fedipod 1.44.0 → 1.45.0

package/gateway.md

@@ -15,7 +15,10 @@ yours, which your agent then signs and sends. It still holds no key, but what yo
 trust it with grows by that much. A browser account is also kept running by
 the gateway (below). That gives the gateway your key while it works, so it can
 post as you, as any Fediverse server can, and your account's working data is
-kept at the gateway too and written to your pod every fifteen minutes.
+kept at the gateway too and written to your pod every fifteen minutes. For
+a kept account the gateway also answers a follower's server asking for one
+of your followers-only posts, and the named person's server asking for a
+direct one, when that server signs its request; nobody else gets them.
 
 A FediPod install works without any gateway at all. Deliveries go straight to
 your pod inbox, which holds them whether your agent is running or not.
@@ -73,8 +76,9 @@ mode says how far you trust the door, and every step is reversible:
 - **locked** — your inbox accepts writes only from the gateway.
 
 In every mode past **off**, the door itself is already filtering: blocked
-actors, content that does not concern you, and forged signatures are dropped
-at the door and never reach the pod. The mode says only how far the agent
+actors and content that does not concern you are dropped at the door and
+never reach the pod; a delivery whose signature does not verify is passed on
+marked unverified, and the agent decides by fetching what it claims to be. The mode says only how far the agent
 believes the door's receipts.
 
 The shadow numbers come from the agent:

package/lib/client/c2s.mjs

@@ -32,11 +32,6 @@ import * as podNotes from '../pod/notes.mjs';
 
 const MAX_BODY = 512 * 1024;          // same ceiling the inbox drain enforces
 
-// How many archived items one page of the inbox will read. A page is one
-// month, and a month with more than this is served short rather than costing
-// the pod an unbounded read; the log says when that happened.
-const MAX_INBOX_PAGE = 500;
-
 // How many recorded activities one page of the locally-served outbox carries.
 const MAX_OUTBOX_PAGE = 50;
 
@@ -99,82 +94,35 @@ export class C2S {
     return iri ? this.store.getStatuses().find((s) => s.noteId === iri) : null;
   }
 
