fedipod-server 0.28.1 → 0.30.0

package/lib/core/shapes/index.mjs

@@ -1,132 +0,0 @@
-// shapes/index.mjs — validating an ActivityStreams document against the shapes
-// beside this file.
-//
-// A shape says what a kind of document IS. Checking one against a document we
-// were sent is a different question from whether we trust it: a forged actor,
-// a receipt that does not bind, a reply naming a note we never wrote are each
-// guarded elsewhere, and none of those guards is replaced here.
-//
-// NOTHING HERE REJECTS ANYTHING. A failure is recorded and the activity is
-// handled exactly as it would have been. Every fediverse implementation writes
-// slightly different documents, and a shape strict enough to catch something
-// real is strict enough to reject somebody's quirk; which one cannot be known
-// in advance, so it is learned from the record rather than guessed at. A shape
-// earns enforcement by not firing.
-
-import { Parser } from 'n3';
-import Environment from '@rdfjs/environment';
-import DataFactory from '@rdfjs/data-model/Factory.js';
-import DatasetFactory from '@rdfjs/dataset/Factory.js';
-import NamespaceFactory from '@rdfjs/namespace/Factory.js';
-import TermSetFactory from '@rdfjs/term-set/Factory.js';
-import TermMapFactory from '@rdfjs/term-map/Factory.js';
-import ClownfaceFactory from 'clownface/Factory.js';
-import SHACLValidator from 'rdf-validate-shacl';
-import { SHAPES_TTL } from './shapes-text.mjs';
-
-// The validator needs a full RDF/JS environment, not a bare factory. These
-// pieces are what rdf-validate-shacl itself depends on, composed here rather
-// than pulling in a packaged environment that reads files — this has to run in
-// a service worker too.
-const rdf = new Environment([DataFactory, DatasetFactory, NamespaceFactory, TermSetFactory, TermMapFactory, ClownfaceFactory]);
-
-// The shapes document's own URL is the base, so `<#Create>` resolves to a
-// fragment of it and no namespace is claimed.
-const SHAPES_BASE = 'https://fedipod.invalid/shapes';
-
-let validator;
-let brokenReported = false;
-
-/** The validator, built once. Reading and parsing the shapes is not per-document work. */
-function shacl() {
-  if (!validator) {
-    const quads = new Parser({ baseIRI: SHAPES_BASE, format: 'text/turtle' }).parse(SHAPES_TTL);
-    validator = new SHACLValidator(rdf.dataset(quads.map(asTerm)), { factory: rdf });
-  }
-  return validator;
-}
-
-/** jsonld and n3 each mint their own terms; the validator's environment must mint the ones it sees. */
-function asTerm(q) {
-  const term = (t) => {
-    if (t.termType === 'NamedNode') return rdf.namedNode(t.value);
-    if (t.termType === 'BlankNode') return rdf.blankNode(String(t.value).replace(/^_:/u, ''));
-    if (t.termType === 'Literal') {
-      return rdf.literal(t.value, t.language || (t.datatype ? rdf.namedNode(t.datatype.value) : undefined));
-    }
-    return rdf.defaultGraph();
-  };
-  return rdf.quad(term(q.subject), term(q.predicate), term(q.object));
-}
-
-/**
- * What to call the property that did not fit.
- *
- * A single-predicate path names itself: the IRI, shortened. A sequence path is
- * a list, and its head is a blank node that names nothing — so the failing
- * property shape is asked for its own `sh:name` instead.
- */
-const SH_NAME = 'http://www.w3.org/ns/shacl#name';
-function pathName(r) {
-  const direct = r.path?.value ?? null;
-  if (direct && /[#/]/u.test(direct)) return direct;
-  const shape = r.sourceShape;
-  if (shape) {
-    for (const q of shacl().$shapes?.dataset ?? []) {
-      if (q.subject.equals(shape) && q.predicate.value === SH_NAME) return q.object.value;
-    }
-  }
-  return direct;
-}
-
-/**
- * Check a document's graph against the shapes.
- *
- * `quads` is what `parseAS2` produced. Returns null when the document
- * conforms or when there was no graph to check, and otherwise a short record
- * of what did not fit — the failing node, the property, and the shape's own
- * words for it.
- *
- * Never throws. A validator that cannot run is not a reason to drop mail — but
- * it is said once, because a checker that silently passes everything is the
- * same silence this change exists to remove.
