fedipod 1.8.0 → 1.11.0

package/README.md

@@ -37,6 +37,9 @@ Which specs FediPod follows, and where it stops short: [specs-in-use.md](specs-i
 4. Enter your pod password once. It creates the account and locks your
    signing key. The password is not stored.
 
+Anyone can open your profile at `https://fedipod.net/@handle`, signed in or
+not.
+
 Your account then opens in the client. To use it from another browser, go to
 https://fedipod.net, enter your address, sign in at your pod, and unlock your
 key with your password once on that browser.

package/groups.md

@@ -55,6 +55,7 @@ queue is its own list, separate from post review, and appears on the group's
 admin page as **Moderation requests** when something is waiting: carry it out,
 or turn it down.
 A followed group's own announced deletion of a post it carried to you is honoured.
+A group that withdraws a post it carried to you takes it off your timeline too.
 
 ## Inviting people
 

package/lib/client/c2s.mjs

@@ -175,7 +175,7 @@ export class C2S {
           + 'actor document names; this address is the owner reading their own' });
       }
       const reader = await this.auth(req, pathname);
-      if (!reader.ok) return this.send(res, reader.status, { error: reader.error });
+      if (!reader.ok) return this.send(res, reader.status, { error: reader.error }, reader.headers || {});
       return this.sendInbox(res, url);
     }
     if (req.method === 'GET' || req.method === 'HEAD') {
@@ -190,7 +190,7 @@ export class C2S {
     }
 
     const who = await this.auth(req, pathname);
-    if (!who.ok) return this.send(res, who.status, { error: who.error });
+    if (!who.ok) return this.send(res, who.status, { error: who.error }, who.headers || {});
 
     // A viewer (another agent holds the lease) may not act — but the user
     // acting HERE outranks an idle active agent elsewhere, exactly as on the
@@ -262,6 +262,16 @@ export class C2S {
     }
   }
 
+  // The actors a client addressed by id, beyond the audience words: the ones
+  // in to/cc are listed and delivered to; the ones in bto/bcc are delivered
+  // to and never listed (§6).
+  addressedActors(activity, object) {
+    const pick = (...fields) => [...new Set(fields.flatMap((f) => arr(activity[f] ?? object?.[f]).map(idOf)))]
+      .filter((a) => typeof a === 'string' && /^https?:\/\//u.test(a)
+        && a !== wire.PUBLIC && a !== this.urls.followers && a !== this.urls.actor);
+    return { also: pick('to', 'cc'), deliverTo: pick('bto', 'bcc') };
+  }
+
   async _dispatch(activity, { slug, raw, reply }) {
     const agent = this.agent;
     const object = typeof activity.object === 'object' && activity.object !== null
@@ -273,13 +283,14 @@ export class C2S {
         const makes = object?.type || 'Note';
         if (!object) return reply(422, { error: 'a Create carries the object it creates' });
         const visibility = this.visibilityOf(activity, object);
+        const { also, deliverTo } = this.addressedActors(activity, object);
         // Not a Note and not a poll: stored as sent, under this actor, and
         // the Create around it delivered — a Web Annotation, for one.
         if (makes !== 'Note' && makes !== 'Question') {
           const asSent = raw && typeof raw === 'object' && !Array.isArray(raw)
             ? (ACTIVITY_TYPES.has(raw.type) ? (raw.object && typeof raw.object === 'object' ? raw.object : null) : raw)
             : null;
-          const made = await agent.publisher.publishObject(asSent || object, { visibility, slug });
+          const made = await agent.publisher.publishObject(asSent || object, { visibility, slug, also, deliverTo });
           return reply(201, { id: made.createId, object: made.id }, { location: made.createId });
         }
         // `source.content` is the client's plain text when it sends one; bare
@@ -302,6 +313,7 @@ export class C2S {
               inReplyTo: idOf(object.inReplyTo) || undefined,
               visibility,
               spoilerText: object.summary || null,
+              sensitive: object.sensitive === true,
             });
             return reply(201,
               { id: wire.createActivityId(question.id), object: question.id },
@@ -320,7 +332,8 @@ export class C2S {
           attachments,
           visibility,
           spoilerText: object.summary || null,
-          slug,
+          sensitive: object.sensitive === true,
+          slug, also, deliverTo,
         });
         return reply(201, { id: wire.createActivityId(note.id), object: note.id },
           { location: wire.createActivityId(note.id) });
@@ -344,7 +357,8 @@ export class C2S {
           })).filter((a) => a.url)
           : null;
         await agent.publisher.updateNote(s, {
-          content: text, spoilerText: object?.summary || null, attachments,
+          content: text, spoilerText: object?.summary || null,
+          sensitive: object?.sensitive === undefined ? null : object.sensitive === true, attachments,
         });
         return reply(200, { ok: true, object: s.noteId });
       }

