fedipod 1.44.0 → 1.47.0

package/lib/gateway/held-mail.mjs

@@ -6,7 +6,9 @@
 // app is closed nobody reads it, so the door keeps it here instead
 // (ctx.holdMail), and writes it to the pod inbox as one document when the app
 // says it is open (POST /api/here) or when the timer comes round (flushAll).
-// While the app is open, mail goes straight to the pod as it always has.
+// While the app is open, mail goes straight to the pod as it always has. With
+// the hold off (copy.mjs: FEDIPOD_HOLD), nothing is held: mail goes straight
+// to the pod whether the app is open or not.
 //
 // A batch is plain JSON, `{ "batch": [ { name, body, receipt } ] }`: `name` is
 // what the item would have been called in the inbox, `body` its bytes, and
@@ -23,7 +25,7 @@
 //   presentAt(handle) -> ms            when it last said so
 //   noteNext(handle, at, {earliest})   when the account's keeper next has work
 
-import { copyMeta, keptNow } from './copy.mjs';
+import { copyMeta, keptNow, holdOn } from './copy.mjs';
 
 // The app says it is open every five minutes; a little over that counts.
 export const PRESENT_MS = 8 * 60_000;
@@ -37,7 +39,11 @@ const inboxOf = (rec) => rec.inboxUrl || rec.podHome + 'ap/inbox/';
 // Only a browser account is held: its owner signs in (so the row has
 // `openedAt`), and its app says when it is open. An account run by a DeviceAgent
 // drains whenever mail lands, and keeps its mail as it always has.
-export const holdsMail = (ctx, rec) => !!(ctx.holdMail && rec?.openedAt);
+export const holdsMail = (ctx, rec) => !!(ctx.holdMail && rec?.openedAt && holdOn(ctx));
+// A browser account whose app may be closed: its mail is held, or with the
+// hold off, sent to the pod, and either way a follow or a notification starts
+// the work that answers it (afterHeld).
+export const mayBeAway = (ctx, rec) => !!(ctx.holdMail && rec?.openedAt);
 
 // Asked on every delivery, so it is remembered a minute per running copy.
 const seen = new Map();   // handle -> { at, asked }
@@ -204,5 +210,6 @@ export async function routeHereApi(request, pathname, ctx, deps) {
   if (body.nextAt !== undefined && ctx.noteNext) await ctx.noteNext(handle, body.nextAt || null).catch(() => {});
   const flushed = await flushHeld(ctx, handle, rec)
     .catch((e) => { console.log(`here @${handle}: held mail not delivered: ${e?.message || e}`); return 0; });
-  return j(200, { ok: true, handle, flushed });
+  // `hold`: with it off, a browser working from a copy goes back to the pod.
+  return j(200, { ok: true, handle, flushed, hold: holdOn(ctx) });
 }

package/lib/gateway/httpsig.mjs

@@ -49,14 +49,16 @@ export function makeSafeLoader({ getActors = null, fetchImpl = fetch } = {}) {
 export async function verifyHttpSignature(request, { documentLoader, keyCache, timeWindow } = {}) {
   const hadSig = request.headers.get('signature') != null;
   let result = null;
+  let threw = null;
   try {
     result = await verifyRequestDetailed(request, {
       documentLoader,
       ...(keyCache ? { keyCache } : {}),
       timeWindow: timeWindow ?? { hours: 1 },
     });
-  } catch {
+  } catch (e) {
     result = null;   // the library itself failed — no more informative than a bad signature
+    threw = e?.message || String(e);
   }
   // Which signature the sender used: RFC 9421 carries a Signature-Input
   // header beside Signature; the cavage draft carries Signature alone. The
@@ -83,9 +85,12 @@ export async function verifyHttpSignature(request, { documentLoader, keyCache, t
       reason: 'key-unfetchable', checks: { signature: false, keyFetched: false },
     };
   }
+  // `why` is for the log line, not the receipt: the library's own word for
+  // the failure, or that it threw.
   return {
     verified: false, method, keyId: null, actor: null,
     reason: 'bad-signature', checks: { signature: false },
+    why: threw ? `library threw: ${threw.split('\n')[0].slice(0, 120)}` : (kind || 'unknown'),
   };
 }
 

package/lib/gateway/keeper.mjs

@@ -18,7 +18,7 @@ import { keeperSession } from './keeper-session.mjs';
 import { flushHeld, heldEntries } from './held-mail.mjs';
 import { publishDue, nextDue } from '../core/scheduled.mjs';
 import { lockCopy } from './copy.mjs';
-import { reachAccount, stateAndLease, actingAgent } from './account-agent.mjs';
+import { reachAccount, settle, stateAndLease, actingAgent } from './account-agent.mjs';
 
 export { keeperSession };
 
