fedipod 0.18.0 → 0.19.0

package/README.md

@@ -74,6 +74,20 @@ keyword filters, scheduled posts, pinned posts (visible from other servers),
 blocking and muting from the client, custom emojis, and web-push
 notifications that reach you while the client is closed.
 
+<!-- CLAUDE 2026-09-09 — the browser build does not have three of the things
+     this paragraph promises, and it says so honestly now rather than
+     advertising them. Written as a first draft in your voice; rework or move
+     it wherever you think it belongs. Delete these markers when done. -->
+Two of those are the installed agent only. **Scheduled posts** need something
+running between now and the time you picked, and in the browser build nothing
+is — so it refuses a scheduled post rather than accepting one it would silently
+drop. **Web-push notifications** likewise: the browser build has no push
+service behind it, so it does not advertise one and your client hides the
+toggle instead of showing one that does nothing. Both work on the installed
+agent. **Custom emojis** you receive are rendered everywhere; the picker for
+sending your own is not built yet, on either.
+<!-- /CLAUDE -->
+
 Polls: up to four options, one answer or several, running from five minutes to
 a month.
 
@@ -85,6 +99,12 @@ a month.
   custom instance.
 - **Streaming**: the agent serves the Mastodon streaming API
   (`/api/v1/streaming`, WebSocket) so clients update live instead of polling.
+  <!-- CLAUDE 2026-09-09 — true of the installed agent; the browser build is a
+       service worker and cannot hold a socket. It advertises no streaming URL,
+       so clients fall back to polling on their own. Delete markers when done. -->
+  The browser build cannot: a service worker answers fetches, not sockets, so it
+  advertises no streaming URL and clients poll instead.
+  <!-- /CLAUDE -->
 
 ## Bluesky and ATProto
 

package/bin/fedipod.mjs

@@ -964,13 +964,12 @@ if (cmd === 'up') {
   let copied;
   try {
     copied = await copyPrivateHalf({
-      from: { state: agent.privateStorage(cred, 'state'), fediverse: agent.privateStorage(cred, 'fediverse') },
-      to: { state: agent.privateStorage(destCred, 'state'), fediverse: agent.privateStorage(destCred, 'fediverse') },
+      from: { state: agent.privateStorage(cred, 'state') },
+      to: { state: agent.privateStorage(destCred, 'state') },
       log: (...a) => console.log('[state]', ...a),
     });
   } catch (e) { console.error(e.message); process.exit(1); }
   console.log(`copied ${copied.docs} state document(s)`);
-  console.log(`copied ${copied.notes} note(s)`);
 
   // An empty source produces an empty destination, and every check above
   // passes: nothing failed to land because nothing was sent. The command then
@@ -2071,8 +2070,7 @@ WantedBy=default.target
     if (res.status >= 400) { console.error(body.error || `HTTP ${res.status}`); process.exit(1); }
     if (body.why) { console.error(body.why); process.exit(1); }
     console.log(`the pod indexed ${body.indexed} post(s); recovered ${body.recovered}`
-      + `${body.reblogs ? `, and marked ${body.reblogs} of them boosted` : ''}`
-      + `${body.rdf ? ` (${body.rdf} written back to the RDF)` : ''}`);
+      + `${body.reblogs ? `, and marked ${body.reblogs} of them boosted` : ''}`);
     if (body.dropped) console.log(`${body.dropped} fell past the 1000-status cap`);
     if (!body.landed) { console.error('the state write did NOT land — nothing is saved'); process.exit(1); }
     if (!body.recovered && !has('from-notes')) {

package/cli.md

@@ -70,6 +70,19 @@ fedipod revoke-credential --email EMAIL  # cut this machine off from the pod acc
 ```
 A new password takes effect when a running agent restarts.
 
+<!-- CLAUDE 2026-09-09 — `passwd` stopped being optional for one case, and a
+     user who hits it will want to know why here. First draft in your voice;
+     delete these markers when done. -->
+**A client hosted somewhere else now needs one.** A client running on its own
+site (Elk, Phanpy on someone's own domain) asks the agent to send the sign-in
+result back to that site. Without a password there is nothing to approve that
+with — and the agent used to do it anyway, which meant any page you happened
+to have open could ask for the same thing and be given a key to your account.
+So: no password, no sending credentials off this machine. Clients that live on
+the agent itself (the bundled one, a dist in `ui/`, anything on
+`https://localhost:<port>`) are unaffected and need no password.
+<!-- /CLAUDE -->
+
 ## Bluesky
 
 ```

package/groups.md

@@ -14,6 +14,17 @@ and pick group rather than person, or take the group path on a signup page.
 You can turn on join review as you create it. The group's pod must be the root
 of its own host, so its handle resolves.
 
