fedipod-server 0.29.0 → 0.30.0

package/lib/core/social.mjs

@@ -1,561 +0,0 @@
-// social.mjs — outbound social actions (follow, like, announce, delete)
-// shared by the admin API and the Mastodon-API facade. Each action delivers
-// the activity and mirrors state into the store; the store keeps the
-// activity a later Undo must name.
-
-import crypto from 'node:crypto';
-import * as wire from './wire.mjs';
-import * as podNotes from '../pod/notes.mjs';
-import { dropFollower } from './store.mjs';
-
-// WebFinger, ours rather than fedify's — v2 dropped lookupWebFinger.
-//
-// Better here anyway: the host comes out of a handle, and a handle can arrive
-// in a MENTION inside a post somebody else wrote, so it is remote input and
-// belongs behind the same SSRF guard as every other outbound request. fedify's
-// lookup did not go through ours. https only, because a handle resolved over
-// plaintext is a handle anyone on the path can answer for.
-//
-// `fetchImpl`, when given, makes the request instead of safeFetch: the agent's
-// own remote read, which in the browser build is the relay — a server-side
-// fetch, so the lookup does not depend on the far pod host answering a
-// browser's cross-origin request. Every other remote read there goes the
-// same way; WebFinger went direct and was the one lookup that could fail
-// while the rest worked.
-export async function lookupWebFinger(acct, { fetchImpl = null } = {}) {
-  const clean = String(acct || '').replace(/^acct:/, '');
-  const at = clean.lastIndexOf('@');
-  if (at < 1) return null;
-  const [user, host] = [clean.slice(0, at), clean.slice(at + 1)];
-  if (!host || /[/\\?#]/.test(host)) return null;
-  const { safeFetch, readCapped } = await import('../shared/safefetch.mjs');
-  const url = `https://${host}/.well-known/webfinger?resource=${encodeURIComponent(`acct:${clean}`)}`;
-  const headers = { accept: 'application/jrd+json, application/json' };
-  const res = await (fetchImpl ? fetchImpl(url, { headers }) : safeFetch(url, { headers })).catch(() => null);
-  if (!res || res.status >= 400) return null;
-  let jrd;
-  try { jrd = JSON.parse(await readCapped(res, 256 * 1024)); } catch { return null; }
-  // The JRD says who it is about. Nothing checked it, so a host answering every
-  // query with one account's document made `@anyone@that.host` resolve to that
-  // account — and it was then stored under the handle that was asked for, not
-  // the one it turned out to be.
-  const subject = String(jrd?.subject || '').replace(/^acct:/, '').toLowerCase();
-  if (subject && subject !== clean.toLowerCase()) {
-    return null;
-  }
-  return jrd;
-}
-
-export const selfLink = (jrd) => jrd?.links?.find(l => l.rel === 'self' &&
-  /application\/(activity\+json|ld\+json)/.test(l.type || ''));
-
-// A WebFinger server can name an actor on ANY host, and until this ran we
-// believed it. The handle is remote input — it arrives in the Mention tags of a
-// note somebody else wrote — so evil.example could answer for `@x@evil.example`
-// with a real, busy actor elsewhere, and a reply that carried that mention was
-// addressed, tagged and DELIVERED to a third party who had nothing to do with
-// the thread, over our signature.
-//
-// The host cannot simply be required to match: `@user@example.com` served by
-// mastodon.example is the ordinary delegated setup and the whole point of
-// WebFinger. So ask the ACTOR's own host who it says that actor is, and require
-// it to come back to the same document. A server may name anyone; it cannot
-// make that person's server agree. This is the round trip Mastodon does.
-//
-// Only when the two hosts differ — same-host is self-consistent by
-// construction, so the common case costs no extra request.