-  /** The months the archive holds, newest first. One container listing. */
-  async archiveMonths() {
-    const archive = this.agent.intake?.archive;
-    if (!archive) return [];
-    const { names } = await archive.list('');
-    return (names || [])
-      .map((n) => n.replace(/\/$/u, ''))
-      .filter((n) => /^\d{4}-\d{2}$/u.test(n))
-      .sort()
-      .reverse();
-  }
-
   /**
-   * The owner's own inbox, §5.2. Paged by month because that is how the
-   * archive is stored, so a page costs one listing and a read per item and no
-   * page is dearer for another month being large.
+   * The owner's own inbox, §5.2: the collection the drain keeps on the pod in
+   * the private container (intake/received.mjs), served under this agent's
+   * address so a client holding no pod credential of its own can read it.
+   * Nothing is built per request; a page is the pod's page.
    */
-  async sendInbox(res, url) {
-    const id = `${this.urls.base}ap/inbox`;
+  async sendInbox(res, url, origin) {
+    const id = `${origin}ap/inbox`;   // named for the client that asked, as the outbox is
+    const own = this.urls.ownInbox;
     const page = url?.searchParams?.get('page') || null;
-    let months;
+    if (page !== null && !/^[1-9]\d{0,6}$/u.test(page)) return this.send(res, 400, { error: 'page is a number' });
+    let doc;
     try {
-      months = await this.archiveMonths();
+      doc = await this.agent.remote.getJson(page ? `${own}-${page}` : own);
     } catch (e) {
-      return this.send(res, 502, { error: `the archive could not be read: ${e.message}` });
+      return this.send(res, 502, { error: `the inbox collection could not be read: ${e.message}` });
     }
-
-    if (!page) {
-      if (!months.length && this.store.getConfig()?.archiveInbox === false) {
+    if (!doc) {
+      if (page) return this.send(res, 404, { error: 'no such page' });
+      if (this.store.getConfig()?.archiveInbox === false) {
         this.log('inbox read: nothing to show — this identity does not keep what it receives');
       }
-      return this.send(res, 200, {
-        '@context': wire.AS_CTX, id, type: 'OrderedCollection',
-        ...(months.length ? { first: `${id}?page=${months[0]}` } : { orderedItems: [] }),
-      });
-    }
-    if (!/^\d{4}-\d{2}$/u.test(page)) {
-      return this.send(res, 400, { error: 'page names a month, written 2026-09' });
-    }
-
-    const archive = this.agent.intake?.archive;
-    let names = [];
-    try {
-      // The trailing slash matters: without it this names a document, not the
-      // container, and a pod answers about the wrong thing.
-      ({ names } = await archive.list(`${page}/`));
-    } catch (e) {
-      return this.send(res, 502, { error: `the archive could not be read: ${e.message}` });
-    }
-    const files = (names || []).filter((n) => n.endsWith('.json')).sort();
-    if (files.length > MAX_INBOX_PAGE) {
-      this.log(`inbox read: ${page} holds ${files.length} items; serving the first ${MAX_INBOX_PAGE}`);
+      return this.send(res, 200, { '@context': wire.AS_CTX, id, type: 'OrderedCollection', totalItems: 0, orderedItems: [] });
     }
-    const kept = [];
-    for (const file of files.slice(0, MAX_INBOX_PAGE)) {
-      // Read as written: these records are JSON-LD, and the default read asks
-      // turtle-first, which a server is free to answer with turtle.
-      const read = await archive.read(`${page}/${file}`, { accept: '*/*' });
-      if (!read?.ok || !read.body) continue;
-      try {
-        const record = JSON.parse(read.body);
-        // The record wraps the bytes as they arrived; the activity is those
-        // bytes, not a retelling of them.
-        kept.push({ at: record.receivedAt || '', activity: JSON.parse(record.raw) });
-      } catch { /* a record that will not parse is not one that can be served */ }
-    }
-    kept.sort((a, b) => String(b.at).localeCompare(String(a.at)));
-    const older = months.filter((m) => m < page)[0] || null;
-    return this.send(res, 200, {
-      '@context': wire.AS_CTX,
-      id: `${id}?page=${page}`,
-      type: 'OrderedCollectionPage',
-      partOf: id,
-      ...(older ? { next: `${id}?page=${older}` } : {}),
-      orderedItems: kept.map((k) => k.activity),
-    });
+    // The pod's names become this agent's: the head is `id`, page n is `id?page=n`.
+    const here = (v) => (typeof v === 'string' && v.startsWith(own)
+      ? (v === own ? id : v.replace(`${own}-`, `${id}?page=`)) : v);
+    for (const k of ['id', 'partOf', 'first', 'last', 'next', 'prev']) if (k in doc) doc[k] = here(doc[k]);
+    return this.send(res, 200, doc);
   }
 
   // The actor a client-to-server client on this machine reads. The same
@@ -277,7 +225,7 @@ export class C2S {
       }
       const reader = await this.auth(req, pathname);
       if (!reader.ok) return this.send(res, reader.status, { error: reader.error }, reader.headers || {});
-      return this.sendInbox(res, url);
+      return this.sendInbox(res, url, this.localOrigin(req) || this.urls.base);
     }
     if (req.method === 'GET' || req.method === 'HEAD') {
       // The owner, signed in, reads every message the actor produced (§5.1:

