fedipod-server 0.26.0 → 0.28.0

package/web/app/site/demo/oidc-session.mjs

@@ -1,233 +0,0 @@
-// oidc-session.mjs — Solid-OIDC login for a browser page, with a secure,
-// durable, worker-visible session.
-//
-// The redirect handshake (authorization-code + PKCE) runs in the page. The
-// session it yields — a DPoP keypair whose private half is NON-EXTRACTABLE, plus
-// the refresh token, the token endpoint and the WebID — is kept in IndexedDB.
-// IndexedDB survives a browser restart and is readable by a service worker,
-// and a non-extractable key can sign but never be read out, even by injected
-// script.
-//
-//   import { solidOidcSession } from 'solid-oidc-session/oidc-session.mjs';
-//   const oidc = solidOidcSession({ dbName: 'my-app-oidc', clientName: 'My app' });
-//
-// Page:   const { authorizationUrl } = await oidc.beginLogin({ issuer, redirectUri });
-//         location.href = authorizationUrl;                      // ... redirect ...
-//         await oidc.completeLogin({ currentUrl: location.href });  // on return
-// Anywhere (page or worker, SAME dbName):
-//         const session = await oidc.getSession();  // { webId, issuer, fetch, refresh, signOut } | null
-//
-// No imports, no Node built-ins, nothing named after the application that
-// uses it: IndexedDB, WebCrypto and fetch are all it needs.
-
-const STORE = 'session';
-const b64u = (buf) => btoa(String.fromCharCode(...new Uint8Array(buf))).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-const enc = (o) => b64u(new TextEncoder().encode(JSON.stringify(o)));
-const sha256 = (s) => crypto.subtle.digest('SHA-256', new TextEncoder().encode(s));
-const rand = (n = 32) => b64u(crypto.getRandomValues(new Uint8Array(n)));
-
-async function dpopKey() { return crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign']); }
-async function publicJwk(pair) { const j = await crypto.subtle.exportKey('jwk', pair.publicKey); return { kty: j.kty, crv: j.crv, x: j.x, y: j.y }; }
-async function dpopProof(pair, jwk, htm, htu, ath) {
-  const header = { typ: 'dpop+jwt', alg: 'ES256', jwk };
-  const payload = { htm, htu: htu.split('#')[0], jti: crypto.randomUUID(), iat: Math.floor(Date.now() / 1000), ...(ath ? { ath } : {}) };
-  const data = `${enc(header)}.${enc(payload)}`;
-  const sig = await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, pair.privateKey, new TextEncoder().encode(data));
-  return `${data}.${b64u(sig)}`;
-}
-const jwtPayload = (jwt) => { try { return JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(jwt.split('.')[1].replace(/-/g, '+').replace(/_/g, '/')), (c) => c.charCodeAt(0)))); } catch { return {}; } };
-
-async function discover(issuer) {
-  const res = await fetch(`${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration`, { headers: { accept: 'application/json' } });
-  if (!res.ok) throw new Error(`OIDC discovery failed at ${issuer} (HTTP ${res.status})`);
-  return res.json();
-}
-async function registerClient(cfg, redirectUri, clientName) {
-  const res = await fetch(cfg.registration_endpoint, {
-    method: 'POST', headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ client_name: clientName, redirect_uris: [redirectUri], token_endpoint_auth_method: 'none',
-      grant_types: ['authorization_code', 'refresh_token'], response_types: ['code'], application_type: 'web', scope: 'openid webid offline_access' }),
-  });
-  if (!res.ok) throw new Error(`client registration failed (HTTP ${res.status})`);
-  return (await res.json()).client_id;
-}
-
-/**
- * One session store. `dbName` is the IndexedDB database the session lives in:
- * a page and its service worker must pass the same name to see the same
- * sign-in, and two apps on one origin pass different names to keep theirs
- * apart. `clientName` is what the pod's login screen shows the person.