- */
-export async function checkShapes(quads) {
-  if (!Array.isArray(quads) || quads.length === 0) return null;
-  let report;
-  try {
-    report = await shacl().validate(rdf.dataset(quads.map(asTerm)));
-  } catch (e) {
-    // A validator that cannot run must not read as "everything conforms" —
-    // that is the same silence this whole change exists to remove. Said once,
-    // then quiet, because a broken validator would otherwise say it per item.
-    if (!brokenReported) {
-      brokenReported = true;
-      return { conforms: false, broken: true, results: [{ focus: null, path: null, message: `shape validation is not running: ${e.message}`, shape: null }] };
-    }
-    return null;
-  }
-  if (report.conforms) return null;
-  return {
-    conforms: false,
-    results: report.results.slice(0, 10).map((r) => ({
-      focus: r.focusNode?.value ?? null,
-      // A SEQUENCE path — `( as:object as:closed )` — is an RDF list, so its
-      // node is blank and `.value` is a generated label like "n3-13". Reported
-      // as that, the record named nothing a reader could act on. The shape's
-      // own `sh:name` is what it is called, so that is used when the path
-      // cannot name itself.
-      path: pathName(r),
-      message: r.message?.[0]?.value ?? String(r.sourceConstraintComponent?.value ?? 'does not fit the shape'),
-      shape: r.sourceShape?.value ?? null,
-    })),
-  };
-}
-
-/** The failure as one line, for a log or a dead-letter record. */
-export function describeShapeFailure(failure) {
-  if (!failure) return null;
-  return failure.results
-    .map((r) => `${r.path ? r.path.replace(/^.*[#/]/u, '') : 'node'}: ${r.message}`)
-    .join('; ');
-}

package/lib/core/shapes/shapes-text.mjs

@@ -1,13 +0,0 @@
-// shapes-text.mjs — the shapes document, as text.
-//
-// The shapes are authored as Turtle in activitystreams.ttl, which is the one
-// source of truth and opens in any RDF tool. Reading it differs by where this
-// runs: Node reads the file, and the browser bundle swaps this module for a
-// shim that imports the same .ttl through esbuild's text loader.
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-export const SHAPES_TTL = fs.readFileSync(
-  path.join(path.dirname(fileURLToPath(import.meta.url)), 'activitystreams.ttl'), 'utf8',
-);

package/lib/core/social.mjs

@@ -1,531 +0,0 @@
-// social.mjs — outbound social actions (follow, like, announce, delete)
-// shared by the admin API and the Mastodon-API facade. Each action delivers
-// the activity and mirrors state into the store; the store keeps the
-// activity a later Undo must name.
-
-import crypto from 'node:crypto';
-import * as wire from './wire.mjs';
-import * as podNotes from '../pod/notes.mjs';
-import { dropFollower } from './store.mjs';
-
-// WebFinger, ours rather than fedify's — v2 dropped lookupWebFinger.
-//
-// Better here anyway: the host comes out of a handle, and a handle can arrive
-// in a MENTION inside a post somebody else wrote, so it is remote input and
-// belongs behind the same SSRF guard as every other outbound request. fedify's
-// lookup did not go through ours. https only, because a handle resolved over
-// plaintext is a handle anyone on the path can answer for.
-//
-// `fetchImpl`, when given, makes the request instead of safeFetch: the agent's
-// own remote read, which in the browser build is the relay — a server-side
-// fetch, so the lookup does not depend on the far pod host answering a
-// browser's cross-origin request. Every other remote read there goes the
-// same way; WebFinger went direct and was the one lookup that could fail
-// while the rest worked.
-export async function lookupWebFinger(acct, { fetchImpl = null } = {}) {
-  const clean = String(acct || '').replace(/^acct:/, '');
-  const at = clean.lastIndexOf('@');
-  if (at < 1) return null;
-  const [user, host] = [clean.slice(0, at), clean.slice(at + 1)];
-  if (!host || /[/\\?#]/.test(host)) return null;
-  const { safeFetch, readCapped } = await import('../shared/safefetch.mjs');
-  const url = `https://${host}/.well-known/webfinger?resource=${encodeURIComponent(`acct:${clean}`)}`;
-  const headers = { accept: 'application/jrd+json, application/json' };
-  const res = await (fetchImpl ? fetchImpl(url, { headers }) : safeFetch(url, { headers })).catch(() => null);
-  if (!res || res.status >= 400) return null;
-  let jrd;
-  try { jrd = JSON.parse(await readCapped(res, 256 * 1024)); } catch { return null; }
-  // The JRD says who it is about. Nothing checked it, so a host answering every
-  // query with one account's document made `@anyone@that.host` resolve to that
-  // account — and it was then stored under the handle that was asked for, not
-  // the one it turned out to be.
