fedipod-server 0.29.0 → 0.31.0

package/lib/gateway/front-core.mjs

@@ -1,966 +0,0 @@
-// front-core.mjs — the multi-user front: one always-on box, run by a host, that
-// fronts many independent FediPod users under a shared domain (@name@fedipod.net).
-// It answers name lookups, serves each user's public face, and is the verifying
-// inbox for all of them — routing every verified delivery into that user's own
-// pod inbox. It is KEYLESS and holds no user data: only a directory (handle →
-// where that user's pod is + their public key) and the per-user secrets needed
-// to append verified mail to their inbox.
-//
-// The identity trick is rewrite-on-read (jg10's pattern): a user's public IRI
-// space at `<front>/u/<handle>/` is a 1:1 path map of their pod's own tree, so
-// the actor id and every id under it live on the shared domain while the bytes
-// still come from the user's pod. The inbox maps the same way, so delivery to
-// the fronted inbox is delivery this box verifies, then forwards to the pod.
-//
-// Runtime-agnostic: `netlify/functions/front.mjs` is one adapter; any always-on
-// HTTPS box is another. UN-DEPLOYED — nothing in FediPod runs it.
-
-import crypto from 'node:crypto';
-import { handleDelivery, handleOwnerPost } from './gateway-core.mjs';
-import { readCapped, safeFetch, isLoopbackHost } from '../shared/safefetch.mjs';
-import * as podRoot from '../pod/root.mjs';
-import * as podPolicy from '../pod/policy.mjs';
-import { podBaseOfWebId } from '../pod/urls.mjs';
-import { routeQuietApi, noteOpened, noteReceived, closedState, accountState, closedAnswer } from './quiet.mjs';
-import { routeNoticesApi } from './notices.mjs';
-import { withSecurityHeaders } from './headers.mjs';
-import { podTokenVerifier } from './caches.mjs';
-import { claimedWebId } from './token-claims.mjs';
-import { withdrawn, overLimit, relayOne } from './relay-extras.mjs';
-
-// The one WebFinger document, spelled out here rather than imported from
-// wire.mjs: wire drags the agent's whole HTML pipeline (sanitize-html and
-// friends), which a serverless front must never carry — it crashed the
-// deployed function before it answered its first request.
-const jrd = ({ handle, host, actor, aliases = [], page = null, subscribe = null }) => ({
-  subject: `acct:${handle}@${host}`,
-  ...(aliases.length ? { aliases } : {}),
-  links: [
-    { rel: 'self', type: 'application/activity+json', href: actor },
-    ...(page ? [{ rel: 'http://webfinger.net/rel/profile-page', type: 'text/html', href: page }] : []),
-    // Remote follow. Somebody reading this account on another server presses
-    // Follow, says they are here, and that server looks for this link to find
-    // out where to send them. `{uri}` is a literal the other server fills in
-    // with whatever they are following — it must not be escaped.
-    ...(subscribe ? [{ rel: 'http://ostatus.org/schema/1.0/subscribe', template: subscribe }] : []),
-  ],
-});
-// The door that link names, which the site staged beside this function serves.
-const subscribeTemplate = (origin) => (origin
-  ? `${String(origin).replace(/\/$/u, '')}/authorize_interaction?uri={uri}` : null);
-// The public profile page of any account the front answers for lives on
-// its pod, whether the address is the front's or the pod's own.
-const profilePageOf = (rec) => (rec?.podHome ? rec.podHome + 'ap/profile.html' : null);
-
-const AP_CT = 'application/activity+json';
-
-// Verify a Solid-OIDC token (DPoP-bound) and return its WebID, or null. The
-// verifier is injected so tests stub it; in production it is the same library
-// the agent's own C2S auth uses.
-async function verifyPodToken(request, pathname, verifier) {
-  const authz = request.headers.get('authorization');
-  if (!authz) return null;
-  try {
-    const dpop = request.headers.get('dpop');
-    // Solid-OIDC binds the token to a key the client proves on every request;
-    // a token shown without the proof is one anyone who saw it could show.
-    if (!dpop) { console.log(`front: pod token without a DPoP proof refused on ${pathname}`); return null; }
-    const v = verifier || await podTokenVerifier();
-    const url = request.url;
-    const { webid } = await v(authz, { header: dpop, method: request.method, url });
-    return webid || null;
-  } catch (e) {
-    // Said aloud: a token the front will not take is otherwise a bare 401 to
-    // the caller and nothing at all here.
-    console.log(`front: pod token refused on ${pathname}: ${e?.message || e}`);
-    return null;
-  }
-}
-
-// Is this WebID served by the claimed pod? A pod owner's WebID lives on the pod
-// origin — that is the whole proof: a token for a WebID under podHome could
-// only be minted by someone who controls that pod's identity provider.
-// A pod that will not answer must not hold up the person opting in; without
-// an answer the older check stands on its own.
-const OWNER_LOOKUP_MS = 5_000;
-
-/**
- * Who the pod server says owns the pod. The server that hosts it is the
- * authority on that, so when it answers, its answer decides. A server that
- * says nothing leaves where the WebID lives as the only evidence there is.
- */
-const podOwners = (podBase, fetchImpl = fetch) =>
-  podRoot.readOwnerLinks(fetchImpl, podBase, { timeoutMs: OWNER_LOOKUP_MS });
-
-// Whether a token's WebID vouches for this pod, on the evidence of where it
-// lives: the same origin, and — for a suffixed pod — inside
-// the WebID's own pod, wherever in it the account was put. Weak on purpose,
-// and never used alone for an attach — see provesPod.
-function webidUnderPod(webid, podHome) {
-  try {
-    return new URL(webid).origin === new URL(podHome).origin && String(podHome).startsWith(podBaseOfWebId(webid));
-  } catch { return false; }
-}
-
-/**
- * Whether this WebID may speak for this pod.
- *
- * Sharing an origin was the whole test, which is right where an origin is one
- * person (a subdomain pod) and wrong where it is not. On a path-based server
- * every account is on the same origin, so any account holder could attach
- * somebody else's pod under a name of their choosing — and, worse, re-attach a
- * name that already existed and be handed its receipt secret (S7).
- *
- * The pod server is the authority on who owns the pod, and it will say so in a
- * `solid:owner` link if asked. When it answers, its answer decides. Only when
- * it says nothing does this fall back to where the WebID lives, which is the
- * best a silent server leaves available. This is the rule /api/agent's opt-in
- * has used all along; attach simply never asked.
- */
-async function provesPod(webid, podHome, fetchImpl) {
-  const owners = await podOwners(podHome, fetchImpl || fetch);
-  if (owners.length) return owners.includes(webid);
-  return webidUnderPod(webid, podHome);
-}
-
-// A pod this front will read from at all.
-//
-// The front reads `rec.podHome + <the rest of the request path>` and, on the
-// CSS server component, that read goes straight into the resource store with
-// no access control of its own — so a row whose podHome names the FRONT is a
-// row that can read the server's own internals, `/.internal/fedipod/directory/`
-// included, where every user's receipt secret is kept (S2). The front is not a
-// pod and never was one; saying so outright is the fix, and it closes the
-// self-recursion of S8 with the same line.
