fedipod-server 0.29.0 → 0.30.0

package/lib/core/store.mjs

@@ -1,578 +0,0 @@
-// store.mjs — PodStore: the agent's operational state as JSON documents in a
-// container. The container is a Storage (lib/storage.mjs) — a pod over HTTP or
-// a directory — and this file does not care which. The sync read/write surface
-// of dk's fs Store is preserved so every consumer (publisher, intake, facade,
-// …) is unchanged: reads come from an in-memory cache loaded once at boot,
-// writes update the cache and are flushed through a serialized, debounced,
-// retrying queue. Everything here is rebuildable from the /fediverse/ RDF, so
-// a lost write degrades, it doesn't destroy. Without a storage the store is
-// pure memory (tests, unconfigured boot).
-
-import crypto from 'node:crypto';
-import { sanitizeHtml } from './wire.mjs';
-
-// A display name is text, not markup: strip tags rather than allow a subset,
-// because there is no tag that belongs in one.
-const plainText = (s) => sanitizeHtml(String(s || '')).replace(/<[^>]*>/g, '').trim();
-
-// An avatar or header URL is written straight into an <img src> by the client.
-// http(s) only — `javascript:` and `data:` have no business being an avatar.
-const safeUrl = (u) => {
-  if (!u) return u;
-  try {
-    const parsed = new URL(String(u));
-    return (parsed.protocol === 'https:' || parsed.protocol === 'http:') ? String(u) : null;
-  } catch { return null; }
-};
-
-// Remote text arrives with no length of its own. `readCapped` bounds a document
-// at 5 MB, which is a sane ceiling for a fetch and an absurd one for a display
-// name — and whatever survives is then written into a document we serialize
-// WHOLE on every change. One planted actor with a megabyte of bio permanently
-// inflated actors.json, and a Follow flood re-PUT it once per commit batch.
-// Mastodon's own limits are the shape of the real world; a little over them is
-// generous rather than lossy.
-const MAX_NAME = 500;
-const MAX_SUMMARY = 5_000;
-const MAX_CONTENT = 100_000;
-const clamp = (s, n) => (typeof s === 'string' && s.length > n ? s.slice(0, n) : s);
-
-const PUT_DEBOUNCE_MS = 300;
-const PUT_RETRIES = 5;
-// This is a CACHE of other people's actor documents — every search, every
-// timeline post from a stranger, every hashtag sweep adds one, and nothing ever
-// took one out. Bounded by dropping the least recently fetched, except for
-// anyone we actually have a relationship with: losing a follower's display name
-// would be re-fetching it on the next render for nothing.
-const ACTOR_CACHE_MAX = 2000;
-const NOTIFICATIONS_MAX = 500;
-
-function prune(actors, max, contacts) {
-  const urls = Object.keys(actors);
-  if (urls.length <= max) return actors;
-  const keep = new Set([
-    ...contacts.followers.map(f => f.actor),
-    ...contacts.following.map(f => f.actor),
-  ]);
-  const droppable = urls.filter(u => !keep.has(u))
-    .sort((a, b) => String(actors[a].fetchedAt || '').localeCompare(String(actors[b].fetchedAt || '')));
-  for (const u of droppable.slice(0, urls.length - max)) delete actors[u];
-  return actors;
-}
-
-// Removing a follower is a DECISION — they unfollowed, or were ejected, or the
-// account is gone. Reconciling the local list against the pod's published one
-// would otherwise bring every one of them back, so each removal leaves a mark.
-// Bounded: the same actor leaving twice is still one entry.
-export function dropFollower(contacts, actor, why) {
-  contacts.followers = contacts.followers.filter(f => f.actor !== actor);
-  const gone = (contacts.removedFollowers || []).filter(r => r.actor !== actor);
-  gone.push({ actor, why, at: new Date().toISOString() });
-  contacts.removedFollowers = gone.slice(-500);
-  return contacts;
-}
-
-// What a state document looks like on the pod; write() and _put() agree on it.
-const serialise = (obj) => JSON.stringify(obj, null, 2) + '\n';
-// The same record apart from when it was fetched.
