fedipod-server 0.28.0 → 0.29.0

package/lib/pod/transport.mjs

@@ -15,6 +15,7 @@
 import * as $rdf from 'rdflib';
 import { readCapped, retryAfterMs } from './http.mjs';
 import { linkTargets, REL } from './links.mjs';
+import { podBaseOfWebId } from './urls.mjs';
 
 const LDP = $rdf.Namespace('http://www.w3.org/ns/ldp#');
 const DC = $rdf.Namespace('http://purl.org/dc/terms/');
@@ -23,6 +24,17 @@ const RDF = $rdf.Namespace('http://www.w3.org/1999/02/22-rdf-syntax-ns#');
 const ACL = $rdf.Namespace('http://www.w3.org/ns/auth/acl#');
 const FOAF = $rdf.Namespace('http://xmlns.com/foaf/0.1/');
 const AS = $rdf.Namespace('https://www.w3.org/ns/activitystreams#');
+const RDFS = $rdf.Namespace('http://www.w3.org/2000/01/rdf-schema#');
+
+// An inserted term must be something a reader can take for what it says it
+// is: an absolute http(s) IRI, or a literal.
+function termProblem(t) {
+  if (t?.termType === 'Literal') return null;
+  if (t?.termType !== 'NamedNode') return `${t?.value ?? t} is not an IRI or a literal`;
+  try {
+    return /^https?:$/.test(new URL(t.value).protocol) ? null : `${t.value} is not an http(s) IRI`;
+  } catch { return `${t.value} is not an absolute IRI`; }
+}
 
 // A pod whose access rules are ACP policies, not WAC authorizations. This
 // library writes WAC; over an ACP resource that would be noise where the pod's
@@ -345,7 +357,31 @@ export class PodTransport {
     const podTarget = this.toPod ? this.toPod(targetUrl) : targetUrl;
     const url = await this.aclUrlFor(podTarget);
     if (!await this.aclWritable(url)) return null;
-    return this.put(url, this.aclDoc(podTarget, publicModes, { ...opts, aclUrl: url }), 'text/turtle');
+    const doc = this.aclDoc(podTarget, publicModes, { ...opts, aclUrl: url });
+    // `ifChanged`: read the rule the pod holds and write only when it differs.
+    // For a rule restated at every start — the inbox door — a read is the
+    // whole cost, where a write took the pod's lock to say the same thing.
+    if (opts.ifChanged && await this.aclSame(url, doc)) return { status: 304, unchanged: true };
+    return this.put(url, doc, 'text/turtle');
+  }
+
+  // Whether the pod's rule at `aclUrl` states exactly what `doc` states.
+  // Compared as graphs, not bytes: the pod serialises what it holds its own
+  // way. Every rule this file writes names its subjects, so triple sets are
+  // enough; anything unreadable or with blank nodes reads as different.
+  async aclSame(aclUrl, doc) {
+    try {
+      const res = await this.fetch(aclUrl, { headers: { accept: 'text/turtle' } });
+      if (res.status !== 200) return false;
+      const triples = (text) => {
+        const g = $rdf.graph();
+        $rdf.parse(text, g, aclUrl, 'text/turtle');
+        if (g.statements.some((st) => st.subject.termType === 'BlankNode' || st.object.termType === 'BlankNode')) return null;
+        return g.statements.map((st) => `${st.subject.value} ${st.predicate.value} ${st.object.value}`).sort().join('\n');
+      };
+      const theirs = triples(await res.text());
+      return theirs !== null && theirs === triples(doc);
+    } catch { return false; }
   }
 