+<!-- CLAUDE 2026-09-09 — nothing anywhere said this, and a browser user who
+     went looking for the group option would just not have found it. First
+     draft in your voice; move or reword as you like. Delete markers when done. -->
+**Running a group needs the installed agent.** The in-browser build makes
+personal identities only — the sign-up wizard has no group option, and the
+moderation surface (join review, members, muting, the moderation queue) is not
+part of that build. You can *join* a group from the browser exactly as from
+anywhere else: joining is following, and that works everywhere. It is hosting
+one that needs an install.
+<!-- /CLAUDE -->
+
 Being in a group also connects you to the people in it: posts from fellow
 members reach your timeline even when you do not follow them individually,
 so a reply in the room is something you see rather than something filed

package/gui.md

@@ -91,7 +91,15 @@ is marked **sign in again** rather than quietly dropped.
 ## Handling follow requests
 
 New followers appear under **Follow requests** with **Accept** and **Refuse**
-beside them; nothing is accepted without you. Groups are different — joining
+beside them; nothing is accepted without you.
+<!-- CLAUDE 2026-09-09 — these were visible on this page and NOWHERE else
+     until today: the client API stubbed the list empty and offered no way to
+     answer one, so no Mastodon client could show them. Delete markers when
+     read. -->
+They show in any Mastodon client as well, now that the client API serves the
+queue and takes both answers — before this they were visible on this page
+alone.
+<!-- /CLAUDE --> Groups are different — joining
 follows the group's own moderation settings; see [Groups](groups.md).
 
 **Accept all** answers the whole queue at once, and the identity pane's
@@ -123,6 +131,12 @@ account*); your followers arrive by themselves. Removing an alias asks
 twice — servers still processing the move check it while they retry. The CSV
 files from the old server's export are imported with the CLI; see
 [CLI admin](cli.md).
+<!-- CLAUDE 2026-09-09 — the browser build runs the same importer now, so
+     "with the CLI" is no longer the whole story. Reword as you like; delete
+     these markers when done. -->
+The in-browser build runs the same importer, so a CSV can be handed to it
+there too.
+<!-- /CLAUDE -->
 
 ## Protecting & recovering your data
 

package/lib/admin.mjs

@@ -1379,15 +1379,15 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
             await agent.store.flush();
             const destCred = { ...cred, privateRoot: target };
             const copied = await copyPrivateHalf({
-              from: { state: agent.privateStorage(cred, 'state'), fediverse: agent.privateStorage(cred, 'fediverse') },
-              to: { state: agent.privateStorage(destCred, 'state'), fediverse: agent.privateStorage(destCred, 'fediverse') },
+              from: { state: agent.privateStorage(cred, 'state') },
+              to: { state: agent.privateStorage(destCred, 'state') },
               log,
             });
             if (target) cred.privateRoot = target; else delete cred.privateRoot;
             if (isCurrent(cred)) cred.layout = CURRENT_LAYOUT; else delete cred.layout;
             writeJsonAtomic(path.join(agent.home, 'credential.json'), cred);
             // connect() rebuilds everything that pointed at the old location —
-            // store, RDF tree, publisher, intake — and restarts them.
+            // store, publisher, intake — and restarts them.
             agent.store.attach(agent.privateStorage(cred, 'state'));
             agent.stateLoaded = false;
             await agent.connect();

package/lib/deliver.mjs

@@ -107,6 +107,12 @@ export class Deliverer {
         current = new URL(res.headers.get('location'), current).href;
         continue;
       }
+      // Where this ended up, which is not always where it was asked to go.
+      // Callers compare the document's own id against the URL they REQUESTED,
+      // so without this an open redirector on a victim's origin let an
+      // attacker's server answer for a victim's URL and be believed.
+      try { Object.defineProperty(res, 'finalUrl', { value: current, configurable: true }); }
+      catch { /* a frozen Response: the caller falls back to the requested URL */ }
       return res;
     }
     throw new Error(`too many redirects from ${url}`);

package/lib/export-collections.mjs

@@ -10,7 +10,7 @@
 // DMs, pins and standalone note documents have no place in that layout and
 // are not carried.
 //
-// Serialised by rdflib, never by hand — the podrdf.mjs rule.
+// Serialised by rdflib, never by hand.
 