-export async function confirmDelegation(asked, doc, lookup = lookupWebFinger) {
-  let home;
-  try { home = new URL(doc.id).host.toLowerCase(); }
-  catch { throw new Error(`actor id is not a URL (${doc.id})`); }
-  if (home === asked.toLowerCase()) return;
-  const user = doc.preferredUsername;
-  if (!user) {
-    throw new Error(`${asked} points at ${doc.id} on another host, which names no `
-      + 'username to confirm it by');
-  }
-  const back = await lookup(`acct:${user}@${home}`);
-  if (selfLink(back)?.href !== doc.id) {
-    throw new Error(`${asked} claims ${doc.id}, but ${home} does not agree that is `
-      + `@${user}@${home} — refusing to take one host's word for another's actor`);
-  }
-}
-
-// acct:user@host → verified actor doc (cached by fetchAP), or throws.
-export async function resolveHandle(agent, handle) {
-  const clean = String(handle || '').replace(/^@/, '');
-  if (!/^[^@]+@[^@]+$/.test(clean)) throw new Error('handle must look like user@host');
-  if (agent.store.isBlocked('https://' + clean.split('@')[1] + '/')) throw new Error('domain is blocked');
-  // Through the agent's own remote read where it has one — the relay, in the
-  // browser build — and directly otherwise.
-  const remote = agent.intake?.deliverer?.signedFetch
-    ? (u, i) => agent.intake.deliverer.signedFetch(u, i) : null;
-  const lookup = (a) => lookupWebFinger(a, { fetchImpl: remote });
-  const jrd = await lookup('acct:' + clean);
-  const self = selfLink(jrd);
-  if (!self?.href) throw new Error(`webfinger found no actor for ${clean}`);
-  const doc = await agent.intake.fetchAP(self.href);
-  if (!doc?.id) throw new Error(`actor document unusable for ${clean}`);
-  if (agent.store.isBlocked(doc.id)) throw new Error('actor is blocked');
-  await confirmDelegation(clean.slice(clean.lastIndexOf('@') + 1), doc, lookup);
-  // Counts live in the collections, not the actor document, so a client asking
-  // "who is this" would otherwise be told everyone has none. Two GETs, and only
-  // when someone asked by name — never on the drain path.
-  await cacheCounts(agent, doc);
-  return doc;
-}
-
-// totalItems off the followers/following collections, stored beside the cached
-// actor. Best effort: a collection that will not answer leaves the count unset
-// rather than reported as zero, which is a different claim.
-async function cacheCounts(agent, doc) {
-  const total = async (url) => {
-    if (!url) return null;
-    try {
-      const res = await agent.intake.fetchAP(url);
-      return Number.isInteger(res?.totalItems) ? res.totalItems : null;
-    } catch { return null; }
-  };
-  const [followers, following] = await Promise.all([total(doc.followers), total(doc.following)]);
-  if (followers === null && following === null) return;
-  const actors = agent.store.getActors();
-  if (!actors[doc.id]) return;
-  actors[doc.id] = { ...actors[doc.id], counts: { followers, following } };
-  agent.store.write('actors.json', actors);
-}
-
-// `doc` skips the fetch when the caller already resolved the actor; a bulk
-// import passes publish:false and republishes the collections once at the end.