@@ -27,10 +27,11 @@ export { keeperSession };
  * keeperCredential and the held-mail stores. `session` may be handed in (a
  * test does); otherwise the keeper's grant is used. Returns what happened.
  *
- * An account whose copy the gateway keeps (copy.mjs) is worked on there: its
- * held mail is read straight into the copy, and the pod is written by the
- * round, not here. Otherwise the held mail goes to the pod inbox first, so the
- * drain reads it, as before.
+ * While the hold is on, the account is worked on in its copy (copy.mjs), made
+ * from the pod if there is none: its held mail is read straight into the
+ * copy, and the pod is written by the round, not here. With the hold off, it
+ * is worked on in the pod, and any held mail goes to the pod inbox first, so
+ * the drain reads it.
  */
 export async function keepOnce(ctx, handle, rec, { log = console.log, session = null } = {}) {
   // A forum, or one of its categories, is run whole by the forum's own code
@@ -40,9 +41,11 @@ export async function keepOnce(ctx, handle, rec, { log = console.log, session =
   const at = await reachAccount(ctx, handle, rec, { log, session });
   if (at.skipped) return { skipped: at.skipped };
 
-  const unlock = at.inCopy ? await lockCopy(ctx.copyKv, handle) : async () => {};
+  const unlock = ctx.copyKv ? await lockCopy(ctx.copyKv, handle) : async () => {};
   if (!unlock) return { skipped: 'the gateway is busy with this account', retry: 'soon' };
   try {
+    const settled = await settle(ctx, handle, rec, at, { log });
+    if (!settled.ok) return { skipped: `the account's copy could not be made: ${settled.why}`, retry: 'soon' };
     // Held mail goes in first, so this drain reads it.
     const flushed = !at.inCopy && ctx.listHeld
       ? await flushHeld(ctx, handle, rec).catch((e) => { say(`held mail not delivered: ${e.message}`); return 0; }) : 0;

package/lib/gateway/masto-gateway.mjs

@@ -1,6 +1,7 @@
 // masto-gateway.mjs — Mastodon apps at the gateway's own address: elk.zone,
 // Ivory, Tusky or any other app, signed in to an account the gateway keeps
-// running, reading and writing it from its copy (copy.mjs).
+// running, reading and writing it from its copy (copy.mjs), made from the pod
+// when there is none while the hold is on; with the hold off, from the pod.
 //
 //   POST /api/v1/apps                   an app registers here, for every account
 //   GET  /oauth/authorize               sends the person to the sign-in page
@@ -20,7 +21,8 @@
 // browser sitting open, as one device does another — and reads the signing
 // key from the pod for that one request. Mail that arrived while nobody was
 // reading is read into the copy after an app's timeline or notification check
-// has been answered, at most every thirty seconds.
+// has been answered, at most every thirty seconds; with the hold off, the pod
+// inbox is drained then instead, unless FediPod is open and drains it itself.
 //
 // Phone notifications: an app signs up for them through the account's own
 // facade (/api/v1/push/subscription), with the one push key pair this gateway
@@ -37,10 +39,13 @@ import { PodStore } from '../core/store.mjs';
 import { apUrls } from '../core/wire.mjs';
 import { Publisher } from '../core/publisher/index.mjs';
 import { nextDue } from '../core/scheduled.mjs';
-import { reachAccount, stateAndLease, actingAgent } from './account-agent.mjs';
+import { reachAccount, settle, stateAndLease, actingAgent } from './account-agent.mjs';
 import { ensureCopy } from './state-api.mjs';
-import { CopyStorage, lockCopy, keptNow, keptBefore, GATEWAY_HOLDER } from './copy.mjs';
+import { CopyStorage, lockCopy, keptNow, keptBefore, holdOn, waitOutClosing, GATEWAY_HOLDER } from './copy.mjs';
+import { HttpStorage } from '../core/storage.mjs';
+import * as podInbox from '../pod/inbox.mjs';
 import { heldEntries } from './held-mail.mjs';
+import { noteOpened } from './quiet.mjs';
 import { Push } from '../client/webpush.mjs';
 import webpush from 'web-push';
 