 import * as $rdf from 'rdflib';
 

package/lib/front-core.mjs

@@ -17,8 +17,9 @@
 
 import crypto from 'node:crypto';
 import { handleDelivery } from './gateway-core.mjs';
-import { readCapped } from './safefetch.mjs';
-import { linkTargets, REL } from './links.mjs';
+import { readCapped, safeFetch, isLoopbackHost } from './safefetch.mjs';
+import * as podRoot from './pod/root.mjs';
+import * as podPolicy from './pod/policy.mjs';
 
 // The one WebFinger document, spelled out here rather than imported from
 // wire.mjs: wire drags the agent's whole HTML pipeline (sanitize-html and
@@ -58,25 +59,122 @@ const OWNER_LOOKUP_MS = 5_000;
  * authority on that, so when it answers, its answer decides. A server that
  * says nothing leaves where the WebID lives as the only evidence there is.
  */
-async function podOwners(podBase, fetchImpl = fetch) {
-  try {
-    const res = await fetchImpl(podBase, {
-      method: 'HEAD', signal: AbortSignal.timeout(OWNER_LOOKUP_MS),
-    });
-    return linkTargets(res?.headers?.get?.('link'), REL.owner, podBase);
-  } catch { return []; }
-}
+const podOwners = (podBase, fetchImpl = fetch) =>
+  podRoot.readOwnerLinks(fetchImpl, podBase, { timeoutMs: OWNER_LOOKUP_MS });
 
+// Whether a token's WebID vouches for this pod, on the evidence of where it
+// lives. Weak on purpose, and never used alone any more — see provesPod.
 function webidUnderPod(webid, podHome) {
   try { return new URL(webid).origin === new URL(podHome).origin; } catch { return false; }
 }
 
