fedipod-server 0.29.0 → 0.30.0

package/lib/device/cli/context.mjs

@@ -1,288 +0,0 @@
-// context.mjs — what every command starts from: the arguments, which
-// identity (HOME) and port (PORT) a command means, and the helpers that ask,
-// probe and finish. HOME, PORT and DEFAULT_ISSUE are live bindings: useProfile()
-// reassigns them and every command module sees the new value.
-
-import fs from 'node:fs';
-import { localFetch } from '../../../lib/client/localapi.mjs';
-import os from 'node:os';
-import path from 'node:path';
-import net from 'node:net';
-import readline from 'node:readline';
-import { spawn } from 'node:child_process';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { apRoot, profilesDir, identityHomes, isLegacyRoot, CURRENT_ROOT, tildify, rootOf,
-  readRoot, writeRoot, defaultProfile, profileHome, rootHoldsIdentity, ROOT_FILE,
-  recordLastUsed, writeJsonAtomic } from '../../../lib/device/home.mjs';
-import { insecureUrlReason } from '../../../lib/shared/safefetch.mjs';
-import { portFree, freePortFrom } from '../../../lib/device/ports.mjs';
-
-export const args = process.argv.slice(2);
-export const cmd = args[0];
-export const flag = (name, dflt) => {
-  const i = args.indexOf('--' + name);
-  return i >= 0 ? args[i + 1] : dflt;
-};
-export const has = (name) => args.includes('--' + name);
-// The port can also be given bare — `npm start 8081` reaches us as `up 8081`,
-// because npm passes positionals through but eats `--port`. Bare form only for
-// the start-style commands, where a lone number cannot mean anything else.
-export const barePort = () => {
-  if (!['up', 'start', 'run'].includes(cmd)) return null;
-  for (let i = 1; i < args.length; i++) {
-    if (/^\d+$/.test(args[i]) && !args[i - 1].startsWith('--')) return args[i];
-  }
-  return null;
-};
-export const portFlag = () => flag('port', null) || barePort();
-// One identity per home, and EVERY identity is `<root>/profiles/<name>/`. There
-// is no privileged unnamed one: `root.json` names which you get when you do not
-// say, and that is a pointer you can change rather than a directory you have to
-// move a private key out of. lib/home.mjs decides the root.
-//
-// An explicit --home / AP_HOME still wins and is taken literally: you named a
-// directory, so that directory is the identity, root.json unread. That is what
-// `rootOf` has always documented for a custom home.
-export const PROFILE = flag('profile', process.env.AP_PROFILE || null);
-export const AP_ROOT = apRoot();
-export const PROFILES_DIR = profilesDir(AP_ROOT);
-
-// `let`, because setup does not know which identity it is until it has asked for
-// the handle — the home is named after it. Everything below reads HOME at call
-// time, so reassigning it once, early, is enough; PORT is the exception and is
-// recomputed with it.
-export let DEFAULT_ISSUE = null;                      // set when the pointer is unusable
-export let HOME = flag('home', process.env.AP_HOME || (() => {
-  if (PROFILE) return profileHome(AP_ROOT, PROFILE);
-  const d = defaultProfile(AP_ROOT);
-  if (typeof d === 'string') return profileHome(AP_ROOT, d);
-  DEFAULT_ISSUE = d?.missing
-    ? `${ROOT_FILE} names "${d.missing}", which is not an identity here`
-    : 'there is more than one identity here and none is the default';
-  return profileHome(AP_ROOT, d?.missing || '');
-})());
-
-// The port chosen at setup is remembered, so `start`/`stop`/`status` need no
-// flags afterwards. Precedence: --port (or a bare port number, `npm start
-// 8081`) > AP_PORT > the recorded choice > 8030.
-// The handle is remembered alongside it, for the named origin: the agent also
-// answers at <handle>.localhost:<port>, and that has to work from the first
-// request, before pod state has been read.