-  const subject = String(jrd?.subject || '').replace(/^acct:/, '').toLowerCase();
-  if (subject && subject !== clean.toLowerCase()) {
-    return null;
-  }
-  return jrd;
-}
-
-export const selfLink = (jrd) => jrd?.links?.find(l => l.rel === 'self' &&
-  /application\/(activity\+json|ld\+json)/.test(l.type || ''));
-
-// A WebFinger server can name an actor on ANY host, and until this ran we
-// believed it. The handle is remote input — it arrives in the Mention tags of a
-// note somebody else wrote — so evil.example could answer for `@x@evil.example`
-// with a real, busy actor elsewhere, and a reply that carried that mention was
-// addressed, tagged and DELIVERED to a third party who had nothing to do with
-// the thread, over our signature.
-//
-// The host cannot simply be required to match: `@user@example.com` served by
-// mastodon.example is the ordinary delegated setup and the whole point of
-// WebFinger. So ask the ACTOR's own host who it says that actor is, and require
-// it to come back to the same document. A server may name anyone; it cannot
-// make that person's server agree. This is the round trip Mastodon does.
-//
-// Only when the two hosts differ — same-host is self-consistent by
-// construction, so the common case costs no extra request.
-export async function confirmDelegation(asked, doc, lookup = lookupWebFinger) {
-  let home;
-  try { home = new URL(doc.id).host.toLowerCase(); }
-  catch { throw new Error(`actor id is not a URL (${doc.id})`); }
-  if (home === asked.toLowerCase()) return;
-  const user = doc.preferredUsername;
-  if (!user) {
-    throw new Error(`${asked} points at ${doc.id} on another host, which names no `
-      + 'username to confirm it by');
-  }
-  const back = await lookup(`acct:${user}@${home}`);
-  if (selfLink(back)?.href !== doc.id) {
-    throw new Error(`${asked} claims ${doc.id}, but ${home} does not agree that is `
-      + `@${user}@${home} — refusing to take one host's word for another's actor`);
-  }
-}
-
-// acct:user@host → verified actor doc (cached by fetchAP), or throws.
-export async function resolveHandle(agent, handle) {
-  const clean = String(handle || '').replace(/^@/, '');
-  if (!/^[^@]+@[^@]+$/.test(clean)) throw new Error('handle must look like user@host');
-  if (agent.store.isBlocked('https://' + clean.split('@')[1] + '/')) throw new Error('domain is blocked');
-  // Through the agent's own remote read where it has one — the relay, in the
-  // browser build — and directly otherwise.
-  const remote = agent.intake?.deliverer?.signedFetch
-    ? (u, i) => agent.intake.deliverer.signedFetch(u, i) : null;
-  const lookup = (a) => lookupWebFinger(a, { fetchImpl: remote });
-  const jrd = await lookup('acct:' + clean);
-  const self = selfLink(jrd);
-  if (!self?.href) throw new Error(`webfinger found no actor for ${clean}`);
-  const doc = await agent.intake.fetchAP(self.href);
-  if (!doc?.id) throw new Error(`actor document unusable for ${clean}`);
-  if (agent.store.isBlocked(doc.id)) throw new Error('actor is blocked');
-  await confirmDelegation(clean.slice(clean.lastIndexOf('@') + 1), doc, lookup);
-  // Counts live in the collections, not the actor document, so a client asking
-  // "who is this" would otherwise be told everyone has none. Two GETs, and only
-  // when someone asked by name — never on the drain path.
-  await cacheCounts(agent, doc);
-  return doc;
-}
-
-// totalItems off the followers/following collections, stored beside the cached
-// actor. Best effort: a collection that will not answer leaves the count unset
-// rather than reported as zero, which is a different claim.
-async function cacheCounts(agent, doc) {
-  const total = async (url) => {
-    if (!url) return null;
-    try {
-      const res = await agent.intake.fetchAP(url);
-      return Number.isInteger(res?.totalItems) ? res.totalItems : null;
-    } catch { return null; }
-  };
-  const [followers, following] = await Promise.all([total(doc.followers), total(doc.following)]);
-  if (followers === null && following === null) return;
-  const actors = agent.store.getActors();
-  if (!actors[doc.id]) return;
-  actors[doc.id] = { ...actors[doc.id], counts: { followers, following } };
-  agent.store.write('actors.json', actors);
-}
-
-// `doc` skips the fetch when the caller already resolved the actor; a bulk
-// import passes publish:false and republishes the collections once at the end.
