fedipod-server 0.26.0 → 0.28.1

package/lib/gateway/quiet.mjs

@@ -0,0 +1,189 @@
+// quiet.mjs — accounts that go quiet: what the front knows about an account
+// nobody opens, and what its owner may say about it. The router in
+// front-core.mjs asks closedState/accountState at the door and on every
+// public read, stamps noteOpened from the relay, counts noteReceived after
+// a forwarded delivery, and hands /api/open, /api/pause and /api/close here.
+
+// ---- accounts that go quiet -------------------------------------------------
+//
+// The gateway holds no mail: every delivery it takes is two writes into the
+// owner's pod inbox, read only when their browser is open. An account nobody
+// opens grows on its pod without limit, and its owner comes back to a drain
+// of everything at once. So the front keeps two facts about each browser
+// account — when its owner was last here, and how much content has arrived
+// since — and acts on them.
+//
+// `openedAt` is written when the owner signs in (POST /api/open, always) and
+// while they act through the relay (at most hourly). The count of content
+// deliveries since then lives in its own record, keyed by handle AND
+// openedAt: a fresh stamp starts a fresh count with nothing to reset, and a
+// delivery's write can never overwrite a sign-in's. Two deliveries landing
+// together may each read the same total and one increment is lost — the cap
+// comes out slightly soft, never too strict.
+//
+// PAUSED: the count has reached the cap, or the owner said so. Content is
+// accepted and discarded, control (follows, unfollows, moves, deletions,
+// blocks) still lands. The owner's next sign-in ends a cap pause by itself; a
+// pause they set lasts until they lift it.
+//
+// CLOSED: the owner said so, or nothing has opened the account for the close
+// window. Found closed by time, it is written down so it stays closed. From
+// then on the door, the actor and the handle answer 410 — never a failure
+// code, which senders retry and count against this whole host, and never a
+// success, which would keep them sending. Nothing on the pod is touched. An
+// address that moved (see /api/move) keeps answering as moved; closing does
+// not take that away.
+//
+// Only an account whose owner has signed in from a browser carries
+// `openedAt`. A DeviceAgent behind this door never does: it drains its own
+// inbox as it runs, so it is never counted, never paused and never closed by
+// time. Accounts from before this was built are counted from their next
+// sign-in.
+export const DEFAULT_PAUSE_ITEMS = 5000;
+export const DEFAULT_CLOSE_DAYS = 183;                // six months
+const OPEN_STAMP_EVERY_MS = 60 * 60_000;              // the relay's stamp, at most hourly
+const pauseItemsOf = (ctx) => (Number(ctx.pauseItems) > 0 ? Number(ctx.pauseItems) : DEFAULT_PAUSE_ITEMS);
+const closeDaysOf = (ctx) => (Number(ctx.closeDays) > 0 ? Number(ctx.closeDays) : DEFAULT_CLOSE_DAYS);
+const receivedKey = (key, rec) => `${key}/${rec.openedAt}`;
+
+export async function receivedSince(ctx, key, rec) {
+  if (!ctx.readReceived || !rec.openedAt) return { items: 0, bytes: 0 };
+  const got = await ctx.readReceived(receivedKey(key, rec)).catch(() => null);
+  return { items: Number(got?.items) || 0, bytes: Number(got?.bytes) || 0 };
+}
+
+// One more content delivery reached the pod. Nothing to count against until
+// the owner has been here once.
+export async function noteReceived(ctx, key, rec, bytes) {
+  if (!ctx.readReceived || !ctx.writeReceived || !rec.openedAt) return;
+  const so = await receivedSince(ctx, key, rec);