-const sameButWhen = (a, b) => JSON.stringify({ ...a, fetchedAt: null }) === JSON.stringify({ ...b, fetchedAt: null });
-
-export class PodStore {
-  constructor({ storage = null, log = console.log } = {}) {
-    this.lastSkipped = [];        // what the last load could not read, as `name (HTTP n)`
-    this.storage = storage;
-    this.log = log;
-    this.cache = new Map();        // name → parsed value
-    this.etags = new Map();        // name (or '') → last ETag, for revalidation
-    this.lastText = new Map();     // name → the bytes last loaded from or sent to the pod
-    this.timers = new Map();       // name → debounce timer
-    this.dirty = new Set();        // written while held; flushed by commit/release
-    this._held = 0;
-    this.chain = Promise.resolve();  // serialized writes
-    this.verdicts = new Map();     // name → did its last write land? (read by commit)
-  }
-
-  get base() { return this.storage?.base || null; }
-
-  attach(storage) {
-    // A different tree is different state: carrying the old cache and its
-    // ETags across would serve one container's documents as another's.
-    if (this.storage && this.storage.base !== storage.base) { this.cache.clear(); this.etags.clear(); this.lastText.clear(); }
-    this.storage = storage;
-  }
-
-  // Load every state doc in the container into the cache. Missing container
-  // (first run) is fine — the cache just starts empty.
-  //
-  // `force` skips the container short-circuit below. A container's ETag says
-  // its CHILDREN have not changed; it does not vouch for their contents, and a
-  // peer agent rewriting a document it already had changes no containment
-  // triple. That is a fine trade for a viewer refreshing a display, and a bad
-  // one at the moment a viewer is promoted and starts acting on what it holds.
-  // Throws when the container cannot be read. An empty cache MUST mean "no
-  // state yet", never "the pod was unreachable" — the caller treats the
-  // former as a fresh install, and silently conflating them would look like
-  // an un-set-up agent every time the pod hiccups.
-  async load({ force = false } = {}) {
-    if (!this.storage) return;
-    // Revalidate rather than re-download: a viewer reloads this every few
-    // minutes and it is almost always unchanged. (Only a pod answers 304; a
-    // directory has nothing to revalidate against, so it always relists —
-    // which is a readdir, not a request.)
-    const listing = await this.storage.list('', { etag: force ? null : this.etags.get('') });
-    if (listing.notModified) return;                   // cannot happen when forced: no etag was sent
-    // A 404'd container over HTTP is "could not read", not "no state yet":
-    // setup creates this container, so once a credential exists it should
-    // answer — and a proxy fronting a dead pod 404s in exactly the same shape.
-    // A directory has no proxy to lie for it, so its absence stays an answer.
-    if (listing.missing && this.storage.kind === 'pod') {
-      throw new Error(`state container missing (HTTP 404) at ${this.base} — pod unreachable or state gone`);
-    }
-    this.etags.set('', listing.etag);
-    const names = listing.names.filter(n => n.endsWith('.json'));
-    let fetched = 0;
-    const skipped = [];
-    for (const name of names) {
-      const etag = force ? null : this.etags.get(name);
-      const r = await this.storage.read(name, { etag: etag && this.cache.has(name) ? etag : null });
-      if (r.notModified) continue;                        // ours is current
-      if (!r.ok) {
-        // One unreadable document must not restart the whole sweep — skip it,
-        // keep whatever we already hold, and try again next load (no etag is
-        // recorded, so the retry is unconditional). config.json is the
-        // exception: without it the caller cannot tell "never set up" from
-        // "could not read", and would tell the user to run setup.
-        if (name === 'config.json' && !this.cache.has(name)) {
-          throw new Error(`state doc ${name} unreadable (HTTP ${r.status})`);
-        }
-        skipped.push(`${name} (HTTP ${r.status})`);
-        continue;
-      }
-      fetched++;
-      this.etags.set(name, r.etag);
-      try { this.cache.set(name, JSON.parse(r.body)); this.lastText.set(name, r.body); }
-      catch (e) { this.log(`state load ${name}: unparsable (${e.message})`); }
-    }
-    // Kept for /status: a document skipped here is a timeline or a contact
-    // list quietly missing, and the owner should be able to see that.
