fedipod 1.29.2 → 1.30.0

package/device-agent.md

@@ -10,18 +10,25 @@ connect to it; and it can host a [group](groups.md).
 ## Requirements
 
 - Node 20 or newer.
-<!-- CLAUDE 2026-09-23 — any pod; delete these markers when done -->
 - A Solid pod, such as `https://alice.solidcommunity.net/` or
   `https://server.example/alice/`. The address is `@handle@yourpod`, or
   `@handle@fedipod.net` when the pod is on a path of a shared host, since
   the shared host cannot answer for the handle; the posts, key and data
   stay on the pod either way.
-<!-- /CLAUDE -->
 - Followers-only and direct posts need a pod that enforces WAC access control;
   on one that does not, the composer refuses those two and says why.
 - While the agent is off, your mail waits on your pod's host. Run it as a
   service, or attach to a gateway, so it does not pile up there.
 
+Moving in from another gateway: a pod that already holds an account whose
+address lives at a gateway (a browser account at fedipod.net, say) can be set
+up here with an address at a different gateway, and the account moves rather
+than being refused. Setup keeps the account's state and key on the pod,
+attaches at the new gateway, publishes the new address with the old one as an
+alias, tells the old gateway, and sends a Move to every follower from the old
+address. The old gateway then serves the old actor as a stub saying where it
+went. An address on the pod itself has nothing to move; it is a sign-in.
+
 ## Installing
 
 ```

package/gateway.md

@@ -120,7 +120,6 @@ not a note, an annotation say, is kept as the app sent it, under your name.
 
 ## Moving to another gateway
 
-<!-- CLAUDE 2026-09-23 — new in 1.29.0, browser build; delete these markers when done -->
 An address that lives at a gateway, `@you@gateway-a`, can move to another
 one and keep its pod, its posts, its followers and its key. Open the new
 gateway, choose **create an account**, and sign in with the same pod. The
@@ -147,9 +146,12 @@ What happens then, in order:
 The old gateway keeps the stub for as long as its row stands; the owner can
 remove the row from the roster later. An address on the pod, `@you@yourpod`,
 needs none of this: it detaches from one mail door and attaches to another.
-Only the browser build moves in this way for now; the DeviceAgent's setup
-does not yet read a pod that already holds an account.
-<!-- /CLAUDE -->
+
+A DeviceAgent moves the same way: set it up with the pod you already have
+and an address at the new gateway (`--address front`, or "At the gateway"
+on the setup page). Setup reads the account on the pod, keeps its state and
+key there, attaches at the new gateway, and completes the move when the
+agent first acts. See [the DeviceAgent](device-agent.md).
 
 ## What the gateway can see
 

package/lib/core/publisher/index.mjs

@@ -106,6 +106,9 @@ export class Publisher {
       image: this.config.image || null, fields: this.config.fields || [],
       webId: this.remote.webId || null,
       aliases: this.config.aliases || [],
+      // A group says whether only its moderators may open posts (Lemmy's
+      // term); a person's actor carries nothing of the kind.
+      postingRestrictedToMods: this.config.kind === 'group' ? !!this.config.postingRestrictedToMods : null,
       moderators,
       pendingFollowers: priv ? urls.pendingFollowers : null,
       pendingFollowing: priv ? urls.pendingFollowing : null,

package/lib/core/wire.mjs

@@ -3,6 +3,10 @@
 // protocol documents, not our RDF.
 
 export const AS_CTX = 'https://www.w3.org/ns/activitystreams';
+// Lemmy's own context, held locally (lib/core/contexts/join-lemmy.json). It
+// names the three terms a Lemmy reader looks for on a community and its
+// posts: postingRestrictedToMods, stickied, commentsEnabled.
