fedipod 0.16.0 → 0.18.0

package/README.md

@@ -74,6 +74,9 @@ keyword filters, scheduled posts, pinned posts (visible from other servers),
 blocking and muting from the client, custom emojis, and web-push
 notifications that reach you while the client is closed.
 
+Polls: up to four options, one answer or several, running from five minutes to
+a month.
+
 ### Other clients
 
 - **Web clients**: drop any static Mastodon client dist into `ui/<name>/`

package/lib/admin.mjs

@@ -485,9 +485,19 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
       // C2S (ActivityPub §6) carries its own authentication — a Solid-OIDC
       // DPoP proof or the facade's bearer — so the dk-token gate does not
       // stand in front of it. The Host/Origin firewall above still does.
-      if (p === '/ap/outbox' || p === '/ap/actor') {
+      if (p === '/ap/outbox' || p === '/ap/actor' || p === '/ap/inbox') {
         if (await c2s.handle(req, res, p, url)) return;
       }
+      // Where a client looks first to find out how to sign in (RFC 8414), and
+      // in front of the door for the same reason C2S is: a client that has to
+      // be handed a secret before it can ask how to sign in cannot set itself
+      // up at all. It names endpoints and nothing else, the endpoints it names
+      // refuse without a password anyway, and the host and origin firewall
+      // above still decides who gets this far.
+      if (p === '/.well-known/oauth-authorization-server') {
+        const scheme = req.socket.encrypted || req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http';
+        return json(res, 200, masto.authorizationServerMetadata(`${scheme}://${req.headers.host}`));
+      }
       if (atDoor && gate(req, res)) return;
       if (p === '/api/v1/streaming/health') {
         res.writeHead(200, { 'content-type': 'text/plain' }); res.end('OK'); return;

package/lib/c2s.mjs

@@ -5,14 +5,26 @@
 // SAME helper the facade and admin surfaces use — this module re-implements
 // no persistence and no delivery, so one write path stays one.
 //
-// GETs are redirects: the pod's documents are the canonical actor and outbox,
-// and a second renderer here would only drift from them.
+// GETs on the actor and outbox are redirects: the pod's documents are the
+// canonical ones, and a second renderer here would only drift from them.
+//
+// The inbox is the exception, and has to be. Deliveries land in a container on
+// the pod which the drain empties as it handles each item, so reading that
+// container tells the owner only what has not been dealt with yet. What was
+// actually received is whole only in the archive, so §5.2's "the owner can
+// read their own inbox" is served from there, by this agent, to the owner
+// alone.
 
 import * as social from './social.mjs';
 import * as wire from './wire.mjs';
 
 const MAX_BODY = 512 * 1024;          // same ceiling the inbox drain enforces
 
+// How many archived items one page of the inbox will read. A page is one
+// month, and a month with more than this is served short rather than costing
+// the pod an unbounded read; the log says when that happened.
+const MAX_INBOX_PAGE = 500;
+
 // §6 names activities; anything else with a type is an object to wrap.
 const ACTIVITY_TYPES = new Set([
   'Create', 'Update', 'Delete', 'Follow', 'Like', 'Announce', 'Undo',
@@ -60,14 +72,102 @@ export class C2S {
     return iri ? this.store.getStatuses().find((s) => s.noteId === iri) : null;
   }
 
+  /** The months the archive holds, newest first. One container listing. */
+  async archiveMonths() {
+    const archive = this.agent.intake?.archive;
+    if (!archive) return [];
+    const { names } = await archive.list('');
+    return (names || [])
+      .map((n) => n.replace(/\/$/u, ''))
+      .filter((n) => /^\d{4}-\d{2}$/u.test(n))
+      .sort()
+      .reverse();
+  }
+
+  /**
+   * The owner's own inbox, §5.2. Paged by month because that is how the
+   * archive is stored, so a page costs one listing and a read per item and no
+   * page is dearer for another month being large.
+   */
+  async sendInbox(res, url) {
+    const id = `${this.urls.base}ap/inbox`;
+    const page = url?.searchParams?.get('page') || null;
+    let months;
+    try {
+      months = await this.archiveMonths();
+    } catch (e) {
+      return this.send(res, 502, { error: `the archive could not be read: ${e.message}` });
+    }
+
+    if (!page) {
+      if (!months.length && this.store.getConfig()?.archiveInbox === false) {
+        this.log('inbox read: nothing to show — this identity does not keep what it receives');
+      }
+      return this.send(res, 200, {
+        '@context': wire.AS_CTX, id, type: 'OrderedCollection',
+        ...(months.length ? { first: `${id}?page=${months[0]}` } : { orderedItems: [] }),
+      });
+    }
+    if (!/^\d{4}-\d{2}$/u.test(page)) {
+      return this.send(res, 400, { error: 'page names a month, written 2026-09' });
+    }
+
+    const archive = this.agent.intake?.archive;
+    let names = [];
+    try {
+      // The trailing slash matters: without it this names a document, not the
+      // container, and a pod answers about the wrong thing.
+      ({ names } = await archive.list(`${page}/`));
+    } catch (e) {
+      return this.send(res, 502, { error: `the archive could not be read: ${e.message}` });
+    }
+    const files = (names || []).filter((n) => n.endsWith('.json')).sort();
+    if (files.length > MAX_INBOX_PAGE) {
+      this.log(`inbox read: ${page} holds ${files.length} items; serving the first ${MAX_INBOX_PAGE}`);
+    }
+    const kept = [];
+    for (const file of files.slice(0, MAX_INBOX_PAGE)) {
+      // Read as written: these records are JSON-LD, and the default read asks
+      // turtle-first, which a server is free to answer with turtle.
+      const read = await archive.read(`${page}/${file}`, { accept: '*/*' });
+      if (!read?.ok || !read.body) continue;
+      try {
+        const record = JSON.parse(read.body);
+        // The record wraps the bytes as they arrived; the activity is those
+        // bytes, not a retelling of them.
+        kept.push({ at: record.receivedAt || '', activity: JSON.parse(record.raw) });
+      } catch { /* a record that will not parse is not one that can be served */ }
+    }
+    kept.sort((a, b) => String(b.at).localeCompare(String(a.at)));
+    const older = months.filter((m) => m < page)[0] || null;
+    return this.send(res, 200, {
+      '@context': wire.AS_CTX,
+      id: `${id}?page=${page}`,
+      type: 'OrderedCollectionPage',
+      partOf: id,
+      ...(older ? { next: `${id}?page=${older}` } : {}),
+      orderedItems: kept.map((k) => k.activity),
+    });
+  }
+
   async handle(req, res, pathname, url) {   // eslint-disable-line no-unused-vars
-    if (pathname !== '/ap/outbox' && pathname !== '/ap/actor') return false;
+    if (pathname !== '/ap/outbox' && pathname !== '/ap/actor' && pathname !== '/ap/inbox') return false;
     if (req.method === 'OPTIONS') {
-      res.writeHead(204, { allow: 'GET, POST, OPTIONS' }); res.end(); return true;
+      res.writeHead(204, { allow: pathname === '/ap/inbox' ? 'GET, OPTIONS' : 'GET, POST, OPTIONS' });
+      res.end(); return true;
     }
     if (!this.agent.configured() || !this.urls) {
       return this.send(res, 409, { error: 'agent not configured' });
     }
+    if (pathname === '/ap/inbox') {
+      if (req.method !== 'GET' && req.method !== 'HEAD') {
+        return this.send(res, 405, { error: "deliveries go to this actor's inbox on the pod, which the "
+          + 'actor document names; this address is the owner reading their own' });
+      }
+      const reader = await this.auth(req, pathname);
+      if (!reader.ok) return this.send(res, reader.status, { error: reader.error });
+      return this.sendInbox(res, url);
+    }
     if (req.method === 'GET' || req.method === 'HEAD') {
       // The pod's copy is the document; send the reader there.
       const target = pathname === '/ap/actor' ? this.urls.actor : this.urls.outbox;
@@ -134,8 +234,9 @@ export class C2S {
 