-export async function followActor(agent, actorUrl, { publish = true, doc: fetched = null, serial = Date.now() } = {}) {
-  const doc = fetched || await agent.intake.fetchAP(actorUrl);
-  if (!doc?.inbox) throw new Error(`actor document unusable (${actorUrl})`);
-  if (agent.store.isBlocked(doc.id)) throw new Error('actor is blocked');
-  const contacts = agent.store.getContacts();
-  let rec = contacts.following.find(f => f.actor === doc.id);
-  if (!rec) {
-    rec = { actor: doc.id, inbox: doc.inbox, accepted: false };
-    contacts.following.push(rec);
-  }
-  const follow = wire.followActivity({ urls: agent.publisher.urls, targetActor: doc.id, serial });
-  rec.followActivity = follow;               // kept for a later Undo
-  agent.store.setContacts(contacts);
-  await agent.deliverer.deliver(doc.inbox, follow);
-  if (publish) await agent.publisher.publishCollections({ following: true, pending: true });
-  return doc;
-}
-
-export async function followHandle(agent, handle, { serial = Date.now() } = {}) {
-  const doc = await resolveHandle(agent, handle);
-  await followActor(agent, doc.id, { serial });
-  const clean = String(handle || '').replace(/^@/, '');
-  const contacts = agent.store.getContacts();
-  const rec = contacts.following.find(f => f.actor === doc.id);
-  if (rec && !rec.handle) { rec.handle = clean; agent.store.setContacts(contacts); }
-  return { ok: true, actor: doc.id };
-}
-
-export async function unfollowActor(agent, actor, { serial = Date.now() } = {}) {
-  const contacts = agent.store.getContacts();
-  const rec = contacts.following.find(f => f.actor === actor);
-  if (!rec) throw new Error('not following that actor');
-  if (rec.followActivity) {
-    await agent.deliverer.deliver(rec.inbox,
-      wire.undoActivity({ urls: agent.publisher.urls, activity: rec.followActivity, serial }));
-  }
-  contacts.following = contacts.following.filter(f => f.actor !== actor);
-  agent.store.setContacts(contacts);
-  await agent.publisher.publishCollections({ following: true, pending: true });
-  return { ok: true };
-}
-
-export async function favourite(agent, s, { serial = Date.now() } = {}) {
-  if (s.favourited) return s;
-  const doc = await agent.intake.fetchAP(s.actor);
-  if (!doc?.inbox) throw new Error('author inbox unavailable');
-  const act = wire.likeActivity({ urls: agent.publisher.urls, noteId: s.noteId, serial, to: s.actor });
-  await agent.deliverer.deliver(doc.endpoints?.sharedInbox || doc.inbox, act);
-  return agent.store.updateStatus(s.noteId, { favourited: true, likeActivity: act });
-}
-
-export async function unfavourite(agent, s, { serial = Date.now() } = {}) {
-  if (s.likeActivity) {
-    const doc = await agent.intake.fetchAP(s.actor).catch(() => null);
-    if (doc?.inbox) {
-      await agent.deliverer.deliver(doc.endpoints?.sharedInbox || doc.inbox,
-        wire.undoActivity({ urls: agent.publisher.urls, activity: s.likeActivity, serial }));
-    }
-  }
-  return agent.store.updateStatus(s.noteId, { favourited: false, likeActivity: undefined });
-}
-
-// Announce goes to our followers (that's what boosting is) and to the author.
-export async function reblog(agent, s, { serial = Date.now() } = {}) {
-  if (s.reblogged) return s;
-  const { urls } = agent.publisher;
-  const act = wire.announceActivity({ urls, object: s.noteId, serial });
-  const inboxes = new Set(agent.store.getContacts().followers
-    .map(f => f.sharedInbox || f.inbox).filter(Boolean));
-  if (s.actor !== urls.actor) {
-    const doc = await agent.intake.fetchAP(s.actor).catch(() => null);
-    if (doc?.inbox) inboxes.add(doc.endpoints?.sharedInbox || doc.inbox);
-  }
-  await agent.deliverer.deliverToAll([...inboxes], act);
-  // Mark it boosted before recording it: a failed outbox write costs one
-  // missing entry, a failed status write would let a retry announce twice.
