fedipod-server 0.21.0 → 0.28.0

package/lib/core/wire.mjs

@@ -3,6 +3,10 @@
 // protocol documents, not our RDF.
 
 export const AS_CTX = 'https://www.w3.org/ns/activitystreams';
+// Lemmy's own context, held locally (lib/core/contexts/join-lemmy.json). It
+// names the three terms a Lemmy reader looks for on a community and its
+// posts: postingRestrictedToMods, stickied, commentsEnabled.
+export const LEMMY_CTX = 'https://join-lemmy.org/context.json';
 export const SEC_CTX = 'https://w3id.org/security/v1';
 export const PUBLIC = 'https://www.w3.org/ns/activitystreams#Public';
 
@@ -80,7 +84,8 @@ export const assertionKeyId = (urls) => urls.actor + '#ed25519-key';
 export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null, movedTo = null, kind = 'person',
   approveJoins = false, summary = null, icon = null, image = null, fields = [],
   webId = null, aliases = [], moderators = null, pendingFollowers = null, pendingFollowing = null,
-  blocked = null, inbox = null, outbox = null, oauthAuthorize = null, oauthToken = null }) {
+  blocked = null, inbox = null, outbox = null, oauthAuthorize = null, oauthToken = null,
+  postingRestrictedToMods = null }) {
   // manuallyApprovesFollowers is NOT in the base AS2 context, so it is declared
   // inline exactly as Mastodon declares it — and only when we actually use it.
   // It is what makes a client show "Request to follow" rather than "Follow" and
@@ -118,13 +123,18 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
   // old accounts elsewhere whose servers check for their own URL here before
   // they will send a Move. Declared inline exactly as Mastodon declares it.
   if (webId || aliases.length) context.push({ alsoKnownAs: { '@id': 'as:alsoKnownAs', '@type': '@id' } });
+  // A community says whether only its moderators may open posts in it, in
+  // Lemmy's term, declared through Lemmy's context. Groups only.
+  if (kind === 'group' && postingRestrictedToMods !== null) context.push(LEMMY_CTX);
   if (fields.length) {
     context.push({ schema: 'http://schema.org#', PropertyValue: 'schema:PropertyValue', value: 'schema:value' });
   }
   return {
     '@context': context,
     id: urls.actor,
-    type: kind === 'group' ? 'Group' : 'Person',
+    // A group is a community; an application is a service that speaks for a
+    // site rather than a person — the actor a forum publishes for itself.
+    type: kind === 'group' ? 'Group' : kind === 'application' ? 'Application' : 'Person',
     ...(approveJoins ? { manuallyApprovesFollowers: true } : {}),
     ...(assertionKey ? { assertionMethod: [{
       id: assertionKeyId(urls), type: 'Multikey', controller: urls.actor,
@@ -132,6 +142,7 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
     }] } : {}),
     ...(movedTo ? { movedTo } : {}),
     ...(webId || aliases.length ? { alsoKnownAs: [...(webId ? [webId] : []), ...aliases] } : {}),
+    ...(kind === 'group' && postingRestrictedToMods !== null ? { postingRestrictedToMods: !!postingRestrictedToMods } : {}),
     preferredUsername: handle,
     name: name || handle,
     // The bio, and the avatar. For a group, `summary` is where what the group
@@ -196,102 +207,7 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
 // the actor document. It says who this is and how to follow — the handle to
 // paste, and the remote-follow control that hands the visitor to their own
 // server's follow screen.
-// `fields` are the profile's name/value rows, `joined` an ISO date, `pinned`
-// the pinned posts as { content (sanitized HTML), published, url }.
-export function profilePageHtml({ name, address, summary = null, icon = null, image = null,
-  fields = [], joined = null, pinned = [], kind = 'person' }) {
-  const esc = (s) => String(s ?? '').replace(/[&<>"]/g, c => ({ ...HTML_ESCAPES, '"': '&quot;' }[c]));
-  const what = kind === 'group' ? 'a group' : 'an account';
-  const month = (iso) => {
-    const d = new Date(iso);
-    return Number.isNaN(d.getTime()) ? null
-      : d.toLocaleDateString('en', { month: 'long', year: 'numeric', timeZone: 'UTC' });
