fedipod 1.30.0 → 1.36.6

package/lib/gateway/quiet.mjs

@@ -0,0 +1,189 @@
+// quiet.mjs — accounts that go quiet: what the front knows about an account
+// nobody opens, and what its owner may say about it. The router in
+// front-core.mjs asks closedState/accountState at the door and on every
+// public read, stamps noteOpened from the relay, counts noteReceived after
+// a forwarded delivery, and hands /api/open, /api/pause and /api/close here.
+
+// ---- accounts that go quiet -------------------------------------------------
+//
+// The gateway holds no mail: every delivery it takes is two writes into the
+// owner's pod inbox, read only when their browser is open. An account nobody
+// opens grows on its pod without limit, and its owner comes back to a drain
+// of everything at once. So the front keeps two facts about each browser
+// account — when its owner was last here, and how much content has arrived
+// since — and acts on them.
+//
+// `openedAt` is written when the owner signs in (POST /api/open, always) and
+// while they act through the relay (at most hourly). The count of content
+// deliveries since then lives in its own record, keyed by handle AND
+// openedAt: a fresh stamp starts a fresh count with nothing to reset, and a
+// delivery's write can never overwrite a sign-in's. Two deliveries landing
+// together may each read the same total and one increment is lost — the cap
+// comes out slightly soft, never too strict.
+//
+// PAUSED: the count has reached the cap, or the owner said so. Content is
+// accepted and discarded, control (follows, unfollows, moves, deletions,
+// blocks) still lands. The owner's next sign-in ends a cap pause by itself; a
+// pause they set lasts until they lift it.
+//
+// CLOSED: the owner said so, or nothing has opened the account for the close
+// window. Found closed by time, it is written down so it stays closed. From
+// then on the door, the actor and the handle answer 410 — never a failure
+// code, which senders retry and count against this whole host, and never a
+// success, which would keep them sending. Nothing on the pod is touched. An
+// address that moved (see /api/move) keeps answering as moved; closing does
+// not take that away.
+//
+// Only an account whose owner has signed in from a browser carries
+// `openedAt`. A DeviceAgent behind this door never does: it drains its own
+// inbox as it runs, so it is never counted, never paused and never closed by
+// time. Accounts from before this was built are counted from their next
+// sign-in.
+export const DEFAULT_PAUSE_ITEMS = 5000;
+export const DEFAULT_CLOSE_DAYS = 183;                // six months
+const OPEN_STAMP_EVERY_MS = 60 * 60_000;              // the relay's stamp, at most hourly
+const pauseItemsOf = (ctx) => (Number(ctx.pauseItems) > 0 ? Number(ctx.pauseItems) : DEFAULT_PAUSE_ITEMS);
+const closeDaysOf = (ctx) => (Number(ctx.closeDays) > 0 ? Number(ctx.closeDays) : DEFAULT_CLOSE_DAYS);
+const receivedKey = (key, rec) => `${key}/${rec.openedAt}`;
+
+export async function receivedSince(ctx, key, rec) {
+  if (!ctx.readReceived || !rec.openedAt) return { items: 0, bytes: 0 };
+  const got = await ctx.readReceived(receivedKey(key, rec)).catch(() => null);
+  return { items: Number(got?.items) || 0, bytes: Number(got?.bytes) || 0 };
+}
+
+// One more content delivery reached the pod. Nothing to count against until
+// the owner has been here once.
+export async function noteReceived(ctx, key, rec, bytes) {
+  if (!ctx.readReceived || !ctx.writeReceived || !rec.openedAt) return;
+  const so = await receivedSince(ctx, key, rec);
+  await ctx.writeReceived(receivedKey(key, rec), { items: so.items + 1, bytes: so.bytes + (Number(bytes) || 0) })
+    .catch((e) => console.log(`front @${key}: count not written: ${e?.message || e}`));
+}
+
+// The owner is here. `always` is a sign-in; the relay stamps at most hourly,
+// so a busy hour of posting is one write. The count that went with the old
+// stamp is dropped: it is over, and a store should not keep one per hour.
+export async function noteOpened(ctx, key, rec, { always = false } = {}) {
+  if (!ctx.putDirectory) return rec;
+  if (!always && rec.openedAt && Date.now() - Date.parse(rec.openedAt) < OPEN_STAMP_EVERY_MS) return rec;
+  const next = { ...rec, openedAt: new Date().toISOString() };
+  await ctx.putDirectory(key, next);
+  if (rec.openedAt && ctx.dropReceived) await ctx.dropReceived(receivedKey(key, rec)).catch(() => {});
+  return next;
+}
+
+// Closed, and why. Reads no count: this is asked on every public read.
+export async function closedState(ctx, key, rec) {
+  if (rec.movedTo) return { closed: false };
+  if (rec.closedAt) return { closed: true, closedAt: rec.closedAt, closedBy: rec.closedBy || 'owner' };
+  if (rec.openedAt && Date.now() - Date.parse(rec.openedAt) > closeDaysOf(ctx) * 86400_000) {
+    const closedAt = new Date().toISOString();
+    if (ctx.putDirectory) await ctx.putDirectory(key, { ...rec, closedAt, closedBy: 'quiet' });
+    console.log(`front @${key}: closed — nothing opened it since ${rec.openedAt}`);
+    return { closed: true, closedAt, closedBy: 'quiet' };
+  }
+  return { closed: false };
+}
+
+// The whole standing of an account, for the door and for its owner's page.
+export async function accountState(ctx, key, rec) {
+  const c = await closedState(ctx, key, rec);
+  const received = c.closed ? { items: 0, bytes: 0 } : await receivedSince(ctx, key, rec);
+  const cap = pauseItemsOf(ctx);
