fedipod-server 0.16.0 → 0.18.0

package/lib/pod/actor.mjs

@@ -69,8 +69,8 @@ export async function writeProfilePage(pod, urls, html) {
  * parsed graph does not mention the WebID, and patches exactly the statements
  * involved rather than rewriting a document full of things that are not ours.
  */
-export function linkInWebIdProfile(pod, { actorUrl, accountName, kind = 'person' }) {
-  return pod.linkAccountInProfile({ actorUrl, accountName, kind });
+export function linkInWebIdProfile(pod, { actorUrl, accountName, kind = 'person', outbox = null }) {
+  return pod.linkAccountInProfile({ actorUrl, accountName, kind, outbox });
 }
 
 // ---- anyone at all ----

package/lib/pod/root.mjs

@@ -66,6 +66,17 @@ export async function podLayout(fetchImpl, providerOrigin, { timeoutMs = OWNER_L
   return /ns\/pim\/space#Storage|pim:Storage/u.test(body) ? 'path' : null;
 }
 
+// Whether a document is there — one unauthenticated GET, 200 or not. The caller
+// names the URL; asked before a second setup, so a pod that already serves an
+// actor at the app's container refuses another rather than growing a duplicate.
+export async function resourceExists(fetchImpl, url, { timeoutMs = OWNER_LOOKUP_MS } = {}) {
+  try {
+    const res = await fetchImpl(url,
+      { headers: { accept: 'application/activity+json' }, signal: AbortSignal.timeout(timeoutMs) });
+    return !!res && res.status === 200;
+  } catch { return false; }
+}
+
 export async function probeAnswers(podUrl, fetchImpl = fetch) {
   try {
     const res = await fetchImpl(podUrl, { method: 'HEAD' });

package/lib/pod/transport.mjs

@@ -407,7 +407,7 @@ export class PodTransport {
    * says all of it. The parsed graph must mention the WebID before anything is
    * written back — an empty or foreign body must never become the new profile.
    */
-  async linkAccountInProfile({ actorUrl, accountName, kind = 'person' }) {
+  async linkAccountInProfile({ actorUrl, accountName, kind = 'person', outbox = null }) {
     const docUrl = this.webId.split('#')[0];
     const res = await this.fetch(docUrl, { headers: { accept: 'text/turtle' } });
     if (res.status >= 400) throw new Error(`[${this.label}] GET ${docUrl} → ${res.status}`);
@@ -424,11 +424,17 @@ export class PodTransport {
       [actor, RDF('type'), FOAF('OnlineAccount')],
       [actor, RDF('type'), kind === 'group' ? AS('Group') : AS('Person')],
       [actor, FOAF('accountName'), $rdf.literal(accountName)],
+      // Where a Solid client posts on this person's behalf (`as:outbox` on the
+      // WebID is what dokieli reads); only where a door exists to take it.
+      ...(outbox ? [[me, AS('outbox'), $rdf.sym(outbox)]] : []),
     ];
     const missing = wanted.filter(([s, p, o]) => !g.holds(s, p, o, doc));
     // A handle change leaves the old accountName behind; ours is replaced.
-    const stale = g.statementsMatching(actor, FOAF('accountName'), null, doc)
-      .filter(st => st.object.value !== accountName);
+    // Likewise an outbox that moved.
+    const stale = [
+      ...g.statementsMatching(actor, FOAF('accountName'), null, doc).filter(st => st.object.value !== accountName),
+      ...(outbox ? g.statementsMatching(me, AS('outbox'), null, doc).filter(st => st.object.value !== outbox) : []),
+    ];
     if (!missing.length && !stale.length) return false;
     // A patch touches these statements and nothing else. Rewriting the whole
     // profile re-serialises statements that are not ours — the OIDC issuer

package/lib/server/embed.mjs

@@ -47,7 +47,8 @@ const mintSecret = () => crypto.randomBytes(32).toString('base64');
  */
 export async function ensureDoorSecret(session, podBase, { rotate = false, dataDir = null, handle = null, log = () => {} } = {}) {
   const base = podBase.endsWith('/') ? podBase : podBase + '/';
-  const url = apUrls(base, DEFAULT_ROOT).state + 'door-secret.json';
+  // Under the identity's own tree (fedipod/), where the gate reads it back.
+  const url = apUrls(base, 'fedipod/').state + 'door-secret.json';
   const onHost = dataDir && handle ? path.join(dataDir, handle, 'door-secret.json') : null;
 
