fedipod-server 0.17.0 → 0.18.0

package/lib/core/publisher/notes.mjs

@@ -99,7 +99,28 @@ export function assertDirectAddressed(content, mentions) {
   throw e;
 }
 
-export async function publishNote(publisher, content, { inReplyTo, attachments, visibility = 'public', spoilerText = null } = {}) {
+// A client may name the document it is creating (the Slug of a client-to-server
+// POST). Only a plain name is taken, and only when nothing is there already;
+// otherwise the agent mints one as it always has.
+const SLUG_OK = /^[A-Za-z0-9._-]{1,64}$/u;
+export const safeSlug = (s) => (typeof s === 'string' && SLUG_OK.test(s) && !/^\.+$/u.test(s) ? s : null);
+async function slugFor(publisher, container, wanted, published) {
+  const name = safeSlug(wanted);
+  if (name && !(await podNotes.read(publisher.remote, container + name).catch(() => null))) return name;
+  return published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
+}
+
+// What the author's own timeline shows for an object: its content, else its
+// text under one of the names other vocabularies use, else a link to it.
+export function rowContent(obj) {
+  if (typeof obj?.content === 'string' && obj.content.trim()) return wire.sanitizeHtml(obj.content);
+  const plain = [obj?.bodyValue, obj?.name, obj?.summary].find((v) => typeof v === 'string' && v.trim());
+  if (plain) return wire.contentHtml(plain);
+  const esc = (v) => String(v).replace(/[&<>"]/gu, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
+  return `<p><a href="${esc(obj?.id || '')}">${esc(obj?.type || 'object')}</a></p>`;
+}
+
+export async function publishNote(publisher, content, { inReplyTo, attachments, visibility = 'public', spoilerText = null, slug: wanted = null } = {}) {
   const { urls } = publisher;
   const priv = visibility === 'private' || visibility === 'direct';
   if (priv) {
@@ -107,7 +128,7 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
     if (ready !== true) throw new Error(ready);
   }
   const published = new Date().toISOString();
-  const slug = published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
+  const slug = await slugFor(publisher, priv ? urls.privateNotes : urls.notes, wanted, published);
   const mentions = await publisher._mentionsFor(content, inReplyTo);
   if (visibility === 'direct') assertDirectAddressed(content, mentions);
   const note = wire.noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions,
@@ -127,6 +148,11 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
     ...(attachments?.length ? { attachments } : {}),
     ...(note.tag?.length ? { mentions: note.tag.map(t => ({ href: t.href, name: t.name })) } : {}),
   });
+  // The row is what the author's own timeline reads. Land it before answering
+  // — the same PUT the debounce would send in 300 ms — so a worker killed or a
+  // write refused after the answer cannot leave a post that stands on the pod
+  // and reached followers but never shows to its author.
+  if (await publisher.store.commit?.() === false) publisher.log(`post published but its timeline row was refused: ${note.id}`);
 