package/lib/client/masto/index.mjs

@@ -117,7 +117,15 @@ export class MastoApi {
       res.end(body);
       return true;
     };
-    const ctx = { req, res, pathname, url, send };
+    // The address the client reached, so every self-URL handed back — the
+    // pagination links above all — names it rather than the pod's host.
+    const scheme = String(this.scheme
+      || (req.headers?.['x-forwarded-proto'] === 'https' || req.socket?.encrypted ? 'https' : 'http')).replace(/:.*$/, '');
+    let self = url;
+    try {
+      self = new URL(`${scheme}://${req.headers?.host || 'localhost'}${this.mount || ''}${pathname}${url.search || ''}`);
+    } catch { /* a Host nothing can parse: the links keep the placeholder origin */ }
+    const ctx = { req, res, pathname, url: self, send };
 
     if (await oauth.handle(this, ctx)) return true;
     if (!pathname.startsWith('/api/')) return false;

package/lib/client/masto/render.mjs

@@ -46,7 +46,7 @@ export function account(api, actorUrl, { selfAcct } = {}) {
     // asking about itself would be told it was a person.
     bot: false, discoverable: true,
     group: self ? api.store.getConfig()?.kind === 'group' : cached.type === 'Group',
-    created_at: '2026-01-01T00:00:00.000Z',
+    created_at: (self && api.store.getConfig()?.createdAt) || '2026-01-01T00:00:00.000Z',
     note: (self ? api.store.getConfig()?.summary : cached.summary) || '',
     url: actorUrl, uri: actorUrl,
     avatar: selfIcon(api, self, cached) || TRANSPARENT_PNG,
@@ -102,7 +102,9 @@ export function page(api, items, url, { limit = 20, max = 40, idOf = (s) => api.
   }
   const pageItems = items.slice(0, n);
   if (!pageItems.length) return { items: pageItems, headers: {} };
-  const base = `http://${api.host}${url.pathname}`;
+  // `url` is the request as the client addressed it (index.mjs handle), so
+  // the links name that origin and mount, not the pod's host.
+  const base = url.origin + url.pathname;
   const q = (extra) => {
     const u = new URL(base);
     for (const [k, v] of url.searchParams) if (!['max_id', 'since_id', 'min_id'].includes(k)) u.searchParams.set(k, v);
@@ -222,7 +224,7 @@ export function status(api, s, { all } = {}) {
     created_at: s.published || new Date().toISOString(),
     in_reply_to_id: s.inReplyTo ? api.store.idFor(s.inReplyTo) : null,
     in_reply_to_account_id: null,
-    sensitive: !!s.spoiler, spoiler_text: s.spoiler || '',
+    sensitive: !!(s.spoiler || s.sensitive), spoiler_text: s.spoiler || '',
     visibility: s.visibility || 'public', language: null,
     edited_at: s.editedAt || null,
     uri: s.noteId, url: s.link || s.noteId,
@@ -251,7 +253,7 @@ export function status(api, s, { all } = {}) {
         acct: bare.includes('@') ? bare : (host ? `${user}@${host}` : bare),
       };
     }),
-    tags: [],
+    tags: (s.tags || []).map(t => ({ name: t.name, url: t.url })),
     emojis: (s.emojis || []).map(e => ({
       shortcode: e.shortcode, url: e.url, static_url: e.url, visible_in_picker: false,
     })),

