fedipod-server 0.26.0 → 0.28.0

package/lib/gateway/notices.mjs

@@ -0,0 +1,84 @@
+// notices.mjs — notices from whoever runs the front, to every account here.
+//
+// The operator writes them on the /notices page, proved as the admin the way
+// the roster is; every page of ours asks GET /api/notices once per load and
+// shows a bell when there are any. A notice is a title, a plain-text body and
+// a time. The body is never markup: the pages render it as text.
+//
+// Kept beside the directory, in a store the adapter supplies:
+//   listNotices() -> { id: notice }     putNotice(id, notice)     deleteNotice(id)
+// A front that supplies none has no notices to offer, and says so.
+
+import crypto from 'node:crypto';
+
+const TITLE_MAX = 120;
+const BODY_MAX = 4000;
+const NOTICES_EDGE_SECONDS = 60;
+
+const clean = (v, max) => String(v ?? '').replace(/\r\n?/gu, '\n').trim().slice(0, max);
+const newest = (a, b) => String(b.at || '').localeCompare(String(a.at || ''));
+
+export async function listNotices(ctx) {
+  const all = ctx.listNotices ? await ctx.listNotices() : {};
+  return Object.values(all || {}).filter(Boolean).sort(newest);
+}
+
+// GET is public: what every account is shown. POST is the admin's alone. The
+// /notices page is where the admin writes them; it signs in like the roster.
+// Returns a response, or null when the path is neither.
+export async function routeNoticesApi(request, pathname, ctx, { j, verifyPodToken, publicFor, notFound }) {
+  // The two admin pages: the roster (who has accounts here) and the notices.
+  // Each signs in and calls its API; a deploy with no admin supplies no page.
+  const page = pathname === '/notices' ? ctx.noticesPage : pathname === '/roster' ? ctx.adminPage : undefined;
+  if (page !== undefined) {
+    if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
+    if (!page) return notFound();
+    return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' }, body: page };
+  }
+  if (pathname !== '/api/notices') return null;
+  const open = { 'access-control-allow-origin': '*' };
+  if (request.method === 'OPTIONS') {
+    return { status: 204, headers: { ...open, 'access-control-allow-methods': 'GET, OPTIONS',
+      'access-control-allow-headers': 'Accept', allow: 'GET, POST, OPTIONS' }, body: null };
+  }
+  if (request.method === 'GET') {
+    if (!ctx.listNotices) return j(501, { error: 'this front keeps no notices' });
+    const out = j(200, { notices: await listNotices(ctx) });
+    Object.assign(out.headers, open, publicFor(NOTICES_EDGE_SECONDS));
+    return out;
+  }
+  if (request.method !== 'POST') return { status: 405, headers: {}, body: '' };
+  if (!ctx.putNotice || !ctx.deleteNotice || !ctx.adminWebId) return j(501, { error: 'this front keeps no notices' });
+  const webid = await verifyPodToken(request, pathname, ctx.verifier);
+  if (!webid) return j(401, { error: 'a Solid-OIDC token is required' });
+  if (webid !== ctx.adminWebId) return j(403, { error: 'that WebID is not the admin of this front' });
+  let body;
+  try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+  const action = String(body.action || '');
+  const all = (ctx.listNotices ? await ctx.listNotices() : {}) || {};
+  if (action === 'delete') {
+    const id = String(body.id || '');
+    if (!all[id]) return j(404, { error: 'no such notice' });
+    await ctx.deleteNotice(id);
+    console.log(`front: notice ${id} deleted by the admin`);
+    return j(200, { ok: true, id, deleted: true });
+  }
+  if (action !== 'create' && action !== 'update') return j(400, { error: 'action must be create, update or delete' });
+  const title = clean(body.title, TITLE_MAX);
+  const text = clean(body.body, BODY_MAX);
+  if (!title) return j(400, { error: 'a title is required' });
+  if (!text) return j(400, { error: 'a body is required' });
+  const now = new Date().toISOString();
+  let notice;
+  if (action === 'create') {
+    const id = `${Date.now().toString(36)}-${crypto.randomBytes(4).toString('hex')}`;
+    notice = { id, title, body: text, at: now, updatedAt: now };
+  } else {
+    const prior = all[String(body.id || '')];
+    if (!prior) return j(404, { error: 'no such notice' });
+    notice = { ...prior, title, body: text, updatedAt: now };
+  }
+  await ctx.putNotice(notice.id, notice);
+  console.log(`front: notice ${notice.id} ${action}d by the admin`);
+  return j(action === 'create' ? 201 : 200, { ok: true, notice });
+}

