fedipod 0.18.0 → 0.19.0

package/lib/wire.mjs

@@ -6,75 +6,40 @@ export const AS_CTX = 'https://www.w3.org/ns/activitystreams';
 export const SEC_CTX = 'https://w3id.org/security/v1';
 export const PUBLIC = 'https://www.w3.org/ns/activitystreams#Public';
 
-// URLs of the actor's documents on the remote pod. Everything the agent owns
-// nests under ONE top-level container (`root`) so the pod stays tidy and one
-// pod could host several actors under different roots. Webfinger + host-meta
-// stay at the pod root — fediverse discovery requires the host root.
-// The AP URLs for an identity. Normally everything hangs off the pod home.
-//
-// When `publicBase` is given (a fronted identity, e.g.
-// "https://fedipod.net/u/me/"), the ADVERTISED ids — the actor and everything
-// under `ap/` a remote server sees — build on the fronted home instead, while
-// the pod-side trees (`fediverse/`, `ap-state/`) and the write targets stay on
-// the pod. `toPod`/`toPublic` map between the two spaces; `RemotePod` applies
-// `toPod` at its one request choke point, so publisher/social/intake keep
-// passing advertised ids and the writes still land on the pod. With no
-// `publicBase` the returned object is byte-identical to before — the invariant
-// the smoke suite pins.
+// The pod LAYOUT — which container each document lives in — moved into the pod
+// library (lib/pod/urls.mjs), which knows nothing about FediPod and requires
+// the container root to be stated rather than defaulted. What stays here is
+// FediPod's own answer to "which root", and the handle rule, both of which read
+// this application's config shape.
+import { apUrls as podUrls } from './pod/urls.mjs';
+
+export { webfingerHost } from './pod/urls.mjs';
+
+// The container the Node agent has always used. Older than the rename to
+// FediPod and kept because it is what every existing Node-side pod actually
+// contains; the browser build states `fedipod/` on its own configs. A config
+// that names a root is always believed — this is only the answer for one that
+// does not.
+export const DEFAULT_ROOT = 'activitypods-js/';
+
 // The handle the fediverse sees: a fronted identity's name is the front's.
 export function publicHandle(config) {
   return config?.gateway?.frontActor?.match(/\/u\/([^/]+)\/ap\/actor\/?$/)?.[1]
     || config?.handle || null;
 }
 
-export function apUrls(remotePod, root = 'activitypods-js/', { publicBase = null } = {}) {
-  const base = remotePod.endsWith('/') ? remotePod : remotePod + '/';
-  const home = base + (!root || root.endsWith('/') ? root : root + '/');
-  // The face a remote sees: the fronted home, or the pod home when unfronted.
-  const face = publicBase ? (publicBase.endsWith('/') ? publicBase : publicBase + '/') : home;
-  const urls = {
-    base, home,
-    webfinger: base + '.well-known/webfinger',
-    actor: face + 'ap/actor',
-    inbox: face + 'ap/inbox/',
-    outbox: face + 'ap/outbox',
-    followers: face + 'ap/followers',
-    following: face + 'ap/following',
-    notes: face + 'ap/notes/',
-    privateNotes: face + 'ap/private/',
-    featured: face + 'ap/featured',
-    // FEP-1b12: the moderator roster a recipient validates announced
-    // moderation against. Published only when moderators are configured.
-    moderators: face + 'ap/moderators',
-    // FEP-4ccd and FEP-c648: follows in limbo and the block list, as
-    // collections. They live in the private container so the owner-only ACL
-    // is inherited, not re-stated per document.
-    pendingFollowers: face + 'ap/private/pending-followers',
-    pendingFollowing: face + 'ap/private/pending-following',
-    blocked: face + 'ap/private/blocked',
-    profileHtml: face + 'ap/profile.html',
-    // Media stays on the pod even when fronted: attachment urls are not
-    // identity-checked by remotes, and proxying blobs would be pure cost.
-    media: home + 'ap/media/',
-    fediverse: home + 'fediverse/',
-    state: home + 'ap-state/',
-  };
-  if (publicBase) {
-    urls.podHome = home;
-    urls.publicHome = face;
-    urls.toPod = (u) => (typeof u === 'string' && u.startsWith(face) ? home + u.slice(face.length) : u);
-    urls.toPublic = (u) => (typeof u === 'string' && u.startsWith(home) ? face + u.slice(home.length) : u);
-  }
-  return urls;
-}
-
-// The host a handle would resolve through, or null when no handle can point
-// here. @name@host is looked up at https://host/.well-known/webfinger, so only
-// a pod that owns the root of its host can answer for one; a pod living at
-// https://server/name/ may publish the document but nothing will ever ask.
-export function webfingerHost(podUrl) {
-  const u = new URL(podUrl);
-  return u.pathname === '/' ? u.host : null;
+/**
+ * The AP URLs for an identity, with FediPod's default root applied.
+ *
+ * The library underneath refuses to guess a root. Every caller here goes
+ * through this wrapper so there is exactly ONE answer to "which container",
+ * which is the thing that was wrong: the browser agent decided `fedipod/` for
+ * its own urls while the publisher, handed a config with no `root`, decided
+ * `activitypods-js/` — putting an identity's state in one container and its
+ * published documents in another.
+ */
+export function apUrls(remotePod, root, opts = {}) {
+  return podUrls(remotePod, root || DEFAULT_ROOT, opts);
 }
 
