fedipod 1.11.0 → 1.26.1

package/lib/core/intake/activities.mjs

@@ -3,7 +3,9 @@
 // rejection reason or nothing.
 
 import { dropFollower } from '../store.mjs';
-import { emojisOf, pollOf, isContentType, trimActivity } from './activity.mjs';
+import { emojisOf, pollOf, isContentType, trimActivity, reactionOf, quoteOf, quotePolicyOf, authorOf } from './activity.mjs';
+
+const idOf = (v) => (typeof v === 'string' ? v : v?.id);
 
 // §7.6 Add / §7.9 Remove. The side effect would be to add or remove the object
 // to/from the collection named in `target` — but only a collection we own AND
@@ -104,7 +106,7 @@ export async function onFollow(intake, activity, actor, { trusted = false } = {}
 
 export async function onUndo(intake, activity, actor, { trusted = false } = {}) {
   const inner = activity.object && typeof activity.object === 'object' ? activity.object : null;
-  if (inner?.type === 'Like' || inner?.type === 'Announce') return onUndoReaction(intake, inner, actor, { trusted });
+  if (inner?.type === 'Like' || inner?.type === 'Announce' || inner?.type === 'EmojiReact') return onUndoReaction(intake, inner, actor, { trusted });
   // AS2 allows `object` to be a bare IRI, and that IRI is exactly the Follow
   // id we stored. Reading `.type` off a string gives undefined, so the whole
   // Undo was dropped — silently, since handle() reads that as handled, so no
@@ -290,6 +292,15 @@ export async function onUndoReaction(intake, inner, actor, { trusted = false } =
   const objectId = typeof target === 'string' ? target : target?.id;
   if (!objectId) return;
   if (objectId.startsWith(intake.urls.notes)) {
+    // An emoji taken back: the one reaction it names, by that sender.
+    const reaction = reactionOf(inner);
+    if (reaction) {
+      const gone = intake.store.removeNotifications(n => n.type === 'reaction' && n.actor === actor
+        && n.noteId === objectId && n.emoji === reaction.emoji);
+      if (gone) intake.log(`reaction ${reaction.emoji} withdrawn by ${actor} on ${objectId}`);
+      return;
+    }
+    if (inner.type === 'EmojiReact') return;
     const type = inner.type === 'Like' ? 'favourite' : 'reblog';
     const gone = intake.store.removeNotifications(n => n.type === type && n.actor === actor && n.noteId === objectId);
     if (gone) intake.log(`${inner.type} withdrawn by ${actor} on ${objectId}`);
@@ -369,6 +380,9 @@ export async function onDelete(intake, activity, actor) {
   }
   const s = intake.store.getStatuses().find(x => x.noteId === objectId);
   if (s) await intake.forget(s);
+  if (s && intake.onCarriedGone) {
+    await intake.onCarriedGone({ noteId: objectId, actor }).catch(e => intake.log(`carried gone ${objectId}: ${e.message}`));
+  }
   intake.log(`deleted upstream: ${objectId}`);
 }
 
@@ -401,9 +415,16 @@ export async function onUpdate(intake, activity, actor) {
   const attachments = attachmentsOf(note);
   const freshPoll = pollOf(note);
   const freshEmojis = emojisOf(note);
+  // A quote's authorization arrives on an Update, once the quoted author
+  // has answered: the quote is checked again, and the policy follows the edit.
+  const quote = quoteOf(note);
+  const quoteState = quote ? await intake.quoteStateOf(note, quote) : null;
+  const quotePolicy = quotePolicyOf(note, s.actor);
   intake.store.updateStatus(objectId, {
     content, ...(attachments.length ? { attachments } : {}),
     emojis: freshEmojis.length ? freshEmojis : undefined,
+    quote: quote || undefined, quoteState: quoteState || undefined,
+    quotePolicy: quotePolicy || undefined,
     // The edit's own stamp when the note carries one; tallies and the
     // content warning follow the edit too. A poll refresh keeps our vote.
     editedAt: note.updated || new Date().toISOString(),
@@ -412,6 +433,9 @@ export async function onUpdate(intake, activity, actor) {
       poll: { ...freshPoll, voted: !!s.poll?.voted, ownVotes: s.poll?.ownVotes || [] },
     } : {}),
   });
+  if (intake.onCarriedEdit) {
+    await intake.onCarriedEdit({ noteId: objectId, actor, note }).catch(e => intake.log(`carried edit ${objectId}: ${e.message}`));
+  }
   intake.log(`edited upstream: ${objectId}`);
 }
 
