fedipod-server 0.10.0 → 0.12.1

package/lib/{embed.mjs → server/embed.mjs}

@@ -16,15 +16,16 @@ import path from 'node:path';
 
 import { createRequire } from 'node:module';
 
-import { Agent } from '../run-agent.mjs';
-import { RemotePod } from './remote.mjs';
-import { apUrls } from './wire.mjs';
-import { writeJsonAtomic } from './home.mjs';
-import { buildAdminSurface } from './admin.mjs';
-import { FixedAuthorities } from './guard.mjs';
+import { Agent } from '../../run-agent.mjs';
+import { RemotePod } from '../device/remote.mjs';
+import { apUrls, DEFAULT_ROOT } from '../core/wire.mjs';
+import { writeJsonAtomic } from '../device/home.mjs';
+import { buildAdminSurface } from '../device/admin/index.mjs';
+import { FixedAuthorities } from '../shared/guard.mjs';
+import { CONNECTION_PREFIX, fileVault, moveVault, podVault } from '../connections/vault.mjs';
 
 const require = createRequire(import.meta.url);
-const { makeGate } = require('../vendor/gate.cjs');
+const { makeGate } = require('../../vendor/gate.cjs');
 
 // How long to gather store events before draining, so a delivery of several
 // items costs one sweep rather than one each.
@@ -34,23 +35,75 @@ const DRAIN_COALESCE_MS = 250;
 const mintSecret = () => crypto.randomBytes(32).toString('base64');
 
 /**
- * The secret guarding one identity's owner door, kept beside its signing key.
- * Minted when absent; `rotate` re-mints over an existing one — which is how a
- * lost secret is recovered, by proving pod control again. Never logged.
+ * The secret guarding one identity's owner door, kept in its pod's state
+ * beside its signing key. Minted when absent; `rotate` re-mints over an
+ * existing one — which is how a lost secret is recovered, by proving pod
+ * control again. Never logged.
+ *
+ * `dataDir`, when given, is where an identity set up before this kept it: the
+ * secret is moved into the pod and the host's copy removed, so the owner's
+ * existing door link goes on working.
  */
-export function ensureDoorSecret(dataDir, handle, { rotate = false } = {}) {
-  const home = path.join(dataDir, handle);
-  fs.mkdirSync(home, { recursive: true, mode: 0o700 });
-  const file = path.join(home, 'door-secret.json');
+export async function ensureDoorSecret(session, podBase, { rotate = false, dataDir = null, handle = null, log = () => {} } = {}) {
+  const base = podBase.endsWith('/') ? podBase : podBase + '/';
+  const url = apUrls(base, DEFAULT_ROOT).state + 'door-secret.json';
+  const onHost = dataDir && handle ? path.join(dataDir, handle, 'door-secret.json') : null;
+
   if (!rotate) {
-    try {
-      const rec = JSON.parse(fs.readFileSync(file, 'utf8'));
-      if (rec?.secret) return { secret: rec.secret, path: file, rotated: false };
-    } catch { /* absent or unreadable: mint below */ }
+    const res = await session.fetch(url, { headers: { accept: 'application/json' } })
+      .catch(() => ({ ok: false }));
+    if (res.ok) {
+      try {
+        const rec = JSON.parse(await res.text());
+        if (rec?.secret) {
+          if (onHost) fs.rmSync(onHost, { force: true });
+          return { secret: rec.secret, url, rotated: false };
+        }
+      } catch { /* unreadable: mint below */ }
+    }
+    // Set up before the secret lived on the pod: keep the one the owner has.
+    if (onHost && fs.existsSync(onHost)) {
+      try {
+        const rec = JSON.parse(fs.readFileSync(onHost, 'utf8'));
+        if (rec?.secret && await putSecret(session, url, rec)) {
+          fs.rmSync(onHost, { force: true });
+          log('door secret moved into the pod');
+          return { secret: rec.secret, url, rotated: false };
+        }
+      } catch { /* unreadable: mint below */ }
+    }
   }
+
   const rec = { secret: mintSecret(), mintedAt: new Date().toISOString() };
-  writeJsonAtomic(file, rec, { mode: 0o600 });
-  return { secret: rec.secret, path: file, rotated: rotate };
+  if (await putSecret(session, url, rec)) {
+    if (onHost) fs.rmSync(onHost, { force: true });
+    return { secret: rec.secret, url, rotated: rotate };
+  }
+  // The pod would not take it. Opting in must not fail for that: a pod that
+  // cannot be written to right now is a pod whose owner still asked for an
+  // identity, and the secret has somewhere else to live — where it lived
+  // before. The next start moves it onto the pod.
+  if (onHost) {
+    writeJsonAtomic(onHost, rec, { mode: 0o600 });
+    log(`the pod would not take the door secret; it is on this host at ${onHost} for now`);
+    return { secret: rec.secret, url: onHost, rotated: rotate };
+  }
+  throw new Error(`could not write the door secret to ${url}, and there is no directory to keep it in`);
+}
+
+async function putSecret(session, url, rec) {
+  try {
+    const res = await session.fetch(url, {
+      method: 'PUT',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(rec, null, 2) + '\n',
+    });
+    return res.ok;
+  } catch {
+    // A store that throws rather than answering is a store that did not take
+    // it, which is the same answer.
+    return false;
+  }
 }
 
