fedipod-server 0.21.0 → 0.28.0

package/web/app/boot.mjs

@@ -6,17 +6,22 @@
 // that same session from IndexedDB. So a returning visit restores silently, and
 // a new browser signs in with one redirect.
 //
-//   New account:  fedipodSignup(answers)  — create the account, then redirect.
-//   Returning:    fedipodSignin({ issuer }) — redirect to the pod's login.
+//   New account:  fedipodPodLogin({ issuer }) — sign in at the pod, and come
+//                 back to the identity screen; fedipodSignup(answers) then
+//                 sets the account up on that session and boots.
+//   Move in:      the same door, on a pod whose account lives at ANOTHER
+//                 gateway: the identity screen becomes a move, and
+//                 fedipodMoveIn(answers) brings the address here.
+//   Returning:    fedipodSignin({ address }) — redirect to the pod's login.
 //   On every load: fedipodOnLoad() — finish a redirect, or restore, then boot.
-import { signUp, handleProblem, AP_ROOT } from './signup.mjs';
+import { signUp, moveIn, readAccount, handleProblem, AP_ROOT } from './signup.mjs';
 import * as podActor from '../../lib/pod/actor.mjs';
 import * as podState from '../../lib/pod/state.mjs';
 import { podBaseOfWebId } from '../../lib/pod/urls.mjs';
-import { podLayout } from '../../lib/pod/root.mjs';
+import { resourceExists } from '../../lib/pod/root.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
 import { beginLogin, completeLogin, getSession, signOut } from './oidc-session.mjs';
-import { generateKeys, wrapKeys, unwrapKeys, isKeyEnvelope } from './keystore.mjs';
+import { generateKeys, unwrapKeys, isKeyEnvelope } from './keystore.mjs';
 import { cacheOpenedKeys } from './keys-browser.mjs';
 
 const REDIRECT = `${location.origin}/`;   // the app root doubles as the OIDC callback
@@ -55,12 +60,11 @@ async function bootWorker({ reset = false } = {}) {
   await booted;
 }
 
-// A browser that has signed in but has never opened this account's signing key.
-//
-// The key on the pod is wrapped under the account password (signup.mjs), which
-// is what keeps the pod's host from being able to sign as you. Opening it needs
-// the password once per browser; after that the opened copy lives in this
-// origin's IndexedDB and the worker boots from it with nothing to ask.
+// An account made before 1.28.0, whose key on the pod is still under the
+// sign-up password. Since 1.28.0 the key is stored as it is, behind the pod's
+// own login, and a new browser reads it with its session (keys-browser.mjs).
+// One of these older accounts is opened once, with the password, and the key
+// is then written back as it is — so no browser ever asks again.
 //
 // The unwrap happens HERE, in the page, and not in the worker: the worker boots
 // itself whenever the browser restarts it, with nobody present to type anything.
@@ -77,7 +81,7 @@ async function readAccountState() {
   const remote = new BrowserRemotePod(session, { webId: session.webId, role: 'signup', log: () => {} });
   const urls = { state };
   const [cfg, doc] = await Promise.all([
-    podState.readConfig(remote, urls), podState.readWrappedKeys(remote, urls),
+    podState.readConfig(remote, urls), podState.readKeys(remote, urls),
   ]);
   if (!cfg) throw new Error(`could not read this account's config under ${state}`);
   const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
@@ -86,36 +90,61 @@ async function readAccountState() {
 
 window.fedipodUnlock = async (password) => {
   if (!password) throw new Error('Enter your password.');
-  const { doc, actorUrl } = await readAccountState();
+  const { remote, urls, doc, actorUrl } = await readAccountState();
   if (!doc) throw new Error('could not read this account\'s key on the pod');
-  if (!isKeyEnvelope(doc)) throw new Error('this account\'s key is not locked — nothing to unlock');
+  if (!isKeyEnvelope(doc)) throw new Error('this account\'s key is not under a password — nothing to unlock');
   const rec = await unwrapKeys(doc, password);          // throws 'wrong password'
+  // Stored as it is from here on: the next browser reads it with the pod
+  // login and asks for nothing.
+  await podState.writeKeys(remote, urls, rec);
   await cacheOpenedKeys(actorUrl, rec);
   await bootWorker();
 };
 
