fedipod 1.8.0 → 1.10.0

package/lib/core/publisher/notes.mjs

@@ -83,6 +83,45 @@ export async function mentionsFor(publisher, content, inReplyTo) {
   return mentions;
 }
 
+// Who a reply is answering. Their server gets the post whether or not the
+// text names them — that is how the thread stays whole where they are — but
+// no Mention tag is added, so a handle the author trimmed out still means no
+// notification. Nothing for a direct post: it goes to whom it names. The
+// parent is read from the timeline row; a parent the agent never held (a
+// client-to-server reply to any address) is fetched to find its author.
+export async function replyTarget(publisher, inReplyTo, mentions = [], visibility = 'public') {
+  if (!inReplyTo || visibility === 'direct' || !publisher.resolveActor) return null;
+  const parent = publisher.store.getStatuses().find(s => s.noteId === inReplyTo);
+  let actor = parent?.actor || null;
+  if (!parent) {
+    const doc = await publisher.resolveActor(inReplyTo).catch(() => null);
+    const by = doc?.attributedTo;
+    actor = typeof by === 'string' ? by : (Array.isArray(by) ? by[0] : by)?.id || null;
+    if (typeof actor === 'object') actor = actor?.id || null;
+  }
+  if (!actor || actor === publisher.urls.actor) return null;
+  if (mentions.some(m => m.actor === actor)) return null;
+  if (publisher.store.isBlocked?.(actor)) return null;
+  const doc = await publisher.resolveActor(actor).catch(() => null);
+  const inbox = doc?.endpoints?.sharedInbox || doc?.inbox || null;
+  if (!inbox) publisher.log(`reply: no inbox found for ${actor} — they get it only through followers`);
+  return { actor, inbox };
+}
+
+// Inboxes for actors a client addressed by id — the people in a post's
+// to/cc and the ones in bto/bcc, who are delivered to and never listed.
+export async function inboxesFor(publisher, actorIds = []) {
+  const out = [];
+  for (const id of [...new Set(actorIds.filter(a => typeof a === 'string' && a && a !== publisher.urls.actor))]) {
+    if (!publisher.resolveActor) break;
+    const doc = await publisher.resolveActor(id).catch(() => null);
+    const inbox = doc?.endpoints?.sharedInbox || doc?.inbox;
+    if (inbox) out.push(inbox);
+    else publisher.log(`addressed actor ${id} has no inbox the agent can find — not delivered to`);
+  }
+  return out;
+}
+
 // A direct post goes only to the people it names, so one that names nobody
 // the agent can find would be kept in the private container and delivered
 // to no one, with nothing said. Refused instead, before anything is written,
@@ -120,7 +159,7 @@ export function rowContent(obj) {
   return `<p><a href="${esc(obj?.id || '')}">${esc(obj?.type || 'object')}</a></p>`;
 }
 
-export async function publishNote(publisher, content, { inReplyTo, attachments, visibility = 'public', spoilerText = null, slug: wanted = null } = {}) {
+export async function publishNote(publisher, content, { inReplyTo, attachments, visibility = 'public', spoilerText = null, sensitive = false, slug: wanted = null, also = [], deliverTo = [] } = {}) {
   const { urls } = publisher;
   const priv = visibility === 'private' || visibility === 'direct';
   if (priv) {
@@ -131,8 +170,11 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
   const slug = await slugFor(publisher, priv ? urls.privateNotes : urls.notes, wanted, published);
   const mentions = await publisher._mentionsFor(content, inReplyTo);
   if (visibility === 'direct') assertDirectAddressed(content, mentions);
+  const reply = await replyTarget(publisher, inReplyTo, mentions, visibility);
   const note = wire.noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions,
-    visibility, summary: spoilerText, container: priv ? urls.privateNotes : urls.notes });
+    visibility, summary: spoilerText, sensitive, container: priv ? urls.privateNotes : urls.notes,
+    also: [...also, ...(reply ? [reply.actor] : [])] });
+  const addressedInboxes = await inboxesFor(publisher, [...also, ...deliverTo]);
 
