fedipod 1.47.0 → 1.48.1

package/lib/session/README.md

@@ -1,137 +1,4 @@
 # fediverse-session
 
-The library lets an app take a Fediverse handle or a WebID and act as that
-account.
-
-- **`login`** — sends the person to wherever their account signs in, their
-  Mastodon server or their pod, and brings them back to where they were.
-- **`resume`** — on every page load, finishes a sign-in they are coming back
-  from. Otherwise does nothing.
-- **`current`** — the signed-in account, or nothing.
-- **`signOut`** — signs them out, at their server or pod as well as in the
-  browser.
-- **`describe`** — says what an address is without signing in: a Mastodon
-  account or a pod account, and its handle.
-
-Once signed in, the account gives you:
-
-- **`post`** — publishes a post as them, public, unlisted or followers-only.
-- **`reply`** — answers a post.
-- **`timeline`** — their home timeline, newest first.
-- **`outbox`** — their own posts, newest first. Pass `rdf: true` to also get
-  the real thing as RDF, for an app that wants to work with it as linked
-  data rather than as this library's own shape.
-- **`follow`** — follows someone by handle.
-- **`favourite`**, **`boost`** — as they say.
-- **`profile`** — who they are as their server or pod shows them: name,
-  handle, picture, bio, counts, profile page, and the WebID for a pod
-  account.
-- **`notice`** — a sentence to show them, or nothing. A browser-based
-  FediPod account gets: "Because you have a browser-based account, your
-  posts and interactions will only go out to the Fediverse when your browser
-  is opened to your account."
-- **`handle`, `name`, `kind`** — who they are, and whether the account is on
-  Mastodon or a pod, for an app that wants to know.
-- **`signOut`** — the same as above.
-
-The app never asks which kind it has. A Mastodon account acts at once. A
-pod account's actions are carried out by its own agent, at once for a
-DeviceAgent or Server account, and when fedipod.net is next open for a
-browser-based one.
-
-Three files, no dependencies. It runs in a page and in a service worker.
-The one exception: `outbox({ rdf: true })` needs the `jsonld` package, and
-only loads it when that flag is actually used.
-
-[The demo](https://jeff-zucker.github.io/FediPod/) shows the sign-in and
-the profile that comes back.
-
-## Get it
-
-From a CDN, with nothing to install:
-
-```js
-import { fediAccount } from 'https://cdn.jsdelivr.net/npm/fediverse-session@0.2.1/fedi-account.mjs';
-```
-
-Or from npm:
-
-```bash
-npm install fediverse-session
-```
-
-```js
-import { fediAccount } from 'fediverse-session';
-```
-
-## Use
-
-```js
-import { fediAccount } from 'fediverse-session';
-const accounts = fediAccount({ dbName: 'my-app', clientName: 'My app' });
-
-await accounts.resume();                                   // on every page load
-
-signInButton.onclick = () => accounts.login(addressField.value);
-
-const me = await accounts.current();                       // null when nobody is signed in
-if (me?.notice) show(me.notice);
-await me.post({ text: 'Hello from my app' });
-for (const p of await me.timeline({ limit: 20 })) render(p);
-for (const p of await me.outbox({ limit: 20 })) render(p);
-await me.follow('@aisha@her.server');
-await me.reply(p.url, 'Well said');
-await me.signOut();
-```
-
-## The details
-
-- **`fediAccount({ dbName, clientName })`** — sets the library up for your
-  app, once. `dbName` keeps this app's sign-ins apart from another app's on
-  the same origin. `clientName` is what the person sees on the consent
-  screen.
-- **`login(address, { returnTo, redirectUri })`** — `@kwame@mastodon.social`
-  goes to Mastodon; `@mei@fedipod.net`, or a WebID, goes to the pod. They
-  come back to this page unless `redirectUri` says otherwise, and are
-  returned to where they were unless `returnTo` says otherwise.
-- **`post({ text, inReplyTo, visibility })`** — `visibility` is `public`,
-  `unlisted` or `followers`.
-- **`reply(post, text)`** — the post is named by its address or its id.
-- **`timeline({ limit })`** — each post as `{ id, url, author: { id, handle,
-  name }, html, published, inReplyTo }`.
-- **`outbox({ limit, rdf })`** — the same shape as `timeline`, but only this
-  account's own posts. With `rdf: true`, the returned array also carries
-  `.rdf`: the real outbox parsed into an RDF/JS quad array — for a Mastodon
-  account too, since a Mastodon server is itself an ActivityPub server with
-  a real actor and outbox, same as a pod's. It comes back empty on a server
-  that requires a signed request just to read that document, which some
-  do. Reading it needs the `jsonld` package available to your app; without
-  `rdf: true` nothing changes and nothing extra loads.
-- **`fetch`** — the raw authenticated fetch, for anything the above does not
-  cover.
-- **`actor`** — the account's ActivityPub id.
-
-Every action answers `{ sent: true }` when the server did it, or `{ queued:
-true }` when the account's own agent will carry it out.
-
-## What it cannot do
-
-- **An address whose server is neither a Mastodon-family server nor a Solid
-  pod** is refused with a sentence naming the host.
-- **A browser-based FediPod account acts when its browser is open.** Posts,
-  follows and replies wait at the account's outbox until fedipod.net is next
-  open in some browser, and its timeline is the one that browser last built.
-  The account's `notice` says so; show it.
-- **A Mastodon account has no pod.** An app that keeps things on a pod has
-  nowhere to keep them for such a person.
-
-## Where the sign-in goes, and what stays in the browser
-
-A Mastodon account signs in at its own server, which asks the person to
-approve your app once. The token it grants stays in their browser and is
-handed back to the server at sign-out.
-
-A pod account signs in at the pod's login provider. The key that proves the
-sign-in is made in the browser and cannot be read out of it, even by a
-script on the page. The person stays signed in across browser restarts
-until they sign out, and sign-out is reported to the provider.
+fediverse-session lives in its own repository:
+https://github.com/jeff-zucker/fediverse-session

