fedipod-server 0.10.0 → 0.12.1

package/lib/core/shapes/activitystreams.ttl

@@ -0,0 +1,129 @@
+# activitystreams.ttl — shapes for the ActivityStreams documents an identity
+# reads from strangers.
+#
+# Shapes are identified by fragments of this document, so nothing here claims a
+# namespace of its own.
+#
+# These are deliberately thin. They state what the ActivityPub specification
+# requires and nothing more, because every fediverse implementation writes
+# slightly different documents and a constraint beyond the spec is a constraint
+# that fires on somebody's real traffic. Nothing here rejects anything: a
+# failure is recorded and the activity is handled. A shape earns its way to
+# being enforced by not firing.
+
+@prefix sh:   <http://www.w3.org/ns/shacl#> .
+@prefix as:   <https://www.w3.org/ns/activitystreams#> .
+@prefix ldp:  <http://www.w3.org/ns/ldp#> .
+@prefix xsd:  <http://www.w3.org/2001/XMLSchema#> .
+
+# --- the actor document ------------------------------------------------------
+
+<#Actor>
+  a sh:NodeShape ;
+  sh:targetClass as:Person, as:Service, as:Group, as:Organization, as:Application ;
+  sh:name "Actor" ;
+  sh:description "Someone or something that acts: it has an address activities are sent to, and a name it is addressed by." ;
+  sh:property [
+    sh:path ldp:inbox ;
+    sh:name "inbox" ;
+    sh:description "The collection an actor receives activities in." ;
+    sh:nodeKind sh:IRI ;
+    sh:minCount 1 ;
+    sh:maxCount 1 ;
+  ] ;
+  sh:property [
+    sh:path as:preferredUsername ;
+    sh:name "preferred username" ;
+    sh:description "The short name an actor is addressed by, the local part of its @handle@host address." ;
+    sh:datatype xsd:string ;
+    sh:maxCount 1 ;
+  ] .
+
+# --- the activities an identity acts on --------------------------------------
+#
+# Each states the two things ActivityPub requires of an activity: who performed
+# it, and what it is about.
+
+<#Create>
+  a sh:NodeShape ;
+  sh:targetClass as:Create ;
+  sh:name "Create" ;
+  sh:description "The bringing into existence of the object it names." ;
+  sh:property [
+    sh:path as:actor ;
+    sh:name "actor" ;
+    sh:description "The one that performed the activity." ;
+    sh:nodeKind sh:BlankNodeOrIRI ;
+    sh:minCount 1 ;
+    sh:maxCount 1 ;
+  ] ;
+  sh:property [
+    sh:path as:object ;
+    sh:name "object" ;
+    sh:description "The thing the activity is about." ;
+    sh:minCount 1 ;
+    sh:maxCount 1 ;
+  ] .
+
+<#Follow>
+  a sh:NodeShape ;
+  sh:targetClass as:Follow ;
+  sh:name "Follow" ;
+  sh:description "A request to receive what the object it names publishes." ;
+  sh:property [
+    sh:path as:actor ;
+    sh:name "actor" ;
+    sh:description "The one that performed the activity." ;
+    sh:nodeKind sh:BlankNodeOrIRI ;
+    sh:minCount 1 ;
+    sh:maxCount 1 ;
+  ] ;
+  sh:property [
+    sh:path as:object ;
+    sh:name "object" ;
+    sh:description "The thing the activity is about." ;
+    sh:minCount 1 ;
+    sh:maxCount 1 ;
+  ] .
+
+<#Accept>
+  a sh:NodeShape ;
+  sh:targetClass as:Accept ;
+  sh:name "Accept" ;
+  sh:description "Assent to the activity it names." ;
+  sh:property [
+    sh:path as:actor ;
+    sh:name "actor" ;
+    sh:description "The one that performed the activity." ;
+    sh:nodeKind sh:BlankNodeOrIRI ;
+    sh:minCount 1 ;
+    sh:maxCount 1 ;
+  ] ;
+  sh:property [
+    sh:path as:object ;
+    sh:name "object" ;
+    sh:description "The thing the activity is about." ;
+    sh:minCount 1 ;
+    sh:maxCount 1 ;
+  ] .
+
+<#Undo>
+  a sh:NodeShape ;
+  sh:targetClass as:Undo ;
+  sh:name "Undo" ;
+  sh:description "The retraction of the activity it names, by the one that performed it." ;
+  sh:property [
+    sh:path as:actor ;
+    sh:name "actor" ;
+    sh:description "The one that performed the activity." ;
+    sh:nodeKind sh:BlankNodeOrIRI ;
+    sh:minCount 1 ;
+    sh:maxCount 1 ;
+  ] ;
+  sh:property [
+    sh:path as:object ;
+    sh:name "object" ;
+    sh:description "The thing the activity is about." ;
+    sh:minCount 1 ;
+    sh:maxCount 1 ;
+  ] .