@@ -427,6 +451,8 @@ export async function onUpdate(intake, activity, actor) {
 // the timeline goes quiet. `followActivity` is stored by followActor
 // (lib/social.mjs) for exactly this kind of comparison.
 export async function onReject(intake, activity, actor, { trusted = false } = {}) {
+  const asked = quoteAsked(intake, activity);
+  if (asked) return onQuoteAnswered(intake, asked, activity, actor, 'Reject');
   if (activity.object?.type && activity.object.type !== 'Follow') return;
   const contacts = intake.store.getContacts();
   const rec = contacts.following.find(f => f.actor === actor);
@@ -475,6 +501,8 @@ export async function onMove(intake, activity, actor) {
 }
 
 export async function onAccept(intake, activity, actor, { trusted = false } = {}) {
+  const asked = quoteAsked(intake, activity);
+  if (asked) return onQuoteAnswered(intake, asked, activity, actor, 'Accept');
   const contacts = intake.store.getContacts();
   const rec = contacts.following.find(f => f.actor === actor);
   // It has to answer the Follow we actually sent. followActor stores that
@@ -497,3 +525,109 @@ export async function onAccept(intake, activity, actor, { trusted = false } = {}
     intake.log(`follow accepted by ${actor}`);
   }
 }
+
+// --- quotes (FEP-044f) ---
+
+// The post of ours whose quote request this Accept or Reject answers, if any.
+// Matched on the request id we sent, which only the quoted author was given.
+function quoteAsked(intake, activity) {
+  const named = idOf(activity.object);
+  if (!named) return null;
+  return intake.store.getStatuses().find(x => x.kind === 'post' && x.quoteRequest?.id === named) || null;
+}
+
+// The quoted author's answer. A yes carries their authorization, a document
+// at their origin naming our post and theirs — fetched and compared, not
+// believed from the envelope; then the note says so to everyone who has it.
+// A no takes the quote off the note.
+async function onQuoteAnswered(intake, s, activity, actor, type) {
+  if (actor !== s.quoteRequest?.actor) {
+    intake.log(`${type} of our quote request from ${actor}, who is not ${s.quoteRequest?.actor} — ignored`);
+    return;
+  }
+  if (type === 'Reject') {
+    if (s.quoteState === 'rejected') return;
+    await intake.publisher.withdrawQuote(s);
+    return;
+  }
+  if (s.quoteState === 'accepted') return;
+  const resultId = idOf(activity.result);
+  if (!resultId || !intake.sameIdentity(resultId, actor)) return `Accept of a quote request carries no authorization at ${actor}`;
+  const auth = await intake.fetchAP(resultId);
+  if (!auth) throw new Error(`cannot fetch quote authorization ${resultId} — will retry`);
+  const ok = auth.id === resultId && auth.type === 'QuoteAuthorization'
+    && [].concat(auth.attributedTo || []).map(idOf).includes(actor)
+    && idOf(auth.interactingObject) === s.noteId && idOf(auth.interactionTarget) === s.quote;
+  if (!ok) return `quote authorization ${resultId} does not say ${s.noteId} may quote ${s.quote}`;
+  await intake.publisher.authorizeQuote(s, resultId);
+}
+
+// Someone asks to quote one of our posts. Their post is read at its origin,
+// like every note that arrives — it has to be theirs, and has to quote ours.
+// A post the world can read may be quoted by anyone; a followers-only or
+// direct one by nobody. The answer is an Accept carrying our authorization,
+// written beside the post, or a Reject. The quoting post is then kept the
+// way a mention of ours is, under the one notification a quote raises.
+export async function onQuoteRequest(intake, activity, actor) {
+  const objectId = idOf(activity.object);
+  const instrumentId = idOf(activity.instrument);
+  if (!objectId || !instrumentId) return 'QuoteRequest without object or instrument';
