fedipod-server 0.11.0 → 0.13.0

package/lib/core/intake/activity.mjs

@@ -0,0 +1,240 @@
+// activity.mjs — what an inbound activity IS, before anything is done with
+// it: the AS2 types the fediverse actually posts, the caps that bound what a
+// stranger can make the agent hold, and the pure checks on ids, origins and
+// authorship that every other intake module shares.
+
+// A note's replies collection is rewritten WHOLE every time one is added, so
+// without a cap the bytes are quadratic in a number a stranger chooses.
+export const MAX_REPLIES_RECORDED = 500;
+// Ids of activities already forwarded to our followers (§7.1.2), so a re-drain
+// never re-broadcasts one. A ceiling on the record, not on forwarding.
+export const MAX_FORWARDED = 2000;
+// How many posts may wait for a group operator's decision. A ceiling, not a
+// window: full refuses the newest rather than dropping the oldest.
+export const MAX_PENDING_REVIEW = 500;
+// A group's membership, cached: it changes when someone joins or leaves, and
+// re-reading it on every arriving post would spend one stranger's fetch per
+// message on a list that moves in days.
+export const CO_MEMBER_TTL_MS = 24 * 60 * 60_000;
+export const CO_MEMBER_MAX = 5000;
+// An activity is a few kB. This is generous by two orders of magnitude and
+// still bounds what one Append can make us hold in memory.
+export const MAX_ITEM_BYTES = 512 * 1024;
+// The AS2 actor types. A group is as much an actor as a person is.
+export const ACTOR_TYPES = new Set(['Person', 'Group', 'Service', 'Application', 'Organization']);
+// The AS2 types the fediverse actually posts. `Note` alone is Mastodon's world
+// and not the fediverse's: an Article is a Plume or WriteFreely post, a
+// Question is a poll, a Video is PeerTube, a Page is Lemmy, an Audio is
+// Funkwhale. Insisting on Note dead-lettered every one of them as "not a
+// verifiable Note" — from people the owner had chosen to follow, silently.
+//
+// They share the shape this code reads: attributedTo, content, published,
+// inReplyTo, tag, attachment. A poll's options are dropped, which is a
+// degraded rendering rather than a lost post.
+export const CONTENT_TYPES = new Set(['Note', 'Article', 'Question', 'Page', 'Video', 'Audio', 'Image', 'Event']);
+
+// A Question is a poll: its options live in oneOf (pick one) or anyOf (pick
+// several), each carrying the tally its author's server maintains.
+// Custom emojis ride the tag list; the images live at the author's server and
+// the client fetches them from there.
+// Content, name and summary were capped; nothing else was. One remote Question
+// with thousands of options, or thousands of emoji, mention or attachment
+// entries, put megabytes into a single statuses.json row — a document rewritten
+// whole on every change. These are display lists: past a few dozen, nothing can
+// render them and nobody meant them to be rendered.
+// http(s) only. An emoji, attachment or mention URL is written straight into
+// the client's markup, so `javascript:` and `data:` have no business in one.
+// The store has guarded avatars this way all along (safeUrl, lib/store.mjs);
+// these three lists were simply never put through it.
+export const httpOnly = (u) => {
+  if (!u) return null;
+  try {
+    const p = new URL(String(u));
+    return (p.protocol === 'https:' || p.protocol === 'http:') ? String(u) : null;
+  } catch { return null; }
+};
+
+export const MAX_MODQUEUE = 200;
+export const MAX_EMOJIS = 60;
+export const MAX_POLL_OPTIONS = 50;
+export const MAX_OPTION_CHARS = 200;
+export const MAX_MENTIONS = 60;
+export const MAX_URL_CHARS = 2048;
+
+export function emojisOf(note) {
+  return [].concat(note?.tag || [])
+    .filter(t => t?.type === 'Emoji' && t.icon?.url && t.name)
+    .slice(0, MAX_EMOJIS)
+    .map(t => ({
+      shortcode: String(t.name).replace(/^:|:$/g, '').slice(0, 64),
+      url: httpOnly(String(t.icon.url).slice(0, MAX_URL_CHARS)),
+    }))
+    .filter(e => e.url);
+}
+
+export function pollOf(note) {
+  const opts = note?.oneOf || note?.anyOf;
+  if (!Array.isArray(opts) || !opts.length) return null;
+  return {
+    multiple: !!note.anyOf,
+    expiresAt: note.endTime || null,
+    closed: !!note.closed,
+    options: opts.slice(0, MAX_POLL_OPTIONS).map(o => ({
+      title: String(o?.name ?? '').slice(0, MAX_OPTION_CHARS),
+      votes: Number(o?.replies?.totalItems) || 0,
+    })),
+  };
+}
+// AS2 lets `type` be one string or a list, and implementations use both —
+// `["Person","Service"]` is an ordinary actor. Read either form.
