fedipod 1.47.0 → 1.48.1

package/README.md

@@ -2,63 +2,36 @@
 
 - access the Fediverse from a Solid pod
 
-FediPod gives you a Fediverse account whose data lives on a Solid pod. You
-follow people on Mastodon, Bluesky, and other Fediverse or ATProto servers in
-one timeline. Your posts, followers and settings are kept on your pod. While fedipod.net
-keeps your account running, it works from a copy of them, and every fifteen
-minutes it writes that copy to your pod and deletes it; your signing key never
-leaves your pod.
+FediPod gives you a Fediverse account whose data lives on a Solid pod, and you
+use it with any Fediverse client. You can follow people on Mastodon, Bluesky, and other Fediverse or ATProto servers in one timeline. 
 
 The easiest way to run FediPod is to use it in any browser at https://fedipod.net. Nothing to install. Sign-up points you to a pod provider if you need a pod, then attaches a Fediverse identity to the pod you sign in with.
 
-
-This README is about the `FediPod BrowserAgent`. There are also a number of [other ways to run FediPod](#other-ways-to-run-fedipod) which offer a variety of scenarios.  If interested in the code, see also : [architecture overview](architecture.md) and [files overview](files-overview.md). Which specs FediPod follows, and where it stops short: [specs-in-use.md](specs-in-use.md).
+This README is about the `FediPod` as used with a Gateway. There are also a number of [other ways to run FediPod](#other-ways-to-run-fedipod) which offer a variety of scenarios.  If interested in the code, see also : [architecture overview](architecture.md) and [files overview](files-overview.md). Which specs FediPod follows, and where it stops short: [specs-in-use.md](specs-in-use.md).
 
 ## Requirements
 
 - A current browser
 - A free account on a gateway such as https://fedipod.net
-- A Solid pod that supports WAC (you can get one if you don't have one as part of account setup)
+- A Solid pod (you can get one if you don't have one as part of account setup)
 
 ## Getting an account
 
 1. Open https://fedipod.net and choose **create an account**.
 2. Choose your pod provider. You'll be redirected to your provider to login if you have a pod or sign up if you need to create one.
 3. Back on fedipod.net, choose your handle and where your address lives:
-   on your pod, `@handle@yourpod`, or at this site, `@handle@fedipod.net`.
+   on your pod, `@handle@yourpod`, or at the gateway, `@handle@fedipod.net`.
    Choose where on your pod your data goes: a container named `fedipod`,
    inside whichever container you name (your pod's root if you leave it
-   empty). If your pod has no public type index yet, you're asked whether
-   to create one; FediPod records there where your account lives, and
-   nothing is set up without it.
+   empty).
 4. You see your Fediverse timeline.
 
-From now on, anyone can open your profile at `https://fedipod.net/@handle@provider`, signed in or not.
-
-## Getting a forum
-
-The same page makes a forum. Choose **A forum** as the first thing on it. A
-forum has a pod of its own, so make a new pod for it at your provider (or
-sign in with one that holds nothing else), then give the forum a handle, a
-name and its categories, and the address at fedipod.net you will moderate it
-as. fedipod.net runs the forum from then on; nothing runs on your machine.
-Its page is at `https://bb.fedipod.net/<handle>/` and its address is
-`@handle@fedipod.net`, with one address per category.
-
 ## What you can do
 
-There are two clients, both served by fedipod.net:
-[Sengi](https://github.com/NicolasConstant/sengi) (MIT, by Nicolas Constant),
-which you get by default, and [Phanpy](https://github.com/cheeaun/phanpy)
-(MIT, by Chee Aun). The links at the top right of every page switch between
+You can access your account by pointing any Mastodon API or C2S client at fedipod.net and signing in.  There are also two built-inclients, both served by fedipod.net: [Sengi](https://github.com/NicolasConstant/sengi) (MIT, by Nicolas Constant), which you get by default, and [Phanpy](https://github.com/cheeaun/phanpy)(MIT, by Chee Aun). The links at the top right of every page switch between
 them, at any time; whichever you opened last is the one that opens next time.
 
