fedipod-server 0.21.0 → 0.28.0

package/web/app/signup.mjs

@@ -1,26 +1,26 @@
-// signup.mjs — the setup flow of `fedipod setup`, run in the browser. It does
-// what lib/setup.mjs's runSetup does up to the publish step: create the account
-// and pod (or accept one you bring), mint a credential, make the signing keys
-// and lock them on the pod under the password. Publishing the actor is the
-// agent's first-run job, exactly as `connect()` publishes after `setup` mints —
-// so this module needs nothing from lib.
+// signup.mjs — the setup flow of `fedipod setup`, run in the browser, on the
+// pod session the person already holds. The pod exists before this runs: a
+// new one is made on the provider's own sign-up page, an existing one is
+// signed in to as it is. So there is no account API here, no credential and
+// no password — the session that signed in at the pod is the session that
+// writes to it. Publishing the actor is the agent's first-run job, exactly as
+// `connect()` publishes after `setup` mints — so this module needs nothing
+// from lib beyond the pod helpers.
 //
-// It returns the two things a browser must keep for itself: the credential and
-// the config. Neither is secret to the pod owner, but the credential is a pod
-// write key, so the caller stores it in this browser only, never on the pod.
-// The only thing this writes to the pod is the password-wrapped signing key.
+// What it writes to the pod: an owner-only state container holding the
+// signing key and the account config; and, with a gateway, the attach.
 
-import { createAccountWithPod, mintCredential, makeDpopSession, revokeCredential } from './pod-auth.mjs';
-import { generateKeys, wrapKeys } from './keystore.mjs';
+import { generateKeys, isKeyEnvelope } from './keystore.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
 import * as podState from '../../lib/pod/state.mjs';
 import { resourceExists } from '../../lib/pod/root.mjs';
+import { podBaseOfWebId } from '../../lib/pod/urls.mjs';
 import { cacheOpenedKeys } from './keys-browser.mjs';
 
 // The container everything the agent publishes hangs under. New pods made here
 // use `fedipod/`; new installs default to `fedipod/` too, and older ones keep
 // that predate this, so those pods are untouched. The name is stored on the
-// credential and the config, so the agent reads it rather than guessing.
+// config, so the agent reads it rather than guessing.
 export const AP_ROOT = 'fedipod/';
 const actorUrlFor = (pod) => `${pod}${AP_ROOT}ap/actor`;
 const keysDocFor = (pod) => `${pod}${AP_ROOT}ap-state/keys.json`;
@@ -35,29 +35,15 @@ export function handleProblem(handle) {
 }
 
 // Resume across a failed attempt. A run that throws part-way keeps what it
-// already achieved in this page session — the pod it made, the credential it
-// minted, the key it wrote — so a second attempt (the failure screen's Try
-// again) continues from the first unfinished step instead of restarting. The
-// record lives only in memory here: no secret is written to disk, and it is
-// dropped the moment the run completes. Keyed by the identity being built, so
-// changing the handle or pod on the form starts a clean attempt.
+// already achieved in this page session — the gateway it attached, the key it
+// wrote — so a second attempt (the failure screen's Try again) continues from
+// the first unfinished step instead of restarting. The record lives only in
+// memory here and is dropped the moment the run completes. Keyed by the
+// identity being built, so changing the handle on the form starts a clean
+// attempt.
 const PROGRESS = new Map();
-const progressKey = (a) => [a.issuer, a.mode, a.handle, a.mode === 'new' ? (a.podName || a.handle) : a.pod].join('|');
+const progressKey = (webId, a) => [webId, a.handle, a.shape || 'pod'].join('|');
 