-export async function followActor(agent, actorUrl, { publish = true, doc: fetched = null } = {}) {
-  const doc = fetched || await agent.intake.fetchAP(actorUrl);
-  if (!doc?.inbox) throw new Error(`actor document unusable (${actorUrl})`);
-  if (agent.store.isBlocked(doc.id)) throw new Error('actor is blocked');
-  const contacts = agent.store.getContacts();
-  let rec = contacts.following.find(f => f.actor === doc.id);
-  if (!rec) {
-    rec = { actor: doc.id, inbox: doc.inbox, accepted: false };
-    contacts.following.push(rec);
-  }
-  const follow = wire.followActivity({ urls: agent.publisher.urls, targetActor: doc.id, serial: Date.now() });
-  rec.followActivity = follow;               // kept for a later Undo
-  agent.store.setContacts(contacts);
-  await agent.deliverer.deliver(doc.inbox, follow);
-  if (publish) await agent.publisher.publishCollections({ following: true, pending: true });
-  return doc;
-}
-
-export async function followHandle(agent, handle) {
-  const doc = await resolveHandle(agent, handle);
-  await followActor(agent, doc.id);
-  const clean = String(handle || '').replace(/^@/, '');
-  const contacts = agent.store.getContacts();
-  const rec = contacts.following.find(f => f.actor === doc.id);
-  if (rec && !rec.handle) { rec.handle = clean; agent.store.setContacts(contacts); }
-  return { ok: true, actor: doc.id };
-}
-
-export async function unfollowActor(agent, actor) {
-  const contacts = agent.store.getContacts();
-  const rec = contacts.following.find(f => f.actor === actor);
-  if (!rec) throw new Error('not following that actor');
-  if (rec.followActivity) {
-    await agent.deliverer.deliver(rec.inbox,
-      wire.undoActivity({ urls: agent.publisher.urls, activity: rec.followActivity, serial: Date.now() }));
-  }
-  contacts.following = contacts.following.filter(f => f.actor !== actor);
-  agent.store.setContacts(contacts);
-  await agent.publisher.publishCollections({ following: true, pending: true });
-  return { ok: true };
-}
-
-export async function favourite(agent, s) {
-  if (s.favourited) return s;
-  const doc = await agent.intake.fetchAP(s.actor);
-  if (!doc?.inbox) throw new Error('author inbox unavailable');
-  const act = wire.likeActivity({ urls: agent.publisher.urls, noteId: s.noteId, serial: Date.now() });
-  await agent.deliverer.deliver(doc.endpoints?.sharedInbox || doc.inbox, act);
-  return agent.store.updateStatus(s.noteId, { favourited: true, likeActivity: act });
-}
-
-export async function unfavourite(agent, s) {
-  if (s.likeActivity) {
-    const doc = await agent.intake.fetchAP(s.actor).catch(() => null);
-    if (doc?.inbox) {
-      await agent.deliverer.deliver(doc.endpoints?.sharedInbox || doc.inbox,
-        wire.undoActivity({ urls: agent.publisher.urls, activity: s.likeActivity, serial: Date.now() }));
-    }
-  }
-  return agent.store.updateStatus(s.noteId, { favourited: false, likeActivity: undefined });
-}
-
-// Announce goes to our followers (that's what boosting is) and to the author.
-export async function reblog(agent, s) {
-  if (s.reblogged) return s;
-  const { urls } = agent.publisher;
-  const act = wire.announceActivity({ urls, object: s.noteId, serial: Date.now() });
-  const inboxes = new Set(agent.store.getContacts().followers
-    .map(f => f.sharedInbox || f.inbox).filter(Boolean));
-  if (s.actor !== urls.actor) {
-    const doc = await agent.intake.fetchAP(s.actor).catch(() => null);
-    if (doc?.inbox) inboxes.add(doc.endpoints?.sharedInbox || doc.inbox);
-  }
-  await agent.deliverer.deliverToAll([...inboxes], act);
-  // Mark it boosted before recording it: a failed outbox write costs one
-  // missing entry, a failed status write would let a retry announce twice.
