fedipod 1.2.0 → 1.3.0

package/lib/client/c2s.mjs

@@ -192,12 +192,14 @@ export class C2S {
     }
 
     // Read as JSON-LD, so a client may send its activity with whatever context
-    // it likes and still be understood. One we cannot read that way is read as
-    // plain JSON rather than refused, which is what a client sending ordinary
-    // ActivityStreams has always got.
+    // it likes and still be understood. What is read is the GRAPH: `dispatch`
+    // takes decisions from it and the publisher builds the document that is
+    // actually posted, so nothing a client sent is republished verbatim and a
+    // term it aliased still means what it says.
     let activity;
     try {
-      activity = (await readLenient(await readBody(req))).doc;
+      const read = await readLenient(await readBody(req));
+      activity = read.view ?? read.doc;
     } catch (e) {
       return this.send(res, 400, { error: `unreadable body: ${e.message}` });
     }

package/lib/core/as2.mjs

@@ -4,8 +4,12 @@
 // read it as one. Expanding it to a graph is what makes the document mean the
 // same thing however its sender chose to write it — `"type": "Create"` and
 // `"@type": "as:Create"` are the same statement, and only a JSON-LD reader
-// knows that. Compacting it back against the standard context is what lets the
-// handlers stay as they are: whatever arrived, they see an ordinary document.
+// knows that.
+//
+// The graph is what the handlers read, through lib/core/graphview.mjs. `doc`,
+// the copy compacted against the standard context, is kept for the callers
+// that republish what they read rather than act on it — compaction alone drops
+// any term the sender defined in its own context, so it is the weaker read.
 //
 // What we STORE and SEND is untouched by any of this. Bytes go into the pod as
 // they arrived, and lib/core/wire.mjs builds what we send as compacted AS2
@@ -15,16 +19,18 @@
 // common shape: one that skipped it would not be read as JSON-LD, and would
 // produce no graph, so nothing could be validated against it.
 //
-// CONTEXTS ARE NEVER FETCHED. `contextsFor` serves the fourteen the fediverse
+// CONTEXTS ARE NEVER FETCHED. The loader serves the fourteen the fediverse
 // actually uses and refuses every other URL. That refusal is the point: this
 // code runs on documents a stranger wrote, in the same path the SSRF guards
 // protect, and expanding one would otherwise mean dereferencing a URL of their
-// choosing. A document naming a context we do not hold is refused with a
-// reason, which is a visible drop rather than a silent one.
+// choosing. A document naming a context we do not hold is not lost for it —
+// `groundContext` reads it against the contexts we hold and says so in
+// `degraded` — but nothing is ever fetched to make that happen.
 
 import jsonld from 'jsonld';
 import { AS_CTX } from './wire.mjs';
 import { CONTEXTS } from './contexts/index.mjs';
+import { graphView } from './graphview.mjs';
 
 export { CONTEXTS };
 