   const create = wire.createActivity(note, urls);
   // Published as its own document: a group that carries this post wraps the
@@ -164,6 +190,62 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
 // edit's own stamp. The pod documents are overwritten in place — the Create
 // too, so a group's Announce resolves to the edited text — and an Update
 // goes everywhere the Create went.
+// Any object as a post: what a client-to-server Create carries when it is not
+// a Note or a Question — a Web Annotation, say. Stored as sent, with its own
+// context, under this actor; the Create around it is what followers receive.
+// Servers that know the type show it; the rest ignore it, which is the
+// expected outcome.
+//
+// An object already living on this pod (an id under it) is not copied: the
+// Create names it where it is. Anything else is written into the notes
+// container under the client's slug when it is free, else a minted one.
+export async function publishObject(publisher, object, { visibility = 'public', slug: wanted = null } = {}) {
+  const { urls } = publisher;
+  const priv = visibility === 'private' || visibility === 'direct';
+  if (priv) {
+    const ready = await publisher.privateReady();
+    if (ready !== true) throw new Error(ready);
+  }
+  const published = new Date().toISOString();
+  const container = priv ? urls.privateNotes : urls.notes;
+  const pod = publisher.config?.remotePod || urls.base;
+  const ownId = typeof object.id === 'string' && /^https?:\/\//u.test(object.id) && object.id.startsWith(pod)
+    ? object.id : null;
+  const name = await slugFor(publisher, container, wanted, published);
+  const addressed = wire.addressing(urls, visibility);
+  let doc = null;
+  const id = ownId || container + name;
+  if (!ownId) {
+    doc = { ...object, id, attributedTo: urls.actor, published: object.published || published, to: addressed.to, cc: addressed.cc };
+    if (!doc['@context']) doc['@context'] = wire.AS_CTX;
+    if (typeof doc.content === 'string') doc.content = wire.sanitizeHtml(doc.content);
+    await podNotes.write(publisher.remote, id, doc);
+  }
+  if (!priv) await publisher.recordOutbox(id);
+  const row = doc || object;
+  publisher.store.addStatus({
+    noteId: id, actor: urls.actor, content: rowContent(row), published: row.published || published,
+    kind: 'post', slug: name, visibility,
+  });
+  if (await publisher.store.commit?.() === false) publisher.log(`object published but its timeline row was refused: ${id}`);
+
+  // The Create sits beside the object; for an object living elsewhere on the
+  // pod it sits in the notes container, whose ACL is public Read.
+  const createId = doc ? wire.createActivityId(id) : wire.createActivityId(container + name);
+  const create = {
+    '@context': wire.AS_CTX, id: createId, type: 'Create', actor: urls.actor,
+    published: row.published || published, to: addressed.to, cc: addressed.cc,
+    object: doc || id,
+  };
+  await podNotes.writeCreate(publisher.remote, create.id, create);
+  const contacts = publisher.store.getContacts();
+  const inboxes = visibility === 'direct' ? []
+    : [...new Set(contacts.followers.map((f) => f.sharedInbox || f.inbox).filter(Boolean))];
+  await publisher.deliverer.deliverToAll(inboxes, create);
+  publisher.log(`${row.type || 'object'} published: ${id} → ${inboxes.length} inbox(es)`);
+  return { id, createId, copied: !ownId };
+}
+
 export async function updateNote(publisher, s, { content, spoilerText = null, attachments = null } = {}) {
   const { urls } = publisher;
   const updated = new Date().toISOString();

package/lib/core/publisher/questions.mjs

@@ -82,6 +82,7 @@ export async function publishQuestion(publisher, content, { options = [], multip
     ...(spoilerText ? { spoiler: spoilerText } : {}),
     ...(question.tag?.length ? { mentions: question.tag.map(t => ({ href: t.href, name: t.name })) } : {}),
   });
+  if (await publisher.store.commit?.() === false) publisher.log(`poll published but its timeline row was refused: ${question.id}`);
 
   const create = publisher._pollActivity('Create', question, wire.createActivityId(question.id));
   await podNotes.writeCreate(publisher.remote, create.id, create);

package/lib/core/publisher/restore.mjs

@@ -5,6 +5,7 @@
 import * as wire from '../wire.mjs';
 import * as podNotes from '../../pod/notes.mjs';
 import { readLenient } from '../as2.mjs';
+import { rowContent } from './notes.mjs';
 
 const ACCEPT_AP = 'application/activity+json, application/ld+json; profile="https://www.w3.org/ns/activitystreams"';
 const REBUILD_MAX_PER_RUN = 200;
@@ -151,13 +152,14 @@ export async function rebuildStatuses(publisher, { fromNotes = false } = {}) {
     if (have.has(id) || removed.has(id)) continue;
     budget--;
     const note = await podNotes.read(publisher.remote, id).catch(() => null);
-    if (note?.type !== 'Note' || note.id !== id || note.attributedTo !== urls.actor) continue;
+    // Any object of ours: a Note, a poll, or whatever a client posted.
+    if (!note?.type || note.id !== id || note.attributedTo !== urls.actor) continue;
     const attachments = wire.attachmentsOf(note);
     const mentions = (Array.isArray(note.tag) ? note.tag : [])
       .filter(t => t?.type === 'Mention' && t.href)
       .map(t => ({ href: t.href, name: t.name }));
     recovered.push({
-      noteId: note.id, actor: urls.actor, content: note.content || '',
+      noteId: note.id, actor: urls.actor, content: rowContent(note),
       published: note.published || null,
       ...(note.inReplyTo ? { inReplyTo: note.inReplyTo } : {}),
       kind: 'post', slug: note.id.slice(urls.notes.length),
@@ -197,3 +199,26 @@ export async function rebuildStatuses(publisher, { fromNotes = false } = {}) {
     dropped: Math.max(0, merged.length - kept.length),
   };
 }
+
+// Own posts the outbox records and the statuses index does not.
+//
+// The index row is the last thing a post writes, and it goes by a debounced
+// PUT: a worker killed or a write refused after the post was answered leaves a
+// post that stands on the pod and reached followers but never shows on its
+// author's own timeline. Run when an agent becomes active. Cheap when nothing
+// is wrong — two cached documents compared, no request — and the capped,
+// merge-only rebuild when something is.
+export async function healStatuses(publisher) {
+  const { urls, store } = publisher;
+  const own = store.read('outbox.json', [])
+    .map(i => (typeof i === 'string' ? i : null))
+    .filter(id => id && id.startsWith(urls.notes));
+  if (!own.length) return { missing: 0, recovered: 0 };
+  const have = new Set(store.getStatuses().map(s => s.noteId));
+  const removed = new Set(store.read('outbox-removed.json', []).map(r => r.id));
+  const missing = own.filter(id => !have.has(id) && !removed.has(id));
+  if (!missing.length) return { missing: 0, recovered: 0 };
+  const r = await rebuildStatuses(publisher);
+  publisher.log(`timeline index healed: ${missing.length} own post(s) were missing, ${r.recovered} recovered`);
+  return { missing: missing.length, recovered: r.recovered };
+}

