fedipod-server 0.29.0 → 0.31.0

package/lib/pod/discovery.mjs

@@ -1,46 +0,0 @@
-// discovery.mjs — the documents that make a handle resolve.
-//
-// These live at the HOST root, not in the actor's container, because that is
-// the only place the fediverse looks: @name@host is resolved at
-// https://host/.well-known/webfinger and nowhere else. A pod that does not own
-// the root of its host can still publish them, but nothing will ever ask.
-//
-// Every one is public by definition — a discovery document nobody may read
-// discovers nothing — so the Read rule is not a parameter here. It travels
-// with the write because publishing one of these unreadable is a failure mode
-// with an entire verification pass devoted to catching it.
-
-const PUBLIC_READ = ['Read'];
-
-// ---- the owner's agent ----
-
-/** The JRD that answers `acct:name@host`. */
-export async function writeWebfinger(pod, urls, jrd) {
-  await pod.putJson(urls.webfinger, jrd, 'application/jrd+json');
-  await pod.setAcl(urls.webfinger, PUBLIC_READ);
-}
-
-/** RFC 6415 host-meta: the LRDD template some implementations prefer. */
-export async function writeHostMeta(pod, urls, xml) {
-  const url = urls.base + '.well-known/host-meta';
-  await pod.put(url, xml, 'application/xrd+xml');
-  await pod.setAcl(url, PUBLIC_READ);
-}
-
-/**
- * NodeInfo, which is two documents: a pointer at the protocol-required root,
- * and the document itself in the actor's own tree.
- *
- * Four requests, one fact — "this pod answers nodeinfo". Split into separate
- * operations, a caller could write the pointer and not what it points at,
- * which is worse than neither.
- */
-export async function writeNodeinfo(pod, urls, { pointer, doc }) {
-  const pointerUrl = urls.base + '.well-known/nodeinfo';
-  const docUrl = urls.home + 'ap/nodeinfo-2.0';
-  await pod.putJson(pointerUrl, pointer, 'application/json');
-  await pod.setAcl(pointerUrl, PUBLIC_READ);
-  await pod.putJson(docUrl, doc, 'application/json');
-  await pod.setAcl(docUrl, PUBLIC_READ);
-  return docUrl;
-}

package/lib/pod/featured.mjs

@@ -1,18 +0,0 @@
-// featured.mjs — ap/featured and ap/moderators: the two small public rosters.
-//
-// Together because both are short, flat, public lists that say "these are the
-// ones that matter", and neither is big enough to page. `featured` is the
-// pinned posts; `moderators` is FEP-1b12's roster, which a recipient validates
-// a group's announced moderation against — published only when a group
-// actually has moderators, since an empty roster and no roster mean different
-// things.
-
-import * as collection from './collection.mjs';
-
-// ---- the owner's agent ----
-
-export const write = (pod, urls, doc) =>
-  collection.writeFlat(pod, urls.featured, doc, { publicRead: true });
-
-export const writeModerators = (pod, urls, doc) =>
-  collection.writeFlat(pod, urls.moderators, doc, { publicRead: true });

package/lib/pod/followers.mjs

@@ -1,24 +0,0 @@
-// followers.mjs — ap/followers: who follows this actor, paged.
-//
-// Paged like the outbox, and for the same reason: a popular account's follower
-// list is large, and a remote server should read a small head rather than pull
-// all of it. Read back to reconcile — anyone the pod says follows us that we
-// have no record of is a sign the local half is BEHIND the pod, and publishing
-// blindly over them would drop them from the wire.
-
-import * as collection from './collection.mjs';
-
-// ---- the owner's agent ----
-
-export const writePage = (pod, pageUrl, doc, opts) => collection.writePage(pod, pageUrl, doc, opts);
-export const writeHead = (pod, urls, doc, opts) => collection.writeHead(pod, urls.followers, doc, opts);
-export const dropPage = (pod, pageUrl) => collection.dropPage(pod, pageUrl);
-
-/**
- * Every follower the pod currently publishes, or null if it publishes none.
- *
- * `alsoItems`, unlike the outbox: the flat followers collection this project
- * used to write put them under `items` rather than `orderedItems`.
- */
-export const readPublished = (pod, urls) =>
-  collection.readPaged(pod, urls.followers, { max: 100_000, alsoItems: true });