   await podNotes.write(publisher.remote, note.id, note);
   // Empty, but present: a dangling `replies` that 404s is worse than none.
@@ -145,8 +187,9 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
     noteId: note.id, actor: urls.actor, content: note.content, published, inReplyTo,
     kind: 'post', slug, text: content, visibility,
     ...(spoilerText ? { spoiler: spoilerText } : {}),
+    ...(note.sensitive ? { sensitive: true } : {}),
     ...(attachments?.length ? { attachments } : {}),
-    ...(note.tag?.length ? { mentions: note.tag.map(t => ({ href: t.href, name: t.name })) } : {}),
+    ...rowTags(note),
   });
   // The row is what the author's own timeline reads. Land it before answering
   // — the same PUT the debounce would send in 300 ms — so a worker killed or a
@@ -164,6 +207,8 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
   const inboxes = [...new Set([
     ...(visibility === 'direct' ? [] : contacts.followers.map(f => f.sharedInbox || f.inbox)),
     ...mentions.map(m => m.inbox),
+    reply?.inbox,
+    ...addressedInboxes,
   ].filter(Boolean))];
   await publisher.deliverer.deliverToAll(inboxes, create);
   publisher.log(`note published: ${note.id} → ${inboxes.length} inbox(es)`);
@@ -199,7 +244,7 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
 // An object already living on this pod (an id under it) is not copied: the
 // Create names it where it is. Anything else is written into the notes
 // container under the client's slug when it is free, else a minted one.
-export async function publishObject(publisher, object, { visibility = 'public', slug: wanted = null } = {}) {
+export async function publishObject(publisher, object, { visibility = 'public', slug: wanted = null, also = [], deliverTo = [] } = {}) {
   const { urls } = publisher;
   const priv = visibility === 'private' || visibility === 'direct';
   if (priv) {
@@ -212,11 +257,15 @@ export async function publishObject(publisher, object, { visibility = 'public',
   const ownId = typeof object.id === 'string' && /^https?:\/\//u.test(object.id) && object.id.startsWith(pod)
     ? object.id : null;
   const name = await slugFor(publisher, container, wanted, published);
-  const addressed = wire.addressing(urls, visibility);
+  const addressed = wire.addressing(urls, visibility, visibility === 'direct' ? also : []);
+  if (visibility !== 'direct') addressed.cc = [...new Set([...addressed.cc, ...also])];
   let doc = null;
   const id = ownId || container + name;
   if (!ownId) {
-    doc = { ...object, id, attributedTo: urls.actor, published: object.published || published, to: addressed.to, cc: addressed.cc };
+    // bto and bcc are for delivery alone: they never appear in what is
+    // stored, served or sent (ActivityPub §6).
+    const { bto, bcc, ...sent } = object;   // eslint-disable-line no-unused-vars
+    doc = { ...sent, id, attributedTo: urls.actor, published: object.published || published, to: addressed.to, cc: addressed.cc };
     if (!doc['@context']) doc['@context'] = wire.AS_CTX;
     if (typeof doc.content === 'string') doc.content = wire.sanitizeHtml(doc.content);
     await podNotes.write(publisher.remote, id, doc);
@@ -239,14 +288,25 @@ export async function publishObject(publisher, object, { visibility = 'public',
   };
   await podNotes.writeCreate(publisher.remote, create.id, create);
   const contacts = publisher.store.getContacts();
-  const inboxes = visibility === 'direct' ? []
-    : [...new Set(contacts.followers.map((f) => f.sharedInbox || f.inbox).filter(Boolean))];
+  const inboxes = [...new Set([
+    ...(visibility === 'direct' ? [] : contacts.followers.map((f) => f.sharedInbox || f.inbox)),
+    ...(await inboxesFor(publisher, [...also, ...deliverTo])),
+  ].filter(Boolean))];
   await publisher.deliverer.deliverToAll(inboxes, create);
   publisher.log(`${row.type || 'object'} published: ${id} → ${inboxes.length} inbox(es)`);
   return { id, createId, copied: !ownId };
 }
 