   if (!rotate) {
@@ -136,7 +137,7 @@ function ensureCredential(home, { podBase, webId }) {
   const rec = {
     webId,
     remotePod: podBase.endsWith('/') ? podBase : podBase + '/',
-    root: 'activitypods-js/',
+    root: 'fedipod/',
     keysMode: 'pod',
   };
   writeJsonAtomic(file, rec, { mode: 0o600 });
@@ -275,7 +276,7 @@ export async function startEmbeddedAgent({
   pollSeconds = null,
   autoAcceptFollows = true,
   gateToken = null,
-  uiPath = '/fedipod/',
+  uiPath = '/fp/',
 }) {
   const base = podBase.endsWith('/') ? podBase : podBase + '/';
   const handle = handleFor(base);
@@ -323,7 +324,7 @@ export async function startEmbeddedAgent({
       throw new Error(`no pod at ${base} yet — its owner profile is not there`);
     }
     log(`no identity on ${base} yet — provisioning @${handle}`);
-    await agent.bootstrap({ handle, name: handle, kind: 'person' });
+    await agent.bootstrap({ handle, name: handle, kind: 'person', root: cred.root });
     if (autoAcceptFollows) {
       agent.store.setConfig({ ...agent.store.getConfig(), autoAcceptFollows: true });
       await agent.store.flush();
@@ -342,15 +343,31 @@ export async function startEmbeddedAgent({
   // speaks, the write API, nodeinfo, and behind the door the admin routes and
   // the web client. Same code the standalone agent serves, minus the routes
   // that only mean something to a process of one's own.
+  //
+  // A pod that lives on a PATH of its host (a suffix pod, e.g.
+  // https://server.example/aisha/) shares its origin with the front and with
+  // every other suffix pod, so its whole surface answers UNDER that path: the
+  // mount is the pod's own pathname, and it is stripped before a route is
+  // matched and folded back into every self-URL. A host-root or subdomain pod
+  // has an empty mount and everything is exactly as it was.
   const authorities = new FixedAuthorities(base);
   agent.authorities = authorities;
+  const mount = new URL(base).pathname.replace(/\/+$/u, '');
   const surface = buildAdminSurface({
     agent,
     log,
-    gate: makeGate(gateToken, { secureCookie: authorities.secure }),
+    // The door cookie is named the same for every identity; on a shared origin
+    // (suffix pods) it has to be scoped to this identity's own door path so two
+    // co-tenants do not overwrite each other's. A host-root/subdomain pod keeps
+    // the whole-origin cookie it always had.
+    gate: makeGate(gateToken, {
+      secureCookie: authorities.secure,
+      cookiePath: mount ? mount + uiPath : '/',
+    }),
     allowed: authorities,
     embedded: true,
     basePath: uiPath,
+    mount,
     publicOrigin: base,
     scheme: new URL(base).protocol,
   });
@@ -399,7 +416,7 @@ export async function startEmbeddedAgent({
   // podHome and actorUrl are the identity's own locations on the pod. They are
   // returned rather than rebuilt by the caller so the root name lives here.
   return {
-    agent, handle, home, surface, host: authorities.host,
+    agent, handle, home, surface, host: authorities.host, mount,
     podHome: urls.home, actorUrl: urls.actor, inboxUrl: urls.inbox, stop,
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod-server",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "The FediPod Server: a full ActivityPub server as a Community Solid Server component.",
   "license": "MIT",
   "main": "dist/index.js",
@@ -55,6 +55,7 @@
     "build:components": "componentsjs-generator -s src -c dist/components -r fps",
     "test": "npm run build && node --test test/*.mjs",
     "test:e2e": "node test/e2e/live-agent.mjs",
+    "test:e2e:suffix": "node test/e2e/live-suffix.mjs",
     "prepublishOnly": "npm test",
     "prepack": "node scripts/pack-tree.mjs copy",
     "postpack": "node scripts/pack-tree.mjs clean"