@@ -99,26 +105,66 @@ export async function parseAS2(raw) {
 }
 
 /**
- * Read AS2 bytes, and when they cannot be read as JSON-LD, read them the way
- * this project always did.
+ * Rewrite a document's `@context` to one we can read without fetching anything.
+ *
+ * A document carrying no `@context` is not a puzzle: AS2 Core §2.1 says a
+ * consumer meeting `application/activity+json` without one MUST assume the
+ * normative context still applies. That is what this does. A document naming a
+ * context we do not hold keeps every entry we DO hold — inline objects
+ * included, since those need no fetch — and loses only the unfetchable ones,
+ * so a Mastodon post with an unknown extension still reads as a post.
+ *
+ * Nothing here dereferences a URL. The result names only contexts already on
+ * disk, so the guarantee that a stranger's document cannot make us reach out
+ * survives the fallback.
+ */
+export function groundContext(input) {
+  const ctx = input['@context'];
+  const held = (c) => typeof c === 'string' ? Object.hasOwn(CONTEXTS, c) : (c && typeof c === 'object');
+  let kept;
+  if (ctx === undefined || ctx === null) kept = [];
+  else if (Array.isArray(ctx)) kept = ctx.filter(held);
+  else kept = held(ctx) ? [ctx] : [];
+  if (!kept.some(c => c === AS_CTX)) kept.unshift(AS_CTX);
+  return { ...input, '@context': kept.length === 1 ? kept[0] : kept };
+}
+
+/**
+ * Read AS2 bytes, and when they cannot be read as JSON-LD as written, read
+ * them against the contexts we do hold.
  *
  * A delivery naming a context we do not hold, or carrying none at all, is
- * still a delivery somebody sent. Refusing it here would lose mail that
- * arrives perfectly well today, so the JSON-LD read is an improvement on the
- * plain one and never a gate in front of it. `degraded` carries the reason
- * when the improvement did not happen, so a caller can record it instead of
- * letting it pass unnoticed.
+ * still a delivery somebody sent. It is now grounded rather than refused, so
+ * `graph` is present for anything that is JSON at all — which is what lets the
+ * handlers read the graph instead of the document. `degraded` still carries
+ * the reason the document could not be read exactly as written, so a caller
+ * records what happened instead of letting it pass unnoticed.
  *
- * `doc` is null only when the bytes are not JSON at all, which is what the
- * plain read would have concluded too.
+ * `doc` and `graph` are null only when the bytes are not JSON at all, which is
+ * what the plain read would have concluded too.
  */
 export async function readLenient(raw) {
   try {
     const { doc, graph } = await parseAS2(raw);
-    return { doc, graph, degraded: null };
+    return { doc, graph, view: graphView(graph), degraded: null };
   } catch (e) {
-    let doc = null;
-    try { doc = typeof raw === 'string' ? JSON.parse(raw) : (raw ?? null); } catch { /* not JSON either */ }
-    return { doc: (doc && typeof doc === 'object') ? doc : null, graph: null, degraded: e.message };
+    let input = null;
+    try { input = typeof raw === 'string' ? JSON.parse(raw) : (raw ?? null); } catch { /* not JSON either */ }
+    if (!input || typeof input !== 'object') return { doc: null, graph: null, view: null, degraded: e.message };
+    // Grounded, so a graph exists for every document that is JSON at all.
+    //
+    // `doc` stays the bytes as they were parsed, NOT the grounded compaction.
+    // Compacting shortens an IRI to whatever term names it — `#Public` comes
+    // back as `as:Public` — and the callers that still read `doc` republish
+    // what they read, so rewriting it here silently changed what they posted.
+    try {
+      const { graph } = await parseAS2(groundContext(input));
+      return { doc: input, graph, view: graphView(graph), degraded: e.message };
+    } catch (inner) {
+      // Grounding names only held contexts, so reaching here means the document
+      // is malformed JSON-LD rather than unfetchable. Hand back what a plain
+      // read would have seen, with no graph, as this always did.
+      return { doc: input, graph: null, view: null, degraded: `${e.message}; grounded read also failed: ${inner.message}` };
+    }
   }
 }

