fedipod 1.7.0 → 1.10.0

package/lib/core/contexts/anno.json

@@ -0,0 +1,126 @@
+{
+ "@context": {
+    "oa":      "http://www.w3.org/ns/oa#",
+    "dc":      "http://purl.org/dc/elements/1.1/",
+    "dcterms": "http://purl.org/dc/terms/",
+    "dctypes": "http://purl.org/dc/dcmitype/",
+    "foaf":    "http://xmlns.com/foaf/0.1/",
+    "rdf":     "http://www.w3.org/1999/02/22-rdf-syntax-ns#",
+    "rdfs":    "http://www.w3.org/2000/01/rdf-schema#",
+    "skos":    "http://www.w3.org/2004/02/skos/core#",
+    "xsd":     "http://www.w3.org/2001/XMLSchema#",
+    "iana":    "http://www.iana.org/assignments/relation/",
+    "owl":     "http://www.w3.org/2002/07/owl#",
+    "as":      "http://www.w3.org/ns/activitystreams#",
+    "schema":  "http://schema.org/",
+
+    "id":      {"@type": "@id", "@id": "@id"},
+    "type":    {"@type": "@id", "@id": "@type"},
+
+    "Annotation":           "oa:Annotation",
+    "Dataset":              "dctypes:Dataset",
+    "Image":                "dctypes:StillImage",
+    "Video":                "dctypes:MovingImage",
+    "Audio":                "dctypes:Sound",
+    "Text":                 "dctypes:Text",
+    "TextualBody":          "oa:TextualBody",
+    "ResourceSelection":    "oa:ResourceSelection",
+    "SpecificResource":     "oa:SpecificResource",
+    "FragmentSelector":     "oa:FragmentSelector",
+    "CssSelector":          "oa:CssSelector",
+    "XPathSelector":        "oa:XPathSelector",
+    "TextQuoteSelector":    "oa:TextQuoteSelector",
+    "TextPositionSelector": "oa:TextPositionSelector",
+    "DataPositionSelector": "oa:DataPositionSelector",
+    "SvgSelector":          "oa:SvgSelector",
+    "RangeSelector":        "oa:RangeSelector",
+    "TimeState":            "oa:TimeState",
+    "HttpRequestState":     "oa:HttpRequestState",
+    "CssStylesheet":        "oa:CssStyle",
+    "Choice":               "oa:Choice",
+    "Person":               "foaf:Person",
+    "Software":             "as:Application",
+    "Organization":         "foaf:Organization",
+    "AnnotationCollection": "as:OrderedCollection",
+    "AnnotationPage":       "as:OrderedCollectionPage",
+    "Audience":             "schema:Audience", 
+
+    "Motivation":    "oa:Motivation",
+    "bookmarking":   "oa:bookmarking",
+    "classifying":   "oa:classifying",
+    "commenting":    "oa:commenting",
+    "describing":    "oa:describing",
+    "editing":       "oa:editing",
+    "highlighting":  "oa:highlighting",
+    "identifying":   "oa:identifying",
+    "linking":       "oa:linking",
+    "moderating":    "oa:moderating",
+    "questioning":   "oa:questioning",
+    "replying":      "oa:replying",
+    "reviewing":     "oa:reviewing",
+    "assessing":     "oa:assessing",
+    "tagging":       "oa:tagging",
+
+    "auto":          "oa:autoDirection",
+    "ltr":           "oa:ltrDirection",
+    "rtl":           "oa:rtlDirection",
+
+    "body":          {"@type": "@id", "@id": "oa:hasBody"},
+    "target":        {"@type": "@id", "@id": "oa:hasTarget"},
+    "source":        {"@type": "@id", "@id": "oa:hasSource"},