-/**
- * Run sign-up. Steps are reported through onStep(key, state, note) so a page can
- * draw the same tick list the CLI setup shows. Resumable: see PROGRESS above.
- *
- * answers: { mode:'new'|'existing', issuer, email, password, handle,
- *            podName?, pod?, gateway?, shape?: 'pod'|'front' }
- *
- * `shape` is where the address lives. On the pod, `@handle@yourpod`, with the
- * gateway as a mail door only — the default. At the gateway, `@handle@front`,
- * a fronted identity whose documents still live on the pod. A pod on a path of
- * a suffix-based host cannot answer WebFinger, so it is fronted whatever was asked.
- *
- * returns: { credential, config, actorUrl, address, keysPublic }
- */
 /** A fronted name is one per gateway; a taken one is refused before anything is made. */
 async function assertFrontNameFree(frontOrigin, handle) {
   const res = await fetch(`${frontOrigin.replace(/\/$/, '')}/api/handle?handle=${encodeURIComponent(handle)}`,
@@ -67,19 +53,35 @@ async function assertFrontNameFree(frontOrigin, handle) {
   if (!d.available) throw new Error(d.reason || `the name @${handle}@${new URL(frontOrigin).host} is taken — choose another handle`);
 }
 
-export async function signUp(answers, { onStep = () => {}, frontOrigin = null } = {}) {
-  const { mode, issuer, email, password, handle } = answers;
+/**
+ * Run sign-up on a pod session. Steps are reported through onStep(key, state,
+ * note) so a page can draw the same tick list the CLI setup shows. Resumable:
+ * see PROGRESS above.
+ *
+ * answers: { handle, shape?: 'pod'|'front', gateway? }
+ * session: { webId, issuer, fetch } — the Solid-OIDC session from the pod's
+ *          own login (oidc-session.mjs). The pod is where the WebID lives.
+ *
+ * `shape` is where the address lives. On the pod, `@handle@yourpod`, with the
+ * gateway as a mail door only — the default. At the gateway, `@handle@front`,
+ * a fronted identity whose documents still live on the pod. A pod on a path of
+ * a suffix-based host cannot answer WebFinger, so it is fronted whatever was asked.
+ *
+ * returns: { config, actorUrl, address, pod, keys, keysPublic }
+ */
+export async function signUp(answers, { session, onStep = () => {}, frontOrigin = null } = {}) {
+  const { handle } = answers;
   const bad = handleProblem(handle);
   if (bad) throw new Error(bad);
-  if (!email) throw new Error('an email is required');           // recovery + account login
-  if (!password) throw new Error('a password is required');
-  if (mode === 'existing' && !answers.pod) throw new Error('a pod address is required');
+  if (!session?.webId || typeof session.fetch !== 'function') throw new Error('sign in at your pod first');
   const wantsFront = answers.shape === 'front';
   if (wantsFront && !frontOrigin) throw new Error('an address at the gateway needs a gateway, and this page has none');
   // A name at the gateway is one per gateway: settle it before making anything.
   if (wantsFront) await assertFrontNameFree(frontOrigin, handle);
 
-  const key = progressKey(answers);
+  const webId = session.webId;
+  const pod = podBaseOfWebId(webId);                 // its own host, or a path on a suffix-based one
+  const key = progressKey(webId, answers);
   const prog = PROGRESS.get(key) || {};
   PROGRESS.set(key, prog);                                       // resume record for this identity
 
@@ -89,28 +91,16 @@ export async function signUp(answers, { onStep = () => {}, frontOrigin = null }
     skip: (note) => onStep(key, 'skipped', note),
   });
 
-  // --- account + pod --- (skipped outright once a prior attempt has made it)
-  let accountToken = null;                                       // valid only within this call
-  const acct = step('account');
+  // --- the pod --- (the session came from it; what is checked is that it has no account yet)
+  const podStep = step('pod');
   if (!prog.pod) {
-    if (mode === 'new') {
-      acct.running('creating the account and pod');
-      const made = await createAccountWithPod({ issuer, email, password, podName: answers.podName || handle });
-      prog.pod = made.pod; prog.webId = made.webId; accountToken = made.accountToken;
-      acct.ok(made.pod);
-    } else {
-      const brought = answers.pod.endsWith('/') ? answers.pod : answers.pod + '/';
-      acct.running('checking your pod');
-      const head = await fetch(brought, { method: 'HEAD' }).catch(() => null);
-      if (!head || head.status >= 400) throw new Error(`the pod at ${brought} did not answer (HTTP ${head?.status || 'no response'})`);
-      if (await resourceExists(fetch, actorUrlFor(brought))) throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
-      prog.pod = brought;
-      acct.skip('using the pod you brought');
-    }
+    podStep.running('checking your pod');
+    if (await resourceExists(session.fetch, actorUrlFor(pod))) throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
+    prog.pod = pod;
+    podStep.ok(pod);
   } else {
-    acct.ok(prog.pod);                                          // resumed: the pod is already there
+    podStep.ok(prog.pod);                                        // resumed
   }
-  const pod = prog.pod; const webId = prog.webId || null;
 