package/lib/client/masto/statuses.mjs

@@ -37,6 +37,7 @@ export async function handle(api, ctx) {
       if (ready !== true) return send(422, { error: ready });
     }
     const spoilerText = String(body.spoiler_text || '').trim() || null;
+    const sensitive = body.sensitive === true || body.sensitive === 'true' || body.sensitive === '1';
     const mediaIds = [].concat(body.media_ids || body['media_ids[]'] || []).filter(Boolean);
     const media = api.store.getMedia();
     const attachments = mediaIds.map(id => media[id] && { id, ...media[id] }).filter(Boolean);
@@ -67,7 +68,7 @@ export async function handle(api, ctx) {
         const q = await api.agent.publisher.publishQuestion(body.status, {
           options: asking.options, multiple: asking.multiple,
           expiresAt: new Date(Date.now() + seconds * 1000).toISOString(),
-          inReplyTo, visibility, spoilerText,
+          inReplyTo, visibility, spoilerText, sensitive,
         });
         return send(200, api.status(api.store.getStatuses().find(x => x.noteId === q.id)));
       } catch (e) {
@@ -98,7 +99,7 @@ export async function handle(api, ctx) {
     let note;
     try {
       note = await api.agent.publisher.publishNote(body.status,
-        { inReplyTo, attachments, visibility, spoilerText });
+        { inReplyTo, attachments, visibility, spoilerText, sensitive });
     } catch (e) {
       // A direct message nobody could be found for: the sender's mistake to
       // fix, said in the client, not a fault of the server.
@@ -126,7 +127,7 @@ export async function handle(api, ctx) {
     const s = noteUrl && api.store.getStatuses().find(x => x.noteId === noteUrl);
     if (!s) return send(404, { error: 'Record not found' });
     return send(200, [{
-      content: s.content || '', spoiler_text: s.spoiler || '', sensitive: !!s.spoiler,
+      content: s.content || '', spoiler_text: s.spoiler || '', sensitive: !!(s.spoiler || s.sensitive),
       created_at: s.editedAt || s.published, account: api.account(s.actor),
       media_attachments: (s.attachments || []).map(a => api.mediaJson(a)),
       emojis: [], poll: null,
@@ -152,8 +153,10 @@ export async function handle(api, ctx) {
       ? mediaIds.map(id => media[id] && { id, ...media[id] }).filter(Boolean)
       : null;                                   // null: keep what the post has
     const spoilerText = String(body.spoiler_text || '').trim() || null;
+    const sensitive = body.sensitive === undefined ? null
+      : (body.sensitive === true || body.sensitive === 'true' || body.sensitive === '1');
     const patched = await api.agent.publisher.updateNote(s,
-      { content: body.status, spoilerText, attachments });
+      { content: body.status, spoilerText, sensitive, attachments });
     return send(200, api.status(patched || s));
   }
   if (mStatus && req.method === 'DELETE') {

package/lib/client/oidc-auth.mjs

@@ -1,7 +1,7 @@
 // oidc-auth.mjs — who may drive the C2S surface. Two proofs are accepted:
 // the Mastodon facade's bearer (minted on this machine, so its holder is the
-// operator by construction), or a Solid-OIDC token — DPoP-bound when the
-// client sends the proof header — verified by the same library the wider
+// operator by construction), or a Solid-OIDC token with its DPoP proof,
+// which Solid-OIDC requires, verified by the same library the wider
 // Solid world uses. The token alone is not enough: the WebID it names must
 // be THIS identity's owner, an authorization step the token does not carry.
 //
@@ -25,6 +25,13 @@ export function makeC2sAuth({ agent, masto = null, verifier = null, log = () =>
     if (!req.headers.authorization) {
       return { ok: false, status: 401, error: 'authentication required: a Solid-OIDC token (DPoP) or this agent\'s own bearer' };
     }
+    // Solid-OIDC binds the token to a key and has the client prove it holds
+    // that key on every request. A token shown without its proof is a token
+    // anyone who saw it could show.
+    if (!req.headers.dpop) {
+      return { ok: false, status: 401, error: 'a Solid-OIDC token must come with its DPoP proof',
+        headers: { 'www-authenticate': 'DPoP' } };
+    }
     let webid;
     try {
       const v = await loadVerifier();
@@ -38,7 +45,7 @@ export function makeC2sAuth({ agent, masto = null, verifier = null, log = () =>
       }://${req.headers.host}${mount}${pathname}`;
       ({ webid } = await v(
         req.headers.authorization,
-        req.headers.dpop ? { header: req.headers.dpop, method: req.method, url: htu } : undefined,
+        { header: req.headers.dpop, method: req.method, url: htu },
       ));
     } catch (e) {
       log(`c2s auth: token rejected — ${e.message}`);

package/lib/core/as2.mjs

@@ -19,7 +19,7 @@
 // common shape: one that skipped it would not be read as JSON-LD, and would
 // produce no graph, so nothing could be validated against it.
 //
-// CONTEXTS ARE NEVER FETCHED. The loader serves the fourteen the fediverse
+// CONTEXTS ARE NEVER FETCHED. The loader serves the fifteen the fediverse
 // actually uses and refuses every other URL. That refusal is the point: this
 // code runs on documents a stranger wrote, in the same path the SSRF guards
 // protect, and expanding one would otherwise mean dereferencing a URL of their

package/lib/core/deliver.mjs

@@ -8,6 +8,7 @@ import { webcrypto } from 'node:crypto';
 import { attachProof } from './proof.mjs';
 import { pinnedFor, retryAfterMs, HTTP_TIMEOUT_MS } from '../shared/safefetch.mjs';
 import { USER_AGENT } from '../shared/ua.mjs';
+import { dropFollower } from './store.mjs';
 
 const MAX_REDIRECTS = 3;
 
