fedipod-server 0.26.0 → 0.28.1

package/web/admin/bar.css

@@ -62,16 +62,32 @@ body { background: var(--surface); }
    quieter than the links; the one in use is marked `aria-current="true"` — the
    current item of a set, which on the record page is not the current PAGE — so
    it needs its own mark rather than borrowing the rule above. */
-#bar #client-pick { display: inline-flex; gap: .6rem; align-items: baseline;
+#bar #client-pick, #bar #account-pick { display: inline-flex; gap: .6rem; align-items: baseline;
   white-space: nowrap; margin-left: 1rem; }
-#bar #client-now { opacity: .75; }
+#bar #client-now, #bar #account-now { opacity: .75; }
+/* The notices bell: the one filled control in the bar, because it is the one
+   thing there that is not a place to go but something to be told. The count is
+   how many notices this browser has not opened yet; with none it is quiet. */
+#bar #bar-notices { display: inline-flex; align-items: center; gap: .35rem; margin-left: 1rem;
+  padding: .3rem .7rem; border-radius: 999px; font-size: 1.05rem; line-height: 1;
+  background: var(--btn); color: var(--btn-text); border: 1px solid var(--btn); }
+/* `display` on an id rule outranks the browser's own [hidden] rule, and the
+   shell has no !important of its own, so the bell hid on the record page and
+   showed on the client with nothing to show. Said here, once, for every page. */
+#bar #bar-notices[hidden] { display: none; }
+#bar #bar-notices:hover { background: var(--btn-hover); border-color: var(--btn-hover); }
+#bar #bar-notices:focus-visible { outline: 3px solid var(--ring); outline-offset: 2px; }
+#bar #bar-notices-count { font-size: .9rem; font-weight: 700; min-width: 1.3em; text-align: center;
+  padding: .05rem .4rem; border-radius: 999px; background: var(--btn-text); color: var(--btn); }
+#bar #bar-notices-count:empty { display: none; }
+#bar #bar-notices[data-new="0"] { background: var(--field-bg); color: var(--ink); border-color: var(--field-edge); }
 #bar a[aria-current="true"] {
   font-weight: 700; text-decoration: underline; text-underline-offset: .3rem; }
 
 /* The two-clients notice: said once, to somebody who knew this page when it
    had one client. Sized and placed rather than left to the browser's default,
    which stretched it edge to edge and put it over the very links it names. */
-#client-news {
+#client-news, #notices-list, #notice-view {
   /* Low rather than centred: it points at the links in the bar, so the bar has
      to stay in view while it is read. */
   max-width: 34rem; margin: auto auto 2.5rem; padding: 1.5rem 1.7rem;
@@ -80,13 +96,31 @@ body { background: var(--surface); }
   font: 1rem/1.55 var(--font);
   box-shadow: 0 .6rem 2rem rgba(0, 0, 0, .25);
 }
-#client-news::backdrop { background: rgba(0, 0, 0, .45); }
-#client-news h2 { font-size: 1.25rem; margin: 0 0 .9rem; color: var(--heading); }
-#client-news p { margin: 0 0 1.2rem; }
-#client-news p:last-child { margin: 0; }
-#client-news button {
+#client-news::backdrop, #notices-list::backdrop, #notice-view::backdrop { background: rgba(0, 0, 0, .45); }
+#client-news h2, #notices-list h2, #notice-view h2 { font-size: 1.25rem; margin: 0 0 .9rem; color: var(--heading); }
+#client-news p, #notices-list p, #notice-view p { margin: 0 0 1.2rem; }
+#client-news p:last-child, #notices-list p:last-child, #notice-view p:last-child { margin: 0; }
+#client-news button, #notices-list button, #notice-view button {
   font: inherit; padding: .55rem 1.3rem; border-radius: .35rem; cursor: pointer;
   background: var(--btn); color: var(--btn-text); border: 1px solid var(--btn);
 }
-#client-news button:hover { background: var(--btn-hover); border-color: var(--btn-hover); }
-#client-news button:focus-visible { outline: 3px solid var(--ring); outline-offset: 2px; }
+#client-news button:hover, #notices-list button:hover, #notice-view button:hover { background: var(--btn-hover); border-color: var(--btn-hover); }
+#client-news button:focus-visible, #notices-list button:focus-visible, #notice-view button:focus-visible { outline: 3px solid var(--ring); outline-offset: 2px; }
+
+/* The notices dialogs are centred and never taller than the window: the
+   client-news rule above sits low, and a short window pushed a list of
+   notices up past the top edge where nothing could reach it. */
+#notices-list, #notice-view { margin: auto; max-height: calc(100dvh - 3rem); overflow: auto; box-sizing: border-box; }
+/* The list of notices: each title a button that opens that notice, the date
+   beside it, the ones not yet opened here in bold. */
+#notices-items { list-style: none; margin: 0 0 1.2rem; padding: 0; }
+#notices-items li { display: flex; gap: .8rem; align-items: baseline; padding: .45rem 0;
+  border-bottom: 1px solid var(--line); }
+#notices-items li:last-child { border-bottom: 0; }
+#notices-items button.notice-open { flex: 1 1 auto; text-align: left; padding: .1rem 0;
+  background: none; border: 0; color: var(--link); text-decoration: underline; text-underline-offset: .2rem; }
+#notices-items li.new button.notice-open { font-weight: 700; }
+#notices-items .when, #notice-view .when { color: var(--sub); font-size: .9rem; white-space: nowrap; }
+#notices-items p.none { color: var(--sub); }
+#notice-view-body p { margin: 0 0 .9rem; }
+#notice-view-body a { color: var(--link); word-break: break-all; }