package/lib/core/social.mjs

@@ -204,6 +204,7 @@ export async function reblog(agent, s) {
   // missing entry, a failed status write would let a retry announce twice.
   const updated = agent.store.updateStatus(s.noteId, { reblogged: true, announceActivity: act });
   await agent.publisher.recordOutbox(act);
+  if (await agent.store.commit?.() === false) agent.log(`boost sent but its timeline row was refused: ${s.noteId}`);
   return updated;
 }
 

package/lib/core/store.mjs

@@ -74,6 +74,7 @@ export function dropFollower(contacts, actor, why) {
 
 export class PodStore {
   constructor({ storage = null, log = console.log } = {}) {
+    this.lastSkipped = [];        // what the last load could not read, as `name (HTTP n)`
     this.storage = storage;
     this.log = log;
     this.cache = new Map();        // name → parsed value
@@ -146,6 +147,9 @@ export class PodStore {
       try { this.cache.set(name, JSON.parse(r.body)); }
       catch (e) { this.log(`state load ${name}: unparsable (${e.message})`); }
     }
+    // Kept for /status: a document skipped here is a timeline or a contact
+    // list quietly missing, and the owner should be able to see that.
+    this.lastSkipped = skipped;
     if (skipped.length) this.log(`state load skipped ${skipped.length}: ${skipped.join(', ')}`);
     this.log(`state loaded: ${this.cache.size} doc(s) from ${this.base} (${fetched} re-fetched)`);
   }

package/lib/core/wire.mjs

@@ -605,29 +605,33 @@ export function contentHtml(text, mentions = []) {
   return '<p>' + html.replace(/\n+/g, '</p><p>') + '</p>';
 }
 
-export function noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions = [],
-  visibility = 'public', summary = null, updated = null, container = null }) {
-  const id = (container || urls.notes) + slug;
-  const who = mentions.map(m => m.actor);
-  // Mastodon's four shapes. Public and unlisted are world-readable; private
-  // (followers-only) and direct carry no Public address at all and belong in
-  // the owner-only container. Mastodon addresses mentions in cc (to, for a
-  // direct post) and will not notify anyone it does not find there or in the
-  // tags.
-  const addressing = {
+// Mastodon's four shapes. Public and unlisted are world-readable; private
+// (followers-only) and direct carry no Public address at all and belong in
+// the owner-only container. Mastodon addresses mentions in cc (to, for a
+// direct post) and will not notify anyone it does not find there or in the
+// tags.
+export function addressing(urls, visibility, who = []) {
+  return {
     public: { to: [PUBLIC], cc: [urls.followers, ...who] },
     unlisted: { to: [urls.followers], cc: [PUBLIC, ...who] },
     private: { to: [urls.followers], cc: who },
     direct: { to: who, cc: [] },
   }[visibility] || { to: [PUBLIC], cc: [urls.followers, ...who] };
+}
+
+export function noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions = [],
+  visibility = 'public', summary = null, updated = null, container = null }) {
+  const id = (container || urls.notes) + slug;
+  const who = mentions.map(m => m.actor);
+  const addressed = addressing(urls, visibility, who);
   const note = {
     '@context': AS_CTX,
     id, type: 'Note',
     attributedTo: urls.actor,
     content: contentHtml(content, mentions),
     published,
-    to: addressing.to,
-    cc: addressing.cc,
+    to: addressed.to,
+    cc: addressed.cc,
     replies: repliesId(id),
   };
   if (summary) note.summary = summary;      // the content warning

package/lib/gateway/front-core.mjs

@@ -16,7 +16,7 @@
 // HTTPS box is another. UN-DEPLOYED — nothing in FediPod runs it.
 