-export async function updateNote(publisher, s, { content, spoilerText = null, attachments = null } = {}) {
+// What the author's timeline row keeps of a note's tags: the people it
+// mentions and the hashtags it carries, each as the client-facing shape.
+export function rowTags(note) {
+  const tags = [].concat(note.tag || []);
+  const mentions = tags.filter(t => t.type === 'Mention').map(t => ({ href: t.href, name: t.name }));
+  const hashtags = tags.filter(t => t.type === 'Hashtag').map(t => ({ name: String(t.name).replace(/^#/, ''), url: t.href }));
+  return { ...(mentions.length ? { mentions } : {}), ...(hashtags.length ? { tags: hashtags } : {}) };
+}
+
+export async function updateNote(publisher, s, { content, spoilerText = null, sensitive = null, attachments = null } = {}) {
   const { urls } = publisher;
   const updated = new Date().toISOString();
   const inText = new Set(wire.mentionsIn(content));
@@ -262,24 +322,29 @@ export async function updateNote(publisher, s, { content, spoilerText = null, at
   // post may carry no slug, but the note id already contains it.
   const container = String(s.noteId).startsWith(urls.privateNotes) ? urls.privateNotes : urls.notes;
   const slug = s.slug || String(s.noteId).slice(container.length);
+  const reply = await replyTarget(publisher, s.inReplyTo, mentions, s.visibility || 'public');
   const note = wire.noteDoc({
     urls, slug, content, published: s.published, inReplyTo: s.inReplyTo,
     attachments: atts, mentions, visibility: s.visibility || 'public',
-    summary: spoilerText, updated, container,
+    summary: spoilerText, sensitive: sensitive ?? !!s.sensitive, updated, container,
+    also: reply ? [reply.actor] : [],
   });
   await podNotes.write(publisher.remote, note.id, note);
   await podNotes.writeCreate(publisher.remote, wire.createActivityId(note.id), wire.createActivity(note, urls));
   const patched = publisher.store.updateStatus(s.noteId, {
     content: note.content, text: content, editedAt: updated,
     spoiler: spoilerText || undefined,
+    sensitive: note.sensitive || undefined,
     attachments: atts.length ? atts : undefined,
-    mentions: note.tag?.length ? note.tag.map(t => ({ href: t.href, name: t.name })) : undefined,
+    mentions: rowTags(note).mentions,
+    tags: rowTags(note).tags,
   });
   const update = wire.updateActivity(note, urls);
   const contacts = publisher.store.getContacts();
   const inboxes = [...new Set([
     ...(s.visibility === 'direct' ? [] : contacts.followers.map(f => f.sharedInbox || f.inbox)),
     ...mentions.map(m => m.inbox),
+    reply?.inbox,
   ].filter(Boolean))];
   await publisher.deliverer.deliverToAll(inboxes, update);
   publisher.log(`note edited: ${note.id} → ${inboxes.length} inbox(es)`);

package/lib/core/publisher/questions.mjs

@@ -9,7 +9,7 @@ import crypto from 'node:crypto';
 import * as wire from '../wire.mjs';
 import * as polls from '../polls.mjs';
 import * as podNotes from '../../pod/notes.mjs';
-import { assertDirectAddressed } from './notes.mjs';
+import { assertDirectAddressed, replyTarget, rowTags } from './notes.mjs';
 
