fedipod-server 0.28.1 → 0.29.0

package/lib/gateway/front-core.mjs

@@ -25,6 +25,8 @@ import { routeQuietApi, noteOpened, noteReceived, closedState, accountState, clo
 import { routeNoticesApi } from './notices.mjs';
 import { withSecurityHeaders } from './headers.mjs';
 import { podTokenVerifier } from './caches.mjs';
+import { claimedWebId } from './token-claims.mjs';
+import { withdrawn, overLimit, relayOne } from './relay-extras.mjs';
 
 // The one WebFinger document, spelled out here rather than imported from
 // wire.mjs: wire drags the agent's whole HTML pipeline (sanitize-html and
@@ -91,9 +93,13 @@ const podOwners = (podBase, fetchImpl = fetch) =>
   podRoot.readOwnerLinks(fetchImpl, podBase, { timeoutMs: OWNER_LOOKUP_MS });
 
 // Whether a token's WebID vouches for this pod, on the evidence of where it
-// lives. Weak on purpose, and never used alone any more — see provesPod.
+// lives: the same origin, and — for a suffixed pod — inside
+// the WebID's own pod, wherever in it the account was put. Weak on purpose,
+// and never used alone for an attach — see provesPod.
 function webidUnderPod(webid, podHome) {
-  try { return new URL(webid).origin === new URL(podHome).origin; } catch { return false; }
+  try {
+    return new URL(webid).origin === new URL(podHome).origin && String(podHome).startsWith(podBaseOfWebId(webid));
+  } catch { return false; }
 }
 
 /**
@@ -144,15 +150,8 @@ function podHomeProblem(podHome, frontOrigin) {
 }
 
 const RELAY_MAX_REQUESTS = 20;
-const RELAY_MAX_BODY = 1024 * 1024;
-const RELAY_TIMEOUT_MS = 8_000;
-// The only headers a relayed request may carry to the remote server. Host
-// comes from the URL; the user agent from safeFetch.
 const SERVER_PROBE_MS = 6000;
 const SERVER_PROBE_BYTES = 64 * 1024;
-const RELAY_HEADERS = new Set(['date', 'digest', 'signature', 'content-type', 'accept']);
-
-const keyIdOf = (signature) => (/keyId="([^"]+)"/.exec(signature || '') || [])[1] || null;
 
 // The owner's APIs a browser at ANOTHER origin may call: an address moving
 // to a new gateway is driven from the new gateway's page, and it has to tell
@@ -167,46 +166,6 @@ const API_CORS = {
 const withApiCors = (out) => ({ ...out, headers: { ...(out.headers || {}), ...API_CORS } });
 const apiPreflight = () => ({ status: 204, headers: { ...API_CORS, allow: 'POST, OPTIONS' }, body: null });
 