 // RFC 6415 host-meta: several fediverse implementations discover WebFinger
@@ -585,15 +550,31 @@ export function titledContent(note) {
 }
 
 // Normalize a wire Note's attachment list to { url, mediaType, description }.
+// Capped: this list comes from somebody else's document and lands in a
+// statuses.json row, which is rewritten whole on every change. Twenty is more
+// than any client shows and more than any real post carries.
+const MAX_ATTACHMENTS = 20;
+const MAX_ATTACHMENT_URL = 2048;
+// http(s) only: an attachment URL becomes a client's <img src> or <video src>,
+// and the store has guarded avatars this way all along (safeUrl).
+const attachmentUrl = (u) => {
+  if (!u) return null;
+  const s = String(u).slice(0, MAX_ATTACHMENT_URL);
+  try {
+    const p = new URL(s);
+    return (p.protocol === 'https:' || p.protocol === 'http:') ? s : null;
+  } catch { return null; }
+};
+
 export function attachmentsOf(note) {
   const list = Array.isArray(note?.attachment) ? note.attachment : note?.attachment ? [note.attachment] : [];
   // A bare Link carries `href` and no `url` — Lemmy's link posts arrive that
   // way, and reading only `url` dropped the link the post was about.
-  return list.map(a => ({
+  return list.slice(0, MAX_ATTACHMENTS).map(a => ({
     url: typeof a?.url === 'string' ? a.url : a?.url?.href || (typeof a?.href === 'string' ? a.href : undefined),
-    mediaType: a?.mediaType || '',
-    ...(a?.name ? { description: a.name } : {}),
-  })).filter(a => a.url);
+    mediaType: String(a?.mediaType || '').slice(0, 128),
+    ...(a?.name ? { description: String(a.name).slice(0, 1500) } : {}),
+  })).map(a => ({ ...a, url: attachmentUrl(a.url) })).filter(a => a.url);
 }
 
 const HTML_ESCAPES = { '&': '&amp;', '<': '&lt;', '>': '&gt;' };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",
@@ -33,8 +33,12 @@
     "install-service": "node bin/fedipod.mjs install-service",
     "uninstall-service": "node bin/fedipod.mjs uninstall-service",
     "prepublishOnly": "npm test",
-    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node scripts/verify-ui.mjs",
+    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs",
     "verify-ui": "node scripts/verify-ui.mjs",
+    "build:sw": "node scripts/build-app.mjs --entry web/app/sw-src.mjs --out web/app/dist/sw.js",
+    "build:boot": "node scripts/build-app.mjs --entry web/app/boot.mjs --out web/app/dist/boot.js",
+    "build:app": "npm run build:sw && npm run build:boot",
+    "stage": "node scripts/stage-site.mjs",
     "audit": "npm audit --omit=dev",
     "agent": "node run-agent.mjs"
   },
@@ -57,5 +61,8 @@
     "@opentelemetry/core": "^2.8.0",
     "package.json": "npm:empty-npm-package@1.0.0",
     "package-lock.json": "npm:empty-npm-package@1.0.0"
+  },
+  "devDependencies": {
+    "esbuild": "^0.28.2"
   }
 }