-function podHomeProblem(podHome, frontOrigin) {
-  let u;
-  try { u = new URL(podHome); } catch { return 'podHome is not a URL'; }
-  if (frontOrigin) {
-    try {
-      if (u.origin === new URL(frontOrigin).origin) {
-        return 'a pod cannot live on this gateway — name the pod that holds your data';
-      }
-    } catch { /* no usable frontOrigin: the other checks still apply */ }
-  }
-  // Nothing may reach a server's private trees, whatever origin they are on.
-  if (/(^|\/)\.internal(\/|$)/u.test(u.pathname) || /(^|\/)\.\.(\/|$)/u.test(u.pathname)) {
-    return 'that is not a pod address';
-  }
-  return null;
-}
-
-const RELAY_MAX_REQUESTS = 20;
-const SERVER_PROBE_MS = 6000;
-const SERVER_PROBE_BYTES = 64 * 1024;
-
-// The owner's APIs a browser at ANOTHER origin may call: an address moving
-// to a new gateway is driven from the new gateway's page, and it has to tell
-// this one it moved and send the Move through this one's relay. Both take a
-// pod token as proof, the way the outbox door does, so any origin may ask.
-const API_CORS = {
-  'access-control-allow-origin': '*',
-  'access-control-allow-methods': 'POST, OPTIONS',
-  'access-control-allow-headers': 'Authorization, DPoP, Content-Type',
-  'access-control-max-age': '86400',
-};
-const withApiCors = (out) => ({ ...out, headers: { ...(out.headers || {}), ...API_CORS } });
-const apiPreflight = () => ({ status: 204, headers: { ...API_CORS, allow: 'POST, OPTIONS' }, body: null });
-
-const j = (status, obj, ct = 'application/json') =>
-  ({ status, headers: { 'content-type': ct, 'cache-control': 'no-store' }, body: JSON.stringify(obj) });
-// Held at the edge like any other missing document: a bot's scan, a dead
-// handle, a typo in a WebFinger query each cost one call, not one per asker.
-const notFound = () => ({ status: 404, headers: { 'content-type': 'text/plain', ...publicFor(MISSING_EDGE_SECONDS) }, body: 'not found\n' });
-
-// A user's public base on the front, a 1:1 mirror of their pod home.
-// The directory key is the FULL fediverse address — handle@host — never the
-// bare handle, which is not unique: two different pods can each have a "me".
-// A fronted identity answers at this front's host; a mail-door identity at its
-// own pod's host. The `/u/` path segment carries that same key.
-export const addressKey = (handle, host) => `${handle}@${host}`;
-export const userBase = (frontOrigin, key) => `${frontOrigin}/u/${encodeURIComponent(key)}/`;
-
-// Rewrite every occurrence of the pod home to the front base (or back). The
-// bodies are JSON, so a whole-string swap rewrites ids wherever they appear —
-// actor id, collection ids, note ids — keeping the whole space self-consistent.
-const swap = (text, from, to) => text.split(from).join(to);
-
-// Which handle a /u/<handle>/... path names, and the pod path under it.
-function parseUserPath(pathname) {
-  const m = /^\/u\/([^/]+)\/(.*)$/.exec(pathname);
-  return m ? { handle: decodeURIComponent(m[1]), rest: m[2] } : null;
-}
-
-// A public document is the same for everybody who asks, so the edge may hold
-// it and answer the next reader itself. Without this every read of an actor,
-// a topic, a post or a card was a function call: one visit to a forum is
-// twenty of them, and every visitor and every refresh paid again.
-//
-// `netlify-cdn-cache-control` is the edge's own instruction; `cache-control`
-// is what the reader's browser is told. The edge may serve a stale copy while
-// it fetches a fresh one, so nobody waits on the pod for a document that is
-// merely minutes old. The edge holds a document far longer than a browser
-// is asked to: the edge is what turns a thousand readers into one function
-// call, while a browser that held an actor for ten minutes would show one
-// person a stale profile they had just edited.
-const BROWSER_MAX_AGE = 60;
-const publicFor = (seconds, stale = seconds * 4) => ({
-  'cache-control': `public, max-age=${Math.min(seconds, BROWSER_MAX_AGE)}`,
-  // `durable`: one copy for every region, and one that a deploy does not
-  // empty. Without it each region held its own and every deploy started cold.
-  'netlify-cdn-cache-control': `public, durable, s-maxage=${seconds}, stale-while-revalidate=${stale}`,
-});
-// How long the edge holds a public document, and a handle's WebFinger
-// answer. Every server that has heard of an account asks for its actor and
-// its handle again and again; a post or a collection changes when its owner
-// acts, and ten minutes of edge is what the plan's budget of function calls
-// can afford.
-const PUBLIC_EDGE_SECONDS = 600;
-const WEBFINGER_EDGE_SECONDS = 3600;
-// A closed or moved address stays gone; a picture's address stays where it is.
-const GONE_EDGE_SECONDS = 3600;
-const MEDIA_EDGE_SECONDS = 86400;
-// A public document the pod would not give (missing, or not public) is asked
-// for again and again by every server that shows the account — a pinned-posts
-// collection an old account never wrote, a forum count nobody published. Held
-// briefly, so the edge absorbs the asking; briefly, so a document published a
-// moment later is not "missing" for long.
-const MISSING_EDGE_SECONDS = 120;
-
-// Where a pod owner opts their identity in. An operator may name it, because
-// the path it takes is one their pod server can no longer serve; the dot says
-// it belongs to the server rather than to anybody's data, the way
-// `.well-known` and `.account` do.
-export const DEFAULT_RUN_PATH = '/.fediverse-account';
-export const runPath = (ctx) => {
-  const said = String(ctx?.runPath || '').trim().replace(/\/+$/u, '');
-  if (!said) return DEFAULT_RUN_PATH;
-  return said.startsWith('/') ? said : `/${said}`;
-};
-
-// A request the browser itself says came from this very origin. `Sec-Fetch-Site`
-// is the browser's word and a page cannot forge it; an `Origin` that matches is
-// the older way of saying the same. This is what makes it safe to read a
-// session cookie as proof: a page on another site gets neither.
-const sameOriginRequest = (request, origin) => {
-  const site = request.headers.get('sec-fetch-site');
-  if (site) return site === 'same-origin';
-  const said = request.headers.get('origin');
-  if (!said || !origin) return false;
-  try { return new URL(said).origin === new URL(origin).origin; } catch { return false; }
-};
-
-// Top-level paths a handle may not take, so a name never shadows a route.
-const RESERVED = new Set(['u', 'api', 'signup', 'new-account', 'run', 'admin', 'roster', 'gateway',
-  'gw', 'well-known', 'inbox', 'outbox', 'actor', 'install', 'notices']);
-
-// Why a handle is unusable, or null when it is fine. Lowercase letters, digits
-// and hyphens; 2–30 chars; not edge-hyphenated; not a reserved route.