- */
-export function solidOidcSession({ dbName = 'solid-oidc-session', clientName = 'Solid app' } = {}) {
-  function idb() {
-    return new Promise((res, rej) => {
-      const r = indexedDB.open(dbName, 1);
-      r.onupgradeneeded = () => r.result.createObjectStore(STORE);
-      r.onsuccess = () => res(r.result);
-      r.onerror = () => rej(r.error);
-    });
-  }
-  async function idbGet(key) {
-    const db = await idb();
-    return new Promise((res, rej) => { const t = db.transaction(STORE).objectStore(STORE).get(key); t.onsuccess = () => res(t.result); t.onerror = () => rej(t.error); });
-  }
-  async function idbPut(key, val) {
-    const db = await idb();
-    return new Promise((res, rej) => { const t = db.transaction(STORE, 'readwrite').objectStore(STORE).put(val, key); t.onsuccess = () => res(); t.onerror = () => rej(t.error); });
-  }
-  async function idbDel(key) {
-    const db = await idb();
-    return new Promise((res, rej) => { const t = db.transaction(STORE, 'readwrite').objectStore(STORE).delete(key); t.onsuccess = () => res(); t.onerror = () => rej(t.error); });
-  }
-
-  /** Begin login: prepare PKCE + a non-extractable DPoP key, stash the pending
-   *  state, and return the authorization URL for the caller to navigate to. */
-  async function beginLogin({ issuer, redirectUri, clientName: name = clientName, returnTo = null }) {
-    const cfg = await discover(issuer);
-    const client_id = await registerClient(cfg, redirectUri, name);
-    const pair = await dpopKey();
-    const verifier = rand(48);
-    const challenge = b64u(await sha256(verifier));
-    const state = rand(16);
-    await idbPut('pending', { issuer, client_id, redirectUri, verifier, state, pair, returnTo,
-      tokenEndpoint: cfg.token_endpoint, authorizationEndpoint: cfg.authorization_endpoint,
-      revocationEndpoint: cfg.revocation_endpoint || null });
-    const url = new URL(cfg.authorization_endpoint);
-    for (const [k, v] of Object.entries({ client_id, redirect_uri: redirectUri, response_type: 'code',
-      scope: 'openid webid offline_access', code_challenge: challenge, code_challenge_method: 'S256', state, prompt: 'consent' })) url.searchParams.set(k, v);
-    return { authorizationUrl: url.href };
-  }
-
-  /** Complete login from the redirect back. Exchanges the code (DPoP + PKCE),
-   *  stores the durable session, and returns it. Returns null if there is no code. */
-  async function completeLogin({ currentUrl }) {
-    const u = new URL(currentUrl);
-    const code = u.searchParams.get('code');
-    const state = u.searchParams.get('state');
-    if (!code) return null;
-    const p = await idbGet('pending');
-    if (!p || p.state !== state) throw new Error('login state mismatch');
-    const jwk = await publicJwk(p.pair);
-    const res = await fetch(p.tokenEndpoint, {
-      method: 'POST',
-      headers: { 'content-type': 'application/x-www-form-urlencoded', dpop: await dpopProof(p.pair, jwk, 'POST', p.tokenEndpoint) },
-      body: new URLSearchParams({ grant_type: 'authorization_code', code, redirect_uri: p.redirectUri, client_id: p.client_id, code_verifier: p.verifier }),
-    });
-    const tok = await res.json().catch(() => ({}));
-    if (!res.ok || !tok.access_token) throw new Error(`token exchange failed (HTTP ${res.status}): ${tok.error || ''}`);
-    const webId = jwtPayload(tok.access_token).webid || jwtPayload(tok.id_token || '').webid || null;
-    const session = { issuer: p.issuer, client_id: p.client_id, tokenEndpoint: p.tokenEndpoint, pair: p.pair,
-      // Where to hand the refresh token back at sign-out. Kept on the session
-      // because discovery is a network round trip and sign-out should not need
-      // one — see signOut().