package/lib/gateway/quiet.mjs

@@ -0,0 +1,184 @@
+// quiet.mjs — accounts that go quiet: what the front knows about an account
+// nobody opens, and what its owner may say about it. The router in
+// front-core.mjs asks closedState/accountState at the door and on every
+// public read, stamps noteOpened from the relay, counts noteReceived after
+// a forwarded delivery, and hands /api/open, /api/pause and /api/close here.
+
+// ---- accounts that go quiet -------------------------------------------------
+//
+// The gateway holds no mail: every delivery it takes is two writes into the
+// owner's pod inbox, read only when their browser is open. An account nobody
+// opens grows on its pod without limit, and its owner comes back to a drain
+// of everything at once. So the front keeps two facts about each browser
+// account — when its owner was last here, and how much content has arrived
+// since — and acts on them.
+//
+// `openedAt` is written when the owner signs in (POST /api/open, always) and
+// while they act through the relay (at most hourly). The count of content
+// deliveries since then lives in its own record, keyed by handle AND
+// openedAt: a fresh stamp starts a fresh count with nothing to reset, and a
+// delivery's write can never overwrite a sign-in's. Two deliveries landing
+// together may each read the same total and one increment is lost — the cap
+// comes out slightly soft, never too strict.
+//
+// PAUSED: the count has reached the cap, or the owner said so. Content is
+// accepted and discarded, control (follows, unfollows, moves, deletions,
+// blocks) still lands. The owner's next sign-in ends a cap pause by itself; a
+// pause they set lasts until they lift it.
+//
+// CLOSED: the owner said so, or nothing has opened the account for the close
+// window. Found closed by time, it is written down so it stays closed. From
+// then on the door, the actor and the handle answer 410 — never a failure
+// code, which senders retry and count against this whole host, and never a
+// success, which would keep them sending. Nothing on the pod is touched. An
+// address that moved (see /api/move) keeps answering as moved; closing does
+// not take that away.
+//
+// Only an account whose owner has signed in from a browser carries
+// `openedAt`. A DeviceAgent behind this door never does: it drains its own
+// inbox as it runs, so it is never counted, never paused and never closed by
+// time. Accounts from before this was built are counted from their next
+// sign-in.
+export const DEFAULT_PAUSE_ITEMS = 5000;
+export const DEFAULT_CLOSE_DAYS = 183;                // six months
+const OPEN_STAMP_EVERY_MS = 60 * 60_000;              // the relay's stamp, at most hourly
+const pauseItemsOf = (ctx) => (Number(ctx.pauseItems) > 0 ? Number(ctx.pauseItems) : DEFAULT_PAUSE_ITEMS);
+const closeDaysOf = (ctx) => (Number(ctx.closeDays) > 0 ? Number(ctx.closeDays) : DEFAULT_CLOSE_DAYS);
+const receivedKey = (key, rec) => `${key}/${rec.openedAt}`;
+
+export async function receivedSince(ctx, key, rec) {
+  if (!ctx.readReceived || !rec.openedAt) return { items: 0, bytes: 0 };
+  const got = await ctx.readReceived(receivedKey(key, rec)).catch(() => null);
+  return { items: Number(got?.items) || 0, bytes: Number(got?.bytes) || 0 };
+}
+
+// One more content delivery reached the pod. Nothing to count against until
+// the owner has been here once.
+export async function noteReceived(ctx, key, rec, bytes) {
+  if (!ctx.readReceived || !ctx.writeReceived || !rec.openedAt) return;
+  const so = await receivedSince(ctx, key, rec);
+  await ctx.writeReceived(receivedKey(key, rec), { items: so.items + 1, bytes: so.bytes + (Number(bytes) || 0) })
+    .catch((e) => console.log(`front @${key}: count not written: ${e?.message || e}`));
+}
+
+// The owner is here. `always` is a sign-in; the relay stamps at most hourly,
+// so a busy hour of posting is one write. The count that went with the old
+// stamp is dropped: it is over, and a store should not keep one per hour.
+export async function noteOpened(ctx, key, rec, { always = false } = {}) {
+  if (!ctx.putDirectory) return rec;
+  if (!always && rec.openedAt && Date.now() - Date.parse(rec.openedAt) < OPEN_STAMP_EVERY_MS) return rec;
+  const next = { ...rec, openedAt: new Date().toISOString() };
+  await ctx.putDirectory(key, next);
+  if (rec.openedAt && ctx.dropReceived) await ctx.dropReceived(receivedKey(key, rec)).catch(() => {});
+  return next;
+}
+
+// Closed, and why. Reads no count: this is asked on every public read.
+export async function closedState(ctx, key, rec) {
+  if (rec.movedTo) return { closed: false };
+  if (rec.closedAt) return { closed: true, closedAt: rec.closedAt, closedBy: rec.closedBy || 'owner' };
+  if (rec.openedAt && Date.now() - Date.parse(rec.openedAt) > closeDaysOf(ctx) * 86400_000) {
+    const closedAt = new Date().toISOString();
+    if (ctx.putDirectory) await ctx.putDirectory(key, { ...rec, closedAt, closedBy: 'quiet' });
+    console.log(`front @${key}: closed — nothing opened it since ${rec.openedAt}`);
+    return { closed: true, closedAt, closedBy: 'quiet' };
+  }
+  return { closed: false };
+}
+
+// The whole standing of an account, for the door and for its owner's page.
+export async function accountState(ctx, key, rec) {
+  const c = await closedState(ctx, key, rec);