-  const updated = agent.store.updateStatus(s.noteId, { reblogged: true, announceActivity: act });
-  await agent.publisher.recordOutbox(act);
-  if (await agent.store.commit?.() === false) agent.log(`boost sent but its timeline row was refused: ${s.noteId}`);
-  return updated;
-}
-
-export async function unreblog(agent, s, { serial = Date.now() } = {}) {
-  if (s.announceActivity) {
-    const undo = wire.undoActivity({ urls: agent.publisher.urls, activity: s.announceActivity, serial });
-    const inboxes = new Set(agent.store.getContacts().followers
-      .map(f => f.sharedInbox || f.inbox).filter(Boolean));
-    const doc = await agent.intake.fetchAP(s.actor).catch(() => null);
-    if (doc?.inbox && s.actor !== agent.publisher.urls.actor) inboxes.add(doc.endpoints?.sharedInbox || doc.inbox);
-    await agent.deliverer.deliverToAll([...inboxes], undo);
-    await agent.publisher.unrecordOutbox(i => i?.id === s.announceActivity.id, { record: () => undo });
-  }
-  return agent.store.updateStatus(s.noteId, { reblogged: false, announceActivity: undefined });
-}
-
-// Group: end a following we will no longer carry. Forgetting them locally is
-// not enough — without the Reject their server keeps the relationship and they
-// keep receiving everything the group announces. Muting them too, because an
-// ejection anyone can undo by re-following is not an ejection; a re-follow is
-// still auto-accepted, but nothing of theirs gets carried.
-export async function ejectFollower(agent, actor) {
-  const { urls } = agent.publisher;
-  const contacts = agent.store.getContacts();
-  const rec = contacts.followers.find(f => f.actor === actor);
-  if (!rec) throw new Error('not a member');
-  dropFollower(contacts, actor, 'ejected');
-  agent.store.setContacts(contacts);
-  const muted = agent.store.getMuted();
-  muted.actors = [...new Set([...muted.actors, actor])];
-  agent.store.setMuted(muted);
-  await agent.publisher.publishCollections({ followers: true });
-  // The ban is broadcast to the membership (FEP-1b12), so their servers can
-  // mirror it. Never sent to the ejected member — they get the Reject below.
-  await announceModeration(agent,
-    wire.blockActivity({ urls, targetActor: actor, serial: Date.now() }))
-    .catch(e => agent.log?.(`moderation announce failed: ${e.message}`));
-  // A Bluesky-side member's departure sticks by blocking the DID.
-  if (rec.bsky) {
-    await agent.bskygroup?.blockDid(rec.bsky.did)
-      .catch(e => agent.log?.(`bluesky block failed for ${rec.bsky.handle}: ${e.message}`));
-    return { ok: true, actor, told: true };
-  }
-  if (rec.inbox) {
-    await agent.deliverer.deliver(rec.inbox, wire.rejectActivity({
-      urls,
-      followActivity: { id: rec.followId, type: 'Follow', actor, object: urls.actor },
-      serial: Date.now(),
-    }));
-  }
-  return { ok: true, actor, told: !!rec.inbox };
-}
-
-// Group: answer a held join request. Admitting is the Accept onFollow would
-// have sent immediately had the group not been gated.
-export async function admitRequest(agent, actor, { publish = true, serial = Date.now() } = {}) {
-  const reqs = agent.store.getRequests();
-  const req = reqs.find(r => r.actor === actor);
-  if (!req) throw new Error('no such request');
-  const contacts = agent.store.getContacts();
-  if (!contacts.followers.some(f => f.actor === actor)) {
-    // Admitting a bridged Bluesky member retires their Bluesky-only record,
-    // the same way an ungated group's follow does: one person, one membership.
-    const bridgedDid = /^https:\/\/bsky\.brid\.gy\/ap\/(did:[^/]+)$/.exec(actor)?.[1];
-    if (bridgedDid) contacts.followers = contacts.followers.filter(f => f.bsky?.did !== bridgedDid);
-    contacts.followers.push(req.bsky
-      ? { actor, bsky: req.bsky }
-      : { actor, inbox: req.inbox, sharedInbox: req.sharedInbox, followId: req.activity?.id });
-    agent.store.setContacts(contacts);
-    agent.store.addNotification({ type: 'follow', actor, ...(req.bsky ? { bsky: true } : {}) });
-  }
-  agent.store.setRequests(reqs.filter(r => r.actor !== actor));
-  // A Bluesky-only member has no inbox and no Accept to receive; the follow
-  // already stands on their side. The one-time bridge nudge goes out instead.
