fedipod-server 0.28.1 → 0.30.0

package/README.md

@@ -30,13 +30,12 @@ before installing: a server that does not meet them cannot offer accounts, and
 sign-up refuses rather than half-working.
 
 - **Community Solid Server 7.**
-- **Pods on subdomains or on paths.** A subdomain pod answers on its own
-  address (`@mei@mei.example.org`); a suffix pod on a path of the server's own
-  host answers under that path, and the server fronts it so its address is the
-  server's host (`@aisha@server.example`, for a pod at
-  `https://server.example/aisha/`). Either works — a suffix pod cannot resolve
-  its own handle, so it is followable only through the server's apex, which the
-  server also runs.
+- **Subdomained or suffixed pods.** A subdomained pod answers on its own
+  address (`@mei@mei.example.org`); a suffixed pod answers under its path, and
+  the server fronts it so its address is the server's host
+  (`@aisha@server.example`, for a pod at `https://server.example/aisha/`).
+  Either works — a suffixed pod cannot resolve its own handle, so it is
+  followable only through the server's apex, which the server also runs.
 - **A single worker.** Run the server as one copy of itself — `--workers 1`,
   which is the default. With more, it still serves pods normally, but no pod
   can be an account: sign-up is refused, and an account set up earlier goes on
@@ -53,6 +52,10 @@ sign-up refuses rather than half-working.
 npm install fedipod-server
 ```
 
+It installs `fedipod` with it: the agent, the Gateway's front and the pages
+are that package's, and a fix there reaches this component at your next
+`npm install`.
+
 Add the package context to your CSS config and import the shipped snippet:
 
 ```json
@@ -70,8 +73,8 @@ Add the package context to your CSS config and import the shipped snippet:
 
 Then set what you need on the `urn:fedipod:server:Handler` node and restart
 the server.
-A subdomain-pods CSS config gives each identity an origin of its own; a
-suffix (path) config hosts each on a path of the shared host. Both opt in.
+A CSS config with subdomained pods gives each identity an origin of its own;
+one with suffixed pods hosts each under its own path. Both opt in.
  The snippet places the component in the routing waterfall ahead of
 the LDP catch-all, on the initializer and finalizer lists so identities start
 and stop with the server, and on the websocket handler list for the live feed.
@@ -88,9 +91,9 @@ and stop with the server, and on the websocket handler list for the live feed.
 ```
 
 An identity is provisioned when its owner opts in: its name is the pod's
-subdomain label, or its last path segment on a suffix pod, and it publishes an
+subdomain label, or its last path segment on a suffixed pod, and it publishes an
 actor and a signing key on the pod itself. Its handle resolves on the pod for a
-subdomain, and through the server's apex for a suffix pod. Everything it is made of lives on its pod — its state, its private
+subdomained pod, and through the server's apex for a suffixed pod. Everything it is made of lives on its pod — its state, its private
 signing key, the secret guarding its own pages, and the credentials for any
 accounts its owner connects on other servers. Each identity has its own
 secret; one owner's opens nobody else's door. The opt-in reply is where the
@@ -108,9 +111,9 @@ naming the pod the identity runs on. Nothing private is in it.
 |---|---|
 | `agentRuntimeOptIn` | Whether pod owners can sign up. With it off, nothing runs. |
 | `agentDataDir` | Where each identity keeps the file naming its pod; its log lines go to the server's own log. Required whenever sign-up is on. |
-| `agentUiPath` | Where the owner's pages live on the pod's origin. `/fp/` by default; empty serves no pages. On a suffix pod it is under the pod's path, e.g. `/aisha/fp/`. |
+| `agentUiPath` | Where the owner's pages live on the pod's origin. `/fp/` by default; empty serves no pages. On a suffixed pod it is under the pod's path, e.g. `/aisha/fp/`. |
 | `agentRegistryContainer` | The internal container holding the sign-up rows. |
-| `runPage` | The HTML of the page where a pod owner opts in or out. The package's own `web/front/run.html` is served unless you set this. |
+| `runPage` | The HTML of the page where a pod owner opts in or out. The page `fedipod` ships is served unless you set this. |
 | `runPath` | Where that page answers. `/.fediverse-account` unless you set it. The path it takes is one the pod no longer serves, so it is yours to name; the dot keeps it out of the way of anybody's data. |
 | `agentWebIdSuffix` | Path from a pod's base to its owner's WebID. Defaults to `profile/card#me`. |
 | `agentPollSeconds` | How often the inbox is swept. Deliveries also wake the sweep as they land, so this is the fallback. |
@@ -134,10 +137,8 @@ Each identity answers on its pod's origin, so the pod is what a client
 connects to. Point a Mastodon app at `https://mei.example.org/` and it finds
 what it expects: nodeinfo, the client API under `/api/`, sign-in under
 `/oauth/`, the live feed at `/api/v1/streaming`, and the ActivityPub write API
-at `/ap/outbox`. The owner's own pages — the record and, in a repository
-checkout, the bundled web client — are behind `agentUiPath`, which the door
-secret guards. The published package does not carry the web client; point a
-Mastodon app at the pod instead.
+at `/ap/outbox`. The owner's own pages — the record and the bundled web client — are behind
+`agentUiPath`, which the door secret guards.
 
 The client API answers any origin, the way any Mastodon server does, so a
 browser client works too: it registers an app, and the authorize screen names
@@ -155,11 +156,11 @@ that document's address and registers nothing here. Once in, it posts to the
 outbox the actor names, and reads what the identity received at `/ap/inbox`,
 which nobody but the owner may read.
 
-A subdomain pod gets an origin of its own and answers at its root; a suffix
-pod shares the host and answers under its own path (`/aisha/ap/actor`,
-`/aisha/api/…`, `/aisha/oauth/…`, its door at `/aisha/fp/`). So a host carries
-at most one root identity, but any number of path pods beside it; a second
-root identity on a host, or a path pod nesting under another, is refused at
+A subdomained pod gets an origin of its own and answers at its root; a
+suffixed pod answers under its own path (`/aisha/ap/actor`, `/aisha/api/…`,
+`/aisha/oauth/…`, its door at `/aisha/fp/`). So a host carries at most one
+root identity, but any number of suffixed pods beside it; a second root
+identity on a host, or a suffixed pod nesting under another, is refused at
 opt-in rather than half-working.
 
 ### Before you turn it on
@@ -173,22 +174,22 @@ for anyone hosting other people, it is a promise being made to them.
 owner's door, with that identity's own door secret:
 