+    "selector":      {"@type": "@id", "@id": "oa:hasSelector"},
+    "state":         {"@type": "@id", "@id": "oa:hasState"},
+    "scope":         {"@type": "@id", "@id": "oa:hasScope"},
+    "refinedBy":     {"@type": "@id", "@id": "oa:refinedBy"},
+    "startSelector": {"@type": "@id", "@id": "oa:hasStartSelector"},
+    "endSelector":   {"@type": "@id", "@id": "oa:hasEndSelector"},
+    "renderedVia":   {"@type": "@id", "@id": "oa:renderedVia"},
+    "creator":       {"@type": "@id", "@id": "dcterms:creator"},
+    "generator":     {"@type": "@id", "@id": "as:generator"},
+    "rights":        {"@type": "@id", "@id": "dcterms:rights"},
+    "homepage":      {"@type": "@id", "@id": "foaf:homepage"},
+    "via":           {"@type": "@id", "@id": "oa:via"},
+    "canonical":     {"@type": "@id", "@id": "oa:canonical"},
+    "stylesheet":    {"@type": "@id", "@id": "oa:styledBy"},
+    "cached":        {"@type": "@id", "@id": "oa:cachedSource"},
+    "conformsTo":    {"@type": "@id", "@id": "dcterms:conformsTo"},
+    "items":         {"@type": "@id", "@id": "as:items", "@container": "@list"},
+    "partOf":        {"@type": "@id", "@id": "as:partOf"},
+    "first":         {"@type": "@id", "@id": "as:first"},
+    "last":          {"@type": "@id", "@id": "as:last"},
+    "next":          {"@type": "@id", "@id": "as:next"},
+    "prev":          {"@type": "@id", "@id": "as:prev"},
+    "audience":      {"@type": "@id", "@id": "schema:audience"},
+    "motivation":    {"@type": "@vocab", "@id": "oa:motivatedBy"},
+    "purpose":       {"@type": "@vocab", "@id": "oa:hasPurpose"},
+    "textDirection": {"@type": "@vocab", "@id": "oa:textDirection"},
+
+    "accessibility": "schema:accessibilityFeature",
+    "bodyValue":     "oa:bodyValue",
+    "format":        "dc:format",
+    "language":      "dc:language",
+    "processingLanguage": "oa:processingLanguage",
+    "value":         "rdf:value",
+    "exact":         "oa:exact",
+    "prefix":        "oa:prefix",
+    "suffix":        "oa:suffix",
+    "styleClass":    "oa:styleClass",
+    "name":          "foaf:name",
+    "email":         "foaf:mbox",
+    "email_sha1":    "foaf:mbox_sha1sum",
+    "nickname":      "foaf:nick",
+    "label":         "rdfs:label",
+
+    "created":       {"@id": "dcterms:created", "@type": "xsd:dateTime"},
+    "modified":      {"@id": "dcterms:modified", "@type": "xsd:dateTime"},
+    "generated":     {"@id": "dcterms:issued", "@type": "xsd:dateTime"},
+    "sourceDate":    {"@id": "oa:sourceDate", "@type": "xsd:dateTime"},
+    "sourceDateStart": {"@id": "oa:sourceDateStart", "@type": "xsd:dateTime"},
+    "sourceDateEnd": {"@id": "oa:sourceDateEnd", "@type": "xsd:dateTime"},
+
+    "start":         {"@id": "oa:start", "@type": "xsd:nonNegativeInteger"},
+    "end":           {"@id": "oa:end", "@type": "xsd:nonNegativeInteger"},
+    "total":         {"@id": "as:totalItems", "@type": "xsd:nonNegativeInteger"},
+    "startIndex":    {"@id": "as:startIndex", "@type": "xsd:nonNegativeInteger"}
+  }
+}