@@ -196,19 +201,65 @@ class GatewayPush extends Push {
 // ---- the account behind a token ----
 
 // Loaded copies, kept while this running copy lives: a check that finds the
-// copy unchanged costs one listing, not every document.
-const reading = new Map();   // handle -> PodStore
+// copy unchanged costs one listing, not every document. With the hold off,
+// the pod's state, read the same way.
+const reading = new Map();   // handle (or pod:handle) -> PodStore
 const noAuthorities = { has: () => false, isLocalRequest: () => false, isLocal: () => false, wsAuthorities: () => [] };
 
-async function readingStore(ctx, handle, log) {
-  let store = reading.get(handle);
-  if (!store) {
-    store = new PodStore({ storage: new CopyStorage(ctx.copyKv, handle, { holder: GATEWAY_HOLDER }), log });
+// What an app reads: the copy, or with the hold off, the pod.
+const stateOf = (ctx, handle, at) => (at.inCopy
+  ? new CopyStorage(ctx.copyKv, handle, { holder: GATEWAY_HOLDER })
+  : new HttpStorage(at.urls.state, at.podFetch));
+
+async function readingStore(ctx, handle, at, log) {
+  const key = at.inCopy ? handle : `pod:${handle}`;
+  let held = reading.get(key);
+  if (!held) {
+    held = { store: new PodStore({ storage: stateOf(ctx, handle, at), log }) };
     if (reading.size > 200) reading.clear();
-    reading.set(handle, store);
+    reading.set(key, held);
   }
-  await store.load();
-  return store;
+  // This request's own sign-in at the pod; the same place, so what is held stays.
+  else held.store.attach(stateOf(ctx, handle, at));
+  held.at = Date.now();
+  await held.store.load();
+  return held.store;
+}
+
+// What this running copy remembers of an account, a loaded copy or an answer,
+// goes once nobody has asked for fifteen minutes, as the copy itself does
+// (copy.mjs: the hold).
+const MEMORY_MS = 15 * 60_000;
+function forgetOld(now = Date.now()) {
+  for (const [k, v] of reading) if (now - v.at > MEMORY_MS) reading.delete(k);
+  for (const [k, v] of answered) if (now - v.at > MEMORY_MS) { answeredBytes -= v.body.length; answered.delete(k); }
+}
+const forget = (handle) => { reading.delete(handle); reading.delete(`pod:${handle}`); };
+
+// An app's repeated check: while the copy's list of documents is as it was
+// and no mail waits, the same question gets the same answer, without opening
+// the copy. Ten minutes at most, for what changes with the clock alone (a
+// poll closing). Kept per token, while this running copy lives.
+const REPEAT_MS = 10 * 60_000;
+const REPEAT_MAX_BYTES = 32 * 1024 * 1024;
+const REPEATABLE = /^\/api\/v[12]\/(timelines\/[^/]+(\/[^/]+)?|notifications(\/unread_count)?|markers|conversations|follow_requests|announcements|accounts\/verify_credentials|lists|filters|preferences)$/u;
+const answered = new Map();   // handle, token hash and the question -> { tag, at, status, headers, body }
+let answeredBytes = 0;
+
+async function repeatAnswer(ctx, handle, key, at) {
+  const had = answered.get(key);
+  if (!had || Date.now() - had.at > REPEAT_MS) return null;
+  const listing = await stateOf(ctx, handle, at).list('', { etag: had.tag }).catch(() => ({ notModified: false }));
+  if (!listing.notModified) return null;
+  if (ctx.listHeld && (await ctx.listHeld(handle)).length) return null;
+  return { status: had.status, headers: { ...had.headers }, body: had.body };
+}
+
+function rememberAnswer(key, tag, status, headers, body) {
+  if (body.length > REPEAT_MAX_BYTES / 64) return;
+  if (answeredBytes + body.length > REPEAT_MAX_BYTES) { answered.clear(); answeredBytes = 0; }
+  answeredBytes += body.length - (answered.get(key)?.body.length || 0);
+  answered.set(key, { tag, at: Date.now(), status, headers, body });
 }
 
