fedipod-server 0.26.0 → 0.28.0

package/dist/handler.js

@@ -657,6 +657,9 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
             runPage: this.args.runPage || webFile('run.html'),
             runPath: this.runPath,
             adminPage: this.args.adminPage || webFile('admin.html'),
+            // The notices page renders here too, and says the server keeps none:
+            // a notices store is the Netlify front's, not this component's.
+            noticesPage: webFile('notices.html'),
             // The opt-in and roster pages load the sign-in library, and the installer
             // command is handed out with it; without these the pages render but
             // cannot be used.
@@ -667,6 +670,7 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
                 'new-account.js': webFile('new-account.js'),
                 'run.js': webFile('run.js'),
                 'admin.js': webFile('admin.js'),
+                'notices.js': webFile('notices.js'),
             },
             installScript: webFile('install.sh'),
             lookup: (h) => this.dir.lookup(h),

package/lib/core/publisher/index.mjs

@@ -106,6 +106,9 @@ export class Publisher {
       image: this.config.image || null, fields: this.config.fields || [],
       webId: this.remote.webId || null,
       aliases: this.config.aliases || [],
+      // A group says whether only its moderators may open posts (Lemmy's
+      // term); a person's actor carries nothing of the kind.
+      postingRestrictedToMods: this.config.kind === 'group' ? !!this.config.postingRestrictedToMods : null,
       moderators,
       pendingFollowers: priv ? urls.pendingFollowers : null,
       pendingFollowing: priv ? urls.pendingFollowing : null,

package/lib/core/wire.mjs

@@ -3,6 +3,10 @@
 // protocol documents, not our RDF.
 
 export const AS_CTX = 'https://www.w3.org/ns/activitystreams';
+// Lemmy's own context, held locally (lib/core/contexts/join-lemmy.json). It
+// names the three terms a Lemmy reader looks for on a community and its
+// posts: postingRestrictedToMods, stickied, commentsEnabled.
+export const LEMMY_CTX = 'https://join-lemmy.org/context.json';
 export const SEC_CTX = 'https://w3id.org/security/v1';
 export const PUBLIC = 'https://www.w3.org/ns/activitystreams#Public';
 
@@ -80,7 +84,8 @@ export const assertionKeyId = (urls) => urls.actor + '#ed25519-key';
 export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null, movedTo = null, kind = 'person',
   approveJoins = false, summary = null, icon = null, image = null, fields = [],
   webId = null, aliases = [], moderators = null, pendingFollowers = null, pendingFollowing = null,
-  blocked = null, inbox = null, outbox = null, oauthAuthorize = null, oauthToken = null }) {
+  blocked = null, inbox = null, outbox = null, oauthAuthorize = null, oauthToken = null,
+  postingRestrictedToMods = null }) {
   // manuallyApprovesFollowers is NOT in the base AS2 context, so it is declared
   // inline exactly as Mastodon declares it — and only when we actually use it.
   // It is what makes a client show "Request to follow" rather than "Follow" and
@@ -118,6 +123,9 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
   // old accounts elsewhere whose servers check for their own URL here before
   // they will send a Move. Declared inline exactly as Mastodon declares it.
   if (webId || aliases.length) context.push({ alsoKnownAs: { '@id': 'as:alsoKnownAs', '@type': '@id' } });
+  // A community says whether only its moderators may open posts in it, in
+  // Lemmy's term, declared through Lemmy's context. Groups only.
+  if (kind === 'group' && postingRestrictedToMods !== null) context.push(LEMMY_CTX);
   if (fields.length) {
     context.push({ schema: 'http://schema.org#', PropertyValue: 'schema:PropertyValue', value: 'schema:value' });
   }
@@ -134,6 +142,7 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
     }] } : {}),
     ...(movedTo ? { movedTo } : {}),
     ...(webId || aliases.length ? { alsoKnownAs: [...(webId ? [webId] : []), ...aliases] } : {}),
+    ...(kind === 'group' && postingRestrictedToMods !== null ? { postingRestrictedToMods: !!postingRestrictedToMods } : {}),
     preferredUsername: handle,
     name: name || handle,
     // The bio, and the avatar. For a group, `summary` is where what the group

package/lib/device/cli/commands/setup.mjs

@@ -52,8 +52,12 @@ if (!newAccount) {
   const { resourceExists } = await import(new URL('../../../../lib/pod/root.mjs', import.meta.url));
   const { apUrls, DEFAULT_ROOT: DR } = await import(new URL('../../../../lib/core/wire.mjs', import.meta.url));
   if (await resourceExists(fetch, apUrls(pod, DR).actor)) {
-    console.error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
-    process.exit(2);
+    if (String(flag('address') || 'pod').toLowerCase() !== 'front') {
+      console.error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
+      console.error('To move an account whose address is at another gateway to this one, add --address front.');
+      process.exit(2);
+    }
+    console.log('The pod already holds an account; if its address is at another gateway, setup moves it here.');
   }
 }
 

