fedipod-server 0.21.0 → 0.28.0

package/web/front/notices.js

@@ -0,0 +1,107 @@
+// notices.js — the notices page's script: the admin signs in, then writes,
+// changes and removes the notices every account here sees behind the bell.
+// Served by the front at /notices.js, like admin.js for the roster.
+const $ = (id) => document.getElementById(id);
+const note = (text) => { const n = $('notices-note'); n.hidden = !text; n.textContent = text || ''; };
+
+let session = null;
+try {
+  const { SessionCore } = await import('/solid-oidc-client.js');
+  session = new SessionCore({ redirect_uris: [location.origin + '/notices'], client_name: 'FediPod admin' });
+} catch { /* leave null — the "did not load" note fires */ }
+
+$('notices-issuer').addEventListener('input', () => {
+  $('notices-signin').disabled = !/^https?:\/\/\S+/.test($('notices-issuer').value.trim());
+});
+
+$('notices-form').addEventListener('submit', (ev) => {
+  ev.preventDefault();
+  if (!session) { note('the sign-in library did not load — reload and try again'); return; }
+  session.login($('notices-issuer').value.trim(), location.origin + '/notices')
+    .catch((e) => note('sign-in failed to start: ' + e.message));
+});
+
+(async () => {
+  if (!session) return;
+  await session.handleRedirectFromLogin().catch(() => {});
+  if (!session.isActive) return;
+  const webId = session.webId;
+  let editing = null;          // the notice being changed, or null for a new one
+
+  const when = (iso) => { try { return new Date(iso).toLocaleString(); } catch { return iso; } };
+
+  const send = async (body) => {
+    let res;
+    try {
+      res = await session.authFetch(location.origin + '/api/notices', {
+        method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body),
+      });
+    } catch (e) { note('the request failed: ' + e.message); return null; }
+    const d = await res.json().catch(() => ({}));
+    if (res.status === 403) { note('signed in as ' + webId + ', which is not this server’s admin'); return null; }
+    if (res.status === 501) { note('this server keeps no notices'); return null; }
+    if (res.status >= 400) { note('refused: ' + (d.error || 'HTTP ' + res.status)); return null; }
+    return d;
+  };
+
+  const startEdit = (n) => {
+    editing = n;
+    $('editor-title').textContent = n ? 'Change this notice' : 'New notice';
+    $('notice-title').value = n ? n.title : '';
+    $('notice-body').value = n ? n.body : '';
+    $('notice-save').textContent = n ? 'Save changes' : 'Publish';
+    $('notice-cancel').hidden = !n;
+    $('notice-title').focus();
+  };
+
+  const load = async () => {
+    let res;
+    try { res = await fetch(location.origin + '/api/notices', { headers: { accept: 'application/json' }, cache: 'no-store' }); }
+    catch (e) { note('the notices could not be read: ' + e.message); return; }
+    if (res.status === 501) { note('this server keeps no notices'); return; }
+    const d = await res.json().catch(() => ({}));
+    const ul = $('notices-list');
+    ul.textContent = '';
+    for (const n of d.notices || []) {
+      const li = document.createElement('li');
+      const head = document.createElement('div');
+      const t = document.createElement('span'); t.className = 'title'; t.textContent = n.title;
+      const w = document.createElement('span'); w.className = 'when';
+      w.textContent = when(n.at) + (n.updatedAt && n.updatedAt !== n.at ? ' (changed ' + when(n.updatedAt) + ')' : '');
+      head.append(t, w);
+      const b = document.createElement('p'); b.className = 'body'; b.textContent = n.body;
+      const acts = document.createElement('p'); acts.className = 'actions';
+      const edit = document.createElement('button'); edit.type = 'button'; edit.textContent = 'Change';
+      edit.onclick = () => startEdit(n);
+      const rm = document.createElement('button'); rm.type = 'button'; rm.textContent = 'Remove'; rm.className = 'danger';
+      rm.onclick = async () => {
+        if (!confirm('Remove the notice “' + n.title + '”? Everyone stops seeing it.')) return;
+        if (await send({ action: 'delete', id: n.id })) { note('removed “' + n.title + '”'); await load(); }
+      };
+      acts.append(edit, rm);
+      li.append(head, b, acts);
+      ul.append(li);
+    }
+    if (!(d.notices || []).length) { const li = document.createElement('li'); li.textContent = 'No notices yet.'; ul.append(li); }
+    $('notices-editor').hidden = false;
+  };
+
+  $('editor-form').addEventListener('submit', async (ev) => {
+    ev.preventDefault();
+    const title = $('notice-title').value.trim();
+    const body = $('notice-body').value.trim();
+    if (!title || !body) { note('a title and a text are both needed'); return; }
+    $('notice-save').disabled = true;
+    const r = await send(editing ? { action: 'update', id: editing.id, title, body } : { action: 'create', title, body });
+    $('notice-save').disabled = false;
+    if (!r) return;
+    note(editing ? 'changed “' + title + '”' : 'published “' + title + '” — everyone sees it within a minute');
+    startEdit(null);
+    await load();
+  });
+  $('notice-cancel').addEventListener('click', () => startEdit(null));
+
+  note('signed in as ' + webId);
+  $('notices-form').hidden = true;
+  await load();
+})();