package/run-agent.mjs

@@ -1,6 +1,6 @@
 // run-agent.mjs — fedipod: a standalone single-actor ActivityPub
 // agent. The remote pod is a RELAY: it serves the public wire face
-// (/activitypods-js/ap/) and buffers inbound mail in a public-append inbox
+// (/fedipod/ap/) and buffers inbound mail in a public-append inbox
 // while this process is off, and it keeps one private document, the lease,
 // because a lock only one machine can reach coordinates nothing.
 //
@@ -37,6 +37,7 @@ import { RemotePod } from './lib/device/remote.mjs';
 import { Deliverer } from './lib/core/deliver.mjs';
 import { Publisher } from './lib/core/publisher/index.mjs';
 import { Intake } from './lib/core/intake/index.mjs';
+import { C2S } from './lib/client/c2s.mjs';
 import { TagFeed } from './lib/connections/tagfeed.mjs';
 import { ImportWorker } from './lib/connections/import.mjs';
 import { Atproto } from './lib/connections/atproto.mjs';
@@ -122,6 +123,7 @@ export class Agent {
       update: this.updateInfo || null,
       inboxCooldownFor: this.intake?.drainCooldownUntil
         ? Math.max(0, Math.round((this.intake.drainCooldownUntil - Date.now()) / 1000)) : 0,
+      stateSkipped: this.store.lastSkipped || [],
     };
   }
 
@@ -336,11 +338,15 @@ export class Agent {
     });
     // Intake is constructed even for viewers — its signed fetchAP powers
     // search/deref; start() (draining) is active-only.
+    // The dispatcher the admin surface also builds; this one is for what the
+    // Gateway's outbox door took on the owner's behalf and the drain finds.
+    this.c2s = new C2S({ agent: this, log: this.log });
     this.intake = new Intake({
       config, urls: this.urls, remote: this.remote, store: this.store,
       deliverer: this.deliverer, publisher: this.publisher, log: this.log, lease: this.lease,
       archive: this.privateStorage(cred, 'archive'),
       push: !this.embedded, pollSeconds: this.pollSeconds || null,
+      ownerPost: (a, o) => this.c2s.dispatch(a, o),
     });
     // The CSV-import worker: paced, resumable, armed only while active.
     this.importer?.stop();
@@ -514,6 +520,9 @@ export class Agent {
     this.viewer = false;
     clearInterval(this.refreshTimer);
     if (promoted) await this.refreshBeforeActing();
+    // Own posts the outbox names and the timeline index lacks come back here,
+    // before anything acts on the index.
+    await this.publisher.healStatuses().catch(e => this.log(`healing the timeline index: ${e.message}`));
     this.lease.onLost = () => this.demote();
     this.lease.startRenewal();
     this.deliverer.startQueue();

package/vendor/gate.cjs

@@ -85,7 +85,7 @@ function cookieValue(header, name) {
 // AP_ALLOWED_HOSTS has nothing but this token, so the gate has to be total.
 // `token` may be a function, resolved per request: an identity's secret can
 // rotate while the server runs, and the very next request sees the new one.
-function makeGate(token, { allowOrigins = [], publicEndpoints = false, secureCookie = false } = {}) {
+function makeGate(token, { allowOrigins = [], publicEndpoints = false, secureCookie = false, cookiePath = '/' } = {}) {
   const tokenNow = () => (typeof token === 'function' ? token() : token);
   // gate(req, res) → true when the gate handled the response (caller stops).
   function gate(req, res) {
@@ -102,7 +102,10 @@ function makeGate(token, { allowOrigins = [], publicEndpoints = false, secureCoo
       url.searchParams.delete(COOKIE);
       url.searchParams.delete('dk-bless');
       res.writeHead(302, {
-        'set-cookie': `${COOKIE}=${t}; Path=/; HttpOnly; SameSite=Strict; Max-Age=31536000`
+        // Path scopes the cookie to this identity's own door: on a shared
+        // origin (suffix pods) two co-tenants must not clobber each other's,
+        // and a whole-origin cookie would. Defaults to '/'.
+        'set-cookie': `${COOKIE}=${t}; Path=${cookiePath}; HttpOnly; SameSite=Strict; Max-Age=31536000`
           + (secureCookie ? '; Secure' : ''),
         'location': url.pathname + url.search,
       });

