fedipod-server 0.28.1 → 0.29.0

package/lib/client/c2s.mjs

@@ -28,6 +28,7 @@ import * as social from '../core/social.mjs';
 import * as wire from '../core/wire.mjs';
 import { readLenient } from '../core/as2.mjs';
 import { safeSlug } from '../core/publisher/notes.mjs';
+import * as podNotes from '../pod/notes.mjs';
 
 const MAX_BODY = 512 * 1024;          // same ceiling the inbox drain enforces
 
@@ -192,9 +193,11 @@ export class C2S {
    * published copy and it stays the canonical one; this is served only where
    * that copy cannot be read by the client asking.
    */
-  sendLocalOutbox(res, url, origin) {
+  sendLocalOutbox(res, url, origin, { owner = false } = {}) {
     const id = `${origin}ap/outbox`;
-    const outbox = this.store.read('outbox.json', []);     // newest first
+    // newest first; the owner's view is every message, the public one what a
+    // stranger may see
+    const outbox = this.store.read(owner ? 'outbox-own.json' : 'outbox.json', []);
     const page = url?.searchParams?.get('page') || null;
     const ct = { 'content-type': 'application/activity+json; charset=utf-8' };
     if (!page) {
@@ -270,12 +273,22 @@ export class C2S {
       return this.sendInbox(res, url);
     }
     if (req.method === 'GET' || req.method === 'HEAD') {
+      // The owner, signed in, reads every message the actor produced (§5.1:
+      // the outbox is filtered by who asks). Anyone else reads the public one.
+      const owner = pathname === '/ap/outbox' && req.headers.authorization
+        ? (await this.auth(req, pathname)).ok : false;
       // Where the client surface answers on an address a stranger can reach,
       // the pod's copies already name it and are the documents. Standalone
       // they are not reachable by the client asking, so it is answered here.
       const local = this.agent.publisher?.clientOrigin ? null : this.localOrigin(req);
       if (local && pathname === '/ap/actor') return this.sendLocalActor(req, res, local);
-      if (local && pathname === '/ap/outbox') return this.sendLocalOutbox(res, url, local);
+      if (local && pathname === '/ap/outbox') return this.sendLocalOutbox(res, url, local, { owner });
+      // The owner is answered here, not sent on: a redirect loses the
+      // credential (a browser drops it across origins, and a DPoP proof names
+      // the address it was made for), so the pod would refuse them.
+      if (owner && pathname === '/ap/outbox') {
+        return this.sendLocalOutbox(res, url, this.agent.publisher.clientOrigin, { owner });
+      }
       // The pod's copy is the document; send the reader there.
       const target = pathname === '/ap/actor' ? this.urls.actor : this.urls.outbox;
       res.writeHead(303, { location: target, 'cache-control': 'no-store' });
@@ -334,14 +347,22 @@ export class C2S {
   visibilityOf(activity, object) {
     const to = arr(activity.to ?? object?.to).map(idOf);
     const cc = arr(activity.cc ?? object?.cc).map(idOf);
-    if (!to.length && !cc.length) return 'public';
+    // Blind copies alone are still an audience: a post for them and nobody
+    // else is direct, never public.
+    const blind = arr(activity.bto ?? object?.bto).length + arr(activity.bcc ?? object?.bcc).length;
+    if (!to.length && !cc.length) return blind ? 'direct' : 'public';
     if (to.includes(wire.PUBLIC)) return 'public';
     if (cc.includes(wire.PUBLIC)) return 'unlisted';
-    if (to.includes(this.urls.followers)) return 'private';
+    // Followers named anywhere — "to alice, cc my followers" included — is a
+    // followers-only post that also reaches whoever else is named.
+    if (to.includes(this.urls.followers) || cc.includes(this.urls.followers)) return 'private';
     return 'direct';
   }
 