package/web/admin/client/index.html

@@ -28,8 +28,16 @@ main { flex: 1 1 auto; min-height: 0; display: flex; }
   <h1 class="name">FediPod</h1>
   <select id="actor-pick" aria-label="Local actors"
     title="   Every actor on this machine; choosing one opens its client"></select>
-  <a id="bar-fediverse" href="./" title="   Open the client and read your timeline" aria-current="page">visit account</a>
-  <a id="bar-manage" href="../" title="   The record: what this actor is, and what you can do to it">manage account</a>
+  <!-- The account group, styled like the client group beside it: one label,
+       then the places to go. The browser build adds "sign out" to it. -->
+  <span id="account-pick"><span id="account-now">account:</span>
+  <a id="bar-fediverse" href="./" title="   Open the client and read your timeline" aria-current="page">visit</a>
+  <a id="bar-manage" href="../" title="   The record: what this actor is, and what you can do to it">manage</a>
+  </span>
+  <!-- Notices from whoever runs this site. Shown only when the site has any
+       (notices-bar.js asks /api/notices); the count is how many are new here. -->
+  <button type="button" id="bar-notices" hidden aria-haspopup="dialog" aria-controls="notices-list"
+    title="   Notices from the operator of this site">&#128276;<span id="bar-notices-count" aria-live="polite"></span></button>
 </nav>
 
 <main>
@@ -38,5 +46,24 @@ main { flex: 1 1 auto; min-height: 0; display: flex; }
 
 <script src="../bar.js"></script>
 <script src="client.js"></script>
+
+<!-- The notices: the list, and one notice open. Declared here and filled by
+     notices-bar.js from /api/notices; nothing in them is markup from a notice. -->
+<dialog id="notices-list" aria-labelledby="notices-title">
+  <section>
+    <h2 id="notices-title">Notices</h2>
+    <ul id="notices-items"></ul>
+    <p class="row"><button type="button" id="notices-close" class="primary" title="   Close the list of notices">Close</button></p>
+  </section>
+</dialog>
+<dialog id="notice-view" aria-labelledby="notice-view-title">
+  <section>
+    <h2 id="notice-view-title"></h2>
+    <p class="when" id="notice-view-when"></p>
+    <div id="notice-view-body"></div>
+    <p class="row"><button type="button" id="notice-view-close" class="primary" title="   Back to the list of notices">Close</button></p>
+  </section>
+</dialog>
+<script src="../notices-bar.js"></script>
 </body>
 </html>