     switch (activity.type) {
       case 'Create': {
-        if (!object || (object.type && object.type !== 'Note')) {
-          return this.send(res, 422, { error: 'only a Note (or a bare Note) can be created here' });
+        const makes = object?.type || 'Note';
+        if (!object || (makes !== 'Note' && makes !== 'Question')) {
+          return this.send(res, 422, { error: 'only a Note or a Question (or a bare Note) can be created here' });
         }
         const visibility = this.visibilityOf(activity, object);
         if (!visibility) {
@@ -146,6 +247,30 @@ export class C2S {
         // visible characters rather than as markup. Documented v1 limit.
         const text = String(object.source?.content ?? object.content ?? '');
         if (!text.trim()) return this.send(res, 422, { error: 'the note has no content' });
+
+        // A Question is a poll: the choices are in oneOf (pick one) or anyOf
+        // (pick several), each naming itself, and endTime is when it shuts.
+        if (makes === 'Question') {
+          const one = arr(object.oneOf);
+          const many = arr(object.anyOf);
+          const titles = (one.length ? one : many).map((c) => String(c?.name ?? '').trim()).filter(Boolean);
+          try {
+            const question = await agent.publisher.publishQuestion(text, {
+              options: titles,
+              multiple: !one.length && many.length > 0,
+              expiresAt: object.endTime || null,
+              inReplyTo: idOf(object.inReplyTo) || undefined,
+              visibility,
+              spoilerText: object.summary || null,
+            });
+            return this.send(res, 201,
+              { id: wire.createActivityId(question.id), object: question.id },
+              { location: wire.createActivityId(question.id) });
+          } catch (e) {
+            return this.send(res, 422, { error: e.message });
+          }
+        }
+
         const attachments = arr(object.attachment).map((a) => ({
           url: a?.url, mediaType: a?.mediaType,
           ...(a?.name ? { description: a.name } : {}),

package/lib/embed.mjs

@@ -202,6 +202,7 @@ export async function startEmbeddedAgent({
     agent.importer?.stop();
     clearInterval(agent.schedTimer);
     clearInterval(agent.refreshTimer);
+    agent.publisher?.stopPolls();
     // Same order the standalone agent's shutdown uses: write what is pending,
     // then let go of the lease so the next agent need not wait out the TTL.
     await Promise.allSettled([

package/lib/intake.mjs

@@ -19,6 +19,7 @@ import { USER_AGENT } from './ua.mjs';
 import { PUBLIC } from './wire.mjs';
 import { HTTP_TIMEOUT_MS, readCapped } from './safefetch.mjs';
 import { linkTargets, REL } from './links.mjs';
+import * as polls from './polls.mjs';
 import { dropFollower } from './store.mjs';
 
 const RDF = $rdf.Namespace('http://www.w3.org/1999/02/22-rdf-syntax-ns#');
@@ -349,13 +350,18 @@ export class Intake {
       || g.each(null, NOTIFY('channelType'), NOTIFY('WebSocketChannel2023'), null)
         .map(n => n.value).find(Boolean);
     if (!channel) { this.wsState = 'unavailable'; this.log('no WebSocketChannel2023 service — polling only'); return; }
+    // The topic is a POD resource, and it travels in the BODY — so the url map
+    // RemotePod applies to the request line never reaches it. A fronted
+    // identity's inbox url names the front, which the pod cannot grant read on,
+    // and the subscription came back 403. A no-op when unfronted.
+    const topic = this.urls.toPod ? this.urls.toPod(this.urls.inbox) : this.urls.inbox;
     const sub = await this.remote.fetch(channel, {
       method: 'POST',
       headers: { 'content-type': 'application/ld+json' },
       body: JSON.stringify({
         '@context': ['https://www.w3.org/ns/solid/notification/v1'],
         type: 'http://www.w3.org/ns/solid/notifications#WebSocketChannel2023',
-        topic: this.urls.inbox,
+        topic,
       }),
     });
     const body = await readCapped(sub).then(JSON.parse).catch(() => null);
@@ -1426,6 +1432,22 @@ export class Intake {
     // somebody else's boost, or through a hashtag feed.
     if (this.store.isBlocked(author)) return `blocked author (${author})`;
 
+    // An answer to one of our polls is a number on a document, not a post. It
+    // arrives as an ordinary reply naming an option and carrying nothing else,
+    // so filing it as one would put a blank entry in the thread and ring the
+    // owner once per voter. Counted or refused — a second answer, an option we
+    // do not offer, a poll already shut — it stops here either way.
+    const asked = note.inReplyTo && this.store.getStatuses()
+      .find(x => x.noteId === String(note.inReplyTo) && x.kind === 'post' && x.poll);
+    if (asked && polls.isVoteShape(note)) {
+      const counted = await this.publisher.recordVote(asked.noteId, author, note.name)
+        .catch(e => { this.log(`vote on ${asked.noteId}: ${e.message}`); return false; });
+      this.log(counted
+        ? `vote counted (${note.name}): ${asked.noteId}`
+        : `vote not counted (${note.name}) from ${author}: ${asked.noteId}`);
+      return;
+    }
+
     // Anyone can Append to a public inbox, so arriving is not the same as
     // belonging in the home timeline. Follow Mastodon's split: people you
     // follow (and their boosts) are HOME; anyone else is a MENTION — kept,

package/lib/mastoapi.mjs

@@ -16,6 +16,11 @@ import { sanitizeHtml, followsNeedApproval, publicHandle } from './wire.mjs';
 import { authorOf } from './intake.mjs';
 import { profileUrl, postUrl } from './bskyfeed.mjs';
 import { Push } from './webpush.mjs';
+import { safeFetch, readCapped } from './safefetch.mjs';
+import {
+  MAX_OPTIONS as POLL_MAX_OPTIONS, MAX_OPTION_CHARS as POLL_MAX_OPTION_CHARS,
+  MIN_SECONDS as POLL_MIN_SECONDS, MAX_SECONDS as POLL_MAX_SECONDS,
+} from './polls.mjs';
 
 // What an attachment is allowed to BE. Anything else is stored as bytes, which
 // a browser downloads rather than runs.
@@ -26,6 +31,26 @@ const ATTACHMENT_KINDS = new Set(['image', 'video', 'audio']);
 const NEVER = new Set(['image/svg+xml', 'image/svg']);
 const OPAQUE = 'application/octet-stream';
 
+/**
+ * A poll out of a compose request, or null when there is none. A JSON client
+ * sends a `poll` object; a form-encoded one spells the same thing out in
+ * Rails's bracket notation, which is the shape the option list arrives in.
+ */
+export function pollParams(body) {
+  const nested = body?.poll && typeof body.poll === 'object' ? body.poll : null;
+  const options = [].concat(nested?.options ?? body?.['poll[options][]'] ?? [])
+    .map(o => String(o ?? '').trim()).filter(Boolean);
+  const rawExpiry = nested?.expires_in ?? body?.['poll[expires_in]'];
+  const rawMultiple = nested?.multiple ?? body?.['poll[multiple]'];
+  if (!options.length && rawExpiry === undefined) return null;
+  return {
+    options,
+    expiresIn: rawExpiry === undefined || rawExpiry === null || rawExpiry === ''
+      ? null : Number(rawExpiry),
+    multiple: rawMultiple === true || rawMultiple === 'true' || rawMultiple === '1',
+  };
+}
+
 export function attachmentType(claimed) {
   const t = String(claimed || '').split(';')[0].trim().toLowerCase();
   if (!/^[a-z0-9.+-]+\/[a-z0-9.+-]+$/.test(t) || NEVER.has(t)) return OPAQUE;
@@ -62,6 +87,8 @@ const AUTHZ_WINDOW_MS = 60_000;
 const AUTHZ_MAX_ATTEMPTS = 5;
 const CODE_TTL_MS = 5 * 60_000;                  // an authorization code is short-lived
 const MAX_APPS = 200;                            // registered third-party clients, capped
+const CLIENT_DOC_TTL_MS = 10 * 60_000;           // how long a fetched client document is trusted
+const CLIENT_DOC_MAX = 64 * 1024;                // it names a client; it is not a payload
 