+  await ctx.writeReceived(receivedKey(key, rec), { items: so.items + 1, bytes: so.bytes + (Number(bytes) || 0) })
+    .catch((e) => console.log(`front @${key}: count not written: ${e?.message || e}`));
+}
+
+// The owner is here. `always` is a sign-in; the relay stamps at most hourly,
+// so a busy hour of posting is one write. The count that went with the old
+// stamp is dropped: it is over, and a store should not keep one per hour.
+export async function noteOpened(ctx, key, rec, { always = false } = {}) {
+  if (!ctx.putDirectory) return rec;
+  if (!always && rec.openedAt && Date.now() - Date.parse(rec.openedAt) < OPEN_STAMP_EVERY_MS) return rec;
+  const next = { ...rec, openedAt: new Date().toISOString() };
+  await ctx.putDirectory(key, next);
+  if (rec.openedAt && ctx.dropReceived) await ctx.dropReceived(receivedKey(key, rec)).catch(() => {});
+  return next;
+}
+
+// Closed, and why. Reads no count: this is asked on every public read.
+export async function closedState(ctx, key, rec) {
+  if (rec.movedTo) return { closed: false };
+  if (rec.closedAt) return { closed: true, closedAt: rec.closedAt, closedBy: rec.closedBy || 'owner' };
+  if (rec.openedAt && Date.now() - Date.parse(rec.openedAt) > closeDaysOf(ctx) * 86400_000) {
+    const closedAt = new Date().toISOString();
+    if (ctx.putDirectory) await ctx.putDirectory(key, { ...rec, closedAt, closedBy: 'quiet' });
+    console.log(`front @${key}: closed — nothing opened it since ${rec.openedAt}`);
+    return { closed: true, closedAt, closedBy: 'quiet' };
+  }
+  return { closed: false };
+}
+
+// The whole standing of an account, for the door and for its owner's page.
+export async function accountState(ctx, key, rec) {
+  const c = await closedState(ctx, key, rec);
+  const received = c.closed ? { items: 0, bytes: 0 } : await receivedSince(ctx, key, rec);
+  const cap = pauseItemsOf(ctx);
+  const pausedBy = c.closed ? null : rec.pausedAt ? 'owner' : received.items >= cap ? 'quiet' : null;
+  return {
+    closed: c.closed, closedAt: c.closedAt || null, closedBy: c.closedBy || null,
+    paused: !!pausedBy, pausedBy, pausedAt: rec.pausedAt || null,
+    openedAt: rec.openedAt || null, received, pauseItems: cap, closeDays: closeDaysOf(ctx),
+  };
+}
+
+// A 410 with a reason, the shape every closed or moved id answers with.
+export const closedAnswer = (headers = {}, why = 'this address is closed') => ({
+  status: 410, headers: { 'cache-control': 'no-store', ...headers, 'content-type': 'application/json' },
+  body: JSON.stringify({ error: why }) });
+
+// The owner of a row, proved the way the relay proves them: a pod token whose
+// WebID is the row's, or lives on the row's pod for a row from before WebIDs
+// were recorded.
+async function provedOwner(request, pathname, ctx, rec, { j, verifyPodToken, webidUnderPod }) {
+  const webid = await verifyPodToken(request, pathname, ctx.verifier);
+  if (!webid) return { error: j(401, { error: 'a Solid-OIDC token proving the pod is required' }) };
+  const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
+  if (!owner) return { error: j(403, { error: "the token proves a different pod than this account's" }) };
+  return { webid };
+}
+
+// The owner's three routes. `deps` are front-core's own JSON reply and
+// token check, handed in so this module stays free of the router's privates.
+// Returns a response, or null when the path is not one of these.
+export async function routeQuietApi(request, pathname, ctx, deps) {
+  const { j } = deps;
+  if (!['/api/open', '/api/pause', '/api/close'].includes(pathname)) return null;
+  // A page at another origin asks first whether it may call, and is answered
