fedipod-server 0.21.0 → 0.28.0

package/lib/client/masto/timelines.mjs

@@ -62,6 +62,49 @@ export async function handle(api, ctx) {
     const following = (api.agent.tagfeed?.config().tags || []).includes(name);
     return send(200, api.tagObject(name, following, req));
   }
+  // --- trending tags: counted off the notes already mirrored ---
+  //
+  // A single-actor instance has no firehose to measure, so "trending" here can
+  // only mean what the tag feed has actually brought in — which is the honest
+  // answer, and the one that makes a client's Explore surface show something
+  // instead of an empty list. `/api/v1/trends` is Mastodon's older name for the
+  // same thing.
+  if (pathname === '/api/v1/trends/tags' || pathname === '/api/v1/trends') {
+    const DAY = 86400000;
+    const today = Math.floor(Date.now() / DAY) * DAY;
+    // tag -> day -> { uses, accounts }. Accounts are counted distinctly, which
+    // is what the number means in Mastodon: one person posting nine times is
+    // nine uses by one account, and a client shows the second number.
+    const seen = new Map();
+    for (const st of api.store.getStatuses()) {
+      if (st.kind !== 'tag' || !st.tag) continue;
+      const at = Date.parse(st.published || '');
+      if (!Number.isFinite(at) || at < today - 6 * DAY) continue;
+      const day = Math.floor(at / DAY) * DAY;
+      if (!seen.has(st.tag)) seen.set(st.tag, new Map());
+      const days = seen.get(st.tag);
+      if (!days.has(day)) days.set(day, { uses: 0, accounts: new Set() });
+      const rec = days.get(day);
+      rec.uses++;
+      if (st.actor) rec.accounts.add(st.actor);
+    }
+    const followed = new Set(api.agent.tagfeed?.config().tags || []);
+    const ranked = [...seen.entries()].map(([name, days]) => {
+      // Seven entries, newest first, gaps filled with zeroes — a client draws
+      // the sparkline straight off this and a short array draws a short line.
+      const history = [];
+      for (let i = 0; i < 7; i++) {
+        const rec = days.get(today - i * DAY);
+        history.push({ day: String(Math.floor((today - i * DAY) / 1000)),
+          uses: String(rec ? rec.uses : 0), accounts: String(rec ? rec.accounts.size : 0) });
+      }
+      return { total: history.reduce((n, h) => n + Number(h.uses), 0),
+        tag: api.tagObject(name, followed.has(name), req, history) };
+    }).sort((a, b) => b.total - a.total);
+    const limit = Math.min(Math.max(Number(url.searchParams.get('limit')) || 10, 1), 40);
+    return send(200, ranked.slice(0, limit).map(x => x.tag));
+  }
+
   const mTagTl = pathname.match(/^\/api\/v1\/timelines\/tag\/([^/]+)$/);
   if (mTagTl && req.method === 'GET') {
     const name = decodeURIComponent(mTagTl[1]).replace(/^#/, '').toLowerCase();
@@ -208,7 +251,83 @@ export async function handle(api, ctx) {
     })));
   }
 
