fedipod 1.7.0 → 1.10.0

package/README.md

@@ -9,15 +9,14 @@ one timeline. Your posts, followers and settings stay on your pod.
 The easiest way to run FediPod is to use it in any browser at https://fedipod.net. Nothing to install. A wizard will walk you through getting a pod (you can also bring your own) and creating a Fediverse identity attached to the pod.  
 
 There are also a number of [other ways to run FediPod](#other-ways-to-run-fedipod) which offer a variety of scenarios.  If interested in the code, see also : [architecture overview](architecture.md) and [files overview](files-overview.md).
+Which specs FediPod follows, and where it stops short: [specs-in-use.md](specs-in-use.md).
 
 ## Requirements
 
 - A current browser, on a desktop or a phone.
 - A Solid pod with a host name of its own, such as
   `https://alice.solidcommunity.net/`. Sign-up can create one for you at
-  solidcommunity.net or another provider, or use a pod you already have. A
-  pod that lives on a suffix-based host, like `https://server.example/alice/`,
-  cannot be a Fediverse address.
+  solidcommunity.net or another provider, or use a pod you already have.
   A pod on a suffix-based host, like `https://server.example/alice/`,
   works too. Its address is then `@handle@fedipod.net`, because the shared
   host cannot answer for the handle; your posts, key and data stay on your pod.
@@ -38,9 +37,16 @@ There are also a number of [other ways to run FediPod](#other-ways-to-run-fedipo
 4. Enter your pod password once. It creates the account and locks your
    signing key. The password is not stored.
 
+<!-- CLAUDE 2026-09-15 — the short profile address; delete these markers when done -->
+Anyone can open your profile at `https://fedipod.net/@handle`, signed in or
+not.
+<!-- /CLAUDE -->
+
 Your account then opens in the client. To use it from another browser, go to
 https://fedipod.net, enter your address, sign in at your pod, and unlock your
 key with your password once on that browser.
+If you have changed your pod password since you signed up, choose "make a new
+signing key" on that screen and use the password you use now.
 
 ## What you can do
 
@@ -70,6 +76,11 @@ hands back stays in your browser unless you choose to keep it on your pod.
 domain blocks import from the manage page. Your old account can be listed as
 an alias, so a Move from it lands here.
 
+**Posting from another app.** Any app that speaks ActivityPub
+client-to-server, dokieli for one, can post as you. It sends to the outbox
+address in your actor document, which your WebID profile also names, signed in
+at your pod. The post goes out the next time you open fedipod.net.
+
 **The manage page.** `manage account` in the bar opens it: your profile,
 aliases, the gateway, key rotation, recovering posts, parking, moving to
 another server, retiring, and clearing a backlog. It is the same interface

package/gateway.md

@@ -10,6 +10,9 @@ Your name, your signing key and your data stay on your own pod. The gateway is
 **keyless** — it never holds the key you sign with, so it cannot post as you,
 read your private things, or be you anywhere. The worst a broken one can do is
 push items into your inbox, and those still face your agent's own checks.
+With the outbox door below, a gateway can also hand your agent a post marked as
+yours, which your agent then signs and sends. It still holds no key, but what you
+trust it with grows by that much.
 
 A FediPod install works without any gateway at all. Deliveries go straight to
 your pod inbox, which holds them whether your agent is running or not.
@@ -102,6 +105,19 @@ yourself. When you attach to a multi-user gateway, the direction is reversed:
 the gateway mints the secret and answers the attach with it, and your agent
 records it.
 
+## The outbox door
+
+The gateway also takes your own posts from any app that speaks ActivityPub
+client-to-server, dokieli for one. Your actor document names the door as your
+outbox, and your WebID profile names it as `as:outbox`. The app sends the post
+there, signed in at your pod. The door checks that the token is yours, puts the
+post in your inbox marked as yours, and answers with the address the post will
+have. Your agent publishes it and sends it to your followers the next time it
+runs: for a browser account, the next time you open the site.
+
+A post with no audience of its own goes out as a public post. A post that is
+not a note, an annotation say, is kept as the app sent it, under your name.
+
 ## What the gateway can see
 
 It reads only public data to decide what concerns you: your published

package/groups.md

@@ -55,6 +55,7 @@ queue is its own list, separate from post review, and appears on the group's
 admin page as **Moderation requests** when something is waiting: carry it out,
 or turn it down.
 A followed group's own announced deletion of a post it carried to you is honoured.
+A group that withdraws a post it carried to you takes it off your timeline too.
 