   // Child documents of an LDP container (URLs under it, excluding aux docs).
@@ -382,12 +418,14 @@ export class PodTransport {
     $rdf.parse(body, g, url, 'text/turtle');
     const here = $rdf.sym(url);
     const seen = new Set();
+    const receipts = new Set();
     const list = [];
     for (const child of g.each(here, LDP('contains'), null, here)) {
       const u = child.value;
       // `.receipt.json` is a verification receipt a gateway wrote beside an
       // inbox item — read with the item, never enumerated as an item itself.
-      if (!u.startsWith(url) || u === url || /\.(acl|meta|receipt\.json)$/.test(u) || seen.has(u)) continue;
+      if (u.endsWith('.receipt.json')) { receipts.add(u); continue; }
+      if (!u.startsWith(url) || u === url || /\.(acl|meta)$/.test(u) || seen.has(u)) continue;
       seen.add(u);
       list.push({
         url: u,
@@ -395,14 +433,21 @@ export class PodTransport {
         modified: g.any(child, DC('modified'), null, here)?.value || null,
       });
     }
+    // Whether a receipt sits beside each item, so the drain asks for one only
+    // where there is one; and the receipts nothing sits beside any more.
+    for (const item of list) item.receipt = receipts.has(item.url + '.receipt.json');
+    const orphans = [...receipts].filter((r) => !seen.has(r.slice(0, -'.receipt.json'.length)));
     // Oldest first. An LDP listing is a set, so without this a drain works in
     // whatever order the graph happened to parse — a mention from last week
     // after one from today, and no way to make progress predictable.
     list.sort((a, b) => String(a.modified || '').localeCompare(String(b.modified || '')));
-    this._listCache.set(url, { etag: res.headers.get('etag'), children: list });
+    this._listCache.set(url, { etag: res.headers.get('etag'), children: list, orphans });
     return list;
   }
 
+  /** Receipts in the last listing of `url` whose item is gone. */
+  orphanReceipts(url) { return this._listCache?.get(url)?.orphans ?? []; }
+
   /**
    * The WebID profile advertises the actor as an account:
    *   <webId> foaf:account <actor> .
@@ -412,16 +457,11 @@ export class PodTransport {
    * written back — an empty or foreign body must never become the new profile.
    */
   async linkAccountInProfile({ actorUrl, accountName, kind = 'person', outbox = null }) {
-    const docUrl = this.webId.split('#')[0];
-    const res = await this.fetch(docUrl, { headers: { accept: 'text/turtle' } });
-    if (res.status >= 400) throw new Error(`[${this.label}] GET ${docUrl} → ${res.status}`);
-    const g = $rdf.graph();
-    $rdf.parse(await res.text(), g, docUrl, 'text/turtle');
-    const doc = $rdf.sym(docUrl);
     const me = $rdf.sym(this.webId);
-    if (!g.statementsMatching(me, null, null, doc).length) {
-      throw new Error(`profile at ${docUrl} does not mention ${this.webId} — not rewriting it`);
-    }
+    const podBase = podBaseOfWebId(this.webId);
+    // The profile and what its seeAlso names: what either says is said.
+    const docs = await this.profileDocs(podBase);
+    const says = (s, p, o) => docs.some(({ g }) => g?.holds(s, p, o));
     const actor = $rdf.sym(actorUrl);
     const wanted = [
       [me, FOAF('account'), actor],
@@ -432,22 +472,24 @@ export class PodTransport {
       // WebID is what dokieli reads); only where a door exists to take it.
       ...(outbox ? [[me, AS('outbox'), $rdf.sym(outbox)]] : []),
     ];
-    const missing = wanted.filter(([s, p, o]) => !g.holds(s, p, o, doc));
+    const missing = wanted.filter(([s, p, o]) => !says(s, p, o));
     // A handle change leaves the old accountName behind; ours is replaced.
     // Likewise an outbox that moved.
-    const stale = [
-      ...g.statementsMatching(actor, FOAF('accountName'), null, doc).filter(st => st.object.value !== accountName),
-      ...(outbox ? g.statementsMatching(me, AS('outbox'), null, doc).filter(st => st.object.value !== outbox) : []),
-    ];
+    const stale = [];
+    for (const { g } of docs) {
+      for (const st of g?.statementsMatching(actor, FOAF('accountName'), null) || []) {
+        if (st.object.value !== accountName) stale.push([st.subject, st.predicate, st.object]);
+      }
+      if (outbox) {
+        for (const st of g?.statementsMatching(me, AS('outbox'), null) || []) {
+          if (st.object.value !== outbox) stale.push([st.subject, st.predicate, st.object]);
+        }
+      }
+    }
     if (!missing.length && !stale.length) return false;
-    // A patch touches these statements and nothing else. Rewriting the whole
-    // profile re-serialises statements that are not ours — the OIDC issuer
-    // among them — and a server is entitled to refuse a write that would.
-    const deletes = stale.map(st => [st.subject, st.predicate, st.object]);
-    if (await this.patchDocument(docUrl, missing, deletes)) return true;
-    for (const st of stale) g.remove(st);
-    for (const [s, p, o] of missing) g.add(s, p, o, doc);
-    await this.put(docUrl, $rdf.serialize(doc, g, docUrl, 'text/turtle'), 'text/turtle');
+    // Checked before it is written, to the profile or else to a document its
+    // seeAlso names (writeAboutWebId); a patch carries only these statements.
+    await this.writeAboutWebId(podBase, { inserts: missing, deletes: stale });
     return true;
   }
 