 // What an app reading needs of an agent: the store, the account's addresses
@@ -246,19 +297,31 @@ async function notePushSubs(ctx, handle, store) {
 }
 export async function pushWanted(ctx, handle) { return Number((await ctx.mastoKv?.get(`push/${handle}`))?.text || 0) > 0; }
 
+// With the hold off, mail is in the pod inbox, not held here: whether any is
+// waiting, from one listing.
+async function inboxWaiting(at) {
+  const items = await podInbox.list(at.remote, at.urls).catch(() => []);
+  return items.some((e) => !e.url.endsWith('.keep') && !e.url.endsWith('.receipt.json'));
+}
+
 /**
  * Read what was held for an account into its copy, and push each notification
- * that makes to the owner's phones and browsers. `takeover`: act even when a
- * browser that went quiet still holds the lease (a push run); otherwise leave
- * the mail to whoever holds it (an app's check).
+ * that makes to the owner's phones and browsers. With the hold off, what waits
+ * in the pod inbox is drained instead. `takeover`: act even when a browser
+ * that went quiet still holds the lease (a push run); otherwise leave the mail
+ * to whoever holds it (an app's check).
  */
 async function readHeld(ctx, handle, rec, { log = console.log, takeover = false, waitMs = 1000 } = {}) {
-  if (!(await ctx.listHeld(handle)).length) return 0;
+  const held = async () => !!(ctx.listHeld && (await ctx.listHeld(handle)).length);
+  if (holdOn(ctx) && !await held()) return 0;
   const unlock = await lockCopy(ctx.copyKv, handle, { waitMs });
   if (!unlock) return 0;
   try {
     const at = await reachAccount(ctx, handle, rec, { log });
-    if (at.skipped || !at.inCopy) return 0;
+    if (at.skipped) return 0;
+    if (!(await settle(ctx, handle, rec, at, { log })).ok) return 0;
+    const drains = !at.inCopy;
+    if (drains && !await inboxWaiting(at) && !await held()) return 0;
     const { store, lease } = stateAndLease(ctx, handle, at, { log });
     if (!await lease.acquire() && !(takeover && await lease.takeover())) return 0;
     await store.load();
@@ -277,22 +340,23 @@ async function readHeld(ctx, handle, rec, { log = console.log, takeover = false,
         })().catch((e) => log(`push @${handle}: ${e.message}`)));
       };
     }
-    const entries = await heldEntries(ctx, handle);
+    const entries = ctx.listHeld ? await heldEntries(ctx, handle) : [];
     const done = new Set(await agent.intake.takeHeld(entries));
     for (const e of entries) if (done.has(e.name)) for (const n of e.held) await ctx.dropHeld(handle, n);
+    if (drains) await agent.intake.drain();
     await Promise.all(pushes);
     await store.commit();
     await lease.release().catch(() => {});
     await ctx.noteNext?.(handle, nextDue(store)).catch(() => {});
-    reading.delete(handle);
-    if (done.size) log(`@${handle}: ${done.size} held deliveries read into the copy, ${pushes.length} pushed`);
-    return done.size;
+    forget(handle);
+    if (done.size || drains) log(`@${handle}: ${drains ? 'the pod inbox drained' : `${done.size} held deliveries read into the copy`}, ${pushes.length} pushed`);
+    return done.size || (drains ? 1 : 0);
   } finally { await unlock(); }
 }
 