@@ -52,14 +53,20 @@ const MAX_QUEUE = 2000;                        // beyond it, overflow dead-lette
 // the server, or no answer at all, is grounds to leave it alone.
 const hostOf = (inbox) => { try { return new URL(inbox).host; } catch { return inbox; } };
 const aboutTheHost = (e) => !e.status || e.status >= 500 || e.status === 429;
+// A 410 says the inbox is gone for good and a 404 that nothing answers there:
+// neither earns a second POST. Gone also means whoever read there has left.
+const unsalvageable = (e) => e.status === 404 || e.status === 410;
 
 export class Deliverer {
   // passive: signing-only (viewer-mode agents) — no queue drain timer, so a
   // read-only agent never mutates shared delivery state. startQueue() flips
   // it live when a viewer is promoted to active.
   constructor({ store, keyId, rsaPrivate, actorId = null, edPrivate = null, proofKeyId = null,
-    log = console.log, passive = false }) {
+    log = console.log, passive = false, onGone = null }) {
     this.store = store;
+    // Called after followers at a gone inbox are dropped: the agent republishes
+    // its followers collection.
+    this.onGone = onGone;
     this.keyId = keyId;
     this.rsaPrivate = rsaPrivate;
     this.actorId = actorId;
@@ -182,6 +189,7 @@ export class Deliverer {
       await this.deliverNow(inbox, signed);
       this.log(`delivered ${signed.type} → ${inbox}`);
     } catch (e) {
+      if (unsalvageable(e)) { await this._unsalvageable(inbox, e); return; }
       this.log(`delivery failed (${e.message}) — queued`);
       const wait = e.retryAfterMs || 60_000;
       if (aboutTheHost(e)) {
@@ -192,6 +200,20 @@ export class Deliverer {
     }
   }
 
+  // Not retried, and on a 410 the followers who received there are dropped,
+  // so the next fan-out stops asking; the followers collection is republished
+  // through onGone. A 404 drops only this delivery.
+  async _unsalvageable(inbox, e) {
+    if (e.status !== 410) { this.log(`delivery dropped (${e.message}) — nothing answers there`); return; }
+    const contacts = this.store.getContacts?.();
+    const left = (contacts?.followers || []).filter(f => f.inbox === inbox || f.sharedInbox === inbox);
+    this.log(`${inbox} is gone (410) — delivery dropped${left.length ? `, ${left.length} follower(s) there forgotten` : ''}`);
+    if (!left.length) return;
+    for (const f of left) dropFollower(contacts, f.actor, 'inbox-gone');
+    this.store.setContacts(contacts);
+    try { await this.onGone?.(); } catch (err) { this.log(`followers republish after 410: ${err.message}`); }
+  }
+
   // The queue has a ceiling: a fan-out into a sea of down servers must not grow
   // queue.json without bound. Overflow keeps the evidence as a dead letter.
   _enqueue(item) {
@@ -292,6 +314,7 @@ export class Deliverer {
         changed = true;
         this.log(`retry ok: ${item.activity.type} → ${item.inbox}`);
       } catch (e) {
+        if (unsalvageable(e)) { changed = true; await this._unsalvageable(item.inbox, e); continue; }
         item.attempts += 1;
         changed = true;
         const wait = e.retryAfterMs || ladderFor(item);

package/lib/core/intake/activities.mjs

@@ -103,6 +103,8 @@ export async function onFollow(intake, activity, actor, { trusted = false } = {}
 }
 
 export async function onUndo(intake, activity, actor, { trusted = false } = {}) {
+  const inner = activity.object && typeof activity.object === 'object' ? activity.object : null;
+  if (inner?.type === 'Like' || inner?.type === 'Announce') return onUndoReaction(intake, inner, actor, { trusted });
   // AS2 allows `object` to be a bare IRI, and that IRI is exactly the Follow
   // id we stored. Reading `.type` off a string gives undefined, so the whole
   // Undo was dropped — silently, since handle() reads that as handled, so no
@@ -274,6 +276,58 @@ export async function onAnnounce(intake, activity, actor, objectId) {
   return intake.ingestNote(objectId, actor, { via: actor });
 }
 