-      revocationEndpoint: p.revocationEndpoint || null,
-      refreshToken: tok.refresh_token || null, accessToken: tok.access_token,
-      expiresAt: Date.now() + Math.max(30, (tok.expires_in || 300)) * 1000, webId };
-    await idbPut('session', session);
-    await idbDel('pending');
-    // `returnTo` rides only on the handle this call returns: where the person
-    // was when they left for the login page, for the caller to send them back.
-    return Object.assign(sessionHandle(session), p.returnTo ? { returnTo: p.returnTo } : {});
-  }
-
-  /** Restore the session from IndexedDB — works in the page and the worker. */
-  async function getSession() {
-    const s = await idbGet('session');
-    return s ? sessionHandle(s) : null;
-  }
-
-  /**
-   * Sign out, and tell the issuer.
-   *
-   * Dropping the row locally leaves the REFRESH TOKEN alive at the pod for its
-   * full life — signing out of a shared or borrowed browser would clear the
-   * screen and nothing else, and anyone who had copied the token could go on
-   * minting access tokens with it. RFC 7009: hand it back.
-   *
-   * Best effort, and the local teardown happens either way: an issuer that is
-   * unreachable, or that publishes no revocation endpoint, must not be able to
-   * keep somebody signed in.
-   */
-  async function signOut() {
-    const s = await idbGet('session').catch(() => null);
-    if (s?.revocationEndpoint && s.refreshToken) {
-      try {
-        await fetch(s.revocationEndpoint, {
-          method: 'POST',
-          headers: { 'content-type': 'application/x-www-form-urlencoded' },
-          body: new URLSearchParams({
-            token: s.refreshToken, token_type_hint: 'refresh_token', client_id: s.client_id,
-          }),
-        });
-      } catch { /* told if we could; leaving is not conditional on being heard */ }
-    }
-    await idbDel('session');
-    await idbDel('pending');
-  }
-
-  function sessionHandle(s) {
-    let { accessToken, expiresAt, refreshToken } = s;
-    const jwkP = publicJwk(s.pair);
-    const refresh = async () => {
-      if (!refreshToken) throw new Error('session expired and there is no refresh token — sign in again');
-      const jwk = await jwkP;
-      let res;
-      try {
-        res = await fetch(s.tokenEndpoint, {
-          method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded', dpop: await dpopProof(s.pair, jwk, 'POST', s.tokenEndpoint) },
-          body: new URLSearchParams({ grant_type: 'refresh_token', refresh_token: refreshToken, client_id: s.client_id, scope: 'openid webid offline_access' }),
-        });
-      } catch (e) {
-        // A renewal that never reached the server is not a refused one: the
-        // session is still good, and saying "your pod refused the write" about
-        // it sends whoever reads it looking in the wrong place. Under load a
-        // server refuses the token endpoint first, and a refusal with no CORS
-        // headers arrives here as the browser's bare "Failed to fetch".
-        throw new Error(`${e.message} — renewing your sign-in at ${new URL(s.tokenEndpoint).host}`);
-      }
-      const tok = await res.json().catch(() => ({}));
-      if (res.status === 429) {
-        throw new Error(`${new URL(s.tokenEndpoint).host} is asking us to slow down — your sign-in could not be renewed just now`);
-      }
-      if (!res.ok || !tok.access_token) { await idbDel('session'); throw new Error('refresh failed — sign in again'); }
-      accessToken = tok.access_token;
-      expiresAt = Date.now() + Math.max(30, (tok.expires_in || 300)) * 1000;
-      if (tok.refresh_token) refreshToken = tok.refresh_token;
-      // Re-read before writing back. There is ONE 'session' row, and this handle
-      // closed over the session it was made from — so a refresh that was already
-      // in flight when the user signed in as somebody else would put the OLD
-      // identity back, silently, over the new one. Only write if the row is still
-      // the session this handle belongs to.