package/lib/device/gateway-move.mjs

@@ -0,0 +1,58 @@
+// gateway-move.mjs — the second half of a DeviceAgent moving an address from
+// one gateway to another (lib/device/setup.mjs does the first, when a pod
+// that already holds an account at another gateway is set up with an address
+// at this one). The browser build has the same two halves in
+// web/app/gateway-move.mjs; this is the Node one, which signs and delivers
+// itself instead of going through a relay.
+//
+//   1. The old gateway is told the address moved (POST /api/move, proved with
+//      the pod session as attach was). From then on it serves the old actor
+//      as a moved stub — same key, old id, `movedTo` the new one.
+//   2. A Move goes to every follower, FROM the old actor, signed under the
+//      old key id: the only signature a follower's server can verify against
+//      the old actor. Same key material; only the key id differs.
+//
+// Runs when the agent starts acting, and is safe to run again: a move left
+// pending (the old gateway unreachable) is tried at the next start.
+import { Deliverer } from '../core/deliver.mjs';
+import { moveActivity } from '../core/wire.mjs';
+
+export async function completeGatewayMove(agent, { makeDeliverer = (o) => new Deliverer(o) } = {}) {
+  const cfg = agent.store.getConfig();
+  const mv = cfg?.movedFrom;
+  if (!mv || mv.completedAt) return null;
+  const log = agent.log || (() => {});
+  const newActor = agent.urls.actor;
+
+  // 1. the old gateway
+  let told;
+  try {
+    told = await agent.remote.session.fetch(`${mv.gateway}/api/move`, {
+      method: 'POST', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ handle: mv.handle, movedTo: newActor }),
+    });
+  } catch (e) { told = { status: 0, statusText: e.message }; }
+  if (told.status !== 200) {
+    log(`gateway move: ${mv.gateway} did not mark @${mv.handle} as moved (${told.status || told.statusText}) — will retry at the next start`);
+    return { told: false };
+  }
+
+  // 2. the Move, from the old address
+  const contacts = agent.store.getContacts();
+  const inboxes = [...new Set(contacts.followers.map((f) => f.sharedInbox || f.inbox).filter(Boolean))];
+  const activity = moveActivity({ actor: mv.actor }, newActor, Date.now());
+  const sender = makeDeliverer({
+    store: agent.store, rsaPrivate: agent.deliverer.rsaPrivate,
+    keyId: `${mv.actor}#main-key`, actorId: mv.actor, log, passive: true,
+  });
+  let sent = 0; let failed = 0;
+  for (const inbox of inboxes) {
+    try { await sender.deliverNow(inbox, activity); sent++; }
+    catch (e) { failed++; log(`gateway move: Move to ${inbox} failed: ${e.message}`); }
+  }
+  const done = { ...mv, completedAt: new Date().toISOString(), moveSent: sent, moveFailed: failed };
+  agent.store.setConfig({ ...agent.store.getConfig(), movedFrom: done });
+  await agent.store.flush?.();
+  log(`moved from ${mv.actor} to ${newActor}: Move sent to ${sent} inbox(es)${failed ? `, ${failed} failed` : ''}`);
+  return done;
+}

package/lib/device/migrate.mjs

@@ -27,7 +27,9 @@ export const layoutOf = (cred) => Number(cred?.layout) || 0;
 // deliberately, with `--private-root`, has said where they want it; a migration
 // that overrode that would be moving data on its own initiative.
 export function needsStateMove(cred) {
-  return !cred?.privateRoot;
+  // `stateOnPod` is a move-in from a browser account (setup.mjs): the state
+  // is on the pod because that is where the account already lives.
+  return !cred?.privateRoot && !cred?.stateOnPod;
 }
 
 export function pendingSteps(cred) {

package/lib/device/setup.mjs

@@ -21,6 +21,7 @@ import { rootOf, recordLastUsed, writeJsonAtomic } from './home.mjs';
 import { insecureUrlReason } from '../shared/safefetch.mjs';
 import { resourceExists } from '../pod/root.mjs';
 import { CURRENT_LAYOUT, isCurrent } from './migrate.mjs';
+import { completeGatewayMove } from './gateway-move.mjs';
 
 const SOLID = $rdf.Namespace('http://www.w3.org/ns/solid/terms#');
 
@@ -125,6 +126,18 @@ export function frontedAddress({ pod, shape }) {
   return pathPod || shape === 'front';
 }
 