   // WebFinger is answered only at a host root. A pod on a path of a shared
   // host therefore takes its address at the gateway, whatever was asked; a
@@ -125,54 +115,13 @@ export async function signUp(answers, { onStep = () => {}, frontOrigin = null }
   const actorUrl = actorUrlFor(pod);                              // where the documents live, always
   const frontActor = fronted ? `${frontOrigin.replace(/\/$/, '')}/u/${handle}/ap/actor` : null;
 
-  // --- credential --- (a fresh attempt re-mints; a resumed one reuses it)
-  const cred = step('credential');
-  let credential;
-  if (!prog.credential) {
-    cred.running('minting a credential for this browser');
-    // accountToken is null when the account step was skipped (a resume), so
-    // mintCredential logs in fresh with email+password rather than reusing a
-    // token that a prior attempt may have let go stale.
-    credential = await mintCredential({ issuer, email, password, webId, podUrl: pod, accountToken });
-    credential.remotePod = pod;
-    credential.root = AP_ROOT;                                   // the agent reads the container name from here
-    prog.credential = credential;
-    cred.ok();
-  } else {
-    credential = prog.credential;
-    cred.ok();
-  }
-
-  // A pod-writing session for the remaining pod writes and the gateway proof.
-  const session = await makeDpopSession(credential);
-
-  // --- keys, encrypted, in an owner-only container on the pod ---
-  //
-  // The durable copy is on the pod, because a browser has no disk you can carry
-  // to the next machine. That copy used to be the bare record, on the argument
-  // that the pod's owner-only ACL is protection enough and the pod host already
-  // holds your data. It is not the same thing: your data is your data, and the
-  // signing key IS you — whoever holds it is you to every server in the
-  // fediverse, for as long as the key lives, and no ACL reaches the host itself.
-  // So it is wrapped under the account password first, and the host stores
-  // ciphertext. (Three documents already said this was happening. Now it is.)
-  //
-  // Two things in that order, deliberately: the ACL BEFORE the key. Writing the
-  // key first leaves a window where a pod whose root is world-readable serves it
-  // to anyone who asks, and a brought pod is exactly the case where that root
-  // may be public.
-  //
-  // The opened copy is kept in this browser (IndexedDB) so the worker can boot
-  // itself after an idle kill with nobody there to type a password. A browser
-  // that has no copy asks for the password once — see boot.mjs.
   // Connect the gateway (fedipod.net) before the key is made, because a
   // fronted identity's key is stamped with the gateway actor. Inbox-only: the
   // actor advertises the door as its inbox and keeps its own ids. Fronted: the
   // gateway answers WebFinger for @handle@front and serves the actor at its own
   // address, rewriting reads onto the pod. Either way the door verifies each
   // delivery and forwards the clean mail to the pod; the agent trusts the
-  // door's receipt. The same DPoP session proves the pod to the gateway — no
-  // password reaches it.
+  // door's receipt. The pod session itself proves the pod to the gateway.
   let gateway = answers.gateway || prog.gateway || null;
   if (frontOrigin && !gateway) {
     const gw = step('gateway');
@@ -199,31 +148,46 @@ export async function signUp(answers, { onStep = () => {}, frontOrigin = null }
     step('gateway').ok();                                        // resumed
   }
 