+  const received = c.closed ? { items: 0, bytes: 0 } : await receivedSince(ctx, key, rec);
+  const cap = pauseItemsOf(ctx);
+  const pausedBy = c.closed ? null : rec.pausedAt ? 'owner' : received.items >= cap ? 'quiet' : null;
+  return {
+    closed: c.closed, closedAt: c.closedAt || null, closedBy: c.closedBy || null,
+    paused: !!pausedBy, pausedBy, pausedAt: rec.pausedAt || null,
+    openedAt: rec.openedAt || null, received, pauseItems: cap, closeDays: closeDaysOf(ctx),
+  };
+}
+
+// A 410 with a reason, the shape every closed or moved id answers with.
+export const closedAnswer = (headers = {}, why = 'this address is closed') => ({
+  status: 410, headers: { ...headers, 'content-type': 'application/json', 'cache-control': 'no-store' },
+  body: JSON.stringify({ error: why }) });
+
+// The owner of a row, proved the way the relay proves them: a pod token whose
+// WebID is the row's, or lives on the row's pod for a row from before WebIDs
+// were recorded.
+async function provedOwner(request, pathname, ctx, rec, { j, verifyPodToken, webidUnderPod }) {
+  const webid = await verifyPodToken(request, pathname, ctx.verifier);
+  if (!webid) return { error: j(401, { error: 'a Solid-OIDC token proving the pod is required' }) };
+  const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
+  if (!owner) return { error: j(403, { error: "the token proves a different pod than this account's" }) };
+  return { webid };
+}
+
+// The owner's three routes. `deps` are front-core's own JSON reply and
+// token check, handed in so this module stays free of the router's privates.
+// Returns a response, or null when the path is not one of these.
+export async function routeQuietApi(request, pathname, ctx, deps) {
+  const { j } = deps;
+  if (request.method !== 'POST' || !['/api/open', '/api/pause', '/api/close'].includes(pathname)) return null;
+  // The owner is here: their browser says so as it opens the account. The
+  // answer is the account's standing at this gateway, which the manage page
+  // shows. A closed address is told so and nothing is written.
+  if (pathname === '/api/open' && request.method === 'POST') {
+    if (!ctx.putDirectory) return j(501, { error: 'this front keeps no directory' });
+    let body;
+    try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+    const handle = String(body.handle || '').toLowerCase();
+    let rec = await ctx.lookup(handle);
+    if (!rec) return j(404, { error: 'no such account' });
+    const who = await provedOwner(request, pathname, ctx, rec, deps);
+    if (who.error) return who.error;
+    const before = await closedState(ctx, handle, rec);
+    if (before.closed) return j(410, { error: 'this address is closed', closedAt: before.closedAt, closedBy: before.closedBy });
+    rec = await noteOpened(ctx, handle, rec, { always: true });
+    return j(200, { ok: true, handle, ...await accountState(ctx, handle, rec) });
+  }
+
+  // The owner pausing their own account, or lifting the pause they set.
+  if (pathname === '/api/pause' && request.method === 'POST') {
+    if (!ctx.putDirectory) return j(501, { error: 'this front keeps no directory' });
+    let body;
+    try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+    const handle = String(body.handle || '').toLowerCase();
+    let rec = await ctx.lookup(handle);
+    if (!rec) return j(404, { error: 'no such account' });
+    const who = await provedOwner(request, pathname, ctx, rec, deps);
+    if (who.error) return who.error;
+    const before = await closedState(ctx, handle, rec);
+    if (before.closed) return j(410, { error: 'this address is closed', closedAt: before.closedAt });
+    if (typeof body.paused !== 'boolean') return j(400, { error: 'paused must be true or false' });
+    if (body.paused && !rec.pausedAt) rec = { ...rec, pausedAt: new Date().toISOString() };
+    if (!body.paused && rec.pausedAt) { rec = { ...rec }; delete rec.pausedAt; }
+    // Lifting a pause is a sign-in's worth of "I am here": the count starts over.
+    if (!body.paused) rec = { ...rec, openedAt: new Date().toISOString() };
+    await ctx.putDirectory(handle, rec);
+    console.log(`front @${handle}: ${body.paused ? 'paused' : 'resumed'} by its owner`);
+    return j(200, { ok: true, handle, ...await accountState(ctx, handle, rec) });
+  }
+
+  // The owner closing their address for good. Repeating it changes nothing.
+  if (pathname === '/api/close' && request.method === 'POST') {
+    if (!ctx.putDirectory) return j(501, { error: 'this front keeps no directory' });
+    let body;
+    try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+    const handle = String(body.handle || '').toLowerCase();
+    let rec = await ctx.lookup(handle);
+    if (!rec) return j(404, { error: 'no such account' });
+    const who = await provedOwner(request, pathname, ctx, rec, deps);
+    if (who.error) return who.error;
+    if (body.confirm !== true) return j(400, { error: 'closing is for good — send confirm: true' });
+    if (!rec.closedAt) {
+      rec = { ...rec, closedAt: new Date().toISOString(), closedBy: 'owner' };
+      await ctx.putDirectory(handle, rec);
+      console.log(`front @${handle}: closed by its owner`);
+    }
+    return j(200, { ok: true, handle, ...await accountState(ctx, handle, rec) });
+  }
+
+  return null;
+}