package/web/front/run.html

@@ -3,31 +3,39 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>FediPod — run your identity on this server</title>
+<title>FediPod — turn your pod into a Fediverse account</title>
+<link rel="icon" href="/icons/gateway.svg" type="image/svg+xml">
 <style>
   :root { color-scheme: light dark; --line:#d9d4c7; --dim:#45443d; --accent:#6a8a5a; }
   @media (prefers-color-scheme: dark) { :root { --dim:#c2c0b4; } }
-  body { font: 19px/1.6 system-ui, sans-serif; max-width: 44rem; margin: 2rem auto; padding: 0 1.1rem; }
+  body { font: 20px/1.6 Arial, Helvetica, sans-serif; max-width: 44rem; margin: 2rem auto; padding: 0 1.1rem; }
   h1 { font-size: 1.7rem; margin: 0 0 .2rem; }
   p.lede { color: var(--dim); margin-top: 0; }
   label { display: block; font-weight: 600; margin: .8rem 0 .2rem; }
   input[type=text], input[type=url] { width: 100%; padding: .5rem .6rem; font: inherit;
     border: 1px solid var(--line); border-radius: 8px; box-sizing: border-box; }
   .hint { color: var(--dim); font-size: .95rem; }
+  .pod { border: 1px solid var(--line); border-radius: 9px; padding: .9rem 1.1rem; margin: .8rem 0; }
+  .pod p { margin: .3rem 0; }
+  .pod .actions { margin-top: .8rem; }
   .primary { background: var(--accent); color: #fff; border: none; border-radius: 9px;
     padding: .6rem 1.1rem; font: inherit; cursor: pointer; }
   button { font: inherit; }
   .primary[disabled], button[disabled] { opacity: .5; cursor: not-allowed; }
   [hidden] { display: none !important; }
   code { background: rgba(120,120,120,.12); padding: .05em .35em; border-radius: 4px; }
+  .pod code { background: #fff3c4; color: #1a1a1a; font-size: 16px; }
+  @media (prefers-color-scheme: dark) { .pod code { background: #5a4a00; color: #fff; } }
   pre { background: rgba(120,120,120,.12); padding: .7rem .9rem; border-radius: 8px; overflow-x: auto; }
 </style>
 </head>
 <body>
-<h1>Run your identity on this server</h1>
-<p class="lede">If your pod is hosted by this server, the server can run your Fediverse identity
-for you: it accepts follows, delivers your posts and serves your Mastodon app, with nothing for
-you to keep running. Sign in with your pod to prove it is yours.</p>
+<h1>Turn your pod into a Fediverse account</h1>
+<p class="lede">Users with pods on this server may opt-in below to create a Fediverse account
+that stores your data on your pod. You'll be able to interact with Mastodon and users of other
+Fediverse services straight from your pod.</p>
+
+<section id="run-known" hidden aria-live="polite"></section>
 