package/lib/core/intake/index.mjs

@@ -28,6 +28,7 @@ import { trimActivity, sameIdentity, sameOrigin, httpUrl, reactionOf, MAX_EMOJIS
 import * as channel from './channel.mjs';
 import * as verify from './verify.mjs';
 import * as group from './group.mjs';
+import * as received from './received.mjs';
 import * as activities from './activities.mjs';
 import * as notes from './notes.mjs';
 import { readLenient } from '../as2.mjs';
@@ -489,6 +490,9 @@ export class Intake {
       if (pending.length >= DELETE_BATCH && !await flush()) return;
     }
     if (!await this._finishSweep(flush)) return;
+    // What this sweep accepted, onto the pod as the owner's inbox collection:
+    // one page write and the head per sweep with mail, never per item.
+    await received.publishReceived(this).catch((e) => this.log(`inbox collection: ${e.message}`));
     // Receipts earlier drains left behind, a few per sweep until none remain.
     for (const stray of podInbox.orphanReceipts(this.remote, this.urls).slice(0, ORPHAN_RECEIPTS_PER_SWEEP)) {
       if (!await podInbox.dropStrayReceipt(this.remote, stray)) break;
@@ -532,7 +536,10 @@ export class Intake {
     const rejection = !activity ? 'unparsable JSON'
       : owned ? await this.ownerPostFrom(activity, raw, receipt)
         : await this.handle(activity, receipt);
-    if (!rejection && raw && !owned) await this._archive(url, raw, activity);
+    if (!rejection && raw && !owned) {
+      await this._archive(url, raw, activity);
+      received.recordReceived(this, activity);   // §5.2: the owner's readable inbox
+    }
     if (!rejection && !owned) await this._maybeForward(activity);    // §7.1.2, only what we accepted
     if (rejection) {
       this.store.addDeadLetter({

package/lib/core/intake/received.mjs

@@ -0,0 +1,78 @@
+// received.mjs — the inbox as its owner reads it (ActivityPub §5.2): every
+// delivery the account accepted, kept on the pod as a paged OrderedCollection
+// in the private container, beside the archive that keeps each delivery's
+// bytes. The door and the agent's own /ap/inbox serve these documents.
+//
+// Pages fill from the oldest end, PAGE_SIZE to a page, and a full page is
+// never written again: an accepted delivery rewrites the newest page and the
+// small head, and nothing else. Activities ride inline, so a reader gets what
+// arrived without a fetch per item — a Like or a Follow has no address its
+// origin answers anyway. Past ITEM_MAX_CHARS the item is the activity's id
+// alone, so one enormous delivery cannot make a page of them enormous.
+//
+// §5.2 also says an activity delivered twice is listed once. The archive
+// already collapses identical bytes; this keeps the last SEEN_MAX ids and
+// drops a repeat that arrived with different addressing.
+//
+// Written only while the archive is on — an owner who chose not to keep what
+// arrives keeps nothing here either — and only once the private container is
+// proved private, the bar every owner-only document clears. Recorded meanwhile,
+// and published the first time the bar is met.
+
+import * as wire from '../wire.mjs';
+import * as collection from '../../pod/collection.mjs';
+
+export const PAGE_SIZE = wire.FOLLOWERS_PAGE_SIZE;
+export const SEEN_MAX = 500;
+export const ITEM_MAX_CHARS = 32 * 1024;
+// Recorded but unpublished items are held in state; past this many the oldest
+// are let go (the archive still has them) rather than growing state forever.
+const HELD_MAX = PAGE_SIZE * 5;
+const RECEIVED = 'received.json';
+
+const fresh = () => ({ sealed: 0, open: [], total: 0, seen: [] });
+
+const keeps = (intake) => !!intake.archive && !!intake.urls?.ownInbox
+  && intake.store.getConfig?.()?.archiveInbox !== false;
+
+/** Record one accepted delivery. False when it was a repeat, or nothing is kept. */
+export function recordReceived(intake, activity) {
+  if (!keeps(intake) || !activity || typeof activity !== 'object') return false;
+  const st = { ...fresh(), ...intake.store.read(RECEIVED, {}) };
+  const id = typeof activity.id === 'string' ? activity.id : null;
+  if (id && st.seen.includes(id)) return false;
+  st.open.push(id && JSON.stringify(activity).length > ITEM_MAX_CHARS ? id : activity);
+  if (st.open.length > HELD_MAX) st.open.splice(0, st.open.length - HELD_MAX);
+  st.total += 1;
+  if (id) {
+    st.seen.push(id);
+    if (st.seen.length > SEEN_MAX) st.seen.splice(0, st.seen.length - SEEN_MAX);
+  }
+  intake.store.write(RECEIVED, st);
+  intake._receivedDirty = true;
+  return true;
+}
+
+/** Write what was recorded since the last publish: the newest page(s) and the head. */
+export async function publishReceived(intake) {
+  if (!intake._receivedDirty || !keeps(intake)) return;
+  const ready = intake.publisher?.privateReady;
+  if (typeof ready === 'function' && await ready.call(intake.publisher) !== true) return;
+  const { remote, urls } = intake;
+  const st = { ...fresh(), ...intake.store.read(RECEIVED, {}) };
+  // Every full page first (several when the bar was met late), then the open one.
+  do {
+    const n = st.sealed + 1;
+    const items = st.open.slice(0, PAGE_SIZE);
+    await collection.writePage(remote, wire.followersPageId(urls.ownInbox, n),
+      wire.followersPage(urls.ownInbox, n, items, n));
+    if (items.length < PAGE_SIZE) break;
+    st.sealed = n;
+    st.open = st.open.slice(PAGE_SIZE);
+    intake.store.write(RECEIVED, st);
+  } while (st.open.length);
+  const pages = Math.max(1, st.sealed + (st.open.length ? 1 : 0));
+  await collection.writeHead(remote, urls.ownInbox, wire.followersHead(urls.ownInbox, st.total, pages));
+  intake.store.write(RECEIVED, st);
+  intake._receivedDirty = false;
+}

