fedipod 1.36.6 → 1.40.0

package/README.md

@@ -4,7 +4,9 @@
 
 FediPod gives you a Fediverse account whose data lives on a Solid pod. You
 follow people on Mastodon, Bluesky, and other Fediverse or ATProto servers in
-one timeline. Your posts, followers and settings stay on your pod.
+one timeline. Your posts, followers and settings are kept on your pod. While fedipod.net
+keeps your account running, it works from a copy of them and writes it to your
+pod every fifteen minutes; your signing key never leaves your pod.
 
 The easiest way to run FediPod is to use it in any browser at https://fedipod.net. Nothing to install. Sign-up points you to a pod provider if you need a pod, then attaches a Fediverse identity to the pod you sign in with.
 
@@ -23,6 +25,11 @@ This README is about the `FediPod BrowserAgent`. There are also a number of [oth
 2. Choose your pod provider. You'll be redirected to your provider to login if you have a pod or sign up if you need to create one.
 3. Back on fedipod.net, choose your handle and where your address lives:
    on your pod, `@handle@yourpod`, or at this site, `@handle@fedipod.net`.
+   Choose where on your pod your data goes: a container named `fedipod`,
+   inside whichever container you name (your pod's root if you leave it
+   empty). If your pod has no public type index yet, you're asked whether
+   to create one; FediPod records there where your account lives, and
+   nothing is set up without it.
 4. You see your Fediverse timeline.
 
 From now on, anyone can open your profile at `https://fedipod.net/@handle@provider`, signed in or not.
@@ -71,6 +78,10 @@ an alias, so a Move from it lands here.
 client-to-server, dokieli for one, can post as you. It sends to the outbox
 address in your actor document, which your WebID profile also names, signed in
 at your pod. The post goes out the next time you open fedipod.net.
+If your account turns a post down when it runs, you get a direct message from
+yourself saying what was refused and why. Signed in, your outbox shows you
+everything you've done, likes and follows included; everyone else sees only
+your public posts.
 
 **The manage page.** `manage`, in the bar's account group, opens it: your profile,
 aliases, the gateway, key rotation, recovering posts, parking, moving to
@@ -83,14 +94,16 @@ there it takes over; the first drops back to reading.
 
 ## What the browser version does not do
 
-- **Scheduled posts.** Nothing runs between now and the time you picked, so
+- **Scheduled posts, if you stop fedipod.net keeping your account running.**
+  It does by default, and publishes them while FediPod is closed. Turned off
+  on the manage page, nothing runs between now and the time you picked, so
   the composer refuses one rather than dropping it later.
-- **Notifications while the client is closed.** There is no push service.
-  Open the tab and they are there.
+- **Notifications, and other clients, if you stop fedipod.net keeping your
+  account running.** While it does (the default), any Mastodon app, phone or
+  desktop, can use your account with `fedipod.net` as its server, and an app
+  that offers notifications gets them on your phone with everything closed.
 - **Live updates.** The client refreshes by polling.
 - **Hosting a group.** Joining one works.
-- **Other clients.** A phone app or desktop client has nothing on the network
-  to connect to.
 
 For these, see [Other ways to run FediPod](#other-ways-to-run-fedipod).
 
@@ -98,7 +111,15 @@ For these, see [Other ways to run FediPod](#other-ways-to-run-fedipod).
 
 Everything you publish and everything you read is stored on your pod. Your
 signing key is stored there too, in a container only you can read through
-your pod's login. fedipod.net holds no key: it verifies incoming mail, drops
+your pod's login.
+While fedipod.net keeps your account running, its own pod identity can read
+that container too, so it can act for you while FediPod is closed, and it
+works from a copy of your account's data that it writes back to your pod every
+fifteen minutes. Your key stays on your pod only.
+It all lives in the `fedipod` container you chose at sign-up. Your pod's
+public type index records it, as an ActivityStreams actor, which is how
+FediPod and other Solid apps find your account again.
+ fedipod.net holds no key: it verifies incoming mail, drops
 the junk, forwards the rest to your pod, and hands your browser the app.
 With an address on your pod, `@handle@yourpod`, you can detach from it at
 any time and attach to a gateway of your own; your address and your data do
@@ -106,7 +127,7 @@ not change.
 