-  if (req.bsky) {
-    await agent.bskygroup?.nudgeOnce(contacts.followers.find(f => f.actor === actor));
-    return { ok: true, actor };
-  }
-  // A bulk admit passes publish:false and republishes once for the lot.
-  if (publish) await agent.publisher.publishCollections({ followers: true, pending: true });
-  await agent.deliverer.deliver(req.inbox, wire.acceptActivity({
-    urls: agent.publisher.urls, followActivity: req.activity, serial,
-  }));
-  return { ok: true, actor };
-}
-
-// Refusing is not a ban: they may ask again, and the queue is where you would
-// see that. Eject is the sticky one, because it mutes.
-export async function refuseRequest(agent, actor, { serial = Date.now() } = {}) {
-  const reqs = agent.store.getRequests();
-  const req = reqs.find(r => r.actor === actor);
-  if (!req) throw new Error('no such request');
-  agent.store.setRequests(reqs.filter(r => r.actor !== actor));
-  await agent.publisher?.publishCollections({ pending: true }).catch(() => {});
-  // No Reject can reach a Bluesky-only requester, so the refusal is enforced
-  // where it can be: their DID is blocked.
-  if (req.bsky) {
-    await agent.bskygroup?.blockDid(req.bsky.did)
-      .catch(e => agent.log?.(`bluesky block failed for ${req.bsky.handle}: ${e.message}`));
-    return { ok: true, actor };
-  }
-  await agent.deliverer.deliver(req.inbox, wire.rejectActivity({
-    urls: agent.publisher.urls, followActivity: req.activity, serial,
-  }));
-  return { ok: true, actor };
-}
-
-// Group: unsay an Announce. The work is in Intake because an upstream Delete
-// has to do the same thing, and both must use the recipient set amplify used.
-export async function retractAnnouncement(agent, noteId) {
-  return agent.intake.retract(noteId);
-}
-
-// Remove an own note everywhere: Delete→followers, remote note + outbox,
-// local pod RDF, statuses mirror.
-//
-// Two of the three pod deletes have to land, and both are checked. While the
-// note document answers, anyone holding its id can still read a post its author
-// deleted — and the `-create` beside it EMBEDS the whole note, so leaving that
-// one behind publishes the same content under another name. A failure keeps the
-// post here and says so, rather than reporting a deletion that did not happen:
-// removing it locally would leave nothing to try again with, and nothing to see
-// that it is still up.
-// A vote is the fediverse convention: one bare Note per chosen option, whose
-// name IS the option, inReplyTo the question, addressed to the question's
-// author alone. The documents are stored for dereference but never listed —
-// not in the outbox, not in the local index.
-export async function votePoll(agent, s, choices) {
-  const { urls } = agent.publisher;
-  const poll = s.poll || {};
-  const opts = poll.options || [];
-  if (poll.closed || (poll.expiresAt && Date.parse(poll.expiresAt) < Date.now())) {
-    return { ok: false, error: 'this poll has closed' };
-  }
-  if (poll.voted) return { ok: false, error: 'already voted' };
-  // Your own poll is the one you are counting, not one you are answering.