-    this.lastSkipped = skipped;
-    if (skipped.length) this.log(`state load skipped ${skipped.length}: ${skipped.join(', ')}`);
-    this.log(`state loaded: ${this.cache.size} doc(s) from ${this.base} (${fetched} re-fetched)`);
-  }
-
-  has(name) { return this.cache.has(name); }
-
-  // The documents held here. Callers that keep one document per thing — a
-  // connected account, say — list them with this rather than a fixed name.
-  names() { return [...this.cache.keys()]; }
-
-  read(name, fallback) {
-    return this.cache.has(name) ? structuredClone(this.cache.get(name)) : fallback;
-  }
-
-  write(name, obj) {
-    this.cache.set(name, structuredClone(obj));
-    if (!this.storage) return;
-    // The same bytes the pod already holds are not sent again. A like, a
-    // bookmark, a sweep that found nothing new each used to upload the whole
-    // timeline index and the whole people cache, unchanged — the largest
-    // write on the pod, on every small action. A write that had been armed
-    // and is now undone is unarmed with it.
-    if (this.lastText.get(name) === serialise(obj)) {
-      clearTimeout(this.timers.get(name)); this.timers.delete(name); this.dirty.delete(name);
-      return;
-    }
-    // Held: record it and leave the writing to the commit boundary the caller
-    // already has. See hold().
-    if (this._held) { this.dirty.add(name); return; }
-    this._arm(name);
-  }
-
-  _arm(name) {
-    clearTimeout(this.timers.get(name));
-    this.timers.set(name, setTimeout(() => { this.timers.delete(name); this._put(name); }, PUT_DEBOUNCE_MS));
-    this.timers.get(name).unref?.();
-  }
-
-  // Suspend the debounce for the length of a sweep.
-  //
-  // 300ms coalesces writes that arrive together, and the inbox drain's never
-  // do: every handler awaits a signed fetch to somebody else's server first, so
-  // each item's timer fires before the next item is even read. statuses.json,
-  // actors.json and notifications.json were therefore serialized and written
-  // WHOLE once per item — fifty times in a fifty-item sweep, where the drain
-  // already commits every ten.
-  //
-  // Nested, because a drain can run a handler that starts another. release()
-  // re-arms anything still dirty rather than dropping it, so a write made by
-  // something else while the drain held the store is never stranded.
-  hold() { this._held = (this._held || 0) + 1; }
-
-  release() {
-    if (this._held) this._held -= 1;
-    if (this._held) return;
-    for (const name of [...this.dirty]) { this.dirty.delete(name); this._arm(name); }
-  }
-
-  // Resolves true when the document is on the pod, false when it is not — a
-  // caller that is about to destroy the only other copy of something needs to
-  // be able to tell. `chain` stays the bare serializer; the boolean rides on
-  // the returned promise so one failure cannot poison the queue.
-  _put(name) {
-    const done = this.chain.then(async () => {
-      const body = serialise(this.cache.get(name));
-      for (let attempt = 1; attempt <= PUT_RETRIES; attempt++) {
-        // A storage that throws is a bug, not a hiccup — but it must not
-        // escape into the write queue, where it would look like success.
-        const r = await this.storage.write(name, body, 'application/json')
-          .catch(e => ({ ok: false, retry: false, why: e.message }));
-        if (r.ok) { this.lastText.set(name, body); return true; }
-        // The storage says whether trying again could possibly help: a pod's
-        // 4xx is an answer rather than a hiccup, and a directory's EACCES will
-        // still be an EACCES in two seconds.
-        if (!r.retry) { this.log(`state write ${name} refused (${r.why}) — not retrying`); return false; }
-        if (attempt === PUT_RETRIES) { this.log(`state write ${name} gave up: ${r.why}`); return false; }
-        const ladder = Math.min(attempt * 2000, 30_000);
-        await new Promise(res => setTimeout(res, r.retryAfterMs || Math.round(ladder * (0.8 + Math.random() * 0.4))));
-      }
-      return false;
-    });
-    // Record the outcome. A write whose debounce fires on its own is not in
-    // any caller's hands: `chain` waits for it but throws its result away, so
-    // commit() reported a clean sweep for a document that had been refused —
-    // and commit()'s one caller is the inbox drain, about to delete the pod's
-    // only copy of what that document describes.