 import crypto from 'node:crypto';
-import { handleDelivery } from './gateway-core.mjs';
+import { handleDelivery, handleOwnerPost } from './gateway-core.mjs';
 import { readCapped, safeFetch, isLoopbackHost } from '../shared/safefetch.mjs';
 import * as podRoot from '../pod/root.mjs';
 import * as podPolicy from '../pod/policy.mjs';
@@ -619,6 +619,48 @@ async function route(request, ctx) {
     return { status, headers: {}, body: '' };
   }
 
+  // Outbox: the owner's own post, from any client that speaks ActivityPub
+  // client-to-server (dokieli, say). Cross-origin by nature — such a client is
+  // a page on another site — so this route answers a preflight and carries
+  // CORS headers; the owner's pod token is the credential, so any origin may
+  // ask. GET stays a read: the pod's document for a fronted account, sent on
+  // to the pod for a door account whose documents live at their own address.
+  if (up.rest === 'ap/outbox') {
+    const cors = {
+      'access-control-allow-origin': '*',
+      'access-control-allow-methods': 'GET, POST, OPTIONS',
+      'access-control-allow-headers': 'Authorization, DPoP, Content-Type, Slug, Link',
+      'access-control-expose-headers': 'Location, Accept-Post',
+      'access-control-max-age': '86400',
+    };
+    if (request.method === 'OPTIONS') {
+      // Accept-Post names JSON only: a client that reads it (dokieli) sends
+      // JSON-LD when HTML is not offered.
+      // body null, not '': a Response refuses any body on a 204, and the
+      // function adapter hands `body` straight to one.
+      return { status: 204, headers: { ...cors, allow: 'GET, POST, OPTIONS',
+        'accept-post': 'application/ld+json, application/activity+json' }, body: null };
+    }
+    if (request.method === 'POST') {
+      const json = (status, obj, extra = {}) => ({ status,
+        headers: { ...cors, 'content-type': 'application/json', 'cache-control': 'no-store', ...extra },
+        body: JSON.stringify(obj) });
+      const webid = await verifyPodToken(request, pathname, ctx.verifier);
+      if (!webid) return json(401, { error: 'a Solid-OIDC token proving this account\'s owner is required' });
+      const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
+      if (!owner) return json(403, { error: 'this outbox belongs to its owner alone' });
+      const { status, reason, location } = await handleOwnerPost(request, identFor(rec),
+        { podPut: (u, b, ct) => ctx.podPut(up.handle, u, b, ct), ownerWebId: webid });
+      console.log(`door @${up.handle}: owner post → ${status} (${reason})`);
+      if (status !== 202) return json(status, { error: reason });
+      return json(202, { accepted: true, ...(location ? { object: location } : {}),
+        note: 'it goes out when your FediPod agent next runs' }, location ? { location } : {});
+    }
+    if (rec.inboxOnly && (request.method === 'GET' || request.method === 'HEAD')) {
+      return { status: 303, headers: { ...cors, location: rec.podHome + 'ap/outbox', 'cache-control': 'no-store' }, body: '' };
+    }
+  }
+
   // Everything else is a public GET, served by reading the user's pod and
   // rewriting pod ids to the front. The actor also gets its handle and inbox
   // fixed to the front so a consumer cross-checks it consistently.

package/lib/gateway/gateway-core.mjs

@@ -110,4 +110,44 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
   return { status: 202, reason: v.verified ? 'verified' : 'buffered-unverified' };
 }
 