-function handleProblem(h) {
-  if (!h) return 'empty';
-  if (!/^[a-z0-9-]{2,30}$/.test(h)) return 'letters, digits and hyphens only, 2–30 characters';
-  if (h.startsWith('-') || h.endsWith('-')) return 'cannot start or end with a hyphen';
-  if (RESERVED.has(h)) return 'that name is reserved';
-  return null;
-}
-
-// The person's own filtering policy, published on their pod and readable by
-// anyone: their accepted following list and a mirror of their blocklist. A
-// directory row carries neither — the row is written at attach time, before
-// the agent has published anything — so without this the door would judge by
-// addressing alone and forward the junk a blocklist exists to stop.
-//
-// Cached briefly: a delivery flood must not become a read per delivery on the
-// person's pod, which is the load this whole door exists to spare them.
-const POLICY_TTL_MS = 5 * 60_000;
-const policyCache = new Map();              // podHome -> { at, policy }
-
-// The cache is OURS, not the library's: on a warm serverless container one Map
-// is shared across every user this front serves, so what it is keyed by is a
-// correctness property. Keyed by podHome, it is one person's policy under one
-// person's key.
-const policyFor = (rec, fetchImpl = fetch) =>
-  podPolicy.read(fetchImpl, rec.podHome, { cache: policyCache, ttlMs: POLICY_TTL_MS });
-
-// The verified-delivery identity for a directory record: what gateway-core
-// needs to check what concerns the user and to append to their pod inbox.
-// `policy` is the person's published filtering policy when there is one.
-function identFor(rec, policy = null) {
-  return {
-    // A row may name the inbox its deliveries are written to: a forum's
-    // categories share one, on the forum's pod, above their own trees.
-    inboxUrl: rec.inboxUrl || rec.podHome + 'ap/inbox/',
-    actorUrl: rec.actorUrl,                 // the FRONT actor id (what mail is addressed to)
-    followersUrl: rec.actorUrl.replace(/actor$/, 'followers'),
-    notesPrefix: rec.actorUrl.replace(/ap\/actor$/, 'ap/notes/'),
-    following: policy?.following || rec.following || [],
-    blocklist: policy?.blocklist || rec.blocklist || { domains: [], actors: [] },
-    kind: policy?.kind || rec.kind || 'person',
-    gatewayWebId: rec.gatewayWebId,
-    hmacSecret: rec.hmacSecret,
-  };
-}
-
-// The single entry point. `ctx`:
-//   host        the front's own host, e.g. "fedipod.net" (for WebFinger subjects)
-//   frontOrigin "https://fedipod.net"
-//   lookup(handle) -> record | null       the directory
-//   listDirectory() -> { handle: record }  every row, for the admin roster
-//   removeDirectory(handle) -> boolean     drop a row; false when a seeded row remains
-//   podPut(url, body, ct) -> boolean      append to a user's pod (per-user cred inside)
-//   readReceived / writeReceived / dropReceived, pauseItems, closeDays — see quiet.mjs
-//   podGet(url, { podHome }) -> Response   read a user's pod (public reads; plain fetch
-//                                          is fine). `podHome` is the row's own pod, for
-//                                          an adapter that reads a store directly and so
-//                                          must confine the read itself.
-export async function routeFront(request, ctx) {
-  const out = await route(request, ctx);
-  return { ...out, headers: withSecurityHeaders(out.headers, out.body) };
-}
-
-async function route(request, ctx) {
-  const url = new URL(request.url);
-  const { pathname } = url;
-
-  // The new-account page: the host's front door, forking solo / group /
-  // manage. Served as a static page the adapter supplies; the page itself
-  // calls the availability API below. It only COLLECTS intent — creating an
-  // account is the Solid-OIDC attach step (proving the pod is the user's).
-  if (pathname === '/' || pathname === '/signup' || pathname === '/new-account') {
-    if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
-    if (!ctx.signupPage) return notFound();
-    return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' }, body: ctx.signupPage };
-  }
-
-  // The run page: a pod owner opting their identity in or out of being run by
-  // this server. Meaningful only on a host that embeds the agent; a host that
-  // does not simply supplies no page.
-  if (pathname === runPath(ctx)) {
-    if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
-    if (!ctx.runPage) return notFound();
-    return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-cache' }, body: ctx.runPage };
-  }
-
-  // The roster page (/roster, off /admin, which is the owner's own record
-  // page on every agent) is served with the notices page, in notices.mjs.
-
-  // Notices from the operator to every account here, and the page they are
-  // written on (notices.mjs).
-  const notices = await routeNoticesApi(request, pathname, ctx, { j, verifyPodToken, publicFor, notFound });
-  if (notices) return notices;
-
-  // The roster: every directory row, secrets stripped, for the host's own
-  // eyes. The reader proves themself the way attach proves a pod — a
-  // Solid-OIDC token — and must be the WebID the deploy names as admin.
-  if (pathname === '/api/roster') {
-    if (!ctx.listDirectory || !ctx.adminWebId) return j(501, { error: 'this front has no roster to offer' });
-    const webid = await verifyPodToken(request, pathname, ctx.verifier);
-    if (!webid) return j(401, { error: 'a Solid-OIDC token is required' });
-    if (webid !== ctx.adminWebId) return j(403, { error: 'that WebID is not the admin of this front' });
-    const rows = await ctx.listDirectory();
-    const accounts = Object.values(rows)
-      .map((r) => ({
-        handle: r.handle, kind: r.kind || 'person', fronted: !r.inboxOnly,
-        podHome: r.podHome, webId: r.webId || null, actorUrl: r.actorUrl,
-        address: r.address || `@${r.handle}@${ctx.host}`,
-        openedAt: r.openedAt || null, pausedAt: r.pausedAt || null, closedAt: r.closedAt || null,
-      }))
-      .sort((a, b) => (a.address || a.handle).localeCompare(b.address || b.handle));
-    return j(200, { host: ctx.host, accounts });
-  }
-
-  // Revoke: the admin removes an account's row, so the server stops answering
-  // for the name. Nothing on the user's pod is touched. Attach-created rows go
-  // for good; a row seeded in the deploy's environment can only be removed there.
-  if (pathname === '/api/revoke' && request.method === 'POST') {
-    if (!ctx.removeDirectory || !ctx.adminWebId) return j(501, { error: 'this front cannot revoke accounts' });
-    const webid = await verifyPodToken(request, pathname, ctx.verifier);
-    if (!webid) return j(401, { error: 'a Solid-OIDC token is required' });
-    if (webid !== ctx.adminWebId) return j(403, { error: 'that WebID is not the admin of this front' });
-    let body;
-    try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
-    // Revoke by full address (what the roster lists); a bare handle still works
-    // for any legacy row keyed that way.
-    const key = String(body.address || body.handle || '').replace(/^@/, '').toLowerCase();
-    if (!key || !(await ctx.lookup(key))) return j(404, { error: 'no such account' });
-    const removed = (await ctx.removeDirectory(key)) === true;
-    return j(200, removed ? { account: key, removed }
-      : { account: key, removed: false,
-          reason: 'this row is seeded in the deploy environment (FEDIPOD_DIRECTORY_JSON) — remove it there and redeploy' });
-  }
-
-  // Live handle check for the page: valid shape AND not already in the
-  // directory. Also tells the page whether this host offers pods.