-You follow and unfollow, post, reply,
-favourite, boost, attach media, edit and delete. Content warnings, polls with
-up to four options and one or several answers, all four visibility levels, a
-conversations view for direct messages, bookmarks, lists, keyword filters,
-pinned posts that other servers can see, blocking and muting, and the custom
-emojis other servers send.
+You can follow and unfollow, post, reply, favourite, boost, attach media, edit and delete. Content warnings, polls with up to four options and one or several answers, all four visibility levels, a conversations view for direct messages, bookmarks, lists, keyword filters, pinned posts that other servers can see, blocking and muting, and the custom emojis other servers send.
 
 A post can quote another post. Quote is offered on posts whose author allows
 it; the quoted author's server is asked, and the quote shows as pending until
@@ -108,50 +81,18 @@ the DeviceAgent has, described in [the admin interface](gui.md).
 it in a second browser shows your timeline read-only, and the moment you act
 there it takes over; the first drops back to reading.
 
-## What the browser version does not do
-
-- **Live updates.** The client refreshes by polling.
-- **Hosting a group.** Joining one works.
-
-For these, see [Other ways to run FediPod](#other-ways-to-run-fedipod).
-
-## Your data and your keys
-
-Everything you publish and everything you read is stored on your pod. Your
-signing key is stored there too, in a container only you can read through
-your pod's login.
-While fedipod.net keeps your account running, its own pod identity can read
-that container too, so it can act for you while FediPod is closed. It works
-from a copy of your account's data, and every fifteen minutes it writes that
-copy to your pod and deletes it, so none of your data stays at fedipod.net
-longer than that. The next time anything needs your account, the copy is made
-again from your pod. Your key stays on your pod only.
-It all lives in the `fedipod` container you chose at sign-up. Your pod's
-public type index records it, as an ActivityStreams actor, which is how
-FediPod and other Solid apps find your account again.
- fedipod.net holds no key: it verifies incoming mail, drops
-the junk, forwards the rest to your pod, and hands your browser the app.
-With an address on your pod, `@handle@yourpod`, you can detach from it at
-any time and attach to a gateway of your own; your address and your data do
-not change.
-
 ## Other ways to use FediPod
 
-- [fediverse-session](lib/session/README.md) - an ESM library that supports both Solid-based and regular Fediverse accounts with methods to login, reply, boost, etc.
-- [FediPod Server](packages/fedipod-server/README.md): a full ActivityPub
+- [fediverse-session](https://github.com/jeff-zucker/fediverse-session) - an ESM library that supports both Solid-based and regular Fediverse accounts with methods to login, reply, boost, etc.
+- [FediPod Server](https://github.com/jeff-zucker/fedipod-server): a full ActivityPub
   server as a Community Solid Server component, giving every pod on the server
-  the option of a Fediverse account.
-- [FediPod BB](packages/fedipod-bb/README.md) - A Lemmy-like  bulletin board forum with the structure stored on a group pod and users' data stored on their own pod or on their Fediverse server if they don't have a pod.
+  the option of a Fediverse account.  See this link for how to host your own Solid-ActivityPub server.
+- [FediPod BB](https://github.com/jeff-zucker/fedipod-bb) - A Lemmy-like  bulletin board forum with the structure stored on a group pod and users' data stored on their own pod or on their Fediverse server if they don't have a pod.
+<!--
 - [FediPod DeviceAgent](device-agent.md) a single-user AP server that lives partly in a gateway, partly on a local device, with all data stored on your pod.
+-->
 - [FediPod Groups](groups.md): hosting a discussion group of Fediverse and Bluesky users from a pod.
-- [FediPod Gateway](gateway.md): A thin, always-on door running on Netlify or any small host that provides a middleman between a pod and the single-user agents. (only needed with `BrowserAgent` and `DeviceAgent`)
-
-There are two ways to run FediPod: in a browser at a Gateway such as
-fedipod.net, with nothing installed, or as a Gateway of your own, deployed
-from this repository ([netlify/README.md](netlify/README.md)). Cloning the
-repository and running it is not one of them: `npm start` only says so. The
-DeviceAgent is deprecated; nothing new is built for it.
-
+- [FediPod Gateway](gateway.md): A thin, always-on door running on Netlify or any small host that provides a middleman between a pod and the single-user agents. See this link for how to host your own gateway.
 
 ## Acknowledgements
 

package/architecture.md

@@ -27,7 +27,7 @@ hold). A gateway's admin may turn the hold off: then there is no copy, and
 everything works on the pod, the browser and the gateway taking turns by the
 pod's lease. See [the gateway](gateway.md).
 