+  // A followers-only post lives in the private container; a follower may
+  // know its id and ask. It is ours, and the answer below is no.
+  const ours = objectId.startsWith(intake.urls.notes)
+    || (intake.urls.privateNotes && objectId.startsWith(intake.urls.privateNotes));
+  if (!ours) {
+    intake.log(`QuoteRequest from ${actor} names ${objectId}, not a post of ours — ignored`);
+    return;
+  }
+  if (!intake.sameIdentity(instrumentId, actor)) return `QuoteRequest instrument/actor identity mismatch (${instrumentId})`;
+  const s = intake.store.getStatuses().find(x => x.noteId === objectId && x.kind === 'post');
+  if (!s) return `QuoteRequest for a post we do not hold (${objectId})`;
+  // Not retried on failure: the instrument is a URL a stranger chose.
+  const note = await intake.fetchAP(instrumentId);
+  if (!note) return `quote request: instrument fetch failed (${instrumentId})`;
+  if (note.id !== instrumentId || !isContentType(note.type)) return `quote request: instrument is not verifiable content (${instrumentId})`;
+  if (authorOf(note, actor) !== actor) return `quote request: ${instrumentId} is not by ${actor}`;
+  if (quoteOf(note) !== objectId) return `quote request: ${instrumentId} does not quote ${objectId}`;
+  const doc = await intake.fetchAP(actor);
+  const inbox = doc?.endpoints?.sharedInbox || doc?.inbox;
+  if (!inbox) return `quote request: no inbox for ${actor}`;
+  const { quoteAnswerActivity } = await import('../wire-quotes.mjs');
+  const open = !s.visibility || s.visibility === 'public' || s.visibility === 'unlisted';
+  if (!open) {
+    await intake.deliverer.deliver(inbox,
+      quoteAnswerActivity({ urls: intake.urls, type: 'Reject', request: activity, to: actor, serial: intake.serial++ }));
+    intake.log(`quote refused: ${instrumentId} asked to quote ${objectId}, which is not public`);
+    return;
+  }
+  const authorization = await intake.publisher.grantQuote(objectId, instrumentId);
+  await intake.deliverer.deliver(inbox,
+    quoteAnswerActivity({ urls: intake.urls, type: 'Accept', request: activity, result: authorization, to: actor, serial: intake.serial++ }));
+  const held = intake.store.getStatuses().find(x => x.noteId === instrumentId);
+  if (!held) {
+    // The origin's copy, already fetched above.
+    const rejected = await intake.ingestNote(instrumentId, actor, { inline: note });
+    if (rejected) intake.log(`quote of ${objectId} by ${actor}: ${rejected}`);
+  } else if (held.quoteState !== 'accepted') {
+    intake.store.updateStatus(instrumentId, { quote: objectId, quoteState: 'accepted' });
+  }
+  intake.store.addNotification({ type: 'quote', actor, noteId: instrumentId });
+  intake.log(`quote allowed: ${instrumentId} quotes ${objectId}`);
+}
+
+// What can be said about a note's quote. The quoted post is ours: allowed if
+// we granted it. Elsewhere: allowed when the note carries an authorization
+// that, fetched from the quoted post's own origin, names this note and that
+// one. Otherwise pending — the honest word for a quote nobody has vouched for.
+export async function quoteStateOf(intake, note, quote) {
+  if (quote.startsWith(intake.urls.notes)) {
+    const target = intake.store.getStatuses().find(x => x.noteId === quote);
+    return (target?.quotedBy || []).some(q => q.note === note.id) ? 'accepted' : 'pending';
+  }
+  const authId = idOf(note.quoteAuthorization);
+  if (!authId || !intake.sameIdentity(authId, quote)) return 'pending';
+  const auth = await intake.fetchAP(authId).catch(() => null);
+  const ok = auth && auth.id === authId && auth.type === 'QuoteAuthorization'
+    && idOf(auth.interactingObject) === note.id && idOf(auth.interactionTarget) === quote;
+  return ok ? 'accepted' : 'pending';
+}

