fedipod-server 0.28.1 → 0.29.0

package/lib/core/publisher/index.mjs

@@ -28,6 +28,8 @@ import { ALL_COLLECTIONS } from './collections.mjs';
 import * as restore from './restore.mjs';
 import * as notes from './notes.mjs';
 import * as questions from './questions.mjs';
+import * as own from './own.mjs';
+import { recordPlace } from '../place.mjs';
 
 const AGENT_VERSION = JSON.parse(fs.readFileSync(
   path.join(path.dirname(fileURLToPath(import.meta.url)), '../../../package.json'), 'utf8')).version;
@@ -40,6 +42,8 @@ export class Publisher {
     this.remote = remote;
     this.store = store;
     this.deliverer = deliverer;
+    // Everything this actor sends goes on the outbox its owner reads.
+    if (deliverer) deliverer.onSent = (a) => own.recordOwn(this, a);
     this.publicKeyPem = publicKeyPem;
     this.assertionKey = assertionKey;      // Ed25519 public half, multibase; null = no proofs
     // Where this identity's client surface answers, when that is an address a
@@ -111,6 +115,9 @@ export class Publisher {
       postingRestrictedToMods: this.config.kind === 'group' ? !!this.config.postingRestrictedToMods : null,
       moderators,
       pendingFollowers: priv ? urls.pendingFollowers : null,
+      // Named only where the private folder is proved to keep it private.
+      liked: priv ? urls.liked : null,
+      ownerOutbox: priv ? urls.ownOutbox : null,
       pendingFollowing: priv ? urls.pendingFollowing : null,
       blocked: priv ? urls.blocked : null,
       inbox,
@@ -244,6 +251,13 @@ export class Publisher {
     } catch (e) {
       this.log(`WebID profile not updated with the actor link: ${e.message}`);
     }
+    // Where the account lives, in the owner's public type index — only where
+    // they already have one; an index is made only on their yes, at sign-up.
+    if (!this.config.forum) {
+      await recordPlace(this.remote, urls.base, urls.home + 'ap/actor')
+        .then((r) => { if (r === 'registered') this.log('the public type index now records where the account lives'); })
+        .catch((e) => this.log(`type index not updated with the account's place: ${e.message}`));
+    }
 
     // inbox: public may only Append; owner (the agent) reads + drains. A
     // quiesced actor keeps its name resolving but takes no more mail, so a
@@ -277,7 +291,7 @@ export class Publisher {
     this.log(this.config.gateway?.frontActor || wire.webfingerHost(urls.base)
       ? `profile published: @${pubName}@${pubHost} → ${urls.actor}`
       : `profile published → ${urls.actor} — NOT discoverable as @${pubName}@${pubHost}: `
-        + 'this pod is a suffix-based host, and WebFinger is only answered at a host root');
+        + 'this pod is suffixed, and WebFinger is only answered for a subdomained pod');
     return { unreachable, updated };
   }
 
@@ -468,6 +482,14 @@ export class Publisher {
   publishBlocked(...a) { return collections.publishBlocked(this, ...a); }
   recordOutbox(...a) { return collections.recordOutbox(this, ...a); }
   unrecordOutbox(...a) { return collections.unrecordOutbox(this, ...a); }
+  recordOwn(...a) { return own.recordOwn(this, ...a); }
+  backfillLiked() { return own.backfillLiked(this); }
+  inboxesFor(...a) { return notes.inboxesFor(this, ...a); }
+  noteToSelf(...a) { return notes.noteToSelf(this, ...a); }
+  updateObject(...a) { return notes.updateObject(this, ...a); }
+  unrecordOwn(...a) { return own.unrecordOwn(this, ...a); }
+  publishOwn(...a) { return own.publishOwn(this, ...a); }
+  ownSettled() { return own.ownSettled(this); }
   publishFeatured(...a) { return collections.publishFeatured(this, ...a); }
 
   // restore.mjs

package/lib/core/publisher/notes.mjs

@@ -79,7 +79,9 @@ export async function mentionsFor(publisher, content, inReplyTo) {
     const doc = await publisher.resolveMention(handle).catch(() => null);
     if (!doc?.id) { publisher.log(`mention @${handle} did not resolve — left as text`); continue; }
     if (!inText.has(handle) && doc.type !== 'Group') continue;   // author trimmed them out
-    mentions.push({ handle, actor: doc.id, page: doc.url || null, inbox: doc.endpoints?.sharedInbox || doc.inbox });
+    // Naming yourself still tags you; it never delivers to your own inbox (§7.1).
+    const self = doc.id === publisher.urls.actor;
+    mentions.push({ handle, actor: doc.id, page: doc.url || null, inbox: self ? null : doc.endpoints?.sharedInbox || doc.inbox });
   }
   return mentions;
 }
@@ -144,12 +146,62 @@ export function assertDirectAddressed(content, mentions) {
 // otherwise the agent mints one as it always has.
 const SLUG_OK = /^[A-Za-z0-9._-]{1,64}$/u;
 export const safeSlug = (s) => (typeof s === 'string' && SLUG_OK.test(s) && !/^\.+$/u.test(s) ? s : null);
-async function slugFor(publisher, container, wanted, published) {
+export async function slugFor(publisher, container, wanted, published) {
   const name = safeSlug(wanted);
   if (name && !(await podNotes.read(publisher.remote, container + name).catch(() => null))) return name;
   return published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
 }
 