+export const typesOf = (t) => (Array.isArray(t) ? t : [t]).filter(x => typeof x === 'string');
+export const isContentType = (t) => typesOf(t).some(x => CONTENT_TYPES.has(x));
+export const isActorType = (t) => typesOf(t).some(x => ACTOR_TYPES.has(x));
+
+// What we will carry to our followers on someone else's behalf (§7.1.2): the
+// activities a conversation is made of, and nothing else. A type this file
+// does not handle falls out of handle() with no rejection, and "no rejection"
+// is what qualifies an activity for forwarding — so without this gate a
+// stranger could have anything at all, of a type nothing here reads,
+// re-delivered to every follower over our signature.
+export const FORWARDABLE = new Set(['Create', 'Update', 'Delete', 'Like', 'Announce', 'Undo']);
+// Of those, the ones we may re-deliver to our own followers over our own
+// signature (§7.1.2). Deliberately narrower than FORWARDABLE: these three are
+// the ones whose object this drain fetched from the author's origin and checked
+// before accepting. A Like, an Announce or an Undo is taken on the envelope's
+// word alone — relaying one is signing for a claim nothing corroborated.
+export const FORWARD_TYPES = new Set(['Create', 'Update', 'Delete']);
+// How many forwards one drain may send. A reply into a busy thread of ours is a
+// handful; anything near this is a flood using us as an amplifier.
+export const MAX_FORWARDS_PER_DRAIN = 20;
+export const ACCEPT_AP = 'application/activity+json, application/ld+json; profile="https://www.w3.org/ns/activitystreams"';
+
+// What is worth keeping of an activity we are filing rather than acting on.
+//
+// A dead letter, a moderation entry and a waiting follow request each used to
+// hold the WHOLE delivered activity — up to the 512 KB item cap — in documents
+// that are serialized and PUT whole on every change. A stranger could inflate
+// deadletter.json to ~100 MB and requests.json to ~250 MB and make us rewrite
+// them on every batch.
+//
+// Everything the consumers need survives: `acceptActivity` wraps this as the
+// Accept's object (and {id, type, actor, object} IS the standard Follow shape),
+// `applyModeration` reads only `object`, and a dead letter is read by a human
+// who wants to know what arrived, not to replay it.
+export function trimActivity(a) {
+  if (!a || typeof a !== 'object') return a ?? null;
+  const idOf = (v) => (typeof v === 'string' ? v : v?.id ?? null);
+  const out = {};
+  for (const k of ['id', 'type', 'actor', 'target']) {
+    const v = idOf(a[k]);
+    if (v) out[k] = String(v).slice(0, 2048);
+  }
+  const obj = idOf(a.object);
+  if (obj) out.object = String(obj).slice(0, 2048);
+  // A typed object with no id still says what it was — a Block of nobody, an
+  // Undo of a Follow — and that is the whole of what the queue reads.
+  else if (a.object && typeof a.object === 'object' && a.object.type) {
+    out.object = { type: String(a.object.type).slice(0, 64) };
+  }
+  return out;
+}
+
+// Same origin AND, where the origin holds more than one identity, the same
+// identity within it.