package/web/admin/gateway.js

@@ -18,12 +18,31 @@ async function refreshGateway() {
     GATEWAY_WORD.textContent = frontName ? `${host} — publishing as @${frontName}@${host}` : host;
     GW_OPEN_ATTACH.hidden = true;
     GW_OPEN_DETACH.hidden = false;
+    // The account's standing at the gateway — paused, closed. The browser
+    // build's agent reports it; a DeviceAgent's does not, and the pause and
+    // close controls stay hidden.
+    const st = g.standing;
+    const known = !!st && (st.status === 200 || st.status === 410);
+    $('gateway-pause').hidden = !known || !!st.closed || !!st.paused;
+    $('gateway-resume').hidden = !known || !!st.closed || !st.paused;
+    $('gateway-close').hidden = !known || !!st.closed;
+    if (known && st.closed) GATEWAY_WORD.textContent += ' — this address is closed';
+    else if (known && st.paused) GATEWAY_WORD.textContent += st.pausedBy === 'owner' ? ' — paused by you' : ' — paused';
   } else {
     GATEWAY_WORD.textContent = '';
     GW_OPEN_ATTACH.hidden = false;
     GW_OPEN_DETACH.hidden = true;
+    for (const id of ['gateway-pause', 'gateway-resume', 'gateway-close']) $(id).hidden = true;
   }
 }
+const setPausedAtGateway = async (paused) => {
+  const r = await write('/gateway/pause', { paused },
+    paused ? 'paused — posts sent to you are not kept until you resume; follows still arrive'
+      : 'resumed — posts sent to you are kept again');
+  if (r) refreshGateway();
+};
+$('gateway-pause').addEventListener('click', () => setPausedAtGateway(true));
+$('gateway-resume').addEventListener('click', () => setPausedAtGateway(false));
 const gwShape = () => document.querySelector('input[name=gwShape]:checked')?.value || 'pod';
 function gwPreviews() {
   $('gw-pod-preview').textContent = config?.address || `@${config?.handle || 'you'}@your.pod`;
@@ -43,6 +62,9 @@ GW_OPEN_ATTACH.addEventListener('click', () => {
 });
 GW_OPEN_DETACH.addEventListener('click', () => {
   $('gw-detach-fronted').hidden = !gwState?.frontActor;
+  // The move-in hint exists only in the browser build (see index.html).
+  const moveHint = $('gw-move-hint-browser');
+  if (moveHint) moveHint.hidden = !gwState?.frontActor;
   $('gw-detach-plain').hidden = !!gwState?.frontActor;
   solWindow.show('gateway-detach-form', 'Detach from gateway');
 });

package/web/admin/index.html

@@ -165,7 +165,7 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
   fieldset { border-color: #555; } .rows li { border-color: #444; }
 }
 </style>
-<link rel="stylesheet" href="bar.css?v=3">
+<link rel="stylesheet" href="bar.css?v=4">
 <link rel="stylesheet" href="window.css">
 </head>
 <body>
@@ -175,8 +175,16 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
   <h1 class="name">FediPod</h1>
   <select id="actor-pick" aria-label="Local actors"
     title="   Every actor on this machine; choosing one goes to its record"></select>
-  <a id="bar-fediverse" href="client/" title="   Open the client and read your timeline">visit account</a>
-  <a id="bar-manage" href="./" title="   The record: what this actor is, and what you can do to it" aria-current="page">manage account</a>
+  <!-- The account group, styled like the client group beside it: one label,
+       then the places to go. The browser build adds "sign out" to it. -->
+  <span id="account-pick"><span id="account-now">account:</span>
+  <a id="bar-fediverse" href="client/" title="   Open the client and read your timeline">visit</a>
+  <a id="bar-manage" href="./" title="   The record: what this actor is, and what you can do to it" aria-current="page">manage</a>
+  </span>
+  <!-- Notices from whoever runs this site. Shown only when the site has any
+       (notices-bar.js asks /api/notices); the count is how many are new here. -->
+  <button type="button" id="bar-notices" hidden aria-haspopup="dialog" aria-controls="notices-list"
+    title="   Notices from the operator of this site">&#128276;<span id="bar-notices-count" aria-live="polite"></span></button>
 </nav>
 <main id="page">
 
@@ -321,6 +329,14 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
     title="   Attach this account to a mail-filtering gateway">Attach to a gateway</button>
   <button type="button" id="gateway-open-detach" class="inline danger" hidden
     title="   Go back to your pod's own inbox">Detach from gateway</button>
+  <!-- Shown only when the agent reports the account's standing at the gateway
+       (the browser build does; a DeviceAgent's admin does not). -->
+  <button type="button" id="gateway-pause" class="inline" hidden
+    title="   Stop keeping the posts sent to you until you resume; follows still arrive">Pause my account</button>
+  <button type="button" id="gateway-resume" class="inline" hidden
+    title="   Keep the posts sent to you again">Resume my account</button>
+  <button type="button" id="gateway-close" class="inline danger" hidden data-confirm="close-address"
+    title="   Close your address at this gateway for good; nothing on your pod is touched">Close this address</button>
 </span>
 