+// A message from this account to itself, for something its owner must hear
+// and has no other way to: a post an app sent through the outbox door that the
+// account then refused, after the door had already told the app "created".
+// Addressed to the owner alone and kept in the private container, so it shows
+// in the owner's apps as a direct message and a mention, and nowhere else.
+export async function noteToSelf(publisher, text) {
+  const { urls } = publisher;
+  const published = new Date().toISOString();
+  const slug = published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
+  const id = urls.privateNotes + slug;
+  const content = wire.contentHtml(text);
+  await podNotes.write(publisher.remote, id, { '@context': wire.AS_CTX, id, type: 'Note',
+    attributedTo: urls.actor, to: [urls.actor], published, content })
+    .catch(e => publisher.log(`note to self kept here only — the pod would not take it: ${e.message}`));
+  publisher.store.addStatus({ noteId: id, actor: urls.actor, content, text, published,
+    kind: 'post', visibility: 'direct', slug });
+  publisher.store.addNotification({ type: 'mention', actor: urls.actor, noteId: id });
+  return id;
+}
+
+// An app's edit of an object that is not a Note — an annotation, a poll —
+// changes only the fields it sends (§6.3); a field sent as null is removed.
+// What the object is, who made it and when, where it lives and who it is
+// addressed to stay as they are, and so do a poll's choices and its count.
+const FIXED = new Set(['@context', 'id', 'type', 'attributedTo', 'published', 'to', 'cc', 'bto', 'bcc',
+  'audience', 'oneOf', 'anyOf', 'endTime', 'closed', 'votersCount', 'replies']);
+export async function updateObject(publisher, s, patch, { updated = new Date().toISOString() } = {}) {
+  const { urls } = publisher;
+  const doc = await podNotes.read(publisher.remote, s.noteId);
+  if (!doc?.id) throw new Error('the object is not on the pod to change');
+  const next = { ...doc };
+  for (const [k, v] of Object.entries(patch || {})) {
+    if (FIXED.has(k)) continue;
+    if (v === null) delete next[k]; else next[k] = v;
+  }
+  if (typeof next.content === 'string') next.content = wire.sanitizeHtml(next.content);
+  next.updated = updated;
+  await podNotes.write(publisher.remote, doc.id, next);
+  await podNotes.writeCreate(publisher.remote, wire.createActivityId(doc.id), wire.createActivity(next, urls));
+  publisher.store.updateStatus(s.noteId, { content: rowContent(next), editedAt: updated });
+  const update = wire.updateActivity(next, urls);
+  const inboxes = [...new Set([
+    ...(s.visibility === 'direct' ? [] : publisher.store.getContacts().followers.map(f => f.sharedInbox || f.inbox)),
+    ...(await inboxesFor(publisher, [...(s.addressed || []), ...(s.replyActor ? [s.replyActor] : [])])),
+  ].filter(Boolean))];
+  await publisher.deliverer.deliverToAll(inboxes, update);
+  if (publisher.store.read('outbox.json', []).includes(s.noteId)) await publisher.recordOutbox(update);
+  return update;
+}
+
 // What the author's own timeline shows for an object: its content, else its
 // text under one of the names other vocabularies use, else a link to it.
 export function rowContent(obj) {
@@ -173,7 +225,9 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
   const published = new Date().toISOString();
   const slug = await slugFor(publisher, priv ? urls.privateNotes : urls.notes, wanted, published);
   const mentions = await publisher._mentionsFor(content, inReplyTo);
-  if (visibility === 'direct') assertDirectAddressed(content, mentions);
+  // Addressed by id (a client-to-server post) it is addressed already; only a
+  // post that names nobody but in its text has to name them there.
+  if (visibility === 'direct' && !also.length && !deliverTo.length) assertDirectAddressed(content, mentions);
   const reply = await replyTarget(publisher, inReplyTo, mentions, visibility);
   const selfQuote = quote?.id && quote.actor === urls.actor;
   const quoted = quote?.id ? {
@@ -199,6 +253,11 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
   publisher.store.addStatus({
     noteId: note.id, actor: urls.actor, content: note.content, published, inReplyTo,
     kind: 'post', slug, text: content, visibility,
+    // Everyone a client named, blind copies included: an edit or a deletion
+    // must reach them too. Kept here only, never published. `named` is the
+    // visible part, which an edit addresses again.
+    ...(also.length || deliverTo.length ? { addressed: [...new Set([...also, ...deliverTo])] } : {}),
+    ...(also.length ? { named: [...also] } : {}),
     ...(spoilerText ? { spoiler: spoilerText } : {}),
     ...(note.sensitive ? { sensitive: true } : {}),
     ...(attachments?.length ? { attachments } : {}),
@@ -301,6 +360,8 @@ export async function publishObject(publisher, object, { visibility = 'public',
   publisher.store.addStatus({
     noteId: id, actor: urls.actor, content: rowContent(row), published: row.published || published,
     kind: 'post', slug: name, visibility,
+    ...(also.length || deliverTo.length ? { addressed: [...new Set([...also, ...deliverTo])] } : {}),
+    ...(also.length ? { named: [...also] } : {}),
   });
   if (await publisher.store.commit?.() === false) publisher.log(`object published but its timeline row was refused: ${id}`);
 