 ```
-# subdomain pod:
+# subdomained pod:
 curl -X POST https://mei.example.org/fp/config \
   -H 'x-dk-token: THE_DOOR_SECRET_FROM_THE_OPT_IN_REPLY' -H 'content-type: application/json' \
   -d '{"password":"the one you will type into your phone"}'
-# suffix pod — the door is under the pod's path:
+# suffixed pod — the door is under the pod's path:
 curl -X POST https://server.example/aisha/fp/config \
   -H 'x-dk-token: THE_DOOR_SECRET_FROM_THE_OPT_IN_REPLY' -H 'content-type: application/json' \
   -d '{"password":"the one you will type into your phone"}'
 ```
 
-**Some pod paths stop being served.** On a subdomain pod the paths above
+**Some pod paths stop being served.** On a subdomained pod the paths above
 belong to the identity, so pod resources at those names — a container called
 `api`, `oauth` or `fp`, or documents at `ap/actor`, `ap/outbox`,
 `ap/inbox`, `.well-known/oauth-authorization-server`,
 `.well-known/nodeinfo` and `nodeinfo/2.0` — are not served over HTTP there.
-On a suffix pod the same names are taken under the pod's own path
+On a suffixed pod the same names are taken under the pod's own path
 (`/aisha/api/…`, `/aisha/ap/actor`, `/aisha/fp/`, and so on); the rest of the
 path, and every other pod on the host, is untouched.
 They stay in the pod and in its listings. Every other path is the pod, exactly
@@ -245,25 +246,28 @@ TypeScript, built the way CSS builds its own components.
 npm install
 npm run build       # tsc → dist, then componentsjs-generator → dist/components
 npm test            # unit tests, plus the transport against a real CSS store
-npm run test:e2e    # boots a real server (subdomain pods) and uses it as a client would
-npm run test:e2e:suffix   # the same, for pods on paths of one host (mode d)
+npm run test:e2e    # boots a real server (subdomained pods) and uses it as a client would
+npm run test:e2e:suffix   # the same, for suffixed pods (mode d)
 ```
 
 `npm test` drives a genuine CSS store stack — ETags, conditional writes,
 container listings — through the transport an identity uses, and checks the
 lease protocol and the deletion deny-list still hold across it.
 