 /** The identity's name: a subdomain pod is its label, a path pod its last segment. */
@@ -64,20 +117,90 @@ export function handleFor(podBase) {
  * The credential file an embedded identity runs on. It names the pod and
  * nothing else: there is no client id and no secret, because there is nobody
  * to authenticate to. Absent `privateRoot`, so the state tree stays on the pod.
+ *
+ * `keysMode: 'pod'` because here the pod's server and the agent are the same
+ * process: keeping the signing key on the host's disk puts it somewhere the
+ * pod does not travel to, so handing the pod over hands over an identity that
+ * cannot sign. An identity set up before this gets the mode added.
  */
 function ensureCredential(home, { podBase, webId }) {
   const file = path.join(home, 'credential.json');
-  try { return JSON.parse(fs.readFileSync(file, 'utf8')); }
-  catch { /* first run for this identity */ }
+  try {
+    const rec = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (rec.keysMode === 'pod') return rec;
+    const updated = { ...rec, keysMode: 'pod' };
+    writeJsonAtomic(file, updated, { mode: 0o600 });
+    return updated;
+  } catch { /* first run for this identity */ }
   const rec = {
     webId,
     remotePod: podBase.endsWith('/') ? podBase : podBase + '/',
     root: 'activitypods-js/',
+    keysMode: 'pod',
   };
   writeJsonAtomic(file, rec, { mode: 0o600 });
   return rec;
 }
 
+/**
+ * Move an identity's signing key off the host's disk and into its pod.
+ *
+ * Only after the pod has it: the private key is the one thing here that
+ * nothing can rebuild, and remote servers have its public half cached, so a
+ * copy lost between the two places is an identity that can never sign again
+ * under the name it already published.
+ */
+async function keyIntoPod(agent, home, log) {
+  const local = path.join(home, 'keys.json');
+  if (!fs.existsSync(local)) return;
+  if (agent.store.read('keys.json', null)) {
+    fs.rmSync(local, { force: true });
+    log('this identity signs with the key in its pod; removed the copy on this host');
+    return;
+  }
+  let rec;
+  try {
+    rec = JSON.parse(fs.readFileSync(local, 'utf8'));
+  } catch (e) {
+    log(`the local signing key could not be read (${e.message}) — leaving it where it is`);
+    return;
+  }
+  agent.store.write('keys.json', rec);
+  if (!await agent.store.commit()) {
+    log('could not write the signing key to the pod — it stays on this host for now');
+    return;
+  }
+  fs.rmSync(local, { force: true });
+  log('signing key moved into the pod');
+}
+
+/**
+ * Move an identity's credentials for accounts it holds on OTHER servers off
+ * the host's disk and into its pod. A token here is full access to somebody's
+ * account on a server this project does not run, so the host's copy goes only
+ * after the pod has taken it.
+ */
+async function connectionsIntoPod(agent, home, log) {
+  const moves = [
+    [fileVault(path.join(home, 'fediaccts')), podVault(agent.store, `${CONNECTION_PREFIX}fedi-`)],
+    [fileVault(path.join(home, 'fediaccts', '_apps')), podVault(agent.store, `${CONNECTION_PREFIX}fediapp-`)],
+    [fileVault(home), podVault(agent.store, CONNECTION_PREFIX)],
+  ];
+  // The last pair is the whole home directory, where only the Bluesky
+  // credential is ours to move.
+  for (const [from, to] of moves.slice(0, 2)) await moveVault(from, to, log);
+  const bluesky = moves[2][0].read('atproto');
+  if (bluesky && !moves[2][1].read('bluesky')) {
+    moves[2][1].write('bluesky', bluesky);
+    if (await moves[2][1].commit()) {
+      await moves[2][0].remove('atproto');
+      log('the Bluesky connection moved into the pod');
+    } else {
+      log('could not write the Bluesky connection to the pod — it stays on this host for now');
+    }
+  }
+}
+
 /**
  * Bring one identity up inside the server.
  *
@@ -151,6 +274,10 @@ export async function startEmbeddedAgent({
     agent.stateLoaded = true;
   }
 