+  // as the relay answers it. Unanswered, the browser never sends the call and
+  // some pages asked again every minute.
+  if (request.method === 'OPTIONS') return deps.apiPreflight();
+  if (request.method !== 'POST') return null;
+  // The owner is here: their browser says so as it opens the account. The
+  // answer is the account's standing at this gateway, which the manage page
+  // shows. A closed address is told so and nothing is written.
+  if (pathname === '/api/open' && request.method === 'POST') {
+    if (!ctx.putDirectory) return j(501, { error: 'this front keeps no directory' });
+    let body;
+    try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+    const handle = String(body.handle || '').toLowerCase();
+    let rec = await ctx.lookup(handle);
+    if (!rec) return j(404, { error: 'no such account' });
+    const who = await provedOwner(request, pathname, ctx, rec, deps);
+    if (who.error) return who.error;
+    const before = await closedState(ctx, handle, rec);
+    if (before.closed) return j(410, { error: 'this address is closed', closedAt: before.closedAt, closedBy: before.closedBy });
+    rec = await noteOpened(ctx, handle, rec, { always: true });
+    return j(200, { ok: true, handle, ...await accountState(ctx, handle, rec) });
+  }
+
+  // The owner pausing their own account, or lifting the pause they set.
+  if (pathname === '/api/pause' && request.method === 'POST') {
+    if (!ctx.putDirectory) return j(501, { error: 'this front keeps no directory' });
+    let body;
+    try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+    const handle = String(body.handle || '').toLowerCase();
+    let rec = await ctx.lookup(handle);
+    if (!rec) return j(404, { error: 'no such account' });
+    const who = await provedOwner(request, pathname, ctx, rec, deps);
+    if (who.error) return who.error;
+    const before = await closedState(ctx, handle, rec);
+    if (before.closed) return j(410, { error: 'this address is closed', closedAt: before.closedAt });
+    if (typeof body.paused !== 'boolean') return j(400, { error: 'paused must be true or false' });
+    if (body.paused && !rec.pausedAt) rec = { ...rec, pausedAt: new Date().toISOString() };
+    if (!body.paused && rec.pausedAt) { rec = { ...rec }; delete rec.pausedAt; }
+    // Lifting a pause is a sign-in's worth of "I am here": the count starts over.
+    if (!body.paused) rec = { ...rec, openedAt: new Date().toISOString() };
+    await ctx.putDirectory(handle, rec);
+    console.log(`front @${handle}: ${body.paused ? 'paused' : 'resumed'} by its owner`);
+    return j(200, { ok: true, handle, ...await accountState(ctx, handle, rec) });
+  }
+
+  // The owner closing their address for good. Repeating it changes nothing.
+  if (pathname === '/api/close' && request.method === 'POST') {
+    if (!ctx.putDirectory) return j(501, { error: 'this front keeps no directory' });
+    let body;
+    try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+    const handle = String(body.handle || '').toLowerCase();
+    let rec = await ctx.lookup(handle);
+    if (!rec) return j(404, { error: 'no such account' });
+    const who = await provedOwner(request, pathname, ctx, rec, deps);
+    if (who.error) return who.error;
+    if (body.confirm !== true) return j(400, { error: 'closing is for good — send confirm: true' });
+    if (!rec.closedAt) {
+      rec = { ...rec, closedAt: new Date().toISOString(), closedBy: 'owner' };
+      await ctx.putDirectory(handle, rec);
+      console.log(`front @${handle}: closed by its owner`);
+    }
+    return j(200, { ok: true, handle, ...await accountState(ctx, handle, rec) });
+  }
+
+  return null;
+}