+// The account a pod already holds, read as its owner: the config and the key
+// record in its state container. Both null when there is none, or when the
+// credential is not the owner's. Injected for tests.
+export async function readPodAccount({ home, credential, pod, root, log = () => {} }) {
+  const remote = new RemotePod(credential, { home, log });
+  await remote.warmup?.();
+  const urls = apUrls(pod, root || DEFAULT_ROOT);
+  const config = await remote.getJson(urls.state + 'config.json').catch(() => null);
+  const keys = await remote.getJson(urls.state + 'keys.json').catch(() => null);
+  return { config, keys };
+}
+
 // Take an address at a Gateway: attach the pod to it, fronted, and return the
 // gateway config bootstrap writes and connect reads. The pod session proves
 // the pod — no password reaches the Gateway. Injected for tests.
@@ -231,8 +244,13 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
   // several writes, and that pod is a server somebody runs. `state --to` moves
   // it afterwards; starting on the pod and moving later is strictly worse,
   // because the copy left behind was on the pod the whole time.
-  const privateRoot = answers.privateRoot
+  let privateRoot = answers.privateRoot
     || pathToFileURL(path.join(home, 'private')).href + '/';
+  // A pod that already holds an account at ANOTHER gateway, set up with an
+  // address at this one: not a second account but the same one moving in.
+  // Its state and key are on the pod, and stay there.
+  let movingIn = false;
+  let movedFrom = null;
   // Everything that leaves this function — notes, errors, the log — goes
   // through here. Nothing today echoes a password back, but /setup/progress is
   // polled repeatedly and would re-serve one forever if anything ever did.
@@ -266,10 +284,15 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       // reachable, and no silent 401 later on a pod whose profile is empty.
       const usable = await checkPod(pod);
       if (!usable.ok) throw new Error(usable.error);
-      if (await (deps.resourceExists || resourceExists)(deps.fetch || fetch, apUrls(pod, root || DEFAULT_ROOT).actor)) {
-        throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
+      const held = await (deps.resourceExists || resourceExists)(deps.fetch || fetch, apUrls(pod, root || DEFAULT_ROOT).actor);
+      if (held && !frontedAddress({ pod, shape })) {
+        throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod. '
+          + 'To move an account whose address is at another gateway to this one, ask for an address at this gateway.');
       }
-      skip('account', 'using the pod you already have');
+      if (held && kind === 'group') throw new Error('The pod already hosts a FediPod account, and a group cannot move between gateways.');
+      movingIn = held;
+      if (movingIn) { privateRoot = null; }
+      skip('account', movingIn ? 'the pod already holds the account — its address moves here' : 'using the pod you already have');
     }
 
     // --- credential: the point of no return, and the durability boundary ---
@@ -295,12 +318,14 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
         remotePod: pod.endsWith('/') ? pod : pod + '/',
         createdAt: new Date().toISOString(),
         ...(root ? { root } : {}),
-        ...(keys === 'pod' ? { keysMode: 'pod' } : {}),
-        // Where the private half lives. Per-machine, like keysMode.
+        ...(keys === 'pod' || movingIn ? { keysMode: 'pod' } : {}),
+        // Where the private half lives. Per-machine, like keysMode. A move-in
+        // keeps it on the pod, where the account already is, and says so.
         ...(privateRoot ? { privateRoot } : {}),
+        ...(movingIn ? { stateOnPod: true } : {}),
         // What shape this install is, so `upgrade` can tell an old one from a
         // new one without guessing from the fields.
-        ...(isCurrent({ privateRoot }) ? { layout: CURRENT_LAYOUT } : {}),
+        ...(isCurrent({ privateRoot, stateOnPod: movingIn }) ? { layout: CURRENT_LAYOUT } : {}),
       };
       fs.mkdirSync(home, { recursive: true, mode: 0o700 });
       writeJsonAtomic(credPath, rec);
@@ -316,6 +341,24 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       done('credential', credPath);
     }
 