package/web/admin/index.html

@@ -275,6 +275,8 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
 
 <section id="pane-identity" hidden>
   <dl id="facts"></dl>
+  <!-- State documents the agent could not read on its last load, if any. -->
+  <p class="err" id="state-skipped" role="alert" hidden></p>
   <!-- Declared here, and render() puts these on the kind row — the row they
        belong to is generated, so this is the only place they can be written
        down. Each reads as the setting it would change, so what it shows IS the

package/web/admin/upkeep.js

@@ -145,8 +145,16 @@ const INBOX_PROMPT_AT = 500;
 let dismissed = false;
 
 async function renderInbox() {
-  if (dismissed) return;
   const { json: st } = await api('/status');
+  // A state document the last load could not read is a timeline or a contact
+  // list quietly missing; the page says which, under the facts.
+  const skipped = st?.stateSkipped || [];
+  const line = $('state-skipped');
+  line.hidden = !skipped.length;
+  line.textContent = skipped.length
+    ? `${skipped.length} state document${skipped.length === 1 ? '' : 's'} could not be read on the last load: ${skipped.join(', ')}.`
+    : '';
+  if (dismissed) return;
   const box = st?.inbox;
   const panel = $('pane-inbox');
   if (!box || box.count < INBOX_PROMPT_AT) { panel.hidden = true; return; }

package/web/app/README.md

@@ -7,7 +7,7 @@ See `claude/plans/browser-agent.md` for the whole design and status.
 |---|---|
 | `pod-auth.mjs` | The pod side of sign-in, browser-native: create a CSS account + pod, mint a client credential, and a DPoP-bound `fetch` that writes to the pod. The twin of `lib/device/account.mjs` + `vendor/idp-grant.cjs`. |
 | `keystore.mjs` | WebCrypto RSA/Ed25519 key generation, and wrapping the keys under the account password (PBKDF2-SHA256 + AES-GCM-256). The pod holds only the wrapped form, so the pod's host cannot sign as you. |
-| `keys-browser.mjs` | Importing a keys record for signing, and finding one: this browser's opened copy in IndexedDB first, else the pod's. A wrapped one the browser has not opened yet raises `KeyPasswordNeeded`, which `boot.mjs` answers with the unlock pane — once per browser. |
+| `keys-browser.mjs` | Importing a keys record for signing, and finding one: this browser's opened copy in IndexedDB first, else the pod's. A wrapped one the browser has not opened yet raises `KeyPasswordNeeded`, which `boot.mjs` answers with the unlock pane — once per browser. The same pane offers a new key wrapped under the password used now, for someone who no longer has the sign-up password. |
 | `signup.mjs` | The `fedipod setup` flow, in the browser, up to publish: account, pod, credential, keys locked on the pod (owner-only ACL written *before* the key). Produces the credential/keys/config shapes the agent already reads. |
 | `shims/fedify-sig.mjs` | Browser stand-in for `@fedify/fedify/sig` (which will not bundle for a browser). `sign()` returns signed headers as data for the relay; `signRequest()` wraps it Fedify-shaped. Proven byte-identical to Fedify. |
 | `shims/node-crypto.mjs` | Browser stand-in for `node:crypto` — the small synchronous slice the agent uses, via crypto-browserify, plus native WebCrypto. |