 // How long a poll gathers votes before its Question is rewritten. Every vote
 // changes a number other servers re-read, and rewriting per vote would make a
@@ -22,7 +22,7 @@ const POLL_REWRITE_MS = 10_000;
  * voter pick more than one, and `expiresAt` is when voting stops.
  */
 export async function publishQuestion(publisher, content, { options = [], multiple = false, expiresAt = null,
-  inReplyTo = undefined, visibility = 'public', spoilerText = null } = {}) {
+  inReplyTo = undefined, visibility = 'public', spoilerText = null, sensitive = false } = {}) {
   const { urls } = publisher;
   const priv = visibility === 'private' || visibility === 'direct';
   if (priv) {
@@ -54,6 +54,7 @@ export async function publishQuestion(publisher, content, { options = [], multip
   const slug = published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
   const mentions = await publisher._mentionsFor(content, inReplyTo);
   if (visibility === 'direct') assertDirectAddressed(content, mentions);
+  const reply = await replyTarget(publisher, inReplyTo, mentions, visibility);
   const poll = {
     multiple: !!multiple,
     expiresAt: expiresAt || null,
@@ -62,11 +63,11 @@ export async function publishQuestion(publisher, content, { options = [], multip
     votersCount: 0,
     // Resolved once, here: a tally rewrite must not cost a webfinger lookup
     // per vote for people the poll named.
-    mentionInboxes: [...new Set(mentions.map(m => m.inbox).filter(Boolean))],
+    mentionInboxes: [...new Set([...mentions.map(m => m.inbox), reply?.inbox].filter(Boolean))],
   };
   const question = wire.questionDoc({
     urls, slug, content, published, inReplyTo, attachments: [], mentions,
-    visibility, summary: spoilerText,
+    visibility, summary: spoilerText, sensitive, also: reply ? [reply.actor] : [],
     container: priv ? urls.privateNotes : urls.notes,
     options: poll.options, multiple: poll.multiple, endTime: poll.expiresAt, votersCount: 0,
   });
@@ -79,8 +80,10 @@ export async function publishQuestion(publisher, content, { options = [], multip
   publisher.store.addStatus({
     noteId: question.id, actor: urls.actor, content: question.content, published,
     kind: 'post', slug, text: content, visibility, poll, inReplyTo,
+    ...(reply ? { replyActor: reply.actor } : {}),
     ...(spoilerText ? { spoiler: spoilerText } : {}),
-    ...(question.tag?.length ? { mentions: question.tag.map(t => ({ href: t.href, name: t.name })) } : {}),
+    ...(question.sensitive ? { sensitive: true } : {}),
+    ...rowTags(question),
   });
   if (await publisher.store.commit?.() === false) publisher.log(`poll published but its timeline row was refused: ${question.id}`);
 
@@ -164,8 +167,8 @@ export async function republishPoll(publisher, questionId, { closing = null } =
   }));
   const question = wire.questionDoc({
     urls, slug, content: s.text ?? '', published: s.published, inReplyTo: s.inReplyTo,
-    attachments: [], mentions,
-    visibility: s.visibility || 'public', summary: s.spoiler || null, container,
+    attachments: [], mentions, also: s.replyActor ? [s.replyActor] : [],
+    visibility: s.visibility || 'public', summary: s.spoiler || null, sensitive: !!s.sensitive, container,
     options: poll.options, multiple: !!poll.multiple, endTime: poll.expiresAt,
     closed: poll.closed, votersCount: poll.votersCount || 0,
   });

package/lib/core/store.mjs

@@ -414,6 +414,15 @@ export class PodStore {
   // — not from the pod, not from the RDF. Unverified entries are dropped first
   // now, so a flood can only ever evict itself, and a stranger's genuine
   // favourite still shows up, which is what recording them at all is for.
+  // What an Undo unsays: the favourite or boost it names, matched by a
+  // predicate on what was recorded. Returns how many went.
+  removeNotifications(pred) {
+    const all = this.getNotifications();
+    const kept = all.filter(n => !pred(n));
+    if (kept.length !== all.length) this.write('notifications.json', kept);
+    return all.length - kept.length;
+  }
+
   addNotification(n) {
     const all = this.getNotifications();
     const id = crypto.createHash('sha256').update(JSON.stringify(n)).digest('hex').slice(0, 16);

package/lib/core/wire.mjs

@@ -52,11 +52,14 @@ export function hostMeta(base) {
   return `<?xml version="1.0" encoding="UTF-8"?>\n<XRD xmlns="http://docs.oasis-open.org/ns/xri/xrd-1.0">\n  <Link rel="lrdd" template="${base}.well-known/webfinger?resource={uri}"/>\n</XRD>\n`;
 }
 