 ## Inviting people
 

package/lib/client/c2s.mjs

@@ -8,6 +8,11 @@
 // GETs on the actor and outbox are redirects: the pod's documents are the
 // canonical ones, and a second renderer here would only drift from them.
 //
+// `dispatch` takes an activity and answers with { status, body, headers }; it
+// touches no request or response. The HTTP handler below is one caller. The
+// other is the inbox drain, handing over an activity the Gateway took at the
+// outbox door on the owner's behalf and stamped as theirs.
+//
 // The inbox is the exception, and has to be. Deliveries land in a container on
 // the pod which the drain empties as it handles each item, so reading that
 // container tells the owner only what has not been dealt with yet. What was
@@ -18,6 +23,7 @@
 import * as social from '../core/social.mjs';
 import * as wire from '../core/wire.mjs';
 import { readLenient } from '../core/as2.mjs';
+import { safeSlug } from '../core/publisher/notes.mjs';
 
 const MAX_BODY = 512 * 1024;          // same ceiling the inbox drain enforces
 
@@ -154,7 +160,10 @@ export class C2S {
   async handle(req, res, pathname, url) {   // eslint-disable-line no-unused-vars
     if (pathname !== '/ap/outbox' && pathname !== '/ap/actor' && pathname !== '/ap/inbox') return false;
     if (req.method === 'OPTIONS') {
-      res.writeHead(204, { allow: pathname === '/ap/inbox' ? 'GET, OPTIONS' : 'GET, POST, OPTIONS' });
+      // Accept-Post is what a client such as dokieli reads to choose a format;
+      // naming JSON only is what makes it send JSON-LD rather than HTML.
+      res.writeHead(204, pathname === '/ap/inbox' ? { allow: 'GET, OPTIONS' }
+        : { allow: 'GET, POST, OPTIONS', 'accept-post': 'application/ld+json, application/activity+json' });
       res.end(); return true;
     }
     if (!this.agent.configured() || !this.urls) {
@@ -166,7 +175,7 @@ export class C2S {
           + 'actor document names; this address is the owner reading their own' });
       }
       const reader = await this.auth(req, pathname);
-      if (!reader.ok) return this.send(res, reader.status, { error: reader.error });
+      if (!reader.ok) return this.send(res, reader.status, { error: reader.error }, reader.headers || {});
       return this.sendInbox(res, url);
     }
     if (req.method === 'GET' || req.method === 'HEAD') {
@@ -181,7 +190,7 @@ export class C2S {
     }
 
     const who = await this.auth(req, pathname);
-    if (!who.ok) return this.send(res, who.status, { error: who.error });
+    if (!who.ok) return this.send(res, who.status, { error: who.error }, who.headers || {});
 