-    const tracked = done.then((ok) => { this.verdicts.set(name, ok); return ok; });
-    this.chain = tracked.then(() => {}, () => {});
-    return tracked;
-  }
-
-  // Remove a state doc from the cache AND the pod (used when key material
-  // migrates to the local machine — leaving the copy behind would defeat it).
-  async remove(name) {
-    this.cache.delete(name);
-    this.lastText.delete(name);
-    clearTimeout(this.timers.get(name));
-    this.timers.delete(name);
-    if (!this.storage) return true;
-    return this.storage.remove(name);
-  }
-
-  // Force every pending write out NOW and say whether they all landed.
-  // The caller that needs this is the inbox drain: taking an item out of the
-  // pod's inbox is a destructive read, so it must not happen until the result
-  // of handling it is written down. With no storage the store is pure memory
-  // and there is nothing to land, so that counts as written.
-  async commit() {
-    const pending = [];
-    // Held names too, or a sweep that suspended the debounce would delete the
-    // pod's copy of an item whose result had not been written down — the one
-    // thing commit() exists to prevent.
-    for (const name of new Set([...this.timers.keys(), ...this.dirty])) {
-      const t = this.timers.get(name);
-      if (t) { clearTimeout(t); this.timers.delete(name); }
-      this.dirty.delete(name);
-      pending.push(this._put(name));
-    }
-    await this.chain;                      // includes anything already in flight
-    await Promise.all(pending);
-    // Every verdict since the last commit, forced and self-fired alike. Cleared
-    // once read: a refusal is reported to the caller that can act on it, and
-    // does not then condemn every later commit.
-    const landed = [...this.verdicts.values()].every(Boolean);
-    this.verdicts.clear();
-    return landed;
-  }
-
-  // Flush pending debounced writes (shutdown path). Same work, result ignored.
-  async flush() { await this.commit(); }
-
-  // ---- the domain helpers, unchanged from dk's Store ----
-
-  // config: { remotePod, handle, name, issuer }  (credential lives ONLY in
-  // the local credential file, never in pod state)
-  getConfig() { return this.read('config.json', null); }
-  setConfig(cfg) { this.write('config.json', cfg); }
-
-  // queue: [{ inbox, activity, attempts, nextAt }]
-  getQueue() { return this.read('queue.json', []); }
-  setQueue(q) { this.write('queue.json', q); }
-
-  // blocklist: { domains: ["spam.example", ...], actors: ["https://host/actor", ...] }
-  // Two granularities because a whole instance is usually the wrong unit: one
-  // bad neighbour should not cost you everyone else on their server.
-  getBlocklist() {
-    const b = this.read('blocklist.json', {});
-    return { domains: b.domains || [], actors: b.actors || [] };
-  }
-  // Blocking someone ends their following as well: a blocked actor, or anyone
-  // on a blocked domain, is no longer delivered to. The mark dropFollower leaves
-  // keeps a reconcile from bringing them back.
-  setBlocklist(b) {
-    this.write('blocklist.json', b);
-    const c = this.getContacts();
-    const gone = c.followers.filter(f => f.actor && this.isBlocked(f.actor)).map(f => f.actor);
-    if (!gone.length) return;
-    for (const actor of gone) dropFollower(c, actor, 'blocked');
-    this.setContacts(c);
-  }
-  // Takes an actor URL or an object URL: the actor list only ever matches the
-  // former, the domain list matches either.
-  isBlocked(url) {
-    let host;
-    try { host = new URL(url).hostname; } catch { return true; }   // unparsable → treat as hostile
-    const { domains, actors } = this.getBlocklist();
-    if (actors.includes(url)) return true;
-    return domains.some(d => host === d || host.endsWith('.' + d));
-  }
-
-  // contacts: { followers: [{actor, inbox, sharedInbox}], following: [{actor, inbox, accepted}] }
-  getContacts() { return this.read('contacts.json', { followers: [], following: [] }); }
-  setContacts(c) { this.write('contacts.json', c); }
-
-  // muted: { actors: [...] } — members whose posts a group declines to carry.
