fedipod-server 0.26.0 → 0.28.1

package/web/app/dist/sw.js

@@ -9700,6 +9700,7 @@ __export(wire_exports, {
   DEFAULT_ROOT: () => DEFAULT_ROOT,
   FOLLOWERS_PAGE_SIZE: () => FOLLOWERS_PAGE_SIZE,
   HASHTAG_RE: () => HASHTAG_RE,
+  LEMMY_CTX: () => LEMMY_CTX,
   MENTION_RE: () => MENTION_RE,
   OUTBOX_PAGE_SIZE: () => OUTBOX_PAGE_SIZE,
   POLICY_CTX: () => POLICY_CTX,
@@ -9812,7 +9813,8 @@ function actorDoc({
   inbox = null,
   outbox = null,
   oauthAuthorize = null,
-  oauthToken = null
+  oauthToken = null,
+  postingRestrictedToMods = null
 }) {
   const context = [AS_CTX, SEC_CTX];
   context.push({ toot: "http://joinmastodon.org/ns#", featured: { "@id": "toot:featured", "@type": "@id" } });
@@ -9835,6 +9837,7 @@ function actorDoc({
     });
   }
   if (webId || aliases.length) context.push({ alsoKnownAs: { "@id": "as:alsoKnownAs", "@type": "@id" } });
+  if (kind === "group" && postingRestrictedToMods !== null) context.push(LEMMY_CTX);
   if (fields.length) {
     context.push({ schema: "http://schema.org#", PropertyValue: "schema:PropertyValue", value: "schema:value" });
   }
@@ -9853,6 +9856,7 @@ function actorDoc({
     }] } : {},
     ...movedTo ? { movedTo } : {},
     ...webId || aliases.length ? { alsoKnownAs: [...webId ? [webId] : [], ...aliases] } : {},
+    ...kind === "group" && postingRestrictedToMods !== null ? { postingRestrictedToMods: !!postingRestrictedToMods } : {},
     preferredUsername: handle7,
     name: name || handle7,
     // The bio, and the avatar. For a group, `summary` is where what the group
@@ -10375,7 +10379,7 @@ function addRemoveActivity({ urls, type, object, target, serial }) {
     target
   };
 }
-var import_sanitize_html, AS_CTX, SEC_CTX, PUBLIC, DEFAULT_ROOT, assertionKeyId, OUTBOX_PAGE_SIZE, outboxPageId, outboxPageCount, outboxItemId, outboxWireItem, outboxLocalItem, FOLLOWERS_PAGE_SIZE, followersPageId, followersPageCount, ALLOWED_TAGS, ALLOWED_ATTRS, MAX_ATTACHMENTS, MAX_ATTACHMENT_URL, attachmentUrl, HTML_ESCAPES2, MENTION_RE, HASHTAG_RE, QUOTE_CTX, POLICY_CTX;
+var import_sanitize_html, AS_CTX, LEMMY_CTX, SEC_CTX, PUBLIC, DEFAULT_ROOT, assertionKeyId, OUTBOX_PAGE_SIZE, outboxPageId, outboxPageCount, outboxItemId, outboxWireItem, outboxLocalItem, FOLLOWERS_PAGE_SIZE, followersPageId, followersPageCount, ALLOWED_TAGS, ALLOWED_ATTRS, MAX_ATTACHMENTS, MAX_ATTACHMENT_URL, attachmentUrl, HTML_ESCAPES2, MENTION_RE, HASHTAG_RE, QUOTE_CTX, POLICY_CTX;
 var init_wire = __esm({
   "lib/core/wire.mjs"() {
     init_urls();
@@ -10383,6 +10387,7 @@ var init_wire = __esm({
     init_profile_page();
     import_sanitize_html = __toESM(require_sanitize_html(), 1);
     AS_CTX = "https://www.w3.org/ns/activitystreams";
+    LEMMY_CTX = "https://join-lemmy.org/context.json";
     SEC_CTX = "https://w3id.org/security/v1";
     PUBLIC = "https://www.w3.org/ns/activitystreams#Public";
     DEFAULT_ROOT = "fedipod/";
@@ -34281,9 +34286,11 @@ async function provisionPublic(pod, base) {
   await pod.setAcl(base, ["Read"]);
 }
 async function provisionPrivate(pod, urls) {
+  if (await exists(pod, urls.state)) return false;
   await pod.putJson(keepUrl(urls.state), KEEP, KEEP_CT);
   await pod.setAcl(urls.state, []);
   await pod.setAcl(urls.home, []);
+  return true;
 }
 async function repairPrivateAcls(pod, trees, { isPublic } = {}) {
   const findings = [];
@@ -34320,8 +34327,8 @@ async function probePrivateEnforcement(probe, podKeepUrl) {
 }
 
 // lib/pod/state.mjs
-var readWrappedKeys = (pod, urls) => pod.getJson(urls.state + "keys.json");
-var writeWrappedKeys = (pod, urls, envelope) => pod.putJson(urls.state + "keys.json", envelope, "application/json");
+var readKeys = (pod, urls) => pod.getJson(urls.state + "keys.json");
+var writeKeys = (pod, urls, keys) => pod.putJson(urls.state + "keys.json", keys, "application/json");
 
 // lib/core/store.mjs
 init_node_crypto();
@@ -34362,6 +34369,8 @@ function dropFollower(contacts, actor, why) {
   contacts.removedFollowers = gone.slice(-500);
   return contacts;
 }
+var serialise = (obj) => JSON.stringify(obj, null, 2) + "\n";
+var sameButWhen = (a, b) => JSON.stringify({ ...a, fetchedAt: null }) === JSON.stringify({ ...b, fetchedAt: null });
 var PodStore = class {
   constructor({ storage = null, log: log2 = console.log } = {}) {
     this.lastSkipped = [];
@@ -34369,6 +34378,7 @@ var PodStore = class {
     this.log = log2;
     this.cache = /* @__PURE__ */ new Map();
     this.etags = /* @__PURE__ */ new Map();
+    this.lastText = /* @__PURE__ */ new Map();
     this.timers = /* @__PURE__ */ new Map();
     this.dirty = /* @__PURE__ */ new Set();
     this._held = 0;