package/web/app/agent.mjs

@@ -12,6 +12,7 @@ import { PodStore } from '../../lib/core/store.mjs';
 import { HttpStorage } from '../../lib/core/storage.mjs';
 import { Publisher } from '../../lib/core/publisher/index.mjs';
 import { Intake } from '../../lib/core/intake/index.mjs';
+import { C2S } from '../../lib/client/c2s.mjs';
 import { Lease } from '../../lib/core/lease.mjs';
 import { MastoApi } from '../../lib/client/masto/index.mjs';
 import { TagFeed } from '../../lib/connections/tagfeed.mjs';
@@ -84,6 +85,9 @@ export class BrowserAgent {
       // whole document back over newer state. Read what is actually there
       // before acting on it.
       await this.store.load({ force: true }).catch((e) => this.log(`re-reading state: ${e.message}`));
+      // Own posts the outbox names and the timeline index lacks come back
+      // here, before anything acts on the index.
+      await this.publisher.healStatuses().catch((e) => this.log(`healing the timeline index: ${e.message}`));
       // And start delivering again, since demote() stopped it. startQueue() is
       // idempotent, so a goActive() that was already active costs nothing.
       this.deliverer?.startQueue?.();
@@ -189,7 +193,7 @@ export class BrowserAgent {
     // builds its own urls from `config.root` (publisher.mjs), and a config
     // without one falls to the Node default — so an account set up elsewhere
     // and signed into here would keep its state under `fedipod/` while every
-    // document it published landed under `activitypods-js/`. One root, decided
+    // document it published landed under a different root. One root, decided
     // once, carried by the config everything downstream reads.
     this.store.setConfig({ ...(this.store.getConfig() || {}), ...cfg, root });
     config = this.store.getConfig();
@@ -257,9 +261,14 @@ export class BrowserAgent {
     // read-only until the owner acts on it and it takes over. Written with fresh
     // fetches, never the cached store. Passed into Intake so the drain checks it.
     this.lease = new Lease({ url: this.urls.state + 'lease.json', fetchImpl: podFetch, log: this.log });
+    // The client-to-server dispatcher, here only for what the Gateway's
+    // outbox door takes on the owner's behalf: the browser answers no
+    // /ap/outbox of its own.
+    this.c2s = new C2S({ agent: this, log: this.log });
     this.intake = new Intake({
       config: this.store.getConfig(), urls: this.urls, remote: this.remote,
       store: this.store, deliverer: this.deliverer, publisher: this.publisher, log: this.log, push: true, lease: this.lease,
+      ownerPost: (a, o) => this.c2s.dispatch(a, o),
     });
     // The Mastodon facade the service worker serves.
     //
@@ -356,6 +365,7 @@ export class BrowserAgent {
       podRequests: this.remote?.stats?.() || null,
       update: null,
       inboxCooldownFor: 0,
+      stateSkipped: this.store?.lastSkipped || [],
     };
   }
 

package/web/app/boot.mjs

@@ -16,7 +16,7 @@ import { podBaseOfWebId } from '../../lib/pod/urls.mjs';
 import { podLayout } from '../../lib/pod/root.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
 import { beginLogin, completeLogin, getSession, signOut } from './oidc-session.mjs';
-import { unwrapKeys, isKeyEnvelope } from './keystore.mjs';
+import { generateKeys, wrapKeys, unwrapKeys, isKeyEnvelope } from './keystore.mjs';
 import { cacheOpenedKeys } from './keys-browser.mjs';
 
 const REDIRECT = `${location.origin}/`;   // the app root doubles as the OIDC callback
@@ -64,30 +64,50 @@ async function bootWorker({ reset = false } = {}) {
 //
 // The unwrap happens HERE, in the page, and not in the worker: the worker boots
 // itself whenever the browser restarts it, with nobody present to type anything.
-window.fedipodUnlock = async (password) => {
-  if (!password) throw new Error('Enter your account password.');
+//
+// Both paths below read the account's config and key the same way: with the
+// session, as the owner, through the transport rather than the bare session —
+// a pod read like any other, with the retry ladder that exists because the pod
+// host throttles bursts.
+async function readAccountState() {
   const session = await getSession();
   if (!session) throw new Error('Sign in first.');
-  // The config on the pod says where this account's state lives; the key sits
-  // beside it. Both are read with the session, as the owner.
   const podFromWebId = podBaseOfWebId(session.webId);   // a suffix-based host, or its own host
   const state = `${podFromWebId}${AP_ROOT}ap-state/`;
-  // Through the transport rather than the bare session: this is a pod read
-  // like any other, and going round it skipped the retry ladder that exists
-  // because the pod host throttles bursts.
   const remote = new BrowserRemotePod(session, { webId: session.webId, role: 'signup', log: () => {} });
   const urls = { state };
   const [cfg, doc] = await Promise.all([
     podState.readConfig(remote, urls), podState.readWrappedKeys(remote, urls),
   ]);
-  if (!cfg || !doc) throw new Error(`could not read this account's config and key under ${state}`);
+  if (!cfg) throw new Error(`could not read this account's config under ${state}`);
+  const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
+  return { remote, urls, cfg, doc, actorUrl };
+}
+
+window.fedipodUnlock = async (password) => {
+  if (!password) throw new Error('Enter your password.');
+  const { doc, actorUrl } = await readAccountState();
+  if (!doc) throw new Error('could not read this account\'s key on the pod');
   if (!isKeyEnvelope(doc)) throw new Error('this account\'s key is not locked — nothing to unlock');
   const rec = await unwrapKeys(doc, password);          // throws 'wrong password'
-  const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
   await cacheOpenedKeys(actorUrl, rec);
   await bootWorker();
 };
 