package/lib/core/graphview.mjs

@@ -0,0 +1,269 @@
+// graphview.mjs — what the handlers read.
+//
+// `parseAS2` produces quads. This turns them back into something a handler can
+// read by name, so the thing being read is the GRAPH: every property access
+// here is a lookup over statements, not a key on the JSON a stranger sent.
+//
+// That distinction is the whole point. A document can say the same thing in
+// many ways — `"type": "Create"`, `"@type": "as:Create"`, a term aliased by the
+// sender's own context — and all of them leave the same statement in the
+// graph. Reading the graph means a handler sees one answer without knowing any
+// of that happened.
+//
+// Names are resolved through the contexts we already hold, AS2 first. They are
+// not hardcoded: `movedTo` is not in the AS2 context at all (it lives in
+// miscellany), and `inbox` is `ldp:inbox` rather than an `as:` term, so a map
+// written by hand would get both wrong.
+
+import { CONTEXTS } from './contexts/index.mjs';
+import { AS_CTX } from './wire.mjs';
+
+const RDF_TYPE = 'http://www.w3.org/1999/02/22-rdf-syntax-ns#type';
+const RDF_FIRST = 'http://www.w3.org/1999/02/22-rdf-syntax-ns#first';
+const RDF_REST = 'http://www.w3.org/1999/02/22-rdf-syntax-ns#rest';
+const RDF_NIL = 'http://www.w3.org/1999/02/22-rdf-syntax-ns#nil';
+
+// Properties a handler treats as a collection. JSON-LD compaction would hand
+// back a bare value when there is only one, and `Array.isArray` checks in the
+// handlers then read it as empty. These always answer with an array.
+// A stranger's document decides the shape of this graph, so the walk is capped
+// rather than trusted to terminate on its own.
+const MAX_DEPTH = 12;
+
+const ALWAYS_LIST = new Set([
+  'items', 'orderedItems', 'to', 'cc', 'bto', 'bcc', 'tag', 'attachment',
+  'anyOf', 'oneOf', 'audience', 'attributedTo', 'alsoKnownAs',
+]);
+
+/** Expand `as:object` against a context's own prefix declarations. */
+function expandIri(value, prefixes) {
+  if (typeof value !== 'string') return null;
+  if (/^https?:\/\//.test(value)) return value;
+  const colon = value.indexOf(':');
+  if (colon < 1) return null;
+  const base = prefixes[value.slice(0, colon)];
+  return base ? base + value.slice(colon + 1) : null;
+}
+
+/**
+ * term -> { iri, list } over every context we hold, AS2 winning ties.
+ *
+ * Built once. A term already claimed by an earlier context is not overwritten,
+ * and AS2 is walked first, so an extension cannot quietly redefine `object`.
+ */
+function buildTerms() {
+  const terms = new Map();
+  const order = [AS_CTX, ...Object.keys(CONTEXTS).filter(u => u !== AS_CTX)];
+  for (const url of order) {
+    const ctx = CONTEXTS[url]?.['@context'];
+    if (!ctx || typeof ctx !== 'object') continue;
+    const prefixes = {};
+    for (const [k, v] of Object.entries(ctx)) {
+      if (typeof v === 'string' && /^https?:\/\//.test(v)) prefixes[k] = v;
+    }
+    for (const [name, def] of Object.entries(ctx)) {
+      if (name.startsWith('@') || terms.has(name)) continue;
+      const raw = typeof def === 'string' ? def : def?.['@id'];
+      const iri = expandIri(raw, prefixes);
+      if (!iri) continue;
+      terms.set(name, { iri, list: def?.['@container'] === '@list', container: def?.['@container'] ?? null });
+    }
+  }
+  return terms;
+}
+
+const TERMS = buildTerms();
+
+/** iri -> shortest term naming it, so a type comes back as `Create`. */
+const BY_IRI = (() => {
+  const m = new Map();
+  for (const [name, { iri }] of TERMS) {
+    const held = m.get(iri);
+    if (!held || name.length < held.length) m.set(iri, name);
+  }
+  return m;
+})();
+
+/**
+ * iri -> every term naming it.
+ *
+ * More than one term can mean the same predicate: `items` and `orderedItems`
+ * are both `as:items`, and only the list tells them apart. Emitting just the
+ * shorter name would lose `orderedItems` — and with it the ordering, which is
+ * the one thing an OrderedCollection is for.
+ */
+const NAMES_BY_IRI = (() => {
+  const m = new Map();
+  for (const [name, { iri, container }] of TERMS) {
+    // `contentMap` and `content` are the same predicate, but a language map is
+    // not another spelling of the plain term — emitting one as a bare string
+    // would invent a value the document never carried.
+    if (container === '@language' || container === '@index') continue;
+    const held = m.get(iri);
+    if (held) held.push(name); else m.set(iri, [name]);
+  }
+  return m;
+})();
+
+/** Index quads by subject, then by predicate. */
+function indexQuads(quads) {
+  const bySubject = new Map();
+  const objects = new Set();
+  // A BlankNode's `.value` has no `_:` on it, so blankness is recorded here
+  // rather than guessed from the string. A blank node has no id, and handing a
+  // handler `id: "b0"` would be handing it an identifier that means nothing.
+  const blanks = new Set();
+  for (const q of quads) {
+    if (q.subject.termType === 'BlankNode') blanks.add(q.subject.value);
+    if (q.object.termType === 'BlankNode') blanks.add(q.object.value);
+    const s = q.subject.value;
+    let preds = bySubject.get(s);
+    if (!preds) bySubject.set(s, preds = new Map());
+    let vals = preds.get(q.predicate.value);
+    if (!vals) preds.set(q.predicate.value, vals = []);
+    vals.push(q.object);
+    if (q.object.termType === 'NamedNode' || q.object.termType === 'BlankNode') {
+      objects.add(q.object.value);
+    }
+  }
+  return { bySubject, objects, blanks };
+}
+
+/**