@@ -34382,6 +34392,7 @@ var PodStore = class {
     if (this.storage && this.storage.base !== storage.base) {
       this.cache.clear();
       this.etags.clear();
+      this.lastText.clear();
     }
     this.storage = storage;
   }
@@ -34423,6 +34434,7 @@ var PodStore = class {
       this.etags.set(name, r.etag);
       try {
         this.cache.set(name, JSON.parse(r.body));
+        this.lastText.set(name, r.body);
       } catch (e) {
         this.log(`state load ${name}: unparsable (${e.message})`);
       }
@@ -34445,6 +34457,12 @@ var PodStore = class {
   write(name, obj) {
     this.cache.set(name, structuredClone(obj));
     if (!this.storage) return;
+    if (this.lastText.get(name) === serialise(obj)) {
+      clearTimeout(this.timers.get(name));
+      this.timers.delete(name);
+      this.dirty.delete(name);
+      return;
+    }
     if (this._held) {
       this.dirty.add(name);
       return;
@@ -34488,10 +34506,13 @@ var PodStore = class {
   // the returned promise so one failure cannot poison the queue.
   _put(name) {
     const done = this.chain.then(async () => {
-      const body = JSON.stringify(this.cache.get(name), null, 2) + "\n";
+      const body = serialise(this.cache.get(name));
       for (let attempt = 1; attempt <= PUT_RETRIES; attempt++) {
         const r = await this.storage.write(name, body, "application/json").catch((e) => ({ ok: false, retry: false, why: e.message }));
-        if (r.ok) return true;
+        if (r.ok) {
+          this.lastText.set(name, body);
+          return true;
+        }
         if (!r.retry) {
           this.log(`state write ${name} refused (${r.why}) \u2014 not retrying`);
           return false;
@@ -34518,6 +34539,7 @@ var PodStore = class {
   // migrates to the local machine — leaving the copy behind would defeat it).
   async remove(name) {
     this.cache.delete(name);
+    this.lastText.delete(name);
     clearTimeout(this.timers.get(name));
     this.timers.delete(name);
     if (!this.storage) return true;
@@ -34768,6 +34790,7 @@ var PodStore = class {
   }
   cacheActor(url, doc) {
     const a = this.getActors();
+    const known2 = a[url];
     a[url] = {
       name: clamp(plainText(doc.name || doc.preferredUsername || ""), MAX_NAME),
       preferredUsername: clamp(plainText(doc.preferredUsername || ""), MAX_NAME),
@@ -34780,9 +34803,13 @@ var PodStore = class {
       type: doc.type || "Person",
       followers: doc.followers || null,
       following: doc.following || null,
-      ...a[url]?.counts ? { counts: a[url].counts } : {},
+      ...known2?.counts ? { counts: known2.counts } : {},
       fetchedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
+    if (known2 && sameButWhen(known2, a[url])) {
+      a[url] = known2;
+      return;
+    }
     this.write("actors.json", prune(a, ACTOR_CACHE_MAX, this.getContacts()));
   }
   // @user@host for an actor we have cached. Null when we have not, rather than
@@ -45482,11 +45509,11 @@ async function writeKeep(pod, urls) {
   await pod.putJson(urls.inbox + ".keep", { keep: true }, "application/json");
 }
 async function setPosture(pod, urls, posture) {
-  if (posture === "open") return pod.setAcl(urls.inbox, ["Append"]);
-  if (posture === "closed") return pod.setAcl(urls.inbox, []);
+  if (posture === "open") return pod.setAcl(urls.inbox, ["Append"], { ifChanged: true });
+  if (posture === "closed") return pod.setAcl(urls.inbox, [], { ifChanged: true });
   const webId = posture?.gatewayWebId;
   if (!webId) throw new Error(`inbox.setPosture: unknown posture ${JSON.stringify(posture)}`);
-  return pod.setAcl(urls.inbox, [], { appendAgents: [webId] });
+  return pod.setAcl(urls.inbox, [], { appendAgents: [webId], ifChanged: true });
 }
 async function list(pod, urls) {
   const children = await pod.listContainer(urls.inbox);
@@ -45503,6 +45530,9 @@ async function readDeliveryReceipt(pod, itemUrl, { maxBytes, readCapped: readCap
   return JSON.parse(await readCapped3(res, maxBytes));
 }
 var dropHandledItem = (pod, url) => pod.delete(url);
+var dropReceiptBeside = (pod, url) => pod.delete(url + ".receipt.json").catch(() => false);
+var orphanReceipts = (pod, urls) => pod.orphanReceipts?.(urls.inbox) ?? [];
+var dropStrayReceipt = (pod, url) => pod.delete(url).catch(() => false);
 
 // lib/pod/collection.mjs
 var PUBLIC_READ3 = ["Read"];
@@ -57180,6 +57210,9 @@ var Publisher = class {
       fields: this.config.fields || [],
       webId: this.remote.webId || null,
       aliases: this.config.aliases || [],
+      // A group says whether only its moderators may open posts (Lemmy's
+      // term); a person's actor carries nothing of the kind.