+  // --- keys, in an owner-only container on the pod ---
+  //
+  // The durable copy is on the pod, because a browser has no disk you can carry
+  // to the next machine. It is stored as it is, behind the container's access
+  // rule: the same rule every private document on the pod lives under, so it
+  // is reachable through the pod's own login and by nobody else.
+  //
+  // Two things in that order, deliberately: the ACL BEFORE the key. Writing the
+  // key first leaves a window where a pod whose root is world-readable serves it
+  // to anyone who asks, and a brought pod is exactly the case where that root
+  // may be public.
+  //
+  // The opened copy is kept in this browser (IndexedDB) so the worker can boot
+  // itself after an idle kill with no read. A browser that has no copy reads
+  // the pod's with its session — see keys-browser.mjs.
+  const remote = new BrowserRemotePod(session, { webId, role: 'signup', log: () => {} });
   const keysStep = step('keys');
   let keys;
   if (!prog.keysStored) {
-    keysStep.running('making your signing key and locking it under your password');
+    keysStep.running('making your signing key and storing it on your pod');
     keys = await generateKeys();
     // One key, one actor (lib/keys.mjs): the actor the world knows, which for
     // a fronted identity is the gateway's address for it.
     keys.mintedFor = gateway?.frontActor || actorUrl;
-    const remote = new BrowserRemotePod(session, { webId: credential.webId, role: 'signup', log: () => {} });
     // Owner-only, and THEN the key — one operation, so the order cannot be got
     // wrong here or anywhere else. A pod that refuses the ACL write is not a
-    // pod this key may sit on, wrapped or not.
+    // pod this key may sit on.
     try {
       await podState.provisionKey(remote, {
         stateUrl: `${pod}${AP_ROOT}ap-state/`,
         keysUrl: keysDocFor(pod),
-        envelope: await wrapKeys(keys, password),
+        keys,
       });
     } catch (e) {
       throw new Error(`could not store the signing key on the pod (${e.message}). `
-        + `The credential is for ${credential.webId} — that WebID must own ${pod} and its ${AP_ROOT} must be writable by it.`);
+        + `You are signed in as ${webId} — that WebID must own ${pod} and its ${AP_ROOT} must be writable by it.`);
     }
-    // This browser's own opened copy, so the boot after the login redirect
-    // needs no password. Best effort: a browser that refuses IndexedDB (private
-    // mode) simply asks for the password on the way back in.
+    // This browser's own opened copy, so the boot that follows needs no read.
+    // Best effort: a browser that refuses IndexedDB (private mode) reads the
+    // pod's copy on the way back in.
     await cacheOpenedKeys(actorUrl, keys);
     prog.keys = keys; prog.keysStored = true;
     keysStep.ok();
@@ -233,46 +197,122 @@ export async function signUp(answers, { onStep = () => {}, frontOrigin = null }
   }
 
   const config = {
-    remotePod: pod, root: AP_ROOT, handle, name: handle, issuer: credential.issuerOrigin,
+    remotePod: pod, root: AP_ROOT, handle, name: handle, issuer: String(session.issuer || '').replace(/\/+$/, ''),
     createdAt: new Date().toISOString(),
     ...(gateway ? { gateway } : {}),
   };
   // Write the config to the pod (owner-only, beside the key) so a returning
   // sign-in — which arrives with only an OIDC session — can read the account's
-  // config and key from the pod and boot with no password.
-  const cfgRemote = new BrowserRemotePod(session, { webId: credential.webId, role: 'signup', log: () => {} });
+  // config and key from the pod and boot.
   try {
-    await podState.writeConfig(cfgRemote, { state: `${pod}${AP_ROOT}ap-state/` }, config);
+    await podState.writeConfig(remote, { state: `${pod}${AP_ROOT}ap-state/` }, config);
   } catch (e) {
     throw new Error(`could not store the config on the pod (${e.message})`);
   }
 
-  // The credential was for sign-up, and sign-up is over. The agent runs on the
-  // Solid-OIDC session from here on and never needs it again, so leaving it
-  // alive would leave permanent full access to the pod in a key nothing holds.
-  // Best effort: a server that will not delete it is a credential the owner can
-  // still revoke from their pod's account page, and not a reason to fail a
-  // sign-up that otherwise worked.
-  const revoked = await revokeCredential({
-    resource: credential.resource, accountToken: credential.accountToken,
-  });
-  delete credential.accountToken;              // never leaves this function
-  if (!revoked && credential.resource) {
-    onStep('credential', 'ok', 'this browser is ready (the setup credential could not be '
-      + 'revoked automatically — you can remove it from your pod\'s account page)');
-  }
-
   PROGRESS.delete(key);                                          // finished — nothing left to resume
 