-  if (s.actor === urls.actor) return { ok: false, error: 'this is your own poll' };
-  const picks = [...new Set(choices)].filter(i => i >= 0 && i < opts.length);
-  if (!picks.length) return { ok: false, error: 'invalid choice' };
-  if (!poll.multiple && picks.length > 1) return { ok: false, error: 'this poll takes one choice' };
-  const author = await agent.intake.fetchAP(s.actor).catch(() => null);
-  const inbox = author?.endpoints?.sharedInbox || author?.inbox;
-  if (!inbox) return { ok: false, error: 'could not reach the poll author' };
-  const published = new Date().toISOString();
-  for (const i of picks) {
-    const id = urls.notes + published.slice(0, 10) + '-vote-' + crypto.randomBytes(4).toString('hex');
-    const note = {
-      '@context': wire.AS_CTX, id, type: 'Note',
-      attributedTo: urls.actor, name: opts[i].title,
-      inReplyTo: s.noteId, published, to: [s.actor],
-    };
-    const create = {
-      '@context': wire.AS_CTX, id: wire.createActivityId(id), type: 'Create',
-      actor: urls.actor, published, to: [s.actor], object: note,
-    };
-    await podNotes.write(agent.remote, id, note);
-    await podNotes.writeCreate(agent.remote, create.id, create);
-    await agent.deliverer.deliverToAll([inbox], create);
-  }
-  agent.store.updateStatus(s.noteId, {
-    poll: {
-      ...poll, voted: true, ownVotes: picks,
-      options: opts.map((o, j) => (picks.includes(j) ? { ...o, votes: (o.votes || 0) + 1 } : o)),
-    },
-  });
-  return { ok: true };
-}
-
-export async function deleteNote(agent, s) {
-  const { urls } = agent.publisher;
-  // The deletion goes where the post went: followers unless it was direct, and
-  // everyone it named or was blind-copied to. Addressed as the post was, read
-  // from the post itself while it is still there.
-  const doc = await Promise.resolve().then(() => podNotes.read(agent.remote, s.noteId)).catch(() => null);
-  const shape = wire.addressing(urls, s.visibility || 'public', (s.mentions || []).map(m => m.href).filter(Boolean));
-  const to = Array.isArray(doc?.to) ? doc.to : shape.to;
-  const cc = Array.isArray(doc?.cc) ? doc.cc : shape.cc;
-  const named = [...to, ...cc, ...(s.addressed || []), ...(s.replyActor ? [s.replyActor] : [])]
-    .filter(a => typeof a === 'string' && a !== wire.PUBLIC && a !== urls.followers && a !== urls.actor);
-  const inboxes = [
-    ...(s.visibility === 'direct' ? [] : agent.store.getContacts().followers.map(f => f.sharedInbox || f.inbox)),
-    ...(agent.publisher.inboxesFor ? await agent.publisher.inboxesFor(named).catch(() => []) : []),
-  ].filter(Boolean);
-  const del = wire.deleteActivity({ urls, noteId: s.noteId, to, cc });
-  await agent.deliverer.deliverToAll(inboxes, del);
-
-  // The note is REPLACED with a Tombstone rather than removed, so a peer that
-  // dereferences it learns the post was deleted instead of a bare 404 (§7.4).
-  // The Tombstone must stay readable; the container above it is owner-only, so
-  // the ACL cannot be inherited. The Create activity is the withdrawn action,
-  // not the object, so it is deleted outright.
-  const stuck = [];
-  const deletedAt = new Date().toISOString();
-  // Only inside the posts folders: an object that lives elsewhere on the pod
-  // (an annotation a client keeps in its own place, or anything it named) is
-  // that client's document, and a deletion here must not overwrite it — the
-  // profile, say — with a Tombstone. Its Create and outbox entry still go.
-  const ours = [urls.notes, urls.privateNotes].some(c => String(s.noteId).startsWith(c));
-  try {
-    if (ours) await podNotes.writeTombstone(agent.remote, s.noteId, wire.noteTombstone(s.noteId, deletedAt));
-  } catch { stuck.push(s.noteId); }
-  // The Create becomes a Tombstone too, not a gap: it embedded the post, so
-  // its words go, and whoever asks for it is told it is gone (410 through the
-  // Gateway) rather than that it never was.
-  // An object kept outside the posts folders has its Create inside them, under
-  // the name it was given (publishObject).