+/**
+ * Whether this WebID may speak for this pod.
+ *
+ * Sharing an origin was the whole test, which is right where an origin is one
+ * person (a subdomain pod) and wrong where it is not. On a path-based server
+ * every account is on the same origin, so any account holder could attach
+ * somebody else's pod under a name of their choosing — and, worse, re-attach a
+ * name that already existed and be handed its receipt secret (S7).
+ *
+ * The pod server is the authority on who owns the pod, and it will say so in a
+ * `solid:owner` link if asked. When it answers, its answer decides. Only when
+ * it says nothing does this fall back to where the WebID lives, which is the
+ * best a silent server leaves available. This is the rule /api/agent's opt-in
+ * has used all along; attach simply never asked.
+ */
+async function provesPod(webid, podHome, fetchImpl) {
+  const owners = await podOwners(podHome, fetchImpl || fetch);
+  if (owners.length) return owners.includes(webid);
+  return webidUnderPod(webid, podHome);
+}
+
+// A pod this front will read from at all.
+//
+// The front reads `rec.podHome + <the rest of the request path>` and, on the
+// CSS server component, that read goes straight into the resource store with
+// no access control of its own — so a row whose podHome names the FRONT is a
+// row that can read the server's own internals, `/.internal/fedipod/directory/`
+// included, where every user's receipt secret is kept (S2). The front is not a
+// pod and never was one; saying so outright is the fix, and it closes the
+// self-recursion of S8 with the same line.
+function podHomeProblem(podHome, frontOrigin) {
+  let u;
+  try { u = new URL(podHome); } catch { return 'podHome is not a URL'; }
+  if (frontOrigin) {
+    try {
+      if (u.origin === new URL(frontOrigin).origin) {
+        return 'a pod cannot live on this gateway — name the pod that holds your data';
+      }
+    } catch { /* no usable frontOrigin: the other checks still apply */ }
+  }
+  // Nothing may reach a server's private trees, whatever origin they are on.
+  if (/(^|\/)\.internal(\/|$)/u.test(u.pathname) || /(^|\/)\.\.(\/|$)/u.test(u.pathname)) {
+    return 'that is not a pod address';
+  }
+  return null;
+}
+
+const RELAY_MAX_REQUESTS = 20;
+const RELAY_MAX_BODY = 1024 * 1024;
+const RELAY_TIMEOUT_MS = 8_000;
+// The only headers a relayed request may carry to the remote server. Host
+// comes from the URL; the user agent from safeFetch.
+const RELAY_HEADERS = new Set(['date', 'digest', 'signature', 'content-type', 'accept']);
+
+const keyIdOf = (signature) => (/keyId="([^"]+)"/.exec(signature || '') || [])[1] || null;
+
+async function relayOne(item, rec, fetchImpl) {
+  const url = String(item?.url || '');
+  const method = String(item?.method || 'POST').toUpperCase();
+  if (method !== 'GET' && method !== 'POST') return { url, status: 0, error: 'method must be GET or POST' };
+  let u;
+  try { u = new URL(url); } catch { return { url, status: 0, error: 'not a URL' }; }
+  if (u.protocol !== 'https:' && !(u.protocol === 'http:' && process.env.AP_ALLOW_PRIVATE_TARGETS === '1')) {
+    return { url, status: 0, error: 'https only' };
+  }
+  const headers = {};
+  for (const [k, v] of Object.entries(item?.headers || {})) {
+    const name = k.toLowerCase();
+    if (RELAY_HEADERS.has(name) && typeof v === 'string') headers[name] = v;
+  }
+  const body = method === 'POST' ? String(item?.body ?? '') : undefined;
+  if (body !== undefined && Buffer.byteLength(body) > RELAY_MAX_BODY) return { url, status: 0, error: 'body too large' };
+  const keyId = keyIdOf(headers.signature);
+  if (method === 'POST' && !keyId) return { url, status: 0, error: 'a delivery must be signed' };
+  if (keyId && !keyId.startsWith(rec.actorUrl + '#')) return { url, status: 0, error: "signed with a key that is not this account's" };
+  if (headers.digest) {
+    const want = 'SHA-256=' + crypto.createHash('sha256').update(body || '').digest('base64');
+    if (headers.digest !== want) return { url, status: 0, error: 'digest does not match the body' };
+  }
+  try {
+    const res = await safeFetch(url, { method, headers, body, signal: AbortSignal.timeout(RELAY_TIMEOUT_MS) }, fetchImpl);
+    const out = { url, status: res.status };
+    // The far server asking to be left alone has to reach the agent that will
+    // do the asking again. Without this the browser build could not honour a
+    // Retry-After at all — every delivery it makes goes through here — and fell
+    // back to its own ladder against a server that had already said how long.
+    const retryAfter = res.headers.get('retry-after');
+    if (retryAfter) out.retryAfter = retryAfter;
+    if (method === 'GET') {
+      out.contentType = res.headers.get('content-type') || null;
+      out.body = await readCapped(res, RELAY_MAX_BODY);
+    }
+    return out;
+  } catch (e) { return { url, status: 0, error: e.message }; }
+}
+
 const j = (status, obj, ct = 'application/json') =>
   ({ status, headers: { 'content-type': ct, 'cache-control': 'no-store' }, body: JSON.stringify(obj) });
 const notFound = () => ({ status: 404, headers: { 'content-type': 'text/plain' }, body: 'not found\n' });
 
 // A user's public base on the front, a 1:1 mirror of their pod home.
-export const userBase = (frontOrigin, handle) => `${frontOrigin}/u/${handle}/`;
+// The directory key is the FULL fediverse address — handle@host — never the
+// bare handle, which is not unique: two different pods can each have a "me".
+// A fronted identity answers at this front's host; a mail-door identity at its
+// own pod's host. The `/u/` path segment carries that same key.
+export const addressKey = (handle, host) => `${handle}@${host}`;
+export const userBase = (frontOrigin, key) => `${frontOrigin}/u/${encodeURIComponent(key)}/`;
 
 // Rewrite every occurrence of the pod home to the front base (or back). The
 // bodies are JSON, so a whole-string swap rewrites ids wherever they appear —
@@ -90,7 +188,7 @@ function parseUserPath(pathname) {
 }
 
 // Top-level paths a handle may not take, so a name never shadows a route.
-const RESERVED = new Set(['u', 'api', 'signup', 'new-account', 'run', 'admin', 'gateway',
+const RESERVED = new Set(['u', 'api', 'signup', 'new-account', 'run', 'admin', 'roster', 'gateway',
   'gw', 'well-known', 'inbox', 'outbox', 'actor', 'install']);
 