     // A viewer (another agent holds the lease) may not act — but the user
     // acting HERE outranks an idle active agent elsewhere, exactly as on the
@@ -196,9 +205,16 @@ export class C2S {
     // takes decisions from it and the publisher builds the document that is
     // actually posted, so nothing a client sent is republished verbatim and a
     // term it aliased still means what it says.
-    let activity;
+    // `raw` is the document as the client wrote it. The graph is what
+    // decisions are taken from; the bytes are what an object that is stored
+    // as sent (publishObject) is stored from — a read against our contexts
+    // rewrites a stranger's terms to full IRIs, which is right for reading and
+    // wrong for keeping.
+    let activity; let raw = null;
     try {
-      const read = await readLenient(await readBody(req));
+      const body = await readBody(req);
+      try { raw = JSON.parse(body); } catch { raw = null; }
+      const read = await readLenient(body);
       activity = read.view ?? read.doc;
     } catch (e) {
       return this.send(res, 400, { error: `unreadable body: ${e.message}` });
@@ -206,34 +222,57 @@ export class C2S {
     if (!activity || typeof activity !== 'object' || Array.isArray(activity) || !activity.type) {
       return this.send(res, 400, { error: 'a typed ActivityStreams object is required' });
     }
-    // A bare object arrives without an activity around it; the server supplies
-    // the Create (§6.2.1), carrying the object's own addressing up onto it.
-    if (!ACTIVITY_TYPES.has(activity.type)) {
-      activity = { type: 'Create', object: activity, to: activity.to, cc: activity.cc };
-    }
-
-    try {
-      return await this.dispatch(res, activity);
-    } catch (e) {
-      this.log(`c2s ${activity.type}: ${e.message}`);
-      return this.send(res, 422, { error: e.message || String(e) });
-    }
+    // The name the client asks for its new document (LDP's Slug), taken when
+    // it is plain and free — it is what lets the client know the address of
+    // what it made before anything answers.
+    const slug = safeSlug(req.headers.slug) || null;
+    const r = await this.dispatch(activity, { slug, raw });
+    return this.send(res, r.status, r.body, r.headers);
   }
 
   // Addressing → the facade's four visibilities, inverting the table the
-  // composer writes (wire.noteDoc). Addressing is required: a post whose
-  // audience the client never stated is not guessed at in either direction.
+  // composer writes (wire.addressing). Nothing stated is a public post — what
+  // every client means by a post with no audience chosen, and what a client
+  // that never addresses (dokieli's annotations) needs.
   visibilityOf(activity, object) {
     const to = arr(activity.to ?? object?.to).map(idOf);
     const cc = arr(activity.cc ?? object?.cc).map(idOf);
-    if (!to.length && !cc.length) return null;
+    if (!to.length && !cc.length) return 'public';
     if (to.includes(wire.PUBLIC)) return 'public';
     if (cc.includes(wire.PUBLIC)) return 'unlisted';
     if (to.includes(this.urls.followers)) return 'private';
     return 'direct';
   }
 
-  async dispatch(res, activity) {
+  async dispatch(activity, { slug = null, raw = null } = {}) {
+    const reply = (status, body, headers = {}) => ({ status, body, headers });
+    if (!activity || typeof activity !== 'object' || Array.isArray(activity) || !activity.type) {
+      return reply(400, { error: 'a typed ActivityStreams object is required' });
+    }
+    // A bare object arrives without an activity around it; the server supplies
+    // the Create (§6.2.1), carrying the object's own addressing up onto it.
+    if (!ACTIVITY_TYPES.has(activity.type)) {
+      activity = { type: 'Create', object: activity, to: activity.to, cc: activity.cc };
+    }
+    try {
+      return await this._dispatch(activity, { slug, raw, reply });
+    } catch (e) {
+      this.log(`c2s ${activity?.type}: ${e.message}`);
+      return reply(422, { error: e.message || String(e) });
+    }
+  }
+
+  // The actors a client addressed by id, beyond the audience words: the ones
+  // in to/cc are listed and delivered to; the ones in bto/bcc are delivered
+  // to and never listed (§6).
+  addressedActors(activity, object) {
+    const pick = (...fields) => [...new Set(fields.flatMap((f) => arr(activity[f] ?? object?.[f]).map(idOf)))]
+      .filter((a) => typeof a === 'string' && /^https?:\/\//u.test(a)
+        && a !== wire.PUBLIC && a !== this.urls.followers && a !== this.urls.actor);
+    return { also: pick('to', 'cc'), deliverTo: pick('bto', 'bcc') };
+  }
+
+  async _dispatch(activity, { slug, raw, reply }) {
     const agent = this.agent;
     const object = typeof activity.object === 'object' && activity.object !== null
       ? activity.object : null;
@@ -242,18 +281,23 @@ export class C2S {
     switch (activity.type) {
       case 'Create': {
         const makes = object?.type || 'Note';
-        if (!object || (makes !== 'Note' && makes !== 'Question')) {
-          return this.send(res, 422, { error: 'only a Note or a Question (or a bare Note) can be created here' });
-        }
+        if (!object) return reply(422, { error: 'a Create carries the object it creates' });
         const visibility = this.visibilityOf(activity, object);
-        if (!visibility) {
-          return this.send(res, 400, { error: 'state the audience: to/cc must address someone (as:Public, your followers collection, or actors)' });
+        const { also, deliverTo } = this.addressedActors(activity, object);
+        // Not a Note and not a poll: stored as sent, under this actor, and
+        // the Create around it delivered — a Web Annotation, for one.
+        if (makes !== 'Note' && makes !== 'Question') {
+          const asSent = raw && typeof raw === 'object' && !Array.isArray(raw)
+            ? (ACTIVITY_TYPES.has(raw.type) ? (raw.object && typeof raw.object === 'object' ? raw.object : null) : raw)
+            : null;
+          const made = await agent.publisher.publishObject(asSent || object, { visibility, slug, also, deliverTo });
+          return reply(201, { id: made.createId, object: made.id }, { location: made.createId });
         }
         // `source.content` is the client's plain text when it sends one; bare
         // `content` is TREATED as plain text and escaped — markup survives as
         // visible characters rather than as markup. Documented v1 limit.
         const text = String(object.source?.content ?? object.content ?? '');
-        if (!text.trim()) return this.send(res, 422, { error: 'the note has no content' });
+        if (!text.trim()) return reply(422, { error: 'the note has no content' });
 