package/lib/core/contexts/index.mjs

@@ -25,6 +25,9 @@ import ctx10 from './fep-5711.json' with { type: 'json' };
 import ctx11 from './join-lemmy.json' with { type: 'json' };
 import ctx12 from './joinmastodon.json' with { type: 'json' };
 import ctx13 from './miscellany.json' with { type: 'json' };
+// Not from fedify: the W3C Web Annotation context, which a client such as
+// dokieli names on the annotations it posts to the outbox.
+import ctx14 from './anno.json' with { type: 'json' };
 
 /** URL → the context document itself. Nothing outside this map is ever resolved. */
 export const CONTEXTS = {
@@ -42,4 +45,5 @@ export const CONTEXTS = {
   'https://join-lemmy.org/context.json': ctx11,
   'http://joinmastodon.org/ns': ctx12,
   'https://purl.archive.org/miscellany': ctx13,
+  'http://www.w3.org/ns/anno.jsonld': ctx14,
 };

package/lib/core/contexts/map.json

@@ -12,5 +12,6 @@
   "https://w3id.org/fep/5711": "fep-5711.json",
   "https://join-lemmy.org/context.json": "join-lemmy.json",
   "http://joinmastodon.org/ns": "joinmastodon.json",
-  "https://purl.archive.org/miscellany": "miscellany.json"
+  "https://purl.archive.org/miscellany": "miscellany.json",
+  "http://www.w3.org/ns/anno.jsonld": "anno.json"
 }

package/lib/core/deliver.mjs

@@ -8,6 +8,7 @@ import { webcrypto } from 'node:crypto';
 import { attachProof } from './proof.mjs';
 import { pinnedFor, retryAfterMs, HTTP_TIMEOUT_MS } from '../shared/safefetch.mjs';
 import { USER_AGENT } from '../shared/ua.mjs';
+import { dropFollower } from './store.mjs';
 
 const MAX_REDIRECTS = 3;
 
@@ -52,14 +53,20 @@ const MAX_QUEUE = 2000;                        // beyond it, overflow dead-lette
 // the server, or no answer at all, is grounds to leave it alone.
 const hostOf = (inbox) => { try { return new URL(inbox).host; } catch { return inbox; } };
 const aboutTheHost = (e) => !e.status || e.status >= 500 || e.status === 429;
+// A 410 says the inbox is gone for good and a 404 that nothing answers there:
+// neither earns a second POST. Gone also means whoever read there has left.
+const unsalvageable = (e) => e.status === 404 || e.status === 410;
 
 export class Deliverer {
   // passive: signing-only (viewer-mode agents) — no queue drain timer, so a
   // read-only agent never mutates shared delivery state. startQueue() flips
   // it live when a viewer is promoted to active.
   constructor({ store, keyId, rsaPrivate, actorId = null, edPrivate = null, proofKeyId = null,
-    log = console.log, passive = false }) {
+    log = console.log, passive = false, onGone = null }) {
     this.store = store;
+    // Called after followers at a gone inbox are dropped: the agent republishes
+    // its followers collection.
+    this.onGone = onGone;
     this.keyId = keyId;
     this.rsaPrivate = rsaPrivate;
     this.actorId = actorId;
@@ -182,6 +189,7 @@ export class Deliverer {
       await this.deliverNow(inbox, signed);
       this.log(`delivered ${signed.type} → ${inbox}`);
     } catch (e) {
+      if (unsalvageable(e)) { await this._unsalvageable(inbox, e); return; }
       this.log(`delivery failed (${e.message}) — queued`);
       const wait = e.retryAfterMs || 60_000;
       if (aboutTheHost(e)) {
@@ -192,6 +200,20 @@ export class Deliverer {
     }
   }
 
+  // Not retried, and on a 410 the followers who received there are dropped,
+  // so the next fan-out stops asking; the followers collection is republished
+  // through onGone. A 404 drops only this delivery.
+  async _unsalvageable(inbox, e) {
+    if (e.status !== 410) { this.log(`delivery dropped (${e.message}) — nothing answers there`); return; }
+    const contacts = this.store.getContacts?.();
+    const left = (contacts?.followers || []).filter(f => f.inbox === inbox || f.sharedInbox === inbox);
+    this.log(`${inbox} is gone (410) — delivery dropped${left.length ? `, ${left.length} follower(s) there forgotten` : ''}`);
+    if (!left.length) return;
+    for (const f of left) dropFollower(contacts, f.actor, 'inbox-gone');
+    this.store.setContacts(contacts);
+    try { await this.onGone?.(); } catch (err) { this.log(`followers republish after 410: ${err.message}`); }
+  }
+
   // The queue has a ceiling: a fan-out into a sea of down servers must not grow
   // queue.json without bound. Overflow keeps the evidence as a dead letter.
   _enqueue(item) {
@@ -292,6 +314,7 @@ export class Deliverer {
         changed = true;
         this.log(`retry ok: ${item.activity.type} → ${item.inbox}`);
       } catch (e) {
+        if (unsalvageable(e)) { changed = true; await this._unsalvageable(item.inbox, e); continue; }
         item.attempts += 1;
         changed = true;
         const wait = e.retryAfterMs || ladderFor(item);