+export const LEMMY_CTX = 'https://join-lemmy.org/context.json';
 export const SEC_CTX = 'https://w3id.org/security/v1';
 export const PUBLIC = 'https://www.w3.org/ns/activitystreams#Public';
 
@@ -80,7 +84,8 @@ export const assertionKeyId = (urls) => urls.actor + '#ed25519-key';
 export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null, movedTo = null, kind = 'person',
   approveJoins = false, summary = null, icon = null, image = null, fields = [],
   webId = null, aliases = [], moderators = null, pendingFollowers = null, pendingFollowing = null,
-  blocked = null, inbox = null, outbox = null, oauthAuthorize = null, oauthToken = null }) {
+  blocked = null, inbox = null, outbox = null, oauthAuthorize = null, oauthToken = null,
+  postingRestrictedToMods = null }) {
   // manuallyApprovesFollowers is NOT in the base AS2 context, so it is declared
   // inline exactly as Mastodon declares it — and only when we actually use it.
   // It is what makes a client show "Request to follow" rather than "Follow" and
@@ -118,6 +123,9 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
   // old accounts elsewhere whose servers check for their own URL here before
   // they will send a Move. Declared inline exactly as Mastodon declares it.
   if (webId || aliases.length) context.push({ alsoKnownAs: { '@id': 'as:alsoKnownAs', '@type': '@id' } });
+  // A community says whether only its moderators may open posts in it, in
+  // Lemmy's term, declared through Lemmy's context. Groups only.
+  if (kind === 'group' && postingRestrictedToMods !== null) context.push(LEMMY_CTX);
   if (fields.length) {
     context.push({ schema: 'http://schema.org#', PropertyValue: 'schema:PropertyValue', value: 'schema:value' });
   }
@@ -134,6 +142,7 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
     }] } : {}),
     ...(movedTo ? { movedTo } : {}),
     ...(webId || aliases.length ? { alsoKnownAs: [...(webId ? [webId] : []), ...aliases] } : {}),
+    ...(kind === 'group' && postingRestrictedToMods !== null ? { postingRestrictedToMods: !!postingRestrictedToMods } : {}),
     preferredUsername: handle,
     name: name || handle,
     // The bio, and the avatar. For a group, `summary` is where what the group

package/lib/device/cli/commands/setup.mjs

@@ -52,8 +52,12 @@ if (!newAccount) {
   const { resourceExists } = await import(new URL('../../../../lib/pod/root.mjs', import.meta.url));
   const { apUrls, DEFAULT_ROOT: DR } = await import(new URL('../../../../lib/core/wire.mjs', import.meta.url));
   if (await resourceExists(fetch, apUrls(pod, DR).actor)) {
-    console.error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
-    process.exit(2);
+    if (String(flag('address') || 'pod').toLowerCase() !== 'front') {
+      console.error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
+      console.error('To move an account whose address is at another gateway to this one, add --address front.');
+      process.exit(2);
+    }
+    console.log('The pod already holds an account; if its address is at another gateway, setup moves it here.');
   }
 }
 

package/lib/device/gateway-move.mjs

@@ -0,0 +1,58 @@
+// gateway-move.mjs — the second half of a DeviceAgent moving an address from
+// one gateway to another (lib/device/setup.mjs does the first, when a pod
+// that already holds an account at another gateway is set up with an address
+// at this one). The browser build has the same two halves in
+// web/app/gateway-move.mjs; this is the Node one, which signs and delivers
+// itself instead of going through a relay.
+//
+//   1. The old gateway is told the address moved (POST /api/move, proved with
+//      the pod session as attach was). From then on it serves the old actor
+//      as a moved stub — same key, old id, `movedTo` the new one.
+//   2. A Move goes to every follower, FROM the old actor, signed under the
+//      old key id: the only signature a follower's server can verify against
+//      the old actor. Same key material; only the key id differs.
+//
+// Runs when the agent starts acting, and is safe to run again: a move left
+// pending (the old gateway unreachable) is tried at the next start.