 // Why a handle is unusable, or null when it is fine. Lowercase letters, digits
@@ -114,19 +212,12 @@ function handleProblem(h) {
 const POLICY_TTL_MS = 5 * 60_000;
 const policyCache = new Map();              // podHome -> { at, policy }
 
-async function policyFor(rec, fetchImpl = fetch) {
-  const key = rec.podHome;
-  const hit = policyCache.get(key);
-  if (hit && Date.now() - hit.at < POLICY_TTL_MS) return hit.policy;
-  let policy = null;
-  try {
-    const res = await fetchImpl(rec.podHome + 'ap/gateway-policy.json',
-      { headers: { accept: 'application/json' } });
-    if (res && res.status < 400) policy = JSON.parse(await readCapped(res, 256 * 1024));
-  } catch { /* unpublished or unreachable: the row's own fields stand */ }
-  policyCache.set(key, { at: Date.now(), policy });
-  return policy;
-}
+// The cache is OURS, not the library's: on a warm serverless container one Map
+// is shared across every user this front serves, so what it is keyed by is a
+// correctness property. Keyed by podHome, it is one person's policy under one
+// person's key.
+const policyFor = (rec, fetchImpl = fetch) =>
+  podPolicy.read(fetchImpl, rec.podHome, { cache: policyCache, ttlMs: POLICY_TTL_MS });
 
 // The verified-delivery identity for a directory record: what gateway-core
 // needs to check what concerns the user and to append to their pod inbox.
@@ -152,8 +243,61 @@ function identFor(rec, policy = null) {
 //   listDirectory() -> { handle: record }  every row, for the admin roster
 //   removeDirectory(handle) -> boolean     drop a row; false when a seeded row remains
 //   podPut(url, body, ct) -> boolean      append to a user's pod (per-user cred inside)
-//   podGet(url) -> Response                read a user's pod (public reads; plain fetch is fine)
+//   podGet(url, { podHome }) -> Response   read a user's pod (public reads; plain fetch
+//                                          is fine). `podHome` is the row's own pod, for
+//                                          an adapter that reads a store directly and so
+//                                          must confine the read itself.
 export async function routeFront(request, ctx) {
+  const out = await route(request, ctx);
+  return { ...out, headers: withSecurityHeaders(out.headers, out.body) };
+}
+
+// Every response this file makes, hardened in one place rather than in each of
+// the dozen shapes below.
+//
+// `nosniff` matters most: the front serves user-supplied JSON straight from
+// somebody's pod (the proxied actor and object documents), and without it a
+// browser is free to decide for itself that a document is HTML and run what is
+// inside it. The rest is the same posture the app already has — nothing may be
+// framed, no base tag may be rewritten, no plugin content.
+//
+// A content-security-policy goes on the HTML only: it would mean nothing on a
+// JSON document, and `frame-ancestors` has to be a header rather than a meta
+// tag anyway.
+//
+// `script-src 'self'` is the one that matters, and it is only possible because
+// none of these pages carries inline script any more — each has its own file and
+// its own route above. A policy cannot tell an inline block the author wrote
+// from one an attacker injected, so as long as any inline script has to run,
+// every inline script may.
+//
+// `connect-src` allows https: because the pages sign in against the user's own
+// pod, which is a different origin by definition and not one we can name here.
+function withSecurityHeaders(headers = {}, body = null) {
+  const ct = String(headers['content-type'] || '');
+  const isHtml = ct.startsWith('text/html');
+  return {
+    ...headers,
+    'x-content-type-options': 'nosniff',
+    'referrer-policy': 'same-origin',
+    'x-frame-options': 'SAMEORIGIN',
+    ...(isHtml && body ? {
+      'content-security-policy': [
+        "default-src 'self'",
+        "script-src 'self'",             // no inline script: see above
+        "style-src 'self' 'unsafe-inline'",
+        "img-src 'self' https: data:",
+        "connect-src 'self' https:",     // sign-in goes to the user's own pod
+        "object-src 'none'",             // no plugin content, ever
+        "base-uri 'none'",               // no rewriting where relative URLs resolve
+        "frame-ancestors 'self'",        // nobody else may frame these pages
+        "form-action 'self'",            // a form here submits here
+      ].join('; '),
+    } : {}),
+  };
+}
+
+async function route(request, ctx) {
   const url = new URL(request.url);
   const { pathname } = url;
 