-  // A group cannot force an unfollow, so declining to amplify is the only
-  // lever it actually holds.
-  getMuted() { return this.read('muted.json', { actors: [] }); }
-  setMuted(m) { this.write('muted.json', m); }
-
-  // The client's own reading arrangements — lists, keyword filters, posts
-  // waiting to be published. None of it federates.
-  getLists() { return this.read('lists.json', []); }
-  setLists(l) { this.write('lists.json', l); }
-  getFilters() { return this.read('filters.json', []); }
-  setFilters(f) { this.write('filters.json', f); }
-  getScheduled() { return this.read('scheduled.json', []); }
-  setScheduled(s) { this.write('scheduled.json', s); }
-
-  // pending: [{ noteId, actor, at }] — posts a reviewed group has ingested but
-  // not carried, awaiting the operator.
-  getPending() { return this.read('pending.json', []); }
-  setPending(p) { this.write('pending.json', p); }
-
-  // requests: [{ actor, inbox, sharedInbox, activity, at }] — Follows a group
-  // with approveJoins has neither accepted nor rejected. The whole Follow is
-  // kept because the Accept or Reject has to name it.
-  getRequests() { return this.read('requests.json', []); }
-  setRequests(r) { this.write('requests.json', r); }
-
-  // dead letters: inbox items that failed verification or exhausted retries —
-  // kept for inspection (GET /deadletter) instead of being destroyed.
-  getDeadLetters() { return this.read('deadletter.json', []); }
-  addDeadLetter(entry) {
-    const dl = this.getDeadLetters();
-    dl.unshift({ at: new Date().toISOString(), ...entry });
-    this.write('deadletter.json', dl.slice(0, 200));
-  }
-
-  // statuses index: operational mirror of what lives in the pod as RDF, in
-  // arrival order — the Mastodon-API facade serves timelines from this.
-  // [{ noteId, actor, content, published, inReplyTo, kind: 'timeline'|'post'|'tag' }]
-  getStatuses() { return this.read('statuses.json', []); }
-  // A count must not pay for a clone: nodeinfo and the instance document are
-  // public and answer strangers, so they read the cache directly.
-  countStatuses(kind = null) {
-    const all = this.cache.get('statuses.json') || [];
-    return kind === null ? all.length : all.reduce((n, s) => n + (s.kind === kind ? 1 : 0), 0);
-  }
-  addStatus(s) {
-    const all = this.getStatuses();
-    const at = all.findIndex(x => x.noteId === s.noteId);
-    if (at >= 0) return this._mergeStatus(all, at, s);
-    // Same reason as cacheActor: statuses.json is serialized whole on every
-    // change, and remote content is only bounded by the 5 MB fetch ceiling.
-    if (typeof s.content === 'string' && s.content.length > MAX_CONTENT) {
-      s = { ...s, content: clamp(s.content, MAX_CONTENT), truncated: true };
-    }
-    all.unshift(s);
-    this.write('statuses.json', all.slice(0, 1000));
-    this.onEvent?.('status', s);            // streaming subscribers
-    return { added: true, merged: false, status: s };
-  }
-
-  // The same post arrives twice when two of the owner's accounts follow its
-  // author, and the second arrival is the only record that the other one saw
-  // it. Merged in place — the per-kind prune tails take the tail to be the
-  // oldest — and with no stream event, which would show the post twice.
-  _mergeStatus(all, at, s) {
-    const row = all[at];
-    const known = new Set((row.sourceAccts || []).map(v => v.acct));
-    const fresh = (s.sourceAccts || []).filter(v => v && !known.has(v.acct));
-    // Only our own verified intake may raise a row's kind. A general ladder
-    // would let a source that merely SAW a post promote a stranger's mention
-    // into the home timeline, which is the route tagfeed had to close.