package/lib/pod/following.mjs

@@ -1,10 +0,0 @@
-// following.mjs — ap/following: who this actor follows.
-//
-// Flat, not paged: it is bounded by what one person chose to do, where the
-// followers list is bounded by what everyone else chose.
-
-import * as collection from './collection.mjs';
-
-// ---- the owner's agent ----
-
-export const write = (pod, urls, doc, opts) => collection.writeFlat(pod, urls.following, doc, opts);

package/lib/pod/http.mjs

@@ -1,74 +0,0 @@
-// http.mjs — the two HTTP manners this library needs, and nothing else.
-//
-// FediPod has lib/safefetch.mjs, which does far more: DNS pinning, private
-// address refusal, redirect re-checking. None of that can come here, because
-// it imports node:dns and node:net and this library must run unmodified inside
-// a service worker. What IS needed on both sides is a byte budget and a reading
-// of Retry-After, so they live here in a form with no runtime of their own.
-//
-// Deliberately NOT a fetch wrapper. The library never opens a connection by
-// itself; every request goes through a transport or a fetcher the caller
-// supplies, which is what lets the same code serve an authenticated agent, a
-// keyless gateway, and a test with no network at all.
-
-// Five megabytes is what the wider project uses as a body budget, and a
-// document this library reads is a pod resource, not a stranger's timeline.
-const MAX_BYTES = 5 * 1024 * 1024;
-
-// Thirty minutes is a ceiling, not a policy: a hostile or confused header must
-// not be able to park a caller for a day. Callers that want a tighter ceiling
-// pass their own — the browser transport does.
-const COOLDOWN_MAX_MS = 30 * 60_000;
-
-/**
- * How long a server asked to be left alone, or **null** when it did not say.
- *
- * The null matters and must not become a default. The caller decides what
- * absence means: a pod falls back to a flat cooldown, while a delivery queue
- * keeps its exponential ladder — and returning a default here once collapsed
- * that ladder to a flat 60s for every 503 without the header, which is most
- * of them.
- */
-export function retryAfterMs(res, max = COOLDOWN_MAX_MS) {
-  const raw = res?.headers?.get?.('retry-after');
-  if (!raw) return null;
-  const secs = Number(raw);
-  // A floor of one second: a server answering `Retry-After: 0` is still asking
-  // for a pause, and honouring it as "none" is how a throttle becomes a spin.
-  if (Number.isFinite(secs)) return Math.min(Math.max(secs, 1) * 1000, max);
-  const when = Date.parse(raw);                       // the HTTP-date spelling
-  if (Number.isFinite(when)) return Math.min(Math.max(when - Date.now(), 1000), max);
-  return null;
-}
-
-/**
- * Read a response body with a hard byte budget.
- *
- * Checking `content-length` and then handing back `res.text()` is not a cap: a
- * chunked response carries no `content-length` at all, and an inbox listing is
- * public-Append, so its size is in other people's hands. Stream it and stop at
- * the budget.
- *
- * TextDecoder rather than Buffer — it exists in both runtimes — and
- * `stream: true` so a UTF-8 sequence split across two chunks still decodes.
- */
-export async function readCapped(res, max = MAX_BYTES) {
-  const len = Number(res.headers?.get?.('content-length') || 0);
-  if (len > max) throw new Error(`response too large (${len} bytes)`);
-  if (!res.body) return res.text();
-  const reader = res.body.getReader();
-  const decoder = new TextDecoder('utf-8');
-  let out = '';
-  let total = 0;
-  for (;;) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    total += value.length;
-    if (total > max) {
-      await reader.cancel();
-      throw new Error(`response exceeded ${max} bytes`);
-    }
-    out += decoder.decode(value, { stream: true });
-  }
-  return out + decoder.decode();
-}