-  };
-  const day = (iso) => {
-    const d = new Date(iso);
-    return Number.isNaN(d.getTime()) ? '' : d.toISOString().slice(0, 10);
-  };
-  const fieldRows = fields.filter(f => f?.name && f?.value !== undefined && f?.value !== null && String(f.value) !== '');
-  const joinedText = joined ? month(joined) : null;
-  const pins = pinned.filter(x => x && typeof x.content === 'string');
-  return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${esc(name)} (${esc(address)})</title>
-<style>
-:root { color-scheme: light dark; }
-body { font: 112.5%/1.5 system-ui, sans-serif; max-width: 34rem; margin: 3rem auto; padding: 0 1rem; }
-img.header { width: 100%; max-height: 12rem; object-fit: cover; border-radius: 1rem; }
-img.avatar { width: 6rem; height: 6rem; border-radius: 1rem; object-fit: cover; margin-top: 1rem; }
-h1 { margin: .5rem 0 0; }
-.address { font-size: 1.1rem; user-select: all; }
-dl.fields { display: grid; grid-template-columns: max-content 1fr; gap: .4rem 1rem; margin: 1.5rem 0; }
-dl.fields dt { font-weight: 600; }
-dl.fields dd { margin: 0; overflow-wrap: anywhere; }
-.joined { margin: 1rem 0; }
-section.pinned h2 { font-size: 1.1rem; margin: 2rem 0 .5rem; }
-article.pin { border: 1px solid #8884; border-radius: 1rem; padding: 1rem 1.2rem; margin: 1rem 0; }
-article.pin p:last-child { margin-bottom: 0; }
-article.pin .when { font-size: 1rem; }
-form { margin-top: 2rem; }
-label { display: block; margin-bottom: .3rem; }
-input { font: inherit; padding: .5rem; width: 14rem; max-width: 100%; }
-button { font: inherit; padding: .5rem 1rem; }
-.hint { color: #666; font-size: 1rem; }
-.err { color: #b00020; }
-.err:empty { display: none; }
-@media (prefers-color-scheme: dark) {
-  .hint { color: #aaa; }
-  .err { color: #ff8a80; }
-}
-</style>
-</head>
-<body>
-<main>
-${image ? `<img class="header" src="${esc(image)}" alt="">` : ''}
-${icon ? `<img class="avatar" src="${esc(icon)}" alt="">` : ''}
-<h1>${esc(name)}</h1>
-<p class="address">${esc(address)}</p>
-${summary ? `<div>${summary}</div>` : ''}
-${fieldRows.length ? `<dl class="fields">
-${fieldRows.map(f => `<dt>${esc(f.name)}</dt><dd>${esc(f.value)}</dd>`).join('\n')}
-</dl>` : ''}
-${joinedText ? `<p class="joined">Joined ${esc(joinedText)}</p>` : ''}
-${pins.length ? `<section class="pinned">
-<h2>Pinned</h2>
-${pins.map(x => `<article class="pin">
-${x.content}
-<p class="when">${x.url ? `<a href="${esc(x.url)}">${esc(day(x.published))}</a>` : esc(day(x.published))}</p>
-</article>`).join('\n')}
-</section>` : ''}
-<p>This is ${what} on the Fediverse. To follow it, paste the address above
-into the search box of Mastodon or any Fediverse app — or use the form.</p>
-<form id="follow">
-  <label for="server">your server</label>
-  <input id="server" type="text" placeholder="mastodon.social" autocomplete="off"
-    required aria-describedby="follow-err">
-  <button type="submit">Follow</button>
-  <p class="err" id="follow-err" role="alert"></p>
-</form>
-<p class="hint">The form sends you to your own server's follow screen.</p>
-</main>
-<script>
-document.getElementById('follow').addEventListener('submit', (ev) => {
-  ev.preventDefault();
-  const s = document.getElementById('server').value.trim().replace(/^https?:\\/\\//, '').replace(/\\/.*$/, '');
-  const err = document.getElementById('follow-err');
-  const addr = document.querySelector('.address').textContent.trim();
-  if (!s) { err.textContent = 'Enter your server, e.g. mastodon.social'; return; }
-  err.textContent = '';
-  location.href = 'https://' + s + '/authorize_interaction?uri=' + encodeURIComponent(addr);
-});
-</script>
-</body>
-</html>
-`;
-}
+export { profilePageHtml } from './profile-page.mjs';
 
 // Retirement. An abandoned pod keeps accepting deliveries into a container
 // nobody will ever drain, and no remote server has any way to learn that. A
@@ -692,18 +608,47 @@ export function addressing(urls, visibility, who = []) {
   }[visibility] || { to: [PUBLIC], cc: [urls.followers, ...who] };
 }
 