+  // Before connect(), which is what looks the key and the connections up.
+  await keyIntoPod(agent, home, log);
+  await connectionsIntoPod(agent, home, log);
+
   await agent.connect();
 
   // The client surfaces, on the pod's own origin: the Mastodon API a phone app

package/lib/shared/links.mjs

@@ -0,0 +1,9 @@
+// links.mjs — reading RFC 8288 Link headers.
+//
+// The implementation moved into the pod library (lib/pod/links.mjs), which has
+// to carry it: that library runs unmodified in a service worker and may not
+// import anything above its own directory. This path stays so the dozen
+// importers around the project do not move, and so there is still one obvious
+// place to look for "how does this read a Link header".
+
+export { linkTargets, REL } from '../pod/links.mjs';

package/lib/{ua.mjs → shared/ua.mjs}

@@ -16,7 +16,7 @@ import { fileURLToPath } from 'node:url';
 let version = '0';
 try {
   ({ version } = JSON.parse(fs.readFileSync(
-    path.join(path.dirname(fileURLToPath(import.meta.url)), '../package.json'), 'utf8')));
+    path.join(path.dirname(fileURLToPath(import.meta.url)), '../../package.json'), 'utf8')));
 } catch {
   try {
     ({ version } = JSON.parse(fs.readFileSync(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod-server",
-  "version": "0.10.0",
+  "version": "0.12.1",
   "description": "The FediPod Server: a full ActivityPub server as a Community Solid Server component.",
   "license": "MIT",
   "main": "dist/index.js",