-  if (pathname === '/api/handle') {
-    const h = (url.searchParams.get('handle') || '').toLowerCase();
-    const problem = handleProblem(h);
-    if (problem) {
-      return j(200, { handle: h, available: false, reason: problem,
-        offersPods: !!ctx.offersPods, version: ctx.version || null });
-    }
-    const taken = !!(await ctx.lookup(h));
-    return j(200, { handle: h, available: !taken, reason: taken ? 'that name is taken' : null,
-      offersPods: !!ctx.offersPods, version: ctx.version || null });
-  }
-
-  // What a reader's own server speaks, asked here rather than in their
-  // browser: a page cannot probe a stranger's server (no CORS), and the
-  // answer decides how that reader takes part in a forum.
-  if (pathname === '/api/server') {
-    const host = (url.searchParams.get('host') || '').trim().toLowerCase();
-    const open = { 'access-control-allow-origin': '*' };
-    const said = (kind, extra = {}) => ({ ...j(200, { host, kind, ...extra }), headers: { ...j(200, {}).headers, ...open } });
-    // An address at this front is a FediPod account: its client is the
-    // browser here, and no other server holds it. Asked before the shape of
-    // the host, since a front may answer at a name with no dot in it.
-    if (host && host === String(ctx.host || '').toLowerCase()) {
-      const handle = (url.searchParams.get('handle') || '').toLowerCase();
-      const rec = handle ? await ctx.lookup(handle) : null;
-      if (!rec) return said('fedipod');
-      // Where the owner of this pod signs in: the pod says so itself, at the
-      // well-known document every Solid server answers (or redirects to).
-      let issuer = null;
-      try {
-        const res = await safeFetch(new URL('/.well-known/openid-configuration', rec.podHome).href,
-          { headers: { accept: 'application/json' }, redirect: 'follow', signal: AbortSignal.timeout(SERVER_PROBE_MS) },
-          ctx.fetchImpl || fetch);
-        if (res.ok) issuer = JSON.parse(await readCapped(res, SERVER_PROBE_BYTES)).issuer || null;
-      } catch { /* a pod that will not say leaves the reader to type it */ }
-      return said('fedipod', { podHome: rec.podHome, actor: rec.actorUrl, issuer, inbox: identFor(rec).inboxUrl });
-    }
-    if (!/^[a-z0-9.-]+\.[a-z0-9-]+(:\d+)?$/u.test(host)) return said('invalid');
-    const f = ctx.fetchImpl || fetch;
-    const ask = async (path) => {
-      try {
-        const res = await safeFetch(`https://${host}${path}`,
-          { headers: { accept: 'application/json' }, signal: AbortSignal.timeout(SERVER_PROBE_MS) }, f);
-        if (!res.ok) return null;
-        return JSON.parse(await readCapped(res, SERVER_PROBE_BYTES));
-      } catch { return null; }
-    };
-    const masto = await ask('/api/v1/instance');
-    if (masto) return said('mastodon-api', { name: masto.title || masto.domain || host });
-    const lemmy = await ask('/api/v3/site');
-    if (lemmy) return said('lemmy', { name: lemmy.site_view?.site?.name || host });
-    return said('unknown');
-  }
-
-  // Attach: create the account. The user proves control of the pod they claim
-  // by presenting a Solid-OIDC token whose WebID lives on that pod — no
-  // password reaches the front. On success the directory gets a row and the
-  // agent gets a one-time HMAC secret to stamp the receipts its front writes.
-  if (pathname === '/api/attach' && request.method === 'POST') {
-    if (!ctx.putDirectory) return j(501, { error: 'this front does not accept signups' });
-    let body;
-    try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
-    const handle = String(body.handle || '').toLowerCase();
-    const podHome = String(body.podHome || '');
-    const problem = handleProblem(handle);
-    if (problem) return j(400, { error: problem });
-    const podLoopback = (() => { try { return isLoopbackHost(new URL(podHome).hostname); } catch { return false; } })();
-    if (!(/^https:\/\/\S+\/$/.test(podHome) || (/^http:\/\/\S+\/$/.test(podHome) && podLoopback))) {
-      return j(400, { error: 'podHome must be an https URL ending in /' });
-    }
-    const badPod = podHomeProblem(podHome, ctx.frontOrigin);
-    if (badPod) return j(400, { error: badPod });
-    const webid = await verifyPodToken(request, pathname, ctx.verifier);
-    if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
-    if (!await provesPod(webid, podHome, ctx.fetchImpl)) {
-      return j(403, { error: 'the token proves a different pod than the one you listed' });
-    }
-    // The usual attachment keeps the user's identity on their pod and moves
-    // only the mail door here (@me@mypod). Fronted identity — actor ids on
-    // this domain — remains available to an explicit `fronted: true`.
-    const fronted = body.fronted === true;
-    // The full address is the key: a fronted name answers at this front's host,
-    // a mail-door name at its pod's host. The same handle on two pods is two
-    // distinct addresses, so it never collides.
-    let addressHost; try { addressHost = fronted ? ctx.host : new URL(podHome).host; } catch { return j(400, { error: 'bad podHome' }); }
-    // A fronted name answers at this front's host, where the handle alone is the
-    // whole address and is unique — so it keeps keying by bare handle (and its
-    // actor id stays /u/<handle>/, unchanged for existing accounts). A mail-door
-    // name answers at its own pod, where "me" is not unique, so it keys by the
-    // full address handle@podhost, which the /u/ segment then carries.
-    const key = fronted ? handle : addressKey(handle, addressHost);
-    const address = `@${handle}@${addressHost}`;
-    // "Taken" only when this exact address already belongs to a DIFFERENT pod.
-    // Re-attaching your own pod — a retry, a re-provision, a second browser — is
-    // idempotent: it updates the row in place and keeps the same door secret.
-    const prior = await ctx.lookup(key);
-    // The same account on the same pod may correct where its tree lives — a
-    // row made by an older sign-up named the pod root, and every delivery
-    // to it was written where nothing reads. A different pod is still taken.
-    const sameOwner = (a, b) => { try { return new URL(a).origin === new URL(b).origin; } catch { return false; } };
-    if (prior && prior.podHome !== podHome
-      && !(prior.webId && prior.webId === webid && sameOwner(prior.podHome, podHome))) {
-      return j(409, { error: 'that name is taken' });
-    }
-    // Re-attaching is idempotent — a retry, a re-provision, a second browser —
-    // and it hands back the EXISTING receipt secret. So it has to be the same
-    // person: matching podHome was enough on a subdomain server and, on a
-    // path-based one, meant any co-tenant could re-attach your row, flip its
-    // kind, and be given your secret (S7). A row that predates `webId` has
-    // nothing to compare and falls back to the pod check above.
-    if (prior?.webId && prior.webId !== webid) {
-      return j(409, { error: 'that name belongs to a different account on this pod' });
-    }
-    // The pod's actor lives under its AP root container, which the pod owner
-    // knows and the front does not — so take the caller's actorUrl when it is on
-    // this pod, and fall back only when none is given.
-    const claimedActor = typeof body.actorUrl === 'string' && body.actorUrl.startsWith(podHome) ? body.actorUrl : null;
-    const actorUrl = fronted ? `${userBase(ctx.frontOrigin, key)}ap/actor` : (claimedActor || podHome + 'ap/actor');
-    const hmacSecret = prior?.hmacSecret || crypto.randomBytes(32).toString('base64');
-    // Where the door writes: the row's own tree unless the caller names an
-    // inbox on the same pod — a forum's categories name the forum's.