-  async dispatch(activity, { slug = null, raw = null } = {}) {
+  // `serial` and `at` name what this activity will make: the outbox door
+  // chose them and told the client, so they are used as given. A client
+  // posting here directly gets fresh ones.
+  async dispatch(activity, { slug = null, raw = null, serial = Date.now(), at = new Date().toISOString() } = {}) {
     const reply = (status, body, headers = {}) => ({ status, body, headers });
     if (!activity || typeof activity !== 'object' || Array.isArray(activity) || !activity.type) {
       return reply(400, { error: 'a typed ActivityStreams object is required' });
@@ -349,10 +370,12 @@ export class C2S {
     // A bare object arrives without an activity around it; the server supplies
     // the Create (§6.2.1), carrying the object's own addressing up onto it.
     if (!ACTIVITY_TYPES.has(activity.type)) {
-      activity = { type: 'Create', object: activity, to: activity.to, cc: activity.cc };
+      // Every audience field is copied up onto the Create (§6.2.1).
+      const { to, cc, bto, bcc, audience } = activity;
+      activity = { type: 'Create', object: activity, to, cc, bto, bcc, audience };
     }
     try {
-      return await this._dispatch(activity, { slug, raw, reply });
+      return await this._dispatch(activity, { slug, raw, reply, serial, at });
     } catch (e) {
       this.log(`c2s ${activity?.type}: ${e.message}`);
       return reply(422, { error: e.message || String(e) });
@@ -366,11 +389,23 @@ export class C2S {
     const pick = (...fields) => [...new Set(fields.flatMap((f) => arr(activity[f] ?? object?.[f]).map(idOf)))]
       .filter((a) => typeof a === 'string' && /^https?:\/\//u.test(a)
         && a !== wire.PUBLIC && a !== this.urls.followers && a !== this.urls.actor);
-    return { also: pick('to', 'cc'), deliverTo: pick('bto', 'bcc') };
+    // `audience` is who the post is for, a group most often: delivered to and
+    // named like to and cc (§7.1).
+    return { also: pick('to', 'cc', 'audience'), deliverTo: pick('bto', 'bcc') };
   }
 
-  async _dispatch(activity, { slug, raw, reply }) {
+  async _dispatch(activity, { slug, raw, reply, serial, at }) {
     const agent = this.agent;
+    // §6: every post to the outbox answers 201 with the new activity's id.
+    const made = (id, body = {}) => reply(201, { id, ...body }, { location: id });
+    // What is never sent anywhere — a person's block, a pin — is still a
+    // message this actor produced, so the owner's outbox records it here.
+    const kept = (type, extra) => {
+      const id = type === 'Undo' ? wire.undoActivityId(this.urls, serial) : `${this.urls.actor}#${type.toLowerCase()}-${serial}`;
+      const act = { id, type, actor: this.urls.actor, published: at, ...extra };
+      agent.publisher.recordOwn?.(act);
+      return act.id;
+    };
     const object = typeof activity.object === 'object' && activity.object !== null
       ? activity.object : null;
     const objectId = idOf(activity.object);
@@ -411,6 +446,7 @@ export class C2S {
               visibility,
               spoilerText: object.summary || null,
               sensitive: object.sensitive === true,
+              slug,
             });
             return reply(201,
               { id: wire.createActivityId(question.id), object: question.id },
@@ -445,19 +481,32 @@ export class C2S {
         if (s.actor !== this.urls.actor || s.kind !== 'post') {
           return reply(403, { error: 'not your note' });
         }
-        const text = String(object?.source?.content ?? object?.content ?? '');
-        if (!text.trim()) return reply(422, { error: 'the edit has no content' });
-        const attachments = object?.attachment !== undefined
+        // §6.3: a client's Update changes only what it sends, and a field sent
+        // as null is removed. What was sent is read from the bytes, because a
+        // JSON-LD reading drops the nulls that mean "remove this".
+        const sent = raw?.type === 'Update' && raw.object && typeof raw.object === 'object' ? raw.object : (object || {});
+        const has = (k) => Object.prototype.hasOwnProperty.call(sent, k);
+        const stored = await Promise.resolve().then(() => podNotes.read(agent.remote, s.noteId)).catch(() => null);
+        if (stored?.type && stored.type !== 'Note') {
+          await agent.publisher.updateObject(s, sent, { updated: at });
+          return made(wire.updateActivityId(s.noteId, at), { object: s.noteId });
+        }
+        const text = has('content') || sent.source?.content !== undefined
+          ? String(object?.source?.content ?? object?.content ?? '') : String(s.text ?? '');
+        if (!text.trim()) return reply(422, { error: 'the edit leaves the note with no content' });
+        const attachments = has('attachment')
           ? arr(object.attachment).map((a) => ({
             url: a?.url, mediaType: a?.mediaType,
             ...(a?.name ? { description: a.name } : {}),
           })).filter((a) => a.url)
           : null;
         await agent.publisher.updateNote(s, {
-          content: text, spoilerText: object?.summary || null,
-          sensitive: object?.sensitive === undefined ? null : object.sensitive === true, attachments,
+          content: text,
+          spoilerText: has('summary') ? (object?.summary || null) : (s.spoiler || null),
+          sensitive: has('sensitive') ? object?.sensitive === true : null, attachments,
+          updated: at,
         });
-        return reply(200, { ok: true, object: s.noteId });
+        return made(wire.updateActivityId(s.noteId, at), { object: s.noteId });
       }
 