-export function recordedAgent() {
-  try { return JSON.parse(fs.readFileSync(path.join(HOME, 'agent.json'), 'utf8')) || {}; }
-  catch { return {}; }
-}
-export function recordedPort() { return Number(recordedAgent().port) || null; }
-export function recordAgent(fields) {
-  try {
-    fs.mkdirSync(HOME, { recursive: true, mode: 0o700 });
-    const rec = { ...recordedAgent(), ...fields };
-    writeJsonAtomic(path.join(HOME, 'agent.json'), rec, { mode: 0o644 });
-  } catch { /* the flag still works, it just isn't remembered */ }
-}
-export let PORT = Number(portFlag() || process.env.AP_PORT || recordedPort() || 8030);
-
-// Setup is the one command that cannot know its home in advance: the identity is
-// named after the handle, and the handle is the first thing it asks. Everything
-// that reads HOME does so at call time, so pointing it at the right directory as
-// soon as the name exists is enough — PORT is recomputed because it was read
-// from the old home's agent.json.
-export function useProfile(name) {
-  HOME = flag('home', process.env.AP_HOME || profileHome(AP_ROOT, name));
-  PORT = Number(portFlag() || process.env.AP_PORT || recordedPort() || 8030);
-  DEFAULT_ISSUE = null;
-  return HOME;
-}
-
-// A handle becomes a directory name, so it is checked before it is one. Same
-// rule the admin API applies before creating an actor (admin.mjs) — without it
-// a handle containing a slash or `..` climbs out of profiles/.
-const HANDLE_RE = /^[a-z0-9][a-z0-9_-]{0,30}$/;
-export function requireHandle(handle) {
-  if (HANDLE_RE.test(handle)) return handle;
-  console.error(`"${handle}" cannot be a handle: letters, digits, hyphens and underscores,`);
-  console.error('starting with a letter or digit, at most 31 characters.');
-  process.exit(2);
-}
-
-// Commands that act on an identity need one decided. Says which of the three
-// ways it failed, because "no identity" and "which identity" are different
-// problems with different fixes.
-export function requireIdentity() {
-  // An explicit AP_HOME / --home is an explicit identity directory. Nothing
-  // about the machine's root applies to it — including whether that root has
-  // been restructured, which is somebody else's install's problem.
-  if (process.env.AP_HOME || flag('home')) return;
-  if (rootHoldsIdentity(AP_ROOT)) {
-    console.error(`${tildify(AP_ROOT)} still keeps an identity at its top level.`);
-    console.error('Every identity lives in profiles/<name>/ now. Move this one down with:\n');
-    console.error(`  ${process.argv[1]} home --restructure\n`);
-    process.exit(2);
-  }
-  if (!DEFAULT_ISSUE) return;
-  const homes = identityHomes(AP_ROOT).filter(h => fs.existsSync(path.join(h.dir, 'credential.json')));
-  console.error(DEFAULT_ISSUE + '.');
-  if (homes.length) {
-    console.error(`\n  ${process.argv[1]} --profile <name> start\n`);
-    console.error('Whichever you start is remembered, so plain commands mean that one afterwards.');
-    console.error(`here: ${homes.map(h => h.name).join(', ')}`);
-  } else {
-    console.error(`\nThere are no identities yet — ${process.argv[1]} setup`);
-  }
-  process.exit(2);
-}
-
-export function askHidden(prompt) {
-  return new Promise((resolve) => {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    const onData = (c) => { if (String(c) !== '\n' && String(c) !== '\r') readline.moveCursor(process.stdout, -1, 0), process.stdout.write('*'); };
-    process.stdin.on('data', onData);
-    rl.question(prompt, (answer) => { process.stdin.off('data', onData); rl.close(); process.stdout.write('\n'); resolve(answer); });
-  });
-}
-
-// Plain prompt with a default: Enter accepts it. Non-interactive runs
-// (scripts, CI) take the default silently, so flags remain sufficient.
-let sharedRl = null;                     // one interface: a new one per
-export function ask(prompt, dflt = '') {        // question would drop buffered input
-  if (!process.stdin.isTTY) return Promise.resolve(dflt);
-  sharedRl ||= readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve) => {
-    sharedRl.question(dflt ? `${prompt} [${dflt}]: ` : `${prompt}: `, (answer) => {
-      resolve(String(answer).trim() || dflt);
-    });
-  });
-}
-export function endAsking() { sharedRl?.close(); sharedRl = null; }
-
-// "Occupied" means "cannot be bound", not "does not answer HTTP": something
-// holding a port without speaking HTTP reads as free to a GET, and then the
-// agent dies on EADDRINUSE.