+  // The direct timeline: every direct post, newest first, paged like the rest.
+  if (pathname === '/api/v1/timelines/direct' && req.method === 'GET') {
+    const all = api.store.getStatuses();
+    const items = all.filter(s => s.direct || s.visibility === 'direct');
+    const { items: page, headers } = api.page(items, url);
+    return send(200, page.map(s => api.status(s, { all })), headers);
+  }
+
+  // One notification by id — what a push notification tap opens — and the
+  // two ways of being rid of them.
+  if (pathname === '/api/v1/notifications/clear' && req.method === 'POST') {
+    api.store.removeNotifications(() => true);
+    return send(200, {});
+  }
+  const mNotif = /^\/api\/v1\/notifications\/([A-Za-z0-9_-]+)(\/dismiss)?$/.exec(pathname);
+  if (mNotif) {
+    const n = api.store.getNotifications().find(x => x.id === mNotif[1]);
+    if (!n) return send(404, { error: 'Record not found' });
+    if (mNotif[2] && req.method === 'POST') { api.store.removeNotifications(x => x.id === n.id); return send(200, {}); }
+    if (!mNotif[2] && req.method === 'GET') return send(200, api.notification(n));
+  }
+
+  // Grouped notifications, the shape a client reads from API version 2 on.
+  // One group per notification: the client does its own gathering of
+  // favourites and boosts on a post, and every field it joins on — the
+  // account and status ids — is here.
+  const mGroup = /^\/api\/v2\/notifications\/([A-Za-z0-9_-]+)(\/accounts|\/dismiss)?$/.exec(pathname);
+  if (mGroup) {
+    const n = api.store.getNotifications().find(x => x.id === mGroup[1]);
+    if (!n) return send(404, { error: 'Record not found' });
+    if (mGroup[2] === '/dismiss' && req.method === 'POST') { api.store.removeNotifications(x => x.id === n.id); return send(200, {}); }
+    if (mGroup[2] === '/accounts' && req.method === 'GET') return send(200, [api.account(n.actor)]);
+    if (!mGroup[2] && req.method === 'GET') return send(200, groupedNotifications(api, [n]));
+  }
+  if (pathname === '/api/v2/notifications') {
+    const { page, headers } = notificationPage(api, ctx);
+    return send(200, groupedNotifications(api, page), headers);
+  }
+
   if (pathname === '/api/v1/notifications') {
+    const { page, headers } = notificationPage(api, ctx);
+    return send(200, page.map((n) => api.notification(n)), headers);
+  }
+
+  // Search: @user@host → webfinger resolve; URL → actor or note ingest;
+  // plain text → local mirror + actor-cache scan.
+  if (pathname === '/api/v2/search' || pathname === '/api/v1/search') {
+    return searchHandler(api, ctx);
+  }
+  return false;
+}
+
+function groupedNotifications(api, page) {
+  const accounts = new Map();
+  const statuses = new Map();
+  const groups = page.map((n) => {
+    const acct = api.account(n.actor);
+    accounts.set(acct.id, acct);
+    const s = n.noteId && api.store.getStatuses().find(x => x.noteId === n.noteId);
+    let statusId = null;
+    if (s) { const j = api.status(s); statuses.set(j.id, j); statusId = j.id; }
+    return {
+      group_key: n.id, notifications_count: 1, type: api.notificationType(n.type),
+      most_recent_notification_id: n.id, page_min_id: n.id, page_max_id: n.id,
+      latest_page_notification_at: n.at, sample_account_ids: [acct.id],
+      ...(statusId ? { status_id: statusId } : {}),
+      ...(n.type === 'reaction' ? { emoji: n.emoji, ...(n.url ? { emoji_url: n.url } : {}) } : {}),
+    };
+  });
+  return { accounts: [...accounts.values()], statuses: [...statuses.values()], notification_groups: groups };
+}
+
+// The slice of notifications a request asks for, and the Link header that
+// pages it. Shared by the flat list and the grouped one.
+function notificationPage(api, ctx) {
+  const { req, pathname, url } = ctx;
+  {
     const limit = Math.min(Number(url.searchParams.get('limit')) || 30, 60);
     const q = url.searchParams;
     // Newest first, which is what every id rule below assumes.
@@ -261,17 +380,20 @@ export async function handle(api, ctx) {
         for (const [k, v] of Object.entries(params)) u.searchParams.set(k, v);
         return u.href;
       };
-      return send(200, page.map((n) => api.notification(n)), {
+      return { page, headers: {
         link: `<${link({ max_id: page[page.length - 1].id })}>; rel="next", `
           + `<${link({ min_id: page[0].id })}>; rel="prev"`,
-      });
+      } };
     }
-    return send(200, []);
+    return { page: [], headers: undefined };
   }
+}
 
-  // Search: @user@host → webfinger resolve; URL → actor or note ingest;
-  // plain text → local mirror + actor-cache scan.
-  if (pathname === '/api/v2/search' || pathname === '/api/v1/search') {
+// Search: @user@host → webfinger resolve; URL → actor or note ingest;
+// plain text → local mirror + actor-cache scan.
+async function searchHandler(api, ctx) {
+  const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
+  {
     const q = String(url.searchParams.get('q') || '').trim();
     const type = url.searchParams.get('type');
     const out = { accounts: [], statuses: [], hashtags: [] };

package/lib/connections/tagfeed.mjs

@@ -12,13 +12,36 @@ import { isContentType, authorOf } from '../core/intake/index.mjs';
 // and a bound where there was none.
 const MAX_TIMELINE_BYTES = 2 * 1024 * 1024;
 