-async function relayOne(item, rec, fetchImpl) {
-  const url = String(item?.url || '');
-  const method = String(item?.method || 'POST').toUpperCase();
-  if (method !== 'GET' && method !== 'POST') return { url, status: 0, error: 'method must be GET or POST' };
-  let u;
-  try { u = new URL(url); } catch { return { url, status: 0, error: 'not a URL' }; }
-  if (u.protocol !== 'https:' && !(u.protocol === 'http:' && process.env.AP_ALLOW_PRIVATE_TARGETS === '1')) {
-    return { url, status: 0, error: 'https only' };
-  }
-  const headers = {};
-  for (const [k, v] of Object.entries(item?.headers || {})) {
-    const name = k.toLowerCase();
-    if (RELAY_HEADERS.has(name) && typeof v === 'string') headers[name] = v;
-  }
-  const body = method === 'POST' ? String(item?.body ?? '') : undefined;
-  if (body !== undefined && Buffer.byteLength(body) > RELAY_MAX_BODY) return { url, status: 0, error: 'body too large' };
-  const keyId = keyIdOf(headers.signature);
-  if (method === 'POST' && !keyId) return { url, status: 0, error: 'a delivery must be signed' };
-  if (keyId && !keyId.startsWith(rec.actorUrl + '#')) return { url, status: 0, error: "signed with a key that is not this account's" };
-  if (headers.digest) {
-    const want = 'SHA-256=' + crypto.createHash('sha256').update(body || '').digest('base64');
-    if (headers.digest !== want) return { url, status: 0, error: 'digest does not match the body' };
-  }
-  try {
-    const res = await safeFetch(url, { method, headers, body, signal: AbortSignal.timeout(RELAY_TIMEOUT_MS) }, fetchImpl);
-    const out = { url, method, status: res.status };
-    // The far server asking to be left alone has to reach the agent that will
-    // do the asking again. Without this the browser build could not honour a
-    // Retry-After at all — every delivery it makes goes through here — and fell
-    // back to its own ladder against a server that had already said how long.
-    const retryAfter = res.headers.get('retry-after');
-    if (retryAfter) out.retryAfter = retryAfter;
-    if (method === 'GET') {
-      out.contentType = res.headers.get('content-type') || null;
-      out.body = await readCapped(res, RELAY_MAX_BODY);
-    }
-    return out;
-  } catch (e) { return { url, method, status: 0, error: e.message }; }
-}
-
 const j = (status, obj, ct = 'application/json') =>
   ({ status, headers: { 'content-type': ct, 'cache-control': 'no-store' }, body: JSON.stringify(obj) });
 // Held at the edge like any other missing document: a bot's scan, a dead
@@ -639,7 +598,11 @@ async function route(request, ctx) {
     // Acting through the relay is being here. Hourly at most; see noteOpened.
     await noteOpened(ctx, handle, rec).catch((e) => console.log(`relay @${handle}: stamp not written: ${e?.message || e}`));
     if (items.length > RELAY_MAX_REQUESTS) return withApiCors(j(400, { error: `at most ${RELAY_MAX_REQUESTS} requests per call` }));
+    const slow = overLimit(handle, items.length) && j(429, { error: 'too many relayed requests — slow down' });
+    if (slow) return withApiCors({ ...slow, headers: { ...slow.headers, 'retry-after': '60' } });
     const results = await Promise.all(items.map((it) => relayOne(it, rec, ctx.fetchImpl || fetch)));
+    // Something of the account's withdrawn: the edge's copies go.
+    if (withdrawn(items, rec.actorUrl)) await ctx.purge?.([`u-${handle}`]).catch((e) => console.log(`purge @${handle}: ${e?.message || e}`));
     // One line per relayed request, so a lookup that fails on the far side is
     // visible here and not only as an empty result in someone's browser.
     for (const r of results) console.log(`relay @${handle}: ${r.method || ''} ${r.url} → ${r.status}${r.error ? ` (${r.error})` : ''}`);
@@ -724,7 +687,8 @@ async function route(request, ctx) {
       return j(403, { error: 'the token proves a different pod than the one you listed' });
     }
     if (action === 'opt-in') {
-      const { httpStatus, ...reply } = await ctx.agentControl.optIn({ podBase, webId: webid });
+      const { httpStatus, ...reply } = await ctx.agentControl.optIn({ podBase, webId: webid,
+        container: String(body.container || ''), createIndex: body.createIndex === true });
       if (reply.doorSecret) {
       // The secret appears here and nowhere else; the command is the
       // paste-and-run way to open the owner door once.
@@ -876,13 +840,28 @@ async function route(request, ctx) {
       if (!webid) return json(401, { error: 'a Solid-OIDC token proving this account\'s owner is required' });
       const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
       if (!owner) return json(403, { error: 'this outbox belongs to its owner alone' });
-      const { status, reason, location } = await handleOwnerPost(request, identFor(rec),
-        { podPut: (u, b, ct) => ctx.podPut(up.handle, u, b, ct), ownerWebId: webid });
+      const onPod = (u) => u.replace(rec.actorUrl.replace(/ap\/actor$/u, ''), rec.podHome);
+      const { status, reason, location, object } = await handleOwnerPost(request, identFor(rec),
+        { podPut: (u, b, ct) => ctx.podPut(up.handle, u, b, ct), ownerWebId: webid,
