fedipod 1.32.0 → 1.36.6

package/lib/pod/inbox.mjs

@@ -85,13 +85,15 @@ export async function writeKeep(pod, urls) {
  * those and not the others is an inbox that is open when it should be shut.
  */
 export async function setPosture(pod, urls, posture) {
-  if (posture === 'open') return pod.setAcl(urls.inbox, ['Append']);
-  if (posture === 'closed') return pod.setAcl(urls.inbox, []);
+  // Restated at every start, and most starts find it already so: the rule is
+  // read first and written only when it differs (transport.setAcl ifChanged).
+  if (posture === 'open') return pod.setAcl(urls.inbox, ['Append'], { ifChanged: true });
+  if (posture === 'closed') return pod.setAcl(urls.inbox, [], { ifChanged: true });
   const webId = posture?.gatewayWebId;
   if (!webId) throw new Error(`inbox.setPosture: unknown posture ${JSON.stringify(posture)}`);
   // Public loses Append; the door keeps it. Both halves in one write, because
   // between two writes the inbox is either open to everyone or shut to the door.
-  return pod.setAcl(urls.inbox, [], { appendAgents: [webId] });
+  return pod.setAcl(urls.inbox, [], { appendAgents: [webId], ifChanged: true });
 }
 
 /**
@@ -145,3 +147,20 @@ export async function readDeliveryReceipt(pod, itemUrl, { maxBytes, readCapped }
  * @returns {Promise<boolean>} whether the pod removed it
  */
 export const dropHandledItem = (pod, url) => pod.delete(url);
+
+/**
+ * Remove the receipt a gateway wrote beside an item, once the item is gone.
+ * Best-effort: a receipt that stays is a stray document, never a lost
+ * delivery. Left behind, they were one stray per delivery, forever.
+ */
+export const dropReceiptBeside = (pod, url) => pod.delete(url + '.receipt.json').catch(() => false);
+
+/**
+ * Receipts whose item is no longer in the inbox, from the last listing: what
+ * earlier drains left behind. The drain removes a few of these each sweep
+ * until none are left.
+ */
+export const orphanReceipts = (pod, urls) => pod.orphanReceipts?.(urls.inbox) ?? [];
+
+/** Remove one such stray. @returns {Promise<boolean>} whether the pod removed it */
+export const dropStrayReceipt = (pod, url) => pod.delete(url).catch(() => false);

package/lib/pod/transport.mjs

@@ -345,7 +345,31 @@ export class PodTransport {
     const podTarget = this.toPod ? this.toPod(targetUrl) : targetUrl;
     const url = await this.aclUrlFor(podTarget);
     if (!await this.aclWritable(url)) return null;
-    return this.put(url, this.aclDoc(podTarget, publicModes, { ...opts, aclUrl: url }), 'text/turtle');
+    const doc = this.aclDoc(podTarget, publicModes, { ...opts, aclUrl: url });
+    // `ifChanged`: read the rule the pod holds and write only when it differs.
+    // For a rule restated at every start — the inbox door — a read is the
+    // whole cost, where a write took the pod's lock to say the same thing.
+    if (opts.ifChanged && await this.aclSame(url, doc)) return { status: 304, unchanged: true };
+    return this.put(url, doc, 'text/turtle');
+  }
+
+  // Whether the pod's rule at `aclUrl` states exactly what `doc` states.
+  // Compared as graphs, not bytes: the pod serialises what it holds its own
+  // way. Every rule this file writes names its subjects, so triple sets are
+  // enough; anything unreadable or with blank nodes reads as different.
+  async aclSame(aclUrl, doc) {
+    try {
+      const res = await this.fetch(aclUrl, { headers: { accept: 'text/turtle' } });
+      if (res.status !== 200) return false;
+      const triples = (text) => {
+        const g = $rdf.graph();
+        $rdf.parse(text, g, aclUrl, 'text/turtle');
+        if (g.statements.some((st) => st.subject.termType === 'BlankNode' || st.object.termType === 'BlankNode')) return null;
+        return g.statements.map((st) => `${st.subject.value} ${st.predicate.value} ${st.object.value}`).sort().join('\n');
+      };
+      const theirs = triples(await res.text());
+      return theirs !== null && theirs === triples(doc);
+    } catch { return false; }
   }
 