package/lib/pod/state.mjs

@@ -11,11 +11,11 @@
 
 // ---- the owner's agent ----
 
-export const readWrappedKeys = (pod, urls) => pod.getJson(urls.state + 'keys.json');
+export const readKeys = (pod, urls) => pod.getJson(urls.state + 'keys.json');
 export const readConfig = (pod, urls) => pod.getJson(urls.state + 'config.json');
 
-export const writeWrappedKeys = (pod, urls, envelope) =>
-  pod.putJson(urls.state + 'keys.json', envelope, 'application/json');
+export const writeKeys = (pod, urls, keys) =>
+  pod.putJson(urls.state + 'keys.json', keys, 'application/json');
 export const writeConfig = (pod, urls, config) =>
   pod.putJson(urls.state + 'config.json', config, 'application/json');
 
@@ -30,10 +30,11 @@ export const writeConfig = (pod, urls, config) =>
  * public. As two statements this was two chances to get it wrong; as one
  * operation there is nowhere to put them in the other order.
  *
- * The envelope is built by the caller. This library does not choose how a key
- * is wrapped, and should not be able to write an unwrapped one by accident.
+ * The keys record is stored as it is: the container's access rule is what
+ * keeps it to the owner, the same rule every private document on the pod
+ * lives under.
  */
-export async function provisionKey(pod, { stateUrl, keysUrl, envelope }) {
+export async function provisionKey(pod, { stateUrl, keysUrl, keys }) {
   await pod.setAcl(stateUrl, []);
-  await pod.putJson(keysUrl, envelope, 'application/json');
+  await pod.putJson(keysUrl, keys, 'application/json');
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod-server",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "description": "The FediPod Server: a full ActivityPub server as a Community Solid Server component.",
   "license": "MIT",
   "main": "dist/index.js",

package/run-agent.mjs

@@ -33,6 +33,7 @@ import { apRoot, rootOf, writeJsonAtomic } from './lib/device/home.mjs';
 import { ensureTrustedTls } from './lib/device/certs.mjs';
 import { storageFor } from './lib/core/storage.mjs';
 import { resolveKeys } from './lib/core/keys.mjs';
+import { completeGatewayMove } from './lib/device/gateway-move.mjs';
 import { RemotePod } from './lib/device/remote.mjs';
 import { Deliverer } from './lib/core/deliver.mjs';
 import { Publisher } from './lib/core/publisher/index.mjs';
@@ -497,6 +498,18 @@ export class Agent {
     return true;
   }
 
