npm - fedipod - Versions diffs - 1.10.0 → 1.26.1 - Mend

fedipod 1.10.0 → 1.26.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7899) hide show

package/web/app/dist/sw.js CHANGED Viewed

@@ -157,6 +157,116 @@ var init_urls = __esm({
   }
 });
+// lib/core/profile-page.mjs
+function profilePageHtml({
+  name,
+  address,
+  summary = null,
+  icon = null,
+  image = null,
+  fields = [],
+  joined = null,
+  pinned = [],
+  kind = "person"
+}) {
+  const esc = (s) => String(s ?? "").replace(/[&<>"]/g, (c) => ({ ...HTML_ESCAPES, '"': "&quot;" })[c]);
+  const what = kind === "group" ? "a group" : "an account";
+  const month = (iso) => {
+    const d = new Date(iso);
+    return Number.isNaN(d.getTime()) ? null : d.toLocaleDateString("en", { month: "long", year: "numeric", timeZone: "UTC" });
+  };
+  const day = (iso) => {
+    const d = new Date(iso);
+    return Number.isNaN(d.getTime()) ? "" : d.toISOString().slice(0, 10);
+  };
+  const fieldRows = fields.filter((f) => f?.name && f?.value !== void 0 && f?.value !== null && String(f.value) !== "");
+  const joinedText = joined ? month(joined) : null;
+  const pins = pinned.filter((x) => x && typeof x.content === "string");
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${esc(name)} (${esc(address)})</title>
+<style>
+:root { color-scheme: light dark; }
+body { font: 112.5%/1.5 system-ui, sans-serif; max-width: 34rem; margin: 3rem auto; padding: 0 1rem; }
+img.header { width: 100%; max-height: 12rem; object-fit: cover; border-radius: 1rem; }
+img.avatar { width: 6rem; height: 6rem; border-radius: 1rem; object-fit: cover; margin-top: 1rem; }
+h1 { margin: .5rem 0 0; }
+.address { font-size: 1.1rem; user-select: all; }
+dl.fields { display: grid; grid-template-columns: max-content 1fr; gap: .4rem 1rem; margin: 1.5rem 0; }
+dl.fields dt { font-weight: 600; }
+dl.fields dd { margin: 0; overflow-wrap: anywhere; }
+.joined { margin: 1rem 0; }
+section.pinned h2 { font-size: 1.1rem; margin: 2rem 0 .5rem; }
+article.pin { border: 1px solid #8884; border-radius: 1rem; padding: 1rem 1.2rem; margin: 1rem 0; }
+article.pin p:last-child { margin-bottom: 0; }
+article.pin .when { font-size: 1rem; }
+form { margin-top: 2rem; }
+label { display: block; margin-bottom: .3rem; }
+input { font: inherit; padding: .5rem; width: 14rem; max-width: 100%; }
+button { font: inherit; padding: .5rem 1rem; }
+.hint { color: #666; font-size: 1rem; }
+.err { color: #b00020; }
+.err:empty { display: none; }
+@media (prefers-color-scheme: dark) {
+  .hint { color: #aaa; }
+  .err { color: #ff8a80; }
+}
+</style>
+</head>
+<body>
+<main>
+${image ? `<img class="header" src="${esc(image)}" alt="">` : ""}
+${icon ? `<img class="avatar" src="${esc(icon)}" alt="">` : ""}
+<h1>${esc(name)}</h1>
+<p class="address">${esc(address)}</p>
+${summary ? `<div>${summary}</div>` : ""}
+${fieldRows.length ? `<dl class="fields">
+${fieldRows.map((f) => `<dt>${esc(f.name)}</dt><dd>${esc(f.value)}</dd>`).join("\n")}
+</dl>` : ""}
+${joinedText ? `<p class="joined">Joined ${esc(joinedText)}</p>` : ""}
+${pins.length ? `<section class="pinned">
+<h2>Pinned</h2>
+${pins.map((x) => `<article class="pin">
+${x.content}
+<p class="when">${x.url ? `<a href="${esc(x.url)}">${esc(day(x.published))}</a>` : esc(day(x.published))}</p>
+</article>`).join("\n")}
+</section>` : ""}
+<p>This is ${what} on the Fediverse. To follow it, paste the address above
+into the search box of Mastodon or any Fediverse app \u2014 or use the form.</p>
+<form id="follow">
+  <label for="server">your server</label>
+  <input id="server" type="text" placeholder="mastodon.social" autocomplete="off"
+    required aria-describedby="follow-err">
+  <button type="submit">Follow</button>
+  <p class="err" id="follow-err" role="alert"></p>
+</form>
+<p class="hint">The form sends you to your own server's follow screen.</p>
+</main>
+<script>
+document.getElementById('follow').addEventListener('submit', (ev) => {
+  ev.preventDefault();
+  const s = document.getElementById('server').value.trim().replace(/^https?:\\/\\//, '').replace(/\\/.*$/, '');
+  const err = document.getElementById('follow-err');
+  const addr = document.querySelector('.address').textContent.trim();
+  if (!s) { err.textContent = 'Enter your server, e.g. mastodon.social'; return; }
+  err.textContent = '';
+  location.href = 'https://' + s + '/authorize_interaction?uri=' + encodeURIComponent(addr);
+});
+<\/script>
+</body>
+</html>
+`;
+}
+var HTML_ESCAPES;
+var init_profile_page = __esm({
+  "lib/core/profile-page.mjs"() {
+    HTML_ESCAPES = { "&": "&amp;", "<": "&lt;", ">": "&gt;" };
+  }
+});
 // node_modules/entities/dist/decode-codepoint.js
 function replaceCodePoint(codePoint) {
   if (codePoint >= 55296 && codePoint <= 57343 || codePoint > 1114111) {
@@ -9592,7 +9702,9 @@ __export(wire_exports, {
   HASHTAG_RE: () => HASHTAG_RE,
   MENTION_RE: () => MENTION_RE,
   OUTBOX_PAGE_SIZE: () => OUTBOX_PAGE_SIZE,
+  POLICY_CTX: () => POLICY_CTX,
   PUBLIC: () => PUBLIC,
+  QUOTE_CTX: () => QUOTE_CTX,
   SEC_CTX: () => SEC_CTX,
   acceptActivity: () => acceptActivity,
   actorDoc: () => actorDoc,
@@ -9640,6 +9752,7 @@ __export(wire_exports, {
   profilePageHtml: () => profilePageHtml,
   publicHandle: () => publicHandle,
   questionDoc: () => questionDoc,
+  quotePolicy: () => quotePolicy,
   rejectActivity: () => rejectActivity,
   repliesId: () => repliesId,
   sanitizeHtml: () => sanitizeHtml,
@@ -9728,7 +9841,9 @@ function actorDoc({
   return {
     "@context": context,
     id: urls.actor,
-    type: kind === "group" ? "Group" : "Person",
+    // A group is a community; an application is a service that speaks for a
+    // site rather than a person — the actor a forum publishes for itself.
+    type: kind === "group" ? "Group" : kind === "application" ? "Application" : "Person",
     ...approveJoins ? { manuallyApprovesFollowers: true } : {},
     ...assertionKey ? { assertionMethod: [{
       id: assertionKeyId(urls),
@@ -9753,8 +9868,8 @@ function actorDoc({
     ...fields.length ? {
       attachment: fields.map((f) => ({
         type: "PropertyValue",
-        name: String(f.name).replace(/[&<>]/g, (c) => HTML_ESCAPES[c]),
-        value: String(f.value).replace(/[&<>]/g, (c) => HTML_ESCAPES[c])
+        name: String(f.name).replace(/[&<>]/g, (c) => HTML_ESCAPES2[c]),
+        value: String(f.value).replace(/[&<>]/g, (c) => HTML_ESCAPES2[c])
       }))
     } : {},
     // The human page. Remote servers send profile clicks here, so it must be
@@ -9797,66 +9912,6 @@ function actorDoc({
     publicKey: { id: urls.actor + "#main-key", owner: urls.actor, publicKeyPem }
   };
 }
-function profilePageHtml({ name, address, summary = null, icon = null, kind = "person" }) {
-  const esc = (s) => String(s ?? "").replace(/[&<>"]/g, (c) => ({ ...HTML_ESCAPES, '"': "&quot;" })[c]);
-  const what = kind === "group" ? "a group" : "an account";
-  return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${esc(name)} (${esc(address)})</title>
-<style>
-:root { color-scheme: light dark; }
-body { font: 112.5%/1.5 system-ui, sans-serif; max-width: 34rem; margin: 3rem auto; padding: 0 1rem; }
-img.avatar { width: 6rem; height: 6rem; border-radius: 1rem; object-fit: cover; }
-h1 { margin: .5rem 0 0; }
-.address { font-size: 1.1rem; user-select: all; }
-form { margin-top: 2rem; }
-label { display: block; margin-bottom: .3rem; }
-input { font: inherit; padding: .5rem; width: 14rem; max-width: 100%; }
-button { font: inherit; padding: .5rem 1rem; }
-.hint { color: #777; font-size: .9rem; }
-.err { color: #b00020; }
-.err:empty { display: none; }
-@media (prefers-color-scheme: dark) {
-  .hint { color: #aaa; }
-  .err { color: #ff8a80; }
-}
-</style>
-</head>
-<body>
-<main>
-${icon ? `<img class="avatar" src="${esc(icon)}" alt="">` : ""}
-<h1>${esc(name)}</h1>
-<p class="address">${esc(address)}</p>
-${summary ? `<div>${summary}</div>` : ""}
-<p>This is ${what} on the Fediverse. To follow it, paste the address above
-into the search box of Mastodon or any Fediverse app \u2014 or use the form.</p>
-<form id="follow">
-  <label for="server">your server</label>
-  <input id="server" type="text" placeholder="mastodon.social" autocomplete="off"
-    required aria-describedby="follow-err">
-  <button type="submit">Follow</button>
-  <p class="err" id="follow-err" role="alert"></p>
-</form>
-<p class="hint">The form sends you to your own server's follow screen.</p>
-</main>
-<script>
-document.getElementById('follow').addEventListener('submit', (ev) => {
-  ev.preventDefault();
-  const s = document.getElementById('server').value.trim().replace(/^https?:\\/\\//, '').replace(/\\/.*$/, '');
-  const err = document.getElementById('follow-err');
-  const addr = document.querySelector('.address').textContent.trim();
-  if (!s) { err.textContent = 'Enter your server, e.g. mastodon.social'; return; }
-  err.textContent = '';
-  location.href = 'https://' + s + '/authorize_interaction?uri=' + encodeURIComponent(addr);
-});
-<\/script>
-</body>
-</html>
-`;
-}
 function deleteActorActivity(urls, stamp) {
   return {
     "@context": AS_CTX,
@@ -10040,7 +10095,7 @@ function titledContent(note) {
   if (!title || types.includes("Note")) return html;
   const opening = html.replace(/<[^>]*>/g, " ").replace(/\s+/g, " ").trim().toLowerCase();
   if (opening.startsWith(title.toLowerCase())) return html;
-  const esc = String(title).replace(/[&<>]/g, (c) => HTML_ESCAPES[c]);
+  const esc = String(title).replace(/[&<>]/g, (c) => HTML_ESCAPES2[c]);
   return `<p><strong>${esc}</strong></p>${html}`;
 }
 function attachmentsOf(note) {
@@ -10066,18 +10121,18 @@ function tagHref(urls, name) {
   return urls.profileHtml + "?tag=" + encodeURIComponent(String(name).toLowerCase());
 }
 function contentHtml(text, mentions = [], hashtags = []) {
-  let html = String(text).replace(/[&<>]/g, (c) => HTML_ESCAPES[c]);
+  let html = String(text).replace(/[&<>]/g, (c) => HTML_ESCAPES2[c]);
   if (hashtags.length) {
     const byName = new Map(hashtags.filter((h) => h?.name && h?.href).map((h) => [h.name.toLowerCase(), h.href]));
     html = html.replace(HASHTAG_RE, (all, lead, name) => {
       const href = byName.get(name.toLowerCase());
       if (!href) return all;
-      return `${lead}<a href="${String(href).replace(/[&<>"]/g, (c) => HTML_ESCAPES[c] || "&quot;")}" class="mention hashtag" rel="tag">#<span>${name}</span></a>`;
+      return `${lead}<a href="${String(href).replace(/[&<>"]/g, (c) => HTML_ESCAPES2[c] || "&quot;")}" class="mention hashtag" rel="tag">#<span>${name}</span></a>`;
     });
   }
   for (const m of mentions) {
     if (!m?.handle || !m?.actor) continue;
-    const href = String(m.page || m.actor).replace(/[&<>"]/g, (c) => HTML_ESCAPES[c] || "&quot;");
+    const href = String(m.page || m.actor).replace(/[&<>"]/g, (c) => HTML_ESCAPES2[c] || "&quot;");
     html = html.split("@" + m.handle).join(
       `<a href="${href}" class="u-url mention">@${m.handle.split("@")[0]}</a>`
     );
@@ -10092,6 +10147,10 @@ function addressing(urls, visibility, who = []) {
     direct: { to: who, cc: [] }
   }[visibility] || { to: [PUBLIC], cc: [urls.followers, ...who] };
 }
+function quotePolicy(visibility) {
+  const open2 = visibility === "public" || visibility === "unlisted";
+  return { canQuote: { automaticApproval: open2 ? [PUBLIC] : [], manualApproval: [] } };
+}
 function noteDoc({
   urls,
   slug,
@@ -10105,7 +10164,8 @@ function noteDoc({
   sensitive = false,
   updated = null,
   container = null,
-  also = []
+  also = [],
+  quote = null
 }) {
   const id = (container || urls.notes) + slug;
   const who = mentions.map((m) => m.actor);
@@ -10113,7 +10173,7 @@ function noteDoc({
   const addressed = addressing(urls, visibility, [...who, ...extra]);
   const hashtags = hashtagsIn(content).map((name) => ({ name, href: tagHref(urls, name) }));
   const note = {
-    "@context": AS_CTX,
+    "@context": [AS_CTX, { ...POLICY_CTX, ...quote?.id ? QUOTE_CTX : {} }],
     id,
     type: "Note",
     attributedTo: urls.actor,
@@ -10121,8 +10181,15 @@ function noteDoc({
     published,
     to: addressed.to,
     cc: addressed.cc,
-    replies: repliesId(id)
+    replies: repliesId(id),
+    interactionPolicy: quotePolicy(visibility)
   };
+  if (quote?.id) {
+    note.quote = quote.id;
+    note.quoteUri = quote.id;
+    note._misskey_quote = quote.id;
+    if (quote.authorization) note.quoteAuthorization = quote.authorization;
+  }
   if (summary) note.summary = summary;
   if (summary || sensitive) note.sensitive = true;
   if (updated) note.updated = updated;
@@ -10164,7 +10231,7 @@ function questionDoc({
   if (endTime) question.endTime = endTime;
   if (closed) question.closed = closed;
   if (votersCount !== null && votersCount !== void 0) {
-    question["@context"] = [AS_CTX, {
+    question["@context"] = [...[].concat(note["@context"]), {
       toot: "http://joinmastodon.org/ns#",
       votersCount: {
         "@id": "toot:votersCount",
@@ -10259,10 +10326,10 @@ function updateActorActivity({ urls, actor, serial, published = (/* @__PURE__ */
     object
   };
 }
-function updateActivity(note, urls) {
+function updateActivity(note, urls, { serial = null } = {}) {
   return {
     "@context": AS_CTX,
-    id: note.id + "#update-" + String(note.updated || "").replace(/[^0-9TZ]/g, ""),
+    id: note.id + "#update-" + (note.updated ? String(note.updated).replace(/[^0-9TZ]/g, "") : "q" + (serial ?? Date.now())),
     type: "Update",
     actor: urls.actor,
     to: note.to,
@@ -10308,11 +10375,12 @@ function addRemoveActivity({ urls, type, object, target, serial }) {
     target
   };
 }
-var import_sanitize_html, AS_CTX, SEC_CTX, PUBLIC, DEFAULT_ROOT, assertionKeyId, OUTBOX_PAGE_SIZE, outboxPageId, outboxPageCount, outboxItemId, outboxWireItem, outboxLocalItem, FOLLOWERS_PAGE_SIZE, followersPageId, followersPageCount, ALLOWED_TAGS, ALLOWED_ATTRS, MAX_ATTACHMENTS, MAX_ATTACHMENT_URL, attachmentUrl, HTML_ESCAPES, MENTION_RE, HASHTAG_RE;
+var import_sanitize_html, AS_CTX, SEC_CTX, PUBLIC, DEFAULT_ROOT, assertionKeyId, OUTBOX_PAGE_SIZE, outboxPageId, outboxPageCount, outboxItemId, outboxWireItem, outboxLocalItem, FOLLOWERS_PAGE_SIZE, followersPageId, followersPageCount, ALLOWED_TAGS, ALLOWED_ATTRS, MAX_ATTACHMENTS, MAX_ATTACHMENT_URL, attachmentUrl, HTML_ESCAPES2, MENTION_RE, HASHTAG_RE, QUOTE_CTX, POLICY_CTX;
 var init_wire = __esm({
   "lib/core/wire.mjs"() {
     init_urls();
     init_urls();
+    init_profile_page();
     import_sanitize_html = __toESM(require_sanitize_html(), 1);
     AS_CTX = "https://www.w3.org/ns/activitystreams";
     SEC_CTX = "https://w3id.org/security/v1";
@@ -10363,9 +10431,22 @@ var init_wire = __esm({
         return null;
       }
     };
-    HTML_ESCAPES = { "&": "&amp;", "<": "&lt;", ">": "&gt;" };
+    HTML_ESCAPES2 = { "&": "&amp;", "<": "&lt;", ">": "&gt;" };
     MENTION_RE = /@([A-Za-z0-9_.-]+)@([A-Za-z0-9.-]+\.[A-Za-z]{2,}(?::\d+)?)/g;
     HASHTAG_RE = /(^|[^\/\w)])#([\p{L}\p{N}_]*[\p{L}_][\p{L}\p{N}_]*)/gu;
+    QUOTE_CTX = {
+      quote: { "@id": "https://w3id.org/fep/044f#quote", "@type": "@id" },
+      quoteUri: { "@id": "http://fedibird.com/ns#quoteUri", "@type": "@id" },
+      _misskey_quote: { "@id": "https://misskey-hub.net/ns#_misskey_quote", "@type": "@id" },
+      quoteAuthorization: { "@id": "https://w3id.org/fep/044f#quoteAuthorization", "@type": "@id" }
+    };
+    POLICY_CTX = {
+      gts: "https://gotosocial.org/ns#",
+      interactionPolicy: { "@id": "gts:interactionPolicy", "@type": "@id" },
+      canQuote: { "@id": "gts:canQuote", "@type": "@id" },
+      automaticApproval: { "@id": "gts:automaticApproval", "@type": "@id" },
+      manualApproval: { "@id": "gts:manualApproval", "@type": "@id" }
+    };
   }
 });
@@ -23558,7 +23639,7 @@ var require_constants = __commonJS({
   "node_modules/jsonld/lib/constants.js"(exports, module2) {
     "use strict";
     var RDF5 = "http://www.w3.org/1999/02/22-rdf-syntax-ns#";
-    var XSD2 = "http://www.w3.org/2001/XMLSchema#";
+    var XSD3 = "http://www.w3.org/2001/XMLSchema#";
     module2.exports = {
       // TODO: Deprecated and will be removed later. Use LINK_HEADER_CONTEXT.