   // Child documents of an LDP container (URLs under it, excluding aux docs).
@@ -382,12 +406,14 @@ export class PodTransport {
     $rdf.parse(body, g, url, 'text/turtle');
     const here = $rdf.sym(url);
     const seen = new Set();
+    const receipts = new Set();
     const list = [];
     for (const child of g.each(here, LDP('contains'), null, here)) {
       const u = child.value;
       // `.receipt.json` is a verification receipt a gateway wrote beside an
       // inbox item — read with the item, never enumerated as an item itself.
-      if (!u.startsWith(url) || u === url || /\.(acl|meta|receipt\.json)$/.test(u) || seen.has(u)) continue;
+      if (u.endsWith('.receipt.json')) { receipts.add(u); continue; }
+      if (!u.startsWith(url) || u === url || /\.(acl|meta)$/.test(u) || seen.has(u)) continue;
       seen.add(u);
       list.push({
         url: u,
@@ -395,14 +421,21 @@ export class PodTransport {
         modified: g.any(child, DC('modified'), null, here)?.value || null,
       });
     }
+    // Whether a receipt sits beside each item, so the drain asks for one only
+    // where there is one; and the receipts nothing sits beside any more.
+    for (const item of list) item.receipt = receipts.has(item.url + '.receipt.json');
+    const orphans = [...receipts].filter((r) => !seen.has(r.slice(0, -'.receipt.json'.length)));
     // Oldest first. An LDP listing is a set, so without this a drain works in
     // whatever order the graph happened to parse — a mention from last week
     // after one from today, and no way to make progress predictable.
     list.sort((a, b) => String(a.modified || '').localeCompare(String(b.modified || '')));
-    this._listCache.set(url, { etag: res.headers.get('etag'), children: list });
+    this._listCache.set(url, { etag: res.headers.get('etag'), children: list, orphans });
     return list;
   }
 
+  /** Receipts in the last listing of `url` whose item is gone. */
+  orphanReceipts(url) { return this._listCache?.get(url)?.orphans ?? []; }
+
   /**
    * The WebID profile advertises the actor as an account:
    *   <webId> foaf:account <actor> .

package/lib/session/README.md

@@ -18,6 +18,9 @@ Once signed in, the account gives you:
 - **`post`** — publishes a post as them, public, unlisted or followers-only.
 - **`reply`** — answers a post.
 - **`timeline`** — their home timeline, newest first.
+- **`outbox`** — their own posts, newest first. Pass `rdf: true` to also get
+  the real thing as RDF, for an app that wants to work with it as linked
+  data rather than as this library's own shape.
 - **`follow`** — follows someone by handle.
 - **`favourite`**, **`boost`** — as they say.
 - **`profile`** — who they are as their server or pod shows them: name,
@@ -37,6 +40,8 @@ DeviceAgent or Server account, and when fedipod.net is next open for a
 browser-based one.
 
 Three files, no dependencies. It runs in a page and in a service worker.
+The one exception: `outbox({ rdf: true })` needs the `jsonld` package, and
+only loads it when that flag is actually used.
 