package/lib/core/shapes/index.mjs

@@ -0,0 +1,107 @@
+// shapes/index.mjs — validating an ActivityStreams document against the shapes
+// beside this file.
+//
+// A shape says what a kind of document IS. Checking one against a document we
+// were sent is a different question from whether we trust it: a forged actor,
+// a receipt that does not bind, a reply naming a note we never wrote are each
+// guarded elsewhere, and none of those guards is replaced here.
+//
+// NOTHING HERE REJECTS ANYTHING. A failure is recorded and the activity is
+// handled exactly as it would have been. Every fediverse implementation writes
+// slightly different documents, and a shape strict enough to catch something
+// real is strict enough to reject somebody's quirk; which one cannot be known
+// in advance, so it is learned from the record rather than guessed at. A shape
+// earns enforcement by not firing.
+
+import { Parser } from 'n3';
+import Environment from '@rdfjs/environment';
+import DataFactory from '@rdfjs/data-model/Factory.js';
+import DatasetFactory from '@rdfjs/dataset/Factory.js';
+import NamespaceFactory from '@rdfjs/namespace/Factory.js';
+import TermSetFactory from '@rdfjs/term-set/Factory.js';
+import TermMapFactory from '@rdfjs/term-map/Factory.js';
+import ClownfaceFactory from 'clownface/Factory.js';
+import SHACLValidator from 'rdf-validate-shacl';
+import { SHAPES_TTL } from './shapes-text.mjs';
+
+// The validator needs a full RDF/JS environment, not a bare factory. These
+// pieces are what rdf-validate-shacl itself depends on, composed here rather
+// than pulling in a packaged environment that reads files — this has to run in
+// a service worker too.
+const rdf = new Environment([DataFactory, DatasetFactory, NamespaceFactory, TermSetFactory, TermMapFactory, ClownfaceFactory]);
+
+// The shapes document's own URL is the base, so `<#Create>` resolves to a
+// fragment of it and no namespace is claimed.
+const SHAPES_BASE = 'https://fedipod.invalid/shapes';
+
+let validator;
+let brokenReported = false;
+
+/** The validator, built once. Reading and parsing the shapes is not per-document work. */
+function shacl() {
+  if (!validator) {
+    const quads = new Parser({ baseIRI: SHAPES_BASE, format: 'text/turtle' }).parse(SHAPES_TTL);
+    validator = new SHACLValidator(rdf.dataset(quads.map(asTerm)), { factory: rdf });
+  }
+  return validator;
+}
+
+/** jsonld and n3 each mint their own terms; the validator's environment must mint the ones it sees. */
+function asTerm(q) {
+  const term = (t) => {
+    if (t.termType === 'NamedNode') return rdf.namedNode(t.value);
+    if (t.termType === 'BlankNode') return rdf.blankNode(String(t.value).replace(/^_:/u, ''));
+    if (t.termType === 'Literal') {
+      return rdf.literal(t.value, t.language || (t.datatype ? rdf.namedNode(t.datatype.value) : undefined));
+    }
+    return rdf.defaultGraph();
+  };
+  return rdf.quad(term(q.subject), term(q.predicate), term(q.object));
+}
+
+/**
+ * Check a document's graph against the shapes.
+ *
+ * `quads` is what `parseAS2` produced. Returns null when the document
+ * conforms or when there was no graph to check, and otherwise a short record
+ * of what did not fit — the failing node, the property, and the shape's own
+ * words for it.
+ *
+ * Never throws. A validator that cannot run is not a reason to drop mail — but
+ * it is said once, because a checker that silently passes everything is the
+ * same silence this change exists to remove.
+ */
+export async function checkShapes(quads) {
+  if (!Array.isArray(quads) || quads.length === 0) return null;
+  let report;
+  try {
+    report = await shacl().validate(rdf.dataset(quads.map(asTerm)));
+  } catch (e) {
+    // A validator that cannot run must not read as "everything conforms" —
+    // that is the same silence this whole change exists to remove. Said once,
+    // then quiet, because a broken validator would otherwise say it per item.
+    if (!brokenReported) {
+      brokenReported = true;
+      return { conforms: false, broken: true, results: [{ focus: null, path: null, message: `shape validation is not running: ${e.message}`, shape: null }] };
+    }
+    return null;
+  }
+  if (report.conforms) return null;
+  return {
+    conforms: false,
+    results: report.results.slice(0, 10).map((r) => ({
+      focus: r.focusNode?.value ?? null,
+      path: r.path?.value ?? null,
+      message: r.message?.[0]?.value ?? String(r.sourceConstraintComponent?.value ?? 'does not fit the shape'),
+      shape: r.sourceShape?.value ?? null,
+    })),
+  };
+}
+
+/** The failure as one line, for a log or a dead-letter record. */
+export function describeShapeFailure(failure) {
+  if (!failure) return null;
+  return failure.results
+    .map((r) => `${r.path ? r.path.replace(/^.*[#/]/u, '') : 'node'}: ${r.message}`)
+    .join('; ');
+}