package/lib/surface/surface.mjs

@@ -8,6 +8,7 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { MastoApi } from '../client/masto/index.mjs';
 import { C2S } from '../client/c2s.mjs';
 import { makeC2sAuth } from '../client/oidc-auth.mjs';
@@ -75,8 +76,8 @@ const hasCredential = (home) => fs.existsSync(path.join(home, 'credential.json')
 // guards the operator's door (basePath) instead of the whole surface.
 const SESSION_FILES = {
   '/oauth/session/signin.mjs': 'web/admin/oauth-signin.mjs',
-  '/oauth/session/fedi-login.mjs': 'lib/session/fedi-login.mjs',
-  '/oauth/session/oidc-session.mjs': 'lib/session/oidc-session.mjs',
+  '/oauth/session/fedi-login.mjs': fileURLToPath(import.meta.resolve('fediverse-session/fedi-login.mjs')),
+  '/oauth/session/oidc-session.mjs': fileURLToPath(import.meta.resolve('fediverse-session/oidc-session.mjs')),
 };
 
 // `extraRoutes` are the routes a host process adds after the owner's — the
@@ -194,7 +195,7 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
       const sessionFile = SESSION_FILES[p];
       if (sessionFile) {
         let body;
-        try { body = fs.readFileSync(path.join(projectRoot, sessionFile)); } catch { return json(res, 404, { error: 'not here' }); }
+        try { body = fs.readFileSync(path.resolve(projectRoot, sessionFile)); } catch { return json(res, 404, { error: 'not here' }); }
         res.writeHead(200, { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'no-cache' });
         res.end(body); return;
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.47.0",
+  "version": "1.48.1",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",
@@ -55,7 +55,7 @@
     "install-service": "node bin/fedipod.mjs install-service",
     "uninstall-service": "node bin/fedipod.mjs uninstall-service",
     "prepublishOnly": "npm test",
-    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/hold-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node packages/fedipod-bb/scripts/link-fedipod.mjs && node --test packages/fedipod-bb/test/*.test.mjs claude/smoke-tests/forum-signup-form.test.mjs claude/smoke-tests/door-verify.test.mjs && node scripts/check-sizes.mjs && node claude/validation/browser-agent/all.mjs",
+    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/hold-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node --test claude/smoke-tests/forum-signup-form.test.mjs claude/smoke-tests/door-verify.test.mjs && node scripts/check-sizes.mjs && node scripts/test-dependents.mjs && node claude/validation/browser-agent/all.mjs",
     "verify-ui": "node scripts/verify-ui.mjs",
     "build:sw": "node scripts/build-app.mjs --entry web/app/sw-src.mjs --out web/app/dist/sw.js",
     "build:boot": "node scripts/build-app.mjs --entry web/app/boot.mjs --out web/app/dist/boot.js",
@@ -76,6 +76,7 @@
     "@rdfjs/term-set": "^2.0.3",
     "@solid/access-token-verifier": "^2.1.1",
     "clownface": "^2.0.3",
+    "fediverse-session": "^0.2.1",
     "jose": "^6.2.8",
     "json-canon": "^1.0.1",
     "jsonld": "^9.0.0",
@@ -96,6 +97,7 @@
     "package-lock.json": "npm:empty-npm-package@1.0.0"
   },
   "devDependencies": {
-    "esbuild": "^0.28.2"
+    "esbuild": "^0.28.2",
+    "fedipod-bb": "^0.4.1"
   }
 }

package/scripts/check-netlify-bundles.mjs

@@ -18,10 +18,6 @@ const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'fn-bundles-'));
 let fails = 0;
 const check = (ok, msg) => { console.log(`${ok ? 'PASS' : 'FAIL'}  ${msg}`); if (!ok) fails++; };
 try {
-  // The forum the front names (netlify/forum-support.mjs) imports fedipod by
-  // name; in this checkout that must be the checkout itself, or the bundle
-  // carries a registry copy beside the Gateway's own code.
-  execFileSync(process.execPath, [path.join(root, 'packages/fedipod-bb/scripts/link-fedipod.mjs')], { cwd: root, stdio: 'inherit' });
   execFileSync('netlify', ['functions:build', '--src', path.join(root, 'netlify/functions'), '--functions', path.join(tmp, 'zips')],
     { cwd: root, stdio: 'ignore' });
   const manifest = JSON.parse(fs.readFileSync(path.join(tmp, 'zips/manifest.json'), 'utf8'));

package/scripts/check-pod-calls.mjs

@@ -179,116 +179,13 @@ if (!failures) pass('every in-scope caller reaches the pod through a named opera
   pass('the library imports and runs against a stub with nothing but rdflib on the path');
 }
 