+  const pausedBy = c.closed ? null : rec.pausedAt ? 'owner' : received.items >= cap ? 'quiet' : null;
+  return {
+    closed: c.closed, closedAt: c.closedAt || null, closedBy: c.closedBy || null,
+    paused: !!pausedBy, pausedBy, pausedAt: rec.pausedAt || null,
+    openedAt: rec.openedAt || null, received, pauseItems: cap, closeDays: closeDaysOf(ctx),
+  };
+}
+
+// A 410 with a reason, the shape every closed or moved id answers with.
+export const closedAnswer = (headers = {}, why = 'this address is closed') => ({
+  status: 410, headers: { 'cache-control': 'no-store', ...headers, 'content-type': 'application/json' },
+  body: JSON.stringify({ error: why }) });
+
+// The owner of a row, proved the way the relay proves them: a pod token whose
+// WebID is the row's, or lives on the row's pod for a row from before WebIDs
+// were recorded.
+async function provedOwner(request, pathname, ctx, rec, { j, verifyPodToken, webidUnderPod }) {
+  const webid = await verifyPodToken(request, pathname, ctx.verifier);
+  if (!webid) return { error: j(401, { error: 'a Solid-OIDC token proving the pod is required' }) };
+  const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
+  if (!owner) return { error: j(403, { error: "the token proves a different pod than this account's" }) };
+  return { webid };
+}
+
+// The owner's three routes. `deps` are front-core's own JSON reply and
+// token check, handed in so this module stays free of the router's privates.
+// Returns a response, or null when the path is not one of these.
+export async function routeQuietApi(request, pathname, ctx, deps) {
+  const { j } = deps;
+  if (!['/api/open', '/api/pause', '/api/close'].includes(pathname)) return null;
+  // A page at another origin asks first whether it may call, and is answered
+  // as the relay answers it. Unanswered, the browser never sends the call and
+  // some pages asked again every minute.
+  if (request.method === 'OPTIONS') return deps.apiPreflight();
+  if (request.method !== 'POST') return null;
+  // The owner is here: their browser says so as it opens the account. The
+  // answer is the account's standing at this gateway, which the manage page
+  // shows. A closed address is told so and nothing is written.
+  if (pathname === '/api/open' && request.method === 'POST') {
+    if (!ctx.putDirectory) return j(501, { error: 'this front keeps no directory' });
+    let body;
+    try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+    const handle = String(body.handle || '').toLowerCase();
+    let rec = await ctx.lookup(handle);
+    if (!rec) return j(404, { error: 'no such account' });
+    const who = await provedOwner(request, pathname, ctx, rec, deps);
+    if (who.error) return who.error;
+    const before = await closedState(ctx, handle, rec);
+    if (before.closed) return j(410, { error: 'this address is closed', closedAt: before.closedAt, closedBy: before.closedBy });
+    rec = await noteOpened(ctx, handle, rec, { always: true });
+    return j(200, { ok: true, handle, ...await accountState(ctx, handle, rec) });
+  }
+
+  // The owner pausing their own account, or lifting the pause they set.
+  if (pathname === '/api/pause' && request.method === 'POST') {
+    if (!ctx.putDirectory) return j(501, { error: 'this front keeps no directory' });
+    let body;
+    try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+    const handle = String(body.handle || '').toLowerCase();
+    let rec = await ctx.lookup(handle);
+    if (!rec) return j(404, { error: 'no such account' });
+    const who = await provedOwner(request, pathname, ctx, rec, deps);
+    if (who.error) return who.error;
+    const before = await closedState(ctx, handle, rec);
+    if (before.closed) return j(410, { error: 'this address is closed', closedAt: before.closedAt });
+    if (typeof body.paused !== 'boolean') return j(400, { error: 'paused must be true or false' });
+    if (body.paused && !rec.pausedAt) rec = { ...rec, pausedAt: new Date().toISOString() };
+    if (!body.paused && rec.pausedAt) { rec = { ...rec }; delete rec.pausedAt; }
+    // Lifting a pause is a sign-in's worth of "I am here": the count starts over.
+    if (!body.paused) rec = { ...rec, openedAt: new Date().toISOString() };
+    await ctx.putDirectory(handle, rec);
+    console.log(`front @${handle}: ${body.paused ? 'paused' : 'resumed'} by its owner`);
+    return j(200, { ok: true, handle, ...await accountState(ctx, handle, rec) });
+  }
+
+  // The owner closing their address for good. Repeating it changes nothing.
+  if (pathname === '/api/close' && request.method === 'POST') {
+    if (!ctx.putDirectory) return j(501, { error: 'this front keeps no directory' });
+    let body;
+    try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+    const handle = String(body.handle || '').toLowerCase();
+    let rec = await ctx.lookup(handle);
+    if (!rec) return j(404, { error: 'no such account' });
+    const who = await provedOwner(request, pathname, ctx, rec, deps);
+    if (who.error) return who.error;
+    if (body.confirm !== true) return j(400, { error: 'closing is for good — send confirm: true' });
+    if (!rec.closedAt) {
+      rec = { ...rec, closedAt: new Date().toISOString(), closedBy: 'owner' };
+      await ctx.putDirectory(handle, rec);
+      console.log(`front @${handle}: closed by its owner`);
+    }
+    return j(200, { ok: true, handle, ...await accountState(ctx, handle, rec) });
+  }
+
+  return null;
+}