 export class MastoApi {
   constructor({ agent, log = console.log, allowed = null, scheme = null, embedded = false }) {
@@ -127,7 +154,91 @@ export class MastoApi {
   // said, and only that client, presenting its secret, can exchange it for a
   // bearer. A redirect back to this agent's own origin keeps the local flow.
   apps() { return this.store.read('oauth-apps.json', []); }
+  /**
+   * What a client needs to know before it can sign in, at the address RFC 8414
+   * puts it. The actor carries the same two endpoints; a client that looks
+   * here first finds everything rather than the minimum.
+   *
+   * `none` among the authentication methods is what says a client keeping no
+   * secret is welcome, which is the whole of what a browser app needs to hear.
+   */
+  authorizationServerMetadata(origin) {
+    const at = (p) => `${origin.replace(/\/$/u, '')}${p}`;
+    return {
+      issuer: origin.replace(/\/$/u, ''),
+      authorization_endpoint: at('/oauth/authorize'),
+      token_endpoint: at('/oauth/token'),
+      revocation_endpoint: at('/oauth/revoke'),
+      registration_endpoint: at('/api/v1/apps'),
+      response_types_supported: [ 'code' ],
+      grant_types_supported: [ 'authorization_code' ],
+      code_challenge_methods_supported: [ 'S256', 'plain' ],
+      token_endpoint_auth_methods_supported: [ 'client_secret_post', 'none' ],
+      scopes_supported: [ 'read', 'write', 'follow', 'push' ],
+    };
+  }
+
   findApp(clientId) { return clientId ? this.apps().find(a => a.clientId === clientId) || null : null; }
+
+  /**
+   * A client that publishes its own metadata document is named by that
+   * document's URL and registers nothing here: the document says who it is
+   * and where it may be sent back to. Such a client keeps no secret, so it
+   * always proves itself with a challenge instead.
+   *
+   * The fetch is the guarded one — a client id is a URL a stranger chose, and
+   * an unguarded fetch of it would ask this machine to reach wherever they
+   * pointed.
+   */
+  async resolveClientDocument(clientId) {
+    if (!/^https:\/\//iu.test(String(clientId || ''))) return null;   // cleartext is refused
+    this.clientDocs = this.clientDocs || new Map();
+    const seen = this.clientDocs.get(clientId);
+    if (seen && Date.now() - seen.at < CLIENT_DOC_TTL_MS) return seen.client;
+    let doc;
+    try {
+      const res = await safeFetch(clientId, { headers: { accept: 'application/json' } });
+      if (res.status >= 400) { this.log(`client document ${clientId} → ${res.status}`); return null; }
+      doc = JSON.parse(await readCapped(res, CLIENT_DOC_MAX));
+    } catch (e) {
+      this.log(`client document ${clientId} could not be read: ${e.message}`);
+      return null;
+    }
+    // It must claim to be itself: a document naming some other id would let
+    // one client borrow another's name.
+    if (doc?.client_id !== clientId) {
+      this.log(`client document ${clientId} names ${doc?.client_id ?? 'nothing'} — refused`);
+      return null;
+    }
+    const redirectUris = [].concat(doc.redirect_uris || []).filter((u) => typeof u === 'string');
+    if (!redirectUris.length) { this.log(`client document ${clientId} names no redirect — refused`); return null; }
+    const client = {
+      clientId, redirectUris,
+      name: String(doc.client_name || clientId).slice(0, 200),
+      scopes: 'read write follow',
+    };
+    this.clientDocs.set(clientId, { at: Date.now(), client });
+    return client;
+  }
+
+  /**
+   * Whether a redirect the client asked for is one it published.
+   *
+   * A native client listens on whatever port the machine gave it, so it can
+   * only publish the loopback address without one (RFC 8252). The port is
+   * therefore not part of the match there, and nowhere else.
+   */
+  static redirectMatches(published, asked) {
+    if (published === asked) return true;
+    try {
+      const a = new URL(published);
+      const b = new URL(asked);
+      const loopback = (h) => h === '127.0.0.1' || h === '[::1]' || h === 'localhost';
+      if (!loopback(a.hostname) || a.hostname !== b.hostname) return false;
+      return a.protocol === b.protocol
+        && a.pathname.replace(/\/$/u, '') === b.pathname.replace(/\/$/u, '');
+    } catch { return false; }
+  }
   registerApp({ name, website, redirectUris, scopes }) {
     const app = {
       clientId: crypto.randomBytes(16).toString('hex'),
@@ -143,13 +254,39 @@ export class MastoApi {
   // A short-lived, single-use authorization code for a registered client, kept
   // apart from masto-tokens.json so the code is NOT a bearer until it is
   // exchanged with the client secret.
-  mintCode({ clientId, redirectUri, scope }) {
+  mintCode({ clientId, redirectUri, scope, challenge = null, challengeMethod = null }) {
     const code = crypto.randomBytes(24).toString('hex');
     const now = Date.now();
     const kept = this.store.read('oauth-codes.json', []).filter(c => now - c.createdAt < CODE_TTL_MS);
-    this.store.write('oauth-codes.json', [...kept, { code, clientId, redirectUri, scope, createdAt: now }].slice(-50));
+    this.store.write('oauth-codes.json', [ ...kept, {
+      code, clientId, redirectUri, scope, createdAt: now,
+      // What the client promised to prove when it comes back for the token.
+      // A client that cannot keep a secret — anything running in a browser —
+      // has this instead, and it is the only thing standing between a stolen
+      // code and a token.
+      ...(challenge ? { challenge, challengeMethod: challengeMethod || 'plain' } : {}),
+    } ].slice(-50));
     return code;
   }
+  /**
+   * Whether this verifier is the one the challenge was made from (RFC 7636).
+   * Length is checked because a short verifier is guessable, which is the
+   * whole thing this is here to prevent.
+   */
+  static provesCode(rec, verifier) {
+    const v = String(verifier || '');
+    if (v.length < 43 || v.length > 128) return false;
+    if ((rec.challengeMethod || 'plain') === 'S256') {
+      const made = crypto.createHash('sha256').update(v).digest('base64url');
+      const given = Buffer.from(made);
+      const known = Buffer.from(String(rec.challenge));
+      return given.length === known.length && crypto.timingSafeEqual(given, known);
+    }
+    const given = Buffer.from(v);
+    const known = Buffer.from(String(rec.challenge));
+    return given.length === known.length && crypto.timingSafeEqual(given, known);
+  }
+
   consumeCode(code) {
     const now = Date.now();
     const all = this.store.read('oauth-codes.json', []);
@@ -515,7 +652,7 @@ export class MastoApi {
       expires_at: s.poll.expiresAt || null,
       expired: !!s.poll.closed || (!!s.poll.expiresAt && Date.parse(s.poll.expiresAt) < Date.now()),
       multiple: !!s.poll.multiple,
-      votes_count: votes, voters_count: null,
+      votes_count: votes, voters_count: s.poll.votersCount ?? null,
       options: opts.map(o => ({ title: o.title, votes_count: o.votes || 0 })),
       voted: !!s.poll.voted, own_votes: s.poll.ownVotes || [],
       emojis: [],
@@ -620,19 +757,35 @@ export class MastoApi {
       if (req.method === 'POST') { body = await readBody(req); params = new URLSearchParams(body); }
       const redirect = params.get('redirect_uri') || '';
       const app = this.findApp(params.get('client_id') || '');
+      // A client that published its own metadata document needs no
+      // registration here: the document is its name and says where it may be
+      // sent back to.
+      const doc = app ? null : await this.resolveClientDocument(params.get('client_id') || '');
       // A REGISTERED client is always the third-party flow — its code is
       // bound to it and exchanged with its secret — even when its redirect
       // points back at this very agent (a web client served from our own
       // origin registers itself exactly like a phone app does). The local
       // code-is-the-token flow is only for the built-in client, which never
       // registers.
-      const external = !!app;
-      const client = { name: app?.name || null, redirect, scope: params.get('scope') || 'read' };
-      if (external) {
+      const external = !!app || !!doc;
+      const client = { name: app?.name || doc?.name || null, redirect, scope: params.get('scope') || 'read' };
+      if (app) {
         if (!app.redirectUris.includes(redirect)) {
           this.log(`authorize refused: redirect_uri "${redirect}" not registered for ${app.clientId}`);
           return send(400, { error: 'redirect_uri was not registered by this client' });
         }
+      } else if (doc) {
+        if (!doc.redirectUris.some((u) => MastoApi.redirectMatches(u, redirect))) {
+          this.log(`authorize refused: redirect_uri "${redirect}" is not one ${doc.clientId} published`);
+          return send(400, { error: 'redirect_uri is not one this client published' });
+        }
+        // It keeps no secret, so the challenge is the only thing that will
+        // stand between its code and a token. Refuse now rather than mint a
+        // code nothing can prove.
+        if (!params.get('code_challenge')) {
+          this.log(`authorize refused: ${doc.clientId} keeps no secret and offered no challenge`);
+          return send(400, { error: 'a client identified by its own document must send a code_challenge' });
+        }
       } else if (!this.redirectAllowed(redirect)) {
         this.log(`authorize refused: redirect_uri "${redirect}" is not this agent`);
         return send(400, { error: 'redirect_uri must be an address of this agent' });
@@ -640,7 +793,11 @@ export class MastoApi {
       if (req.method === 'POST') {
         if (this.rateLimited()) {
           this.log('authorize rate limited');
-          return sendLoginForm(res, params, 'too many attempts — wait a minute', client);
+          // 429, not 401: a client that reads this as a wrong password will
+          // ask the person to type it again, which is the one thing that
+          // cannot help. Retry-After says how long the wait actually is.
+          return sendLoginForm(res, params, 'too many attempts — wait a minute', client,
+            429, { 'retry-after': String(Math.ceil(AUTHZ_WINDOW_MS / 1000)) });
         }
         if (!pw || !checkPassword(pw, body.password || '')) {
           return sendLoginForm(res, params, 'wrong password — try again', client);
@@ -670,7 +827,9 @@ export class MastoApi {
       }
       // External clients get a bound code; the local flow keeps code==token.
       const code = external
-        ? this.mintCode({ clientId: app.clientId, redirectUri: redirect, scope: client.scope })
+        ? this.mintCode({ clientId: (app || doc).clientId, redirectUri: redirect, scope: client.scope,
+          challenge: params.get('code_challenge') || null,
+          challengeMethod: params.get('code_challenge_method') || null })
         : this.mintToken();
       if (!redirect || redirect === 'urn:ietf:wg:oauth:2.0:oob') return send(200, { code });
       const target = new URL(redirect);
@@ -685,6 +844,44 @@ export class MastoApi {
       // A registered third-party client exchanges its bound code, proving its
       // secret, for a real bearer — the code alone is not a token.
       const app = this.findApp(body.client_id || '');
+      // A client named by its own document keeps no secret at all, so the
+      // challenge is the whole of its proof. The code carries the document's
+      // URL as the client it was bound to.
+      if (!app && body.code_verifier && /^https:\/\//iu.test(String(body.client_id || ''))) {
+        const rec = this.consumeCode(body.code || '');
+        if (!rec || rec.clientId !== body.client_id
+          || (body.redirect_uri && rec.redirectUri !== body.redirect_uri)) {
+          this.log('token refused: code is not a live authorization for that client document');
+          return send(400, { error: 'invalid_grant' });
+        }
+        if (!rec.challenge || !MastoApi.provesCode(rec, body.code_verifier)) {
+          this.log('token refused: the verifier does not answer the challenge this code was made with');
+          return send(400, { error: 'invalid_grant' });
+        }
+        return send(200, { access_token: this.mintToken(), token_type: 'Bearer',
+          scope: rec.scope || 'read', created_at: Math.floor(Date.now() / 1000),
+          ...(this.urls?.actor ? { activitypub_actor_id: this.urls.actor } : {}) });
+      }
+      // A client that runs in a browser cannot keep a secret, so it proves it
+      // is the same caller that asked instead: it sends the verifier for the
+      // challenge it presented at authorize (RFC 7636). Sending a verifier is
+      // what says which of the two flows this is.
+      if (app && body.code_verifier) {
+        const rec = this.consumeCode(body.code || '');
+        if (!rec || rec.clientId !== app.clientId || (body.redirect_uri && rec.redirectUri !== body.redirect_uri)) {
+          this.log('token refused: code is not a live authorization for this client');
+          return send(400, { error: 'invalid_grant' });
+        }
+        // A code minted without a challenge cannot be redeemed with one: that
+        // would let anyone holding a stolen code invent the proof for it.
+        if (!rec.challenge || !MastoApi.provesCode(rec, body.code_verifier)) {
+          this.log('token refused: the verifier does not answer the challenge this code was made with');
+          return send(400, { error: 'invalid_grant' });
+        }
+        return send(200, { access_token: this.mintToken(), token_type: 'Bearer',
+          scope: rec.scope || 'read', created_at: Math.floor(Date.now() / 1000),
+          ...(this.urls?.actor ? { activitypub_actor_id: this.urls.actor } : {}) });
+      }
       if (app && body.client_secret) {
         const given = Buffer.from(String(body.client_secret));
         const known = Buffer.from(app.clientSecret);
@@ -695,8 +892,18 @@ export class MastoApi {
           this.log('token refused: code is not a live authorization for this client');
           return send(400, { error: 'invalid_grant' });
         }
+        // A challenge, once made, is not optional: without this a client could
+        // present one and then skip past it with the secret alone.
+        if (rec.challenge && !MastoApi.provesCode(rec, body.code_verifier)) {
+          this.log('token refused: this code was made with a challenge and the verifier does not answer it');
+          return send(400, { error: 'invalid_grant' });
+        }
         return send(200, { access_token: this.mintToken(), token_type: 'Bearer',
-          scope: rec.scope || 'read', created_at: Math.floor(Date.now() / 1000) });
+          scope: rec.scope || 'read', created_at: Math.floor(Date.now() / 1000),
+          // Which actor the token acts for. A Mastodon client ignores it; an
+          // ActivityPub API client needs it, and asking for it separately
+          // would mean a second round trip before it knows who it is.
+          ...(this.urls?.actor ? { activitypub_actor_id: this.urls.actor } : {}) });
       }
       // Local flow: the code IS the token, minted by /oauth/authorize after the
       // password gate. Minting one here for an unrecognised code handed a
@@ -707,7 +914,9 @@ export class MastoApi {
         this.log('token refused: code is not a live authorization');
         return send(400, { error: 'invalid_grant' });
       }
-      return send(200, { access_token: body.code, token_type: 'Bearer', scope: body.scope || 'read write follow push', created_at: Math.floor(Date.now() / 1000) });
+      return send(200, { access_token: body.code, token_type: 'Bearer',
+        scope: body.scope || 'read write follow push', created_at: Math.floor(Date.now() / 1000),
+        ...(this.urls?.actor ? { activitypub_actor_id: this.urls.actor } : {}) });
     }
     if (pathname === '/oauth/revoke' && req.method === 'POST') {
       // It used to answer 200 and keep the token, so logging out of a client
@@ -895,6 +1104,41 @@ export class MastoApi {
       const mediaIds = [].concat(body.media_ids || body['media_ids[]'] || []).filter(Boolean);
       const media = this.store.getMedia();
       const attachments = mediaIds.map(id => media[id] && { id, ...media[id] }).filter(Boolean);
+
+      const asking = pollParams(body);
+      if (asking) {
+        // Mastodon's own rules, stated here rather than discovered inside the
+        // publisher, so a client gets the reason back on the request it made.
+        if (attachments.length) return send(422, { error: 'a poll cannot carry media' });
+        if (body.scheduled_at) return send(422, { error: 'a poll cannot be scheduled' });
+        if (asking.options.length < 2) return send(422, { error: 'a poll needs at least two options' });
+        if (asking.options.length > POLL_MAX_OPTIONS) {
+          return send(422, { error: `a poll takes at most ${POLL_MAX_OPTIONS} options` });
+        }
+        if (asking.options.some(o => o.length > POLL_MAX_OPTION_CHARS)) {
+          return send(422, { error: `a poll option is at most ${POLL_MAX_OPTION_CHARS} characters` });
+        }
+        if (new Set(asking.options).size !== asking.options.length) {
+          return send(422, { error: 'a poll\u2019s options must differ from one another' });
+        }
+        const seconds = asking.expiresIn ?? POLL_MAX_SECONDS;
+        if (!Number.isFinite(seconds) || seconds < POLL_MIN_SECONDS || seconds > POLL_MAX_SECONDS) {
+          return send(422, {
+            error: `a poll runs between ${POLL_MIN_SECONDS} and ${POLL_MAX_SECONDS} seconds`,
+          });
+        }
+        try {
+          const q = await this.agent.publisher.publishQuestion(body.status, {
+            options: asking.options, multiple: asking.multiple,
+            expiresAt: new Date(Date.now() + seconds * 1000).toISOString(),
+            inReplyTo, visibility, spoilerText,
+          });
+          return send(200, this.status(this.store.getStatuses().find(x => x.noteId === q.id)));
+        } catch (e) {
+          return send(422, { error: e.message });
+        }
+      }
+
       if (body.scheduled_at) {
         const at = Date.parse(body.scheduled_at);
         if (!Number.isFinite(at) || at < Date.now() + 60_000) {
@@ -1522,7 +1766,12 @@ function instanceConfig() {
       image_size_limit: 10 * 1024 * 1024, video_size_limit: 40 * 1024 * 1024,
       image_matrix_limit: 16777216, video_matrix_limit: 2304000,
     },
-    polls: { max_options: 0 },
+    polls: {
+      max_options: POLL_MAX_OPTIONS,
+      max_characters_per_option: POLL_MAX_OPTION_CHARS,
+      min_expiration: POLL_MIN_SECONDS,
+      max_expiration: POLL_MAX_SECONDS,
+    },
     accounts: { max_featured_tags: 0 },
   };
 }
@@ -1554,7 +1803,7 @@ const escapeHtml = (s) => String(s).replace(/[&<>"']/g, c =>
 const parseRedirects = (v) => (Array.isArray(v) ? v : String(v || '').split(/\s+/))
   .map(s => s.trim()).filter(Boolean);
 