-
-// The first port from `first` upward that binds. Walking always ends in one,
-// so this is a step rather than a condition.
-
-// Is anything at all on this port? For the operations that MOVE data, "it did
-// not answer as one of ours" is not the same as "nothing is there": an agent
-// started with AP_GATE_TOKEN answers 401 to an un-tokened /status, so agentOn
-// reads a perfectly live agent as stopped — and a sweep that trusted it would
-// copy the state out from under one, which the next write then overwrites.
-// Bind to find out, and fail closed.
-export async function somethingOn(port) {
-  const mine = await agentOn(port);
-  if (mine) return 'running';
-  return (await portFree(port)) ? null : 'something is on the port and did not answer as ours';
-}
-
-// Whatever is on the port — is it one of ours?
-export async function agentOn(port) {
-  try {
-    const res = await localFetch(HOME, port, `/status`, { signal: AbortSignal.timeout(2000) });
-    const body = await res.json();
-    return typeof body?.configured === 'boolean' ? body : null;
-  } catch { return null; }
-}
-
-export const isInside = (root, p) => {
-  const rel = path.relative(root, p);
-  return !!rel && !rel.startsWith('..') && !path.isAbsolute(rel);
-};
-
-export function openBrowser(url) {
-  try {
-    const win = process.platform === 'win32';
-    const cmd = win ? 'cmd' : process.platform === 'darwin' ? 'open' : 'xdg-open';
-    const child = spawn(cmd, win ? ['/c', 'start', '', url] : [url], { detached: true, stdio: 'ignore' });
-    // A box with no opener at all (a server, a bare container) emits this
-    // asynchronously, where the try/catch cannot reach it — and an unhandled
-    // 'error' event on a child process ends the agent.
-    child.on('error', () => {});
-    child.unref();
-  } catch { /* best-effort — the URL is printed anyway */ }
-}
-
-// A one-shot command holds the lease only for its own duration: exiting without
-// releasing it leaves the next `start` as a read-only viewer until the lease
-// expires, which is 5 minutes of doing nothing.
-export async function finish(agent, code = 0) {
-  await agent.lease?.release().catch(() => {});
-  await agent.store?.flush?.().catch(() => {});
-  process.exit(code);
-}
-
-// Anything that decides the identity. Given even one of these, setup stays on
-// the command line exactly as it always did — scripts, CI and the tarball's
-// unpack-and-go line depend on that. At a terminal with none of them, setup
-// asks the two things it needs to open a browser and asks the rest there.
-export const IDENTITY_FLAGS = ['new-account', 'pod', 'issuer', 'email', 'name', 'pod-name',
-  'group', 'approve-joins', 'summary', 'icon', 'root', 'in', 'create-type-index', 'keys', 'rotate-key'];
-
-// Refuse before anything is asked, let alone typed: setup used to overwrite
-// credential.json in place, and a minted credential is only shown once — so
-// the identity it belonged to could not be recovered afterwards.
-export function refuseExistingIdentity() {
-  const credPath = path.join(HOME, 'credential.json');
-  if (!fs.existsSync(credPath) || has('force')) return;
-  let held = '(unreadable)';
-  try { held = JSON.parse(fs.readFileSync(credPath, 'utf8')).remotePod; } catch {}
-  console.error(`${HOME} already holds an identity: ${held}`);
-  console.error('For another identity:  fedipod setup --profile <name>');
-  console.error('To list what exists:   fedipod profiles');
-  console.error('To replace this one:   add --force (the old credential is lost)');
-  console.error('');
-  console.error('If a setup died half-way, do NOT re-run it — the credential it already');
-  console.error('minted cannot be minted twice. Run `fedipod start` and');
-  console.error('finish at /admin/setup/ in the browser.');
-  process.exit(2);
-}
-
-// Ask the handle (permanent, and it names the origin) and the port, start
-// serving, and hand over to the page at /admin/setup/. Nothing is created here: the
-// agent's own POST /setup does all of it, so a closed tab cannot lose a
-// credential that only exists in an HTTP response.