-// The same pane, for someone who no longer has the sign-up password: a new key,
-// wrapped under the password they use now, written over the pod's copy. Nothing
-// is unwrapped, so the old password is never needed. The boot that follows
-// publishes the new public key (agent.goActive → publishProfile).
-window.fedipodNewKey = async (password) => {
-  if (!password) throw new Error('Enter the password you use for your pod now.');
+// The same pane, for someone who no longer has the old password: a new key,
+// stored as it is, written over the pod's copy. Nothing is unwrapped, so the
+// old password is never needed. The boot that follows publishes the new public
+// key (agent.goActive → publishProfile).
+window.fedipodNewKey = async () => {
   const { remote, urls, cfg, actorUrl } = await readAccountState();
   const keys = await generateKeys();
   keys.mintedFor = cfg.gateway?.frontActor || actorUrl;   // one key, one actor (signup.mjs)
-  await podState.writeWrappedKeys(remote, urls, await wrapKeys(keys, password));
+  await podState.writeKeys(remote, urls, keys);
   await cacheOpenedKeys(actorUrl, keys);
   await bootWorker();
 };
 
-// New account: create the account, pod, key, config and gateway attach (this
-// needs the password once), then redirect to the pod's login to establish the
-// durable session. The agent boots on return, reading config + key from the pod.
-window.fedipodSignup = async ({ onStep, ...answers }) => {
-  await signUp(answers, { onStep, frontOrigin: location.origin });
-  const { authorizationUrl } = await beginLogin({ issuer: answers.issuer, redirectUri: REDIRECT });
+// New account, first half: sign in at the pod. The pod already exists — made
+// on the provider's own page, or brought — and its login is the only place
+// a password is ever typed. `returnTo` marks the way back as a sign-up, so
+// the load that follows shows the identity screen instead of booting.
+const SIGNUP_RETURN = 'signup';
+const issuerOf = (v) => { let s = String(v || '').trim(); if (!s) throw new Error('A pod provider is required.'); if (!/^https?:\/\//i.test(s)) s = 'https://' + s; return new URL(s).origin; };
+window.fedipodPodLogin = async ({ issuer }) => {
+  const { authorizationUrl } = await beginLogin({ issuer: issuerOf(issuer), redirectUri: REDIRECT, returnTo: SIGNUP_RETURN });
   location.href = authorizationUrl;
 };
+// Second half, back on the session: key, config and gateway attach on the pod,
+// then the agent boots here. Nothing is typed and nothing leaves the browser
+// but pod writes on the session the pod itself issued.
+window.fedipodSignup = async ({ onStep, ...answers }) => {
+  const session = await getSession();
+  if (!session) throw new Error('Sign in at your pod first.');
+  await signUp(answers, { session, onStep, frontOrigin: location.origin });
+  await bootWorker({ reset: true });
+};
+// An account whose address lives at another gateway, moving here: the pod's
+// part (signup.mjs moveIn), then a boot under the new ids, which finishes
+// the move by telling the old gateway and the followers (gateway-move.mjs).
+window.fedipodMoveIn = async ({ onStep, ...answers }) => {
+  const session = await getSession();
+  if (!session) throw new Error('Sign in at your pod first.');
+  await moveIn(answers, { session, onStep, frontOrigin: location.origin });
+  await bootWorker({ reset: true });
+};
+// Set on the load that finds an account at another gateway; read by the
+// identity screen, which then offers a move instead of a new account.
+let moveFrom = null;
 
 // Returning / new browser: sign-in takes the full Fediverse address, @you@yourpod.
 // The host part IS the pod (a FediPod address lives at a host root), so the pod is
@@ -150,6 +179,7 @@ async function issuerForPod(pod) {
 async function podForFrontedAddress(handle) {
   const res = await fetch(`/.well-known/webfinger?resource=${encodeURIComponent(`acct:${handle}@${location.host}`)}`,
     { headers: { accept: 'application/jrd+json, application/json' } }).catch(() => null);
+  if (res?.status === 410) throw new Error(`@${handle}@${location.host} is closed: nothing on the pod behind it was touched, but the address is gone for good.`);
   if (!res || res.status >= 400) throw new Error(`nobody at this site is called @${handle}@${location.host}`);
   const doc = await res.json().catch(() => ({}));
   const podActorId = (doc.aliases || []).find((a) => /\/ap\/actor$/u.test(String(a)));
@@ -171,11 +201,22 @@ window.fedipodSignin = async ({ address }) => {
   location.href = authorizationUrl;
 };
 