-  const createId = ours ? wire.createActivityId(s.noteId) : (s.slug ? wire.createActivityId(urls.notes + s.slug) : null);
-  try {
-    if (createId) await podNotes.writeTombstone(agent.remote, createId, wire.noteTombstone(createId, deletedAt, 'Create'));
-  } catch { stuck.push(createId); }
-  if (stuck.length) {
-    agent.log?.(`delete ${s.noteId}: the pod kept ${stuck.length} document(s) — the post is STILL PUBLISHED`);
-    return {
-      ok: false, stillPublished: stuck,
-      error: 'the pod would not remove the post — it is still published, and has been kept here so you can try again',
-    };
-  }
-  // Empty, and referenced by nothing once the note is gone.
-  await podNotes.dropReplies(agent.remote, wire.repliesId(s.noteId));
-
-  // The Bluesky mirror goes with the post. Best-effort: a mirror the far side
-  // already lost is not a reason to keep the post here.
-  if (s.atproto?.uri && agent.atproto?.connected()) {
-    await agent.atproto.deleteCrossPost(s.atproto.uri)
-      .then(() => agent.log?.(`bluesky mirror deleted: ${s.atproto.uri}`))
-      .catch(e => agent.log?.(`bluesky mirror not deleted (${e.message}): ${s.atproto.uri}`));
-  }
-
-  // The note's outbox entry, and our own boost of it if there was one. The
-  // Delete takes the post's place — only for a post the outbox listed, so a
-  // private post's deletion stays as private as the post was.
-  const itsOwn = (i) => i === s.noteId || (i?.id && i.id === s.announceActivity?.id)
-    // its edits too: an Update carries the post's words, which must not
-    // outlive the post on the public record
-    || (i?.type === 'Update' && (typeof i.object === 'string' ? i.object : i.object?.id) === s.noteId);
-  await agent.publisher.unrecordOutbox(itsOwn,
-    { record: (gone) => (gone.includes(s.noteId) ? del : null) });
-  agent.store.removeStatus(s.noteId);
-  return { ok: true };
-}
-
-// FEP-1b12: a GROUP's moderation is announced to its followers, so their
-// servers can mirror the action. Group moderation only — a person's blocks
-// never go on the wire (that is also the spec's own SHOULD NOT), which is why
-// the guard lives here rather than in every caller. Never delivered to the
-// moderated party; the announce goes to the membership.
-export async function announceModeration(agent, activity) {
-  if (agent.store.getConfig()?.kind !== 'group') return null;
-  const { urls } = agent.publisher;
-  const act = wire.announceActivity({ urls, object: activity, serial: Date.now(), audience: urls.actor });
-  const inboxes = [...new Set(agent.store.getContacts().followers
-    .map(f => f.sharedInbox || f.inbox).filter(Boolean))];
-  await agent.deliverer.deliverToAll(inboxes, act);
-  await agent.publisher.recordOutbox(act);
-  return act;
-}
-
-// A block is state, not speech: the list changes and the follow ends, and
-// nothing is delivered TO THE BLOCKED PARTY (§6.10). Intake already refuses a
-// blocked author on arrival. A group additionally announces the ban to its
-// members (FEP-1b12) — announceModeration keeps a person's blocks silent.
-export async function blockActor(agent, actorUrl, { serial = Date.now() } = {}) {
-  if (!/^https?:\/\/\S+$/.test(String(actorUrl || ''))) throw new Error('actor must be a URL');
-  const b = agent.store.getBlocklist();
-  if (!b.actors.includes(actorUrl)) b.actors.push(actorUrl);
-  agent.store.setBlocklist(b);
-  await unfollowActor(agent, actorUrl).catch(() => {});   // not following is fine
-  await agent.publisher?.publishCollections({ blocked: true }).catch(() => {});
-  await announceModeration(agent,
-    wire.blockActivity({ urls: agent.publisher.urls, targetActor: actorUrl, serial }))
-    .catch(e => agent.log?.(`moderation announce failed: ${e.message}`));
-  return { ok: true, actor: actorUrl };
-}
-
-export async function unblockActor(agent, actorUrl, { serial = Date.now() } = {}) {
-  const b = agent.store.getBlocklist();
-  b.actors = b.actors.filter(a => a !== actorUrl);
-  agent.store.setBlocklist(b);
-  await agent.publisher?.publishCollections({ blocked: true }).catch(() => {});
-  // The unban is announced as the Undo of the ban, the ban re-stated inside it
-  // — its id was a fragment nobody stored, so receivers match on the shape.