-function sendLoginForm(res, params, error = '', client = null) {
+function sendLoginForm(res, params, error = '', client = null, status = null, headers = {}) {
   const hidden = [...params.entries()].filter(([k]) => k !== 'password')
     .map(([k, v]) => `<input type="hidden" name="${escapeHtml(k)}" value="${escapeHtml(v)}">`).join('\n');
   // Name what is asking, so the owner approves a client they can see rather
@@ -1569,7 +1818,8 @@ function sendLoginForm(res, params, error = '', client = null) {
       + `${where ? `, sending the authorization to <code>${escapeHtml(where)}</code>` : ''}.</p>`
       + `<p>Scope: <code>${escapeHtml(client.scope || 'read')}</code>. Enter the agent password to allow it.</p>`;
   }
-  res.writeHead(error ? 401 : 200, { 'content-type': 'text/html; charset=utf-8' });
+  res.writeHead(status || (error ? 401 : 200),
+    { 'content-type': 'text/html; charset=utf-8', ...headers });
   res.end(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
 <title>FediPod — authorize</title>
 <style>:root{color-scheme:light dark;font-size:125%;--heading:#1a4f8a}
@@ -1679,7 +1929,17 @@ function readBody(req) {
       const ct = String(req.headers['content-type'] || '');
       try {
         if (ct.includes('application/json')) return resolve(data ? JSON.parse(data) : {});
-        resolve(Object.fromEntries(new URLSearchParams(data)));
+        // A form-encoded list is the same key repeated, spelled with a
+        // trailing `[]`. Reading it as a plain object kept only the last one,
+        // so a client sending its poll or its media that way lost all but the
+        // final value. Only the `[]` keys become lists: everything else keeps
+        // the single value the rest of this file reads.
+        const form = new URLSearchParams(data);
+        const out = {};
+        for (const key of new Set(form.keys())) {
+          out[key] = key.endsWith('[]') ? form.getAll(key) : form.get(key);
+        }
+        resolve(out);
       } catch (e) { reject(e); }
     });
     req.on('error', reject);