+// The outbox door: the owner's own post, taken on their behalf.
+//
+// A client such as dokieli POSTs an activity — or a bare object — to the
+// outbox address the actor advertises. The door holds no key and mints nothing:
+// it checks that the token proves the account's owner (the caller has already
+// done that and hands in `owner`), writes the bytes into the pod inbox exactly
+// as verified mail is written, and stamps them with a receipt whose method is
+// `c2s` and whose actor is this account. The drain hands such an item to the
+// client-to-server dispatcher, which publishes and delivers it — so the post
+// goes out when the agent next runs, the same way inbound mail is read.
+//
+// `slug` is the name the client asked for its new document. It rides in the
+// receipt so the dispatcher can use it, and it is what lets the door answer a
+// Location before anything exists: the object will live at notesPrefix+slug
+// unless that name is taken, in which case the agent mints another.
+export const SLUG_OK = /^[A-Za-z0-9._-]{1,64}$/u;
+export const safeSlug = (s) => (typeof s === 'string' && SLUG_OK.test(s) && !/^\.+$/u.test(s) ? s : null);
+
+export async function handleOwnerPost(request, ident, { podPut, ownerWebId, maxBytes = DEFAULT_MAX_BYTES } = {}) {
+  if (!ident.hmacSecret) return { status: 409, reason: 'this account has no door secret — attach it again' };
+  let raw;
+  try { raw = await request.text(); } catch { return { status: 400, reason: 'unreadable body' }; }
+  if (Buffer.byteLength(raw) > maxBytes) return { status: 413, reason: 'too large' };
+  let doc;
+  try { doc = JSON.parse(raw); } catch { return { status: 400, reason: 'unparsable JSON' }; }
+  if (!doc || typeof doc !== 'object' || Array.isArray(doc) || !doc.type) {
+    return { status: 400, reason: 'a typed ActivityStreams object is required' };
+  }
+  const slug = safeSlug(request.headers.get('slug'));
+  const receipt = signReceipt({
+    v: 1, verified: true, method: 'c2s', keyId: ownerWebId || null, actor: ident.actorUrl,
+    checks: ['owner-token'], reason: 'owner', gateway: ident.gatewayWebId, ...(slug ? { slug } : {}),
+  }, ident.hmacSecret);
+  const hash = sha256hex(raw);
+  const okA = await inbox.appendVerifiedDelivery(podPut, ident.inboxUrl, hash, raw);
+  if (!okA) return { status: 502, reason: 'pod inbox write failed' };
+  await inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt);
+  return { status: 202, reason: 'accepted', location: slug && ident.notesPrefix ? ident.notesPrefix + slug : null };
+}
+
 export const _internal = { isBlocked, concernsUsAtEdge, httpUrl, sha256hex };

package/lib/pod/actor.mjs

@@ -69,8 +69,8 @@ export async function writeProfilePage(pod, urls, html) {
  * parsed graph does not mention the WebID, and patches exactly the statements
  * involved rather than rewriting a document full of things that are not ours.
  */
-export function linkInWebIdProfile(pod, { actorUrl, accountName, kind = 'person' }) {
-  return pod.linkAccountInProfile({ actorUrl, accountName, kind });
+export function linkInWebIdProfile(pod, { actorUrl, accountName, kind = 'person', outbox = null }) {
+  return pod.linkAccountInProfile({ actorUrl, accountName, kind, outbox });
 }
 
 // ---- anyone at all ----

package/lib/pod/transport.mjs

@@ -407,7 +407,7 @@ export class PodTransport {
    * says all of it. The parsed graph must mention the WebID before anything is
    * written back — an empty or foreign body must never become the new profile.
    */
-  async linkAccountInProfile({ actorUrl, accountName, kind = 'person' }) {
+  async linkAccountInProfile({ actorUrl, accountName, kind = 'person', outbox = null }) {
     const docUrl = this.webId.split('#')[0];
     const res = await this.fetch(docUrl, { headers: { accept: 'text/turtle' } });
     if (res.status >= 400) throw new Error(`[${this.label}] GET ${docUrl} → ${res.status}`);
@@ -424,11 +424,17 @@ export class PodTransport {
       [actor, RDF('type'), FOAF('OnlineAccount')],
       [actor, RDF('type'), kind === 'group' ? AS('Group') : AS('Person')],
       [actor, FOAF('accountName'), $rdf.literal(accountName)],
+      // Where a Solid client posts on this person's behalf (`as:outbox` on the
+      // WebID is what dokieli reads); only where a door exists to take it.
+      ...(outbox ? [[me, AS('outbox'), $rdf.sym(outbox)]] : []),
     ];
     const missing = wanted.filter(([s, p, o]) => !g.holds(s, p, o, doc));
     // A handle change leaves the old accountName behind; ours is replaced.
-    const stale = g.statementsMatching(actor, FOAF('accountName'), null, doc)
-      .filter(st => st.object.value !== accountName);
+    // Likewise an outbox that moved.
+    const stale = [
+      ...g.statementsMatching(actor, FOAF('accountName'), null, doc).filter(st => st.object.value !== accountName),
+      ...(outbox ? g.statementsMatching(me, AS('outbox'), null, doc).filter(st => st.object.value !== outbox) : []),
+    ];
     if (!missing.length && !stale.length) return false;
     // A patch touches these statements and nothing else. Rewriting the whole
     // profile re-serialises statements that are not ours — the OIDC issuer