-// ---- 8. lib/session/ is a library on the same terms ----
+// ---- 8. the app binds the session library to its own database ----
+// The library (fediverse-session) checks itself in its own repository; what
+// is FediPod's is the name every signed-in browser holds its session under.
 {
-  const SESSION = path.join(root, 'lib/session');
-  const files = fs.readdirSync(SESSION).filter((f) => f.endsWith('.mjs'));
-  let bad = 0;
-  for (const f of files) {
-    const src = code(read(path.join(SESSION, f)));
-    for (const m of src.matchAll(/from\s+['"]([^'"]+)['"]/g)) {
-      if (!m[1].startsWith('./')) { fail(`lib/session/${f} imports ${m[1]} — the session library imports nothing but its own files`); bad++; }
-    }
-    if (/fedipod/i.test(src)) { fail(`lib/session/${f} names FediPod in code — the database and client names are the caller's`); bad++; }
-  }
-  const { solidOidcSession } = await import(path.join(SESSION, 'oidc-session.mjs'));
-  const oidc = solidOidcSession({ dbName: 'x', clientName: 'y' });
-  for (const k of ['beginLogin', 'completeLogin', 'getSession', 'signOut']) {
-    if (typeof oidc[k] !== 'function') { fail(`solidOidcSession() returned no ${k}`); bad++; }
-  }
-  // An address at a Gateway resolves to the POD's login, through the alias
-  // WebFinger names; an address on a Mastodon server is refused in words.
-  const { fediLogin, parseAddress } = await import(path.join(SESSION, 'fedi-login.mjs'));
-  const jrd = (host, aliases, self) => ({ ok: true, json: async () => ({ aliases, links: [{ rel: 'self', type: 'application/activity+json', href: self }] }) });
-  const stub = async (url) => {
-    if (url.startsWith('https://front.example/.well-known/webfinger')) return jrd('front.example', ['https://mei.pod.example/anything/ap/actor'], 'https://front.example/u/mei/ap/actor');
-    if (url.startsWith('https://masto.example/.well-known/webfinger')) return jrd('masto.example', ['https://masto.example/@kwame'], 'https://masto.example/users/kwame');
-    if (url === 'https://mei.pod.example/.well-known/openid-configuration') return { ok: true, json: async () => ({ issuer: 'https://pod.example/', authorization_endpoint: 'https://pod.example/.oidc/auth' }) };
-    // A pod whose host answers no discovery: the actor names the WebID, and
-    // the WebID document names the issuer.
-    if (url.startsWith('https://server.example/.well-known/webfinger')) return jrd('server.example', [], 'https://server.example/aisha/anything/ap/actor');
-    if (url === 'https://server.example/aisha/anything/ap/actor') return { ok: true, json: async () => ({ id: url, alsoKnownAs: ['https://server.example/aisha/profile/card#me'] }) };
-    if (url === 'https://server.example/aisha/profile/card#me') return { ok: true, json: async () => ([{ '@id': url, 'http://www.w3.org/ns/solid/terms#oidcIssuer': [{ '@id': 'https://idp.example/' }] }]) };
-    if (url === 'https://idp.example/.well-known/openid-configuration') return { ok: true, json: async () => ({ issuer: 'https://idp.example/', authorization_endpoint: 'https://idp.example/auth' }) };
-    return { ok: false, json: async () => ({}) };
-  };
-  const login = fediLogin({ dbName: 'x', fetch: stub });
-  const found = await login.resolve('@mei@front.example').catch((e) => ({ error: e.message }));
-  if (found.issuer !== 'https://pod.example/' || found.origin !== 'https://mei.pod.example' || found.actor !== 'https://front.example/u/mei/ap/actor') {
-    fail(`a fronted address did not resolve to its pod's login: ${JSON.stringify(found)}`); bad++;
-  }
-  const viaWebId = await login.resolve('@aisha@server.example').catch((e) => ({ error: e.message }));
-  if (viaWebId.issuer !== 'https://idp.example/' || viaWebId.webId !== 'https://server.example/aisha/profile/card#me') {
-    fail(`an address on a host without discovery did not resolve through its WebID: ${JSON.stringify(viaWebId)}`); bad++;
-  }
-  const typedWebId = await login.resolve('https://server.example/aisha/profile/card#me').catch((e) => ({ error: e.message }));
-  if (typedWebId.issuer !== 'https://idp.example/') { fail(`a typed WebID did not resolve: ${JSON.stringify(typedWebId)}`); bad++; }
-  const refused = await login.resolve('kwame@masto.example').then(() => '', (e) => e.message);
-  if (!/masto\.example is not a Solid pod/.test(refused)) { fail(`a Mastodon address was not refused in words: ${refused || 'resolved'}`); bad++; }
-  if (parseAddress('nonsense') !== null || parseAddress('@mei@Front.Example')?.at !== '@mei@front.example') { fail('parseAddress does not read @you@host'); bad++; }
-  // The account library tells a Mastodon address from a pod address and
-  // speaks to each: the Mastodon API for one, the outbox door for the other.
-  const { fediAccount, BROWSER_ACCOUNT_NOTICE } = await import(path.join(SESSION, 'fedi-account.mjs'));
-  const seen = [];
-  const acctStub = async (url, init = {}) => {
-    seen.push(`${init.method || 'GET'} ${url}`);
-    const ok = (body, headers = {}) => ({ ok: true, status: 200, headers: { get: (k) => headers[k] || null }, json: async () => body, text: async () => JSON.stringify(body) });
-    if (url.startsWith('https://masto.example/.well-known/webfinger')) return jrd('masto.example', ['https://masto.example/@kwame'], 'https://masto.example/users/kwame');
-    if (url === 'https://masto.example/api/v1/instance') return ok({ uri: 'masto.example', title: 'Masto' });
-    if (url === 'https://masto.example/api/v1/statuses' && init.method === 'POST') return ok({ id: '77', url: 'https://masto.example/@kwame/77' });
-    if (url.startsWith('https://masto.example/api/v1/timelines/home')) return ok([{ id: '1', url: 'https://masto.example/@aisha/1', created_at: '2026-09-20T10:00:00Z', content: '<p>hi</p>', account: { acct: 'aisha', display_name: 'Aisha', url: 'https://masto.example/@aisha' } }]);
-    if (url.startsWith('https://masto.example/api/v1/accounts/lookup')) return ok({ id: '9' });
-    if (url === 'https://masto.example/api/v1/accounts/9/follow') return ok({ following: true });