-      const now = await idbGet('session');
-      if (now && now.webId !== s.webId) {
-        throw new Error('signed in as somebody else while this session was refreshing');
-      }
-      await idbPut('session', { ...s, accessToken, expiresAt, refreshToken });
-    };
-    const send = async (url, init) => {
-      const jwk = await jwkP;
-      const ath = b64u(await sha256(accessToken));
-      const headers = { ...(init.headers || {}), authorization: `DPoP ${accessToken}`, dpop: await dpopProof(s.pair, jwk, (init.method || 'GET'), url, ath) };
-      return fetch(url, { ...init, headers });
-    };
-    const authFetch = async (url, init = {}) => {
-      if (Date.now() > expiresAt - 30_000) await refresh();
-      const res = await send(url, init);
-      // A token the pod REFUSES is not only ever an expired one: a pod that
-      // restarted, a clock that drifted, a token the server stopped recognising
-      // all answer 401 while the clock here still says the token is good — so the
-      // renewal above never fires and every call fails from then on. Renew once
-      // and ask again.
-      if (res.status === 401 && refreshToken) {
-        try { await refresh(); } catch { return res; }
-        return send(url, init);
-      }
-      return res;
-    };
-    // `issuer` so a page that cannot renew can send the person back to the right
-    // login without asking them for their address again.
-    return { webId: s.webId, issuer: s.issuer, fetch: authFetch, refresh, signOut };
-  }
-
-  return { beginLogin, completeLogin, getSession, signOut };
-}

package/web/app/site/demo/tokens.css

@@ -1,68 +0,0 @@
-/* tokens.css — the FediPod design tokens: the front page's palette
-   (web/app/index.html), so the front, the record page, the bar and the client
-   shell are one visual system. The front is the reference; these values mirror
-   its :root. Declared under every name the pages already use — plus aliases
-   (--ink=--fg, --muted=--sub, --link=--accent, --field-edge=--field-border,
-   --danger=--err, --ring=--focus) — so a page only has to drop its own :root
-   colours and inherit these. The base size and the font family live here too:
-   20px base, Arial, and nothing on any page below 16px. */
-:root {
-  color-scheme: light dark;
-  font-size: 125%;                      /* 20px base (125% of 16) */
-  --font: Arial, Helvetica, sans-serif;  /* one family across the site */
-
-  /* ground + text */
-  --bg: #ffffff; --fg: #1a1a1a; --ink: #1a1a1a;
-  --surface: #f0f2f5;          /* the page ground behind cards */
-  --raised: #ffffff;           /* cards, the rail, the bar band, dialogs */
-
-  /* structure + action */
-  --heading: #2c4a35; --accent: #12467e; --link: #12467e;
-  --sub: #565656; --muted: #565656; --line: #b0b0b0;
-
-  /* fields */
-  --field-bg: #ececec; --field-bg-hover: #e2e4e8; --field-hover: #e2e4e8;
-  --field-text: #141414; --field-edge: #6f6f6f; --field-border: #6f6f6f;
-
-  /* buttons — filled, muted forest green (like the front) */
-  --btn: #3a5f43; --btn-hover: #30503a; --btn-text: #ffffff;
-  --btn-bg: #ececec; --btn-bg-hover: #e2e4e8; --btn-bg-active: #d8dade; --btn-edge: #6f6f6f;
-
-  /* status + focus */
-  --err: #b00020; --danger: #b00020; --warn: #8a4b00; --ok: #1f7a3d;
-  --focus: #12467e; --ring: #12467e;
-
-  /* the edge of a dialog: bright against the page behind it */
-  --dialog-edge: #b8b8b8;
-
-  /* every other row of a table. A stripe nobody can see is not a stripe:
-     this is a real step from the page, not a hint of one. */
-  --stripe: #d3dce8;
-
-  --chevron: url("data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' width='10' height='6'><path d='M1 1l4 4 4-4' fill='none' stroke='%23124f8a' stroke-width='1.6' stroke-linecap='round'/></svg>");