 /** For an app checking in: at most every thirty seconds, never over a browser. */
 export async function readHeldForApp(ctx, handle, rec, { log = console.log } = {}) {
-  if (!ctx.listHeld) return 0;
+  if (!ctx.listHeld && holdOn(ctx)) return 0;
   const key = `${handle}/mail-read-at`;
   const last = Number((await ctx.copyKv.get(key))?.text || 0);
   if (Date.now() - last < MAIL_EVERY_MS) return 0;
@@ -307,7 +371,7 @@ export async function readHeldForApp(ctx, handle, rec, { log = console.log } = {
  * burst of likes is a run or two, not one each.
  */
 export async function pushHeld(ctx, handle, rec, { log = console.log } = {}) {
-  if (!ctx.listHeld || !await pushWanted(ctx, handle)) return 0;
+  if ((!ctx.listHeld && holdOn(ctx)) || !await pushWanted(ctx, handle)) return 0;
   const kv = ctx.mastoKv;
   const wanted = async () => (await kv.get(`pushwant/${handle}`))?.text || null;
   let n = 0;
@@ -326,21 +390,44 @@ export async function pushHeld(ctx, handle, rec, { log = console.log } = {}) {
   return n;
 }
 
-// A request from an app, answered by the account's facade over its copy.
-async function answerForAccount(request, url, ctx, tok, rec, log) {
+// A request from an app, answered by the account's facade over its copy, or
+// with the hold off, over the pod.
+async function answerForAccount(request, url, ctx, tok, rec, log, tokenHash) {
   const handle = tok.handle;
+  forgetOld();
+  const repeatKey = request.method === 'GET' && REPEATABLE.test(url.pathname) ? `${handle}\n${tokenHash}\n${url.pathname}${url.search}` : null;
+  // The copy's listing as it was: the same answer, without opening the copy.
+  // A copy written to the pod and deleted since lists differently.
+  if (repeatKey && holdOn(ctx)) {
+    const again = await repeatAnswer(ctx, handle, repeatKey, { inCopy: true });
+    if (again) return again;
+  }
+  // A copy the round is writing to the pod and deleting is waited out; it is
+  // made again below.
+  await waitOutClosing(ctx.copyKv, handle);
   const at = await reachAccount(ctx, handle, rec, { log });
   if (at.skipped) return json(503, { error: `this account cannot be reached now: ${at.skipped}` });
-  if (!at.inCopy) {
+  const token = { token: 'gateway', scope: tok.scope };
+  const writes = request.method !== 'GET' && request.method !== 'HEAD';
+  if (!writes && !at.inCopy && holdOn(ctx)) {
     const made = await ensureCopy(ctx, handle, rec, log);
     if (!made.ok) return json(made.status === 409 ? 503 : made.status, { error: made.why });
     at.inCopy = true;
   }
-  const token = { token: 'gateway', scope: tok.scope };
-  const writes = request.method !== 'GET' && request.method !== 'HEAD';
+  // New mail read in beside this answer, for the app's next check.
+  if (!writes && /^\/api\/v[12]\/(timelines\/home|notifications)$/u.test(url.pathname)) {
+    ctx.waitUntil?.(readHeldForApp(ctx, handle, rec, { log }).catch((e) => log(`app @${handle}: held mail: ${e.message}`)));
+  }
+  // With the hold off, the pod's listing, after the inbox has been looked at.
+  if (repeatKey && !holdOn(ctx)) {
+    const again = await repeatAnswer(ctx, handle, repeatKey, at);
+    if (again) return again;
+  }
   const b = await bridge(request, url);
   if (!writes) {
-    const store = await readingStore(ctx, handle, log);
+    const store = await readingStore(ctx, handle, at, log);
+    // The copy as this answer reads it: a later check finding the same list repeats it.
+    const tag = store.etags.get('');
     let actingP = null;
     const acting = () => (actingP ||= (async () => {
       const s = stateAndLease(ctx, handle, at, { log });
@@ -353,17 +440,23 @@ async function answerForAccount(request, url, ctx, tok, rec, log) {
     if (!agent) return json(503, { error: 'this account\'s copy holds no account' });
     const api = facade(agent, token, log, await vapidKeys(ctx.mastoKv), pushContact(ctx));