 <form id="run-form">
   <p class="field">
@@ -42,10 +50,9 @@ you to keep running. Sign in with your pod to prove it is yours.</p>
     <button type="button" id="run-continue" class="primary" disabled>Sign in with your pod &amp; opt in</button>
     <button type="button" id="run-leave">Stop running it here</button>
   </p>
-  <p class="hint" id="run-note" hidden></p>
 </form>
+<p class="hint" id="run-note" hidden></p>
 
 <script type="module" src="/run.js"></script>
-<i>(cc) 4.0 By, Jeff Zucker, 2026</i>
 </body>
 </html>

package/web/front/run.js

@@ -3,7 +3,7 @@
 // It lived inline in run.html until 2026-09-09. Out here the page can be served
 // under `script-src 'self'`, which is what stops a stray bit of markup from
 // becoming running code; inline script cannot be told apart from injected
-// script by any policy. Served by the front at /run.js.
+// script by any policy. Served by the front beside the page it belongs to.
 //
 // A module, because it awaits an import of /solid-oidc-client.js at the top
 // level — which is itself the proof this mechanism works: that file has been
@@ -13,28 +13,90 @@ const $ = (id) => document.getElementById(id);
 // The Solid-OIDC client for the sign-in round trip. Constructed once; the
 // redirect state (PKCE, csrf) lives in this tab's sessionStorage, so the same
 // session finishes the login on the way back.
+// This page's own address. The identity provider is told it and sends the
+// reader back to it, so a hard-coded name would end the sign-in on a page that
+// does not exist wherever the operator put this one.
+const HERE = location.origin + location.pathname.replace(/\/$/u, '');
 let session = null;
 try {
   const { SessionCore } = await import('/solid-oidc-client.js');
-  session = new SessionCore({ redirect_uris: [location.origin + '/run'], client_name: 'FediPod gateway' });
+  session = new SessionCore({ redirect_uris: [HERE], client_name: 'FediPod gateway' });
 } catch { /* leave null — the "did not load" notes below fire */ }
 
-// Offered only where this server actually runs identities. An
-// unauthenticated probe tells the two apart: 501 = not offered here,
-// anything else = offered (a real opt-in still needs the signed-in proof).
+// What this server knows before anything is typed. 501: it runs no
+// identities. A pod server that issued the reader's session names their pod
+// and its address, and the page shows one button per pod. Not signed in
+// there: one button, to its login. A Gateway knows nothing: the form below.
 let offered = true;
+const say = (tag, text) => { const e = document.createElement(tag); e.textContent = text; return e; };
 (async () => {
-  const res = await fetch('/api/agent', { method: 'POST',
-    headers: { 'content-type': 'application/json' }, body: '{}' }).catch(() => null);
+  const res = await fetch('/api/agent', { credentials: 'same-origin', headers: { accept: 'application/json' } }).catch(() => null);
+  const d = res && res.ok ? await res.json().catch(() => ({})) : {};
+  const n = $('run-note');
   if (!res || res.status === 501) {
     offered = false;
-    const n = $('run-note');
     n.hidden = false;
     n.textContent = 'This server does not run identities. Your agent stays where it is.';
-    runFormCheck();
+  } else if (d.session === 'none') {
+    $('run-form').hidden = true;
+    showSignIn(d.loginUrl);
+  } else if (d.session === 'ok' && Array.isArray(d.pods) && d.pods.length) {
+    $('run-form').hidden = true;
+    showPods(d.pods);
   }
+  runFormCheck();
 })();
 