+ * The document's own node: a subject nothing else points at. A document that
+ * points back at itself leaves no such subject, so the first typed subject is
+ * the fallback rather than nothing at all.
+ */
+function findRoot({ bySubject, objects }) {
+  for (const s of bySubject.keys()) if (!objects.has(s)) return s;
+  for (const [s, preds] of bySubject) if (preds.has(RDF_TYPE)) return s;
+  return bySubject.keys().next().value ?? null;
+}
+
+/** Walk an rdf:List into an ordered array. `orderedItems` depends on this. */
+function readList(head, ctx, depth, path) {
+  const out = [];
+  const walked = new Set();
+  let node = head;
+  while (node && node !== RDF_NIL && !walked.has(node)) {
+    walked.add(node);
+    const preds = ctx.bySubject.get(node);
+    if (!preds) break;
+    const first = preds.get(RDF_FIRST)?.[0];
+    if (first) {
+      const value = toValue(first, ctx, depth, path);
+      if (value !== null) out.push(value);
+    }
+    node = preds.get(RDF_REST)?.[0]?.value ?? null;
+  }
+  return out;
+}
+
+function isListHead(term, ctx) {
+  if (term.termType !== 'BlankNode' && term.termType !== 'NamedNode') return false;
+  return !!ctx.bySubject.get(term.value)?.has(RDF_FIRST);
+}
+
+/**
+ * A term becomes what a handler expects to find there.
+ *
+ * A node we hold statements about becomes a nested view, which is what an
+ * embedded object was in the JSON. A node we hold nothing about becomes its
+ * IRI, which is what a bare reference was. Handlers already test which they
+ * got (`typeof activity.object === 'object'`), so both stay readable.
+ */
+function toValue(term, ctx, depth, path) {
+  if (term.termType === 'Literal') return term.value;
+  if (isListHead(term, ctx)) return readList(term.value, ctx, depth, path);
+  const preds = ctx.bySubject.get(term.value);
+  if (preds && preds.size) return makeView(term.value, ctx, depth + 1, path);
+  return term.termType === 'BlankNode' ? null : term.value;
+}
+
+function readProperty(subject, name, ctx, depth = 0, path = new Set()) {
+  const preds = ctx.bySubject.get(subject);
+  if (!preds) return undefined;
+
+  if (name === 'id') return ctx.blanks.has(subject) ? undefined : subject;
+  if (name === 'type') {
+    const types = (preds.get(RDF_TYPE) ?? []).map(t => BY_IRI.get(t.value) ?? t.value);
+    if (!types.length) return undefined;
+    return types.length === 1 ? types[0] : types;
+  }
+
+  const term = TERMS.get(name);
+  if (!term) return undefined;
+  const values = preds.get(term.iri);
+  if (!values || !values.length) return undefined;
+
+  // `items` and `orderedItems` are the same predicate; the list is what tells
+  // them apart, so asking for the ordered one only answers when it is ordered.
+  const listed = values.filter(v => isListHead(v, ctx));
+  if (term.list) {
+    if (!listed.length) return undefined;
+    return readList(listed[0].value, ctx, depth, path);
+  }
+  if (listed.length === values.length && listed.length === 1) return readList(listed[0].value, ctx, depth, path);
+
+  const out = values.map(v => toValue(v, ctx, depth, path)).filter(v => v !== null);
+  if (ALWAYS_LIST.has(name)) return out.flat();
+  return out.length === 1 ? out[0] : out;
+}
+
+/**
+ * Build the plain object for one node.
+ *
+ * Materialised rather than proxied on purpose. A lazy reader would still be
+ * reading the graph, but it would be an exotic object, and the handlers pass
+ * what they read on to things that spread it, serialise it and structuredClone
+ * it into the store — all of which a Proxy either breaks or quietly truncates.
+ * What comes out here is an ordinary object whose every value came from a
+ * statement.
+ *
+ * `depth` and `seen` are the guards. The graph is built from a stranger's
+ * document, so it can be cyclic or enormous; a node already on the path
+ * becomes its IRI rather than being walked again.
+ */
+function makeView(subject, ctx, depth = 0, seen = new Set()) {
+  if (depth > MAX_DEPTH || seen.has(subject)) {
+    return ctx.blanks.has(subject) ? null : subject;
+  }
+  const preds = ctx.bySubject.get(subject);
+  if (!preds) return ctx.blanks.has(subject) ? null : subject;
+
+  const path = new Set(seen).add(subject);
+  const out = {};
+  const id = readProperty(subject, 'id', ctx, depth, path);
+  if (id !== undefined) out.id = id;
+  const type = readProperty(subject, 'type', ctx, depth, path);
+  if (type !== undefined) out.type = type;
+
+  for (const predicate of preds.keys()) {
+    if (predicate === RDF_TYPE || predicate === RDF_FIRST || predicate === RDF_REST) continue;
+    // A predicate no context we hold names cannot be asked for by name, so it
+    // is left out rather than carried under an IRI no handler would look up.
+    for (const name of NAMES_BY_IRI.get(predicate) ?? []) {
+      if (name === 'id' || name === 'type') continue;
+      const value = readProperty(subject, name, ctx, depth, path);
+      if (value !== undefined) out[name] = value;
+    }
+  }
+  return out;
+}
+
+/**
+ * A reader over `parseAS2`'s quads.
+ *
+ * Returns null when there is nothing to read, which is the same answer the
+ * document-shaped read gave for bytes that were not a document.
+ */
+export function graphView(quads, { root = null } = {}) {
+  if (!quads || !quads.length) return null;
+  const ctx = indexQuads(quads);
+  const subject = root ?? findRoot(ctx);
+  if (!subject) return null;
+  const view = makeView(subject, ctx);
+  return (view && typeof view === 'object') ? view : null;
+}
+
+export { TERMS, BY_IRI };