     const handled = await api.handle(b.req, b.res, url.pathname, url);
-    // New mail read in after this answer, for the app's next check.
-    if (/^\/api\/v[12]\/(timelines\/home|notifications)$/u.test(url.pathname)) {
-      ctx.waitUntil?.(readHeldForApp(ctx, handle, rec, { log }).catch((e) => log(`app @${handle}: held mail: ${e.message}`)));
-    }
-    return handled ? b.response() : new Response(JSON.stringify({ error: 'not found' }), { status: 404 });
+    if (!handled) return new Response(JSON.stringify({ error: 'not found' }), { status: 404 });
+    const res = b.response();
+    // An answer that had to act (a fetch from another server) is not repeated.
+    if (!repeatKey || actingP || res.status !== 200 || !tag) return res;
+    const headers = Object.fromEntries(res.headers);
+    const body = await res.text();
+    rememberAnswer(repeatKey, tag, res.status, headers, body);
+    return { status: res.status, headers, body };
   }
   // Acting: this app outranks a browser sitting open, as one device does another.
   const unlock = await lockCopy(ctx.copyKv, handle);
   if (!unlock) return json(503, { error: 'this account is busy; try again' });
   let lease = null;
   try {
+    // Decided under the lock, so the round cannot delete the copy meanwhile.
+    const settled = await settle(ctx, handle, rec, at, { log });
+    if (!settled.ok) return json(settled.status === 409 ? 503 : settled.status || 503, { error: settled.why });
     const s = stateAndLease(ctx, handle, at, { log });
     if (!await s.lease.acquire() && !await s.lease.takeover()) return json(503, { error: 'could not take this account over; try again' });
     lease = s.lease;
@@ -377,7 +470,7 @@ async function answerForAccount(request, url, ctx, tok, rec, log) {
     if (url.pathname === '/api/v1/push/subscription') await notePushSubs(ctx, handle, store);
     agent.publisher.stopPolls?.();
     await ctx.noteNext?.(handle, nextDue(store)).catch(() => {});
-    reading.delete(handle);
+    forget(handle);
     return handled ? b.response() : new Response(JSON.stringify({ error: 'not found' }), { status: 404 });
   } finally {
     // Done acting, however it went: the lease goes back, so a browser sitting
@@ -478,14 +571,17 @@ async function route(request, pathname, ctx, deps, log) {
     if (keptBefore(ctx, rec)) return json(503, { error: MOVING });
     if (!usable(ctx, rec)) return json(409, { error: notReady(rec) });
     if (rec.webId !== webid) return json(403, { error: `you signed in as ${webid}, and this account belongs to ${rec.webId}` });
+    // Signing an app in is the owner being here, as signing in to FediPod is.
+    await noteOpened(ctx, handle, rec, { always: true }).catch((e) => log(`@${handle}: stamp not written: ${e?.message || e}`));
     const app = await appOf(kv, body.client_id);
     if (!app) return json(400, { error: 'this app has not registered here' });
     const redirect = body.redirect_uri || 'urn:ietf:wg:oauth:2.0:oob';
     if (redirect !== 'urn:ietf:wg:oauth:2.0:oob' && !app.redirectUris.includes(redirect)) {
       return json(400, { error: 'this app asked to be sent somewhere it did not register' });
     }
-    // The owner, proved: not an app checking in, so not made to wait.
-    const made = await ensureCopy(ctx, handle, rec, log, { owner: true });
+    // The owner, proved: not an app checking in, so not made to wait. With
+    // the hold off there is no copy to make; the app reads the pod.
+    const made = holdOn(ctx) ? await ensureCopy(ctx, handle, rec, log, { owner: true }) : { ok: true };
     if (!made.ok) return json(made.status === 409 ? 503 : made.status, { error: made.why });
     const code = rand(24);
     await putJson(kv, `code/${sha(code)}`, {
@@ -537,7 +633,8 @@ async function route(request, pathname, ctx, deps, log) {
 