-  const updated = agent.store.updateStatus(s.noteId, { reblogged: true, announceActivity: act });
-  await agent.publisher.recordOutbox(act);
-  if (await agent.store.commit?.() === false) agent.log(`boost sent but its timeline row was refused: ${s.noteId}`);
-  return updated;
-}
-
-export async function unreblog(agent, s) {
-  if (s.announceActivity) {
-    const undo = wire.undoActivity({ urls: agent.publisher.urls, activity: s.announceActivity, serial: Date.now() });
-    const inboxes = new Set(agent.store.getContacts().followers
-      .map(f => f.sharedInbox || f.inbox).filter(Boolean));
-    const doc = await agent.intake.fetchAP(s.actor).catch(() => null);
-    if (doc?.inbox && s.actor !== agent.publisher.urls.actor) inboxes.add(doc.endpoints?.sharedInbox || doc.inbox);
-    await agent.deliverer.deliverToAll([...inboxes], undo);
-    await agent.publisher.unrecordOutbox(i => i?.id === s.announceActivity.id);
-  }
-  return agent.store.updateStatus(s.noteId, { reblogged: false, announceActivity: undefined });
-}
-
-// Group: end a following we will no longer carry. Forgetting them locally is
-// not enough — without the Reject their server keeps the relationship and they
-// keep receiving everything the group announces. Muting them too, because an
-// ejection anyone can undo by re-following is not an ejection; a re-follow is
-// still auto-accepted, but nothing of theirs gets carried.
-export async function ejectFollower(agent, actor) {
-  const { urls } = agent.publisher;
-  const contacts = agent.store.getContacts();
-  const rec = contacts.followers.find(f => f.actor === actor);
-  if (!rec) throw new Error('not a member');
-  dropFollower(contacts, actor, 'ejected');
-  agent.store.setContacts(contacts);
-  const muted = agent.store.getMuted();
-  muted.actors = [...new Set([...muted.actors, actor])];
-  agent.store.setMuted(muted);
-  await agent.publisher.publishCollections({ followers: true });
-  // The ban is broadcast to the membership (FEP-1b12), so their servers can
-  // mirror it. Never sent to the ejected member — they get the Reject below.
-  await announceModeration(agent,
-    wire.blockActivity({ urls, targetActor: actor, serial: Date.now() }))
-    .catch(e => agent.log?.(`moderation announce failed: ${e.message}`));
-  // A Bluesky-side member's departure sticks by blocking the DID.
-  if (rec.bsky) {
-    await agent.bskygroup?.blockDid(rec.bsky.did)
-      .catch(e => agent.log?.(`bluesky block failed for ${rec.bsky.handle}: ${e.message}`));
-    return { ok: true, actor, told: true };
-  }
-  if (rec.inbox) {
-    await agent.deliverer.deliver(rec.inbox, wire.rejectActivity({
-      urls,
-      followActivity: { id: rec.followId, type: 'Follow', actor, object: urls.actor },
-      serial: Date.now(),
-    }));
-  }
-  return { ok: true, actor, told: !!rec.inbox };
-}
-
-// Group: answer a held join request. Admitting is the Accept onFollow would
-// have sent immediately had the group not been gated.
-export async function admitRequest(agent, actor, { publish = true } = {}) {
-  const reqs = agent.store.getRequests();
-  const req = reqs.find(r => r.actor === actor);
-  if (!req) throw new Error('no such request');
-  const contacts = agent.store.getContacts();
-  if (!contacts.followers.some(f => f.actor === actor)) {
-    // Admitting a bridged Bluesky member retires their Bluesky-only record,
-    // the same way an ungated group's follow does: one person, one membership.
-    const bridgedDid = /^https:\/\/bsky\.brid\.gy\/ap\/(did:[^/]+)$/.exec(actor)?.[1];
-    if (bridgedDid) contacts.followers = contacts.followers.filter(f => f.bsky?.did !== bridgedDid);
-    contacts.followers.push(req.bsky
-      ? { actor, bsky: req.bsky }
-      : { actor, inbox: req.inbox, sharedInbox: req.sharedInbox, followId: req.activity?.id });
-    agent.store.setContacts(contacts);
-    agent.store.addNotification({ type: 'follow', actor, ...(req.bsky ? { bsky: true } : {}) });
-  }
-  agent.store.setRequests(reqs.filter(r => r.actor !== actor));
-  // A Bluesky-only member has no inbox and no Accept to receive; the follow
-  // already stands on their side. The one-time bridge nudge goes out instead.