 ## Other ways to use FediPod
 
-- [fediverse-account]() - an ESM library that supports both Solid-based and regular Fediverse accounts with methods to login, reply, boost, etc.
+- [fediverse-session](lib/session/README.md) - an ESM library that supports both Solid-based and regular Fediverse accounts with methods to login, reply, boost, etc.
 - [FediPod Server](packages/fedipod-server/README.md): a full ActivityPub
   server as a Community Solid Server component, giving every pod on the server
   the option of a Fediverse account.

package/architecture.md

@@ -16,6 +16,14 @@ and forwards the rest to the pod inbox with a receipt. It holds no key. The
 browser version always has one; the DeviceAgent may use one. Any
 lightweight host will do, Netlify included.
 
+A gateway can also keep a browser account running. It then acts as that
+account's agent whenever FediPod is closed, under a pod identity of its own
+that the owner's rules name, reading the signing key from the pod when it
+needs it. The account's state documents live in a working copy at the
+gateway, which FediPod in the browser, the gateway and any Mastodon app all
+work from, and which the gateway writes to the pod every fifteen minutes. See
+[the gateway](gateway.md).
+
 [FediPod Server](packages/fedipod-server/README.md) puts the agent inside a
 Community Solid Server, so anyone with a pod on that server can opt in to a
 Fediverse account fed by the server itself.

package/bin/fedipod.mjs

@@ -25,6 +25,12 @@
 //     --pod-name, --group, --summary, --icon, --root, --keys) keeps setup
 //     entirely on the command line, as does a non-TTY stdin. --cli forces it.
 //
+//     --in <container>  the container on the pod that holds `fedipod/`
+//                       (asked when not given; empty is the pod's root)
+//     --create-type-index  make a public type index when the pod has none;
+//                       where the account lives is recorded there, and
+//                       without one and without this, setup stops
+//
 //     The password is prompted (or AP_PASSWORD) — used once to create the
 //     account and/or mint a revocable CSS client-credential, never stored.
 //     Keys live in AP_HOME by default (the pod host cannot read them);

package/cli.md

@@ -32,10 +32,16 @@ prompt. `--profile NAME` names the new identity when you have more than one.
 `--address pod` (the default) puts your address on your pod, `@you@yourpod`;
 `--address front` puts it at a gateway, `@you@the-gateway`, with your posts,
 key and data still on your pod. `--gateway <url>` names the gateway
-(`https://fedipod.net` by default). A pod on a suffix-based host cannot
+(`https://fedipod.net` by default). A suffixed pod cannot
 answer WebFinger for a handle, so it always takes a gateway address, whichever
 `--address` you gave.
 
+Your data goes in a container named `fedipod`, inside the container you name
+with `--in <path>` (asked when you leave it out; empty is your pod's root). Where
+it lives is recorded in your pod's public type index. If your pod has none,
+setup asks before making one, and `--create-type-index` says yes in advance;
+without a yes, setup stops before anything is written.
+
 ## Which identity a command acts on
 
 `--profile NAME` works on every command, not just `up`; `AP_PROFILE` is the

package/device-agent.md

@@ -12,9 +12,9 @@ connect to it; and it can host a [group](groups.md).
 - Node 20 or newer.
 - A Solid pod, such as `https://alice.solidcommunity.net/` or
   `https://server.example/alice/`. The address is `@handle@yourpod`, or
-  `@handle@fedipod.net` when the pod is on a path of a shared host, since
-  the shared host cannot answer for the handle; the posts, key and data
-  stay on the pod either way.
+  `@handle@fedipod.net` when the pod is suffixed, since a suffixed pod
+  cannot answer for the handle; the posts, key and data stay on the pod
+  either way.
 - Followers-only and direct posts need a pod that enforces WAC access control;
   on one that does not, the composer refuses those two and says why.
 - While the agent is off, your mail waits on your pod's host. Run it as a

package/gateway.md

@@ -6,13 +6,16 @@ each delivery's signature where the headers still exist, drops forgeries and
 junk before they ever touch your pod, and passes the rest on with a receipt
 saying it checked.
 
-Your name, your signing key and your data stay on your own pod. The gateway is
+Your name, your signing key and your data are kept on your own pod. The gateway is
 **keyless** — it never holds the key you sign with, so it cannot post as you,
 read your private things, or be you anywhere. The worst a broken one can do is
 push items into your inbox, and those still face your agent's own checks.
 With the outbox door below, a gateway can also hand your agent a post marked as
 yours, which your agent then signs and sends. It still holds no key, but what you
-trust it with grows by that much.
+trust it with grows by that much. A browser account is also kept running by
+the gateway (below). That gives the gateway your key while it works, so it can
+post as you, as any Fediverse server can, and your account's working data is
+kept at the gateway too and written to your pod every fifteen minutes.
 