+// The quote terms, declared exactly as Mastodon declares them on a post:
+// FEP-044f's `quote` and `quoteAuthorization`, and the two older spellings
+// (Fedibird's quoteUri, Misskey's _misskey_quote) that older servers read.
+export const QUOTE_CTX = {
+  quote: { '@id': 'https://w3id.org/fep/044f#quote', '@type': '@id' },
+  quoteUri: { '@id': 'http://fedibird.com/ns#quoteUri', '@type': '@id' },
+  _misskey_quote: { '@id': 'https://misskey-hub.net/ns#_misskey_quote', '@type': '@id' },
+  quoteAuthorization: { '@id': 'https://w3id.org/fep/044f#quoteAuthorization', '@type': '@id' },
+};
+// The interaction policy terms, GoToSocial's, declared as Mastodon declares them.
+export const POLICY_CTX = {
+  gts: 'https://gotosocial.org/ns#',
+  interactionPolicy: { '@id': 'gts:interactionPolicy', '@type': '@id' },
+  canQuote: { '@id': 'gts:canQuote', '@type': '@id' },
+  automaticApproval: { '@id': 'gts:automaticApproval', '@type': '@id' },
+  manualApproval: { '@id': 'gts:manualApproval', '@type': '@id' },
+};
+
+// Who may quote a post: anyone, for a post the world can read; nobody, for a
+// followers-only or direct one. Said on every note, because a server that
+// finds no policy offers no quote button.
+export function quotePolicy(visibility) {
+  const open = visibility === 'public' || visibility === 'unlisted';
+  return { canQuote: { automaticApproval: open ? [PUBLIC] : [], manualApproval: [] } };
+}
+
 // `also`: actors addressed without being mentioned — the parent's author on
 // a reply. In cc but not in tag, so their server receives the post and does
 // not notify them. A direct post names its audience in the text alone.
+// `quote`: the post this one quotes, `{ id, authorization }` — the
+// authorization is the quoted author's QuoteAuthorization, once granted.
 export function noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions = [],
-  visibility = 'public', summary = null, sensitive = false, updated = null, container = null, also = [] }) {
+  visibility = 'public', summary = null, sensitive = false, updated = null, container = null, also = [],
+  quote = null }) {
   const id = (container || urls.notes) + slug;
   const who = mentions.map(m => m.actor);
   const extra = visibility === 'direct' ? [] : also.filter(a => a && !who.includes(a));
   const addressed = addressing(urls, visibility, [...who, ...extra]);
   const hashtags = hashtagsIn(content).map(name => ({ name, href: tagHref(urls, name) }));
   const note = {
-    '@context': AS_CTX,
+    '@context': [AS_CTX, { ...POLICY_CTX, ...(quote?.id ? QUOTE_CTX : {}) }],
     id, type: 'Note',
     attributedTo: urls.actor,
     content: contentHtml(content, mentions, hashtags),
@@ -711,7 +656,15 @@ export function noteDoc({ urls, slug, content, published, inReplyTo, attachments
     to: addressed.to,
     cc: addressed.cc,
     replies: repliesId(id),
+    interactionPolicy: quotePolicy(visibility),
   };
+  if (quote?.id) {
+    // All three spellings name the same post, as Mastodon writes them.
+    note.quote = quote.id;
+    note.quoteUri = quote.id;
+    note._misskey_quote = quote.id;
+    if (quote.authorization) note.quoteAuthorization = quote.authorization;
+  }
   if (summary) note.summary = summary;      // the content warning
   // A content warning is what a receiver hides behind; media marked
   // sensitive without one is hidden the same way.
@@ -759,7 +712,7 @@ export function questionDoc({ options = [], multiple = false, endTime = null,
   if (endTime) question.endTime = endTime;
   if (closed) question.closed = closed;
   if (votersCount !== null && votersCount !== undefined) {
-    question['@context'] = [AS_CTX, {
+    question['@context'] = [...[].concat(note['@context']), {
       toot: 'http://joinmastodon.org/ns#',
       votersCount: {
         '@id': 'toot:votersCount',
@@ -875,10 +828,13 @@ export function updateActorActivity({ urls, actor, serial, published = new Date(
 // An edit: same Note id, `updated` stamped, so receivers replace their copy
 // and show it as edited. The activity id carries the stamp — each edit is a
 // new activity, and a replay of an old one is already seen.
-export function updateActivity(note, urls) {
+// `serial` names the activity when the note is not being edited — a quote
+// authorization arriving on it changes what the note says about its quote,
+// not what it says.
+export function updateActivity(note, urls, { serial = null } = {}) {
   return {
     '@context': AS_CTX,
-    id: note.id + '#update-' + String(note.updated || '').replace(/[^0-9TZ]/g, ''),
+    id: note.id + '#update-' + (note.updated ? String(note.updated).replace(/[^0-9TZ]/g, '') : 'q' + (serial ?? Date.now())),
     type: 'Update',
     actor: urls.actor,
     to: note.to, cc: note.cc,