 <section id="pane-group" hidden>
@@ -486,6 +502,12 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
   <p class="warn" id="gw-detach-fronted" hidden>This identity publishes under the gateway's
     name. Detaching moves every published id back to the pod — a rename other servers
     see, not just a mail change.</p>
+  <!-- Browser build only: stage-site.mjs renames this id to gw-move-hint-browser,
+       and gateway.js shows it for an address that lives at a gateway. The
+       DeviceAgent has no move-in yet, so here it stays hidden under this id. -->
+  <p class="hint" id="gw-move-hint" hidden>To move this address to another gateway, open that
+    gateway, choose “create an account”, and sign in with this pod. Your posts, followers and
+    key come with you, and your followers are told the new address.</p>
   <p>
     <button id="gw-detach" type="button" class="primary"
       title="   Forget the gateway and republish the actor with the pod inbox">Detach</button>
@@ -495,15 +517,6 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
   <div id="warn-rotate-key" class="warn" hidden>
     <p>A new keypair replaces the one in this home and the actor is republished so other
       servers learn it. Any other device still holding the old key stops being able to sign.</p>
-    <!-- Browser build only: there the key on the pod is locked under the account
-         password, so a new one has to be locked too. The Node agent keeps its key
-         on disk and needs nothing here — stage-site.mjs reveals this row. -->
-    <div id="rotate-pw-row" hidden>
-      <label for="rotate-password">Your account password</label>
-      <input type="password" id="rotate-password" autocomplete="current-password">
-      <p class="hint">Your signing key is kept on your pod locked under this, so the
-        replacement has to be locked under it too. It is not sent anywhere else.</p>
-    </div>
   </div>
   <div id="warn-retire" class="warn" hidden>
     <p><strong>This cannot be undone.</strong> A Delete goes to every follower's inbox telling
@@ -519,6 +532,14 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
     <label for="confirm-handle">Type the handle to confirm</label>
     <input type="text" id="confirm-handle" autocomplete="off">
   </div>
+  <div id="warn-close-address" class="warn" hidden>
+    <p><strong>This cannot be undone.</strong> Your address at the gateway is closed for good:
+      mail to it is turned away, other servers drop the account the next time they look, and
+      nobody can take the name. Nothing on your pod is touched — your posts, key and data stay
+      where they are.</p>
+    <label for="confirm-handle-close">Type the handle to confirm</label>
+    <input type="text" id="confirm-handle-close" autocomplete="off">
+  </div>
   <!-- "Move private data" (POST /state-move) had a panel here and no way to
        open it: nothing in this page has ever carried data-confirm="move-state",
        so the panel was only ever hidden. Removed 2026-09-09 rather than left as
@@ -559,5 +580,24 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
 <script src="group.js"></script>
 <script src="upkeep.js"></script>
 <script src="gateway.js"></script>
+
+<!-- The notices: the list, and one notice open. Declared here and filled by
+     notices-bar.js from /api/notices; nothing in them is markup from a notice. -->
+<dialog id="notices-list" aria-labelledby="notices-title">
+  <section>
+    <h2 id="notices-title">Notices</h2>
+    <ul id="notices-items"></ul>
+    <p class="row"><button type="button" id="notices-close" class="primary" title="   Close the list of notices">Close</button></p>
+  </section>
+</dialog>
+<dialog id="notice-view" aria-labelledby="notice-view-title">
+  <section>
+    <h2 id="notice-view-title"></h2>
+    <p class="when" id="notice-view-when"></p>
+    <div id="notice-view-body"></div>
+    <p class="row"><button type="button" id="notice-view-close" class="primary" title="   Back to the list of notices">Close</button></p>
+  </section>
+</dialog>
+<script src="notices-bar.js"></script>
 </body>
 </html>