package/lib/pod/containers.mjs

@@ -51,12 +51,16 @@ export async function provisionPublic(pod, base) {
  * The private half: the home itself and the state container.
  *
  * Idempotent, so two devices doing it at once is harmless — which is what
- * makes it safe to run on every boot rather than only at setup.
+ * makes it safe to run on every boot rather than only at setup. Asked before
+ * written: a browser's worker boots whenever the browser likes, and each boot
+ * used to write the canary and both rules again. Returns whether it wrote.
  */
 export async function provisionPrivate(pod, urls) {
+  if (await exists(pod, urls.state)) return false;
   await pod.putJson(keepUrl(urls.state), KEEP, KEEP_CT);
   await pod.setAcl(urls.state, []);
   await pod.setAcl(urls.home, []);
+  return true;
 }
 
 /**

package/lib/pod/inbox.mjs

@@ -85,13 +85,15 @@ export async function writeKeep(pod, urls) {
  * those and not the others is an inbox that is open when it should be shut.
  */
 export async function setPosture(pod, urls, posture) {
-  if (posture === 'open') return pod.setAcl(urls.inbox, ['Append']);
-  if (posture === 'closed') return pod.setAcl(urls.inbox, []);
+  // Restated at every start, and most starts find it already so: the rule is
+  // read first and written only when it differs (transport.setAcl ifChanged).
+  if (posture === 'open') return pod.setAcl(urls.inbox, ['Append'], { ifChanged: true });
+  if (posture === 'closed') return pod.setAcl(urls.inbox, [], { ifChanged: true });
   const webId = posture?.gatewayWebId;
   if (!webId) throw new Error(`inbox.setPosture: unknown posture ${JSON.stringify(posture)}`);
   // Public loses Append; the door keeps it. Both halves in one write, because
   // between two writes the inbox is either open to everyone or shut to the door.
-  return pod.setAcl(urls.inbox, [], { appendAgents: [webId] });
+  return pod.setAcl(urls.inbox, [], { appendAgents: [webId], ifChanged: true });
 }
 
 /**
@@ -145,3 +147,20 @@ export async function readDeliveryReceipt(pod, itemUrl, { maxBytes, readCapped }
  * @returns {Promise<boolean>} whether the pod removed it
  */
 export const dropHandledItem = (pod, url) => pod.delete(url);
+
+/**
+ * Remove the receipt a gateway wrote beside an item, once the item is gone.
+ * Best-effort: a receipt that stays is a stray document, never a lost
+ * delivery. Left behind, they were one stray per delivery, forever.
+ */
+export const dropReceiptBeside = (pod, url) => pod.delete(url + '.receipt.json').catch(() => false);
+
+/**
+ * Receipts whose item is no longer in the inbox, from the last listing: what
+ * earlier drains left behind. The drain removes a few of these each sweep
+ * until none are left.
+ */
+export const orphanReceipts = (pod, urls) => pod.orphanReceipts?.(urls.inbox) ?? [];
+
+/** Remove one such stray. @returns {Promise<boolean>} whether the pod removed it */
+export const dropStrayReceipt = (pod, url) => pod.delete(url).catch(() => false);

package/lib/pod/state.mjs

@@ -11,11 +11,11 @@
 
 // ---- the owner's agent ----
 
-export const readWrappedKeys = (pod, urls) => pod.getJson(urls.state + 'keys.json');
+export const readKeys = (pod, urls) => pod.getJson(urls.state + 'keys.json');
 export const readConfig = (pod, urls) => pod.getJson(urls.state + 'config.json');
 
-export const writeWrappedKeys = (pod, urls, envelope) =>
-  pod.putJson(urls.state + 'keys.json', envelope, 'application/json');
+export const writeKeys = (pod, urls, keys) =>
+  pod.putJson(urls.state + 'keys.json', keys, 'application/json');
 export const writeConfig = (pod, urls, config) =>
   pod.putJson(urls.state + 'config.json', config, 'application/json');
 
@@ -30,10 +30,11 @@ export const writeConfig = (pod, urls, config) =>
  * public. As two statements this was two chances to get it wrong; as one
  * operation there is nowhere to put them in the other order.
  *
- * The envelope is built by the caller. This library does not choose how a key
- * is wrapped, and should not be able to write an unwrapped one by accident.
+ * The keys record is stored as it is: the container's access rule is what
+ * keeps it to the owner, the same rule every private document on the pod
+ * lives under.
  */
-export async function provisionKey(pod, { stateUrl, keysUrl, envelope }) {
+export async function provisionKey(pod, { stateUrl, keysUrl, keys }) {
   await pod.setAcl(stateUrl, []);
-  await pod.putJson(keysUrl, envelope, 'application/json');
+  await pod.putJson(keysUrl, keys, 'application/json');
 }