+// The same pane, for someone who no longer has the sign-up password: a new key,
+// wrapped under the password they use now, written over the pod's copy. Nothing
+// is unwrapped, so the old password is never needed. The boot that follows
+// publishes the new public key (agent.goActive → publishProfile).
+window.fedipodNewKey = async (password) => {
+  if (!password) throw new Error('Enter the password you use for your pod now.');
+  const { remote, urls, cfg, actorUrl } = await readAccountState();
+  const keys = await generateKeys();
+  keys.mintedFor = cfg.gateway?.frontActor || actorUrl;   // one key, one actor (signup.mjs)
+  await podState.writeWrappedKeys(remote, urls, await wrapKeys(keys, password));
+  await cacheOpenedKeys(actorUrl, keys);
+  await bootWorker();
+};
+
 // New account: create the account, pod, key, config and gateway attach (this
 // needs the password once), then redirect to the pod's login to establish the
 // durable session. The agent boots on return, reading config + key from the pod.
@@ -213,6 +233,25 @@ if (typeof document !== 'undefined') (async () => {
   };
   $('unlock-go')?.addEventListener('click', doUnlock);
   $('unlock-password')?.addEventListener('keydown', (e) => { if (e.key === 'Enter') doUnlock(); });
+  // The new-key path: one click reveals the confirmation, the second acts.
+  $('unlock-newkey')?.addEventListener('click', () => {
+    $('unlock-newkey-confirm').hidden = false;
+    $('unlock-password').focus();
+  });
+  const doNewKey = async () => {
+    $('unlock-error').textContent = '';
+    const btn = $('unlock-newkey-go'); btn.disabled = true;
+    try {
+      await window.fedipodNewKey($('unlock-password').value);
+      $('unlock-password').value = '';
+      location.href = '/admin/client/';
+    } catch (err) {
+      $('unlock-error').textContent = err.message || String(err);
+      btn.disabled = false;
+      $('unlock-password').select();
+    }
+  };
+  $('unlock-newkey-go')?.addEventListener('click', doNewKey);
 