package/web/admin/notices-bar.js

@@ -0,0 +1,90 @@
+// notices-bar.js — the notices bell in the bar, on every page of ours.
+//
+// Whoever runs the site writes notices (the /notices page, admin only); every
+// signed-in account sees the bell. This asks /api/notices once per page load,
+// hides the bell where the site has none to offer (a DeviceAgent's own pages
+// answer no such thing), lists the titles, and opens one notice at a time.
+// Which notices this browser has already opened is this browser's business
+// alone, so it lives in localStorage and nowhere else.
+//
+// Every element here is declared in the page's markup; this fills them.
+(() => {
+  const bell = document.getElementById('bar-notices');
+  const list = document.getElementById('notices-list');
+  const view = document.getElementById('notice-view');
+  if (!bell || !list || !view) return;
+  const $ = (id) => document.getElementById(id);
+  const SEEN = 'fedipod-notices-seen';
+  const readSeen = () => { try { return JSON.parse(localStorage.getItem(SEEN) || '[]'); } catch { return []; } };
+  const writeSeen = (ids) => { try { localStorage.setItem(SEEN, JSON.stringify(ids.slice(-200))); } catch { /* keeps no site data */ } };
+
+  const when = (iso) => { try { return new Date(iso).toLocaleDateString(undefined, { year: 'numeric', month: 'short', day: 'numeric' }); } catch { return ''; } };
+
+  // A notice's body is plain text: paragraphs at blank lines, and a bare
+  // https link becomes a link. Nothing in it is ever read as markup.
+  const renderBody = (el, text) => {
+    el.textContent = '';
+    for (const para of String(text || '').split(/\n\s*\n/u)) {
+      const p = document.createElement('p');
+      for (const part of para.split(/(https?:\/\/[^\s<>"']+)/u)) {
+        if (/^https?:\/\//u.test(part)) {
+          const a = document.createElement('a');
+          a.href = part; a.textContent = part; a.target = '_blank'; a.rel = 'noopener';
+          p.append(a);
+        } else p.append(part);
+      }
+      el.append(p);
+    }
+  };
+
+  let notices = [];
+  const render = () => {
+    const seen = new Set(readSeen());
+    const fresh = notices.filter((n) => !seen.has(n.id)).length;
+    $('bar-notices-count').textContent = fresh ? String(fresh) : '';
+    bell.dataset.new = String(fresh);
+    bell.setAttribute('aria-label', fresh ? `Notices, ${fresh} new` : 'Notices');
+    const ul = $('notices-items');
+    ul.textContent = '';
+    if (!notices.length) {
+      const p = document.createElement('p'); p.className = 'none'; p.textContent = 'No notices.';
+      ul.append(p);
+      return;
+    }
+    for (const n of notices) {
+      const li = document.createElement('li');
+      if (!seen.has(n.id)) li.classList.add('new');
+      const b = document.createElement('button');
+      b.type = 'button'; b.className = 'notice-open'; b.textContent = n.title;
+      b.addEventListener('click', () => open(n));
+      const w = document.createElement('span'); w.className = 'when'; w.textContent = when(n.at);
+      li.append(b, w);
+      ul.append(li);
+    }
+  };
+
+  const open = (n) => {
+    $('notice-view-title').textContent = n.title;
+    $('notice-view-when').textContent = when(n.at);
+    renderBody($('notice-view-body'), n.body);
+    const seen = readSeen();
+    if (!seen.includes(n.id)) { seen.push(n.id); writeSeen(seen); }
+    render();
+    list.close();
+    view.showModal();
+  };
+
+  bell.addEventListener('click', () => { render(); list.showModal(); });
+  $('notices-close').addEventListener('click', () => list.close());
+  $('notice-view-close').addEventListener('click', () => { view.close(); list.showModal(); });
+
+  fetch(location.origin + '/api/notices', { headers: { accept: 'application/json' } })
+    .then((r) => (r.ok ? r.json() : null))
+    .then((j) => {
+      if (!j || !Array.isArray(j.notices)) return;
+      notices = j.notices;
+      render();
+      bell.hidden = false;
+    })
+    .catch(() => { /* no site notices here; the bell stays hidden */ });
+})();

package/web/admin/record.js

@@ -61,6 +61,18 @@ async function load() {
     $('fatal').appendChild(a);
     return;
   }
+  // No agent answering on this browser: nobody is signed in here (the
+  // worker answers 503 with no session, and nothing answers at all before
+  // the worker exists). Say so, with the way on, rather than the reason.
+  if (status === 503 || status === 404) {
+    $('fatal').textContent = 'Not signed in on this browser. Sign in ';
+    const a = document.createElement('a');
+    a.href = '/';
+    a.textContent = 'here';
+    $('fatal').appendChild(a);
+    $('fatal').appendChild(document.createTextNode('.'));
+    return;
+  }
   if (status !== 200 || !json) {
     $('fatal').textContent = json?.error || `could not read the record (HTTP ${status})`;
     return;
@@ -82,8 +94,8 @@ function resetConfirm() {
   for (const k of Object.keys(LIFECYCLE)) $(`warn-${k}`)?.hidden !== undefined && ($(`warn-${k}`).hidden = true);
   $('confirm-handle').value = '';
   $('confirm-handle-move').value = '';
+  $('confirm-handle-close').value = '';
   $('move-target').value = '';
-  $('rotate-password').value = '';
 }
 function closePanels(keep = null) {
   if (!keep) solWindow.close();