@@ -176,9 +320,10 @@ export async function routeFront(request, ctx) {
     return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' }, body: ctx.runPage };
   }
 
-  // The admin page: the host reading who has accounts here. The page signs in
+  // The roster page: the host reading who has accounts here. The page signs in
   // and calls the roster API below; a deploy with no admin supplies no page.
-  if (pathname === '/admin') {
+  // Off /admin, which is the owner's own record page on every agent.
+  if (pathname === '/roster') {
     if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
     if (!ctx.adminPage) return notFound();
     return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' }, body: ctx.adminPage };
@@ -197,9 +342,9 @@ export async function routeFront(request, ctx) {
       .map((r) => ({
         handle: r.handle, kind: r.kind || 'person', fronted: !r.inboxOnly,
         podHome: r.podHome, webId: r.webId || null, actorUrl: r.actorUrl,
-        address: `@${r.handle}@${ctx.host}`,
+        address: r.address || `@${r.handle}@${ctx.host}`,
       }))
-      .sort((a, b) => a.handle.localeCompare(b.handle));
+      .sort((a, b) => (a.address || a.handle).localeCompare(b.address || b.handle));
     return j(200, { host: ctx.host, accounts });
   }
 
@@ -213,11 +358,13 @@ export async function routeFront(request, ctx) {
     if (webid !== ctx.adminWebId) return j(403, { error: 'that WebID is not the admin of this front' });
     let body;
     try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
-    const handle = String(body.handle || '').toLowerCase();
-    if (!(await ctx.lookup(handle))) return j(404, { error: 'no such account' });
-    const removed = (await ctx.removeDirectory(handle)) === true;
-    return j(200, removed ? { handle, removed }
-      : { handle, removed: false,
+    // Revoke by full address (what the roster lists); a bare handle still works
+    // for any legacy row keyed that way.
+    const key = String(body.address || body.handle || '').replace(/^@/, '').toLowerCase();
+    if (!key || !(await ctx.lookup(key))) return j(404, { error: 'no such account' });
+    const removed = (await ctx.removeDirectory(key)) === true;
+    return j(200, removed ? { account: key, removed }
+      : { account: key, removed: false,
           reason: 'this row is seeded in the deploy environment (FEDIPOD_DIRECTORY_JSON) — remove it there and redeploy' });
   }
 