+      postingRestrictedToMods: this.config.kind === "group" ? !!this.config.postingRestrictedToMods : null,
       moderators,
       pendingFollowers: priv ? urls.pendingFollowers : null,
       pendingFollowing: priv ? urls.pendingFollowing : null,
@@ -63862,6 +63895,7 @@ var DRAIN_COOLDOWN_MAX_MS = 30 * 6e4;
 var DELETE_GAP_MS = 150;
 var CHAIN_GAP_MS = 5e3;
 var DELETE_BATCH = 10;
+var ORPHAN_RECEIPTS_PER_SWEEP = 20;
 var ATTEMPTS_DOC = "intake-attempts.json";
 var ATTEMPTS_TTL_MS = 7 * 24 * 60 * 6e4;
 var MAX_ITEM_ATTEMPTS = 5;
@@ -64132,6 +64166,7 @@ var Intake = class {
     if (all.length > items.length) this.log(`inbox has ${all.length} items \u2014 processing ${items.length} this sweep`);
     let handled = 0;
     const pending = [];
+    const withReceipt = /* @__PURE__ */ new Set();
     const flush = async () => {
       if (!pending.length) return true;
       if (!await this._persisted()) {
@@ -64146,12 +64181,14 @@ var Intake = class {
         }
         this._clearAttempt(url);
         handled++;
+        if (withReceipt.has(url)) await dropReceiptBeside(this.remote, url);
         await new Promise((r) => setTimeout(r, DELETE_GAP_MS));
       }
       return true;
     };
-    for (const { url, size } of items) {
+    for (const { url, size, receipt: hasReceipt } of items) {
       if (url.endsWith(".keep")) continue;
+      if (hasReceipt) withReceipt.add(url);
       if (size > MAX_ITEM_BYTES) {
         this.store.addDeadLetter({ inboxUrl: url, reason: `oversized (${size} bytes)`, activity: null });
         pending.push(url);
@@ -64177,7 +64214,7 @@ var Intake = class {
             });
           }
         }
-        const receipt = activity ? await this._readReceipt(url) : null;
+        const receipt = activity && hasReceipt !== false ? await this._readReceipt(url) : null;
         if (activity && this.gatewaySecret()) this._bumpGatewayStat(!!receipt?.verified);
         const owned = activity && this.isOwnerPost(receipt);
         const rejection = !activity ? "unparsable JSON" : owned ? await this.ownerPostFrom(activity, raw, receipt) : await this.handle(activity, receipt);
@@ -64204,6 +64241,10 @@ var Intake = class {
       if (pending.length >= DELETE_BATCH && !await flush()) return;
     }
     if (!await this._finishSweep(flush)) return;
+    for (const stray of orphanReceipts(this.remote, this.urls).slice(0, ORPHAN_RECEIPTS_PER_SWEEP)) {
+      if (!await dropStrayReceipt(this.remote, stray)) break;
+      await new Promise((r) => setTimeout(r, DELETE_GAP_MS));
+    }
     if (handled > 0 && all.length > items.length && !this.stopped) this._drainAgain = true;
   }
   // The end of a sweep: publish whatever the follow graph did ONCE, then flush.
@@ -65410,8 +65451,8 @@ var C2S = class {
 
 // lib/core/lease.mjs
 init_node_crypto();
-var TTL_MS = 3e5;
-var RENEW_MS = 9e4;
+var TTL_MS = 9e5;
+var RENEW_MS = 3e5;
 var JITTER = () => 0.85 + Math.random() * 0.3;
 var UNREADABLE = /* @__PURE__ */ Symbol("lease-unreadable");
 var Lease = class {
@@ -66487,6 +66528,7 @@ var BskyFeed = class {
     this.lastSweep = (/* @__PURE__ */ new Date()).toISOString();
     const self2 = this.atproto.read()?.did;
     let added = 0;
+    this.store.hold?.();
     try {
       const ownMirrors = new Set(this.store.getStatuses().map((s) => s.atproto?.uri).filter(Boolean));
       const tl = await this.atproto.xrpc("app.bsky.feed.getTimeline", { params: { limit: PER_SWEEP } });
@@ -66535,6 +66577,8 @@ var BskyFeed = class {
     } catch (e) {
       this._backOff(e.status || 0, null);
       return;
+    } finally {
+      this.store.release?.();
     }
     const all = this.store.getStatuses();
     const mirrored = all.filter((s) => s.kind === "bsky");
@@ -68832,7 +68876,29 @@ var PodTransport = class {
     const podTarget = this.toPod ? this.toPod(targetUrl) : targetUrl;
     const url = await this.aclUrlFor(podTarget);
     if (!await this.aclWritable(url)) return null;
-    return this.put(url, this.aclDoc(podTarget, publicModes, { ...opts, aclUrl: url }), "text/turtle");
+    const doc = this.aclDoc(podTarget, publicModes, { ...opts, aclUrl: url });
+    if (opts.ifChanged && await this.aclSame(url, doc)) return { status: 304, unchanged: true };
+    return this.put(url, doc, "text/turtle");
+  }
+  // Whether the pod's rule at `aclUrl` states exactly what `doc` states.