-`npm test` is also what a publish runs, so a red suite blocks one.
+`npm test` is also what a publish runs, so a red suite blocks one. In a
+FediPod checkout the tests run against the checkout's own `fedipod`:
+`scripts/link-fedipod.mjs` links it into `node_modules` before each test
+script, and does nothing anywhere else.
 
 `npm run test:e2e` starts a real Community Solid Server with three pods (two
 become identities up front; the third opts in and out at runtime), then signs in as a phone app does, posts,
 receives a follow from another server, and watches the live feed. It takes
 about a minute. `FEDIPOD_E2E_LOG=info` shows the server's log while it runs.
-`npm run test:e2e:suffix` does the same on a server whose pods live on paths of
-one host (`@aisha@server`): it proves the apex WebFinger resolves straight to
-the pod actor, that the actor, inbox, client API, OAuth and door all answer
-under the pod's path, that two path pods on one origin stay separate, and that
-a signed delivery is verified at the pod's own door.
+`npm run test:e2e:suffix` does the same on a server whose pods are suffixed
+(`@aisha@server`): it proves the apex WebFinger resolves straight to the pod
+actor, that the actor, inbox, client API, OAuth and door all answer under the
+pod's path, that two suffixed pods on one origin stay separate, and that a
+signed delivery is verified at the pod's own door.
 
 `dist/` and `node_modules/` are gitignored; `src/`, `config/` and this file are
 the sources.

package/config/server.json

@@ -60,6 +60,28 @@
         }
       ]
     },
+    {
+      "comment": "ActivityStreams documents are stored as application/activity+json. The spec asks a server to answer application/ld+json with the ActivityStreams profile for them too, and CSS alone refuses that form with 501. This relabels the one type as the other, both ways, without touching the bytes, so either Accept reads the same document.",
+      "@id": "urn:fedipod:server:ActivityStreamsReplacer",
+      "@type": "ContentTypeReplacer",
+      "replacements": [
+        { "ContentTypeReplacer:_replacements_key": "application/activity+json", "ContentTypeReplacer:_replacements_value": "application/ld+json" },
+        { "ContentTypeReplacer:_replacements_key": "application/ld+json", "ContentTypeReplacer:_replacements_value": "application/activity+json" }
+      ]
+    },
+    {
+      "comment": "The replacer goes first in the converter chain, before CSS's own ContentTypeReplacer.",
+      "@type": "Override",
+      "overrideInstance": { "@id": "urn:solid-server:default:ChainedConverter" },
+      "overrideSteps": [
+        {
+          "@type": "OverrideListInsertBefore",
+          "overrideParameter": { "@id": "https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^7.0.0/dist/storage/conversion/ChainedConverter.jsonld#ChainedConverter_converters" },
+          "overrideTarget": { "@id": "urn:solid-server:default:ContentTypeReplacer" },
+          "overrideValue": { "@id": "urn:fedipod:server:ActivityStreamsReplacer" }
+        }
+      ]
+    },
     {
       "comment": "Insert the handler into the routing waterfall just before the LDP catch-all, so it claims only the front routes and everything else stays normal CSS. OverrideListInsertBefore is available in componentsjs 5.x (which CSS 7 uses).",
       "@type": "Override",

package/dist/claims.js

@@ -51,11 +51,12 @@ const AGENT_PATHS = new Set([
 ]);
 const AGENT_PREFIXES = ['/api/', '/oauth/', '/@']; // /@handle: the short profile address
 // An identity's inbox is the container `/<root>/ap/inbox/`, matched by shape
-// rather than a fixed root. A POST here is a delivery, verified at the door
+// rather than a fixed root — and the root may be nested, wherever its owner put
+// the `fedipod/` container. A POST here is a delivery, verified at the door
 // before it is written; the handler checks the exact path per identity. The
 // path is relative to the identity's mount (see agentClaims), so a suffix pod's
 // `/aisha/fedipod/ap/inbox/` arrives here already stripped to `/fedipod/ap/inbox/`.
-const isInboxPath = (pathname) => /^\/[^/]+\/ap\/inbox\/$/u.test(pathname);
+const isInboxPath = (pathname) => /^\/(?:[^/]+\/)+ap\/inbox\/$/u.test(pathname);
 exports.isInboxPath = isInboxPath;
 /**
  * True when this path belongs to an identity's client surface.