+    // --- a move-in: the account on the pod, read with the credential just
+    // minted, has to be one whose address lives at another gateway ---
+    if (movingIn) {
+      const cred = JSON.parse(fs.readFileSync(credPath, 'utf8'));
+      const account = await (deps.readPodAccount || readPodAccount)({ home, credential: cred, pod, root: root || DEFAULT_ROOT, log });
+      if (!account?.config) throw new Error('the pod holds an account, but its record could not be read with this credential — is this account the pod\'s owner?');
+      const frontActor = account.config.gateway?.frontActor || null;
+      const gwHost = new URL(gatewayOrigin).host;
+      if (!frontActor) throw new Error('The pod already hosts a FediPod account whose address lives on the pod: nothing to move. Sign in to it instead.');
+      if (new URL(frontActor).host === gwHost) throw new Error(`The pod already hosts a FediPod account at ${gwHost}: sign in to it instead of setting up again.`);
+      if ((account.config.kind || 'person') === 'group') throw new Error('a group cannot move between gateways');
+      if (!account.keys?.rsa || account.keys.ct) {
+        throw new Error(`this account's key is still under a password from an earlier version — sign in once at ${new URL(frontActor).host} first, then set up here`);
+      }
+      movedFrom = { actor: frontActor, gateway: new URL(frontActor).origin, handle: account.config.handle, at: new Date().toISOString() };
+      log(`moving @${account.config.handle}@${new URL(frontActor).host} here, as @${handle}@${gwHost}`);
+    }
+
     // --- take an address at the Gateway, if this pod needs one or asked for
     // one --- before bootstrap, so the config it writes carries the Gateway
     // ids and the key connect mints below is stamped to the Gateway actor from
@@ -346,6 +389,17 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       if (!ready.ok) throw new Error(ready.error);
     }
     await agent.bootstrap({ handle, name: name || handle, root, kind, approveJoins, summary, icon, gateway: gatewayCfg });
+    if (movingIn && movedFrom) {
+      // The old actor becomes an alias, which is what a server checks on the
+      // new actor before it honours a Move; the Move itself is pending until
+      // the new actor is published (completeGatewayMove, below and at every
+      // start). The key stays; its stamp follows the actor.
+      const cfg = agent.store.getConfig() || {};
+      agent.store.setConfig({ ...cfg, aliases: [...new Set([...(cfg.aliases || []), movedFrom.actor])], movedFrom });
+      const keyRec = agent.store.read?.('keys.json', null);
+      if (keyRec?.mintedFor && gatewayCfg?.frontActor) agent.store.write?.('keys.json', { ...keyRec, mintedFor: gatewayCfg.frontActor });
+      await agent.store.flush();
+    }
     done('bootstrap');
 
     begin('connect');
@@ -360,6 +414,12 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
     }
     const published = await agent.publisher.publishProfile();
     await agent.store.flush();
+    if (movingIn) {
+      // Tell the old gateway and the followers. Not fatal: left pending, it
+      // is tried again when the agent next starts acting.
+      const moved = await (deps.completeGatewayMove || completeGatewayMove)(agent).catch((e) => { log(`gateway move: ${e.message}`); return null; });
+      if (moved?.completedAt) log(`Move sent from ${movedFrom.actor} to ${moved.moveSent} inbox(es)`);
+    }
     done('publish');
 
     // --- and say plainly whether the world can actually see it ---

package/lib/gateway/front-core.mjs

@@ -21,6 +21,8 @@ import { readCapped, safeFetch, isLoopbackHost } from '../shared/safefetch.mjs';
 import * as podRoot from '../pod/root.mjs';
 import * as podPolicy from '../pod/policy.mjs';
 import { podBaseOfWebId } from '../pod/urls.mjs';
+import { routeQuietApi, noteOpened, noteReceived, closedState, accountState, closedAnswer } from './quiet.mjs';
+import { routeNoticesApi } from './notices.mjs';
 
 // The one WebFinger document, spelled out here rather than imported from
 // wire.mjs: wire drags the agent's whole HTML pipeline (sanitize-html and
@@ -150,6 +152,19 @@ const RELAY_HEADERS = new Set(['date', 'digest', 'signature', 'content-type', 'a
 
 const keyIdOf = (signature) => (/keyId="([^"]+)"/.exec(signature || '') || [])[1] || null;
 
+// The owner's APIs a browser at ANOTHER origin may call: an address moving
+// to a new gateway is driven from the new gateway's page, and it has to tell
+// this one it moved and send the Move through this one's relay. Both take a
+// pod token as proof, the way the outbox door does, so any origin may ask.
+const API_CORS = {
+  'access-control-allow-origin': '*',
+  'access-control-allow-methods': 'POST, OPTIONS',
+  'access-control-allow-headers': 'Authorization, DPoP, Content-Type',
+  'access-control-max-age': '86400',
+};
+const withApiCors = (out) => ({ ...out, headers: { ...(out.headers || {}), ...API_CORS } });
+const apiPreflight = () => ({ status: 204, headers: { ...API_CORS, allow: 'POST, OPTIONS' }, body: null });
+
 async function relayOne(item, rec, fetchImpl) {
   const url = String(item?.url || '');
   const method = String(item?.method || 'POST').toUpperCase();
@@ -263,7 +278,7 @@ const sameOriginRequest = (request, origin) => {
 