package/lib/core/shapes/shapes-text.mjs

@@ -0,0 +1,13 @@
+// shapes-text.mjs — the shapes document, as text.
+//
+// The shapes are authored as Turtle in activitystreams.ttl, which is the one
+// source of truth and opens in any RDF tool. Reading it differs by where this
+// runs: Node reads the file, and the browser bundle swaps this module for a
+// shim that imports the same .ttl through esbuild's text loader.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const SHAPES_TTL = fs.readFileSync(
+  path.join(path.dirname(fileURLToPath(import.meta.url)), 'activitystreams.ttl'), 'utf8',
+);

package/lib/{social.mjs → core/social.mjs}

@@ -5,6 +5,7 @@
 
 import crypto from 'node:crypto';
 import * as wire from './wire.mjs';
+import * as podNotes from '../pod/notes.mjs';
 import { dropFollower } from './store.mjs';
 
 // WebFinger, ours rather than fedify's — v2 dropped lookupWebFinger.
@@ -20,13 +21,23 @@ export async function lookupWebFinger(acct) {
   if (at < 1) return null;
   const [user, host] = [clean.slice(0, at), clean.slice(at + 1)];
   if (!host || /[/\\?#]/.test(host)) return null;
-  const { safeFetch, readCapped } = await import('./safefetch.mjs');
+  const { safeFetch, readCapped } = await import('../shared/safefetch.mjs');
   const url = `https://${host}/.well-known/webfinger?resource=${encodeURIComponent(`acct:${clean}`)}`;
   const res = await safeFetch(url, {
     headers: { accept: 'application/jrd+json, application/json' },
   }).catch(() => null);
   if (!res || res.status >= 400) return null;
-  try { return JSON.parse(await readCapped(res, 256 * 1024)); } catch { return null; }
+  let jrd;
+  try { jrd = JSON.parse(await readCapped(res, 256 * 1024)); } catch { return null; }
+  // The JRD says who it is about. Nothing checked it, so a host answering every
+  // query with one account's document made `@anyone@that.host` resolve to that
+  // account — and it was then stored under the handle that was asked for, not
+  // the one it turned out to be.
+  const subject = String(jrd?.subject || '').replace(/^acct:/, '').toLowerCase();
+  if (subject && subject !== clean.toLowerCase()) {
+    return null;
+  }
+  return jrd;
 }
 
 export const selfLink = (jrd) => jrd?.links?.find(l => l.rel === 'self' &&
@@ -337,8 +348,8 @@ export async function votePoll(agent, s, choices) {
       '@context': wire.AS_CTX, id: wire.createActivityId(id), type: 'Create',
       actor: urls.actor, published, to: [s.actor], object: note,
     };
-    await agent.remote.putJson(id, note);
-    await agent.remote.putJson(create.id, create);
+    await podNotes.write(agent.remote, id, note);
+    await podNotes.writeCreate(agent.remote, create.id, create);
     await agent.deliverer.deliverToAll([inbox], create);
   }
   agent.store.updateStatus(s.noteId, {
@@ -364,10 +375,9 @@ export async function deleteNote(agent, s) {
   const stuck = [];
   const deletedAt = new Date().toISOString();
   try {
-    await agent.remote.putJson(s.noteId, wire.noteTombstone(s.noteId, deletedAt));
-    await agent.remote.setAcl(s.noteId, ['Read']);
+    await podNotes.writeTombstone(agent.remote, s.noteId, wire.noteTombstone(s.noteId, deletedAt));
   } catch { stuck.push(s.noteId); }
-  if (!await agent.remote.delete(wire.createActivityId(s.noteId)).catch(() => false)) {
+  if (!await podNotes.dropCreate(agent.remote, wire.createActivityId(s.noteId))) {
     stuck.push(wire.createActivityId(s.noteId));
   }
   if (stuck.length) {
@@ -378,7 +388,7 @@ export async function deleteNote(agent, s) {
     };
   }
   // Empty, and referenced by nothing once the note is gone.
-  await agent.remote.delete(wire.repliesId(s.noteId)).catch(() => {});
+  await podNotes.dropReplies(agent.remote, wire.repliesId(s.noteId));
 