package/lib/pod/transport.mjs

@@ -345,7 +345,31 @@ export class PodTransport {
     const podTarget = this.toPod ? this.toPod(targetUrl) : targetUrl;
     const url = await this.aclUrlFor(podTarget);
     if (!await this.aclWritable(url)) return null;
-    return this.put(url, this.aclDoc(podTarget, publicModes, { ...opts, aclUrl: url }), 'text/turtle');
+    const doc = this.aclDoc(podTarget, publicModes, { ...opts, aclUrl: url });
+    // `ifChanged`: read the rule the pod holds and write only when it differs.
+    // For a rule restated at every start — the inbox door — a read is the
+    // whole cost, where a write took the pod's lock to say the same thing.
+    if (opts.ifChanged && await this.aclSame(url, doc)) return { status: 304, unchanged: true };
+    return this.put(url, doc, 'text/turtle');
+  }
+
+  // Whether the pod's rule at `aclUrl` states exactly what `doc` states.
+  // Compared as graphs, not bytes: the pod serialises what it holds its own
+  // way. Every rule this file writes names its subjects, so triple sets are
+  // enough; anything unreadable or with blank nodes reads as different.
+  async aclSame(aclUrl, doc) {
+    try {
+      const res = await this.fetch(aclUrl, { headers: { accept: 'text/turtle' } });
+      if (res.status !== 200) return false;
+      const triples = (text) => {
+        const g = $rdf.graph();
+        $rdf.parse(text, g, aclUrl, 'text/turtle');
+        if (g.statements.some((st) => st.subject.termType === 'BlankNode' || st.object.termType === 'BlankNode')) return null;
+        return g.statements.map((st) => `${st.subject.value} ${st.predicate.value} ${st.object.value}`).sort().join('\n');
+      };
+      const theirs = triples(await res.text());
+      return theirs !== null && theirs === triples(doc);
+    } catch { return false; }
   }
 
   // Child documents of an LDP container (URLs under it, excluding aux docs).
@@ -382,12 +406,14 @@ export class PodTransport {
     $rdf.parse(body, g, url, 'text/turtle');
     const here = $rdf.sym(url);
     const seen = new Set();
+    const receipts = new Set();
     const list = [];
     for (const child of g.each(here, LDP('contains'), null, here)) {
       const u = child.value;
       // `.receipt.json` is a verification receipt a gateway wrote beside an
       // inbox item — read with the item, never enumerated as an item itself.
-      if (!u.startsWith(url) || u === url || /\.(acl|meta|receipt\.json)$/.test(u) || seen.has(u)) continue;
+      if (u.endsWith('.receipt.json')) { receipts.add(u); continue; }
+      if (!u.startsWith(url) || u === url || /\.(acl|meta)$/.test(u) || seen.has(u)) continue;
       seen.add(u);
       list.push({
         url: u,
@@ -395,14 +421,21 @@ export class PodTransport {
         modified: g.any(child, DC('modified'), null, here)?.value || null,
       });
     }
+    // Whether a receipt sits beside each item, so the drain asks for one only
+    // where there is one; and the receipts nothing sits beside any more.
+    for (const item of list) item.receipt = receipts.has(item.url + '.receipt.json');
+    const orphans = [...receipts].filter((r) => !seen.has(r.slice(0, -'.receipt.json'.length)));
     // Oldest first. An LDP listing is a set, so without this a drain works in
     // whatever order the graph happened to parse — a mention from last week
     // after one from today, and no way to make progress predictable.
     list.sort((a, b) => String(a.modified || '').localeCompare(String(b.modified || '')));
-    this._listCache.set(url, { etag: res.headers.get('etag'), children: list });
+    this._listCache.set(url, { etag: res.headers.get('etag'), children: list, orphans });
     return list;
   }
 
+  /** Receipts in the last listing of `url` whose item is gone. */
+  orphanReceipts(url) { return this._listCache?.get(url)?.orphans ?? []; }
+
   /**
    * The WebID profile advertises the actor as an account:
    *   <webId> foaf:account <actor> .

package/lib/session/README.md

@@ -18,6 +18,9 @@ Once signed in, the account gives you:
 - **`post`** — publishes a post as them, public, unlisted or followers-only.
 - **`reply`** — answers a post.
 - **`timeline`** — their home timeline, newest first.
+- **`outbox`** — their own posts, newest first. Pass `rdf: true` to also get
+  the real thing as RDF, for an app that wants to work with it as linked
+  data rather than as this library's own shape.
 - **`follow`** — follows someone by handle.
 - **`favourite`**, **`boost`** — as they say.
 - **`profile`** — who they are as their server or pod shows them: name,
@@ -37,6 +40,8 @@ DeviceAgent or Server account, and when fedipod.net is next open for a
 browser-based one.
 