@@ -332,16 +393,16 @@ export function rowTags(note) {
   return { ...(mentions.length ? { mentions } : {}), ...(hashtags.length ? { tags: hashtags } : {}) };
 }
 
-export async function updateNote(publisher, s, { content, spoilerText = null, sensitive = null, attachments = null } = {}) {
+export async function updateNote(publisher, s, { content, spoilerText = null, sensitive = null, attachments = null, updated = new Date().toISOString() } = {}) {
   const { urls } = publisher;
-  const updated = new Date().toISOString();
   const inText = new Set(wire.mentionsIn(content));
   const mentions = [];
   for (const handle of inText) {
     if (!publisher.resolveMention) break;
     const doc = await publisher.resolveMention(handle).catch(() => null);
     if (!doc?.id) { publisher.log(`mention @${handle} did not resolve — left as text`); continue; }
-    mentions.push({ handle, actor: doc.id, page: doc.url || null, inbox: doc.endpoints?.sharedInbox || doc.inbox });
+    mentions.push({ handle, actor: doc.id, page: doc.url || null,
+      inbox: doc.id === urls.actor ? null : doc.endpoints?.sharedInbox || doc.inbox });
   }
   const atts = attachments ?? s.attachments ?? [];
   // The note stays in the container its visibility put it in; a recovered
@@ -353,7 +414,7 @@ export async function updateNote(publisher, s, { content, spoilerText = null, se
     urls, slug, content, published: s.published, inReplyTo: s.inReplyTo,
     attachments: atts, mentions, visibility: s.visibility || 'public',
     summary: spoilerText, sensitive: sensitive ?? !!s.sensitive, updated, container,
-    also: reply ? [reply.actor] : [],
+    also: [...new Set([...(s.named || []), ...(reply ? [reply.actor] : [])])],
     quote: rowQuote(s),
   });
   await podNotes.write(publisher.remote, note.id, note);
@@ -372,8 +433,13 @@ export async function updateNote(publisher, s, { content, spoilerText = null, se
     ...(s.visibility === 'direct' ? [] : contacts.followers.map(f => f.sharedInbox || f.inbox)),
     ...mentions.map(m => m.inbox),
     reply?.inbox,
+    // everyone a client named or blind-copied, and a quoted author
+    ...(await inboxesFor(publisher, [...(s.addressed || []), ...(s.quoteRequest?.actor ? [s.quoteRequest.actor] : [])])),
   ].filter(Boolean))];
   await publisher.deliverer.deliverToAll(inboxes, update);
+  // The edit goes on the record beside the Create, for a post the outbox lists:
+  // a reader catching up from the outbox otherwise keeps the words it first saw.
+  if (publisher.store.read('outbox.json', []).includes(s.noteId)) await publisher.recordOutbox(update);
   publisher.log(`note edited: ${note.id} → ${inboxes.length} inbox(es)`);
   return patched;
 }