       LINK_HEADER_REL: "http://www.w3.org/ns/json-ld#context",
@@ -23574,11 +23655,11 @@ var require_constants = __commonJS({
       RDF_JSON_LITERAL: RDF5 + "JSON",
       RDF_OBJECT: RDF5 + "object",
       RDF_LANGSTRING: RDF5 + "langString",
-      XSD: XSD2,
-      XSD_BOOLEAN: XSD2 + "boolean",
-      XSD_DOUBLE: XSD2 + "double",
-      XSD_INTEGER: XSD2 + "integer",
-      XSD_STRING: XSD2 + "string"
+      XSD: XSD3,
+      XSD_BOOLEAN: XSD3 + "boolean",
+      XSD_DOUBLE: XSD3 + "double",
+      XSD_INTEGER: XSD3 + "integer",
+      XSD_STRING: XSD3 + "string"
     };
   }
 });
@@ -32608,6 +32689,73 @@ var init_safefetch = __esm({
   }
 });
+// lib/core/wire-quotes.mjs
+var wire_quotes_exports = {};
+__export(wire_quotes_exports, {
+  QUOTE_TYPES_CTX: () => QUOTE_TYPES_CTX,
+  quoteAnswerActivity: () => quoteAnswerActivity,
+  quoteAuthorizationDoc: () => quoteAuthorizationDoc,
+  quoteAuthorizationId: () => quoteAuthorizationId,
+  quoteRequestActivity: () => quoteRequestActivity
+});
+function quoteRequestActivity({ urls, note, quoted, quotedActor, serial }) {
+  const { "@context": ctx, ...instrument } = note;
+  return {
+    "@context": [AS_CTX, { ...QUOTE_CTX, ...POLICY_CTX, QuoteRequest: QUOTE_TYPES_CTX.QuoteRequest }],
+    id: urls.actor + "#quote-request-" + serial,
+    type: "QuoteRequest",
+    actor: urls.actor,
+    to: [quotedActor],
+    object: quoted,
+    instrument
+  };
+}
+function quoteAuthorizationId(noteId, instrumentId) {
+  return noteId + "-quote-" + node_crypto_default.createHash("sha256").update(String(instrumentId)).digest("hex").slice(0, 16);
+}
+function quoteAuthorizationDoc({ urls, id, instrument, target }) {
+  return {
+    "@context": [AS_CTX, QUOTE_TYPES_CTX],
+    id,
+    type: "QuoteAuthorization",
+    attributedTo: urls.actor,
+    interactingObject: instrument,
+    interactionTarget: target
+  };
+}
+function quoteAnswerActivity({ urls, type, request, result = null, to, serial }) {
+  const idOf3 = (v) => typeof v === "string" ? v : v?.id;
+  return {
+    "@context": [AS_CTX, { QuoteRequest: QUOTE_TYPES_CTX.QuoteRequest }],
+    id: urls.actor + "#" + type.toLowerCase() + "-" + serial,
+    type,
+    actor: urls.actor,
+    to: [to],
+    object: {
+      id: idOf3(request),
+      type: "QuoteRequest",
+      actor: idOf3(request?.actor),
+      object: idOf3(request?.object),
+      instrument: idOf3(request?.instrument)
+    },
+    ...result ? { result } : {}
+  };
+}
+var QUOTE_TYPES_CTX;
+var init_wire_quotes = __esm({
+  "lib/core/wire-quotes.mjs"() {
+    init_node_crypto();
+    init_wire();
+    QUOTE_TYPES_CTX = {
+      QuoteRequest: "https://w3id.org/fep/044f#QuoteRequest",
+      QuoteAuthorization: "https://w3id.org/fep/044f#QuoteAuthorization",
+      gts: "https://gotosocial.org/ns#",
+      interactingObject: { "@id": "gts:interactingObject", "@type": "@id" },
+      interactionTarget: { "@id": "gts:interactionTarget", "@type": "@id" }
+    };
+  }
+});
 // web/app/shims/fedify-sig.mjs
 async function sign({ url, method = "POST", headers = {}, body }, privateKey, keyId) {
   const u = new URL(url);
@@ -34054,6 +34202,61 @@ var require_src = __commonJS({
   }
 });
+// web/app/idb-kv.mjs
+var DB = "fedipod-accounts";
+function open() {
+  return new Promise((res, rej) => {
+    const r = indexedDB.open(DB, 1);
+    r.onupgradeneeded = () => {
+      const db = r.result;
+      if (!db.objectStoreNames.contains("kv")) db.createObjectStore("kv");
+    };
+    r.onsuccess = () => res(r.result);
+    r.onerror = () => rej(r.error);
+  });
+}
+async function kvGet(key) {
+  const db = await open();
+  return new Promise((res, rej) => {
+    const rq = db.transaction("kv", "readonly").objectStore("kv").get(key);
+    rq.onsuccess = () => res(rq.result ?? null);
+    rq.onerror = () => rej(rq.error);
+  });
+}
+async function kvAll() {
+  const db = await open();
+  return new Promise((res, rej) => {
+    const out = {};
+    const cur = db.transaction("kv", "readonly").objectStore("kv").openCursor();
+    cur.onsuccess = () => {
+      const c = cur.result;
+      if (c) {
+        out[c.key] = c.value;
+        c.continue();
+      } else res(out);
+    };
+    cur.onerror = () => rej(cur.error);
+  });
+}
+async function kvPut(key, val) {
+  const db = await open();
+  return new Promise((res, rej) => {
+    const tx = db.transaction("kv", "readwrite");
+    tx.objectStore("kv").put(val, key);
+    tx.oncomplete = () => res();
+    tx.onerror = () => rej(tx.error);
+  });
+}
+async function kvDel(key) {
+  const db = await open();
+  return new Promise((res, rej) => {
+    const tx = db.transaction("kv", "readwrite");
+    tx.objectStore("kv").delete(key);
+    tx.oncomplete = () => res();
+    tx.onerror = () => rej(tx.error);
+  });
+}
 // web/app/agent.mjs
 init_wire();
@@ -55662,6 +55865,88 @@ var anno_default = {
   }
 };
+// lib/core/contexts/litepub-0.1.json
+var litepub_0_1_default = {
+  "@context": [
+    "https://www.w3.org/ns/activitystreams",
+    "https://w3id.org/security/v1",
+    {
+      Emoji: "toot:Emoji",
+      Hashtag: "as:Hashtag",
+      PropertyValue: "schema:PropertyValue",
+      atomUri: "ostatus:atomUri",
+      conversation: {
+        "@id": "ostatus:conversation",
+        "@type": "@id"
+      },
+      discoverable: "toot:discoverable",
+      manuallyApprovesFollowers: "as:manuallyApprovesFollowers",
+      capabilities: "litepub:capabilities",
+      ostatus: "http://ostatus.org#",
+      schema: "http://schema.org#",
+      toot: "http://joinmastodon.org/ns#",
+      misskey: "https://misskey-hub.net/ns#",
+      fedibird: "http://fedibird.com/ns#",
+      sharkey: "https://joinsharkey.org/ns#",
+      value: "schema:value",
+      sensitive: "as:sensitive",
+      litepub: "http://litepub.social/ns#",
+      invisible: "litepub:invisible",
+      directMessage: "litepub:directMessage",
+      listMessage: {
+        "@id": "litepub:listMessage",
+        "@type": "@id"
+      },
+      quoteUrl: "as:quoteUrl",
+      quoteUri: "fedibird:quoteUri",
+      oauthRegistrationEndpoint: {
+        "@id": "litepub:oauthRegistrationEndpoint",
+        "@type": "@id"
+      },
+      EmojiReact: "litepub:EmojiReact",
+      ChatMessage: "litepub:ChatMessage",
+      alsoKnownAs: {
+        "@id": "as:alsoKnownAs",
+        "@type": "@id"
+      },
+      vcard: "http://www.w3.org/2006/vcard/ns#",
+      formerRepresentations: "litepub:formerRepresentations",
+      contentMap: {
+        "@id": "as:content",
+        "@container": "@language"
+      },
+      featured: {
+        "@id": "toot:featured",
+        "@type": "@id"
+      },
+      backgroundUrl: {
+        "@id": "sharkey:backgroundUrl",
+        "@type": "@id"
+      }
+    }
+  ]
+};
+// lib/core/contexts/quotes.json
+var quotes_default = {
+  "@context": {
+    quote: {
+      "@id": "https://w3id.org/fep/044f#quote",
+      "@type": "@id"
+    },
+    quoteAuthorization: {
+      "@id": "https://w3id.org/fep/044f#quoteAuthorization",
+      "@type": "@id"
+    },
+    QuoteRequest: "https://w3id.org/fep/044f#QuoteRequest",
+    QuoteAuthorization: "https://w3id.org/fep/044f#QuoteAuthorization",
+    _misskey_quote: {
+      "@id": "https://misskey-hub.net/ns#_misskey_quote",
+      "@type": "@id"
+    }
+  }
+};
 // lib/core/contexts/index.mjs
 var CONTEXTS = {
   "https://www.w3.org/ns/activitystreams": activitystreams_default,
@@ -55678,7 +55963,9 @@ var CONTEXTS = {
   "https://join-lemmy.org/context.json": join_lemmy_default,
   "http://joinmastodon.org/ns": joinmastodon_default,
   "https://purl.archive.org/miscellany": miscellany_default,
-  "http://www.w3.org/ns/anno.jsonld": anno_default
+  "http://www.w3.org/ns/anno.jsonld": anno_default,
+  "http://litepub.social/ns": litepub_0_1_default,
+  "https://w3id.org/fep/044f": quotes_default
 };
 // lib/core/graphview.mjs
@@ -55715,8 +56002,10 @@ function buildTerms() {
   const terms = /* @__PURE__ */ new Map();
   const order = [AS_CTX, ...Object.keys(CONTEXTS).filter((u) => u !== AS_CTX)];
   for (const url of order) {
-    const ctx = CONTEXTS[url]?.["@context"];
-    if (!ctx || typeof ctx !== "object") continue;
+    const body = CONTEXTS[url]?.["@context"];
+    const maps = (Array.isArray(body) ? body : [body]).filter((c) => c && typeof c === "object");
+    if (!maps.length) continue;
+    const ctx = Object.assign({}, ...maps);
     const prefixes = {};
     for (const [k, v] of Object.entries(ctx)) {
       if (typeof v === "string" && /^https?:\/\//.test(v)) prefixes[k] = v;
@@ -55801,8 +56090,40 @@ function isListHead(term3, ctx) {
   if (term3.termType !== "BlankNode" && term3.termType !== "NamedNode") return false;
   return !!ctx.bySubject.get(term3.value)?.has(RDF_FIRST);
 }
+var XSD2 = "http://www.w3.org/2001/XMLSchema#";
+var NUMERIC = new Set([
+  "integer",
+  "decimal",
+  "double",
+  "float",
+  "long",
+  "int",
+  "short",
+  "byte",
+  "nonNegativeInteger",
+  "positiveInteger",
+  "nonPositiveInteger",
+  "negativeInteger",
+  "unsignedLong",
+  "unsignedInt",
+  "unsignedShort",
+  "unsignedByte"
+].map((t) => XSD2 + t));
+function fromLiteral(term3) {
+  const type = term3.datatype?.value || "";
+  if (type === `${XSD2}boolean`) {
+    if (term3.value === "true" || term3.value === "1") return true;
+    if (term3.value === "false" || term3.value === "0") return false;
+    return term3.value;
+  }
+  if (NUMERIC.has(type)) {
+    const n = Number(term3.value);
+    return Number.isFinite(n) ? n : term3.value;
+  }
+  return term3.value;
+}
 function toValue(term3, ctx, depth, path) {
-  if (term3.termType === "Literal") return term3.value;
+  if (term3.termType === "Literal") return fromLiteral(term3);
   if (isListHead(term3, ctx)) return readList(term3.value, ctx, depth, path);
   const preds = ctx.bySubject.get(term3.value);
   if (preds && preds.size) return makeView(term3.value, ctx, depth + 1, path);
@@ -55870,8 +56191,10 @@ var AS2Error = class extends Error {
     this.context = context;
   }
 };
+var LITEPUB = "http://litepub.social/ns";
+var heldKey = (url) => typeof url === "string" && /\/schemas\/litepub-0\.1\.jsonld$/u.test(url) ? LITEPUB : url;
 function contextLoader(url) {
-  const doc = CONTEXTS[url];
+  const doc = CONTEXTS[heldKey(url)];
   if (!doc) {
     return Promise.reject(new AS2Error(`context not held here: ${url}`, { context: url }));
   }
@@ -55906,7 +56229,7 @@ async function parseAS2(raw) {
 }
 function groundContext(input) {
   const ctx = input["@context"];
-  const held = (c) => typeof c === "string" ? Object.hasOwn(CONTEXTS, c) : c && typeof c === "object";
+  const held = (c) => typeof c === "string" ? Object.hasOwn(CONTEXTS, heldKey(c)) : c && typeof c === "object";
   let kept;
   if (ctx === void 0 || ctx === null) kept = [];
   else if (Array.isArray(ctx)) kept = ctx.filter(held);
@@ -55914,6 +56237,17 @@ function groundContext(input) {
   if (!kept.some((c) => c === AS_CTX)) kept.unshift(AS_CTX);
   return { ...input, "@context": kept.length === 1 ? kept[0] : kept };
 }
+function carryRemovals(input, view) {
+  if (!input || typeof input !== "object" || !view || typeof view !== "object") return view;
+  for (const [key, value] of Object.entries(input)) {
+    if (value === null) {
+      if (!(key in view)) view[key] = null;
+    } else if (key === "object" && typeof value === "object" && !Array.isArray(value) && view.object && typeof view.object === "object" && !Array.isArray(view.object)) {
+      carryRemovals(value, view.object);
+    }
+  }
+  return view;
+}
 async function readLenient(raw) {
   let input = null;
   try {
@@ -55924,12 +56258,12 @@ async function readLenient(raw) {
   const root = typeof own === "string" && /^https?:\/\//u.test(own) ? own : null;
   try {
     const { doc, graph: graph2 } = await parseAS2(raw);
-    return { doc, graph: graph2, view: graphView(graph2, { root }), degraded: null };
+    return { doc, graph: graph2, view: carryRemovals(input, graphView(graph2, { root })), degraded: null };
   } catch (e) {
     if (!input || typeof input !== "object") return { doc: null, graph: null, view: null, degraded: e.message };
     try {
       const { graph: graph2 } = await parseAS2(groundContext(input));
-      return { doc: input, graph: graph2, view: graphView(graph2, { root }), degraded: e.message };
+      return { doc: input, graph: graph2, view: carryRemovals(input, graphView(graph2, { root })), degraded: e.message };
     } catch (inner) {
       return { doc: input, graph: null, view: null, degraded: `${e.message}; grounded read also failed: ${inner.message}` };
     }
@@ -55939,6 +56273,7 @@ async function readLenient(raw) {
 // lib/core/publisher/notes.mjs
 init_node_crypto();
 init_wire();
+init_wire_quotes();
 async function ensureMediaContainer(publisher) {
   if (publisher._mediaReady) return;
   if (await exists(publisher.remote, publisher.urls.media)) {
@@ -56042,7 +56377,7 @@ function rowContent(obj) {
   const esc = (v) => String(v).replace(/[&<>"]/gu, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" })[c]);
   return `<p><a href="${esc(obj?.id || "")}">${esc(obj?.type || "object")}</a></p>`;
 }
-async function publishNote(publisher, content, { inReplyTo, attachments, visibility = "public", spoilerText = null, sensitive = false, slug: wanted = null, also = [], deliverTo = [] } = {}) {
+async function publishNote(publisher, content, { inReplyTo, attachments, visibility = "public", spoilerText = null, sensitive = false, slug: wanted = null, also = [], deliverTo = [], quote = null } = {}) {
   const { urls } = publisher;
   const priv = visibility === "private" || visibility === "direct";
   if (priv) {
@@ -56054,6 +56389,12 @@ async function publishNote(publisher, content, { inReplyTo, attachments, visibil
   const mentions = await publisher._mentionsFor(content, inReplyTo);
   if (visibility === "direct") assertDirectAddressed(content, mentions);
   const reply = await replyTarget(publisher, inReplyTo, mentions, visibility);
+  const selfQuote = quote?.id && quote.actor === urls.actor;
+  const quoted = quote?.id ? {
+    id: quote.id,
+    // Our own post: the authorization is minted here, before the note goes out.