package/run-agent.mjs

@@ -34,7 +34,6 @@ import { ensureTrustedTls } from './lib/certs.mjs';
 import { storageFor } from './lib/storage.mjs';
 import { resolveKeys } from './lib/keys.mjs';
 import { RemotePod } from './lib/remote.mjs';
-import { PodRdf } from './lib/podrdf.mjs';
 import { Deliverer } from './lib/deliver.mjs';
 import { Publisher } from './lib/publisher.mjs';
 import { Intake } from './lib/intake.mjs';
@@ -69,15 +68,14 @@ export class Agent {
 
   // Where the private half lives. `privateRoot` in the credential file names a
   // container — by default a plain directory beside the credential, and a pod
-  // on this machine if you move it there — under which the same two trees are
-  // laid out as on the pod. Absent means on the pod, exactly as before, so an
+  // on this machine if you move it there. Absent means on the pod, so an
   // existing install is untouched.
   privateUrls(cred, urls = this.urls) {
     if (!cred.privateRoot) {
-      return { state: urls.state, fediverse: urls.fediverse, archive: urls.home + 'inbox-archive/', elsewhere: false };
+      return { state: urls.state, archive: urls.home + 'inbox-archive/', elsewhere: false };
     }
     const base = cred.privateRoot.endsWith('/') ? cred.privateRoot : cred.privateRoot + '/';
-    return { state: base + 'ap-state/', fediverse: base + 'fediverse/', archive: base + 'inbox-archive/', elsewhere: true };
+    return { state: base + 'ap-state/', archive: base + 'inbox-archive/', elsewhere: true };
   }
 
   // A container to keep the private half in. On the pod it is reached with the
@@ -146,14 +144,9 @@ export class Agent {
     await this.remote.setAcl(this.urls.home, []);
     await this.remote.setAcl(this.urls.state, []);
     if (priv.elsewhere) {
-      for (const s of [stateStore, this.privateStorage(cred, 'fediverse')]) {
-        const r = await s.write('.keep', '{"keep":true}\n', 'application/json');
-        if (!r.ok) throw new Error(`private store ${s.base}.keep → ${r.why}`);
-      }
+      const r = await stateStore.write('.keep', '{"keep":true}\n', 'application/json');
+      if (!r.ok) throw new Error(`private store ${stateStore.base}.keep → ${r.why}`);
       this.log(`private state lives at ${cred.privateRoot} (${stateStore.kind})`);
-    } else {
-      await this.remote.putJson(this.urls.fediverse + '.keep', { keep: true }, 'application/json');
-      await this.remote.setAcl(this.urls.fediverse, []);
     }
     this.store.attach(stateStore);
     // Re-running setup must not destroy state set afterwards (the UI
@@ -314,7 +307,6 @@ export class Agent {
       const { rotateKeyOnce, ...rest } = cred;
       writeJsonAtomic(path.join(this.home, 'credential.json'), rest);
     }
-    this.local = new PodRdf({ storage: this.privateStorage(cred, 'fediverse') });
     // connect() can run more than once — connectWithRetry retries after a throw,
     // and the CLI connects for real after its confirmation. Deliverer arms a
     // 60s queue timer in its constructor and Intake owns a poll timer and a
@@ -332,13 +324,10 @@ export class Agent {
       log: this.log, passive: this.viewer,
     });
     this.publisher = new Publisher({
-      config, remote: this.remote, local: this.local, store: this.store,
+      config, remote: this.remote, store: this.store,
       deliverer: this.deliverer, publicKeyPem: keys.rsaPublicPem,
       assertionKey: keys.edPublicMultibase, log: this.log,
       resolveMention: (h) => resolveHandle(this, h),
-      // Whether the fediverse tree is on the pod at all, so the ACL check does
-      // not probe for something the default layout keeps on local disk.
-      privateOnPod: !cred.privateRoot,
       // Inside a pod server the client surface answers on the pod's own
       // origin, so it can be advertised. Standalone it is on loopback, and
       // naming it in a world-readable actor would send clients nowhere.
@@ -347,7 +336,7 @@ export class Agent {
     // Intake is constructed even for viewers — its signed fetchAP powers
     // search/deref; start() (draining) is active-only.
     this.intake = new Intake({
-      config, urls: this.urls, remote: this.remote, local: this.local, store: this.store,
+      config, urls: this.urls, remote: this.remote, store: this.store,
       deliverer: this.deliverer, publisher: this.publisher, log: this.log, lease: this.lease,
       archive: this.privateStorage(cred, 'archive'),
       push: !this.embedded, pollSeconds: this.pollSeconds || null,
@@ -581,7 +570,7 @@ export class Agent {
       this.ensureActorPublished()
         .catch(e => this.log(`actor check failed: ${e.message}`));
     }
-    this.backfillStatuses().catch(e => this.log(`statuses backfill failed: ${e.message}`));
+    this.seedFollowNotifications().catch(e => this.log(`notification seeding failed: ${e.message}`));
   }
 