         // A Question is a poll: the choices are in oneOf (pick one) or anyOf
         // (pick several), each naming itself, and endTime is when it shuts.
@@ -269,12 +313,13 @@ export class C2S {
               inReplyTo: idOf(object.inReplyTo) || undefined,
               visibility,
               spoilerText: object.summary || null,
+              sensitive: object.sensitive === true,
             });
-            return this.send(res, 201,
+            return reply(201,
               { id: wire.createActivityId(question.id), object: question.id },
               { location: wire.createActivityId(question.id) });
           } catch (e) {
-            return this.send(res, 422, { error: e.message });
+            return reply(422, { error: e.message });
           }
         }
 
@@ -287,22 +332,24 @@ export class C2S {
           attachments,
           visibility,
           spoilerText: object.summary || null,
+          sensitive: object.sensitive === true,
+          slug, also, deliverTo,
         });
-        return this.send(res, 201, { id: wire.createActivityId(note.id), object: note.id },
+        return reply(201, { id: wire.createActivityId(note.id), object: note.id },
           { location: wire.createActivityId(note.id) });
       }
 
       case 'Update': {
         if (objectId === this.urls.actor) {
-          return this.send(res, 422, { error: 'edit the profile on the admin surface; actor updates are not taken here' });
+          return reply(422, { error: 'edit the profile on the admin surface; actor updates are not taken here' });
         }
         const s = this.byIri(objectId);
-        if (!s) return this.send(res, 404, { error: 'no such note here' });
+        if (!s) return reply(404, { error: 'no such note here' });
         if (s.actor !== this.urls.actor || s.kind !== 'post') {
-          return this.send(res, 403, { error: 'not your note' });
+          return reply(403, { error: 'not your note' });
         }
         const text = String(object?.source?.content ?? object?.content ?? '');
-        if (!text.trim()) return this.send(res, 422, { error: 'the edit has no content' });
+        if (!text.trim()) return reply(422, { error: 'the edit has no content' });
         const attachments = object?.attachment !== undefined
           ? arr(object.attachment).map((a) => ({
             url: a?.url, mediaType: a?.mediaType,
@@ -310,54 +357,55 @@ export class C2S {
           })).filter((a) => a.url)
           : null;
         await agent.publisher.updateNote(s, {
-          content: text, spoilerText: object?.summary || null, attachments,
+          content: text, spoilerText: object?.summary || null,
+          sensitive: object?.sensitive === undefined ? null : object.sensitive === true, attachments,
         });
-        return this.send(res, 200, { ok: true, object: s.noteId });
+        return reply(200, { ok: true, object: s.noteId });
       }
 