-[FediPod Server](packages/fedipod-server/README.md) puts the agent inside a
+[FediPod Server](https://github.com/jeff-zucker/fedipod-server) puts the agent inside a
 Community Solid Server, so anyone with a pod on that server can opt in to a
 Fediverse account fed by the server itself.
 

package/gateway.md

@@ -242,9 +242,9 @@ from an app.
 
 **Notifications on your phone.** An app that offers notifications can sign up
 for them here. A mention, a reply, a direct message, a follow, or a like, boost
-or reaction to your own post then reaches your phone as it arrives, while
-FediPod and the app are closed. While FediPod is open in a browser, it reads
-your mail itself, and those arrivals are not pushed.
+or reaction to your own post then reaches your phone as it arrives, whether
+FediPod is open in a browser or closed. Notifications from a connected Bluesky
+or Mastodon account are not pushed.
 
 ## Accounts that go quiet
 
@@ -308,7 +308,7 @@ Two ways are ready to use:
   [netlify/README.md](netlify/README.md) for the deployment specifics.
 - **On any box of your own**, with your own adapter around the same core.
 - **Inside a Community Solid Server**, as the same door run in-process by the
-  CSS component — see [packages/fedipod-server](packages/fedipod-server/README.md).
+  CSS component — see [fedipod-server](https://github.com/jeff-zucker/fedipod-server).
 
 ### Offering accounts to other people
 

package/gui.md

@@ -19,7 +19,8 @@ The software row names the version the agent is running. When the copy on the ma
   old handle keeps working as a redirect, and the identity is parked
   afterwards.
 * **Retire identity** is permanent — every follower's server is told to drop
-  the account, and the identity does not come back.
+  the account, your WebID profile and public type index stop naming it, and
+  the identity does not come back.
 * In the **Upkeep** group: **Drain the inbox** fetches and handles everything
   waiting now, and **Show dead letters** lists deliveries that failed for
   good and will not be retried.

package/lib/core/place.mjs

@@ -52,6 +52,16 @@ export async function recordPlace(pod, podBase, actorAtPod, { create = false } =
   return (await typeIndex.register(pod, index, actorAtPod)) ? 'registered' : 'already';
 }
 
+/**
+ * Take the account's place out of the owner's public type index, for an
+ * account retired for good. Returns 'removed', 'absent' or 'no-index'.
+ */
+export async function forgetPlace(pod, podBase, actorAtPod) {
+  const index = await typeIndex.findPublicIndex(pod, podBase);
+  if (!index) return 'no-index';
+  return (await typeIndex.unregister(pod, index, actorAtPod)) ? 'removed' : 'absent';
+}
+
 /** Whether this person's profile names a public type index. */
 export async function hasPublicIndex(pod, podBase) {
   return !!(await typeIndex.findPublicIndex(pod, podBase).catch(() => null));

package/lib/core/publisher/index.mjs

@@ -26,7 +26,7 @@ import * as restore from './restore.mjs';
 import * as notes from './notes.mjs';
 import * as questions from './questions.mjs';
 import * as own from './own.mjs';
-import { recordPlace } from '../place.mjs';
+import { recordPlace, forgetPlace } from '../place.mjs';
 
 // The version is read where a bundled deploy (the Netlify functions) cannot
 // break it: a package.json that is not beside the bundle is not a reason for
@@ -212,7 +212,7 @@ export class Publisher {
     // writes none — the forum's own actor, or a Gateway, answers for it.
     if (!this.config.forum) {
       await discovery.writeWebfinger(this.remote, urls,
-        wire.jrd({ handle: this.config.handle, host, actor: urls.actor, page: urls.profileHtml }));
+        wire.jrd({ handle: this.config.handle, host, actor: urls.actor, page: urls.profileHtml, avatar: this.config.icon || null }));
       await discovery.writeHostMeta(this.remote, urls, wire.hostMeta(urls.base));
 