-    if (url === 'https://front.example/api/v1/instance' || url === 'https://mei.pod.example/api/v1/instance') return { ok: false, status: 404, json: async () => ({}) };
-    return stub(url, init);
-  };
-  const accounts = fediAccount({ dbName: 'x', fetch: acctStub, storage: undefined });
-  const kwame = await accounts.describe('@kwame@masto.example').catch((e) => ({ error: e.message }));
-  if (kwame.kind !== 'mastodon' || kwame.host !== 'masto.example') { fail(`a Mastodon address was not recognised: ${JSON.stringify(kwame)}`); bad++; }
-  const mei = await accounts.describe('@mei@front.example').catch((e) => ({ error: e.message }));
-  if (mei.kind !== 'pod' || mei.root !== 'https://mei.pod.example/anything/' || mei.issuer !== 'https://pod.example/') { fail(`a pod address was not recognised: ${JSON.stringify(mei)}`); bad++; }
-  // The Mastodon account acts through its server's API.
-  const store = { getItem: (k) => store.m.get(k) ?? null, setItem: (k, v) => store.m.set(k, String(v)), removeItem: (k) => store.m.delete(k), m: new Map() };
-  store.setItem('x:masto:account', JSON.stringify({ host: 'masto.example', token: 't', handle: '@kwame@masto.example', name: 'Kwame', actor: 'https://masto.example/@kwame' }));
-  const me = await fediAccount({ dbName: 'x', fetch: acctStub, storage: store }).current();
-  const posted = await me.post({ text: 'hello' }).catch((e) => ({ error: e.message }));
-  const tl = await me.timeline().catch((e) => ({ error: e.message }));
-  const followed = await me.follow('@aisha@masto.example').catch((e) => ({ error: e.message }));
-  if (me.kind !== 'mastodon' || me.notice !== null || posted.id !== '77' || tl[0]?.author?.handle !== '@aisha@masto.example' || followed.followed !== '@aisha@masto.example') {
-    fail(`the Mastodon account did not act through its API: ${JSON.stringify({ posted, tl, followed })}`); bad++;
-  }
-  // The pod account acts through its outbox door and reads its own records;
-  // a sealed key on the pod marks it browser-based, which sets the notice.
-  const doorSeen = [];
-  const podFetch = async (url, init = {}) => {
-    doorSeen.push(`${init.method || 'GET'} ${url}`);
-    if (url === 'https://front.example/u/mei/ap/outbox') return { ok: true, status: 202, headers: { get: (k) => (k === 'location' ? 'https://front.example/u/mei/ap/notes/n1' : null) }, text: async () => '' };
-    if (url === 'https://mei.pod.example/anything/ap-state/keys.json') return { ok: true, status: 200, json: async () => ({ v: 1, kdf: 'PBKDF2-SHA256', ct: 'x', salt: 'y' }) };
-    if (url === 'https://mei.pod.example/anything/ap-state/statuses.json') return { ok: true, status: 200, json: async () => ([{ noteId: 'https://x.example/n/1', actor: 'https://x.example/u/tamara', content: '<p>one</p>', published: '2026-09-20T09:00:00Z', kind: 'timeline' }, { noteId: 'https://x.example/n/2', actor: 'https://x.example/u/tamara', content: '<p>dm</p>', published: '2026-09-20T09:30:00Z', kind: 'timeline', direct: true }]) };
-    if (url === 'https://mei.pod.example/anything/ap-state/actors.json') return { ok: true, status: 200, json: async () => ({ 'https://x.example/u/tamara': { preferredUsername: 'tamara', name: 'Tamara' } }) };
-    return { ok: false, status: 404, json: async () => ({}), text: async () => '' };
-  };
-  const session = { webId: 'https://mei.pod.example/profile/card#me', fetch: podFetch, signOut: async () => {} };
-  const stubWithCard = async (url, init = {}) => {
-    if (url === 'https://mei.pod.example/profile/card#me') return { ok: true, json: async () => ([{ '@id': url, 'https://www.w3.org/ns/activitystreams#outbox': [{ '@id': 'https://front.example/u/mei/ap/outbox' }], 'http://xmlns.com/foaf/0.1/account': [{ '@id': 'https://front.example/u/mei/ap/actor' }] }]) };
-    if (url === 'https://front.example/u/mei/ap/actor') return { ok: true, json: async () => ({ id: url, preferredUsername: 'mei', name: 'Mei', followers: 'https://front.example/u/mei/ap/followers' }) };
-    return acctStub(url, init);
-  };
-  const podStore = { getItem: (k) => podStore.m.get(k) ?? null, setItem: (k, v) => podStore.m.set(k, String(v)), removeItem: (k) => podStore.m.delete(k), m: new Map() };
-  // Reach the pod account the way resume() would, with the session handed in.
-  const meiAcct = await fediAccount({ dbName: 'x', fetch: stubWithCard, storage: podStore })
-    ._podAccount(session, { handle: '@mei@front.example', actor: 'https://front.example/u/mei/ap/actor', root: 'https://mei.pod.example/anything/' });
-  const p2 = await meiAcct.post({ text: 'hello <b>' }).catch((e) => ({ error: e.message }));
-  const t2 = await meiAcct.timeline().catch((e) => ({ error: e.message }));
-  const f2 = await meiAcct.follow('@tamara@x.example').catch((e) => ({ error: e.message }));
-  const doorBodies = doorSeen.filter((s) => s.startsWith('POST https://front.example/u/mei/ap/outbox')).length;
-  if (meiAcct.kind !== 'pod' || meiAcct.notice !== BROWSER_ACCOUNT_NOTICE || !p2.queued || p2.id !== 'https://front.example/u/mei/ap/notes/n1'
-    || t2.length !== 1 || t2[0].author.handle !== '@tamara@x.example' || !f2.queued || doorBodies !== 2) {
-    fail(`the pod account did not act through its door: ${JSON.stringify({ notice: meiAcct.notice, p2, t2, f2, doorBodies })}`); bad++;
-  }
   const bound = code(read(path.join(root, 'web/app/oidc-session.mjs')));
-  if (!/dbName:\s*'fedipod-oidc'/.test(bound)) { fail("web/app/oidc-session.mjs must bind dbName 'fedipod-oidc' — every signed-in browser holds its session under that name"); bad++; }
-  if (!bad) pass('lib/session/ imports nothing above itself, names no application, tells a Mastodon address from a pod one and acts through each, and the app binds its own database name');
+  if (!/dbName:\s*'fedipod-oidc'/.test(bound)) fail("web/app/oidc-session.mjs must bind dbName 'fedipod-oidc' — every signed-in browser holds its session under that name");
+  else pass("the app binds the session library to its own database name");
 }
 