 // Top-level paths a handle may not take, so a name never shadows a route.
 const RESERVED = new Set(['u', 'api', 'signup', 'new-account', 'run', 'admin', 'roster', 'gateway',
-  'gw', 'well-known', 'inbox', 'outbox', 'actor', 'install']);
+  'gw', 'well-known', 'inbox', 'outbox', 'actor', 'install', 'notices']);
 
 // Why a handle is unusable, or null when it is fine. Lowercase letters, digits
 // and hyphens; 2–30 chars; not edge-hyphenated; not a reserved route.
@@ -319,6 +334,7 @@ function identFor(rec, policy = null) {
 //   listDirectory() -> { handle: record }  every row, for the admin roster
 //   removeDirectory(handle) -> boolean     drop a row; false when a seeded row remains
 //   podPut(url, body, ct) -> boolean      append to a user's pod (per-user cred inside)
+//   readReceived / writeReceived / dropReceived, pauseItems, closeDays — see quiet.mjs
 //   podGet(url, { podHome }) -> Response   read a user's pod (public reads; plain fetch
 //                                          is fine). `podHome` is the row's own pod, for
 //                                          an adapter that reads a store directly and so
@@ -396,14 +412,13 @@ async function route(request, ctx) {
     return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-cache' }, body: ctx.runPage };
   }
 
-  // The roster page: the host reading who has accounts here. The page signs in
-  // and calls the roster API below; a deploy with no admin supplies no page.
-  // Off /admin, which is the owner's own record page on every agent.
-  if (pathname === '/roster') {
-    if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
-    if (!ctx.adminPage) return notFound();
-    return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' }, body: ctx.adminPage };
-  }
+  // The roster page (/roster, off /admin, which is the owner's own record
+  // page on every agent) is served with the notices page, in notices.mjs.
+
+  // Notices from the operator to every account here, and the page they are
+  // written on (notices.mjs).
+  const notices = await routeNoticesApi(request, pathname, ctx, { j, verifyPodToken, publicFor, notFound });
+  if (notices) return notices;
 
   // The roster: every directory row, secrets stripped, for the host's own
   // eyes. The reader proves themself the way attach proves a pod — a
@@ -419,6 +434,7 @@ async function route(request, ctx) {
         handle: r.handle, kind: r.kind || 'person', fronted: !r.inboxOnly,
         podHome: r.podHome, webId: r.webId || null, actorUrl: r.actorUrl,
         address: r.address || `@${r.handle}@${ctx.host}`,
+        openedAt: r.openedAt || null, pausedAt: r.pausedAt || null, closedAt: r.closedAt || null,
       }))
       .sort((a, b) => (a.address || a.handle).localeCompare(b.address || b.handle));
     return j(200, { host: ctx.host, accounts });
@@ -593,6 +609,43 @@ async function route(request, ctx) {
       command: `fedipod gateway ${doorInbox} --secret ${hmacSecret} --inbox-only` });
   }
 