+// Two tags from each of six subjects, so a new account reads something on the
+// first morning without having followed anybody. Deliberately even: a busy
+// subject and a quiet one get the same number of places, and the sweep below
+// makes sure the busy ones cannot take the quiet ones' turns as well.
 const DEFAULTS = {
   instance: 'https://mastodon.social',
-  tags: ['solidproject', 'linkeddata', 'rdf'],
+  tags: [
+    'fediverse', 'activitypub',                  // the network this account is on
+    'opensource', 'foss',                        // how the software gets made
+    'solidproject', 'linkeddata',                // where the data lives
+    'privacy', 'digitalrights',                  // what is at stake
+    'indieweb', 'smallweb',                      // publishing for yourself
+    'commons', 'platformcooperativism',          // owning it together
+  ],
   intervalMin: 15,
 };
 const PER_TAG = 20;              // statuses requested per tag per sweep
-const MAX_NEW_PER_SWEEP = 12;    // dereference budget per sweep — stay light
+const MAX_NEW_PER_SWEEP = 8;     // dereference budget per sweep — stay light
+// …and no one tag may take more than this much of it. Without a per-tag share
+// the budget was spent in list order: the first two or three busy tags used it
+// all and everything below them never appeared once, however long you waited.
+const MAX_NEW_PER_TAG = 2;
+// Only this many tags are polled in any one sweep, taken in turn. A sweep holds
+// its writes until it finishes — so on the browser build, where the agent lives
+// in a service worker the browser is free to kill whenever it likes, a sweep
+// that runs long enough to be killed contributes NOTHING. Twelve tags was long
+// enough: a new account could open the app repeatedly and still see an empty
+// timeline. Four finishes. The list is still covered, three sweeps at a time,
+// and a sweep now costs the gateway less than the three-tag one it replaced.
+const TAGS_PER_SWEEP = 4;
 const MAX_TAG_ENTRIES = 200;     // oldest tag entries pruned beyond this
 // The instance here is a stranger's server we poll on our own schedule, and it
 // has no other way to tell us to stop.
@@ -31,6 +54,9 @@ export class TagFeed {
     Object.assign(this, { store, intake, log, fetcher });
     this.lastSweep = null;
     this.lastAdded = 0;
+    // Where this sweep starts in the tag list. It moves on by one each time, so
+    // when the budget does run out it is a different tag that goes without.
+    this.cursor = 0;
   }
 
   config() { return { ...DEFAULTS, ...this.store.read('tagfeed.json', {}) }; }
@@ -91,6 +117,11 @@ export class TagFeed {
     const known = new Set(this.store.getStatuses().map(s => s.noteId));
     let budget = MAX_NEW_PER_SWEEP;
     let added = 0;
+    // A different handful every time, taken in turn, so no tag is permanently
+    // first and none is permanently last.
+    const start = this.cursor % tags.length;
+    this.cursor = (start + TAGS_PER_SWEEP) % tags.length;
+    const order = [...tags, ...tags].slice(start, start + Math.min(TAGS_PER_SWEEP, tags.length));
     // The store's 300ms debounce cannot coalesce a sweep that awaits between
     // items — every note costs a fetch to somebody else's server, which outlives
     // the timer — so statuses.json and actors.json, the two largest documents,
@@ -99,7 +130,8 @@ export class TagFeed {
     // acctfeed has done it this way since 2026-08-03; this is the same fix.
     this.store.hold?.();
     try {
-    for (const tag of tags) {
+    for (const tag of order) {
+      let perTag = MAX_NEW_PER_TAG;
       let list;
       try {
         const { safeFetch, retryAfterMs, readCapped } = await import('../shared/safefetch.mjs');
@@ -129,7 +161,8 @@ export class TagFeed {
       for (const st of Array.isArray(list) ? list : []) {
         const noteId = st?.uri;
         if (!noteId || known.has(noteId) || this.store.isBlocked(noteId)) continue;
-        if (budget-- <= 0) break;
+        if (perTag <= 0 || budget <= 0) break;
+        perTag--; budget--;
         const note = await this.intake.fetchAP(noteId).catch(() => null);
         if (!note || note.id !== noteId || !isContentType(note.type)) continue;
         // The author is only known once the note is dereferenced, and this
@@ -159,6 +192,10 @@ export class TagFeed {
         known.add(noteId);
         added++;
       }
+      // Nothing left to take, so stop asking. Every remaining tag would be a
+      // request whose answer is thrown away — and in the browser build every
+      // one of those goes out through the gateway.
+      if (budget <= 0) break;
     }
     const all = this.store.getStatuses();
     const tagged = all.filter(s => s.kind === 'tag');
@@ -170,6 +207,6 @@ export class TagFeed {
       this.store.release?.();
     }
     this.lastAdded = added;
-    if (added) this.log(`tagfeed: +${added} from #${tags.join(' #')}`);
+    if (added) this.log(`tagfeed: +${added} from #${order.join(' #')}`);
   }
 }