+  // Compared as graphs, not bytes: the pod serialises what it holds its own
+  // way. Every rule this file writes names its subjects, so triple sets are
+  // enough; anything unreadable or with blank nodes reads as different.
+  async aclSame(aclUrl, doc) {
+    try {
+      const res = await this.fetch(aclUrl, { headers: { accept: "text/turtle" } });
+      if (res.status !== 200) return false;
+      const triples = (text) => {
+        const g = graph();
+        parse2(text, g, aclUrl, "text/turtle");
+        if (g.statements.some((st2) => st2.subject.termType === "BlankNode" || st2.object.termType === "BlankNode")) return null;
+        return g.statements.map((st2) => `${st2.subject.value} ${st2.predicate.value} ${st2.object.value}`).sort().join("\n");
+      };
+      const theirs = triples(await res.text());
+      return theirs !== null && theirs === triples(doc);
+    } catch {
+      return false;
+    }
   }
   // Child documents of an LDP container (URLs under it, excluding aux docs).
   // Revalidated: the inbox is polled every couple of minutes and is usually
@@ -68856,10 +68922,15 @@ var PodTransport = class {
     parse2(body, g, url, "text/turtle");
     const here = namedNode2(url);
     const seen = /* @__PURE__ */ new Set();
+    const receipts = /* @__PURE__ */ new Set();
     const list3 = [];
     for (const child of g.each(here, LDP2("contains"), null, here)) {
       const u = child.value;
-      if (!u.startsWith(url) || u === url || /\.(acl|meta|receipt\.json)$/.test(u) || seen.has(u)) continue;
+      if (u.endsWith(".receipt.json")) {
+        receipts.add(u);
+        continue;
+      }
+      if (!u.startsWith(url) || u === url || /\.(acl|meta)$/.test(u) || seen.has(u)) continue;
       seen.add(u);
       list3.push({
         url: u,
@@ -68867,10 +68938,16 @@ var PodTransport = class {
         modified: g.any(child, DC("modified"), null, here)?.value || null
       });
     }
+    for (const item of list3) item.receipt = receipts.has(item.url + ".receipt.json");
+    const orphans = [...receipts].filter((r) => !seen.has(r.slice(0, -".receipt.json".length)));
     list3.sort((a, b) => String(a.modified || "").localeCompare(String(b.modified || "")));
-    this._listCache.set(url, { etag: res.headers.get("etag"), children: list3 });
+    this._listCache.set(url, { etag: res.headers.get("etag"), children: list3, orphans });
     return list3;
   }
+  /** Receipts in the last listing of `url` whose item is gone. */
+  orphanReceipts(url) {
+    return this._listCache?.get(url)?.orphans ?? [];
+  }
   /**
    * The WebID profile advertises the actor as an account:
    *   <webId> foaf:account <actor> .
@@ -69040,18 +69117,6 @@ async function generateKeys() {
   }
   return rec;
 }
-var PBKDF2_ITERATIONS = 31e4;
-async function deriveAesKey(password, salt, iterations) {
-  const base = await crypto.subtle.importKey("raw", new TextEncoder().encode(password), "PBKDF2", false, ["deriveKey"]);
-  return crypto.subtle.deriveKey(
-    { name: "PBKDF2", salt, iterations, hash: "SHA-256" },
-    base,
-    { name: "AES-GCM", length: 256 },
-    false,
-    ["encrypt", "decrypt"]
-  );
-}
-var toB64 = (buf) => btoa(String.fromCharCode(...new Uint8Array(buf)));
 function isKeyEnvelope(doc) {
   return !!doc && doc.v === 1 && typeof doc.ct === "string" && typeof doc.salt === "string";
 }
@@ -69061,21 +69126,6 @@ var KeyPasswordNeeded = class extends Error {
   }
   code = "key-password-needed";
 };
-async function wrapKeys(keysRecord, password) {
-  const salt = crypto.getRandomValues(new Uint8Array(16));
-  const iv = crypto.getRandomValues(new Uint8Array(12));
-  const aes = await deriveAesKey(password, salt, PBKDF2_ITERATIONS);
-  const plaintext = new TextEncoder().encode(JSON.stringify(keysRecord));
-  const ct = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, aes, plaintext);
-  return {
-    v: 1,
-    kdf: "PBKDF2-SHA256",
-    iterations: PBKDF2_ITERATIONS,
-    salt: toB64(salt),
-    iv: toB64(iv),
-    ct: toB64(ct)
-  };
-}
 
 // web/app/keys-browser.mjs
 var pemToDer = (pem) => Uint8Array.from(
@@ -69107,7 +69157,7 @@ async function loadKeysFromPod(remote, urls) {
   const cached = await kvGet(keyCacheKey(podActor)).catch(() => null);
   if (isOpenedKey(cached)) return fromCache(cached);
   if (cached?.rsa?.privatePem) return cacheOpenedKeys(podActor, cached);
-  const doc = await readWrappedKeys(remote, urls);
+  const doc = await readKeys(remote, urls);
   if (isKeyEnvelope(doc)) throw new KeyPasswordNeeded();
   if (!doc || !doc.rsa) throw new Error("no signing key on the pod \u2014 sign up did not finish");
   return cacheOpenedKeys(podActor, doc);
@@ -69227,6 +69277,7 @@ var Deliverer = class {
     this.edPrivate = edPrivate;
     this.proofKeyId = proofKeyId;
     this.log = log2;
+    this.batchSize = 1;
     if (!passive) this.startQueue();
   }
   startQueue() {
@@ -69303,31 +69354,56 @@ var Deliverer = class {
       return activity;
     }
   }
+  // One attempt per target, answered in order: `{ ok: true }` or `{ error }`
+  // with the error deliverNow would have thrown. Here one at a time; the
+  // relay deliverer sends the whole list in one call.