package/lib/pod/containers.mjs

@@ -51,12 +51,16 @@ export async function provisionPublic(pod, base) {
  * The private half: the home itself and the state container.
  *
  * Idempotent, so two devices doing it at once is harmless — which is what
- * makes it safe to run on every boot rather than only at setup.
+ * makes it safe to run on every boot rather than only at setup. Asked before
+ * written: a browser's worker boots whenever the browser likes, and each boot
+ * used to write the canary and both rules again. Returns whether it wrote.
  */
 export async function provisionPrivate(pod, urls) {
+  if (await exists(pod, urls.state)) return false;
   await pod.putJson(keepUrl(urls.state), KEEP, KEEP_CT);
   await pod.setAcl(urls.state, []);
   await pod.setAcl(urls.home, []);
+  return true;
 }
 
 /**

package/lib/pod/inbox.mjs

@@ -85,13 +85,15 @@ export async function writeKeep(pod, urls) {
  * those and not the others is an inbox that is open when it should be shut.
  */
 export async function setPosture(pod, urls, posture) {
-  if (posture === 'open') return pod.setAcl(urls.inbox, ['Append']);
-  if (posture === 'closed') return pod.setAcl(urls.inbox, []);
+  // Restated at every start, and most starts find it already so: the rule is
+  // read first and written only when it differs (transport.setAcl ifChanged).
+  if (posture === 'open') return pod.setAcl(urls.inbox, ['Append'], { ifChanged: true });
+  if (posture === 'closed') return pod.setAcl(urls.inbox, [], { ifChanged: true });
   const webId = posture?.gatewayWebId;
   if (!webId) throw new Error(`inbox.setPosture: unknown posture ${JSON.stringify(posture)}`);
   // Public loses Append; the door keeps it. Both halves in one write, because
   // between two writes the inbox is either open to everyone or shut to the door.
-  return pod.setAcl(urls.inbox, [], { appendAgents: [webId] });
+  return pod.setAcl(urls.inbox, [], { appendAgents: [webId], ifChanged: true });
 }
 
 /**
@@ -145,3 +147,20 @@ export async function readDeliveryReceipt(pod, itemUrl, { maxBytes, readCapped }
  * @returns {Promise<boolean>} whether the pod removed it
  */
 export const dropHandledItem = (pod, url) => pod.delete(url);
+
+/**
+ * Remove the receipt a gateway wrote beside an item, once the item is gone.
+ * Best-effort: a receipt that stays is a stray document, never a lost
+ * delivery. Left behind, they were one stray per delivery, forever.
+ */
+export const dropReceiptBeside = (pod, url) => pod.delete(url + '.receipt.json').catch(() => false);
+
+/**
+ * Receipts whose item is no longer in the inbox, from the last listing: what
+ * earlier drains left behind. The drain removes a few of these each sweep
+ * until none are left.
+ */
+export const orphanReceipts = (pod, urls) => pod.orphanReceipts?.(urls.inbox) ?? [];
+
+/** Remove one such stray. @returns {Promise<boolean>} whether the pod removed it */
+export const dropStrayReceipt = (pod, url) => pod.delete(url).catch(() => false);