package/lib/core/publisher/own.mjs

@@ -0,0 +1,143 @@
+// own.mjs — the outbox as its owner reads it, and the owner's liked list.
+//
+// The public outbox is what a stranger may see: posts and boosts, and what
+// withdrew them. ActivityPub's outbox is every message the actor produced,
+// filtered by who is asking (§5.1), so its owner is owed the rest as well —
+// likes, follows, undos, follower decisions, followers-only and direct posts.
+// That view lives in the private container, whose owner-only rule it inherits,
+// and is what the outbox address answers its signed-in owner.
+//
+// Everything this actor sends passes through the deliverer, which hands each
+// fresh activity here (Deliverer.onSent), so nothing has to remember to record
+// itself. What is never sent — a block or a pin posted by a client — is
+// recorded by the client-to-server dispatcher.
+//
+// `liked` (§5.5) is the objects this actor has liked and not taken back,
+// kept beside it under the same rule.
+
+import crypto from 'node:crypto';
+import * as wire from '../wire.mjs';
+import * as collection from '../../pod/collection.mjs';
+
+const OWN = 'outbox-own.json';
+const LIKED = 'liked.json';
+// The owner's view keeps its newest entries; older ones leave the view only —
+// the public outbox, and everything the account did, are untouched.
+export const OWN_MAX = 5000;
+
+// A Create is kept by its object's id, as the public outbox keeps it, so the
+// two can be matched when a post is withdrawn; anything else is kept whole.
+const localForm = (a) => (a?.type === 'Create' && (typeof a.object === 'string' ? a.object : a.object?.id)) || a;
+
+export function recordOwn(publisher, activity) {
+  const { urls, store } = publisher;
+  if (!activity?.type || activity.actor !== urls.actor) return false;
+  const item = localForm(activity);
+  const id = wire.outboxItemId(item);
+  const own = store.read(OWN, []);
+  if (id && own.some(i => wire.outboxItemId(i) === id)) return false;   // a retry, or said twice
+  own.unshift(item);
+  store.write(OWN, own.slice(0, OWN_MAX));
+  if (activity.type === 'Like' || (activity.type === 'Undo' && activity.object?.type === 'Like')) {
+    backfillLiked(publisher);
+    const object = wire.outboxItemId(activity.type === 'Like' ? activity.object : activity.object.object);
+    if (object) {
+      const liked = store.read(LIKED, []).filter(o => o !== object);
+      if (activity.type === 'Like') liked.unshift(object);
+      store.write(LIKED, liked);
+    }
+  }
+  schedule(publisher);
+  return true;
+}
+
+// An account that liked things before the list existed: the likes it still
+// holds (a timeline row marked favourited, with the Like that was sent) are
+// its liked list to begin with. Once only — a list that exists, even empty,
+// is the record from then on.
+export function backfillLiked(publisher) {
+  const { store } = publisher;
+  if (store.read(LIKED, null) !== null) return 0;
+  const liked = (store.getStatuses?.() || [])
+    .filter(s => s.favourited && s.noteId)
+    .sort((x, y) => String(y.published || '').localeCompare(String(x.published || '')))
+    .map(s => s.noteId);
+  store.write(LIKED, [...new Set(liked)]);
+  schedule(publisher);
+  return liked.length;
+}
+
+// A post deleted or a boost withdrawn leaves the owner's view as it leaves the
+// public one; the Delete or Undo that did it is already recorded, having been
+// sent.
+export function unrecordOwn(publisher, matches) {
+  const own = publisher.store.read(OWN, []);
+  const kept = own.filter(i => !matches(i));
+  if (kept.length === own.length) return;
+  publisher.store.write(OWN, kept);
+  schedule(publisher);
+}
+
+// Recording never waits on the pod: a like is answered when it is sent, and
+// the pages follow. One publish at a time, the last one covering every record
+// made while it waited.
+function schedule(publisher) {
+  if (publisher._ownQueued) return;
+  publisher._ownQueued = true;
+  publisher._ownChain = (publisher._ownChain || Promise.resolve()).then(async () => {
+    publisher._ownQueued = false;
+    try { await publishOwn(publisher); }
+    catch (e) { publisher.log?.(`owner's outbox view not published: ${e.message}`); }
+  });
+}
+
+export function ownSettled(publisher) { return publisher._ownChain || Promise.resolve(); }
+
+export async function publishOwn(publisher) {
+  const { urls, store, remote } = publisher;
+  // Written only where the private folder is proved to keep it private — the
+  // same bar the pending and blocked lists clear. Recorded meanwhile, and
+  // published the first time the bar is met.
+  if (publisher.privateReady && await publisher.privateReady() !== true) return;
+  const seen = store.read('published.json', {});
+  const own = store.read(OWN, []);
+  const out = wire.outboxPaging(own, seen.ownIndex || []);
+  const ownPages = await writePages(remote, seen.ownPages, out.pages.map((items, i) => ({
+    id: wire.outboxPageId(urls.ownOutbox, i + 1), doc: wire.outboxPage(urls.ownOutbox, i + 1, items),
+  })));
+  const ownHead = await writeHead(remote, seen.ownHead, urls.ownOutbox, wire.outboxHead(urls.ownOutbox, own.length, out.pages.length));
+
+  const liked = store.read(LIKED, []);
+  // liked.json is newest first; pages are filled from the oldest end.
+  const lk = wire.followersPaging([...liked].reverse(), seen.likedIndex || []);
+  const likedPages = await writePages(remote, seen.likedPages, lk.pages.map((items, i) => ({
+    id: wire.followersPageId(urls.liked, i + 1), doc: wire.followersPage(urls.liked, i + 1, items, lk.pages.length),
+  })));
+  const likedHead = await writeHead(remote, seen.likedHead, urls.liked, wire.followersHead(urls.liked, liked.length, lk.pages.length));
+
+  store.write('published.json', { ...store.read('published.json', {}),
+    ownPages, ownIndex: out.index, ownHead, likedPages, likedIndex: lk.index, likedHead });
+}
+
+// A head is written only when it changed: most records change a page, not the
+// count or the bounds.
+async function writeHead(remote, before, url, doc) {
+  const digest = crypto.createHash('sha256').update(JSON.stringify(doc)).digest('hex').slice(0, 16);
+  if (digest !== before) await collection.writeHead(remote, url, doc);
+  return digest;
+}
+
+// Only the pages that changed, and none past the new end. No rule is written:
+// the private container's owner-only rule is inherited.
+async function writePages(remote, before = {}, pages) {
+  const after = {};
+  for (const [i, { id, doc }] of pages.entries()) {
+    const n = i + 1;
+    after[n] = crypto.createHash('sha256').update(JSON.stringify(doc)).digest('hex').slice(0, 16);
+    if (before[n] !== after[n]) await collection.writePage(remote, id, doc);
+  }
+  for (const n of Object.keys(before).map(Number).filter(n => Number.isFinite(n) && n > pages.length)) {
+    await collection.dropPage(remote, pages[0].id.replace(/-\d+$/u, `-${n}`));
+  }
+  return after;
+}