-    const first = (k) => k === 'post' || k === 'timeline';
-    const raise = first(s.kind) && !first(row.kind);
-    if (!fresh.length && !raise) return { added: false, merged: false, status: row };
-    all[at] = {
-      ...row,
-      ...(fresh.length ? { sourceAccts: [...(row.sourceAccts || []), ...fresh] } : {}),
-      ...(raise ? { kind: s.kind, ...(s.slug ? { slug: s.slug } : {}) } : {}),
-    };
-    this.write('statuses.json', all);
-    return { added: false, merged: true, status: all[at] };
-  }
-  updateStatus(noteId, patch) {
-    const all = this.getStatuses();
-    const i = all.findIndex(x => x.noteId === noteId);
-    if (i < 0) return null;
-    all[i] = { ...all[i], ...patch };
-    this.write('statuses.json', all);
-    return all[i];
-  }
-  removeStatus(noteId) {
-    this.write('statuses.json', this.getStatuses().filter(x => x.noteId !== noteId));
-  }
-
-  // notifications: what other actors did to us — the facade serves
-  // /api/v1/notifications from this. [{ id, type, actor, noteId?, at }]
-  // The id is a content hash, so a re-delivered activity dedupes.
-  getNotifications() { return this.read('notifications.json', []); }
-
-  // `unverified` marks one whose actor nothing vouched for — a Like or Announce
-  // arrives with no signature and, unlike a Create, has no object at the
-  // sender's origin to re-read, so the actor is whatever the body claimed.
-  //
-  // It decides what the cap evicts. The id is a content hash, so changing one
-  // character of the actor gives a fresh entry: ~500 appends into the pod's
-  // public-append inbox used to push out every real favourite, boost, mention
-  // and follow request, and notifications are the one thing nothing can rebuild
-  // — not from the pod, not from the RDF. Unverified entries are dropped first
-  // now, so a flood can only ever evict itself, and a stranger's genuine
-  // favourite still shows up, which is what recording them at all is for.
-  // What an Undo unsays: the favourite or boost it names, matched by a
-  // predicate on what was recorded. Returns how many went.
-  removeNotifications(pred) {
-    const all = this.getNotifications();
-    const kept = all.filter(n => !pred(n));
-    if (kept.length !== all.length) this.write('notifications.json', kept);
-    return all.length - kept.length;
-  }
-
-  addNotification(n) {
-    const all = this.getNotifications();
-    const id = crypto.createHash('sha256').update(JSON.stringify(n)).digest('hex').slice(0, 16);
-    if (all.some(x => x.id === id)) return;
-    const entry = { id, at: new Date().toISOString(), ...n };
-    all.unshift(entry);
-    let kept = all;
-    if (kept.length > NOTIFICATIONS_MAX) {
-      const solid = kept.filter(x => !x.unverified);
-      const loose = kept.filter(x => x.unverified);
-      kept = solid.length >= NOTIFICATIONS_MAX
-        ? solid.slice(0, NOTIFICATIONS_MAX)
-        : [...solid, ...loose.slice(0, NOTIFICATIONS_MAX - solid.length)]
-          .sort((a, b) => String(b.at).localeCompare(String(a.at)));
-    }
-    this.write('notifications.json', kept);
-    this.onEvent?.('notification', entry);  // streaming subscribers
-  }
-
-  // uploaded media registry: opaque id → { url, mediaType, description }
-  getMedia() { return this.read('media.json', {}); }
-  setMedia(id, entry) {
-    const m = this.getMedia();
-    m[id] = entry;
-    this.write('media.json', m);
-  }
-
-  // actor-doc cache for account rendering (display name, avatar).
-  //
-  // Everything here comes from a document at someone else's origin, and the
-  // facade serves `summary` back to the client as a status account's `note`,
-  // which every Mastodon client renders as HTML. Note CONTENT was sanitized at
-  // all four of its entry points and this, the other thing a remote party
-  // writes, was not — so looking anyone up handed their markup to the client.
-  // Sanitized at the boundary where it enters our store, so nothing downstream
-  // has to remember. Names are plain text and are stripped outright.