package/lib/core/intake/activity.mjs

@@ -130,7 +130,32 @@ export function trimActivity(a) {
     if (v) out[k] = String(v).slice(0, 2048);
   }
   const obj = idOf(a.object);
-  if (obj) out.object = String(obj).slice(0, 2048);
+  if (obj) {
+    // An Update says what to change INSIDE its object — a topic's new name, or
+    // whether it is closed — so flattening the object to its id alone threw the
+    // instruction away and left a bare topic id that meant nothing. Close,
+    // reopen and rename all arrived at the queue saying only which topic, and
+    // the moderator watched them do nothing. Kept now, bounded, and only the
+    // two fields a moderation queue acts on: everything else is still dropped.
+    const asked = a.object && typeof a.object === 'object' ? a.object : null;
+    const said = {};
+    if (asked) {
+      if (typeof asked.name === 'string') said.name = asked.name.slice(0, 300);
+      // `false` is the whole of a reopen, so presence is what counts, not truth.
+      if ('closed' in asked) {
+        // A date stays a date; a boolean stays a boolean; and the STRINGS
+        // "true"/"false" — which is what a boolean looks like after a form, a
+        // template or an RDF round trip — become the booleans they mean,
+        // because `!!"false"` is true and would turn a reopen into a close.
+        const v = asked.closed;
+        said.closed = v === 'false' ? false : v === 'true' ? true
+          : typeof v === 'string' ? v.slice(0, 64) : !!v;
+      }
+    }
+    out.object = Object.keys(said).length
+      ? { id: String(obj).slice(0, 2048), ...said }
+      : String(obj).slice(0, 2048);
+  }
   // A typed object with no id still says what it was — a Block of nobody, an
   // Undo of a Follow — and that is the whole of what the queue reads.
   else if (a.object && typeof a.object === 'object' && a.object.type) {
@@ -238,3 +263,56 @@ export function authorOf(note, delivered = null) {
   // post. See sameIdentity.
   return sameIdentity(note?.id, author) ? author : null;
 }
+
+// A reaction: an emoji somebody put on a post. Pleroma, Akkoma, Misskey and
+// Sharkey send EmojiReact; Misskey also sends a Like whose `content` is the
+// emoji, which is what its own users see as a reaction. Either way the
+// emoji is the content — a unicode character, or `:name:` for a custom one
+// whose image rides the tag list. Null when the activity is a plain Like.
+export const MAX_REACTION_CHARS = 64;
+export function reactionOf(activity) {
+  if (!activity || (activity.type !== 'EmojiReact' && activity.type !== 'Like')) return null;
+  const content = typeof activity.content === 'string' ? activity.content.trim() : '';
+  if (!content) return null;
+  const emoji = content.slice(0, MAX_REACTION_CHARS);
+  const bare = emoji.replace(/^:|:$/g, '');
+  const custom = emojisOf(activity).find(e => e.shortcode === bare);
+  return { emoji, ...(custom ? { url: custom.url } : {}) };
+}
+
+// What a note quotes, whichever way its server says it. Mastodon writes
+// FEP-044f's `quote` alongside the two older spellings, Fedibird's quoteUri
+// and Misskey's _misskey_quote; Pleroma writes quoteUrl; FEP-e232 puts a Link
+// in the tag list with the Misskey relation. One post, one quote.
+const QUOTE_REL = 'https://misskey-hub.net/ns#_misskey_quote';
+export function quoteOf(note) {
+  const idOf = (v) => (typeof v === 'string' ? v : v?.id);
+  const named = [note?.quote, note?.quoteUri, note?._misskey_quote, note?.quoteUrl]
+    .map(v => idOf(Array.isArray(v) ? v[0] : v)).find(Boolean);
+  const linked = [].concat(note?.tag || []).find(t => t?.type === 'Link' && t.href
+    && [].concat(t.rel || []).includes(QUOTE_REL))?.href;
+  const q = named || linked;
+  return q && q !== note?.id ? httpOnly(String(q).slice(0, MAX_URL_CHARS)) : null;
+}
+
+// Who the author lets quote a post: their interaction policy's canQuote, in
+// the words a client uses. The public collection is `public`; the author's
+// own followers or following collections are `followers` and `following`.
+// Null when the note says nothing, which is the common case on servers that
+// predate the policy.
+export function quotePolicyOf(note, author) {
+  const can = note?.interactionPolicy?.canQuote;
+  if (!can || typeof can !== 'object') return null;
+  const word = (v) => {
+    const id = typeof v === 'string' ? v : v?.id;
+    if (!id) return null;
+    if (id === 'https://www.w3.org/ns/activitystreams#Public' || id === 'as:Public' || id === 'Public') return 'public';
+    if (author && sameIdentity(id, author)) {
+      if (/\/followers\/?$/u.test(id)) return 'followers';
+      if (/\/following\/?$/u.test(id)) return 'following';
+    }
+    return null;
+  };
+  const list = (v) => [...new Set([].concat(v || []).map(word).filter(Boolean))];
+  return { automatic: list(can.automaticApproval), manual: list(can.manualApproval) };
+}