-export async function runBrowserSetup() {
-  const handle = flag('handle') || await ask('handle (the name in your address; permanent)');
-  if (!handle) { console.error('a handle is required'); process.exit(2); }
-  // The handle names the home, so nothing can be decided before it — including
-  // which identity would be overwritten, and which port was remembered.
-  requireHandle(handle);
-  useProfile(PROFILE || handle);
-  refuseExistingIdentity();
-  const port = portFlag() ? PORT : (Number(await ask('port', String(PORT))) || PORT);
-  endAsking();
-
-  // Recorded before the server starts, so `stop`/`status` work while the
-  // browser flow is still open — it used to be written only after the mint.
-  recordAgent({ port, handle });
-
-  const { Agent } = await import(new URL('../../../run-agent.mjs', import.meta.url));
-  const { startAdmin } = await import(new URL('../../../lib/device/admin/index.mjs', import.meta.url));
-  const { hostLabel } = await import(new URL('../../../lib/shared/guard.mjs', import.meta.url));
-  const agent = new Agent({ home: HOME, log: (...a) => console.log('[ap]', ...a) });
-  startAdmin({
-    port, handle, agent,
-    gateToken: process.env.AP_GATE_TOKEN || '',
-    log: (...a) => console.log('[ap]', ...a),
-  });
-  const shutdown = () => {
-    setTimeout(() => process.exit(0), 1500).unref();
-    try { fs.rmSync(path.join(HOME, 'agent.pid'), { force: true }); } catch {}
-    Promise.allSettled([agent.store.flush(), agent.lease?.release()]).finally(() => process.exit(0));
-  };
-  process.on('SIGINT', shutdown);
-  process.on('SIGTERM', shutdown);
-
-  const label = hostLabel(handle);
-  const named = label ? `https://${label}.localhost:${port}/` : null;
-  const plain = `https://localhost:${port}/`;
-  const pad = Math.max(named?.length || 0, plain.length);
-  console.log('');
-  if (named) {
-    console.log(`  ${named.padEnd(pad)}   <- opening this`);
-    console.log(`  ${plain.padEnd(pad)}   <- the same agent, if your browser cannot find that name`);
-  } else {
-    console.log(`  ${plain}`);
-  }
-  console.log('\nsetup continues in the browser — Ctrl-C to stop\n');
-  openBrowser(named || plain);
-}

package/lib/device/export-collections.mjs

@@ -1,161 +0,0 @@
-// export-collections.mjs — the account's collections as paged Turtle AS2
-// collections: `as:Collection` / `as:OrderedCollectionPage` documents whose
-// pages carry `as:items` arcs plus the activity's own triples. Produced ON
-// DEMAND — for a migration, or for any AS2/RDF reader — so the live pod pays
-// nothing to keep this shape fresh. The layout matches the one kept by
-// https://github.com/jg10-mastodon-social/solid-activitypub-netlify.
-//
-// Fidelity: their skeleton plus AS2-subset activity triples (type, actor,
-// object, published, to/cc, content, inReplyTo, attachment). Media blobs,
-// DMs, pins and standalone note documents have no place in that layout and
-// are not carried.
-//
-// Serialised by rdflib, never by hand.
-
-import * as $rdf from 'rdflib';
-
-const AS = $rdf.Namespace('https://www.w3.org/ns/activitystreams#');
-const RDF = $rdf.Namespace('http://www.w3.org/1999/02/22-rdf-syntax-ns#');
-const XSD = $rdf.Namespace('http://www.w3.org/2001/XMLSchema#');
-const TURTLE = 'text/turtle';
-const PAGE_SIZE = 20;
-
-// Doc IRIs need a base even when the target is a directory; links between the
-// export's own documents relativise against it, so the files stay portable.
-export const DIR_BASE = 'https://fedipod-export.invalid/';
-
-const sym = (v) => { try { return typeof v === 'string' && /^[a-z][a-z0-9+.-]*:/i.test(v) ? $rdf.sym(v) : null; } catch { return null; } };
-const typeNode = (t) => (typeof t === 'string' && /^[A-Za-z]+$/.test(t) ? AS(t) : null);
-
-// The object-ish AS2-subset fields, shared by activities, embedded objects,
-// and bare Notes an outbox names by IRI.