package/dist/directory.d.ts

@@ -38,6 +38,8 @@ export interface AgentRegistryRecord {
     host: string;
     webId: string;
     optedInAt: string;
+    /** Where on the pod the account lives, relative to it; absent on older rows, which are at fedipod/. */
+    root?: string;
 }
 /**
  * The registry key for an opted-in pod: its host plus its path. Several pods

package/dist/door.d.ts

@@ -0,0 +1,4 @@
+import type { HttpHandlerInput } from '@solid/community-server';
+import type { EmbeddedIdentity } from './identities';
+import type { FediPodServerHandler } from './handler';
+export declare function deliverAtDoor(h: FediPodServerHandler, identity: EmbeddedIdentity, request: HttpHandlerInput['request'], response: HttpHandlerInput['response']): Promise<void>;

package/dist/door.js

@@ -0,0 +1,31 @@
+"use strict";
+// door.ts — a delivery to an identity's own inbox, verified here: the server
+// that stores the inbox is the one the request reached, so the signature is
+// checked while its headers exist and the receipt is written beside the
+// activity. The same door code the front runs; nothing is renamed.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deliverAtDoor = deliverAtDoor;
+const adapt_1 = require("./adapt");
+const fedipod_1 = require("./fedipod");
+async function deliverAtDoor(h, identity, request, response) {
+    const s = h.internals();
+    const { deliverToInbox } = await (0, fedipod_1.esmImport)(fedipod_1.EMBED);
+    let whatwg;
+    try {
+        // The pod's own origin: the signature covers the path and the Host header, and both are the pod's.
+        whatwg = await (0, adapt_1.nodeToWhatwg)(request, new URL(identity.podHome).origin);
+    }
+    catch (e) {
+        const status = e.statusCode === 413 ? 413 : 400;
+        response.writeHead(status, { 'content-type': 'application/json' });
+        response.end(JSON.stringify({ error: e.message }));
+        return;
+    }
+    const out = await deliverToInbox(identity.agent, whatwg, {
+        podPut: (url, body, ct) => s.podPut(url, body, ct),
+        gatewayWebId: s.args.gatewayWebId ?? null,
+    });
+    s.logger.info(`FediPod: delivery for @${identity.handle} at the door — ${out.reason} (${out.status})`);
+    response.writeHead(out.status, { 'content-type': 'application/json' });
+    response.end(JSON.stringify({ reason: out.reason }));
+}

package/dist/fedipod.d.ts

@@ -0,0 +1,16 @@
+export declare const FRONT_CORE = "fedipod/front";
+export declare const FRONT_PAGES = "fedipod/front-pages";
+export declare const EMBED = "fedipod/embed";
+export declare const PLACE = "fedipod/place";
+export declare const TRANSPORT = "fedipod/pod/transport.mjs";
+export declare const esmImport: (s: string) => Promise<Record<string, Function>>;
+/** The front's pages and the files they load, as fedipod/front-pages reads them. */
+export interface FrontPages {
+    signupPage: string | null;
+    runPage: string | null;
+    adminPage: string | null;
+    noticesPage: string | null;
+    authBundle: string | null;
+    pageScripts: Record<string, string | null>;
+    installScript: string | null;
+}

package/dist/fedipod.js

@@ -0,0 +1,13 @@
+"use strict";
+// fedipod.ts — the fedipod modules this component loads, by name, at runtime.
+// They are an ESM tree; a real dynamic import() built via Function keeps tsc
+// from downleveling it to require(), which cannot load an ESM module with
+// top-level await under a CommonJS build.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.esmImport = exports.TRANSPORT = exports.PLACE = exports.EMBED = exports.FRONT_PAGES = exports.FRONT_CORE = void 0;
+exports.FRONT_CORE = 'fedipod/front';
+exports.FRONT_PAGES = 'fedipod/front-pages';
+exports.EMBED = 'fedipod/embed';
+exports.PLACE = 'fedipod/place';
+exports.TRANSPORT = 'fedipod/pod/transport.mjs';
+exports.esmImport = new Function('s', 'return import(s)');