 
   // The client shell's bar returns here for two things, and neither continues

package/web/app/dist/boot.js

@@ -33075,7 +33075,7 @@ var PodTransport = class {
    * says all of it. The parsed graph must mention the WebID before anything is
    * written back — an empty or foreign body must never become the new profile.
    */
-  async linkAccountInProfile({ actorUrl, accountName, kind = "person" }) {
+  async linkAccountInProfile({ actorUrl, accountName, kind = "person", outbox = null }) {
     const docUrl = this.webId.split("#")[0];
     const res = await this.fetch(docUrl, { headers: { accept: "text/turtle" } });
     if (res.status >= 400) throw new Error(`[${this.label}] GET ${docUrl} \u2192 ${res.status}`);
@@ -33091,10 +33091,16 @@ var PodTransport = class {
       [me, FOAF("account"), actor],
       [actor, RDF3("type"), FOAF("OnlineAccount")],
       [actor, RDF3("type"), kind === "group" ? AS("Group") : AS("Person")],
-      [actor, FOAF("accountName"), literal2(accountName)]
+      [actor, FOAF("accountName"), literal2(accountName)],
+      // Where a Solid client posts on this person's behalf (`as:outbox` on the
+      // WebID is what dokieli reads); only where a door exists to take it.
+      ...outbox ? [[me, AS("outbox"), namedNode2(outbox)]] : []
     ];
     const missing = wanted.filter(([s, p, o]) => !g.holds(s, p, o, doc));
-    const stale = g.statementsMatching(actor, FOAF("accountName"), null, doc).filter((st2) => st2.object.value !== accountName);
+    const stale = [
+      ...g.statementsMatching(actor, FOAF("accountName"), null, doc).filter((st2) => st2.object.value !== accountName),
+      ...outbox ? g.statementsMatching(me, AS("outbox"), null, doc).filter((st2) => st2.object.value !== outbox) : []
+    ];
     if (!missing.length && !stale.length) return false;
     const deletes = stale.map((st2) => [st2.subject, st2.predicate, st2.object]);
     if (await this.patchDocument(docUrl, missing, deletes)) return true;
@@ -33202,12 +33208,54 @@ var BrowserRemotePod = class extends PodTransport {
 // lib/pod/state.mjs
 var readWrappedKeys = (pod, urls) => pod.getJson(urls.state + "keys.json");
 var readConfig = (pod, urls) => pod.getJson(urls.state + "config.json");
+var writeWrappedKeys = (pod, urls, envelope) => pod.putJson(urls.state + "keys.json", envelope, "application/json");
 var writeConfig = (pod, urls, config) => pod.putJson(urls.state + "config.json", config, "application/json");
 async function provisionKey(pod, { stateUrl, keysUrl, envelope }) {
   await pod.setAcl(stateUrl, []);
   await pod.putJson(keysUrl, envelope, "application/json");
 }
 
+// lib/pod/root.mjs
+var OWNER_LOOKUP_MS = 5e3;
+var PUBLIC_DOC_MAX_BYTES = 1024 * 1024;
+async function podLayout(fetchImpl, providerOrigin, { timeoutMs = OWNER_LOOKUP_MS } = {}) {
+  let origin;
+  try {
+    origin = new URL(providerOrigin).origin;
+  } catch {
+    return null;
+  }
+  let res;
+  try {
+    res = await fetchImpl(
+      `${origin}/.well-known/solid`,
+      { headers: { accept: "text/turtle" }, signal: AbortSignal.timeout(timeoutMs) }
+    );
+  } catch {
+    return null;
+  }
+  if (res.status === 501) return "host";
+  if (res.status !== 200) return null;
+  let body = "";
+  try {
+    body = await readCapped(res, 64 * 1024);
+  } catch {
+    return null;
+  }
+  return /ns\/pim\/space#Storage|pim:Storage/u.test(body) ? "path" : null;
+}
+async function resourceExists(fetchImpl, url, { timeoutMs = OWNER_LOOKUP_MS } = {}) {
+  try {
+    const res = await fetchImpl(
+      url,
+      { headers: { accept: "application/activity+json" }, signal: AbortSignal.timeout(timeoutMs) }
+    );
+    return !!res && res.status === 200;
+  } catch {
+    return false;
+  }
+}
+
 // web/app/idb-kv.mjs
 var DB = "fedipod-accounts";
 function open() {
@@ -33310,6 +33358,7 @@ async function signUp(answers, { onStep = () => {
       acct.running("checking your pod");
       const head = await fetch(brought, { method: "HEAD" }).catch(() => null);
       if (!head || head.status >= 400) throw new Error(`the pod at ${brought} did not answer (HTTP ${head?.status || "no response"})`);
+      if (await resourceExists(fetch, actorUrlFor(brought))) throw new Error("The pod already hosts a FediPod account. If you want a second account, put it on a different pod.");
       prog.pod = brought;
       acct.skip("using the pod you brought");
     }
@@ -33450,36 +33499,6 @@ function podBaseOfWebId(webId) {
   return `${u.origin}${dir.endsWith("/") ? dir : dir + "/"}`;
 }
 