package/lib/gateway/front-core.mjs

@@ -28,6 +28,7 @@ import { routeNoticesApi } from './notices.mjs';
 import { withSecurityHeaders } from './headers.mjs';
 import { podTokenVerifier } from './caches.mjs';
 import { claimedWebId } from './token-claims.mjs';
+import { answerPrivateRead } from './private-read.mjs';
 import { announced, overLimit, relayOne } from './relay-extras.mjs';
 
 // The one WebFinger document, spelled out here rather than imported from
@@ -810,6 +811,15 @@ async function route(request, ctx) {
       'access-control-max-age': '86400',
     };
     if (request.method === 'OPTIONS') return { status: 204, headers: { ...doorCors, allow: 'POST, OPTIONS' }, body: null };
+    // The owner, signed in, reads the inbox as a collection (§5.2): the drain
+    // keeps it on the pod, under the owner's own rule. The token is only
+    // read, never verified, as at the outbox door: the pod checks it.
+    if ((request.method === 'GET' || request.method === 'HEAD') && request.headers.get('authorization')) {
+      const webid = claimedWebId(request);
+      if (webid && (rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome))) {
+        return { status: 303, headers: { ...doorCors, location: rec.podHome + 'ap/private/inbox', 'cache-control': 'no-store' }, body: '' };
+      }
+    }
     if (request.method !== 'POST') return { status: 405, headers: {}, body: '' };
     if (movedBase) { console.log(`door @${up.handle}: delivery → 410 (moved)`); return gone(doorCors); }
     if (closed) { console.log(`door @${up.handle}: delivery → 410 (closed)`); return gone(doorCors, CLOSED); }
@@ -819,7 +829,7 @@ async function route(request, ctx) {
     const held = holdsMail(ctx, rec) && !(await isPresent(ctx, up.handle));
     const { status, reason, content, bytes, type, notifies, name, raw, receipt } = await handleDelivery(request, identFor(rec, policy),
       { podPut: held ? holdingPut(ctx, up.handle, rec) : (u, b, ct) => ctx.podPut(up.handle, u, b, ct),
-        fetchImpl: ctx.fetchImpl, paused: standing.paused });
+        fetchImpl: ctx.fetchImpl, paused: standing.paused, origin: ctx.frontOrigin || null });
     // One line per delivery, so "did it arrive at the door" has an answer.
     console.log(`door @${up.handle}: delivery → ${status} (${reason}${held && status === 202 ? ', held' : ''})`);
     if (status === 202 && content) await noteReceived(ctx, up.handle, rec, bytes);
@@ -911,10 +921,9 @@ async function route(request, ctx) {
   const podTarget = rec.podHome + up.rest;
   // The owner's own documents — the full outbox, the liked list, the pending
   // lists — are read at the pod, which decides who may; never held here,
-  // where one reader's answer would be served to the next.
-  if (up.rest.startsWith('ap/private/')) {
-    return { status: 303, headers: { ...open, location: podTarget, 'cache-control': 'no-store' }, body: '' };
-  }
+  // where one reader's answer would be served to the next. A signed read of
+  // a private post by a server it was sent to is answered (private-read.mjs).
+  if (up.rest.startsWith('ap/private/')) return answerPrivateRead(ctx, rec, { request, handle: up.handle, podTarget, base, open, swap });
   // Media stays on the pod (lib/pod/urls.mjs keeps `media` off the front), but
   // the id rewrite below turns media links onto the front like every other
   // pod url in a document. Answer those by pointing at the pod: bytes are not