+async function refreshKnown() {
+  const res = await fetch('/api/agent', { credentials: 'same-origin', headers: { accept: 'application/json' } }).catch(() => null);
+  const d = res && res.ok ? await res.json().catch(() => ({})) : {};
+  if (d.session === 'ok' && Array.isArray(d.pods) && d.pods.length) showPods(d.pods);
+}
+
+function showSignIn(loginUrl) {
+  const k = $('run-known');
+  k.hidden = false;
+  k.replaceChildren();
+  k.append(say('p', 'You are not signed in at this server.'));
+  if (loginUrl) {
+    const go = say('button', 'Sign in');
+    go.type = 'button'; go.className = 'primary';
+    go.onclick = () => { location.href = loginUrl; };
+    const p = document.createElement('p'); p.className = 'actions'; p.append(go);
+    k.append(p, say('p', 'Sign in, then come back to this page.'));
+    k.lastChild.className = 'hint';
+  }
+}
+
+function showPods(pods) {
+  const k = $('run-known');
+  k.hidden = false;
+  k.replaceChildren();
+  for (const pod of pods) {
+    const box = document.createElement('div'); box.className = 'pod';
+    // The names stand out from the sentences around them.
+    const line = (before, id, after = '.') => { const p = say('p', before); p.append(say('code', id), after); return p; };
+    box.append(line('Solid Identity (WebID): ', pod.webId, ''));
+    const actions = document.createElement('p'); actions.className = 'actions';
+    box.append(line('Fediverse Identity: ', pod.address, ''));
+    if (pod.running) {
+      const links = say('p', 'Manage your account: ');
+      const m = say('a', pod.manage.split('?')[0]); m.href = pod.manage;
+      links.append(m);
+      box.append(links);
+      const stop = say('button', 'Close this Fediverse account'); stop.type = 'button'; stop.className = 'primary';
+      stop.onclick = () => runStart('opt-out', pod.podBase);
+      actions.append(stop);
+    } else {
+      const go = say('button', 'Create a Fediverse account'); go.type = 'button'; go.className = 'primary';
+      go.onclick = () => runStart('opt-in', pod.podBase);
+      actions.append(go);
+    }
+    box.append(actions);
+    k.append(box);
+  }
+}
+
 function runFormCheck() {
   let ok = false;
   try { ok = /^https?:$/.test(new URL($('run-pod-url').value.trim()).protocol); } catch { /* not yet */ }
@@ -53,22 +115,67 @@ $('run-pod-url').addEventListener('input', () => {
   runFormCheck();
 });
 $('run-issuer').addEventListener('input', runFormCheck);
+// A browser that puts back what was in these boxes — a reload, the back
+// button, its own remembered values — fills them without anybody typing, and
+// no typing meant the button was never asked to wake up. It stayed grey over
+// a filled-in form, with nothing to say why.
+runFormCheck();
 
-const runStart = (action) => {
+const runStart = async (action, podBase = null) => {
   const n = $('run-note');
-  if (!session) { n.hidden = false; n.textContent = 'the sign-in library did not load — reload and try again'; return; }
-  const u = new URL($('run-pod-url').value.trim());
+  const u = new URL(podBase || $('run-pod-url').value.trim());
   if (u.pathname === '') u.pathname = '/';
   if (!u.pathname.endsWith('/')) u.pathname += '/';
   u.search = ''; u.hash = '';
-  sessionStorage.setItem('fp-run', JSON.stringify({ podBase: u.href, action }));
-  session.login($('run-issuer').value.trim(), location.origin + '/run')
-    .catch((e) => { n.hidden = false; n.textContent = 'sign-in failed to start: ' + e.message; });
+  const p = { podBase: u.href, action };
+
+  // A pod server issued the session this page is being read with, so ask it
+  // first: where it knows who you are, there is nothing to sign in to again.
+  // A Gateway fronting somebody else's pod answers 401 here and the login
+  // below is the only way.
+  n.hidden = false;
+  n.textContent = 'asking the server…';
+  const known = await fetch('/api/agent', {
+    method: 'POST', credentials: 'same-origin',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(p),
+  }).catch(() => null);
+  if (known && known.status !== 401) { await showReply(known, p); return; }
+
+  if (!session) { n.textContent = 'the sign-in library did not load — reload and try again'; return; }
+  sessionStorage.setItem('fp-run', JSON.stringify(p));
+  session.login($('run-issuer').value.trim(), HERE)
+    .catch((e) => { n.textContent = 'sign-in failed to start: ' + e.message; });
 };
 $('run-continue').onclick = () => runStart('opt-in');
 $('run-leave').onclick = () => runStart('opt-out');
 