package/lib/core/intake/activities.mjs

@@ -103,6 +103,8 @@ export async function onFollow(intake, activity, actor, { trusted = false } = {}
 }
 
 export async function onUndo(intake, activity, actor, { trusted = false } = {}) {
+  const inner = activity.object && typeof activity.object === 'object' ? activity.object : null;
+  if (inner?.type === 'Like' || inner?.type === 'Announce') return onUndoReaction(intake, inner, actor, { trusted });
   // AS2 allows `object` to be a bare IRI, and that IRI is exactly the Follow
   // id we stored. Reading `.type` off a string gives undefined, so the whole
   // Undo was dropped — silently, since handle() reads that as handled, so no
@@ -274,6 +276,58 @@ export async function onAnnounce(intake, activity, actor, objectId) {
   return intake.ingestNote(objectId, actor, { via: actor });
 }
 
+// Undo{Like} and Undo{Announce}: the sender unsaying a favourite or a boost.
+// The Like it unsays was recorded on the sender's word alone, so its undoing
+// is taken the same way: the notification it left goes. A boost unsaid by
+// someone we follow takes the post they carried off the timeline — the carry
+// was accepted on that follow, and the retraction is honoured on it.
+export async function onUndoReaction(intake, inner, actor, { trusted = false } = {}) {
+  const innerActor = typeof inner.actor === 'string' ? inner.actor : inner.actor?.id;
+  if (innerActor && innerActor !== actor) return;             // one cannot unsay another's
+  const wrapped = inner.object;
+  const target = (wrapped && typeof wrapped === 'object'
+    && (wrapped.type === 'Create' || wrapped.type === 'Update')) ? wrapped.object : wrapped;
+  const objectId = typeof target === 'string' ? target : target?.id;
+  if (!objectId) return;
+  if (objectId.startsWith(intake.urls.notes)) {
+    const type = inner.type === 'Like' ? 'favourite' : 'reblog';
+    const gone = intake.store.removeNotifications(n => n.type === type && n.actor === actor && n.noteId === objectId);
+    if (gone) intake.log(`${inner.type} withdrawn by ${actor} on ${objectId}`);
+    return;
+  }
+  if (inner.type !== 'Announce') return;
+  const followed = trusted || intake.store.getContacts().following.some(f => f.actor === actor && f.accepted);
+  if (!followed) return;
+  const s = intake.store.getStatuses().find(x => x.noteId === objectId);
+  if (!s || s.kind === 'post' || s.via !== actor) return;
+  await intake.forget(s);
+  intake.log(`boost withdrawn by ${actor}: ${objectId} left the timeline`);
+}
+
+// Block: the sender wants nothing more to do with this account. Mastodon
+// drops the follow both ways on receipt, and so does this — on a delivery
+// the door verified. A Block carries nothing to check and names nothing we
+// hold, so one taken from the public-append inbox unverified would let
+// anybody evict any follower, the hole the Undo handler closes with the
+// follow id. Unverified: logged, nothing else.
+export async function onBlock(intake, activity, actor, { trusted = false } = {}) {
+  const objectId = typeof activity.object === 'string' ? activity.object : activity.object?.id;
+  if (objectId !== intake.urls.actor) return;
+  if (!trusted) { intake.log(`Block from ${actor} arrived unverified — ignored`); return; }
+  const contacts = intake.store.getContacts();
+  const wasFollower = contacts.followers.some(f => f.actor === actor);
+  const wasFollowing = contacts.following.some(f => f.actor === actor);
+  if (wasFollower) dropFollower(contacts, actor, 'blocked-us');
+  contacts.following = contacts.following.filter(f => f.actor !== actor);
+  intake.store.setContacts(contacts);
+  const reqs = intake.store.getRequests();
+  const left = reqs.filter(r => r.actor !== actor);
+  if (left.length !== reqs.length) intake.store.setRequests(left);
+  await intake.republish({ followers: wasFollower, following: wasFollowing, pending: true });
+  const what = [wasFollower && 'their follow of us', wasFollowing && 'our follow of them'].filter(Boolean).join(' and ');
+  intake.log(`blocked by ${actor}: ${what || 'no relationship'} dropped`);
+}
+
 // Mastodon sends these constantly; ignoring them left deleted posts standing
 // for good. Two guards, because a forged Delete would otherwise erase anyone's
 // content: it must come from the object's own origin, and the object must