+  async deliverManyNow(targets) {
+    const out = [];
+    for (const t of targets) {
+      try {
+        await this.deliverNow(t.inbox, t.activity);
+        out.push({ ok: true });
+      } catch (error2) {
+        out.push({ error: error2 });
+      }
+    }
+    return out;
+  }
   async deliver(inbox, activity) {
     const signed = await this.proofed(activity);
+    if (this._queueIfCooling(inbox, signed)) return;
+    const [result] = await this.deliverManyNow([{ inbox, activity: signed }]);
+    await this._settle(inbox, signed, result);
+  }
+  // A host we already know is refusing: queue without asking again. This is
+  // the path a FRESH activity takes, so without it a fan-out to a struggling
+  // server opened one socket per follower before any of this applied.
+  _queueIfCooling(inbox, signed) {
     const host = hostOf(inbox);
     const until = this._cooling?.get(host);
-    if (until && until > Date.now()) {
-      this.log(`${host} is cooling \u2014 queueing ${signed.type} rather than asking again`);
-      this._enqueue({ inbox, activity: signed, attempts: 1, nextAt: until });
+    if (!until || until <= Date.now()) return false;
+    this.log(`${host} is cooling \u2014 queueing ${signed.type} rather than asking again`);
+    this._enqueue({ inbox, activity: signed, attempts: 1, nextAt: until });
+    return true;
+  }
+  // What one attempt's outcome means for the queue.
+  async _settle(inbox, signed, result) {
+    if (result.ok) {
+      this.log(`delivered ${signed.type} \u2192 ${inbox}`);
       return;
     }
-    try {
-      await this.deliverNow(inbox, signed);
-      this.log(`delivered ${signed.type} \u2192 ${inbox}`);
-    } catch (e) {
-      if (unsalvageable(e)) {
-        await this._unsalvageable(inbox, e);
-        return;
-      }
-      this.log(`delivery failed (${e.message}) \u2014 queued`);
-      const wait = e.retryAfterMs || 6e4;
-      if (aboutTheHost(e)) {
-        this._cooling ||= /* @__PURE__ */ new Map();
-        this._cooling.set(host, Date.now() + wait);
-      }
-      this._enqueue({ inbox, activity: signed, attempts: 1, nextAt: Date.now() + wait });
+    const e = result.error;
+    if (unsalvageable(e)) {
+      await this._unsalvageable(inbox, e);
+      return;
+    }
+    this.log(`delivery failed (${e.message}) \u2014 queued`);
+    const wait = e.retryAfterMs || 6e4;
+    if (aboutTheHost(e)) {
+      this._cooling ||= /* @__PURE__ */ new Map();
+      this._cooling.set(hostOf(inbox), Date.now() + wait);
     }
+    this._enqueue({ inbox, activity: signed, attempts: 1, nextAt: Date.now() + wait });
   }
   // Not retried, and on a 410 the followers who received there are dropped,
   // so the next fan-out stops asking; the followers collection is republished
@@ -69363,7 +69439,13 @@ var Deliverer = class {
   }
   async deliverToAll(inboxes, activity) {
     const signed = await this.proofed(activity);
-    for (const inbox of [...new Set(inboxes)]) await this.deliver(inbox, signed);
+    const targets = [...new Set(inboxes)].map((inbox) => ({ inbox, activity: signed }));
+    for (let i = 0; i < targets.length; i += this.batchSize) {
+      const chunk = targets.slice(i, i + this.batchSize).filter((t) => !this._queueIfCooling(t.inbox, signed));
+      if (!chunk.length) continue;
+      const results = await this.deliverManyNow(chunk);
+      for (let k = 0; k < chunk.length; k++) await this._settle(chunk[k].inbox, signed, results[k]);
+    }
   }
   // Serialized, for the same reason Intake.drain is: the tick is 60s and a
   // drain over slow peers outlasts it, so a second run started on top of the
@@ -69463,6 +69545,7 @@ var Deliverer = class {
 
 // web/app/deliver-relay.mjs
 init_fedify_sig();
+var RELAY_MAX_REQUESTS = 20;
 function doorKeyOf(doorInboxUrl) {
   try {
     const seg2 = new URL(doorInboxUrl).pathname.split("/");
@@ -69477,6 +69560,7 @@ var RelayDeliverer = class extends Deliverer {
     this.relayUrl = opts.relayUrl;
     this.handle = opts.handle;
     this.sessionFetch = opts.sessionFetch;
+    this.batchSize = RELAY_MAX_REQUESTS;
   }
   // Same contract as Deliverer.signedFetch, DEFAULT INCLUDED: an init with no
   // method is a read. The Node one builds a `Request`, whose default is GET, and
@@ -69486,9 +69570,41 @@ var RelayDeliverer = class extends Deliverer {
   // never saw the document it asked for: a Follow from anyone new was rejected
   // with "actor fetch failed", and nothing needing a lookup could be ingested.
   async signedFetch(url, init = {}) {
+    const req = await this._signedRequest(url, init);
+    const [r0] = await this._relay([req]);
+    return this._outcome(r0, url, init.method || "GET");
+  }
+  // A fan-out in one call: the relay takes a list, so a post to twenty
+  // followers is one call, not twenty (Deliverer.deliverToAll, batchSize).