package/lib/pod/inbox.mjs

@@ -1,166 +0,0 @@
-// inbox.mjs — ap/inbox/: what arrives, and who may touch it.
-//
-// One file for the whole inbox, because the inbox is where two different
-// parties meet and neither half is comprehensible alone: a delivery gateway
-// may only ADD to it, holding at most an Append token; the owner's agent
-// lists, reads and removes, holding the pod's own credential. Splitting them
-// by who does them would put the two ends of one contract in two files.
-
-const DELIVERY_CT = 'application/activity+json';
-const RECEIPT_CT = 'application/json';
-
-// ---- a delivery gateway: appends verified mail, and can do nothing else ----
-
-/**
- * PUT one document into a pod inbox, with an Append token when the caller
- * holds one and anonymously when it does not.
- *
- * Sending no `authorization` header is not the same as sending an empty one:
- * `Bearer undefined` is a credential the pod will reject, where absence is a
- * public Append the pod may well allow. This is the one place that gets to
- * decide that, because it lived in two adapters and had to be right in both.
- *
- * @returns {Promise<boolean>} whether it landed
- */
-export async function appendWithToken(url, body, contentType, { appendToken = null, fetchImpl = fetch, report = null } = {}) {
-  const headers = { 'content-type': contentType,
-    ...(appendToken ? { authorization: `Bearer ${appendToken}` } : {}) };
-  const r = await fetchImpl(url, { method: 'PUT', headers, body }).catch(() => null);
-  // The pod's answer, for a caller that keeps a log: a refused write is
-  // otherwise a bare "failed" with the status thrown away.
-  report?.(r ? r.status : 0);
-  return !!r && r.status < 400;
-}
-
-/**
- * The delivery itself, named by the hash of its own bytes.
- *
- * Content-addressed on purpose: the same activity delivered twice writes the
- * same document twice, so a retrying origin cannot produce duplicates in
- * someone's inbox.
- *
- * A failure here must reach the ORIGIN as a 5xx so it retries over its own
- * ladder — that is what preserves the pod's buffer property without the
- * gateway holding any state of its own.
- */
-export async function appendVerifiedDelivery(podPut, inboxUrl, hash, raw) {
-  return podPut(inboxUrl + hash, raw, DELIVERY_CT);
-}
-
-/**
- * The verification receipt, written beside the delivery it vouches for.
- *
- * Best-effort by design: a delivery that landed but whose receipt did not is
- * read as unverified at the drain, which is a lesser thing than losing it.
- */
-export async function writeReceiptBeside(podPut, inboxUrl, hash, receipt) {
-  await podPut(inboxUrl + hash + '.receipt.json', JSON.stringify(receipt), RECEIPT_CT)
-    .catch(() => {});
-}
-
-// ---- the owner's agent: brings it into being and decides who may post ----
-
-/**
- * The canary that makes the container exist.
- *
- * Written without an access rule of its own, because the rule that matters is
- * the container's and is stated separately — see setPosture, which a caller
- * must reach for deliberately rather than inherit by accident.
- */
-export async function writeKeep(pod, urls) {
-  await pod.putJson(urls.inbox + '.keep', { keep: true }, 'application/json');
-}
-
-/**
- * Who may deliver here.
- *
- *   'open'                 anyone may Append — an inbox the fediverse can post to
- *   'closed'               nobody may — a quiesced actor, still resolving, taking no mail
- *   { gatewayWebId }       only that WebID may — mail arrives through a door that
- *                          verifies it first, and nobody may go round the door
- *
- * One operation because the three are one decision, and they were made in five
- * places: the profile publish, three separate methods, and the manage surface
- * reaching past all of them to set the ACL directly. A posture set in one of
- * those and not the others is an inbox that is open when it should be shut.
- */
-export async function setPosture(pod, urls, posture) {
-  // Restated at every start, and most starts find it already so: the rule is
-  // read first and written only when it differs (transport.setAcl ifChanged).
-  if (posture === 'open') return pod.setAcl(urls.inbox, ['Append'], { ifChanged: true });
-  if (posture === 'closed') return pod.setAcl(urls.inbox, [], { ifChanged: true });
-  const webId = posture?.gatewayWebId;
-  if (!webId) throw new Error(`inbox.setPosture: unknown posture ${JSON.stringify(posture)}`);
-  // Public loses Append; the door keeps it. Both halves in one write, because
-  // between two writes the inbox is either open to everyone or shut to the door.
-  return pod.setAcl(urls.inbox, [], { appendAgents: [webId], ifChanged: true });
-}
-
-/**
- * What is waiting, oldest first.
- *
- * A defensive copy, because the transport hands back the SAME array on a 304
- * and the inbox is polled constantly — a caller that sorted or spliced in
- * place would corrupt the cache for every later reader.
- */
-export async function list(pod, urls) {
-  const children = await pod.listContainer(urls.inbox);
-  return children.map((c) => ({ ...c }));
-}
-
-/**
- * One item's bytes.
- *
- * A pod that would not GIVE us the item has told us nothing about it. Reading
- * a 500 as an empty body once made it "unparsable JSON" — which is a
- * REJECTION, so the delivery was dead-lettered with nothing recorded and then
- * DELETED: destroyed by a transient fault, with no trace of what it had been.
- * Anything but 404 throws, and the caller's retry path takes it. 404 is the
- * exception: the item is already gone, so removing it is right.
- *
- * Capped rather than read whole: the listing's size is advisory, the inbox is
- * public-Append, and the body is whatever a stranger chose to send.
- *
- * @returns {Promise<{status:number, raw:string|null}>}
- */
-export async function readItem(pod, url, { maxBytes, readCapped }) {
-  const res = await pod.fetch(url, { headers: { accept: '*/*' } });
-  if (res.status >= 400 && res.status !== 404) throw new Error(`inbox item GET → ${res.status}`);
-  return { status: res.status, raw: res.status < 400 ? await readCapped(res, maxBytes) : null };
-}
-
-/** The gateway's receipt for an item, unparsed and unverified, or null. */
-export async function readDeliveryReceipt(pod, itemUrl, { maxBytes, readCapped }) {
-  const res = await pod.fetch(itemUrl + '.receipt.json', { headers: { accept: 'application/json' } });
-  if (res.status >= 400) return null;
-  return JSON.parse(await readCapped(res, maxBytes));
-}
-
-/**
- * Remove an item that has been dealt with.
- *
- * This must NOT know about the caller's state: the drain deletes only after
- * its own state write has landed, and folding that gate in here would put the
- * decision somewhere with no view of whether it did. Getting that wrong
- * deletes deliveries whose record never persisted — silent, and unrecoverable.
- *
- * @returns {Promise<boolean>} whether the pod removed it
- */
-export const dropHandledItem = (pod, url) => pod.delete(url);
-
-/**
- * Remove the receipt a gateway wrote beside an item, once the item is gone.
- * Best-effort: a receipt that stays is a stray document, never a lost
- * delivery. Left behind, they were one stray per delivery, forever.
- */
-export const dropReceiptBeside = (pod, url) => pod.delete(url + '.receipt.json').catch(() => false);
-
-/**
- * Receipts whose item is no longer in the inbox, from the last listing: what
- * earlier drains left behind. The drain removes a few of these each sweep
- * until none are left.
- */
-export const orphanReceipts = (pod, urls) => pod.orphanReceipts?.(urls.inbox) ?? [];
-
-/** Remove one such stray. @returns {Promise<boolean>} whether the pod removed it */
-export const dropStrayReceipt = (pod, url) => pod.delete(url).catch(() => false);