       const nodeinfoDocUrl = urls.home + 'ap/nodeinfo-2.0';
@@ -393,6 +393,18 @@ export class Publisher {
     await podActor.writeTombstone(this.remote, urls, wire.tombstoneDoc(urls, deletedAt, this.config.kind));
     this.store.setConfig({ ...this.store.getConfig(), retiredAt: deletedAt });
     await this.store.flush();
+    // The owner's own documents stop pointing at it: the WebID profile's
+    // account and outbox links, and its place in the public type index.
+    // Best-effort, as writing them was.
+    if (!this.config.forum) {
+      await podActor.unlinkInWebIdProfile(this.remote, {
+        actorUrl: urls.actor, outbox: this.clientOrigin ? `${this.clientOrigin}ap/outbox` : this.gatewayOutbox(),
+      }).then((n) => { if (n) this.log('the WebID profile no longer lists the actor'); })
+        .catch((e) => this.log(`the WebID profile still lists the actor: ${e.message}`));
+      await forgetPlace(this.remote, urls.base, urls.home + 'ap/actor')
+        .then((r) => { if (r === 'removed') this.log('the public type index no longer records the account'); })
+        .catch((e) => this.log(`the type index still records the account: ${e.message}`));
+    }
     this.log(`retired: Delete sent to ${inboxes.length} inbox(es), actor replaced with a Tombstone`);
     return { inboxes: inboxes.length, deletedAt };
   }

package/lib/core/store.mjs

@@ -185,9 +185,13 @@ export class PodStore {
   // Read these documents again, whatever is held: a kept copy caught them
   // mid-write, so the pod's copy is the one to hold. Throws when one cannot be
   // read, so the caller can fall back to a full load rather than act without it.
-  async refresh(names) {
+  // `ifChanged`: a document held here is asked for only if it changed since — a
+  // pod's listing does not change when a document in it is rewritten.
+  async refresh(names, { ifChanged = false } = {}) {
     for (const name of names) {
-      const r = await this.storage.read(name);
+      const etag = ifChanged && this.cache.has(name) ? this.etags.get(name) : null;
+      const r = await this.storage.read(name, etag ? { etag } : undefined);
+      if (r.notModified) continue;
       if (r.status === 404) {
         this.cache.delete(name); this.lastText.delete(name); this.etags.delete(name);
       } else if (!r.ok) {

package/lib/core/wire.mjs

@@ -56,13 +56,15 @@ export function hostMeta(base) {
   return `<?xml version="1.0" encoding="UTF-8"?>\n<XRD xmlns="http://docs.oasis-open.org/ns/xri/xrd-1.0">\n  <Link rel="lrdd" template="${base}.well-known/webfinger?resource={uri}"/>\n</XRD>\n`;
 }
 
-export function jrd({ handle, host, actor, aliases = [], page = null }) {
+export function jrd({ handle, host, actor, aliases = [], page = null, avatar = null }) {
   return {
     subject: `acct:${handle}@${host}`,
     ...(aliases.length ? { aliases } : {}),
     links: [
       { rel: 'self', type: 'application/activity+json', href: actor },
       ...(page ? [{ rel: 'http://webfinger.net/rel/profile-page', type: 'text/html', href: page }] : []),
+      // The account's picture, as Mastodon's answer names it.
+      ...(avatar ? [{ rel: 'http://webfinger.net/rel/avatar', href: avatar }] : []),
     ],
   };
 }