package/lib/gateway/gateway-core.mjs

@@ -91,12 +91,34 @@ export function notifies(activity, ident) {
 // Returns { status, reason } — the adapter turns it into an HTTP response —
 // and, for a delivery that reached the pod, `content` (whether it was
 // content rather than control) and `bytes`, so the caller can keep count.
-export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES, paused = false } = {}) {
-  // Read the body once from a clone; the original, unconsumed, goes to the
-  // verifier (which needs the body for the Digest check).
-  let raw;
-  try { raw = await request.clone().text(); } catch { return { status: 400, reason: 'unreadable body' }; }
-  if (Buffer.byteLength(raw) > maxBytes) return { status: 413, reason: 'too large' };
+// The request as the sender signed it. A sender signs the host it delivered
+// to and digests the bytes it sent; what reaches this code has been through
+// an edge that may have rewritten the Host header, the URL's host or both
+// (Netlify does), and a verifier that trusts those fails every honest
+// delivery. So the verifier gets a request rebuilt from the bytes read here,
+// at the door's own origin when the caller names it, else at the host a
+// proxy says it forwarded for, else at the URL's own.
+export function asSigned(request, bytes, origin) {
+  const u = new URL(request.url);
+  let host = null;
+  if (origin) { try { const o = new URL(origin); u.protocol = o.protocol; host = o.host; } catch { /* not an origin: the URL's own */ } }
+  host = host || request.headers.get('x-forwarded-host')?.split(',')[0].trim() || u.host;
+  u.host = host;
+  const headers = new Headers(request.headers);
+  headers.set('host', host);
+  // A GET or HEAD carries no body, and a Request refuses one (a signed read: private-read.mjs).
+  const bodiless = request.method === 'GET' || request.method === 'HEAD';
+  return new Request(u.href, { method: request.method, headers, ...(bodiless ? {} : { body: bytes }) });
+}
+
+// `origin` is the door's own, the one senders address (see asSigned).
+export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES, paused = false, origin = null } = {}) {
+  // The body, once, as the bytes the sender digested; the text of it is what
+  // is filed and hashed, as before.
+  let bytes, raw;
+  try { bytes = new Uint8Array(await request.clone().arrayBuffer()); raw = new TextDecoder().decode(bytes); }
+  catch { return { status: 400, reason: 'unreadable body' }; }
+  if (bytes.byteLength > maxBytes) return { status: 413, reason: 'too large' };
 
   let activity;
   try { activity = JSON.parse(raw); } catch { return { status: 400, reason: 'unparsable JSON' }; }
@@ -114,15 +136,25 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
 
   // The sender's key, kept between deliveries: a server pushing a hundred
   // items is asked for its key once (caches.mjs).
-  const v = await verifyHttpSignature(request, {
+  const v = await verifyHttpSignature(asSigned(request, bytes, origin), {
     documentLoader: makeSafeLoader({ fetchImpl }), keyCache: senderKeys,
   });
-  // A present-but-invalid signature is a forgery — dropped here, so it never
-  // reaches the pod (today it would, drain, and die unapplied). An absent or
-  // unfetchable-key signature is NOT dropped: it forwards unverified and the
-  // drain's verify-by-dereference still stands behind it.
+  // A signature that does not verify is NOT dropped (it was, 2026-08-20 to
+  // 2026-09-28, and for a stretch of that every honest Mastodon delivery was
+  // dropped with it, silently, because of what the edge had done to the
+  // request). It forwards unverified, like an absent or unfetchable-key
+  // signature, and the drain's verify-by-dereference decides; the log says
+  // why it failed and what the request looked like, so the next such
+  // stretch is visible.
+  let failed = null;
   if (v.verified === false && v.reason === 'bad-signature') {
-    return { status: 202, reason: 'forged signature' };
+    const has = (h) => (request.headers.has(h) ? 'yes' : 'no');
+    const fwd = request.headers.get('x-forwarded-host');
+    // The sender's signature parameters — which components it signed, its
+    // key id and algorithm — without the signature value itself.
+    const params = request.headers.get('signature-input')
+      || (request.headers.get('signature') || '').replace(/signature="[^"]*"/u, 'signature="…"');
+    failed = `signature ${v.why} (${v.method}); host ${request.headers.get('host') || 'none'}${fwd ? ` forwarded-for ${fwd}` : ''}, date ${has('date')}, digest ${has('digest') === 'yes' || has('content-digest') === 'yes' ? 'yes' : 'no'}; ${params.slice(0, 300)}`;
   }
 