   // The Bluesky mirror goes with the post. Best-effort: a mirror the far side
   // already lost is not a reason to keep the post here.
@@ -388,9 +398,8 @@ export async function deleteNote(agent, s) {
       .catch(e => agent.log?.(`bluesky mirror not deleted (${e.message}): ${s.atproto.uri}`));
   }
 
-  // The note, and our own boost of it if there was one.
+  // The note's outbox entry, and our own boost of it if there was one.
   await agent.publisher.unrecordOutbox(i => i === s.noteId || (i?.id && i.id === s.announceActivity?.id));
-  if (s.slug) await agent.local.delete(agent.local.fedi + 'posts/' + s.slug).catch(() => {});
   agent.store.removeStatus(s.noteId);
   return { ok: true };
 }

package/lib/{storage.mjs → core/storage.mjs}

@@ -30,8 +30,8 @@ export class HttpStorage {
   // The same jail FileStorage has, and for the same reason: a path here can
   // carry `..`, encodeURI leaves both `.` and `/` alone, and fetch normalises
   // the segments away — so a name derived from remote input could name a
-  // resource outside the container entirely. PodRdf._rel only checks the
-  // PREFIX, which a concatenated URL always satisfies, so it catches nothing.
+  // resource outside the container entirely. A prefix check is not enough on
+  // its own: a concatenated URL always satisfies one.
   _url(p) {
     const u = new URL(encodeURI(p), this.base);
     if (!u.href.startsWith(this.base)) throw new Error(`path escapes the container: ${p}`);

package/lib/{store.mjs → core/store.mjs}

@@ -152,6 +152,10 @@ export class PodStore {
 
   has(name) { return this.cache.has(name); }
 
+  // The documents held here. Callers that keep one document per thing — a
+  // connected account, say — list them with this rather than a fixed name.
+  names() { return [...this.cache.keys()]; }
+
   read(name, fallback) {
     return this.cache.has(name) ? structuredClone(this.cache.get(name)) : fallback;
   }
@@ -487,8 +491,15 @@ export class PodStore {
     if (ids[id] === url) return id;                    // already known, nothing to write
     const legacy = Object.entries(ids).find(([, u]) => u === url);
     if (legacy) return legacy[0];                      // pre-hash entry a client may hold
+    // In memory only. This runs on the RENDER path — once per status, per
+    // account, per attachment, every time a timeline is drawn — and `write()`
+    // is write-through, so on the browser build scrolling a timeline was a pod
+    // PUT of this whole document. Nothing durable is lost: the id IS the hash
+    // of the url, so idFor recomputes it identically on any later run, and the
+    // map exists only so urlFor can still answer for ids minted under an older
+    // scheme (which are loaded from the pod and never written here).
     ids[id] = url;
-    this.write('ids.json', ids);
+    this.cache.set('ids.json', ids);
     return id;
   }
   urlFor(id) { return this.getIds()[id] || null; }

package/lib/{wire.mjs → core/wire.mjs}

@@ -6,75 +6,40 @@ export const AS_CTX = 'https://www.w3.org/ns/activitystreams';
 export const SEC_CTX = 'https://w3id.org/security/v1';
 export const PUBLIC = 'https://www.w3.org/ns/activitystreams#Public';
 