package/lib/pod/links.mjs

@@ -1,35 +0,0 @@
-// links.mjs — reading RFC 8288 Link headers.
-//
-// Solid says where a resource's access control lives, where a storage
-// describes itself, and who owns a storage, by putting a link on the response.
-// Working any of those out from the resource's own URL instead is exactly what
-// the specs tell clients not to do, so this is the one place that reads them.
-
-/**
- * Every target a Link header gives for one relation, resolved against the URL
- * the header came from. A header may carry several links, and one link may
- * carry several relation names.
- */
-export function linkTargets(headerValue, rel, baseUrl) {
-  if (!headerValue) return [];
-  const wanted = String(rel).toLowerCase();
-  const out = [];
-  // Split on the commas BETWEEN links: one inside a URI has its closing angle
-  // bracket still ahead of it, and is left alone.
-  for (const part of String(headerValue).split(/,(?![^<]*>)/u)) {
-    const link = /^\s*<([^>]*)>\s*(.*)$/u.exec(part);
-    if (!link) continue;
-    const relParam = /(?:^|;)\s*rel\s*=\s*(?:"([^"]*)"|([^;"\s]+))/iu.exec(link[2]);
-    const names = (relParam?.[1] ?? relParam?.[2] ?? '').toLowerCase().split(/\s+/u);
-    if (!names.includes(wanted)) continue;
-    try { out.push(new URL(link[1], baseUrl).href); } catch { /* not a URL we can follow */ }
-  }
-  return out;
-}
-
-/** The relations this library follows. */
-export const REL = {
-  acl: 'acl',
-  storageDescription: 'http://www.w3.org/ns/solid/terms#storageDescription',
-  owner: 'http://www.w3.org/ns/solid/terms#owner',
-};