package/lib/polls.mjs

@@ -0,0 +1,105 @@
+// polls.mjs — the count behind a Question.
+//
+// A poll travels as a Question whose options live in `oneOf` (pick one) or
+// `anyOf` (pick several). A vote is not a special activity: it arrives as an
+// ordinary reply carrying the option's `name` and no content. So the fediverse
+// carries the votes and the author's server keeps the count — which means when
+// the poll is ours, the roster of who chose what is ours to hold.
+//
+// Everything here is pure. The roster is a plain object the caller stores and
+// hands back; the tallies are always DERIVED from it rather than kept beside
+// it, so a count cannot drift away from the votes it is meant to summarize.
+
+import crypto from 'node:crypto';
+
+/** Where the roster lives in agent state. */
+export const VOTES_DOC = 'poll-votes.json';
+
+// What a poll may be. These are Mastodon's own limits, and they are the ones
+// clients read out of the instance document to draw their poll composer, so a
+// number we chose differently would be a number the composer then lets someone
+// exceed. They live here rather than beside the client API because every way
+// in has to honour them: an option is matched BY NAME when the vote comes
+// back, so a long title is one something else in the network may truncate and
+// hand back unrecognizable.
+export const MAX_OPTIONS = 4;
+export const MAX_OPTION_CHARS = 50;
+export const MIN_SECONDS = 5 * 60;
+export const MAX_SECONDS = 2629746;          // a month, as Mastodon counts one
+
+// A voter is recorded as a hash of their actor id rather than the id itself.
+// The roster is rewritten on every vote inside a document we serialize whole,
+// and a poll that travels would otherwise grow a list of everyone who took
+// part. The hash is stable, which is all a duplicate check needs.
+export function voterKey(actor) {
+  return crypto.createHash('sha256').update(String(actor)).digest('hex').slice(0, 16);
+}
+
+/**
+ * Does this note have the shape of a vote? A name, and no content: that is the
+ * whole convention. Anything carrying prose is a reply somebody wrote, and
+ * swallowing it into a tally would lose it.
+ */
+export function isVoteShape(note) {
+  if (!note?.name || typeof note.name !== 'string') return false;
+  const text = String(note.content ?? '').replace(/<[^>]*>/gu, '').trim();
+  return text === '';
+}
+
+/** Which option is this the name of? -1 when it names none of them. */
+export function optionIndex(poll, name) {
+  const opts = poll?.options || [];
+  return opts.findIndex(o => o.title === String(name));
+}
+
+/** Closed outright, or past its end time. */
+export function pollClosed(poll, now = Date.now()) {
+  if (!poll) return false;
+  if (poll.closed) return true;
+  return !!poll.expiresAt && Date.parse(poll.expiresAt) <= now;
+}
+
+/**
+ * Record one choice. Returns the roster to store and whether anything changed
+ * — an unchanged roster must not cost a rewrite of the Question, which is the
+ * one expense a busy poll can run up on the pod.
+ *
+ * A single-choice poll takes the first answer and ignores the rest, which is
+ * how a voter changing their mind is refused rather than counted twice. A
+ * multiple-choice poll unions the answers, because each choice arrives as its
+ * own reply.
+ */
+export function addVote(roster, key, index, { multiple = false } = {}) {
+  const had = roster[key] || [];
+  if (had.length && !multiple) return { roster, changed: false };
+  if (had.includes(index)) return { roster, changed: false };
+  return { roster: { ...roster, [key]: [...had, index] }, changed: true };
+}
+
+/**
+ * The counts, derived. `votes` is answers given, `voters` is people who gave
+ * them — the same number until a poll takes several answers each.
+ */
+export function tallyOf(roster, optionCount) {
+  const counts = new Array(optionCount).fill(0);
+  let voters = 0;
+  for (const picks of Object.values(roster || {})) {
+    let counted = false;
+    for (const i of picks) {
+      if (i >= 0 && i < optionCount) { counts[i]++; counted = true; }
+    }
+    if (counted) voters++;
+  }
+  return { counts, voters, votes: counts.reduce((n, c) => n + c, 0) };
+}
+
+/** The poll record with its counts brought up to date from the roster. */
+export function withTally(poll, roster) {
+  const opts = poll?.options || [];
+  const { counts, voters } = tallyOf(roster, opts.length);
+  return {
+    ...poll,
+    options: opts.map((o, i) => ({ ...o, votes: counts[i] })),
+    votersCount: voters,
+  };
+}

package/lib/publisher.mjs

@@ -7,6 +7,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import * as wire from './wire.mjs';
+import * as polls from './polls.mjs';
 import { USER_AGENT } from './ua.mjs';
 import { HTTP_TIMEOUT_MS } from './safefetch.mjs';
 