-// URLs of the actor's documents on the remote pod. Everything the agent owns
-// nests under ONE top-level container (`root`) so the pod stays tidy and one
-// pod could host several actors under different roots. Webfinger + host-meta
-// stay at the pod root — fediverse discovery requires the host root.
-// The AP URLs for an identity. Normally everything hangs off the pod home.
-//
-// When `publicBase` is given (a fronted identity, e.g.
-// "https://fedipod.net/u/me/"), the ADVERTISED ids — the actor and everything
-// under `ap/` a remote server sees — build on the fronted home instead, while
-// the pod-side trees (`fediverse/`, `ap-state/`) and the write targets stay on
-// the pod. `toPod`/`toPublic` map between the two spaces; `RemotePod` applies
-// `toPod` at its one request choke point, so publisher/social/intake keep
-// passing advertised ids and the writes still land on the pod. With no
-// `publicBase` the returned object is byte-identical to before — the invariant
-// the smoke suite pins.
+// The pod LAYOUT — which container each document lives in — moved into the pod
+// library (lib/pod/urls.mjs), which knows nothing about FediPod and requires
+// the container root to be stated rather than defaulted. What stays here is
+// FediPod's own answer to "which root", and the handle rule, both of which read
+// this application's config shape.
+import { apUrls as podUrls } from '../pod/urls.mjs';
+
+export { webfingerHost } from '../pod/urls.mjs';
+
+// The container the Node agent has always used. Older than the rename to
+// FediPod and kept because it is what every existing Node-side pod actually
+// contains; the browser build states `fedipod/` on its own configs. A config
+// that names a root is always believed — this is only the answer for one that
+// does not.
+export const DEFAULT_ROOT = 'activitypods-js/';
+
 // The handle the fediverse sees: a fronted identity's name is the front's.
 export function publicHandle(config) {
   return config?.gateway?.frontActor?.match(/\/u\/([^/]+)\/ap\/actor\/?$/)?.[1]
     || config?.handle || null;
 }
 
-export function apUrls(remotePod, root = 'activitypods-js/', { publicBase = null } = {}) {
-  const base = remotePod.endsWith('/') ? remotePod : remotePod + '/';
-  const home = base + (!root || root.endsWith('/') ? root : root + '/');
-  // The face a remote sees: the fronted home, or the pod home when unfronted.
-  const face = publicBase ? (publicBase.endsWith('/') ? publicBase : publicBase + '/') : home;
-  const urls = {
-    base, home,
-    webfinger: base + '.well-known/webfinger',
-    actor: face + 'ap/actor',
-    inbox: face + 'ap/inbox/',
-    outbox: face + 'ap/outbox',
-    followers: face + 'ap/followers',
-    following: face + 'ap/following',
-    notes: face + 'ap/notes/',
-    privateNotes: face + 'ap/private/',
-    featured: face + 'ap/featured',
-    // FEP-1b12: the moderator roster a recipient validates announced
-    // moderation against. Published only when moderators are configured.
-    moderators: face + 'ap/moderators',
-    // FEP-4ccd and FEP-c648: follows in limbo and the block list, as
-    // collections. They live in the private container so the owner-only ACL
-    // is inherited, not re-stated per document.
-    pendingFollowers: face + 'ap/private/pending-followers',
-    pendingFollowing: face + 'ap/private/pending-following',
-    blocked: face + 'ap/private/blocked',
-    profileHtml: face + 'ap/profile.html',
-    // Media stays on the pod even when fronted: attachment urls are not
-    // identity-checked by remotes, and proxying blobs would be pure cost.
-    media: home + 'ap/media/',
-    fediverse: home + 'fediverse/',
-    state: home + 'ap-state/',
-  };
-  if (publicBase) {
-    urls.podHome = home;
-    urls.publicHome = face;
-    urls.toPod = (u) => (typeof u === 'string' && u.startsWith(face) ? home + u.slice(face.length) : u);
-    urls.toPublic = (u) => (typeof u === 'string' && u.startsWith(home) ? face + u.slice(home.length) : u);
-  }
-  return urls;
-}
-
-// The host a handle would resolve through, or null when no handle can point
-// here. @name@host is looked up at https://host/.well-known/webfinger, so only
-// a pod that owns the root of its host can answer for one; a pod living at
-// https://server/name/ may publish the document but nothing will ever ask.
-export function webfingerHost(podUrl) {
-  const u = new URL(podUrl);
-  return u.pathname === '/' ? u.host : null;
+/**
+ * The AP URLs for an identity, with FediPod's default root applied.
+ *
+ * The library underneath refuses to guess a root. Every caller here goes
+ * through this wrapper so there is exactly ONE answer to "which container",
+ * which is the thing that was wrong: the browser agent decided `fedipod/` for
+ * its own urls while the publisher, handed a config with no `root`, decided
+ * `activitypods-js/` — putting an identity's state in one container and its
+ * published documents in another.
+ */
+export function apUrls(remotePod, root, opts = {}) {
+  return podUrls(remotePod, root || DEFAULT_ROOT, opts);
 }
 