 [The demo](https://jeff-zucker.github.io/FediPod/) shows the sign-in and
 the profile that comes back.
@@ -73,6 +78,7 @@ const me = await accounts.current();                       // null when nobody i
 if (me?.notice) show(me.notice);
 await me.post({ text: 'Hello from my app' });
 for (const p of await me.timeline({ limit: 20 })) render(p);
+for (const p of await me.outbox({ limit: 20 })) render(p);
 await me.follow('@aisha@her.server');
 await me.reply(p.url, 'Well said');
 await me.signOut();
@@ -93,6 +99,14 @@ await me.signOut();
 - **`reply(post, text)`** — the post is named by its address or its id.
 - **`timeline({ limit })`** — each post as `{ id, url, author: { id, handle,
   name }, html, published, inReplyTo }`.
+- **`outbox({ limit, rdf })`** — the same shape as `timeline`, but only this
+  account's own posts. With `rdf: true`, the returned array also carries
+  `.rdf`: the real outbox parsed into an RDF/JS quad array — for a Mastodon
+  account too, since a Mastodon server is itself an ActivityPub server with
+  a real actor and outbox, same as a pod's. It comes back empty on a server
+  that requires a signed request just to read that document, which some
+  do. Reading it needs the `jsonld` package available to your app; without
+  `rdf: true` nothing changes and nothing extra loads.
 - **`fetch`** — the raw authenticated fetch, for anything the above does not
   cover.
 - **`actor`** — the account's ActivityPub id.

package/lib/session/fedi-account.mjs

@@ -15,6 +15,8 @@
 //   await me.post({ text });            await me.timeline({ limit: 20 })
 //   await me.reply(postUrlOrId, text);  await me.follow('@aisha@her.server')
 //   await me.favourite(postUrlOrId);    await me.boost(postUrlOrId)
+//   await me.outbox({ limit: 20 });     // this account's own posts, newest first
+//   await me.outbox({ rdf: true });     // the same, plus the real RDF graph on .rdf
 //   await me.signOut()
 //
 // A Mastodon account is used through its server's API with a token the
@@ -58,6 +60,35 @@ export function fediAccount({
     return body;
   };
 
+  // Only loaded when `outbox({ rdf: true })` is actually called, so nobody
+  // pays for a JSON-LD parser just by importing this file. Not in
+  // `dependencies` — the app supplies "jsonld" if it wants this flag to work.
+  const loadJsonLd = async () => {
+    try { return (await import('jsonld')).default; }
+    catch { throw new Error('outbox({ rdf: true }) needs the "jsonld" package available to the app — it is not bundled with this library'); }
+  };
+
+  // The account's real outbox, read from the pod: the head collection names
+  // `first`, each page names `orderedItems` and (while there is more) `next`.
+  // Walked only far enough to cover `limit`, and run through jsonld.toRDF so
+  // the result is a genuine RDF/JS quad array, not this library's own shape.
+  const fetchOutboxRdf = async (actorUrl, limit) => {
+    if (!actorUrl) return null;
+    const jsonld = await loadJsonLd();
+    const actorDoc = await json(actorUrl, { headers: { accept: 'application/activity+json' } });
+    let pageUrl = actorDoc?.outbox ? (await json(actorDoc.outbox, { headers: { accept: 'application/activity+json' } }))?.first : null;
+    const quads = []; const seen = new Set(); let collected = 0;
+    while (pageUrl && collected < limit && !seen.has(pageUrl)) {
+      seen.add(pageUrl);
+      const page = await json(pageUrl, { headers: { accept: 'application/activity+json' } });
+      if (!page) break;
+      quads.push(...(await jsonld.toRDF(page)));
+      collected += (page.orderedItems || []).length;
+      pageUrl = page.next || null;
+    }
+    return quads;
+  };
+
   // ---- finding out what an address is ----
 