-}
-
-@media (prefers-color-scheme: dark) {
-  :root {
-    --bg: #191919; --fg: #f3f3f3; --ink: #f3f3f3;
-    --surface: #18191a; --raised: #242526;
-
-    --heading: #a7d4b5; --accent: #8fc2f2; --link: #8fc2f2;
-    --sub: #d2d2d2; --muted: #d2d2d2; --line: #6d6d6d;
-
-    --field-bg: #474747; --field-bg-hover: #515151; --field-hover: #515151;
-    --field-text: #f5f5f5; --field-edge: #9aa0a6; --field-border: #9aa0a6;
-
-    /* a touch brighter on the dark page so white text and the fill-vs-page edge
-       both clear their contrast floors — still muted (kept in sync with the front) */
-    --btn: #4a7a54; --btn-hover: #3f6a49; --btn-text: #ffffff;
-    --btn-bg: #474747; --btn-bg-hover: #515151; --btn-bg-active: #5b5b5b; --btn-edge: #9aa0a6;
-
-    --err: #ff9b9b; --danger: #ff9b9b; --warn: #ffb366; --ok: #7fd39a;
-    --focus: #8fc2f2; --ring: #8fc2f2;
-    --dialog-edge: #f3f3f3;
-    --stripe: #363c45;
-
-    --chevron: url("data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' width='10' height='6'><path d='M1 1l4 4 4-4' fill='none' stroke='%23bcd8f0' stroke-width='1.6' stroke-linecap='round'/></svg>");
-  }
-}

package/web/app/site/icons/forum.svg

@@ -1,11 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">
-<!-- The forum: more than one person talking. Icon "messages-square" from
-     Lucide (lucide.dev), ISC licence, © Lucide Contributors. -->
-<title>Federated Solid Forum</title>
-<rect width="32" height="32" rx="7" fill="#3b5bb5"/>
-<g transform="translate(4 4)" fill="none" stroke="#ffffff" stroke-width="2"
-   stroke-linecap="round" stroke-linejoin="round">
-  <path d="M16 10a2 2 0 0 1-2 2H6.828a2 2 0 0 0-1.414.586l-2.202 2.202A.71.71 0 0 1 2 14.286V4a2 2 0 0 1 2-2h10a2 2 0 0 1 2 2z"/>
-  <path d="M20 9a2 2 0 0 1 2 2v10.286a.71.71 0 0 1-1.212.502l-2.202-2.202A2 2 0 0 0 17.172 19H10a2 2 0 0 1-2-2v-1"/>
-</g>
-</svg>

package/web/app/site/icons/gateway.svg

@@ -1,14 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">
-<!-- The gateway: the door your mail comes through. Icon "door-open" from
-     Lucide (lucide.dev), ISC licence, © Lucide Contributors. -->
-<title>FediPod gateway</title>
-<rect width="32" height="32" rx="7" fill="#b4531a"/>
-<g transform="translate(4 4)" fill="none" stroke="#ffffff" stroke-width="2"
-   stroke-linecap="round" stroke-linejoin="round">
-  <path d="M10 21H2"/>
-  <path d="M10 3H7a2 2 0 00-2 2v16"/>
-  <path d="M14 12h.01"/>
-  <path d="M19 21V5a2 2 0 00-1.675-1.974l-6.163-1.013A1 1 0 0010 3v18a1 1 0 001.124.992z"/>
-  <path d="M22 21h-3"/>
-</g>
-</svg>

package/web/app/site/icons/local.svg

@@ -1,11 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">
-<!-- Your own pod and your own posts. Icon "house" from Lucide (lucide.dev),
-     ISC licence, © Lucide Contributors. -->
-<title>FediPod</title>
-<rect width="32" height="32" rx="7" fill="#2f7d4f"/>
-<g transform="translate(4 4)" fill="none" stroke="#ffffff" stroke-width="2"
-   stroke-linecap="round" stroke-linejoin="round">
-  <path d="M15 21v-8a1 1 0 0 0-1-1h-4a1 1 0 0 0-1 1v8"/>
-  <path d="M3 10a2 2 0 0 1 .709-1.528l7-6a2 2 0 0 1 2.582 0l7 6A2 2 0 0 1 21 10v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/>
-</g>
-</svg>

package/web/app/site/index.html

@@ -1,255 +0,0 @@
-<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https:; form-action 'self'; base-uri 'none'">
-<title>FediPod</title>
-<link rel="icon" href="/icons/local.svg" type="image/svg+xml">
-<style>
-:root {
-  color-scheme: light dark;
-  font-size: 125%;                      /* 20px default (125% of 16) */
-  --bg: #ffffff; --fg: #1a1a1a;
-  --heading: #2c4a35; --sub: #565656; --line: #b0b0b0; --accent: #12467e;
-  --btn: #3a5f43; --btn-hover: #30503a; --btn-text: #ffffff;