package/dist/front.d.ts

@@ -0,0 +1,3 @@
+import type { HttpHandlerInput } from '@solid/community-server';
+import type { FediPodServerHandler } from './handler';
+export declare function serveFront(h: FediPodServerHandler, request: HttpHandlerInput['request'], response: HttpHandlerInput['response']): Promise<void>;

package/dist/front.js

@@ -0,0 +1,94 @@
+"use strict";
+// front.ts — a request the Gateway's front answers: the same routeFront the
+// Netlify front runs, given this server's pages, its directory, its store
+// and the opt-in controls.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.serveFront = serveFront;
+const adapt_1 = require("./adapt");
+const fedipod_1 = require("./fedipod");
+async function serveFront(h, request, response) {
+    const s = h.internals();
+    const { routeFront } = await (0, fedipod_1.esmImport)(fedipod_1.FRONT_CORE);
+    // Read on each request, so an edited page shows without a restart. A
+    // missing file is not fatal: the route it feeds answers 404.
+    const { frontPages } = await (0, fedipod_1.esmImport)(fedipod_1.FRONT_PAGES);
+    const pages = frontPages();
+    let whatwg;
+    try {
+        whatwg = await (0, adapt_1.nodeToWhatwg)(request, s.args.frontOrigin);
+    }
+    catch (e) {
+        const status = e.statusCode === 413 ? 413 : 400;
+        response.writeHead(status, { 'content-type': 'application/json' });
+        response.end(JSON.stringify({ error: e.message }));
+        return;
+    }
+    const out = await routeFront(whatwg, {
+        host: s.frontHost,
+        frontOrigin: s.args.frontOrigin,
+        // This server issued the session the reader is already using, so it can
+        // read it rather than sending them to an identity provider that has just
+        // told them who they are. Same-origin only; front-core decides that.
+        webIdsFromSession: (req) => h.webIdsFromSession(req),
+        gatewayWebId: s.args.gatewayWebId,
+        offersPods: !!s.args.offersPods,
+        signupPage: s.args.signupPage || pages.signupPage,
+        runPage: s.args.runPage || pages.runPage,
+        runPath: s.runPath,
+        adminPage: s.args.adminPage || pages.adminPage,
+        // The notices page renders here too, and says the server keeps none:
+        // a notices store is the Netlify front's, not this component's.
+        noticesPage: pages.noticesPage,
+        // The opt-in and roster pages load the sign-in library, and the installer
+        // command is handed out with it; without these the pages render but
+        // cannot be used.
+        authBundle: pages.authBundle,
+        // Each page's own script, so the pages can be served under
+        // `script-src 'self'` (see fedipod/front).
+        pageScripts: pages.pageScripts,
+        installScript: pages.installScript,
+        lookup: (handle) => h.dir.lookup(handle),
+        putDirectory: (handle, rec) => h.dir.putDirectory(handle, rec),
+        podPut: (_handle, url, body, ct) => s.podPut(url, body, ct),
+        // Reads for the public proxy. `s.io.read` goes STRAIGHT into the
+        // resource store, which applies no access control of its own — so this is
+        // the one place that has to say what may be read, and it says: only
+        // inside the pod of the handle being served, and never a server-internal
+        // tree. Without it a row could name any location and this would fetch it
+        // (the directory, with every user's receipt secret, included).
+        //
+        // The front now refuses to attach such a row at all (podHomeProblem in
+        // fedipod/front); this is the same refusal at the other end, because
+        // a row can also arrive from a seed or an older deploy.
+        podGet: async (url, opts) => {
+            const denied = { status: 403, text: async () => '', headers: { get: () => null } };
+            let target;
+            try {
+                target = new URL(url);
+            }
+            catch {
+                return denied;
+            }
+            if (/(^|\/)\.internal(\/|$)/u.test(target.pathname))
+                return denied;
+            // Which pod asked: routeFront reads `rec.podHome + rest` and passes
+            // that podHome here, so the confinement is a value on the call rather
+            // than state on the handler. No podHome, no read.
+            const home = opts?.podHome;
+            if (!home || !url.startsWith(home))
+                return denied;
+            const raw = await s.io.read(url);
+            return raw == null
+                ? { status: 404, text: async () => '', headers: { get: () => null } }
+                : { status: 200, text: async () => raw, headers: { get: () => null } };
+        },
+        agentControl: s.registry
+            ? {
+                optIn: (a) => h.optInPod(a),
+                optOut: (a) => h.optOutPod(a),
+                describe: (a) => h.describePod(a),
+            }
+            : undefined,
+    });
+    await (0, adapt_1.applyToNode)(response, out);
+}