package/run-agent.mjs

@@ -28,29 +28,29 @@ import os from 'node:os';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 
-import { PodStore } from './lib/store.mjs';
-import { apRoot, rootOf, writeJsonAtomic } from './lib/home.mjs';
-import { ensureTrustedTls } from './lib/certs.mjs';
-import { storageFor } from './lib/storage.mjs';
-import { resolveKeys } from './lib/keys.mjs';
-import { RemotePod } from './lib/remote.mjs';
-import { PodRdf } from './lib/podrdf.mjs';
-import { Deliverer } from './lib/deliver.mjs';
-import { Publisher } from './lib/publisher.mjs';
-import { Intake } from './lib/intake.mjs';
-import { TagFeed } from './lib/tagfeed.mjs';
-import { ImportWorker } from './lib/import.mjs';
-import { Atproto } from './lib/atproto.mjs';
-import { FediAccounts } from './lib/fediacct.mjs';
-import { AcctFeed } from './lib/acctfeed.mjs';
-import { BskyFeed } from './lib/bskyfeed.mjs';
-import { BskyGroup } from './lib/bskygroup.mjs';
-import { Lease } from './lib/lease.mjs';
-import { startAdmin } from './lib/admin.mjs';
-import { exposureProblem, hostLabel } from './lib/guard.mjs';
-import { pendingSteps } from './lib/migrate.mjs';
-import { apUrls, assertionKeyId , publicHandle } from './lib/wire.mjs';
-import { followActor, unfollowActor, resolveHandle } from './lib/social.mjs';
+import { PodStore } from './lib/core/store.mjs';
+import { apRoot, rootOf, writeJsonAtomic } from './lib/device/home.mjs';
+import { ensureTrustedTls } from './lib/device/certs.mjs';
+import { storageFor } from './lib/core/storage.mjs';
+import { resolveKeys } from './lib/core/keys.mjs';
+import { RemotePod } from './lib/device/remote.mjs';
+import { Deliverer } from './lib/core/deliver.mjs';
+import { Publisher } from './lib/core/publisher/index.mjs';
+import { Intake } from './lib/core/intake/index.mjs';
+import { TagFeed } from './lib/connections/tagfeed.mjs';
+import { ImportWorker } from './lib/connections/import.mjs';
+import { Atproto } from './lib/connections/atproto.mjs';
+import { FediAccounts } from './lib/connections/fediacct.mjs';
+import { vaultsFor } from './lib/connections/vault.mjs';
+import { AcctFeed } from './lib/connections/acctfeed.mjs';
+import { BskyFeed } from './lib/connections/bskyfeed.mjs';
+import { BskyGroup } from './lib/connections/bskygroup.mjs';
+import { Lease } from './lib/core/lease.mjs';
+import { startAdmin } from './lib/device/admin/index.mjs';
+import { exposureProblem, hostLabel } from './lib/shared/guard.mjs';
+import { pendingSteps } from './lib/device/migrate.mjs';
+import { apUrls, assertionKeyId , publicHandle } from './lib/core/wire.mjs';
+import { followActor, unfollowActor, resolveHandle } from './lib/core/social.mjs';
 
 export class Agent {
   constructor({ home, log }) {
@@ -69,15 +69,14 @@ export class Agent {
 
   // Where the private half lives. `privateRoot` in the credential file names a
   // container — by default a plain directory beside the credential, and a pod
-  // on this machine if you move it there — under which the same two trees are
-  // laid out as on the pod. Absent means on the pod, exactly as before, so an
+  // on this machine if you move it there. Absent means on the pod, so an
   // existing install is untouched.
   privateUrls(cred, urls = this.urls) {
     if (!cred.privateRoot) {
-      return { state: urls.state, fediverse: urls.fediverse, archive: urls.home + 'inbox-archive/', elsewhere: false };
+      return { state: urls.state, archive: urls.home + 'inbox-archive/', elsewhere: false };
     }
     const base = cred.privateRoot.endsWith('/') ? cred.privateRoot : cred.privateRoot + '/';
-    return { state: base + 'ap-state/', fediverse: base + 'fediverse/', archive: base + 'inbox-archive/', elsewhere: true };
+    return { state: base + 'ap-state/', archive: base + 'inbox-archive/', elsewhere: true };
   }
 