 A FediPod install works without any gateway at all. Deliveries go straight to
 your pod inbox, which holds them whether your agent is running or not.
@@ -32,7 +35,7 @@ password is typed anywhere:
    restarts the agent itself to publish under it.
 
 In the BrowserAgent the same choice is made once, at sign-up, and cannot be
-changed afterwards. A pod on a suffix-based host, like
+changed afterwards. A suffixed pod, like
 `https://server.example/alice/`, always takes the gateway-based name: nothing
 at that host answers for the handle, so the gateway does. Its posts, key and
 data stay on the pod.
@@ -153,10 +156,61 @@ on the setup page). Setup reads the account on the pod, keeps its state and
 key there, attaches at the new gateway, and completes the move when the
 agent first acts. See [the DeviceAgent](device-agent.md).
 
+## While your app is closed
+
+A browser account runs only while FediPod is open somewhere. While it is
+closed, fedipod.net does two things for it.
+
+**Your mail waits at the gateway.** Deliveries are kept there, not written to
+your pod one by one, and reach your pod in batches of up to a hundred: when you
+open FediPod, or every fifteen minutes otherwise. While FediPod is open, mail
+goes straight to your pod as before. A DeviceAgent's mail always goes straight
+to its pod.
+
+**The gateway keeps your account running.** Unless you turn it off, the
+gateway accepts your follows, tries again what failed to go out, and publishes
+the posts you scheduled, all while FediPod is closed. Other mail waits on your
+pod for FediPod to open, as before. It works under its own pod identity, which your app
+names in the access rules on your FediPod folder. It reads your signing key
+from your pod when it needs it, so it can post as you, and keeps no copy of the
+key. **Stop keeping it running** on the manage page takes it out of the rules.
+If fedipod.net ever changes its own pod identity, your FediPod moves your
+account over the next time you open it, with nothing for you to do.
+Scheduling a post is offered only while this is on, because otherwise nothing
+would be running when the time came.
+
+**Your account's working data is kept at the gateway.** While the gateway
+keeps your account running, your timeline, notifications, followers, settings
+and the rest of your FediPod state are kept at fedipod.net, and FediPod in your
+browser, the gateway and any app you use all work from that one copy, so they
+never disagree. fedipod.net writes what changed to your pod every fifteen
+minutes, and everything at once when you stop it keeping your account running,
+move your address or close it. Your signing key and the passwords of accounts
+you connected elsewhere are never in the copy; they stay on your pod only.
+
+## Using any Mastodon app
+
+While the gateway keeps your account running, any Mastodon app can use it:
+elk.zone, Ivory, Tusky, Phanpy and the rest. In the app, give `fedipod.net` as
+your server. The app sends you to a fedipod.net page that asks for your
+address here and signs you in at your own pod; no password is typed on
+fedipod.net. The app then reads your timeline and notifications from your
+account's copy at the gateway, and posts, boosts, likes and follows as you.
+
+An app checks for new posts every minute or so while it is open; there are no
+live updates. Accounts are made on the fedipod.net front page, with a pod, not
+from an app.
+
+**Notifications on your phone.** An app that offers notifications can sign up
+for them here. A mention, a reply, a direct message, a follow, or a like, boost
+or reaction to your own post then reaches your phone as it arrives, while
+FediPod and the app are closed. While FediPod is open in a browser, it reads
+your mail itself, and those arrivals are not pushed.
+
 ## Accounts that go quiet
 
-A gateway holds no mail. Every delivery it accepts is written into your pod
-inbox, and your agent reads it from there. A BrowserAgent reads only while
+Every delivery the gateway accepts ends up in your pod inbox, and your agent
+reads it from there. A BrowserAgent reads only while
 its page is open, so an account nobody opens grows on its pod without limit
 and comes back to a drain of everything at once. fedipod.net keeps two facts
 about each browser account — when its owner last signed in or posted, and
@@ -194,9 +248,16 @@ web address becomes a link.
 