   const host = gateway?.frontActor ? new URL(gateway.frontActor).host : new URL(pod).host;
   return {
-    credential, config, actorUrl,
+    config, actorUrl, pod,
     address: `@${handle}@${host}`,
     // The opened keys, for booting the agent in THIS browser session right away.
-    // The durable copy on the pod is wrapped under the account password; this
-    // browser also holds an opened one in IndexedDB (above), which is what the
-    // worker reads. A fresh browser asks for the password once and makes its own.
     keys,
     keysPublic: { rsa: keys.rsa.publicPem, ed25519: keys.ed25519?.publicPem || null },
   };
 }
+
+// ---- an account already on the pod ----
+
+/**
+ * What the pod already holds: null when there is no FediPod account on it,
+ * else its config, the pod, and where its address lives — `frontHost` is
+ * the gateway's host for an address at a gateway, null for one on the pod.
+ */
+export async function readAccount(session) {
+  const pod = podBaseOfWebId(session.webId);
+  const remote = new BrowserRemotePod(session, { webId: session.webId, role: 'signup', log: () => {} });
+  const config = await podState.readConfig(remote, { state: `${pod}${AP_ROOT}ap-state/` }).catch(() => null);
+  if (!config) return null;
+  const frontActor = config.gateway?.frontActor || null;
+  let frontHost = null;
+  try { frontHost = frontActor ? new URL(frontActor).host : null; } catch { frontHost = null; }
+  let podHost = '';
+  try { podHost = new URL(config.remotePod || pod).host; } catch { podHost = ''; }
+  return { pod, config, frontActor, frontHost, address: `@${config.handle}@${frontHost || podHost}` };
+}
+
+/**
+ * Move an account whose address lives at another gateway to this one. The
+ * pod, its posts, its followers and its key all stay where they are; what
+ * changes is the gateway that answers for it. This half does the pod's
+ * part: attach here, rewrite the config to name this gateway, restamp the
+ * key. The agent's first boot from that config publishes under the new
+ * ids, and then tells the old gateway and the followers (gateway-move.mjs).
+ *
+ * answers: { handle }  — the name here; the old one is the default.
+ * returns: { config, address, movedFrom }
+ */
+export async function moveIn(answers, { session, onStep = () => {}, frontOrigin = null } = {}) {
+  const { handle } = answers;
+  const bad = handleProblem(handle);
+  if (bad) throw new Error(bad);
+  if (!session?.webId || typeof session.fetch !== 'function') throw new Error('sign in at your pod first');
+  if (!frontOrigin) throw new Error('a move needs a gateway to move to, and this page has none');
+  const origin = frontOrigin.replace(/\/$/, '');
+  const step = (key) => ({ running: (note) => onStep(key, 'running', note), ok: (note) => onStep(key, 'ok', note) });
+
+  // --- the pod: the account that is there, and its key ---
+  const podStep = step('pod');
+  podStep.running('reading your account on your pod');
+  const here = await readAccount(session);
+  if (!here?.frontActor) throw new Error('this pod holds no account at another gateway to move here');
+  if (here.frontHost === new URL(origin).host) throw new Error('this account already lives at this gateway');
+  const { pod, config: old } = here;
+  const remote = new BrowserRemotePod(session, { webId: session.webId, role: 'signup', log: () => {} });
+  const urls = { state: `${pod}${AP_ROOT}ap-state/` };
+  const keys = await podState.readKeys(remote, urls);
+  if (!keys?.rsa) throw new Error('could not read this account\'s signing key on the pod');
+  if (isKeyEnvelope(keys)) throw new Error(`this account's key is still under a password from an earlier version — sign in once at ${here.frontHost} first, then come back`);
+  podStep.ok(here.address);
+
+  // --- this gateway: the name, then the attach, fronted ---
+  const gw = step('gateway');
+  gw.running(`taking your address at ${new URL(origin).host}`);
+  await assertFrontNameFree(origin, handle);
+  const res = await session.fetch(`${origin}/api/attach`, {
+    method: 'POST', headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ handle, podHome: `${pod}${AP_ROOT}`, actorUrl: actorUrlFor(pod), kind: old.kind || 'person', fronted: true }),
+  });
+  const d = await res.json().catch(() => ({}));
+  if (res.status !== 201 || !d.hmacSecret) throw new Error(`could not attach to this gateway (HTTP ${res.status}): ${d.error || ''}`);
+  const gateway = {
+    url: `${origin}/u/${handle}/ap/inbox/`, frontActor: String(d.frontActor || `${origin}/u/${handle}/ap/actor`),
+    hmacSecret: d.hmacSecret, mode: 'trust',
+  };
+  gw.ok();
+
+  // --- the pod again: the config names this gateway, the key is restamped ---
+  //
+  // The old actor becomes an alias, which is what a server checks on the new
+  // actor before it honours a Move. `movedFrom` is the pending half: the
+  // agent completes it after its first boot under the new ids.
+  const keysStep = step('keys');
+  keysStep.running('moving your key and account record to the new address');
+  const aliases = [...new Set([...(old.aliases || []), here.frontActor])];
+  const config = {
+    ...old, handle, gateway, aliases,
+    movedFrom: { actor: here.frontActor, gateway: new URL(here.frontActor).origin, handle: old.handle, at: new Date().toISOString() },
+  };
+  keys.mintedFor = gateway.frontActor;                          // one key, one actor (lib/keys.mjs)
+  try {
+    await podState.writeKeys(remote, urls, keys);
+    await podState.writeConfig(remote, urls, config);
+  } catch (e) {
+    throw new Error(`could not update your account on the pod (${e.message})`);
+  }
+  await cacheOpenedKeys(actorUrlFor(pod), keys);
+  keysStep.ok();
+
+  return { config, address: `@${handle}@${new URL(origin).host}`, movedFrom: config.movedFrom };
+}