+// Undo{Like} and Undo{Announce}: the sender unsaying a favourite or a boost.
+// The Like it unsays was recorded on the sender's word alone, so its undoing
+// is taken the same way: the notification it left goes. A boost unsaid by
+// someone we follow takes the post they carried off the timeline — the carry
+// was accepted on that follow, and the retraction is honoured on it.
+export async function onUndoReaction(intake, inner, actor, { trusted = false } = {}) {
+  const innerActor = typeof inner.actor === 'string' ? inner.actor : inner.actor?.id;
+  if (innerActor && innerActor !== actor) return;             // one cannot unsay another's
+  const wrapped = inner.object;
+  const target = (wrapped && typeof wrapped === 'object'
+    && (wrapped.type === 'Create' || wrapped.type === 'Update')) ? wrapped.object : wrapped;
+  const objectId = typeof target === 'string' ? target : target?.id;
+  if (!objectId) return;
+  if (objectId.startsWith(intake.urls.notes)) {
+    const type = inner.type === 'Like' ? 'favourite' : 'reblog';
+    const gone = intake.store.removeNotifications(n => n.type === type && n.actor === actor && n.noteId === objectId);
+    if (gone) intake.log(`${inner.type} withdrawn by ${actor} on ${objectId}`);
+    return;
+  }
+  if (inner.type !== 'Announce') return;
+  const followed = trusted || intake.store.getContacts().following.some(f => f.actor === actor && f.accepted);
+  if (!followed) return;
+  const s = intake.store.getStatuses().find(x => x.noteId === objectId);
+  if (!s || s.kind === 'post' || s.via !== actor) return;
+  await intake.forget(s);
+  intake.log(`boost withdrawn by ${actor}: ${objectId} left the timeline`);
+}
+
+// Block: the sender wants nothing more to do with this account. Mastodon
+// drops the follow both ways on receipt, and so does this — on a delivery
+// the door verified. A Block carries nothing to check and names nothing we
+// hold, so one taken from the public-append inbox unverified would let
+// anybody evict any follower, the hole the Undo handler closes with the
+// follow id. Unverified: logged, nothing else.
+export async function onBlock(intake, activity, actor, { trusted = false } = {}) {
+  const objectId = typeof activity.object === 'string' ? activity.object : activity.object?.id;
+  if (objectId !== intake.urls.actor) return;
+  if (!trusted) { intake.log(`Block from ${actor} arrived unverified — ignored`); return; }
+  const contacts = intake.store.getContacts();
+  const wasFollower = contacts.followers.some(f => f.actor === actor);
+  const wasFollowing = contacts.following.some(f => f.actor === actor);
+  if (wasFollower) dropFollower(contacts, actor, 'blocked-us');
+  contacts.following = contacts.following.filter(f => f.actor !== actor);
+  intake.store.setContacts(contacts);
+  const reqs = intake.store.getRequests();
+  const left = reqs.filter(r => r.actor !== actor);
+  if (left.length !== reqs.length) intake.store.setRequests(left);
+  await intake.republish({ followers: wasFollower, following: wasFollowing, pending: true });
+  const what = [wasFollower && 'their follow of us', wasFollowing && 'our follow of them'].filter(Boolean).join(' and ');
+  intake.log(`blocked by ${actor}: ${what || 'no relationship'} dropped`);
+}
+
 // Mastodon sends these constantly; ignoring them left deleted posts standing
 // for good. Two guards, because a forged Delete would otherwise erase anyone's
 // content: it must come from the object's own origin, and the object must

package/lib/core/intake/index.mjs

@@ -584,6 +584,7 @@ export class Intake {
       case 'Reject': return this.onReject(activity, actor, { trusted });
       case 'Move': return this.onMove(activity, actor);
       case 'Add': case 'Remove': return this.onAddRemove(activity, actor);
+      case 'Block': return this.onBlock(activity, actor, { trusted });
       default: this.log(`ignored ${activity.type} from ${actor}`);
     }
   }
@@ -636,6 +637,7 @@ export class Intake {
   onAddRemove(...a) { return activities.onAddRemove(this, ...a); }
   onFollow(...a) { return activities.onFollow(this, ...a); }
   onUndo(...a) { return activities.onUndo(this, ...a); }
+  onBlock(...a) { return activities.onBlock(this, ...a); }
   onCreate(...a) { return activities.onCreate(this, ...a); }
   onAnnouncedDelete(...a) { return activities.onAnnouncedDelete(this, ...a); }
   onAnnounce(...a) { return activities.onAnnounce(this, ...a); }