+          exists: async (u) => ((await (ctx.podGet || fetch)(onPod(u), { podHome: rec.podHome })).status !== 404) });
       console.log(`door @${up.handle}: owner post → ${status} (${reason})`);
       if (status !== 201) return json(status, { error: reason });
-      return json(201, { accepted: true, ...(location ? { object: location } : {}),
+      return json(201, { accepted: true, ...(location ? { id: location } : {}), ...(object ? { object } : {}),
         note: 'it goes out when your FediPod agent next runs' }, location ? { location } : {});
     }
+    // Its owner, signed in, reads every message the account produced (§5.1:
+    // the outbox is filtered by who asks); that view is on the pod, under the
+    // owner's own rule. Anyone else reads the public one.
+    // The token is only read here, not verified: the redirect grants nothing,
+    // the pod checks the credential when the owner arrives there, and a
+    // verification per read would let anyone make the front fetch keys from a
+    // server they name.
+    if ((request.method === 'GET' || request.method === 'HEAD') && request.headers.get('authorization')) {
+      const webid = claimedWebId(request);
+      if (webid && (rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome))) {
+        return { status: 303, headers: { ...cors, location: rec.podHome + 'ap/private/outbox', 'cache-control': 'no-store' }, body: '' };
+      }
+    }
     if (rec.inboxOnly && (request.method === 'GET' || request.method === 'HEAD')) {
       return { status: 303, headers: { ...cors, location: rec.podHome + 'ap/outbox', 'cache-control': 'no-store' }, body: '' };
     }
@@ -907,6 +886,12 @@ async function route(request, ctx) {
   }
   if (closed) return gone({ ...open, ...publicFor(GONE_EDGE_SECONDS) }, CLOSED);
   const podTarget = rec.podHome + up.rest;
+  // The owner's own documents — the full outbox, the liked list, the pending
+  // lists — are read at the pod, which decides who may; never held here,
+  // where one reader's answer would be served to the next.
+  if (up.rest.startsWith('ap/private/')) {
+    return { status: 303, headers: { ...open, location: podTarget, 'cache-control': 'no-store' }, body: '' };
+  }
   // Media stays on the pod (lib/pod/urls.mjs keeps `media` off the front), but
   // the id rewrite below turns media links onto the front like every other
   // pod url in a document. Answer those by pointing at the pod: bytes are not
@@ -929,8 +914,9 @@ async function route(request, ctx) {
     ctx.podGet || ((u) => fetch(u, { headers: { accept } })),
     podTarget, { podHome: rec.podHome, accept });
   if (got.text === null) {
-    const hold = [401, 403, 404, 410].includes(got.status) ? publicFor(MISSING_EDGE_SECONDS) : {};
-    return { status: got.status, headers: { ...open, ...hold }, body: '' };
+    const hold = [401, 403, 404, 410].includes(got.status) ? { ...publicFor(MISSING_EDGE_SECONDS), 'netlify-cache-tag': `u-${up.handle}` } : {};
+    // A stranger is not told a document exists that they may not read (§3.2).
+    return { status: got.status === 401 || got.status === 403 ? 404 : got.status, headers: { ...open, ...hold }, body: '' };
   }
   let text = got.text;
   text = swap(text, rec.podHome, base);
@@ -946,6 +932,9 @@ async function route(request, ctx) {
       doc.preferredUsername = up.handle;               // so @handle@front cross-checks
       doc.inbox = base + 'ap/inbox/';                  // deliveries come to the front to be verified
       doc.endpoints = { ...(doc.endpoints || {}), sharedInbox: base + 'ap/inbox/' };
+      // The owner's own documents are read at the pod, where their credential
+      // works; they keep the pod's address.
+      for (const k of ['liked', 'ownerOutbox']) if (typeof doc[k] === 'string') doc[k] = doc[k].replace(base, rec.podHome);
       if (movedBase) {
         doc.movedTo = rec.movedTo;
         const aka = new Set([].concat(doc.alsoKnownAs || []).filter((a) => typeof a === 'string' && a !== doc.id));
@@ -961,9 +950,16 @@ async function route(request, ctx) {
     } catch { /* leave the rewritten text as-is if it will not parse */ }
   }
   // `readPublicDocument` asked for it with no credential, so a document that
-  // came back is one anybody can read — which is what makes it cacheable.
-  return { status: 200,
-    headers: { ...open, 'content-type': got.type || (container ? 'text/turtle' : page ? 'text/html' : AP_CT), ...publicFor(PUBLIC_EDGE_SECONDS) },
+  // came back is one anybody can read — which is what makes it cacheable. A
+  // deleted post's Tombstone answers 410 Gone, and still says what it was.
+  let kind = null;
+  try { kind = JSON.parse(text)?.type; } catch { /* not JSON: a page or a container */ }
+  return { status: kind === 'Tombstone' ? 410 : 200,
+    headers: { ...open, 'content-type': got.type || (container ? 'text/turtle' : page ? 'text/html' : AP_CT), ...publicFor(PUBLIC_EDGE_SECONDS),
+      // The outbox answers its signed-in owner differently, so the edge keeps
+      // the public copy for those who show no credential.
+      ...(up.rest === 'ap/outbox' ? { 'netlify-vary': 'header=Authorization', vary: 'Authorization' } : {}),
+      'netlify-cache-tag': `u-${up.handle}` },
     body: text };
 }
 