-// Called on every page load. Returns 'signed-in' | 'restored' | 'anonymous'.
+// Called on every page load. Returns 'signed-in' | 'restored' | 'anonymous' |
+// 'signup' | 'move-in' — the last two being a return from the pod's login
+// in the middle of creating an account: with no account on the pod yet, or
+// with one whose address lives at another gateway.
 window.fedipodOnLoad = async () => {
   if (new URLSearchParams(location.search).get('code')) {
-    await completeLogin({ currentUrl: location.href });
+    const done = await completeLogin({ currentUrl: location.href });
     history.replaceState({}, '', REDIRECT);
+    if (done?.returnTo === SIGNUP_RETURN) {
+      const here = await readAccount(done).catch(() => null);
+      if (!here) return 'signup';
+      // An address at ANOTHER gateway: "create an account" here is a move
+      // in, not a second account. One at this gateway, or on the pod
+      // itself, is a sign-in.
+      if (here.frontHost && here.frontHost !== location.host) { moveFrom = here; return 'move-in'; }
+    }
     await bootWorker({ reset: true });        // this may be a different account
     return 'signed-in';
   }
@@ -209,6 +250,9 @@ window.fedipodHandleProblem = handleProblem;
 if (typeof document !== 'undefined') (async () => {
   const $ = (id) => document.getElementById(id);
   const params = new URLSearchParams(location.search);
+  // Set by the load below and acted on at the end, once the form is wired:
+  // the identity screen needs the step machine, which is built further down.
+  let pendingIdentity = false;
 