package/lib/pod/transport.mjs

@@ -345,7 +345,31 @@ export class PodTransport {
     const podTarget = this.toPod ? this.toPod(targetUrl) : targetUrl;
     const url = await this.aclUrlFor(podTarget);
     if (!await this.aclWritable(url)) return null;
-    return this.put(url, this.aclDoc(podTarget, publicModes, { ...opts, aclUrl: url }), 'text/turtle');
+    const doc = this.aclDoc(podTarget, publicModes, { ...opts, aclUrl: url });
+    // `ifChanged`: read the rule the pod holds and write only when it differs.
+    // For a rule restated at every start — the inbox door — a read is the
+    // whole cost, where a write took the pod's lock to say the same thing.
+    if (opts.ifChanged && await this.aclSame(url, doc)) return { status: 304, unchanged: true };
+    return this.put(url, doc, 'text/turtle');
+  }
+
+  // Whether the pod's rule at `aclUrl` states exactly what `doc` states.
+  // Compared as graphs, not bytes: the pod serialises what it holds its own
+  // way. Every rule this file writes names its subjects, so triple sets are
+  // enough; anything unreadable or with blank nodes reads as different.
+  async aclSame(aclUrl, doc) {
+    try {
+      const res = await this.fetch(aclUrl, { headers: { accept: 'text/turtle' } });
+      if (res.status !== 200) return false;
+      const triples = (text) => {
+        const g = $rdf.graph();
+        $rdf.parse(text, g, aclUrl, 'text/turtle');
+        if (g.statements.some((st) => st.subject.termType === 'BlankNode' || st.object.termType === 'BlankNode')) return null;
+        return g.statements.map((st) => `${st.subject.value} ${st.predicate.value} ${st.object.value}`).sort().join('\n');
+      };
+      const theirs = triples(await res.text());
+      return theirs !== null && theirs === triples(doc);
+    } catch { return false; }
   }
 
   // Child documents of an LDP container (URLs under it, excluding aux docs).
@@ -382,12 +406,14 @@ export class PodTransport {
     $rdf.parse(body, g, url, 'text/turtle');
     const here = $rdf.sym(url);
     const seen = new Set();
+    const receipts = new Set();
     const list = [];
     for (const child of g.each(here, LDP('contains'), null, here)) {
       const u = child.value;
       // `.receipt.json` is a verification receipt a gateway wrote beside an
       // inbox item — read with the item, never enumerated as an item itself.
-      if (!u.startsWith(url) || u === url || /\.(acl|meta|receipt\.json)$/.test(u) || seen.has(u)) continue;
+      if (u.endsWith('.receipt.json')) { receipts.add(u); continue; }
+      if (!u.startsWith(url) || u === url || /\.(acl|meta)$/.test(u) || seen.has(u)) continue;
       seen.add(u);
       list.push({
         url: u,
@@ -395,14 +421,21 @@ export class PodTransport {
         modified: g.any(child, DC('modified'), null, here)?.value || null,
       });
     }
+    // Whether a receipt sits beside each item, so the drain asks for one only
+    // where there is one; and the receipts nothing sits beside any more.
+    for (const item of list) item.receipt = receipts.has(item.url + '.receipt.json');
+    const orphans = [...receipts].filter((r) => !seen.has(r.slice(0, -'.receipt.json'.length)));
     // Oldest first. An LDP listing is a set, so without this a drain works in
     // whatever order the graph happened to parse — a mention from last week
     // after one from today, and no way to make progress predictable.
     list.sort((a, b) => String(a.modified || '').localeCompare(String(b.modified || '')));
-    this._listCache.set(url, { etag: res.headers.get('etag'), children: list });
+    this._listCache.set(url, { etag: res.headers.get('etag'), children: list, orphans });
     return list;
   }
 
+  /** Receipts in the last listing of `url` whose item is gone. */
+  orphanReceipts(url) { return this._listCache?.get(url)?.orphans ?? []; }
+
   /**
    * The WebID profile advertises the actor as an account:
    *   <webId> foaf:account <actor> .

package/lib/session/README.md

@@ -18,6 +18,9 @@ Once signed in, the account gives you:
 - **`post`** — publishes a post as them, public, unlisted or followers-only.
 - **`reply`** — answers a post.
 - **`timeline`** — their home timeline, newest first.
+- **`outbox`** — their own posts, newest first. Pass `rdf: true` to also get
+  the real thing as RDF, for an app that wants to work with it as linked
+  data rather than as this library's own shape.
 - **`follow`** — follows someone by handle.
 - **`favourite`**, **`boost`** — as they say.
 - **`profile`** — who they are as their server or pod shows them: name,
@@ -37,6 +40,8 @@ DeviceAgent or Server account, and when fedipod.net is next open for a
 browser-based one.
 