+    authorization: selfQuote ? await grantQuote(publisher, quote.id, (priv ? urls.privateNotes : urls.notes) + slug) : null
+  } : null;
   const note = noteDoc({
     urls,
     slug,
@@ -56066,9 +56407,10 @@ async function publishNote(publisher, content, { inReplyTo, attachments, visibil
     summary: spoilerText,
     sensitive,
     container: priv ? urls.privateNotes : urls.notes,
-    also: [...also, ...reply ? [reply.actor] : []]
+    also: [...also, ...reply ? [reply.actor] : [], ...quote?.actor && !selfQuote ? [quote.actor] : []],
+    quote: quoted
   });
-  const addressedInboxes = await inboxesFor(publisher, [...also, ...deliverTo]);
+  const addressedInboxes = await inboxesFor(publisher, [...also, ...deliverTo, ...quote?.actor && !selfQuote ? [quote.actor] : []]);
   await write4(publisher.remote, note.id, note);
   await writeEmptyReplies(
     publisher.remote,
@@ -56076,6 +56418,7 @@ async function publishNote(publisher, content, { inReplyTo, attachments, visibil
     collection(repliesId(note.id), [])
   );
   if (!priv) await publisher.recordOutbox(note.id);
+  const request = quote?.id && !selfQuote ? quoteRequestActivity({ urls, note, quoted: quote.id, quotedActor: quote.actor, serial: Date.now() }) : null;
   publisher.store.addStatus({
     noteId: note.id,
     actor: urls.actor,
@@ -56089,7 +56432,13 @@ async function publishNote(publisher, content, { inReplyTo, attachments, visibil
     ...spoilerText ? { spoiler: spoilerText } : {},
     ...note.sensitive ? { sensitive: true } : {},
     ...attachments?.length ? { attachments } : {},
-    ...rowTags(note)
+    ...rowTags(note),
+    ...quote?.id ? {
+      quote: quote.id,
+      quoteState: selfQuote ? "accepted" : "pending",
+      ...quoted.authorization ? { quoteAuthorization: quoted.authorization } : {},
+      ...request ? { quoteRequest: { id: request.id, actor: quote.actor } } : {}
+    } : {}
   });
   if (await publisher.store.commit?.() === false) publisher.log(`post published but its timeline row was refused: ${note.id}`);
   const create = createActivity(note, urls);
@@ -56103,6 +56452,11 @@ async function publishNote(publisher, content, { inReplyTo, attachments, visibil
   ].filter(Boolean))];
   await publisher.deliverer.deliverToAll(inboxes, create);
   publisher.log(`note published: ${note.id} \u2192 ${inboxes.length} inbox(es)`);
+  if (request) {
+    const [inbox] = await inboxesFor(publisher, [quote.actor]);
+    if (inbox) await publisher.deliverer.deliver(inbox, request);
+    else publisher.log(`quote of ${quote.id}: no inbox found for ${quote.actor} \u2014 the quote stays pending`);
+  }
   if (visibility === "public" && publisher.atproto?.connected() && publisher.store.getConfig()?.atproto?.crossPost) {
     try {
       const mirror = await publisher.atproto.crossPost(
@@ -56211,7 +56565,8 @@ async function updateNote(publisher, s, { content, spoilerText = null, sensitive
     sensitive: sensitive ?? !!s.sensitive,
     updated,
     container,
-    also: reply ? [reply.actor] : []
+    also: reply ? [reply.actor] : [],
+    quote: rowQuote(s)
   });
   await write4(publisher.remote, note.id, note);
   await writeCreate(publisher.remote, createActivityId(note.id), createActivity(note, urls));
@@ -56236,6 +56591,71 @@ async function updateNote(publisher, s, { content, spoilerText = null, sensitive
   publisher.log(`note edited: ${note.id} \u2192 ${inboxes.length} inbox(es)`);
   return patched;
 }
+function rowQuote(s) {
+  if (!s?.quote || s.quoteState === "rejected") return null;
+  return { id: s.quote, ...s.quoteAuthorization ? { authorization: s.quoteAuthorization } : {} };
+}
+async function restateNote(publisher, s, { quote }) {
+  const { urls } = publisher;
+  const content = s.text ?? "";
+  const mentions = await publisher._mentionsFor(content, s.inReplyTo);
+  const container = String(s.noteId).startsWith(urls.privateNotes) ? urls.privateNotes : urls.notes;
+  const slug = s.slug || String(s.noteId).slice(container.length);
+  const reply = await replyTarget(publisher, s.inReplyTo, mentions, s.visibility || "public");
+  const note = noteDoc({
+    urls,
+    slug,
+    content,
+    published: s.published,
+    inReplyTo: s.inReplyTo,
+    attachments: s.attachments || [],
+    mentions,
+    visibility: s.visibility || "public",
+    summary: s.spoiler || null,
+    sensitive: !!s.sensitive,
+    updated: s.editedAt || null,
+    container,
+    also: [...reply ? [reply.actor] : [], ...s.quoteRequest?.actor ? [s.quoteRequest.actor] : []],
+    quote
+  });
+  await write4(publisher.remote, note.id, note);
+  await writeCreate(publisher.remote, createActivityId(note.id), createActivity(note, urls));
+  const update = updateActivity(note, urls, { serial: Date.now() });
+  const contacts = publisher.store.getContacts();
+  const inboxes = [...new Set([
+    ...s.visibility === "direct" ? [] : contacts.followers.map((f) => f.sharedInbox || f.inbox),
+    ...mentions.map((m) => m.inbox),
+    reply?.inbox,
+    ...await inboxesFor(publisher, s.quoteRequest?.actor ? [s.quoteRequest.actor] : [])
+  ].filter(Boolean))];
+  await publisher.deliverer.deliverToAll(inboxes, update);
+  return inboxes.length;
+}
+async function authorizeQuote(publisher, s, authorizationId) {
+  const patched = publisher.store.updateStatus(s.noteId, { quoteState: "accepted", quoteAuthorization: authorizationId });
+  const n = await restateNote(publisher, patched || s, { quote: { id: s.quote, authorization: authorizationId } });
+  publisher.log(`quote allowed by ${s.quoteRequest?.actor || "the author"}: ${s.noteId} \u2192 ${n} inbox(es)`);
+  return patched;
+}
+async function withdrawQuote(publisher, s) {
+  const patched = publisher.store.updateStatus(s.noteId, { quoteState: "rejected", quoteAuthorization: void 0 });
+  const n = await restateNote(publisher, patched || s, { quote: null });
+  publisher.log(`quote refused by ${s.quoteRequest?.actor || "the author"}: ${s.noteId} \u2192 ${n} inbox(es)`);
+  return patched;
+}
+var MAX_QUOTED_BY = 200;
+async function grantQuote(publisher, noteId, instrumentId) {
+  const { urls } = publisher;
+  const id = quoteAuthorizationId(noteId, instrumentId);
+  await write4(publisher.remote, id, quoteAuthorizationDoc({ urls, id, instrument: instrumentId, target: noteId }));
+  const s = publisher.store.getStatuses().find((x) => x.noteId === noteId);
+  if (s) {
+    const quotedBy = (s.quotedBy || []).filter((q) => q.note !== instrumentId);
+    quotedBy.unshift({ note: instrumentId, authorization: id });
+    publisher.store.updateStatus(noteId, { quotedBy: quotedBy.slice(0, MAX_QUOTED_BY) });
+  }
+  return id;
+}
 // lib/core/publisher/restore.mjs
 var ACCEPT_AP = 'application/activity+json, application/ld+json; profile="https://www.w3.org/ns/activitystreams"';
@@ -56289,11 +56709,11 @@ async function reconcileOutbox(publisher, outbox) {
     return 0;
   }
   if (!Array.isArray(published) || !published.length) return 0;
-  const idOf2 = (i) => typeof i === "string" ? i : i?.id || null;
-  const known2 = new Set(outbox.map(idOf2).filter(Boolean));
+  const idOf3 = (i) => typeof i === "string" ? i : i?.id || null;
+  const known2 = new Set(outbox.map(idOf3).filter(Boolean));
   const removed = new Set(publisher.store.read("outbox-removed.json", []).map((r) => r.id));
   const missing = published.filter((i) => {
-    const id = idOf2(i);
+    const id = idOf3(i);
     return id && !known2.has(id) && !removed.has(id);
   });
   if (!missing.length) return 0;
@@ -56732,7 +57152,16 @@ var Publisher = class {
   // Every actor document this identity publishes, from one place: the
   // profile publish and a Move both write it, and a Move that rebuilt it
   // by hand dropped the gateway inbox, the outbox door and the collections.
-  actorDocFor({ priv = false, moderators = null, inbox = null, movedTo = this.config.movedTo || null } = {}) {
+  // `clientOrigin` is overridden only by the agent serving a client its own
+  // local actor: standalone, the published document cannot name a loopback
+  // address, but a client already talking to that address can be told it.
+  actorDocFor({
+    priv = false,
+    moderators = null,
+    inbox = null,
+    movedTo = this.config.movedTo || null,
+    clientOrigin = this.clientOrigin
+  } = {}) {
     const { urls } = this;
     return actorDoc({
       urls,
@@ -56757,12 +57186,46 @@ var Publisher = class {
       // The agent's own outbox endpoint, where it is reachable: a client
       // following the actor must arrive somewhere that will take a write.
       // Otherwise the Gateway's outbox door, when one is attached.
-      outbox: this.clientOrigin ? `${this.clientOrigin}ap/outbox` : this.gatewayOutbox(),
+      outbox: clientOrigin ? `${clientOrigin}ap/outbox` : this.gatewayOutbox(),
       // How a client-to-server client finds the way in with nothing configured
       // by hand. Advertised only where the surface is publicly reachable.
-      oauthAuthorize: this.clientOrigin ? `${this.clientOrigin}oauth/authorize` : null,
-      oauthToken: this.clientOrigin ? `${this.clientOrigin}oauth/token` : null
+      oauthAuthorize: clientOrigin ? `${clientOrigin}oauth/authorize` : null,
+      oauthToken: clientOrigin ? `${clientOrigin}oauth/token` : null
+    });
+  }
+  // The human half: a page a browser can open and follow from. The actor
+  // document is for servers; this is the address you hand to a person. It
+  // shows who the account is, its fields, when it joined and what it pinned;
+  // the counts and the posts live in the collections. Written only when its
+  // content changed.
+  async publishProfilePage({ force = false } = {}) {
+    const { urls } = this;
+    const host = new URL(urls.base).host;
+    if (!this.config.createdAt) {
+      const oldest = this.store.getStatuses().filter((s) => s.kind === "post" && s.published).map((s) => s.published).sort()[0];
+      this.config.createdAt = oldest || (/* @__PURE__ */ new Date()).toISOString();
+      this.store.setConfig?.({ ...this.store.getConfig?.(), createdAt: this.config.createdAt });
+    }
+    const pinned = this.store.getStatuses().filter((s) => s.kind === "post" && s.pinned && s.visibility !== "private" && s.visibility !== "direct").sort((a, b) => String(b.published).localeCompare(String(a.published))).slice(0, 5).map((s) => ({ content: s.content, published: s.published, url: s.noteId }));
+    const frontActor = this.config.gateway?.frontActor;
+    const address = frontActor ? `@${publicHandle(this.config)}@${new URL(frontActor).host}` : webfingerHost(urls.base) ? `@${this.config.handle}@${host}` : urls.actor;
+    const html = profilePageHtml({
+      name: this.config.name || this.config.handle,
+      address,
+      summary: this.config.summary ? contentHtml(this.config.summary) : null,
+      icon: this.config.icon || null,
+      image: this.config.image || null,
+      fields: this.config.fields || [],
+      joined: this.config.createdAt,
+      pinned,
+      kind: this.config.kind
     });
+    const digest = node_crypto_default.createHash("sha256").update(html).digest("hex").slice(0, 32);
+    const seen = this.store.read("published.json", {});
+    if (!force && seen.pageDigest === digest) return false;
+    await writeProfilePage(this.remote, urls, html);
+    this.store.write("published.json", { ...this.store.read("published.json", {}), pageDigest: digest });
+    return true;
   }
   async publishProfile({ force = false } = {}) {
     const { urls } = this;
@@ -56771,7 +57234,7 @@ var Publisher = class {
     const moderators = (this.config.moderators || []).length ? urls.moderators : null;
     const gw = this.config.gateway;
     const gwActive = gw && gw.url && gw.mode && gw.mode !== "off";
-    const actorDoc2 = this.actorDocFor({ priv, moderators, inbox: gwActive ? gw.url : null });
+    const actorDoc2 = this.actorDocFor({ priv, moderators, inbox: gwActive ? gw.url : this.config.inboxUrl || null });
     const surface = node_crypto_default.createHash("sha256").update(JSON.stringify({
       actor: actorDoc2,
       handle: this.config.handle,
@@ -56780,22 +57243,25 @@ var Publisher = class {
       version: AGENT_VERSION,
       moderators: this.config.moderators || []
     })).digest("hex").slice(0, 32);
+    await this.publishProfilePage({ force });
     if (!force && this.store.read("published.json", {}).surfaceDigest === surface) {
       this.log("profile unchanged \u2014 nothing republished");
       return { unreachable: [], updated: 0, skipped: true };
     }
-    await writeWebfinger(
-      this.remote,
-      urls,
-      jrd({ handle: this.config.handle, host, actor: urls.actor, page: urls.profileHtml })
-    );
-    await writeHostMeta(this.remote, urls, hostMeta(urls.base));
-    const nodeinfoDocUrl = urls.home + "ap/nodeinfo-2.0";
-    const localPosts = this.store.getStatuses().filter((s) => s.kind === "post").length;
-    await writeNodeinfo(this.remote, urls, {
-      pointer: nodeinfoPointer(nodeinfoDocUrl),
-      doc: nodeinfoDoc({ version: AGENT_VERSION, localPosts })
-    });
+    if (!this.config.forum) {
+      await writeWebfinger(
+        this.remote,
+        urls,
+        jrd({ handle: this.config.handle, host, actor: urls.actor, page: urls.profileHtml })
+      );
+      await writeHostMeta(this.remote, urls, hostMeta(urls.base));
+      const nodeinfoDocUrl = urls.home + "ap/nodeinfo-2.0";
+      const localPosts = this.store.getStatuses().filter((s) => s.kind === "post").length;
+      await writeNodeinfo(this.remote, urls, {
+        pointer: nodeinfoPointer(nodeinfoDocUrl),
+        doc: nodeinfoDoc({ version: AGENT_VERSION, localPosts })
+      });
+    }
     const actor = actorDoc2;
     await write(this.remote, urls, actor);
     if (moderators) {
@@ -56806,14 +57272,8 @@ var Publisher = class {
       );
     }
     if (gwActive) await this.publishGatewayPolicy();
-    await writeProfilePage(this.remote, urls, profilePageHtml({
-      name: this.config.name || this.config.handle,
-      address: webfingerHost(urls.base) ? `@${this.config.handle}@${host}` : urls.actor,
-      summary: this.config.summary ? contentHtml(this.config.summary) : null,
-      icon: this.config.icon || null,
-      kind: this.config.kind
-    }));
-    try {
+    if (this.config.forum) {
+    } else try {
       const wrote = await linkInWebIdProfile(this.remote, {
         actorUrl: urls.actor,
         accountName: `@${this.config.handle}@${host}`,
@@ -56879,8 +57339,8 @@ var Publisher = class {
   async verifyPublicSurface() {
     const { urls } = this;
     const targets = [
-      ["webfinger", urls.webfinger],
-      ["host-meta", urls.base + ".well-known/host-meta"],
+      // Discovery documents are the pod's, not a forum category's (see publishProfile).
+      ...this.config.forum ? [] : [["webfinger", urls.webfinger], ["host-meta", urls.base + ".well-known/host-meta"]],
       ["actor", urls.actor],
       ["notes", urls.notes],
       ["followers", urls.followers],
@@ -57082,6 +57542,15 @@ var Publisher = class {
   publishNote(...a) {
     return publishNote(this, ...a);
   }
+  authorizeQuote(...a) {
+    return authorizeQuote(this, ...a);
+  }
+  withdrawQuote(...a) {
+    return withdrawQuote(this, ...a);
+  }
+  grantQuote(...a) {
+    return grantQuote(this, ...a);
+  }
   publishObject(...a) {
     return publishObject(this, ...a);
   }
@@ -57167,15 +57636,25 @@ var MAX_FORWARDS_PER_DRAIN = 20;
 var ACCEPT_AP2 = 'application/activity+json, application/ld+json; profile="https://www.w3.org/ns/activitystreams"';
 function trimActivity(a) {
   if (!a || typeof a !== "object") return a ?? null;
-  const idOf2 = (v) => typeof v === "string" ? v : v?.id ?? null;
+  const idOf3 = (v) => typeof v === "string" ? v : v?.id ?? null;
   const out = {};
   for (const k of ["id", "type", "actor", "target"]) {
-    const v = idOf2(a[k]);
+    const v = idOf3(a[k]);
     if (v) out[k] = String(v).slice(0, 2048);
   }
-  const obj = idOf2(a.object);
-  if (obj) out.object = String(obj).slice(0, 2048);
-  else if (a.object && typeof a.object === "object" && a.object.type) {
+  const obj = idOf3(a.object);
+  if (obj) {
+    const asked = a.object && typeof a.object === "object" ? a.object : null;
+    const said = {};
+    if (asked) {
+      if (typeof asked.name === "string") said.name = asked.name.slice(0, 300);
+      if ("closed" in asked) {
+        const v = asked.closed;
+        said.closed = v === "false" ? false : v === "true" ? true : typeof v === "string" ? v.slice(0, 64) : !!v;
+      }
+    }
+    out.object = Object.keys(said).length ? { id: String(obj).slice(0, 2048), ...said } : String(obj).slice(0, 2048);
+  } else if (a.object && typeof a.object === "object" && a.object.type) {
     out.object = { type: String(a.object.type).slice(0, 64) };
   }
   return out;
@@ -57227,6 +57706,40 @@ function authorOf(note, delivered = null) {
   if (!author) return null;
   return sameIdentity(note?.id, author) ? author : null;
 }
+var MAX_REACTION_CHARS = 64;
+function reactionOf(activity) {
+  if (!activity || activity.type !== "EmojiReact" && activity.type !== "Like") return null;
+  const content = typeof activity.content === "string" ? activity.content.trim() : "";
+  if (!content) return null;
+  const emoji = content.slice(0, MAX_REACTION_CHARS);
+  const bare = emoji.replace(/^:|:$/g, "");
+  const custom = emojisOf(activity).find((e) => e.shortcode === bare);
+  return { emoji, ...custom ? { url: custom.url } : {} };
+}
+var QUOTE_REL = "https://misskey-hub.net/ns#_misskey_quote";
+function quoteOf(note) {
+  const idOf3 = (v) => typeof v === "string" ? v : v?.id;
+  const named = [note?.quote, note?.quoteUri, note?._misskey_quote, note?.quoteUrl].map((v) => idOf3(Array.isArray(v) ? v[0] : v)).find(Boolean);
+  const linked = [].concat(note?.tag || []).find((t) => t?.type === "Link" && t.href && [].concat(t.rel || []).includes(QUOTE_REL))?.href;
+  const q = named || linked;
+  return q && q !== note?.id ? httpOnly(String(q).slice(0, MAX_URL_CHARS)) : null;
+}
+function quotePolicyOf(note, author) {
+  const can = note?.interactionPolicy?.canQuote;
+  if (!can || typeof can !== "object") return null;
+  const word = (v) => {
+    const id = typeof v === "string" ? v : v?.id;
+    if (!id) return null;
+    if (id === "https://www.w3.org/ns/activitystreams#Public" || id === "as:Public" || id === "Public") return "public";
+    if (author && sameIdentity(id, author)) {
+      if (/\/followers\/?$/u.test(id)) return "followers";
+      if (/\/following\/?$/u.test(id)) return "following";
+    }
+    return null;
+  };
+  const list3 = (v) => [...new Set([].concat(v || []).map(word).filter(Boolean))];
+  return { automatic: list3(can.automaticApproval), manual: list3(can.manualApproval) };
+}
 // lib/pod/links.mjs
 function linkTargets(headerValue, rel, baseUrl) {
@@ -57484,6 +57997,7 @@ async function isGone(intake, url) {
 // lib/core/intake/group.mjs
 function isModerationAsk(intake, activity) {
+  if (intake.isModerationAskExtra?.(activity)) return true;
   if (activity.type === "Block") return true;
   if (activity.type === "Undo") {
     return typeof activity.object === "object" && activity.object?.type === "Block";
@@ -57533,14 +58047,23 @@ async function amplify(intake, noteId, { approved = false, activity = null } = {
   const s = intake.store.getStatuses().find((x) => x.noteId === noteId);
   if (!s) return;
   if (s.announcedAt) return;
-  if (s.direct || s.nonPublic) {
+  if (s.direct || s.nonPublic && !intake.config.private) {
     intake.log(`not amplified \u2014 ${noteId} was not addressed publicly, and a group never widens a post's audience`);
     return;
   }
   const contacts = intake.store.getContacts();
   if (!contacts.followers.some((f) => f.actor === s.actor)) {
-    intake.log(`not amplified \u2014 ${s.actor} is not a member`);
-    return;
+    if (intake.onStranger) {
+      const held2 = await intake.onStranger({ noteId, actor: s.actor, activity }).catch(() => false);
+      if (held2) {
+        intake.log(`held for a moderator \u2014 ${s.actor} is not a member`);
+        return;
+      }
+    }
+    if (!intake.store.getContacts().followers.some((f) => f.actor === s.actor)) {
+      intake.log(`not amplified \u2014 ${s.actor} is not a member`);
+      return;
+    }
   }
   if (intake.store.getMuted().actors.includes(s.actor)) {
     intake.log(`not amplified \u2014 ${s.actor} is muted`);
@@ -57585,6 +58108,9 @@ async function amplify(intake, noteId, { approved = false, activity = null } = {
   await intake.publisher.recordOutbox(act);
   intake.store.setPending(intake.store.getPending().filter((p) => p.noteId !== noteId));
   intake.log(`amplified ${noteId} \u2192 ${inboxes.length} inbox(es)`);
+  if (intake.onCarried) {
+    await intake.onCarried({ noteId, actor: s.actor, activity: act, sent: activity }).catch((e) => intake.log(`after the carry of ${noteId}: ${e.message}`));
+  }
   await intake.bskyGroup?.mirrorCarry(s).catch((e) => intake.log(`bluesky mirror of the carry failed: ${e.message}`));
 }
 async function isCoMember(intake, actor) {
@@ -57632,6 +58158,7 @@ function announceTargets(intake, author) {
 }
 // lib/core/intake/activities.mjs
+var idOf = (v) => typeof v === "string" ? v : v?.id;
 function onAddRemove(intake, activity, actor) {
   const target = typeof activity.target === "string" ? activity.target : activity.target?.id;
   const ours = target && [intake.urls.followers, intake.urls.following, intake.urls.featured].filter(Boolean).includes(target);
@@ -57695,7 +58222,7 @@ async function onFollow(intake, activity, actor, { trusted = false } = {}) {
 }
 async function onUndo(intake, activity, actor, { trusted = false } = {}) {
   const inner = activity.object && typeof activity.object === "object" ? activity.object : null;
-  if (inner?.type === "Like" || inner?.type === "Announce") return onUndoReaction(intake, inner, actor, { trusted });
+  if (inner?.type === "Like" || inner?.type === "Announce" || inner?.type === "EmojiReact") return onUndoReaction(intake, inner, actor, { trusted });
   if (typeof activity.object === "object" && activity.object?.type && activity.object.type !== "Follow") return;
   const named = typeof activity.object === "string" ? activity.object : activity.object?.id;
   if (!named && !trusted) return;
@@ -57791,6 +58318,13 @@ async function onUndoReaction(intake, inner, actor, { trusted = false } = {}) {
   const objectId = typeof target === "string" ? target : target?.id;
   if (!objectId) return;
   if (objectId.startsWith(intake.urls.notes)) {
+    const reaction = reactionOf(inner);
+    if (reaction) {
+      const gone2 = intake.store.removeNotifications((n) => n.type === "reaction" && n.actor === actor && n.noteId === objectId && n.emoji === reaction.emoji);
+      if (gone2) intake.log(`reaction ${reaction.emoji} withdrawn by ${actor} on ${objectId}`);
+      return;
+    }
+    if (inner.type === "EmojiReact") return;
     const type = inner.type === "Like" ? "favourite" : "reblog";
     const gone = intake.store.removeNotifications((n) => n.type === type && n.actor === actor && n.noteId === objectId);
     if (gone) intake.log(`${inner.type} withdrawn by ${actor} on ${objectId}`);
@@ -57851,6 +58385,9 @@ async function onDelete(intake, activity, actor) {
   }
   const s = intake.store.getStatuses().find((x) => x.noteId === objectId);
   if (s) await intake.forget(s);
+  if (s && intake.onCarriedGone) {
+    await intake.onCarriedGone({ noteId: objectId, actor }).catch((e) => intake.log(`carried gone ${objectId}: ${e.message}`));
+  }
   intake.log(`deleted upstream: ${objectId}`);
 }
 async function onUpdate(intake, activity, actor) {
@@ -57875,10 +58412,16 @@ async function onUpdate(intake, activity, actor) {
   const attachments = attachmentsOf3(note);
   const freshPoll = pollOf(note);
   const freshEmojis = emojisOf(note);
+  const quote = quoteOf(note);
+  const quoteState = quote ? await intake.quoteStateOf(note, quote) : null;
+  const quotePolicy2 = quotePolicyOf(note, s.actor);
   intake.store.updateStatus(objectId, {
     content,
     ...attachments.length ? { attachments } : {},
     emojis: freshEmojis.length ? freshEmojis : void 0,
+    quote: quote || void 0,
+    quoteState: quoteState || void 0,
+    quotePolicy: quotePolicy2 || void 0,
     // The edit's own stamp when the note carries one; tallies and the
     // content warning follow the edit too. A poll refresh keeps our vote.