   // A container to keep the private half in. On the pod it is reached with the
@@ -146,14 +145,9 @@ export class Agent {
     await this.remote.setAcl(this.urls.home, []);
     await this.remote.setAcl(this.urls.state, []);
     if (priv.elsewhere) {
-      for (const s of [stateStore, this.privateStorage(cred, 'fediverse')]) {
-        const r = await s.write('.keep', '{"keep":true}\n', 'application/json');
-        if (!r.ok) throw new Error(`private store ${s.base}.keep → ${r.why}`);
-      }
+      const r = await stateStore.write('.keep', '{"keep":true}\n', 'application/json');
+      if (!r.ok) throw new Error(`private store ${stateStore.base}.keep → ${r.why}`);
       this.log(`private state lives at ${cred.privateRoot} (${stateStore.kind})`);
-    } else {
-      await this.remote.putJson(this.urls.fediverse + '.keep', { keep: true }, 'application/json');
-      await this.remote.setAcl(this.urls.fediverse, []);
     }
     this.store.attach(stateStore);
     // Re-running setup must not destroy state set afterwards (the UI
@@ -314,7 +308,6 @@ export class Agent {
       const { rotateKeyOnce, ...rest } = cred;
       writeJsonAtomic(path.join(this.home, 'credential.json'), rest);
     }
-    this.local = new PodRdf({ storage: this.privateStorage(cred, 'fediverse') });
     // connect() can run more than once — connectWithRetry retries after a throw,
     // and the CLI connects for real after its confirmation. Deliverer arms a
     // 60s queue timer in its constructor and Intake owns a poll timer and a
@@ -332,13 +325,10 @@ export class Agent {
       log: this.log, passive: this.viewer,
     });
     this.publisher = new Publisher({
-      config, remote: this.remote, local: this.local, store: this.store,
+      config, remote: this.remote, store: this.store,
       deliverer: this.deliverer, publicKeyPem: keys.rsaPublicPem,
       assertionKey: keys.edPublicMultibase, log: this.log,
       resolveMention: (h) => resolveHandle(this, h),
-      // Whether the fediverse tree is on the pod at all, so the ACL check does
-      // not probe for something the default layout keeps on local disk.
-      privateOnPod: !cred.privateRoot,
       // Inside a pod server the client surface answers on the pod's own
       // origin, so it can be advertised. Standalone it is on loopback, and
       // naming it in a world-readable actor would send clients nowhere.
@@ -347,7 +337,7 @@ export class Agent {
     // Intake is constructed even for viewers — its signed fetchAP powers
     // search/deref; start() (draining) is active-only.
     this.intake = new Intake({
-      config, urls: this.urls, remote: this.remote, local: this.local, store: this.store,
+      config, urls: this.urls, remote: this.remote, store: this.store,
       deliverer: this.deliverer, publisher: this.publisher, log: this.log, lease: this.lease,
       archive: this.privateStorage(cred, 'archive'),
       push: !this.embedded, pollSeconds: this.pollSeconds || null,
@@ -355,13 +345,20 @@ export class Agent {
     // The CSV-import worker: paced, resumable, armed only while active.
     this.importer?.stop();
     this.importer = new ImportWorker({ agent: this, log: this.log });
+    // Where the credentials for accounts held on OTHER servers are kept.
+    const vaults = vaultsFor({ embedded: this.embedded, home: this.home, store: this.store });
     // The Bluesky connection, when one exists. Stamped to this actor; a
     // credential connected for another identity is treated as absent.
-    this.atproto = new Atproto({ localDir: this.home, actorId: this.urls.actor, log: this.log });
+    this.atproto = new Atproto({
+      localDir: this.home, actorId: this.urls.actor, log: this.log, vault: vaults.bluesky,
+    });
     this.publisher.atproto = this.atproto;
     // Fediverse accounts the owner holds elsewhere. Same custody rules as the
     // Bluesky credential, and the same absence when stamped for someone else.
-    this.fediaccts = new FediAccounts({ localDir: this.home, actorId: this.urls.actor, log: this.log });
+    this.fediaccts = new FediAccounts({
+      localDir: this.home, actorId: this.urls.actor, log: this.log,
+      vault: vaults.fedi, apps: vaults.apps,
+    });
     this.acctfeed?.stop();
     this.acctfeed = null;
     this.bskyfeed?.stop();
@@ -581,7 +578,7 @@ export class Agent {
       this.ensureActorPublished()
         .catch(e => this.log(`actor check failed: ${e.message}`));
     }
-    this.backfillStatuses().catch(e => this.log(`statuses backfill failed: ${e.message}`));
+    this.seedFollowNotifications().catch(e => this.log(`notification seeding failed: ${e.message}`));
   }
 
   // Re-read state before acting on what we hold. A viewer's cache is kept
@@ -695,27 +692,13 @@ export class Agent {
     return true;
   }
 