-function addObjectFields(g, doc, s, o) {
-  const t = typeNode(o.type);
-  if (t) g.add(s, RDF('type'), t, doc);
-  const by = sym(typeof o.attributedTo === 'string' ? o.attributedTo : o.attributedTo?.id);
-  if (by) g.add(s, AS('attributedTo'), by, doc);
-  if (o.published) g.add(s, AS('published'), $rdf.literal(o.published, XSD('dateTime')), doc);
-  if (typeof o.content === 'string') g.add(s, AS('content'), $rdf.literal(o.content), doc);
-  const irt = sym(typeof o.inReplyTo === 'string' ? o.inReplyTo : o.inReplyTo?.id);
-  if (irt) g.add(s, AS('inReplyTo'), irt, doc);
-  for (const at of [].concat(o.attachment || [])) {
-    const au = sym(at?.url);
-    if (!au) continue;
-    g.add(s, AS('attachment'), au, doc);
-    g.add(au, RDF('type'), AS('Document'), doc);
-    if (at.mediaType) g.add(au, AS('mediaType'), $rdf.literal(at.mediaType), doc);
-    if (at.name) g.add(au, AS('name'), $rdf.literal(at.name), doc);
-  }
-}
-
-// One activity's (or bare object's) AS2-subset triples into the page document.
-function addActivity(g, doc, a) {
-  const s = sym(a.id);
-  if (!s) return false;
-  addObjectFields(g, doc, s, a);
-  const actor = sym(typeof a.actor === 'string' ? a.actor : a.actor?.id);
-  if (actor) g.add(s, AS('actor'), actor, doc);
-  for (const key of ['to', 'cc']) {
-    for (const addr of [].concat(a[key] || [])) {
-      const n = sym(addr);
-      if (n) g.add(s, AS(key), n, doc);
-    }
-  }
-  const o = a.object;
-  if (typeof o === 'string') {
-    const n = sym(o);
-    if (n) g.add(s, AS('object'), n, doc);
-  } else if (o && typeof o === 'object' && sym(o.id)) {
-    const n = sym(o.id);
-    g.add(s, AS('object'), n, doc);
-    addObjectFields(g, doc, n, o);
-  }
-  return true;
-}
-
-// A collection into documents: a head at <name>/collection.ttl pointing
-// as:first at the newest page, pages at <name>/pages/<slot>.ttl chained
-// as:next toward the older ones — the direction their layout walks. Items:
-// activity objects (triples added) or bare IRIs (followers).
-export function collectionDocs(name, items, base) {
-  const headUrl = `${base}${name}/collection.ttl`;
-  const slots = [];
-  const seen = new Set();
-  const pages = [];
-  for (let i = 0; i < items.length; i += PAGE_SIZE) pages.push(items.slice(i, i + PAGE_SIZE));
-  if (!pages.length) pages.push([]);
-  for (const page of pages) {
-    const first = page.find(it => typeof it === 'object' && it?.published);
-    let slot = String(first ? Date.parse(first.published) || 0 : 0);
-    while (seen.has(slot)) slot += 'x';
-    seen.add(slot);
-    slots.push(slot);
-  }
-  const pageUrl = (i) => `${base}${name}/pages/${slots[i]}.ttl`;
-  const docs = [];
-
-  const hg = $rdf.graph();
-  const head = $rdf.sym(headUrl);
-  hg.add(head, RDF('type'), AS('Collection'), head);
-  hg.add(head, AS('first'), $rdf.sym(pageUrl(0)), head);
-  docs.push({ path: `${name}/collection.ttl`, turtle: $rdf.serialize(head, hg, headUrl, TURTLE) });
-
-  let carried = 0;
-  pages.forEach((page, i) => {
-    const url = pageUrl(i);
-    const g = $rdf.graph();
-    const doc = $rdf.sym(url);
-    g.add(doc, RDF('type'), AS('OrderedCollectionPage'), doc);
-    if (i + 1 < pages.length) g.add(doc, AS('next'), $rdf.sym(pageUrl(i + 1)), doc);
-    for (const item of page) {
-      if (typeof item === 'string') {
-        const n = sym(item);
-        if (n) { g.add(doc, AS('items'), n, doc); carried++; }
-      } else if (item && addActivity(g, doc, item)) {
-        g.add(doc, AS('items'), $rdf.sym(item.id), doc);
-        carried++;
-      }
-    }
-    docs.push({ path: `${name}/pages/${slots[i]}.ttl`, turtle: $rdf.serialize(doc, g, url, TURTLE) });
-  });
-  return { docs, carried, pages: pages.length };
-}
-
-// The whole export. Inputs arrive as plain data so the CLI and the tests
-// assemble them the same way; `storage` is a lib/storage.mjs container.