package/lib/core/intake/index.mjs

@@ -223,8 +223,8 @@ export class Intake {
           // failed and stays for the next pass.
           const got = await podInbox.readItem(this.remote, item.url, { maxBytes: MAX_ITEM_BYTES, readCapped });
           const read = got.raw === null ? null : await readLenient(got.raw);
-          if (read?.degraded) this.log(`inbox item ${item.url} read as plain JSON: ${read.degraded}`);
-          const activity = read?.doc ?? null;
+          if (read?.degraded) this.log(`inbox item ${item.url} grounded to read: ${read.degraded}`);
+          const activity = read?.view ?? read?.doc ?? null;
           // A Create is the content the owner just asked to be rid of. Anything
           // else changes state and is applied exactly as a drain would.
           if (keepConcerning) {
@@ -407,8 +407,8 @@ export class Intake {
         // says. A document we cannot read that way is read the way it always
         // was rather than lost, and the reason is logged.
         const read = raw ? await readLenient(raw) : null;
-        if (read?.degraded) this.log(`inbox item ${url} read as plain JSON: ${read.degraded}`);
-        activity = read?.doc ?? null;
+        if (read?.degraded) this.log(`inbox item ${url} grounded to read: ${read.degraded}`);
+        activity = read?.view ?? read?.doc ?? null;
         // What the shapes make of it. This decides NOTHING — the activity is
         // handled either way. It is written down so that which shapes fire on
         // real traffic is a question with an answer, rather than a guess made