   // Re-read state before acting on what we hold. A viewer's cache is kept
@@ -695,27 +684,13 @@ export class Agent {
     return true;
   }
 
-  // The statuses index is an operational mirror of the pod's RDF — rebuild it
-  // from /fediverse/ when absent (fresh state, or state loss).
-  async backfillStatuses() {
-    if (!this.store.has('notifications.json')) {
-      for (const f of this.store.getContacts().followers) {
-        this.store.addNotification({ type: 'follow', actor: f.actor });
-      }
-    }
-    if (this.store.has('statuses.json')) return;
-    const entries = [];
-    for (const [container, kind] of [['timeline', 'timeline'], ['posts', 'post']]) {
-      for (const url of await this.local.listNotes(container)) {
-        try {
-          const n = await this.local.readNote(url);
-          if (n.noteId) entries.push({ ...n, kind, slug: url.split('/').pop() });
-        } catch (e) { this.log(`backfill: skipped ${url}: ${e.message}`); }
-      }
+  // A first run inherits followers without ever having seen them arrive, so
+  // the notifications list starts empty where it should start full.
+  async seedFollowNotifications() {
+    if (this.store.has('notifications.json')) return;
+    for (const f of this.store.getContacts().followers) {
+      this.store.addNotification({ type: 'follow', actor: f.actor });
     }
-    entries.sort((a, b) => String(b.published || '').localeCompare(String(a.published || '')));
-    this.store.write('statuses.json', entries.slice(0, 1000));
-    this.log(`backfilled ${entries.length} statuses from pod RDF`);
   }
 }
 