 It reads only public data to decide what concerns you: your published
 followers and following, and a small public policy document your agent writes
-with a mirror of your blocklist. Nothing private leaves your pod. Publishing
-that mirror does make your blocklist public, which is part of the bargain of
-running behind a door.
+with a mirror of your blocklist. Publishing that mirror does make your
+blocklist public, which is part of the bargain of running behind a door.
+
+Three things go further, all for browser accounts only. Mail that waits at
+the gateway while your app is closed, direct messages included, is stored there
+until it reaches your pod. A gateway keeping your account running can read and
+write everything in your FediPod folder, your signing key included, while it
+works; nothing else on your pod is open to it. And it keeps your account's
+working data — your timeline, notifications and direct messages among it — for
+as long as it keeps your account running.
 
 ## Running a gateway
 

package/groups.md

@@ -60,7 +60,8 @@ A group that withdraws a post it carried to you takes it off your timeline too.
 ## Inviting people
 
 A group has a page anyone can open, at `ap/profile.html` under its pod's
-app container — `<pod>/fedipod/ap/profile.html`. It
+app container — `<pod>/fedipod/ap/profile.html`
+by default, or under the `fedipod` container wherever it was put at setup. It
 carries the group's address and a Follow box that sends a visitor to their
 own server's follow screen, so it is the link to put where people will find
 it. Posts the group carries appear in members' timelines as the group

package/gui.md

@@ -46,7 +46,9 @@ its own port.
 ## Sharing an account
 
 Each identity has a page anyone can open, at `ap/profile.html` under its pod
-— for example `https://your-pod.example/fedipod/ap/profile.html`. It
+— for example `https://your-pod.example/fedipod/ap/profile.html`
+(the `fedipod` container is wherever you put it at setup; the manage page's
+"stored at" row says where). It
 shows the name, bio and address, and offers a Follow box: a visitor types
 their own server and lands on that server's follow screen. Hand out that
 link, or the `@name@host` address itself, which works in the search box of

package/lib/client/c2s.mjs

@@ -28,6 +28,7 @@ import * as social from '../core/social.mjs';
 import * as wire from '../core/wire.mjs';
 import { readLenient } from '../core/as2.mjs';
 import { safeSlug } from '../core/publisher/notes.mjs';
+import * as podNotes from '../pod/notes.mjs';
 
 const MAX_BODY = 512 * 1024;          // same ceiling the inbox drain enforces
 
@@ -192,9 +193,11 @@ export class C2S {
    * published copy and it stays the canonical one; this is served only where
    * that copy cannot be read by the client asking.
    */
-  sendLocalOutbox(res, url, origin) {
+  sendLocalOutbox(res, url, origin, { owner = false } = {}) {
     const id = `${origin}ap/outbox`;
-    const outbox = this.store.read('outbox.json', []);     // newest first
+    // newest first; the owner's view is every message, the public one what a
+    // stranger may see
+    const outbox = this.store.read(owner ? 'outbox-own.json' : 'outbox.json', []);
     const page = url?.searchParams?.get('page') || null;
     const ct = { 'content-type': 'application/activity+json; charset=utf-8' };
     if (!page) {
@@ -270,12 +273,22 @@ export class C2S {
       return this.sendInbox(res, url);
     }
     if (req.method === 'GET' || req.method === 'HEAD') {
+      // The owner, signed in, reads every message the actor produced (§5.1:
+      // the outbox is filtered by who asks). Anyone else reads the public one.
+      const owner = pathname === '/ap/outbox' && req.headers.authorization
+        ? (await this.auth(req, pathname)).ok : false;
       // Where the client surface answers on an address a stranger can reach,
       // the pod's copies already name it and are the documents. Standalone
       // they are not reachable by the client asking, so it is answered here.
       const local = this.agent.publisher?.clientOrigin ? null : this.localOrigin(req);
       if (local && pathname === '/ap/actor') return this.sendLocalActor(req, res, local);
-      if (local && pathname === '/ap/outbox') return this.sendLocalOutbox(res, url, local);
+      if (local && pathname === '/ap/outbox') return this.sendLocalOutbox(res, url, local, { owner });
+      // The owner is answered here, not sent on: a redirect loses the
+      // credential (a browser drops it across origins, and a DPoP proof names
+      // the address it was made for), so the pod would refuse them.
+      if (owner && pathname === '/ap/outbox') {
+        return this.sendLocalOutbox(res, url, this.agent.publisher.clientOrigin, { owner });
+      }
       // The pod's copy is the document; send the reader there.
       const target = pathname === '/ap/actor' ? this.urls.actor : this.urls.outbox;
       res.writeHead(303, { location: target, 'cache-control': 'no-store' });
@@ -334,14 +347,22 @@ export class C2S {
   visibilityOf(activity, object) {
     const to = arr(activity.to ?? object?.to).map(idOf);
     const cc = arr(activity.cc ?? object?.cc).map(idOf);
-    if (!to.length && !cc.length) return 'public';
+    // Blind copies alone are still an audience: a post for them and nobody
+    // else is direct, never public.
+    const blind = arr(activity.bto ?? object?.bto).length + arr(activity.bcc ?? object?.bcc).length;
+    if (!to.length && !cc.length) return blind ? 'direct' : 'public';
     if (to.includes(wire.PUBLIC)) return 'public';
     if (cc.includes(wire.PUBLIC)) return 'unlisted';
-    if (to.includes(this.urls.followers)) return 'private';
+    // Followers named anywhere — "to alice, cc my followers" included — is a
+    // followers-only post that also reaches whoever else is named.
+    if (to.includes(this.urls.followers) || cc.includes(this.urls.followers)) return 'private';
     return 'direct';
   }
 