package/lib/device/admin/routes/lifecycle.mjs

@@ -14,6 +14,15 @@ export async function post(p, body, ctx, req, res) {   // eslint-disable-line no
     // lease exists to keep to a single agent. A viewer must claim it first
     // and give up if it cannot — the facade has refused viewer writes since
     // multi-device landed, and these two were simply missed.
+    // The account back in this agent's hands. A viewer publishes nothing and
+    // drains nothing, so a lease left behind by something that is gone leaves
+    // the account silent with nothing in the interface to say so.
+    case '/takeover': {
+      if (!await agent.requestTakeover?.()) {
+        return json(res, 503, { error: 'the lease could not be taken — the pod refused the write' });
+      }
+      return json(res, 200, { ok: true, mode: agent.status().mode });
+    }
     case '/drain': {
       if (!await agent.requestTakeover?.()) {
         return json(res, 503, { error: 'another agent is active for this pod — it is doing the draining' });

package/lib/device/admin/static.mjs

@@ -52,7 +52,10 @@ const UI_DIR = path.join(projectRoot, 'ui');       // extra client dists: ui/<na
 // One surface, /admin/, with setup as its first section: /admin/setup/ is the
 // first run, /admin/ is the record, and there is room for the rest.
 const WEB_DIR = path.join(projectRoot, 'web');
-const WEB_MOUNTS = ['admin'];
+// `icons` alongside `admin`: the favicons the agent's own pages name. One
+// file each, no authority behind them, and the same jail as everything else
+// under web/.
+const WEB_MOUNTS = ['admin', 'icons'];
 export const webMount = (pathname) => {
   const seg = decodeURIComponent(pathname).replace(/^\/+/, '').split('/')[0];
   return WEB_MOUNTS.includes(seg) ? seg : null;

package/lib/device/admin/surface.mjs

@@ -6,6 +6,8 @@
 // served off disk, and the dispatch to the routes modules beside it. Each of
 // those exports get() and post() over the same ctx.
 
+import fs from 'node:fs';
+import path from 'node:path';
 import { MastoApi } from '../../client/masto/index.mjs';
 import { C2S } from '../../client/c2s.mjs';
 import { makeC2sAuth } from '../../client/oidc-auth.mjs';
@@ -75,15 +77,27 @@ const ROUTES = [owner, setup, lifecycle, gateway, social, connections];
 // meaning inside a server that is not one — and moves the gate: a pod that is
 // a fediverse instance must let strangers reach /api and /oauth, so the gate
 // guards the operator's door (basePath) instead of the whole surface.
+const SESSION_FILES = {
+  '/oauth/session/signin.mjs': 'web/admin/oauth-signin.mjs',
+  '/oauth/session/fedi-login.mjs': 'lib/session/fedi-login.mjs',
+  '/oauth/session/oidc-session.mjs': 'lib/session/oidc-session.mjs',
+};
+
 export function buildAdminSurface({ agent, gate, allowed, log = console.log,
   port = null, handle = null, embedded = false, basePath = '/', mount = '',
   publicOrigin = null, scheme = null,
   versionOnDisk = () => localVersion(projectRoot) }) {
   const json = (res, status, obj) => sendJson(res, status, obj, allowed);
-  const masto = new MastoApi({ agent, log, allowed, scheme, embedded, mount });
+  const masto = new MastoApi({ agent, log, allowed, scheme, embedded, mount,
+    throughDoor: (req) => Boolean(gate?.upgradeOk?.(req)) });
+  // A client's sign-in can be proved with the owner's pod sign-in instead of a
+  // password: the same verification the post door uses, and the owner it names.
+  masto.podAuth = makeC2sAuth({ agent, log, scheme, mount });
+  masto.ownerWebId = () => agent.remote?.webId || null;
   // The spec's own write API (§6), beside the facade. Its bearer fallback is
   // the facade's token, so the two surfaces share one notion of the operator.
-  const c2s = new C2S({ agent, log, auth: makeC2sAuth({ agent, masto, log, scheme, mount }) });
+  const c2s = new C2S({ agent, log, scheme, mount,
+    auth: makeC2sAuth({ agent, masto, log, scheme, mount }) });
   const streaming = new Streaming({ masto, log, allowed, gate, gateOptional: embedded });
   // Asked per request, not once here: startAdmin runs before connect, so the
   // kind is not known yet at mount time.
@@ -171,6 +185,16 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
       if (p === '/ap/outbox' || p === '/ap/actor' || p === '/ap/inbox') {
         if (await c2s.handle(req, res, p, url)) return;
       }
+      // The sign-in page's script and the library it signs in with, outside
+      // the door like the sign-in itself. A fixed list; nothing in the request
+      // names a file.
+      const sessionFile = SESSION_FILES[p];
+      if (sessionFile) {
+        let body;
+        try { body = fs.readFileSync(path.join(projectRoot, sessionFile)); } catch { return json(res, 404, { error: 'not here' }); }
+        res.writeHead(200, { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'no-cache' });
+        res.end(body); return;
+      }
       // Where a client looks first to find out how to sign in (RFC 8414), and
       // in front of the door for the same reason C2S is: a client that has to
       // be handed a secret before it can ask how to sign in cannot set itself