@@ -247,38 +394,94 @@ export async function routeFront(request, ctx) {
     const podHome = String(body.podHome || '');
     const problem = handleProblem(handle);
     if (problem) return j(400, { error: problem });
-    if (!/^https:\/\/\S+\/$/.test(podHome)) return j(400, { error: 'podHome must be an https URL ending in /' });
-    if (await ctx.lookup(handle)) return j(409, { error: 'that name is taken' });
+    const podLoopback = (() => { try { return isLoopbackHost(new URL(podHome).hostname); } catch { return false; } })();
+    if (!(/^https:\/\/\S+\/$/.test(podHome) || (/^http:\/\/\S+\/$/.test(podHome) && podLoopback))) {
+      return j(400, { error: 'podHome must be an https URL ending in /' });
+    }
+    const badPod = podHomeProblem(podHome, ctx.frontOrigin);
+    if (badPod) return j(400, { error: badPod });
     const webid = await verifyPodToken(request, pathname, ctx.verifier);
     if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
-    if (!webidUnderPod(webid, podHome)) {
+    if (!await provesPod(webid, podHome, ctx.fetchImpl)) {
       return j(403, { error: 'the token proves a different pod than the one you listed' });
     }
     // The usual attachment keeps the user's identity on their pod and moves
     // only the mail door here (@me@mypod). Fronted identity — actor ids on
     // this domain — remains available to an explicit `fronted: true`.
     const fronted = body.fronted === true;
-    const actorUrl = fronted ? `${ctx.frontOrigin}/u/${handle}/ap/actor` : podHome + 'ap/actor';
-    const hmacSecret = crypto.randomBytes(32).toString('base64');
+    // The full address is the key: a fronted name answers at this front's host,
+    // a mail-door name at its pod's host. The same handle on two pods is two
+    // distinct addresses, so it never collides.
+    let addressHost; try { addressHost = fronted ? ctx.host : new URL(podHome).host; } catch { return j(400, { error: 'bad podHome' }); }
+    // A fronted name answers at this front's host, where the handle alone is the
+    // whole address and is unique — so it keeps keying by bare handle (and its
+    // actor id stays /u/<handle>/, unchanged for existing accounts). A mail-door
+    // name answers at its own pod, where "me" is not unique, so it keys by the
+    // full address handle@podhost, which the /u/ segment then carries.
+    const key = fronted ? handle : addressKey(handle, addressHost);
+    const address = `@${handle}@${addressHost}`;
+    // "Taken" only when this exact address already belongs to a DIFFERENT pod.
+    // Re-attaching your own pod — a retry, a re-provision, a second browser — is
+    // idempotent: it updates the row in place and keeps the same door secret.
+    const prior = await ctx.lookup(key);
+    if (prior && prior.podHome !== podHome) return j(409, { error: 'that name is taken' });
+    // Re-attaching is idempotent — a retry, a re-provision, a second browser —
+    // and it hands back the EXISTING receipt secret. So it has to be the same
+    // person: matching podHome was enough on a subdomain server and, on a
+    // path-based one, meant any co-tenant could re-attach your row, flip its
+    // kind, and be given your secret (S7). A row that predates `webId` has
+    // nothing to compare and falls back to the pod check above.
+    if (prior?.webId && prior.webId !== webid) {
+      return j(409, { error: 'that name belongs to a different account on this pod' });
+    }
+    // The pod's actor lives under its AP root container, which the pod owner
+    // knows and the front does not — so take the caller's actorUrl when it is on
+    // this pod, and fall back only when none is given.
+    const claimedActor = typeof body.actorUrl === 'string' && body.actorUrl.startsWith(podHome) ? body.actorUrl : null;
+    const actorUrl = fronted ? `${userBase(ctx.frontOrigin, key)}ap/actor` : (claimedActor || podHome + 'ap/actor');
+    const hmacSecret = prior?.hmacSecret || crypto.randomBytes(32).toString('base64');
     const record = {
-      handle, podHome, webId: webid, actorUrl,
+      handle, address, podHome, webId: webid, actorUrl,
       kind: body.kind === 'group' ? 'group' : 'person',
       gatewayWebId: ctx.gatewayWebId || null, hmacSecret,
       ...(fronted ? {} : { inboxOnly: true }),
     };
-    await ctx.putDirectory(handle, record);
+    await ctx.putDirectory(key, record);
     // The secret is returned ONCE, with the one command the user runs to
     // point their agent at this gateway.
-    const doorInbox = `${ctx.frontOrigin}/u/${handle}/ap/inbox/`;
+    const doorInbox = `${userBase(ctx.frontOrigin, key)}ap/inbox/`;
     if (fronted) {
-      return j(201, { ok: true, handle, actorUrl, frontActor: actorUrl, hmacSecret,
-        address: `@${handle}@${ctx.host}`,
+      return j(201, { ok: true, handle, address, actorUrl, frontActor: actorUrl, hmacSecret,
         command: `fedipod gateway ${actorUrl} --secret ${hmacSecret}` });
     }
-    return j(201, { ok: true, handle, doorInbox, hmacSecret,
+    return j(201, { ok: true, handle, address, doorInbox, hmacSecret,
       command: `fedipod gateway ${doorInbox} --secret ${hmacSecret} --inbox-only` });
   }
 