package/web/admin/setup/index.html

@@ -59,8 +59,16 @@ button:disabled { opacity: .5; cursor: default; }
 <nav id="bar" aria-label="Site">
   <h1 class="name">FediPod</h1>
   <span id="bar-handle"></span>
-  <a id="bar-fediverse" href="../client/" title="   Open the client and read your timeline">visit account</a>
-  <a id="bar-manage" href="../" title="   The record: what this actor is, and what you can do to it">manage account</a>
+  <!-- The account group, styled like the client group beside it: one label,
+       then the places to go. The browser build adds "sign out" to it. -->
+  <span id="account-pick"><span id="account-now">account:</span>
+  <a id="bar-fediverse" href="../client/" title="   Open the client and read your timeline">visit</a>
+  <a id="bar-manage" href="../" title="   The record: what this actor is, and what you can do to it">manage</a>
+  </span>
+  <!-- Notices from whoever runs this site. Shown only when the site has any
+       (notices-bar.js asks /api/notices); the count is how many are new here. -->
+  <button type="button" id="bar-notices" hidden aria-haspopup="dialog" aria-controls="notices-list"
+    title="   Notices from the operator of this site">&#128276;<span id="bar-notices-count" aria-live="polite"></span></button>
   <a id="bar-add" href="../?new=1" title="   Set up another actor on this machine, with its own pod" aria-current="page">add new account</a>
 </nav>
 <main id="page">
@@ -210,5 +218,24 @@ button:disabled { opacity: .5; cursor: default; }
 <script src="../bar.js"></script>
 <script src="../common.js"></script>
 <script src="setup.js"></script>
+
+<!-- The notices: the list, and one notice open. Declared here and filled by
+     notices-bar.js from /api/notices; nothing in them is markup from a notice. -->
+<dialog id="notices-list" aria-labelledby="notices-title">
+  <section>
+    <h2 id="notices-title">Notices</h2>
+    <ul id="notices-items"></ul>
+    <p class="row"><button type="button" id="notices-close" class="primary" title="   Close the list of notices">Close</button></p>
+  </section>
+</dialog>
+<dialog id="notice-view" aria-labelledby="notice-view-title">
+  <section>
+    <h2 id="notice-view-title"></h2>
+    <p class="when" id="notice-view-when"></p>
+    <div id="notice-view-body"></div>
+    <p class="row"><button type="button" id="notice-view-close" class="primary" title="   Back to the list of notices">Close</button></p>
+  </section>
+</dialog>
+<script src="../notices-bar.js"></script>
 </body>
 </html>

package/web/admin/upkeep.js

@@ -76,6 +76,9 @@ const LIFECYCLE = {
   retire: { path: '/retire', title: 'Retire this identity', go: 'Retire it', danger: true, done: (r) => `retired ${r.deletedAt}: Delete delivered to ${r.inboxes} inbox(es)` },
   move: { path: '/move', title: 'Transfer this account away', go: 'Transfer it', focus: 'move-target',
     done: (r) => `transferred to ${r.target}: Move delivered to ${r.inboxes} inbox(es), unfollowed ${r.unfollowed}/${r.following}` },
+  // The address at the gateway, not the identity: the pod keeps everything.
+  'close-address': { path: '/gateway/close', title: 'Close this address', go: 'Close it', danger: true, focus: 'confirm-handle-close',
+    done: (r) => (r.closed ? 'closed — this address is gone for good; everything on your pod is untouched' : 'not closed') },
 };
 let pending = null;
 
@@ -119,11 +122,7 @@ $('confirm-form').addEventListener('submit', async (ev) => {
   const what = pending;
   const body = what === 'retire' ? { confirm: $('confirm-handle').value.trim() }
     : what === 'move' ? { target: $('move-target').value.trim(), confirm: $('confirm-handle-move').value.trim() }
-      // Only where the field is shown (the browser build — see index.html).
-      // On the Node agent the row stays hidden and nothing is sent, which is
-      // what that agent expects.
-      : what === 'rotate-key' && !$('rotate-pw-row').hidden
-        ? { password: $('rotate-password').value }
+      : what === 'close-address' ? { confirm: $('confirm-handle-close').value.trim() }
         : {};
   if (what === 'move' && !body.target) { say('name the account to transfer to', 'err'); return; }
   $('confirm-go').disabled = true;

package/web/app/README.md

@@ -5,10 +5,11 @@ See `claude/plans/browser-agent.md` for the whole design and status.
 