@@ -489,4 +531,144 @@ export class PodTransport {
     if (res.status === 405 || res.status === 415 || res.status === 501) return false;
     throw new Error(`[${this.label}] PATCH ${docUrl} → ${res.status}`);
   }
+
+  // ---- writing a profile or a type index: valid RDF, or nothing ----
+  //
+  // Two rules. A change is written only if the document it leaves behind is
+  // valid RDF: the graph as it would be afterwards is serialised and parsed
+  // back, and the subject that must stay described still is. And a profile
+  // that will not take a write is not the end: the statements go to the first
+  // document its rdfs:seeAlso names, inside the same pod, that takes them —
+  // under the same check. A profile is what every Solid app signs in through;
+  // one left broken breaks them all. Reading follows the same links.
+
+  /** An IRI or a literal as a term, for the operations that pass plain values. */
+  sym(iri) {
+    try { return $rdf.sym(iri); } catch { throw new Error(`not written: ${iri} is not an absolute IRI`); }
+  }
+  literal(value) { return $rdf.literal(value); }
+
+  /** A document as a graph, or null when it is not there. */
+  async readRdf(docUrl) {
+    const res = await this.fetch(docUrl, { headers: { accept: 'text/turtle' } });
+    if (res.status === 404 || res.status === 410) return null;
+    if (res.status >= 400) throw new Error(`[${this.label}] GET ${docUrl} → ${res.status}`);
+    const g = $rdf.graph();
+    $rdf.parse(await res.text(), g, docUrl, 'text/turtle');
+    return g;
+  }
+
+  /**
+   * The document as it would be after the change, checked. Returns the Turtle
+   * to write, or throws saying why nothing may be written.
+   */
+  checkedRdf(g, docUrl, { inserts = [], deletes = [], mustDescribe = null }) {
+    const doc = $rdf.sym(docUrl);
+    for (const [s, p, o] of inserts) {
+      const bad = termProblem(s) || termProblem(p) || termProblem(o)
+        || (s?.termType === 'Literal' || p?.termType !== 'NamedNode' ? 'a literal subject or predicate' : null);
+      if (bad) throw new Error(`not written: ${bad}`);
+    }
+    const after = $rdf.graph();
+    for (const st of g.statementsMatching(null, null, null, doc)) after.add(st.subject, st.predicate, st.object, doc);
+    for (const [s, p, o] of deletes) for (const st of after.statementsMatching(s, p, o, doc)) after.remove(st);
+    for (const [s, p, o] of inserts) if (!after.holds(s, p, o, doc)) after.add(s, p, o, doc);
+    let text;
+    try { text = $rdf.serialize(doc, after, docUrl, 'text/turtle'); } catch (e) {
+      throw new Error(`not written: ${docUrl} would not serialise (${e.message})`);
+    }
+    const back = $rdf.graph();
+    try { $rdf.parse(text, back, docUrl, 'text/turtle'); } catch (e) {
+      throw new Error(`not written: ${docUrl} would not parse back (${e.message})`);
+    }
+    if (back.statementsMatching(null, null, null, doc).length !== after.statementsMatching(null, null, null, doc).length) {
+      throw new Error(`not written: ${docUrl} would not read back as written`);
+    }
+    if (mustDescribe && !back.statementsMatching($rdf.sym(mustDescribe), null, null, doc).length) {
+      throw new Error(`not written: ${docUrl} would no longer describe ${mustDescribe}`);
+    }
+    return text;
+  }
+
+  /**
+   * Change one document, or refuse. `g` is the document as read (null for a
+   * new one). A PATCH carries only these statements; where the pod cannot
+   * patch, the whole checked document is written. Returns the write's status.
+   */