package/lib/gateway/gateway-core.mjs

@@ -133,14 +133,15 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
 // client-to-server dispatcher, which publishes and delivers it — so the post
 // goes out when the agent next runs, the same way inbound mail is read.
 //
-// `slug` is the name the client asked for its new document. It rides in the
-// receipt so the dispatcher can use it, and it is what lets the door answer a
-// Location before anything exists: the object will live at notesPrefix+slug
-// unless that name is taken, in which case the agent mints another.
+// `slug` is the name of the new document — the client's, or one the door
+// chose — and `serial` and `at` name any other activity. They ride in the
+// receipt so the dispatcher uses them, and they are what let the door answer a
+// Location before anything exists. A name the client chose that is already
+// taken is the one case where the agent picks another.
 export const SLUG_OK = /^[A-Za-z0-9._-]{1,64}$/u;
 export const safeSlug = (s) => (typeof s === 'string' && SLUG_OK.test(s) && !/^\.+$/u.test(s) ? s : null);
 
-export async function handleOwnerPost(request, ident, { podPut, ownerWebId, maxBytes = DEFAULT_MAX_BYTES } = {}) {
+export async function handleOwnerPost(request, ident, { podPut, ownerWebId, maxBytes = DEFAULT_MAX_BYTES, exists = null } = {}) {
   if (!ident.hmacSecret) return { status: 409, reason: 'this account has no door secret — attach it again' };
   let raw;
   try { raw = await request.text(); } catch { return { status: 400, reason: 'unreadable body' }; }
@@ -150,16 +151,94 @@ export async function handleOwnerPost(request, ident, { podPut, ownerWebId, maxB
   if (!doc || typeof doc !== 'object' || Array.isArray(doc) || !doc.type) {
     return { status: 400, reason: 'a typed ActivityStreams object is required' };
   }
-  const slug = safeSlug(request.headers.get('slug'));
+  // A post that makes something new is named HERE, when the client did not
+  // name it, so the answer can give the address of what it made (§6: 201 with
+  // the new activity's id in Location) though nothing has been made yet.
+  // What the account would refuse is refused here, before the app is told
+  // "created" for something that will never exist.
+  const refusal = refusedAtTheDoor(doc, ident);
+  if (refusal) return { status: 422, reason: refusal };
+  const makes = doc.type === 'Create' || !ACTIVITY_TYPES.has(doc.type);
+  // A name the client asks for that is already taken is replaced here, so the
+  // address answered is the one the post gets.
+  let slug = safeSlug(request.headers.get('slug'));
+  if (slug && makes && exists && await exists(containerFor(doc, ident) + slug).catch(() => false)) slug = null;
+  if (!slug && makes) slug = mintSlug();
+  // Anything else is named the way the agent names it, from a serial and a
+  // time chosen here and handed over in the receipt.
+  // Two posts in the same millisecond still get different names.
+  const now = Date.now();
+  const serial = now * 1000 + crypto.randomInt(1000);
+  const at = new Date(now).toISOString();
+  const hash = sha256hex(raw);
+  // The receipt names the body it vouches for, so it vouches for nothing else,
+  // and the agent can tell the same body sent twice.
   const receipt = signReceipt({
     v: 1, verified: true, method: 'c2s', keyId: ownerWebId || null, actor: ident.actorUrl,
     checks: ['owner-token'], reason: 'owner', gateway: ident.gatewayWebId, ...(slug ? { slug } : {}),
+    serial, at, hash,
   }, ident.hmacSecret);
-  const hash = sha256hex(raw);
   const okA = await inbox.appendVerifiedDelivery(podPut, ident.inboxUrl, hash, raw);
   if (!okA) return { status: 502, reason: 'pod inbox write failed' };
   await inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt);