+  // The relay: the front sends requests a browser has already signed. A page
+  // may not set the Date or Host header, and both are inside an HTTP
+  // signature, so a browser-run agent signs and hands the request here; the
+  // front sends it with exactly the headers that were signed. It can forward
+  // a signature and cannot make one. Only the account's own key may sign,
+  // only the account's own pod may call, and nothing unsigned-for reaches
+  // the remote server.
+  if (pathname === '/api/relay' && request.method === 'POST') {
+    let body;
+    try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+    const handle = String(body.handle || '').toLowerCase();
+    const rec = await ctx.lookup(handle);
+    if (!rec) return j(404, { error: 'no such account' });
+    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
+    const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
+    if (!owner) return j(403, { error: "the token proves a different pod than this account's" });
+    const items = Array.isArray(body.requests) ? body.requests : [];
+    if (!items.length) return j(400, { error: 'requests must be a non-empty list' });
+    if (items.length > RELAY_MAX_REQUESTS) return j(400, { error: `at most ${RELAY_MAX_REQUESTS} requests per call` });
+    const results = await Promise.all(items.map((it) => relayOne(it, rec, ctx.fetchImpl || fetch)));
+    return j(200, { results });
+  }
+
   // Runtime opt-in: a pod owner asks the server this front sits on to RUN
   // their identity. Same proof as attach — a Solid-OIDC token — but the
   // ownership check is stricter: the WebID must live UNDER the pod base, not
@@ -327,6 +530,20 @@ export async function routeFront(request, ctx) {
     return j(400, { error: 'action must be opt-in or opt-out' });
   }
 
+  // Each page's own script. They were inline until 2026-09-09; out here the
+  // pages can be served under `script-src 'self'`, which is the directive that
+  // tells running code from injected markup — and inline script defeats it by
+  // construction. Same mechanism the vendored library below has always used.
+  //
+  // The name is matched against a literal list, so nothing about the request
+  // chooses a file.
+  const mPageScript = /^\/(new-account|run|admin)\.js$/u.exec(pathname);
+  if (mPageScript) {
+    const body = ctx.pageScripts?.[`${mPageScript[1]}.js`];
+    if (!body) return notFound();
+    return { status: 200, headers: { 'content-type': 'text/javascript; charset=utf-8' }, body };
+  }
+
   // The vendored Solid-OIDC browser library the /run and /admin pages load —
   // served here because this function owns every path on the domain.
   if (pathname === '/solid-oidc-client.js') {
@@ -373,9 +590,15 @@ export async function routeFront(request, ctx) {
   // fixed to the front so a consumer cross-checks it consistently.
   if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
   const podTarget = rec.podHome + up.rest;
-  const res = await (ctx.podGet ? ctx.podGet(podTarget) : fetch(podTarget, { headers: { accept: AP_CT } }));
-  if (!res || res.status >= 400) return { status: res?.status || 502, headers: {}, body: '' };
-  let text = await readCapped(res, 1024 * 1024);
+  // The pod this read belongs to travels with it: an adapter reading a store
+  // directly (the CSS server component) has no access control of its own and
+  // needs to be told what it may reach. See podHomeProblem above for the other
+  // half — a row that names something which is not a pod.
+  const got = await podRoot.readPublicDocument(
+    ctx.podGet || ((u) => fetch(u, { headers: { accept: AP_CT } })),
+    podTarget, { podHome: rec.podHome });
+  if (got.text === null) return { status: got.status, headers: {}, body: '' };
+  let text = got.text;
   text = swap(text, rec.podHome, base);
   if (up.rest === 'ap/actor') {
     try {

package/lib/gateway-core.mjs

@@ -14,6 +14,7 @@
 
 import crypto from 'node:crypto';
 import { verifyHttpSignature, makeSafeLoader, makeReceipt, signReceipt } from './httpsig.mjs';
+import * as inbox from './pod/inbox.mjs';
 
 const DEFAULT_MAX_BYTES = 512 * 1024;   // mirror intake.mjs MAX_ITEM_BYTES
 
@@ -100,17 +101,12 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
     ? signReceipt(makeReceipt(v, { gateway: ident.gatewayWebId }), ident.hmacSecret)
     : null;
   const hash = sha256hex(raw);
-  const okA = await podPut(ident.inboxUrl + hash, raw, 'application/activity+json');
+  const okA = await inbox.appendVerifiedDelivery(podPut, ident.inboxUrl, hash, raw);
   // A pod-write failure returns 5xx so the ORIGIN retries over its own ladder —
   // that is what preserves the pod's buffer property without the gateway
   // holding any state.
   if (!okA) return { status: 502, reason: 'pod inbox write failed' };
-  // The receipt is best-effort, like _archive: a delivery that landed but whose
-  // receipt did not is simply unverified, never lost.
-  if (receipt) {
-    await podPut(ident.inboxUrl + hash + '.receipt.json', JSON.stringify(receipt), 'application/json')
-      .catch(() => {});
-  }
+  if (receipt) await inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt);
   return { status: 202, reason: v.verified ? 'verified' : 'buffered-unverified' };
 }