 | file | what |
 |---|---|
-| `pod-auth.mjs` | The pod side of sign-in, browser-native: create a CSS account + pod, mint a client credential, and a DPoP-bound `fetch` that writes to the pod. The twin of `lib/device/account.mjs` + `vendor/idp-grant.cjs`. |
-| `keystore.mjs` | WebCrypto RSA/Ed25519 key generation, and wrapping the keys under the account password (PBKDF2-SHA256 + AES-GCM-256). The pod holds only the wrapped form, so the pod's host cannot sign as you. |
-| `keys-browser.mjs` | Importing a keys record for signing, and finding one: this browser's opened copy in IndexedDB first, else the pod's. A wrapped one the browser has not opened yet raises `KeyPasswordNeeded`, which `boot.mjs` answers with the unlock pane — once per browser. The same pane offers a new key wrapped under the password used now, for someone who no longer has the sign-up password. |
-| `signup.mjs` | The `fedipod setup` flow, in the browser, up to publish: account, pod, credential, keys locked on the pod (owner-only ACL written *before* the key). Produces the credential/keys/config shapes the agent already reads. |
+| `pod-auth.mjs` | A CSS account API client, browser-native: create an account + pod, mint a client credential, and a DPoP-bound `fetch`. Since 1.28.0 the app itself uses none of it — a pod is made on the provider's own page and the app runs on the pod's Solid-OIDC login — but the harnesses do, to make scratch pods and stand in for a login form. The twin of `lib/device/account.mjs` + `vendor/idp-grant.cjs`. |
+| `keystore.mjs` | WebCrypto RSA/Ed25519 key generation. The key is stored on the pod as it is, in the owner-only state container, since 1.28.0 (2026-09-22); `unwrapKeys` remains for accounts from before then, whose key is under the sign-up password until it is opened once. |
+| `keys-browser.mjs` | Importing a keys record for signing, and finding one: this browser's opened copy in IndexedDB first, else the pod's, read with the pod session. A pre-1.28.0 envelope raises `KeyPasswordNeeded`, which `boot.mjs` answers with the open-once pane; the same pane offers a new key to someone who no longer has that password. |
+| `signup.mjs` | The `fedipod setup` flow, in the browser, up to publish, on the pod session the person already holds: pod check, gateway attach, key stored on the pod (owner-only ACL written *before* the key), config. Takes no password and no credential. Also `readAccount` (what the pod already holds) and `moveIn` (an address at another gateway moving here: attach fronted, rewrite the config with the old actor as an alias, restamp the key, leave the Move pending). |
+| `gateway-move.mjs` | The pending half of a move, run when the agent goes active under the new ids: tells the old gateway (`/api/move`) and sends the Move to every follower from the old actor, signed under the old key id through the old relay. Safe to run again. |
 | `shims/fedify-sig.mjs` | Browser stand-in for `@fedify/fedify/sig` (which will not bundle for a browser). `sign()` returns signed headers as data for the relay; `signRequest()` wraps it Fedify-shaped. Proven byte-identical to Fedify. |
 | `shims/node-crypto.mjs` | Browser stand-in for `node:crypto` — the small synchronous slice the agent uses, via crypto-browserify, plus native WebCrypto. |
 | `shims/safefetch.mjs` | Browser stand-in for `lib/shared/safefetch.mjs`. Pinning and the private-address checks are unnecessary here (a browser closes DNS rebinding itself); the BYTE BUDGET is not, so `readCapped` streams and stops at the cap exactly as the Node one does. |
@@ -26,7 +27,7 @@ Build: `node scripts/build-app.mjs`. Tests live in `claude/validation/`:
 | `deliver-relay.mjs` | lib's Deliverer, sending through the relay (a browser cannot set Date/Host). |
 | `agent.mjs` | Wires lib's store, publisher, intake and Mastodon facade with the browser edges. |
 | `sw-src.mjs` | The service worker that hosts the agent and answers the facade (Mastodon paths + the owner/manage paths); static files fall through. Built to `dist/sw.js`. |
-| `boot.mjs` | Page side: sign up / sign in, register the worker, hand it the boot material, route into `/admin/client/`; `?signout` / `?add` teardown. Built to `dist/boot.js`. |
+| `boot.mjs` | Page side: sign in at the pod (also the first half of sign-up), the identity screen on the way back, sign in by address, register the worker, route into `/admin/client/`; `?signout` / `?add` teardown. Built to `dist/boot.js`. |
 | `shims/` | Browser stand-ins the bundle needs: `node-crypto`, `node-path`, `node-url`, `node-fs`, `web-push`, `safefetch`, `prelude` (process + Buffer). |
 