-  async dispatch(activity, { slug = null, raw = null } = {}) {
+  // `serial` and `at` name what this activity will make: the outbox door
+  // chose them and told the client, so they are used as given. A client
+  // posting here directly gets fresh ones.
+  async dispatch(activity, { slug = null, raw = null, serial = Date.now(), at = new Date().toISOString() } = {}) {
     const reply = (status, body, headers = {}) => ({ status, body, headers });
     if (!activity || typeof activity !== 'object' || Array.isArray(activity) || !activity.type) {
       return reply(400, { error: 'a typed ActivityStreams object is required' });
@@ -349,10 +370,12 @@ export class C2S {
     // A bare object arrives without an activity around it; the server supplies
     // the Create (§6.2.1), carrying the object's own addressing up onto it.
     if (!ACTIVITY_TYPES.has(activity.type)) {
-      activity = { type: 'Create', object: activity, to: activity.to, cc: activity.cc };
+      // Every audience field is copied up onto the Create (§6.2.1).
+      const { to, cc, bto, bcc, audience } = activity;
+      activity = { type: 'Create', object: activity, to, cc, bto, bcc, audience };
     }
     try {
-      return await this._dispatch(activity, { slug, raw, reply });
+      return await this._dispatch(activity, { slug, raw, reply, serial, at });
     } catch (e) {
       this.log(`c2s ${activity?.type}: ${e.message}`);
       return reply(422, { error: e.message || String(e) });
@@ -366,11 +389,23 @@ export class C2S {
     const pick = (...fields) => [...new Set(fields.flatMap((f) => arr(activity[f] ?? object?.[f]).map(idOf)))]
       .filter((a) => typeof a === 'string' && /^https?:\/\//u.test(a)
         && a !== wire.PUBLIC && a !== this.urls.followers && a !== this.urls.actor);
-    return { also: pick('to', 'cc'), deliverTo: pick('bto', 'bcc') };
+    // `audience` is who the post is for, a group most often: delivered to and
+    // named like to and cc (§7.1).
+    return { also: pick('to', 'cc', 'audience'), deliverTo: pick('bto', 'bcc') };
   }
 