package/lib/core/intake/verify.mjs

@@ -25,8 +25,8 @@ export async function fetchAP(intake, url) {
   let doc = null;
   try {
     const read = await readLenient(await readCapped(res));
-    if (read.degraded) intake.log(`fetch ${url} read as plain JSON: ${read.degraded}`);
-    doc = read.doc;
+    if (read.degraded) intake.log(`fetch ${url} grounded to read: ${read.degraded}`);
+    doc = read.view ?? read.doc;
   } catch (e) { intake.log(`fetch ${url}: unreadable — ${e.message}`); return null; }
   if (!doc) { intake.log(`fetch ${url}: unreadable as JSON`); return null; }
   // A document is only evidence about its OWN origin.
@@ -134,7 +134,8 @@ export async function isGone(intake, url) {
     // A Tombstone answers 200 and still means deleted.
     try {
       const { readCapped } = await import('../../shared/safefetch.mjs');
-      return (await readLenient(await readCapped(res))).doc?.type === 'Tombstone';
+      const read = await readLenient(await readCapped(res));
+      return (read.view ?? read.doc)?.type === 'Tombstone';
     } catch { return false; }
   }
   return null;                       // 401/403/5xx — no answer, not a denial

package/lib/core/publisher/restore.mjs

@@ -37,11 +37,14 @@ export async function reconcileFollowers(publisher, contacts) {
     try {
       const res = await publisher.deliverer.signedFetch(actor, { headers: { accept: ACCEPT_AP } });
       if (!res.ok) continue;
-      const { doc, degraded } = await readLenient(await res.json());
-      if (degraded) publisher.log?.(`actor ${actor} read as plain JSON: ${degraded}`);
-      if (!doc?.inbox) continue;
+      // The graph, not the compacted copy: `inbox` is `ldp:inbox` rather than
+      // an `as:` term, and what is wanted here is the statement, not a key.
+      const { doc, view, degraded } = await readLenient(await res.json());
+      const actorDoc = view ?? doc;
+      if (degraded) publisher.log?.(`actor ${actor} grounded to read: ${degraded}`);
+      if (!actorDoc?.inbox) continue;
       contacts.followers.push({
-        actor, inbox: doc.inbox, sharedInbox: doc.endpoints?.sharedInbox || null, recovered: true,
+        actor, inbox: actorDoc.inbox, sharedInbox: actorDoc.endpoints?.sharedInbox || null, recovered: true,
         // Said explicitly, because onUndo reads it: the pod publishes WHO
         // follows, never the id of the Follow that did it, so a recovered
         // record has nothing an Undo can be matched against and must not be

package/lib/server/embed.mjs

@@ -19,6 +19,7 @@ import { createRequire } from 'node:module';
 import { Agent } from '../../run-agent.mjs';
 import { RemotePod } from '../device/remote.mjs';
 import { apUrls, DEFAULT_ROOT } from '../core/wire.mjs';
+import { handleDelivery } from '../gateway/gateway-core.mjs';
 import { writeJsonAtomic } from '../device/home.mjs';
 import { buildAdminSurface } from '../device/admin/index.mjs';
 import { FixedAuthorities } from '../shared/guard.mjs';
@@ -50,7 +51,8 @@ export async function ensureDoorSecret(session, podBase, { rotate = false, dataD
   const onHost = dataDir && handle ? path.join(dataDir, handle, 'door-secret.json') : null;
 
   if (!rotate) {
-    const res = await session.fetch(url, { headers: { accept: 'application/json' } });
+    const res = await session.fetch(url, { headers: { accept: 'application/json' } })
+      .catch(() => ({ ok: false }));
     if (res.ok) {
       try {
         const rec = JSON.parse(await res.text());
@@ -74,18 +76,35 @@ export async function ensureDoorSecret(session, podBase, { rotate = false, dataD
   }
 