package/lib/core/intake/notes.mjs

@@ -190,6 +190,11 @@ export async function ingestNote(intake, objectId, actor, { via, inline = null }
     .slice(0, MAX_MENTIONS)
     .map(t => ({ href: httpOnly(String(t.href).slice(0, MAX_URL_CHARS)), name: String(t.name).slice(0, 256) }))
     .filter(m => m.href);
+  const hashtags = [].concat(note.tag || [])
+    .filter(t => t?.type === 'Hashtag' && t.name)
+    .slice(0, MAX_MENTIONS)
+    .map(t => ({ name: String(t.name).replace(/^#/, '').slice(0, 128), url: httpOnly(String(t.href || '').slice(0, MAX_URL_CHARS)) }))
+    .filter(t => t.name);
   const emojis = emojisOf(note);
   const poll = pollOf(note);
   // Explicitly addressed, but to nobody public and to no followers
@@ -209,6 +214,8 @@ export async function ingestNote(intake, objectId, actor, { via, inline = null }
     ...(nonPublic ? { nonPublic: true } : {}),
     // The author's content warning, shown as one: plain text only.
     ...(note.summary ? { spoiler: String(note.summary).replace(/<[^>]*>/g, '') } : {}),
+    ...(note.sensitive === true ? { sensitive: true } : {}),
+    ...(hashtags.length ? { tags: hashtags } : {}),
     ...(poll ? { poll } : {}),
     ...(emojis.length ? { emojis } : {}),
     ...(mentions.length ? { mentions } : {}),

package/lib/core/publisher/collections.mjs

@@ -86,7 +86,10 @@ export async function publishOutbox(publisher, outbox, { acls = false, force = f
 // the flat collection this used to write, so an actor published before paging
 // is still readable — which matters because rebuild reads this to recover
 // posts a lost machine no longer has.
-export function readPublishedOutbox(publisher) { return podOutbox.readPublished(publisher.remote, publisher.urls); }
+export async function readPublishedOutbox(publisher) {
+  const items = await podOutbox.readPublished(publisher.remote, publisher.urls);
+  return Array.isArray(items) ? items.map(wire.outboxLocalItem) : items;
+}
 
 // The followers collection, paged like the outbox: a head that carries only
 // the count and the page bounds, and page documents holding the actor IRIs —
@@ -191,9 +194,9 @@ export async function publishBlocked(publisher) {
 }
 
 // The outbox is the public record of everything this actor has said, boosts
-// included. A Create goes in as its note id, which dereferences; an Announce
-// has only a fragment id, so the activity itself goes in the collection —
-// legal AS2, and what Mastodon serves.
+// included. A post is recorded by its note id and published as its Create
+// (wire.outboxWireItem); an Announce has only a fragment id, so the activity
+// itself goes in.
 export async function recordOutbox(publisher, item) {
   const outbox = publisher.store.read('outbox.json', []);
   outbox.unshift(item);

package/lib/core/publisher/index.mjs

@@ -34,7 +34,7 @@ const AGENT_VERSION = JSON.parse(fs.readFileSync(
 
 export class Publisher {
   constructor({ config, remote, store, deliverer, publicKeyPem, assertionKey = null, log = console.log,
-    probeFetch = null, resolveMention = null, clientOrigin = null,
+    probeFetch = null, resolveMention = null, resolveActor = null, clientOrigin = null,
   }) {
     this.config = config;
     this.remote = remote;
@@ -57,6 +57,9 @@ export class Publisher {
     // socket opened to that pod. Tests inject their own.
     this.probeFetch = probeFetch || ((u, i) => this.remote.probe(u, i));
     this.resolveMention = resolveMention;
+    // An actor or object by its address, verified at its origin — how a reply
+    // finds the inbox of the person it answers.
+    this.resolveActor = resolveActor;
     // Per-poll rewrite windows, keyed by question id. See POLL_REWRITE_MS.
     this.pollTimers = new Map();
     this.log = log;
@@ -85,22 +88,14 @@ export class Publisher {
     return String(gw.url).replace(/ap\/inbox\/?$/u, 'ap/outbox');
   }
 