   // No per-user secret on record = no receipt: the delivery still filters and
@@ -137,8 +169,8 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
   // holding any state.
   if (!okA) return { status: 502, reason: 'pod inbox write failed' };
   if (receipt) await inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt);
-  return { status: 202, reason: v.verified ? 'verified' : 'buffered-unverified', content, bytes: Buffer.byteLength(raw),
-    type: activity.type, notifies: notifies(activity, ident), name: hash, raw, receipt };
+  return { status: 202, reason: v.verified ? 'verified' : failed ? `buffered-unverified: ${failed}` : 'buffered-unverified',
+    content, bytes: bytes.byteLength, type: activity.type, notifies: notifies(activity, ident), name: hash, raw, receipt };
 }
 
 // The outbox door: the owner's own post, taken on their behalf.

package/lib/gateway/httpsig.mjs

@@ -49,14 +49,16 @@ export function makeSafeLoader({ getActors = null, fetchImpl = fetch } = {}) {
 export async function verifyHttpSignature(request, { documentLoader, keyCache, timeWindow } = {}) {
   const hadSig = request.headers.get('signature') != null;
   let result = null;
+  let threw = null;
   try {
     result = await verifyRequestDetailed(request, {
       documentLoader,
       ...(keyCache ? { keyCache } : {}),
       timeWindow: timeWindow ?? { hours: 1 },
     });
-  } catch {
+  } catch (e) {
     result = null;   // the library itself failed — no more informative than a bad signature
+    threw = e?.message || String(e);
   }
   // Which signature the sender used: RFC 9421 carries a Signature-Input
   // header beside Signature; the cavage draft carries Signature alone. The
@@ -83,9 +85,12 @@ export async function verifyHttpSignature(request, { documentLoader, keyCache, t
       reason: 'key-unfetchable', checks: { signature: false, keyFetched: false },
     };
   }
+  // `why` is for the log line, not the receipt: the library's own word for
+  // the failure, or that it threw.
   return {
     verified: false, method, keyId: null, actor: null,
     reason: 'bad-signature', checks: { signature: false },
+    why: threw ? `library threw: ${threw.split('\n')[0].slice(0, 120)}` : (kind || 'unknown'),
   };
 }
 