package/lib/core/intake/group.mjs

@@ -9,6 +9,9 @@ import { trimActivity, MAX_MODQUEUE, MAX_PENDING_REVIEW, CO_MEMBER_TTL_MS, CO_ME
 // moderator's ordinary traffic (their posts, likes, follows) is not
 // moderation and takes the normal arms.
 export function isModerationAsk(intake, activity) {
+  // What a forum holds beyond a group's own asks: a topic removed or moved,
+  // a post deleted out of a topic, a report.
+  if (intake.isModerationAskExtra?.(activity)) return true;
   if (activity.type === 'Block') return true;
   if (activity.type === 'Undo') {
     return typeof activity.object === 'object' && activity.object?.type === 'Block';
@@ -78,14 +81,34 @@ export async function amplify(intake, noteId, { approved = false, activity = nul
   // A DM to the group, or a followers-only post it happened to receive, was
   // addressed to less than the world — carrying it would widen the author's
   // audience for them. A group only ever amplifies public posts.
-  if (s.direct || s.nonPublic) {
+  //
+  // Except a PRIVATE group, where that reasoning runs backwards. Its members
+  // write to the group and to nobody else on purpose, and its membership is
+  // exactly the people already allowed to read what they write; refusing the
+  // carry there would mean a private group could only carry posts its author
+  // had published to the world. So a group told it is private carries what is
+  // addressed to it. A DM is still a DM and is still never carried.
+  if (s.direct || (s.nonPublic && !intake.config.private)) {
     intake.log(`not amplified — ${noteId} was not addressed publicly, and a group never widens a post's audience`);
     return;
   }
   const contacts = intake.store.getContacts();
   if (!contacts.followers.some(f => f.actor === s.actor)) {
-    intake.log(`not amplified — ${s.actor} is not a member`);
-    return;
+    // A group carries its members and nobody else. A forum may choose to
+    // HOLD a stranger's reply for a moderator instead of dropping it, which
+    // is what `replyPolicy` says; the group itself still carries nothing it
+    // has not been told to.
+    if (intake.onStranger) {
+      const held = await intake.onStranger({ noteId, actor: s.actor, activity }).catch(() => false);
+      if (held) { intake.log(`held for a moderator — ${s.actor} is not a member`); return; }
+    }
+    // The hook may have made them one — a forum whose categories are open
+    // treats posting into one as joining it. So ask the record again rather
+    // than the copy taken before the hook ran.
+    if (!intake.store.getContacts().followers.some(f => f.actor === s.actor)) {
+      intake.log(`not amplified — ${s.actor} is not a member`);
+      return;
+    }
   }
   if (intake.store.getMuted().actors.includes(s.actor)) {
     intake.log(`not amplified — ${s.actor} is muted`);
@@ -155,6 +178,17 @@ export async function amplify(intake, noteId, { approved = false, activity = nul
   await intake.publisher.recordOutbox(act);
   intake.store.setPending(intake.store.getPending().filter(p => p.noteId !== noteId));
   intake.log(`amplified ${noteId} → ${inboxes.length} inbox(es)`);
+  // What the group carried is what the group's conversation holds. A forum
+  // places the post in its topic here — after the carry, so only what the
+  // category vouched for is in the topic (FEP-7888 ownership). Its failure
+  // never undoes the carry.
+  if (intake.onCarried) {
+    // Both: what the group said (the Announce) and what its author sent. A
+    // forum reads the author's own activity — the name they gave the topic
+    // they were opening is on that one, and on no other.
+    await intake.onCarried({ noteId, actor: s.actor, activity: act, sent: activity })
+      .catch(e => intake.log(`after the carry of ${noteId}: ${e.message}`));
+  }
   // The same carry, shown natively to the group's Bluesky followers.
   await intake.bskyGroup?.mirrorCarry(s)
     .catch(e => intake.log(`bluesky mirror of the carry failed: ${e.message}`));