+  // The featured collection was once written only on the first pin, so an
+  // account from before then has none, and every server that shows the
+  // profile is refused and asks again. One authenticated GET; the empty
+  // collection goes up when the pod lacks it. True when it had to.
+  async ensureFeaturedPublished() {
+    const doc = await this.remote.getJson(this.urls.featured);
+    if (doc?.id) return false;
+    this.log('featured collection missing from the pod — publishing it');
+    await this.publisher.publishFeatured();
+    return true;
+  }
+
   // Read-only mode: refresh the state cache periodically, and take over the
   // moment the active agent's lease frees.
   startViewer() {
@@ -535,6 +548,10 @@ export class Agent {
       return;                                // renewal is already running, above
     }
     await this.intake.start();
+    // An address that moved here from another gateway, whose move was left
+    // pending (the old gateway could not be told): try again now that this
+    // agent acts and the actor is published.
+    completeGatewayMove(this).catch(e => this.log(`gateway move: ${e.message}`));
     // Reused, not replaced: demote() stops this instance but does not clear it,
     // so constructing a new one over the top orphaned the old chain beyond the
     // reach of any later stop().
@@ -588,6 +605,8 @@ export class Agent {
     if (repair) {
       this.ensureActorPublished()
         .catch(e => this.log(`actor check failed: ${e.message}`));
+      this.ensureFeaturedPublished()
+        .catch(e => this.log(`featured check failed: ${e.message}`));
       // The human page, rewritten only when what it shows has changed: one
       // local digest compare, and a write the first time after an upgrade.
       this.publisher.publishProfilePage()

package/web/admin/bar.css

@@ -62,16 +62,32 @@ body { background: var(--surface); }
    quieter than the links; the one in use is marked `aria-current="true"` — the
    current item of a set, which on the record page is not the current PAGE — so
    it needs its own mark rather than borrowing the rule above. */
-#bar #client-pick { display: inline-flex; gap: .6rem; align-items: baseline;
+#bar #client-pick, #bar #account-pick { display: inline-flex; gap: .6rem; align-items: baseline;
   white-space: nowrap; margin-left: 1rem; }
-#bar #client-now { opacity: .75; }
+#bar #client-now, #bar #account-now { opacity: .75; }
+/* The notices bell: the one filled control in the bar, because it is the one
+   thing there that is not a place to go but something to be told. The count is
+   how many notices this browser has not opened yet; with none it is quiet. */
+#bar #bar-notices { display: inline-flex; align-items: center; gap: .35rem; margin-left: 1rem;
+  padding: .3rem .7rem; border-radius: 999px; font-size: 1.05rem; line-height: 1;
+  background: var(--btn); color: var(--btn-text); border: 1px solid var(--btn); }
+/* `display` on an id rule outranks the browser's own [hidden] rule, and the
+   shell has no !important of its own, so the bell hid on the record page and
+   showed on the client with nothing to show. Said here, once, for every page. */
+#bar #bar-notices[hidden] { display: none; }
+#bar #bar-notices:hover { background: var(--btn-hover); border-color: var(--btn-hover); }
+#bar #bar-notices:focus-visible { outline: 3px solid var(--ring); outline-offset: 2px; }
+#bar #bar-notices-count { font-size: .9rem; font-weight: 700; min-width: 1.3em; text-align: center;
+  padding: .05rem .4rem; border-radius: 999px; background: var(--btn-text); color: var(--btn); }
+#bar #bar-notices-count:empty { display: none; }
+#bar #bar-notices[data-new="0"] { background: var(--field-bg); color: var(--ink); border-color: var(--field-edge); }
 #bar a[aria-current="true"] {
   font-weight: 700; text-decoration: underline; text-underline-offset: .3rem; }
 