package/lib/gateway/private-read.mjs

@@ -0,0 +1,91 @@
+// private-read.mjs — a followers-only or direct post, read at its address by
+// a server it was sent to (ActivityPub §3.2). The read is signed the way a
+// delivery is; the signer is resolved; and the post is served only to an
+// actor in its audience: a follower for a post sent to followers, a named
+// recipient for a direct one. That is the rule Mastodon applies to its own
+// posts (StatusPolicy#show?). Anyone else learns nothing — 404, as for a
+// document that is not there, which §3.2 allows for a private target.
+//
+// At fedipod.net this works for an account it keeps: the post is read from
+// the pod with the keeper's credential, and the followers list from the
+// account's copy. An account it does not keep gives it nothing to read with,
+// so that read is sent on to the pod, as every private read was.
+
+import { verifyHttpSignature, makeSafeLoader } from './httpsig.mjs';
+import { asSigned } from './gateway-core.mjs';
+import { senderKeys } from './caches.mjs';
+import { keptNow } from './copy.mjs';
+
+const AP_CT = 'application/activity+json';
+const PUBLIC_NAMES = new Set(['https://www.w3.org/ns/activitystreams#Public', 'as:Public', 'Public']);
+const list = (v) => (v == null ? [] : Array.isArray(v) ? v : [v])
+  .map((x) => (typeof x === 'string' ? x : x?.id)).filter((x) => typeof x === 'string');
+
+/** Who a document was sent to: the actors named, and whether followers were. */
+export function audienceOf(doc, followersUrls = []) {
+  const o = doc?.type === 'Create' && doc.object && typeof doc.object === 'object' ? doc.object : doc;
+  const named = new Set(['to', 'cc', 'audience'].flatMap((k) => [...list(doc?.[k]), ...list(o?.[k])]));
+  return {
+    named,
+    isPublic: [...named].some((a) => PUBLIC_NAMES.has(a)),
+    toFollowers: followersUrls.some((f) => named.has(f)),
+  };
+}
+
+/** Whether `actor` may read `doc`: named in its audience, or a follower when it went to followers. */
+export function mayRead(doc, actor, { followersUrls = [], followers = [] } = {}) {
+  if (typeof actor !== 'string' || !actor) return false;
+  const a = audienceOf(doc, followersUrls);
+  if (a.isPublic || a.named.has(actor)) return true;
+  return a.toFollowers && followers.includes(actor);
+}
+
+/**
+ * The actor behind a signed read, or null with why. `origin` is the door's
+ * own (see asSigned in gateway-core.mjs); a GET has no body to digest.
+ */
+export async function signedReader(request, { fetchImpl = fetch, origin = null } = {}) {
+  if (!request.headers.get('signature')) return { actor: null, reason: 'no-signature' };
+  const v = await verifyHttpSignature(asSigned(request, new Uint8Array(0), origin), {
+    documentLoader: makeSafeLoader({ fetchImpl }), keyCache: senderKeys,
+  });
+  return v.verified && typeof v.actor === 'string' ? { actor: v.actor, reason: null } : { actor: null, reason: v.reason };
+}
+
+// Refused reads are told nothing, and never held at the edge.
+const nothing = (open) => ({ status: 404, headers: { ...open, 'cache-control': 'no-store', vary: 'Signature' }, body: '' });
+
+/**
+ * A read under `ap/private/` at the front. Unsigned: sent on to the pod, which
+ * decides (the owner reads there with their own credential). Signed: answered
+ * here for a kept account, to a reader the post was sent to.
+ */
+export async function answerPrivateRead(ctx, rec, { request, handle, podTarget, base, open, swap }) {
+  if (!request.headers.get('signature')) {
+    return { status: 303, headers: { ...open, location: podTarget, 'cache-control': 'no-store' }, body: '' };
+  }
+  const say = (what) => console.log(`private read @${handle}: ${what}`);
+  if (!keptNow(ctx, rec) || typeof ctx.keeperFetch !== 'function' || !ctx.copyKv) { say('refused — account not kept here'); return nothing(open); }
+  const { actor, reason } = await signedReader(request, { fetchImpl: ctx.fetchImpl || fetch, origin: ctx.frontOrigin || null });
+  if (!actor) { say(`refused — ${reason}`); return nothing(open); }
+  const podFetch = await ctx.keeperFetch();
+  if (!podFetch) { say('refused — no keeper credential'); return nothing(open); }
+  let text = null;
+  try {
+    const res = await podFetch(podTarget, { headers: { accept: AP_CT } });
+    if (res.status === 200) text = await res.text();
+  } catch { /* unreachable: nothing to serve */ }
+  let doc = null;
+  try { doc = text ? JSON.parse(text) : null; } catch { doc = null; }
+  if (!doc) { say(`refused — the pod did not give it (${actor})`); return nothing(open); }
+  let followers = [];
+  try {
+    const got = await ctx.copyKv.get(`${handle}/contacts.json`);
+    followers = (JSON.parse(got?.text || '{}').followers || []).map((f) => f?.actor).filter(Boolean);
+  } catch { followers = []; }
+  const followersUrls = [rec.podHome + 'ap/followers', base + 'ap/followers'];
+  if (!mayRead(doc, actor, { followersUrls, followers })) { say(`refused — ${actor} is not in its audience`); return nothing(open); }
+  say(`served to ${actor}`);
+  return { status: 200, headers: { ...open, 'content-type': AP_CT, 'cache-control': 'no-store', vary: 'Signature' },
+    body: request.method === 'HEAD' ? '' : swap(text, rec.podHome, base) };
+}