package/lib/gateway/front-core.mjs

@@ -23,7 +23,7 @@ import * as podRoot from '../pod/root.mjs';
 import * as podPolicy from '../pod/policy.mjs';
 import { podBaseOfWebId } from '../pod/urls.mjs';
 import { routeQuietApi, noteOpened, noteReceived, closedState, accountState, closedAnswer, provedOwner } from './quiet.mjs';
-import { holdsMail, mayBeAway, isPresent, holdingPut, afterHeld, routeHereApi, routeKeeperApi } from './held-mail.mjs';
+import { holdsMail, mayBeAway, isPresent, holdingPut, afterHeld, routeHereApi, routeKeeperApi, routePushApi } from './held-mail.mjs';
 import { routeNoticesApi } from './notices.mjs';
 import { withSecurityHeaders } from './headers.mjs';
 import { podTokenVerifier } from './caches.mjs';
@@ -35,16 +35,15 @@ import { announced, overLimit, relayOne } from './relay-extras.mjs';
 // wire.mjs: wire drags the agent's whole HTML pipeline (sanitize-html and
 // friends), which a serverless front must never carry — it crashed the
 // deployed function before it answered its first request.
-const jrd = ({ handle, host, actor, aliases = [], page = null, subscribe = null }) => ({
+const jrd = ({ handle, host, actor, aliases = [], page = null, subscribe = null, avatar = null }) => ({
   subject: `acct:${handle}@${host}`,
   ...(aliases.length ? { aliases } : {}),
   links: [
     { rel: 'self', type: 'application/activity+json', href: actor },
     ...(page ? [{ rel: 'http://webfinger.net/rel/profile-page', type: 'text/html', href: page }] : []),
-    // Remote follow. Somebody reading this account on another server presses
-    // Follow, says they are here, and that server looks for this link to find
-    // out where to send them. `{uri}` is a literal the other server fills in
-    // with whatever they are following — it must not be escaped.
+    ...(avatar ? [{ rel: 'http://webfinger.net/rel/avatar', href: avatar }] : []),   // the account's picture
+    // Remote follow: another server sends its reader to this template to follow
+    // from there. `{uri}` is a literal that server fills in; never escape it.
     ...(subscribe ? [{ rel: 'http://ostatus.org/schema/1.0/subscribe', template: subscribe }] : []),
   ],
 });
@@ -585,9 +584,9 @@ async function route(request, ctx) {
   // The owner's say over an account that goes quiet (quiet.mjs).
   const quiet = await routeQuietApi(request, pathname, ctx, { j, verifyPodToken, webidUnderPod, apiPreflight });
   if (quiet) return withApiCors(quiet);
-  // The owner's app saying it is open, and taking what was held (held-mail.mjs).
-  const here = await routeHereApi(request, pathname, ctx, { j, verifyPodToken, webidUnderPod, apiPreflight, provedOwner })
-    || await routeKeeperApi(request, pathname, ctx, { j, verifyPodToken, webidUnderPod, apiPreflight, provedOwner });
+  // The owner's app saying it is open, taking what was held, and naming what to push (held-mail.mjs).
+  const owned = { j, verifyPodToken, webidUnderPod, apiPreflight, provedOwner };
+  const here = await routeHereApi(request, pathname, ctx, owned) || await routeKeeperApi(request, pathname, ctx, owned) || await routePushApi(request, pathname, ctx, owned);
   if (here) return withApiCors(here);
 
   // The relay: the front sends requests a browser has already signed. A page
@@ -758,7 +757,7 @@ async function route(request, ctx) {
     // the pod (and its login) without a lookup only the host could answer.
     const podActor = rec.inboxOnly ? [] : [rec.podHome + 'ap/actor'];
     const out = j(200, jrd({ handle: m[1], host: ctx.host, actor: rec.actorUrl, aliases: podActor,
-      page: profilePageOf(rec), subscribe: subscribeTemplate(ctx.frontOrigin) }),
+      page: profilePageOf(rec), subscribe: subscribeTemplate(ctx.frontOrigin), avatar: rec.icon || null }),
     'application/jrd+json');
     // RFC 7033: a JRD is read from any origin.
     out.headers['access-control-allow-origin'] = '*';

package/lib/gateway/held-mail.mjs

@@ -213,3 +213,26 @@ export async function routeHereApi(request, pathname, ctx, deps) {
   // `hold`: with it off, a browser working from a copy goes back to the pod.
   return j(200, { ok: true, handle, flushed, hold: holdOn(ctx) });
 }
+
+// FediPod open in a browser reads its own mail, so nothing is held for the
+// door to push: it names the notifications it made, and they are pushed to the
+// phones and browsers its owner signed up (masto-gateway.mjs: pushMade).
+// Proved like /api/here. Returns a response, or null for other paths.
+const NOTIFICATION_ID = /^[0-9a-f]{16}$/u;
+export async function routePushApi(request, pathname, ctx, deps) {
+  if (pathname !== '/api/push') return null;
+  const { j } = deps;
+  if (request.method === 'OPTIONS') return deps.apiPreflight();
+  if (request.method !== 'POST') return null;
+  let body;
+  try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+  const handle = String(body.handle || '').toLowerCase();
+  const rec = await ctx.lookup(handle);
+  if (!rec) return j(404, { error: 'no such account' });
+  const who = await deps.provedOwner(request, pathname, ctx, rec, deps);
+  if (who.error) return who.error;
+  const ids = [...new Set((Array.isArray(body.ids) ? body.ids : []).filter((id) => NOTIFICATION_ID.test(String(id))))].slice(0, 50);
+  if (!ids.length || !ctx.startPush || !await ctx.pushWanted?.(handle).catch(() => false)) return j(200, { ok: true, handle, pushing: 0 });
+  await ctx.startPush(handle, { ids }).catch((e) => console.log(`push @${handle}: not started: ${e?.message || e}`));
+  return j(200, { ok: true, handle, pushing: ids.length });
+}