-    let inboxUrl = null;
-    if (typeof body.inboxUrl === 'string' && body.inboxUrl) {
-      let ok = false;
-      try { ok = new URL(body.inboxUrl).origin === new URL(podHome).origin && body.inboxUrl.endsWith('/'); } catch { ok = false; }
-      if (!ok) return j(400, { error: 'inboxUrl must be a container on the same pod' });
-      inboxUrl = body.inboxUrl;
-    }
-    const record = {
-      handle, address, podHome, webId: webid, actorUrl,
-      kind: body.kind === 'group' ? 'group' : body.kind === 'application' ? 'application' : 'person',
-      gatewayWebId: ctx.gatewayWebId || null, hmacSecret,
-      ...(inboxUrl ? { inboxUrl } : {}),
-      ...(fronted ? {} : { inboxOnly: true }),
-    };
-    await ctx.putDirectory(key, record);
-    // The secret is returned ONCE, with the one command the user runs to
-    // point their agent at this gateway.
-    const doorInbox = `${userBase(ctx.frontOrigin, key)}ap/inbox/`;
-    if (fronted) {
-      return j(201, { ok: true, handle, address, actorUrl, frontActor: actorUrl, hmacSecret,
-        command: `fedipod gateway ${actorUrl} --secret ${hmacSecret}` });
-    }
-    return j(201, { ok: true, handle, address, doorInbox, hmacSecret,
-      command: `fedipod gateway ${doorInbox} --secret ${hmacSecret} --inbox-only` });
-  }
-
-  // An address at this gateway moving to another one. Its owner, proved the
-  // way attach proves a pod, says where it went. From then on this front
-  // answers the old actor as a moved stub — the same key under the old id,
-  // `movedTo` the new one, so the Move the owner sends from the old address
-  // verifies — every other old id redirects to its new address, and the
-  // mail door is shut: deliveries belong at the new one. Repeating it with
-  // the same target changes nothing.
-  if (pathname === '/api/move' && request.method === 'OPTIONS') return apiPreflight();
-  if (pathname === '/api/move' && request.method === 'POST') {
-    if (!ctx.putDirectory) return withApiCors(j(501, { error: 'this front keeps no directory' }));
-    let body;
-    try { body = JSON.parse(await request.clone().text()); } catch { return withApiCors(j(400, { error: 'bad JSON' })); }
-    const handle = String(body.handle || '').toLowerCase();
-    const rec = await ctx.lookup(handle);
-    if (!rec) return withApiCors(j(404, { error: 'no such account' }));
-    if (rec.inboxOnly) return withApiCors(j(400, { error: 'this address lives on its pod; only an address at this gateway can move' }));
-    const movedTo = String(body.movedTo || '');
-    let mu;
-    try { mu = new URL(movedTo); } catch { return withApiCors(j(400, { error: 'movedTo must be the new actor URL' })); }
-    if (!((mu.protocol === 'https:' || (mu.protocol === 'http:' && isLoopbackHost(mu.hostname))) && /\/ap\/actor$/u.test(mu.pathname))) {
-      return withApiCors(j(400, { error: 'movedTo must be an https …/ap/actor URL' }));
-    }
-    if (ctx.frontOrigin && mu.origin === new URL(ctx.frontOrigin).origin) return withApiCors(j(400, { error: 'that address is at this gateway' }));
-    const webid = await verifyPodToken(request, pathname, ctx.verifier);
-    if (!webid) return withApiCors(j(401, { error: 'a Solid-OIDC token proving the pod is required' }));
-    const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
-    if (!owner) return withApiCors(j(403, { error: "the token proves a different pod than this account's" }));
-    const movedAt = rec.movedTo === movedTo && rec.movedAt ? rec.movedAt : new Date().toISOString();
-    await ctx.putDirectory(handle, { ...rec, movedTo, movedAt });
-    console.log(`front @${handle}: moved to ${movedTo}`);
-    return withApiCors(j(200, { ok: true, handle, movedTo, movedAt }));
-  }
-
-  // The owner's say over an account that goes quiet (quiet.mjs).
-  const quiet = await routeQuietApi(request, pathname, ctx, { j, verifyPodToken, webidUnderPod, apiPreflight });
-  if (quiet) return withApiCors(quiet);
-
-  // The relay: the front sends requests a browser has already signed. A page
-  // may not set the Date or Host header, and both are inside an HTTP
-  // signature, so a browser-run agent signs and hands the request here; the
-  // front sends it with exactly the headers that were signed. It can forward
-  // a signature and cannot make one. Only the account's own key may sign,
-  // only the account's own pod may call, and nothing unsigned-for reaches
-  // the remote server.
-  if (pathname === '/api/relay' && request.method === 'OPTIONS') return apiPreflight();
-  if (pathname === '/api/relay' && request.method === 'POST') {
-    let body;
-    try { body = JSON.parse(await request.clone().text()); } catch { return withApiCors(j(400, { error: 'bad JSON' })); }
-    const handle = String(body.handle || '').toLowerCase();
-    const rec = await ctx.lookup(handle);
-    if (!rec) { console.log(`relay: no account named ${handle}`); return withApiCors(j(404, { error: 'no such account' })); }
-    const webid = await verifyPodToken(request, pathname, ctx.verifier);
-    if (!webid) { console.log(`relay @${handle}: no usable pod token`); return withApiCors(j(401, { error: 'a Solid-OIDC token proving the pod is required' })); }
-    const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
-    if (!owner) { console.log(`relay @${handle}: token is for ${webid}, not this account's pod`); return withApiCors(j(403, { error: "the token proves a different pod than this account's" })); }
-    const items = Array.isArray(body.requests) ? body.requests : [];
-    if (!items.length) return withApiCors(j(400, { error: 'requests must be a non-empty list' }));
-    // Acting through the relay is being here. Hourly at most; see noteOpened.
-    await noteOpened(ctx, handle, rec).catch((e) => console.log(`relay @${handle}: stamp not written: ${e?.message || e}`));
-    if (items.length > RELAY_MAX_REQUESTS) return withApiCors(j(400, { error: `at most ${RELAY_MAX_REQUESTS} requests per call` }));
-    const slow = overLimit(handle, items.length) && j(429, { error: 'too many relayed requests — slow down' });
-    if (slow) return withApiCors({ ...slow, headers: { ...slow.headers, 'retry-after': '60' } });
-    const results = await Promise.all(items.map((it) => relayOne(it, rec, ctx.fetchImpl || fetch)));
-    // Something of the account's withdrawn: the edge's copies go.
-    if (withdrawn(items, rec.actorUrl)) await ctx.purge?.([`u-${handle}`]).catch((e) => console.log(`purge @${handle}: ${e?.message || e}`));
-    // One line per relayed request, so a lookup that fails on the far side is
-    // visible here and not only as an empty result in someone's browser.