       case 'Delete': {
@@ -471,7 +520,7 @@ export class C2S {
         }
         const r = await social.deleteNote(agent, s);
         if (!r.ok) return reply(502, { error: r.error, stillPublished: r.stillPublished });
-        return reply(200, { ok: true });
+        return made(wire.deleteActivityId(s.noteId), { object: s.noteId });
       }
 
       case 'Follow': {
@@ -479,31 +528,27 @@ export class C2S {
         // An acct: form or bare handle resolves through WebFinger; an https
         // IRI is fetched directly.
         if (/^acct:|^@|^[^/@]+@[^/@]+$/.test(objectId) && !/^https?:/.test(objectId)) {
-          const r = await social.followHandle(agent, objectId.replace(/^acct:/, ''));
+          const r = await social.followHandle(agent, objectId.replace(/^acct:/, ''), { serial });
           const rec = this.store.getContacts().following.find((f) => f.actor === r.actor);
-          return reply(201, { id: rec?.followActivity?.id, object: r.actor },
-            rec?.followActivity?.id ? { location: rec.followActivity.id } : {});
+          return made(rec?.followActivity?.id, { object: r.actor });
         }
-        const doc = await social.followActor(agent, objectId);
+        const doc = await social.followActor(agent, objectId, { serial });
         const rec = this.store.getContacts().following.find((f) => f.actor === doc.id);
-        return reply(201, { id: rec?.followActivity?.id, object: doc.id },
-          rec?.followActivity?.id ? { location: rec.followActivity.id } : {});
+        return made(rec?.followActivity?.id, { object: doc.id });
       }
 
       case 'Like': {
         const s = this.byIri(objectId);
         if (!s) return reply(422, { error: 'that note is not held here — like what the timeline holds' });
-        const updated = await social.favourite(agent, s);
-        return reply(201, { id: updated.likeActivity?.id, object: s.noteId },
-          updated.likeActivity?.id ? { location: updated.likeActivity.id } : {});
+        const updated = await social.favourite(agent, s, { serial });
+        return made(updated.likeActivity?.id, { object: s.noteId });
       }
 
       case 'Announce': {
         const s = this.byIri(objectId);
         if (!s) return reply(422, { error: 'that note is not held here — boost what the timeline holds' });
-        const updated = await social.reblog(agent, s);
-        return reply(201, { id: updated.announceActivity?.id, object: s.noteId },
-          updated.announceActivity?.id ? { location: updated.announceActivity.id } : {});
+        const updated = await social.reblog(agent, s, { serial });
+        return made(updated.announceActivity?.id, { object: s.noteId });
       }
 
       case 'Undo': {
@@ -511,39 +556,47 @@ export class C2S {
         // sends one, by its type+object when it re-states it instead.
         const inner = object;
         const innerId = idOf(activity.object);
+        const undone = wire.undoActivityId(this.urls, serial);
         if (inner?.type === 'Block') {
           const target = idOf(inner.object);
           if (!target) return reply(400, { error: 'unblock whom?' });
-          await social.unblockActor(agent, target);
-          return reply(200, { ok: true, object: target });
+          await social.unblockActor(agent, target, { serial });
+          // A group's unban was sent, and recorded as it went; a person's is not.
+          if (this.store.getConfig()?.kind !== 'group') {
+            kept('Undo', { object: { type: 'Block', actor: this.urls.actor, object: target } });
+          }
+          return made(undone, { object: target });
         }
         const statuses = this.store.getStatuses();
         let s = innerId ? statuses.find((x) => x.likeActivity?.id === innerId) : null;
         if (!s && inner?.type === 'Like') s = this.byIri(idOf(inner.object));
         if (s?.favourited) {
-          const updated = await social.unfavourite(agent, s);
-          return reply(200, { ok: true, object: updated.noteId });
+          const updated = await social.unfavourite(agent, s, { serial });
+          return made(undone, { object: updated.noteId });
         }
         s = innerId ? statuses.find((x) => x.announceActivity?.id === innerId) : null;
         if (!s && inner?.type === 'Announce') s = this.byIri(idOf(inner.object));
         if (s?.reblogged) {
-          const updated = await social.unreblog(agent, s);
-          return reply(200, { ok: true, object: updated.noteId });
+          const updated = await social.unreblog(agent, s, { serial });
+          return made(undone, { object: updated.noteId });
         }
         const following = this.store.getContacts().following;
         const rec = following.find((f) => f.followActivity?.id === innerId)
           || (inner?.type === 'Follow' ? following.find((f) => f.actor === idOf(inner.object)) : null);
         if (rec) {
-          await social.unfollowActor(agent, rec.actor);
-          return reply(200, { ok: true, object: rec.actor });
+          await social.unfollowActor(agent, rec.actor, { serial });
+          return made(undone, { object: rec.actor });
         }
         return reply(422, { error: 'nothing here matches what that Undo names' });
       }
 
