a)));
+  }
+  if (pathname === '/api/v1/blocks' && req.method === 'GET') {
+    return send(200, (api.store.getBlocklist().actors || []).map(a => api.account(a)));
+  }
+  if (pathname === '/api/v1/domain_blocks') {
+    const b = api.store.getBlocklist();
+    if (req.method === 'GET') return send(200, [...b.domains]);
+    const body = await readBody(req);
+    const domain = String(body.domain || url.searchParams.get('domain') || '').trim().toLowerCase();
+    if (!/^[a-z0-9.-]+\.[a-z]{2,}$/u.test(domain)) return send(422, { error: 'a domain is required' });
+    if (req.method === 'POST' && !b.domains.includes(domain)) b.domains.push(domain);
+    if (req.method === 'DELETE') b.domains = b.domains.filter(d => d !== domain);
+    api.store.setBlocklist(b);
+    return send(200, {});
+  }
+
   // The counts these back are rendered from the same two arrays (see
   // `account`), so a client that shows a number here can always open it.
   const mAccList = /^\/api\/v1\/accounts\/([a-f0-9]+)\/(following|followers)$/.exec(pathname);
@@ -259,9 +291,17 @@ export async function handle(api, ctx) {
   if (mAccStatuses) {
     const actorUrl = api.store.urlFor(mAccStatuses[1]);
     const all = api.store.getStatuses();
-    const pinnedOnly = url.searchParams.get('pinned') === 'true';
+    const q = url.searchParams;
+    const is = (name) => q.get(name) === 'true' || q.get(name) === '1';
+    const pinnedOnly = is('pinned');
+    const tagged = String(q.get('tagged') || '').replace(/^#/, '').toLowerCase();
+    const isBoost = (s) => !!s.via && s.via !== s.actor;
     const { items, headers } = api.page(
-      all.filter(s => s.actor === actorUrl && (!pinnedOnly || s.pinned)), url);
+      all.filter(s => s.actor === actorUrl && (!pinnedOnly || s.pinned))
+        .filter(s => !is('exclude_replies') || !s.inReplyTo)
+        .filter(s => !is('exclude_reblogs') || !isBoost(s))
+        .filter(s => !is('only_media') || (s.attachments || []).length > 0)
+        .filter(s => !tagged || (s.tags || []).some(t => String(t.name).toLowerCase() === tagged)), url);
     return send(200, items.map(s => api.statusOrBoost(s, { all })), headers);
   }