+  async writeRdfChecked(docUrl, g, { inserts = [], deletes = [], mustDescribe = null }) {
+    const current = g || $rdf.graph();
+    const doc = $rdf.sym(docUrl);
+    const todo = inserts.filter(([s, p, o]) => !current.holds(s, p, o, doc));
+    const gone = deletes.filter(([s, p, o]) => current.holds(s, p, o, doc));
+    if (!todo.length && !gone.length) return 200;
+    const text = this.checkedRdf(current, docUrl, { inserts: todo, deletes: gone, mustDescribe });
+    if (g) {
+      let res = null;
+      try {
+        res = await this.fetch(docUrl, { method: 'PATCH', headers: { 'content-type': 'text/n3' },
+          body: this.n3Patch(docUrl, todo, gone) });
+      } catch { res = null; }
+      if (res && res.status < 300) return res.status;
+      // A pod that cannot patch gets the whole checked document; any other
+      // answer — a refusal, a conflict — is the answer.
+      if (res && ![405, 415, 501].includes(res.status)) return res.status;
+    }
+    const put = await this.fetch(docUrl, { method: 'PUT', headers: { 'content-type': 'text/turtle' }, body: text });
+    return put.status;
+  }
+
+  /**
+   * The profile and the documents its rdfs:seeAlso names inside this pod,
+   * each with its graph, the profile first. What any of them says about the
+   * WebID is what the profile says.
+   */
+  async profileDocs(podBase) {
+    const profileUrl = this.webId.split('#')[0];
+    const g = await this.readRdf(profileUrl);
+    if (!g) throw new Error(`no profile at ${profileUrl}`);
+    const out = [{ url: profileUrl, g, profile: true }];
+    const seen = new Set([profileUrl]);
+    for (const st of g.statementsMatching(null, RDFS('seeAlso'), null)) {
+      const url = st.object.value.split('#')[0];
+      if (seen.has(url) || !url.startsWith(podBase)) continue;       // inside this pod only
+      seen.add(url);
+      out.push({ url, g: await this.readRdf(url).catch(() => null), profile: false });
+    }
+    return out;
+  }
+
+  /** Every value the WebID has for `predicate`, across the profile and its seeAlso documents. */
+  webIdValues(docs, predicate) {
+    const me = $rdf.sym(this.webId);
+    const p = $rdf.sym(predicate);
+    const out = [];
+    for (const { g } of docs) for (const st of g?.statementsMatching(me, p, null) || []) out.push(st.object.value);
+    return [...new Set(out)];
+  }
+
+  /**
+   * Write statements about the WebID: to the profile, or — if the profile will
+   * not take them — to the first of its seeAlso documents that will. Every
+   * write checked. Returns the document written to, or null when nothing
+   * needed writing; throws when none would take it.
+   */
+  async writeAboutWebId(podBase, { inserts = [], deletes = [] }) {
+    const docs = await this.profileDocs(podBase);
+    const holds = ([s, p, o]) => docs.some(({ g }) => g?.holds(s, p, o));
+    const todo = inserts.filter(t => !holds(t));
+    const gone = deletes.filter(holds);
+    if (!todo.length && !gone.length) return null;
+    const refusals = [];
+    for (const d of docs) {
+      const here = gone.filter(([s, p, o]) => d.g?.holds(s, p, o));
+      const status = await this.writeRdfChecked(d.url, d.g, {
+        inserts: todo, deletes: here, mustDescribe: d.profile ? this.webId : null,
+      });
+      if (status < 300) return d.url;
+      refusals.push(`${d.url} → ${status}`);
+      if (status !== 401 && status !== 403) break;                    // a real answer, not "not yours to write"
+    }
+    throw new Error(`not written: neither the profile nor a document it names would take it (${refusals.join('; ')})`);
+  }
+
 }