   // Everything else needs a token.
   const bearer = /^Bearer (.+)$/u.exec(request.headers.get('authorization') || '')?.[1];
-  const tok = bearer ? await getJson(kv, `token/${sha(bearer)}`) : null;
+  const tokenHash = bearer ? sha(bearer) : null;
+  const tok = tokenHash ? await getJson(kv, `token/${tokenHash}`) : null;
   if (!tok || Date.now() - tok.at > TOKEN_TTL_MS) {
     // A page of this site asking with a token the gateway never gave out is
     // FediPod's own client in a browser whose worker is not answering yet:
@@ -555,5 +652,8 @@ async function route(request, pathname, ctx, deps, log) {
   // by somebody else is not theirs.
   if (rec && rec.webId === tok.webId && keptBefore(ctx, rec)) return json(503, { error: MOVING });
   if (!usable(ctx, rec) || rec.webId !== tok.webId) return json(401, { error: 'this account is not kept running here any more' });
-  return answerForAccount(request, url, ctx, tok, rec, log);
+  // Using an app is being here: no pause, no closing, for want of opening
+  // FediPod. Hourly at most; see noteOpened.
+  const here = await noteOpened(ctx, tok.handle, rec).catch((e) => { log(`@${tok.handle}: stamp not written: ${e?.message || e}`); return rec; });
+  return answerForAccount(request, url, ctx, tok, here, log, tokenHash);
 }

package/lib/gateway/private-read.mjs

@@ -0,0 +1,98 @@
+// private-read.mjs — a followers-only or direct post, read at its address by
+// a server it was sent to (ActivityPub §3.2). The read is signed the way a
+// delivery is; the signer is resolved; and the post is served only to an
+// actor in its audience: a follower for a post sent to followers, a named
+// recipient for a direct one. That is the rule Mastodon applies to its own
+// posts (StatusPolicy#show?). Anyone else learns nothing — 404, as for a
+// document that is not there, which §3.2 allows for a private target.
+//
+// At fedipod.net this works for an account it keeps: the post is read from
+// the pod with the keeper's credential, and the followers list from the
+// account's copy, or from the pod when there is no copy just then (the hold,
+// copy.mjs). Nothing read is kept. An account it does not keep gives it
+// nothing to read with,
+// so that read is sent on to the pod, as every private read was.
+
+import { verifyHttpSignature, makeSafeLoader } from './httpsig.mjs';
+import { asSigned } from './gateway-core.mjs';
+import { senderKeys } from './caches.mjs';
+import { keptNow } from './copy.mjs';
+
+const AP_CT = 'application/activity+json';
+const PUBLIC_NAMES = new Set(['https://www.w3.org/ns/activitystreams#Public', 'as:Public', 'Public']);
+const list = (v) => (v == null ? [] : Array.isArray(v) ? v : [v])
+  .map((x) => (typeof x === 'string' ? x : x?.id)).filter((x) => typeof x === 'string');
+
+/** Who a document was sent to: the actors named, and whether followers were. */
+export function audienceOf(doc, followersUrls = []) {
+  const o = doc?.type === 'Create' && doc.object && typeof doc.object === 'object' ? doc.object : doc;
+  const named = new Set(['to', 'cc', 'audience'].flatMap((k) => [...list(doc?.[k]), ...list(o?.[k])]));
+  return {
+    named,
+    isPublic: [...named].some((a) => PUBLIC_NAMES.has(a)),
+    toFollowers: followersUrls.some((f) => named.has(f)),
+  };
+}
+
+/** Whether `actor` may read `doc`: named in its audience, or a follower when it went to followers. */
+export function mayRead(doc, actor, { followersUrls = [], followers = [] } = {}) {
+  if (typeof actor !== 'string' || !actor) return false;
+  const a = audienceOf(doc, followersUrls);
+  if (a.isPublic || a.named.has(actor)) return true;
+  return a.toFollowers && followers.includes(actor);
+}
+
+/**
+ * The actor behind a signed read, or null with why. `origin` is the door's
+ * own (see asSigned in gateway-core.mjs); a GET has no body to digest.
+ */
+export async function signedReader(request, { fetchImpl = fetch, origin = null } = {}) {
+  if (!request.headers.get('signature')) return { actor: null, reason: 'no-signature' };
+  const v = await verifyHttpSignature(asSigned(request, new Uint8Array(0), origin), {
+    documentLoader: makeSafeLoader({ fetchImpl }), keyCache: senderKeys,
+  });
+  return v.verified && typeof v.actor === 'string' ? { actor: v.actor, reason: null } : { actor: null, reason: v.reason };
+}
+
+// Refused reads are told nothing, and never held at the edge.
+const nothing = (open) => ({ status: 404, headers: { ...open, 'cache-control': 'no-store', vary: 'Signature' }, body: '' });
+
+/**
+ * A read under `ap/private/` at the front. Unsigned: sent on to the pod, which
+ * decides (the owner reads there with their own credential). Signed: answered
+ * here for a kept account, to a reader the post was sent to.
+ */
+export async function answerPrivateRead(ctx, rec, { request, handle, podTarget, base, open, swap }) {
+  if (!request.headers.get('signature')) {
+    return { status: 303, headers: { ...open, location: podTarget, 'cache-control': 'no-store' }, body: '' };
+  }
+  const say = (what) => console.log(`private read @${handle}: ${what}`);
+  if (!keptNow(ctx, rec) || typeof ctx.keeperFetch !== 'function' || !ctx.copyKv) { say('refused — account not kept here'); return nothing(open); }
+  const { actor, reason } = await signedReader(request, { fetchImpl: ctx.fetchImpl || fetch, origin: ctx.frontOrigin || null });
+  if (!actor) { say(`refused — ${reason}`); return nothing(open); }
+  const podFetch = await ctx.keeperFetch();
+  if (!podFetch) { say('refused — no keeper credential'); return nothing(open); }
+  let text = null;
+  try {
+    const res = await podFetch(podTarget, { headers: { accept: AP_CT } });
+    if (res.status === 200) text = await res.text();
+  } catch { /* unreachable: nothing to serve */ }
+  let doc = null;
+  try { doc = text ? JSON.parse(text) : null; } catch { doc = null; }
+  if (!doc) { say(`refused — the pod did not give it (${actor})`); return nothing(open); }
+  // Who follows: from the account's copy while there is one, else from the pod.
+  let followers = [];
+  try {
+    let contacts = (await ctx.copyKv.get(`${handle}/d/contacts.json`))?.text || null;
+    if (!contacts) {
+      const res = await podFetch(`${rec.podHome.replace(/\/?$/u, '/')}ap-state/contacts.json`, { headers: { accept: 'application/json' } });
+      if (res.status === 200) contacts = await res.text();
+    }
+    followers = (JSON.parse(contacts || '{}').followers || []).map((f) => f?.actor).filter(Boolean);
+  } catch { followers = []; }
+  const followersUrls = [rec.podHome + 'ap/followers', base + 'ap/followers'];
+  if (!mayRead(doc, actor, { followersUrls, followers })) { say(`refused — ${actor} is not in its audience`); return nothing(open); }
+  say(`served to ${actor}`);
+  return { status: 200, headers: { ...open, 'content-type': AP_CT, 'cache-control': 'no-store', vary: 'Signature' },
+    body: request.method === 'HEAD' ? '' : swap(text, rec.podHome, base) };
+}