   // Does this host speak the Mastodon API? Any server of that family says so
@@ -255,6 +286,20 @@ export function fediAccount({
         const list = await call(`/api/v1/timelines/home?limit=${Math.min(40, limit)}`).then((r) => said(r, a.host));
         return (Array.isArray(list) ? list : []).map(item);
       },
+      // This account's own posts, newest first — Mastodon's equivalent of an
+      // outbox. A Mastodon server IS an ActivityPub server, so its actor and
+      // outbox are real AS2/JSON-LD too, same as a pod's; `rdf: true` reads
+      // that, not the REST API above. It comes back empty on an instance that
+      // requires a signed request just to read the public actor document
+      // (some do — mastodon.social among them); `fetchOutboxRdf`'s plain GET
+      // then gets 401 and the loop below finds nothing to walk.
+      async outbox({ limit = 20, rdf = false } = {}) {
+        const me = await call('/api/v1/accounts/verify_credentials').then((r) => said(r, a.host));
+        const list = await call(`/api/v1/accounts/${me.id}/statuses?limit=${Math.min(40, limit)}`).then((r) => said(r, a.host));
+        const items = (Array.isArray(list) ? list : []).map(item);
+        if (rdf) items.rdf = await fetchOutboxRdf(a.actor, limit);
+        return items;
+      },
       async follow(handle) {
         const who = parseAddress(handle);
         if (!who?.at) throw new Error('a handle looks like @you@your.server');
@@ -314,6 +359,23 @@ export function fediAccount({
           .slice(0, limit)
           .map((s) => ({ id: s.noteId, url: s.noteId, published: s.published || null, author: who(s.actor), html: s.content || '', inReplyTo: s.inReplyTo || null }));
       },
+      // This account's own posts, newest first, read from the same local
+      // record `timeline` uses (fast, no network call). With `rdf: true`,
+      // also fetches the real outbox from the pod and parses it into RDF/JS
+      // quads on the returned array's `.rdf` — a second, live document, not
+      // derived from the local record, so it needs `jsonld` (see loadJsonLd).
+      async outbox({ limit = 20, rdf = false } = {}) {
+        const rows = await state('statuses.json');
+        const actors = (await state('actors.json')) || {};
+        const who = (id) => { const d = actors[id]?.doc || actors[id] || {}; return { id, handle: d.preferredUsername ? `@${d.preferredUsername}@${new URL(id).host}` : null, name: d.name || null }; };
+        const items = (Array.isArray(rows) ? rows : [])
+          .filter((s) => s.kind === 'post')
+          .sort((x, y) => String(y.published || '').localeCompare(String(x.published || '')))
+          .slice(0, limit)
+          .map((s) => ({ id: s.noteId, url: s.noteId, published: s.published || null, author: who(s.actor), html: s.content || '', inReplyTo: s.inReplyTo || null }));
+        if (rdf) items.rdf = await fetchOutboxRdf(facts.actor, limit);
+        return items;
+      },
       async follow(handle) {
         const who = parseAddress(handle);
         if (!who?.at) throw new Error('a handle looks like @you@your.server');

package/lib/session/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fediverse-account",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Type a Fediverse handle or a WebID and get back an account you can act with: post, read its timeline, follow, reply, favourite, boost. Works out whether the account lives on a Mastodon-family server or on a Solid pod through FediPod, sends the person to sign in there, brings them back to where they were, and speaks to whichever it is.",
   "type": "module",
   "license": "MIT",
@@ -37,5 +37,13 @@
   "scripts": {
     "prepublishOnly": "node ../../scripts/check-pod-calls.mjs"
   },
-  "dependencies": {}
+  "dependencies": {},
+  "peerDependencies": {
+    "jsonld": "^9.0.0"
+  },
+  "peerDependenciesMeta": {
+    "jsonld": {
+      "optional": true
+    }
+  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.32.0",
+  "version": "1.36.6",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",

package/run-agent.mjs

@@ -53,6 +53,7 @@ import { exposureProblem, hostLabel } from './lib/shared/guard.mjs';
 import { pendingSteps } from './lib/device/migrate.mjs';
 import { apUrls, assertionKeyId , publicHandle } from './lib/core/wire.mjs';
 import { followActor, unfollowActor, resolveHandle } from './lib/core/social.mjs';
+import * as podInbox from './lib/pod/inbox.mjs';
 
 export class Agent {
   constructor({ home, log }) {
@@ -510,6 +511,19 @@ export class Agent {
     return true;
   }
 