@@ -16,6 +17,11 @@ const ACCEPT_AP = 'application/activity+json, application/ld+json; profile="http
 // still gets everything, so a missed call site degrades to the old cost rather
 // than silently publishing nothing.
 const REBUILD_MAX_PER_RUN = 200;
+// How long a poll gathers votes before its Question is rewritten. Every vote
+// changes a number other servers re-read, and rewriting per vote would make a
+// busy poll a steady write stream against the pod. A burst costs one rewrite
+// and one Update instead.
+const POLL_REWRITE_MS = 10_000;
 const ALL_COLLECTIONS = { followers: true, following: true, outbox: true, acls: true,
   pending: true, blocked: true };
 const AGENT_VERSION = JSON.parse(fs.readFileSync(
@@ -23,7 +29,7 @@ const AGENT_VERSION = JSON.parse(fs.readFileSync(
 
 export class Publisher {
   constructor({ config, remote, local, store, deliverer, publicKeyPem, assertionKey = null, log = console.log,
-    probeFetch = null, resolveMention = null, privateOnPod = true,
+    probeFetch = null, resolveMention = null, privateOnPod = true, clientOrigin = null,
   }) {
     this.config = config;
     this.remote = remote;
@@ -32,6 +38,10 @@ export class Publisher {
     this.deliverer = deliverer;
     this.publicKeyPem = publicKeyPem;
     this.assertionKey = assertionKey;      // Ed25519 public half, multibase; null = no proofs
+    // Where this identity's client surface answers, when that is an address a
+    // stranger can reach. Null on a laptop, where the surface is on loopback
+    // and advertising it to the world would name somewhere nobody can go.
+    this.clientOrigin = clientOrigin;
     // A fronted identity (config.gateway.frontActor) advertises its ids on a
     // shared domain; the map tells RemotePod where each writes on the pod.
     const publicBase = config.gateway?.frontActor
@@ -44,6 +54,8 @@ export class Publisher {
     this.probeFetch = probeFetch || ((u, i) => this.remote.probe(u, i));
     this.resolveMention = resolveMention;
     this.privateOnPod = privateOnPod;
+    // Per-poll rewrite windows, keyed by question id. See POLL_REWRITE_MS.
+    this.pollTimers = new Map();
     this.log = log;
   }
 
@@ -88,6 +100,13 @@ export class Publisher {
       pendingFollowing: priv ? urls.pendingFollowing : null,
       blocked: priv ? urls.blocked : null,
       inbox: gwActive ? gw.url : null,
+      // The agent's own outbox endpoint, where it is reachable: a client
+      // following the actor must arrive somewhere that will take a write.
+      outbox: this.clientOrigin ? `${this.clientOrigin}ap/outbox` : null,
+      // How a client-to-server client finds the way in with nothing configured
+      // by hand. Advertised only where the surface is publicly reachable.
+      oauthAuthorize: this.clientOrigin ? `${this.clientOrigin}oauth/authorize` : null,
+      oauthToken: this.clientOrigin ? `${this.clientOrigin}oauth/token` : null,
     });
     const surface = crypto.createHash('sha256').update(JSON.stringify({
       actor: actorDoc, handle: this.config.handle, host,
@@ -872,20 +891,13 @@ export class Publisher {
   }
 
   // Compose → wire note on remote pod + RDF truth locally + deliver Create.
-  async publishNote(content, { inReplyTo, attachments, visibility = 'public', spoilerText = null } = {}) {
-    const { urls } = this;
-    const priv = visibility === 'private' || visibility === 'direct';
-    if (priv) {
-      const ready = await this.privateReady();
-      if (ready !== true) throw new Error(ready);
-    }
-    const published = new Date().toISOString();
-    const slug = published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
-    // A mention nobody can resolve stays plain text rather than failing the post.
-    // The reply's own text decides who is mentioned: trim a handle out and that
-    // person is not notified, which is what every fediverse client leads people
-    // to expect. A Group named in the parent is the one thing carried forward
-    // regardless — drop it and the group stops carrying the thread.
+  // Who this text mentions, resolved. A mention nobody can resolve stays plain
+  // text rather than failing the post. The text itself decides: trim a handle
+  // out and that person is not notified, which is what every fediverse client
+  // leads people to expect. A Group named in the parent is the one thing
+  // carried forward regardless — drop it and the group stops carrying the
+  // thread.
+  async _mentionsFor(content, inReplyTo) {
     const inText = new Set(wire.mentionsIn(content));
     const carried = inReplyTo
       ? (this.store.getStatuses().find(s => s.noteId === inReplyTo)?.mentions || [])
@@ -899,6 +911,19 @@ export class Publisher {
       if (!inText.has(handle) && doc.type !== 'Group') continue;   // author trimmed them out
       mentions.push({ handle, actor: doc.id, page: doc.url || null, inbox: doc.endpoints?.sharedInbox || doc.inbox });
     }
+    return mentions;
+  }
+
+  async publishNote(content, { inReplyTo, attachments, visibility = 'public', spoilerText = null } = {}) {
+    const { urls } = this;
+    const priv = visibility === 'private' || visibility === 'direct';
+    if (priv) {
+      const ready = await this.privateReady();
+      if (ready !== true) throw new Error(ready);
+    }
+    const published = new Date().toISOString();
+    const slug = published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
+    const mentions = await this._mentionsFor(content, inReplyTo);
     const note = wire.noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions,
       visibility, summary: spoilerText, container: priv ? urls.privateNotes : urls.notes });
 