   // --- unlock: this browser's first use of an account whose key is locked ---
   //
@@ -242,13 +286,12 @@ if (typeof document !== 'undefined') (async () => {
     $('unlock-error').textContent = '';
     const btn = $('unlock-newkey-go'); btn.disabled = true;
     try {
-      await window.fedipodNewKey($('unlock-password').value);
+      await window.fedipodNewKey();
       $('unlock-password').value = '';
       location.href = '/admin/client/';
     } catch (err) {
       $('unlock-error').textContent = err.message || String(err);
       btn.disabled = false;
-      $('unlock-password').select();
     }
   };
   $('unlock-newkey-go')?.addEventListener('click', doNewKey);
@@ -278,16 +321,96 @@ if (typeof document !== 'undefined') (async () => {
         return;
       }
       // We logged in (or had a saved session) but the agent could not start.
-      // Show exactly why — including where it threw — instead of silently
-      // dropping back to the landing, which hides every real failure.
+      // What the agent could name. Most of these the page can act on ITSELF,
+      // and does: a sign-in the pod will not take is renewed (and, if the
+      // renewal is refused too, taken back to the pod's own login), and a pod
+      // that was busy or unreachable is asked again on a timer. Nobody is
+      // asked to press a button to find out what happened, and nobody is left
+      // pressing Reload by hand. A button is still there for whoever does not
+      // want to wait — and for the failures where waiting would not help.
+      //
+      // Each automatic step happens ONCE per tab (`once` below): a renewal
+      // that comes back refused, or a retry that fails the same way, means
+      // something the page cannot fix, and the reader gets the message rather
+      // than a loop.
+      const once = (key) => {
+        try {
+          if (sessionStorage.getItem(key)) return false;
+          sessionStorage.setItem(key, '1');
+          return true;
+        } catch { return false; }        // no storage: never automatic, always the button
+      };
+      const reload = () => location.reload();
+      const signIn = () => { location.href = '/?add'; };
+      const known = {
+        'sign-in-refused': { title: 'Your pod refused this sign-in', retry: 'Sign in again', go: signIn },
+        'pod-busy': { title: 'Your pod is asking for a pause', retry: 'Reload', go: reload, wait: 45 },
+        'pod-error': { title: 'Your pod had an error', retry: 'Reload', go: reload, wait: 20 },
+        'pod-unreachable': { title: 'Your pod could not be reached', retry: 'Reload', go: reload, wait: 20 },
+        // A session with no account behind it is a sign-up that has not
+        // happened yet — the person who closed the tab between the pod's
+        // login and the identity screen lands here.
+        'no-account-here': { title: 'No FediPod account in that pod', retry: 'Create one on this pod', go: () => showIdentity() },
+        'no-account': { title: 'No FediPod account in that pod', retry: 'Create one on this pod', go: () => showIdentity() },
+        'device-account': { title: 'This account is run from a device', retry: 'Use another pod', go: signIn },
+        'address-closed': { title: 'This address is closed', retry: 'Sign in with another account', go: signIn },
+      }[e.code];
+
+      // A sign-in the pod would not take: renew it here, and if the pod will
+      // not renew it either, go to the pod's own login. Both without asking.
+      if (e.code === 'sign-in-refused' && once('fedipod-renewing')) {
+        $('loading').hidden = true; $('hero').hidden = true; $('landing').hidden = true;
+        $('brand').hidden = false; $('running').hidden = false;
+        $('running-title').textContent = 'Renewing your sign-in';
+        // Not red: nothing has gone wrong for the reader yet, something is
+        // being done about it. The pane is shared with the real failures,
+        // which keep the alarm colouring.
+        $('run-error').style.color = 'var(--sub)';
+        $('run-error').style.borderLeftColor = 'var(--line)';
+        $('run-error').textContent = 'Your pod would not take the sign-in this browser is holding. Renewing it now.';
+        $('run-actions').hidden = true;
+        const session = await getSession().catch(() => null);
+        if (session) {
+          try {
+            await session.refresh();
+            location.reload();                     // renewed: boot again with it
+            return;
+          } catch { /* the pod will not renew it either: its login is the only way */ }
+          try {
+            const { authorizationUrl } = await beginLogin({ issuer: session.issuer, redirectUri: REDIRECT });
+            location.href = authorizationUrl;
+            return;
+          } catch { /* cannot even reach the login: fall through and say so */ }
+        }
+      }
+
       console.error(e);
       $('loading').hidden = true; $('hero').hidden = true; $('landing').hidden = true;
       $('brand').hidden = false; $('running').hidden = false;
-      $('running-title').textContent = 'Signed in, but the agent could not start';
+      $('running-title').textContent = known ? known.title : 'Signed in, but the agent could not start';
       $('run-error').style.whiteSpace = 'pre-wrap';
-      $('run-error').textContent = (e.message || String(e)) + (e.detail ? `\n\n${e.detail}` : '');
+      $('run-error').textContent = (e.message || String(e)) + (!known && e.detail ? `\n\n${e.detail}` : '');
       $('run-actions').hidden = false;
-      $('run-retry').textContent = 'Reload'; $('run-retry').addEventListener('click', () => location.reload());
+      // The button that leads somewhere goes first. The pane is shared with the
+      // sign-up flow, where "Start over" leads and "Try again" follows; here
+      // the reader is being told what to do, so what to do is the first thing
+      // under it.
+      $('run-actions').prepend($('run-retry'));
+      $('run-retry').textContent = known ? known.retry : 'Reload';
+      $('run-retry').addEventListener('click', known ? known.go : reload);
+      // Busy, broken or out of reach: the transport already climbed its own
+      // retry ladder to get here, so this waits longer and asks once more by
+      // itself. The button counts down so the wait is not a blank stare, and
+      // pressing it goes now.
+      if (known?.wait && once(`fedipod-waited-${e.code}`)) {
+        let left = known.wait;
+        const tick = () => {
+          $('run-retry').textContent = left > 0 ? `Trying again in ${left}s` : 'Trying again…';
+          if (left-- <= 0) { clearInterval(timer); location.reload(); }
+        };
+        const timer = setInterval(tick, 1000);
+        tick();
+      }
       $('run-back').textContent = 'Sign out'; $('run-back').addEventListener('click', async () => { try { await window.fedipodSignOut(); } catch {} location.href = '/'; });
       return;
     }
@@ -296,16 +419,40 @@ if (typeof document !== 'undefined') (async () => {
     // a fresh session and forwards deep links on a returning one, so both a
     // fresh sign-in and a restored session land in the same place.
     if (state === 'signed-in' || state === 'restored') { location.href = '/admin/client/'; return; }
-
-    // Anonymous: show the landing (sign-in address + create-account); form stays hidden.
-    $('loading').hidden = true;
-    $('landing').hidden = false;
+    // Back from the pod's login with no account there yet, or with one to
+    // move here: the identity screen, once the form below is wired.
+    if (state === 'signup' || state === 'move-in') pendingIdentity = true;
+    else {
+      // Anonymous: show the landing (sign-in address + create-account); form stays hidden.
+      $('loading').hidden = true;
+      $('landing').hidden = false;
+    }
   }
 