-// Back from the identity provider: finish the opt-in with the proven login.
+// What came of it, however the server was satisfied — the session it already
+// had, or a login proved afterwards.
+async function showReply(res, p) {
+  const n = $('run-note');
+  n.hidden = false;
+  const d = res ? await res.json().catch(() => ({})) : {};
+  if (res && res.status === 201 && d.doorSecret) {
+    // Built as nodes, not as a string of HTML. Three of the pieces below come
+    // back from the server and one comes from sessionStorage, and pasting any
+    // of them into innerHTML means whatever markup they contain is rendered.
+    // Only the fixed wording is markup here; everything variable is text.
+    const manage = `${p.podBase.replace(/\/$/, '')}${d.doorPath}?dk-token=${encodeURIComponent(d.doorSecret)}`;
+    n.textContent = 'Your Fediverse account is ready. Manage it at ';
+    const a = say('a', p.podBase.replace(/\/$/, '') + d.doorPath); a.href = manage;
+    n.append(a, '.');
+    refreshKnown();
+  } else if (res && res.status === 200) {
+    n.textContent = 'Your Fediverse account is closed. Your pod and its data are untouched.';
+    refreshKnown();
+  } else {
+    n.textContent = (p.action === 'opt-in' ? 'opt-in' : 'opt-out') + ' failed: '
+      + (d.error || (res ? 'HTTP ' + res.status : 'no response'));
+  }
+}
+
+// Back from the identity provider: finish with the proven login.
 (async () => {
   if (!session) return;
   await session.handleRedirectFromLogin().catch(() => {});
@@ -84,24 +191,5 @@ $('run-leave').onclick = () => runStart('opt-out');
     method: 'POST', headers: { 'content-type': 'application/json' },
     body: JSON.stringify({ action: p.action, podBase: p.podBase }),
   }).catch(() => null);
-  const d = res ? await res.json().catch(() => ({})) : {};
-  if (res && res.status === 201 && d.doorSecret) {
-    // Built as nodes, not as a string of HTML. Three of the pieces below come
-    // back from the server and one comes from sessionStorage, and pasting any
-    // of them into innerHTML means whatever markup they contain is rendered.
-    // Only the fixed wording is markup here; everything variable is text.
-    const say = (tag, text) => { const e = document.createElement(tag); e.textContent = text; return e; };
-    n.textContent = 'Your identity runs here now. This is your door secret — ';
-    n.append(say('b', 'save it now'));
-    n.append(', it is shown only this once. It opens your admin pages at ');
-    n.append(say('code', p.podBase.replace(/\/$/, '') + d.doorPath));
-    n.append(':', say('pre', d.doorSecret));
-    n.append('To check it works:', say('pre', d.command));
-    n.append('Lost it? Opt in again — that mints a fresh one and retires this one.');
-  } else if (res && res.status === 200) {
-    n.textContent = 'Done — this server no longer runs that identity. Your pod and its data are untouched.';
-  } else {
-    n.textContent = (p.action === 'opt-in' ? 'opt-in' : 'opt-out') + ' failed: '
-      + (d.error || (res ? 'HTTP ' + res.status : 'no response'));
-  }
+  await showReply(res, p);
 })();