+  // An address at this gateway moving to another one. Its owner, proved the
+  // way attach proves a pod, says where it went. From then on this front
+  // answers the old actor as a moved stub — the same key under the old id,
+  // `movedTo` the new one, so the Move the owner sends from the old address
+  // verifies — every other old id redirects to its new address, and the
+  // mail door is shut: deliveries belong at the new one. Repeating it with
+  // the same target changes nothing.
+  if (pathname === '/api/move' && request.method === 'OPTIONS') return apiPreflight();
+  if (pathname === '/api/move' && request.method === 'POST') {
+    if (!ctx.putDirectory) return withApiCors(j(501, { error: 'this front keeps no directory' }));
+    let body;
+    try { body = JSON.parse(await request.clone().text()); } catch { return withApiCors(j(400, { error: 'bad JSON' })); }
+    const handle = String(body.handle || '').toLowerCase();
+    const rec = await ctx.lookup(handle);
+    if (!rec) return withApiCors(j(404, { error: 'no such account' }));
+    if (rec.inboxOnly) return withApiCors(j(400, { error: 'this address lives on its pod; only an address at this gateway can move' }));
+    const movedTo = String(body.movedTo || '');
+    let mu;
+    try { mu = new URL(movedTo); } catch { return withApiCors(j(400, { error: 'movedTo must be the new actor URL' })); }
+    if (!((mu.protocol === 'https:' || (mu.protocol === 'http:' && isLoopbackHost(mu.hostname))) && /\/ap\/actor$/u.test(mu.pathname))) {
+      return withApiCors(j(400, { error: 'movedTo must be an https …/ap/actor URL' }));
+    }
+    if (ctx.frontOrigin && mu.origin === new URL(ctx.frontOrigin).origin) return withApiCors(j(400, { error: 'that address is at this gateway' }));
+    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    if (!webid) return withApiCors(j(401, { error: 'a Solid-OIDC token proving the pod is required' }));
+    const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
+    if (!owner) return withApiCors(j(403, { error: "the token proves a different pod than this account's" }));
+    const movedAt = rec.movedTo === movedTo && rec.movedAt ? rec.movedAt : new Date().toISOString();
+    await ctx.putDirectory(handle, { ...rec, movedTo, movedAt });
+    console.log(`front @${handle}: moved to ${movedTo}`);
+    return withApiCors(j(200, { ok: true, handle, movedTo, movedAt }));
+  }
+
+  // The owner's say over an account that goes quiet (quiet.mjs).
+  const quiet = await routeQuietApi(request, pathname, ctx, { j, verifyPodToken, webidUnderPod });
+  if (quiet) return quiet;
+
   // The relay: the front sends requests a browser has already signed. A page
   // may not set the Date or Host header, and both are inside an HTTP
   // signature, so a browser-run agent signs and hands the request here; the
@@ -600,24 +653,27 @@ async function route(request, ctx) {
   // a signature and cannot make one. Only the account's own key may sign,
   // only the account's own pod may call, and nothing unsigned-for reaches
   // the remote server.
+  if (pathname === '/api/relay' && request.method === 'OPTIONS') return apiPreflight();
   if (pathname === '/api/relay' && request.method === 'POST') {
     let body;
-    try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+    try { body = JSON.parse(await request.clone().text()); } catch { return withApiCors(j(400, { error: 'bad JSON' })); }
     const handle = String(body.handle || '').toLowerCase();
     const rec = await ctx.lookup(handle);
-    if (!rec) { console.log(`relay: no account named ${handle}`); return j(404, { error: 'no such account' }); }
+    if (!rec) { console.log(`relay: no account named ${handle}`); return withApiCors(j(404, { error: 'no such account' })); }
     const webid = await verifyPodToken(request, pathname, ctx.verifier);
-    if (!webid) { console.log(`relay @${handle}: no usable pod token`); return j(401, { error: 'a Solid-OIDC token proving the pod is required' }); }
+    if (!webid) { console.log(`relay @${handle}: no usable pod token`); return withApiCors(j(401, { error: 'a Solid-OIDC token proving the pod is required' })); }
     const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
-    if (!owner) { console.log(`relay @${handle}: token is for ${webid}, not this account's pod`); return j(403, { error: "the token proves a different pod than this account's" }); }
+    if (!owner) { console.log(`relay @${handle}: token is for ${webid}, not this account's pod`); return withApiCors(j(403, { error: "the token proves a different pod than this account's" })); }
     const items = Array.isArray(body.requests) ? body.requests : [];
-    if (!items.length) return j(400, { error: 'requests must be a non-empty list' });
-    if (items.length > RELAY_MAX_REQUESTS) return j(400, { error: `at most ${RELAY_MAX_REQUESTS} requests per call` });
+    if (!items.length) return withApiCors(j(400, { error: 'requests must be a non-empty list' }));
+    // Acting through the relay is being here. Hourly at most; see noteOpened.
+    await noteOpened(ctx, handle, rec).catch((e) => console.log(`relay @${handle}: stamp not written: ${e?.message || e}`));
+    if (items.length > RELAY_MAX_REQUESTS) return withApiCors(j(400, { error: `at most ${RELAY_MAX_REQUESTS} requests per call` }));
     const results = await Promise.all(items.map((it) => relayOne(it, rec, ctx.fetchImpl || fetch)));
     // One line per relayed request, so a lookup that fails on the far side is
     // visible here and not only as an empty result in someone's browser.
     for (const r of results) console.log(`relay @${handle}: ${r.method || ''} ${r.url} → ${r.status}${r.error ? ` (${r.error})` : ''}`);
-    return j(200, { results });
+    return withApiCors(j(200, { results }));
   }
 