-    for (const r of results) console.log(`relay @${handle}: ${r.method || ''} ${r.url} → ${r.status}${r.error ? ` (${r.error})` : ''}`);
-    return withApiCors(j(200, { results }));
-  }
-
-  // Who is here, and which pod of theirs could opt in. The opt-in page asks
-  // this first: on a pod server that issued the reader's session, the answer
-  // names their pod and its address, and the page shows one button instead of
-  // a form. A Gateway holds no such session and says so; the page then asks
-  // for the pod by hand and proves it with a sign-in, as before.
-  if (pathname === '/api/agent' && request.method === 'GET') {
-    if (!ctx.agentControl) return j(501, { error: 'this server does not run identities' });
-    if (!ctx.webIdsFromSession) return j(200, { offered: true, session: 'unknown' });
-    if (!sameOriginRequest(request, ctx.frontOrigin)) return j(200, { offered: true, session: 'none' });
-    const webIds = await ctx.webIdsFromSession(request).catch(() => []);
-    if (!webIds.length) return j(200, { offered: true, session: 'none', loginUrl: '/.account/login/password/' });
-    const pods = [];
-    for (const webId of webIds) {
-      let podBase;
-      try { podBase = podBaseOfWebId(webId); } catch { continue; }
-      let about = null;
-      try { about = ctx.agentControl.describe ? await ctx.agentControl.describe({ podBase }) : null; } catch { about = null; }
-      pods.push({ webId, podBase, ...(about || {}) });
-    }
-    return j(200, { offered: true, session: 'ok', pods });
-  }
-
-  // Runtime opt-in: a pod owner asks the server this front sits on to RUN
-  // their identity. Same proof as attach — a Solid-OIDC token — but the
-  // ownership check is stricter: the WebID must live UNDER the pod base, not
-  // merely on its origin, or on a path-pod server one user could opt in
-  // another's pod. Offered only where the deployment wired agentControl in
-  // (a pod server running the CSS component); everywhere else it is 501.
-  if (pathname === '/api/agent' && request.method === 'POST') {
-    if (!ctx.agentControl) return j(501, { error: 'this server does not run identities' });
-    let body;
-    try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
-    const action = String(body.action || '');
-    const podBase = String(body.podBase || '');
-    if (!/^https?:\/\/\S+\/$/.test(podBase)) {
-      return j(400, { error: 'podBase must be a URL ending in /' });
-    }
-    let podUrl;
-    try { podUrl = new URL(podBase); } catch { return j(400, { error: 'podBase is not a URL' }); }
-    // A pod may be host-root (its own origin) or on a PATH of a shared host — a
-    // suffix pod, which the Server runs at `https://server/aisha/`. What is
-    // refused is the gateway's own origin root itself: that is where the
-    // gateway lives, not a pod, and admitting it would (with the ownership
-    // fallback below) let a co-tenant claim the whole origin.
-    if (ctx.frontOrigin) {
-      try {
-        if (podUrl.origin === new URL(ctx.frontOrigin).origin && podUrl.pathname === '/') {
-          return j(403, { error: 'that is this gateway, not a pod — name the pod that holds your data' });
-        }
-      } catch { /* no usable frontOrigin: the checks below still apply */ }
-    }
-    if (/(^|\/)\.internal(\/|$)/u.test(podUrl.pathname) || /(^|\/)\.\.(\/|$)/u.test(podUrl.pathname)) {
-      return j(403, { error: 'that is not a pod address' });
-    }
-    // The pod's own server names its owner when it can, and where it does that
-    // is the proof. Where it does not, the WebID must live in EXACTLY this pod
-    // — its own pod base equal to podBase, not merely starting with it, which on
-    // a path server an ancestor of another's pod would.
-    const owners = await podOwners(podBase, ctx.fetchImpl || fetch);
-    const ownsIt = (who) => (owners.length ? owners.includes(who) : podBaseOfWebId(who) === podBase);
-    const token = await verifyPodToken(request, pathname, ctx.verifier);
-    // A server that issued the reader's own session can simply read it. On a
-    // pod server the page, the session and the pod are one origin, and a token
-    // proves nothing the session does not — so opting in cost a round trip to
-    // an identity provider that had just said who they were. A Gateway fronting
-    // somebody else's pod holds no such session and this does nothing there.
-    //
-    // One account can hold several WebIDs, so it is the one that owns this pod
-    // that is taken, not whichever came back first.
-    const session = !token && ctx.webIdsFromSession && sameOriginRequest(request, ctx.frontOrigin)
-      ? (await ctx.webIdsFromSession(request).catch(() => [])).find(ownsIt) || null
-      : null;
-    const webid = token || session;
-    if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
-    if (!ownsIt(webid)) {
-      return j(403, { error: 'the token proves a different pod than the one you listed' });
-    }
-    if (action === 'opt-in') {
-      const { httpStatus, ...reply } = await ctx.agentControl.optIn({ podBase, webId: webid,
-        container: String(body.container || ''), createIndex: body.createIndex === true });
-      if (reply.doorSecret) {
-      // The secret appears here and nowhere else; the command is the
-      // paste-and-run way to open the owner door once.
-        reply.command = `curl -H 'x-dk-token: ${reply.doorSecret}' ${podBase.replace(/\/$/, '')}${reply.doorPath}status`;
-      }
-      return j(httpStatus, reply);
-    }
-    if (action === 'opt-out') {
-      const { httpStatus, ...reply } = await ctx.agentControl.optOut({ podBase });
-      return j(httpStatus, reply);
-    }
-    return j(400, { error: 'action must be opt-in or opt-out' });
-  }
-
-  // Each page's own script. They were inline until 2026-09-09; out here the
-  // pages can be served under `script-src 'self'`, which is the directive that
-  // tells running code from injected markup — and inline script defeats it by
-  // construction. Same mechanism the vendored library below has always used.
-  //
-  // The name is matched against a literal list, so nothing about the request
-  // chooses a file.
-  const mPageScript = /^\/(new-account|run|admin|notices)\.js$/u.exec(pathname);
-  if (mPageScript) {
-    const body = ctx.pageScripts?.[`${mPageScript[1]}.js`];
-    if (!body) return notFound();
-    // Revalidated on every load: a page served fresh with a script the
-    // browser kept from last time is the mismatch nobody can see.
-    return { status: 200, headers: { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'no-cache' }, body };
-  }
-
-  // The vendored Solid-OIDC browser library the opt-in and admin pages load —
-  // served here because this function owns every path on the domain.
-  if (pathname === '/solid-oidc-client.js') {
-    if (!ctx.authBundle) return notFound();
-    return { status: 200, headers: { 'content-type': 'text/javascript' }, body: ctx.authBundle };
-  }
-
-  // The installer:  curl -fsSL https://<host>/install | sh
-  if (pathname === '/install') {
-    if (!ctx.installScript) return notFound();
-    return { status: 200, headers: { 'content-type': 'text/plain; charset=utf-8' }, body: ctx.installScript };
-  }
-
-  // WebFinger: acct:<handle>@<host> → the fronted actor. This is what makes
-  // @name@fedipod.net a real handle the fediverse can look up.
-  if (pathname === '/.well-known/webfinger') {
-    const resource = url.searchParams.get('resource') || '';
-    const m = /^acct:([^@]+)@(.+)$/.exec(resource);
-    if (!m || m[2] !== ctx.host) return notFound();
-    const rec = await ctx.lookup(m[1]);
-    if (!rec) return notFound();
-    // A closed address is gone, and says so rather than pretending never to
-    // have existed: the name stays taken.