     editedAt: note.updated || (/* @__PURE__ */ new Date()).toISOString(),
@@ -57887,9 +58430,14 @@ async function onUpdate(intake, activity, actor) {
       poll: { ...freshPoll, voted: !!s.poll?.voted, ownVotes: s.poll?.ownVotes || [] }
     } : {}
   });
+  if (intake.onCarriedEdit) {
+    await intake.onCarriedEdit({ noteId: objectId, actor, note }).catch((e) => intake.log(`carried edit ${objectId}: ${e.message}`));
+  }
   intake.log(`edited upstream: ${objectId}`);
 }
 async function onReject(intake, activity, actor, { trusted = false } = {}) {
+  const asked = quoteAsked(intake, activity);
+  if (asked) return onQuoteAnswered(intake, asked, activity, actor, "Reject");
   if (activity.object?.type && activity.object.type !== "Follow") return;
   const contacts = intake.store.getContacts();
   const rec = contacts.following.find((f) => f.actor === actor);
@@ -57927,6 +58475,8 @@ async function onMove(intake, activity, actor) {
   intake.log(`${actor} moved to ${target} \u2014 follow the new account to keep seeing them`);
 }
 async function onAccept(intake, activity, actor, { trusted = false } = {}) {
+  const asked = quoteAsked(intake, activity);
+  if (asked) return onQuoteAnswered(intake, asked, activity, actor, "Accept");
   const contacts = intake.store.getContacts();
   const rec = contacts.following.find((f) => f.actor === actor);
   const named = typeof activity.object === "string" ? activity.object : activity.object?.id;
@@ -57942,6 +58492,86 @@ async function onAccept(intake, activity, actor, { trusted = false } = {}) {
     intake.log(`follow accepted by ${actor}`);
   }
 }
+function quoteAsked(intake, activity) {
+  const named = idOf(activity.object);
+  if (!named) return null;
+  return intake.store.getStatuses().find((x) => x.kind === "post" && x.quoteRequest?.id === named) || null;
+}
+async function onQuoteAnswered(intake, s, activity, actor, type) {
+  if (actor !== s.quoteRequest?.actor) {
+    intake.log(`${type} of our quote request from ${actor}, who is not ${s.quoteRequest?.actor} \u2014 ignored`);
+    return;
+  }
+  if (type === "Reject") {
+    if (s.quoteState === "rejected") return;
+    await intake.publisher.withdrawQuote(s);
+    return;
+  }
+  if (s.quoteState === "accepted") return;
+  const resultId = idOf(activity.result);
+  if (!resultId || !intake.sameIdentity(resultId, actor)) return `Accept of a quote request carries no authorization at ${actor}`;
+  const auth = await intake.fetchAP(resultId);
+  if (!auth) throw new Error(`cannot fetch quote authorization ${resultId} \u2014 will retry`);
+  const ok = auth.id === resultId && auth.type === "QuoteAuthorization" && [].concat(auth.attributedTo || []).map(idOf).includes(actor) && idOf(auth.interactingObject) === s.noteId && idOf(auth.interactionTarget) === s.quote;
+  if (!ok) return `quote authorization ${resultId} does not say ${s.noteId} may quote ${s.quote}`;
+  await intake.publisher.authorizeQuote(s, resultId);
+}
+async function onQuoteRequest(intake, activity, actor) {
+  const objectId = idOf(activity.object);
+  const instrumentId = idOf(activity.instrument);
+  if (!objectId || !instrumentId) return "QuoteRequest without object or instrument";
+  const ours = objectId.startsWith(intake.urls.notes) || intake.urls.privateNotes && objectId.startsWith(intake.urls.privateNotes);
+  if (!ours) {
+    intake.log(`QuoteRequest from ${actor} names ${objectId}, not a post of ours \u2014 ignored`);
+    return;
+  }
+  if (!intake.sameIdentity(instrumentId, actor)) return `QuoteRequest instrument/actor identity mismatch (${instrumentId})`;
+  const s = intake.store.getStatuses().find((x) => x.noteId === objectId && x.kind === "post");
+  if (!s) return `QuoteRequest for a post we do not hold (${objectId})`;
+  const note = await intake.fetchAP(instrumentId);
+  if (!note) return `quote request: instrument fetch failed (${instrumentId})`;
+  if (note.id !== instrumentId || !isContentType(note.type)) return `quote request: instrument is not verifiable content (${instrumentId})`;
+  if (authorOf(note, actor) !== actor) return `quote request: ${instrumentId} is not by ${actor}`;
+  if (quoteOf(note) !== objectId) return `quote request: ${instrumentId} does not quote ${objectId}`;
+  const doc = await intake.fetchAP(actor);
+  const inbox = doc?.endpoints?.sharedInbox || doc?.inbox;
+  if (!inbox) return `quote request: no inbox for ${actor}`;
+  const { quoteAnswerActivity: quoteAnswerActivity2 } = await Promise.resolve().then(() => (init_wire_quotes(), wire_quotes_exports));
+  const open2 = !s.visibility || s.visibility === "public" || s.visibility === "unlisted";
+  if (!open2) {
+    await intake.deliverer.deliver(
+      inbox,
+      quoteAnswerActivity2({ urls: intake.urls, type: "Reject", request: activity, to: actor, serial: intake.serial++ })
+    );
+    intake.log(`quote refused: ${instrumentId} asked to quote ${objectId}, which is not public`);
+    return;
+  }
+  const authorization = await intake.publisher.grantQuote(objectId, instrumentId);
+  await intake.deliverer.deliver(
+    inbox,
+    quoteAnswerActivity2({ urls: intake.urls, type: "Accept", request: activity, result: authorization, to: actor, serial: intake.serial++ })
+  );
+  const held = intake.store.getStatuses().find((x) => x.noteId === instrumentId);
+  if (!held) {
+    const rejected = await intake.ingestNote(instrumentId, actor, { inline: note });
+    if (rejected) intake.log(`quote of ${objectId} by ${actor}: ${rejected}`);
+  } else if (held.quoteState !== "accepted") {
+    intake.store.updateStatus(instrumentId, { quote: objectId, quoteState: "accepted" });
+  }
+  intake.store.addNotification({ type: "quote", actor, noteId: instrumentId });
+  intake.log(`quote allowed: ${instrumentId} quotes ${objectId}`);
+}
+async function quoteStateOf(intake, note, quote) {
+  if (quote.startsWith(intake.urls.notes)) {
+    const target = intake.store.getStatuses().find((x) => x.noteId === quote);
+    return (target?.quotedBy || []).some((q) => q.note === note.id) ? "accepted" : "pending";
+  }
+  const authId = idOf(note.quoteAuthorization);
+  if (!authId || !intake.sameIdentity(authId, quote)) return "pending";
+  const auth = await intake.fetchAP(authId).catch(() => null);
+  const ok = auth && auth.id === authId && auth.type === "QuoteAuthorization" && idOf(auth.interactingObject) === note.id && idOf(auth.interactionTarget) === quote;
+  return ok ? "accepted" : "pending";
+}
 // lib/core/intake/notes.mjs
 init_wire();
@@ -57951,6 +58581,8 @@ function concernsUs(intake, doc, actor) {
   if (audience.includes(intake.urls.actor) || audience.includes(intake.urls.followers)) return true;
   const tagged = [].concat(doc?.tag || []).some((t) => t?.type === "Mention" && (t.href === intake.urls.actor || t.name?.includes(intake.urls.actor)));
   if (tagged) return true;
+  const quoted = quoteOf(doc);
+  if (quoted && quoted.startsWith(intake.urls.notes)) return true;
   const inReplyTo = typeof doc?.inReplyTo === "string" ? doc.inReplyTo : doc?.inReplyTo?.id;
   if (!inReplyTo) return false;
   if (String(inReplyTo).startsWith(intake.urls.notes)) return true;
@@ -58011,6 +58643,7 @@ async function ingestNote(intake, objectId, actor, { via, inline = null } = {})
   const content = titledContent2(note);
   const author = authorOf(note, actor);
   if (!author) return `object names an author its origin does not vouch for (${objectId})`;
+  intake.recentNotes?.set(note.id, note);
   if (intake.store.isBlocked(author)) return `blocked author (${author})`;
   if (!via && !intake.concernsUs(note, author)) {
     return `the note its own server serves does not address us (${objectId})`;
@@ -58032,6 +58665,10 @@ async function ingestNote(intake, objectId, actor, { via, inline = null } = {})
   const hashtags = [].concat(note.tag || []).filter((t) => t?.type === "Hashtag" && t.name).slice(0, MAX_MENTIONS).map((t) => ({ name: String(t.name).replace(/^#/, "").slice(0, 128), url: httpOnly(String(t.href || "").slice(0, MAX_URL_CHARS)) })).filter((t) => t.name);
   const emojis = emojisOf(note);
   const poll = pollOf(note);
+  const quote = quoteOf(note);
+  const quotePolicy2 = quotePolicyOf(note, author);
+  const quoteState = quote ? await intake.quoteStateOf(note, quote) : null;
+  if (quote) await holdQuoted(intake, quote);
   const audience = [].concat(note.to || [], note.cc || []).map(String);
   const direct = audience.length > 0 && !audience.includes(PUBLIC) && !audience.some((a) => a.endsWith("/followers"));
   const nonPublic = audience.length > 0 && !audience.includes(PUBLIC);
@@ -58052,11 +58689,16 @@ async function ingestNote(intake, objectId, actor, { via, inline = null } = {})
     ...emojis.length ? { emojis } : {},
     ...mentions.length ? { mentions } : {},
     ...attachments.length ? { attachments } : {},
+    ...quote ? { quote, quoteState } : {},
+    ...quotePolicy2 ? { quotePolicy: quotePolicy2 } : {},
     ...via ? { via } : {}
   });
   const namesUs = mentions.some((m) => m.href === intake.urls.actor);
   const replyToOurs = !!note.inReplyTo && String(note.inReplyTo).startsWith(intake.urls.notes);
-  if (!followed || replyToOurs || direct || namesUs) {
+  const quotesUs = !!quote && quote.startsWith(intake.urls.notes);
+  if (quotesUs) {
+    intake.store.addNotification({ type: "quote", actor: author, noteId: note.id });
+  } else if (!followed || replyToOurs || direct || namesUs) {
     intake.store.addNotification({ type: "mention", actor: author, noteId: note.id });
   }
   if (note.inReplyTo && String(note.inReplyTo).startsWith(intake.urls.notes)) {
@@ -58064,6 +58706,39 @@ async function ingestNote(intake, objectId, actor, { via, inline = null } = {})
   }
   intake.log(`${kind}: ${note.id}${via ? ` (boosted by ${via})` : ""}`);
 }
+async function holdQuoted(intake, quoteId) {
+  if (intake.store.getStatuses().some((s) => s.noteId === quoteId)) return;
+  if (intake.store.isBlocked(quoteId)) return;
+  const q = await intake.fetchAP(quoteId).catch(() => null);
+  if (!q || q.id !== quoteId || !isContentType(q.type)) {
+    intake.log(`quoted post ${quoteId} could not be read \u2014 the quote shows without it`);
+    return;
+  }
+  const by = authorOf(q, null);
+  if (!by || intake.store.isBlocked(by)) return;
+  const { attachmentsOf: attachmentsOf3, titledContent: titledContent2 } = await Promise.resolve().then(() => (init_wire(), wire_exports));
+  const attachments = attachmentsOf3(q);
+  const emojis = emojisOf(q);
+  const poll = pollOf(q);
+  const quotePolicy2 = quotePolicyOf(q, by);
+  const mentions = [].concat(q.tag || []).filter((t) => t?.type === "Mention" && t.href && t.name).slice(0, MAX_MENTIONS).map((t) => ({ href: httpOnly(String(t.href).slice(0, MAX_URL_CHARS)), name: String(t.name).slice(0, 256) })).filter((m) => m.href);
+  intake.store.addStatus({
+    noteId: q.id,
+    actor: by,
+    content: titledContent2(q),
+    published: q.published,
+    inReplyTo: q.inReplyTo,
+    kind: "remote",
+    ...q.summary ? { spoiler: String(q.summary).replace(/<[^>]*>/g, "") } : {},
+    ...q.sensitive === true ? { sensitive: true } : {},
+    ...poll ? { poll } : {},
+    ...emojis.length ? { emojis } : {},
+    ...mentions.length ? { mentions } : {},
+    ...attachments.length ? { attachments } : {},
+    ...quotePolicy2 ? { quotePolicy: quotePolicy2 } : {}
+  });
+  intake.log(`quoted post kept: ${q.id}`);
+}
 async function forget(intake, s, { collect = null } = {}) {
   if (s.announceActivity) {
     await intake.retract(s.noteId, { collect }).catch((e) => intake.log(`retract: ${e.message}`));
@@ -63075,6 +63750,34 @@ var activitystreams_default2 = `# activitystreams.ttl \u2014 shapes for the Acti
     sh:minCount 1 ;
     sh:maxCount 1 ;
   ] .
+<#Update>
+  a sh:NodeShape ;
+  sh:targetClass as:Update ;
+  sh:name "Update" ;
+  sh:description "A change to the object it names, carrying the parts that are now different." ;
+  sh:property [
+    sh:path as:actor ;
+    sh:name "actor" ;
+    sh:description "The one that performed the activity." ;
+    sh:nodeKind sh:BlankNodeOrIRI ;
+    sh:minCount 1 ;
+    sh:maxCount 1 ;
+  ] ;
+  sh:property [
+    sh:path as:object ;
+    sh:name "object" ;
+    sh:description "The thing the activity is about." ;
+    sh:minCount 1 ;
+    sh:maxCount 1 ;
+  ] ;
+  sh:property [
+    sh:path ( as:object as:closed ) ;
+    sh:name "closed" ;
+    sh:description "The time the object stopped taking anything more." ;
+    sh:datatype xsd:dateTime ;
+    sh:maxCount 1 ;
+  ] .
 `;
 // web/app/shims/shapes-text.mjs
@@ -63103,6 +63806,18 @@ function asTerm(q) {
   };
   return rdf3.quad(term3(q.subject), term3(q.predicate), term3(q.object));
 }
+var SH_NAME = "http://www.w3.org/ns/shacl#name";
+function pathName(r) {
+  const direct = r.path?.value ?? null;
+  if (direct && /[#/]/u.test(direct)) return direct;
+  const shape = r.sourceShape;
+  if (shape) {
+    for (const q of shacl().$shapes?.dataset ?? []) {
+      if (q.subject.equals(shape) && q.predicate.value === SH_NAME) return q.object.value;
+    }
+  }
+  return direct;
+}
 async function checkShapes(quads) {
   if (!Array.isArray(quads) || quads.length === 0) return null;
   let report;
@@ -63120,7 +63835,12 @@ async function checkShapes(quads) {
     conforms: false,
     results: report.results.slice(0, 10).map((r) => ({
       focus: r.focusNode?.value ?? null,
-      path: r.path?.value ?? null,
+      // A SEQUENCE path — `( as:object as:closed )` — is an RDF list, so its
+      // node is blank and `.value` is a generated label like "n3-13". Reported
+      // as that, the record named nothing a reader could act on. The shape's
+      // own `sh:name` is what it is called, so that is used when the path
+      // cannot name itself.