   // Views. The register form stands alone: the marketing hero and the sign-in
   // landing give way to the short brand, so only "FediPod" and the form show.
   const showLanding = () => { $('pane-form').hidden = true; $('running').hidden = true; $('brand').hidden = true; $('hero').hidden = false; $('landing').hidden = false; };
   const showForm = () => { $('hero').hidden = true; $('landing').hidden = true; $('brand').hidden = false; $('pane-form').hidden = false; goStep(1); };
+  // The identity screen, on a pod session: the pod is read off the WebID and
+  // fixes what the form can offer (a path pod is fronted, no choice). For a
+  // move in, the handle is the old one to start with, the address lives here
+  // by definition, and the button says what it does.
+  let signedPod = '';
+  async function showIdentity() {
+    const session = await getSession();
+    if (!session) { showLanding(); return; }
+    signedPod = podBaseOfWebId(session.webId);
+    $('loading').hidden = true; $('hero').hidden = true; $('landing').hidden = true; $('running').hidden = true;
+    $('brand').hidden = false; $('pane-form').hidden = false;
+    $('signed-pod').textContent = signedPod;
+    $('movein-note').hidden = !moveFrom;
+    if (moveFrom) {
+      $('movein-from').textContent = moveFrom.address;
+      if (!f().handle.value) f().handle.value = moveFrom.config.handle;
+      $('submit').textContent = 'Move your account here';
+    }
+    goStep(2);
+  }
 
 
   // --- sign in: the full @you@yourpod address → redirect to your pod's login ---
@@ -317,64 +464,51 @@ if (typeof document !== 'undefined') (async () => {
   $('signin').addEventListener('click', doSignin);
   $('signin-address').addEventListener('keydown', (e) => { if (e.key === 'Enter') { e.preventDefault(); doSignin(); } });
 