-export async function exportCollections({ outboxItems = [], followers = [], inboxEntries = [], storage, base = DIR_BASE, log = console.log, resolve = null }) {
-  const out = { written: 0 };
-  // A published outbox may hold bare note IRIs rather than embedded
-  // activities; with a resolver those are fetched once each so their triples
-  // travel in the page instead of a pointer to a pod that may be retiring.
-  if (resolve) {
-    const resolved = [];
-    for (const it of outboxItems) {
-      if (typeof it !== 'string') { resolved.push(it); continue; }
-      const doc = await resolve(it).catch(() => null);
-      resolved.push(doc && doc.id ? doc : it);
-    }
-    outboxItems = resolved;
-  }
-  const write = async (name, items) => {
-    const { docs, carried, pages } = collectionDocs(name, items, base);
-    for (const d of docs) {
-      const w = await storage.write(d.path, d.turtle, TURTLE);
-      if (!w.ok) throw new Error(`write ${d.path}: ${w.why || 'failed'}`);
-      out.written++;
-    }
-    out[name] = { items: carried, pages };
-  };
-
-  await write('outbox', outboxItems);
-  await write('followers', followers);
-  // Newest first, like the outbox — receivedAt rides in each archive entry.
-  const inbox = [...inboxEntries]
-    .sort((a, b) => String(b.receivedAt || '').localeCompare(String(a.receivedAt || '')))
-    .map(e => { try { return { published: e.receivedAt, ...JSON.parse(e.raw) }; } catch { return null; } })
-    .filter(Boolean);
-  await write('inbox', inbox);
-  if (!inbox.length) log('inbox: no archived mail yet — history begins when the archive does');
-  log('carries what the collection layout can hold — media blobs, DMs, pins and standalone notes are not representable and were not exported');
-  return out;
-}

package/lib/device/gateway-move.mjs

@@ -1,58 +0,0 @@
-// gateway-move.mjs — the second half of a DeviceAgent moving an address from
-// one gateway to another (lib/device/setup.mjs does the first, when a pod
-// that already holds an account at another gateway is set up with an address
-// at this one). The browser build has the same two halves in
-// web/app/gateway-move.mjs; this is the Node one, which signs and delivers
-// itself instead of going through a relay.
-//
-//   1. The old gateway is told the address moved (POST /api/move, proved with
-//      the pod session as attach was). From then on it serves the old actor
-//      as a moved stub — same key, old id, `movedTo` the new one.
-//   2. A Move goes to every follower, FROM the old actor, signed under the
-//      old key id: the only signature a follower's server can verify against
-//      the old actor. Same key material; only the key id differs.
-//
-// Runs when the agent starts acting, and is safe to run again: a move left
-// pending (the old gateway unreachable) is tried at the next start.