       case 'Delete': {
         if (objectId === this.urls.actor) {
-          return this.send(res, 422, { error: 'retiring the actor is done on the admin surface, where it asks twice' });
+          return reply(422, { error: 'retiring the actor is done on the admin surface, where it asks twice' });
         }
         const s = this.byIri(objectId);
-        if (!s) return this.send(res, 404, { error: 'no such note here' });
+        if (!s) return reply(404, { error: 'no such note here' });
         if (s.actor !== this.urls.actor || s.kind !== 'post') {
-          return this.send(res, 403, { error: 'not your note' });
+          return reply(403, { error: 'not your note' });
         }
         const r = await social.deleteNote(agent, s);
-        if (!r.ok) return this.send(res, 502, { error: r.error, stillPublished: r.stillPublished });
-        return this.send(res, 200, { ok: true });
+        if (!r.ok) return reply(502, { error: r.error, stillPublished: r.stillPublished });
+        return reply(200, { ok: true });
       }
 
       case 'Follow': {
-        if (!objectId) return this.send(res, 400, { error: 'whom? object must name an actor' });
+        if (!objectId) return reply(400, { error: 'whom? object must name an actor' });
         // An acct: form or bare handle resolves through WebFinger; an https
         // IRI is fetched directly.
         if (/^acct:|^@|^[^/@]+@[^/@]+$/.test(objectId) && !/^https?:/.test(objectId)) {
           const r = await social.followHandle(agent, objectId.replace(/^acct:/, ''));
           const rec = this.store.getContacts().following.find((f) => f.actor === r.actor);
-          return this.send(res, 201, { id: rec?.followActivity?.id, object: r.actor },
+          return reply(201, { id: rec?.followActivity?.id, object: r.actor },
             rec?.followActivity?.id ? { location: rec.followActivity.id } : {});
         }
         const doc = await social.followActor(agent, objectId);
         const rec = this.store.getContacts().following.find((f) => f.actor === doc.id);
-        return this.send(res, 201, { id: rec?.followActivity?.id, object: doc.id },
+        return reply(201, { id: rec?.followActivity?.id, object: doc.id },
           rec?.followActivity?.id ? { location: rec.followActivity.id } : {});
       }
 
       case 'Like': {
         const s = this.byIri(objectId);
-        if (!s) return this.send(res, 422, { error: 'that note is not held here — like what the timeline holds' });
+        if (!s) return reply(422, { error: 'that note is not held here — like what the timeline holds' });
         const updated = await social.favourite(agent, s);
-        return this.send(res, 201, { id: updated.likeActivity?.id, object: s.noteId },
+        return reply(201, { id: updated.likeActivity?.id, object: s.noteId },
           updated.likeActivity?.id ? { location: updated.likeActivity.id } : {});
       }
 
       case 'Announce': {
         const s = this.byIri(objectId);
-        if (!s) return this.send(res, 422, { error: 'that note is not held here — boost what the timeline holds' });
+        if (!s) return reply(422, { error: 'that note is not held here — boost what the timeline holds' });
         const updated = await social.reblog(agent, s);
-        return this.send(res, 201, { id: updated.announceActivity?.id, object: s.noteId },
+        return reply(201, { id: updated.announceActivity?.id, object: s.noteId },
           updated.announceActivity?.id ? { location: updated.announceActivity.id } : {});
       }
 