+  async deliverManyNow(targets) {
+    const reqs = await Promise.all(targets.map((t) => this._signedRequest(t.inbox, {
+      method: "POST",
+      headers: { "content-type": "application/activity+json" },
+      body: JSON.stringify(t.activity)
+    })));
+    let results;
+    try {
+      results = await this._relay(reqs);
+    } catch (error2) {
+      return targets.map(() => ({ error: error2 }));
+    }
+    return targets.map((t, i) => {
+      try {
+        this._outcome(results[i] || {}, t.inbox, "POST");
+        return { ok: true };
+      } catch (error2) {
+        return { error: error2 };
+      }
+    });
+  }
+  // Signed here, sent verbatim by the relay. Every signed header goes along,
+  // `accept` included: the signature covers it, so a relay request missing it
+  // carries an invalid signature — and a read without it gets the HTML page
+  // instead of the document.
+  async _signedRequest(url, init = {}) {
     const body = typeof init.body === "string" ? init.body : init.body ? new TextDecoder().decode(init.body) : "";
     const s = await sign({ url, method: init.method || "GET", headers: init.headers || {}, body }, this.rsaPrivate, this.keyId);
-    const relayReq = {
+    return {
       url: s.url,
       method: s.method,
       body,
@@ -69500,25 +69616,42 @@ var RelayDeliverer = class extends Deliverer {
         signature: s.headers.signature
       }
     };
+  }
+  // One relay call for a list of requests; the results in the same order.
+  // The relay's OWN answer, apart from the recipients': unreachable and a
+  // refusal are hiccups the queue retries. Its 404 is not — it says this
+  // account has no row here, and no retry changes that. It used to be read as
+  // a hiccup too, and a tab whose account the site did not know retried its
+  // deliveries every minute for three days.
+  async _relay(requests) {
     let res;
     try {
       res = await this.sessionFetch(this.relayUrl, {
         method: "POST",
         headers: { "content-type": "application/json" },
-        body: JSON.stringify({ handle: this.handle, requests: [relayReq] })
+        body: JSON.stringify({ handle: this.handle, requests })
       });
     } catch (e) {
       const err = new Error(`relay unreachable: ${e.message}`);
       err.status = 0;
       throw err;
     }
+    if (res.status === 404) {
+      const err = new Error("relay: no such account here");
+      err.status = 404;
+      throw err;
+    }
     if (res.status >= 400) {
       const err = new Error(`relay ${res.status}`);
       err.status = 502;
       throw err;
     }
     const out = await res.json().catch(() => ({}));
-    const r0 = out.results && out.results[0] || {};
+    return Array.isArray(out.results) ? out.results : [];
+  }
+  // What the far server answered, as the Node deliverer would have seen it:
+  // a Response for a read, a thrown error carrying the status for a refusal.
+  _outcome(r0, url, method) {
     const status2 = r0.status || 0;
     if (status2 === 0) {
       const err = new Error(r0.error || "relay could not send");
@@ -69526,7 +69659,7 @@ var RelayDeliverer = class extends Deliverer {
       throw err;
     }
     if (status2 >= 400) {
-      const err = new Error(`${init.method || "POST"} ${url} \u2192 ${status2}`);
+      const err = new Error(`${method} ${url} \u2192 ${status2}`);
       err.status = status2;
       if (r0.retryAfter) {
         const secs = Number(r0.retryAfter);
@@ -69938,6 +70071,8 @@ var ADMIN_PATHS = /* @__PURE__ */ new Set([
   "/park",
   "/revive",
   "/takeover",
+  "/gateway/pause",
+  "/gateway/close",
   "/fediacct/connect",
   "/fediacct/disconnect",
   "/fediacct/callback"
@@ -70042,7 +70177,11 @@ var AdminFacade = class {
             frontActor: g?.frontActor || null,
             mode: g?.mode || "off",
             hasSecret: !!g?.hmacSecret,
-            stats: a.store.read("gateway-stats.json", { verified: 0, unverified: 0, lastAt: null })
+            stats: a.store.read("gateway-stats.json", { verified: 0, unverified: 0, lastAt: null }),
+            // The account's standing at the gateway — paused, closed — as the
+            // gateway last said it (agent.mjs tellGateway). The record page
+            // shows its pause and close controls only when this is here.
+            standing: a.gatewayStanding || null
           });
         }
         case "/deadletter":
@@ -70186,6 +70325,24 @@ var AdminFacade = class {
         if (!await a.requestTakeover?.()) return json2(503, { error: "the lease could not be taken \u2014 the pod refused the write" });
         return json2(200, { ok: true, mode: a.status().mode });
       }
+      // The account's standing at its gateway: paused by its owner, or closed
+      // for good (front-core: accounts that go quiet). Both go to the gateway
+      // with the pod session as proof, and its answer is the new standing.