+//
+// Origin alone is the right test when an origin is one person — the ordinary
+// fediverse server, and a subdomain pod. It is the WRONG test on a path-based
+// host, and above all on a multi-tenant front: every tenant of fedipod.net has
+// ids under `https://fedipod.net/u/<name>/`, so origin-equality made every
+// tenant able to vouch for every other. One tenant could publish posts
+// attributed to another, Update a neighbour's post, or Delete it — and a
+// receiving Mastodon would believe it for the same reason we did.
+//
+// So when both ids carry an identity prefix, the prefixes must match too. The
+// two shapes that exist here are the front's `/u/<name>/` and a pod's own AP
+// root (`…/<root>/ap/…`); anything else has no prefix and falls back to origin,
+// which is what a plain remote server should be judged by.
+function identityPrefix(u) {
+  const m = /^(https?:\/\/[^/]+\/u\/[^/]+\/)/u.exec(u);
+  if (m) return m[1];
+  const ap = /^(https?:\/\/[^/]+\/(?:[^/]+\/)*?)ap\//u.exec(u);
+  return ap ? ap[1] : null;
+}
+
+export function sameIdentity(a, b) {
+  if (!sameOrigin(a, b)) return false;
+  const pa = identityPrefix(String(a));
+  const pb = identityPrefix(String(b));
+  if (!pa || !pb) return true;              // no prefix to compare: origin is the answer
+  return pa === pb;
+}
+
+export function sameOrigin(a, b) {
+  try { return new URL(a).origin === new URL(b).origin; } catch { return false; }
+}
+
+// Is this socket URL the pod's own? The scheme has to be the socket form of the
+// pod's — wss for https, ws for http — so a downgrade to plaintext from an https
+// pod is somewhere else, not the same place unencrypted.
+//
+// The host may be the pod's, or a PARENT of it. Not a loosening for
+// convenience: a CSS server that gives every pod a subdomain answers
+// notifications from the server root, so jeff-zucker.teamid.live is served by
+// wss://teamid.live/.notifications/… — which is the deployment this project
+// actually runs on. Requiring an exact match dropped it to polling, and the
+// live agents are how that was found rather than the suite.
+//
+// A sibling subdomain is still refused: only a suffix of our own host passes,
+// and two labels minimum so `.live` cannot pose as everyone's parent. Not a
+// public-suffix list — that is a dependency and a data file to keep current,
+// and the party this guards against is the pod you already chose to trust.
+//
+// `localhost` is the one single-label parent allowed, because it is the one that
+// cannot be anybody else: it is reserved to the loopback interface (RFC 6761),
+// so `alice.localhost` and `localhost` are the same machine by definition and
+// there is no stranger for the rule to keep out. Without this a pod served from
+// a subdomain of localhost — which is how a Solid server with subdomain pods
+// runs on a developer's machine — refused its own socket and fell back to
+// polling, so every delivery waited up to two minutes.
+export function sameSocketOrigin(socketUrl, podBase) {
+  let s, p;
+  try { s = new URL(socketUrl); p = new URL(podBase); } catch { return false; }
+  if (s.protocol !== (p.protocol === 'https:' ? 'wss:' : 'ws:')) return false;
+  if (s.host === p.host) return true;
+  const parent = s.hostname.toLowerCase();
+  return (parent.split('.').length >= 2 || parent === 'localhost')
+    && s.port === p.port
+    && p.hostname.toLowerCase().endsWith('.' + parent);
+}
+
+export function httpUrl(u) {
+  try {
+    const p = new URL(String(u)).protocol;
+    return p === 'https:' || p === 'http:';
+  } catch { return false; }
+}
+
+// Who a note is BY. A document may only speak for an actor at its own origin.
+// `attributedTo` used to be taken at face value, so a note served anywhere
+// could name anyone: one at a host the attacker controls, claiming to be by
+// someone the owner follows, passed every check we had — the envelope's
+// sameOrigin compares the ACTIVITY to its object, never the object to its
+// author — and landed in the home timeline and in the pod as them. For a group
+// it went further still, because amplify() gates on the author's membership,
+// so the group signed an Announce of it and delivered it to every member.