package/lib/device/certs.mjs

@@ -71,7 +71,16 @@ function nameConstraintsExtension() {
   return { id: '2.5.29.30', critical: true, value: der.getBytes() };
 }
 
-function makeCert({ subjectCN, issuer = null, issuerKeyPem = null, isCA = false, days, extraDns = [] }) {
+// The issuer's own key identifier, for the certificate it signs to name. A
+// verifier that finds several CAs under one name — this machine's browser
+// store has held dozens of "FediPod Local CA" from scratch agents — picks by
+// this, and without it picks by name, tries the wrong key and fails.
+const issuerKeyId = (issuerCertPem) => {
+  const ext = forge.pki.certificateFromPem(issuerCertPem).getExtension('subjectKeyIdentifier');
+  return ext?.subjectKeyIdentifier ? forge.util.hexToBytes(ext.subjectKeyIdentifier) : null;
+};
+
+function makeCert({ subjectCN, issuer = null, issuerKeyPem = null, issuerCertPem = null, isCA = false, days, extraDns = [] }) {
   const keys = forge.pki.rsa.generateKeyPair({ bits: 2048 });
   const cert = forge.pki.createCertificate();
   cert.publicKey = keys.publicKey;
@@ -89,6 +98,9 @@ function makeCert({ subjectCN, issuer = null, issuerKeyPem = null, isCA = false,
     : [{ name: 'basicConstraints', cA: false },
        { name: 'keyUsage', digitalSignature: true, keyEncipherment: true },
        { name: 'extKeyUsage', serverAuth: true },
+       { name: 'subjectKeyIdentifier' },
+       ...(issuerCertPem && issuerKeyId(issuerCertPem)
+         ? [{ name: 'authorityKeyIdentifier', keyIdentifier: issuerKeyId(issuerCertPem) }] : []),
        { name: 'subjectAltName',
          altNames: [...SANS, ...extraDns.map(v => ({ type: 2, value: v }))] }]);
   const signingKey = issuerKeyPem ? forge.pki.privateKeyFromPem(issuerKeyPem) : keys.privateKey;
@@ -131,6 +143,7 @@ export function ensureLocalTls(dir, { log = () => {}, names = [] } = {}) {
   const trust = !!(caKey && caCert);
   const isStale = (k, c) => !k || !c || daysLeft(c) < REMINT_DAYS || !coversLocalhost(c)
     || (trust && !issuedBy(c, caCert))
+    || (trust && !namesIssuerKey(c))
     || names.some(n => !certDnsNames(c).includes(n));
   let key = readPem(dir, FILES.key);
   let cert = readPem(dir, FILES.cert);
@@ -165,7 +178,7 @@ export function ensureLocalTls(dir, { log = () => {}, names = [] } = {}) {
         .filter(n => n !== 'localhost' && n !== '*.localhost');
       const minted = makeCert({
         subjectCN: 'localhost',
-        ...(trust ? { issuer: caSubject(caCert), issuerKeyPem: caKey } : {}),
+        ...(trust ? { issuer: caSubject(caCert), issuerKeyPem: caKey, issuerCertPem: caCert } : {}),
         days: LEAF_DAYS,
         extraDns: carried,
       });
@@ -181,6 +194,9 @@ export function ensureLocalTls(dir, { log = () => {}, names = [] } = {}) {
   return { key, cert, trust, dir, expiresInDays: Math.floor(daysLeft(cert)) };
 }
 