@@ -368,37 +416,37 @@ export class C2S {
         const innerId = idOf(activity.object);
         if (inner?.type === 'Block') {
           const target = idOf(inner.object);
-          if (!target) return this.send(res, 400, { error: 'unblock whom?' });
+          if (!target) return reply(400, { error: 'unblock whom?' });
           await social.unblockActor(agent, target);
-          return this.send(res, 200, { ok: true, object: target });
+          return reply(200, { ok: true, object: target });
         }
         const statuses = this.store.getStatuses();
         let s = innerId ? statuses.find((x) => x.likeActivity?.id === innerId) : null;
         if (!s && inner?.type === 'Like') s = this.byIri(idOf(inner.object));
         if (s?.favourited) {
           const updated = await social.unfavourite(agent, s);
-          return this.send(res, 200, { ok: true, object: updated.noteId });
+          return reply(200, { ok: true, object: updated.noteId });
         }
         s = innerId ? statuses.find((x) => x.announceActivity?.id === innerId) : null;
         if (!s && inner?.type === 'Announce') s = this.byIri(idOf(inner.object));
         if (s?.reblogged) {
           const updated = await social.unreblog(agent, s);
-          return this.send(res, 200, { ok: true, object: updated.noteId });
+          return reply(200, { ok: true, object: updated.noteId });
         }
         const following = this.store.getContacts().following;
         const rec = following.find((f) => f.followActivity?.id === innerId)
           || (inner?.type === 'Follow' ? following.find((f) => f.actor === idOf(inner.object)) : null);
         if (rec) {
           await social.unfollowActor(agent, rec.actor);
-          return this.send(res, 200, { ok: true, object: rec.actor });
+          return reply(200, { ok: true, object: rec.actor });
         }
-        return this.send(res, 422, { error: 'nothing here matches what that Undo names' });
+        return reply(422, { error: 'nothing here matches what that Undo names' });
       }
 
       case 'Block': {
-        if (!objectId) return this.send(res, 400, { error: 'block whom? object must name an actor' });
+        if (!objectId) return reply(400, { error: 'block whom? object must name an actor' });
         await social.blockActor(agent, objectId);
-        return this.send(res, 200, { ok: true, object: objectId });
+        return reply(200, { ok: true, object: objectId });
       }
 
       case 'Add':
@@ -406,12 +454,12 @@ export class C2S {
         // The one collection a client may edit is the pins (§7.6/§7.9 in the
         // other direction): target must be the featured collection.
         if (idOf(activity.target) !== this.urls.featured) {
-          return this.send(res, 422, { error: 'the featured collection is the one Add/Remove edits here' });
+          return reply(422, { error: 'the featured collection is the one Add/Remove edits here' });
         }
         const s = this.byIri(objectId);
-        if (!s) return this.send(res, 404, { error: 'no such note here' });
+        if (!s) return reply(404, { error: 'no such note here' });
         const updated = await social.pinStatus(agent, s, activity.type === 'Add');
-        return this.send(res, 200, { ok: true, object: updated.noteId, pinned: !!updated.pinned });
+        return reply(200, { ok: true, object: updated.noteId, pinned: !!updated.pinned });
       }
 
       case 'Accept':
@@ -419,19 +467,19 @@ export class C2S {
         // Answering a held follow request: the object is the Follow (or the
         // requester). Which request is meant comes from the Follow's actor.
         const requester = object?.actor ? idOf(object.actor) : objectId;
-        if (!requester) return this.send(res, 400, { error: 'whose request? object must name the Follow or its actor' });
+        if (!requester) return reply(400, { error: 'whose request? object must name the Follow or its actor' });
         const r = activity.type === 'Accept'
           ? await social.admitRequest(agent, requester).catch((e) => ({ error: e.message }))
           : await social.refuseRequest(agent, requester).catch((e) => ({ error: e.message }));
-        if (r.error) return this.send(res, 404, { error: r.error });
-        return this.send(res, 200, { ok: true, object: requester });
+        if (r.error) return reply(404, { error: r.error });
+        return reply(200, { ok: true, object: requester });
       }
 
       case 'Move':
-        return this.send(res, 422, { error: 'moving the account is done on the admin surface, where it asks twice' });
+        return reply(422, { error: 'moving the account is done on the admin surface, where it asks twice' });
 
       default:
-        return this.send(res, 422, { error: `no handler for ${activity.type}` });
+        return reply(422, { error: `no handler for ${activity.type}` });
     }
   }
 }