 /* The two-clients notice: said once, to somebody who knew this page when it
    had one client. Sized and placed rather than left to the browser's default,
    which stretched it edge to edge and put it over the very links it names. */
-#client-news {
+#client-news, #notices-list, #notice-view {
   /* Low rather than centred: it points at the links in the bar, so the bar has
      to stay in view while it is read. */
   max-width: 34rem; margin: auto auto 2.5rem; padding: 1.5rem 1.7rem;
@@ -80,13 +96,31 @@ body { background: var(--surface); }
   font: 1rem/1.55 var(--font);
   box-shadow: 0 .6rem 2rem rgba(0, 0, 0, .25);
 }
-#client-news::backdrop { background: rgba(0, 0, 0, .45); }
-#client-news h2 { font-size: 1.25rem; margin: 0 0 .9rem; color: var(--heading); }
-#client-news p { margin: 0 0 1.2rem; }
-#client-news p:last-child { margin: 0; }
-#client-news button {
+#client-news::backdrop, #notices-list::backdrop, #notice-view::backdrop { background: rgba(0, 0, 0, .45); }
+#client-news h2, #notices-list h2, #notice-view h2 { font-size: 1.25rem; margin: 0 0 .9rem; color: var(--heading); }
+#client-news p, #notices-list p, #notice-view p { margin: 0 0 1.2rem; }
+#client-news p:last-child, #notices-list p:last-child, #notice-view p:last-child { margin: 0; }
+#client-news button, #notices-list button, #notice-view button {
   font: inherit; padding: .55rem 1.3rem; border-radius: .35rem; cursor: pointer;
   background: var(--btn); color: var(--btn-text); border: 1px solid var(--btn);
 }
-#client-news button:hover { background: var(--btn-hover); border-color: var(--btn-hover); }
-#client-news button:focus-visible { outline: 3px solid var(--ring); outline-offset: 2px; }
+#client-news button:hover, #notices-list button:hover, #notice-view button:hover { background: var(--btn-hover); border-color: var(--btn-hover); }
+#client-news button:focus-visible, #notices-list button:focus-visible, #notice-view button:focus-visible { outline: 3px solid var(--ring); outline-offset: 2px; }
+
+/* The notices dialogs are centred and never taller than the window: the
+   client-news rule above sits low, and a short window pushed a list of
+   notices up past the top edge where nothing could reach it. */
+#notices-list, #notice-view { margin: auto; max-height: calc(100dvh - 3rem); overflow: auto; box-sizing: border-box; }
+/* The list of notices: each title a button that opens that notice, the date
+   beside it, the ones not yet opened here in bold. */
+#notices-items { list-style: none; margin: 0 0 1.2rem; padding: 0; }
+#notices-items li { display: flex; gap: .8rem; align-items: baseline; padding: .45rem 0;
+  border-bottom: 1px solid var(--line); }
+#notices-items li:last-child { border-bottom: 0; }
+#notices-items button.notice-open { flex: 1 1 auto; text-align: left; padding: .1rem 0;
+  background: none; border: 0; color: var(--link); text-decoration: underline; text-underline-offset: .2rem; }
+#notices-items li.new button.notice-open { font-weight: 700; }
+#notices-items .when, #notice-view .when { color: var(--sub); font-size: .9rem; white-space: nowrap; }
+#notices-items p.none { color: var(--sub); }
+#notice-view-body p { margin: 0 0 .9rem; }
+#notice-view-body a { color: var(--link); word-break: break-all; }

package/web/admin/client/index.html

@@ -28,8 +28,16 @@ main { flex: 1 1 auto; min-height: 0; display: flex; }
   <h1 class="name">FediPod</h1>
   <select id="actor-pick" aria-label="Local actors"
     title="   Every actor on this machine; choosing one opens its client"></select>
-  <a id="bar-fediverse" href="./" title="   Open the client and read your timeline" aria-current="page">visit account</a>
-  <a id="bar-manage" href="../" title="   The record: what this actor is, and what you can do to it">manage account</a>
+  <!-- The account group, styled like the client group beside it: one label,
+       then the places to go. The browser build adds "sign out" to it. -->
+  <span id="account-pick"><span id="account-now">account:</span>
+  <a id="bar-fediverse" href="./" title="   Open the client and read your timeline" aria-current="page">visit</a>
+  <a id="bar-manage" href="../" title="   The record: what this actor is, and what you can do to it">manage</a>
+  </span>
+  <!-- Notices from whoever runs this site. Shown only when the site has any
+       (notices-bar.js asks /api/notices); the count is how many are new here. -->
+  <button type="button" id="bar-notices" hidden aria-haspopup="dialog" aria-controls="notices-list"
+    title="   Notices from the operator of this site">&#128276;<span id="bar-notices-count" aria-live="polite"></span></button>
 </nav>
 
 <main>
@@ -38,5 +46,24 @@ main { flex: 1 1 auto; min-height: 0; display: flex; }
 
 <script src="../bar.js"></script>
 <script src="client.js"></script>
+
+<!-- The notices: the list, and one notice open. Declared here and filled by
+     notices-bar.js from /api/notices; nothing in them is markup from a notice. -->
+<dialog id="notices-list" aria-labelledby="notices-title">
+  <section>
+    <h2 id="notices-title">Notices</h2>
+    <ul id="notices-items"></ul>
+    <p class="row"><button type="button" id="notices-close" class="primary" title="   Close the list of notices">Close</button></p>
+  </section>
+</dialog>
+<dialog id="notice-view" aria-labelledby="notice-view-title">
+  <section>
+    <h2 id="notice-view-title"></h2>
+    <p class="when" id="notice-view-when"></p>
+    <div id="notice-view-body"></div>
+    <p class="row"><button type="button" id="notice-view-close" class="primary" title="   Back to the list of notices">Close</button></p>
+  </section>
+</dialog>
+<script src="../notices-bar.js"></script>
 </body>
 </html>

