fedipod-server 0.11.0 → 0.12.1

package/web/admin/setup/setup.js

@@ -3,26 +3,15 @@
 // at localhost:<port> or at <handle>.localhost:<port>.
 //
 // External file, not an inline script: the CSP allows 'self' plus the hashes
-// of Phanpy's own inline bootstrap, and nothing else.
+// of Phanpy's own inline bootstrap, and nothing else. `$`, `BASE`, `api` and
+// `postJson` come from ../common.js, loaded first.
 
-const $ = (id) => document.getElementById(id);
 // Empty means gone, not a blank line where a sentence used to be.
 const strap = (t) => { const el = $('strap'); el.textContent = t || ''; el.hidden = !t; };
 // By id, not by position: these were `body > section` until a wrapper went
 // round them for layout, and the selector then matched nothing — every pane
 // kept whatever it started as and the page sat on "Reading this agent's state".
 const show = (id) => { for (const s of document.querySelectorAll('section[id^="pane-"]')) s.hidden = s.id !== id; };
-// The door this page is served behind: nothing when the agent runs on this
-// machine, `/app` when the identity is hosted by its own pod server. Read from
-// the page's own address, so one build serves both.
-const BASE = location.pathname.replace(/\/admin\/.*$/u, '');
-const api = async (path, init) => {
-  const res = await fetch(BASE + path, { ...init, headers: { ...(init?.headers || {}), 'x-fedipod-page': '1' } });
-  return { status: res.status, json: await res.json().catch(() => null) };
-};
-const postJson = (path, body) => api(path, {
-  method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body),
-});
 
 let state = null;
 