+      path: pathName(r),
       message: r.message?.[0]?.value ?? String(r.sourceConstraintComponent?.value ?? "does not fit the shape"),
       shape: r.sourceShape?.value ?? null
     }))
@@ -63387,6 +64107,7 @@ var Intake = class {
     }
     this.lastDrain = (/* @__PURE__ */ new Date()).toISOString();
     this.lastDrainAtMs = Date.now();
+    if (this.afterDrain) setTimeout(() => this.afterDrain(), 0);
     this._pruneAttempts();
     let all;
     try {
@@ -63538,8 +64259,11 @@ var Intake = class {
         return this.onCreate(activity, actor, { trusted });
       case "Accept":
         return this.onAccept(activity, actor, { trusted });
+      case "QuoteRequest":
+        return this.onQuoteRequest(activity, actor, { trusted });
       case "Like":
-      case "Announce": {
+      case "Announce":
+      case "EmojiReact": {
         const wrapped = activity.object;
         if (activity.type === "Announce" && wrapped && typeof wrapped === "object" && wrapped.type === "Delete") {
           return this.onAnnouncedDelete(actor, wrapped);
@@ -63547,6 +64271,27 @@ var Intake = class {
         const inner = wrapped && typeof wrapped === "object" && (wrapped.type === "Create" || wrapped.type === "Update") ? wrapped.object : wrapped;
         const objectId = typeof inner === "string" ? inner : inner?.id;
         this.log(`${activity.type} from ${actor} on ${objectId}`);
+        const reaction = activity.type !== "Announce" ? reactionOf(activity) : null;
+        if (reaction) {
+          if (!objectId || !objectId.startsWith(this.urls.notes)) return;
+          this.store.addNotification({
+            type: "reaction",
+            actor,
+            noteId: objectId,
+            emoji: reaction.emoji,
+            ...reaction.url ? { url: reaction.url } : {},
+            ...this.known(actor) ? {} : { unverified: true }
+          });
+          if (reaction.url) {
+            const s = this.store.getStatuses().find((x) => x.noteId === objectId);
+            const shortcode = reaction.emoji.replace(/^:|:$/g, "");
+            if (s && !(s.emojis || []).some((e) => e.shortcode === shortcode) && (s.emojis || []).length < MAX_EMOJIS) {
+              this.store.updateStatus(objectId, { emojis: [...s.emojis || [], { shortcode, url: reaction.url }] });
+            }
+          }
+          return;
+        }
+        if (activity.type === "EmojiReact") return;
         if (objectId && objectId.startsWith(this.urls.notes)) {
           this.store.addNotification({
             type: activity.type === "Like" ? "favourite" : "reblog",
@@ -63572,6 +64317,9 @@ var Intake = class {
         return this.onAddRemove(activity, actor);
       case "Block":
         return this.onBlock(activity, actor, { trusted });
+      case "Flag":
+        if (this.onReport) return this.onReport(activity, actor, { trusted });
+        return;
       default:
         this.log(`ignored ${activity.type} from ${actor}`);
     }
@@ -63677,6 +64425,12 @@ var Intake = class {
   onAnnounce(...a) {
     return onAnnounce(this, ...a);
   }
+  onQuoteRequest(...a) {
+    return onQuoteRequest(this, ...a);
+  }
+  quoteStateOf(...a) {
+    return quoteStateOf(this, ...a);
+  }
   onDelete(...a) {
     return onDelete(this, ...a);
   }
@@ -64148,6 +64902,9 @@ async function pinStatus(agent2, s, pinned) {
   if (s.actor !== agent2.publisher.urls.actor) throw new Error("not your status");
   const updated = agent2.store.updateStatus(s.noteId, { pinned: !!pinned });
   await agent2.publisher.publishFeatured().catch((e) => agent2.log?.(`featured: ${e.message}`));
+  if (agent2.publisher.publishProfilePage) {
+    await agent2.publisher.publishProfilePage().catch((e) => agent2.log?.(`profile page: ${e.message}`));
+  }
   agent2.publisher.publishProfile?.().catch(() => {
   });
   return updated || s;
@@ -64157,6 +64914,7 @@ async function pinStatus(agent2, s, pinned) {
 init_wire();
 var MAX_BODY = 512 * 1024;
 var MAX_INBOX_PAGE = 500;
+var MAX_OUTBOX_PAGE = 50;
 var ACTIVITY_TYPES = /* @__PURE__ */ new Set([
   "Create",
   "Update",
@@ -64173,7 +64931,7 @@ var ACTIVITY_TYPES = /* @__PURE__ */ new Set([
   "Move"
 ]);
 var arr = (v) => v === void 0 || v === null ? [] : Array.isArray(v) ? v : [v];
-var idOf = (v) => typeof v === "string" ? v : v?.id || null;
+var idOf2 = (v) => typeof v === "string" ? v : v?.id || null;
 function readBody(req) {
   return new Promise((resolve2, reject) => {
     let size = 0;
@@ -64192,10 +64950,12 @@ function readBody(req) {
   });
 }
 var C2S = class {
-  constructor({ agent: agent2, log: log2 = console.log, auth }) {
+  constructor({ agent: agent2, log: log2 = console.log, auth, scheme = null, mount = "" }) {
     this.agent = agent2;
     this.log = log2;
     this.auth = auth;
+    this.scheme = scheme;
+    this.mount = mount;
   }
   get store() {
     return this.agent.store;
@@ -64282,6 +65042,79 @@ var C2S = class {
       orderedItems: kept.map((k) => k.activity)
     });
   }
+  // The actor a client-to-server client on this machine reads. The same
+  // document the pod holds, but for the fields naming where a write goes —
+  // the outbox and the two OAuth endpoints — and for `id`, which names this
+  // address so the client files its credential here and comes back. The pod's
+  // id stays on as an alias; the two are one identity.
+  // What this agent calls itself, to the client that just asked. The Host
+  // passed the Authorities firewall before any route ran, so whichever alias
+  // the client used is one this agent answers on. The scheme is read off the
+  // connection unless the caller named one: only the Server passes a scheme,
+  // and standalone this listener is its own TLS.
+  localOrigin(req) {
+    const host = req.headers.host;
+    if (!host) return null;
+    const scheme = this.scheme || (req.socket?.encrypted || req.headers["x-forwarded-proto"] === "https" ? "https" : "http");
+    return `${scheme}://${host}${this.mount}/`;
+  }
+  /**
+   * The owner's own outbox, from what this agent recorded. The pod holds the
+   * published copy and it stays the canonical one; this is served only where
+   * that copy cannot be read by the client asking.
+   */
+  sendLocalOutbox(res, url, origin) {
+    const id = `${origin}ap/outbox`;
+    const outbox = this.store.read("outbox.json", []);
+    const page2 = url?.searchParams?.get("page") || null;
+    const ct = { "content-type": "application/activity+json; charset=utf-8" };
+    if (!page2) {
+      return this.send(res, 200, {
+        "@context": AS_CTX,
+        id,
+        type: "OrderedCollection",
+        totalItems: outbox.length,
+        ...outbox.length ? { first: `${id}?page=1` } : { orderedItems: [] }
+      }, ct);
+    }
+    const n = Number(page2);
+    if (!Number.isInteger(n) || n < 1) {
+      return this.send(res, 400, { error: "page is a whole number from 1" });
+    }
+    const start = (n - 1) * MAX_OUTBOX_PAGE;
+    const items = outbox.slice(start, start + MAX_OUTBOX_PAGE);
+    return this.send(res, 200, {
+      "@context": AS_CTX,
+      id: `${id}?page=${n}`,
+      type: "OrderedCollectionPage",
+      partOf: id,
+      ...start + items.length < outbox.length ? { next: `${id}?page=${n + 1}` } : {},
+      // A post is recorded by its object id and published as the Create beside
+      // it — the same mapping the pod's copy uses, from the same helper.
+      orderedItems: items.map(outboxWireItem)
+    }, ct);
+  }
+  sendLocalActor(req, res, origin) {
+    const pub = this.agent.publisher;
+    const cfg = pub.config || {};
+    const gw = cfg.gateway;
+    const gwActive = gw && gw.url && gw.mode && gw.mode !== "off";
+    const doc = pub.actorDocFor({
+      inbox: gwActive ? gw.url : cfg.inboxUrl || null,
+      clientOrigin: origin
+    });
+    const canonical2 = doc.id;
+    doc.id = `${origin}ap/actor`;
+    doc.alsoKnownAs = [.../* @__PURE__ */ new Set([...doc.alsoKnownAs || [], canonical2])];
+    const body = JSON.stringify(doc);
+    res.writeHead(200, {
+      "content-type": "application/activity+json; charset=utf-8",
+      "cache-control": "no-store",
+      "content-length": Buffer.byteLength(body)
+    });
+    res.end(req.method === "HEAD" ? void 0 : body);
+    return true;
+  }
   async handle(req, res, pathname, url) {
     if (pathname !== "/ap/outbox" && pathname !== "/ap/actor" && pathname !== "/ap/inbox") return false;
     if (req.method === "OPTIONS") {
@@ -64301,6 +65134,9 @@ var C2S = class {
       return this.sendInbox(res, url);
     }
     if (req.method === "GET" || req.method === "HEAD") {
+      const local = this.agent.publisher?.clientOrigin ? null : this.localOrigin(req);
+      if (local && pathname === "/ap/actor") return this.sendLocalActor(req, res, local);
+      if (local && pathname === "/ap/outbox") return this.sendLocalOutbox(res, url, local);
       const target = pathname === "/ap/actor" ? this.urls.actor : this.urls.outbox;
       res.writeHead(303, { location: target, "cache-control": "no-store" });
       res.end();
@@ -64341,8 +65177,8 @@ var C2S = class {
   // every client means by a post with no audience chosen, and what a client
   // that never addresses (dokieli's annotations) needs.
   visibilityOf(activity, object) {
-    const to = arr(activity.to ?? object?.to).map(idOf);
-    const cc = arr(activity.cc ?? object?.cc).map(idOf);
+    const to = arr(activity.to ?? object?.to).map(idOf2);
+    const cc = arr(activity.cc ?? object?.cc).map(idOf2);
     if (!to.length && !cc.length) return "public";
     if (to.includes(PUBLIC)) return "public";
     if (cc.includes(PUBLIC)) return "unlisted";
@@ -64368,13 +65204,13 @@ var C2S = class {
   // in to/cc are listed and delivered to; the ones in bto/bcc are delivered
   // to and never listed (§6).
   addressedActors(activity, object) {
-    const pick = (...fields) => [...new Set(fields.flatMap((f) => arr(activity[f] ?? object?.[f]).map(idOf)))].filter((a) => typeof a === "string" && /^https?:\/\//u.test(a) && a !== PUBLIC && a !== this.urls.followers && a !== this.urls.actor);
+    const pick = (...fields) => [...new Set(fields.flatMap((f) => arr(activity[f] ?? object?.[f]).map(idOf2)))].filter((a) => typeof a === "string" && /^https?:\/\//u.test(a) && a !== PUBLIC && a !== this.urls.followers && a !== this.urls.actor);
     return { also: pick("to", "cc"), deliverTo: pick("bto", "bcc") };
   }
   async _dispatch(activity, { slug, raw, reply }) {
     const agent2 = this.agent;
     const object = typeof activity.object === "object" && activity.object !== null ? activity.object : null;
-    const objectId = idOf(activity.object);
+    const objectId = idOf2(activity.object);
     switch (activity.type) {
       case "Create": {
         const makes = object?.type || "Note";
@@ -64397,7 +65233,7 @@ var C2S = class {
               options: titles,
               multiple: !one.length && many.length > 0,
               expiresAt: object.endTime || null,
-              inReplyTo: idOf(object.inReplyTo) || void 0,
+              inReplyTo: idOf2(object.inReplyTo) || void 0,
               visibility,
               spoilerText: object.summary || null,
               sensitive: object.sensitive === true
@@ -64417,7 +65253,7 @@ var C2S = class {
           ...a?.name ? { description: a.name } : {}
         })).filter((a) => a.url);
         const note = await agent2.publisher.publishNote(text, {
-          inReplyTo: idOf(object.inReplyTo) || void 0,
+          inReplyTo: idOf2(object.inReplyTo) || void 0,
           attachments,
           visibility,
           spoilerText: object.summary || null,
@@ -64510,28 +65346,28 @@ var C2S = class {
       }
       case "Undo": {
         const inner = object;
-        const innerId = idOf(activity.object);
+        const innerId = idOf2(activity.object);
         if (inner?.type === "Block") {
-          const target = idOf(inner.object);
+          const target = idOf2(inner.object);
           if (!target) return reply(400, { error: "unblock whom?" });
           await unblockActor(agent2, target);
           return reply(200, { ok: true, object: target });
         }
         const statuses = this.store.getStatuses();
         let s = innerId ? statuses.find((x) => x.likeActivity?.id === innerId) : null;
-        if (!s && inner?.type === "Like") s = this.byIri(idOf(inner.object));
+        if (!s && inner?.type === "Like") s = this.byIri(idOf2(inner.object));
         if (s?.favourited) {
           const updated = await unfavourite(agent2, s);
           return reply(200, { ok: true, object: updated.noteId });
         }
         s = innerId ? statuses.find((x) => x.announceActivity?.id === innerId) : null;
-        if (!s && inner?.type === "Announce") s = this.byIri(idOf(inner.object));
+        if (!s && inner?.type === "Announce") s = this.byIri(idOf2(inner.object));
         if (s?.reblogged) {
           const updated = await unreblog(agent2, s);
           return reply(200, { ok: true, object: updated.noteId });
         }
         const following = this.store.getContacts().following;
-        const rec = following.find((f) => f.followActivity?.id === innerId) || (inner?.type === "Follow" ? following.find((f) => f.actor === idOf(inner.object)) : null);
+        const rec = following.find((f) => f.followActivity?.id === innerId) || (inner?.type === "Follow" ? following.find((f) => f.actor === idOf2(inner.object)) : null);
         if (rec) {
           await unfollowActor(agent2, rec.actor);
           return reply(200, { ok: true, object: rec.actor });
@@ -64545,7 +65381,7 @@ var C2S = class {
       }
       case "Add":
       case "Remove": {
-        if (idOf(activity.target) !== this.urls.featured) {
+        if (idOf2(activity.target) !== this.urls.featured) {
           return reply(422, { error: "the featured collection is the one Add/Remove edits here" });
         }
         const s = this.byIri(objectId);
@@ -64555,7 +65391,7 @@ var C2S = class {
       }
       case "Accept":
       case "Reject": {
-        const requester = object?.actor ? idOf(object.actor) : objectId;
+        const requester = object?.actor ? idOf2(object.actor) : objectId;
         if (!requester) return reply(400, { error: "whose request? object must name the Follow or its actor" });
         const r = activity.type === "Accept" ? await admitRequest(agent2, requester).catch((e) => ({ error: e.message })) : await refuseRequest(agent2, requester).catch((e) => ({ error: e.message }));
         if (r.error) return reply(404, { error: r.error });
@@ -64576,11 +65412,21 @@ var RENEW_MS = 9e4;
 var JITTER = () => 0.85 + Math.random() * 0.3;
 var UNREADABLE = /* @__PURE__ */ Symbol("lease-unreadable");
 var Lease = class {
-  constructor({ url, fetchImpl, log: log2 = console.log }) {
+  // `id` names the HOLDER, and acquire() lets a holder reclaim its own lease
+  // without waiting for the TTL — so whether it is stable decides whether a
+  // restart is the same agent coming back or a second one arriving. A process
+  // that is gone for good wants a new one each time; a browser does not, since
+  // its agent lives in a service worker the browser is free to kill and restart
+  // whenever it likes. Left to the default, every one of those restarts looked
+  // like another device and asked the owner to take over their own account —
+  // which is what switching between the two clients did, because that is a
+  // navigation and a navigation can take the worker with it. The browser build
+  // passes one it keeps.
+  constructor({ url, fetchImpl, log: log2 = console.log, id = null }) {
     this.url = url;
     this.fetchImpl = fetchImpl;
     this.log = log2;
-    this.id = node_crypto_default.randomUUID();
+    this.id = id || node_crypto_default.randomUUID();
     this.stopped = false;
     this.timer = null;
     this.heldUntil = 0;
@@ -64895,6 +65741,7 @@ function readBody2(req) {
       const ct = String(req.headers["content-type"] || "");
       try {
         if (ct.includes("application/json")) return resolve2(data ? JSON.parse(data) : {});
+        if (ct.includes("multipart/form-data")) return resolve2(textFields(data, ct));
         const form = new URLSearchParams(data);
         const out = {};
         for (const key of new Set(form.keys())) {
@@ -64908,6 +65755,76 @@ function readBody2(req) {
     req.on("error", reject);
   });
 }
+function textFields(data, contentType) {
+  const m = /boundary=(?:"([^"]+)"|([^;]+))/.exec(contentType);
+  if (!m) return {};
+  const out = {};
+  for (const part of data.split("--" + (m[1] || m[2]).trim())) {
+    const sep = part.indexOf("\r\n\r\n");
+    if (sep < 0) continue;
+    const head = part.slice(0, sep);
+    const name = /name="([^"]*)"/.exec(head)?.[1];
+    if (!name || /filename="/.test(head)) continue;
+    const value = part.slice(sep + 4).replace(/\r\n$/, "");
+    if (name.endsWith("[]")) (out[name] ||= []).push(value);
+    else out[name] = value;
+  }
+  return out;
+}
+function readMultipart(req, limit = 12e6) {
+  return new Promise((resolve2, reject) => {
+    const chunks = [];
+    let n = 0;
+    req.on("data", (c) => {
+      n += c.length;
+      if (n > limit) {
+        reject(new Error("upload too large"));
+        req.destroy();
+        return;
+      }
+      chunks.push(c);
+    });
+    req.on("error", reject);
+    req.on("end", () => {
+      try {
+        const m = /boundary=(?:"([^"]+)"|([^;]+))/.exec(String(req.headers["content-type"] || ""));
+        if (!m) return resolve2({ fields: {}, file: null });
+        const buf = Buffer.concat(chunks);
+        const boundary = Buffer.from("--" + (m[1] || m[2]).trim());
+        const fields = {};
+        const files = {};
+        let file = null;
+        let i = buf.indexOf(boundary);
+        while (i >= 0) {
+          const start = i + boundary.length;
+          if (buf.slice(start, start + 2).toString() === "--") break;
+          const next = buf.indexOf(boundary, start);
+          if (next < 0) break;
+          const part = buf.slice(start + 2, next - 2);
+          const sep = part.indexOf("\r\n\r\n");
+          if (sep >= 0) {
+            const head = part.slice(0, sep).toString();
+            const body = part.slice(sep + 4);
+            const name = /name="([^"]*)"/.exec(head)?.[1];
+            const filename = /filename="([^"]*)"/.exec(head)?.[1];
+            if (filename !== void 0) {
+              file = {
+                filename,
+                contentType: /content-type:\s*([^\r\n]+)/i.exec(head)?.[1]?.trim() || "application/octet-stream",
+                data: body
+              };
+              if (name) files[name] = file;
+            } else if (name) fields[name] = body.toString();
+          }
+          i = next;
+        }
+        resolve2({ fields, file, files });
+      } catch (e) {
+        reject(e);
+      }
+    });
+  });
+}
 // lib/client/masto/oauth.mjs
 var TOKEN_TTL_MS = 90 * 24 * 60 * 60 * 1e3;
@@ -65583,6 +66500,7 @@ var BskyFeed = class {
 // lib/client/masto/render.mjs
 var TRANSPARENT_PNG = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==";
+var DEFAULT_AVATAR = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAABd0lEQVR42u3ZoW4CQRDG8Xk6NBLbVCJ5gBpMTQ2iBlFR29RXNsFhz1JHXV9hydfkEkoobW5n2F34i0kIHMfN73ZvdwYbTabpmsMAAAAAAAAAAAAAAAAAAACiY3wzS/ePz+n1bZW6zTZ9fH59h17rPX2mYy4OQEktnl5+JP1b6Bgdey6IcIDb2Ty9r7s/Ez8MfUffbRpACfznrp8aDdEIFjnsh9z5YyMhcjqEAWge5ybfh87VFIDuWM7QPzYVokZBCICWM6/k+9A5mwHQmu4NoHM2A+A5/PenQTMA3sn3AQBTgIcgyyAbIbbCFEOUwzREaInRFKUtDgAAFQLcPSxDCqH9Z4V+o0oAXVhU4ofhiWCtJe+NYKV3e6V3idkAHvv9nDqhKIBnxVeqUrRaav5SvQKrqetTols0GGDdbaoB0LWcFUBP31qS72PoimCtD//caWC1tL1Ltc2ttbXfe08wCKC25HP+OgMAAAAAAAAAAAAAAAAArhNgB1PE/x/JOiuNAAAAAElFTkSuQmCC";
 var selfIcon = (api, self2, cached) => (self2 ? api.store.getConfig()?.icon : null) || cached.icon;
 function selfAccount(api) {
   return api.account(api.urls.actor, { selfAcct: publicHandle(api.store.getConfig()) });
@@ -65616,12 +66534,12 @@ function account(api, actorUrl, { selfAcct } = {}) {
     bot: false,
     discoverable: true,
     group: self2 ? api.store.getConfig()?.kind === "group" : cached.type === "Group",
-    created_at: "2026-01-01T00:00:00.000Z",
+    created_at: self2 && api.store.getConfig()?.createdAt || "2026-01-01T00:00:00.000Z",
     note: (self2 ? api.store.getConfig()?.summary : cached.summary) || "",
     url: actorUrl,
     uri: actorUrl,
-    avatar: selfIcon(api, self2, cached) || TRANSPARENT_PNG,
-    avatar_static: selfIcon(api, self2, cached) || TRANSPARENT_PNG,
+    avatar: selfIcon(api, self2, cached) || DEFAULT_AVATAR,
+    avatar_static: selfIcon(api, self2, cached) || DEFAULT_AVATAR,
     header: (self2 ? api.store.getConfig()?.image : null) || TRANSPARENT_PNG,
     header_static: (self2 ? api.store.getConfig()?.image : null) || TRANSPARENT_PNG,
     // A remote actor's counts are whatever its own collections said when we
@@ -65636,11 +66554,11 @@ function account(api, actorUrl, { selfAcct } = {}) {
     fields: (self2 ? api.store.getConfig()?.fields : cached.fields) || []
   };
 }
-function page(api, items, url, { limit = 20, max = 40, idOf: idOf2 = (s) => api.store.idFor(s.noteId) } = {}) {
+function page(api, items, url, { limit = 20, max = 40, idOf: idOf3 = (s) => api.store.idFor(s.noteId) } = {}) {
   const n = Math.min(Number(url.searchParams.get("limit")) || limit, max);
   const ids = /* @__PURE__ */ new Map();
   const idAt = (s) => {
-    if (!ids.has(s)) ids.set(s, idOf2(s));
+    if (!ids.has(s)) ids.set(s, idOf3(s));
     return ids.get(s);
   };
   const cut = (param) => {
@@ -65664,8 +66582,8 @@ function page(api, items, url, { limit = 20, max = 40, idOf: idOf2 = (s) => api.