+import { Deliverer } from '../core/deliver.mjs';
+import { moveActivity } from '../core/wire.mjs';
+
+export async function completeGatewayMove(agent, { makeDeliverer = (o) => new Deliverer(o) } = {}) {
+  const cfg = agent.store.getConfig();
+  const mv = cfg?.movedFrom;
+  if (!mv || mv.completedAt) return null;
+  const log = agent.log || (() => {});
+  const newActor = agent.urls.actor;
+
+  // 1. the old gateway
+  let told;
+  try {
+    told = await agent.remote.session.fetch(`${mv.gateway}/api/move`, {
+      method: 'POST', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ handle: mv.handle, movedTo: newActor }),
+    });
+  } catch (e) { told = { status: 0, statusText: e.message }; }
+  if (told.status !== 200) {
+    log(`gateway move: ${mv.gateway} did not mark @${mv.handle} as moved (${told.status || told.statusText}) — will retry at the next start`);
+    return { told: false };
+  }
+
+  // 2. the Move, from the old address
+  const contacts = agent.store.getContacts();
+  const inboxes = [...new Set(contacts.followers.map((f) => f.sharedInbox || f.inbox).filter(Boolean))];
+  const activity = moveActivity({ actor: mv.actor }, newActor, Date.now());
+  const sender = makeDeliverer({
+    store: agent.store, rsaPrivate: agent.deliverer.rsaPrivate,
+    keyId: `${mv.actor}#main-key`, actorId: mv.actor, log, passive: true,
+  });
+  let sent = 0; let failed = 0;
+  for (const inbox of inboxes) {
+    try { await sender.deliverNow(inbox, activity); sent++; }
+    catch (e) { failed++; log(`gateway move: Move to ${inbox} failed: ${e.message}`); }
+  }
+  const done = { ...mv, completedAt: new Date().toISOString(), moveSent: sent, moveFailed: failed };
+  agent.store.setConfig({ ...agent.store.getConfig(), movedFrom: done });
+  await agent.store.flush?.();
+  log(`moved from ${mv.actor} to ${newActor}: Move sent to ${sent} inbox(es)${failed ? `, ${failed} failed` : ''}`);
+  return done;
+}

package/lib/device/migrate.mjs

@@ -27,7 +27,9 @@ export const layoutOf = (cred) => Number(cred?.layout) || 0;
 // deliberately, with `--private-root`, has said where they want it; a migration
 // that overrode that would be moving data on its own initiative.
 export function needsStateMove(cred) {
-  return !cred?.privateRoot;
+  // `stateOnPod` is a move-in from a browser account (setup.mjs): the state
+  // is on the pod because that is where the account already lives.
+  return !cred?.privateRoot && !cred?.stateOnPod;
 }
 
 export function pendingSteps(cred) {

package/lib/device/setup.mjs

@@ -21,6 +21,7 @@ import { rootOf, recordLastUsed, writeJsonAtomic } from './home.mjs';
 import { insecureUrlReason } from '../shared/safefetch.mjs';
 import { resourceExists } from '../pod/root.mjs';
 import { CURRENT_LAYOUT, isCurrent } from './migrate.mjs';
+import { completeGatewayMove } from './gateway-move.mjs';
 
 const SOLID = $rdf.Namespace('http://www.w3.org/ns/solid/terms#');
 
@@ -125,6 +126,18 @@ export function frontedAddress({ pod, shape }) {
   return pathPod || shape === 'front';
 }
 
+// The account a pod already holds, read as its owner: the config and the key
+// record in its state container. Both null when there is none, or when the
+// credential is not the owner's. Injected for tests.
+export async function readPodAccount({ home, credential, pod, root, log = () => {} }) {
+  const remote = new RemotePod(credential, { home, log });
+  await remote.warmup?.();
+  const urls = apUrls(pod, root || DEFAULT_ROOT);
+  const config = await remote.getJson(urls.state + 'config.json').catch(() => null);
+  const keys = await remote.getJson(urls.state + 'keys.json').catch(() => null);
+  return { config, keys };
+}
+
 // Take an address at a Gateway: attach the pod to it, fronted, and return the
 // gateway config bootstrap writes and connect reads. The pod session proves
 // the pod — no password reaches the Gateway. Injected for tests.
@@ -231,8 +244,13 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
   // several writes, and that pod is a server somebody runs. `state --to` moves
   // it afterwards; starting on the pod and moving later is strictly worse,
   // because the copy left behind was on the pod the whole time.