+const namesIssuerKey = (certPem) => {
+  try { return !!forge.pki.certificateFromPem(certPem).getExtension('authorityKeyIdentifier'); } catch { return false; }
+};
 const caSubject = (caCertPem) => forge.pki.certificateFromPem(caCertPem).subject.attributes
   .map(a => ({ name: a.name, value: a.value }));
 const issuedBy = (certPem, caCertPem) => {

package/lib/device/cli/commands/setup.mjs

@@ -52,8 +52,12 @@ if (!newAccount) {
   const { resourceExists } = await import(new URL('../../../../lib/pod/root.mjs', import.meta.url));
   const { apUrls, DEFAULT_ROOT: DR } = await import(new URL('../../../../lib/core/wire.mjs', import.meta.url));
   if (await resourceExists(fetch, apUrls(pod, DR).actor)) {
-    console.error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
-    process.exit(2);
+    if (String(flag('address') || 'pod').toLowerCase() !== 'front') {
+      console.error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
+      console.error('To move an account whose address is at another gateway to this one, add --address front.');
+      process.exit(2);
+    }
+    console.log('The pod already holds an account; if its address is at another gateway, setup moves it here.');
   }
 }
 

package/lib/device/cli/commands/state.mjs

@@ -289,7 +289,9 @@ for (const { name, dir } of homes) {
   // The kind lives in pod state, so it is only knowable from the live probe —
   // a stopped identity honestly shows nothing rather than a guess.
   rows.push({ name, pod: pod ? new URL(pod).host : '(no credential)', port: port || '—',
-    kind: live?.kind === 'group' ? 'group' : live ? 'person' : '—',
+    // A home can hold a forum, which says so itself; anything else that
+    // answers is a person unless it says group.
+    kind: live?.kind === 'group' ? 'group' : live?.kind === 'forum' ? 'forum' : live ? 'person' : '—',
     state: live ? `${live.mode}${live.podRequests ? ` · ${live.podRequests.perMinuteNow}/min` : ''}` : 'not running' });
 }
 

package/lib/device/gateway-move.mjs

@@ -0,0 +1,58 @@
+// gateway-move.mjs — the second half of a DeviceAgent moving an address from
+// one gateway to another (lib/device/setup.mjs does the first, when a pod
+// that already holds an account at another gateway is set up with an address
+// at this one). The browser build has the same two halves in
+// web/app/gateway-move.mjs; this is the Node one, which signs and delivers
+// itself instead of going through a relay.
+//
+//   1. The old gateway is told the address moved (POST /api/move, proved with
+//      the pod session as attach was). From then on it serves the old actor
+//      as a moved stub — same key, old id, `movedTo` the new one.
+//   2. A Move goes to every follower, FROM the old actor, signed under the
+//      old key id: the only signature a follower's server can verify against
+//      the old actor. Same key material; only the key id differs.
+//
+// Runs when the agent starts acting, and is safe to run again: a move left
+// pending (the old gateway unreachable) is tried at the next start.
+import { Deliverer } from '../core/deliver.mjs';
+import { moveActivity } from '../core/wire.mjs';
+
+export async function completeGatewayMove(agent, { makeDeliverer = (o) => new Deliverer(o) } = {}) {
+  const cfg = agent.store.getConfig();
+  const mv = cfg?.movedFrom;
+  if (!mv || mv.completedAt) return null;
+  const log = agent.log || (() => {});
+  const newActor = agent.urls.actor;
+
+  // 1. the old gateway
+  let told;
+  try {
+    told = await agent.remote.session.fetch(`${mv.gateway}/api/move`, {
+      method: 'POST', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ handle: mv.handle, movedTo: newActor }),
+    });
+  } catch (e) { told = { status: 0, statusText: e.message }; }
+  if (told.status !== 200) {
+    log(`gateway move: ${mv.gateway} did not mark @${mv.handle} as moved (${told.status || told.statusText}) — will retry at the next start`);
+    return { told: false };
+  }
+
+  // 2. the Move, from the old address
+  const contacts = agent.store.getContacts();
+  const inboxes = [...new Set(contacts.followers.map((f) => f.sharedInbox || f.inbox).filter(Boolean))];
+  const activity = moveActivity({ actor: mv.actor }, newActor, Date.now());
+  const sender = makeDeliverer({
+    store: agent.store, rsaPrivate: agent.deliverer.rsaPrivate,
+    keyId: `${mv.actor}#main-key`, actorId: mv.actor, log, passive: true,
+  });
+  let sent = 0; let failed = 0;
+  for (const inbox of inboxes) {
+    try { await sender.deliverNow(inbox, activity); sent++; }
+    catch (e) { failed++; log(`gateway move: Move to ${inbox} failed: ${e.message}`); }
+  }
+  const done = { ...mv, completedAt: new Date().toISOString(), moveSent: sent, moveFailed: failed };
+  agent.store.setConfig({ ...agent.store.getConfig(), movedFrom: done });
+  await agent.store.flush?.();
+  log(`moved from ${mv.actor} to ${newActor}: Move sent to ${sent} inbox(es)${failed ? `, ${failed} failed` : ''}`);
+  return done;
+}