package/lib/core/as2.mjs

@@ -19,7 +19,7 @@
 // common shape: one that skipped it would not be read as JSON-LD, and would
 // produce no graph, so nothing could be validated against it.
 //
-// CONTEXTS ARE NEVER FETCHED. The loader serves the fifteen the fediverse
+// CONTEXTS ARE NEVER FETCHED. The loader serves the ones the fediverse
 // actually uses and refuses every other URL. That refusal is the point: this
 // code runs on documents a stranger wrote, in the same path the SSRF guards
 // protect, and expanding one would otherwise mean dereferencing a URL of their
@@ -50,8 +50,14 @@ export class AS2Error extends Error {
  * the map throws rather than being fetched, so a document cannot make this
  * process reach out to an address its sender picked.
  */
+// Pleroma and Akkoma name their own copy of the litepub schema, one URL per
+// instance. Every copy is the same document, held here under the litepub
+// namespace, so a per-instance URL names that entry.
+const LITEPUB = 'http://litepub.social/ns';
+export const heldKey = (url) => (typeof url === 'string' && /\/schemas\/litepub-0\.1\.jsonld$/u.test(url) ? LITEPUB : url);
+
 export function contextLoader(url) {
-  const doc = CONTEXTS[url];
+  const doc = CONTEXTS[heldKey(url)];
   if (!doc) {
     return Promise.reject(new AS2Error(`context not held here: ${url}`, { context: url }));
   }
@@ -120,7 +126,7 @@ export async function parseAS2(raw) {
  */
 export function groundContext(input) {
   const ctx = input['@context'];
-  const held = (c) => typeof c === 'string' ? Object.hasOwn(CONTEXTS, c) : (c && typeof c === 'object');
+  const held = (c) => typeof c === 'string' ? Object.hasOwn(CONTEXTS, heldKey(c)) : (c && typeof c === 'object');
   let kept;
   if (ctx === undefined || ctx === null) kept = [];
   else if (Array.isArray(ctx)) kept = ctx.filter(held);
@@ -143,6 +149,31 @@ export function groundContext(input) {
  * `doc` and `graph` are null only when the bytes are not JSON at all, which is
  * what the plain read would have concluded too.
  */
+/**
+ * What a `null` in the document meant, carried onto the reading of it.
+ *
+ * ActivityPub §6.3.1: in an Update, a key set to `null` says REMOVE that
+ * property. JSON-LD has no way to carry that — expansion drops a null outright
+ * — so a partial update that takes something away arrives through the graph
+ * saying nothing at all, and is indistinguishable from an Update that never
+ * mentioned the property. The document plainly said it, so it is put back.
+ *
+ * Only nulls, only on the activity and its object, and only where the reading
+ * does not already have the key: nothing here overrides what the graph carried.
+ */
+function carryRemovals(input, view) {
+  if (!input || typeof input !== 'object' || !view || typeof view !== 'object') return view;
+  for (const [key, value] of Object.entries(input)) {
+    if (value === null) {
+      if (!(key in view)) view[key] = null;
+    } else if (key === 'object' && typeof value === 'object' && !Array.isArray(value)
+      && view.object && typeof view.object === 'object' && !Array.isArray(view.object)) {
+      carryRemovals(value, view.object);
+    }
+  }
+  return view;
+}
+
 export async function readLenient(raw) {
   // The document's own node is the one its `id` names. Handed to the view
   // as the root, so a document that points at itself — every actor does,
@@ -153,7 +184,7 @@ export async function readLenient(raw) {
   const root = typeof own === 'string' && /^https?:\/\//u.test(own) ? own : null;
   try {
     const { doc, graph } = await parseAS2(raw);
-    return { doc, graph, view: graphView(graph, { root }), degraded: null };
+    return { doc, graph, view: carryRemovals(input, graphView(graph, { root })), degraded: null };
   } catch (e) {
     if (!input || typeof input !== 'object') return { doc: null, graph: null, view: null, degraded: e.message };
     // Grounded, so a graph exists for every document that is JSON at all.
@@ -164,7 +195,7 @@ export async function readLenient(raw) {
     // what they read, so rewriting it here silently changed what they posted.
     try {
       const { graph } = await parseAS2(groundContext(input));
-      return { doc: input, graph, view: graphView(graph, { root }), degraded: e.message };
+      return { doc: input, graph, view: carryRemovals(input, graphView(graph, { root })), degraded: e.message };
     } catch (inner) {
       // Grounding names only held contexts, so reaching here means the document
       // is malformed JSON-LD rather than unfetchable. Hand back what a plain