 // ---- 9. core is a library: nothing in it reaches the DeviceAgent, and every entry loads alone ----

package/scripts/check-sizes.mjs

@@ -1,14 +1,17 @@
 #!/usr/bin/env node
 // check-sizes.mjs — no runtime source file over 1,000 lines. The split of
 // 2026-09-11 made every module readable one part at a time; this keeps it so.
-// Run by `npm test`. Exits 1 naming the offenders.
+// Run by `npm test`, and on the forum's and the Server's sources (named as
+// arguments) by scripts/test-dependents.mjs. Exits 1 naming the offenders.
+//
+//   node scripts/check-sizes.mjs [extra source folder ...]
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const LIMIT = 1000;
-const ROOTS = ['lib', 'bin', 'web/app', 'web/front', 'web/admin', 'netlify/functions', 'packages/fedipod-server/src', 'packages/css-nextgraph/src', 'packages/fedipod-bb/src'];
+const ROOTS = ['lib', 'bin', 'web/app', 'web/front', 'web/admin', 'netlify/functions', ...process.argv.slice(2).map(d => path.resolve(d))];
 const FILES = ['run-agent.mjs'];
 const SKIP = /\/(dist|site|node_modules|vendor|client|shims)\//u;
 const EXT = /\.(mjs|js|ts)$/u;
@@ -21,7 +24,7 @@ const walk = (dir, out = []) => {
   }
   return out;
 };
-const files = [...FILES.map(f => path.join(root, f)), ...ROOTS.flatMap(r => (fs.existsSync(path.join(root, r)) ? walk(path.join(root, r)) : []))];
+const files = [...FILES.map(f => path.join(root, f)), ...ROOTS.flatMap(r => (fs.existsSync(path.resolve(root, r)) ? walk(path.resolve(root, r)) : []))];
 const over = files
   .map(f => ({ f: path.relative(root, f), n: fs.readFileSync(f, 'utf8').split('\n').length }))
   .filter(x => x.n > LIMIT)