package/web/admin/gateway.js

@@ -18,12 +18,31 @@ async function refreshGateway() {
     GATEWAY_WORD.textContent = frontName ? `${host} — publishing as @${frontName}@${host}` : host;
     GW_OPEN_ATTACH.hidden = true;
     GW_OPEN_DETACH.hidden = false;
+    // The account's standing at the gateway — paused, closed. The browser
+    // build's agent reports it; a DeviceAgent's does not, and the pause and
+    // close controls stay hidden.
+    const st = g.standing;
+    const known = !!st && (st.status === 200 || st.status === 410);
+    $('gateway-pause').hidden = !known || !!st.closed || !!st.paused;
+    $('gateway-resume').hidden = !known || !!st.closed || !st.paused;
+    $('gateway-close').hidden = !known || !!st.closed;
+    if (known && st.closed) GATEWAY_WORD.textContent += ' — this address is closed';
+    else if (known && st.paused) GATEWAY_WORD.textContent += st.pausedBy === 'owner' ? ' — paused by you' : ' — paused';
   } else {
     GATEWAY_WORD.textContent = '';
     GW_OPEN_ATTACH.hidden = false;
     GW_OPEN_DETACH.hidden = true;
+    for (const id of ['gateway-pause', 'gateway-resume', 'gateway-close']) $(id).hidden = true;
   }
 }
+const setPausedAtGateway = async (paused) => {
+  const r = await write('/gateway/pause', { paused },
+    paused ? 'paused — posts sent to you are not kept until you resume; follows still arrive'
+      : 'resumed — posts sent to you are kept again');
+  if (r) refreshGateway();
+};
+$('gateway-pause').addEventListener('click', () => setPausedAtGateway(true));
+$('gateway-resume').addEventListener('click', () => setPausedAtGateway(false));
 const gwShape = () => document.querySelector('input[name=gwShape]:checked')?.value || 'pod';
 function gwPreviews() {
   $('gw-pod-preview').textContent = config?.address || `@${config?.handle || 'you'}@your.pod`;
@@ -43,6 +62,9 @@ GW_OPEN_ATTACH.addEventListener('click', () => {
 });
 GW_OPEN_DETACH.addEventListener('click', () => {
   $('gw-detach-fronted').hidden = !gwState?.frontActor;
+  // The move-in hint exists only in the browser build (see index.html).
+  const moveHint = $('gw-move-hint-browser');
+  if (moveHint) moveHint.hidden = !gwState?.frontActor;
   $('gw-detach-plain').hidden = !!gwState?.frontActor;
   solWindow.show('gateway-detach-form', 'Detach from gateway');
 });

package/web/admin/index.html

@@ -165,7 +165,7 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
   fieldset { border-color: #555; } .rows li { border-color: #444; }
 }
 </style>
-<link rel="stylesheet" href="bar.css?v=3">
+<link rel="stylesheet" href="bar.css?v=4">
 <link rel="stylesheet" href="window.css">
 </head>
 <body>
@@ -175,8 +175,16 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
   <h1 class="name">FediPod</h1>
   <select id="actor-pick" aria-label="Local actors"
     title="   Every actor on this machine; choosing one goes to its record"></select>
-  <a id="bar-fediverse" href="client/" title="   Open the client and read your timeline">visit account</a>
-  <a id="bar-manage" href="./" title="   The record: what this actor is, and what you can do to it" aria-current="page">manage account</a>
+  <!-- The account group, styled like the client group beside it: one label,
+       then the places to go. The browser build adds "sign out" to it. -->
+  <span id="account-pick"><span id="account-now">account:</span>
+  <a id="bar-fediverse" href="client/" title="   Open the client and read your timeline">visit</a>
+  <a id="bar-manage" href="./" title="   The record: what this actor is, and what you can do to it" aria-current="page">manage</a>
+  </span>
+  <!-- Notices from whoever runs this site. Shown only when the site has any
+       (notices-bar.js asks /api/notices); the count is how many are new here. -->
+  <button type="button" id="bar-notices" hidden aria-haspopup="dialog" aria-controls="notices-list"
+    title="   Notices from the operator of this site">&#128276;<span id="bar-notices-count" aria-live="polite"></span></button>
 </nav>
 <main id="page">
 