-  await announceModeration(agent, wire.undoActivity({
-    urls: agent.publisher.urls,
-    activity: { type: 'Block', actor: agent.publisher.urls.actor, object: actorUrl },
-    serial,
-  })).catch(e => agent.log?.(`moderation announce failed: ${e.message}`));
-  return { ok: true, actor: actorUrl };
-}
-
-// Apply (or refuse) one queued moderation request — an action a LISTED
-// moderator asked for over federation. Deliveries carry nothing that proves
-// the sender, which is exactly why these wait in a queue for the operator
-// instead of running on arrival; applying one is the operator vouching for it.
-export async function applyModeration(agent, entry) {
-  const { urls } = agent.publisher;
-  const target = typeof entry.activity?.object === 'string'
-    ? entry.activity.object : entry.activity?.object?.id;
-  switch (entry.type) {
-    case 'Block': {
-      if (!target) throw new Error('the queued Block names nobody');
-      // A member is ejected (which mutes and announces the ban); a stranger is
-      // simply blocked. Either way the ban is broadcast once.
-      const member = agent.store.getContacts().followers.some(f => f.actor === target);
-      return member ? ejectFollower(agent, target) : blockActor(agent, target);
-    }
-    case 'Undo': {
-      const inner = entry.activity?.object;
-      const unbanned = typeof inner === 'object' && inner?.type === 'Block'
-        ? (typeof inner.object === 'string' ? inner.object : inner.object?.id) : null;
-      if (!unbanned) throw new Error('the queued Undo does not name a Block');
-      const muted = agent.store.getMuted();
-      muted.actors = muted.actors.filter(a => a !== unbanned);
-      agent.store.setMuted(muted);
-      return unblockActor(agent, unbanned);
-    }
-    case 'Delete': {
-      if (!target) throw new Error('the queued Delete names nothing');
-      // Removing a post from the group is unsaying its carry.
-      return agent.intake.retract(target);
-    }
-    case 'Add':
-    case 'Remove': {
-      if (!target) throw new Error('the queued roster change names nobody');
-      const cfg = { ...agent.store.getConfig() };
-      const prev = cfg.moderators || [];
-      cfg.moderators = entry.type === 'Add'
-        ? [...new Set([...prev, target])]
-        : prev.filter(m => m !== target);
-      agent.store.setConfig(cfg);
-      if (agent.publisher) agent.publisher.config.moderators = cfg.moderators;
-      await agent.publisher.publishProfile();
-      await announceModeration(agent, wire.addRemoveActivity({
-        urls, type: entry.type, object: target, target: urls.moderators, serial: Date.now(),
-      })).catch(e => agent.log?.(`moderation announce failed: ${e.message}`));
-      return { ok: true, moderators: cfg.moderators };
-    }
-    default: throw new Error(`no way to apply a queued ${entry.type}`);
-  }
-}
-
-// Pin or unpin an own post. Republishing the featured collection is what makes
-// the pin real to anyone else — the actor document names that collection, and
-// a visitor's server reads it, so the profile is republished too (it skips
-// itself when nothing changed).
-export async function pinStatus(agent, s, pinned) {
-  if (s.actor !== agent.publisher.urls.actor) throw new Error('not your status');
-  const updated = agent.store.updateStatus(s.noteId, { pinned: !!pinned });
-  await agent.publisher.publishFeatured().catch(e => agent.log?.(`featured: ${e.message}`));
-  if (agent.publisher.publishProfilePage) {
-    await agent.publisher.publishProfilePage().catch(e => agent.log?.(`profile page: ${e.message}`));
-  }
-  agent.publisher.publishProfile?.().catch(() => {});
-  return updated || s;
-}