package/web/admin/upkeep.js

@@ -0,0 +1,170 @@
+// upkeep.js — upkeep and the lifecycle: the output pane, drain, recover,
+// log and dead letters; the confirmations for rotate, retire and move; and
+// the inbox backlog panel.
+
+// Which button filled the output pane, so clicking that one again closes it
+// rather than re-fetching the same thing under an already-open panel.
+let outputSource = null;
+
+const OUTPUT_TITLES = { log: 'Log', deadletter: 'Dead letters', drain: 'Inbox drain', rebuild: 'Recovered posts' };
+const output = (obj, source = null) => {
+  closePanels('output');
+  outputSource = source;
+  solWindow.show('output', OUTPUT_TITLES[source] || 'Output');
+  $('output').textContent = typeof obj === 'string' ? obj : JSON.stringify(obj, null, 2);
+};
+
+const showingFrom = (source) => outputSource === source && solWindow.openId() === 'output';
+
+// Drain is the one that does work rather than reveals it, so a second click
+// re-runs instead of closing. It can take a while — the agent joins a sweep
+// already in flight and queues another after it — and a button that looks dead
+// for a minute reads as broken.
+$('do-drain').addEventListener('click', async (ev) => {
+  const b = ev.currentTarget;
+  b.disabled = true;
+  b.textContent = 'draining…';
+  say('draining the inbox — if a sweep is already running this waits for it to finish');
+  const r = await write('/drain', {}, 'inbox drained');
+  b.disabled = false;
+  b.textContent = 'Drain the inbox';
+  if (r) {
+    const box = r.inbox || {};
+    say(`inbox drained — ${box.count ?? 0} still waiting`);
+    output(r, 'drain');
+  }
+});
+
+// Like the drain, this does work rather than reveals it, so a second click
+// re-runs. Nothing here can lose anything: it only adds posts back.
+$('do-rebuild').addEventListener('click', async (ev) => {
+  const b = ev.currentTarget;
+  b.disabled = true;
+  b.textContent = 'recovering…';
+  say('reading what the pod still holds — one request per post, so this takes a moment');
+  const r = await write('/rebuild', {}, 'checked');
+  b.disabled = false;
+  b.textContent = 'Recover posts';
+  if (!r) return;
+  if (r.why) { say(r.why, 'err'); return; }
+  if (!r.landed) { say('recovered posts could NOT be saved — see the log', 'err'); return; }
+  say(r.recovered
+    ? `recovered ${r.recovered} post(s) the pod had and this machine did not`
+    : `nothing was missing — the pod indexed ${r.indexed} post(s), all of them already here`);
+  output(r, 'rebuild');
+});
+
+$('do-log').addEventListener('click', async () => {
+  if (showingFrom('log')) { closePanels(); return; }
+  const { json } = await api('/log');
+  output((json?.lines || []).slice(-60).join('\n') || 'nothing logged yet', 'log');
+});
+
+$('do-deadletter').addEventListener('click', async () => {
+  if (showingFrom('deadletter')) { closePanels(); return; }
+  const { json } = await api('/deadletter');
+  output(json?.items?.length ? json.items : 'no dead letters', 'deadletter');
+});
+
+// ---- lifecycle ----
+// None of these can be taken back by clicking again, so the button only opens
+// the matching warning in the markup; the second click is the one that acts.
+// Retire also wants the handle typed, because a misclick cannot produce it.
+
+const LIFECYCLE = {
+  'rotate-key': { path: '/rotate-key', title: 'Rotate the signing key', done: (r) => (r.changed ? 'rotated and republished' : 'no change — the key was already fresh') },
+  retire: { path: '/retire', title: 'Retire this identity', go: 'Retire it', danger: true, done: (r) => `retired ${r.deletedAt}: Delete delivered to ${r.inboxes} inbox(es)` },
+  move: { path: '/move', title: 'Transfer this account away', go: 'Transfer it', focus: 'move-target',
+    done: (r) => `transferred to ${r.target}: Move delivered to ${r.inboxes} inbox(es), unfollowed ${r.unfollowed}/${r.following}` },
+};
+let pending = null;
+
+const closeConfirm = () => closePanels();
+
+for (const btn of document.querySelectorAll('[data-confirm]')) {
+  btn.addEventListener('click', () => {
+    const what = btn.dataset.confirm;
+    // The same button again closes its question rather than re-asking it.
+    if (pending === what && solWindow.openId() === 'confirm-form') { closePanels(); return; }
+    closePanels();                    // including whatever else was open
+    pending = what;
+    const spec = LIFECYCLE[what];
+    $(`warn-${what}`).hidden = false;
+    solWindow.show('confirm-form', spec.title);
+    $('confirm-go').className = spec.danger ? 'danger' : 'primary';
+    $('confirm-go').textContent = spec.go || 'Confirm';
+    if (spec.focus) $(spec.focus).focus();
+    else if (what === 'retire') $('confirm-handle').focus();
+  });
+}
+
+// Offered from inside the retire warning: someone reading it has already said
+// what they want ("not this account, here, any more") and these are the two
+// answers that are not destruction. Switching panels rather than closing means
+// they do not have to go and find the button themselves.
+const openConfirm = (what) => {
+  closePanels();                 // or `show` toggles: same panel, different warning
+  document.querySelector(`[data-confirm="${what}"]`).click();
+};
+// Park lives on the status control now; from inside the retire warning it is
+// still one click — close the question and park.
+$('go-park').addEventListener('click', () => { closePanels(); setStatus(true); });
+$('go-move').addEventListener('click', () => openConfirm('move'));
+
+$('confirm-cancel').addEventListener('click', () => { closeConfirm(); say('nothing changed'); });
+
+$('confirm-form').addEventListener('submit', async (ev) => {
+  ev.preventDefault();
+  if (!pending) return;
+  const what = pending;
+  const body = what === 'retire' ? { confirm: $('confirm-handle').value.trim() }
+    : what === 'move' ? { target: $('move-target').value.trim(), confirm: $('confirm-handle-move').value.trim() }
+      // Only where the field is shown (the browser build — see index.html).
+      // On the Node agent the row stays hidden and nothing is sent, which is
+      // what that agent expects.
+      : what === 'rotate-key' && !$('rotate-pw-row').hidden
+        ? { password: $('rotate-password').value }
+        : {};
+  if (what === 'move' && !body.target) { say('name the account to transfer to', 'err'); return; }
+  $('confirm-go').disabled = true;
+  say(`${what} — this talks to the pod and to other servers, so it takes a moment`);
+  const r = await write(LIFECYCLE[what].path, body, what);
+  $('confirm-go').disabled = false;
+  if (!r) return;                        // write() already said why
+  closeConfirm();
+  say(LIFECYCLE[what].done(r));
+  load();                                // mode, and whether it is retired, both changed
+});
+
+// ---- inbox ----
+// Only appears when there is enough waiting to be worth a decision. The agent
+// drains oldest-first regardless; this exists to let the owner say "do not
+// bother with that fortnight", which is not a call an agent should make on
+// someone's mail by itself.
+const INBOX_PROMPT_AT = 500;
+let dismissed = false;
+
+async function renderInbox() {
+  if (dismissed) return;
+  const { json: st } = await api('/status');
+  const box = st?.inbox;
+  const panel = $('pane-inbox');
+  if (!box || box.count < INBOX_PROMPT_AT) { panel.hidden = true; return; }
+  const mb = box.bytes >= 1048576
+    ? `${(box.bytes / 1048576).toFixed(1)} MB` : `${Math.round(box.bytes / 1024)} kB`;
+  const since = box.oldest ? new Date(box.oldest).toLocaleDateString() : 'unknown';
+  $('inbox-summary').textContent =
+    `${box.count.toLocaleString()} deliveries waiting (${mb}), the oldest from ${since}.`;
+  // One request each to read and delete, and the agent holds itself to 60 a
+  // minute, so the honest number is minutes not seconds.
+  $('inbox-warn').hidden = box.count < 2000;
+  $('inbox-warn').textContent = box.count >= 2000
+    ? `At 60 requests a minute this is roughly ${Math.ceil(box.count * 2 / 60)} minutes of `
+      + 'draining if you keep everything. Discarding the old content is much quicker.'
+    : '';
+  panel.hidden = false;
+}
+
+// The gateway, as a facts row under software: attach through a multi-user
+// front with this agent's own credential, detach back to the pod inbox. The
+// forms live in the floating window, like every other disclosure.