package/lib/core/intake/index.mjs

@@ -24,7 +24,7 @@
 
 import * as podInbox from '../../pod/inbox.mjs';
 import { readCapped } from '../../shared/safefetch.mjs';
-import { trimActivity, sameIdentity, sameOrigin, httpUrl, MAX_ITEM_BYTES, MAX_FORWARDS_PER_DRAIN } from './activity.mjs';
+import { trimActivity, sameIdentity, sameOrigin, httpUrl, reactionOf, MAX_EMOJIS, MAX_ITEM_BYTES, MAX_FORWARDS_PER_DRAIN } from './activity.mjs';
 import * as channel from './channel.mjs';
 import * as verify from './verify.mjs';
 import * as group from './group.mjs';
@@ -322,6 +322,9 @@ export class Intake {
     }
     this.lastDrain = new Date().toISOString();
     this.lastDrainAtMs = Date.now();
+    // What a drain leaves behind may need acting on: a forum's queue of asks,
+    // which is filled here and emptied by whoever can vouch for them.
+    if (this.afterDrain) setTimeout(() => this.afterDrain(), 0);
     this._pruneAttempts();
     let all;
     try {
@@ -548,7 +551,8 @@ export class Intake {
       case 'Undo': return this.onUndo(activity, actor, { trusted });
       case 'Create': return this.onCreate(activity, actor, { trusted });
       case 'Accept': return this.onAccept(activity, actor, { trusted });
-      case 'Like': case 'Announce': {
+      case 'QuoteRequest': return this.onQuoteRequest(activity, actor, { trusted });
+      case 'Like': case 'Announce': case 'EmojiReact': {
         // FEP-1b12: a group Announces the member's whole Create, not the note.
         // Without unwrapping we try to ingest a Create as if it were a Note and
         // dead-letter every post a group ever carries — including our own.
@@ -564,6 +568,29 @@ export class Intake {
           && (wrapped.type === 'Create' || wrapped.type === 'Update')) ? wrapped.object : wrapped;
         const objectId = typeof inner === 'string' ? inner : inner?.id;
         this.log(`${activity.type} from ${actor} on ${objectId}`);
+        // An emoji on one of our posts. Recorded the way a Like is — on the
+        // sender's word, nothing to dereference — with the emoji itself, and
+        // a custom emoji's image added to the post's own list so a client
+        // that draws reactions from there finds it. Anything else an
+        // EmojiReact names is not ours to notice.
+        const reaction = activity.type !== 'Announce' ? reactionOf(activity) : null;
+        if (reaction) {
+          if (!objectId || !objectId.startsWith(this.urls.notes)) return;
+          this.store.addNotification({
+            type: 'reaction', actor, noteId: objectId, emoji: reaction.emoji,
+            ...(reaction.url ? { url: reaction.url } : {}),
+            ...(this.known(actor) ? {} : { unverified: true }),
+          });
+          if (reaction.url) {
+            const s = this.store.getStatuses().find(x => x.noteId === objectId);
+            const shortcode = reaction.emoji.replace(/^:|:$/g, '');
+            if (s && !(s.emojis || []).some(e => e.shortcode === shortcode) && (s.emojis || []).length < MAX_EMOJIS) {
+              this.store.updateStatus(objectId, { emojis: [...(s.emojis || []), { shortcode, url: reaction.url }] });
+            }
+          }
+          return;
+        }
+        if (activity.type === 'EmojiReact') return;
         if (objectId && objectId.startsWith(this.urls.notes)) {
           // Nothing vouches for this actor: a Like carries no signature and,
           // unlike a Create, has no object at the sender's origin to re-read.
@@ -585,6 +612,7 @@ export class Intake {
       case 'Move': return this.onMove(activity, actor);
       case 'Add': case 'Remove': return this.onAddRemove(activity, actor);
       case 'Block': return this.onBlock(activity, actor, { trusted });
+      case 'Flag': if (this.onReport) return this.onReport(activity, actor, { trusted }); return;
       default: this.log(`ignored ${activity.type} from ${actor}`);
     }
   }
@@ -641,6 +669,8 @@ export class Intake {
   onCreate(...a) { return activities.onCreate(this, ...a); }
   onAnnouncedDelete(...a) { return activities.onAnnouncedDelete(this, ...a); }
   onAnnounce(...a) { return activities.onAnnounce(this, ...a); }
+  onQuoteRequest(...a) { return activities.onQuoteRequest(this, ...a); }
+  quoteStateOf(...a) { return activities.quoteStateOf(this, ...a); }
   onDelete(...a) { return activities.onDelete(this, ...a); }
   onUpdate(...a) { return activities.onUpdate(this, ...a); }
   onReject(...a) { return activities.onReject(this, ...a); }