package/lib/gateway/masto-gateway.mjs

@@ -29,7 +29,10 @@
 // keeps for all its accounts, made the first time it is needed. When the door
 // holds a delivery that becomes a notification (gateway-core: notifies), it
 // starts a short run (push-background.mjs, pushHeld below) that reads the held
-// mail into the copy and pushes each notification it makes.
+// mail into the copy and pushes each notification it makes. While FediPod is
+// open in a browser, it reads the mail itself and names the notifications it
+// made (held-mail.mjs: /api/push); those are pushed from the account as it
+// reads (pushMade below).
 import crypto from 'node:crypto';
 import { MastoApi } from '../client/masto/index.mjs';
 import { instanceConfig } from '../client/masto/instance.mjs';
@@ -49,7 +52,10 @@ import { noteOpened } from './quiet.mjs';
 import { Push } from '../client/webpush.mjs';
 import webpush from 'web-push';
 
+// An app stays signed in for ninety days from its last use; the mark of use
+// moves at most once a day.
 const TOKEN_TTL_MS = 90 * 86400_000;
+const TOKEN_USE_MARK_MS = 86400_000;
 const CODE_TTL_MS = 10 * 60_000;
 const MAIL_EVERY_MS = 30_000;
 const SIGNIN_PAGE = '/app-signin/';
@@ -194,8 +200,11 @@ export async function vapidKeys(kv) {
 }
 
 class GatewayPush extends Push {
-  constructor({ keys, ...o }) { super(o); this.keys = keys; }
+  constructor({ keys, keep = true, ...o }) { super(o); this.keys = keys; this.keep = keep; }
   vapid() { return this.keys; }
+  // Pushing from an account only read: a sign-up the push service has dropped
+  // is let go by the next push that acts on the account.
+  save(s) { if (this.keep) super.save(s); }
 }
 
 // ---- the account behind a token ----
@@ -282,10 +291,10 @@ function readingAgent(at, store, acting, log) {
 // contact address push services accept (https or mailto).
 const pushContact = (ctx) => (/^https:\/\//u.test(ctx.frontOrigin || '') ? `${ctx.frontOrigin.replace(/\/$/u, '')}/` : `mailto:postmaster@${ctx.host || 'localhost'}`);
 
-function facade(agent, token, log, keys = null, contact = null) {
+function facade(agent, token, log, keys = null, contact = null, { keep = true } = {}) {
   const api = new MastoApi({ agent, log, scheme: 'https', streaming: false, webPush: !!keys, scheduling: true, allowed: noAuthorities });
   api.tokenOf = () => token;
-  if (keys) api._push = new GatewayPush({ store: agent.store, keys, log, subject: () => contact });
+  if (keys) api._push = new GatewayPush({ store: agent.store, keys, log, subject: () => contact, keep });
   return api;
 }
 
@@ -390,6 +399,40 @@ export async function pushHeld(ctx, handle, rec, { log = console.log } = {}) {
   return n;
 }
 