package/web/app/README.md

@@ -5,13 +5,13 @@ See `claude/plans/browser-agent.md` for the whole design and status.
 
 | file | what |
 |---|---|
-| `pod-auth.mjs` | The pod side of sign-in, browser-native: create a CSS account + pod, mint a client credential, and a DPoP-bound `fetch` that writes to the pod. The twin of `lib/account.mjs` + `vendor/idp-grant.cjs`. |
+| `pod-auth.mjs` | The pod side of sign-in, browser-native: create a CSS account + pod, mint a client credential, and a DPoP-bound `fetch` that writes to the pod. The twin of `lib/device/account.mjs` + `vendor/idp-grant.cjs`. |
 | `keystore.mjs` | WebCrypto RSA/Ed25519 key generation, and wrapping the keys under the account password (PBKDF2-SHA256 + AES-GCM-256). The pod holds only the wrapped form, so the pod's host cannot sign as you. |
 | `keys-browser.mjs` | Importing a keys record for signing, and finding one: this browser's opened copy in IndexedDB first, else the pod's. A wrapped one the browser has not opened yet raises `KeyPasswordNeeded`, which `boot.mjs` answers with the unlock pane — once per browser. |
 | `signup.mjs` | The `fedipod setup` flow, in the browser, up to publish: account, pod, credential, keys locked on the pod (owner-only ACL written *before* the key). Produces the credential/keys/config shapes the agent already reads. |
 | `shims/fedify-sig.mjs` | Browser stand-in for `@fedify/fedify/sig` (which will not bundle for a browser). `sign()` returns signed headers as data for the relay; `signRequest()` wraps it Fedify-shaped. Proven byte-identical to Fedify. |
 | `shims/node-crypto.mjs` | Browser stand-in for `node:crypto` — the small synchronous slice the agent uses, via crypto-browserify, plus native WebCrypto. |
-| `shims/safefetch.mjs` | Browser stand-in for `lib/safefetch.mjs`. Pinning and the private-address checks are unnecessary here (a browser closes DNS rebinding itself); the BYTE BUDGET is not, so `readCapped` streams and stops at the cap exactly as the Node one does. |
+| `shims/safefetch.mjs` | Browser stand-in for `lib/shared/safefetch.mjs`. Pinning and the private-address checks are unnecessary here (a browser closes DNS rebinding itself); the BYTE BUDGET is not, so `readCapped` streams and stops at the cap exactly as the Node one does. |
 | `dist/` | The bundled agent, built by `scripts/build-app.mjs`. Committed like `phanpy/dist`, regenerated on release. (Not present until the agent entry is built.) |
 