-import { Deliverer } from '../core/deliver.mjs';
-import { moveActivity } from '../core/wire.mjs';
-
-export async function completeGatewayMove(agent, { makeDeliverer = (o) => new Deliverer(o) } = {}) {
-  const cfg = agent.store.getConfig();
-  const mv = cfg?.movedFrom;
-  if (!mv || mv.completedAt) return null;
-  const log = agent.log || (() => {});
-  const newActor = agent.urls.actor;
-
-  // 1. the old gateway
-  let told;
-  try {
-    told = await agent.remote.session.fetch(`${mv.gateway}/api/move`, {
-      method: 'POST', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ handle: mv.handle, movedTo: newActor }),
-    });
-  } catch (e) { told = { status: 0, statusText: e.message }; }
-  if (told.status !== 200) {
-    log(`gateway move: ${mv.gateway} did not mark @${mv.handle} as moved (${told.status || told.statusText}) — will retry at the next start`);
-    return { told: false };
-  }
-
-  // 2. the Move, from the old address
-  const contacts = agent.store.getContacts();
-  const inboxes = [...new Set(contacts.followers.map((f) => f.sharedInbox || f.inbox).filter(Boolean))];
-  const activity = moveActivity({ actor: mv.actor }, newActor, Date.now());
-  const sender = makeDeliverer({
-    store: agent.store, rsaPrivate: agent.deliverer.rsaPrivate,
-    keyId: `${mv.actor}#main-key`, actorId: mv.actor, log, passive: true,
-  });
-  let sent = 0; let failed = 0;
-  for (const inbox of inboxes) {
-    try { await sender.deliverNow(inbox, activity); sent++; }
-    catch (e) { failed++; log(`gateway move: Move to ${inbox} failed: ${e.message}`); }
-  }
-  const done = { ...mv, completedAt: new Date().toISOString(), moveSent: sent, moveFailed: failed };
-  agent.store.setConfig({ ...agent.store.getConfig(), movedFrom: done });
-  await agent.store.flush?.();
-  log(`moved from ${mv.actor} to ${newActor}: Move sent to ${sent} inbox(es)${failed ? `, ${failed} failed` : ''}`);
-  return done;
-}

package/lib/device/home.mjs

@@ -1,161 +0,0 @@
-// Where an install keeps its credential, signing keys, pidfile and log.
-//
-// The root was `~/.activitypod`, then `~/.solid-activitypub`, before the
-// rename to fedipod. An install that already has one keeps using it: that
-// directory holds the credential and the private key, and moving those is the
-// owner's decision rather than an upgrade's side effect. `fedipod home
-// --to <dir>` is how you take the new name when you want it.
-//
-// Resolve ONCE and derive `profiles/` from the same answer. Deciding the two
-// separately is how `--profile solo` ends up looking in a different tree from
-// the default agent.
-
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-export const CURRENT_ROOT = '.fedipod';
-export const LEGACY_ROOTS = ['.solid-activitypub', '.activitypod'];  // most recent first
-
-// Existing install wins over the new name; a fresh one gets the new name.
-export function apRoot(homedir = os.homedir()) {
-  const current = path.join(homedir, CURRENT_ROOT);
-  if (fs.existsSync(current)) return current;
-  for (const name of LEGACY_ROOTS) {
-    const legacy = path.join(homedir, name);
-    if (fs.existsSync(legacy)) return legacy;
-  }
-  return current;
-}
-
-export const isLegacyRoot = (root) => LEGACY_ROOTS.includes(path.basename(root));
-
-// Write one of this home's files without a window in which it is half there.
-//
-// lib/storage.mjs goes to the trouble of tmp+rename for state documents that
-// its own header calls rebuildable from the pod. The files here are the ones
-// that are NOT: keys.json is the private key remote servers have cached, and
-// credential.json holds a secret a Solid server mints once and will not mint
-// again. A plain writeFileSync truncates first, so a crash, a power loss or a
-// full disk between truncate and write leaves an empty or half-written file
-// where the identity used to be.
-//
-// rename(2) is atomic on POSIX, so a reader — or a backup running at the wrong
-// moment — sees either the old file or the new one. fsync before it, so the
-// content is on the platter and not merely in the page cache when the rename
-// lands. Windows has no atomic rename over an existing file; there the copy
-// path is still better than a truncate, and this is a best effort by design.
-export function writeFileAtomic(file, body, { mode = 0o600 } = {}) {
-  const tmp = `${file}.${process.pid}.tmp`;
-  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
-  const fd = fs.openSync(tmp, 'w', mode);
-  try {
-    fs.writeFileSync(fd, body);
-    fs.fsyncSync(fd);
-  } finally {
-    fs.closeSync(fd);
-  }
-  fs.renameSync(tmp, file);
-}
-
-// The same, for the JSON these files all happen to be.
-export function writeJsonAtomic(file, obj, opts) {
-  writeFileAtomic(file, JSON.stringify(obj, null, 2) + '\n', opts);
-}
-
-export const profilesDir = (root) => path.join(root, 'profiles');
-
-// The root an arbitrary home belongs to. `<root>/profiles/<name>` is a profile;
-// anything else is its own root — so a custom AP_HOME reports no neighbours,
-// which is the truth rather than a special case.