package/scripts/dependents.mjs

@@ -0,0 +1,76 @@
+// dependents.mjs — the packages built on fedipod, each in a repository of its
+// own, and where this machine keeps each one. A checkout beside FediPod
+// (../fedipod-bb and so on) is used as it stands, edits and all; failing that,
+// a shallow clone of its main branch under .dependents/, which is what CI and
+// anyone else's clone get.
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+export const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+// `fedipod`: whether its tests import fedipod, and so run against this checkout.
+// `sizes`: its source folder, held to FediPod's size limit.
+export const DEPENDENTS = {
+  'fedipod-server': {
+    repo: 'https://github.com/jeff-zucker/fedipod-server.git', fedipod: true, sizes: 'src',
+    tests: [['npm', 'test'], ['npm', 'run', 'test:e2e'], ['npm', 'run', 'test:e2e:suffix']],
+  },
+  'fedipod-bb': {
+    repo: 'https://github.com/jeff-zucker/fedipod-bb.git', fedipod: true, sizes: 'src',
+    tests: [['npm', 'test']],
+  },
+  'fediverse-session': {
+    repo: 'https://github.com/jeff-zucker/fediverse-session.git', fedipod: false,
+    tests: [['npm', 'test']],
+  },
+};
+
+const nameOf = (dir) => {
+  try { return JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8')).name; } catch { return null; }
+};
+
+/** The folder holding this dependent: the checkout beside FediPod, else .dependents/<name>. */
+export function dependentDir(name) {
+  const beside = path.resolve(root, '..', name);
+  return nameOf(beside) === name ? beside : path.join(root, '.dependents', name);
+}
+
+/** The dependent's folder, cloned from its repository first when there is none. */
+export function fetchDependent(name, { log = console.log } = {}) {
+  const dir = dependentDir(name);
+  if (nameOf(dir) === name) return dir;
+  log(`dependents: cloning ${DEPENDENTS[name].repo} into ${path.relative(root, dir)}`);
+  fs.mkdirSync(path.dirname(dir), { recursive: true });
+  execFileSync('git', ['clone', '--quiet', '--depth', '1', DEPENDENTS[name].repo, dir], { stdio: 'inherit' });
+  return dir;
+}
+
+/** Its packages installed, when it has any and they are not there yet. */
+export function installDependent(dir, { log = console.log } = {}) {
+  const pkg = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8'));
+  const wants = Object.keys({ ...pkg.dependencies, ...pkg.devDependencies }).length > 0;
+  if (!wants || fs.existsSync(path.join(dir, 'node_modules'))) return;
+  const lock = fs.existsSync(path.join(dir, 'package-lock.json'));
+  log(`dependents: npm ${lock ? 'ci' : 'install'} in ${dir}`);
+  execFileSync('npm', [lock ? 'ci' : 'install', '--no-audit', '--no-fund'], { cwd: dir, stdio: 'inherit' });
+}
+
+/** Its `fedipod` pointed at this checkout, replacing whatever npm put there. */
+export function linkFedipod(dir) {
+  const link = path.join(dir, 'node_modules', 'fedipod');
+  const real = (p) => { try { return fs.realpathSync(p); } catch { return null; } };
+  if (real(link) === real(root)) return;
+  fs.rmSync(link, { recursive: true, force: true });
+  fs.mkdirSync(path.dirname(link), { recursive: true });
+  fs.symlinkSync(root, link, 'dir');
+}
+
+/** The dependent made ready to run against this checkout. */
+export function readyDependent(name, opts = {}) {
+  const dir = fetchDependent(name, opts);
+  installDependent(dir, opts);
+  if (DEPENDENTS[name].fedipod) linkFedipod(dir);
+  return dir;
+}