-  getActors() { return this.read('actors.json', {}); }
-  cacheActor(url, doc) {
-    const a = this.getActors();
-    const known = a[url];
-    a[url] = {
-      name: clamp(plainText(doc.name || doc.preferredUsername || ''), MAX_NAME),
-      preferredUsername: clamp(plainText(doc.preferredUsername || ''), MAX_NAME),
-      icon: safeUrl(typeof doc.icon === 'object' ? doc.icon?.url : doc.icon),
-      image: safeUrl(typeof doc.image === 'object' ? doc.image?.url : doc.image),
-      summary: clamp(sanitizeHtml(doc.summary || ''), MAX_SUMMARY),
-      // A Group is an actor too, and a client that cannot tell shows it as a
-      // person. The counts are NOT in this document — they are the collections'
-      // totalItems, filled in only when someone asks about this actor by name.
-      type: doc.type || 'Person',
-      followers: doc.followers || null,
-      following: doc.following || null,
-      ...(known?.counts ? { counts: known.counts } : {}),
-      fetchedAt: new Date().toISOString(),
-    };
-    // Fetched again and found the same: nothing to write. Only the time of
-    // asking differs, and that is not worth the whole cache going to the pod.
-    if (known && sameButWhen(known, a[url])) { a[url] = known; return; }
-    this.write('actors.json', prune(a, ACTOR_CACHE_MAX, this.getContacts()));
-  }
-
-  // @user@host for an actor we have cached. Null when we have not, rather than
-  // a last-segment guess off the URL: that guess is what rendered a group as
-  // @actor@host, because our own actors all end in /actor.
-  handleOf(actorUrl) {
-    const user = this.getActors()[actorUrl]?.preferredUsername;
-    if (!user) return null;
-    try { return `@${user}@${new URL(actorUrl).host}`; } catch { return null; }
-  }
-
-  // Mastodon-API opaque ids ↔ URLs (snac-style: hashes are fine for clients).
-  getIds() { return this.read('ids.json', {}); }
-  // The id is a hash OF the url, so the mapping is computable — the scan was
-  // only ever finding what the hash already tells us. It ran on the status
-  // render path, once per rendered status, over a map that never shrinks.
-  //
-  // The map is still kept, because urlFor has to answer for ids a client is
-  // still holding, and it is still consulted first so an entry written under
-  // some older scheme keeps resolving.
-  idFor(url) {
-    const id = crypto.createHash('sha256').update(url).digest('hex').slice(0, 16);
-    const ids = this.getIds();
-    if (ids[id] === url) return id;                    // already known, nothing to write
-    const legacy = Object.entries(ids).find(([, u]) => u === url);
-    if (legacy) return legacy[0];                      // pre-hash entry a client may hold
-    // In memory only. This runs on the RENDER path — once per status, per
-    // account, per attachment, every time a timeline is drawn — and `write()`
-    // is write-through, so on the browser build scrolling a timeline was a pod
-    // PUT of this whole document. Nothing durable is lost: the id IS the hash
-    // of the url, so idFor recomputes it identically on any later run, and the
-    // map exists only so urlFor can still answer for ids minted under an older
-    // scheme (which are loaded from the pod and never written here).
-    ids[id] = url;
-    this.cache.set('ids.json', ids);
-    return id;
-  }
-  // The map first, for ids minted under an older scheme. Then, because the
-  // id IS the hash of the url, whatever this store knows is scanned for the
-  // url that hashes to it — actors, posts, contacts, requests, media. The
-  // browser build's worker is stopped whenever it idles, and the in-memory
-  // map went with it: a client clicking an account it had just been shown
-  // reached a fresh worker that held the actor and could not name it.