-// lib/pod/root.mjs
-var OWNER_LOOKUP_MS = 5e3;
-var PUBLIC_DOC_MAX_BYTES = 1024 * 1024;
-async function podLayout(fetchImpl, providerOrigin, { timeoutMs = OWNER_LOOKUP_MS } = {}) {
-  let origin;
-  try {
-    origin = new URL(providerOrigin).origin;
-  } catch {
-    return null;
-  }
-  let res;
-  try {
-    res = await fetchImpl(
-      `${origin}/.well-known/solid`,
-      { headers: { accept: "text/turtle" }, signal: AbortSignal.timeout(timeoutMs) }
-    );
-  } catch {
-    return null;
-  }
-  if (res.status === 501) return "host";
-  if (res.status !== 200) return null;
-  let body = "";
-  try {
-    body = await readCapped(res, 64 * 1024);
-  } catch {
-    return null;
-  }
-  return /ns\/pim\/space#Storage|pim:Storage/u.test(body) ? "path" : null;
-}
-
 // web/app/oidc-session.mjs
 var DB2 = "fedipod-oidc";
 var STORE = "session";
@@ -33725,8 +33744,7 @@ async function bootWorker({ reset = false } = {}) {
   worker.postMessage({ type: "boot", frontOrigin: location.origin });
   await booted;
 }
-window.fedipodUnlock = async (password) => {
-  if (!password) throw new Error("Enter your account password.");
+async function readAccountState() {
   const session = await getSession();
   if (!session) throw new Error("Sign in first.");
   const podFromWebId = podBaseOfWebId(session.webId);
@@ -33738,13 +33756,28 @@ window.fedipodUnlock = async (password) => {
     readConfig(remote, urls),
     readWrappedKeys(remote, urls)
   ]);
-  if (!cfg || !doc) throw new Error(`could not read this account's config and key under ${state}`);
+  if (!cfg) throw new Error(`could not read this account's config under ${state}`);
+  const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
+  return { remote, urls, cfg, doc, actorUrl };
+}
+window.fedipodUnlock = async (password) => {
+  if (!password) throw new Error("Enter your password.");
+  const { doc, actorUrl } = await readAccountState();
+  if (!doc) throw new Error("could not read this account's key on the pod");
   if (!isKeyEnvelope(doc)) throw new Error("this account's key is not locked \u2014 nothing to unlock");
   const rec = await unwrapKeys(doc, password);
-  const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
   await cacheOpenedKeys(actorUrl, rec);
   await bootWorker();
 };
+window.fedipodNewKey = async (password) => {
+  if (!password) throw new Error("Enter the password you use for your pod now.");
+  const { remote, urls, cfg, actorUrl } = await readAccountState();
+  const keys = await generateKeys();
+  keys.mintedFor = cfg.gateway?.frontActor || actorUrl;
+  await writeWrappedKeys(remote, urls, await wrapKeys(keys, password));
+  await cacheOpenedKeys(actorUrl, keys);
+  await bootWorker();
+};
 window.fedipodSignup = async ({ onStep, ...answers }) => {
   await signUp(answers, { onStep, frontOrigin: location.origin });
   const { authorizationUrl } = await beginLogin({ issuer: answers.issuer, redirectUri: REDIRECT });
@@ -33849,6 +33882,25 @@ if (typeof document !== "undefined") (async () => {
   $("unlock-password")?.addEventListener("keydown", (e) => {
     if (e.key === "Enter") doUnlock();
   });
+  $("unlock-newkey")?.addEventListener("click", () => {
+    $("unlock-newkey-confirm").hidden = false;
+    $("unlock-password").focus();
+  });
+  const doNewKey = async () => {
+    $("unlock-error").textContent = "";
+    const btn = $("unlock-newkey-go");
+    btn.disabled = true;
+    try {
+      await window.fedipodNewKey($("unlock-password").value);
+      $("unlock-password").value = "";
+      location.href = "/admin/client/";
+    } catch (err) {
+      $("unlock-error").textContent = err.message || String(err);
+      btn.disabled = false;
+      $("unlock-password").select();
+    }
+  };
+  $("unlock-newkey-go")?.addEventListener("click", doNewKey);
   if (params.has("signout") || params.has("add")) {
     if (params.has("signout")) {
       try {