package/scripts/stage-site.mjs

@@ -13,10 +13,11 @@
 // source is the hardest kind of thing to see in the browser build.
 import fs from 'node:fs'; import path from 'node:path'; import { fileURLToPath } from 'node:url';
 import { createHash } from 'node:crypto';
+import { readyDependent } from './dependents.mjs';
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const site = path.join(root, 'web/app/site');
 fs.rmSync(site, { recursive: true, force: true }); fs.mkdirSync(path.join(site, 'app'), { recursive: true });
-const cp = (from, to) => fs.copyFileSync(path.join(root, from), path.join(site, to));
+const cp = (from, to) => fs.copyFileSync(path.resolve(root, from), path.join(site, to));
 cp('web/app/index.html', 'index.html');
 cp('web/app/dist/boot.js', 'boot.js');
 cp('web/app/dist/sw.js', 'sw.js');
@@ -267,21 +268,22 @@ fs.writeFileSync(path.join(site, '_redirects'), [
 // own /u/<handle>/ or a pod named outright. Its script is a module file of
 // its own, so it is served under the same `script-src 'self'` as the app.
 fs.mkdirSync(path.join(site, 'bb'), { recursive: true });
-for (const f of ['index.html', 'bb.js', 'read.mjs', 'masto.mjs', 'pod.mjs', 'markdown.mjs', 'seen.mjs', 'mine.mjs', 'private.mjs', 'oidc-session.mjs']) cp(`packages/fedipod-bb/site/${f}`, `bb/${f}`);
+for (const f of ['index.html', 'bb.js', 'read.mjs', 'masto.mjs', 'pod.mjs', 'markdown.mjs', 'seen.mjs', 'mine.mjs', 'private.mjs', 'oidc-session.mjs']) cp(`node_modules/fedipod-bb/site/${f}`, `bb/${f}`);
 cp('web/admin/tokens.css', 'bb/tokens.css');   // the site's shared palette, size and family
-cp('lib/session/oidc-session.mjs', 'bb/solid-oidc-session.mjs');   // signing in to a pod: the library the forum's binding names
-// The account library's demo page, with the library beside it, under /demo/.
+cp('node_modules/fediverse-session/oidc-session.mjs', 'bb/solid-oidc-session.mjs');   // signing in to a pod: the library the forum's binding names
+// The account library's demo page, with the library beside it, under /demo/:
+// both from the library's own repository, since the package carries no demo.
+const sessionRepo = readyDependent('fediverse-session');
 fs.mkdirSync(path.join(site, 'demo'), { recursive: true });
-for (const f of ['fedi-account.mjs', 'fedi-login.mjs', 'oidc-session.mjs']) cp(`lib/session/${f}`, `demo/${f}`);
+for (const f of ['fedi-account.mjs', 'fedi-login.mjs', 'oidc-session.mjs']) cp(path.join(sessionRepo, f), `demo/${f}`);
 cp('web/admin/tokens.css', 'demo/tokens.css');
 // The page a Mastodon app sends its person to (lib/gateway/masto-gateway.mjs),
 // with the pod sign-in library and the palette beside it, as the demo has.
 fs.mkdirSync(path.join(site, 'app-signin'), { recursive: true });
 for (const f of ['index.html', 'app-signin.mjs']) cp(`web/app-signin/${f}`, `app-signin/${f}`);
-for (const f of ['fedi-login.mjs', 'oidc-session.mjs']) cp(`lib/session/${f}`, `app-signin/${f}`);
+for (const f of ['fedi-login.mjs', 'oidc-session.mjs']) cp(`node_modules/fediverse-session/${f}`, `app-signin/${f}`);
 cp('web/admin/tokens.css', 'app-signin/tokens.css');
-fs.writeFileSync(path.join(site, 'demo/index.html'),
-  fs.readFileSync(path.join(root, 'lib/session/demo.html'), 'utf8').replace('../../web/admin/tokens.css', './tokens.css'));
+cp(path.join(sessionRepo, 'demo.html'), 'demo/index.html');
 // Each file the forum page loads is named with a hash of its content. A
 // browser holding the last build cannot serve half of it back: the page is
 // revalidated (no-cache below) and every url under it changes with its bytes.

package/scripts/start.mjs

@@ -7,7 +7,7 @@ console.log(`FediPod is not started from this directory.
   In a browser:        open a Gateway such as https://fedipod.net and create an
                        account. Nothing is installed.
   A Gateway of your own:  deploy this repository to Netlify — netlify/README.md
-  A pod server with FediPod built in:  packages/fedipod-server/README.md
-  A forum:             packages/fedipod-bb/README.md, or "A forum" on a
+  A pod server with FediPod built in:  https://github.com/jeff-zucker/fedipod-server
+  A forum:             https://github.com/jeff-zucker/fedipod-bb, or "A forum" on a
                        Gateway's sign-up page
 `);

package/scripts/test-dependents.mjs

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+// test-dependents.mjs — every package built on fedipod, tested against this
+// checkout: the Server, the forum and the session library, each from the
+// folder dependents.mjs finds it in. Run by `npm test` before the browser rigs,
+// which boot their scratch pod server from the Server's folder. A dependent
+// that cannot be fetched, installed or run fails the whole run; none is ever
+// skipped. Exits 1, the failures named in its last lines.
+//
+//   node scripts/test-dependents.mjs [name ...]
+import path from 'node:path';
+import { spawnSync, execFileSync } from 'node:child_process';
+import { DEPENDENTS, readyDependent, root } from './dependents.mjs';
+
+const names = process.argv.slice(2).length ? process.argv.slice(2) : Object.keys(DEPENDENTS);
+const failed = [];
+for (const name of names) {
+  const spec = DEPENDENTS[name];
+  if (!spec) { failed.push(`${name}: not a dependent`); continue; }
+  let dir;
+  try { dir = readyDependent(name); }
+  catch (e) { failed.push(`${name}: could not be made ready (${e.message})`); continue; }
+  console.log(`\n== ${name} (${dir}) against this checkout`);
+  for (const cmd of spec.tests) {
+    const r = spawnSync(cmd[0], cmd.slice(1), { cwd: dir, stdio: 'inherit' });
+    if (r.status !== 0) failed.push(`${name}: \`${cmd.join(' ')}\` failed (exit ${r.status ?? r.signal})`);
+  }
+  if (spec.sizes) {
+    try { execFileSync(process.execPath, [path.join(root, 'scripts/check-sizes.mjs'), path.join(dir, spec.sizes)], { stdio: 'inherit' }); }
+    catch { failed.push(`${name}: a source file is over the size limit`); }
+  }
+}
+if (failed.length) {
+  console.error(`\ntest-dependents: ${failed.length} FAILED`);
+  for (const f of failed) console.error(`  ${f}`);
+  process.exit(1);
+}
+console.log(`\ntest-dependents: ${names.join(', ')} pass against this checkout`);