 ## The manage surface & connected accounts (built 2026-09-08)
@@ -55,11 +56,14 @@ Tests: `claude/smoke-tests/admin-facade-smoke.mjs`, and eight harnesses in
 Solid server — `run` (the agent and the facade), `sw-run` (the same through the
 service worker, plus media upload and notification paging), `full-run` (the
 staged site, sign-up to Phanpy rendering), `unlock-run` (a browser with no opened
-key), `oidc-run`, `resume-run`, `gateway-run`, and `provider-csp-run` (the
-sign-up page's own policy, read from the browser's refusal reports). Three
-helpers sit beside them: `idp-login.mjs` fills the pod's login and consent
-screens, `worker-log.mjs` reads the agent's console out of the service worker,
-and the attach and relay stubs in `sw-run.mjs` stand in for the front.
+key, and a pre-1.28.0 account opened once), `oidc-run`, `resume-run`,
+`gateway-run`, and `provider-csp-run` (the sign-up page's own policy, read from
+the browser's refusal reports). Four helpers sit beside them: `idp-login.mjs`
+fills the pod's login and consent screens, `page-signup.mjs` drives the page
+through sign-up the way a person does since 1.28.0 (pod first, then the pod's
+login, then the identity screen), `worker-log.mjs` reads the agent's console
+out of the service worker, and the attach and relay stubs in `sw-run.mjs` stand
+in for the front.
 
 ## What this build does not have
 

package/web/app/admin-facade.mjs

@@ -33,6 +33,7 @@ export const ADMIN_PATHS = new Set([
   '/deadletter', '/blocks', '/profiles', '/modqueue', '/log', '/fediacct', '/describe', '/follow',
   '/atproto', '/atproto/connect', '/atproto/disconnect',
   '/rebuild', '/move', '/retire', '/inbox/prune', '/park', '/revive', '/takeover',
+  '/gateway/pause', '/gateway/close',
   '/fediacct/connect', '/fediacct/disconnect', '/fediacct/callback',
 ]);
 
@@ -138,6 +139,10 @@ export class AdminFacade {
             configured: !!(g && g.url), url: g?.url || null, webId: g?.webId || null,
             frontActor: g?.frontActor || null, mode: g?.mode || 'off', hasSecret: !!g?.hmacSecret,
             stats: a.store.read('gateway-stats.json', { verified: 0, unverified: 0, lastAt: null }),
+            // The account's standing at the gateway — paused, closed — as the
+            // gateway last said it (agent.mjs tellGateway). The record page
+            // shows its pause and close controls only when this is here.
+            standing: a.gatewayStanding || null,
           });
         }
         case '/deadletter': return json(200, { items: a.store.getDeadLetters() });
@@ -264,6 +269,25 @@ export class AdminFacade {
         return json(200, { ok: true, mode: a.status().mode });
       }
 
+      // The account's standing at its gateway: paused by its owner, or closed
+      // for good (front-core: accounts that go quiet). Both go to the gateway
+      // with the pod session as proof, and its answer is the new standing.
+      case '/gateway/pause': {
+        if (typeof body.paused !== 'boolean') return json(400, { error: 'paused must be true or false' });
+        if (!a.pauseAtGateway || !a.gatewayApi) return json(501, { error: 'this account is not at a gateway' });
+        const r = await a.pauseAtGateway(body.paused);
+        if (!r) return json(502, { error: 'the gateway could not be reached' });
+        return json(r.status === 200 ? 200 : r.status, r);
+      }
+      case '/gateway/close': {
+        const handle = String(a.store.getConfig()?.handle || '').toLowerCase();
+        if (!handle || String(body.confirm || '').toLowerCase() !== handle) return json(400, { error: 'type the handle to confirm' });
+        if (!a.closeAtGateway || !a.gatewayApi) return json(501, { error: 'this account is not at a gateway' });
+        const r = await a.closeAtGateway();
+        if (!r) return json(502, { error: 'the gateway could not be reached' });
+        return json(r.status === 200 ? 200 : r.status, r);
+      }
+
       // Going quiet, and coming back. The record page's active/parked select.
       case '/park': {
         if (!await a.requestTakeover?.()) return json(503, { error: 'another device is active for this pod — park from there' });
@@ -276,16 +300,8 @@ export class AdminFacade {
 
       case '/rotate-key': {
         await a.requestTakeover?.();
-        // The pod's copy of the key is wrapped under the account password, so a
-        // rotation has to be given one. 428 rather than 400: nothing is wrong
-        // with the request, something is required before it can be made.
-        try {
-          const r = await a.rotateKey({ password: body.password });
-          return json(200, { ok: true, changed: !!r?.changed });
-        } catch (e) {
-          if (e.code !== 'key-password-needed') throw e;
-          return json(428, { error: e.message, needsPassword: true });
-        }
+        const r = await a.rotateKey();
+        return json(200, { ok: true, changed: !!r?.changed });
       }
 
       // Recover posts this browser lost, from what the pod still holds.