-  async _dispatch(activity, { slug, raw, reply }) {
+  async _dispatch(activity, { slug, raw, reply, serial, at }) {
     const agent = this.agent;
+    // §6: every post to the outbox answers 201 with the new activity's id.
+    const made = (id, body = {}) => reply(201, { id, ...body }, { location: id });
+    // What is never sent anywhere — a person's block, a pin — is still a
+    // message this actor produced, so the owner's outbox records it here.
+    const kept = (type, extra) => {
+      const id = type === 'Undo' ? wire.undoActivityId(this.urls, serial) : `${this.urls.actor}#${type.toLowerCase()}-${serial}`;
+      const act = { id, type, actor: this.urls.actor, published: at, ...extra };
+      agent.publisher.recordOwn?.(act);
+      return act.id;
+    };
     const object = typeof activity.object === 'object' && activity.object !== null
       ? activity.object : null;
     const objectId = idOf(activity.object);
@@ -411,6 +446,7 @@ export class C2S {
               visibility,
               spoilerText: object.summary || null,
               sensitive: object.sensitive === true,
+              slug,
             });
             return reply(201,
               { id: wire.createActivityId(question.id), object: question.id },
@@ -445,19 +481,32 @@ export class C2S {
         if (s.actor !== this.urls.actor || s.kind !== 'post') {
           return reply(403, { error: 'not your note' });
         }
-        const text = String(object?.source?.content ?? object?.content ?? '');
-        if (!text.trim()) return reply(422, { error: 'the edit has no content' });
-        const attachments = object?.attachment !== undefined
+        // §6.3: a client's Update changes only what it sends, and a field sent
+        // as null is removed. What was sent is read from the bytes, because a
+        // JSON-LD reading drops the nulls that mean "remove this".
+        const sent = raw?.type === 'Update' && raw.object && typeof raw.object === 'object' ? raw.object : (object || {});
+        const has = (k) => Object.prototype.hasOwnProperty.call(sent, k);
+        const stored = await Promise.resolve().then(() => podNotes.read(agent.remote, s.noteId)).catch(() => null);
+        if (stored?.type && stored.type !== 'Note') {
+          await agent.publisher.updateObject(s, sent, { updated: at });
+          return made(wire.updateActivityId(s.noteId, at), { object: s.noteId });
+        }
+        const text = has('content') || sent.source?.content !== undefined
+          ? String(object?.source?.content ?? object?.content ?? '') : String(s.text ?? '');
+        if (!text.trim()) return reply(422, { error: 'the edit leaves the note with no content' });
+        const attachments = has('attachment')
           ? arr(object.attachment).map((a) => ({
             url: a?.url, mediaType: a?.mediaType,
             ...(a?.name ? { description: a.name } : {}),
           })).filter((a) => a.url)
           : null;
         await agent.publisher.updateNote(s, {
-          content: text, spoilerText: object?.summary || null,
-          sensitive: object?.sensitive === undefined ? null : object.sensitive === true, attachments,
+          content: text,
+          spoilerText: has('summary') ? (object?.summary || null) : (s.spoiler || null),
+          sensitive: has('sensitive') ? object?.sensitive === true : null, attachments,
+          updated: at,
         });
-        return reply(200, { ok: true, object: s.noteId });
+        return made(wire.updateActivityId(s.noteId, at), { object: s.noteId });
       }
 
       case 'Delete': {
@@ -471,7 +520,7 @@ export class C2S {
         }
         const r = await social.deleteNote(agent, s);
         if (!r.ok) return reply(502, { error: r.error, stillPublished: r.stillPublished });
-        return reply(200, { ok: true });
+        return made(wire.deleteActivityId(s.noteId), { object: s.noteId });
       }
 
       case 'Follow': {
@@ -479,31 +528,27 @@ export class C2S {
         // An acct: form or bare handle resolves through WebFinger; an https
         // IRI is fetched directly.
         if (/^acct:|^@|^[^/@]+@[^/@]+$/.test(objectId) && !/^https?:/.test(objectId)) {
-          const r = await social.followHandle(agent, objectId.replace(/^acct:/, ''));
+          const r = await social.followHandle(agent, objectId.replace(/^acct:/, ''), { serial });
           const rec = this.store.getContacts().following.find((f) => f.actor === r.actor);
-          return reply(201, { id: rec?.followActivity?.id, object: r.actor },
-            rec?.followActivity?.id ? { location: rec.followActivity.id } : {});
+          return made(rec?.followActivity?.id, { object: r.actor });
         }
-        const doc = await social.followActor(agent, objectId);
+        const doc = await social.followActor(agent, objectId, { serial });
         const rec = this.store.getContacts().following.find((f) => f.actor === doc.id);
-        return reply(201, { id: rec?.followActivity?.id, object: doc.id },
-          rec?.followActivity?.id ? { location: rec.followActivity.id } : {});
+        return made(rec?.followActivity?.id, { object: doc.id });
       }
 
       case 'Like': {
         const s = this.byIri(objectId);
         if (!s) return reply(422, { error: 'that note is not held here — like what the timeline holds' });
-        const updated = await social.favourite(agent, s);
-        return reply(201, { id: updated.likeActivity?.id, object: s.noteId },
-          updated.likeActivity?.id ? { location: updated.likeActivity.id } : {});
+        const updated = await social.favourite(agent, s, { serial });
+        return made(updated.likeActivity?.id, { object: s.noteId });
       }
 