-  const privateRoot = answers.privateRoot
+  let privateRoot = answers.privateRoot
     || pathToFileURL(path.join(home, 'private')).href + '/';
+  // A pod that already holds an account at ANOTHER gateway, set up with an
+  // address at this one: not a second account but the same one moving in.
+  // Its state and key are on the pod, and stay there.
+  let movingIn = false;
+  let movedFrom = null;
   // Everything that leaves this function — notes, errors, the log — goes
   // through here. Nothing today echoes a password back, but /setup/progress is
   // polled repeatedly and would re-serve one forever if anything ever did.
@@ -266,10 +284,15 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       // reachable, and no silent 401 later on a pod whose profile is empty.
       const usable = await checkPod(pod);
       if (!usable.ok) throw new Error(usable.error);
-      if (await (deps.resourceExists || resourceExists)(deps.fetch || fetch, apUrls(pod, root || DEFAULT_ROOT).actor)) {
-        throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
+      const held = await (deps.resourceExists || resourceExists)(deps.fetch || fetch, apUrls(pod, root || DEFAULT_ROOT).actor);
+      if (held && !frontedAddress({ pod, shape })) {
+        throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod. '
+          + 'To move an account whose address is at another gateway to this one, ask for an address at this gateway.');
       }
-      skip('account', 'using the pod you already have');
+      if (held && kind === 'group') throw new Error('The pod already hosts a FediPod account, and a group cannot move between gateways.');
+      movingIn = held;
+      if (movingIn) { privateRoot = null; }
+      skip('account', movingIn ? 'the pod already holds the account — its address moves here' : 'using the pod you already have');
     }
 
     // --- credential: the point of no return, and the durability boundary ---
@@ -295,12 +318,14 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
         remotePod: pod.endsWith('/') ? pod : pod + '/',
         createdAt: new Date().toISOString(),
         ...(root ? { root } : {}),
-        ...(keys === 'pod' ? { keysMode: 'pod' } : {}),
-        // Where the private half lives. Per-machine, like keysMode.
+        ...(keys === 'pod' || movingIn ? { keysMode: 'pod' } : {}),
+        // Where the private half lives. Per-machine, like keysMode. A move-in
+        // keeps it on the pod, where the account already is, and says so.
         ...(privateRoot ? { privateRoot } : {}),
+        ...(movingIn ? { stateOnPod: true } : {}),
         // What shape this install is, so `upgrade` can tell an old one from a
         // new one without guessing from the fields.
-        ...(isCurrent({ privateRoot }) ? { layout: CURRENT_LAYOUT } : {}),
+        ...(isCurrent({ privateRoot, stateOnPod: movingIn }) ? { layout: CURRENT_LAYOUT } : {}),
       };
       fs.mkdirSync(home, { recursive: true, mode: 0o700 });
       writeJsonAtomic(credPath, rec);
@@ -316,6 +341,24 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       done('credential', credPath);
     }
 
+    // --- a move-in: the account on the pod, read with the credential just
+    // minted, has to be one whose address lives at another gateway ---
+    if (movingIn) {
+      const cred = JSON.parse(fs.readFileSync(credPath, 'utf8'));
+      const account = await (deps.readPodAccount || readPodAccount)({ home, credential: cred, pod, root: root || DEFAULT_ROOT, log });
+      if (!account?.config) throw new Error('the pod holds an account, but its record could not be read with this credential — is this account the pod\'s owner?');
+      const frontActor = account.config.gateway?.frontActor || null;
+      const gwHost = new URL(gatewayOrigin).host;
+      if (!frontActor) throw new Error('The pod already hosts a FediPod account whose address lives on the pod: nothing to move. Sign in to it instead.');
+      if (new URL(frontActor).host === gwHost) throw new Error(`The pod already hosts a FediPod account at ${gwHost}: sign in to it instead of setting up again.`);
+      if ((account.config.kind || 'person') === 'group') throw new Error('a group cannot move between gateways');
+      if (!account.keys?.rsa || account.keys.ct) {
+        throw new Error(`this account's key is still under a password from an earlier version — sign in once at ${new URL(frontActor).host} first, then set up here`);
+      }
+      movedFrom = { actor: frontActor, gateway: new URL(frontActor).origin, handle: account.config.handle, at: new Date().toISOString() };
+      log(`moving @${account.config.handle}@${new URL(frontActor).host} here, as @${handle}@${gwHost}`);
+    }
+
     // --- take an address at the Gateway, if this pod needs one or asked for
     // one --- before bootstrap, so the config it writes carries the Gateway
     // ids and the key connect mints below is stamped to the Gateway actor from
@@ -346,6 +389,17 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       if (!ready.ok) throw new Error(ready.error);
     }
     await agent.bootstrap({ handle, name: name || handle, root, kind, approveJoins, summary, icon, gateway: gatewayCfg });
+    if (movingIn && movedFrom) {
+      // The old actor becomes an alias, which is what a server checks on the
+      // new actor before it honours a Move; the Move itself is pending until
+      // the new actor is published (completeGatewayMove, below and at every
+      // start). The key stays; its stamp follows the actor.