-  if (req.bsky) {
-    await agent.bskygroup?.nudgeOnce(contacts.followers.find(f => f.actor === actor));
-    return { ok: true, actor };
-  }
-  // A bulk admit passes publish:false and republishes once for the lot.
-  if (publish) await agent.publisher.publishCollections({ followers: true, pending: true });
-  await agent.deliverer.deliver(req.inbox, wire.acceptActivity({
-    urls: agent.publisher.urls, followActivity: req.activity, serial: Date.now(),
-  }));
-  return { ok: true, actor };
-}
-
-// Refusing is not a ban: they may ask again, and the queue is where you would
-// see that. Eject is the sticky one, because it mutes.
-export async function refuseRequest(agent, actor) {
-  const reqs = agent.store.getRequests();
-  const req = reqs.find(r => r.actor === actor);
-  if (!req) throw new Error('no such request');
-  agent.store.setRequests(reqs.filter(r => r.actor !== actor));
-  await agent.publisher?.publishCollections({ pending: true }).catch(() => {});
-  // No Reject can reach a Bluesky-only requester, so the refusal is enforced
-  // where it can be: their DID is blocked.
-  if (req.bsky) {
-    await agent.bskygroup?.blockDid(req.bsky.did)
-      .catch(e => agent.log?.(`bluesky block failed for ${req.bsky.handle}: ${e.message}`));
-    return { ok: true, actor };
-  }
-  await agent.deliverer.deliver(req.inbox, wire.rejectActivity({
-    urls: agent.publisher.urls, followActivity: req.activity, serial: Date.now(),
-  }));
-  return { ok: true, actor };
-}
-
-// Group: unsay an Announce. The work is in Intake because an upstream Delete
-// has to do the same thing, and both must use the recipient set amplify used.
-export async function retractAnnouncement(agent, noteId) {
-  return agent.intake.retract(noteId);
-}
-
-// Remove an own note everywhere: Delete→followers, remote note + outbox,
-// local pod RDF, statuses mirror.
-//
-// Two of the three pod deletes have to land, and both are checked. While the
-// note document answers, anyone holding its id can still read a post its author
-// deleted — and the `-create` beside it EMBEDS the whole note, so leaving that
-// one behind publishes the same content under another name. A failure keeps the
-// post here and says so, rather than reporting a deletion that did not happen:
-// removing it locally would leave nothing to try again with, and nothing to see
-// that it is still up.
-// A vote is the fediverse convention: one bare Note per chosen option, whose
-// name IS the option, inReplyTo the question, addressed to the question's
-// author alone. The documents are stored for dereference but never listed —
-// not in the outbox, not in the local index.
-export async function votePoll(agent, s, choices) {
-  const { urls } = agent.publisher;
-  const poll = s.poll || {};
-  const opts = poll.options || [];
-  if (poll.closed || (poll.expiresAt && Date.parse(poll.expiresAt) < Date.now())) {
-    return { ok: false, error: 'this poll has closed' };
-  }
-  if (poll.voted) return { ok: false, error: 'already voted' };
-  // Your own poll is the one you are counting, not one you are answering.
-  if (s.actor === urls.actor) return { ok: false, error: 'this is your own poll' };
-  const picks = [...new Set(choices)].filter(i => i >= 0 && i < opts.length);
-  if (!picks.length) return { ok: false, error: 'invalid choice' };
-  if (!poll.multiple && picks.length > 1) return { ok: false, error: 'this poll takes one choice' };
-  const author = await agent.intake.fetchAP(s.actor).catch(() => null);
-  const inbox = author?.endpoints?.sharedInbox || author?.inbox;
-  if (!inbox) return { ok: false, error: 'could not reach the poll author' };
-  const published = new Date().toISOString();
-  for (const i of picks) {
-    const id = urls.notes + published.slice(0, 10) + '-vote-' + crypto.randomBytes(4).toString('hex');
-    const note = {
-      '@context': wire.AS_CTX, id, type: 'Note',
-      attributedTo: urls.actor, name: opts[i].title,
-      inReplyTo: s.noteId, published, to: [s.actor],
-    };
-    const create = {
-      '@context': wire.AS_CTX, id: wire.createActivityId(id), type: 'Create',
-      actor: urls.actor, published, to: [s.actor], object: note,
-    };
-    await podNotes.write(agent.remote, id, note);
-    await podNotes.writeCreate(agent.remote, create.id, create);
-    await agent.deliverer.deliverToAll([inbox], create);
-  }
-  agent.store.updateStatus(s.noteId, {
-    poll: {
-      ...poll, voted: true, ownVotes: picks,
-      options: opts.map((o, j) => (picks.includes(j) ? { ...o, votes: (o.votes || 0) + 1 } : o)),
-    },
-  });
-  return { ok: true };
-}
-
-export async function deleteNote(agent, s) {
-  const { urls } = agent.publisher;
-  const inboxes = agent.store.getContacts().followers
-    .map(f => f.sharedInbox || f.inbox).filter(Boolean);
-  await agent.deliverer.deliverToAll(inboxes, wire.deleteActivity({ urls, noteId: s.noteId }));
-
-  // The note is REPLACED with a Tombstone rather than removed, so a peer that
-  // dereferences it learns the post was deleted instead of a bare 404 (§7.4).