package/web/admin/index.html

@@ -527,7 +527,8 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
     <p><strong>This cannot be undone.</strong> A Delete goes to every follower's inbox telling
       those servers to drop the account and the posts they cached, the actor document is
       replaced with a Tombstone, and this agent will refuse to start again for this pod. Your
-      posts and RDF stay on the pod; the identity does not come back.</p>
+      WebID profile and public type index stop naming the account. Your posts and RDF stay on
+      the pod; the identity does not come back.</p>
     <p>Two things that are not this, and can be done from here:
       <button type="button" id="go-park" title="   Park instead: keeps the handle, just stops the mail" class="inline">Park it instead</button>
       keeps the handle resolving and just stops the mail — setting status back to

package/web/app/agent.mjs

@@ -152,8 +152,9 @@ export class BrowserAgent {
 
   // One call to the gateway's owner API, proved with the pod session. What
   // comes back on 200 or 410 is the account's standing there, kept for the
-  // manage page; anything else is logged and forgotten.
-  async tellGateway(what, body) {
+  // manage page; anything else is logged and forgotten. `standing: false` for
+  // a call whose answer says nothing about the account's standing.
+  async tellGateway(what, body, { standing = true } = {}) {
     if (!this.gatewayApi) return null;
     let res;
     try {
@@ -163,15 +164,38 @@ export class BrowserAgent {
     } catch (e) { this.log(`gateway ${what}: ${e.message}`); return null; }
     const json = await res.json().catch(() => ({}));
     const out = { status: res.status, ...json };
-    if (res.status === 200 || res.status === 410) this.gatewayStanding = out;
+    if (res.status === 200 || res.status === 410) { if (standing) this.gatewayStanding = out; }
     else this.log(`gateway ${what}: ${res.status} ${json.error || ''}`);
     return out;
   }
-  openAtGateway() { return this.tellGateway('open', { handle: this.doorKey }); }
+  // The account's picture goes with it, for the address's WebFinger answer;
+  // said only once the account has been read, so "none" is never a guess.
+  openAtGateway() {
+    const config = this.store?.getConfig?.();
+    return this.tellGateway('open', { handle: this.doorKey, ...(config ? { icon: config.icon || null } : {}) });
+  }
   pauseAtGateway(paused) { return this.tellGateway('pause', { handle: this.doorKey, paused: !!paused }); }
   closeAtGateway() { return this.tellGateway('close', { handle: this.doorKey, confirm: true }); }
   static OPEN_EVERY_MS = 60 * 60_000;
 
+  // A notification made here, from mail read while FediPod is open, goes to
+  // the phones the owner signed up, as one made while it is closed does
+  // (lib/gateway/held-mail.mjs: /api/push). Named a moment later, once written,
+  // so a burst is one call. One from another network is not pushed.
+  static PUSH_AFTER_MS = 2_000;
+  notePush(n) {
+    if (!this.gatewayApi || n?.bsky || n?.via) return;
+    if (!Object.keys(this.store.read('webpush.json', { subs: {} }).subs || {}).length) return;
+    (this._toPush ||= new Set()).add(n.id);
+    this._pushTimer ||= setTimeout(async () => {
+      const ids = [...this._toPush];
+      this._toPush.clear();
+      this._pushTimer = null;
+      await this.store.flush?.().catch(() => {});
+      await this.tellGateway('push', { handle: this.doorKey, ids }, { standing: false });
+    }, BrowserAgent.PUSH_AFTER_MS);
+  }
+
   // The gateway acting for this account while the app is closed, or not. On:
   // the rules on the account's folders name the gateway's pod identity, then
   // the gateway is told. Off: the gateway is told first, so it stops, then the
@@ -304,6 +328,7 @@ export class BrowserAgent {
           if (this.viewer) return;              // another agent holds the copy: reading only
         }
       }
+      this.store.onEvent = (type, n) => { if (type === 'notification') this.notePush(n); };
       const now = Date.now();
       // Said before the drain starts, so held mail is in the inbox to be read.
       const hereDue = !warm || now - (warm.hereAt || 0) >= BrowserAgent.HERE_EVERY_MS;