+      case "/gateway/pause": {
+        if (typeof body.paused !== "boolean") return json2(400, { error: "paused must be true or false" });
+        if (!a.pauseAtGateway || !a.gatewayApi) return json2(501, { error: "this account is not at a gateway" });
+        const r = await a.pauseAtGateway(body.paused);
+        if (!r) return json2(502, { error: "the gateway could not be reached" });
+        return json2(r.status === 200 ? 200 : r.status, r);
+      }
+      case "/gateway/close": {
+        const handle7 = String(a.store.getConfig()?.handle || "").toLowerCase();
+        if (!handle7 || String(body.confirm || "").toLowerCase() !== handle7) return json2(400, { error: "type the handle to confirm" });
+        if (!a.closeAtGateway || !a.gatewayApi) return json2(501, { error: "this account is not at a gateway" });
+        const r = await a.closeAtGateway();
+        if (!r) return json2(502, { error: "the gateway could not be reached" });
+        return json2(r.status === 200 ? 200 : r.status, r);
+      }
       // Going quiet, and coming back. The record page's active/parked select.
       case "/park": {
         if (!await a.requestTakeover?.()) return json2(503, { error: "another device is active for this pod \u2014 park from there" });
@@ -70197,13 +70354,8 @@ var AdminFacade = class {
       }
       case "/rotate-key": {
         await a.requestTakeover?.();
-        try {
-          const r = await a.rotateKey({ password: body.password });
-          return json2(200, { ok: true, changed: !!r?.changed });
-        } catch (e) {
-          if (e.code !== "key-password-needed") throw e;
-          return json2(428, { error: e.message, needsPassword: true });
-        }
+        const r = await a.rotateKey();
+        return json2(200, { ok: true, changed: !!r?.changed });
       }
       // Recover posts this browser lost, from what the pod still holds.
       case "/rebuild": {
@@ -70502,6 +70654,60 @@ var AdminFacade = class {
   }
 };
 
+// web/app/gateway-move.mjs
+init_wire();
+async function completeGatewayMove(agent2) {
+  const cfg = agent2.store.getConfig();
+  const mv = cfg?.movedFrom;
+  if (!mv || mv.completedAt) return null;
+  const log2 = agent2.log;
+  const newActor = agent2.urls.actor;
+  let told;
+  try {
+    told = await agent2.sessionFetch(`${mv.gateway}/api/move`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ handle: mv.handle, movedTo: newActor })
+    });
+  } catch (e) {
+    told = { status: 0, statusText: e.message };
+  }
+  if (told.status !== 200) {
+    log2(`gateway move: ${mv.gateway} did not mark @${mv.handle} as moved (${told.status || told.statusText}) \u2014 will retry`);
+    return { told: false };
+  }
+  const contacts = agent2.store.getContacts();
+  const inboxes = [...new Set(contacts.followers.map((f) => f.sharedInbox || f.inbox).filter(Boolean))];
+  const activity = moveActivity({ actor: mv.actor }, newActor, Date.now());
+  const sender = new RelayDeliverer({
+    passive: true,
+    store: agent2.store,
+    rsaPrivate: agent2.deliverer.rsaPrivate,
+    keyId: `${mv.actor}#main-key`,
+    actorId: mv.actor,
+    log: log2,
+    relayUrl: `${mv.gateway}/api/relay`,
+    handle: mv.handle,
+    sessionFetch: agent2.sessionFetch
+  });
+  let sent = 0;
+  let failed = 0;
+  for (const inbox of inboxes) {
+    try {
+      await sender.deliverNow(inbox, activity);
+      sent++;
+    } catch (e) {
+      failed++;
+      log2(`gateway move: Move to ${inbox} failed: ${e.message}`);
+    }
+  }
+  const done = { ...mv, completedAt: (/* @__PURE__ */ new Date()).toISOString(), moveSent: sent, moveFailed: failed };
+  agent2.store.setConfig({ ...agent2.store.getConfig(), movedFrom: done });
+  await agent2.store.flush?.();
+  log2(`moved from ${mv.actor} to ${newActor}: Move sent to ${sent} inbox(es)${failed ? `, ${failed} failed` : ""}`);
+  return done;
+}
+
 // stub:node:os
 var fail2 = () => {
   throw new Error("node:os is not available in the browser agent");
@@ -71678,19 +71884,57 @@ var BrowserAgent = class _BrowserAgent {
     this.log("took over from the other device (action here)");
     return true;
   }
+  // One call to the gateway's owner API, proved with the pod session. What
+  // comes back on 200 or 410 is the account's standing there, kept for the
+  // manage page; anything else is logged and forgotten.
+  async tellGateway(what, body) {
+    if (!this.gatewayApi) return null;
+    let res;
+    try {
+      res = await this.sessionFetch(`${this.gatewayApi}/${what}`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body)
+      });
+    } catch (e) {
+      this.log(`gateway ${what}: ${e.message}`);
+      return null;
+    }
+    const json2 = await res.json().catch(() => ({}));
+    const out = { status: res.status, ...json2 };
+    if (res.status === 200 || res.status === 410) this.gatewayStanding = out;
+    else this.log(`gateway ${what}: ${res.status} ${json2.error || ""}`);
+    return out;
+  }
+  openAtGateway() {
+    return this.tellGateway("open", { handle: this.doorKey });
+  }
+  pauseAtGateway(paused) {
+    return this.tellGateway("pause", { handle: this.doorKey, paused: !!paused });
+  }
+  closeAtGateway() {
+    return this.tellGateway("close", { handle: this.doorKey, confirm: true });
+  }
+  static OPEN_EVERY_MS = 60 * 6e4;
   // Become the active agent: renew the lease, then start what a viewer skips —
   // publish the face, drain the inbox, run the mirrors.