+  // The inbox's door must be open to the world (or to the gateway alone, in
+  // locked mode) or nothing anyone sends ever lands. The permission is written
+  // at setup, and a container made again later — a root move, a pod rebuilt —
+  // came back without it: the group's inbox on fp2 refused every delivery for
+  // nine days while its agent ran on, healthy-looking. One write per start,
+  // and it is idempotent.
+  async ensureInboxOpen() {
+    const g = this.store.getConfig()?.gateway;
+    const posture = g?.mode === 'locked' && g.webId ? { gatewayWebId: g.webId } : 'open';
+    await podInbox.setPosture(this.remote, this.urls, posture);
+    return posture;
+  }
+
   // Read-only mode: refresh the state cache periodically, and take over the
   // moment the active agent's lease frees.
   startViewer() {
@@ -607,6 +621,8 @@ export class Agent {
         .catch(e => this.log(`actor check failed: ${e.message}`));
       this.ensureFeaturedPublished()
         .catch(e => this.log(`featured check failed: ${e.message}`));
+      this.ensureInboxOpen()
+        .catch(e => this.log(`inbox door check failed: ${e.message}`));
       // The human page, rewritten only when what it shows has changed: one
       // local digest compare, and a write the first time after an upgrade.
       this.publisher.publishProfilePage()

package/web/app/agent.mjs

@@ -169,12 +169,14 @@ export class BrowserAgent {
     this.lease.onLost = () => this.demote();
     this.lease.startRenewal();
     try {
-      // Forced, not revalidated. While this device watched, the ACTIVE one was
-      // writing; our cache is however stale the last viewer poll left it, and
-      // the store is write-through — so the first write from here would push a
-      // whole document back over newer state. Read what is actually there
-      // before acting on it.
-      await this.store.load({ force: true }).catch((e) => this.log(`re-reading state: ${e.message}`));
+      // Forced, not revalidated, when this device WATCHED first: the active
+      // one was writing, our cache is however stale the last viewer poll left
+      // it, and the store is write-through — so the first write from here
+      // would push a whole document back over newer state. A device that
+      // booted straight into acting read everything a moment ago; asking
+      // again is one revalidation, not a second download of every document.
+      await this.store.load({ force: !!this._watched }).catch((e) => this.log(`re-reading state: ${e.message}`));
+      this._watched = false;
       // Own posts the outbox names and the timeline index lacks come back
       // here, before anything acts on the index.
       await this.publisher.healStatuses().catch((e) => this.log(`healing the timeline index: ${e.message}`));
@@ -202,6 +204,7 @@ export class BrowserAgent {
   demote() {
     if (this.viewer) return;
     this.viewer = true;
+    this._watched = true;
     this.log('another device took over — read-only here');
     this.lease.stopRenewal();
     clearInterval(this._openTimer); this._openTimer = null;
@@ -355,8 +358,9 @@ export class BrowserAgent {
     // somebody reads from counting as a quiet one. Only a closed address
     // stops the boot; a gateway that cannot be reached is no reason to
     // refuse a sign-in.
-    this.gatewayApi = null;
-    try { if (config.gateway?.url) this.gatewayApi = `${new URL(config.gateway.url).origin}/api`; } catch { this.gatewayApi = null; }
+    // At the page's own origin, as the relay is: a page on the test alias
+    // asked the real site instead and could not get past its preflight.
+    this.gatewayApi = config.gateway?.url ? `${frontOrigin.replace(/\/$/, '')}/api` : null;
     this.doorKey = doorKeyOf(config.gateway?.url) || config.handle;
     this.gatewayStanding = null;
     const standing = await this.openAtGateway();
@@ -476,6 +480,7 @@ export class BrowserAgent {
       // The lease decides: this device ACTS on the pod, or reads it read-only.
       this.viewer = !(await this.lease.acquire());
       if (this.viewer) {
+        this._watched = true;
         this.log(`read-only viewer: another device is active on @${config.handle}`);
         this.startViewerPoll();       // reload the feed, and promote if the lease frees
         return;

package/web/app/deliver-relay.mjs

@@ -10,6 +10,9 @@
 import { Deliverer } from '../../lib/core/deliver.mjs';
 import { sign } from './shims/fedify-sig.mjs';
 