package/lib/pod/type-index.mjs

@@ -0,0 +1,101 @@
+// type-index.mjs — an account's place, recorded in the person's public type
+// index: the list Solid apps read to find what kind of thing lives where.
+//
+// The record is a registration saying there is an instance of `as:Actor` at the
+// account's actor on the pod:
+//
+//   <#actor-…> a solid:TypeRegistration;
+//     solid:forClass as:Actor;
+//     solid:instance <…/ap/actor>.
+//
+// The instance is the actor at the pod, not a gateway's address for it, so the
+// place can be read off it. It is also how the account is found again.
+//
+// Every write goes through the transport's checked writers: valid RDF, to the
+// profile or a document its seeAlso names, or nothing.
+
+const SOLID = 'http://www.w3.org/ns/solid/terms#';
+const RDF_TYPE = 'http://www.w3.org/1999/02/22-rdf-syntax-ns#type';
+const AS_ACTOR = 'https://www.w3.org/ns/activitystreams#Actor';
+const PUBLIC_READ = ['Read'];
+
+/** Where a new public type index goes when a person has none. */
+export const newIndexUrl = (podBase) => `${podBase}settings/publicTypeIndex.ttl`;
+
+/** The person's public type index, or null when their profile names none. */
+export async function findPublicIndex(pod, podBase) {
+  const docs = await pod.profileDocs(podBase);
+  return pod.webIdValues(docs, SOLID + 'publicTypeIndex')[0] || null;
+}
+
+/** Every actor the index registers, as the instances it names. */
+export async function actorsIn(pod, indexUrl) {
+  const g = await pod.readRdf(indexUrl).catch(() => null);
+  if (!g) return [];
+  const out = [];
+  for (const reg of g.each(null, pod.sym(SOLID + 'forClass'), pod.sym(AS_ACTOR))) {
+    for (const inst of g.each(reg, pod.sym(SOLID + 'instance'), null)) out.push(inst.value);
+  }
+  return [...new Set(out)];
+}
+
+// One registration per actor, named by the actor, so registering again finds
+// the same one.
+function regFor(indexUrl, actorUrl) {
+  let h = 0;
+  for (const c of actorUrl) h = (h * 31 + c.charCodeAt(0)) >>> 0;
+  return `${indexUrl}#actor-${h.toString(36)}`;
+}
+
+/** Add the account's registration, unless the index already has one for it. */
+export async function register(pod, indexUrl, actorUrl) {
+  const g = await pod.readRdf(indexUrl);
+  if (!g) throw new Error(`no type index at ${indexUrl}`);
+  if ((await actorsIn(pod, indexUrl)).includes(actorUrl)) return false;
+  const reg = pod.sym(regFor(indexUrl, actorUrl));
+  const status = await pod.writeRdfChecked(indexUrl, g, {
+    inserts: [
+      [reg, pod.sym(RDF_TYPE), pod.sym(SOLID + 'TypeRegistration')],
+      [reg, pod.sym(SOLID + 'forClass'), pod.sym(AS_ACTOR)],
+      [reg, pod.sym(SOLID + 'instance'), pod.sym(actorUrl)],
+    ],
+    mustDescribe: indexUrl,
+  });
+  if (status >= 300) throw new Error(`the type index at ${indexUrl} did not take the registration (${status})`);
+  return true;
+}
+
+/**
+ * Make a public type index and name it from the profile. Only ever called
+ * after the person has said yes. An index already at the usual place is kept,
+ * not overwritten; it is only named.
+ */
+export async function createPublicIndex(pod, podBase) {
+  const url = newIndexUrl(podBase);
+  const doc = pod.sym(url);
+  const existing = await pod.readRdf(url).catch(() => null);
+  if (!existing) {
+    const status = await pod.writeRdfChecked(url, null, {
+      inserts: [[doc, pod.sym(RDF_TYPE), pod.sym(SOLID + 'TypeIndex')],
+        [doc, pod.sym(RDF_TYPE), pod.sym(SOLID + 'ListedDocument')]],
+      mustDescribe: url,
+    });
+    if (status >= 300) throw new Error(`could not make a type index at ${url} (${status})`);
+  }
+  // Public, as the profile is: an app finds your things by reading it.
+  await pod.setAcl(url, PUBLIC_READ);
+  await pod.writeAboutWebId(podBase, {
+    inserts: [[pod.sym(pod.webId), pod.sym(SOLID + 'publicTypeIndex'), doc]],
+  });
+  return url;
+}
+
+/**
+ * The actors this person's index says live in this pod. Empty when there is no
+ * index or nothing registered.
+ */
+export async function registeredActors(pod, podBase) {
+  const index = await findPublicIndex(pod, podBase).catch(() => null);
+  if (!index) return [];
+  return (await actorsIn(pod, index)).filter(a => a.startsWith(podBase) && a.endsWith('ap/actor'));
+}

package/lib/pod/urls.mjs

@@ -46,6 +46,12 @@ export function apUrls(remotePod, root, { publicBase = null } = {}) {
     pendingFollowers: face + 'ap/private/pending-followers',
     pendingFollowing: face + 'ap/private/pending-following',
     blocked: face + 'ap/private/blocked',
+    // The outbox as its owner reads it (every message, §5.1) and what the
+    // owner has liked (§5.5): the owner's alone, so they sit here too — and
+    // at the pod's own address even for a fronted identity, because the owner
+    // reads them there, with a credential the pod checks.
+    ownOutbox: home + 'ap/private/outbox',
+    liked: home + 'ap/private/liked',
     profileHtml: face + 'ap/profile.html',
     // Media stays on the pod even when fronted: attachment urls are not
     // identity-checked by remotes, and proxying blobs would be pure cost.