package/lib/core/publisher/questions.mjs

@@ -9,7 +9,7 @@ import crypto from 'node:crypto';
 import * as wire from '../wire.mjs';
 import * as polls from '../polls.mjs';
 import * as podNotes from '../../pod/notes.mjs';
-import { assertDirectAddressed, replyTarget, rowTags } from './notes.mjs';
+import { assertDirectAddressed, replyTarget, rowTags, slugFor } from './notes.mjs';
 
 // How long a poll gathers votes before its Question is rewritten. Every vote
 // changes a number other servers re-read, and rewriting per vote would make a
@@ -22,7 +22,7 @@ const POLL_REWRITE_MS = 10_000;
  * voter pick more than one, and `expiresAt` is when voting stops.
  */
 export async function publishQuestion(publisher, content, { options = [], multiple = false, expiresAt = null,
-  inReplyTo = undefined, visibility = 'public', spoilerText = null, sensitive = false } = {}) {
+  inReplyTo = undefined, visibility = 'public', spoilerText = null, sensitive = false, slug: wanted = null } = {}) {
   const { urls } = publisher;
   const priv = visibility === 'private' || visibility === 'direct';
   if (priv) {
@@ -51,7 +51,9 @@ export async function publishQuestion(publisher, content, { options = [], multip
   }
 
   const published = new Date().toISOString();
-  const slug = published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
+  // The name the client asked for, when it is plain — the outbox door has
+  // already told the client the address it names.
+  const slug = await slugFor(publisher, priv ? urls.privateNotes : urls.notes, wanted, published);
   const mentions = await publisher._mentionsFor(content, inReplyTo);
   if (visibility === 'direct') assertDirectAddressed(content, mentions);
   const reply = await replyTarget(publisher, inReplyTo, mentions, visibility);

package/lib/core/social.mjs

@@ -126,7 +126,7 @@ async function cacheCounts(agent, doc) {
 
 // `doc` skips the fetch when the caller already resolved the actor; a bulk
 // import passes publish:false and republishes the collections once at the end.
-export async function followActor(agent, actorUrl, { publish = true, doc: fetched = null } = {}) {
+export async function followActor(agent, actorUrl, { publish = true, doc: fetched = null, serial = Date.now() } = {}) {
   const doc = fetched || await agent.intake.fetchAP(actorUrl);
   if (!doc?.inbox) throw new Error(`actor document unusable (${actorUrl})`);
   if (agent.store.isBlocked(doc.id)) throw new Error('actor is blocked');
@@ -136,7 +136,7 @@ export async function followActor(agent, actorUrl, { publish = true, doc: fetche
     rec = { actor: doc.id, inbox: doc.inbox, accepted: false };
     contacts.following.push(rec);
   }
-  const follow = wire.followActivity({ urls: agent.publisher.urls, targetActor: doc.id, serial: Date.now() });
+  const follow = wire.followActivity({ urls: agent.publisher.urls, targetActor: doc.id, serial });
   rec.followActivity = follow;               // kept for a later Undo
   agent.store.setContacts(contacts);
   await agent.deliverer.deliver(doc.inbox, follow);
@@ -144,9 +144,9 @@ export async function followActor(agent, actorUrl, { publish = true, doc: fetche
   return doc;
 }
 