+//
+// `delivered` is the actor that brought it, used only when the note names no
+// author of its own; it has to clear the same test, which is why a boost of an
+// unattributed note is refused rather than credited to the booster.
+//
+// Returns the author, or null when nothing at the note's origin vouches for one.
+export function authorOf(note, delivered = null) {
+  const claimed = [].concat(note?.attributedTo || [])
+    .map(a => (typeof a === 'string' ? a : a?.id)).find(Boolean) || null;
+  const author = claimed || delivered;
+  if (!author) return null;
+  // sameIdentity, not sameOrigin: on a multi-tenant front every tenant shares
+  // an origin, so origin-equality let any of them be credited with any other's
+  // post. See sameIdentity.
+  return sameIdentity(note?.id, author) ? author : null;
+}

package/lib/core/intake/channel.mjs

@@ -0,0 +1,144 @@
+// channel.mjs — the inbox's push channel: a WebSocketChannel2023 subscription
+// on the pod's inbox container, reconnecting with backoff, and the drain it
+// wakes. State (ws, wsState, reconnectTries, resubTimer) lives on the Intake
+// so status pages and stop() see it; this module is the behaviour.
+
+import * as podNotifications from '../../pod/notifications.mjs';
+import { USER_AGENT } from '../../shared/ua.mjs';
+import { HTTP_TIMEOUT_MS, readCapped } from '../../shared/safefetch.mjs';
+import { sameSocketOrigin } from './activity.mjs';
+
+// The channel a subscription returns outlives a dropped socket, so reconnecting
+// reuses it. Creating a new one per reconnect is what buried solidcommunity.net
+// in channel records they then had to sweep.
+const CHANNEL_DOC = 'inbox-channel.json';
+// A flapping socket used to POST a NEW WebSocketChannel2023 channel every two
+// seconds — hundreds an hour against a server that is already struggling, and
+// channel churn its operators have to sweep up. Backs off instead, and an open
+// only triggers a sweep if we have not just swept.
+const RECONNECT_MIN_MS = 2_000;
+const RECONNECT_MAX_MS = 5 * 60_000;
+// How long a socket must stay up before the backoff counts it as a success and
+// resets. Shorter than that is a flap, not a connection.
+const RECONNECT_STABLE_MS = 60_000;
+const OPEN_DRAIN_MIN_GAP_MS = 30_000;
+
+// Jittered exponential, floor to ceiling, reset by a successful open.
+export function reconnectDelay(intake) {
+  const capped = Math.min(RECONNECT_MIN_MS * 2 ** intake.reconnectTries, RECONNECT_MAX_MS);
+  intake.reconnectTries++;
+  return Math.round(capped * (0.8 + Math.random() * 0.4));
+}
+
+// --- push ---
+// Any failure in here used to end push for the life of the process: the
+// retry lived only in the "server refused the subscription" branch, so a
+// network blip left wsState at never-connected and the agent silently on
+// polling. Every path now schedules a retry on the same backoff.
+export async function subscribe(intake) {
+  try {
+    await intake._subscribeOnce();
+  } catch (e) {
+    intake.wsState = 'subscribe-error';
+    const wait = intake._reconnectDelay();
+    intake.log(`subscribe failed (${e.message}) — retrying in ${Math.round(wait / 1000)}s (polling meanwhile)`);
+    if (!intake.stopped) {
+      intake.resubTimer = setTimeout(() => intake.subscribe().catch(() => {}), wait);
+      intake.resubTimer.unref?.();
+    }
+  }
+}
+
+/**
+ * Where this pod describes the services it offers. The pod says so on any
+ * response about one of its resources; the well-known path is only what a
+ * pod that says nothing has always used.
+ */
+export async function storageDescriptionUrl(intake) {
+  return podNotifications.storageDescriptionUrl(intake.urls.base,
+    { headers: { 'user-agent': USER_AGENT }, timeoutMs: HTTP_TIMEOUT_MS });
+}
+
+export async function subscribeOnce(intake) {
+  // Reuse a channel we already have rather than asking for another one.