package/lib/client/masto/index.mjs

@@ -117,7 +117,15 @@ export class MastoApi {
       res.end(body);
       return true;
     };
-    const ctx = { req, res, pathname, url, send };
+    // The address the client reached, so every self-URL handed back — the
+    // pagination links above all — names it rather than the pod's host.
+    const scheme = String(this.scheme
+      || (req.headers?.['x-forwarded-proto'] === 'https' || req.socket?.encrypted ? 'https' : 'http')).replace(/:.*$/, '');
+    let self = url;
+    try {
+      self = new URL(`${scheme}://${req.headers?.host || 'localhost'}${this.mount || ''}${pathname}${url.search || ''}`);
+    } catch { /* a Host nothing can parse: the links keep the placeholder origin */ }
+    const ctx = { req, res, pathname, url: self, send };
 
     if (await oauth.handle(this, ctx)) return true;
     if (!pathname.startsWith('/api/')) return false;

package/lib/client/masto/render.mjs

@@ -102,7 +102,9 @@ export function page(api, items, url, { limit = 20, max = 40, idOf = (s) => api.
   }
   const pageItems = items.slice(0, n);
   if (!pageItems.length) return { items: pageItems, headers: {} };
-  const base = `http://${api.host}${url.pathname}`;
+  // `url` is the request as the client addressed it (index.mjs handle), so
+  // the links name that origin and mount, not the pod's host.
+  const base = url.origin + url.pathname;
   const q = (extra) => {
     const u = new URL(base);
     for (const [k, v] of url.searchParams) if (!['max_id', 'since_id', 'min_id'].includes(k)) u.searchParams.set(k, v);
@@ -222,7 +224,7 @@ export function status(api, s, { all } = {}) {
     created_at: s.published || new Date().toISOString(),
     in_reply_to_id: s.inReplyTo ? api.store.idFor(s.inReplyTo) : null,
     in_reply_to_account_id: null,
-    sensitive: !!s.spoiler, spoiler_text: s.spoiler || '',
+    sensitive: !!(s.spoiler || s.sensitive), spoiler_text: s.spoiler || '',
     visibility: s.visibility || 'public', language: null,
     edited_at: s.editedAt || null,
     uri: s.noteId, url: s.link || s.noteId,
@@ -251,7 +253,7 @@ export function status(api, s, { all } = {}) {
         acct: bare.includes('@') ? bare : (host ? `${user}@${host}` : bare),
       };
     }),
-    tags: [],
+    tags: (s.tags || []).map(t => ({ name: t.name, url: t.url })),
     emojis: (s.emojis || []).map(e => ({
       shortcode: e.shortcode, url: e.url, static_url: e.url, visible_in_picker: false,
     })),