-export function jrd({ handle, host, actor, aliases = [] }) {
+export function jrd({ handle, host, actor, aliases = [], page = null }) {
   return {
     subject: `acct:${handle}@${host}`,
     ...(aliases.length ? { aliases } : {}),
-    links: [{ rel: 'self', type: 'application/activity+json', href: actor }],
+    links: [
+      { rel: 'self', type: 'application/activity+json', href: actor },
+      ...(page ? [{ rel: 'http://webfinger.net/rel/profile-page', type: 'text/html', href: page }] : []),
+    ],
   };
 }
 
@@ -372,7 +375,7 @@ export function outboxPage(outboxId, n, items) {
     id: outboxPageId(outboxId, n),
     type: 'OrderedCollectionPage',
     partOf: outboxId,
-    orderedItems: items,
+    orderedItems: items.map(outboxWireItem),
     ...(n > 1 ? { next: outboxPageId(outboxId, n - 1) } : {}),
   };
 }
@@ -394,6 +397,13 @@ export function outboxPages(outbox) {
 
 export const outboxItemId = (i) => (typeof i === 'string' ? i : i?.id || null);
 
+// The outbox lists activities. A post is recorded by its object id, which is
+// what every local reader keys on, and published as the Create beside it — a
+// document of its own. An Announce is recorded and published whole.
+export const outboxWireItem = (i) => (typeof i === 'string' ? createActivityId(i) : i);
+export const outboxLocalItem = (i) =>
+  (typeof i === 'string' && i.endsWith('-create') ? i.slice(0, -'-create'.length) : i);
+
 // Assign entries to pages, and KEEP the assignment.
 //
 // Deriving the pages from position — which is what outboxPages does — makes an
@@ -589,10 +599,37 @@ export function mentionsIn(text) {
   return [...new Set(String(text).match(MENTION_RE) || [])].map(m => m.slice(1));
 }
 
+// #word in the text: letters, digits and underscores with at least one
+// letter, not glued to a word or a path (so a URL's fragment is not a tag).
+export const HASHTAG_RE = /(^|[^\/\w)])#([\p{L}\p{N}_]*[\p{L}_][\p{L}\p{N}_]*)/gu;
+
+export function hashtagsIn(text) {
+  const seen = new Map();
+  for (const m of String(text).matchAll(HASHTAG_RE)) {
+    const key = m[2].toLowerCase();
+    if (!seen.has(key)) seen.set(key, m[2]);
+  }
+  return [...seen.values()];
+}
+
+// Where a tag's link points: this actor's own page, asked for the tag. A
+// Hashtag's href must be a URL; the name is what servers file it under.
+export function tagHref(urls, name) {
+  return urls.profileHtml + '?tag=' + encodeURIComponent(String(name).toLowerCase());
+}
+
 // Escape first, then linkify: escaping cannot introduce an @handle, and the
 // anchors must survive it. A mention nobody could resolve stays plain text.
-export function contentHtml(text, mentions = []) {
+export function contentHtml(text, mentions = [], hashtags = []) {
   let html = String(text).replace(/[&<>]/g, c => HTML_ESCAPES[c]);
+  if (hashtags.length) {
+    const byName = new Map(hashtags.filter(h => h?.name && h?.href).map(h => [h.name.toLowerCase(), h.href]));
+    html = html.replace(HASHTAG_RE, (all, lead, name) => {
+      const href = byName.get(name.toLowerCase());
+      if (!href) return all;
+      return `${lead}<a href="${String(href).replace(/[&<>"]/g, c => (HTML_ESCAPES[c] || '&quot;'))}" class="mention hashtag" rel="tag">#<span>${name}</span></a>`;
+    });
+  }
   for (const m of mentions) {
     if (!m?.handle || !m?.actor) continue;
     // The anchor is for PEOPLE — the mentioned actor's advertised page when it
@@ -619,26 +656,36 @@ export function addressing(urls, visibility, who = []) {
   }[visibility] || { to: [PUBLIC], cc: [urls.followers, ...who] };
 }
 