+  const saved = intake.store.read(CHANNEL_DOC, null);
+  if (saved?.receiveFrom && (!saved.endAt || Date.parse(saved.endAt) - Date.now() > 60_000)) {
+    intake._openSocket(saved.receiveFrom, true);
+    return;
+  }
+  const descUrl = await intake._storageDescriptionUrl();
+  const { channel, error } = await podNotifications.readWebSocketChannel(descUrl,
+    { headers: { 'user-agent': USER_AGENT }, timeoutMs: HTTP_TIMEOUT_MS });
+  if (!channel) { intake.wsState = 'unavailable'; intake.log(`${error} — polling only`); return; }
+  // The topic is a POD resource, and it travels in the BODY — so the url map
+  // RemotePod applies to the request line never reaches it. A fronted
+  // identity's inbox url names the front, which the pod cannot grant read on,
+  // and the subscription came back 403. A no-op when unfronted.
+  const topic = intake.urls.toPod ? intake.urls.toPod(intake.urls.inbox) : intake.urls.inbox;
+  const sub = await podNotifications.subscribeToInbox(intake.remote,
+    { channelUrl: channel, podTopicUrl: topic });
+  const body = await readCapped(sub).then(JSON.parse).catch(() => null);
+  if (!body?.receiveFrom) {
+    intake.wsState = `subscribe-failed-${sub.status}`;
+    const wait = intake._reconnectDelay();
+    intake.log(`subscription failed (${sub.status}) — retrying in ${Math.round(wait / 1000)}s (polling meanwhile)`);
+    if (!intake.stopped) {
+      intake.resubTimer = setTimeout(() => intake.subscribe().catch(e => intake.log(`resubscribe: ${e.message}`)), wait);
+      intake.resubTimer.unref?.();
+    }
+    return;
+  }
+  intake.store.write(CHANNEL_DOC, { receiveFrom: body.receiveFrom, endAt: body.endAt || null });
+  intake._openSocket(body.receiveFrom, false);
+}
+
+// The socket URL arrives in the pod's own subscription response, and it was
+// the one outbound address in the project that reached the network without
+// passing anything — safefetch guards every fetch, and `new WebSocket()` is
+// not a fetch. A pod that answered with somebody else's address had us open a
+// long-lived connection there and treat what came back as our inbox waking up.
+//
+// Same origin as the pod, not assertPublicUrl: a pod on this machine is a
+// documented setup and its socket is legitimately ws://localhost:3000, which
+// a public-address check would refuse.
+export function openSocket(intake, receiveFrom, reused) {
+  if (!sameSocketOrigin(receiveFrom, intake.urls.base)) {
+    intake.wsState = 'refused';
+    intake.log(`subscription named ${receiveFrom}, which is not this pod — polling only`);
+    if (reused) intake.store.write(CHANNEL_DOC, null);
+    return;
+  }
+  intake.ws = new WebSocket(receiveFrom);
+  intake.ws.onopen = () => {
+    intake.wsState = 'open';
+    if (!intake._announcedPush) { intake.log('inbox push subscription active'); intake._announcedPush = true; }
+    intake._openedAt = Date.now();
+    // Anything that arrived while the socket was down is waiting — sweep it,
+    // unless a sweep just ran: a flapping socket must not re-list the inbox
+    // on every open.
+    if (Date.now() - intake.lastDrainAtMs > OPEN_DRAIN_MIN_GAP_MS) {
+      intake.drain().catch(e => intake.log(`drain: ${e.message}`));
+    }
+  };
+  intake.ws.onmessage = () => intake.drain().catch(e => intake.log(`drain: ${e.message}`));
+  intake.ws.onclose = () => {
+    intake.wsState = 'closed';
+    // Only a connection that STAYED up counts as a success. Resetting on open
+    // alone meant the 2026-07-29 failure — a server that accepts the upgrade
+    // and then drops the socket on a crash cycle — reconnected at the 2s
+    // floor indefinitely: every cycle "succeeded", so the exponential cap was
+    // never reached, and each open also drained the inbox.