package/lib/server/embed.mjs

@@ -45,10 +45,10 @@ const mintSecret = () => crypto.randomBytes(32).toString('base64');
  * secret is moved into the pod and the host's copy removed, so the owner's
  * existing door link goes on working.
  */
-export async function ensureDoorSecret(session, podBase, { rotate = false, dataDir = null, handle = null, log = () => {} } = {}) {
+export async function ensureDoorSecret(session, podBase, { rotate = false, dataDir = null, handle = null, root = 'fedipod/', log = () => {} } = {}) {
   const base = podBase.endsWith('/') ? podBase : podBase + '/';
-  // Under the identity's own tree (fedipod/), where the gate reads it back.
-  const url = apUrls(base, 'fedipod/').state + 'door-secret.json';
+  // Under the identity's own tree, where the gate reads it back.
+  const url = apUrls(base, root).state + 'door-secret.json';
   const onHost = dataDir && handle ? path.join(dataDir, handle, 'door-secret.json') : null;
 
   if (!rotate) {
@@ -125,7 +125,7 @@ export function handleFor(podBase) {
  * pod does not travel to, so handing the pod over hands over an identity that
  * cannot sign. An identity set up before this gets the mode added.
  */
-function ensureCredential(home, { podBase, webId }) {
+function ensureCredential(home, { podBase, webId, root = 'fedipod/' }) {
   const file = path.join(home, 'credential.json');
   try {
     const rec = JSON.parse(fs.readFileSync(file, 'utf8'));
@@ -138,7 +138,7 @@ function ensureCredential(home, { podBase, webId }) {
     webId,
     remotePod: podBase.endsWith('/') ? podBase : podBase + '/',
     createdAt: new Date().toISOString(),
-    root: 'fedipod/',
+    root,
     keysMode: 'pod',
   };
   writeJsonAtomic(file, rec, { mode: 0o600 });
@@ -269,6 +269,7 @@ export async function deliverToInbox(agent, request, { podPut, gatewayWebId = nu
  */
 export async function startEmbeddedAgent({
   podBase,
+  root = 'fedipod/',
   dataDir,
   session,
   resourceStore = null,
@@ -285,7 +286,7 @@ export async function startEmbeddedAgent({
   fs.mkdirSync(home, { recursive: true, mode: 0o700 });
 
   const webId = base + webIdSuffix.replace(/^\//u, '');
-  const cred = ensureCredential(home, { podBase: base, webId });
+  const cred = ensureCredential(home, { podBase: base, webId, root });
 
   const agent = new Agent({ home, log });
   agent.log = log;

package/lib/session/README.md

@@ -18,6 +18,9 @@ Once signed in, the account gives you:
 - **`post`** — publishes a post as them, public, unlisted or followers-only.
 - **`reply`** — answers a post.
 - **`timeline`** — their home timeline, newest first.
+- **`outbox`** — their own posts, newest first. Pass `rdf: true` to also get
+  the real thing as RDF, for an app that wants to work with it as linked
+  data rather than as this library's own shape.
 - **`follow`** — follows someone by handle.
 - **`favourite`**, **`boost`** — as they say.
 - **`profile`** — who they are as their server or pod shows them: name,
@@ -37,6 +40,8 @@ DeviceAgent or Server account, and when fedipod.net is next open for a
 browser-based one.
 
 Three files, no dependencies. It runs in a page and in a service worker.
+The one exception: `outbox({ rdf: true })` needs the `jsonld` package, and
+only loads it when that flag is actually used.
 
 [The demo](https://jeff-zucker.github.io/FediPod/) shows the sign-in and
 the profile that comes back.
@@ -73,6 +78,7 @@ const me = await accounts.current();                       // null when nobody i
 if (me?.notice) show(me.notice);
 await me.post({ text: 'Hello from my app' });
 for (const p of await me.timeline({ limit: 20 })) render(p);
+for (const p of await me.outbox({ limit: 20 })) render(p);
 await me.follow('@aisha@her.server');
 await me.reply(p.url, 'Well said');
 await me.signOut();
@@ -93,6 +99,14 @@ await me.signOut();
 - **`reply(post, text)`** — the post is named by its address or its id.
 - **`timeline({ limit })`** — each post as `{ id, url, author: { id, handle,
   name }, html, published, inReplyTo }`.
+- **`outbox({ limit, rdf })`** — the same shape as `timeline`, but only this
+  account's own posts. With `rdf: true`, the returned array also carries
+  `.rdf`: the real outbox parsed into an RDF/JS quad array — for a Mastodon
+  account too, since a Mastodon server is itself an ActivityPub server with
+  a real actor and outbox, same as a pod's. It comes back empty on a server
+  that requires a signed request just to read that document, which some
+  do. Reading it needs the `jsonld` package available to your app; without
+  `rdf: true` nothing changes and nothing extra loads.
 - **`fetch`** — the raw authenticated fetch, for anything the above does not
   cover.
 - **`actor`** — the account's ActivityPub id.