 Three files, no dependencies. It runs in a page and in a service worker.
+The one exception: `outbox({ rdf: true })` needs the `jsonld` package, and
+only loads it when that flag is actually used.
 
 [The demo](https://jeff-zucker.github.io/FediPod/) shows the sign-in and
 the profile that comes back.
@@ -73,6 +78,7 @@ const me = await accounts.current();                       // null when nobody i
 if (me?.notice) show(me.notice);
 await me.post({ text: 'Hello from my app' });
 for (const p of await me.timeline({ limit: 20 })) render(p);
+for (const p of await me.outbox({ limit: 20 })) render(p);
 await me.follow('@aisha@her.server');
 await me.reply(p.url, 'Well said');
 await me.signOut();
@@ -93,6 +99,14 @@ await me.signOut();
 - **`reply(post, text)`** — the post is named by its address or its id.
 - **`timeline({ limit })`** — each post as `{ id, url, author: { id, handle,
   name }, html, published, inReplyTo }`.
+- **`outbox({ limit, rdf })`** — the same shape as `timeline`, but only this
+  account's own posts. With `rdf: true`, the returned array also carries
+  `.rdf`: the real outbox parsed into an RDF/JS quad array — for a Mastodon
+  account too, since a Mastodon server is itself an ActivityPub server with
+  a real actor and outbox, same as a pod's. It comes back empty on a server
+  that requires a signed request just to read that document, which some
+  do. Reading it needs the `jsonld` package available to your app; without
+  `rdf: true` nothing changes and nothing extra loads.
 - **`fetch`** — the raw authenticated fetch, for anything the above does not
   cover.
 - **`actor`** — the account's ActivityPub id.

package/lib/session/fedi-account.mjs

@@ -15,6 +15,8 @@
 //   await me.post({ text });            await me.timeline({ limit: 20 })
 //   await me.reply(postUrlOrId, text);  await me.follow('@aisha@her.server')
 //   await me.favourite(postUrlOrId);    await me.boost(postUrlOrId)
+//   await me.outbox({ limit: 20 });     // this account's own posts, newest first
+//   await me.outbox({ rdf: true });     // the same, plus the real RDF graph on .rdf
 //   await me.signOut()
 //
 // A Mastodon account is used through its server's API with a token the
@@ -58,6 +60,35 @@ export function fediAccount({
     return body;
   };
 
+  // Only loaded when `outbox({ rdf: true })` is actually called, so nobody
+  // pays for a JSON-LD parser just by importing this file. Not in
+  // `dependencies` — the app supplies "jsonld" if it wants this flag to work.
+  const loadJsonLd = async () => {
+    try { return (await import('jsonld')).default; }
+    catch { throw new Error('outbox({ rdf: true }) needs the "jsonld" package available to the app — it is not bundled with this library'); }
+  };
+
+  // The account's real outbox, read from the pod: the head collection names
+  // `first`, each page names `orderedItems` and (while there is more) `next`.
+  // Walked only far enough to cover `limit`, and run through jsonld.toRDF so
+  // the result is a genuine RDF/JS quad array, not this library's own shape.
+  const fetchOutboxRdf = async (actorUrl, limit) => {
+    if (!actorUrl) return null;
+    const jsonld = await loadJsonLd();
+    const actorDoc = await json(actorUrl, { headers: { accept: 'application/activity+json' } });
+    let pageUrl = actorDoc?.outbox ? (await json(actorDoc.outbox, { headers: { accept: 'application/activity+json' } }))?.first : null;
+    const quads = []; const seen = new Set(); let collected = 0;
+    while (pageUrl && collected < limit && !seen.has(pageUrl)) {
+      seen.add(pageUrl);
+      const page = await json(pageUrl, { headers: { accept: 'application/activity+json' } });
+      if (!page) break;
+      quads.push(...(await jsonld.toRDF(page)));
+      collected += (page.orderedItems || []).length;
+      pageUrl = page.next || null;
+    }
+    return quads;
+  };
+
   // ---- finding out what an address is ----
 