package/lib/core/intake/notes.mjs

@@ -6,7 +6,7 @@
 import * as podNotes from '../../pod/notes.mjs';
 import { PUBLIC } from '../wire.mjs';
 import * as polls from '../polls.mjs';
-import { httpOnly, emojisOf, pollOf, isContentType, authorOf, MAX_MENTIONS, MAX_URL_CHARS, MAX_REPLIES_RECORDED, MAX_FORWARDED, FORWARDABLE, FORWARD_TYPES } from './activity.mjs';
+import { httpOnly, emojisOf, pollOf, isContentType, authorOf, quoteOf, quotePolicyOf, MAX_MENTIONS, MAX_URL_CHARS, MAX_REPLIES_RECORDED, MAX_FORWARDED, FORWARDABLE, FORWARD_TYPES } from './activity.mjs';
 
 // Does this activity/note concern us at all? Either it comes from someone
 // we follow, or it names us (to/cc, mention tag) or replies to one of our
@@ -21,6 +21,9 @@ export function concernsUs(intake, doc, actor) {
   const tagged = [].concat(doc?.tag || [])
     .some(t => t?.type === 'Mention' && (t.href === intake.urls.actor || t.name?.includes(intake.urls.actor)));
   if (tagged) return true;
+  // A post that quotes one of ours is about us as much as a reply is.
+  const quoted = quoteOf(doc);
+  if (quoted && quoted.startsWith(intake.urls.notes)) return true;
   const inReplyTo = typeof doc?.inReplyTo === 'string' ? doc.inReplyTo : doc?.inReplyTo?.id;
   if (!inReplyTo) return false;
   if (String(inReplyTo).startsWith(intake.urls.notes)) return true;
@@ -130,6 +133,9 @@ export async function ingestNote(intake, objectId, actor, { via, inline = null }
   // signed Announce to every member.
   const author = authorOf(note, actor);
   if (!author) return `object names an author its origin does not vouch for (${objectId})`;
+  // The verified document, kept for whoever acts on this note after the
+  // carry: a forum caches it for its readers. Only when someone asked.
+  intake.recentNotes?.set(note.id, note);
   // This is the check that catches a blocked actor reaching us through
   // somebody else's boost, or through a hashtag feed.
   if (intake.store.isBlocked(author)) return `blocked author (${author})`;
@@ -197,6 +203,13 @@ export async function ingestNote(intake, objectId, actor, { via, inline = null }
     .filter(t => t.name);
   const emojis = emojisOf(note);
   const poll = pollOf(note);
+  // What the note quotes, and what its author lets others quote. The quoted
+  // post is fetched and kept so the quote can be shown whole; whether the
+  // quote was allowed is checked, never assumed.
+  const quote = quoteOf(note);
+  const quotePolicy = quotePolicyOf(note, author);
+  const quoteState = quote ? await intake.quoteStateOf(note, quote) : null;
+  if (quote) await holdQuoted(intake, quote);
   // Explicitly addressed, but to nobody public and to no followers
   // collection: a direct message, which belongs to the conversations view
   // rather than a timeline. A note with no addressing at all is NOT direct —
@@ -220,15 +233,21 @@ export async function ingestNote(intake, objectId, actor, { via, inline = null }
     ...(emojis.length ? { emojis } : {}),
     ...(mentions.length ? { mentions } : {}),
     ...(attachments.length ? { attachments } : {}),
+    ...(quote ? { quote, quoteState } : {}),
+    ...(quotePolicy ? { quotePolicy } : {}),
     ...(via ? { via } : {}),
   });
   // A notification for anything addressed to this person: a stranger's
   // post, a reply to one of ours, a direct message, or a post that names
   // us — whoever sent it. A direct message from someone followed used to
-  // raise nothing and sat unseen in the private mentions.
+  // raise nothing and sat unseen in the private mentions. A post quoting
+  // one of ours is its own kind of notification.
   const namesUs = mentions.some((m) => m.href === intake.urls.actor);
   const replyToOurs = !!note.inReplyTo && String(note.inReplyTo).startsWith(intake.urls.notes);
-  if (!followed || replyToOurs || direct || namesUs) {
+  const quotesUs = !!quote && quote.startsWith(intake.urls.notes);
+  if (quotesUs) {
+    intake.store.addNotification({ type: 'quote', actor: author, noteId: note.id });
+  } else if (!followed || replyToOurs || direct || namesUs) {
     intake.store.addNotification({ type: 'mention', actor: author, noteId: note.id });
   }
   if (note.inReplyTo && String(note.inReplyTo).startsWith(intake.urls.notes)) {
@@ -238,6 +257,44 @@ export async function ingestNote(intake, objectId, actor, { via, inline = null }
   intake.log(`${kind}: ${note.id}${via ? ` (boosted by ${via})` : ''}`);
 }
 