package/lib/session/fedi-account.mjs

@@ -15,6 +15,8 @@
 //   await me.post({ text });            await me.timeline({ limit: 20 })
 //   await me.reply(postUrlOrId, text);  await me.follow('@aisha@her.server')
 //   await me.favourite(postUrlOrId);    await me.boost(postUrlOrId)
+//   await me.outbox({ limit: 20 });     // this account's own posts, newest first
+//   await me.outbox({ rdf: true });     // the same, plus the real RDF graph on .rdf
 //   await me.signOut()
 //
 // A Mastodon account is used through its server's API with a token the
@@ -58,6 +60,44 @@ export function fediAccount({
     return body;
   };
 
+  // A collection, or a page of one, may be named by its address or given
+  // whole in place (ActivityPub allows either); the whole one is used as it
+  // is, an address is fetched.
+  const idOf = (v) => (typeof v === 'string' ? v : v?.id || null);
+  const asDoc = async (v) => (v && typeof v === 'object'
+    ? (v.type ? v : await asDoc(v.id))
+    : (typeof v === 'string' ? await json(v, { headers: { accept: 'application/activity+json' } }) : null));
+
+  // Only loaded when `outbox({ rdf: true })` is actually called, so nobody
+  // pays for a JSON-LD parser just by importing this file. Not in
+  // `dependencies` — the app supplies "jsonld" if it wants this flag to work.
+  const loadJsonLd = async () => {
+    try { return (await import('jsonld')).default; }
+    catch { throw new Error('outbox({ rdf: true }) needs the "jsonld" package available to the app — it is not bundled with this library'); }
+  };
+
+  // The account's real outbox, read from the pod: the head collection names
+  // `first`, each page names `orderedItems` and (while there is more) `next`.
+  // Walked only far enough to cover `limit`, and run through jsonld.toRDF so
+  // the result is a genuine RDF/JS quad array, not this library's own shape.
+  const fetchOutboxRdf = async (actorUrl, limit) => {
+    if (!actorUrl) return null;
+    const jsonld = await loadJsonLd();
+    const actorDoc = await json(actorUrl, { headers: { accept: 'application/activity+json' } });
+    const head = await asDoc(actorDoc?.outbox);
+    let page = head?.first ?? null;
+    const quads = []; const seen = new Set(); let collected = 0;
+    while (page && collected < limit && !seen.has(idOf(page) || page)) {
+      seen.add(idOf(page) || page);
+      const doc = await asDoc(page);
+      if (!doc) break;
+      quads.push(...(await jsonld.toRDF(doc)));
+      collected += (doc.orderedItems || []).length;
+      page = doc.next ?? null;
+    }
+    return quads;
+  };
+
   // ---- finding out what an address is ----
 