     for (const [k, v] of Object.entries(extra)) u.searchParams.set(k, v);
     return u.href;
   };
-  const links = [`<${q({ max_id: idOf2(pageItems2[pageItems2.length - 1]) })}>; rel="next"`];
-  if (pageItems2.length) links.push(`<${q({ min_id: idOf2(pageItems2[0]) })}>; rel="prev"`);
+  const links = [`<${q({ max_id: idOf3(pageItems2[pageItems2.length - 1]) })}>; rel="next"`];
+  if (pageItems2.length) links.push(`<${q({ min_id: idOf3(pageItems2[0]) })}>; rel="prev"`);
   return { items: pageItems2, headers: { link: links.join(", ") } };
 }
 async function bskyReply(api, send, body, parent, visibility) {
@@ -65776,7 +66694,26 @@ async function acctReply(api, send, body, parent, visibility) {
     return send(422, { error: e.message });
   }
 }
-function status(api, s, { all } = {}) {
+function quoteJson(api, s, { all, depth = 0 } = {}) {
+  if (!s.quote) return null;
+  const state = s.quoteState || "pending";
+  const quoted = state !== "rejected" && (all || api.store.getStatuses()).find((x) => x.noteId === s.quote);
+  if (depth > 0) return { state, quoted_status_id: quoted ? api.store.idFor(quoted.noteId) : null };
+  return { state, quoted_status: quoted ? api.status(quoted, { all, depth: depth + 1 }) : null };
+}
+function quoteApproval(api, s) {
+  if (s.actor === api.urls?.actor) {
+    const open2 = !s.visibility || s.visibility === "public" || s.visibility === "unlisted";
+    return { automatic: open2 ? ["public"] : [], manual: [], current_user: open2 ? "automatic" : "denied" };
+  }
+  const p = s.quotePolicy;
+  if (!p) return { automatic: [], manual: [], current_user: "unknown" };
+  const follows = () => api.store.getContacts().following.some((f) => f.actor === s.actor && f.accepted);
+  const may = (list3) => list3.includes("public") || list3.includes("followers") && follows();
+  const current = may(p.automatic) ? "automatic" : may(p.manual) ? "manual" : "denied";
+  return { automatic: p.automatic, manual: p.manual, current_user: current };
+}
+function status(api, s, { all, depth = 0 } = {}) {
   const replies = (all || api.store.getStatuses()).filter((x) => x.inReplyTo === s.noteId).length;
   return {
     id: api.store.idFor(s.noteId),
@@ -65832,6 +66769,8 @@ function status(api, s, { all } = {}) {
     })),
     card: null,
     poll: s.poll ? api.pollJson(s) : null,
+    quote: quoteJson(api, s, { all, depth }),
+    quote_approval: quoteApproval(api, s),
     // What a filter matched, if any. Mastodon's clients read this and do the
     // hiding or warning; they do NOT match keywords themselves — Phanpy does
     // not — so filters that were stored and served but never applied were a
@@ -65918,7 +66857,9 @@ function pushNotify(api, n) {
     reblog: "boosted your post",
     follow: "followed you",
     "follow-request": "asked to follow you",
-    move: "moved account"
+    move: "moved account",
+    reaction: `reacted ${n.emoji || ""} to your post`,
+    quote: "quoted your post"
   };
   const s = n.noteId && api.store.getStatuses().find((x) => x.noteId === n.noteId);
   return api.push.notify(n, {
@@ -65999,10 +66940,14 @@ function relationship(api, actorUrl) {
   };
 }
 function notificationType(api, t) {
-  return t === "follow-request" ? "follow_request" : t;
+  return t === "follow-request" ? "follow_request" : t === "reaction" ? "emoji_reaction" : t;
 }
 function notification(api, n) {
   const out = { id: n.id, type: api.notificationType(n.type), created_at: n.at, account: api.account(n.actor) };
+  if (n.type === "reaction") {
+    out.emoji = n.emoji;
+    if (n.url) out.emoji_url = n.url;
+  }
   if (n.noteId) {
     const s = api.store.getStatuses().find((x) => x.noteId === n.noteId);
     if (s) out.status = api.status(s);
@@ -66047,7 +66992,6 @@ var STUBS = new Map(Object.entries({
   "/api/v1/custom_emojis": [],
   "/api/v1/announcements": [],
   "/api/v1/instance/peers": [],
-  "/api/v1/trends/tags": [],
   "/api/v1/trends/links": [],
   "/api/v2/suggestions": [],
   "/api/v1/preferences": {}
@@ -66084,14 +67028,15 @@ function instanceTitle(api) {
   const cfg = api.store.getConfig();
   return cfg?.handle ? `@${cfg.handle}@${api.host}` : "FediPod";
 }
-function tagObject(api, name, following, req) {
+function tagObject(api, name, following, req, history = []) {
   const host = req?.headers?.host || api.host;
-  return { name, url: `https://${host}/tags/${name}`, history: [], following: !!following };
+  return { name, url: `https://${host}/tags/${name}`, history, following: !!following };
 }
 function instanceBlurb(api) {
   const kind = api.store.getConfig()?.kind === "group" ? "group" : "actor";
   return `Solid pod ActivityPub ${kind}`;
 }
+var API_VERSIONS = { mastodon: 7 };
 async function handle2(api, ctx) {
   const { req, res, pathname, url, send } = ctx;
   if (pathname === "/api/v1/instance") {
@@ -66103,6 +67048,7 @@ async function handle2(api, ctx) {
       description: api.instanceBlurb(),
       email: "",
       version: "4.2.0 (compatible; fedipod)",
+      api_versions: API_VERSIONS,
       urls: su ? { streaming_api: su } : {},
       stats: { user_count: 1, status_count: api.store.countStatuses(), domain_count: 1 },
       languages: ["en"],
@@ -66120,6 +67066,7 @@ async function handle2(api, ctx) {
       domain: api.host,
       title: api.instanceTitle(),
       version: "4.2.0 (compatible; fedipod)",
+      api_versions: API_VERSIONS,
       source_url: "https://github.com/jeff-zucker/FediPod",
       description: api.instanceBlurb(),
       usage: { users: { active_month: 1 } },
@@ -66147,124 +67094,15 @@ async function handle2(api, ctx) {
 // lib/client/masto/accounts.mjs
 var accounts_exports = {};
 __export(accounts_exports, {
-  handle: () => handle4
+  handle: () => handle3
 });
 init_node_crypto();
 // lib/pod/media.mjs
 var write6 = (pod, url, bytes, contentType) => pod.put(url, bytes, contentType);
-// lib/client/masto/media.mjs
-var media_exports = {};
-__export(media_exports, {
-  attachmentType: () => attachmentType,
-  extensionFor: () => extensionFor,
-  handle: () => handle3,
-  readMultipart: () => readMultipart
-});
-init_node_crypto();
-var ATTACHMENT_KINDS = /* @__PURE__ */ new Set(["image", "video", "audio"]);
-var NEVER = /* @__PURE__ */ new Set(["image/svg+xml", "image/svg"]);
-var OPAQUE = "application/octet-stream";
-function attachmentType(claimed) {
-  const t = String(claimed || "").split(";")[0].trim().toLowerCase();
-  if (!/^[a-z0-9.+-]+\/[a-z0-9.+-]+$/.test(t) || NEVER.has(t)) return OPAQUE;
-  return ATTACHMENT_KINDS.has(t.split("/")[0]) ? t : OPAQUE;
-}
-function extensionFor(mediaType, filename = "") {
-  if (mediaType === OPAQUE) return "bin";
-  const sub = mediaType.split("/")[1].replace(/[^a-z0-9]/g, "");
-  const given = String(filename || "").includes(".") ? filename.split(".").pop().toLowerCase().replace(/[^a-z0-9]/g, "") : "";
-  return given && (given === sub || sub.startsWith(given) || given.startsWith(sub)) ? given : sub || "bin";
-}
-function readMultipart(req, limit = 12e6) {
-  return new Promise((resolve2, reject) => {
-    const chunks = [];
-    let n = 0;
-    req.on("data", (c) => {
-      n += c.length;
-      if (n > limit) {
-        reject(new Error("upload too large"));
-        req.destroy();
-        return;
-      }
-      chunks.push(c);
-    });
-    req.on("error", reject);
-    req.on("end", () => {
-      try {
-        const m = /boundary=(?:"([^"]+)"|([^;]+))/.exec(String(req.headers["content-type"] || ""));
-        if (!m) return resolve2({ fields: {}, file: null });
-        const buf = Buffer.concat(chunks);
-        const boundary = Buffer.from("--" + (m[1] || m[2]).trim());
-        const fields = {};
-        const files = {};
-        let file = null;
-        let i = buf.indexOf(boundary);
-        while (i >= 0) {
-          const start = i + boundary.length;
-          if (buf.slice(start, start + 2).toString() === "--") break;
-          const next = buf.indexOf(boundary, start);
-          if (next < 0) break;
-          const part = buf.slice(start + 2, next - 2);
-          const sep = part.indexOf("\r\n\r\n");
-          if (sep >= 0) {
-            const head = part.slice(0, sep).toString();
-            const body = part.slice(sep + 4);
-            const name = /name="([^"]*)"/.exec(head)?.[1];
-            const filename = /filename="([^"]*)"/.exec(head)?.[1];
-            if (filename !== void 0) {
-              file = {
-                filename,
-                contentType: /content-type:\s*([^\r\n]+)/i.exec(head)?.[1]?.trim() || "application/octet-stream",
-                data: body
-              };
-              if (name) files[name] = file;
-            } else if (name) fields[name] = body.toString();
-          }
-          i = next;
-        }
-        resolve2({ fields, file, files });
-      } catch (e) {
-        reject(e);
-      }
-    });
-  });
-}
-async function handle3(api, ctx) {
-  const { req, res, pathname, url, send } = ctx;
-  if ((pathname === "/api/v2/media" || pathname === "/api/v1/media") && req.method === "POST") {
-    const { fields, file } = await readMultipart(req);
-    if (!file?.data?.length) return send(422, { error: "file required" });
-    const mediaType = attachmentType(file.contentType);
-    const ext = extensionFor(mediaType, file.filename);
-    const slug = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10) + "-" + node_crypto_default.randomBytes(4).toString("hex") + "." + ext;
-    const mediaUrl = api.urls.media + slug;
-    await api.agent.publisher.ensureMediaContainer();
-    await write6(api.agent.remote, mediaUrl, file.data, mediaType);
-    const entry = { url: mediaUrl, mediaType, description: fields.description || "" };
-    const id = api.store.idFor(mediaUrl);
-    api.store.setMedia(id, entry);
-    return send(200, api.mediaJson({ id, ...entry }));
-  }
-  const mMedia = /^\/api\/v1\/media\/([a-f0-9]+)$/.exec(pathname);
-  if (mMedia) {
-    const entry = api.store.getMedia()[mMedia[1]];
-    if (!entry) return send(404, { error: "Record not found" });
-    if (req.method === "PUT") {
-      const body = await readBody2(req);
-      if (typeof body.description === "string") {
-        entry.description = body.description;
-        api.store.setMedia(mMedia[1], entry);
-      }
-    }
-    return send(200, api.mediaJson({ id: mMedia[1], ...entry }));
-  }
-  return false;
-}
 // lib/client/masto/accounts.mjs
-async function handle4(api, ctx) {
+async function handle3(api, ctx) {
   const { req, res, pathname, url, send } = ctx;
   if (pathname === "/api/v1/accounts/verify_credentials") {
     const cfg0 = api.store.getConfig() || {};
@@ -66443,6 +67281,31 @@ async function handle4(api, ctx) {
     }
   }
   if (/^\/api\/v1\/accounts\/[a-f0-9]+\/featured_tags$/.test(pathname)) return send(200, []);
+  if (pathname === "/api/v1/directory") return send(200, api.urls?.actor ? [api.account(api.urls.actor)] : []);
+  if (pathname === "/api/v1/suggestions") return send(200, []);
+  const mAccLists = /^\/api\/v1\/accounts\/([a-f0-9]+)\/lists$/.exec(pathname);
+  if (mAccLists && req.method === "GET") {
+    const actorUrl = api.store.urlFor(mAccLists[1]);
+    if (!actorUrl) return send(404, { error: "Record not found" });
+    return send(200, api.store.getLists().filter((l) => (l.members || []).includes(actorUrl)).map((l) => ({ id: l.id, title: l.title, replies_policy: l.repliesPolicy || "list", exclusive: false })));
+  }
+  if (pathname === "/api/v1/mutes" && req.method === "GET") {
+    return send(200, (api.store.getMuted().actors || []).map((a) => api.account(a)));
+  }
+  if (pathname === "/api/v1/blocks" && req.method === "GET") {
+    return send(200, (api.store.getBlocklist().actors || []).map((a) => api.account(a)));
+  }
+  if (pathname === "/api/v1/domain_blocks") {
+    const b = api.store.getBlocklist();
+    if (req.method === "GET") return send(200, [...b.domains]);
+    const body = await readBody2(req);
+    const domain = String(body.domain || url.searchParams.get("domain") || "").trim().toLowerCase();
+    if (!/^[a-z0-9.-]+\.[a-z]{2,}$/u.test(domain)) return send(422, { error: "a domain is required" });
+    if (req.method === "POST" && !b.domains.includes(domain)) b.domains.push(domain);
+    if (req.method === "DELETE") b.domains = b.domains.filter((d) => d !== domain);
+    api.store.setBlocklist(b);
+    return send(200, {});
+  }
   const mAccList = /^\/api\/v1\/accounts\/([a-f0-9]+)\/(following|followers)$/.exec(pathname);
   if (mAccList && req.method === "GET") {
     const actorUrl = api.store.urlFor(mAccList[1]);
@@ -66465,9 +67328,13 @@ async function handle4(api, ctx) {
   if (mAccStatuses) {
     const actorUrl = api.store.urlFor(mAccStatuses[1]);
     const all = api.store.getStatuses();
-    const pinnedOnly = url.searchParams.get("pinned") === "true";
+    const q = url.searchParams;
+    const is = (name) => q.get(name) === "true" || q.get(name) === "1";
+    const pinnedOnly = is("pinned");
+    const tagged = String(q.get("tagged") || "").replace(/^#/, "").toLowerCase();
+    const isBoost = (s) => !!s.via && s.via !== s.actor;
     const { items, headers } = api.page(
-      all.filter((s) => s.actor === actorUrl && (!pinnedOnly || s.pinned)),
+      all.filter((s) => s.actor === actorUrl && (!pinnedOnly || s.pinned)).filter((s) => !is("exclude_replies") || !s.inReplyTo).filter((s) => !is("exclude_reblogs") || !isBoost(s)).filter((s) => !is("only_media") || (s.attachments || []).length > 0).filter((s) => !tagged || (s.tags || []).some((t) => String(t.name).toLowerCase() === tagged)),
       url
     );
     return send(200, items.map((s) => api.statusOrBoost(s, { all })), headers);
@@ -66478,11 +67345,11 @@ async function handle4(api, ctx) {
 // lib/client/masto/timelines.mjs
 var timelines_exports = {};
 __export(timelines_exports, {
-  handle: () => handle5
+  handle: () => handle4
 });
 init_node_crypto();
 init_wire();
-async function handle5(api, ctx) {
+async function handle4(api, ctx) {
   const { req, res, pathname, url, send } = ctx;
   if (pathname === "/api/v1/timelines/home" || pathname === "/api/v1/timelines/public" || pathname === "/api/v1/trends/statuses") {
     const localOnly = pathname === "/api/v1/timelines/public" && url.searchParams.get("local") === "true";
@@ -66513,6 +67380,41 @@ async function handle5(api, ctx) {
     const following = (api.agent.tagfeed?.config().tags || []).includes(name);
     return send(200, api.tagObject(name, following, req));
   }
+  if (pathname === "/api/v1/trends/tags" || pathname === "/api/v1/trends") {
+    const DAY = 864e5;
+    const today = Math.floor(Date.now() / DAY) * DAY;
+    const seen = /* @__PURE__ */ new Map();
+    for (const st2 of api.store.getStatuses()) {
+      if (st2.kind !== "tag" || !st2.tag) continue;
+      const at = Date.parse(st2.published || "");
+      if (!Number.isFinite(at) || at < today - 6 * DAY) continue;
+      const day = Math.floor(at / DAY) * DAY;
+      if (!seen.has(st2.tag)) seen.set(st2.tag, /* @__PURE__ */ new Map());
+      const days = seen.get(st2.tag);
+      if (!days.has(day)) days.set(day, { uses: 0, accounts: /* @__PURE__ */ new Set() });
+      const rec = days.get(day);
+      rec.uses++;
+      if (st2.actor) rec.accounts.add(st2.actor);
+    }
+    const followed = new Set(api.agent.tagfeed?.config().tags || []);
+    const ranked = [...seen.entries()].map(([name, days]) => {
+      const history = [];
+      for (let i = 0; i < 7; i++) {
+        const rec = days.get(today - i * DAY);
+        history.push({
+          day: String(Math.floor((today - i * DAY) / 1e3)),
+          uses: String(rec ? rec.uses : 0),
+          accounts: String(rec ? rec.accounts.size : 0)
+        });
+      }
+      return {
+        total: history.reduce((n, h) => n + Number(h.uses), 0),
+        tag: api.tagObject(name, followed.has(name), req, history)
+      };
+    }).sort((a, b) => b.total - a.total);
+    const limit = Math.min(Math.max(Number(url.searchParams.get("limit")) || 10, 1), 40);
+    return send(200, ranked.slice(0, limit).map((x) => x.tag));
+  }
   const mTagTl = pathname.match(/^\/api\/v1\/timelines\/tag\/([^/]+)$/);
   if (mTagTl && req.method === "GET") {
     const name = decodeURIComponent(mTagTl[1]).replace(/^#/, "").toLowerCase();
@@ -66649,7 +67551,81 @@ async function handle5(api, ctx) {
       last_status: api.status(c.last, { all })
     })));
   }
+  if (pathname === "/api/v1/timelines/direct" && req.method === "GET") {
+    const all = api.store.getStatuses();
+    const items = all.filter((s) => s.direct || s.visibility === "direct");
+    const { items: page2, headers } = api.page(items, url);
+    return send(200, page2.map((s) => api.status(s, { all })), headers);
+  }
+  if (pathname === "/api/v1/notifications/clear" && req.method === "POST") {
+    api.store.removeNotifications(() => true);
+    return send(200, {});
+  }
+  const mNotif = /^\/api\/v1\/notifications\/([A-Za-z0-9_-]+)(\/dismiss)?$/.exec(pathname);
+  if (mNotif) {
+    const n = api.store.getNotifications().find((x) => x.id === mNotif[1]);
+    if (!n) return send(404, { error: "Record not found" });
+    if (mNotif[2] && req.method === "POST") {
+      api.store.removeNotifications((x) => x.id === n.id);
+      return send(200, {});
+    }
+    if (!mNotif[2] && req.method === "GET") return send(200, api.notification(n));
+  }