package/lib/pod/location.mjs

@@ -1,52 +0,0 @@
-// location.mjs — where in a pod an application's container goes.
-//
-// The container's own name is the caller's. The person says which container of
-// their pod holds it, as a path on the pod's own origin: `/` for a subdomained
-// pod, `/jeff/` for a suffixed one, or any container below either. Everything then lives under `<that><name>`, and the root kept is that
-// place relative to the pod.
-
-// The pod's own furniture: its profile, its settings, its well-known documents.
-const RESERVED = new Set(['profile', 'settings', '.well-known']);
-const SEGMENT = /^[A-Za-z0-9._-]+$/u;
-
-/** The prefilled answer: the pod's own root, as a path. */
-export function podRootPath(podBase) {
-  return new URL(podBase).pathname;
-}
-
-/**
- * The container path someone typed, checked against their pod. Returns
- * `{ root }` — the root relative to the pod, ending in `name` — or
- * `{ problem }` saying what is wrong, in words for them.
- */
-export function rootFromContainer(podBase, typed, name) {
-  const base = new URL(podBase);
-  let path = String(typed ?? '').trim() || base.pathname;
-  if (!path.startsWith('/')) path = '/' + path;
-  if (!path.endsWith('/')) path += '/';
-  if (!path.startsWith(base.pathname)) {
-    return { problem: `that is not in your pod — your pod starts at ${base.pathname}` };
-  }
-  const inside = path.slice(base.pathname.length);
-  const segments = inside.split('/').filter(Boolean);
-  if (segments.some(s => s === '.' || s === '..')) return { problem: 'a container path cannot go up with ..' };
-  if (segments.some(s => !SEGMENT.test(s))) {
-    return { problem: 'container names are letters, digits, dots, dashes and underscores' };
-  }
-  if (segments.length && RESERVED.has(segments[0])) {
-    return { problem: `${base.pathname}${segments[0]}/ belongs to your pod itself — choose another container` };
-  }
-  if (segments.length > 8) return { problem: 'that is nested too deep — eight containers at most' };
-  return { root: (segments.length ? segments.join('/') + '/' : '') + name };
-}
-
-/** Where the account lives, in full: the pod plus its root. */
-export const homeOf = (podBase, root) => podBase + root;
-
-/** The root back from a pod actor's address: `<pod><root>ap/actor`. */
-export function rootOfActor(podBase, actorUrl) {
-  const a = String(actorUrl || '');
-  if (!a.startsWith(podBase) || !a.endsWith('ap/actor')) return null;
-  const root = a.slice(podBase.length, -'ap/actor'.length);
-  return root.endsWith('/') ? root : null;
-}

package/lib/pod/media.mjs

@@ -1,27 +0,0 @@
-// media.mjs — ap/media/: the bytes an attachment points at.
-//
-// The only tree here holding things that are not documents. Public-Read,
-// because an attachment url travels inside a post to servers that will fetch
-// it without credentials — and unlike an actor or a note, nothing checks that
-// the url belongs to the identity that posted it, which is why media stays on
-// the pod even for an identity whose ids are advertised elsewhere: proxying
-// blobs would be pure cost for no verification gained.
-
-const PUBLIC_READ = ['Read'];
-
-// ---- the owner's agent ----
-
-export async function provisionContainer(pod, urls) {
-  await pod.putJson(urls.media + '.keep', { keep: true }, 'application/json');
-  await pod.setAcl(urls.media, PUBLIC_READ);
-}
-
-/**
- * One uploaded file.
- *
- * Takes the container as given: an upload into a container that was never
- * provisioned is a 404, or worse a file nobody outside can read, so the caller
- * ensures the container first — see provisionContainer, and the `exists` probe
- * in containers.mjs that keeps a worker restart from re-provisioning.
- */
-export const write = (pod, url, bytes, contentType) => pod.put(url, bytes, contentType);