 Build: `node scripts/build-app.mjs`. Tests live in `claude/validation/`:
@@ -39,12 +39,12 @@ worker answers the data endpoints it calls. See
 
 | file | what |
 |---|---|
-| `admin-facade.mjs` | Answers the owner/manage endpoints (`/status`, `/config`, `/gateway`, `/alias`, `/rotate-key`, `/rebuild`, `/move`, `/retire`, `/inbox/prune`, `/deadletter`, `/blocks`, `/atproto*`, `/fediacct*`) over the browser agent, mirroring `lib/admin.mjs`. Personal only. |
-| `atproto-browser.mjs` | The Bluesky connection (`lib/atproto.mjs`) with a per-connection storage choice — IndexedDB (this browser) or owner-only pod state — plus pause. |
-| `fediacct-browser.mjs` | Connections to fediverse accounts on other servers (`lib/fediacct.mjs`): the OAuth dance, the same storage choice, and a best-effort server-side revoke on disconnect. |
+| `admin-facade.mjs` | Answers the owner/manage endpoints (`/status`, `/config`, `/gateway`, `/alias`, `/rotate-key`, `/rebuild`, `/move`, `/retire`, `/inbox/prune`, `/deadletter`, `/blocks`, `/atproto*`, `/fediacct*`) over the browser agent, mirroring `lib/device/admin.mjs`. Personal only. |
+| `atproto-browser.mjs` | The Bluesky connection (`lib/connections/atproto.mjs`) with a per-connection storage choice — IndexedDB (this browser) or owner-only pod state — plus pause. |
+| `fediacct-browser.mjs` | Connections to fediverse accounts on other servers (`lib/connections/fediacct.mjs`): the OAuth dance, the same storage choice, and a best-effort server-side revoke on disconnect. |
 | `idb-kv.mjs` | The per-origin IndexedDB key/value store the two connectors use for "on this device, never the pod" credentials. |
 
-`agent.mjs` also holds the single-active-agent **lease** (`lib/lease.mjs`) — a
+`agent.mjs` also holds the single-active-agent **lease** (`lib/core/lease.mjs`) — a
 second device runs read-only until it takes over — and starts the drain/mirrors
 only when it is the active holder.
 

package/web/app/admin-facade.mjs

@@ -14,10 +14,10 @@
 //
 // It mirrors lib/admin.mjs's handlers for those paths, calling the same agent
 // objects (store, publisher, intake, deliverer, remote) the Node agent does.
-import { publicHandle, webfingerHost } from '../../lib/wire.mjs';
+import { publicHandle, webfingerHost } from '../../lib/core/wire.mjs';
 import * as podInbox from '../../lib/pod/inbox.mjs';
-import { normalizeImport, IMPORT_KINDS } from '../../lib/import.mjs';
-import { hashPassword } from '../../lib/mastoapi.mjs';
+import { normalizeImport, IMPORT_KINDS } from '../../lib/connections/import.mjs';
+import { hashPassword } from '../../lib/client/masto/index.mjs';
 