+// `also`: actors addressed without being mentioned — the parent's author on
+// a reply. In cc but not in tag, so their server receives the post and does
+// not notify them. A direct post names its audience in the text alone.
 export function noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions = [],
-  visibility = 'public', summary = null, updated = null, container = null }) {
+  visibility = 'public', summary = null, sensitive = false, updated = null, container = null, also = [] }) {
   const id = (container || urls.notes) + slug;
   const who = mentions.map(m => m.actor);
-  const addressed = addressing(urls, visibility, who);
+  const extra = visibility === 'direct' ? [] : also.filter(a => a && !who.includes(a));
+  const addressed = addressing(urls, visibility, [...who, ...extra]);
+  const hashtags = hashtagsIn(content).map(name => ({ name, href: tagHref(urls, name) }));
   const note = {
     '@context': AS_CTX,
     id, type: 'Note',
     attributedTo: urls.actor,
-    content: contentHtml(content, mentions),
+    content: contentHtml(content, mentions, hashtags),
     published,
     to: addressed.to,
     cc: addressed.cc,
     replies: repliesId(id),
   };
   if (summary) note.summary = summary;      // the content warning
+  // A content warning is what a receiver hides behind; media marked
+  // sensitive without one is hidden the same way.
+  if (summary || sensitive) note.sensitive = true;
   if (updated) note.updated = updated;      // an edit's own stamp
-  if (mentions.length) {
-    note.tag = mentions.map(m => ({ type: 'Mention', href: m.actor, name: '@' + m.handle }));
-  }
+  const tag = [
+    ...mentions.map(m => ({ type: 'Mention', href: m.actor, name: '@' + m.handle })),
+    ...hashtags.map(h => ({ type: 'Hashtag', href: h.href, name: '#' + h.name })),
+  ];
+  if (tag.length) note.tag = tag;
   if (inReplyTo) note.inReplyTo = inReplyTo;
   if (attachments?.length) {
     note.attachment = attachments.map(a => ({

package/lib/device/admin/static.mjs

@@ -130,8 +130,8 @@ export function securityHeaders(auth, isHtml) {
   return h;
 }
 
-export function sendJson(res, status, obj, auth) {
-  res.writeHead(status, { 'content-type': 'application/json', ...securityHeaders(auth, false) });
+export function sendJson(res, status, obj, auth, contentType = 'application/json') {
+  res.writeHead(status, { 'content-type': contentType, ...securityHeaders(auth, false) });
   res.end(JSON.stringify(obj) + '\n');
 }
 

package/lib/device/admin/surface.mjs

@@ -181,6 +181,14 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
         const scheme = req.socket.encrypted || req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http';
         return json(res, 200, masto.authorizationServerMetadata(`${scheme}://${req.headers.host}${mount}`));
       }
+      // The short address a person types: /@handle opens the profile page.
+      const at = /^\/@([^/]+)$/u.exec(p);
+      const ownHandle = handle || agent.store?.getConfig?.()?.handle || '';
+      if (at && ownHandle && agent.publisher?.urls?.profileHtml
+        && decodeURIComponent(at[1]).toLowerCase() === String(ownHandle).toLowerCase()) {
+        res.writeHead(302, { location: agent.publisher.urls.profileHtml, 'cache-control': 'no-store' });
+        res.end(); return;
+      }
       if (atDoor && gate(req, res)) return;
       if (p === '/api/v1/streaming/health') {
         res.writeHead(200, { 'content-type': 'text/plain' }); res.end('OK'); return;
@@ -191,10 +199,11 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
           `${req.socket.encrypted || req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http'}://${req.headers.host}${mount}/nodeinfo/2.0`));
       }
       if (p === '/nodeinfo/2.0') {
-        return json(res, 200, nodeinfoDoc({
+        // The schema's own media type, as the NodeInfo spec names it.
+        return sendJson(res, 200, nodeinfoDoc({
           version: AGENT_VERSION,
           localPosts: agent.store.countStatuses('post'),
-        }));
+        }), allowed, 'application/json; profile="http://nodeinfo.diaspora.software/ns/schema/2.0#"');
       }
       // A group serves the client too, as of 2026-08-01. It was withheld on the
       // reasoning that a group has no timeline a human reads — which was wrong