+/**
+ * For FediPod open in a browser, which read mail that went straight to the pod
+ * and names the notifications it made: each is read from the account as it is
+ * now, without acting, and pushed once, while it is new. One that came from
+ * another network (Bluesky, a connected account) is not pushed, as it is not
+ * while FediPod is closed.
+ */
+const PUSH_FRESH_MS = 15 * 60_000;
+const PUSHED_KEPT = 200;
+export async function pushMade(ctx, handle, rec, ids, { log = console.log, now = Date.now() } = {}) {
+  if (!ids?.length || !await pushWanted(ctx, handle)) return 0;
+  const key = `pushed/${handle}`;
+  const done = (await getJson(ctx.mastoKv, key)) || [];
+  const want = new Set(ids.filter((id) => !done.includes(id)));
+  if (!want.size) return 0;
+  await waitOutClosing(ctx.copyKv, handle);
+  const at = await reachAccount(ctx, handle, rec, { log });
+  if (at.skipped) return 0;
+  const store = await readingStore(ctx, handle, at, log);
+  const agent = readingAgent(at, store, async () => { throw new Error('only reading'); }, log);
+  if (!agent) return 0;
+  // On the pod, a rewritten document leaves the listing as it was: what the
+  // push reads is asked for again, if it changed.
+  if (!at.inCopy) await store.refresh(['notifications.json', 'actors.json', 'statuses.json', 'webpush.json'], { ifChanged: true });
+  const fresh = store.getNotifications()
+    .filter((n) => want.has(n.id) && !n.bsky && !n.via && now - Date.parse(n.at) < PUSH_FRESH_MS);
+  if (!fresh.length) return 0;
+  const api = facade(agent, null, log, await vapidKeys(ctx.mastoKv), pushContact(ctx), { keep: false });
+  for (const n of fresh) await api.pushNotify(n).catch((e) => log(`push @${handle}: ${e.message}`));
+  await ctx.mastoKv.set(key, JSON.stringify([...fresh.map((n) => n.id), ...done].slice(0, PUSHED_KEPT)));
+  log(`@${handle}: ${fresh.length} made in FediPod pushed`);
+  return fresh.length;
+}
+
 // A request from an app, answered by the account's facade over its copy, or
 // with the hold off, over the pod.
 async function answerForAccount(request, url, ctx, tok, rec, log, tokenHash) {
@@ -635,13 +678,15 @@ async function route(request, pathname, ctx, deps, log) {
   const bearer = /^Bearer (.+)$/u.exec(request.headers.get('authorization') || '')?.[1];
   const tokenHash = bearer ? sha(bearer) : null;
   const tok = tokenHash ? await getJson(kv, `token/${tokenHash}`) : null;
-  if (!tok || Date.now() - tok.at > TOKEN_TTL_MS) {
+  const lastUse = tok ? tok.usedAt || tok.at : 0;
+  if (!tok || Date.now() - lastUse > TOKEN_TTL_MS) {
     // A page of this site asking with a token the gateway never gave out is
     // FediPod's own client in a browser whose worker is not answering yet:
     // told to try again, not that it is signed out.
     if (request.headers.get('sec-fetch-site') === 'same-origin') return json(503, { error: 'FediPod is starting in this browser; try again' });
     return json(401, { error: 'The access token is invalid' });
   }
+  if (Date.now() - lastUse > TOKEN_USE_MARK_MS) await putJson(kv, `token/${tokenHash}`, { ...tok, usedAt: Date.now() }).catch(() => {});
   if (pathname === '/api/v1/apps/verify_credentials') {
     const app = await appOf(kv, tok.clientId);
     return json(200, { name: app?.name || 'an app', website: app?.website || null, scopes: String(tok.scope).split(/\s+/u) });

package/lib/gateway/quiet.mjs

@@ -63,6 +63,10 @@ export async function noteReceived(ctx, key, rec, bytes) {
     .catch((e) => console.log(`front @${key}: count not written: ${e?.message || e}`));
 }
 
+// The account's picture as its owner's browser names it, for the address's
+// WebFinger answer (front-core.mjs): an http(s) address, or none.
+const pictureOf = (v) => (typeof v === 'string' && v.length <= 2048 && /^https?:\/\/\S+$/u.test(v) ? v : null);
+
 // The owner is here. `always` is a sign-in; the relay stamps at most hourly,
 // so a busy hour of posting is one write. The count that went with the old
 // stamp is dropped: it is over, and a store should not keep one per hour.
@@ -142,6 +146,12 @@ export async function routeQuietApi(request, pathname, ctx, deps) {
     if (who.error) return who.error;
     const before = await closedState(ctx, handle, rec);
     if (before.closed) return j(410, { error: 'this address is closed', closedAt: before.closedAt, closedBy: before.closedBy });
+    // The picture rides on the same write as the stamp. Anything that is not
+    // an address, or null, is not a picture, and changes nothing.
+    if ('icon' in body && (body.icon === null || pictureOf(body.icon)) && pictureOf(body.icon) !== (rec.icon || null)) {
+      const { icon: _was, ...rest } = rec;
+      rec = pictureOf(body.icon) ? { ...rest, icon: pictureOf(body.icon) } : rest;
+    }
     rec = await noteOpened(ctx, handle, rec, { always: true });
     // Whom the app would name if its owner lets the gateway act for them while
     // it is closed, and whether they have (held-mail.mjs, keeper.mjs); and

package/lib/pod/actor.mjs

@@ -73,6 +73,11 @@ export function linkInWebIdProfile(pod, { actorUrl, accountName, kind = 'person'
   return pod.linkAccountInProfile({ actorUrl, accountName, kind, outbox });
 }
 