 // RFC 6415 host-meta: several fediverse implementations discover WebFinger
@@ -585,15 +550,31 @@ export function titledContent(note) {
 }
 
 // Normalize a wire Note's attachment list to { url, mediaType, description }.
+// Capped: this list comes from somebody else's document and lands in a
+// statuses.json row, which is rewritten whole on every change. Twenty is more
+// than any client shows and more than any real post carries.
+const MAX_ATTACHMENTS = 20;
+const MAX_ATTACHMENT_URL = 2048;
+// http(s) only: an attachment URL becomes a client's <img src> or <video src>,
+// and the store has guarded avatars this way all along (safeUrl).
+const attachmentUrl = (u) => {
+  if (!u) return null;
+  const s = String(u).slice(0, MAX_ATTACHMENT_URL);
+  try {
+    const p = new URL(s);
+    return (p.protocol === 'https:' || p.protocol === 'http:') ? s : null;
+  } catch { return null; }
+};
+
 export function attachmentsOf(note) {
   const list = Array.isArray(note?.attachment) ? note.attachment : note?.attachment ? [note.attachment] : [];
   // A bare Link carries `href` and no `url` — Lemmy's link posts arrive that
   // way, and reading only `url` dropped the link the post was about.
-  return list.map(a => ({
+  return list.slice(0, MAX_ATTACHMENTS).map(a => ({
     url: typeof a?.url === 'string' ? a.url : a?.url?.href || (typeof a?.href === 'string' ? a.href : undefined),
-    mediaType: a?.mediaType || '',
-    ...(a?.name ? { description: a.name } : {}),
-  })).filter(a => a.url);
+    mediaType: String(a?.mediaType || '').slice(0, 128),
+    ...(a?.name ? { description: String(a.name).slice(0, 1500) } : {}),
+  })).map(a => ({ ...a, url: attachmentUrl(a.url) })).filter(a => a.url);
 }
 
 const HTML_ESCAPES = { '&': '&amp;', '<': '&lt;', '>': '&gt;' };

package/lib/device/admin/index.mjs

@@ -0,0 +1,13 @@
+// admin.mjs — loopback HTTP front: admin API + Mastodon client-API facade +
+// the bundled Phanpy UI served same-origin (no CORS, no mixed content — the
+// role data-kitchen's router plays for the in-app pane). Loopback-bound; the
+// gate (vendor/gate.cjs) engages only when a token is configured, exactly
+// its standalone behavior.
+//
+// The surface is surface.mjs, its routes are the modules under routes/, the
+// static serving is static.mjs, the listener is server.mjs. This file is the
+// door the rest of the agent imports through.
+
+export { buildAdminSurface } from './surface.mjs';
+export { startAdmin } from './server.mjs';
+export { namedOrigin, secureOrigin, wsOrigins } from './origins.mjs';

package/lib/device/admin/origins.mjs

@@ -0,0 +1,35 @@
+// origins.mjs — the addresses an identity answers on, as a browser must be
+// sent to them.
+
+import { allowedAuthorities, hostLabel } from '../../shared/guard.mjs';
+
+// The origin a browser should be sent to for an identity. A browser keys
+// storage per ORIGIN, so linking every identity at localhost:<port> files them
+// all in one bucket — which is how a client ends up holding one actor's login
+// and showing it on another's page. Named whenever the handle is a legal host
+// label; bare loopback when it is not, because a mangled name would be an
+// origin the other agent's own guard refuses.
+export function namedOrigin(handle, port) {
+  const label = hostLabel(handle);
+  return `http://${label ? label + '.' : ''}localhost:${port}`;
+}
+
+// The https origin for an identity, on the one port it was given.
+// This is the advertised default — what gets printed, opened and linked; the
+// http listener stays served beside it for anything that needs cleartext.
+export function secureOrigin(handle, httpsPort) {
+  const label = hostLabel(handle);
+  return `https://${label ? label + '.' : ''}localhost:${httpsPort}`;
+}
+
+export function wsOrigins(port, labels = []) {
+  const out = new Set();
+  for (const a of allowedAuthorities(port, labels)) {
+    // No IPv6 at all. Bare `::1` cannot carry a port, and Chrome rejects the
+    // bracketed form inside a CSP source expression — one invalid source makes
+    // it drop the whole directive, which is worse than not listing the socket.
+    if (a.startsWith('::') || a.startsWith('[')) continue;
+    out.add(`wss://${/:\d+$/.test(a) ? a : `${a}:${port}`}`);
+  }
+  return [...out];
+}