package/lib/pod/notes.mjs

@@ -1,78 +0,0 @@
-// notes.mjs — ap/notes/: the posts themselves, and the two documents each one
-// drags with it.
-//
-// A published post is not one document. It is the Note, the Create activity
-// that announced it, and a replies collection remote servers will dereference
-// — and they have different lifetimes, which is the whole reason this file
-// exists. Deleting a post REPLACES the Note with a Tombstone (a peer learns
-// the post was deleted, rather than getting a bare 404 it reads as a temporary
-// failure) while DELETING the Create outright, because the Create was an
-// action that has been withdrawn rather than an object that still exists.
-//
-// The container is public-Read and the notes inherit it. The Tombstone is the
-// exception that has to state its own rule: a private post lives in a
-// different, owner-only container, so there is nothing public to inherit.
-
-const PUBLIC_READ = ['Read'];
-
-// ---- the owner's agent ----
-
-/** The notes container itself, public-Read so everything under it inherits. */
-export async function provisionContainer(pod, urls) {
-  await pod.putJson(urls.notes + '.keep', { keep: true }, 'application/json');
-  await pod.setAcl(urls.notes, PUBLIC_READ);
-}
-
-/** The Note. Inherits the container's rule; states none of its own. */
-export const write = (pod, noteId, doc) => pod.putJson(noteId, doc);
-
-/** The Create that announced it — its own document, at a derived id. */
-export const writeCreate = (pod, createId, doc) => pod.putJson(createId, doc);
-
-/**
- * An empty replies collection, written with the note.
- *
- * Remote servers dereference `replies`, and a dangling pointer that 404s is
- * worse than no pointer at all.
- */
-export const writeEmptyReplies = (pod, repliesId, doc) => pod.putJson(repliesId, doc);
-
-/** The replies collection as it stands. */
-export const readReplies = (pod, repliesId) => pod.getJson(repliesId);
-export const writeReplies = (pod, repliesId, doc) => pod.putJson(repliesId, doc);
-
-/** One published note, as the pod currently serves it. */
-export const read = (pod, noteId) => pod.getJson(noteId);
-
-/**
- * Replace a note with a Tombstone, and keep it readable.
- *
- * The Read rule is stated explicitly here even though the public container
- * grants it: a private or direct post lives in the owner-only container, and
- * its Tombstone still has to be fetchable by the servers being told about the
- * deletion.
- */
-export async function writeTombstone(pod, noteId, doc) {
-  await pod.putJson(noteId, doc);
-  await pod.setAcl(noteId, PUBLIC_READ);
-}
-
-/** The replies collection, once the note it belonged to is gone. */
-export const dropReplies = (pod, repliesId) => pod.delete(repliesId).catch(() => {});
-
-/**
- * What the container holds, with the derived documents filtered out.
- *
- * A listing returns the Note, its `-create` and its `-replies` alike; only the
- * first is a post, and handing the other two to a reader that expects posts
- * produces failures that read like corruption.
- */
-export async function list(pod, urls) {
-  const children = await pod.listContainer(urls.notes);
-  return children
-    .filter((c) => !/(-create|-replies|-delete|-update-[^/]+)$/.test(c.url) && !/\/(announce|undo)-\d+$/.test(c.url)
-      && !c.url.endsWith('.keep'))
-    // A defensive copy: the transport hands back the same array on a 304, so a
-    // caller that sorts in place would corrupt it for every later reader.
-    .map((c) => ({ ...c }));
-}