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod-server",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "The FediPod Server: a full ActivityPub server as a Community Solid Server component.",
   "license": "MIT",
   "main": "dist/index.js",

package/run-agent.mjs

@@ -37,6 +37,7 @@ import { RemotePod } from './lib/device/remote.mjs';
 import { Deliverer } from './lib/core/deliver.mjs';
 import { Publisher } from './lib/core/publisher/index.mjs';
 import { Intake } from './lib/core/intake/index.mjs';
+import { C2S } from './lib/client/c2s.mjs';
 import { TagFeed } from './lib/connections/tagfeed.mjs';
 import { ImportWorker } from './lib/connections/import.mjs';
 import { Atproto } from './lib/connections/atproto.mjs';
@@ -122,6 +123,7 @@ export class Agent {
       update: this.updateInfo || null,
       inboxCooldownFor: this.intake?.drainCooldownUntil
         ? Math.max(0, Math.round((this.intake.drainCooldownUntil - Date.now()) / 1000)) : 0,
+      stateSkipped: this.store.lastSkipped || [],
     };
   }
 
@@ -336,11 +338,15 @@ export class Agent {
     });
     // Intake is constructed even for viewers — its signed fetchAP powers
     // search/deref; start() (draining) is active-only.
+    // The dispatcher the admin surface also builds; this one is for what the
+    // Gateway's outbox door took on the owner's behalf and the drain finds.
+    this.c2s = new C2S({ agent: this, log: this.log });
     this.intake = new Intake({
       config, urls: this.urls, remote: this.remote, store: this.store,
       deliverer: this.deliverer, publisher: this.publisher, log: this.log, lease: this.lease,
       archive: this.privateStorage(cred, 'archive'),
       push: !this.embedded, pollSeconds: this.pollSeconds || null,
+      ownerPost: (a, o) => this.c2s.dispatch(a, o),
     });
     // The CSV-import worker: paced, resumable, armed only while active.
     this.importer?.stop();
@@ -514,6 +520,9 @@ export class Agent {
     this.viewer = false;
     clearInterval(this.refreshTimer);
     if (promoted) await this.refreshBeforeActing();
+    // Own posts the outbox names and the timeline index lacks come back here,
+    // before anything acts on the index.
+    await this.publisher.healStatuses().catch(e => this.log(`healing the timeline index: ${e.message}`));
     this.lease.onLost = () => this.demote();
     this.lease.startRenewal();
     this.deliverer.startQueue();

package/web/admin/index.html

@@ -275,6 +275,8 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
 
 <section id="pane-identity" hidden>
   <dl id="facts"></dl>
+  <!-- State documents the agent could not read on its last load, if any. -->
+  <p class="err" id="state-skipped" role="alert" hidden></p>
   <!-- Declared here, and render() puts these on the kind row — the row they
        belong to is generated, so this is the only place they can be written
        down. Each reads as the setting it would change, so what it shows IS the

package/web/admin/upkeep.js

@@ -145,8 +145,16 @@ const INBOX_PROMPT_AT = 500;
 let dismissed = false;
 
 async function renderInbox() {
-  if (dismissed) return;
   const { json: st } = await api('/status');
+  // A state document the last load could not read is a timeline or a contact
+  // list quietly missing; the page says which, under the facts.
+  const skipped = st?.stateSkipped || [];
+  const line = $('state-skipped');
+  line.hidden = !skipped.length;
+  line.textContent = skipped.length
+    ? `${skipped.length} state document${skipped.length === 1 ? '' : 's'} could not be read on the last load: ${skipped.join(', ')}.`
+    : '';
+  if (dismissed) return;
   const box = st?.inbox;
   const panel = $('pane-inbox');
   if (!box || box.count < INBOX_PROMPT_AT) { panel.hidden = true; return; }