package/lib/gateway/quiet.mjs

@@ -4,7 +4,7 @@
 // public read, stamps noteOpened from the relay, counts noteReceived after
 // a forwarded delivery, and hands /api/open, /api/pause and /api/close here.
 
-import { keptNow } from './copy.mjs';
+import { keptNow, holdOn } from './copy.mjs';
 
 // ---- accounts that go quiet -------------------------------------------------
 //
@@ -144,9 +144,10 @@ export async function routeQuietApi(request, pathname, ctx, deps) {
     if (before.closed) return j(410, { error: 'this address is closed', closedAt: before.closedAt, closedBy: before.closedBy });
     rec = await noteOpened(ctx, handle, rec, { always: true });
     // Whom the app would name if its owner lets the gateway act for them while
-    // it is closed, and whether they have (held-mail.mjs, keeper.mjs).
+    // it is closed, and whether they have (held-mail.mjs, keeper.mjs); and
+    // whether the gateway holds a copy of the account at all (copy.mjs).
     return j(200, { ok: true, handle, ...await accountState(ctx, handle, rec),
-      keeper: ctx.keeperWebId || null, kept: keptNow(ctx, rec), keptBy: rec.keeper?.webId || null });
+      keeper: ctx.keeperWebId || null, kept: keptNow(ctx, rec), keptBy: rec.keeper?.webId || null, hold: holdOn(ctx) });
   }
 
   // The owner pausing their own account, or lifting the pause they set.