-export async function followHandle(agent, handle) {
+export async function followHandle(agent, handle, { serial = Date.now() } = {}) {
   const doc = await resolveHandle(agent, handle);
-  await followActor(agent, doc.id);
+  await followActor(agent, doc.id, { serial });
   const clean = String(handle || '').replace(/^@/, '');
   const contacts = agent.store.getContacts();
   const rec = contacts.following.find(f => f.actor === doc.id);
@@ -154,13 +154,13 @@ export async function followHandle(agent, handle) {
   return { ok: true, actor: doc.id };
 }
 
-export async function unfollowActor(agent, actor) {
+export async function unfollowActor(agent, actor, { serial = Date.now() } = {}) {
   const contacts = agent.store.getContacts();
   const rec = contacts.following.find(f => f.actor === actor);
   if (!rec) throw new Error('not following that actor');
   if (rec.followActivity) {
     await agent.deliverer.deliver(rec.inbox,
-      wire.undoActivity({ urls: agent.publisher.urls, activity: rec.followActivity, serial: Date.now() }));
+      wire.undoActivity({ urls: agent.publisher.urls, activity: rec.followActivity, serial }));
   }
   contacts.following = contacts.following.filter(f => f.actor !== actor);
   agent.store.setContacts(contacts);
@@ -168,31 +168,31 @@ export async function unfollowActor(agent, actor) {
   return { ok: true };
 }
 
-export async function favourite(agent, s) {
+export async function favourite(agent, s, { serial = Date.now() } = {}) {
   if (s.favourited) return s;
   const doc = await agent.intake.fetchAP(s.actor);
   if (!doc?.inbox) throw new Error('author inbox unavailable');
-  const act = wire.likeActivity({ urls: agent.publisher.urls, noteId: s.noteId, serial: Date.now() });
+  const act = wire.likeActivity({ urls: agent.publisher.urls, noteId: s.noteId, serial, to: s.actor });
   await agent.deliverer.deliver(doc.endpoints?.sharedInbox || doc.inbox, act);
   return agent.store.updateStatus(s.noteId, { favourited: true, likeActivity: act });
 }
 
-export async function unfavourite(agent, s) {
+export async function unfavourite(agent, s, { serial = Date.now() } = {}) {
   if (s.likeActivity) {
     const doc = await agent.intake.fetchAP(s.actor).catch(() => null);
     if (doc?.inbox) {
       await agent.deliverer.deliver(doc.endpoints?.sharedInbox || doc.inbox,
-        wire.undoActivity({ urls: agent.publisher.urls, activity: s.likeActivity, serial: Date.now() }));
+        wire.undoActivity({ urls: agent.publisher.urls, activity: s.likeActivity, serial }));
     }
   }
   return agent.store.updateStatus(s.noteId, { favourited: false, likeActivity: undefined });
 }
 
 // Announce goes to our followers (that's what boosting is) and to the author.
-export async function reblog(agent, s) {
+export async function reblog(agent, s, { serial = Date.now() } = {}) {
   if (s.reblogged) return s;
   const { urls } = agent.publisher;
-  const act = wire.announceActivity({ urls, object: s.noteId, serial: Date.now() });
+  const act = wire.announceActivity({ urls, object: s.noteId, serial });
   const inboxes = new Set(agent.store.getContacts().followers
     .map(f => f.sharedInbox || f.inbox).filter(Boolean));
   if (s.actor !== urls.actor) {
@@ -208,15 +208,15 @@ export async function reblog(agent, s) {
   return updated;
 }
 
-export async function unreblog(agent, s) {
+export async function unreblog(agent, s, { serial = Date.now() } = {}) {
   if (s.announceActivity) {
-    const undo = wire.undoActivity({ urls: agent.publisher.urls, activity: s.announceActivity, serial: Date.now() });
+    const undo = wire.undoActivity({ urls: agent.publisher.urls, activity: s.announceActivity, serial });
     const inboxes = new Set(agent.store.getContacts().followers
       .map(f => f.sharedInbox || f.inbox).filter(Boolean));
     const doc = await agent.intake.fetchAP(s.actor).catch(() => null);
     if (doc?.inbox && s.actor !== agent.publisher.urls.actor) inboxes.add(doc.endpoints?.sharedInbox || doc.inbox);
     await agent.deliverer.deliverToAll([...inboxes], undo);
-    await agent.publisher.unrecordOutbox(i => i?.id === s.announceActivity.id);
+    await agent.publisher.unrecordOutbox(i => i?.id === s.announceActivity.id, { record: () => undo });
   }
   return agent.store.updateStatus(s.noteId, { reblogged: false, announceActivity: undefined });
 }
@@ -260,7 +260,7 @@ export async function ejectFollower(agent, actor) {
 