       case 'Block': {
         if (!objectId) return reply(400, { error: 'block whom? object must name an actor' });
-        await social.blockActor(agent, objectId);
-        return reply(200, { ok: true, object: objectId });
+        await social.blockActor(agent, objectId, { serial });
+        // A group's ban was sent to its members; a person's never goes anywhere.
+        const id = this.store.getConfig()?.kind === 'group'
+          ? `${this.urls.actor}#block-${serial}` : kept('Block', { object: objectId });
+        return made(id, { object: objectId });
       }
 
       case 'Add':
@@ -556,7 +609,8 @@ export class C2S {
         const s = this.byIri(objectId);
         if (!s) return reply(404, { error: 'no such note here' });
         const updated = await social.pinStatus(agent, s, activity.type === 'Add');
-        return reply(200, { ok: true, object: updated.noteId, pinned: !!updated.pinned });
+        return made(kept(activity.type, { object: updated.noteId, target: this.urls.featured }),
+          { object: updated.noteId, pinned: !!updated.pinned });
       }
 
       case 'Accept':
@@ -566,10 +620,10 @@ export class C2S {
         const requester = object?.actor ? idOf(object.actor) : objectId;
         if (!requester) return reply(400, { error: 'whose request? object must name the Follow or its actor' });
         const r = activity.type === 'Accept'
-          ? await social.admitRequest(agent, requester).catch((e) => ({ error: e.message }))
-          : await social.refuseRequest(agent, requester).catch((e) => ({ error: e.message }));
+          ? await social.admitRequest(agent, requester, { serial }).catch((e) => ({ error: e.message }))
+          : await social.refuseRequest(agent, requester, { serial }).catch((e) => ({ error: e.message }));
         if (r.error) return reply(404, { error: r.error });
-        return reply(200, { ok: true, object: requester });
+        return made(`${this.urls.actor}#${activity.type.toLowerCase()}-${serial}`, { object: requester });
       }
 
       case 'Move':

package/lib/client/masto/accounts.mjs

@@ -255,6 +255,7 @@ export async function handle(api, ctx) {
     if (req.method === 'POST' && !b.domains.includes(domain)) b.domains.push(domain);
     if (req.method === 'DELETE') b.domains = b.domains.filter(d => d !== domain);
     api.store.setBlocklist(b);
+    Promise.resolve(api.agent?.publisher?.publishCollections?.({ blocked: true })).catch(() => {});
     return send(200, {});
   }
 

package/lib/core/deliver.mjs

@@ -187,7 +187,21 @@ export class Deliverer {
     return out;
   }
 
+  // A fresh activity of this actor's, for the outbox its owner reads. Never
+  // allowed to stop a delivery; a retry from the queue is not fresh.
+  _sent(activity) {
+    try { this.onSent?.(activity); } catch (e) { this.log(`owner's outbox record: ${e.message}`); }
+  }
+
+  // An inbox on a blocked domain is never delivered to, whoever still lists it.
+  _blockedInbox(inbox) {
+    try { return !!this.store.getBlocklist?.().domains.length && this.store.isBlocked?.(new URL(inbox).origin + '/'); }
+    catch { return false; }
+  }
+
   async deliver(inbox, activity) {
+    this._sent(activity);
+    if (this._blockedInbox(inbox)) return;
     // Proved before anything else, so the copy that goes on the queue is the
     // copy that was signed — a retry days later must not post a bare activity.
     const signed = await this.proofed(activity);
@@ -250,13 +264,15 @@ export class Deliverer {
   }
 