package/scripts/build-app.mjs

@@ -0,0 +1,64 @@
+// build-app.mjs — bundle the in-browser agent (and its pieces) with esbuild.
+//
+// The agent's brain is lib/, written for Node. This bundles it for a browser by
+// swapping the Node-only edges for shims (web/app/shims/) and stubbing the Node
+// modules the browser agent never uses (a local HTTP server, the filesystem,
+// DNS pinning). A stubbed module that is actually called throws a named error,
+// so a missing port shows up loudly rather than as silent wrong behaviour.
+//
+//   node scripts/build-app.mjs [--entry <file>] [--out <file>]
+import esbuild from 'esbuild';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const shim = (p) => path.join(root, 'web/app/shims', p);
+
+// Node modules the browser agent does not use. Stubbed to an empty module so an
+// unrelated transitive import does not fail the build; anything that truly needs
+// one will fail at runtime with a clear message, which is the signal to port it.
+const STUBBED = ['node:fs/promises', 'node:os', 'node:net', 'node:http',
+  'node:https', 'node:dns', 'node:dns/promises', 'node:child_process', 'node:tls',
+  'undici', 'node-forge'];
+
+const aliasPlugin = {
+  name: 'fedipod-agent-aliases',
+  setup(build) {
+    build.onResolve({ filter: /^@fedify\/fedify\/sig$/ }, () => ({ path: shim('fedify-sig.mjs') }));
+    build.onResolve({ filter: /^node:crypto$/ }, () => ({ path: shim('node-crypto.mjs') }));
+    build.onResolve({ filter: /^node:path$/ }, () => ({ path: shim('node-path.mjs') }));
+    build.onResolve({ filter: /^node:url$/ }, () => ({ path: shim('node-url.mjs') }));
+    build.onResolve({ filter: /^node:fs$/ }, () => ({ path: shim('node-fs.mjs') }));
+    build.onResolve({ filter: /^web-push$/ }, () => ({ path: shim('web-push.mjs') }));
+    build.onResolve({ filter: /\/safefetch\.mjs$/ }, () => ({ path: shim('safefetch.mjs') }));
+    const stub = new RegExp(`^(${STUBBED.map((s) => s.replace('/', '\\/')).join('|')})$`);
+    build.onResolve({ filter: stub }, (args) => ({ path: args.path, namespace: 'stub' }));
+    build.onLoad({ filter: /.*/, namespace: 'stub' }, (args) => ({
+      contents: `const fail = () => { throw new Error(${JSON.stringify(args.path)} + ' is not available in the browser agent'); };`
+        + 'export default new Proxy({}, { get: () => fail });',
+      loader: 'js',
+    }));
+  },
+};
+
+export async function buildApp({ entry, out, minify = false, format = 'esm' } = {}) {
+  const result = await esbuild.build({
+    entryPoints: [entry],
+    bundle: true, format, platform: 'browser', target: 'es2022',
+    outfile: out, sourcemap: true, minify, logLevel: 'silent', metafile: true,
+    plugins: [aliasPlugin],
+    define: { 'process.env.NODE_ENV': '"production"' },
+    banner: { js: fs.readFileSync(shim('prelude.js'), 'utf8') },
+  });
+  return { out, bytes: Object.values(result.metafile.outputs).reduce((n, o) => n + o.bytes, 0) };
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const args = process.argv.slice(2);
+  const entry = args[args.indexOf('--entry') + 1] || path.join(root, 'web/app/agent.mjs');
+  const out = args[args.indexOf('--out') + 1] || path.join(root, 'web/app/dist/agent.js');
+  const format = args.includes('--format') ? args[args.indexOf('--format') + 1] : 'esm';
+  const { bytes } = await buildApp({ entry, out, format });
+  console.log(`built ${path.relative(root, out)} — ${Math.round(bytes / 1024)} KB`);
+}