@@ -321,6 +329,14 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
     title="   Attach this account to a mail-filtering gateway">Attach to a gateway</button>
   <button type="button" id="gateway-open-detach" class="inline danger" hidden
     title="   Go back to your pod's own inbox">Detach from gateway</button>
+  <!-- Shown only when the agent reports the account's standing at the gateway
+       (the browser build does; a DeviceAgent's admin does not). -->
+  <button type="button" id="gateway-pause" class="inline" hidden
+    title="   Stop keeping the posts sent to you until you resume; follows still arrive">Pause my account</button>
+  <button type="button" id="gateway-resume" class="inline" hidden
+    title="   Keep the posts sent to you again">Resume my account</button>
+  <button type="button" id="gateway-close" class="inline danger" hidden data-confirm="close-address"
+    title="   Close your address at this gateway for good; nothing on your pod is touched">Close this address</button>
 </span>
 
 <section id="pane-group" hidden>
@@ -486,6 +502,12 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
   <p class="warn" id="gw-detach-fronted" hidden>This identity publishes under the gateway's
     name. Detaching moves every published id back to the pod — a rename other servers
     see, not just a mail change.</p>
+  <!-- Browser build only: stage-site.mjs renames this id to gw-move-hint-browser,
+       and gateway.js shows it for an address that lives at a gateway. The
+       DeviceAgent has no move-in yet, so here it stays hidden under this id. -->
+  <p class="hint" id="gw-move-hint" hidden>To move this address to another gateway, open that
+    gateway, choose “create an account”, and sign in with this pod. Your posts, followers and
+    key come with you, and your followers are told the new address.</p>
   <p>
     <button id="gw-detach" type="button" class="primary"
       title="   Forget the gateway and republish the actor with the pod inbox">Detach</button>
@@ -495,15 +517,6 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
   <div id="warn-rotate-key" class="warn" hidden>
     <p>A new keypair replaces the one in this home and the actor is republished so other
       servers learn it. Any other device still holding the old key stops being able to sign.</p>
-    <!-- Browser build only: there the key on the pod is locked under the account
-         password, so a new one has to be locked too. The Node agent keeps its key
-         on disk and needs nothing here — stage-site.mjs reveals this row. -->
-    <div id="rotate-pw-row" hidden>
-      <label for="rotate-password">Your account password</label>
-      <input type="password" id="rotate-password" autocomplete="current-password">
-      <p class="hint">Your signing key is kept on your pod locked under this, so the
-        replacement has to be locked under it too. It is not sent anywhere else.</p>
-    </div>
   </div>
   <div id="warn-retire" class="warn" hidden>
     <p><strong>This cannot be undone.</strong> A Delete goes to every follower's inbox telling
@@ -519,6 +532,14 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
     <label for="confirm-handle">Type the handle to confirm</label>
     <input type="text" id="confirm-handle" autocomplete="off">
   </div>
+  <div id="warn-close-address" class="warn" hidden>
+    <p><strong>This cannot be undone.</strong> Your address at the gateway is closed for good:
+      mail to it is turned away, other servers drop the account the next time they look, and
+      nobody can take the name. Nothing on your pod is touched — your posts, key and data stay
+      where they are.</p>
+    <label for="confirm-handle-close">Type the handle to confirm</label>
+    <input type="text" id="confirm-handle-close" autocomplete="off">
+  </div>
   <!-- "Move private data" (POST /state-move) had a panel here and no way to
        open it: nothing in this page has ever carried data-confirm="move-state",
        so the panel was only ever hidden. Removed 2026-09-09 rather than left as
@@ -559,5 +580,24 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
 <script src="group.js"></script>
 <script src="upkeep.js"></script>
 <script src="gateway.js"></script>
+
+<!-- The notices: the list, and one notice open. Declared here and filled by
+     notices-bar.js from /api/notices; nothing in them is markup from a notice. -->
+<dialog id="notices-list" aria-labelledby="notices-title">
+  <section>
+    <h2 id="notices-title">Notices</h2>
+    <ul id="notices-items"></ul>
+    <p class="row"><button type="button" id="notices-close" class="primary" title="   Close the list of notices">Close</button></p>
+  </section>
+</dialog>
+<dialog id="notice-view" aria-labelledby="notice-view-title">
+  <section>
+    <h2 id="notice-view-title"></h2>
+    <p class="when" id="notice-view-when"></p>
+    <div id="notice-view-body"></div>
+    <p class="row"><button type="button" id="notice-view-close" class="primary" title="   Back to the list of notices">Close</button></p>
+  </section>
+</dialog>
+<script src="notices-bar.js"></script>
 </body>
 </html>