-  return { status: 201, reason: 'accepted', location: slug && ident.notesPrefix ? ident.notesPrefix + slug : null };
+  if (makes) {
+    const object = slug && ident.notesPrefix ? containerFor(doc, ident) + slug : null;
+    return { status: 201, reason: 'accepted', object, location: object ? object + '-create' : null };
+  }
+  const object = typeof doc.object === 'string' ? doc.object : doc.object?.id || null;
+  return { status: 201, reason: 'accepted', object, location: activityIdFor(doc.type, object, ident, serial, at) };
+}
+
+// The id the agent gives each kind of activity (lib/core/wire.mjs): an edit by
+// its note and time, a deletion by its note, a boost and an undo as documents
+// in the posts folder, the rest by the actor and serial.
+const SERIAL_NAMED = new Set(['Like', 'Follow', 'Block', 'Add', 'Remove', 'Accept', 'Reject']);
+function activityIdFor(type, object, ident, serial, at) {
+  const actor = ident.actorUrl;
+  if ((type === 'Update' || type === 'Delete') && object && object !== actor) {
+    return type === 'Delete' ? object + '-delete' : object + '-update-' + at.replace(/[^0-9TZ]/g, '');
+  }
+  if ((type === 'Announce' || type === 'Undo') && ident.notesPrefix) return `${ident.notesPrefix}${type.toLowerCase()}-${serial}`;
+  return SERIAL_NAMED.has(type) ? `${actor}#${type.toLowerCase()}-${serial}` : null;
+}
+
+// The account's own changes are made on its manage page, and the one
+// collection a client may add to or take from is the pinned posts.
+function refusedAtTheDoor(doc, ident) {
+  const object = typeof doc.object === 'string' ? doc.object : doc.object?.id || null;
+  const target = typeof doc.target === 'string' ? doc.target : doc.target?.id || null;
+  if (doc.type === 'Move') return 'moving the account is done on its manage page';
+  if ((doc.type === 'Update' || doc.type === 'Delete') && object === ident.actorUrl) {
+    return 'the account itself is changed on its manage page';
+  }
+  if ((doc.type === 'Add' || doc.type === 'Remove') && target !== ident.actorUrl.replace(/actor$/u, 'featured')) {
+    return 'the pinned posts are the one collection an app may add to or take from';
+  }
+  return null;
+}
+
+// The activity types §6 names; anything else with a type is an object the
+// agent wraps in a Create. The same list the dispatcher keeps (lib/client/c2s.mjs).
+const ACTIVITY_TYPES = new Set([
+  'Create', 'Update', 'Delete', 'Follow', 'Like', 'Announce', 'Undo',
+  'Block', 'Add', 'Remove', 'Accept', 'Reject', 'Move',
+]);
+
+// The name the agent would have chosen itself: the day and eight hex characters.
+const mintSlug = () => new Date().toISOString().slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
+
+// Where the agent will keep it: public and unlisted posts under notes/, posts
+// for followers or named people under private/ — decided by the addressing,
+// read the way the dispatcher reads it (nothing stated is public).
+const PUBLIC_NAMES = new Set(['https://www.w3.org/ns/activitystreams#Public', 'as:Public', 'Public']);
+function containerFor(doc, ident) {
+  const object = doc.type === 'Create' && doc.object && typeof doc.object === 'object' ? doc.object : doc;
+  const list = (v) => (v == null ? [] : Array.isArray(v) ? v : [v]).map(x => (typeof x === 'string' ? x : x?.id));
+  const to = list(doc.to ?? object.to);
+  const cc = list(doc.cc ?? object.cc);
+  const blind = list(doc.bto ?? object.bto).length + list(doc.bcc ?? object.bcc).length;
+  const open = (!to.length && !cc.length && !blind) || [...to, ...cc].some(a => PUBLIC_NAMES.has(a));
+  return open ? ident.notesPrefix : ident.notesPrefix.replace(/ap\/notes\/$/u, 'ap/private/');
 }
 
 export const _internal = { isBlocked, concernsUsAtEdge, httpUrl, sha256hex };