package/web/icons/forum.svg

@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">
+<!-- The forum: more than one person talking. Icon "messages-square" from
+     Lucide (lucide.dev), ISC licence, © Lucide Contributors. -->
+<title>Federated Solid Forum</title>
+<rect width="32" height="32" rx="7" fill="#3b5bb5"/>
+<g transform="translate(4 4)" fill="none" stroke="#ffffff" stroke-width="2"
+   stroke-linecap="round" stroke-linejoin="round">
+  <path d="M16 10a2 2 0 0 1-2 2H6.828a2 2 0 0 0-1.414.586l-2.202 2.202A.71.71 0 0 1 2 14.286V4a2 2 0 0 1 2-2h10a2 2 0 0 1 2 2z"/>
+  <path d="M20 9a2 2 0 0 1 2 2v10.286a.71.71 0 0 1-1.212.502l-2.202-2.202A2 2 0 0 0 17.172 19H10a2 2 0 0 1-2-2v-1"/>
+</g>
+</svg>

package/web/icons/gateway.svg

@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">
+<!-- The gateway: the door your mail comes through. Icon "door-open" from
+     Lucide (lucide.dev), ISC licence, © Lucide Contributors. -->
+<title>FediPod gateway</title>
+<rect width="32" height="32" rx="7" fill="#b4531a"/>
+<g transform="translate(4 4)" fill="none" stroke="#ffffff" stroke-width="2"
+   stroke-linecap="round" stroke-linejoin="round">
+  <path d="M10 21H2"/>
+  <path d="M10 3H7a2 2 0 00-2 2v16"/>
+  <path d="M14 12h.01"/>
+  <path d="M19 21V5a2 2 0 00-1.675-1.974l-6.163-1.013A1 1 0 0010 3v18a1 1 0 001.124.992z"/>
+  <path d="M22 21h-3"/>
+</g>
+</svg>

package/web/icons/local.svg

@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">
+<!-- Your own pod and your own posts. Icon "house" from Lucide (lucide.dev),
+     ISC licence, © Lucide Contributors. -->
+<title>FediPod</title>
+<rect width="32" height="32" rx="7" fill="#2f7d4f"/>
+<g transform="translate(4 4)" fill="none" stroke="#ffffff" stroke-width="2"
+   stroke-linecap="round" stroke-linejoin="round">
+  <path d="M15 21v-8a1 1 0 0 0-1-1h-4a1 1 0 0 0-1 1v8"/>
+  <path d="M3 10a2 2 0 0 1 .709-1.528l7-6a2 2 0 0 1 2.582 0l7 6A2 2 0 0 1 21 10v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/>
+</g>
+</svg>