   // Does this host speak the Mastodon API? Any server of that family says so
@@ -255,6 +286,20 @@ export function fediAccount({
         const list = await call(`/api/v1/timelines/home?limit=${Math.min(40, limit)}`).then((r) => said(r, a.host));
         return (Array.isArray(list) ? list : []).map(item);
       },
+      // This account's own posts, newest first — Mastodon's equivalent of an
+      // outbox. A Mastodon server IS an ActivityPub server, so its actor and
+      // outbox are real AS2/JSON-LD too, same as a pod's; `rdf: true` reads
+      // that, not the REST API above. It comes back empty on an instance that
+      // requires a signed request just to read the public actor document
+      // (some do — mastodon.social among them); `fetchOutboxRdf`'s plain GET
+      // then gets 401 and the loop below finds nothing to walk.
+      async outbox({ limit = 20, rdf = false } = {}) {
+        const me = await call('/api/v1/accounts/verify_credentials').then((r) => said(r, a.host));
+        const list = await call(`/api/v1/accounts/${me.id}/statuses?limit=${Math.min(40, limit)}`).then((r) => said(r, a.host));
+        const items = (Array.isArray(list) ? list : []).map(item);
+        if (rdf) items.rdf = await fetchOutboxRdf(a.actor, limit);
+        return items;
+      },
       async follow(handle) {
         const who = parseAddress(handle);
         if (!who?.at) throw new Error('a handle looks like @you@your.server');
@@ -314,6 +359,23 @@ export function fediAccount({
           .slice(0, limit)
           .map((s) => ({ id: s.noteId, url: s.noteId, published: s.published || null, author: who(s.actor), html: s.content || '', inReplyTo: s.inReplyTo || null }));
       },
+      // This account's own posts, newest first, read from the same local
+      // record `timeline` uses (fast, no network call). With `rdf: true`,
+      // also fetches the real outbox from the pod and parses it into RDF/JS
+      // quads on the returned array's `.rdf` — a second, live document, not
+      // derived from the local record, so it needs `jsonld` (see loadJsonLd).
+      async outbox({ limit = 20, rdf = false } = {}) {
+        const rows = await state('statuses.json');
+        const actors = (await state('actors.json')) || {};
+        const who = (id) => { const d = actors[id]?.doc || actors[id] || {}; return { id, handle: d.preferredUsername ? `@${d.preferredUsername}@${new URL(id).host}` : null, name: d.name || null }; };
+        const items = (Array.isArray(rows) ? rows : [])
+          .filter((s) => s.kind === 'post')
+          .sort((x, y) => String(y.published || '').localeCompare(String(x.published || '')))
+          .slice(0, limit)
+          .map((s) => ({ id: s.noteId, url: s.noteId, published: s.published || null, author: who(s.actor), html: s.content || '', inReplyTo: s.inReplyTo || null }));
+        if (rdf) items.rdf = await fetchOutboxRdf(facts.actor, limit);
+        return items;
+      },
       async follow(handle) {
         const who = parseAddress(handle);
         if (!who?.at) throw new Error('a handle looks like @you@your.server');

package/lib/session/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fediverse-account",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Type a Fediverse handle or a WebID and get back an account you can act with: post, read its timeline, follow, reply, favourite, boost. Works out whether the account lives on a Mastodon-family server or on a Solid pod through FediPod, sends the person to sign in there, brings them back to where they were, and speaks to whichever it is.",
   "type": "module",
   "license": "MIT",
@@ -37,5 +37,13 @@
   "scripts": {
     "prepublishOnly": "node ../../scripts/check-pod-calls.mjs"
   },
-  "dependencies": {}
+  "dependencies": {},
+  "peerDependencies": {
+    "jsonld": "^9.0.0"
+  },
+  "peerDependenciesMeta": {
+    "jsonld": {
+      "optional": true
+    }
+  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod-server",
-  "version": "0.26.0",
+  "version": "0.28.1",
   "description": "The FediPod Server: a full ActivityPub server as a Community Solid Server component.",
   "license": "MIT",
   "main": "dist/index.js",