+// The post a quote shows: fetched at its origin and kept out of every
+// timeline (`remote`), the way a thread's ancestors are — it is there to be
+// shown inside the quoting post, not on its own. Nothing is fetched twice,
+// and nothing is followed further: a quote of a quote shows one level.
+export async function holdQuoted(intake, quoteId) {
+  if (intake.store.getStatuses().some(s => s.noteId === quoteId)) return;
+  if (intake.store.isBlocked(quoteId)) return;
+  const q = await intake.fetchAP(quoteId).catch(() => null);
+  if (!q || q.id !== quoteId || !isContentType(q.type)) {
+    intake.log(`quoted post ${quoteId} could not be read — the quote shows without it`);
+    return;
+  }
+  const by = authorOf(q, null);
+  if (!by || intake.store.isBlocked(by)) return;
+  const { attachmentsOf, titledContent } = await import('../wire.mjs');
+  const attachments = attachmentsOf(q);
+  const emojis = emojisOf(q);
+  const poll = pollOf(q);
+  const quotePolicy = quotePolicyOf(q, by);
+  const mentions = [].concat(q.tag || [])
+    .filter(t => t?.type === 'Mention' && t.href && t.name)
+    .slice(0, MAX_MENTIONS)
+    .map(t => ({ href: httpOnly(String(t.href).slice(0, MAX_URL_CHARS)), name: String(t.name).slice(0, 256) }))
+    .filter(m => m.href);
+  intake.store.addStatus({
+    noteId: q.id, actor: by, content: titledContent(q),
+    published: q.published, inReplyTo: q.inReplyTo, kind: 'remote',
+    ...(q.summary ? { spoiler: String(q.summary).replace(/<[^>]*>/g, '') } : {}),
+    ...(q.sensitive === true ? { sensitive: true } : {}),
+    ...(poll ? { poll } : {}),
+    ...(emojis.length ? { emojis } : {}),
+    ...(mentions.length ? { mentions } : {}),
+    ...(attachments.length ? { attachments } : {}),
+    ...(quotePolicy ? { quotePolicy } : {}),
+  });
+  intake.log(`quoted post kept: ${q.id}`);
+}
+
 // Drop a post we were holding. A group that carried it also unsays its own
 // Announce — forwarding the author's Delete would be signed by us and not by
 // them, which receivers are right to refuse.

package/lib/core/lease.mjs

@@ -21,11 +21,21 @@ const JITTER = () => 0.85 + Math.random() * 0.3;
 const UNREADABLE = Symbol('lease-unreadable');
 
 export class Lease {
-  constructor({ url, fetchImpl, log = console.log }) {
+  // `id` names the HOLDER, and acquire() lets a holder reclaim its own lease
+  // without waiting for the TTL — so whether it is stable decides whether a
+  // restart is the same agent coming back or a second one arriving. A process
+  // that is gone for good wants a new one each time; a browser does not, since
+  // its agent lives in a service worker the browser is free to kill and restart
+  // whenever it likes. Left to the default, every one of those restarts looked
+  // like another device and asked the owner to take over their own account —
+  // which is what switching between the two clients did, because that is a
+  // navigation and a navigation can take the worker with it. The browser build
+  // passes one it keeps.
+  constructor({ url, fetchImpl, log = console.log, id = null }) {
     this.url = url;
     this.fetchImpl = fetchImpl;
     this.log = log;
-    this.id = crypto.randomUUID();
+    this.id = id || crypto.randomUUID();
     this.stopped = false;
     this.timer = null;
     this.heldUntil = 0;   // wall-clock end of the lease we last wrote