package/web/app/sw-src.mjs

@@ -157,7 +157,7 @@ async function serve(request, url) {
   // Boot on demand from the stored session, so the client works even when the
   // worker was restarted (idle-killed) and nobody posted 'boot' this time.
   if (!agent) { try { await ensureBooting(); } catch { /* no session → 503 below */ } }
-  if (!agent) return json(503, { error: 'the agent is not booted yet — open the app from the sign-in page' });
+  if (!agent) return json(503, { error: 'not signed in on this browser — sign in at the front page' });
   // Bytes, not text. A multipart upload is binary — read as text it comes back
   // through a UTF-8 round trip that replaces every byte that is not valid UTF-8,
   // which is most of a JPEG, so the boundary search found nothing and every

package/web/app/update.js

@@ -0,0 +1,66 @@
+// update.js — a fedipod.net page notices a newer build and reloads itself once.
+//
+// The page carries the version it was staged with (a meta tag); the site
+// answers its current version at the handle probe. When they differ, the
+// worker is asked to update — it installs and takes over at once (sw-src.mjs
+// skips waiting and claims) — and the page reloads when the new worker takes
+// over, or after a moment if only the pages changed. A page with text in a
+// composer is not reloaded from under it: it shows a line with a button.
+(() => {
+  const mine = document.querySelector('meta[name="fedipod-version"]')?.content;
+  // The build this page was staged from. A version changes when a release is
+  // cut; a build changes every time the site is deployed, which is what a
+  // reader with the page open actually needs to hear about.
+  const myBuild = document.querySelector('meta[name="fedipod-build"]')?.content || null;
+  if (!mine) return;
+  const loadedAt = Date.now();
+  let acted = false;
+  const drafting = () => [...document.querySelectorAll('textarea')].some((t) => t.value.trim());
+  const banner = () => {
+    if (document.getElementById('fedipod-update')) return;
+    const d = document.createElement('div');
+    d.id = 'fedipod-update';
+    d.setAttribute('role', 'status');
+    d.style.cssText = 'position:fixed;left:0;right:0;bottom:0;z-index:2147483647;padding:1rem 1.25rem;'
+      + 'font:1rem/1.5 Arial, Helvetica, sans-serif;background:#1d1d1d;color:#fff;display:flex;gap:1rem;align-items:center;justify-content:center;flex-wrap:wrap';
+    const t = document.createElement('span');
+    t.textContent = 'A new version of FediPod is ready. Reload when you have finished writing.';
+    const b = document.createElement('button');
+    b.type = 'button'; b.textContent = 'Reload now';
+    b.style.cssText = 'font:inherit;padding:.5rem 1rem;border-radius:.5rem;border:1px solid #fff;background:#fff;color:#1d1d1d;cursor:pointer';
+    b.addEventListener('click', () => location.reload());
+    d.append(t, b);
+    document.body.append(d);
+  };
+  const go = () => {
+    if (acted) return;
+    acted = true;
+    if (drafting()) { acted = false; banner(); return; }
+    location.reload();
+  };
+  // A worker taking over a page that has been open a while is a new build;
+  // in a page's first seconds it is the boot, not an update.
+  if ('serviceWorker' in navigator) {
+    navigator.serviceWorker.addEventListener('controllerchange', () => { if (Date.now() - loadedAt > 5000) go(); });
+  }
+  const check = async () => {
+    try {
+      // The build first: it moves with every deploy. The version is the
+      // fallback for a page staged before builds were stamped.
+      if (myBuild) {
+        const b = await fetch('/build.json', { cache: 'no-store', headers: { accept: 'application/json' } })
+          .then(x => (x.ok ? x.json() : null)).catch(() => null);
+        if (b?.build && b.build !== myBuild) { go(); return; }
+      }
+      const r = await fetch('/api/handle?handle=__probe__', { cache: 'no-store', headers: { accept: 'application/json' } });
+      const v = (await r.json())?.version;
+      if (!v || v === mine) return;
+      const reg = await navigator.serviceWorker.getRegistration();
+      await reg?.update().catch(() => {});
+      setTimeout(go, 4000);   // a pages-only change: no new worker will take over
+    } catch { /* offline, or the site did not answer: try again later */ }
+  };
+  // Often enough that a reader watching a page being worked on sees it.
+  setTimeout(check, 5000);
+  setInterval(check, 60 * 1000);
+})();