-  --field-bg: #ececec; --field-text: #141414; --field-border: #6f6f6f;
-  --select-bg: #dce7f3; --select-border: #12467e;
-  --err: #b00020; --warn: #8a4b00; --focus: #12467e;
-}
-@media (prefers-color-scheme: dark) {
-  :root {
-    --bg: #191919; --fg: #f3f3f3;
-    --heading: #a7d4b5; --sub: #d2d2d2; --line: #6d6d6d; --accent: #8fc2f2;
-    --field-bg: #474747; --field-text: #f5f5f5; --field-border: #9aa0a6;
-    --select-bg: #2f4a66; --select-border: #8fc2f2;
-    --btn: #4a7a54; --btn-hover: #3f6a49;
-    --err: #ff9b9b; --warn: #ffb366; --focus: #8fc2f2;
-  }
-}
-body { font: 1rem/1.55 Arial, Helvetica, sans-serif; margin: 0; background: var(--bg); color: var(--fg); }
-#page { max-width: 42rem; margin: 0 auto; padding: 1.75rem 1rem 4rem; box-sizing: border-box; }
-h1, h2, h3 { color: var(--heading); }
-h1 { font-size: 1.6rem; margin: 0 0 .5rem; }
-#brand { margin: 0 0 1.25rem; }
-h2 { font-size: 1.2rem; margin: 2rem 0 .5rem; }
-p { margin: .6rem 0; }
-code { background: rgba(120,120,120,.18); padding: .05em .35em; border-radius: 4px; }
-.sub { color: var(--sub); margin-top: 0; }
-.hint { color: var(--sub); font-size: .95rem; margin: .15rem 0 0; }    /* ~17px, never under 16 */
-.grouplabel { display: block; margin: .75rem 0 .2rem; font-weight: 600; }
-fieldset { border: 1px solid var(--line); border-radius: .4rem; margin: 1rem 0; padding: .75rem 1rem 1rem; }
-legend { padding: 0 .3rem; font-weight: 600; }
-label { display: block; margin: .75rem 0 .2rem; }
-input[type=text], input[type=email], input[type=url], input[type=password], select {
-  font: inherit; font-size: 1rem; width: 100%; padding: .55rem; box-sizing: border-box;
-  border: 1px solid var(--field-border); border-radius: .3rem;
-  background: var(--field-bg); color: var(--field-text); }
-/* A list to pick from looks different from a box to type in: its own tint,
-   the accent border, and the same on its options. */
-select { background: var(--select-bg); border-color: var(--select-border); }
-select option { background: var(--select-bg); color: var(--field-text); }
-::placeholder { color: var(--sub); opacity: 1; }
-.choice { display: block; margin: .4rem 0; font-weight: normal; }
-.choice input { margin-right: .5rem; width: auto; }
-button { font: inherit; font-size: 1rem; padding: .6rem 1.3rem; border-radius: .4rem;
-  border: 1px solid var(--btn); background: var(--btn); color: var(--btn-text);
-  font-weight: 600; cursor: pointer; }
-button:hover { background: var(--btn-hover); border-color: var(--btn-hover); }
-button.primary { font-weight: 700; }
-button:disabled { opacity: .55; cursor: default; }
-#create { margin-bottom: 2rem; }
-:focus-visible { outline: 3px solid var(--focus); outline-offset: 2px; }
-.row { display: flex; gap: .5rem; align-items: center; }
-.row input { flex: 1; }
-.row button { white-space: nowrap; }
-.address { font-size: 1.25rem; font-weight: 700; word-break: break-all; color: var(--fg); }
-.warn { border-left: .25rem solid var(--warn); padding-left: .75rem; color: var(--warn); }
-.err { border-left: .25rem solid var(--err); padding-left: .75rem; color: var(--err); }
-.err:empty { display: none; }
-.steps { list-style: none; padding: 0; }
-.steps li { padding: .3rem 0; }
-a { color: var(--accent); }
-[hidden] { display: none !important; }
-</style>
-<meta name="fedipod-version" content="1.27.2">
-<meta name="fedipod-build" content="745d128275bf">
-<script src="/update.js" defer></script>
-</head>
-<body>
-<main id="page">
-
-<!-- The marketing hero: shown on the landing, hidden once a form is up. -->
-<header id="hero">
-  <h1>FediPod - join the Fediverse from a Solid pod.</h1>
-  <p>Welcome to <b>fedipod.net</b>! By creating an account here, you can get a free Solid pod
-  and Fediverse identity or link to your existing pod/identity. Your fedipod.net