package/lib/gateway/relay-extras.mjs

@@ -0,0 +1,89 @@
+// relay-extras.mjs — the relay's single request, and what the relay notices
+// about the requests it carries.
+//
+// relayOne(): sends one request a browser-run agent has already signed, with
+// exactly the headers that were signed. It forwards a signature and cannot
+// make one: a POST must carry one, by this account's own key, over the body
+// its Digest names.
+//
+// withdrawn(): a relayed delivery that withdraws something of the account's —
+// a Delete, or an Undo — means the copies the edge holds of that account's
+// documents are out of date; the front purges them rather than serving a
+// deleted post for the rest of its hold.
+//
+// overLimit(): how many requests one account may have the relay carry. Counted
+// per running instance, which bounds a runaway agent or a stolen token without
+// any shared state; a real account sends nowhere near it.
+
+import crypto from 'node:crypto';
+import { readCapped, safeFetch } from '../shared/safefetch.mjs';
+
+const RELAY_MAX_BODY = 1024 * 1024;
+const RELAY_TIMEOUT_MS = 8_000;
+// The only headers a relayed request may carry to the remote server. Host
+// comes from the URL; the user agent from safeFetch.
+const RELAY_HEADERS = new Set(['date', 'digest', 'signature', 'content-type', 'accept']);
+const keyIdOf = (signature) => (/keyId="([^"]+)"/.exec(signature || '') || [])[1] || null;
+
+export async function relayOne(item, rec, fetchImpl) {
+  const url = String(item?.url || '');
+  const method = String(item?.method || 'POST').toUpperCase();
+  if (method !== 'GET' && method !== 'POST') return { url, status: 0, error: 'method must be GET or POST' };
+  let u;
+  try { u = new URL(url); } catch { return { url, status: 0, error: 'not a URL' }; }
+  if (u.protocol !== 'https:' && !(u.protocol === 'http:' && process.env.AP_ALLOW_PRIVATE_TARGETS === '1')) {
+    return { url, status: 0, error: 'https only' };
+  }
+  const headers = {};
+  for (const [k, v] of Object.entries(item?.headers || {})) {
+    const name = k.toLowerCase();
+    if (RELAY_HEADERS.has(name) && typeof v === 'string') headers[name] = v;
+  }
+  const body = method === 'POST' ? String(item?.body ?? '') : undefined;
+  if (body !== undefined && Buffer.byteLength(body) > RELAY_MAX_BODY) return { url, status: 0, error: 'body too large' };
+  const keyId = keyIdOf(headers.signature);
+  if (method === 'POST' && !keyId) return { url, status: 0, error: 'a delivery must be signed' };
+  if (keyId && !keyId.startsWith(rec.actorUrl + '#')) return { url, status: 0, error: "signed with a key that is not this account's" };
+  if (headers.digest) {
+    const want = 'SHA-256=' + crypto.createHash('sha256').update(body || '').digest('base64');
+    if (headers.digest !== want) return { url, status: 0, error: 'digest does not match the body' };
+  }
+  try {
+    const res = await safeFetch(url, { method, headers, body, signal: AbortSignal.timeout(RELAY_TIMEOUT_MS) }, fetchImpl);
+    const out = { url, method, status: res.status };
+    // The far server asking to be left alone has to reach the agent that will
+    // do the asking again. Without this the browser build could not honour a
+    // Retry-After at all — every delivery it makes goes through here — and fell
+    // back to its own ladder against a server that had already said how long.
+    const retryAfter = res.headers.get('retry-after');
+    if (retryAfter) out.retryAfter = retryAfter;
+    if (method === 'GET') {
+      out.contentType = res.headers.get('content-type') || null;
+      out.body = await readCapped(res, RELAY_MAX_BODY);
+    }
+    return out;
+  } catch (e) { return { url, method, status: 0, error: e.message }; }
+}
+
+const WINDOW_MS = 10 * 60 * 1000;
+const PER_WINDOW = 600;
+const counts = new Map();   // handle → { since, n }
+
+export function withdrawn(items, actorUrl) {
+  return items.some((it) => {
+    if (String(it?.method || 'POST').toUpperCase() !== 'POST') return false;
+    try {
+      const a = JSON.parse(String(it?.body ?? ''));
+      return a?.actor === actorUrl && (a.type === 'Delete' || a.type === 'Undo');
+    } catch { return false; }
+  });
+}
+
+export function overLimit(handle, n, now = Date.now()) {
+  const c = counts.get(handle);
+  const fresh = !c || now - c.since > WINDOW_MS ? { since: now, n: 0 } : c;
+  fresh.n += n;
+  counts.set(handle, fresh);
+  if (counts.size > 10_000) counts.clear();
+  return fresh.n > PER_WINDOW;
+}