package/lib/core/intake/index.mjs

@@ -59,8 +59,10 @@ const MAX_ITEM_ATTEMPTS = 5;
 const MAX_ITEMS_PER_DRAIN = 50;
 
 export class Intake {
-  constructor({ config, urls, remote, store, deliverer, publisher, log = console.log, lease = null, archive = null, push = true, pollSeconds = null }) {
-    Object.assign(this, { config, urls, remote, store, deliverer, publisher, log, lease, archive, push, pollSeconds });
+  // `ownerPost(activity, { raw, slug })` is the client-to-server dispatcher,
+  // for an item the Gateway's outbox door took on the owner's behalf.
+  constructor({ config, urls, remote, store, deliverer, publisher, log = console.log, lease = null, archive = null, push = true, pollSeconds = null, ownerPost = null }) {
+    Object.assign(this, { config, urls, remote, store, deliverer, publisher, log, lease, archive, push, pollSeconds, ownerPost });
     this.serial = Date.now();
     this.stopped = false;
     // (attempt counts are kept in pod state — see _bumpAttempt)
@@ -429,9 +431,14 @@ export class Intake {
         // receipt reads as null, which is exactly today's unverified behavior.
         const receipt = activity ? await this._readReceipt(url) : null;
         if (activity && this.gatewaySecret()) this._bumpGatewayStat(!!receipt?.verified);
-        const rejection = activity ? await this.handle(activity, receipt) : 'unparsable JSON';
-        if (!rejection && raw) await this._archive(url, raw, activity);
-        if (!rejection) await this._maybeForward(activity);    // §7.1.2, only what we accepted
+        // The owner's own post, taken at the outbox door: not mail to read
+        // but a write to make. Never archived or forwarded as if received.
+        const owned = activity && this.isOwnerPost(receipt);
+        const rejection = !activity ? 'unparsable JSON'
+          : owned ? await this.ownerPostFrom(activity, raw, receipt)
+            : await this.handle(activity, receipt);
+        if (!rejection && raw && !owned) await this._archive(url, raw, activity);
+        if (!rejection && !owned) await this._maybeForward(activity);    // §7.1.2, only what we accepted
         if (rejection) {
           this.store.addDeadLetter({
             inboxUrl: url, reason: rejection, activity: trimActivity(activity),
@@ -577,6 +584,7 @@ export class Intake {
       case 'Reject': return this.onReject(activity, actor, { trusted });
       case 'Move': return this.onMove(activity, actor);
       case 'Add': case 'Remove': return this.onAddRemove(activity, actor);
+      case 'Block': return this.onBlock(activity, actor, { trusted });
       default: this.log(`ignored ${activity.type} from ${actor}`);
     }
   }
@@ -594,6 +602,26 @@ export class Intake {
   gatewaySecret(...a) { return verify.gatewaySecret(this, ...a); }
   _bumpGatewayStat(...a) { return verify.bumpGatewayStat(this, ...a); }
   _readReceipt(...a) { return verify.readReceipt(this, ...a); }
+
+  // A receipt the door stamped `c2s` for THIS actor, and only a receipt whose
+  // HMAC verified (readReceipt returns nothing else). A stranger appending an
+  // item that claims to be ours has no such receipt and is read as mail.
+  isOwnerPost(receipt) {
+    return !!(this.ownerPost && receipt?.verified && receipt.method === 'c2s' && receipt.actor === this.urls.actor);
+  }
+
+  // Publish what the owner posted at the door. The bytes as the client wrote
+  // them go to the dispatcher (an object stored as sent must be the client's
+  // document, not our reading of it); the graph is what it decides from.
+  // Returns null when published, else the reason it was not — a dead letter.
+  async ownerPostFrom(activity, raw, receipt) {
+    let asSent = null;
+    try { asSent = raw ? JSON.parse(raw) : null; } catch { asSent = null; }
+    const r = await this.ownerPost(activity, { raw: asSent, slug: receipt.slug || null });
+    if (!r || r.status >= 300) return `owner post refused (${r?.status || '?'}): ${r?.body?.error || ''}`;
+    this.log(`owner post from the outbox door published: ${r.body?.object || r.body?.id || activity.type}`);
+    return null;
+  }
   receiptVouchesFor(...a) { return verify.receiptVouchesFor(this, ...a); }
   isGone(...a) { return verify.isGone(this, ...a); }
 