package/lib/device/migrate.mjs

@@ -27,7 +27,9 @@ export const layoutOf = (cred) => Number(cred?.layout) || 0;
 // deliberately, with `--private-root`, has said where they want it; a migration
 // that overrode that would be moving data on its own initiative.
 export function needsStateMove(cred) {
-  return !cred?.privateRoot;
+  // `stateOnPod` is a move-in from a browser account (setup.mjs): the state
+  // is on the pod because that is where the account already lives.
+  return !cred?.privateRoot && !cred?.stateOnPod;
 }
 
 export function pendingSteps(cred) {

package/lib/device/setup.mjs

@@ -21,6 +21,7 @@ import { rootOf, recordLastUsed, writeJsonAtomic } from './home.mjs';
 import { insecureUrlReason } from '../shared/safefetch.mjs';
 import { resourceExists } from '../pod/root.mjs';
 import { CURRENT_LAYOUT, isCurrent } from './migrate.mjs';
+import { completeGatewayMove } from './gateway-move.mjs';
 
 const SOLID = $rdf.Namespace('http://www.w3.org/ns/solid/terms#');
 
@@ -125,6 +126,18 @@ export function frontedAddress({ pod, shape }) {
   return pathPod || shape === 'front';
 }
 
+// The account a pod already holds, read as its owner: the config and the key
+// record in its state container. Both null when there is none, or when the
+// credential is not the owner's. Injected for tests.
+export async function readPodAccount({ home, credential, pod, root, log = () => {} }) {
+  const remote = new RemotePod(credential, { home, log });
+  await remote.warmup?.();
+  const urls = apUrls(pod, root || DEFAULT_ROOT);
+  const config = await remote.getJson(urls.state + 'config.json').catch(() => null);
+  const keys = await remote.getJson(urls.state + 'keys.json').catch(() => null);
+  return { config, keys };
+}
+
 // Take an address at a Gateway: attach the pod to it, fronted, and return the
 // gateway config bootstrap writes and connect reads. The pod session proves
 // the pod — no password reaches the Gateway. Injected for tests.
@@ -231,8 +244,13 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
   // several writes, and that pod is a server somebody runs. `state --to` moves
   // it afterwards; starting on the pod and moving later is strictly worse,
   // because the copy left behind was on the pod the whole time.
-  const privateRoot = answers.privateRoot
+  let privateRoot = answers.privateRoot
     || pathToFileURL(path.join(home, 'private')).href + '/';
+  // A pod that already holds an account at ANOTHER gateway, set up with an
+  // address at this one: not a second account but the same one moving in.
+  // Its state and key are on the pod, and stay there.
+  let movingIn = false;
+  let movedFrom = null;
   // Everything that leaves this function — notes, errors, the log — goes
   // through here. Nothing today echoes a password back, but /setup/progress is
   // polled repeatedly and would re-serve one forever if anything ever did.
@@ -266,10 +284,15 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       // reachable, and no silent 401 later on a pod whose profile is empty.
       const usable = await checkPod(pod);
       if (!usable.ok) throw new Error(usable.error);
-      if (await (deps.resourceExists || resourceExists)(deps.fetch || fetch, apUrls(pod, root || DEFAULT_ROOT).actor)) {
-        throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
+      const held = await (deps.resourceExists || resourceExists)(deps.fetch || fetch, apUrls(pod, root || DEFAULT_ROOT).actor);
+      if (held && !frontedAddress({ pod, shape })) {
+        throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod. '
+          + 'To move an account whose address is at another gateway to this one, ask for an address at this gateway.');
       }
-      skip('account', 'using the pod you already have');
+      if (held && kind === 'group') throw new Error('The pod already hosts a FediPod account, and a group cannot move between gateways.');
+      movingIn = held;
+      if (movingIn) { privateRoot = null; }
+      skip('account', movingIn ? 'the pod already holds the account — its address moves here' : 'using the pod you already have');
     }
 