-export function rootOf(home) {
-  const resolved = path.resolve(home);
-  const parent = path.dirname(resolved);
-  return path.basename(parent) === 'profiles' ? path.dirname(parent) : resolved;
-}
-
-// Every identity under a root — all of them under `profiles/`, none of them the
-// root itself. Callers read `agent.json` from these — a port and a handle.
-// Nothing here, and nothing that uses it, opens a sibling's credential or keys.
-//
-// The root used to BE one of these, and had no name, so this function invented
-// `(default)` for it at display time. That was the tell: a thing you have to
-// name when you show it does not have an identity, it has a position. It also
-// meant one identity's home contained all the others — back it up and you
-// backed up everyone; delete it and you deleted everyone.
-export function identityHomes(root) {
-  const homes = [];
-  try {
-    for (const name of fs.readdirSync(profilesDir(root)).sort()) {
-      const dir = path.join(profilesDir(root), name);
-      if (fs.statSync(dir).isDirectory()) homes.push({ name, dir });
-    }
-  } catch { /* no identities yet */ }
-  return homes;
-}
-
-// The root's own record. Today it holds one thing: which identity was last
-// started, which is what a plain command means afterwards. Nobody sets it —
-// using an identity IS setting it, so there is no default to configure and no
-// way for the configured answer to drift from the one you actually work in.
-export const ROOT_FILE = 'root.json';
-
-export function readRoot(root) {
-  try { return JSON.parse(fs.readFileSync(path.join(root, ROOT_FILE), 'utf8')) || {}; }
-  catch { return {}; }
-}
-
-export function writeRoot(root, fields) {
-  fs.mkdirSync(root, { recursive: true, mode: 0o700 });
-  const rec = { ...readRoot(root), ...fields };
-  writeJsonAtomic(path.join(root, ROOT_FILE), rec);
-  return rec;
-}
-
-// Which identity you get with no `--profile`: the last one started. Failing
-// that, one identity is unambiguous and needs no ceremony. Two, neither ever
-// started, is a genuine question — and the answer is to ask rather than pick,
-// because picking silently would be picking someone's fediverse account.
-export function defaultProfile(root) {
-  const named = readRoot(root).default;
-  // Only a home holding a credential counts. A setup that was abandoned leaves a
-  // directory behind, and letting that become the default would answer "which
-  // identity" with one that does not exist yet.
-  const real = identityHomes(root).filter(h => fs.existsSync(path.join(h.dir, 'credential.json')));
-  if (named && real.some(h => h.name === named)) return named;
-  if (named) return { missing: named };
-  return real.length === 1 ? real[0].name : null;
-}
-
-export const profileHome = (root, name) => path.join(profilesDir(root), name);
-
-// A root from before every identity moved under profiles/. Its presence is what
-// every command checks to tell you to migrate, rather than quietly doing it —
-// this directory holds a private key.
-export const rootHoldsIdentity = (root) => fs.existsSync(path.join(root, 'credential.json'));
-
-
-// For DISPLAY only: `~/.fedipod` reads at a glance where
-// `/home/jeff/.fedipod` has to be parsed, and the home directory is
-// the least interesting part of every path this prints. A `file:` URL is a path
-// wearing a scheme, so it is shown as the path — which is also what you would
-// type, since `state --to` takes either.
-//
-// Never used to build a path. `~` is the shell's, not the filesystem's, and
-// anything that resolves one must expand it first.
-export function tildify(p, homedir = os.homedir()) {
-  if (!p) return p;
-  let s = String(p);
-  if (s.startsWith('file://')) { try { s = fileURLToPath(s); } catch { return s; } }
-  if (s === homedir) return '~';
-  return s.startsWith(homedir + path.sep) ? '~' + s.slice(homedir.length) : s;
-}
-
-// Using an identity is what makes it the default. Called when an agent starts
-// for one — not on every read, or `--profile other status` would quietly move
-// the machine's idea of "you" while only asking a question.
-export function recordLastUsed(root, name) {
-  if (!root || !name || readRoot(root).default === name) return;
-  try { writeRoot(root, { default: name, at: new Date().toISOString() }); } catch { /* not fatal */ }
-}