package/lib/client/masto/statuses.mjs

@@ -37,6 +37,7 @@ export async function handle(api, ctx) {
       if (ready !== true) return send(422, { error: ready });
     }
     const spoilerText = String(body.spoiler_text || '').trim() || null;
+    const sensitive = body.sensitive === true || body.sensitive === 'true' || body.sensitive === '1';
     const mediaIds = [].concat(body.media_ids || body['media_ids[]'] || []).filter(Boolean);
     const media = api.store.getMedia();
     const attachments = mediaIds.map(id => media[id] && { id, ...media[id] }).filter(Boolean);
@@ -67,7 +68,7 @@ export async function handle(api, ctx) {
         const q = await api.agent.publisher.publishQuestion(body.status, {
           options: asking.options, multiple: asking.multiple,
           expiresAt: new Date(Date.now() + seconds * 1000).toISOString(),
-          inReplyTo, visibility, spoilerText,
+          inReplyTo, visibility, spoilerText, sensitive,
         });
         return send(200, api.status(api.store.getStatuses().find(x => x.noteId === q.id)));
       } catch (e) {
@@ -98,7 +99,7 @@ export async function handle(api, ctx) {
     let note;
     try {
       note = await api.agent.publisher.publishNote(body.status,
-        { inReplyTo, attachments, visibility, spoilerText });
+        { inReplyTo, attachments, visibility, spoilerText, sensitive });
     } catch (e) {
       // A direct message nobody could be found for: the sender's mistake to
       // fix, said in the client, not a fault of the server.
@@ -126,7 +127,7 @@ export async function handle(api, ctx) {
     const s = noteUrl && api.store.getStatuses().find(x => x.noteId === noteUrl);
     if (!s) return send(404, { error: 'Record not found' });
     return send(200, [{
-      content: s.content || '', spoiler_text: s.spoiler || '', sensitive: !!s.spoiler,
+      content: s.content || '', spoiler_text: s.spoiler || '', sensitive: !!(s.spoiler || s.sensitive),
       created_at: s.editedAt || s.published, account: api.account(s.actor),
       media_attachments: (s.attachments || []).map(a => api.mediaJson(a)),
       emojis: [], poll: null,
@@ -152,8 +153,10 @@ export async function handle(api, ctx) {
       ? mediaIds.map(id => media[id] && { id, ...media[id] }).filter(Boolean)
       : null;                                   // null: keep what the post has
     const spoilerText = String(body.spoiler_text || '').trim() || null;
+    const sensitive = body.sensitive === undefined ? null
+      : (body.sensitive === true || body.sensitive === 'true' || body.sensitive === '1');
     const patched = await api.agent.publisher.updateNote(s,
-      { content: body.status, spoilerText, attachments });
+      { content: body.status, spoilerText, sensitive, attachments });
     return send(200, api.status(patched || s));
   }
   if (mStatus && req.method === 'DELETE') {

package/lib/client/oidc-auth.mjs

@@ -1,7 +1,7 @@
 // oidc-auth.mjs — who may drive the C2S surface. Two proofs are accepted:
 // the Mastodon facade's bearer (minted on this machine, so its holder is the
-// operator by construction), or a Solid-OIDC token — DPoP-bound when the
-// client sends the proof header — verified by the same library the wider
+// operator by construction), or a Solid-OIDC token with its DPoP proof,
+// which Solid-OIDC requires, verified by the same library the wider
 // Solid world uses. The token alone is not enough: the WebID it names must
 // be THIS identity's owner, an authorization step the token does not carry.
 //
@@ -25,6 +25,13 @@ export function makeC2sAuth({ agent, masto = null, verifier = null, log = () =>
     if (!req.headers.authorization) {
       return { ok: false, status: 401, error: 'authentication required: a Solid-OIDC token (DPoP) or this agent\'s own bearer' };
     }
+    // Solid-OIDC binds the token to a key and has the client prove it holds
+    // that key on every request. A token shown without its proof is a token
+    // anyone who saw it could show.
+    if (!req.headers.dpop) {
+      return { ok: false, status: 401, error: 'a Solid-OIDC token must come with its DPoP proof',
+        headers: { 'www-authenticate': 'DPoP' } };
+    }
     let webid;
     try {
       const v = await loadVerifier();
@@ -38,7 +45,7 @@ export function makeC2sAuth({ agent, masto = null, verifier = null, log = () =>
       }://${req.headers.host}${mount}${pathname}`;
       ({ webid } = await v(
         req.headers.authorization,
-        req.headers.dpop ? { header: req.headers.dpop, method: req.method, url: htu } : undefined,
+        { header: req.headers.dpop, method: req.method, url: htu },
       ));
     } catch (e) {
       log(`c2s auth: token rejected — ${e.message}`);

package/lib/core/as2.mjs

@@ -19,7 +19,7 @@
 // common shape: one that skipped it would not be read as JSON-LD, and would
 // produce no graph, so nothing could be validated against it.
 //
-// CONTEXTS ARE NEVER FETCHED. The loader serves the fourteen the fediverse
+// CONTEXTS ARE NEVER FETCHED. The loader serves the fifteen the fediverse
 // actually uses and refuses every other URL. That refusal is the point: this
 // code runs on documents a stranger wrote, in the same path the SSRF guards
 // protect, and expanding one would otherwise mean dereferencing a URL of their