-  // The Tombstone must stay readable; the container above it is owner-only, so
-  // the ACL cannot be inherited. The Create activity is the withdrawn action,
-  // not the object, so it is deleted outright.
-  const stuck = [];
-  const deletedAt = new Date().toISOString();
-  try {
-    await podNotes.writeTombstone(agent.remote, s.noteId, wire.noteTombstone(s.noteId, deletedAt));
-  } catch { stuck.push(s.noteId); }
-  if (!await podNotes.dropCreate(agent.remote, wire.createActivityId(s.noteId))) {
-    stuck.push(wire.createActivityId(s.noteId));
-  }
-  if (stuck.length) {
-    agent.log?.(`delete ${s.noteId}: the pod kept ${stuck.length} document(s) — the post is STILL PUBLISHED`);
-    return {
-      ok: false, stillPublished: stuck,
-      error: 'the pod would not remove the post — it is still published, and has been kept here so you can try again',
-    };
-  }
-  // Empty, and referenced by nothing once the note is gone.
-  await podNotes.dropReplies(agent.remote, wire.repliesId(s.noteId));
-
-  // The Bluesky mirror goes with the post. Best-effort: a mirror the far side
-  // already lost is not a reason to keep the post here.
-  if (s.atproto?.uri && agent.atproto?.connected()) {
-    await agent.atproto.deleteCrossPost(s.atproto.uri)
-      .then(() => agent.log?.(`bluesky mirror deleted: ${s.atproto.uri}`))
-      .catch(e => agent.log?.(`bluesky mirror not deleted (${e.message}): ${s.atproto.uri}`));
-  }
-
-  // The note's outbox entry, and our own boost of it if there was one.
-  await agent.publisher.unrecordOutbox(i => i === s.noteId || (i?.id && i.id === s.announceActivity?.id));
-  agent.store.removeStatus(s.noteId);
-  return { ok: true };
-}
-
-// FEP-1b12: a GROUP's moderation is announced to its followers, so their
-// servers can mirror the action. Group moderation only — a person's blocks
-// never go on the wire (that is also the spec's own SHOULD NOT), which is why
-// the guard lives here rather than in every caller. Never delivered to the
-// moderated party; the announce goes to the membership.
-export async function announceModeration(agent, activity) {
-  if (agent.store.getConfig()?.kind !== 'group') return null;
-  const { urls } = agent.publisher;
-  const act = wire.announceActivity({ urls, object: activity, serial: Date.now(), audience: urls.actor });
-  const inboxes = [...new Set(agent.store.getContacts().followers
-    .map(f => f.sharedInbox || f.inbox).filter(Boolean))];
-  await agent.deliverer.deliverToAll(inboxes, act);
-  await agent.publisher.recordOutbox(act);
-  return act;
-}
-
-// A block is state, not speech: the list changes and the follow ends, and
-// nothing is delivered TO THE BLOCKED PARTY (§6.10). Intake already refuses a
-// blocked author on arrival. A group additionally announces the ban to its
-// members (FEP-1b12) — announceModeration keeps a person's blocks silent.