+      const cfg = agent.store.getConfig() || {};
+      agent.store.setConfig({ ...cfg, aliases: [...new Set([...(cfg.aliases || []), movedFrom.actor])], movedFrom });
+      const keyRec = agent.store.read?.('keys.json', null);
+      if (keyRec?.mintedFor && gatewayCfg?.frontActor) agent.store.write?.('keys.json', { ...keyRec, mintedFor: gatewayCfg.frontActor });
+      await agent.store.flush();
+    }
     done('bootstrap');
 
     begin('connect');
@@ -360,6 +414,12 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
     }
     const published = await agent.publisher.publishProfile();
     await agent.store.flush();
+    if (movingIn) {
+      // Tell the old gateway and the followers. Not fatal: left pending, it
+      // is tried again when the agent next starts acting.
+      const moved = await (deps.completeGatewayMove || completeGatewayMove)(agent).catch((e) => { log(`gateway move: ${e.message}`); return null; });
+      if (moved?.completedAt) log(`Move sent from ${movedFrom.actor} to ${moved.moveSent} inbox(es)`);
+    }
     done('publish');
 
     // --- and say plainly whether the world can actually see it ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.29.2",
+  "version": "1.30.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",

package/run-agent.mjs

@@ -33,6 +33,7 @@ import { apRoot, rootOf, writeJsonAtomic } from './lib/device/home.mjs';
 import { ensureTrustedTls } from './lib/device/certs.mjs';
 import { storageFor } from './lib/core/storage.mjs';
 import { resolveKeys } from './lib/core/keys.mjs';
+import { completeGatewayMove } from './lib/device/gateway-move.mjs';
 import { RemotePod } from './lib/device/remote.mjs';
 import { Deliverer } from './lib/core/deliver.mjs';
 import { Publisher } from './lib/core/publisher/index.mjs';
@@ -547,6 +548,10 @@ export class Agent {
       return;                                // renewal is already running, above
     }
     await this.intake.start();
+    // An address that moved here from another gateway, whose move was left
+    // pending (the old gateway could not be told): try again now that this
+    // agent acts and the actor is published.
+    completeGatewayMove(this).catch(e => this.log(`gateway move: ${e.message}`));
     // Reused, not replaced: demote() stops this instance but does not clear it,
     // so constructing a new one over the top orphaned the old chain beyond the
     // reach of any later stop().