   // Does this host speak the Mastodon API? Any server of that family says so
@@ -195,7 +235,7 @@ export function fediAccount({
     let actor = p.actor || pick(me, FOAF_ACCOUNT);
     let door = pick(me, AS_OUTBOX);
     const doc = actor ? await json(actor, { headers: { accept: 'application/activity+json' } }) : null;
-    if (!door && doc?.outbox) door = doc.outbox;
+    if (!door && doc?.outbox) door = idOf(doc.outbox);
     let root = p.root || null;
     if (!root && doc?.preferredUsername && actor) {
       const { aliases } = await webfinger(doc.preferredUsername, new URL(actor).host).catch(() => ({ aliases: [] }));
@@ -255,6 +295,20 @@ export function fediAccount({
         const list = await call(`/api/v1/timelines/home?limit=${Math.min(40, limit)}`).then((r) => said(r, a.host));
         return (Array.isArray(list) ? list : []).map(item);
       },
+      // This account's own posts, newest first — Mastodon's equivalent of an
+      // outbox. A Mastodon server IS an ActivityPub server, so its actor and
+      // outbox are real AS2/JSON-LD too, same as a pod's; `rdf: true` reads
+      // that, not the REST API above. It comes back empty on an instance that
+      // requires a signed request just to read the public actor document
+      // (some do — mastodon.social among them); `fetchOutboxRdf`'s plain GET
+      // then gets 401 and the loop below finds nothing to walk.
+      async outbox({ limit = 20, rdf = false } = {}) {
+        const me = await call('/api/v1/accounts/verify_credentials').then((r) => said(r, a.host));
+        const list = await call(`/api/v1/accounts/${me.id}/statuses?limit=${Math.min(40, limit)}`).then((r) => said(r, a.host));
+        const items = (Array.isArray(list) ? list : []).map(item);
+        if (rdf) items.rdf = await fetchOutboxRdf(a.actor, limit);
+        return items;
+      },
       async follow(handle) {
         const who = parseAddress(handle);
         if (!who?.at) throw new Error('a handle looks like @you@your.server');
@@ -295,7 +349,7 @@ export function fediAccount({
       fetch: session.fetch,
       async profile() {
         const doc = facts.actor ? await json(facts.actor, { headers: { accept: 'application/activity+json' } }) : null;
-        const count = async (url) => (url ? (await json(url, { headers: { accept: 'application/activity+json' } }))?.totalItems ?? null : null);
+        const count = async (v) => (await asDoc(v))?.totalItems ?? null;
         return { handle: facts.handle, name: doc?.name || null, url: doc?.url || null, avatar: doc?.icon?.url || (typeof doc?.icon === 'string' ? doc.icon : null), bio: doc?.summary || '',
           followers: await count(doc?.followers), following: await count(doc?.following), posts: await count(doc?.outbox), actor: facts.actor, webId: facts.webId };
       },
@@ -314,6 +368,23 @@ export function fediAccount({
           .slice(0, limit)
           .map((s) => ({ id: s.noteId, url: s.noteId, published: s.published || null, author: who(s.actor), html: s.content || '', inReplyTo: s.inReplyTo || null }));
       },
+      // This account's own posts, newest first, read from the same local
+      // record `timeline` uses (fast, no network call). With `rdf: true`,
+      // also fetches the real outbox from the pod and parses it into RDF/JS
+      // quads on the returned array's `.rdf` — a second, live document, not
+      // derived from the local record, so it needs `jsonld` (see loadJsonLd).
+      async outbox({ limit = 20, rdf = false } = {}) {
+        const rows = await state('statuses.json');
+        const actors = (await state('actors.json')) || {};
+        const who = (id) => { const d = actors[id]?.doc || actors[id] || {}; return { id, handle: d.preferredUsername ? `@${d.preferredUsername}@${new URL(id).host}` : null, name: d.name || null }; };
+        const items = (Array.isArray(rows) ? rows : [])
+          .filter((s) => s.kind === 'post')
+          .sort((x, y) => String(y.published || '').localeCompare(String(x.published || '')))
+          .slice(0, limit)
+          .map((s) => ({ id: s.noteId, url: s.noteId, published: s.published || null, author: who(s.actor), html: s.content || '', inReplyTo: s.inReplyTo || null }));
+        if (rdf) items.rdf = await fetchOutboxRdf(facts.actor, limit);
+        return items;
+      },
       async follow(handle) {
         const who = parseAddress(handle);
         if (!who?.at) throw new Error('a handle looks like @you@your.server');

package/lib/session/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fediverse-account",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Type a Fediverse handle or a WebID and get back an account you can act with: post, read its timeline, follow, reply, favourite, boost. Works out whether the account lives on a Mastodon-family server or on a Solid pod through FediPod, sends the person to sign in there, brings them back to where they were, and speaks to whichever it is.",
   "type": "module",
   "license": "MIT",
@@ -37,5 +37,13 @@
   "scripts": {
     "prepublishOnly": "node ../../scripts/check-pod-calls.mjs"
   },
-  "dependencies": {}
+  "dependencies": {},
+  "peerDependencies": {
+    "jsonld": "^9.0.0"
+  },
+  "peerDependenciesMeta": {
+    "jsonld": {
+      "optional": true
+    }
+  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod-server",
-  "version": "0.28.0",
+  "version": "0.29.0",
   "description": "The FediPod Server: a full ActivityPub server as a Community Solid Server component.",
   "license": "MIT",
   "main": "dist/index.js",