-export async function blockActor(agent, actorUrl) {
-  if (!/^https?:\/\/\S+$/.test(String(actorUrl || ''))) throw new Error('actor must be a URL');
-  const b = agent.store.getBlocklist();
-  if (!b.actors.includes(actorUrl)) b.actors.push(actorUrl);
-  agent.store.setBlocklist(b);
-  await unfollowActor(agent, actorUrl).catch(() => {});   // not following is fine
-  await agent.publisher?.publishCollections({ blocked: true }).catch(() => {});
-  await announceModeration(agent,
-    wire.blockActivity({ urls: agent.publisher.urls, targetActor: actorUrl, serial: Date.now() }))
-    .catch(e => agent.log?.(`moderation announce failed: ${e.message}`));
-  return { ok: true, actor: actorUrl };
-}
-
-export async function unblockActor(agent, actorUrl) {
-  const b = agent.store.getBlocklist();
-  b.actors = b.actors.filter(a => a !== actorUrl);
-  agent.store.setBlocklist(b);
-  await agent.publisher?.publishCollections({ blocked: true }).catch(() => {});
-  // The unban is announced as the Undo of the ban, the ban re-stated inside it
-  // — its id was a fragment nobody stored, so receivers match on the shape.
-  await announceModeration(agent, wire.undoActivity({
-    urls: agent.publisher.urls,
-    activity: { type: 'Block', actor: agent.publisher.urls.actor, object: actorUrl },
-    serial: Date.now(),
-  })).catch(e => agent.log?.(`moderation announce failed: ${e.message}`));
-  return { ok: true, actor: actorUrl };
-}
-
-// Apply (or refuse) one queued moderation request — an action a LISTED
-// moderator asked for over federation. Deliveries carry nothing that proves
-// the sender, which is exactly why these wait in a queue for the operator
-// instead of running on arrival; applying one is the operator vouching for it.
-export async function applyModeration(agent, entry) {
-  const { urls } = agent.publisher;
-  const target = typeof entry.activity?.object === 'string'
-    ? entry.activity.object : entry.activity?.object?.id;
-  switch (entry.type) {
-    case 'Block': {
-      if (!target) throw new Error('the queued Block names nobody');
-      // A member is ejected (which mutes and announces the ban); a stranger is
-      // simply blocked. Either way the ban is broadcast once.
-      const member = agent.store.getContacts().followers.some(f => f.actor === target);
-      return member ? ejectFollower(agent, target) : blockActor(agent, target);
-    }
-    case 'Undo': {
-      const inner = entry.activity?.object;
-      const unbanned = typeof inner === 'object' && inner?.type === 'Block'
-        ? (typeof inner.object === 'string' ? inner.object : inner.object?.id) : null;
-      if (!unbanned) throw new Error('the queued Undo does not name a Block');
-      const muted = agent.store.getMuted();
-      muted.actors = muted.actors.filter(a => a !== unbanned);
-      agent.store.setMuted(muted);
-      return unblockActor(agent, unbanned);
-    }
-    case 'Delete': {
-      if (!target) throw new Error('the queued Delete names nothing');
-      // Removing a post from the group is unsaying its carry.
-      return agent.intake.retract(target);
-    }
-    case 'Add':
-    case 'Remove': {
-      if (!target) throw new Error('the queued roster change names nobody');
-      const cfg = { ...agent.store.getConfig() };
-      const prev = cfg.moderators || [];
-      cfg.moderators = entry.type === 'Add'
-        ? [...new Set([...prev, target])]
-        : prev.filter(m => m !== target);
-      agent.store.setConfig(cfg);
-      if (agent.publisher) agent.publisher.config.moderators = cfg.moderators;
-      await agent.publisher.publishProfile();
-      await announceModeration(agent, wire.addRemoveActivity({
-        urls, type: entry.type, object: target, target: urls.moderators, serial: Date.now(),
-      })).catch(e => agent.log?.(`moderation announce failed: ${e.message}`));
-      return { ok: true, moderators: cfg.moderators };
-    }
-    default: throw new Error(`no way to apply a queued ${entry.type}`);
-  }
-}
-
-// Pin or unpin an own post. Republishing the featured collection is what makes
-// the pin real to anyone else — the actor document names that collection, and
-// a visitor's server reads it, so the profile is republished too (it skips
-// itself when nothing changed).
-export async function pinStatus(agent, s, pinned) {
-  if (s.actor !== agent.publisher.urls.actor) throw new Error('not your status');
-  const updated = agent.store.updateStatus(s.noteId, { pinned: !!pinned });
-  await agent.publisher.publishFeatured().catch(e => agent.log?.(`featured: ${e.message}`));
-  if (agent.publisher.publishProfilePage) {
-    await agent.publisher.publishProfilePage().catch(e => agent.log?.(`profile page: ${e.message}`));
-  }
-  agent.publisher.publishProfile?.().catch(() => {});
-  return updated || s;
-}