package/web/app/README.md

@@ -7,7 +7,7 @@ See `claude/plans/browser-agent.md` for the whole design and status.
 |---|---|
 | `pod-auth.mjs` | The pod side of sign-in, browser-native: create a CSS account + pod, mint a client credential, and a DPoP-bound `fetch` that writes to the pod. The twin of `lib/device/account.mjs` + `vendor/idp-grant.cjs`. |
 | `keystore.mjs` | WebCrypto RSA/Ed25519 key generation, and wrapping the keys under the account password (PBKDF2-SHA256 + AES-GCM-256). The pod holds only the wrapped form, so the pod's host cannot sign as you. |
-| `keys-browser.mjs` | Importing a keys record for signing, and finding one: this browser's opened copy in IndexedDB first, else the pod's. A wrapped one the browser has not opened yet raises `KeyPasswordNeeded`, which `boot.mjs` answers with the unlock pane — once per browser. |
+| `keys-browser.mjs` | Importing a keys record for signing, and finding one: this browser's opened copy in IndexedDB first, else the pod's. A wrapped one the browser has not opened yet raises `KeyPasswordNeeded`, which `boot.mjs` answers with the unlock pane — once per browser. The same pane offers a new key wrapped under the password used now, for someone who no longer has the sign-up password. |
 | `signup.mjs` | The `fedipod setup` flow, in the browser, up to publish: account, pod, credential, keys locked on the pod (owner-only ACL written *before* the key). Produces the credential/keys/config shapes the agent already reads. |
 | `shims/fedify-sig.mjs` | Browser stand-in for `@fedify/fedify/sig` (which will not bundle for a browser). `sign()` returns signed headers as data for the relay; `signRequest()` wraps it Fedify-shaped. Proven byte-identical to Fedify. |
 | `shims/node-crypto.mjs` | Browser stand-in for `node:crypto` — the small synchronous slice the agent uses, via crypto-browserify, plus native WebCrypto. |

package/web/app/agent.mjs

@@ -12,6 +12,7 @@ import { PodStore } from '../../lib/core/store.mjs';
 import { HttpStorage } from '../../lib/core/storage.mjs';
 import { Publisher } from '../../lib/core/publisher/index.mjs';
 import { Intake } from '../../lib/core/intake/index.mjs';
+import { C2S } from '../../lib/client/c2s.mjs';
 import { Lease } from '../../lib/core/lease.mjs';
 import { MastoApi } from '../../lib/client/masto/index.mjs';
 import { TagFeed } from '../../lib/connections/tagfeed.mjs';
@@ -84,6 +85,9 @@ export class BrowserAgent {
       // whole document back over newer state. Read what is actually there
       // before acting on it.
       await this.store.load({ force: true }).catch((e) => this.log(`re-reading state: ${e.message}`));
+      // Own posts the outbox names and the timeline index lacks come back
+      // here, before anything acts on the index.
+      await this.publisher.healStatuses().catch((e) => this.log(`healing the timeline index: ${e.message}`));
       // And start delivering again, since demote() stopped it. startQueue() is
       // idempotent, so a goActive() that was already active costs nothing.
       this.deliverer?.startQueue?.();
@@ -257,9 +261,14 @@ export class BrowserAgent {
     // read-only until the owner acts on it and it takes over. Written with fresh
     // fetches, never the cached store. Passed into Intake so the drain checks it.
     this.lease = new Lease({ url: this.urls.state + 'lease.json', fetchImpl: podFetch, log: this.log });
+    // The client-to-server dispatcher, here only for what the Gateway's
+    // outbox door takes on the owner's behalf: the browser answers no
+    // /ap/outbox of its own.
+    this.c2s = new C2S({ agent: this, log: this.log });
     this.intake = new Intake({
       config: this.store.getConfig(), urls: this.urls, remote: this.remote,
       store: this.store, deliverer: this.deliverer, publisher: this.publisher, log: this.log, push: true, lease: this.lease,
+      ownerPost: (a, o) => this.c2s.dispatch(a, o),
     });
     // The Mastodon facade the service worker serves.
     //
@@ -356,6 +365,7 @@ export class BrowserAgent {
       podRequests: this.remote?.stats?.() || null,
       update: null,
       inboxCooldownFor: 0,
+      stateSkipped: this.store?.lastSkipped || [],
     };
   }
 

package/web/app/boot.mjs

@@ -16,7 +16,7 @@ import { podBaseOfWebId } from '../../lib/pod/urls.mjs';
 import { podLayout } from '../../lib/pod/root.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
 import { beginLogin, completeLogin, getSession, signOut } from './oidc-session.mjs';
-import { unwrapKeys, isKeyEnvelope } from './keystore.mjs';
+import { generateKeys, wrapKeys, unwrapKeys, isKeyEnvelope } from './keystore.mjs';
 import { cacheOpenedKeys } from './keys-browser.mjs';
 