-  // The statuses index is an operational mirror of the pod's RDF — rebuild it
-  // from /fediverse/ when absent (fresh state, or state loss).
-  async backfillStatuses() {
-    if (!this.store.has('notifications.json')) {
-      for (const f of this.store.getContacts().followers) {
-        this.store.addNotification({ type: 'follow', actor: f.actor });
-      }
-    }
-    if (this.store.has('statuses.json')) return;
-    const entries = [];
-    for (const [container, kind] of [['timeline', 'timeline'], ['posts', 'post']]) {
-      for (const url of await this.local.listNotes(container)) {
-        try {
-          const n = await this.local.readNote(url);
-          if (n.noteId) entries.push({ ...n, kind, slug: url.split('/').pop() });
-        } catch (e) { this.log(`backfill: skipped ${url}: ${e.message}`); }
-      }
+  // A first run inherits followers without ever having seen them arrive, so
+  // the notifications list starts empty where it should start full.
+  async seedFollowNotifications() {
+    if (this.store.has('notifications.json')) return;
+    for (const f of this.store.getContacts().followers) {
+      this.store.addNotification({ type: 'follow', actor: f.actor });
     }
-    entries.sort((a, b) => String(b.published || '').localeCompare(String(a.published || '')));
-    this.store.write('statuses.json', entries.slice(0, 1000));
-    this.log(`backfilled ${entries.length} statuses from pod RDF`);
   }
 }
 
@@ -798,7 +781,7 @@ export async function startAgent({
   // Is a newer FediPod published? Once at boot and daily after; the answer
   // rides /status and the record page offers the update.
   const updateTick = async () => {
-    const { checkLatest } = await import('./lib/update.mjs');
+    const { checkLatest } = await import('./lib/device/update.mjs');
     const u = await checkLatest();
     if (u) {
       agent.updateInfo = u;