package/lib/gateway/front-core.mjs

@@ -26,11 +26,17 @@ import { podBaseOfWebId } from '../pod/urls.mjs';
 // wire.mjs: wire drags the agent's whole HTML pipeline (sanitize-html and
 // friends), which a serverless front must never carry — it crashed the
 // deployed function before it answered its first request.
-const jrd = ({ handle, host, actor, aliases = [] }) => ({
+const jrd = ({ handle, host, actor, aliases = [], page = null }) => ({
   subject: `acct:${handle}@${host}`,
   ...(aliases.length ? { aliases } : {}),
-  links: [{ rel: 'self', type: 'application/activity+json', href: actor }],
+  links: [
+    { rel: 'self', type: 'application/activity+json', href: actor },
+    ...(page ? [{ rel: 'http://webfinger.net/rel/profile-page', type: 'text/html', href: page }] : []),
+  ],
 });
+// The public profile page of any account the front answers for lives on
+// its pod, whether the address is the front's or the pod's own.
+const profilePageOf = (rec) => (rec?.podHome ? rec.podHome + 'ap/profile.html' : null);
 
 const AP_CT = 'application/activity+json';
 
@@ -41,10 +47,13 @@ async function verifyPodToken(request, pathname, verifier) {
   const authz = request.headers.get('authorization');
   if (!authz) return null;
   try {
-    const v = verifier || (await import('@solid/access-token-verifier')).createSolidTokenVerifier();
     const dpop = request.headers.get('dpop');
+    // Solid-OIDC binds the token to a key the client proves on every request;
+    // a token shown without the proof is one anyone who saw it could show.
+    if (!dpop) { console.log(`front: pod token without a DPoP proof refused on ${pathname}`); return null; }
+    const v = verifier || (await import('@solid/access-token-verifier')).createSolidTokenVerifier();
     const url = request.url;
-    const { webid } = await v(authz, dpop ? { header: dpop, method: request.method, url } : undefined);
+    const { webid } = await v(authz, { header: dpop, method: request.method, url });
     return webid || null;
   } catch (e) {
     // Said aloud: a token the front will not take is otherwise a bare 401 to
@@ -597,8 +606,27 @@ async function route(request, ctx) {
     // is the alias, so a client signing in by the fronted address can find
     // the pod (and its login) without a lookup only the host could answer.
     const podActor = rec.inboxOnly ? [] : [rec.podHome + 'ap/actor'];
-    return j(200, jrd({ handle: m[1], host: ctx.host, actor: rec.actorUrl, aliases: podActor }),
+    const out = j(200, jrd({ handle: m[1], host: ctx.host, actor: rec.actorUrl, aliases: podActor, page: profilePageOf(rec) }),
       'application/jrd+json');
+    // RFC 7033: a JRD is read from any origin.
+    out.headers['access-control-allow-origin'] = '*';
+    return out;
+  }
+
+  // The short address a person types: https://<host>/@handle opens the
+  // profile page, the way most Fediverse servers spell it. /@handle@pod-host
+  // is the same for an account whose address is its pod's, which the front
+  // holds under that full address — the form other servers use for a
+  // profile that lives elsewhere.
+  const at = /^\/@([^/@]+)(?:@([^/@]+))?$/u.exec(pathname);
+  if (at) {
+    const handle = decodeURIComponent(at[1]).toLowerCase();
+    const host = at[2] ? decodeURIComponent(at[2]).toLowerCase() : null;
+    const key = host && host !== String(ctx.host).toLowerCase() ? `${handle}@${host}` : handle;
+    const rec = await ctx.lookup(key);
+    const page = rec && profilePageOf(rec);
+    if (!page) return notFound();
+    return { status: 302, headers: { location: page, 'cache-control': 'no-store' }, body: '' };
   }
 