package/dist/handler.d.ts

@@ -1,6 +1,8 @@
 import { HttpHandler } from '@solid/community-server';
-import type { HttpHandlerInput, ResourceStore, Initializable, Finalizable, ClusterManager } from '@solid/community-server';
-import type { Directory } from './directory';
+import type { HttpHandlerInput, ResourceStore, Initializable, Finalizable, ClusterManager, Logger } from '@solid/community-server';
+import type { IO, Directory, AgentRegistry } from './directory';
+import type { AgentClaim } from './mounts';
+import type { EmbeddedIdentity } from './identities';
 export interface FediPodServerArgs {
     /** The server's ResourceStore: the handler reads pods and writes inbox items and directory rows directly through it — no HTTP, no credential. */
     resourceStore: ResourceStore;
@@ -41,25 +43,31 @@ export interface FediPodServerArgs {
     /** An internal container URL where the runtime opt-in rows live. */
     agentRegistryContainer?: string;
 }
-/** One running identity, and the call that stops it. */
-interface EmbeddedIdentity {
-    handle: string;
-    host: string;
-    /** Where the identity's own tree begins on its pod, and the actor inside it. */
-    podHome: string;
-    actorUrl: string;
-    surface: {
-        handler: (req: unknown, res: unknown) => Promise<void>;
-        streaming?: unknown;
-    };
-    stop: () => Promise<void>;
-    agent?: {
-        store?: {
-            getConfig?: () => {
-                kind?: string;
-            } | null | undefined;
-        };
-    };
+/**
+ * What the parts beside this file share. Private on the class, because the
+ * component generator would otherwise offer every public field as a
+ * configurable member; read through internals().
+ */
+export interface Internals {
+    args: FediPodServerArgs;
+    io: IO;
+    dir: Directory;
+    runPath: string;
+    uiPath: string;
+    frontHost: string;
+    podPut: (url: string, body: string, contentType: string) => Promise<boolean>;
+    logger: Logger;
+    registry: AgentRegistry | null;
+    claimed: Map<string, AgentClaim>;
+    agentHandles: Map<string, string>;
+    roots: Map<string, string>;
+    identities: Map<string, EmbeddedIdentity>;
+    surfaces: Map<string, EmbeddedIdentity>;
+    doorSecrets: Map<string, string>;
+    starting: Set<string>;
+    startCancelled: Set<string>;
+    stopping: boolean;
+    onSignal: ((signal: NodeJS.Signals) => void) | null;
 }
 export declare class FediPodServerHandler extends HttpHandler implements Initializable, Finalizable {
     private readonly args;
@@ -70,6 +78,7 @@ export declare class FediPodServerHandler extends HttpHandler implements Initial
     private readonly logger;
     private readonly claimed;
     private readonly agentHandles;
+    private readonly roots;
     private readonly frontHost;
     private readonly uiPath;
     private readonly identities;
@@ -81,61 +90,13 @@ export declare class FediPodServerHandler extends HttpHandler implements Initial
     private stopping;
     private onSignal;
     constructor(args: FediPodServerArgs);
-    /**
-     * Whether this pod may become an identity here, and the claim it earns: a
-     * real URL, a place no other identity already sits, and a handle no other
-     * identity uses — two pods must never share <agentDataDir>/<handle>/.
-     *
-     * A HOST-ROOT or subdomain pod needs an origin of its own, and it may not be
-     * the front's host: the whole surface answers at the origin root, so two of
-     * them, or one sharing the front, would collide. A SUFFIX pod lives on a path
-     * (`server/aisha/`), so it may share its host — with the front and with other
-     * suffix pods — provided no claim already contains or nests under its path.
-     */
-    private validateAgentPod;
-    /**
-     * The claim a request belongs to, or null. A request matches when its host is
-     * the claim's host and its path is at or under the claim's mount; the deepest
-     * mount wins, so a suffix pod's own routes are never swallowed by a shallower
-     * claim on the same host.
-     */
-    private resolveClaim;
-    /** A request path relative to a mount: `/aisha/ap/actor` under `/aisha` → `/ap/actor`. */
-    private stripMount;
-    /**
-     * Start an agent for each opted-in pod. Runs before the server listens, so
-     * the identities come up in the background and boot is never held on a pod.