package/web/app/index.html~

@@ -1,152 +0,0 @@
-<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https://solidcommunity.net https://*.solidcommunity.net; form-action 'self' https://solidcommunity.net https://*.solidcommunity.net; base-uri 'none'">
-<title>FediPod</title>
-<style>
-:root { color-scheme: light dark; font-size: 112.5%; --heading: #1a4f8a; --sub: #666; --line: #bbb; --accent: #1a4f8a; }
-@media (prefers-color-scheme: dark) { :root { --heading: #7fb3e8; --sub: #aaa; --line: #555; --accent: #7fb3e8; } }
-body { font: 1rem/1.5 system-ui, sans-serif; margin: 0; }
-#page { max-width: 42rem; margin: 0 auto; padding: 1.75rem 1rem 4rem; box-sizing: border-box; }
-h1, h2, h3 { color: var(--heading); }
-h1 { font-size: 1.5rem; margin: 0 0 .5rem; }
-#brand { margin: 0 0 1.25rem; }
-h2 { font-size: 1.1rem; margin: 2rem 0 .5rem; }
-p { margin: .6rem 0; }
-code { background: rgba(120,120,120,.14); padding: .05em .35em; border-radius: 4px; }
-.sub { color: var(--sub); margin-top: 0; }
-.hint { color: var(--sub); font-size: .9rem; margin: .15rem 0 0; }
-fieldset { border: 1px solid var(--line); border-radius: .4rem; margin: 1rem 0; padding: .75rem 1rem 1rem; }
-legend { padding: 0 .3rem; font-weight: 600; }
-label { display: block; margin: .75rem 0 .2rem; }
-input[type=text], input[type=email], input[type=url], input[type=password], select {
-  font: inherit; width: 100%; padding: .5rem; box-sizing: border-box;
-  border: 1px solid #767676; border-radius: .3rem; background: Field; color: FieldText; }
-.choice { display: block; margin: .35rem 0; font-weight: normal; }
-.choice input { margin-right: .4rem; width: auto; }
-button { font: inherit; padding: .6rem 1.2rem; border-radius: .3rem; border: 1px solid #666;
-  background: ButtonFace; color: ButtonText; cursor: pointer; }
-button.primary { font-weight: 600; }
-button:disabled { opacity: .5; cursor: default; }
-.row { display: flex; gap: .5rem; align-items: center; }
-.row input { flex: 1; }
-.row button { white-space: nowrap; }
-.address { font-size: 1.2rem; font-weight: 600; word-break: break-all; }
-.warn { border-left: .25rem solid #c60; padding-left: .75rem; }
-.err { border-left: .25rem solid #b00020; padding-left: .75rem; color: #b00020; }
-@media (prefers-color-scheme: dark) { .err { color: #ff8a8a; border-left-color: #ff8a8a; } }
-#form-error:empty, #signin-error:empty { display: none; }
-.steps { list-style: none; padding: 0; }
-.steps li { padding: .3rem 0; }
-a { color: var(--accent); }
-[hidden] { display: none !important; }
-</style>
-</head>
-<body>
-<main id="page">
-
-<!-- The marketing hero: shown on the landing, hidden once a form is up. -->
-<header id="hero">
-  <h1>FediPod - join the Fediverse from a Solid pod.</h1>
-  <p>Welcome to <b>fedipod.net</b>! By creating an account here, you can get a free Solid pod
-  and Fediverse identity or link to your existing pod/identity. Your <code>fedipod.net</code>
-  account provides you a portal to the Fediverse and filters unverified mail but does not tie
-  you to anything. All of your data lives on your pod and your Fediverse identity is yours
-  forever regardless of what happens to fedipod.net.</p>
-  <p>There is nothing to install, once you've setup an account, just point any browser at
-  <code>https://fedipod.net</code> and sign in.</p>
-</header>
-
-<!-- The short brand: shown only when a form is up, so the form stands alone. -->
-<h1 id="brand" hidden>FediPod</h1>
-
-<p id="loading">Loading…</p>
-
-<section id="landing" hidden>
-  <h2>Already have an account?</h2>
-  <p class="row">
-    <input type="text" id="signin-address" autocapitalize="off" spellcheck="false" placeholder="@me@mypod">
-    <button type="button" class="primary" id="signin">sign in</button>
-  </p>
-  <p class="err" id="signin-error" role="alert"></p>
-  <h2>New user?</h2>
-  <p><button type="button" class="primary" id="create">create an account</button></p>
-  <p class="hint">For more information, see
-    <a href="https://github.com/jeff-zucker/FediPod">github.com/jeff-zucker/FediPod</a></p>
-</section>
-
-<section id="pane-form" hidden>
-  <form id="form">
-
-    <!-- Screen 1: Your Solid Pod -->
-    <div class="step" id="step-1">
-      <fieldset>
-        <legend>Your Solid Pod</legend>
-
-        <label>Pod type</label>
-        <label class="choice"><input type="radio" name="mode" value="existing"> An existing pod</label>
-        <label class="choice"><input type="radio" name="mode" value="new" checked> A new pod</label>
-
-        <label for="provider">Pod provider</label>
-        <input type="url" id="provider" name="provider" autocomplete="url" placeholder="https://solidcommunity.net">
-
-        <label for="podName">Pod username/subdomain</label>
-        <input type="text" id="podName" name="podName" autocomplete="off" aria-describedby="podname-hint">
-        <p class="hint" id="podname-hint">The subdomain of your pod: your pod address becomes
-          https://YOUR-USERNAME.your-provider.</p>
-
-        <label for="email">Pod email</label>
-        <input type="email" id="email" name="email" autocomplete="email" placeholder="you@example.org">
-
-        <label for="password">Pod password</label>
-        <input type="password" id="password" name="password" autocomplete="current-password"
-          aria-describedby="password-hint">
-        <p class="hint" id="password-hint">The password is sent once in return for a credential stored
-          in this browser. The password itself is never stored, and you can revoke the credential
-          without changing it.</p>
-      </fieldset>
-      <p class="err" id="err-1" role="alert"></p>
-      <p>
-        <button type="button" id="cancel">Cancel</button>
-        <button type="button" class="primary" id="to-2">Continue</button>
-      </p>
-    </div>
-
-    <!-- Screen 2: Your Fediverse Identity -->
-    <div class="step" id="step-2" hidden>
-      <fieldset>
-        <legend>Your Fediverse Identity</legend>
-
-        <label for="handle">Fediverse handle</label>
-        <input type="text" id="handle" name="handle" autocomplete="off"
-          placeholder="the handle part of your address: @HANDLE@server" aria-describedby="handle-hint">
-        <p class="hint" id="handle-hint">The name in your Fediverse address. This is permanent.
-          Letters, digits, and hyphens only.</p>
-
-        <label>Your Fediverse address</label>
-        <p class="address" id="preview">@…@…</p>
-      </fieldset>
-      <p class="hint">The handle and the pod cannot be changed afterwards. Everything else — display
-        name, bio, pictures — you set later in the client.</p>
-      <p class="err" id="form-error" role="alert"></p>
-      <p>
-        <button type="button" id="back-1">Back</button>
-        <button type="submit" class="primary" id="submit">Create Pod and Fediverse accounts</button>
-      </p>
-    </div>
-
-  </form>
-</section>
-
-<section id="running" hidden>
-  <h2>Setting up…</h2>
-  <ul class="steps" id="steps"></ul>
-  <p class="err" id="run-error" role="alert"></p>
-</section>
-
-</main>
-<script type="module" src="/boot.js"></script>
-</body>
-</html>