 // The identity itself — changing any means a different actor, i.e. a new setup.
 const PERMANENT_CONFIG = ['handle', 'remotePod', 'issuer', 'root', 'kind'];

package/web/app/agent.mjs

@@ -5,16 +5,16 @@
 // the signing key comes from WebCrypto (keys-browser), and delivery goes through
 // the relay (deliver-relay). Everything between — wire, the store, the
 // publisher, intake, the Mastodon facade — is lib/, unchanged.
-import { apUrls } from '../../lib/wire.mjs';
+import { apUrls } from '../../lib/core/wire.mjs';
 import * as containers from '../../lib/pod/containers.mjs';
 import * as podState from '../../lib/pod/state.mjs';
-import { PodStore } from '../../lib/store.mjs';
-import { HttpStorage } from '../../lib/storage.mjs';
-import { Publisher } from '../../lib/publisher.mjs';
-import { Intake } from '../../lib/intake.mjs';
-import { Lease } from '../../lib/lease.mjs';
-import { MastoApi } from '../../lib/mastoapi.mjs';
-import { TagFeed } from '../../lib/tagfeed.mjs';
+import { PodStore } from '../../lib/core/store.mjs';
+import { HttpStorage } from '../../lib/core/storage.mjs';
+import { Publisher } from '../../lib/core/publisher/index.mjs';
+import { Intake } from '../../lib/core/intake/index.mjs';
+import { Lease } from '../../lib/core/lease.mjs';
+import { MastoApi } from '../../lib/client/masto/index.mjs';
+import { TagFeed } from '../../lib/connections/tagfeed.mjs';
 import { makeDpopSession } from './pod-auth.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
 import { importSigningKey, loadKeysFromPod, keyCacheKey } from './keys-browser.mjs';
@@ -23,11 +23,11 @@ import { kvPut } from './idb-kv.mjs';
 import { RelayDeliverer } from './deliver-relay.mjs';
 import { AdminFacade } from './admin-facade.mjs';
 import { BrowserAtproto } from './atproto-browser.mjs';
-import { BskyFeed } from '../../lib/bskyfeed.mjs';
+import { BskyFeed } from '../../lib/connections/bskyfeed.mjs';
 import { BrowserFediAccounts } from './fediacct-browser.mjs';
-import { AcctFeed } from '../../lib/acctfeed.mjs';
-import { followActor, unfollowActor } from '../../lib/social.mjs';
-import { ImportWorker } from '../../lib/import.mjs';
+import { AcctFeed } from '../../lib/connections/acctfeed.mjs';
+import { followActor, unfollowActor } from '../../lib/core/social.mjs';
+import { ImportWorker } from '../../lib/connections/import.mjs';
 
 // The authorities this identity answers on: exactly one, this origin. The Node
 // agent gets this from lib/guard.mjs, which is not in the browser bundle and

package/web/app/atproto-browser.mjs

@@ -10,7 +10,7 @@
 //  2. The mirror can be paused (feedPaused) without disconnecting.
 //
 // Bluesky's API answers CORS, so the fetches go direct, not through the relay.
-import { Atproto } from '../../lib/atproto.mjs';
+import { Atproto } from '../../lib/connections/atproto.mjs';
 import { kvGet, kvPut, kvDel } from './idb-kv.mjs';
 
 const IDB_KEY = 'atproto';

package/web/app/deliver-relay.mjs

@@ -7,7 +7,7 @@
 // which sends it verbatim. Everything else — the retry queue, the cooling
 // hosts, the dead-letter, FEP-8b32 proofs — is the Node Deliverer, reused by
 // overriding only the one network step.
-import { Deliverer } from '../../lib/deliver.mjs';
+import { Deliverer } from '../../lib/core/deliver.mjs';
 import { sign } from './shims/fedify-sig.mjs';
 
 export class RelayDeliverer extends Deliverer {