-  // --- register form: two screens, pod first then Fediverse identity ---
+  // --- register form: two screens, the pod's login first, then the identity ---
   const f = () => $('form').elements;
   // The pod provider is a free-text URL; default and normalise to a scheme.
   // The provider is picked from the list, or typed under "Other…".
   const providerUrl = () => { let v = (f().provider.value || f().providerOther.value).trim(); if (!v) return ''; if (!/^https?:\/\//i.test(v)) v = 'https://' + v; return v; };
   const providerHost = () => { try { return new URL(providerUrl()).host; } catch { return ''; } };
-  // A new pod is named by its subdomain under the provider; an existing pod is
-  // brought by its address, which may be its own host or a path on a shared one.
-  const podHostOf = () => { const sub = f().podName.value.trim().toLowerCase(); const ph = providerHost(); return (sub && ph) ? `${sub}.${ph}` : ''; };
-  const podUrl = () => { let v = f().pod.value.trim(); if (!v) return ''; if (!/^https?:\/\//i.test(v)) v = 'https://' + v; if (!v.endsWith('/')) v += '/'; try { return new URL(v).href; } catch { return ''; } };
-  // A pod on a suffix-based host cannot answer WebFinger, so its address
-  // lives at this site; a pod at its own host root gets the choice.
-  const isPathPod = (u) => { try { return new URL(u).pathname !== '/'; } catch { return false; } };
-  // Where the chosen provider puts new pods, asked of the provider itself
-  // (lib/pod/root.mjs podLayout) and remembered per provider: 'host', 'path',
-  // or null when it would not say.
-  const layouts = new Map();
-  let layout = null;
-  const learnLayout = async () => {
-    const origin = providerHost() ? new URL(providerUrl()).origin : '';
-    if (!origin) { layout = null; return; }
-    if (!layouts.has(origin)) layouts.set(origin, podLayout(fetch, origin).catch(() => null));
-    const known = await layouts.get(origin);
-    if (providerHost() && new URL(providerUrl()).origin === origin) { layout = known; applyShape(); previewAddr(); }
-  };
-  const pathPod = () => (f().mode.value === 'existing' ? isPathPod(podUrl()) : layout === 'path');
-  const shape = () => (pathPod() ? 'front' : f().shape.value);
-  const answers = () => {
-    const mode = f().mode.value;
-    const a = { mode, handle: f().handle.value.trim().toLowerCase(), email: f().email.value.trim(),
-      password: f().password.value, issuer: providerUrl(), shape: shape() };
-    if (mode === 'new') a.podName = f().podName.value.trim().toLowerCase();
-    else a.pod = podUrl();
-    return a;
+  // Where a new pod is made: the provider's own sign-up page. Every provider
+  // in the list runs Community Solid Server, whose page is at this path; a
+  // typed provider gets its front page, which links to it.
+  const registerUrl = () => {
+    if (!providerHost()) return '';
+    const origin = new URL(providerUrl()).origin;
+    return f().provider.value ? `${origin}/.account/login/password/register/` : `${origin}/`;
   };
+  // A pod on a suffix-based host cannot answer WebFinger, so its address
+  // lives at this site; a pod at its own host root gets the choice. Known
+  // from the signed-in pod, not guessed from the provider.
+  const pathPod = () => { try { return new URL(signedPod).pathname !== '/'; } catch { return false; } };
+  // A move between gateways is an address at a gateway: no choice either.
+  const shape = () => ((pathPod() || moveFrom) ? 'front' : f().shape.value);
+  const answers = () => ({ handle: f().handle.value.trim().toLowerCase(), shape: shape() });
   const previewAddr = () => {
     const handle = f().handle.value.trim().toLowerCase();
-    const host = shape() === 'front' ? location.host
-      : (f().mode.value === 'existing' ? (podUrl() ? new URL(podUrl()).host : '') : podHostOf());
+    let host = '';
+    try { host = shape() === 'front' ? location.host : new URL(signedPod).host; } catch { host = ''; }
     $('preview').textContent = (handle && host) ? `@${handle}@${host}` : '@…@…';
   };
   // The shape choice is fixed for a path pod, and open for a host-root pod.
   // A path pod has no choice to make: the radios go away and the note says why.
   const applyShape = () => {
-    const fixed = pathPod();
+    const fixed = pathPod() || !!moveFrom;
     for (const r of f().shape) { if (fixed) r.checked = r.value === 'front'; }
     $('shape-group').hidden = fixed;
-    $('shape-hint').hidden = !fixed;
+    $('shape-hint').hidden = !fixed || !!moveFrom;   // a move explains itself in its own note
   };
   const applyMode = () => {
     const existing = f().mode.value === 'existing';
-    $('pod-field').hidden = !existing;
-    $('podname-field').hidden = existing;
+    $('newpod-field').hidden = existing;
     $('provider-other-field').hidden = f().provider.value !== '';
+    const url = registerUrl();
+    $('register-link').href = url || '#';
+    $('register-link').textContent = providerHost() ? `Create your pod at ${providerHost()}` : 'Create your pod at your provider';
   };
   for (const el of $('form').elements) for (const evt of ['input', 'change']) el.addEventListener(evt, () => { applyMode(); applyShape(); previewAddr(); });
-  for (const evt of ['input', 'change']) { $('provider').addEventListener(evt, learnLayout); $('providerOther').addEventListener(evt, learnLayout); }
-  applyMode(); learnLayout();
+  applyMode();
 