package/web/app/site/_headers

@@ -1,9 +0,0 @@
-/app/*
-  Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' https: data: blob:; media-src 'self' https: blob:; connect-src 'self' https:; font-src 'self' data:; object-src 'none'; base-uri 'none'; frame-ancestors 'self'; form-action 'self'
-  X-Content-Type-Options: nosniff
-  Referrer-Policy: same-origin
-
-/admin/*
-  Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' https: data: blob:; connect-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'self'; form-action 'self'
-  X-Content-Type-Options: nosniff
-  Referrer-Policy: same-origin

package/web/app/site/_redirects

@@ -1,22 +0,0 @@
-# gateway + front API → the function
-/api/handle             /.netlify/functions/front  200
-/api/attach             /.netlify/functions/front  200
-/api/relay              /.netlify/functions/front  200
-/api/roster             /.netlify/functions/front  200
-/api/revoke             /.netlify/functions/front  200
-/api/agent              /.netlify/functions/front  200
-/u/*                    /.netlify/functions/front  200
-/.well-known/*          /.netlify/functions/front  200
-/@*                     /.netlify/functions/front  200
-/install                /.netlify/functions/front  200
-/run                    /.netlify/functions/front  200
-/roster                 /.netlify/functions/front  200
-/solid-oidc-client.js   /.netlify/functions/front  200
-# the in-browser app, served static (these win over the project catch-all)
-/            /index.html    200
-/sw.js       /sw.js         200
-/boot.js     /boot.js       200
-/app         /app/          301
-/app/*       /app/:splat    200
-/admin       /admin/        301
-/admin/*     /admin/:splat  200