package/web/admin/actors.js

@@ -0,0 +1,145 @@
+// actors.js — the other actors on this machine: the picker, going to one,
+// starting a stopped one, and the form for a new one.
+
+// Somewhere to go, and nothing else. A stopped actor is left out — the link
+// would land on nothing. The one you are on keeps its place in the row but
+// offers only `app`, because its admin page is the page you are reading.
+
+let actors = [];
+
+async function renderOthers() {
+  const { json } = await api('/profiles');
+  actors = json?.identities || [];
+  const sel = $('actor-pick');
+  sel.textContent = '';
+  // The fediverse address, which is what the actor IS to everyone else, and the
+  // only form that stays distinct: two identities can share a local handle, but
+  // never a handle AND a pod. A stopped one has no address to report — nothing
+  // answered — so it falls back to the name it is filed under.
+  const label = (r) => (r.address || r.handle || r.name)
+    + (r.mode && r.mode !== 'active' ? ` (${r.mode})` : '') + (r.mode ? '' : ' (stopped)');
+  const seen = {};
+  for (const r of actors) seen[label(r)] = (seen[label(r)] || 0) + 1;
+
+  for (const [i, r] of actors.entries()) {
+    const o = document.createElement('option');
+    o.value = String(i);
+    o.selected = !!r.current;      // it opens showing where you already are
+    o.textContent = label(r) + (seen[label(r)] > 1 && r.port ? ` :${r.port}` : '');
+    sel.appendChild(o);
+  }
+  // The way to a NEW actor rides the same dropdown as the existing ones.
+  const add = document.createElement('option');
+  add.value = '__add';
+  add.textContent = '+ add a new account…';
+  sel.appendChild(add);
+}
+
+// Going to an actor commits a navigation and, for a stopped one, a POST that
+// boots its pod — so it must run once per choice. Pressing Enter on the select
+// fires BOTH a keydown (handled below) and a native `change`, so without a
+// guard a keyboard commit would start the actor twice.
+let goingToActor = false;
+const goToActor = async () => {
+  if (goingToActor) return;
+  if ($('actor-pick').value === '__add') { renderOthers(); openNewActor(); return; }
+  const r = actors[Number($('actor-pick').value)];
+  if (!r || r.current) return;
+  goingToActor = true;
+  try {
+    if (r.mode) { location.href = r.admin; return; }
+    $('actor-pick').disabled = true;
+    say(`starting ${r.name}`);
+    const started = await write('/start-actor', { name: r.name }, `${r.name} is up`);
+    $('actor-pick').disabled = false;
+    if (started?.url) location.href = `${started.url}admin/`;
+    else renderOthers();            // put the picker back on the current actor
+  } finally {
+    goingToActor = false;
+  }
+};
+// Choosing one goes to its record, as it always has.
+//
+// Arrowing is the one case that must not: on a closed select every Arrow
+// keypress fires `change`, so a keyboard user browsing the list would be
+// carried off to the first actor they passed — and for a stopped one that
+// boots its pod. An arrow key arms a flag and the change it causes is ignored;
+// Enter commits. A mouse never sets the flag, so clicking behaves as before.
+let arrowing = false;
+$('actor-pick').addEventListener('keydown', (ev) => {
+  if (['ArrowUp', 'ArrowDown', 'Home', 'End', 'PageUp', 'PageDown'].includes(ev.key)) arrowing = true;
+  if (ev.key === 'Enter') { arrowing = false; goToActor(); }
+});
+$('actor-pick').addEventListener('pointerdown', () => { arrowing = false; });
+$('actor-pick').addEventListener('change', () => {
+  if (!arrowing) goToActor();
+  arrowing = false;
+});
+
+// Setting up a new actor asks for exactly what this page cannot already tell
+// it: the pod and the account behind it, and its permanent name. Display name,
+// bio and pictures are the client's job now — Phanpy's profile editor writes
+// them through /api/v1/accounts/update_credentials. Where the private data goes
+// is not a question either: it lands beside the credential, and `state --to`
+// moves it afterwards.
+
+const picked = (name) => document.querySelector(`input[name=${name}]:checked`)?.value;
+
+function newActorRows() {
+  const mode = picked('newMode');
+  $('new-row-podname').hidden = mode !== 'new';
+  $('new-row-pod').hidden = mode !== 'existing';
+}
+for (const el of document.querySelectorAll('input[name=newMode]')) {
+  el.addEventListener('change', newActorRows);
+}
+
+// While the form is up the page IS the new actor's setup — so the record of
+// the actor you came from goes away, list included. Which panes were showing
+// is remembered rather than recomputed: whether Group and Inbox belong is a
+// decision render() already made.
+const RECORD_PANES = ['pane-identity', 'pane-group', 'pane-inbox', 'rail'];
+let putBack = [];
+
+function showNewActor(on) {
+  if (on) closePanels();              // nothing of the old actor left open behind it
+  document.body.classList.toggle('adding', on);   // see body.adding in the CSS
+  $('new-actor-form').hidden = !on;
+  if (on) {
+    putBack = RECORD_PANES.filter(id => !$(id).hidden);
+    for (const id of putBack) $(id).hidden = true;
+  } else {
+    for (const id of putBack) $(id).hidden = false;
+    putBack = [];
+  }
+}
+
+// `add a new account` is the last item of the Local Actors dropdown; choosing
+// it opens the form in place. Arriving with ?new does the same.
+function openNewActor() {
+  showNewActor(true);
+  newActorRows();
+  $('new-handle').focus();
+}
+$('new-actor-cancel').addEventListener('click', () => { showNewActor(false); say('nothing changed'); });
+
+$('new-actor-form').addEventListener('submit', async (ev) => {
+  ev.preventDefault();
+  const handle = $('new-handle').value.trim();
+  const answers = {
+    handle,
+    kind: picked('newKind'),
+    mode: picked('newMode'),
+    issuer: $('new-issuer').value.trim(),
+    email: $('new-email').value.trim(),
+    password: $('new-password').value,
+  };
+  if (answers.mode === 'new') answers.podName = $('new-podname').value.trim() || handle;
+  else answers.pod = $('new-pod').value.trim();
+  $('new-actor-go').disabled = true;
+  say(`setting up ${handle || 'the new actor'} — this takes a while`);
+  const r = await write('/new-actor', answers, `setting up ${handle}`);
+  $('new-actor-go').disabled = false;
+  if (r?.url) location.href = r.url;      // its own page, where the progress is
+});
+