-    if ((await closedState(ctx, m[1], rec)).closed) return closedAnswer({ 'access-control-allow-origin': '*', ...publicFor(GONE_EDGE_SECONDS) });
-    // A fronted identity's documents live on its pod; the pod's own actor id
-    // is the alias, so a client signing in by the fronted address can find
-    // the pod (and its login) without a lookup only the host could answer.
-    const podActor = rec.inboxOnly ? [] : [rec.podHome + 'ap/actor'];
-    const out = j(200, jrd({ handle: m[1], host: ctx.host, actor: rec.actorUrl, aliases: podActor,
-      page: profilePageOf(rec), subscribe: subscribeTemplate(ctx.frontOrigin) }),
-    'application/jrd+json');
-    // RFC 7033: a JRD is read from any origin.
-    out.headers['access-control-allow-origin'] = '*';
-    // A handle answers the same for everybody, and changes only when a row
-    // does. Every server that has heard of this account asks for it; the edge
-    // can answer most of them.
-    Object.assign(out.headers, publicFor(WEBFINGER_EDGE_SECONDS));
-    return out;
-  }
-
-  // The short address a person types: https://<host>/@handle opens the
-  // profile page, the way most Fediverse servers spell it. /@handle@pod-host
-  // is the same for an account whose address is its pod's, which the front
-  // holds under that full address — the form other servers use for a
-  // profile that lives elsewhere.
-  const at = /^\/@([^/@]+)(?:@([^/@]+))?$/u.exec(pathname);
-  if (at) {
-    const handle = decodeURIComponent(at[1]).toLowerCase();
-    const host = at[2] ? decodeURIComponent(at[2]).toLowerCase() : null;
-    const key = host && host !== String(ctx.host).toLowerCase() ? `${handle}@${host}` : handle;
-    const rec = await ctx.lookup(key);
-    const page = rec && profilePageOf(rec);
-    if (!page) return notFound();
-    return { status: 302, headers: { location: page, 'cache-control': 'no-store' }, body: '' };
-  }
-
-  const up = parseUserPath(pathname);
-  if (!up) return notFound();
-  const rec = await ctx.lookup(up.handle);
-  if (!rec) return notFound();
-  const base = userBase(ctx.frontOrigin, up.handle);
-  // An account that moved to another gateway (see /api/move): where its ids
-  // live now. The actor below answers as a stub; everything else redirects.
-  const movedBase = rec.movedTo ? rec.movedTo.replace(/ap\/actor$/u, '') : null;
-  // A closed address (see "accounts that go quiet" above): every id under it
-  // is gone. Asked after moved, which a close does not undo.
-  const closed = movedBase ? false : (await closedState(ctx, up.handle, rec)).closed;
-  const gone = (headers = {}, why = `this account has moved to ${rec.movedTo}`) => closedAnswer(headers, why);
-  const CLOSED = 'this address is closed';
-
-  // Inbox: verify at the door, forward to the user's pod inbox. This is the
-  // gateway, per user.
-  if (up.rest === 'ap/inbox/' || up.rest === 'ap/inbox') {
-    if (request.method !== 'POST') return { status: 405, headers: {}, body: '' };
-    if (movedBase) { console.log(`door @${up.handle}: delivery → 410 (moved)`); return gone(); }
-    if (closed) { console.log(`door @${up.handle}: delivery → 410 (closed)`); return gone({}, CLOSED); }
-    const policy = await policyFor(rec, ctx.fetchImpl || fetch);
-    const standing = await accountState(ctx, up.handle, rec);
-    const { status, reason, content, bytes } = await handleDelivery(request, identFor(rec, policy),
-      { podPut: (u, b, ct) => ctx.podPut(up.handle, u, b, ct), fetchImpl: ctx.fetchImpl, paused: standing.paused });
-    // One line per delivery, so "did it arrive at the door" has an answer.
-    console.log(`door @${up.handle}: delivery → ${status} (${reason})`);
-    if (status === 202 && content) await noteReceived(ctx, up.handle, rec, bytes);
-    return { status, headers: {}, body: '' };
-  }
-
-  // Outbox: the owner's own post, from any client that speaks ActivityPub
-  // client-to-server (dokieli, say). Cross-origin by nature — such a client is
-  // a page on another site — so this route answers a preflight and carries
-  // CORS headers; the owner's pod token is the credential, so any origin may
-  // ask. GET stays a read: the pod's document for a fronted account, sent on
-  // to the pod for a door account whose documents live at their own address.
-  if (up.rest === 'ap/outbox') {
-    const cors = {
-      'access-control-allow-origin': '*',
-      'access-control-allow-methods': 'GET, POST, OPTIONS',
-      'access-control-allow-headers': 'Authorization, DPoP, Content-Type, Slug, Link',
-      'access-control-expose-headers': 'Location, Accept-Post',
-      'access-control-max-age': '86400',
-    };
-    if (request.method === 'OPTIONS') {
-      // Accept-Post names JSON only: a client that reads it (dokieli) sends
-      // JSON-LD when HTML is not offered.
-      // body null, not '': a Response refuses any body on a 204, and the
-      // function adapter hands `body` straight to one.
-      return { status: 204, headers: { ...cors, allow: 'GET, POST, OPTIONS',
-        'accept-post': 'application/ld+json, application/activity+json' }, body: null };
-    }
-    if (movedBase && request.method === 'POST') return gone(cors);
-    if (closed && request.method === 'POST') return gone(cors, CLOSED);
-    if (movedBase && (request.method === 'GET' || request.method === 'HEAD')) {
-      return { status: 301, headers: { ...cors, location: movedBase + up.rest, 'cache-control': 'no-store' }, body: '' };
-    }
-    if (request.method === 'POST') {
-      const json = (status, obj, extra = {}) => ({ status,
-        headers: { ...cors, 'content-type': 'application/json', 'cache-control': 'no-store', ...extra },
-        body: JSON.stringify(obj) });
-      const webid = await verifyPodToken(request, pathname, ctx.verifier);
-      if (!webid) return json(401, { error: 'a Solid-OIDC token proving this account\'s owner is required' });
-      const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
-      if (!owner) return json(403, { error: 'this outbox belongs to its owner alone' });
-      const onPod = (u) => u.replace(rec.actorUrl.replace(/ap\/actor$/u, ''), rec.podHome);
-      const { status, reason, location, object } = await handleOwnerPost(request, identFor(rec),
-        { podPut: (u, b, ct) => ctx.podPut(up.handle, u, b, ct), ownerWebId: webid,
-          exists: async (u) => ((await (ctx.podGet || fetch)(onPod(u), { podHome: rec.podHome })).status !== 404) });
-      console.log(`door @${up.handle}: owner post → ${status} (${reason})`);
-      if (status !== 201) return json(status, { error: reason });
-      return json(201, { accepted: true, ...(location ? { id: location } : {}), ...(object ? { object } : {}),
-        note: 'it goes out when your FediPod agent next runs' }, location ? { location } : {});
-    }
-    // Its owner, signed in, reads every message the account produced (§5.1:
-    // the outbox is filtered by who asks); that view is on the pod, under the
-    // owner's own rule. Anyone else reads the public one.