package/web/front/admin.html

@@ -4,10 +4,11 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>FediPod — accounts on this server</title>
+<link rel="icon" href="/icons/gateway.svg" type="image/svg+xml">
 <style>
   :root { color-scheme: light dark; --line:#d9d4c7; --dim:#45443d; --accent:#6a8a5a; }
   @media (prefers-color-scheme: dark) { :root { --dim:#c2c0b4; } }
-  body { font: 19px/1.6 system-ui, sans-serif; max-width: 44rem; margin: 2rem auto; padding: 0 1.1rem; }
+  body { font: 20px/1.6 Arial, Helvetica, sans-serif; max-width: 44rem; margin: 2rem auto; padding: 0 1.1rem; }
   h1 { font-size: 1.7rem; margin: 0 0 .2rem; }
   p.lede { color: var(--dim); margin-top: 0; }
   label { display: block; font-weight: 600; margin: .8rem 0 .2rem; }
@@ -27,7 +28,9 @@
 <body>
 <h1>Accounts on this server</h1>
 <p class="lede">Every name this server answers for: accounts whose identity lives here, and
-accounts that only use it as their gateway. Sign in as the server's admin to see them.</p>
+accounts that only use it as their gateway. Sign in as the server's admin to see them.
+<a href="/notices">Notices</a> — what every account sees behind the bell in its bar — are
+written on their own page.</p>
 
 <form id="roster-form">
   <p class="field">
@@ -48,6 +51,5 @@ accounts that only use it as their gateway. Sign in as the server's admin to see
 </table>
 
 <script type="module" src="/admin.js"></script>
-<i>(cc) 4.0 By, Jeff Zucker, 2026</i>
 </body>
 </html>

package/web/front/new-account.html

@@ -4,10 +4,11 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>FediPod — access the Fediverse and ATProto from a Solid pod</title>
+<link rel="icon" href="/icons/gateway.svg" type="image/svg+xml">
 <style>
   :root { color-scheme: light dark; --line:#d9d4c7; --dim:#45443d; --accent:#6a8a5a; }
   @media (prefers-color-scheme: dark) { :root { --dim:#c2c0b4; } }
-  body { font: 19px/1.6 system-ui, sans-serif; max-width: 44rem; margin: 2rem auto; padding: 0 1.1rem; }
+  body { font: 20px/1.6 Arial, Helvetica, sans-serif; max-width: 44rem; margin: 2rem auto; padding: 0 1.1rem; }
   h1 { font-size: 1.7rem; margin: 0 0 .2rem; }
   h2 { font-size: 1.2rem; margin: 1.4rem 0 .4rem; }
   p.lede { color: var(--dim); margin-top: 0; }
@@ -30,6 +31,5 @@ FediPod is experimental and free to use.  See the <a href="https://github.com/je
 </p>
 