   async deliverToAll(inboxes, activity) {
+    this._sent(activity);
     // Proved once for the whole fan-out: every recipient gets the same bytes,
     // and one signature is computed rather than one per follower.
     const signed = await this.proofed(activity);
     // Shared inboxes deduplicate fan-out to the same server. Sent in batches
     // of batchSize, and a host found cooling by one batch is not asked again
     // by the next.
-    const targets = [...new Set(inboxes)].map((inbox) => ({ inbox, activity: signed }));
+    const targets = [...new Set(inboxes)].filter((inbox) => !this._blockedInbox(inbox))
+      .map((inbox) => ({ inbox, activity: signed }));
     for (let i = 0; i < targets.length; i += this.batchSize) {
       const chunk = targets.slice(i, i + this.batchSize).filter((t) => !this._queueIfCooling(t.inbox, signed));
       if (!chunk.length) continue;

package/lib/core/intake/activities.mjs

@@ -5,6 +5,9 @@
 import { dropFollower } from '../store.mjs';
 import { emojisOf, pollOf, isContentType, trimActivity, reactionOf, quoteOf, quotePolicyOf, authorOf } from './activity.mjs';
 
+// How long a follower's refollow waits before it is answered again.
+const REACCEPT_MS = 60 * 60 * 1000;
+
 const idOf = (v) => (typeof v === 'string' ? v : v?.id);
 
 // §7.6 Add / §7.9 Remove. The side effect would be to add or remove the object
@@ -98,6 +101,18 @@ export async function onFollow(intake, activity, actor, { trusted = false } = {}
     await intake.republish({ followers: true });
     intake.log(`new follower: ${actor}`);
   }
+  // A refollow from someone already following is answered again — their server
+  // may have lost our Accept — but not every time: the same Follow sent over and
+  // over would otherwise make us send, and record, an Accept for each one.
+  if (existing) {
+    const c = intake.store.getContacts();
+    const f = c.followers.find(x => x.actor === actor);
+    if (f?.acceptedAt && Date.now() - Date.parse(f.acceptedAt) < REACCEPT_MS) {
+      intake.log(`refollow from ${actor} — already accepted within the hour, not answered again`);
+      return;
+    }
+    if (f) { f.acceptedAt = new Date().toISOString(); intake.store.setContacts(c); }
+  }
   const { acceptActivity } = await import('../wire.mjs');
   await intake.deliverer.deliver(doc.inbox,
     acceptActivity({ urls: intake.urls, followActivity: activity, serial: intake.serial++ }));
@@ -370,8 +385,9 @@ export async function onDelete(intake, activity, actor) {
       await intake.forget(s, { collect: retracted });
     }
     if (retracted.length) {
-      const gone = new Set(retracted);
-      await intake.publisher.unrecordOutbox(i => gone.has(i?.id));
+      const gone = new Set(retracted.map(u => u.object.id));
+      await intake.publisher.unrecordOutbox(i => gone.has(i?.id),
+        { record: (was) => (intake.config.private ? null : retracted.filter(u => was.includes(u.object.id))) });
     }
     // Both: an account deletion drops them from followers AND following.
     await intake.republish({ followers: true, following: true });

package/lib/core/intake/group.mjs

@@ -175,7 +175,9 @@ export async function amplify(intake, noteId, { approved = false, activity = nul
   // Marked carried before recorded: a failed outbox write costs one missing
   // entry, a failed status write would carry the same post twice.
   intake.store.updateStatus(noteId, { announcedAt: new Date().toISOString(), announceActivity: act });
-  await intake.publisher.recordOutbox(act);
+  // A private group's carries are written for its members alone, so they go on
+  // its owner's full outbox (recorded as sent) and never on the public one.
+  if (!intake.config.private) await intake.publisher.recordOutbox(act);
   intake.store.setPending(intake.store.getPending().filter(p => p.noteId !== noteId));
   intake.log(`amplified ${noteId} → ${inboxes.length} inbox(es)`);
   // What the group carried is what the group's conversation holds. A forum