package/scripts/check-pod-calls.mjs

@@ -0,0 +1,177 @@
+// check-pod-calls.mjs — keeps the pod library a library, and keeps pod I/O
+// inside it.
+//
+// Two jobs. The first is that the layer does not erode: once every pod request
+// goes through a named operation, one `remote.putJson(...)` added back at a
+// call site is invisible in review and undoes the property quietly. The second
+// is that lib/pod/ stays EXTRACTABLE — no imports above itself, no Node
+// built-ins, its one dependency confined — because "we could lift this out"
+// stops being true the first time something reaches upward, and nobody notices
+// until they try.
+//
+// Comments are stripped before every check. The rules are about code; the
+// files explain themselves in prose, and prose that mentions node:dns or
+// names the application it grew up in is not a violation.
+//
+//   node scripts/check-pod-calls.mjs
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const POD = path.join(root, 'lib/pod');
+
+let failures = 0;
+const fail = (msg) => { console.log(`FAIL  ${msg}`); failures++; };
+const pass = (msg) => console.log(`PASS  ${msg}`);
+
+const read = (p) => fs.readFileSync(p, 'utf8');
+// Prose is stripped LINE BY LINE, never with a regex spanning lines. A
+// `/*...*/` matcher looks obvious and is not: a `*/` inside a regex literal or
+// a string ends the match early, and everything up to the next one disappears —
+// which silently deleted the very code these rules exist to look at, and left
+// the check passing. Every comment in this project's style occupies whole
+// lines, so dropping whole comment lines is both sufficient and safe.
+const code = (src) => {
+  const out = [];
+  let inBlock = false;
+  for (const line of src.split('\n')) {
+    const t = line.trim();
+    if (inBlock) { if (t.endsWith('*/') || t === '*/') inBlock = false; continue; }
+    if (t.startsWith('/*')) { if (!t.includes('*/')) inBlock = true; continue; }
+    if (t.startsWith('//') || t.startsWith('*')) continue;
+    out.push(line);
+  }
+  return out.join('\n');
+};
+
+const podFiles = fs.readdirSync(POD).filter((f) => f.endsWith('.mjs'));
+
+// ---- 1. the layer: pod I/O lives behind a named operation ----
+
+// The files that run the browser agent and the gateway. Node-only code is
+// deliberately out of scope for this pass and must not fail the check.
+const IN_SCOPE = [
+  'lib/publisher.mjs', 'lib/intake.mjs', 'lib/social.mjs', 'lib/mastoapi.mjs',
+  'lib/gateway-core.mjs', 'lib/front-core.mjs',
+  'web/app/agent.mjs', 'web/app/signup.mjs', 'web/app/boot.mjs',
+  'web/app/admin-facade.mjs', 'web/app/keys-browser.mjs',
+];
+const VERBS = /\b(?:remote|pod)\??\.(put|putJson|getJson|delete|setAcl|listContainer|aclUrlFor|aclWritable|patchDocument|linkAccountInProfile|aclDoc)\(/;
+
+for (const rel of IN_SCOPE) {
+  const hits = code(read(path.join(root, rel))).split('\n')
+    .map((l, i) => [i + 1, l]).filter(([, l]) => VERBS.test(l));
+  if (hits.length) {
+    fail(`${rel} calls a transport verb directly — that belongs in a lib/pod/ operation`);
+    for (const [n, l] of hits.slice(0, 5)) console.log(`        ${rel}:${n}  ${l.trim()}`);
+  }
+}
+if (!failures) pass('every in-scope caller reaches the pod through a named operation');
+
+// ---- 2. the deny-list cannot be routed around ----
+{
+  const offenders = [];
+  const walk = (dir) => {
+    for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+      const p = path.join(dir, e.name);
+      if (e.isDirectory()) {
+        if (['node_modules', 'dist', 'site', '.git', 'claude', 'phanpy', 'ui', 'packages'].includes(e.name)) continue;
+        walk(p);
+      } else if (e.name.endsWith('.mjs') && p !== path.join(POD, 'transport.mjs')) {
+        // A DELETE is only a problem when it is sent on a RAW fetch. One sent
+        // through an injected fetcher is going through the transport — that is
+        // what `storage.mjs` does, and is the point of it being injected.
+        const src = code(read(p));
+        for (const m of src.matchAll(/method:\s*['"]DELETE['"]/g)) {
+          const before = src.slice(Math.max(0, m.index - 240), m.index);
+          const call = before.lastIndexOf('(');
+          const receiver = before.slice(Math.max(0, call - 60), call + 1);
+          if (/(?:^|[^.\w])(?:window\.)?fetch\($/.test(receiver) || /session\.fetch\($/.test(receiver)) {