       case 'Announce': {
         const s = this.byIri(objectId);
         if (!s) return reply(422, { error: 'that note is not held here — boost what the timeline holds' });
-        const updated = await social.reblog(agent, s);
-        return reply(201, { id: updated.announceActivity?.id, object: s.noteId },
-          updated.announceActivity?.id ? { location: updated.announceActivity.id } : {});
+        const updated = await social.reblog(agent, s, { serial });
+        return made(updated.announceActivity?.id, { object: s.noteId });
       }
 
       case 'Undo': {
@@ -511,39 +556,47 @@ export class C2S {
         // sends one, by its type+object when it re-states it instead.
         const inner = object;
         const innerId = idOf(activity.object);
+        const undone = wire.undoActivityId(this.urls, serial);
         if (inner?.type === 'Block') {
           const target = idOf(inner.object);
           if (!target) return reply(400, { error: 'unblock whom?' });
-          await social.unblockActor(agent, target);
-          return reply(200, { ok: true, object: target });
+          await social.unblockActor(agent, target, { serial });
+          // A group's unban was sent, and recorded as it went; a person's is not.
+          if (this.store.getConfig()?.kind !== 'group') {
+            kept('Undo', { object: { type: 'Block', actor: this.urls.actor, object: target } });
+          }
+          return made(undone, { object: target });
         }
         const statuses = this.store.getStatuses();
         let s = innerId ? statuses.find((x) => x.likeActivity?.id === innerId) : null;
         if (!s && inner?.type === 'Like') s = this.byIri(idOf(inner.object));
         if (s?.favourited) {
-          const updated = await social.unfavourite(agent, s);
-          return reply(200, { ok: true, object: updated.noteId });
+          const updated = await social.unfavourite(agent, s, { serial });
+          return made(undone, { object: updated.noteId });
         }
         s = innerId ? statuses.find((x) => x.announceActivity?.id === innerId) : null;
         if (!s && inner?.type === 'Announce') s = this.byIri(idOf(inner.object));
         if (s?.reblogged) {
-          const updated = await social.unreblog(agent, s);
-          return reply(200, { ok: true, object: updated.noteId });
+          const updated = await social.unreblog(agent, s, { serial });
+          return made(undone, { object: updated.noteId });
         }
         const following = this.store.getContacts().following;
         const rec = following.find((f) => f.followActivity?.id === innerId)
           || (inner?.type === 'Follow' ? following.find((f) => f.actor === idOf(inner.object)) : null);
         if (rec) {
-          await social.unfollowActor(agent, rec.actor);
-          return reply(200, { ok: true, object: rec.actor });
+          await social.unfollowActor(agent, rec.actor, { serial });
+          return made(undone, { object: rec.actor });
         }
         return reply(422, { error: 'nothing here matches what that Undo names' });
       }
 
       case 'Block': {
         if (!objectId) return reply(400, { error: 'block whom? object must name an actor' });
-        await social.blockActor(agent, objectId);
-        return reply(200, { ok: true, object: objectId });
+        await social.blockActor(agent, objectId, { serial });
+        // A group's ban was sent to its members; a person's never goes anywhere.
+        const id = this.store.getConfig()?.kind === 'group'
+          ? `${this.urls.actor}#block-${serial}` : kept('Block', { object: objectId });
+        return made(id, { object: objectId });
       }
 
       case 'Add':
@@ -556,7 +609,8 @@ export class C2S {
         const s = this.byIri(objectId);
         if (!s) return reply(404, { error: 'no such note here' });
         const updated = await social.pinStatus(agent, s, activity.type === 'Add');
-        return reply(200, { ok: true, object: updated.noteId, pinned: !!updated.pinned });
+        return made(kept(activity.type, { object: updated.noteId, target: this.urls.featured }),
+          { object: updated.noteId, pinned: !!updated.pinned });
       }
 
       case 'Accept':
@@ -566,10 +620,10 @@ export class C2S {
         const requester = object?.actor ? idOf(object.actor) : objectId;
         if (!requester) return reply(400, { error: 'whose request? object must name the Follow or its actor' });
         const r = activity.type === 'Accept'
-          ? await social.admitRequest(agent, requester).catch((e) => ({ error: e.message }))
-          : await social.refuseRequest(agent, requester).catch((e) => ({ error: e.message }));
+          ? await social.admitRequest(agent, requester, { serial }).catch((e) => ({ error: e.message }))
+          : await social.refuseRequest(agent, requester, { serial }).catch((e) => ({ error: e.message }));
         if (r.error) return reply(404, { error: r.error });
-        return reply(200, { ok: true, object: requester });
+        return made(`${this.urls.actor}#${activity.type.toLowerCase()}-${serial}`, { object: requester });
       }
 