package/lib/core/intake/index.mjs

@@ -656,10 +656,33 @@ export class Intake {
   // document, not our reading of it); the graph is what it decides from.
   // Returns null when published, else the reason it was not — a dead letter.
   async ownerPostFrom(activity, raw, receipt) {
+    // The receipt names the body it vouches for; a body it does not name is
+    // not the owner's. A body already handled — a replayed request, or an item
+    // the pod would not let us delete — is not published twice.
+    const hash = raw ? await sha256Hex(raw) : null;
+    if (receipt.hash && receipt.hash !== hash) return 'owner post refused: the body is not the one its receipt names';
+    const seen = this.store.read('c2s-seen.json', []);
+    if (hash && seen.includes(hash)) {
+      this.log('owner post already handled — not published again');
+      return null;
+    }
     let asSent = null;
     try { asSent = raw ? JSON.parse(raw) : null; } catch { asSent = null; }
-    const r = await this.ownerPost(activity, { raw: asSent, slug: receipt.slug || null });
-    if (!r || r.status >= 300) return `owner post refused (${r?.status || '?'}): ${r?.body?.error || ''}`;
+    const r = await this.ownerPost(activity, { raw: asSent, slug: receipt.slug || null,
+      // What the door told the client this will be called, when it said.
+      ...(receipt.serial ? { serial: receipt.serial } : {}), ...(receipt.at ? { at: receipt.at } : {}) });
+    // Handled, one way or the other: a second sight of it changes nothing. A
+    // throw above is not handled, and is tried again.
+    if (hash) this.store.write('c2s-seen.json', [hash, ...this.store.read('c2s-seen.json', [])].slice(0, C2S_SEEN_MAX));
+    if (!r || r.status >= 300) {
+      const why = r?.body?.error || 'no reason was given';
+      // The door already answered the app "created"; the owner is the one
+      // left to tell.
+      await this.publisher.noteToSelf?.(`An app asked your account to publish ${article(activity.type)}, `
+        + `and your account refused it: ${why}. Nothing was sent.`)
+        .catch(e => this.log(`could not tell the owner their post was refused: ${e.message}`));
+      return `owner post refused (${r?.status || '?'}): ${why}`;
+    }
     this.log(`owner post from the outbox door published: ${r.body?.object || r.body?.id || activity.type}`);
     return null;
   }
@@ -699,3 +722,11 @@ export class Intake {
   retract(...a) { return notes.retract(this, ...a); }
   addReply(...a) { return notes.addReply(this, ...a); }
 }
+
+// "a Like", "an Update": the kind of activity, as a sentence says it.
+const article = (type) => `${/^[AEIOU]/u.test(String(type)) ? 'an' : 'a'} ${type || 'post'}`;
+
+// Bodies the outbox door handed over that were handled, newest first.
+const C2S_SEEN_MAX = 500;
+const sha256Hex = async (text) => [...new Uint8Array(await globalThis.crypto.subtle.digest('SHA-256',
+  new TextEncoder().encode(text)))].map(b => b.toString(16).padStart(2, '0')).join('');

package/lib/core/intake/notes.mjs

@@ -91,7 +91,11 @@ export async function maybeForward(intake, activity) {
       .filter(Boolean))];
     if (!inboxes.length) return;
     intake._forwardBudget -= 1;
-    await intake.deliverer.deliverToAll(inboxes, activity);
+    // Blind copies are for their sender's delivery alone and never travel on
+    // (§6, §7.1), from the activity or its object.
+    const strip = (o) => { if (!o || typeof o !== 'object') return o; const { bto, bcc, ...rest } = o; return rest; };   // eslint-disable-line no-unused-vars
+    const onward = { ...strip(activity), ...(activity.object && typeof activity.object === 'object' ? { object: strip(activity.object) } : {}) };
+    await intake.deliverer.deliverToAll(inboxes, onward);
     intake.store.write('forwarded.json', [...forwarded, id].slice(-MAX_FORWARDED));
     intake.log(`forwarded ${activity.type} ${id} to ${inboxes.length} follower inbox(es)`);
   } catch (e) {
@@ -319,10 +323,13 @@ export async function retract(intake, noteId, { collect = null } = {}) {
   if (!s.announceActivity) throw new Error('that post was never carried');
   const { undoActivity } = await import('../wire.mjs');
   const inboxes = intake.announceTargets(s.actor);
-  await intake.deliverer.deliverToAll(inboxes,
-    undoActivity({ urls: intake.urls, activity: s.announceActivity, serial: intake.serial++ }));
-  if (collect) collect.push(s.announceActivity.id);
-  else await intake.publisher.unrecordOutbox(i => i?.id === s.announceActivity.id);
+  const undo = undoActivity({ urls: intake.urls, activity: s.announceActivity, serial: intake.serial++ });
+  await intake.deliverer.deliverToAll(inboxes, undo);
+  // The Undo takes the carry's place in the outbox, so a reader catching up
+  // from it learns the carry was withdrawn.
+  if (collect) collect.push(undo);
+  else await intake.publisher.unrecordOutbox(i => i?.id === s.announceActivity.id,
+    { record: () => (intake.config.private ? null : undo) });
   intake.store.updateStatus(noteId, {
     announcedAt: undefined, announceActivity: undefined, retractedAt: new Date().toISOString(),
   });