   async goActive() {
     this.viewer = false;
+    clearInterval(this._openTimer);
+    this._openTimer = setInterval(() => {
+      this.openAtGateway();
+    }, _BrowserAgent.OPEN_EVERY_MS);
     this.lease.onLost = () => this.demote();
     this.lease.startRenewal();
     try {
-      await this.store.load({ force: true }).catch((e) => this.log(`re-reading state: ${e.message}`));
+      await this.store.load({ force: !!this._watched }).catch((e) => this.log(`re-reading state: ${e.message}`));
+      this._watched = false;
       await this.publisher.healStatuses().catch((e) => this.log(`healing the timeline index: ${e.message}`));
       await this.publisher.publishProfilePage().catch((e) => this.log(`profile page: ${e.message}`));
       this.deliverer?.startQueue?.();
       await this.publisher.publishProfile();
       await this.store.flush?.();
+      await completeGatewayMove(this).catch((e) => this.log(`gateway move: ${e.message}`));
       await this.intake.start();
       this.startBsky();
       this.startAccts();
@@ -71705,8 +71949,11 @@ var BrowserAgent = class _BrowserAgent {
   demote() {
     if (this.viewer) return;
     this.viewer = true;
+    this._watched = true;
     this.log("another device took over \u2014 read-only here");
     this.lease.stopRenewal();
+    clearInterval(this._openTimer);
+    this._openTimer = null;
     this.intake?.stop?.();
     this.deliverer?.stop?.();
     this.importer?.stop?.();
@@ -71788,6 +72035,7 @@ var BrowserAgent = class _BrowserAgent {
       remotePod = credential.remotePod;
     }
     this.webId = webId;
+    this.sessionFetch = session.fetch;
     const root = config && config.root || "fedipod/";
     this.remote = new BrowserRemotePod(session, { webId, log: this.log });
     this.urls = apUrls2(remotePod, root);
@@ -71819,6 +72067,24 @@ var BrowserAgent = class _BrowserAgent {
       sessionFetch: session.fetch,
       onGone: () => this.publisher.publishCollections({ followers: true })
     });
+    this.gatewayApi = config.gateway?.url ? `${frontOrigin.replace(/\/$/, "")}/api` : null;
+    this.doorKey = doorKeyOf(config.gateway?.url) || config.handle;
+    this.gatewayStanding = null;
+    const standing = await this.openAtGateway();
+    if (standing?.status === 410) {
+      const host = (() => {
+        try {
+          return new URL(this.gatewayApi).host;
+        } catch {
+          return "the gateway";
+        }
+      })();
+      const address = this.doorKey.includes("@") ? `@${this.doorKey}` : `@${this.doorKey}@${host}`;
+      const why = standing.closedBy === "owner" ? "you closed it" : "nothing opened it for six months";
+      const e = new Error(`${address} is closed at ${host}: ${why}, and a closed address does not come back. Everything on your pod is untouched. The sign-in used here was ${webId}.`);
+      e.code = "address-closed";
+      throw e;
+    }
     this.publisher = new Publisher({
       config: this.store.getConfig(),
       remote: this.remote,
@@ -71879,6 +72145,7 @@ var BrowserAgent = class _BrowserAgent {
       await this.fediaccts.load();
       this.viewer = !await this.lease.acquire();
       if (this.viewer) {
+        this._watched = true;
         this.log(`read-only viewer: another device is active on @${config.handle}`);
         this.startViewerPoll();
         return;
@@ -71927,23 +72194,11 @@ var BrowserAgent = class _BrowserAgent {
   // actor so the new public key is on the wire. The old key stops signing the
   // moment this returns — same one-way change as the Node agent's rotateKey
   // (run-agent.mjs).
-  //
-  // The pod's copy is wrapped, so this needs the account password. There is
-  // nowhere to get it from without asking: the worker boots from a stored
-  // session and holds no password, and caching one to save a prompt on a
-  // once-in-a-while action would put the account password in storage to avoid
-  // typing it. So the caller supplies it, and rotating without one is refused
-  // rather than quietly writing a bare key back where a wrapped one was.
-  async rotateKey({ password } = {}) {
-    if (!password) {
-      const e = new Error("rotating the signing key needs your account password \u2014 it is what the new key is locked under on the pod");
-      e.code = "key-password-needed";
-      throw e;
-    }
+  async rotateKey() {
     const before = this.publisher.publicKeyPem;
     const rec = await generateKeys();
     rec.mintedFor = this.urls.actor;
-    await writeWrappedKeys(this.remote, this.urls, await wrapKeys(rec, password));
+    await writeKeys(this.remote, this.urls, rec);
     const keys = await cacheOpenedKeys(podActorOf(this.urls), rec);
     this.publisher.publicKeyPem = keys.rsaPublicPem;
     this.deliverer.rsaPrivate = keys.rsaPrivate;
@@ -72396,7 +72651,7 @@ async function serve(request, url) {
     } catch {
     }
   }
-  if (!agent) return json(503, { error: "the agent is not booted yet \u2014 open the app from the sign-in page" });
+  if (!agent) return json(503, { error: "not signed in on this browser \u2014 sign in at the front page" });
   const bodyBytes = request.method === "GET" || request.method === "HEAD" ? null : Buffer.from(new Uint8Array(await request.arrayBuffer()));
   const bodyText = bodyBytes ? new TextDecoder().decode(bodyBytes) : "";
   const reqHeaders = {};