+  const mGroup = /^\/api\/v2\/notifications\/([A-Za-z0-9_-]+)(\/accounts|\/dismiss)?$/.exec(pathname);
+  if (mGroup) {
+    const n = api.store.getNotifications().find((x) => x.id === mGroup[1]);
+    if (!n) return send(404, { error: "Record not found" });
+    if (mGroup[2] === "/dismiss" && req.method === "POST") {
+      api.store.removeNotifications((x) => x.id === n.id);
+      return send(200, {});
+    }
+    if (mGroup[2] === "/accounts" && req.method === "GET") return send(200, [api.account(n.actor)]);
+    if (!mGroup[2] && req.method === "GET") return send(200, groupedNotifications(api, [n]));
+  }
+  if (pathname === "/api/v2/notifications") {
+    const { page: page2, headers } = notificationPage(api, ctx);
+    return send(200, groupedNotifications(api, page2), headers);
+  }
   if (pathname === "/api/v1/notifications") {
+    const { page: page2, headers } = notificationPage(api, ctx);
+    return send(200, page2.map((n) => api.notification(n)), headers);
+  }
+  if (pathname === "/api/v2/search" || pathname === "/api/v1/search") {
+    return searchHandler(api, ctx);
+  }
+  return false;
+}
+function groupedNotifications(api, page2) {
+  const accounts = /* @__PURE__ */ new Map();
+  const statuses = /* @__PURE__ */ new Map();
+  const groups = page2.map((n) => {
+    const acct = api.account(n.actor);
+    accounts.set(acct.id, acct);
+    const s = n.noteId && api.store.getStatuses().find((x) => x.noteId === n.noteId);
+    let statusId = null;
+    if (s) {
+      const j = api.status(s);
+      statuses.set(j.id, j);
+      statusId = j.id;
+    }
+    return {
+      group_key: n.id,
+      notifications_count: 1,
+      type: api.notificationType(n.type),
+      most_recent_notification_id: n.id,
+      page_min_id: n.id,
+      page_max_id: n.id,
+      latest_page_notification_at: n.at,
+      sample_account_ids: [acct.id],
+      ...statusId ? { status_id: statusId } : {},
+      ...n.type === "reaction" ? { emoji: n.emoji, ...n.url ? { emoji_url: n.url } : {} } : {}
+    };
+  });
+  return { accounts: [...accounts.values()], statuses: [...statuses.values()], notification_groups: groups };
+}
+function notificationPage(api, ctx) {
+  const { req, pathname, url } = ctx;
+  {
     const limit = Math.min(Number(url.searchParams.get("limit")) || 30, 60);
     const q = url.searchParams;
     let items = api.store.getNotifications();
@@ -66680,13 +67656,16 @@ async function handle5(api, ctx) {
         for (const [k, v] of Object.entries(params)) u.searchParams.set(k, v);
         return u.href;
       };
-      return send(200, page2.map((n) => api.notification(n)), {
+      return { page: page2, headers: {
         link: `<${link({ max_id: page2[page2.length - 1].id })}>; rel="next", <${link({ min_id: page2[0].id })}>; rel="prev"`
-      });
+      } };
     }
-    return send(200, []);
+    return { page: [], headers: void 0 };
   }
-  if (pathname === "/api/v2/search" || pathname === "/api/v1/search") {
+}
+async function searchHandler(api, ctx) {
+  const { req, res, pathname, url, send } = ctx;
+  {
     const q = String(url.searchParams.get("q") || "").trim();
     const type = url.searchParams.get("type");
     const out = { accounts: [], statuses: [], hashtags: [] };
@@ -66733,10 +67712,10 @@ async function handle5(api, ctx) {
 // lib/client/masto/statuses.mjs
 var statuses_exports = {};
 __export(statuses_exports, {
-  handle: () => handle6
+  handle: () => handle5
 });
 init_node_crypto();
-async function handle6(api, ctx) {
+async function handle5(api, ctx) {
   const { req, res, pathname, url, send } = ctx;
   if (pathname === "/api/v1/statuses" && req.method === "POST") {
     const body = await readBody2(req);
@@ -66759,8 +67738,22 @@ async function handle6(api, ctx) {
     const mediaIds = [].concat(body.media_ids || body["media_ids[]"] || []).filter(Boolean);
     const media = api.store.getMedia();
     const attachments = mediaIds.map((id) => media[id] && { id, ...media[id] }).filter(Boolean);
+    let quote = null;
+    if (body.quoted_status_id) {
+      const quotedUrl = api.store.urlFor(String(body.quoted_status_id));
+      const quoted = quotedUrl && api.store.getStatuses().find((x) => x.noteId === quotedUrl);
+      if (!quoted) return send(404, { error: "Record not found" });
+      if (["bsky", "acct"].includes(quoted.kind)) return send(422, { error: "that post cannot be quoted from this account" });
+      if (visibility === "private" || visibility === "direct") return send(422, { error: "a quote post is public or unlisted" });
+      const may = api.quoteApproval(quoted).current_user;
+      if (may === "denied") return send(422, { error: "the author of that post does not allow quotes" });
+      if (may === "unknown") return send(422, { error: "the author of that post has not said whether it may be quoted" });
+      if (body.scheduled_at) return send(422, { error: "a quote cannot be scheduled" });
+      quote = { id: quoted.noteId, actor: quoted.actor };
+    }
     const asking = pollParams(body);
     if (asking) {
+      if (quote) return send(422, { error: "a poll cannot quote a post" });
       if (attachments.length) return send(422, { error: "a poll cannot carry media" });
       if (body.scheduled_at) return send(422, { error: "a poll cannot be scheduled" });
       if (asking.options.length < 2) return send(422, { error: "a poll needs at least two options" });
@@ -66816,7 +67809,7 @@ async function handle6(api, ctx) {
     try {
       note = await api.agent.publisher.publishNote(
         body.status,
-        { inReplyTo, attachments, visibility, spoilerText, sensitive }
+        { inReplyTo, attachments, visibility, spoilerText, sensitive, quote }
       );
     } catch (e) {
       if (e.code === "unaddressed") return send(422, { error: e.message });
@@ -66825,6 +67818,9 @@ async function handle6(api, ctx) {
     const s = api.store.getStatuses().find((x) => x.noteId === note.id);
     return send(200, api.status(s));
   }
+  if (/^\/api\/v1\/statuses\/[a-f0-9]+\/interaction_policy$/.test(pathname) && req.method === "PUT") {
+    return send(422, { error: "the quote policy is the same for every post here: anyone may quote a public or unlisted post, nobody a followers-only or direct one" });
+  }
   const mSource = /^\/api\/v1\/statuses\/([a-f0-9]+)\/source$/.exec(pathname);
   if (mSource && req.method === "GET") {
     const noteUrl = api.store.urlFor(mSource[1]);
@@ -67033,6 +68029,60 @@ async function handle6(api, ctx) {
   return false;
 }
+// lib/client/masto/media.mjs
+var media_exports2 = {};
+__export(media_exports2, {
+  attachmentType: () => attachmentType,
+  extensionFor: () => extensionFor,
+  handle: () => handle6
+});
+init_node_crypto();
+var ATTACHMENT_KINDS = /* @__PURE__ */ new Set(["image", "video", "audio"]);
+var NEVER = /* @__PURE__ */ new Set(["image/svg+xml", "image/svg"]);
+var OPAQUE = "application/octet-stream";
+function attachmentType(claimed) {
+  const t = String(claimed || "").split(";")[0].trim().toLowerCase();
+  if (!/^[a-z0-9.+-]+\/[a-z0-9.+-]+$/.test(t) || NEVER.has(t)) return OPAQUE;
+  return ATTACHMENT_KINDS.has(t.split("/")[0]) ? t : OPAQUE;
+}
+function extensionFor(mediaType, filename = "") {
+  if (mediaType === OPAQUE) return "bin";
+  const sub = mediaType.split("/")[1].replace(/[^a-z0-9]/g, "");
+  const given = String(filename || "").includes(".") ? filename.split(".").pop().toLowerCase().replace(/[^a-z0-9]/g, "") : "";
+  return given && (given === sub || sub.startsWith(given) || given.startsWith(sub)) ? given : sub || "bin";
+}
+async function handle6(api, ctx) {
+  const { req, res, pathname, url, send } = ctx;
+  if ((pathname === "/api/v2/media" || pathname === "/api/v1/media") && req.method === "POST") {
+    const { fields, file } = await readMultipart(req);
+    if (!file?.data?.length) return send(422, { error: "file required" });
+    const mediaType = attachmentType(file.contentType);
+    const ext = extensionFor(mediaType, file.filename);
+    const slug = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10) + "-" + node_crypto_default.randomBytes(4).toString("hex") + "." + ext;
+    const mediaUrl = api.urls.media + slug;
+    await api.agent.publisher.ensureMediaContainer();
+    await write6(api.agent.remote, mediaUrl, file.data, mediaType);
+    const entry = { url: mediaUrl, mediaType, description: fields.description || "" };
+    const id = api.store.idFor(mediaUrl);
+    api.store.setMedia(id, entry);
+    return send(200, api.mediaJson({ id, ...entry }));
+  }
+  const mMedia = /^\/api\/v1\/media\/([a-f0-9]+)$/.exec(pathname);
+  if (mMedia) {
+    const entry = api.store.getMedia()[mMedia[1]];
+    if (!entry) return send(404, { error: "Record not found" });
+    if (req.method === "PUT") {
+      const body = await readBody2(req);
+      if (typeof body.description === "string") {
+        entry.description = body.description;
+        api.store.setMedia(mMedia[1], entry);
+      }
+    }
+    return send(200, api.mediaJson({ id: mMedia[1], ...entry }));
+  }
+  return false;
+}
 // lib/client/masto/index.mjs
 var MastoApi = class _MastoApi {
   constructor({
@@ -67129,7 +68179,7 @@ var MastoApi = class _MastoApi {
       const took = await this.agent.requestTakeover?.();
       if (!took) return send(503, { error: "another agent is active for this pod \u2014 takeover failed, try again" });
     }
-    for (const area of [accounts_exports, timelines_exports, statuses_exports, media_exports]) {
+    for (const area of [accounts_exports, timelines_exports, statuses_exports, media_exports2]) {
       if (await area.handle(this, ctx)) return true;
     }
     this.log(`mastoapi: unhandled ${req.method} ${pathname} \u2014 punch list`);
@@ -67200,6 +68250,9 @@ var MastoApi = class _MastoApi {
   status(...a) {
     return status(this, ...a);
   }
+  quoteApproval(...a) {
+    return quoteApproval(this, ...a);
+  }
   filtersFor(...a) {
     return filtersFor(this, ...a);
   }
@@ -67249,11 +68302,32 @@ var MastoApi = class _MastoApi {
 var MAX_TIMELINE_BYTES = 2 * 1024 * 1024;
 var DEFAULTS2 = {
   instance: "https://mastodon.social",
-  tags: ["solidproject", "linkeddata", "rdf"],
+  tags: [
+    "fediverse",
+    "activitypub",
+    // the network this account is on
+    "opensource",
+    "foss",
+    // how the software gets made
+    "solidproject",
+    "linkeddata",
+    // where the data lives
+    "privacy",
+    "digitalrights",
+    // what is at stake
+    "indieweb",
+    "smallweb",
+    // publishing for yourself
+    "commons",
+    "platformcooperativism"
+    // owning it together
+  ],
   intervalMin: 15
 };
 var PER_TAG = 20;
-var MAX_NEW_PER_SWEEP = 12;
+var MAX_NEW_PER_SWEEP = 8;
+var MAX_NEW_PER_TAG = 2;
+var TAGS_PER_SWEEP = 4;
 var MAX_TAG_ENTRIES = 200;
 var BACKOFF_MIN_MS2 = 15 * 6e4;
 var BACKOFF_MAX_MS2 = 6 * 60 * 6e4;
@@ -67263,6 +68337,7 @@ var TagFeed = class {
     Object.assign(this, { store, intake, log: log2, fetcher: fetcher2 });
     this.lastSweep = null;
     this.lastAdded = 0;
+    this.cursor = 0;
   }
   config() {
     return { ...DEFAULTS2, ...this.store.read("tagfeed.json", {}) };
@@ -67320,9 +68395,13 @@ var TagFeed = class {
     const known2 = new Set(this.store.getStatuses().map((s) => s.noteId));
     let budget = MAX_NEW_PER_SWEEP;
     let added = 0;
+    const start = this.cursor % tags.length;
+    this.cursor = (start + TAGS_PER_SWEEP) % tags.length;
+    const order = [...tags, ...tags].slice(start, start + Math.min(TAGS_PER_SWEEP, tags.length));
     this.store.hold?.();
     try {
-      for (const tag of tags) {
+      for (const tag of order) {
+        let perTag = MAX_NEW_PER_TAG;
         let list3;
         try {
           const { safeFetch: safeFetch2, retryAfterMs: retryAfterMs3, readCapped: readCapped3 } = await Promise.resolve().then(() => (init_safefetch(), safefetch_exports));
@@ -67342,7 +68421,9 @@ var TagFeed = class {
         for (const st2 of Array.isArray(list3) ? list3 : []) {
           const noteId = st2?.uri;
           if (!noteId || known2.has(noteId) || this.store.isBlocked(noteId)) continue;
-          if (budget-- <= 0) break;
+          if (perTag <= 0 || budget <= 0) break;
+          perTag--;
+          budget--;
           const note = await this.intake.fetchAP(noteId).catch(() => null);
           if (!note || note.id !== noteId || !isContentType(note.type)) continue;
           const author = authorOf(note);
@@ -67366,6 +68447,7 @@ var TagFeed = class {
           known2.add(noteId);
           added++;
         }
+        if (budget <= 0) break;
       }
       const all = this.store.getStatuses();
       const tagged = all.filter((s) => s.kind === "tag");
@@ -67377,7 +68459,7 @@ var TagFeed = class {
       this.store.release?.();
     }
     this.lastAdded = added;
-    if (added) this.log(`tagfeed: +${added} from #${tags.join(" #")}`);
+    if (added) this.log(`tagfeed: +${added} from #${order.join(" #")}`);
   }
 };
@@ -67670,7 +68752,7 @@ var PodTransport = class {
   // leaves the private trees world-readable. $rdf.sym() also throws on an
   // illegal IRI, so a pod URL with something odd in it fails here rather than
   // silently producing a document that means something else.
-  aclDoc(targetUrl, publicModes, { appendAgents = [], aclUrl = null } = {}) {
+  aclDoc(targetUrl, publicModes, { appendAgents = [], readAgents = [], aclUrl = null } = {}) {
     const url = aclUrl || targetUrl + ".acl";
     const doc = namedNode2(url);
     const target = namedNode2(targetUrl);
@@ -67686,6 +68768,7 @@ var PodTransport = class {
       authorize(namedNode2(url + "#public"), ACL("agentClass"), FOAF("Agent"), publicModes);
     }
     appendAgents.forEach((webId, i) => authorize(namedNode2(url + `#gw${i}`), ACL("agent"), namedNode2(webId), ["Append"]));
+    readAgents.forEach((webId, i) => authorize(namedNode2(url + `#r${i}`), ACL("agent"), namedNode2(webId), ["Read"]));
     authorize(
       namedNode2(url + "#owner"),
       ACL("agent"),
@@ -67875,61 +68958,6 @@ var BrowserRemotePod = class extends PodTransport {
   }
 };
-// web/app/idb-kv.mjs
-var DB = "fedipod-accounts";
-function open() {
-  return new Promise((res, rej) => {
-    const r = indexedDB.open(DB, 1);
-    r.onupgradeneeded = () => {
-      const db = r.result;
-      if (!db.objectStoreNames.contains("kv")) db.createObjectStore("kv");
-    };
-    r.onsuccess = () => res(r.result);
-    r.onerror = () => rej(r.error);
-  });
-}
-async function kvGet(key) {
-  const db = await open();
-  return new Promise((res, rej) => {
-    const rq = db.transaction("kv", "readonly").objectStore("kv").get(key);
-    rq.onsuccess = () => res(rq.result ?? null);
-    rq.onerror = () => rej(rq.error);
-  });
-}
-async function kvAll() {
-  const db = await open();
-  return new Promise((res, rej) => {
-    const out = {};
-    const cur = db.transaction("kv", "readonly").objectStore("kv").openCursor();
-    cur.onsuccess = () => {
-      const c = cur.result;
-      if (c) {
-        out[c.key] = c.value;
-        c.continue();
-      } else res(out);
-    };
-    cur.onerror = () => rej(cur.error);
-  });
-}
-async function kvPut(key, val) {
-  const db = await open();
-  return new Promise((res, rej) => {
-    const tx = db.transaction("kv", "readwrite");
-    tx.objectStore("kv").put(val, key);
-    tx.oncomplete = () => res();
-    tx.onerror = () => rej(tx.error);
-  });
-}
-async function kvDel(key) {
-  const db = await open();
-  return new Promise((res, rej) => {
-    const tx = db.transaction("kv", "readwrite");
-    tx.objectStore("kv").delete(key);
-    tx.oncomplete = () => res();
-    tx.onerror = () => rej(tx.error);
-  });
-}
 // web/app/keystore.mjs
 var PEM = (der, label) => {
   const b642 = btoa(String.fromCharCode(...new Uint8Array(der)));
@@ -68848,6 +69876,7 @@ var ADMIN_PATHS = /* @__PURE__ */ new Set([
   "/log",
   "/fediacct",
   "/describe",
+  "/follow",
   "/atproto",
   "/atproto/connect",
   "/atproto/disconnect",
@@ -68857,6 +69886,7 @@ var ADMIN_PATHS = /* @__PURE__ */ new Set([
   "/inbox/prune",
   "/park",
   "/revive",
+  "/takeover",
   "/fediacct/connect",
   "/fediacct/disconnect",
   "/fediacct/callback"
@@ -69082,6 +70112,29 @@ var AdminFacade = class {
         await a.publisher.publishProfile();
         return json2(200, { ok: true, summary: cfg.summary || null, icon: cfg.icon || null });
       }
+      // Following somebody, the same call the Node agent's admin surface takes
+      // (lib/device/admin/routes/social.mjs): by handle normally, by actor url
+      // when WebFinger cannot answer for them. The remote-follow page
+      // (/authorize_interaction) is what asks for it here — another server
+      // sends its reader to that page when they press Follow and say they are
+      // at this host.
+      case "/follow": {
+        await a.requestTakeover?.();
+        if (body.actor) {
+          await followActor(a, String(body.actor));
+          return json2(200, { ok: true, actor: String(body.actor) });
+        }
+        if (!body.handle) return json2(400, { error: "handle or actor required" });
+        return json2(200, await followHandle(a, String(body.handle)));
+      }
+      // Taking the account back. A viewer publishes nothing and drains
+      // nothing, so an account whose lease is held by something that is not
+      // running any more stays silent with no way to say so. The owner acting
+      // HERE outranks whatever holds it.