@@ -951,6 +976,232 @@ export class Publisher {
     return note;
   }
 
+  // --- polls ---------------------------------------------------------------
+  //
+  // A poll is published as a Question and answered by ordinary replies naming
+  // an option, so the count is ours to keep and ours to republish. The roster
+  // of who chose what lives in agent state (polls.VOTES_DOC); the tallies on
+  // the status row and in the pod document are always derived from it.
+
+  /**
+   * Publish a poll. `options` is a list of choice titles, `multiple` lets a
+   * voter pick more than one, and `expiresAt` is when voting stops.
+   */
+  async publishQuestion(content, { options = [], multiple = false, expiresAt = null,
+    inReplyTo = undefined, visibility = 'public', spoilerText = null } = {}) {
+    const { urls } = this;
+    const priv = visibility === 'private' || visibility === 'direct';
+    if (priv) {
+      const ready = await this.privateReady();
+      if (ready !== true) throw new Error(ready);
+    }
+    const titles = [].concat(options).map(o => String(o ?? '').trim()).filter(Boolean);
+    if (titles.length < 2) throw new Error('a poll needs at least two options');
+    // Options are matched BY NAME when a vote arrives — that is the whole of
+    // the convention — so two options reading the same are one option that
+    // cannot be told apart.
+    if (new Set(titles).size !== titles.length) throw new Error('a poll’s options must differ from one another');
+    // Bounded here as well as at the client API, because the outbox is a
+    // second way in and an unbounded poll is a document a stranger sizes.
+    if (titles.length > polls.MAX_OPTIONS) throw new Error(`a poll takes at most ${polls.MAX_OPTIONS} options`);
+    if (titles.some(t => t.length > polls.MAX_OPTION_CHARS)) {
+      throw new Error(`a poll option is at most ${polls.MAX_OPTION_CHARS} characters`);
+    }
+    if (expiresAt) {
+      const ends = Date.parse(expiresAt);
+      if (!Number.isFinite(ends)) throw new Error('the closing time is not a date');
+      const seconds = (ends - Date.now()) / 1000;
+      if (seconds < polls.MIN_SECONDS || seconds > polls.MAX_SECONDS) {
+        throw new Error(`a poll runs between ${polls.MIN_SECONDS} and ${polls.MAX_SECONDS} seconds`);
+      }
+    }
+
+    const published = new Date().toISOString();
+    const slug = published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
+    const mentions = await this._mentionsFor(content, inReplyTo);
+    const poll = {
+      multiple: !!multiple,
+      expiresAt: expiresAt || null,
+      closed: null,
+      options: titles.map(title => ({ title, votes: 0 })),
+      votersCount: 0,
+      // Resolved once, here: a tally rewrite must not cost a webfinger lookup
+      // per vote for people the poll named.
+      mentionInboxes: [...new Set(mentions.map(m => m.inbox).filter(Boolean))],
+    };
+    const question = wire.questionDoc({
+      urls, slug, content, published, inReplyTo, attachments: [], mentions,
+      visibility, summary: spoilerText,
+      container: priv ? urls.privateNotes : urls.notes,
+      options: poll.options, multiple: poll.multiple, endTime: poll.expiresAt, votersCount: 0,
+    });
+
+    await this.remote.putJson(question.id, question);
+    // Empty, but present: a dangling `replies` that 404s is worse than none.
+    await this.remote.putJson(wire.repliesId(question.id), wire.collection(wire.repliesId(question.id), []));
+    if (!priv) await this.recordOutbox(question.id);
+    await this.local.writeNote('posts', slug, {
+      noteId: question.id, actor: urls.actor, published, content: question.content,
+      inReplyTo, attachments: [],
+    });
+    this.store.addStatus({
+      noteId: question.id, actor: urls.actor, content: question.content, published,
+      kind: 'post', slug, text: content, visibility, poll, inReplyTo,
+      ...(spoilerText ? { spoiler: spoilerText } : {}),
+      ...(question.tag?.length ? { mentions: question.tag.map(t => ({ href: t.href, name: t.name })) } : {}),
+    });
+
+    const create = this._pollActivity('Create', question, wire.createActivityId(question.id));
+    await this.remote.putJson(create.id, create);
+    const contacts = this.store.getContacts();
+    const inboxes = [...new Set([
+      ...(visibility === 'direct' ? [] : contacts.followers.map(f => f.sharedInbox || f.inbox)),
+      ...poll.mentionInboxes,
+    ].filter(Boolean))];
+    await this.deliverer.deliverToAll(inboxes, create);
+    this.log(`poll published: ${question.id} (${titles.length} options) → ${inboxes.length} inbox(es)`);
+    return question;
+  }
+
+  // The Create or Update carrying a Question. The context is hoisted onto the
+  // activity and the embedded object keeps none: a nested @context is legal
+  // JSON-LD but not every server reads one, and votersCount is declared there.
+  _pollActivity(type, question, id) {
+    const { '@context': ctx, ...object } = question;
+    return {
+      '@context': ctx, id, type,
+      actor: this.urls.actor,
+      published: question.published,
+      to: question.to, cc: question.cc,
+      object,
+    };
+  }
+
+  /**
+   * One vote on one of OUR polls, named by the option's title. Returns true
+   * when it counted — a second answer to a single-choice poll, an option we do
+   * not offer, or a poll that has closed all count for nothing.
+   */
+  async recordVote(questionId, actor, optionName) {
+    const s = this.store.getStatuses().find(x => x.noteId === questionId);
+    if (!s?.poll || s.kind !== 'post' || s.actor !== this.urls.actor) return false;
+    if (polls.pollClosed(s.poll)) return false;
+    const index = polls.optionIndex(s.poll, optionName);
+    if (index < 0) return false;
+    const all = this.store.read(polls.VOTES_DOC, {});
+    const { roster, changed } = polls.addVote(all[questionId] || {}, polls.voterKey(actor), index,
+      { multiple: !!s.poll.multiple });
+    if (!changed) return false;
+    this.store.write(polls.VOTES_DOC, { ...all, [questionId]: roster });
+    this.store.updateStatus(questionId, { poll: polls.withTally(s.poll, roster) });
+    this._pollDirty(questionId);
+    return true;
+  }
+
+  // Open the rewrite window for a poll whose count moved. Already open is
+  // already enough: the whole point is that a burst costs one rewrite.
+  _pollDirty(questionId) {
+    if (this.pollTimers.has(questionId)) return;
+    const t = setTimeout(() => {
+      this.pollTimers.delete(questionId);
+      this.republishPoll(questionId).catch(e => this.log(`poll rewrite: ${e.message}`));
+    }, POLL_REWRITE_MS);
+    t.unref?.();
+    this.pollTimers.set(questionId, t);
+  }
+
+  /**
+   * Write the poll's current count back to the pod and tell everyone who has
+   * it. `closing` stamps it shut, which is a one-way door.
+   */
+  async republishPoll(questionId, { closing = null } = {}) {
+    const s = this.store.getStatuses().find(x => x.noteId === questionId);
+    if (!s?.poll) return null;
+    const { urls } = this;
+    const roster = this.store.read(polls.VOTES_DOC, {})[questionId] || {};
+    // A shut poll whose roster has been retired keeps the counts on its row:
+    // deriving them from an empty roster would publish a poll nobody voted in.
+    const shut = closing || s.poll.closed;
+    const counted = shut && !Object.keys(roster).length ? s.poll : polls.withTally(s.poll, roster);
+    const poll = { ...counted, ...(closing ? { closed: closing } : {}) };
+    const container = String(s.noteId).startsWith(urls.privateNotes) ? urls.privateNotes : urls.notes;
+    const slug = s.slug || String(s.noteId).slice(container.length);
+    const mentions = (s.mentions || []).map(m => ({
+      handle: String(m.name || '').replace(/^@/, ''), actor: m.href, page: null, inbox: null,
+    }));
+    const question = wire.questionDoc({
+      urls, slug, content: s.text ?? '', published: s.published, inReplyTo: s.inReplyTo,
+      attachments: [], mentions,
+      visibility: s.visibility || 'public', summary: s.spoiler || null, container,
+      options: poll.options, multiple: !!poll.multiple, endTime: poll.expiresAt,
+      closed: poll.closed, votersCount: poll.votersCount || 0,
+    });
+    await this.remote.putJson(question.id, question);
+    // The Create is overwritten too, so a group's Announce resolves to the
+    // current count rather than to the one the poll opened with.
+    await this.remote.putJson(wire.createActivityId(question.id),
+      this._pollActivity('Create', question, wire.createActivityId(question.id)));
+    this.store.updateStatus(questionId, { poll });
+
+    // Not `updated`: a changed count is not an edit, and stamping one would
+    // have every client show the poll as edited each time somebody voted.
+    //
+    // The Update is named after the STATE it carries rather than the moment it
+    // was sent. A clock only tells two rewrites apart when they fall in
+    // different milliseconds, and a receiving server that has seen an activity
+    // id drops the next one wearing it — which would quietly freeze the count.
+    // Naming the state means an id changes exactly when there is something new
+    // to say, and two sends of the same numbers are the duplicate they look
+    // like.
+    const stamp = crypto.createHash('sha256').update(JSON.stringify([
+      poll.options.map(o => o.votes || 0), poll.votersCount || 0, poll.closed || '',
+    ])).digest('hex').slice(0, 12);
+    const update = this._pollActivity('Update', question, `${question.id}#poll-${stamp}`);
+    const contacts = this.store.getContacts();
+    const inboxes = [...new Set([
+      ...(s.visibility === 'direct' ? [] : contacts.followers.map(f => f.sharedInbox || f.inbox)),
+      ...(s.poll.mentionInboxes || []),
+    ].filter(Boolean))];
+    await this.deliverer.deliverToAll(inboxes, update);
+    this.log(`poll ${closing ? 'closed' : 'count published'}: ${question.id} → ${inboxes.length} inbox(es)`);
+    return poll;
+  }
+
+  /**
+   * Shut any poll whose time is up. Called from the agent's sweep. Closing is
+   * recorded BEFORE the republish, so a failed republish cannot leave a poll
+   * open and collecting votes it has already refused.
+   */
+  async closeDuePolls(now = Date.now()) {
+    const due = this.store.getStatuses().filter(s => s.kind === 'post' && s.poll
+      && !s.poll.closed && s.poll.expiresAt && Date.parse(s.poll.expiresAt) <= now);
+    for (const s of due) {
+      const closed = new Date(Math.min(now, Date.parse(s.poll.expiresAt) || now)).toISOString();
+      clearTimeout(this.pollTimers.get(s.noteId));
+      this.pollTimers.delete(s.noteId);
+      this.store.updateStatus(s.noteId, { poll: { ...s.poll, closed } });
+      const done = await this.republishPoll(s.noteId, { closing: closed })
+        .catch(e => { this.log(`poll close ${s.noteId}: ${e.message}`); return null; });
+      // The roster only ever answered one question — has this person already
+      // voted — and a shut poll has stopped asking it. Dropping it keeps a
+      // document we serialize whole from carrying every poll's voters forever.
+      if (done) {
+        const all = this.store.read(polls.VOTES_DOC, {});
+        if (all[s.noteId]) {
+          delete all[s.noteId];
+          this.store.write(polls.VOTES_DOC, all);
+        }
+      }
+    }
+    return due.length;
+  }
+
+  /** Stop the pending rewrite windows. Called at shutdown. */
+  stopPolls() {
+    for (const t of this.pollTimers.values()) clearTimeout(t);
+    this.pollTimers.clear();
+  }
+
   // The pinned posts, as the actor's featured collection — the one document a
   // remote server reads when it shows this profile's pins.
   async publishFeatured() {