@@ -609,6 +637,7 @@ export class Intake {
   onAddRemove(...a) { return activities.onAddRemove(this, ...a); }
   onFollow(...a) { return activities.onFollow(this, ...a); }
   onUndo(...a) { return activities.onUndo(this, ...a); }
+  onBlock(...a) { return activities.onBlock(this, ...a); }
   onCreate(...a) { return activities.onCreate(this, ...a); }
   onAnnouncedDelete(...a) { return activities.onAnnouncedDelete(this, ...a); }
   onAnnounce(...a) { return activities.onAnnounce(this, ...a); }

package/lib/core/intake/notes.mjs

@@ -190,6 +190,11 @@ export async function ingestNote(intake, objectId, actor, { via, inline = null }
     .slice(0, MAX_MENTIONS)
     .map(t => ({ href: httpOnly(String(t.href).slice(0, MAX_URL_CHARS)), name: String(t.name).slice(0, 256) }))
     .filter(m => m.href);
+  const hashtags = [].concat(note.tag || [])
+    .filter(t => t?.type === 'Hashtag' && t.name)
+    .slice(0, MAX_MENTIONS)
+    .map(t => ({ name: String(t.name).replace(/^#/, '').slice(0, 128), url: httpOnly(String(t.href || '').slice(0, MAX_URL_CHARS)) }))
+    .filter(t => t.name);
   const emojis = emojisOf(note);
   const poll = pollOf(note);
   // Explicitly addressed, but to nobody public and to no followers
@@ -209,6 +214,8 @@ export async function ingestNote(intake, objectId, actor, { via, inline = null }
     ...(nonPublic ? { nonPublic: true } : {}),
     // The author's content warning, shown as one: plain text only.
     ...(note.summary ? { spoiler: String(note.summary).replace(/<[^>]*>/g, '') } : {}),
+    ...(note.sensitive === true ? { sensitive: true } : {}),
+    ...(hashtags.length ? { tags: hashtags } : {}),
     ...(poll ? { poll } : {}),
     ...(emojis.length ? { emojis } : {}),
     ...(mentions.length ? { mentions } : {}),

package/lib/core/publisher/collections.mjs

@@ -86,7 +86,10 @@ export async function publishOutbox(publisher, outbox, { acls = false, force = f
 // the flat collection this used to write, so an actor published before paging
 // is still readable — which matters because rebuild reads this to recover
 // posts a lost machine no longer has.
-export function readPublishedOutbox(publisher) { return podOutbox.readPublished(publisher.remote, publisher.urls); }
+export async function readPublishedOutbox(publisher) {
+  const items = await podOutbox.readPublished(publisher.remote, publisher.urls);
+  return Array.isArray(items) ? items.map(wire.outboxLocalItem) : items;
+}
 
 // The followers collection, paged like the outbox: a head that carries only
 // the count and the page bounds, and page documents holding the actor IRIs —
@@ -191,9 +194,9 @@ export async function publishBlocked(publisher) {
 }
 
 // The outbox is the public record of everything this actor has said, boosts
-// included. A Create goes in as its note id, which dereferences; an Announce
-// has only a fragment id, so the activity itself goes in the collection —
-// legal AS2, and what Mastodon serves.
+// included. A post is recorded by its note id and published as its Create
+// (wire.outboxWireItem); an Announce has only a fragment id, so the activity
+// itself goes in.
 export async function recordOutbox(publisher, item) {
   const outbox = publisher.store.read('outbox.json', []);
   outbox.unshift(item);