   const rec = { secret: mintSecret(), mintedAt: new Date().toISOString() };
-  if (!await putSecret(session, url, rec)) throw new Error(`could not write the door secret to ${url}`);
-  if (onHost) fs.rmSync(onHost, { force: true });
-  return { secret: rec.secret, url, rotated: rotate };
+  if (await putSecret(session, url, rec)) {
+    if (onHost) fs.rmSync(onHost, { force: true });
+    return { secret: rec.secret, url, rotated: rotate };
+  }
+  // The pod would not take it. Opting in must not fail for that: a pod that
+  // cannot be written to right now is a pod whose owner still asked for an
+  // identity, and the secret has somewhere else to live — where it lived
+  // before. The next start moves it onto the pod.
+  if (onHost) {
+    writeJsonAtomic(onHost, rec, { mode: 0o600 });
+    log(`the pod would not take the door secret; it is on this host at ${onHost} for now`);
+    return { secret: rec.secret, url: onHost, rotated: rotate };
+  }
+  throw new Error(`could not write the door secret to ${url}, and there is no directory to keep it in`);
 }
 
 async function putSecret(session, url, rec) {
-  const res = await session.fetch(url, {
-    method: 'PUT',
-    headers: { 'content-type': 'application/json' },
-    body: JSON.stringify(rec, null, 2) + '\n',
-  });
-  return res.ok;
+  try {
+    const res = await session.fetch(url, {
+      method: 'PUT',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(rec, null, 2) + '\n',
+    });
+    return res.ok;
+  } catch {
+    // A store that throws rather than answering is a store that did not take
+    // it, which is the same answer.
+    return false;
+  }
 }
 
 /** The identity's name: a subdomain pod is its label, a path pod its last segment. */
@@ -183,6 +202,62 @@ async function connectionsIntoPod(agent, home, log) {
   }
 }
 
+/**
+ * The pod's own inbox is a verifying door here.
+ *
+ * The server that stores the inbox is the server the delivery arrives at, so
+ * the signature is checked while the headers still exist and the receipt is
+ * written beside the activity — the same door code a standalone gateway runs,
+ * with nothing renamed and nothing advertised differently. The identity's
+ * config names its own inbox as the door and carries the receipt secret, which
+ * is what makes the drain read receipts at all; `trust` because a verified
+ * sender is one the identity may act for.
+ *
+ * An identity attached to an outside door keeps that door: only the secret
+ * is ensured, so receipts from either door verify against the one value.
+ */
+export async function ensureInboxDoor(agent, urls, log = () => {}) {
+  const cfg = agent.store.getConfig();
+  if (!cfg) return;
+  const g = { ...(cfg.gateway || {}) };
+  const fresh = !g.url || !g.mode || g.mode === 'off';
+  if (fresh) Object.assign(g, { url: urls.inbox, mode: 'trust' });
+  if (!g.hmacSecret) g.hmacSecret = crypto.randomBytes(32).toString('base64');
+  if (fresh || !cfg.gateway?.hmacSecret) {
+    agent.store.setConfig({ ...cfg, gateway: g });
+    await agent.store.flush();
+    log(fresh ? 'the pod inbox verifies deliveries at the door' : 'receipt secret added for the inbox door');
+  }
+}
+
+/**
+ * One delivery to a running identity's inbox, verified at the door.
+ *
+ * `request` is the WHATWG form of the POST. `podPut` writes through the
+ * server's store. Returns { status, reason } for the caller to answer with.
+ * The policy is read from the identity's live state rather than its
+ * published policy document, because both are in this process.
+ */
+export async function deliverToInbox(agent, request, { podPut, gatewayWebId = null, fetchImpl = fetch } = {}) {
+  const cfg = agent.store.getConfig() || {};
+  const contacts = agent.store.getContacts();
+  const bl = agent.store.getBlocklist();
+  const u = agent.urls;
+  const toPod = (x) => (u.toPod ? u.toPod(x) : x);
+  const ident = {
+    inboxUrl: toPod(u.inbox),
+    actorUrl: u.actor,
+    followersUrl: u.followers,
+    notesPrefix: u.notes,
+    following: contacts.following.filter((f) => f.accepted && !f.bsky).map((f) => f.actor),
+    blocklist: { domains: bl.domains || [], actors: bl.actors || [] },
+    kind: cfg.kind || 'person',
+    gatewayWebId,
+    hmacSecret: cfg.gateway?.hmacSecret || null,
+  };
+  return handleDelivery(request, ident, { podPut, fetchImpl });
+}
+
 /**
  * Bring one identity up inside the server.
  *
@@ -259,6 +334,7 @@ export async function startEmbeddedAgent({
   // Before connect(), which is what looks the key and the connections up.
   await keyIntoPod(agent, home, log);
   await connectionsIntoPod(agent, home, log);
+  await ensureInboxDoor(agent, urls, log);
 