-  account provides you a portal to the Fediverse and filters unverified mail.</p>
-
-  <p>There is nothing to install, once you've setup an account, just point any browser at
-  <code>https://fedipod.net</code> and sign in.</p>
-</header>
-
-<!-- The short brand: shown only when a form is up, so the form stands alone. -->
-<h1 id="brand" hidden>FediPod</h1>
-
-<p id="loading" role="status">Loading…</p>
-
-<section id="landing" hidden>
-  <h2>Already have a FediPod account?</h2>
-  <p class="row">
-    <input type="text" id="signin-address" autocomplete="username" autocapitalize="off" spellcheck="false" placeholder="@me@mypod"
-      aria-label="Your FediPod address, in the form @you@yourpod">
-    <button type="button" class="primary" id="signin">sign in</button>
-  </p>
-  <p class="err" id="signin-error" role="alert"></p>
-  <h2>New user?</h2>
-  <p><button type="button" class="primary" id="create">create an account</button></p>
-  <p>Fedipod.net is a FediPod Gateway operated by Jeff Zucker. You can detach from the gateway at any
-  time and transfer your account either to your own FediPod Gateway (easy to set up on a free tier Netlify) 
-  or to any Fediverse server. All of your data lives on your pod and your Fediverse identity is yours
-  forever independent of which gateway you attach to.</p>
-  <p>For more information, see
-    <a href="https://github.com/jeff-zucker/FediPod">github.com/jeff-zucker/FediPod</a></p>
-</section>
-
-<!-- Shown only on a browser that has signed in but has never opened the signing
-     key. The key is kept on the pod encrypted under the sign-up password, so
-     the pod's host cannot sign as you; a browser opens it once and remembers.
-     The second block is for someone who no longer has that password: a new
-     key, locked under the password they use now. -->
-<section id="unlock" hidden>
-  <h2>Unlock your signing key</h2>
-  <p>Your signing key is stored on your pod, locked under the password you gave
-  when you signed up, so nobody who can read your pod — your pod's host included
-  — can post as you. This browser has not opened it yet.</p>
-  <p class="row">
-    <input type="password" id="unlock-password" autocomplete="current-password"
-      placeholder="Your password" aria-label="Your password">
-    <button type="button" class="primary" id="unlock-go">unlock</button>
-  </p>
-  <p class="err" id="unlock-error" role="alert"></p>
-  <p class="hint">This browser only — it is not sent anywhere.</p>
-  <h2>Changed your pod password, or lost the old one?</h2>
-  <p>Make a new signing key, locked under the password you use now. Your account,
-  address, posts and followers stay as they are; other servers learn the new key
-  the next time they hear from you.</p>
-  <p><button type="button" id="unlock-newkey">make a new signing key</button></p>
-  <p id="unlock-newkey-confirm" hidden>This replaces the key on your pod. Type the
-  password you use now in the field above, then
-  <button type="button" id="unlock-newkey-go">make the new key</button></p>
-</section>
-
-
-<section id="pane-form" hidden>
-  <form id="form">
-
-    <!-- Screen 1: Your Solid Pod -->
-    <div class="step" id="step-1">
-      <fieldset>
-        <legend>Your Solid Pod</legend>
-
-        <div role="radiogroup" aria-labelledby="podtype-label">
-          <span id="podtype-label" class="grouplabel">Pod type</span>
-          <label class="choice"><input type="radio" name="mode" value="existing"> An existing pod</label>
-          <label class="choice"><input type="radio" name="mode" value="new" checked> A new pod</label>
-        </div>
-
-        <label for="provider">Pod provider</label>
-        <!-- The providers listed at https://solidproject.org/get_a_pod that run Community