-  async publishProfile({ force = false } = {}) {
+  // Every actor document this identity publishes, from one place: the
+  // profile publish and a Move both write it, and a Move that rebuilt it
+  // by hand dropped the gateway inbox, the outbox door and the collections.
+  actorDocFor({ priv = false, moderators = null, inbox = null, movedTo = this.config.movedTo || null } = {}) {
     const { urls } = this;
-    const host = new URL(urls.base).host;
-
-    // The owner-only collections (FEP-4ccd, FEP-c648) are advertised only
-    // where "owner-only" is real — the pod must provably enforce the private
-    // container's ACL, the same bar private posts clear.
-    const priv = await this.privateReady() === true;
-    const moderators = (this.config.moderators || []).length ? urls.moderators : null;
-    // An advertised inbox gateway (config.gateway.mode past 'off') becomes the
-    // actor's inbox; deliveries reach the pod inbox through it. Absent → today.
-    const gw = this.config.gateway;
-    const gwActive = gw && gw.url && gw.mode && gw.mode !== 'off';
-    const actorDoc = wire.actorDoc({
+    return wire.actorDoc({
       urls, handle: wire.publicHandle(this.config), name: this.config.name, publicKeyPem: this.publicKeyPem,
-      movedTo: this.config.movedTo || null, kind: this.config.kind,
+      movedTo, kind: this.config.kind,
       approveJoins: wire.followsNeedApproval(this.config),
       assertionKey: this.assertionKey,
       summary: this.config.summary || null, icon: this.config.icon || null,
@@ -111,7 +106,7 @@ export class Publisher {
       pendingFollowers: priv ? urls.pendingFollowers : null,
       pendingFollowing: priv ? urls.pendingFollowing : null,
       blocked: priv ? urls.blocked : null,
-      inbox: gwActive ? gw.url : null,
+      inbox,
       // The agent's own outbox endpoint, where it is reachable: a client
       // following the actor must arrive somewhere that will take a write.
       // Otherwise the Gateway's outbox door, when one is attached.
@@ -121,18 +116,83 @@ export class Publisher {
       oauthAuthorize: this.clientOrigin ? `${this.clientOrigin}oauth/authorize` : null,
       oauthToken: this.clientOrigin ? `${this.clientOrigin}oauth/token` : null,
     });
+  }
+
+  // The human half: a page a browser can open and follow from. The actor
+  // document is for servers; this is the address you hand to a person. It
+  // shows who the account is, its fields, when it joined and what it pinned;
+  // the counts and the posts live in the collections. Written only when its
+  // content changed.
+  async publishProfilePage({ force = false } = {}) {
+    const { urls } = this;
+    const host = new URL(urls.base).host;
+    // When the account was made. Accounts from before this was recorded take
+    // the date of their oldest post, or today.
+    if (!this.config.createdAt) {
+      const oldest = this.store.getStatuses().filter(s => s.kind === 'post' && s.published)
+        .map(s => s.published).sort()[0];
+      this.config.createdAt = oldest || new Date().toISOString();
+      this.store.setConfig?.({ ...this.store.getConfig?.(), createdAt: this.config.createdAt });
+    }
+    const pinned = this.store.getStatuses()
+      .filter(s => s.kind === 'post' && s.pinned && s.visibility !== 'private' && s.visibility !== 'direct')
+      .sort((a, b) => String(b.published).localeCompare(String(a.published)))
+      .slice(0, 5)
+      .map(s => ({ content: s.content, published: s.published, url: s.noteId }));
+    // The address as the world knows it: at the Gateway for a fronted
+    // identity, on the pod's host otherwise, the actor id where no host can
+    // answer for a handle.
+    const frontActor = this.config.gateway?.frontActor;
+    const address = frontActor ? `@${wire.publicHandle(this.config)}@${new URL(frontActor).host}`
+      : (wire.webfingerHost(urls.base) ? `@${this.config.handle}@${host}` : urls.actor);
+    const html = wire.profilePageHtml({
+      name: this.config.name || this.config.handle,
+      address,
+      summary: this.config.summary ? wire.contentHtml(this.config.summary) : null,
+      icon: this.config.icon || null,
+      image: this.config.image || null,
+      fields: this.config.fields || [],
+      joined: this.config.createdAt,
+      pinned,
+      kind: this.config.kind,
+    });
+    const digest = crypto.createHash('sha256').update(html).digest('hex').slice(0, 32);
+    const seen = this.store.read('published.json', {});
+    if (!force && seen.pageDigest === digest) return false;
+    await podActor.writeProfilePage(this.remote, urls, html);
+    this.store.write('published.json', { ...this.store.read('published.json', {}), pageDigest: digest });
+    return true;
+  }
+
+  async publishProfile({ force = false } = {}) {
+    const { urls } = this;
+    const host = new URL(urls.base).host;
+
+    // The owner-only collections (FEP-4ccd, FEP-c648) are advertised only
+    // where "owner-only" is real — the pod must provably enforce the private
+    // container's ACL, the same bar private posts clear.
+    const priv = await this.privateReady() === true;
+    const moderators = (this.config.moderators || []).length ? urls.moderators : null;
+    // An advertised inbox gateway (config.gateway.mode past 'off') becomes the
+    // actor's inbox; deliveries reach the pod inbox through it. Absent → today.
+    const gw = this.config.gateway;
+    const gwActive = gw && gw.url && gw.mode && gw.mode !== 'off';
+    const actorDoc = this.actorDocFor({ priv, moderators, inbox: gwActive ? gw.url : null });
     const surface = crypto.createHash('sha256').update(JSON.stringify({
       actor: actorDoc, handle: this.config.handle, host,
       quiesced: !!this.config.quiescedAt, version: AGENT_VERSION,
       moderators: this.config.moderators || [],
     })).digest('hex').slice(0, 32);
+    // The human page has its own gate: it changes with pins and the joined
+    // date as well as with the profile, and costs one write when it does.
+    await this.publishProfilePage({ force });
     if (!force && this.store.read('published.json', {}).surfaceDigest === surface) {
       this.log('profile unchanged — nothing republished');
       return { unreachable: [], updated: 0, skipped: true };
     }
 