+    if (intake._openedAt && Date.now() - intake._openedAt >= RECONNECT_STABLE_MS) intake.reconnectTries = 0;
+    intake._openedAt = 0;
+    if (!intake.stopped) {
+      intake.resubTimer = setTimeout(() => intake.subscribe().catch(e => intake.log(`resubscribe: ${e.message}`)), intake._reconnectDelay());
+      intake.resubTimer.unref?.();
+    }
+  };
+  intake.ws.onerror = () => {
+    intake.wsState = 'error';
+    // A channel we reused may simply be gone: forget it so the next attempt
+    // asks for a fresh one instead of retrying a dead URL forever.
+    if (reused) intake.store.write(CHANNEL_DOC, null);
+  };
+}

package/lib/core/intake/group.mjs

@@ -0,0 +1,222 @@
+// group.mjs — what a group actor does with what arrives (FEP-1b12): carries a
+// member's post to the membership, knows who its co-members are, and queues a
+// listed moderator's ask for the operator rather than running it.
+
+import { trimActivity, MAX_MODQUEUE, MAX_PENDING_REVIEW, CO_MEMBER_TTL_MS, CO_MEMBER_MAX } from './activity.mjs';
+
+// Which inbound activities count as a moderator's ask: a ban, an unban, a
+// post removal, or a roster change naming OUR moderators collection. A
+// moderator's ordinary traffic (their posts, likes, follows) is not
+// moderation and takes the normal arms.
+export function isModerationAsk(intake, activity) {
+  if (activity.type === 'Block') return true;
+  if (activity.type === 'Undo') {
+    return typeof activity.object === 'object' && activity.object?.type === 'Block';
+  }
+  if (activity.type === 'Delete') {
+    const id = typeof activity.object === 'string' ? activity.object : activity.object?.id;
+    const s = id && intake.store.getStatuses().find(x => x.noteId === id);
+    // Only a post the group holds and did not author — removing those is
+    // moderation; everything else is the author's own Delete.
+    return !!s && s.kind !== 'post';
+  }
+  if (activity.type === 'Add' || activity.type === 'Remove') {
+    const target = typeof activity.target === 'string' ? activity.target : activity.target?.id;
+    return target === intake.urls.moderators;
+  }
+  return false;
+}
+
+// Held, not run: one entry per distinct ask, capped, waiting for the
+// operator to apply or dismiss it (social.applyModeration).
+// A moderator's WORD, not their proof. `actor` is a field in an unsigned
+// body and a moderator's URL is public, so anyone can claim to be one — which
+// is exactly why these are QUEUED for the operator rather than run. What was
+// missing is that the queue did not say which is which, and a stranger could
+// fill all 200 slots and push the real asks out.
+//
+// So: the entry records whether the door vouched for the sender, and when the
+// queue is full the UNVERIFIED entries are what get dropped. A real
+// moderator's ask cannot be crowded out by someone impersonating them.
+export function queueModeration(intake, activity, actor, { trusted = false } = {}) {
+  const q = intake.store.read('modqueue.json', []);
+  const objectId = typeof activity.object === 'string' ? activity.object : activity.object?.id;
+  const key = [activity.type, actor, objectId || JSON.stringify(activity.object || null)].join(' ');
+  const seen = q.find(e => e.key === key);
+  if (seen) {
+    // The same ask arriving verified is worth more than the copy we hold.
+    if (trusted && !seen.verified) {
+      seen.verified = true;
+      intake.store.write('modqueue.json', q);
+    }
+    return;
+  }
+  q.unshift({
+    key, id: (intake.serial++).toString(36) + '-' + q.length,
+    type: activity.type, moderator: actor, activity: trimActivity(activity),
+    verified: !!trusted, at: new Date().toISOString(),
+  });
+  let kept = q;
+  if (kept.length > MAX_MODQUEUE) {
+    const verified = kept.filter(e => e.verified);
+    const rest = kept.filter(e => !e.verified);
+    // Verified first, then the newest unverified up to the cap.