package/lib/pod/urls.mjs

@@ -52,6 +52,9 @@ export function apUrls(remotePod, root, { publicBase = null } = {}) {
     // reads them there, with a credential the pod checks.
     ownOutbox: home + 'ap/private/outbox',
     liked: home + 'ap/private/liked',
+    // The inbox as its owner reads it (§5.2): what the account received,
+    // kept by the drain as a paged collection beside the archive.
+    ownInbox: home + 'ap/private/inbox',
     profileHtml: face + 'ap/profile.html',
     // Media stays on the pod even when fronted: attachment urls are not
     // identity-checked by remotes, and proxying blobs would be pure cost.

package/lib/server/embed.mjs

@@ -20,6 +20,7 @@ import { Agent } from '../core/agent.mjs';
 import { RemotePod } from '../core/remote.mjs';
 import { apUrls, DEFAULT_ROOT } from '../core/wire.mjs';
 import { handleDelivery } from '../gateway/gateway-core.mjs';
+import { signedReader, mayRead } from '../gateway/private-read.mjs';
 import { writeJsonAtomic } from '../shared/files.mjs';
 import { buildAdminSurface } from '../surface/index.mjs';
 import { FixedAuthorities } from '../shared/guard.mjs';
@@ -260,6 +261,30 @@ export async function deliverToInbox(agent, request, { podPut, gatewayWebId = nu
   return handleDelivery(request, ident, { podPut, fetchImpl });
 }
 
+/**
+ * A signed read of a followers-only or direct post at its address on this
+ * pod (ActivityPub §3.2), answered to a server the post was sent to. The
+ * rule is lib/gateway/private-read.mjs's; here the post is read through the
+ * server's own store and the followers come from the identity's live state.
+ * Returns { status, reason, body }: 200 with the document, else 404 with why.
+ */
+export async function readPrivateForSigner(agent, request, { read, fetchImpl = fetch } = {}) {
+  const u = agent.urls;
+  const toPod = (x) => (u.toPod ? u.toPod(x) : x);
+  const url = request.url.split('?')[0];
+  const { actor, reason } = await signedReader(request, { fetchImpl, origin: new URL(request.url).origin });
+  if (!actor) return { status: 404, reason: `refused — ${reason}` };
+  const text = await Promise.resolve().then(() => read(url)).catch(() => null);
+  let doc = null;
+  try { doc = text ? JSON.parse(text) : null; } catch { doc = null; }
+  if (!doc) return { status: 404, reason: `refused — nothing at ${url} (${actor})` };
+  const followers = (agent.store.getContacts().followers || []).map((f) => f?.actor).filter(Boolean);
+  if (!mayRead(doc, actor, { followersUrls: [u.followers, toPod(u.followers)], followers })) {
+    return { status: 404, reason: `refused — ${actor} is not in its audience` };
+  }
+  return { status: 200, reason: `served to ${actor}`, body: text };
+}
+
 /**
  * Bring one identity up inside the server.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.44.0",
+  "version": "1.45.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",
@@ -55,7 +55,7 @@
     "install-service": "node bin/fedipod.mjs install-service",
     "uninstall-service": "node bin/fedipod.mjs uninstall-service",
     "prepublishOnly": "npm test",
-    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node packages/fedipod-bb/scripts/link-fedipod.mjs && node --test packages/fedipod-bb/test/*.test.mjs claude/smoke-tests/forum-signup-form.test.mjs && node scripts/check-sizes.mjs",
+    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node packages/fedipod-bb/scripts/link-fedipod.mjs && node --test packages/fedipod-bb/test/*.test.mjs claude/smoke-tests/forum-signup-form.test.mjs claude/smoke-tests/door-verify.test.mjs && node scripts/check-sizes.mjs && node claude/validation/browser-agent/all.mjs",
     "verify-ui": "node scripts/verify-ui.mjs",
     "build:sw": "node scripts/build-app.mjs --entry web/app/sw-src.mjs --out web/app/dist/sw.js",
     "build:boot": "node scripts/build-app.mjs --entry web/app/boot.mjs --out web/app/dist/boot.js",