package/lib/core/contexts/index.mjs

@@ -28,6 +28,18 @@ import ctx13 from './miscellany.json' with { type: 'json' };
 // Not from fedify: the W3C Web Annotation context, which a client such as
 // dokieli names on the annotations it posts to the outbox.
 import ctx14 from './anno.json' with { type: 'json' };
+// Not from fedify either. Pleroma and Akkoma name a copy of the litepub schema
+// served by each instance itself, at /schemas/litepub-0.1.jsonld; every copy
+// is the same document, and this is one of them. It is what declares
+// EmojiReact, and the older quote spellings quoteUrl and quoteUri. Held under
+// the litepub namespace, since no one URL names it; groundContext maps a
+// per-instance URL onto this entry.
+import ctx15 from './litepub-0.1.json' with { type: 'json' };
+// The quote terms as Mastodon declares them inline on a post: FEP-044f's
+// quote, quoteAuthorization, QuoteRequest and QuoteAuthorization, and
+// Misskey's _misskey_quote. No document at the FEP's URL serves a context;
+// the key is what lets the terms be named when reading.
+import ctx16 from './quotes.json' with { type: 'json' };
 
 /** URL → the context document itself. Nothing outside this map is ever resolved. */
 export const CONTEXTS = {
@@ -46,4 +58,6 @@ export const CONTEXTS = {
   'http://joinmastodon.org/ns': ctx12,
   'https://purl.archive.org/miscellany': ctx13,
   'http://www.w3.org/ns/anno.jsonld': ctx14,
+  'http://litepub.social/ns': ctx15,
+  'https://w3id.org/fep/044f': ctx16,
 };

package/lib/core/contexts/litepub-0.1.json

@@ -0,0 +1,60 @@
+{
+    "@context": [
+        "https://www.w3.org/ns/activitystreams",
+        "https://w3id.org/security/v1",
+        {
+            "Emoji": "toot:Emoji",
+            "Hashtag": "as:Hashtag",
+            "PropertyValue": "schema:PropertyValue",
+            "atomUri": "ostatus:atomUri",
+            "conversation": {
+                "@id": "ostatus:conversation",
+                "@type": "@id"
+            },
+            "discoverable": "toot:discoverable",
+            "manuallyApprovesFollowers": "as:manuallyApprovesFollowers",
+            "capabilities": "litepub:capabilities",
+            "ostatus": "http://ostatus.org#",
+            "schema": "http://schema.org#",
+            "toot": "http://joinmastodon.org/ns#",
+            "misskey": "https://misskey-hub.net/ns#",
+            "fedibird": "http://fedibird.com/ns#",
+            "sharkey": "https://joinsharkey.org/ns#",
+            "value": "schema:value",
+            "sensitive": "as:sensitive",
+            "litepub": "http://litepub.social/ns#",
+            "invisible": "litepub:invisible",
+            "directMessage": "litepub:directMessage",
+            "listMessage": {
+                "@id": "litepub:listMessage",
+                "@type": "@id"
+            },
+            "quoteUrl": "as:quoteUrl",
+            "quoteUri": "fedibird:quoteUri",
+            "oauthRegistrationEndpoint": {
+                "@id": "litepub:oauthRegistrationEndpoint",
+                "@type": "@id"
+            },
+            "EmojiReact": "litepub:EmojiReact",
+            "ChatMessage": "litepub:ChatMessage",
+            "alsoKnownAs": {
+                "@id": "as:alsoKnownAs",
+                "@type": "@id"
+            },
+            "vcard": "http://www.w3.org/2006/vcard/ns#",
+            "formerRepresentations": "litepub:formerRepresentations",
+            "contentMap": {
+                "@id": "as:content",
+                "@container": "@language"
+            },
+            "featured": {
+                "@id": "toot:featured",
+                "@type": "@id"
+            },
+            "backgroundUrl": {
+                "@id": "sharkey:backgroundUrl",
+                "@type": "@id"
+            }
+        }
+    ]
+}