package/lib/gateway/token-claims.mjs

@@ -0,0 +1,16 @@
+// token-claims.mjs — who a Solid access token says it is for, unchecked.
+//
+// Only for choosing where to send a read that the pod checks anyway: the
+// owner's full outbox lives on the pod under the owner's own rule, so reading
+// the claim decides nothing but the address. Verifying it here would let
+// anyone make the front fetch signing keys from a server they name, on every
+// read.
+
+export function claimedWebId(request) {
+  const token = /^(?:DPoP|Bearer)\s+([\w-]+)\.([\w-]+)\./u.exec(request.headers.get('authorization') || '');
+  if (!token) return null;
+  try {
+    const claims = JSON.parse(Buffer.from(token[2], 'base64url').toString('utf8'));
+    return typeof claims?.webid === 'string' ? claims.webid : null;
+  } catch { return null; }
+}

package/lib/pod/location.mjs

@@ -0,0 +1,52 @@
+// location.mjs — where in a pod an application's container goes.
+//
+// The container's own name is the caller's. The person says which container of
+// their pod holds it, as a path on the pod's own origin: `/` for a subdomained
+// pod, `/jeff/` for a suffixed one, or any container below either. Everything then lives under `<that><name>`, and the root kept is that
+// place relative to the pod.
+
+// The pod's own furniture: its profile, its settings, its well-known documents.
+const RESERVED = new Set(['profile', 'settings', '.well-known']);
+const SEGMENT = /^[A-Za-z0-9._-]+$/u;
+
+/** The prefilled answer: the pod's own root, as a path. */
+export function podRootPath(podBase) {
+  return new URL(podBase).pathname;
+}
+
+/**
+ * The container path someone typed, checked against their pod. Returns
+ * `{ root }` — the root relative to the pod, ending in `name` — or
+ * `{ problem }` saying what is wrong, in words for them.
+ */
+export function rootFromContainer(podBase, typed, name) {
+  const base = new URL(podBase);
+  let path = String(typed ?? '').trim() || base.pathname;
+  if (!path.startsWith('/')) path = '/' + path;
+  if (!path.endsWith('/')) path += '/';
+  if (!path.startsWith(base.pathname)) {
+    return { problem: `that is not in your pod — your pod starts at ${base.pathname}` };
+  }
+  const inside = path.slice(base.pathname.length);
+  const segments = inside.split('/').filter(Boolean);
+  if (segments.some(s => s === '.' || s === '..')) return { problem: 'a container path cannot go up with ..' };
+  if (segments.some(s => !SEGMENT.test(s))) {
+    return { problem: 'container names are letters, digits, dots, dashes and underscores' };
+  }
+  if (segments.length && RESERVED.has(segments[0])) {
+    return { problem: `${base.pathname}${segments[0]}/ belongs to your pod itself — choose another container` };
+  }
+  if (segments.length > 8) return { problem: 'that is nested too deep — eight containers at most' };
+  return { root: (segments.length ? segments.join('/') + '/' : '') + name };
+}
+
+/** Where the account lives, in full: the pod plus its root. */
+export const homeOf = (podBase, root) => podBase + root;
+
+/** The root back from a pod actor's address: `<pod><root>ap/actor`. */
+export function rootOfActor(podBase, actorUrl) {
+  const a = String(actorUrl || '');
+  if (!a.startsWith(podBase) || !a.endsWith('ap/actor')) return null;
+  const root = a.slice(podBase.length, -'ap/actor'.length);
+  return root.endsWith('/') ? root : null;
+}

package/lib/pod/notes.mjs

@@ -57,9 +57,6 @@ export async function writeTombstone(pod, noteId, doc) {
   await pod.setAcl(noteId, PUBLIC_READ);
 }
 
-/** Withdraw the Create. Returns whether the pod actually removed it. */
-export const dropCreate = (pod, createId) => pod.delete(createId).catch(() => false);
-
 /** The replies collection, once the note it belonged to is gone. */
 export const dropReplies = (pod, repliesId) => pod.delete(repliesId).catch(() => {});
 
@@ -73,7 +70,8 @@ export const dropReplies = (pod, repliesId) => pod.delete(repliesId).catch(() =>
 export async function list(pod, urls) {
   const children = await pod.listContainer(urls.notes);
   return children
-    .filter((c) => !/(-create|-replies)$/.test(c.url) && !c.url.endsWith('.keep'))
+    .filter((c) => !/(-create|-replies|-delete|-update-[^/]+)$/.test(c.url) && !/\/(announce|undo)-\d+$/.test(c.url)
+      && !c.url.endsWith('.keep'))
     // A defensive copy: the transport hands back the same array on a 304, so a
     // caller that sorts in place would corrupt it for every later reader.
     .map((c) => ({ ...c }));