 Three files, no dependencies. It runs in a page and in a service worker.
+The one exception: `outbox({ rdf: true })` needs the `jsonld` package, and
+only loads it when that flag is actually used.
 
 [The demo](https://jeff-zucker.github.io/FediPod/) shows the sign-in and
 the profile that comes back.
@@ -73,6 +78,7 @@ const me = await accounts.current();                       // null when nobody i
 if (me?.notice) show(me.notice);
 await me.post({ text: 'Hello from my app' });
 for (const p of await me.timeline({ limit: 20 })) render(p);
+for (const p of await me.outbox({ limit: 20 })) render(p);
 await me.follow('@aisha@her.server');
 await me.reply(p.url, 'Well said');
 await me.signOut();
@@ -93,6 +99,14 @@ await me.signOut();
 - **`reply(post, text)`** — the post is named by its address or its id.
 - **`timeline({ limit })`** — each post as `{ id, url, author: { id, handle,
   name }, html, published, inReplyTo }`.
+- **`outbox({ limit, rdf })`** — the same shape as `timeline`, but only this
+  account's own posts. With `rdf: true`, the returned array also carries
+  `.rdf`: the real outbox parsed into an RDF/JS quad array — for a Mastodon
+  account too, since a Mastodon server is itself an ActivityPub server with
+  a real actor and outbox, same as a pod's. It comes back empty on a server
+  that requires a signed request just to read that document, which some
+  do. Reading it needs the `jsonld` package available to your app; without
+  `rdf: true` nothing changes and nothing extra loads.
 - **`fetch`** — the raw authenticated fetch, for anything the above does not
   cover.
 - **`actor`** — the account's ActivityPub id.

package/lib/session/fedi-account.mjs

@@ -15,6 +15,8 @@
 //   await me.post({ text });            await me.timeline({ limit: 20 })
 //   await me.reply(postUrlOrId, text);  await me.follow('@aisha@her.server')
 //   await me.favourite(postUrlOrId);    await me.boost(postUrlOrId)
+//   await me.outbox({ limit: 20 });     // this account's own posts, newest first
+//   await me.outbox({ rdf: true });     // the same, plus the real RDF graph on .rdf
 //   await me.signOut()
 //
 // A Mastodon account is used through its server's API with a token the
@@ -58,6 +60,35 @@ export function fediAccount({
     return body;
   };
 
+  // Only loaded when `outbox({ rdf: true })` is actually called, so nobody
+  // pays for a JSON-LD parser just by importing this file. Not in
+  // `dependencies` — the app supplies "jsonld" if it wants this flag to work.
+  const loadJsonLd = async () => {
+    try { return (await import('jsonld')).default; }
+    catch { throw new Error('outbox({ rdf: true }) needs the "jsonld" package available to the app — it is not bundled with this library'); }
+  };
+
+  // The account's real outbox, read from the pod: the head collection names
+  // `first`, each page names `orderedItems` and (while there is more) `next`.
+  // Walked only far enough to cover `limit`, and run through jsonld.toRDF so
+  // the result is a genuine RDF/JS quad array, not this library's own shape.
+  const fetchOutboxRdf = async (actorUrl, limit) => {
+    if (!actorUrl) return null;
+    const jsonld = await loadJsonLd();
+    const actorDoc = await json(actorUrl, { headers: { accept: 'application/activity+json' } });
+    let pageUrl = actorDoc?.outbox ? (await json(actorDoc.outbox, { headers: { accept: 'application/activity+json' } }))?.first : null;
+    const quads = []; const seen = new Set(); let collected = 0;
+    while (pageUrl && collected < limit && !seen.has(pageUrl)) {
+      seen.add(pageUrl);
+      const page = await json(pageUrl, { headers: { accept: 'application/activity+json' } });
+      if (!page) break;
+      quads.push(...(await jsonld.toRDF(page)));
+      collected += (page.orderedItems || []).length;
+      pageUrl = page.next || null;
+    }
+    return quads;
+  };
+
   // ---- finding out what an address is ----
 