+// What one relay call may carry (lib/gateway/front-core.mjs RELAY_MAX_REQUESTS).
+const RELAY_MAX_REQUESTS = 20;
+
 /**
  * The name the front keys this account's row by, read off its door inbox:
  * `<front>/u/<key>/ap/inbox/`. A mail-door account is keyed by its full
@@ -30,6 +33,7 @@ export class RelayDeliverer extends Deliverer {
     this.relayUrl = opts.relayUrl;       // <front>/api/relay
     this.handle = opts.handle;
     this.sessionFetch = opts.sessionFetch;   // the DPoP session's fetch, to authenticate to the relay
+    this.batchSize = RELAY_MAX_REQUESTS;
   }
 
   // Same contract as Deliverer.signedFetch, DEFAULT INCLUDED: an init with no
@@ -40,32 +44,68 @@ export class RelayDeliverer extends Deliverer {
   // never saw the document it asked for: a Follow from anyone new was rejected
   // with "actor fetch failed", and nothing needing a lookup could be ingested.
   async signedFetch(url, init = {}) {
+    const req = await this._signedRequest(url, init);
+    const [r0] = await this._relay([req]);
+    return this._outcome(r0, url, init.method || 'GET');
+  }
+
+  // A fan-out in one call: the relay takes a list, so a post to twenty
+  // followers is one call, not twenty (Deliverer.deliverToAll, batchSize).
+  async deliverManyNow(targets) {
+    const reqs = await Promise.all(targets.map((t) => this._signedRequest(t.inbox, {
+      method: 'POST', headers: { 'content-type': 'application/activity+json' }, body: JSON.stringify(t.activity),
+    })));
+    let results;
+    try { results = await this._relay(reqs); } catch (error) { return targets.map(() => ({ error })); }
+    return targets.map((t, i) => {
+      try { this._outcome(results[i] || {}, t.inbox, 'POST'); return { ok: true }; }
+      catch (error) { return { error }; }
+    });
+  }
+
+  // Signed here, sent verbatim by the relay. Every signed header goes along,
+  // `accept` included: the signature covers it, so a relay request missing it
+  // carries an invalid signature — and a read without it gets the HTML page
+  // instead of the document.
+  async _signedRequest(url, init = {}) {
     const body = typeof init.body === 'string' ? init.body : (init.body ? new TextDecoder().decode(init.body) : '');
     const s = await sign({ url, method: init.method || 'GET', headers: init.headers || {}, body }, this.rsaPrivate, this.keyId);
-    // Every signed header goes to the relay, `accept` included: the signature
-    // covers it, so a relay request missing it carries an invalid signature —
-    // and a read without it gets the HTML page instead of the document.
-    const relayReq = {
+    return {
       url: s.url, method: s.method, body,
       headers: {
         date: s.headers.date, digest: s.headers.digest, accept: s.headers.accept,
         'content-type': s.headers['content-type'], signature: s.headers.signature,
       },
     };
+  }
+
+  // One relay call for a list of requests; the results in the same order.
+  // The relay's OWN answer, apart from the recipients': unreachable and a
+  // refusal are hiccups the queue retries. Its 404 is not — it says this
+  // account has no row here, and no retry changes that. It used to be read as
+  // a hiccup too, and a tab whose account the site did not know retried its
+  // deliveries every minute for three days.
+  async _relay(requests) {
     let res;
     try {
       res = await this.sessionFetch(this.relayUrl, {
         method: 'POST', headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ handle: this.handle, requests: [relayReq] }),
+        body: JSON.stringify({ handle: this.handle, requests }),
       });
     } catch (e) { const err = new Error(`relay unreachable: ${e.message}`); err.status = 0; throw err; }
+    if (res.status === 404) { const err = new Error('relay: no such account here'); err.status = 404; throw err; }
     if (res.status >= 400) { const err = new Error(`relay ${res.status}`); err.status = 502; throw err; }
     const out = await res.json().catch(() => ({}));
-    const r0 = (out.results && out.results[0]) || {};
+    return Array.isArray(out.results) ? out.results : [];
+  }
+
+  // What the far server answered, as the Node deliverer would have seen it:
+  // a Response for a read, a thrown error carrying the status for a refusal.
+  _outcome(r0, url, method) {
     const status = r0.status || 0;
     if (status === 0) { const err = new Error(r0.error || 'relay could not send'); err.status = 502; throw err; }
     if (status >= 400) {
-      const err = new Error(`${init.method || 'POST'} ${url} → ${status}`); err.status = status;
+      const err = new Error(`${method} ${url} → ${status}`); err.status = status;
       // The receiving server's own answer to "when should I try again", carried
       // through the relay (lib/front-core.mjs). Spelled `retryAfterMs`, which is
       // what the delivery queue reads (lib/deliver.mjs) — the queue's ladder is