     // --- credential: the point of no return, and the durability boundary ---
@@ -295,12 +318,14 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
         remotePod: pod.endsWith('/') ? pod : pod + '/',
         createdAt: new Date().toISOString(),
         ...(root ? { root } : {}),
-        ...(keys === 'pod' ? { keysMode: 'pod' } : {}),
-        // Where the private half lives. Per-machine, like keysMode.
+        ...(keys === 'pod' || movingIn ? { keysMode: 'pod' } : {}),
+        // Where the private half lives. Per-machine, like keysMode. A move-in
+        // keeps it on the pod, where the account already is, and says so.
         ...(privateRoot ? { privateRoot } : {}),
+        ...(movingIn ? { stateOnPod: true } : {}),
         // What shape this install is, so `upgrade` can tell an old one from a
         // new one without guessing from the fields.
-        ...(isCurrent({ privateRoot }) ? { layout: CURRENT_LAYOUT } : {}),
+        ...(isCurrent({ privateRoot, stateOnPod: movingIn }) ? { layout: CURRENT_LAYOUT } : {}),
       };
       fs.mkdirSync(home, { recursive: true, mode: 0o700 });
       writeJsonAtomic(credPath, rec);
@@ -316,6 +341,24 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       done('credential', credPath);
     }
 
+    // --- a move-in: the account on the pod, read with the credential just
+    // minted, has to be one whose address lives at another gateway ---
+    if (movingIn) {
+      const cred = JSON.parse(fs.readFileSync(credPath, 'utf8'));
+      const account = await (deps.readPodAccount || readPodAccount)({ home, credential: cred, pod, root: root || DEFAULT_ROOT, log });
+      if (!account?.config) throw new Error('the pod holds an account, but its record could not be read with this credential — is this account the pod\'s owner?');
+      const frontActor = account.config.gateway?.frontActor || null;
+      const gwHost = new URL(gatewayOrigin).host;
+      if (!frontActor) throw new Error('The pod already hosts a FediPod account whose address lives on the pod: nothing to move. Sign in to it instead.');
+      if (new URL(frontActor).host === gwHost) throw new Error(`The pod already hosts a FediPod account at ${gwHost}: sign in to it instead of setting up again.`);
+      if ((account.config.kind || 'person') === 'group') throw new Error('a group cannot move between gateways');
+      if (!account.keys?.rsa || account.keys.ct) {
+        throw new Error(`this account's key is still under a password from an earlier version — sign in once at ${new URL(frontActor).host} first, then set up here`);
+      }
+      movedFrom = { actor: frontActor, gateway: new URL(frontActor).origin, handle: account.config.handle, at: new Date().toISOString() };
+      log(`moving @${account.config.handle}@${new URL(frontActor).host} here, as @${handle}@${gwHost}`);
+    }
+
     // --- take an address at the Gateway, if this pod needs one or asked for
     // one --- before bootstrap, so the config it writes carries the Gateway
     // ids and the key connect mints below is stamped to the Gateway actor from
@@ -346,6 +389,17 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       if (!ready.ok) throw new Error(ready.error);
     }
     await agent.bootstrap({ handle, name: name || handle, root, kind, approveJoins, summary, icon, gateway: gatewayCfg });
+    if (movingIn && movedFrom) {
+      // The old actor becomes an alias, which is what a server checks on the
+      // new actor before it honours a Move; the Move itself is pending until
+      // the new actor is published (completeGatewayMove, below and at every
+      // start). The key stays; its stamp follows the actor.
+      const cfg = agent.store.getConfig() || {};
+      agent.store.setConfig({ ...cfg, aliases: [...new Set([...(cfg.aliases || []), movedFrom.actor])], movedFrom });
+      const keyRec = agent.store.read?.('keys.json', null);
+      if (keyRec?.mintedFor && gatewayCfg?.frontActor) agent.store.write?.('keys.json', { ...keyRec, mintedFor: gatewayCfg.frontActor });
+      await agent.store.flush();
+    }
     done('bootstrap');
 
     begin('connect');
@@ -360,6 +414,12 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
     }
     const published = await agent.publisher.publishProfile();
     await agent.store.flush();
+    if (movingIn) {
+      // Tell the old gateway and the followers. Not fatal: left pending, it
+      // is tried again when the agent next starts acting.
+      const moved = await (deps.completeGatewayMove || completeGatewayMove)(agent).catch((e) => { log(`gateway move: ${e.message}`); return null; });
+      if (moved?.completedAt) log(`Move sent from ${movedFrom.actor} to ${moved.moveSent} inbox(es)`);
+    }
     done('publish');
 
     // --- and say plainly whether the world can actually see it ---