package/lib/social.mjs

@@ -317,6 +317,8 @@ export async function votePoll(agent, s, choices) {
     return { ok: false, error: 'this poll has closed' };
   }
   if (poll.voted) return { ok: false, error: 'already voted' };
+  // Your own poll is the one you are counting, not one you are answering.
+  if (s.actor === urls.actor) return { ok: false, error: 'this is your own poll' };
   const picks = [...new Set(choices)].filter(i => i >= 0 && i < opts.length);
   if (!picks.length) return { ok: false, error: 'invalid choice' };
   if (!poll.multiple && picks.length > 1) return { ok: false, error: 'this poll takes one choice' };

package/lib/storage.mjs

@@ -61,9 +61,15 @@ export class HttpStorage {
     return { notModified: false, names, etag: res.headers.get('etag') };
   }
 
-  async read(p, { etag } = {}) {
+  // `accept` is for callers reading something that is RDF but is wanted as it
+  // was written: asking turtle-first for a JSON-LD document gets turtle back,
+  // because the server is entitled to convert between two RDF syntaxes.
+  async read(p, { etag, accept } = {}) {
     const res = await this.fetchImpl(this._url(p), {
-      headers: { accept: 'text/turtle, application/json;q=0.9, */*;q=0.8', ...(etag ? { 'if-none-match': etag } : {}) },
+      headers: {
+        accept: accept || 'text/turtle, application/json;q=0.9, */*;q=0.8',
+        ...(etag ? { 'if-none-match': etag } : {}),
+      },
     });
     if (res.status === 304) return { ok: true, notModified: true, status: 304, body: null, etag };
     if (res.status >= 400) return { ok: false, notModified: false, status: res.status, body: null, etag: null };

package/lib/wire.mjs

@@ -108,7 +108,7 @@ export const assertionKeyId = (urls) => urls.actor + '#ed25519-key';
 export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null, movedTo = null, kind = 'person',
   approveJoins = false, summary = null, icon = null, image = null, fields = [],
   webId = null, aliases = [], moderators = null, pendingFollowers = null, pendingFollowing = null,
-  blocked = null, inbox = null }) {
+  blocked = null, inbox = null, outbox = null, oauthAuthorize = null, oauthToken = null }) {
   // manuallyApprovesFollowers is NOT in the base AS2 context, so it is declared
   // inline exactly as Mastodon declares it — and only when we actually use it.
   // It is what makes a client show "Request to follow" rather than "Follow" and
@@ -188,8 +188,23 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
     inbox: inbox || urls.inbox,
     // Every Mastodon actor publishes one. With a single actor per pod ours is
     // just the inbox, but its absence is the non-standard thing.
-    endpoints: { sharedInbox: inbox || urls.inbox },
-    outbox: urls.outbox,
+    //
+    // The two OAuth entries are how a client-to-server client finds its way in
+    // without being told anything by hand (ActivityPub 4.1). They appear only
+    // where this identity's client surface answers on an address a stranger
+    // can reach, which is why the caller supplies them rather than this
+    // building them from the pod URL.
+    endpoints: {
+      sharedInbox: inbox || urls.inbox,
+      ...(oauthAuthorize ? { oauthAuthorizationEndpoint: oauthAuthorize } : {}),
+      ...(oauthToken ? { oauthTokenEndpoint: oauthToken } : {}),
+    },
+    // Where a client sends what this actor writes, which the protocol says is
+    // this same address. The pod holds the collection and answers reads of it;
+    // a client-to-server write has to reach the agent, and the pod cannot take
+    // one. So where the agent is reachable it is named here, and a read of it
+    // is sent straight on to the pod's own document.
+    outbox: outbox || urls.outbox,
     // The pinned posts, as the collection other servers read when they show
     // this profile. Mastodon's term, declared the way Mastodon declares it.
     featured: urls.featured,
@@ -645,6 +660,45 @@ export function noteDoc({ urls, slug, content, published, inReplyTo, attachments
   return note;
 }
 
+// A poll is a note that asks something: the same addressing, the same
+// mentions, the same replies collection, with the choices in `oneOf` (pick
+// one) or `anyOf` (pick several). Each choice carries the count as the
+// totalItems of its own replies collection, which is where every server that
+// shows a poll reads it from.
+//
+// `endTime` is when voting stops and `closed` is the stamp saying it has —
+// both plain AS2. `votersCount` is Mastodon's: PEOPLE rather than answers,
+// which differ only once a poll takes several answers each. It is not in the
+// base context, so it is declared inline exactly as Mastodon declares it, and
+// only when we actually carry it.
+export function questionDoc({ options = [], multiple = false, endTime = null,
+  closed = null, votersCount = null, ...rest }) {
+  const note = noteDoc(rest);
+  const choices = options.map(o => ({
+    type: 'Note',
+    name: String(o.title),
+    replies: { type: 'Collection', totalItems: Number(o.votes) || 0 },
+  }));
+  const question = {
+    ...note,
+    type: 'Question',
+    [multiple ? 'anyOf' : 'oneOf']: choices,
+  };
+  if (endTime) question.endTime = endTime;
+  if (closed) question.closed = closed;
+  if (votersCount !== null && votersCount !== undefined) {
+    question['@context'] = [AS_CTX, {
+      toot: 'http://joinmastodon.org/ns#',
+      votersCount: {
+        '@id': 'toot:votersCount',
+        '@type': 'http://www.w3.org/2001/XMLSchema#nonNegativeInteger',
+      },
+    }];
+    question.votersCount = votersCount;
+  }
+  return question;
+}
+
 // The id is a document of its own, not `note.id + '#create'`. A group wraps this
 // whole activity in its Announce (FEP-1b12), and the receiver resolves it by
 // dereferencing this id — a fragment would just serve the Note back under a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",

package/run-agent.mjs

@@ -324,6 +324,7 @@ export class Agent {
     this.deliverer?.stop();
     this.tagfeed?.stop();
     clearInterval(this.schedTimer);
+    this.publisher?.stopPolls();
     this.deliverer = new Deliverer({
       store: this.store, rsaPrivate: keys.rsaPrivate, keyId: this.urls.actor + '#main-key',
       actorId: this.urls.actor, edPrivate: keys.edPrivate,
@@ -338,6 +339,10 @@ export class Agent {
       // Whether the fediverse tree is on the pod at all, so the ACL check does
       // not probe for something the default layout keeps on local disk.
       privateOnPod: !cred.privateRoot,
+      // Inside a pod server the client surface answers on the pod's own
+      // origin, so it can be advertised. Standalone it is on loopback, and
+      // naming it in a world-readable actor would send clients nowhere.
+      clientOrigin: this.embedded ? this.urls.base : null,
     });
     // Intake is constructed even for viewers — its signed fetchAP powers
     // search/deref; start() (draining) is active-only.
@@ -543,6 +548,10 @@ export class Agent {
         }).then(() => this.log(`scheduled post published (${e.id})`))
           .catch(err => this.log(`scheduled post ${e.id} failed: ${err.message} — dropped`));
       }
+      // A poll whose time is up is shut on the same sweep: it stops taking
+      // answers here, and everyone holding it is told once.
+      this.publisher.closeDuePolls()
+        .catch(err => this.log(`closing polls: ${err.message}`));
     }, 30_000);
     this.schedTimer.unref();
     // A CSV import interrupted by a restart or a handoff picks back up here.
@@ -647,6 +656,7 @@ export class Agent {
     this.deliverer?.stop();
     this.importer?.stop();
     clearInterval(this.schedTimer);
+    this.publisher?.stopPolls();
     // The lease too: standing down means standing down. Left renewing, a viewer
     // keeps writing to the pod on the active agent's behalf and can win the
     // lease back on a conditional PUT it had no business making.