+            offenders.push(`${path.relative(root, p)} (raw fetch)`);
+          }
+        }
+      }
+    }
+  };
+  walk(path.join(root, 'lib'));
+  walk(path.join(root, 'web/app'));
+  if (offenders.length) fail(`a DELETE is issued outside the transport, skipping the deny-list: ${offenders.join(', ')}`);
+  else pass('every DELETE goes through the transport, where the deny-list is');
+}
+
+// ---- 3. the signing key is never written without its ACL ----
+{
+  const s = code(read(path.join(root, 'web/app/signup.mjs')));
+  if (/keys\.json[\s\S]{0,200}method:\s*['"]PUT['"]/.test(s) || /method:\s*['"]PUT['"][\s\S]{0,200}keys\.json/.test(s)) {
+    fail('signup writes keys.json directly — it must go through state.provisionKey, which sets the ACL first');
+  } else pass('the signing key is written only by the operation that locks the container first');
+}
+
+// ---- 4. lib/pod/ reaches nothing above itself ----
+{
+  let bad = 0;
+  for (const f of podFiles) {
+    const src = code(read(path.join(POD, f)));
+    for (const m of src.matchAll(/from\s+['"]([^'"]+)['"]/g)) {
+      const spec = m[1];
+      if (spec.startsWith('../')) { fail(`lib/pod/${f} imports ${spec} — the library may not reach above itself`); bad++; }
+      if (spec.startsWith('node:')) { fail(`lib/pod/${f} imports ${spec} — the library must run in a service worker`); bad++; }
+    }
+  }
+  if (!bad) pass('lib/pod/ imports nothing above itself and no Node built-ins');
+}
+
+// ---- 5. its one dependency stays confined ----
+{
+  const rdflibbers = podFiles.filter((f) => /from\s+['"]rdflib['"]/.test(code(read(path.join(POD, f)))));
+  const allowed = ['transport.mjs', 'notifications.mjs'];
+  const extra = rdflibbers.filter((f) => !allowed.includes(f));
+  if (extra.length) fail(`rdflib reached from ${extra.join(', ')} — a resource module must not pull a parser in behind it`);
+  else pass(`rdflib is confined to ${allowed.join(' and ')}`);
+
+  const importsTransport = podFiles
+    .filter((f) => f !== 'transport.mjs')
+    .filter((f) => /from\s+['"]\.\/transport\.mjs['"]/.test(code(read(path.join(POD, f)))));
+  if (importsTransport.length) fail(`${importsTransport.join(', ')} imports the transport — operations receive one, they do not reach for it`);
+  else pass('no resource module imports or constructs a transport');
+}
+
+// ---- 6. it does not know what application it grew up in ----
+{
+  const named = podFiles.filter((f) => /fedipod/i.test(code(read(path.join(POD, f)))));
+  if (named.length) fail(`lib/pod/${named.join(', ')} names FediPod in code — the library is meant to outlive it`);
+  else pass('no FediPod vocabulary in library code');
+}
+
+// ---- 7. and it actually runs on its own ----
+{
+  const { apUrls } = await import(path.join(POD, 'urls.mjs'));
+  const { PodTransport, protectedFromDeletion } = await import(path.join(POD, 'transport.mjs'));
+  const urls = apUrls('https://p.example/', 'anything/');
+  let threw = false;
+  try { apUrls('https://p.example/'); } catch { threw = true; }
+  if (!threw) fail('apUrls guessed a container root instead of requiring one');
+
+  const seen = [];
+  const pod = new PodTransport(
+    { fetch: async (u, i) => { seen.push(`${i?.method || 'GET'} ${u}`); return { status: 200, headers: { get: () => null } }; } },
+    { webId: 'https://p.example/profile/card#me', role: 'agent', runtime: 'node' },
+  );
+  const inbox = await import(path.join(POD, 'inbox.mjs'));
+  await inbox.writeKeep(pod, urls);
+  await inbox.setPosture(pod, urls, 'open');
+  let refused = false;
+  try { await pod.delete('https://p.example/profile/card'); } catch { refused = true; }
+  if (!refused) fail('the deny-list did not refuse a DELETE of the WebID document');
+  if (!seen.some((r) => r.startsWith('PUT https://p.example/anything/ap/inbox/.keep'))) {
+    fail(`the inbox operations did not reach the pod as expected: ${seen.join(', ')}`);
+  }
+  if (pod.label !== 'agent/node') fail(`the transport did not label itself: ${pod.label}`);
+  if (typeof protectedFromDeletion !== 'function') fail('protectedFromDeletion is not exported');
+  pass('the library imports and runs against a stub with nothing but rdflib on the path');
+}
+
+console.log(failures ? `\n${failures} failure(s)` : '\npod layer intact');
+process.exit(failures ? 1 : 0);