+/** The same link taken out again, for an account retired for good. */
+export async function unlinkInWebIdProfile(pod, { actorUrl, outbox = null }) {
+  return pod.unlinkAccountInProfile({ actorUrl, outbox });
+}
+
 // ---- anyone at all ----
 
 /**

package/lib/pod/transport.mjs

@@ -534,6 +534,34 @@ export class PodTransport {
     return true;
   }
 
+  /**
+   * The account taken out of the WebID profile again, as linkAccountInProfile
+   * wrote it: the foaf:account link, what the profile says of the actor, and
+   * `outbox` when it is the one named. From every document of the profile that
+   * holds any of it, each write checked. Returns how many documents changed.
+   */
+  async unlinkAccountInProfile({ actorUrl, outbox = null }) {
+    const me = $rdf.sym(this.webId);
+    const actor = $rdf.sym(actorUrl);
+    let changed = 0;
+    for (const d of await this.profileDocs(podBaseOfWebId(this.webId))) {
+      if (!d.g) continue;
+      const gone = [
+        ...d.g.statementsMatching(me, FOAF('account'), actor),
+        ...d.g.statementsMatching(actor, RDF('type'), FOAF('OnlineAccount')),
+        ...d.g.statementsMatching(actor, RDF('type'), AS('Person')),
+        ...d.g.statementsMatching(actor, RDF('type'), AS('Group')),
+        ...d.g.statementsMatching(actor, FOAF('accountName'), null),
+        ...(outbox ? d.g.statementsMatching(me, AS('outbox'), $rdf.sym(outbox)) : []),
+      ].map((st) => [st.subject, st.predicate, st.object]);
+      if (!gone.length) continue;
+      const status = await this.writeRdfChecked(d.url, d.g, { deletes: gone, mustDescribe: d.profile ? this.webId : null });
+      if (status >= 300) throw new Error(`not written: ${d.url} → ${status}`);
+      changed++;
+    }
+    return changed;
+  }
+
   /**
    * An N3 Patch of exactly these statements, or false when the pod will not
    * take one and the caller should write the document instead.

package/lib/pod/type-index.mjs

@@ -65,6 +65,29 @@ export async function register(pod, indexUrl, actorUrl) {
   return true;
 }
 
+/**
+ * Take the account's registration out again. A registration that names other
+ * instances too keeps them and loses only this one. True when one was there.
+ */
+export async function unregister(pod, indexUrl, actorUrl) {
+  const g = await pod.readRdf(indexUrl);
+  if (!g) return false;
+  const actor = pod.sym(actorUrl);
+  const instance = pod.sym(SOLID + 'instance');
+  const gone = [];
+  for (const reg of g.each(null, instance, actor)) {
+    if (!g.holds(reg, pod.sym(SOLID + 'forClass'), pod.sym(AS_ACTOR))) continue;
+    const others = g.each(reg, instance, null).filter((i) => i.value !== actorUrl);
+    for (const st of others.length ? g.statementsMatching(reg, instance, actor) : g.statementsMatching(reg, null, null)) {
+      gone.push([st.subject, st.predicate, st.object]);
+    }
+  }
+  if (!gone.length) return false;
+  const status = await pod.writeRdfChecked(indexUrl, g, { deletes: gone, mustDescribe: indexUrl });
+  if (status >= 300) throw new Error(`the type index at ${indexUrl} did not let the registration go (${status})`);
+  return true;
+}
+
 /**
  * Make a public type index and name it from the profile. Only ever called
  * after the person has said yes. An index already at the usual place is kept,

package/lib/server/embed.mjs

@@ -396,7 +396,7 @@ export async function startEmbeddedAgent({
     basePath: uiPath,
     mount,
     publicOrigin: base,
-    scheme: new URL(base).protocol,
+    scheme: new URL(base).protocol.slice(0, -1),
   });
 
   // A delivery landing in the inbox — through the door, or from any other