package/lib/pod/notifications.mjs

@@ -1,89 +0,0 @@
-// notifications.mjs — being told when the inbox changes, instead of asking.
-//
-// A pod that offers Solid Notifications lets a client open a socket and hear
-// about a container the moment it changes, which is the difference between
-// mail arriving and mail being noticed two minutes later. Discovering that
-// service takes two unauthenticated reads of the pod's own description, and
-// then one authenticated POST to subscribe.
-//
-// This is the ONLY module here that parses RDF itself, which is why it is its
-// own file: a service that only ever appends to an inbox can import inbox.mjs
-// without pulling a parser in behind it.
-
-import * as $rdf from 'rdflib';
-import { readCapped } from './http.mjs';
-import { linkTargets, REL } from './links.mjs';
-
-const RDF = $rdf.Namespace('http://www.w3.org/1999/02/22-rdf-syntax-ns#');
-const NOTIFY = $rdf.Namespace('http://www.w3.org/ns/solid/notifications#');
-const WS_CHANNEL = 'WebSocketChannel2023';
-
-// ---- anyone at all: a pod describes its own services publicly ----
-
-/**
- * Where this pod describes the services it offers.
- *
- * The pod says so on any response about one of its resources; the well-known
- * path is only what a pod that says nothing has always used. Unauthenticated
- * on purpose — this is a public fact about the server, asked before there is
- * anything to authenticate about.
- */
-export async function storageDescriptionUrl(podBase, { fetchImpl = fetch, headers = {}, timeoutMs = 20_000 } = {}) {
-  try {
-    const head = await fetchImpl(podBase, {
-      method: 'HEAD', headers, signal: AbortSignal.timeout(timeoutMs),
-    });
-    const [found] = linkTargets(head.headers.get('link'), REL.storageDescription, podBase);
-    if (found) return found;
-  } catch { /* the well-known path below */ }
-  return podBase + '.well-known/solid';
-}
-
-/**
- * The websocket channel service this pod offers, or null when it offers none.
- *
- * Asked of rdflib rather than pattern-matched: the description is RDF, and the
- * gap between "a string that appears in the document" and "the service this
- * pod actually advertises" is where quiet bugs live. A pod may name the type
- * on the service, or name the service's channelType — both are asked for.
- */
-export async function readWebSocketChannel(descUrl, { fetchImpl = fetch, headers = {}, timeoutMs = 20_000 } = {}) {
-  const res = await fetchImpl(descUrl, {
-    headers: { accept: 'text/turtle', ...headers },
-    signal: AbortSignal.timeout(timeoutMs),
-  });
-  const g = $rdf.graph();
-  try {
-    $rdf.parse(await readCapped(res), g, descUrl, 'text/turtle');
-  } catch (e) {
-    return { channel: null, error: `service description unparsable (${e.message})` };
-  }
-  const channel = g.each(null, RDF('type'), NOTIFY(WS_CHANNEL), null).map((n) => n.value).find(Boolean)
-    || g.each(null, NOTIFY('channelType'), NOTIFY(WS_CHANNEL), null).map((n) => n.value).find(Boolean);
-  return { channel: channel || null, error: channel ? null : `no ${WS_CHANNEL} service` };
-}
-
-// ---- the owner's agent ----
-
-/**
- * Subscribe to changes on the inbox.
- *
- * `podTopicUrl` is POD-SPACE, and the parameter is named that way because
- * getting it wrong fails in a way nothing else here does: the topic travels in
- * the BODY, so the advertised-to-pod url map a transport applies to the
- * request LINE never reaches it. An identity whose ids are advertised
- * elsewhere would name a container the pod cannot grant read on, and the
- * subscription comes back 403.
- */
-export async function subscribeToInbox(pod, { channelUrl, podTopicUrl, ...rest }) {
-  return pod.fetch(channelUrl, {
-    method: 'POST',
-    headers: { 'content-type': 'application/ld+json' },
-    body: JSON.stringify({
-      '@context': ['https://www.w3.org/ns/solid/notification/v1'],
-      type: `http://www.w3.org/ns/solid/notifications#${WS_CHANNEL}`,
-      topic: podTopicUrl,
-      ...rest,
-    }),
-  });
-}

package/lib/pod/outbox.mjs

@@ -1,18 +0,0 @@
-// outbox.mjs — ap/outbox: everything this actor has published, paged.
-//
-// Public by definition, and read by strangers rather than by us: a remote
-// server walks it to backfill an account it has just met. It is also what a
-// rebuild reads to recover posts a lost machine no longer has, which is why
-// readPublished tolerates the flat shape this project used to write.
-
-import * as collection from './collection.mjs';
-
-// ---- the owner's agent ----
-
-export const writePage = (pod, pageUrl, doc, opts) => collection.writePage(pod, pageUrl, doc, opts);
-export const writeHead = (pod, urls, doc, opts) => collection.writeHead(pod, urls.outbox, doc, opts);
-export const dropPage = (pod, pageUrl) => collection.dropPage(pod, pageUrl);
-
-/** Every activity the pod currently publishes, or null if it publishes none. */
-export const readPublished = (pod, urls) =>
-  collection.readPaged(pod, urls.outbox, { max: 10_000 });

package/lib/pod/package.json

@@ -1,19 +0,0 @@
-{
-  "name": "solid-ap-pod",
-  "version": "0.1.0",
-  "description": "Read and write an ActivityPub actor's documents on a Solid pod: the container layout, an injected-session transport, WAC access control, and one module per pod resource.",
-  "type": "module",
-  "license": "MIT",
-  "exports": {
-    "./urls.mjs": "./urls.mjs",
-    "./transport.mjs": "./transport.mjs",
-    "./http.mjs": "./http.mjs",
-    "./links.mjs": "./links.mjs"
-  },
-  "dependencies": {
-    "rdflib": "^2.4.0"
-  },
-  "engines": {
-    "node": ">=20"
-  }
-}