-  urlFor(id) {
-    const ids = this.getIds();
-    if (ids[id]) return ids[id];
-    if (!/^[a-f0-9]{16}$/u.test(String(id))) return null;
-    const hash = (u) => crypto.createHash('sha256').update(u).digest('hex').slice(0, 16);
-    const seen = new Set();
-    const candidates = function* (store) {
-      for (const u of Object.keys(store.getActors())) yield u;
-      for (const st of store.getStatuses()) {
-        yield st.noteId; yield st.actor;
-        for (const a of st.attachments || []) if (a?.url) yield a.url;
-      }
-      const c = store.getContacts();
-      for (const f of [...c.followers, ...c.following]) if (f?.actor) yield f.actor;
-      for (const r of store.getRequests()) if (r?.actor) yield r.actor;
-      for (const u of Object.keys(store.getMedia())) yield u;
-    };
-    for (const u of candidates(this)) {
-      if (typeof u !== 'string' || seen.has(u)) continue;
-      seen.add(u);
-      if (hash(u) === id) { ids[id] = u; this.cache.set('ids.json', ids); return u; }
-    }
-    return null;
-  }
-}

package/lib/core/wire-quotes.mjs

@@ -1,71 +0,0 @@
-// wire-quotes.mjs — the documents and activities a quote is made of on the
-// wire (FEP-044f): the request to the quoted author, the authorization they
-// publish, and the Accept or Reject that answers. The quote terms a note
-// itself carries live in wire.mjs with the note.
-
-import crypto from 'node:crypto';
-import { AS_CTX, QUOTE_CTX, POLICY_CTX } from './wire.mjs';
-
-// The activity and object types, and the two terms an authorization names
-// its parties by — GoToSocial's, declared as Mastodon declares them.
-export const QUOTE_TYPES_CTX = {
-  QuoteRequest: 'https://w3id.org/fep/044f#QuoteRequest',
-  QuoteAuthorization: 'https://w3id.org/fep/044f#QuoteAuthorization',
-  gts: 'https://gotosocial.org/ns#',
-  interactingObject: { '@id': 'gts:interactingObject', '@type': '@id' },
-  interactionTarget: { '@id': 'gts:interactionTarget', '@type': '@id' },
-};
-
-// FEP-044f: asking the quoted post's author to allow the quote. The whole
-// quoting note rides along as the instrument, so their server can see what
-// is being asked without fetching it; `object` is their post.
-export function quoteRequestActivity({ urls, note, quoted, quotedActor, serial }) {
-  const { '@context': ctx, ...instrument } = note;   // eslint-disable-line no-unused-vars
-  return {
-    '@context': [AS_CTX, { ...QUOTE_CTX, ...POLICY_CTX, QuoteRequest: QUOTE_TYPES_CTX.QuoteRequest }],
-    id: urls.actor + '#quote-request-' + serial,
-    type: 'QuoteRequest',
-    actor: urls.actor,
-    to: [quotedActor],
-    object: quoted,
-    instrument,
-  };
-}
-
-// The authorization a quoted author publishes (FEP-044f): a document of its
-// own, at the quoted post's origin, naming the quoting post and the quoted
-// one. A receiver checks the quote by fetching this and comparing both.
-export function quoteAuthorizationId(noteId, instrumentId) {
-  return noteId + '-quote-' + crypto.createHash('sha256').update(String(instrumentId)).digest('hex').slice(0, 16);
-}
-
-export function quoteAuthorizationDoc({ urls, id, instrument, target }) {
-  return {
-    '@context': [AS_CTX, QUOTE_TYPES_CTX],
-    id,
-    type: 'QuoteAuthorization',
-    attributedTo: urls.actor,
-    interactingObject: instrument,
-    interactionTarget: target,
-  };
-}
-
-// The answer to a QuoteRequest: Accept, carrying the authorization as its
-// result, or Reject. The request is echoed by its id, type, actor, object
-// and the instrument's id — enough for the asker to match it, and nothing a
-// stranger wrote is repeated whole.
-export function quoteAnswerActivity({ urls, type, request, result = null, to, serial }) {
-  const idOf = (v) => (typeof v === 'string' ? v : v?.id);
-  return {
-    '@context': [AS_CTX, { QuoteRequest: QUOTE_TYPES_CTX.QuoteRequest }],
-    id: urls.actor + '#' + type.toLowerCase() + '-' + serial,
-    type,
-    actor: urls.actor,
-    to: [to],
-    object: {
-      id: idOf(request), type: 'QuoteRequest', actor: idOf(request?.actor),
-      object: idOf(request?.object), instrument: idOf(request?.instrument),
-    },
-    ...(result ? { result } : {}),
-  };
-}