package/web/app/dist/sw.js

@@ -9700,6 +9700,7 @@ __export(wire_exports, {
   DEFAULT_ROOT: () => DEFAULT_ROOT,
   FOLLOWERS_PAGE_SIZE: () => FOLLOWERS_PAGE_SIZE,
   HASHTAG_RE: () => HASHTAG_RE,
+  LEMMY_CTX: () => LEMMY_CTX,
   MENTION_RE: () => MENTION_RE,
   OUTBOX_PAGE_SIZE: () => OUTBOX_PAGE_SIZE,
   POLICY_CTX: () => POLICY_CTX,
@@ -9812,7 +9813,8 @@ function actorDoc({
   inbox = null,
   outbox = null,
   oauthAuthorize = null,
-  oauthToken = null
+  oauthToken = null,
+  postingRestrictedToMods = null
 }) {
   const context = [AS_CTX, SEC_CTX];
   context.push({ toot: "http://joinmastodon.org/ns#", featured: { "@id": "toot:featured", "@type": "@id" } });
@@ -9835,6 +9837,7 @@ function actorDoc({
     });
   }
   if (webId || aliases.length) context.push({ alsoKnownAs: { "@id": "as:alsoKnownAs", "@type": "@id" } });
+  if (kind === "group" && postingRestrictedToMods !== null) context.push(LEMMY_CTX);
   if (fields.length) {
     context.push({ schema: "http://schema.org#", PropertyValue: "schema:PropertyValue", value: "schema:value" });
   }
@@ -9853,6 +9856,7 @@ function actorDoc({
     }] } : {},
     ...movedTo ? { movedTo } : {},
     ...webId || aliases.length ? { alsoKnownAs: [...webId ? [webId] : [], ...aliases] } : {},
+    ...kind === "group" && postingRestrictedToMods !== null ? { postingRestrictedToMods: !!postingRestrictedToMods } : {},
     preferredUsername: handle7,
     name: name || handle7,
     // The bio, and the avatar. For a group, `summary` is where what the group
@@ -10375,7 +10379,7 @@ function addRemoveActivity({ urls, type, object, target, serial }) {
     target
   };
 }
-var import_sanitize_html, AS_CTX, SEC_CTX, PUBLIC, DEFAULT_ROOT, assertionKeyId, OUTBOX_PAGE_SIZE, outboxPageId, outboxPageCount, outboxItemId, outboxWireItem, outboxLocalItem, FOLLOWERS_PAGE_SIZE, followersPageId, followersPageCount, ALLOWED_TAGS, ALLOWED_ATTRS, MAX_ATTACHMENTS, MAX_ATTACHMENT_URL, attachmentUrl, HTML_ESCAPES2, MENTION_RE, HASHTAG_RE, QUOTE_CTX, POLICY_CTX;
+var import_sanitize_html, AS_CTX, LEMMY_CTX, SEC_CTX, PUBLIC, DEFAULT_ROOT, assertionKeyId, OUTBOX_PAGE_SIZE, outboxPageId, outboxPageCount, outboxItemId, outboxWireItem, outboxLocalItem, FOLLOWERS_PAGE_SIZE, followersPageId, followersPageCount, ALLOWED_TAGS, ALLOWED_ATTRS, MAX_ATTACHMENTS, MAX_ATTACHMENT_URL, attachmentUrl, HTML_ESCAPES2, MENTION_RE, HASHTAG_RE, QUOTE_CTX, POLICY_CTX;
 var init_wire = __esm({
   "lib/core/wire.mjs"() {
     init_urls();
@@ -10383,6 +10387,7 @@ var init_wire = __esm({
     init_profile_page();
     import_sanitize_html = __toESM(require_sanitize_html(), 1);
     AS_CTX = "https://www.w3.org/ns/activitystreams";
+    LEMMY_CTX = "https://join-lemmy.org/context.json";
     SEC_CTX = "https://w3id.org/security/v1";
     PUBLIC = "https://www.w3.org/ns/activitystreams#Public";
     DEFAULT_ROOT = "fedipod/";
@@ -57180,6 +57185,9 @@ var Publisher = class {
       fields: this.config.fields || [],
       webId: this.remote.webId || null,
       aliases: this.config.aliases || [],
+      // A group says whether only its moderators may open posts (Lemmy's
+      // term); a person's actor carries nothing of the kind.
+      postingRestrictedToMods: this.config.kind === "group" ? !!this.config.postingRestrictedToMods : null,
       moderators,
       pendingFollowers: priv ? urls.pendingFollowers : null,
       pendingFollowing: priv ? urls.pendingFollowing : null,