package/run-agent.mjs

@@ -33,6 +33,7 @@ import { apRoot, rootOf, writeJsonAtomic } from './lib/device/home.mjs';
 import { ensureTrustedTls } from './lib/device/certs.mjs';
 import { storageFor } from './lib/core/storage.mjs';
 import { resolveKeys } from './lib/core/keys.mjs';
+import { completeGatewayMove } from './lib/device/gateway-move.mjs';
 import { RemotePod } from './lib/device/remote.mjs';
 import { Deliverer } from './lib/core/deliver.mjs';
 import { Publisher } from './lib/core/publisher/index.mjs';
@@ -52,6 +53,7 @@ import { exposureProblem, hostLabel } from './lib/shared/guard.mjs';
 import { pendingSteps } from './lib/device/migrate.mjs';
 import { apUrls, assertionKeyId , publicHandle } from './lib/core/wire.mjs';
 import { followActor, unfollowActor, resolveHandle } from './lib/core/social.mjs';
+import * as podInbox from './lib/pod/inbox.mjs';
 
 export class Agent {
   constructor({ home, log }) {
@@ -497,6 +499,31 @@ export class Agent {
     return true;
   }
 
+  // The featured collection was once written only on the first pin, so an
+  // account from before then has none, and every server that shows the
+  // profile is refused and asks again. One authenticated GET; the empty
+  // collection goes up when the pod lacks it. True when it had to.
+  async ensureFeaturedPublished() {
+    const doc = await this.remote.getJson(this.urls.featured);
+    if (doc?.id) return false;
+    this.log('featured collection missing from the pod — publishing it');
+    await this.publisher.publishFeatured();
+    return true;
+  }
+
+  // The inbox's door must be open to the world (or to the gateway alone, in
+  // locked mode) or nothing anyone sends ever lands. The permission is written
+  // at setup, and a container made again later — a root move, a pod rebuilt —
+  // came back without it: the group's inbox on fp2 refused every delivery for
+  // nine days while its agent ran on, healthy-looking. One write per start,
+  // and it is idempotent.
+  async ensureInboxOpen() {
+    const g = this.store.getConfig()?.gateway;
+    const posture = g?.mode === 'locked' && g.webId ? { gatewayWebId: g.webId } : 'open';
+    await podInbox.setPosture(this.remote, this.urls, posture);
+    return posture;
+  }
+
   // Read-only mode: refresh the state cache periodically, and take over the
   // moment the active agent's lease frees.
   startViewer() {
@@ -535,6 +562,10 @@ export class Agent {
       return;                                // renewal is already running, above
     }
     await this.intake.start();
+    // An address that moved here from another gateway, whose move was left
+    // pending (the old gateway could not be told): try again now that this
+    // agent acts and the actor is published.
+    completeGatewayMove(this).catch(e => this.log(`gateway move: ${e.message}`));
     // Reused, not replaced: demote() stops this instance but does not clear it,
     // so constructing a new one over the top orphaned the old chain beyond the
     // reach of any later stop().
@@ -588,6 +619,10 @@ export class Agent {
     if (repair) {
       this.ensureActorPublished()
         .catch(e => this.log(`actor check failed: ${e.message}`));
+      this.ensureFeaturedPublished()
+        .catch(e => this.log(`featured check failed: ${e.message}`));
+      this.ensureInboxOpen()
+        .catch(e => this.log(`inbox door check failed: ${e.message}`));
       // The human page, rewritten only when what it shows has changed: one
       // local digest compare, and a write the first time after an upgrade.
       this.publisher.publishProfilePage()