 // Group: answer a held join request. Admitting is the Accept onFollow would
 // have sent immediately had the group not been gated.
-export async function admitRequest(agent, actor, { publish = true } = {}) {
+export async function admitRequest(agent, actor, { publish = true, serial = Date.now() } = {}) {
   const reqs = agent.store.getRequests();
   const req = reqs.find(r => r.actor === actor);
   if (!req) throw new Error('no such request');
@@ -286,14 +286,14 @@ export async function admitRequest(agent, actor, { publish = true } = {}) {
   // A bulk admit passes publish:false and republishes once for the lot.
   if (publish) await agent.publisher.publishCollections({ followers: true, pending: true });
   await agent.deliverer.deliver(req.inbox, wire.acceptActivity({
-    urls: agent.publisher.urls, followActivity: req.activity, serial: Date.now(),
+    urls: agent.publisher.urls, followActivity: req.activity, serial,
   }));
   return { ok: true, actor };
 }
 
 // Refusing is not a ban: they may ask again, and the queue is where you would
 // see that. Eject is the sticky one, because it mutes.
-export async function refuseRequest(agent, actor) {
+export async function refuseRequest(agent, actor, { serial = Date.now() } = {}) {
   const reqs = agent.store.getRequests();
   const req = reqs.find(r => r.actor === actor);
   if (!req) throw new Error('no such request');
@@ -307,7 +307,7 @@ export async function refuseRequest(agent, actor) {
     return { ok: true, actor };
   }
   await agent.deliverer.deliver(req.inbox, wire.rejectActivity({
-    urls: agent.publisher.urls, followActivity: req.activity, serial: Date.now(),
+    urls: agent.publisher.urls, followActivity: req.activity, serial,
   }));
   return { ok: true, actor };
 }
@@ -375,9 +375,21 @@ export async function votePoll(agent, s, choices) {
 
 export async function deleteNote(agent, s) {
   const { urls } = agent.publisher;
-  const inboxes = agent.store.getContacts().followers
-    .map(f => f.sharedInbox || f.inbox).filter(Boolean);
-  await agent.deliverer.deliverToAll(inboxes, wire.deleteActivity({ urls, noteId: s.noteId }));
+  // The deletion goes where the post went: followers unless it was direct, and
+  // everyone it named or was blind-copied to. Addressed as the post was, read
+  // from the post itself while it is still there.
+  const doc = await Promise.resolve().then(() => podNotes.read(agent.remote, s.noteId)).catch(() => null);
+  const shape = wire.addressing(urls, s.visibility || 'public', (s.mentions || []).map(m => m.href).filter(Boolean));
+  const to = Array.isArray(doc?.to) ? doc.to : shape.to;
+  const cc = Array.isArray(doc?.cc) ? doc.cc : shape.cc;
+  const named = [...to, ...cc, ...(s.addressed || []), ...(s.replyActor ? [s.replyActor] : [])]
+    .filter(a => typeof a === 'string' && a !== wire.PUBLIC && a !== urls.followers && a !== urls.actor);
+  const inboxes = [
+    ...(s.visibility === 'direct' ? [] : agent.store.getContacts().followers.map(f => f.sharedInbox || f.inbox)),
+    ...(agent.publisher.inboxesFor ? await agent.publisher.inboxesFor(named).catch(() => []) : []),
+  ].filter(Boolean);
+  const del = wire.deleteActivity({ urls, noteId: s.noteId, to, cc });
+  await agent.deliverer.deliverToAll(inboxes, del);
 
   // The note is REPLACED with a Tombstone rather than removed, so a peer that
   // dereferences it learns the post was deleted instead of a bare 404 (§7.4).
@@ -386,12 +398,23 @@ export async function deleteNote(agent, s) {
   // not the object, so it is deleted outright.
   const stuck = [];
   const deletedAt = new Date().toISOString();
+  // Only inside the posts folders: an object that lives elsewhere on the pod
+  // (an annotation a client keeps in its own place, or anything it named) is
+  // that client's document, and a deletion here must not overwrite it — the
+  // profile, say — with a Tombstone. Its Create and outbox entry still go.
+  const ours = [urls.notes, urls.privateNotes].some(c => String(s.noteId).startsWith(c));
   try {
-    await podNotes.writeTombstone(agent.remote, s.noteId, wire.noteTombstone(s.noteId, deletedAt));
+    if (ours) await podNotes.writeTombstone(agent.remote, s.noteId, wire.noteTombstone(s.noteId, deletedAt));
   } catch { stuck.push(s.noteId); }
-  if (!await podNotes.dropCreate(agent.remote, wire.createActivityId(s.noteId))) {
-    stuck.push(wire.createActivityId(s.noteId));
-  }
+  // The Create becomes a Tombstone too, not a gap: it embedded the post, so
+  // its words go, and whoever asks for it is told it is gone (410 through the
+  // Gateway) rather than that it never was.
+  // An object kept outside the posts folders has its Create inside them, under
+  // the name it was given (publishObject).
+  const createId = ours ? wire.createActivityId(s.noteId) : (s.slug ? wire.createActivityId(urls.notes + s.slug) : null);
+  try {
+    if (createId) await podNotes.writeTombstone(agent.remote, createId, wire.noteTombstone(createId, deletedAt, 'Create'));
+  } catch { stuck.push(createId); }
   if (stuck.length) {
     agent.log?.(`delete ${s.noteId}: the pod kept ${stuck.length} document(s) — the post is STILL PUBLISHED`);
     return {
@@ -410,8 +433,15 @@ export async function deleteNote(agent, s) {
       .catch(e => agent.log?.(`bluesky mirror not deleted (${e.message}): ${s.atproto.uri}`));
   }
 