 <script src="/new-account.js"></script>
-<i style="text-align:right">(cc) 4.0 By, Jeff Zucker, 2026</i>
 </body>
 </html>

package/web/front/notices.html

@@ -0,0 +1,69 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>FediPod — notices</title>
+<link rel="icon" href="/icons/gateway.svg" type="image/svg+xml">
+<style>
+  :root { color-scheme: light dark; --line:#d9d4c7; --dim:#45443d; --accent:#6a8a5a; --danger:#b00020; }
+  @media (prefers-color-scheme: dark) { :root { --dim:#c2c0b4; --danger:#ff8a9a; } }
+  body { font: 20px/1.6 Arial, Helvetica, sans-serif; max-width: 44rem; margin: 2rem auto; padding: 0 1.1rem; }
+  h1 { font-size: 1.7rem; margin: 0 0 .2rem; }
+  h2 { font-size: 1.25rem; margin: 1.6rem 0 .4rem; }
+  p.lede { color: var(--dim); margin-top: 0; }
+  label { display: block; font-weight: 600; margin: .8rem 0 .2rem; }
+  input[type=url], input[type=text], textarea { width: 100%; padding: .5rem .6rem; font: inherit;
+    border: 1px solid var(--line); border-radius: 8px; box-sizing: border-box; }
+  textarea { min-height: 9rem; resize: vertical; }
+  .hint { color: var(--dim); font-size: .95rem; }
+  .primary { background: var(--accent); color: #fff; border: none; border-radius: 9px;
+    padding: .6rem 1.1rem; font: inherit; cursor: pointer; }
+  .primary[disabled] { opacity: .5; cursor: not-allowed; }
+  button { font: inherit; cursor: pointer; }
+  button.danger { color: var(--danger); background: none; border: 1px solid var(--danger); border-radius: 9px; padding: .4rem .8rem; }
+  [hidden] { display: none !important; }
+  ul.notices { list-style: none; padding: 0; margin: 1rem 0; }
+  ul.notices li { padding: .8rem 0; border-bottom: 1px solid var(--line); }
+  ul.notices .title { font-weight: 600; }
+  ul.notices .when { color: var(--dim); font-size: .95rem; margin-left: .6rem; }
+  ul.notices .body { white-space: pre-wrap; margin: .3rem 0 .6rem; }
+  ul.notices .actions button { margin-right: .6rem; }
+</style>
+</head>
+<body>
+<h1>Notices</h1>
+<p class="lede">What every account on this server sees behind the bell in its bar. Sign in as the
+server's admin to write, change or remove them. <a href="/roster">Back to the roster.</a></p>
+
+<form id="notices-form">
+  <p class="field">
+  <label for="notices-issuer">Your identity provider</label>
+  <input type="url" id="notices-issuer" autocomplete="off" value="https://solidcommunity.net">
+  </p>
+  <p class="actions">
+    <button type="submit" id="notices-signin" class="primary">Sign in &amp; manage notices</button>
+  </p>
+  <p class="hint" id="notices-note" hidden></p>
+</form>
+
+<section id="notices-editor" hidden>
+  <h2 id="editor-title">New notice</h2>
+  <form id="editor-form">
+    <label for="notice-title">Title</label>
+    <input type="text" id="notice-title" maxlength="120" autocomplete="off" required>
+    <label for="notice-body">Text</label>
+    <textarea id="notice-body" maxlength="4000" required></textarea>
+    <p class="hint">Plain text. A blank line starts a new paragraph; a web address becomes a link.</p>
+    <p class="actions">
+      <button type="submit" id="notice-save" class="primary">Publish</button>
+      <button type="button" id="notice-cancel" hidden>Cancel</button>
+    </p>
+  </form>
+  <h2>Published</h2>
+  <ul class="notices" id="notices-list"></ul>
+</section>
+
+<script type="module" src="/notices.js"></script>
+</body>
+</html>