+      case "/takeover": {
+        if (!await a.requestTakeover?.()) return json2(503, { error: "the lease could not be taken \u2014 the pod refused the write" });
+        return json2(200, { ok: true, mode: a.status().mode });
+      }
       // Going quiet, and coming back. The record page's active/parked select.
       case "/park": {
         if (!await a.requestTakeover?.()) return json2(503, { error: "another device is active for this pod \u2014 park from there" });
@@ -70509,6 +71562,48 @@ var originAuthorities = (host) => ({
   }
   // fetch-only: this build serves no socket
 });
+async function accountNotRead({ unread, podBase, state, webId, actorUrl = null, fetchImpl = globalThis.fetch }) {
+  const host = (() => {
+    try {
+      return new URL(podBase).host;
+    } catch {
+      return podBase;
+    }
+  })();
+  const of = (code, message) => {
+    const e = new Error(message);
+    e.code = code;
+    return e;
+  };
+  if (!unread) {
+    const actor = actorUrl ? await fetchImpl(actorUrl, { headers: { accept: "application/activity+json" } }).then((r) => r.ok ? r.json() : null).catch(() => null) : null;
+    if (actor?.preferredUsername) {
+      const at = (() => {
+        try {
+          return `@${actor.preferredUsername}@${new URL(actor.id || actorUrl).host}`;
+        } catch {
+          return actor.preferredUsername;
+        }
+      })();
+      return of("device-account", `${host} holds the account ${at}, but not its record: this account is run by a DeviceAgent, and its record lives on that device. Open it from that device's admin page, not here. The sign-in used here was ${webId}.`);
+    }
+    return of("no-account", `${host} answered, and there is no FediPod account in it. Sign in with the pod that holds your account, or make an account in this one \u2014 both start from the sign-in page. The sign-in used here was ${webId}.`);
+  }
+  const status2 = Number((/HTTP (\d{3})/u.exec(unread.message) || [])[1]) || 0;
+  if (status2 === 401 || status2 === 403) {
+    return of("sign-in-refused", `${host} would not let this sign-in read your account \u2014 it answered "not allowed" (HTTP ${status2}) \u2014 and renewing the sign-in did not change its mind. Your account and everything in it are untouched. Signing in at ${host} again is the one thing that helps.`);
+  }
+  if (status2 === 429) {
+    return of("pod-busy", `${host} is telling this browser it has asked for too much too quickly (HTTP 429), so your account could not be read. Nothing is wrong with your account, and nothing here needs doing: this page is waiting the throttle out and will ask again by itself. While a pod is rate-limiting you, only time helps.`);
+  }
+  if (status2 >= 500) {
+    return of("pod-error", `${host} broke while handing your account over (HTTP ${status2}). That is the pod's own failure, not your account's. This page asks again by itself in a moment; if it keeps saying this, the pod is down and there is nothing to do here.`);
+  }
+  if (status2 === 404) {
+    return of("no-account-here", `${host} says there is nothing at ${state} (HTTP 404). Either no FediPod account has ever been set up in this pod, or you signed in with a different pod than the one holding yours. Sign in with that one, or make an account in this one \u2014 both start from the sign-in page.`);
+  }
+  return of("pod-unreachable", `This browser could not reach ${host} to read your account (${unread.message}). Your account is still there. This page tries again by itself; if it keeps saying this, check that you are online and that the pod is up.`);
+}
 var BrowserAgent = class _BrowserAgent {
   constructor({ log: log2 = console.log } = {}) {
     this.log = log2;
@@ -70541,6 +71636,7 @@ var BrowserAgent = class _BrowserAgent {
     try {
       await this.store.load({ force: true }).catch((e) => this.log(`re-reading state: ${e.message}`));
       await this.publisher.healStatuses().catch((e) => this.log(`healing the timeline index: ${e.message}`));
+      await this.publisher.publishProfilePage().catch((e) => this.log(`profile page: ${e.message}`));
       this.deliverer?.startQueue?.();
       await this.publisher.publishProfile();
       await this.store.flush?.();
@@ -70611,6 +71707,21 @@ var BrowserAgent = class _BrowserAgent {
    *  - { credential, keysRecord, config }: a client-credential session with the
    *    material in hand (the offline test path).
    */
+  // This browser's name for itself, minted once and kept. Not an identity and
+  // not a secret — it says only "the same browser as last time" to the lease.
+  // If storage cannot be reached, a fresh one is honest: this browser cannot
+  // prove it is the one that held the lease, so it should not claim to be.
+  async deviceId() {
+    try {
+      const had = await kvGet("device-id");
+      if (had) return had;
+      const made = crypto.randomUUID();
+      await kvPut("device-id", made);
+      return made;
+    } catch {
+      return null;
+    }
+  }
   async boot({ oidc, credential, keysRecord, config, frontOrigin }) {
     let session;
     let webId;
@@ -70631,10 +71742,12 @@ var BrowserAgent = class _BrowserAgent {
     this.urls = apUrls2(remotePod, root);
     const podFetch = (u, i) => this.remote.fetch(u, i);
     this.store = new PodStore({ storage: new HttpStorage(this.urls.state, podFetch), log: this.log });
-    await this.store.load().catch(() => {
+    let unread = null;
+    await this.store.load().catch((e) => {
+      unread = e;
     });
     const cfg = config || this.store.getConfig();
-    if (!cfg) throw new Error("no account config on this pod \u2014 sign up first");
+    if (!cfg) throw await accountNotRead({ unread, podBase: remotePod, state: this.urls.state, webId, actorUrl: this.urls.actor });
     this.store.setConfig({ ...this.store.getConfig() || {}, ...cfg, root });
     config = this.store.getConfig();
     const publicBase = config.gateway?.frontActor ? config.gateway.frontActor.replace(/ap\/actor\/?$/, "") : null;
@@ -70672,7 +71785,17 @@ var BrowserAgent = class _BrowserAgent {
     this.atproto = new BrowserAtproto({ store: this.store, actorId: this.urls.actor, log: this.log });
     this.publisher.atproto = this.atproto;
     this.fediaccts = new BrowserFediAccounts({ store: this.store, actorId: this.urls.actor, log: this.log });
-    this.lease = new Lease({ url: this.urls.state + "lease.json", fetchImpl: podFetch, log: this.log });
+    this.lease = new Lease({
+      url: this.urls.state + "lease.json",
+      fetchImpl: podFetch,
+      log: this.log,
+      // Kept on this origin, so THIS browser is one holder however many times
+      // its worker is killed and restarted. Without it every restart was a new
+      // holder: the old lease still had minutes to run, so the browser found
+      // its own account "active on another device" and asked to take it over.
+      // Switching between the clients did it every time, being a navigation.
+      id: await this.deviceId()
+    });
     this.c2s = new C2S({ agent: this, log: this.log });
     this.intake = new Intake({
       config: this.store.getConfig(),
@@ -70904,43 +72027,14 @@ var BrowserAgent = class _BrowserAgent {
   }
 };
-// web/app/oidc-session.mjs
-var DB2 = "fedipod-oidc";
+// lib/session/oidc-session.mjs
 var STORE = "session";
 var b64u3 = (buf) => btoa(String.fromCharCode(...new Uint8Array(buf))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 var enc3 = (o) => b64u3(new TextEncoder().encode(JSON.stringify(o)));
 var sha2564 = (s) => crypto.subtle.digest("SHA-256", new TextEncoder().encode(s));
-function idb() {
-  return new Promise((res, rej) => {
-    const r = indexedDB.open(DB2, 1);
-    r.onupgradeneeded = () => r.result.createObjectStore(STORE);
-    r.onsuccess = () => res(r.result);
-    r.onerror = () => rej(r.error);
-  });
-}
-async function idbGet(key) {
-  const db = await idb();
-  return new Promise((res, rej) => {
-    const t = db.transaction(STORE).objectStore(STORE).get(key);
-    t.onsuccess = () => res(t.result);
-    t.onerror = () => rej(t.error);
-  });
-}
-async function idbPut(key, val) {
-  const db = await idb();
-  return new Promise((res, rej) => {
-    const t = db.transaction(STORE, "readwrite").objectStore(STORE).put(val, key);
-    t.onsuccess = () => res();
-    t.onerror = () => rej(t.error);
-  });
-}
-async function idbDel(key) {
-  const db = await idb();
-  return new Promise((res, rej) => {
-    const t = db.transaction(STORE, "readwrite").objectStore(STORE).delete(key);
-    t.onsuccess = () => res();
-    t.onerror = () => rej(t.error);
-  });
+var rand = (n = 32) => b64u3(crypto.getRandomValues(new Uint8Array(n)));
+async function dpopKey() {
+  return crypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
 }
 async function publicJwk(pair) {
   const j = await crypto.subtle.exportKey("jwk", pair.publicKey);
@@ -70953,64 +72047,217 @@ async function dpopProof(pair, jwk, htm, htu, ath) {
   const sig = await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, pair.privateKey, new TextEncoder().encode(data));
   return `${data}.${b64u3(sig)}`;
 }
-async function getSession() {
-  const s = await idbGet("session");
-  return s ? sessionHandle(s) : null;
-}
-async function signOut() {
-  const s = await idbGet("session").catch(() => null);
-  if (s?.revocationEndpoint && s.refreshToken) {
-    try {
-      await fetch(s.revocationEndpoint, {
-        method: "POST",
-        headers: { "content-type": "application/x-www-form-urlencoded" },
-        body: new URLSearchParams({
-          token: s.refreshToken,
-          token_type_hint: "refresh_token",
-          client_id: s.client_id
-        })
-      });
-    } catch {
-    }
+var jwtPayload = (jwt) => {
+  try {
+    return JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(jwt.split(".")[1].replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0))));
+  } catch {
+    return {};
   }
-  await idbDel("session");
-  await idbDel("pending");
+};
+async function discover(issuer) {
+  const res = await fetch(`${issuer.replace(/\/+$/, "")}/.well-known/openid-configuration`, { headers: { accept: "application/json" } });
+  if (!res.ok) throw new Error(`OIDC discovery failed at ${issuer} (HTTP ${res.status})`);
+  return res.json();
 }
-function sessionHandle(s) {
-  let { accessToken, expiresAt, refreshToken } = s;
-  const jwkP = publicJwk(s.pair);
-  const refresh = async () => {
-    if (!refreshToken) throw new Error("session expired and there is no refresh token \u2014 sign in again");
-    const jwk = await jwkP;
-    const res = await fetch(s.tokenEndpoint, {
+async function registerClient(cfg, redirectUri, clientName) {
+  const res = await fetch(cfg.registration_endpoint, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      client_name: clientName,
+      redirect_uris: [redirectUri],
+      token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      application_type: "web",
+      scope: "openid webid offline_access"
+    })
+  });
+  if (!res.ok) throw new Error(`client registration failed (HTTP ${res.status})`);
+  return (await res.json()).client_id;
+}
+function solidOidcSession({ dbName = "solid-oidc-session", clientName = "Solid app" } = {}) {
+  function idb() {
+    return new Promise((res, rej) => {
+      const r = indexedDB.open(dbName, 1);
+      r.onupgradeneeded = () => r.result.createObjectStore(STORE);
+      r.onsuccess = () => res(r.result);
+      r.onerror = () => rej(r.error);
+    });
+  }
+  async function idbGet(key) {
+    const db = await idb();
+    return new Promise((res, rej) => {
+      const t = db.transaction(STORE).objectStore(STORE).get(key);
+      t.onsuccess = () => res(t.result);
+      t.onerror = () => rej(t.error);
+    });
+  }
+  async function idbPut(key, val) {
+    const db = await idb();
+    return new Promise((res, rej) => {
+      const t = db.transaction(STORE, "readwrite").objectStore(STORE).put(val, key);
+      t.onsuccess = () => res();
+      t.onerror = () => rej(t.error);
+    });
+  }
+  async function idbDel(key) {
+    const db = await idb();
+    return new Promise((res, rej) => {
+      const t = db.transaction(STORE, "readwrite").objectStore(STORE).delete(key);
+      t.onsuccess = () => res();
+      t.onerror = () => rej(t.error);
+    });
+  }
+  async function beginLogin2({ issuer, redirectUri, clientName: name = clientName, returnTo = null }) {
+    const cfg = await discover(issuer);
+    const client_id = await registerClient(cfg, redirectUri, name);
+    const pair = await dpopKey();
+    const verifier = rand(48);
+    const challenge = b64u3(await sha2564(verifier));
+    const state = rand(16);
+    await idbPut("pending", {
+      issuer,
+      client_id,
+      redirectUri,
+      verifier,
+      state,
+      pair,
+      returnTo,
+      tokenEndpoint: cfg.token_endpoint,
+      authorizationEndpoint: cfg.authorization_endpoint,
+      revocationEndpoint: cfg.revocation_endpoint || null
+    });
+    const url = new URL(cfg.authorization_endpoint);
+    for (const [k, v] of Object.entries({
+      client_id,
+      redirect_uri: redirectUri,
+      response_type: "code",
+      scope: "openid webid offline_access",
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+      state,
+      prompt: "consent"
+    })) url.searchParams.set(k, v);
+    return { authorizationUrl: url.href };
+  }
+  async function completeLogin2({ currentUrl }) {
+    const u = new URL(currentUrl);
+    const code = u.searchParams.get("code");
+    const state = u.searchParams.get("state");
+    if (!code) return null;
+    const p = await idbGet("pending");
+    if (!p || p.state !== state) throw new Error("login state mismatch");
+    const jwk = await publicJwk(p.pair);
+    const res = await fetch(p.tokenEndpoint, {
       method: "POST",
-      headers: { "content-type": "application/x-www-form-urlencoded", dpop: await dpopProof(s.pair, jwk, "POST", s.tokenEndpoint) },
-      body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: refreshToken, client_id: s.client_id, scope: "openid webid offline_access" })
+      headers: { "content-type": "application/x-www-form-urlencoded", dpop: await dpopProof(p.pair, jwk, "POST", p.tokenEndpoint) },
+      body: new URLSearchParams({ grant_type: "authorization_code", code, redirect_uri: p.redirectUri, client_id: p.client_id, code_verifier: p.verifier })
     });
     const tok = await res.json().catch(() => ({}));
-    if (!res.ok || !tok.access_token) {
-      await idbDel("session");
-      throw new Error("refresh failed \u2014 sign in again");
-    }
-    accessToken = tok.access_token;
-    expiresAt = Date.now() + Math.max(30, tok.expires_in || 300) * 1e3;
-    if (tok.refresh_token) refreshToken = tok.refresh_token;
-    const now = await idbGet("session");
-    if (now && now.webId !== s.webId) {
-      throw new Error("signed in as somebody else while this session was refreshing");
-    }
-    await idbPut("session", { ...s, accessToken, expiresAt, refreshToken });
-  };
-  const authFetch = async (url, init = {}) => {
-    if (Date.now() > expiresAt - 3e4) await refresh();
-    const jwk = await jwkP;
-    const ath = b64u3(await sha2564(accessToken));
-    const headers = { ...init.headers || {}, authorization: `DPoP ${accessToken}`, dpop: await dpopProof(s.pair, jwk, init.method || "GET", url, ath) };
-    return fetch(url, { ...init, headers });
-  };
-  return { webId: s.webId, fetch: authFetch, refresh, signOut };
+    if (!res.ok || !tok.access_token) throw new Error(`token exchange failed (HTTP ${res.status}): ${tok.error || ""}`);
+    const webId = jwtPayload(tok.access_token).webid || jwtPayload(tok.id_token || "").webid || null;
+    const session = {
+      issuer: p.issuer,
+      client_id: p.client_id,
+      tokenEndpoint: p.tokenEndpoint,
+      pair: p.pair,
+      // Where to hand the refresh token back at sign-out. Kept on the session
+      // because discovery is a network round trip and sign-out should not need
+      // one — see signOut().
+      revocationEndpoint: p.revocationEndpoint || null,
+      refreshToken: tok.refresh_token || null,
+      accessToken: tok.access_token,
+      expiresAt: Date.now() + Math.max(30, tok.expires_in || 300) * 1e3,
+      webId
+    };
+    await idbPut("session", session);
+    await idbDel("pending");
+    return Object.assign(sessionHandle(session), p.returnTo ? { returnTo: p.returnTo } : {});
+  }
+  async function getSession2() {
+    const s = await idbGet("session");
+    return s ? sessionHandle(s) : null;
+  }
+  async function signOut2() {
+    const s = await idbGet("session").catch(() => null);
+    if (s?.revocationEndpoint && s.refreshToken) {
+      try {
+        await fetch(s.revocationEndpoint, {
+          method: "POST",
+          headers: { "content-type": "application/x-www-form-urlencoded" },
+          body: new URLSearchParams({
+            token: s.refreshToken,
+            token_type_hint: "refresh_token",
+            client_id: s.client_id
+          })
+        });
+      } catch {
+      }
+    }
+    await idbDel("session");
+    await idbDel("pending");
+  }
+  function sessionHandle(s) {
+    let { accessToken, expiresAt, refreshToken } = s;
+    const jwkP = publicJwk(s.pair);
+    const refresh = async () => {
+      if (!refreshToken) throw new Error("session expired and there is no refresh token \u2014 sign in again");
+      const jwk = await jwkP;
+      let res;
+      try {
+        res = await fetch(s.tokenEndpoint, {
+          method: "POST",
+          headers: { "content-type": "application/x-www-form-urlencoded", dpop: await dpopProof(s.pair, jwk, "POST", s.tokenEndpoint) },
+          body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: refreshToken, client_id: s.client_id, scope: "openid webid offline_access" })
+        });
+      } catch (e) {
+        throw new Error(`${e.message} \u2014 renewing your sign-in at ${new URL(s.tokenEndpoint).host}`);
+      }
+      const tok = await res.json().catch(() => ({}));
+      if (res.status === 429) {
+        throw new Error(`${new URL(s.tokenEndpoint).host} is asking us to slow down \u2014 your sign-in could not be renewed just now`);
+      }
+      if (!res.ok || !tok.access_token) {
+        await idbDel("session");
+        throw new Error("refresh failed \u2014 sign in again");
+      }
+      accessToken = tok.access_token;
+      expiresAt = Date.now() + Math.max(30, tok.expires_in || 300) * 1e3;
+      if (tok.refresh_token) refreshToken = tok.refresh_token;
+      const now = await idbGet("session");
+      if (now && now.webId !== s.webId) {
+        throw new Error("signed in as somebody else while this session was refreshing");
+      }
+      await idbPut("session", { ...s, accessToken, expiresAt, refreshToken });
+    };
+    const send = async (url, init) => {
+      const jwk = await jwkP;
+      const ath = b64u3(await sha2564(accessToken));
+      const headers = { ...init.headers || {}, authorization: `DPoP ${accessToken}`, dpop: await dpopProof(s.pair, jwk, init.method || "GET", url, ath) };
+      return fetch(url, { ...init, headers });
+    };
+    const authFetch = async (url, init = {}) => {
+      if (Date.now() > expiresAt - 3e4) await refresh();
+      const res = await send(url, init);
+      if (res.status === 401 && refreshToken) {
+        try {
+          await refresh();
+        } catch {
+          return res;
+        }
+        return send(url, init);
+      }
+      return res;
+    };
+    return { webId: s.webId, issuer: s.issuer, fetch: authFetch, refresh, signOut: signOut2 };
+  }
+  return { beginLogin: beginLogin2, completeLogin: completeLogin2, getSession: getSession2, signOut: signOut2 };
 }
+// web/app/oidc-session.mjs
+var { beginLogin, completeLogin, getSession, signOut } = solidOidcSession({ dbName: "fedipod-oidc", clientName: "FediPod" });
 // web/app/sw-src.mjs
 var agent = null;
 var booting = null;