   // Does this host speak the Mastodon API? Any server of that family says so
@@ -255,6 +286,20 @@ export function fediAccount({
         const list = await call(`/api/v1/timelines/home?limit=${Math.min(40, limit)}`).then((r) => said(r, a.host));
         return (Array.isArray(list) ? list : []).map(item);
       },
+      // This account's own posts, newest first — Mastodon's equivalent of an
+      // outbox. A Mastodon server IS an ActivityPub server, so its actor and
+      // outbox are real AS2/JSON-LD too, same as a pod's; `rdf: true` reads
+      // that, not the REST API above. It comes back empty on an instance that
+      // requires a signed request just to read the public actor document
+      // (some do — mastodon.social among them); `fetchOutboxRdf`'s plain GET
+      // then gets 401 and the loop below finds nothing to walk.
+      async outbox({ limit = 20, rdf = false } = {}) {
+        const me = await call('/api/v1/accounts/verify_credentials').then((r) => said(r, a.host));
+        const list = await call(`/api/v1/accounts/${me.id}/statuses?limit=${Math.min(40, limit)}`).then((r) => said(r, a.host));
+        const items = (Array.isArray(list) ? list : []).map(item);
+        if (rdf) items.rdf = await fetchOutboxRdf(a.actor, limit);
+        return items;
+      },
       async follow(handle) {
         const who = parseAddress(handle);
         if (!who?.at) throw new Error('a handle looks like @you@your.server');
@@ -314,6 +359,23 @@ export function fediAccount({
           .slice(0, limit)
           .map((s) => ({ id: s.noteId, url: s.noteId, published: s.published || null, author: who(s.actor), html: s.content || '', inReplyTo: s.inReplyTo || null }));
       },
+      // This account's own posts, newest first, read from the same local
+      // record `timeline` uses (fast, no network call). With `rdf: true`,
+      // also fetches the real outbox from the pod and parses it into RDF/JS
+      // quads on the returned array's `.rdf` — a second, live document, not
+      // derived from the local record, so it needs `jsonld` (see loadJsonLd).
+      async outbox({ limit = 20, rdf = false } = {}) {
+        const rows = await state('statuses.json');
+        const actors = (await state('actors.json')) || {};
+        const who = (id) => { const d = actors[id]?.doc || actors[id] || {}; return { id, handle: d.preferredUsername ? `@${d.preferredUsername}@${new URL(id).host}` : null, name: d.name || null }; };
+        const items = (Array.isArray(rows) ? rows : [])
+          .filter((s) => s.kind === 'post')
+          .sort((x, y) => String(y.published || '').localeCompare(String(x.published || '')))
+          .slice(0, limit)
+          .map((s) => ({ id: s.noteId, url: s.noteId, published: s.published || null, author: who(s.actor), html: s.content || '', inReplyTo: s.inReplyTo || null }));
+        if (rdf) items.rdf = await fetchOutboxRdf(facts.actor, limit);
+        return items;
+      },
       async follow(handle) {
         const who = parseAddress(handle);
         if (!who?.at) throw new Error('a handle looks like @you@your.server');

package/lib/session/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fediverse-account",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Type a Fediverse handle or a WebID and get back an account you can act with: post, read its timeline, follow, reply, favourite, boost. Works out whether the account lives on a Mastodon-family server or on a Solid pod through FediPod, sends the person to sign in there, brings them back to where they were, and speaks to whichever it is.",
   "type": "module",
   "license": "MIT",
@@ -37,5 +37,13 @@
   "scripts": {
     "prepublishOnly": "node ../../scripts/check-pod-calls.mjs"
   },
-  "dependencies": {}
+  "dependencies": {},
+  "peerDependencies": {
+    "jsonld": "^9.0.0"
+  },
+  "peerDependenciesMeta": {
+    "jsonld": {
+      "optional": true
+    }
+  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.30.0",
+  "version": "1.36.6",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",

package/run-agent.mjs

@@ -53,6 +53,7 @@ import { exposureProblem, hostLabel } from './lib/shared/guard.mjs';
 import { pendingSteps } from './lib/device/migrate.mjs';
 import { apUrls, assertionKeyId , publicHandle } from './lib/core/wire.mjs';
 import { followActor, unfollowActor, resolveHandle } from './lib/core/social.mjs';
+import * as podInbox from './lib/pod/inbox.mjs';
 
 export class Agent {
   constructor({ home, log }) {
@@ -510,6 +511,19 @@ export class Agent {
     return true;
   }
 