package/lib/core/place.mjs

@@ -0,0 +1,82 @@
+// place.mjs — where on a pod a FediPod account lives, and recording it.
+//
+// The account's container is always named `fedipod`, inside a container its
+// owner chose. The choice is recorded in their public type index as an
+// instance of as:Actor (lib/pod/type-index.mjs), and that record is how the
+// account is found again. An account made before the choice existed sits at
+// `<pod>fedipod/` with no record, and is found there.
+
+import * as typeIndex from '../pod/type-index.mjs';
+import { PodTransport } from '../pod/transport.mjs';
+import { rootFromContainer, rootOfActor } from '../pod/location.mjs';
+import { DEFAULT_ROOT } from './wire.mjs';
+
+export { podRootPath } from '../pod/location.mjs';
+
+/** The container someone typed, as the account's root — or why it cannot be. */
+export const chosenRoot = (podBase, typed) => rootFromContainer(podBase, typed, DEFAULT_ROOT);
+
+/**
+ * The roots of the accounts this pod's owner has recorded, then the place an
+ * older account sits without a record. `pod` is a transport acting as the owner.
+ */
+export async function candidateRoots(pod, podBase) {
+  const recorded = await typeIndex.registeredActors(pod, podBase).catch(() => []);
+  const roots = recorded.map(a => rootOfActor(podBase, a)).filter(Boolean);
+  return [...new Set([...roots, DEFAULT_ROOT])];
+}
+
+/**
+ * The account on this pod: the first candidate whose config `read(root)` finds
+ * and `accept(config)` takes. Null when there is none.
+ */
+export async function findAccount(pod, podBase, read, accept = () => true) {
+  for (const root of await candidateRoots(pod, podBase)) {
+    const config = await read(root).catch(() => null);
+    if (config && accept(config)) return { root, config };
+  }
+  return null;
+}
+
+/**
+ * Record the account's place in the owner's public type index. With no index,
+ * one is made only when `create` is true — the person's own yes. Returns what
+ * was done: 'registered', 'already', or 'no-index'.
+ */
+export async function recordPlace(pod, podBase, actorAtPod, { create = false } = {}) {
+  let index = await typeIndex.findPublicIndex(pod, podBase);
+  if (!index) {
+    if (!create) return 'no-index';
+    index = await typeIndex.createPublicIndex(pod, podBase);
+  }
+  return (await typeIndex.register(pod, index, actorAtPod)) ? 'registered' : 'already';
+}
+
+/** Whether this person's profile names a public type index. */
+export async function hasPublicIndex(pod, podBase) {
+  return !!(await typeIndex.findPublicIndex(pod, podBase).catch(() => null));
+}
+
+/**
+ * Whether a pod's owner has a public type index, asked as a stranger before any
+ * credential exists: true, false, or null when the profile could not be read.
+ */
+export async function publicIndexKnown(fetchImpl, podBase, webId = `${podBase}profile/card#me`) {
+  const pod = new PodTransport({ fetch: fetchImpl }, { webId });
+  try { return !!(await typeIndex.findPublicIndex(pod, podBase)); } catch { return null; }
+}
+
+/**
+ * The root for a container typed before the pod's own path was known — a new
+ * pod: the answer is taken as inside the pod's root, whatever it turns out to be.
+ */
+export function chosenRootInNewPod(podBase, typed) {
+  const inner = String(typed ?? '').trim().replace(/^\/+/, '');
+  return chosenRoot(podBase, new URL(podBase).pathname + inner);
+}
+
+/** The error that stops a setup until its person has said yes to a new type index. */
+export function needsIndex(detail) {
+  return Object.assign(new Error(`${detail} FediPod records where your account lives in your public type index, `
+    + 'so it needs one. Say yes to creating it, or nothing is set up.'), { code: 'needs-index' });
+}

package/lib/core/publisher/collections.mjs

@@ -9,6 +9,7 @@ import * as podFollowers from '../../pod/followers.mjs';
 import * as podFollowing from '../../pod/following.mjs';
 import * as podFeatured from '../../pod/featured.mjs';
 import * as podPrivate from '../../pod/private.mjs';
+import * as podNotes from '../../pod/notes.mjs';
 