 const REDIRECT = `${location.origin}/`;   // the app root doubles as the OIDC callback
@@ -64,30 +64,50 @@ async function bootWorker({ reset = false } = {}) {
 //
 // The unwrap happens HERE, in the page, and not in the worker: the worker boots
 // itself whenever the browser restarts it, with nobody present to type anything.
-window.fedipodUnlock = async (password) => {
-  if (!password) throw new Error('Enter your account password.');
+//
+// Both paths below read the account's config and key the same way: with the
+// session, as the owner, through the transport rather than the bare session —
+// a pod read like any other, with the retry ladder that exists because the pod
+// host throttles bursts.
+async function readAccountState() {
   const session = await getSession();
   if (!session) throw new Error('Sign in first.');
-  // The config on the pod says where this account's state lives; the key sits
-  // beside it. Both are read with the session, as the owner.
   const podFromWebId = podBaseOfWebId(session.webId);   // a suffix-based host, or its own host
   const state = `${podFromWebId}${AP_ROOT}ap-state/`;
-  // Through the transport rather than the bare session: this is a pod read
-  // like any other, and going round it skipped the retry ladder that exists
-  // because the pod host throttles bursts.
   const remote = new BrowserRemotePod(session, { webId: session.webId, role: 'signup', log: () => {} });
   const urls = { state };
   const [cfg, doc] = await Promise.all([
     podState.readConfig(remote, urls), podState.readWrappedKeys(remote, urls),
   ]);
-  if (!cfg || !doc) throw new Error(`could not read this account's config and key under ${state}`);
+  if (!cfg) throw new Error(`could not read this account's config under ${state}`);
+  const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
+  return { remote, urls, cfg, doc, actorUrl };
+}
+
+window.fedipodUnlock = async (password) => {
+  if (!password) throw new Error('Enter your password.');
+  const { doc, actorUrl } = await readAccountState();
+  if (!doc) throw new Error('could not read this account\'s key on the pod');
   if (!isKeyEnvelope(doc)) throw new Error('this account\'s key is not locked — nothing to unlock');
   const rec = await unwrapKeys(doc, password);          // throws 'wrong password'
-  const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
   await cacheOpenedKeys(actorUrl, rec);
   await bootWorker();
 };
 
+// The same pane, for someone who no longer has the sign-up password: a new key,
+// wrapped under the password they use now, written over the pod's copy. Nothing
+// is unwrapped, so the old password is never needed. The boot that follows
+// publishes the new public key (agent.goActive → publishProfile).
+window.fedipodNewKey = async (password) => {
+  if (!password) throw new Error('Enter the password you use for your pod now.');
+  const { remote, urls, cfg, actorUrl } = await readAccountState();
+  const keys = await generateKeys();
+  keys.mintedFor = cfg.gateway?.frontActor || actorUrl;   // one key, one actor (signup.mjs)
+  await podState.writeWrappedKeys(remote, urls, await wrapKeys(keys, password));
+  await cacheOpenedKeys(actorUrl, keys);
+  await bootWorker();
+};
+
 // New account: create the account, pod, key, config and gateway attach (this
 // needs the password once), then redirect to the pod's login to establish the
 // durable session. The agent boots on return, reading config + key from the pod.
@@ -213,6 +233,25 @@ if (typeof document !== 'undefined') (async () => {
   };
   $('unlock-go')?.addEventListener('click', doUnlock);
   $('unlock-password')?.addEventListener('keydown', (e) => { if (e.key === 'Enter') doUnlock(); });
+  // The new-key path: one click reveals the confirmation, the second acts.
+  $('unlock-newkey')?.addEventListener('click', () => {
+    $('unlock-newkey-confirm').hidden = false;
+    $('unlock-password').focus();
+  });
+  const doNewKey = async () => {
+    $('unlock-error').textContent = '';
+    const btn = $('unlock-newkey-go'); btn.disabled = true;
+    try {
+      await window.fedipodNewKey($('unlock-password').value);
+      $('unlock-password').value = '';
+      location.href = '/admin/client/';
+    } catch (err) {
+      $('unlock-error').textContent = err.message || String(err);
+      btn.disabled = false;
+      $('unlock-password').select();
+    }
+  };
+  $('unlock-newkey-go')?.addEventListener('click', doNewKey);
 
 
   // The client shell's bar returns here for two things, and neither continues