   // Who is here, and which pod of theirs could opt in. The opt-in page asks
@@ -720,7 +776,7 @@ async function route(request, ctx) {
   //
   // The name is matched against a literal list, so nothing about the request
   // chooses a file.
-  const mPageScript = /^\/(new-account|run|admin)\.js$/u.exec(pathname);
+  const mPageScript = /^\/(new-account|run|admin|notices)\.js$/u.exec(pathname);
   if (mPageScript) {
     const body = ctx.pageScripts?.[`${mPageScript[1]}.js`];
     if (!body) return notFound();
@@ -750,6 +806,9 @@ async function route(request, ctx) {
     if (!m || m[2] !== ctx.host) return notFound();
     const rec = await ctx.lookup(m[1]);
     if (!rec) return notFound();
+    // A closed address is gone, and says so rather than pretending never to
+    // have existed: the name stays taken.
+    if ((await closedState(ctx, m[1], rec)).closed) return closedAnswer({ 'access-control-allow-origin': '*' });
     // A fronted identity's documents live on its pod; the pod's own actor id
     // is the alias, so a client signing in by the fronted address can find
     // the pod (and its login) without a lookup only the host could answer.
@@ -787,16 +846,28 @@ async function route(request, ctx) {
   const rec = await ctx.lookup(up.handle);
   if (!rec) return notFound();
   const base = userBase(ctx.frontOrigin, up.handle);
+  // An account that moved to another gateway (see /api/move): where its ids
+  // live now. The actor below answers as a stub; everything else redirects.
+  const movedBase = rec.movedTo ? rec.movedTo.replace(/ap\/actor$/u, '') : null;
+  // A closed address (see "accounts that go quiet" above): every id under it
+  // is gone. Asked after moved, which a close does not undo.
+  const closed = movedBase ? false : (await closedState(ctx, up.handle, rec)).closed;
+  const gone = (headers = {}, why = `this account has moved to ${rec.movedTo}`) => closedAnswer(headers, why);
+  const CLOSED = 'this address is closed';
 
   // Inbox: verify at the door, forward to the user's pod inbox. This is the
   // gateway, per user.
   if (up.rest === 'ap/inbox/' || up.rest === 'ap/inbox') {
     if (request.method !== 'POST') return { status: 405, headers: {}, body: '' };
+    if (movedBase) { console.log(`door @${up.handle}: delivery → 410 (moved)`); return gone(); }
+    if (closed) { console.log(`door @${up.handle}: delivery → 410 (closed)`); return gone({}, CLOSED); }
     const policy = await policyFor(rec, ctx.fetchImpl || fetch);
-    const { status, reason } = await handleDelivery(request, identFor(rec, policy),
-      { podPut: (u, b, ct) => ctx.podPut(up.handle, u, b, ct), fetchImpl: ctx.fetchImpl });
+    const standing = await accountState(ctx, up.handle, rec);
+    const { status, reason, content, bytes } = await handleDelivery(request, identFor(rec, policy),
+      { podPut: (u, b, ct) => ctx.podPut(up.handle, u, b, ct), fetchImpl: ctx.fetchImpl, paused: standing.paused });
     // One line per delivery, so "did it arrive at the door" has an answer.
     console.log(`door @${up.handle}: delivery → ${status} (${reason})`);
+    if (status === 202 && content) await noteReceived(ctx, up.handle, rec, bytes);
     return { status, headers: {}, body: '' };
   }
 
@@ -822,6 +893,11 @@ async function route(request, ctx) {
       return { status: 204, headers: { ...cors, allow: 'GET, POST, OPTIONS',
         'accept-post': 'application/ld+json, application/activity+json' }, body: null };
     }
+    if (movedBase && request.method === 'POST') return gone(cors);
+    if (closed && request.method === 'POST') return gone(cors, CLOSED);
+    if (movedBase && (request.method === 'GET' || request.method === 'HEAD')) {
+      return { status: 301, headers: { ...cors, location: movedBase + up.rest, 'cache-control': 'no-store' }, body: '' };
+    }
     if (request.method === 'POST') {
       const json = (status, obj, extra = {}) => ({ status,
         headers: { ...cors, 'content-type': 'application/json', 'cache-control': 'no-store', ...extra },
@@ -854,6 +930,12 @@ async function route(request, ctx) {
       'access-control-allow-headers': 'Accept', 'access-control-max-age': '86400', allow: 'GET, HEAD, OPTIONS' }, body: null };
   }
   if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
+  // Moved: every old id but the actor's answers with where it is now, so a
+  // reply or a boost another server still holds under the old id resolves.
+  if (movedBase && up.rest !== 'ap/actor') {
+    return { status: 301, headers: { ...open, location: movedBase + up.rest, 'cache-control': 'no-store' }, body: '' };
+  }
+  if (closed) return gone(open, CLOSED);
   const podTarget = rec.podHome + up.rest;
   // Media stays on the pod (lib/pod/urls.mjs keeps `media` off the front), but
   // the id rewrite below turns media links onto the front like every other
@@ -879,12 +961,29 @@ async function route(request, ctx) {
   if (got.text === null) return { status: got.status, headers: open, body: '' };
   let text = got.text;
   text = swap(text, rec.podHome, base);
+  // The moved stub: the pod's actor now carries the NEW gateway's ids, and a
+  // server verifying the Move fetches the OLD id and needs a document whose
+  // id is that old id — with the same key under it, and `movedTo` saying
+  // where the account went. Swapping the new base back to this one gives
+  // exactly that; alsoKnownAs and movedTo are set below.
+  if (movedBase) text = swap(text, movedBase, base);
   if (up.rest === 'ap/actor') {
     try {
       const doc = JSON.parse(text);
       doc.preferredUsername = up.handle;               // so @handle@front cross-checks
       doc.inbox = base + 'ap/inbox/';                  // deliveries come to the front to be verified
       doc.endpoints = { ...(doc.endpoints || {}), sharedInbox: base + 'ap/inbox/' };
+      if (movedBase) {
+        doc.movedTo = rec.movedTo;
+        const aka = new Set([].concat(doc.alsoKnownAs || []).filter((a) => typeof a === 'string' && a !== doc.id));
+        aka.add(rec.movedTo);
+        doc.alsoKnownAs = [...aka];
+        const ctxs = [].concat(doc['@context'] || []);
+        const declared = (term) => ctxs.some((c) => c && typeof c === 'object' && term in c);
+        if (!declared('alsoKnownAs')) ctxs.push({ alsoKnownAs: { '@id': 'as:alsoKnownAs', '@type': '@id' } });
+        if (!declared('movedTo')) ctxs.push({ movedTo: { '@id': 'as:movedTo', '@type': '@id' } });
+        doc['@context'] = ctxs;
+      }
       text = JSON.stringify(doc);
     } catch { /* leave the rewritten text as-is if it will not parse */ }
   }