+  // The inbox's door must be open to the world (or to the gateway alone, in
+  // locked mode) or nothing anyone sends ever lands. The permission is written
+  // at setup, and a container made again later — a root move, a pod rebuilt —
+  // came back without it: the group's inbox on fp2 refused every delivery for
+  // nine days while its agent ran on, healthy-looking. One write per start,
+  // and it is idempotent.
+  async ensureInboxOpen() {
+    const g = this.store.getConfig()?.gateway;
+    const posture = g?.mode === 'locked' && g.webId ? { gatewayWebId: g.webId } : 'open';
+    await podInbox.setPosture(this.remote, this.urls, posture);
+    return posture;
+  }
+
   // Read-only mode: refresh the state cache periodically, and take over the
   // moment the active agent's lease frees.
   startViewer() {
@@ -607,6 +621,8 @@ export class Agent {
         .catch(e => this.log(`actor check failed: ${e.message}`));
       this.ensureFeaturedPublished()
         .catch(e => this.log(`featured check failed: ${e.message}`));
+      this.ensureInboxOpen()
+        .catch(e => this.log(`inbox door check failed: ${e.message}`));
       // The human page, rewritten only when what it shows has changed: one
       // local digest compare, and a write the first time after an upgrade.
       this.publisher.publishProfilePage()

package/scripts/stage-site.mjs

@@ -86,7 +86,7 @@ const shell = (text, c) => text
   .replace('src="../../"', `src="${c.path}"`)
   .replace('<script src="client.js"></script>',
     c.login ? '<script src="/admin/client/client.js"></script>' : '')
-  .replace('>sign out</a>', `>sign out</a>${clientBar()}`)
+  .replace('<span id="account-pick">', `${clientBar()}\n  <span id="account-pick">`)
   .replace('</head>', '<script src="/admin/client-pick.js"></script>\n</head>')
   .replace('</body>', `${clientNews()}</body>`);
 
@@ -136,7 +136,7 @@ const copyAdmin = (from, to) => { fs.mkdirSync(to, { recursive: true });
       // A sign-out beside "manage account", on every bar. It clears the FediPod
       // session, the client's stored account, browser-stored connected keys, and
       // the worker — the /?signout page (boot.js) does the teardown.
-      .replace('>manage account</a>', '>manage account</a>\n  <a id="bar-signout" href="/?signout" title="   Sign out of FediPod and clear this browser">sign out</a>')
+      .replace(/(<a id="bar-manage"[^>]*>manage<\/a>)/u, '$1\n  <a id="bar-signout" href="/?signout" title="   Sign out of FediPod and clear this browser">sign out</a>')
       .replace('</head>', '<style>#actor-pick{display:none!important}</style>\n</head>');
     text = withUpdate(text);
     if (/[/\\]client$/.test(from)) {
@@ -147,7 +147,7 @@ const copyAdmin = (from, to) => { fs.mkdirSync(to, { recursive: true });
     } else if (/[/\\]admin$/.test(from)) {
       // The record page carries the same client control as the shells: it is
       // the page the owner is on when they want to change which client opens.
-      text = text.replace('>sign out</a>', `>sign out</a>${clientBar()}`)
+      text = text.replace('<span id="account-pick">', `${clientBar()}\n  <span id="account-pick">`)
         .replace('</head>', '<script src="/admin/client-pick.js"></script>\n</head>')
   .replace('</body>', `${clientNews()}</body>`);
       // Hide controls the browser build does not carry: the manual drain (it
@@ -197,6 +197,9 @@ fs.writeFileSync(path.join(site, '_redirects'), [
   '/api/roster             /.netlify/functions/front  200',
   '/api/revoke             /.netlify/functions/front  200',
   '/api/agent              /.netlify/functions/front  200',
+  '/api/notices            /.netlify/functions/front  200',
+  '/notices                /.netlify/functions/front  200',
+  '/notices.js             /.netlify/functions/front  200',
   '/u/*                    /.netlify/functions/front  200',
   '/.well-known/*          /.netlify/functions/front  200',
   '/@*                     /.netlify/functions/front  200',