-  // The note's outbox entry, and our own boost of it if there was one.
-  await agent.publisher.unrecordOutbox(i => i === s.noteId || (i?.id && i.id === s.announceActivity?.id));
+  // The note's outbox entry, and our own boost of it if there was one. The
+  // Delete takes the post's place — only for a post the outbox listed, so a
+  // private post's deletion stays as private as the post was.
+  const itsOwn = (i) => i === s.noteId || (i?.id && i.id === s.announceActivity?.id)
+    // its edits too: an Update carries the post's words, which must not
+    // outlive the post on the public record
+    || (i?.type === 'Update' && (typeof i.object === 'string' ? i.object : i.object?.id) === s.noteId);
+  await agent.publisher.unrecordOutbox(itsOwn,
+    { record: (gone) => (gone.includes(s.noteId) ? del : null) });
   agent.store.removeStatus(s.noteId);
   return { ok: true };
 }
@@ -436,7 +466,7 @@ export async function announceModeration(agent, activity) {
 // nothing is delivered TO THE BLOCKED PARTY (§6.10). Intake already refuses a
 // blocked author on arrival. A group additionally announces the ban to its
 // members (FEP-1b12) — announceModeration keeps a person's blocks silent.
-export async function blockActor(agent, actorUrl) {
+export async function blockActor(agent, actorUrl, { serial = Date.now() } = {}) {
   if (!/^https?:\/\/\S+$/.test(String(actorUrl || ''))) throw new Error('actor must be a URL');
   const b = agent.store.getBlocklist();
   if (!b.actors.includes(actorUrl)) b.actors.push(actorUrl);
@@ -444,12 +474,12 @@ export async function blockActor(agent, actorUrl) {
   await unfollowActor(agent, actorUrl).catch(() => {});   // not following is fine
   await agent.publisher?.publishCollections({ blocked: true }).catch(() => {});
   await announceModeration(agent,
-    wire.blockActivity({ urls: agent.publisher.urls, targetActor: actorUrl, serial: Date.now() }))
+    wire.blockActivity({ urls: agent.publisher.urls, targetActor: actorUrl, serial }))
     .catch(e => agent.log?.(`moderation announce failed: ${e.message}`));
   return { ok: true, actor: actorUrl };
 }
 
-export async function unblockActor(agent, actorUrl) {
+export async function unblockActor(agent, actorUrl, { serial = Date.now() } = {}) {
   const b = agent.store.getBlocklist();
   b.actors = b.actors.filter(a => a !== actorUrl);
   agent.store.setBlocklist(b);
@@ -459,7 +489,7 @@ export async function unblockActor(agent, actorUrl) {
   await announceModeration(agent, wire.undoActivity({
     urls: agent.publisher.urls,
     activity: { type: 'Block', actor: agent.publisher.urls.actor, object: actorUrl },
-    serial: Date.now(),
+    serial,
   })).catch(e => agent.log?.(`moderation announce failed: ${e.message}`));
   return { ok: true, actor: actorUrl };
 }

package/lib/core/store.mjs

@@ -305,7 +305,17 @@ export class PodStore {
     const b = this.read('blocklist.json', {});
     return { domains: b.domains || [], actors: b.actors || [] };
   }
-  setBlocklist(b) { this.write('blocklist.json', b); }
+  // Blocking someone ends their following as well: a blocked actor, or anyone
+  // on a blocked domain, is no longer delivered to. The mark dropFollower leaves
+  // keeps a reconcile from bringing them back.
+  setBlocklist(b) {
+    this.write('blocklist.json', b);
+    const c = this.getContacts();
+    const gone = c.followers.filter(f => f.actor && this.isBlocked(f.actor)).map(f => f.actor);
+    if (!gone.length) return;
+    for (const actor of gone) dropFollower(c, actor, 'blocked');
+    this.setContacts(c);
+  }
   // Takes an actor URL or an object URL: the actor list only ever matches the
   // former, the domain list matches either.
   isBlocked(url) {