package/lib/core/contexts/map.json

@@ -13,5 +13,7 @@
   "https://join-lemmy.org/context.json": "join-lemmy.json",
   "http://joinmastodon.org/ns": "joinmastodon.json",
   "https://purl.archive.org/miscellany": "miscellany.json",
-  "http://www.w3.org/ns/anno.jsonld": "anno.json"
+  "http://www.w3.org/ns/anno.jsonld": "anno.json",
+  "http://litepub.social/ns": "litepub-0.1.json",
+  "https://w3id.org/fep/044f": "quotes.json"
 }

package/lib/core/contexts/quotes.json

@@ -0,0 +1,18 @@
+{
+  "@context": {
+    "quote": {
+      "@id": "https://w3id.org/fep/044f#quote",
+      "@type": "@id"
+    },
+    "quoteAuthorization": {
+      "@id": "https://w3id.org/fep/044f#quoteAuthorization",
+      "@type": "@id"
+    },
+    "QuoteRequest": "https://w3id.org/fep/044f#QuoteRequest",
+    "QuoteAuthorization": "https://w3id.org/fep/044f#QuoteAuthorization",
+    "_misskey_quote": {
+      "@id": "https://misskey-hub.net/ns#_misskey_quote",
+      "@type": "@id"
+    }
+  }
+}

package/lib/core/graphview.mjs

@@ -55,8 +55,13 @@ function buildTerms() {
   const terms = new Map();
   const order = [AS_CTX, ...Object.keys(CONTEXTS).filter(u => u !== AS_CTX)];
   for (const url of order) {
-    const ctx = CONTEXTS[url]?.['@context'];
-    if (!ctx || typeof ctx !== 'object') continue;
+    const body = CONTEXTS[url]?.['@context'];
+    // A context document's body is one term map, or a list mixing URLs of
+    // other contexts with term maps — the litepub schema is the second shape.
+    // The URLs are held on their own; only the maps carry terms.
+    const maps = (Array.isArray(body) ? body : [body]).filter(c => c && typeof c === 'object');
+    if (!maps.length) continue;
+    const ctx = Object.assign({}, ...maps);
     const prefixes = {};
     for (const [k, v] of Object.entries(ctx)) {
       if (typeof v === 'string' && /^https?:\/\//.test(v)) prefixes[k] = v;
@@ -189,8 +194,41 @@ function isListHead(term, ctx) {
  * IRI, which is what a bare reference was. Handlers already test which they
  * got (`typeof activity.object === 'object'`), so both stay readable.
  */
+// A literal's `.value` is its LEXICAL form, which is a string whatever the
+// literal meant: `false` written in JSON-LD arrives here as the four characters
+// "false", and `42` as two digits. Every handler downstream then reads a string
+// where the document said a boolean or a number — and `!!"false"` is true, which
+// is how a moderator's reopen was applied as another close.
+//
+// So the two datatypes whose lexical form lies about the value are turned back.
+// Everything else is left exactly as it was, dates above all: a timestamp is
+// carried, compared and republished as its string everywhere in this project,
+// and "helpfully" turning it into a Date would break all of it.
+const XSD = 'http://www.w3.org/2001/XMLSchema#';
+const NUMERIC = new Set(['integer', 'decimal', 'double', 'float', 'long', 'int', 'short', 'byte',
+  'nonNegativeInteger', 'positiveInteger', 'nonPositiveInteger', 'negativeInteger',
+  'unsignedLong', 'unsignedInt', 'unsignedShort', 'unsignedByte'].map(t => XSD + t));
+
+function fromLiteral(term) {
+  const type = term.datatype?.value || '';
+  if (type === `${XSD}boolean`) {
+    // The lexical space of xsd:boolean is exactly these four. Anything else is
+    // not a boolean the document can have meant, so it stays as it was written.
+    if (term.value === 'true' || term.value === '1') return true;
+    if (term.value === 'false' || term.value === '0') return false;
+    return term.value;
+  }
+  if (NUMERIC.has(type)) {
+    const n = Number(term.value);
+    // A numeric literal that will not parse is malformed; handing back NaN
+    // would lose what the document actually said.
+    return Number.isFinite(n) ? n : term.value;
+  }
+  return term.value;
+}
+
 function toValue(term, ctx, depth, path) {
-  if (term.termType === 'Literal') return term.value;
+  if (term.termType === 'Literal') return fromLiteral(term);
   if (isListHead(term, ctx)) return readList(term.value, ctx, depth, path);
   const preds = ctx.bySubject.get(term.value);
   if (preds && preds.size) return makeView(term.value, ctx, depth + 1, path);