   await agent.connect();
 
@@ -324,6 +400,6 @@ export async function startEmbeddedAgent({
   // returned rather than rebuilt by the caller so the root name lives here.
   return {
     agent, handle, home, surface, host: authorities.host,
-    podHome: urls.home, actorUrl: urls.actor, stop,
+    podHome: urls.home, actorUrl: urls.actor, inboxUrl: urls.inbox, stop,
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",

package/web/app/agent.mjs

@@ -17,9 +17,8 @@ import { MastoApi } from '../../lib/client/masto/index.mjs';
 import { TagFeed } from '../../lib/connections/tagfeed.mjs';
 import { makeDpopSession } from './pod-auth.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
-import { importSigningKey, loadKeysFromPod, keyCacheKey } from './keys-browser.mjs';
+import { importSigningKey, loadKeysFromPod, cacheOpenedKeys } from './keys-browser.mjs';
 import { generateKeys, wrapKeys } from './keystore.mjs';
-import { kvPut } from './idb-kv.mjs';
 import { RelayDeliverer } from './deliver-relay.mjs';
 import { AdminFacade } from './admin-facade.mjs';
 import { BrowserAtproto } from './atproto-browser.mjs';
@@ -364,8 +363,7 @@ export class BrowserAgent {
     const rec = await generateKeys();
     rec.mintedFor = this.urls.actor;                  // one key, one actor (lib/keys.mjs)
     await podState.writeWrappedKeys(this.remote, this.urls, await wrapKeys(rec, password));
-    await kvPut(keyCacheKey(this.urls.actor), rec).catch(() => {});
-    const keys = await importSigningKey(rec);
+    const keys = await cacheOpenedKeys(this.urls.actor, rec);
     this.publisher.publicKeyPem = keys.rsaPublicPem;
     this.deliverer.rsaPrivate = keys.rsaPrivate;
     await this.publisher.publishProfile();

package/web/app/boot.mjs

@@ -15,8 +15,7 @@ import * as podState from '../../lib/pod/state.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
 import { beginLogin, completeLogin, getSession, signOut } from './oidc-session.mjs';
 import { unwrapKeys, isKeyEnvelope } from './keystore.mjs';
-import { kvPut } from './idb-kv.mjs';
-import { keyCacheKey } from './keys-browser.mjs';
+import { cacheOpenedKeys } from './keys-browser.mjs';
 
 const REDIRECT = `${location.origin}/`;   // the app root doubles as the OIDC callback
 
@@ -83,7 +82,7 @@ window.fedipodUnlock = async (password) => {
   if (!isKeyEnvelope(doc)) throw new Error('this account\'s key is not locked — nothing to unlock');
   const rec = await unwrapKeys(doc, password);          // throws 'wrong password'
   const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
-  await kvPut(keyCacheKey(actorUrl), rec);
+  await cacheOpenedKeys(actorUrl, rec);
   await bootWorker();
 };