package/web/app/dist/boot.js

@@ -32822,7 +32822,29 @@ var PodTransport = class {
     const podTarget = this.toPod ? this.toPod(targetUrl) : targetUrl;
     const url = await this.aclUrlFor(podTarget);
     if (!await this.aclWritable(url)) return null;
-    return this.put(url, this.aclDoc(podTarget, publicModes, { ...opts, aclUrl: url }), "text/turtle");
+    const doc = this.aclDoc(podTarget, publicModes, { ...opts, aclUrl: url });
+    if (opts.ifChanged && await this.aclSame(url, doc)) return { status: 304, unchanged: true };
+    return this.put(url, doc, "text/turtle");
+  }
+  // Whether the pod's rule at `aclUrl` states exactly what `doc` states.
+  // Compared as graphs, not bytes: the pod serialises what it holds its own
+  // way. Every rule this file writes names its subjects, so triple sets are
+  // enough; anything unreadable or with blank nodes reads as different.
+  async aclSame(aclUrl, doc) {
+    try {
+      const res = await this.fetch(aclUrl, { headers: { accept: "text/turtle" } });
+      if (res.status !== 200) return false;
+      const triples = (text) => {
+        const g = graph();
+        parse2(text, g, aclUrl, "text/turtle");
+        if (g.statements.some((st2) => st2.subject.termType === "BlankNode" || st2.object.termType === "BlankNode")) return null;
+        return g.statements.map((st2) => `${st2.subject.value} ${st2.predicate.value} ${st2.object.value}`).sort().join("\n");
+      };
+      const theirs = triples(await res.text());
+      return theirs !== null && theirs === triples(doc);
+    } catch {
+      return false;
+    }
   }
   // Child documents of an LDP container (URLs under it, excluding aux docs).
   // Revalidated: the inbox is polled every couple of minutes and is usually
@@ -32846,10 +32868,15 @@ var PodTransport = class {
     parse2(body, g, url, "text/turtle");
     const here = namedNode2(url);
     const seen = /* @__PURE__ */ new Set();
+    const receipts = /* @__PURE__ */ new Set();
     const list = [];
     for (const child of g.each(here, LDP("contains"), null, here)) {
       const u = child.value;
-      if (!u.startsWith(url) || u === url || /\.(acl|meta|receipt\.json)$/.test(u) || seen.has(u)) continue;
+      if (u.endsWith(".receipt.json")) {
+        receipts.add(u);
+        continue;
+      }
+      if (!u.startsWith(url) || u === url || /\.(acl|meta)$/.test(u) || seen.has(u)) continue;
       seen.add(u);
       list.push({
         url: u,
@@ -32857,10 +32884,16 @@ var PodTransport = class {
         modified: g.any(child, DC("modified"), null, here)?.value || null
       });
     }
+    for (const item of list) item.receipt = receipts.has(item.url + ".receipt.json");
+    const orphans = [...receipts].filter((r) => !seen.has(r.slice(0, -".receipt.json".length)));
     list.sort((a, b) => String(a.modified || "").localeCompare(String(b.modified || "")));
-    this._listCache.set(url, { etag: res.headers.get("etag"), children: list });
+    this._listCache.set(url, { etag: res.headers.get("etag"), children: list, orphans });
     return list;
   }
+  /** Receipts in the last listing of `url` whose item is gone. */
+  orphanReceipts(url) {
+    return this._listCache?.get(url)?.orphans ?? [];
+  }
   /**
    * The WebID profile advertises the actor as an account:
    *   <webId> foaf:account <actor> .