   // Step machine: one screen at a time, each gated by its own validation.
   const STEP_IDS = ['step-1', 'step-2'];
@@ -382,21 +516,11 @@ if (typeof document !== 'undefined') (async () => {
   const goStep = (n) => {
     STEP_IDS.forEach((id, i) => { $(id).hidden = i !== n - 1; });
     $('err-1').textContent = ''; $('form-error').textContent = '';
-    if (n === 2) { applyShape(); previewAddr(); learnLayout(); }
+    if (n === 2) { applyShape(); previewAddr(); }
     if (FOCUS[n]) $(FOCUS[n]).focus();
   };
   const validateStep1 = () => {
     if (!providerHost()) return f().provider.value === '' ? 'A pod provider address is required under Other….' : 'A valid pod provider URL is required.';
-    if (f().mode.value === 'existing') {
-      if (!podUrl()) return 'A pod address is required, like https://alice.solidcommunity.net/ or https://server.example/alice/.';
-    } else {
-      const sub = f().podName.value.trim().toLowerCase();
-      if (!sub) return 'A pod username/subdomain is required.';
-      const sp = window.fedipodHandleProblem(sub);
-      if (sp) return `Pod username: ${sp}`;
-    }
-    if (!f().email.value.trim()) return 'A pod email is required.';
-    if (!f().password.value) return 'A pod password is required.';
     return null;
   };
   const validateStep2 = () => {
@@ -406,33 +530,47 @@ if (typeof document !== 'undefined') (async () => {
   };
   $('create').addEventListener('click', showForm);
   $('cancel').addEventListener('click', () => { showLanding(); goStep(1); });
-  $('to-2').addEventListener('click', () => { const e = validateStep1(); if (e) { $('err-1').textContent = e; return; } goStep(2); });
+  // Off to the pod's login. The identity screen is shown by the load that
+  // brings the person back (fedipodOnLoad → 'signup').
+  $('to-2').addEventListener('click', async () => {
+    const e = validateStep1(); if (e) { $('err-1').textContent = e; return; }
+    $('err-1').textContent = ''; $('to-2').disabled = true;
+    try { await window.fedipodPodLogin({ issuer: providerUrl() }); }
+    catch (err) { $('err-1').textContent = err.message || String(err); $('to-2').disabled = false; }
+  });
   $('back-1').addEventListener('click', () => goStep(1));
 
   // From the setup screen back to the form (a failed run) or the landing.
   const backToForm = (errMsg) => {
     $('running').hidden = true; $('brand').hidden = false; $('pane-form').hidden = false;
-    goStep(1);
-    if (errMsg) $('err-1').textContent = errMsg;   // remind them what failed
+    goStep(2);
+    if (errMsg) $('form-error').textContent = errMsg;   // remind them what failed
   };
   $('run-retry').addEventListener('click', () => backToForm($('run-error').textContent));
   $('run-back').addEventListener('click', () => { showLanding(); goStep(1); });
 
-  const LABELS = { account: 'Creating your account and pod', credential: 'Preparing this browser', keys: 'Making your signing key', gateway: 'Connecting your mail door' };
+  const LABELS = { pod: 'Checking your pod', keys: 'Making your signing key', gateway: 'Connecting your mail door' };
+  const MOVE_LABELS = { pod: 'Reading your account on your pod', gateway: 'Taking your address here', keys: 'Moving your key and account record' };
   $('form').addEventListener('submit', async (e) => {
     e.preventDefault(); $('form-error').textContent = '';
-    const e1 = validateStep1(); if (e1) { $('form-error').textContent = e1; goStep(1); $('err-1').textContent = e1; return; }
     const e2 = validateStep2(); if (e2) { $('form-error').textContent = e2; goStep(2); return; }
     const a = answers();
     $('pane-form').hidden = true; $('running').hidden = false;
     $('running-title').textContent = 'Setting up…'; $('run-error').textContent = ''; $('run-actions').hidden = true;
     const steps = $('steps'); steps.textContent = ''; const mark = {};
-    const onStep = (k, st) => { if (!mark[k]) { const li = document.createElement('li'); steps.appendChild(li); mark[k] = li; } mark[k].textContent = (st === 'ok' ? '✓ ' : st === 'running' ? '… ' : '') + (LABELS[k] || k); };
-    try { await window.fedipodSignup({ ...a, onStep }); }
+    const labels = moveFrom ? MOVE_LABELS : LABELS;
+    const onStep = (k, st) => { if (!mark[k]) { const li = document.createElement('li'); steps.appendChild(li); mark[k] = li; } mark[k].textContent = (st === 'ok' ? '✓ ' : st === 'running' ? '… ' : '') + (labels[k] || k); };
+    try {
+      if (moveFrom) await window.fedipodMoveIn({ handle: a.handle, onStep });
+      else await window.fedipodSignup({ ...a, onStep });
+      location.href = '/admin/client/';
+    }
     catch (err) {
       $('running-title').textContent = 'Setup did not finish';
       $('run-error').textContent = err.message || String(err);
       $('run-actions').hidden = false;                // the way out of the failure screen
     }
   });
+
+  if (pendingIdentity) await showIdentity();
 })();