   const up = parseUserPath(pathname);

package/lib/gateway/httpsig.mjs

@@ -58,10 +58,14 @@ export async function verifyHttpSignature(request, { documentLoader, keyCache, t
   } catch {
     result = null;   // the library itself failed — no more informative than a bad signature
   }
+  // Which signature the sender used: RFC 9421 carries a Signature-Input
+  // header beside Signature; the cavage draft carries Signature alone. The
+  // library picks the verifier by the same header.
+  const method = request.headers.has('signature-input') ? 'rfc9421' : 'draft-cavage';
   if (result?.verified) {
     const key = result.key;
     return {
-      verified: true, method: 'draft-cavage',
+      verified: true, method,
       keyId: key.id?.href ?? null, actor: key.ownerId?.href ?? null, reason: null,
       checks: { signature: true, digest: true, dateSkew: true, keyFetched: true },
     };
@@ -75,12 +79,12 @@ export async function verifyHttpSignature(request, { documentLoader, keyCache, t
   }
   if (kind === 'keyFetchError') {
     return {
-      verified: false, method: 'draft-cavage', keyId: null, actor: null,
+      verified: false, method, keyId: null, actor: null,
       reason: 'key-unfetchable', checks: { signature: false, keyFetched: false },
     };
   }
   return {
-    verified: false, method: 'draft-cavage', keyId: null, actor: null,
+    verified: false, method, keyId: null, actor: null,
     reason: 'bad-signature', checks: { signature: false },
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.8.0",
+  "version": "1.10.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",

package/run-agent.mjs

@@ -325,12 +325,14 @@ export class Agent {
       actorId: this.urls.actor, edPrivate: keys.edPrivate,
       proofKeyId: assertionKeyId(this.urls),
       log: this.log, passive: this.viewer,
+      onGone: () => this.publisher.publishCollections({ followers: true }),
     });
     this.publisher = new Publisher({
       config, remote: this.remote, store: this.store,
       deliverer: this.deliverer, publicKeyPem: keys.rsaPublicPem,
       assertionKey: keys.edPublicMultibase, log: this.log,
       resolveMention: (h) => resolveHandle(this, h),
+      resolveActor: (u) => this.intake.fetchAP(u),
       // Inside a pod server the client surface answers on the pod's own
       // origin, so it can be advertised. Standalone it is on loopback, and
       // naming it in a world-readable actor would send clients nowhere.

package/scripts/stage-site.mjs

@@ -94,6 +94,7 @@ fs.writeFileSync(path.join(site, '_redirects'), [
   '/api/agent              /.netlify/functions/front  200',
   '/u/*                    /.netlify/functions/front  200',
   '/.well-known/*          /.netlify/functions/front  200',
+  '/@*                     /.netlify/functions/front  200',
   '/install                /.netlify/functions/front  200',
   '/run                    /.netlify/functions/front  200',
   '/roster                 /.netlify/functions/front  200',

package/web/app/agent.mjs

@@ -223,6 +223,7 @@ export class BrowserAgent {
       // The relay finds the account by the front's own key for it, which for a
       // mail-door account is the full address, not the bare handle.
       handle: doorKeyOf(config.gateway?.url) || config.handle, sessionFetch: session.fetch,
+      onGone: () => this.publisher.publishCollections({ followers: true }),
     });
 
     this.publisher = new Publisher({
@@ -232,6 +233,7 @@ export class BrowserAgent {
       // gives its publisher. Without it no mention from the browser ever
       // resolved: a direct message went to nobody, a mention notified no one.
       resolveMention: (h) => resolveHandle(this, h),
+      resolveActor: (u) => this.intake.fetchAP(u),
     });
 
     // The Bluesky connection, stamped to this actor. The same client the Node