-     */
+    /** The shared state, for the parts beside this file. */
+    internals(): Internals;
+    /** Start an agent for each opted-in pod, before the server listens. */
     initialize(): Promise<void>;
     /** Stop every identity: timers cleared, state written, lease let go. */
     finalize(): Promise<void>;
-    /**
-     * One identity's door secret, in its own pod's state. `agentDataDir` is
-     * handed in as the place an identity set up before this kept it, so its
-     * owner's existing door link survives the move.
-     */
-    private doorSecretFor;
-    private startIdentity;
-    /**
-     * When this server is also the door, give a running identity a
-     * @handle@<frontHost> address: one inbox-only directory row so the
-     * shared-domain handle resolves and the door can take verified delivery for
-     * it. The row names the identity's own tree, which is where its inbox and
-     * its actor are — the door writes deliveries there and the agent watches
-     * that container. A row written by an attach belongs to its owner and is
-     * left alone; one this server wrote itself is corrected. The identity keeps
-     * its own ids on the pod; nothing is moved.
-     */
-    private frontIdentity;
     canHandle({ request }: HttpHandlerInput): Promise<void>;
-    /**
-     * Whether identities run in this process. They run in one: the lease admits
-     * a single drainer, and the state each one holds is in memory. With workers,
-     * that process is the primary — which serves no requests, so every process
-     * still has to know which hosts belong to an identity even though only one
-     * of them can answer for it.
-     */
-    private runsIdentities;
     /**
      * The identity a request belongs to (matched by host and mount) and the
      * request path relative to that identity's mount, or null. The identity is
@@ -146,35 +107,21 @@ export declare class FediPodServerHandler extends HttpHandler implements Initial
         identity: EmbeddedIdentity | undefined;
         rel: string;
     } | null;
-    /**
-     * A pod owner, already proven to control podBase, asks this server to run
-     * their identity. Returns { httpStatus, ...body }; the secret appears in the
-     * reply and nowhere else. Re-opting-in rotates the secret — that is how a
-     * lost one is recovered.
-     */
-    /**
-     * The WebIDs behind the account session in the request, or none. The server
-     * keeps that session in a `css-account` cookie; its own account API is what
-     * says which WebIDs the session owns, and it takes the same cookie. Nothing
-     * here trusts the cookie's presence — the account API does the deciding, and
-     * the caller picks the WebID that owns the pod being claimed.
-     */
+    /** What a pod owner asks of this server; see opt-in.ts. */
     webIdsFromSession(request: {
         headers: {
             get(name: string): string | null;
         };
     }): Promise<string[]>;
-    optInPod({ podBase, webId }: {
+    optInPod(a: {
         podBase: string;
         webId: string;
+        container?: string;
+        createIndex?: boolean;
     }): Promise<Record<string, unknown> & {
         httpStatus: number;
     }>;
-    /**
-     * What a pod would be as an identity here, without changing anything: its
-     * handle, the host its address carries, and whether it runs here already.
-     */
-    describePod({ podBase }: {
+    describePod(a: {
         podBase: string;
     }): Promise<{
         handle: string;
@@ -183,19 +130,10 @@ export declare class FediPodServerHandler extends HttpHandler implements Initial
         running: boolean;
         manage: string;
     }>;
-    /** The reverse: stop the identity and let the pod be plain LDP again. */
-    optOutPod({ podBase }: {
+    optOutPod(a: {
         podBase: string;
     }): Promise<Record<string, unknown> & {
         httpStatus: number;
     }>;
-    /**
-     * A delivery to an identity's own inbox, verified here — the server that
-     * stores the inbox is the one the request reached, so the signature is
-     * checked while its headers exist and the receipt is written beside the
-     * activity. The same door code the front runs; nothing is renamed.
-     */
-    private deliverAtDoor;
     handle({ request, response }: HttpHandlerInput): Promise<void>;
 }
-export {};