package/lib/core/publisher/index.mjs

@@ -34,7 +34,7 @@ const AGENT_VERSION = JSON.parse(fs.readFileSync(
 
 export class Publisher {
   constructor({ config, remote, store, deliverer, publicKeyPem, assertionKey = null, log = console.log,
-    probeFetch = null, resolveMention = null, clientOrigin = null,
+    probeFetch = null, resolveMention = null, resolveActor = null, clientOrigin = null,
   }) {
     this.config = config;
     this.remote = remote;
@@ -57,6 +57,9 @@ export class Publisher {
     // socket opened to that pod. Tests inject their own.
     this.probeFetch = probeFetch || ((u, i) => this.remote.probe(u, i));
     this.resolveMention = resolveMention;
+    // An actor or object by its address, verified at its origin — how a reply
+    // finds the inbox of the person it answers.
+    this.resolveActor = resolveActor;
     // Per-poll rewrite windows, keyed by question id. See POLL_REWRITE_MS.
     this.pollTimers = new Map();
     this.log = log;
@@ -76,22 +79,23 @@ export class Publisher {
   // republish button. Without it, an actor lost from the pod would match the
   // digest, be skipped, and leave the agent reporting success while nobody can
   // resolve it.
-  async publishProfile({ force = false } = {}) {
-    const { urls } = this;
-    const host = new URL(urls.base).host;
-
-    // The owner-only collections (FEP-4ccd, FEP-c648) are advertised only
-    // where "owner-only" is real — the pod must provably enforce the private
-    // container's ACL, the same bar private posts clear.
-    const priv = await this.privateReady() === true;
-    const moderators = (this.config.moderators || []).length ? urls.moderators : null;
-    // An advertised inbox gateway (config.gateway.mode past 'off') becomes the
-    // actor's inbox; deliveries reach the pod inbox through it. Absent → today.
+  // The Gateway's outbox door for this account, when a Gateway is attached:
+  // beside its inbox door, or under the fronted actor.
+  gatewayOutbox() {
     const gw = this.config.gateway;
-    const gwActive = gw && gw.url && gw.mode && gw.mode !== 'off';
-    const actorDoc = wire.actorDoc({
+    if (!(gw && gw.url && gw.mode && gw.mode !== 'off')) return null;
+    if (gw.frontActor) return String(gw.frontActor).replace(/ap\/actor\/?$/u, 'ap/outbox');
+    return String(gw.url).replace(/ap\/inbox\/?$/u, 'ap/outbox');
+  }
+
+  // Every actor document this identity publishes, from one place: the
+  // profile publish and a Move both write it, and a Move that rebuilt it
+  // by hand dropped the gateway inbox, the outbox door and the collections.
+  actorDocFor({ priv = false, moderators = null, inbox = null, movedTo = this.config.movedTo || null } = {}) {
+    const { urls } = this;
+    return wire.actorDoc({
       urls, handle: wire.publicHandle(this.config), name: this.config.name, publicKeyPem: this.publicKeyPem,
-      movedTo: this.config.movedTo || null, kind: this.config.kind,
+      movedTo, kind: this.config.kind,
       approveJoins: wire.followsNeedApproval(this.config),
       assertionKey: this.assertionKey,
       summary: this.config.summary || null, icon: this.config.icon || null,
@@ -102,15 +106,32 @@ export class Publisher {
       pendingFollowers: priv ? urls.pendingFollowers : null,
       pendingFollowing: priv ? urls.pendingFollowing : null,
       blocked: priv ? urls.blocked : null,
-      inbox: gwActive ? gw.url : null,
+      inbox,
       // The agent's own outbox endpoint, where it is reachable: a client
       // following the actor must arrive somewhere that will take a write.
-      outbox: this.clientOrigin ? `${this.clientOrigin}ap/outbox` : null,
+      // Otherwise the Gateway's outbox door, when one is attached.
+      outbox: this.clientOrigin ? `${this.clientOrigin}ap/outbox` : this.gatewayOutbox(),
       // How a client-to-server client finds the way in with nothing configured
       // by hand. Advertised only where the surface is publicly reachable.
       oauthAuthorize: this.clientOrigin ? `${this.clientOrigin}oauth/authorize` : null,
       oauthToken: this.clientOrigin ? `${this.clientOrigin}oauth/token` : null,
     });
+  }
+
+  async publishProfile({ force = false } = {}) {
+    const { urls } = this;
+    const host = new URL(urls.base).host;
+
+    // The owner-only collections (FEP-4ccd, FEP-c648) are advertised only
+    // where "owner-only" is real — the pod must provably enforce the private
+    // container's ACL, the same bar private posts clear.
+    const priv = await this.privateReady() === true;
+    const moderators = (this.config.moderators || []).length ? urls.moderators : null;
+    // An advertised inbox gateway (config.gateway.mode past 'off') becomes the
+    // actor's inbox; deliveries reach the pod inbox through it. Absent → today.
+    const gw = this.config.gateway;
+    const gwActive = gw && gw.url && gw.mode && gw.mode !== 'off';
+    const actorDoc = this.actorDocFor({ priv, moderators, inbox: gwActive ? gw.url : null });
     const surface = crypto.createHash('sha256').update(JSON.stringify({
       actor: actorDoc, handle: this.config.handle, host,
       quiesced: !!this.config.quiescedAt, version: AGENT_VERSION,
@@ -122,7 +143,7 @@ export class Publisher {
     }
 