     await discovery.writeWebfinger(this.remote, urls,
-      wire.jrd({ handle: this.config.handle, host, actor: urls.actor }));
+      wire.jrd({ handle: this.config.handle, host, actor: urls.actor, page: urls.profileHtml }));
     await discovery.writeHostMeta(this.remote, urls, wire.hostMeta(urls.base));
 
     const nodeinfoDocUrl = urls.home + 'ap/nodeinfo-2.0';
@@ -155,16 +215,6 @@ export class Publisher {
     // what concerns this identity. Written only while a gateway is advertised.
     if (gwActive) await this.publishGatewayPolicy();
 
-    // The human half: a page a browser can open and follow from. The actor
-    // document is for servers; this is the address you hand to a person.
-    await podActor.writeProfilePage(this.remote, urls, wire.profilePageHtml({
-      name: this.config.name || this.config.handle,
-      address: wire.webfingerHost(urls.base) ? `@${this.config.handle}@${host}` : urls.actor,
-      summary: this.config.summary ? wire.contentHtml(this.config.summary) : null,
-      icon: this.config.icon || null,
-      kind: this.config.kind,
-    }));
-
     // WebID → actor: the profile card lists the actor as a foaf:account.
     // Best-effort — a profile that cannot be read or edited does not stop the
     // publish, it is logged and the rest of the surface still goes up.
@@ -358,15 +408,12 @@ export class Publisher {
     await this.deliverer.deliverToAll(inboxes, wire.moveActivity(urls, target, Date.parse(at)));
     this.config.movedTo = target;                       // so the republish below carries it
     this.store.setConfig({ ...this.store.getConfig(), movedTo: target, movedAt: at });
-    await podActor.writeMoved(this.remote, urls, wire.actorDoc({
-      urls, handle: wire.publicHandle(this.config), name: this.config.name,
-      publicKeyPem: this.publicKeyPem, movedTo: target, kind: this.config.kind,
-      approveJoins: wire.followsNeedApproval(this.config),
-      assertionKey: this.assertionKey,
-      summary: this.config.summary || null, icon: this.config.icon || null,
-      image: this.config.image || null, fields: this.config.fields || [],
-      webId: this.remote.webId || null,
-      aliases: this.config.aliases || [],
+    const gw = this.config.gateway;
+    const gwActive = gw && gw.url && gw.mode && gw.mode !== 'off';
+    const priv = await this.privateReady() === true;
+    const moderators = (this.config.moderators || []).length ? urls.moderators : null;
+    await podActor.writeMoved(this.remote, urls, this.actorDocFor({
+      priv, moderators, inbox: gwActive ? gw.url : null, movedTo: target,
     }));
     await this.store.flush();
     this.log(`moved to ${target}: Move sent to ${inboxes.length} inbox(es), actor now advertises movedTo`);