+    kept = [...verified, ...rest].slice(0, MAX_MODQUEUE);
+  }
+  intake.store.write('modqueue.json', kept);
+  intake.log(`moderation queued from ${actor}${trusted ? '' : ' (unverified)'}: ${activity.type} ${objectId || ''}`);
+}
+
+// Anyone can Append to a public inbox, so arriving is not the same as being
+// carried to every follower. Membership is the gate: you cannot post to a
+// group you have not joined, and declining to carry a member is the only
+// moderation a group can actually enforce.
+export async function amplify(intake, noteId, { approved = false, activity = null } = {}) {
+  const s = intake.store.getStatuses().find(x => x.noteId === noteId);
+  if (!s) return;
+  if (s.announcedAt) return;                      // a re-delivered Create announces once
+  // A DM to the group, or a followers-only post it happened to receive, was
+  // addressed to less than the world — carrying it would widen the author's
+  // audience for them. A group only ever amplifies public posts.
+  if (s.direct || s.nonPublic) {
+    intake.log(`not amplified — ${noteId} was not addressed publicly, and a group never widens a post's audience`);
+    return;
+  }
+  const contacts = intake.store.getContacts();
+  if (!contacts.followers.some(f => f.actor === s.actor)) {
+    intake.log(`not amplified — ${s.actor} is not a member`);
+    return;
+  }
+  if (intake.store.getMuted().actors.includes(s.actor)) {
+    intake.log(`not amplified — ${s.actor} is muted`);
+    return;
+  }
+  // A reviewed group carries nothing until its operator says so.
+  if (intake.config.review && !approved) {
+    const pending = intake.store.getPending();
+    if (!pending.some(p => p.noteId === noteId)) {
+      // Full means refuse the new one, not evict the oldest. `slice(0, 500)`
+      // dropped from the tail, so one member posting 500 notes silently
+      // discarded everything the operator was still deciding about — the
+      // posts were never carried, never refused, and left no record that they
+      // had ever arrived. Becoming a member costs one Follow when joins are
+      // unmoderated, which is the default.
+      //
+      // Not carrying it is what a reviewed group does with anything it has
+      // not approved, so refusing is the same outcome the queue was for.
+      if (pending.length >= MAX_PENDING_REVIEW) {
+        intake.log(`review queue is full (${MAX_PENDING_REVIEW}) — ${noteId} not held. `
+          + 'Approve or decline what is waiting and it will be carried on redelivery.');
+        return;
+      }
+      // The activity rides along: approving later still has to wrap the one
+      // the member actually sent, not a reconstruction of it.
+      pending.unshift({ noteId, actor: s.actor, activity, at: new Date().toISOString() });
+      intake.store.setPending(pending);
+    }
+    intake.log(`held for review: ${noteId}`);
+    return;
+  }
+  // A member's Bluesky post: the carry is a native repost by the group's
+  // account. It reaches AP followers only through the author's own bridge —
+  // the group never fabricates an AP object for someone else's words.
+  if (s.kind === 'bsky') {
+    if (!intake.bskyGroup) { intake.log(`not amplified — ${noteId} is a bluesky post and no account is connected`); return; }
+    return intake.bskyGroup.carry(s);
+  }
+  const held = intake.store.getPending().find(p => p.noteId === noteId);
+  const inboxes = intake.announceTargets(s.actor);
+  const { announceActivity } = await import('../wire.mjs');
+  // Wrap the member's own activity when we have it; a bare note URL is the
+  // fallback, and renders as a plain boost rather than a group carry. The
+  // group names itself as the audience (FEP-1b12).
+  //
+  // `activity` is the envelope as DELIVERED — a document the sender wrote,
+  // which the group would otherwise re-sign and hand to every follower with
+  // whatever addressing, tags and object body it carried. Only the note id was
+  // ever verified (ingestNote fetched it from the author's origin and checked
+  // the attribution), so only the note id is safe to pass on: send the bare
+  // id unless the wrapper's own object id agrees with what we verified.