     await discovery.writeWebfinger(this.remote, urls,
-      wire.jrd({ handle: this.config.handle, host, actor: urls.actor }));
+      wire.jrd({ handle: this.config.handle, host, actor: urls.actor, page: urls.profileHtml }));
     await discovery.writeHostMeta(this.remote, urls, wire.hostMeta(urls.base));
 
     const nodeinfoDocUrl = urls.home + 'ap/nodeinfo-2.0';
@@ -163,6 +184,8 @@ export class Publisher {
         actorUrl: urls.actor,
         accountName: `@${this.config.handle}@${host}`,
         kind: this.config.kind,
+        // Where a Solid client posts: dokieli reads `as:outbox` off the WebID.
+        outbox: this.clientOrigin ? `${this.clientOrigin}ap/outbox` : this.gatewayOutbox(),
       });
       if (wrote) this.log('WebID profile now lists the actor as a foaf:account');
     } catch (e) {
@@ -346,15 +369,12 @@ export class Publisher {
     await this.deliverer.deliverToAll(inboxes, wire.moveActivity(urls, target, Date.parse(at)));
     this.config.movedTo = target;                       // so the republish below carries it
     this.store.setConfig({ ...this.store.getConfig(), movedTo: target, movedAt: at });
-    await podActor.writeMoved(this.remote, urls, wire.actorDoc({
-      urls, handle: wire.publicHandle(this.config), name: this.config.name,
-      publicKeyPem: this.publicKeyPem, movedTo: target, kind: this.config.kind,
-      approveJoins: wire.followsNeedApproval(this.config),
-      assertionKey: this.assertionKey,
-      summary: this.config.summary || null, icon: this.config.icon || null,
-      image: this.config.image || null, fields: this.config.fields || [],
-      webId: this.remote.webId || null,
-      aliases: this.config.aliases || [],
+    const gw = this.config.gateway;
+    const gwActive = gw && gw.url && gw.mode && gw.mode !== 'off';
+    const priv = await this.privateReady() === true;
+    const moderators = (this.config.moderators || []).length ? urls.moderators : null;
+    await podActor.writeMoved(this.remote, urls, this.actorDocFor({
+      priv, moderators, inbox: gwActive ? gw.url : null, movedTo: target,
     }));
     await this.store.flush();
     this.log(`moved to ${target}: Move sent to ${inboxes.length} inbox(es), actor now advertises movedTo`);
@@ -400,6 +420,7 @@ export class Publisher {
   reconcileFollowers(...a) { return restore.reconcileFollowers(this, ...a); }
   reconcileOutbox(...a) { return restore.reconcileOutbox(this, ...a); }
   rebuildStatuses(...a) { return restore.rebuildStatuses(this, ...a); }
+  healStatuses(...a) { return restore.healStatuses(this, ...a); }
 
   // notes.mjs
   ensureMediaContainer(...a) { return notes.ensureMediaContainer(this, ...a); }
@@ -408,6 +429,7 @@ export class Publisher {
   privateReady(...a) { return notes.privateReady(this, ...a); }
   _mentionsFor(...a) { return notes.mentionsFor(this, ...a); }
   publishNote(...a) { return notes.publishNote(this, ...a); }
+  publishObject(...a) { return notes.publishObject(this, ...a); }
   updateNote(...a) { return notes.updateNote(this, ...a); }
 
   // questions.mjs