 // The default for publishCollections: the whole public surface, ACLs included.
 // A caller that knows what it changed narrows it; a caller that says nothing
@@ -133,6 +134,9 @@ export function readPublishedFollowers(publisher) { return podFollowers.readPubl
 
 export async function publishCollections(publisher, which = ALL_COLLECTIONS) {
   const { urls } = publisher;
+  // A block takes the blocked out of the followers too (PodStore.setBlocklist),
+  // so the published list changes with it.
+  if (which.blocked) which = { ...which, followers: true };
   const contacts = publisher.store.getContacts();
   if (which.followers) {
     // Reconcile walks the published pages, so — like the outbox — pay for it
@@ -147,7 +151,8 @@ export async function publishCollections(publisher, which = ALL_COLLECTIONS) {
   }
   if (which.following) {
     await podFollowing.write(publisher.remote, urls,
-      wire.orderedCollection(urls.following, contacts.following.filter(f => f.accepted).map(f => f.actor)),
+      // newest first (§5): contacts append as follows are made
+      wire.orderedCollection(urls.following, contacts.following.filter(f => f.accepted).map(f => f.actor).reverse()),
       { publicRead: which.acls });
   }
   if (which.pending) await publisher.publishPending();
@@ -158,6 +163,14 @@ export async function publishCollections(publisher, which = ALL_COLLECTIONS) {
   // reader, a refusal nothing caches, and every server asked again.
   if (which.featured) await publisher.publishFeatured();
   if (which.outbox) {
+    // A group made private takes back what it carried while open, as it goes:
+    // those posts were carried for its members, and a group turned private must
+    // not go on listing them to the world. Taken back, not hidden, so opening
+    // the group again does not put them back.
+    if (publisher.config?.kind === 'group' && publisher.config?.private) {
+      const carry = (i) => i?.type === 'Announce' || i?.type === 'Undo';
+      if (publisher.store.read('outbox.json', []).some(carry)) await unrecordOutbox(publisher, carry);
+    }
     const outbox = publisher.store.read('outbox.json', []);
     // Reconcile reads every published page, which is the expensive part of a
     // profile save. It is worth paying only when we are about to write pages
@@ -206,14 +219,32 @@ export async function recordOutbox(publisher, item) {
   const outbox = publisher.store.read('outbox.json', []);
   outbox.unshift(item);
   publisher.store.write('outbox.json', outbox);
+  await writeEntry(publisher, item);
   await publisher.publishOutbox(outbox);
 }
 
+// An entry kept whole — a boost, an edit, a deletion, an undo — is also written
+// as its own document at its id, beside the posts, so it can be fetched (§3.1).
+// Only for the public record, and only where the id is one of those documents.
+async function writeEntry(publisher, item) {
+  const notes = publisher.urls?.notes;
+  if (!notes || !item || typeof item !== 'object' || typeof item.id !== 'string' || !item.id.startsWith(notes)) return;
+  await podNotes.writeCreate(publisher.remote, item.id, { '@context': wire.AS_CTX, ...item })
+    .catch(e => publisher.log?.(`${item.type} ${item.id} not written as its own document: ${e.message}`));
+}
+
 // Taking something out of the outbox is a DECISION — a post deleted, a boost
 // undone. It leaves a mark for the same reason dropFollower does: the pod's
 // copy is rewritten right after, but a rewrite that fails would otherwise let
 // the next reconcile put the entry back. Bounded, like the follower one.
-export async function unrecordOutbox(publisher, matches) {
+//
+// What took it back goes in its place: a Delete for a deleted post, an Undo for
+// a withdrawn boost. A reader catching up from the outbox otherwise never learns
+// the entry it saw earlier was withdrawn. `record(gone)` names that activity (or
+// several, newest last), or null when nothing it cares about was in the outbox
+// (a private post never was). Both land in the one write, so the outbox is
+// never seen with the entry gone and its reason missing.
+export async function unrecordOutbox(publisher, matches, { record = null } = {}) {
   const before = publisher.store.read('outbox.json', []);
   const outbox = before.filter(i => !matches(i));
   const gone = before.filter(i => matches(i))
@@ -224,8 +255,12 @@ export async function unrecordOutbox(publisher, matches) {
     publisher.store.write('outbox-removed.json',
       [...marks, ...gone.map(id => ({ id, at }))].slice(-500));
   }
+  const reasons = [].concat((gone.length && record ? record(gone) : null) || []);
+  for (const r of reasons) { outbox.unshift(r); await writeEntry(publisher, r); }
   publisher.store.write('outbox.json', outbox);
   await publisher.publishOutbox(outbox);
+  publisher.unrecordOwn?.(matches);
+  return gone;
 }
 
 // The pinned posts, as the actor's featured collection — the one document a