+  const wrapperObject = (a) => {
+    const inner = a?.object;
+    const id = typeof inner === 'string' ? inner : inner?.id;
+    return id === noteId ? a : null;
+  };
+  const act = announceActivity({
+    urls: intake.urls,
+    object: wrapperObject(activity) || wrapperObject(held?.activity) || noteId,
+    serial: intake.serial++,
+    audience: intake.urls.actor,
+  });
+  await intake.deliverer.deliverToAll(inboxes, act);
+  // Marked carried before recorded: a failed outbox write costs one missing
+  // entry, a failed status write would carry the same post twice.
+  intake.store.updateStatus(noteId, { announcedAt: new Date().toISOString(), announceActivity: act });
+  await intake.publisher.recordOutbox(act);
+  intake.store.setPending(intake.store.getPending().filter(p => p.noteId !== noteId));
+  intake.log(`amplified ${noteId} → ${inboxes.length} inbox(es)`);
+  // The same carry, shown natively to the group's Bluesky followers.
+  await intake.bskyGroup?.mirrorCarry(s)
+    .catch(e => intake.log(`bluesky mirror of the carry failed: ${e.message}`));
+}
+
+// Is this actor in a group we are in? Each followed Group's membership is a
+// public collection, read at most once a day and cached — a membership list
+// is slow-moving, and this runs on arriving mail.
+export async function isCoMember(intake, actor) {
+  if (intake.config.kind === 'group') return false;      // a group has members, not peers
+  const groups = intake.store.getContacts().following
+    .filter(f => f.accepted && intake.store.getActors()[f.actor]?.type === 'Group')
+    .map(f => f.actor);
+  if (!groups.length) return false;
+  const cache = intake.store.read('comembers.json', {});
+  const fresh = Date.now() - CO_MEMBER_TTL_MS;
+  let changed = false;
+  for (const g of groups) {
+    const held = cache[g];
+    if (held && Date.parse(held.at || 0) > fresh) continue;
+    const doc = await intake.fetchAP(g).catch(() => null);
+    const list = doc?.followers ? await intake.collectionMembers(doc.followers) : null;
+    // A list we could not read keeps whatever we had: losing it would demote
+    // every co-member to a stranger for a day because one fetch failed.
+    if (!list) continue;
+    cache[g] = { at: new Date().toISOString(), members: list };
+    changed = true;
+  }
+  if (changed) intake.store.write('comembers.json', cache);
+  return groups.some(g => cache[g]?.members?.includes(actor));
+}
+
+// The actor ids in a (possibly paged) public collection, capped.
+export async function collectionMembers(intake, url) {
+  const out = [];
+  let next = url;
+  for (let page = 0; next && page < 10 && out.length < CO_MEMBER_MAX; page++) {
+    const doc = await intake.fetchAP(next).catch(() => null);
+    if (!doc) return out.length ? out : null;
+    for (const item of doc.orderedItems || doc.items || []) {
+      if (typeof item === 'string') out.push(item);
+    }
+    next = doc.first && page === 0 ? doc.first : doc.next;
+    if (typeof next === 'object') next = next?.id;
+  }
+  return out;
+}
+
+// Who an Announce for `author` goes to. Shared with the retract path: an Undo
+// that reached a different set than the Announce did would leave the post
+// standing for whoever the two sets disagreed about.
+// The author's own target is dropped only when it serves nobody else — a
+// shared inbox carries the whole server's members.
+export function announceTargets(intake, author) {
+  const byTarget = new Map();
+  for (const f of intake.store.getContacts().followers) {
+    const t = f.sharedInbox || f.inbox;
+    if (!t) continue;
+    if (!byTarget.has(t)) byTarget.set(t, new Set());
+    byTarget.get(t).add(f.actor);
+  }
+  return [...byTarget]
+    .filter(([, who]) => !(who.size === 1 && who.has(author)))
+    .map(([t]) => t);
+}