package/web/admin/bar.css

@@ -62,16 +62,32 @@ body { background: var(--surface); }
    quieter than the links; the one in use is marked `aria-current="true"` — the
    current item of a set, which on the record page is not the current PAGE — so
    it needs its own mark rather than borrowing the rule above. */
-#bar #client-pick { display: inline-flex; gap: .6rem; align-items: baseline;
+#bar #client-pick, #bar #account-pick { display: inline-flex; gap: .6rem; align-items: baseline;
   white-space: nowrap; margin-left: 1rem; }
-#bar #client-now { opacity: .75; }
+#bar #client-now, #bar #account-now { opacity: .75; }
+/* The notices bell: the one filled control in the bar, because it is the one
+   thing there that is not a place to go but something to be told. The count is
+   how many notices this browser has not opened yet; with none it is quiet. */
+#bar #bar-notices { display: inline-flex; align-items: center; gap: .35rem; margin-left: 1rem;
+  padding: .3rem .7rem; border-radius: 999px; font-size: 1.05rem; line-height: 1;
+  background: var(--btn); color: var(--btn-text); border: 1px solid var(--btn); }
+/* `display` on an id rule outranks the browser's own [hidden] rule, and the
+   shell has no !important of its own, so the bell hid on the record page and
+   showed on the client with nothing to show. Said here, once, for every page. */
+#bar #bar-notices[hidden] { display: none; }
+#bar #bar-notices:hover { background: var(--btn-hover); border-color: var(--btn-hover); }
+#bar #bar-notices:focus-visible { outline: 3px solid var(--ring); outline-offset: 2px; }
+#bar #bar-notices-count { font-size: .9rem; font-weight: 700; min-width: 1.3em; text-align: center;
+  padding: .05rem .4rem; border-radius: 999px; background: var(--btn-text); color: var(--btn); }
+#bar #bar-notices-count:empty { display: none; }
+#bar #bar-notices[data-new="0"] { background: var(--field-bg); color: var(--ink); border-color: var(--field-edge); }
 #bar a[aria-current="true"] {
   font-weight: 700; text-decoration: underline; text-underline-offset: .3rem; }
 
 /* The two-clients notice: said once, to somebody who knew this page when it
    had one client. Sized and placed rather than left to the browser's default,
    which stretched it edge to edge and put it over the very links it names. */
-#client-news {
+#client-news, #notices-list, #notice-view {
   /* Low rather than centred: it points at the links in the bar, so the bar has
      to stay in view while it is read. */
   max-width: 34rem; margin: auto auto 2.5rem; padding: 1.5rem 1.7rem;
@@ -80,13 +96,31 @@ body { background: var(--surface); }
   font: 1rem/1.55 var(--font);
   box-shadow: 0 .6rem 2rem rgba(0, 0, 0, .25);
 }
-#client-news::backdrop { background: rgba(0, 0, 0, .45); }
-#client-news h2 { font-size: 1.25rem; margin: 0 0 .9rem; color: var(--heading); }
-#client-news p { margin: 0 0 1.2rem; }
-#client-news p:last-child { margin: 0; }
-#client-news button {
+#client-news::backdrop, #notices-list::backdrop, #notice-view::backdrop { background: rgba(0, 0, 0, .45); }
+#client-news h2, #notices-list h2, #notice-view h2 { font-size: 1.25rem; margin: 0 0 .9rem; color: var(--heading); }
+#client-news p, #notices-list p, #notice-view p { margin: 0 0 1.2rem; }
+#client-news p:last-child, #notices-list p:last-child, #notice-view p:last-child { margin: 0; }
+#client-news button, #notices-list button, #notice-view button {
   font: inherit; padding: .55rem 1.3rem; border-radius: .35rem; cursor: pointer;
   background: var(--btn); color: var(--btn-text); border: 1px solid var(--btn);
 }
-#client-news button:hover { background: var(--btn-hover); border-color: var(--btn-hover); }
-#client-news button:focus-visible { outline: 3px solid var(--ring); outline-offset: 2px; }
+#client-news button:hover, #notices-list button:hover, #notice-view button:hover { background: var(--btn-hover); border-color: var(--btn-hover); }
+#client-news button:focus-visible, #notices-list button:focus-visible, #notice-view button:focus-visible { outline: 3px solid var(--ring); outline-offset: 2px; }
+
+/* The notices dialogs are centred and never taller than the window: the
+   client-news rule above sits low, and a short window pushed a list of
+   notices up past the top edge where nothing could reach it. */
+#notices-list, #notice-view { margin: auto; max-height: calc(100dvh - 3rem); overflow: auto; box-sizing: border-box; }
+/* The list of notices: each title a button that opens that notice, the date
+   beside it, the ones not yet opened here in bold. */
+#notices-items { list-style: none; margin: 0 0 1.2rem; padding: 0; }
+#notices-items li { display: flex; gap: .8rem; align-items: baseline; padding: .45rem 0;
+  border-bottom: 1px solid var(--line); }
+#notices-items li:last-child { border-bottom: 0; }
+#notices-items button.notice-open { flex: 1 1 auto; text-align: left; padding: .1rem 0;
+  background: none; border: 0; color: var(--link); text-decoration: underline; text-underline-offset: .2rem; }
+#notices-items li.new button.notice-open { font-weight: 700; }
+#notices-items .when, #notice-view .when { color: var(--sub); font-size: .9rem; white-space: nowrap; }
+#notices-items p.none { color: var(--sub); }
+#notice-view-body p { margin: 0 0 .9rem; }
+#notice-view-body a { color: var(--link); word-break: break-all; }