-    // The token is only read here, not verified: the redirect grants nothing,
-    // the pod checks the credential when the owner arrives there, and a
-    // verification per read would let anyone make the front fetch keys from a
-    // server they name.
-    if ((request.method === 'GET' || request.method === 'HEAD') && request.headers.get('authorization')) {
-      const webid = claimedWebId(request);
-      if (webid && (rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome))) {
-        return { status: 303, headers: { ...cors, location: rec.podHome + 'ap/private/outbox', 'cache-control': 'no-store' }, body: '' };
-      }
-    }
-    if (rec.inboxOnly && (request.method === 'GET' || request.method === 'HEAD')) {
-      return { status: 303, headers: { ...cors, location: rec.podHome + 'ap/outbox', 'cache-control': 'no-store' }, body: '' };
-    }
-  }
-
-  // Everything else is a public GET, served by reading the user's pod and
-  // rewriting pod ids to the front. The actor also gets its handle and inbox
-  // fixed to the front so a consumer cross-checks it consistently.
-  // Public documents are read from any origin — a page on another site, the
-  // forum's own host among them — the way a pod serves them, so the read
-  // carries the open origin and a preflight is answered.
-  const open = { 'access-control-allow-origin': '*' };
-  if (request.method === 'OPTIONS') {
-    return { status: 204, headers: { ...open, 'access-control-allow-methods': 'GET, HEAD, OPTIONS',
-      'access-control-allow-headers': 'Accept', 'access-control-max-age': '86400', allow: 'GET, HEAD, OPTIONS' }, body: null };
-  }
-  if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
-  // Moved: every old id but the actor's answers with where it is now, so a
-  // reply or a boost another server still holds under the old id resolves.
-  if (movedBase && up.rest !== 'ap/actor') {
-    return { status: 301, headers: { ...open, location: movedBase + up.rest, 'cache-control': 'no-store' }, body: '' };
-  }
-  if (closed) return gone({ ...open, ...publicFor(GONE_EDGE_SECONDS) }, CLOSED);
-  const podTarget = rec.podHome + up.rest;
-  // The owner's own documents — the full outbox, the liked list, the pending
-  // lists — are read at the pod, which decides who may; never held here,
-  // where one reader's answer would be served to the next.
-  if (up.rest.startsWith('ap/private/')) {
-    return { status: 303, headers: { ...open, location: podTarget, 'cache-control': 'no-store' }, body: '' };
-  }
-  // Media stays on the pod (lib/pod/urls.mjs keeps `media` off the front), but
-  // the id rewrite below turns media links onto the front like every other
-  // pod url in a document. Answer those by pointing at the pod: bytes are not
-  // a document to cap and relabel, and remotes follow a redirect for a picture.
-  if (up.rest.startsWith('ap/media/')) {
-    return { status: 302, headers: { location: podTarget, ...publicFor(MEDIA_EDGE_SECONDS) }, body: '' };
-  }
-  // The pod this read belongs to travels with it: an adapter reading a store
-  // directly (the CSS server component) has no access control of its own and
-  // needs to be told what it may reach. See podHomeProblem above for the other
-  // half — a row that names something which is not a pod.
-  // A container is Turtle, a profile page is HTML, everything else here is
-  // ActivityPub. Ask for what the thing can be, not for what most of them are.
-  const container = podTarget.endsWith('/');
-  const page = /\.html?$/u.test(podTarget);
-  const accept = container ? 'text/turtle, */*;q=0.8'
-    : page ? 'text/html, */*;q=0.8'
-      : AP_CT;
-  const got = await podRoot.readPublicDocument(
-    ctx.podGet || ((u) => fetch(u, { headers: { accept } })),
-    podTarget, { podHome: rec.podHome, accept });
-  if (got.text === null) {
-    const hold = [401, 403, 404, 410].includes(got.status) ? { ...publicFor(MISSING_EDGE_SECONDS), 'netlify-cache-tag': `u-${up.handle}` } : {};
-    // A stranger is not told a document exists that they may not read (§3.2).
-    return { status: got.status === 401 || got.status === 403 ? 404 : got.status, headers: { ...open, ...hold }, body: '' };
-  }
-  let text = got.text;
-  text = swap(text, rec.podHome, base);
-  // The moved stub: the pod's actor now carries the NEW gateway's ids, and a
-  // server verifying the Move fetches the OLD id and needs a document whose
-  // id is that old id — with the same key under it, and `movedTo` saying
-  // where the account went. Swapping the new base back to this one gives
-  // exactly that; alsoKnownAs and movedTo are set below.
-  if (movedBase) text = swap(text, movedBase, base);
-  if (up.rest === 'ap/actor') {
-    try {
-      const doc = JSON.parse(text);
-      doc.preferredUsername = up.handle;               // so @handle@front cross-checks
-      doc.inbox = base + 'ap/inbox/';                  // deliveries come to the front to be verified
-      doc.endpoints = { ...(doc.endpoints || {}), sharedInbox: base + 'ap/inbox/' };
-      // The owner's own documents are read at the pod, where their credential
-      // works; they keep the pod's address.
-      for (const k of ['liked', 'ownerOutbox']) if (typeof doc[k] === 'string') doc[k] = doc[k].replace(base, rec.podHome);
-      if (movedBase) {
-        doc.movedTo = rec.movedTo;
-        const aka = new Set([].concat(doc.alsoKnownAs || []).filter((a) => typeof a === 'string' && a !== doc.id));
-        aka.add(rec.movedTo);
-        doc.alsoKnownAs = [...aka];
-        const ctxs = [].concat(doc['@context'] || []);
-        const declared = (term) => ctxs.some((c) => c && typeof c === 'object' && term in c);
-        if (!declared('alsoKnownAs')) ctxs.push({ alsoKnownAs: { '@id': 'as:alsoKnownAs', '@type': '@id' } });
-        if (!declared('movedTo')) ctxs.push({ movedTo: { '@id': 'as:movedTo', '@type': '@id' } });
-        doc['@context'] = ctxs;
-      }
-      text = JSON.stringify(doc);
-    } catch { /* leave the rewritten text as-is if it will not parse */ }
-  }
-  // `readPublicDocument` asked for it with no credential, so a document that
-  // came back is one anybody can read — which is what makes it cacheable. A
-  // deleted post's Tombstone answers 410 Gone, and still says what it was.
-  let kind = null;
-  try { kind = JSON.parse(text)?.type; } catch { /* not JSON: a page or a container */ }
-  return { status: kind === 'Tombstone' ? 410 : 200,
-    headers: { ...open, 'content-type': got.type || (container ? 'text/turtle' : page ? 'text/html' : AP_CT), ...publicFor(PUBLIC_EDGE_SECONDS),
-      // The outbox answers its signed-in owner differently, so the edge keeps
-      // the public copy for those who show no credential.
-      ...(up.rest === 'ap/outbox' ? { 'netlify-vary': 'header=Authorization', vary: 'Authorization' } : {}),
-      'netlify-cache-tag': `u-${up.handle}` },
-    body: text };
-}
-
-export const _internal = { parseUserPath, identFor, swap, handleProblem, policyFor, policyCache };