       case 'Move':

package/lib/client/masto/accounts.mjs

@@ -255,6 +255,7 @@ export async function handle(api, ctx) {
     if (req.method === 'POST' && !b.domains.includes(domain)) b.domains.push(domain);
     if (req.method === 'DELETE') b.domains = b.domains.filter(d => d !== domain);
     api.store.setBlocklist(b);
+    Promise.resolve(api.agent?.publisher?.publishCollections?.({ blocked: true })).catch(() => {});
     return send(200, {});
   }
 

package/lib/client/masto/bridge.mjs

@@ -0,0 +1,61 @@
+// bridge.mjs — a fetch Request handed to code written for Node's request and
+// response: the Mastodon facade and the admin surface. The browser worker
+// answers its own client through it (web/app/sw-src.mjs), and the gateway
+// answers Mastodon apps through it (lib/gateway/masto-gateway.mjs).
+//
+// Returns { req, res, bodyBytes, bodyText, response() }: `response()` is what
+// the handler wrote, as a fetch Response.
+export async function bridge(request, url, { sameOrigin = false } = {}) {
+  // Bytes, not text. A multipart upload is binary — read as text it comes back
+  // through a UTF-8 round trip that replaces every byte that is not valid UTF-8,
+  // which is most of a JPEG, so the boundary search found nothing and every
+  // media and avatar upload answered "422 file required". readBody() does
+  // `data += chunk`, which decodes a Buffer the same way it always did, so the
+  // JSON and form paths are unchanged.
+  const bodyBytes = (request.method === 'GET' || request.method === 'HEAD')
+    ? null : Buffer.from(new Uint8Array(await request.arrayBuffer()));
+  const bodyText = bodyBytes ? new TextDecoder().decode(bodyBytes) : '';
+  const reqHeaders = {}; for (const [k, v] of request.headers) reqHeaders[k.toLowerCase()] = v;
+  // `host` is a forbidden header name, so a fetch Request never carries one and
+  // the loop above cannot produce it — but it is a header every real request
+  // arrives with, and the agent reads it to say where it lives. Without it the
+  // notifications `Link` header named `https://undefined/`, so a client that
+  // paged by following it (which is how a client is meant to page) walked off
+  // the origin and saw nothing past the first screen.
+  reqHeaders.host = url.host;
+  const listeners = {};
+  // The body's events fire on the next microtask. A route that reads the body
+  // may only register for them after an await or two — the facade dispatches
+  // through its area modules first — so a listener that arrives after the
+  // events have fired is given them at once, in the order it asks.
+  let fired = false;
+  const req = { method: request.method, url: url.pathname + url.search, headers: reqHeaders,
+    // Whether the caller is a page on the agent's own origin. The browser
+    // worker has established that before anything reaches the facade, and
+    // MastoApi asks (through its authorities) whether a request is the owner's
+    // own; a request at the gateway never is.
+    sameOrigin,
+    socket: { encrypted: url.protocol === 'https:' },
+    on(ev, cb) {
+      (listeners[ev] ||= []).push(cb);
+      if (fired) { if (ev === 'data' && bodyBytes?.length) cb(bodyBytes); else if (ev === 'end') cb(); }
+      return req;
+    },
+    destroy() {} };
+  queueMicrotask(() => {
+    fired = true;
+    if (bodyBytes?.length) (listeners.data || []).forEach((cb) => cb(bodyBytes));
+    (listeners.end || []).forEach((cb) => cb());
+  });
+  let status = 200; const outHeaders = {}; const chunks = [];
+  const res = {
+    writeHead(s, h) { status = s; if (h) Object.assign(outHeaders, h); return res; },
+    setHeader(k, v) { outHeaders[k] = v; }, getHeader(k) { return outHeaders[k]; },
+    write(c) { chunks.push(c); }, end(c) { if (c) chunks.push(c); },
+  };
+  return {
+    req, res, bodyBytes, bodyText,
+    get status() { return status; },
+    response: () => new Response(chunks.join(''), { status, headers: { 'content-type': 'application/json', ...outHeaders } }),
+  };
+}