package/lib/gateway/gateway-core.mjs

@@ -19,9 +19,11 @@ import * as inbox from '../pod/inbox.mjs';
 const DEFAULT_MAX_BYTES = 512 * 1024;   // mirror intake.mjs MAX_ITEM_BYTES
 
 // Control activities are the message itself and must always pass — you want
-// Follows from strangers. Only CONTENT is subject to the concerns-us drop.
-const CONTROL = new Set(['Follow', 'Undo', 'Accept', 'Reject', 'Delete', 'Move',
+// Follows from strangers. Only CONTENT is subject to the concerns-us drop,
+// and to a pause: an account nobody is reading still takes its follows.
+export const CONTROL = new Set(['Follow', 'Undo', 'Accept', 'Reject', 'Delete', 'Move',
   'Add', 'Remove', 'Block']);
+export const isControl = (type) => CONTROL.has(type);
 
 const idOf = (v) => (typeof v === 'string' ? v : v?.id) || null;
 const sha256hex = (s) => crypto.createHash('sha256').update(s).digest('hex');
@@ -64,8 +66,13 @@ function concernsUsAtEdge(activity, ident) {
 // resolved identity policy: { inboxUrl, actorUrl, followersUrl, notesPrefix,
 // following, blocklist, kind, gatewayWebId, hmacSecret }. `podPut(url, body,
 // contentType) → boolean` appends to the pod with the gateway's credential.
-// Returns { status, reason } — the adapter turns it into an HTTP response.
-export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES } = {}) {
+// `paused` says nobody is reading this inbox: content is accepted and
+// discarded (the same quiet 202 a blocked sender gets, so nothing retries
+// and nothing counts a failure against this host), control still lands.
+// Returns { status, reason } — the adapter turns it into an HTTP response —
+// and, for a delivery that reached the pod, `content` (whether it was
+// content rather than control) and `bytes`, so the caller can keep count.
+export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES, paused = false } = {}) {
   // Read the body once from a clone; the original, unconsumed, goes to the
   // verifier (which needs the body for the Digest check).
   let raw;
@@ -80,7 +87,9 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
   // Edge drops — silent 202 so a rejected sender does not retry a delivery we
   // will never accept. None of these becomes a pod write.
   if (isBlocked(actor, ident.blocklist)) return { status: 202, reason: 'blocked' };
-  if (!CONTROL.has(activity.type) && !concernsUsAtEdge(activity, ident)) {
+  const content = !CONTROL.has(activity.type);
+  if (content && paused) return { status: 202, reason: 'paused' };
+  if (content && !concernsUsAtEdge(activity, ident)) {
     return { status: 202, reason: 'does not concern us' };
   }
 
@@ -107,7 +116,7 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
   // holding any state.
   if (!okA) return { status: 502, reason: 'pod inbox write failed' };
   if (receipt) await inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt);
-  return { status: 202, reason: v.verified ? 'verified' : 'buffered-unverified' };
+  return { status: 202, reason: v.verified ? 'verified' : 'buffered-unverified', content, bytes: Buffer.byteLength(raw) };
 }
 
 // The outbox door: the owner's own post, taken on their behalf.