package/web/admin/bar.css

@@ -4,18 +4,9 @@
    page's left edge and the buttons over its right rather than out at the window
    borders. `width: 100%` with `box-sizing: border-box` keeps the padding inside
    that 960 instead of adding to it, which is what makes the two margins equal. */
-/* Phanpy's own colours, read off the running client. --surface is the one you
-   see behind Phanpy — its --bg-faded-color — and that is the PAGE. --raised is
-   Phanpy's --bg-color, and that is the bar sitting on top of it. Declared here
-   because bar.css is on all three pages, so they cannot drift. */
-:root { --surface: #f0f2f5; --raised: #fff;
-  --ink: #1b1c1e; --field-bg: #ffffff; --field-bg-hover: #f7f4ee; --field-edge: #767676;
-  --chevron: url("data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' width='10' height='6'><path d='M1 1l4 4 4-4' fill='none' stroke='%23444444' stroke-width='1.6' stroke-linecap='round'/></svg>"); }
-@media (prefers-color-scheme: dark) {
-  :root { --surface: #18191a; --raised: #242526;
-    --ink: #e8eaed; --field-bg: #383d44; --field-bg-hover: #40464e; --field-edge: #9aa0a6;
-    --chevron: url("data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' width='10' height='6'><path d='M1 1l4 4 4-4' fill='none' stroke='%23dddddd' stroke-width='1.6' stroke-linecap='round'/></svg>"); }
-}
+/* Colours come from tokens.css (the front's palette), linked by every page
+   before this file, so the bar matches the front and the record rather than
+   Phanpy: --surface is the page ground, --raised the bar band on top of it. */
 body { background: var(--surface); }
 /* The BAND spans the window; its CONTENTS stay in the 960 column. Constraining
    the element itself left the colour as a stripe with bare page either side.
@@ -51,8 +42,13 @@ body { background: var(--surface); }
 #bar select:hover { background-color: var(--field-bg-hover); }
 /* The app title, in px rather than rem: it is chrome, the same on every page,
    not something that should move when a page changes its base size. */
-#bar .name { flex: 1 1 auto; font-weight: 600; font-size: 24px; color: var(--heading);
+#bar .name { flex: 1 1 auto; font-weight: 600; font-size: 40px; color: var(--heading);
   margin: 0; line-height: 1.1; }
+/* The browser build wraps the brand text in a link (to /?add) — the general
+   #bar a rule below would otherwise pin it back down to nav-link size and
+   colour, since a rule on the anchor itself always wins over inheriting the
+   heading's size. */
+#bar .name a { font: inherit; color: inherit; text-decoration: none; }
 /* Plain text, not chrome: three destinations in a row read better without a
    box round each. */
 #bar button, #bar a { font: inherit; font-size: .95rem; padding: .15rem .2rem;

package/web/admin/bar.js

@@ -17,7 +17,7 @@
   // open windows apart without putting the handle in the page twice.
   // /status, not /config: an agent that is not set up yet answers this one and
   // 409s the other, which logged a failed request on every setup page.
-  fetch(location.pathname.replace(/\/admin\/.*$/u, '') + '/status').then(r => (r.ok ? r.json() : null)).then((s) => {
+  fetch(location.pathname.replace(/\/admin\/.*$/u, '') + '/status', { headers: { 'x-fedipod-page': '1' } }).then(r => (r.ok ? r.json() : null)).then((s) => {
     if (s?.handle) document.title = `FediPod — ${s.handle}`;
     // The full fediverse handle, centred in the bar on every page.
     const el = document.getElementById('bar-handle');
@@ -32,7 +32,7 @@
   const pick = document.getElementById('actor-pick');
   if (pick && !document.getElementById('new-actor-form')) {
     const base = location.pathname.replace(/\/admin\/.*$/u, '');
-    fetch(base + '/profiles').then(r => (r.ok ? r.json() : null)).then((j) => {
+    fetch(base + '/profiles', { headers: { 'x-fedipod-page': '1' } }).then(r => (r.ok ? r.json() : null)).then((j) => {
       const actors = j?.identities || [];
       pick.textContent = '';
       const label = (r) => (r.address || r.handle || r.name)

package/web/admin/client/client.js

@@ -27,7 +27,7 @@
   // "which account logged in here" is a different question, and it is the one
   // that goes wrong when the two origins get mixed.
   const base = location.pathname.replace(/\/admin\/.*$/u, '');
-  const status = await fetch(base + '/status').then(r => (r.ok ? r.json() : null)).catch(() => null);
+  const status = await fetch(base + '/status', { headers: { 'x-fedipod-page': '1' } }).then(r => (r.ok ? r.json() : null)).catch(() => null);
   if (!status?.actor) return;                 // not set up yet; setup owns that
 
   // A deep link into the client — the record links an actor's own page this way