-             Solid Server, whose account API is what "A new pod" uses. Checked 2026-09-14. -->
-        <select id="provider" name="provider">
-          <option value="https://solidcommunity.net">solidcommunity.net</option>
-          <option value="https://privatedatapod.com">privatedatapod.com</option>
-          <option value="https://solid.redpencil.io">redpencil.io</option>
-          <option value="https://pods.solidcommunity.au">solidcommunity.au</option>
-          <option value="https://solidweb.me">solidweb.me</option>
-          <option value="https://teamid.live">teamid.live</option>
-          <option value="">Other…</option>
-        </select>
-        <div id="provider-other-field" hidden>
-          <label for="providerOther">Provider address</label>
-          <input type="url" id="providerOther" name="providerOther" autocomplete="url" placeholder="https://pods.example.org">
-        </div>
-
-        <div id="podname-field">
-          <label for="podName">Pod username</label>
-          <input type="text" id="podName" name="podName" autocomplete="off" aria-describedby="podname-hint">
-          <p class="hint" id="podname-hint">Depending on your provider's setup, your pod will be at
-            either https://USERNAME.podprovider or https://podprovider/USERNAME.</p>
-        </div>
-
-        <div id="pod-field" hidden>
-          <label for="pod">Pod address</label>
-          <input type="url" id="pod" name="pod" autocomplete="url" aria-describedby="pod-hint"
-            placeholder="https://alice.solidcommunity.net/ or https://server.example/alice/">
-          <p class="hint" id="pod-hint">The address of your pod: its own host, or a path on a
-            suffix-based host.</p>
-        </div>
-
-        <label for="email">Email (used as pod id)</label>
-        <input type="email" id="email" name="email" autocomplete="email" placeholder="you@example.org">
-
-        <label for="password">Pod password</label>
-        <input type="password" id="password" name="password" autocomplete="new-password"
-          aria-describedby="password-hint">
-        <p class="hint" id="password-hint">Your password is sent once, to make your account and to
-          lock your signing key. It is never stored. The credential used to set things up is
-          deleted when setup finishes — from then on this browser signs in through your pod,
-          the way any other Solid app does.</p>
-      </fieldset>
-      <p class="err" id="err-1" role="alert"></p>
-      <p>
-        <button type="button" id="cancel">Cancel</button>
-        <button type="button" class="primary" id="to-2">Continue</button>
-      </p>
-    </div>
-
-    <!-- Screen 2: Your Fediverse Identity -->
-    <div class="step" id="step-2" hidden>
-      <fieldset>
-        <legend>Your Fediverse Identity</legend>
-
-        <label for="handle">Fediverse handle</label>
-        <input type="text" id="handle" name="handle" autocomplete="off"
-          placeholder="the handle part of your address: @HANDLE@server" aria-describedby="handle-hint">
-        <p class="hint" id="handle-hint">The name in your Fediverse address. This is permanent.
-          Letters, digits, and hyphens only.</p>
-
-        <div role="radiogroup" aria-labelledby="shape-label" id="shape-group">
-          <span id="shape-label" class="grouplabel">Where your address lives</span>
-          <label class="choice"><input type="radio" name="shape" value="pod" checked> On your pod</label>
-          <label class="choice"><input type="radio" name="shape" value="front"> At this site</label>
-        </div>
-        <p class="hint" id="shape-hint" hidden>Your pod provider uses suffixes, so your only option
-          is to use an account on a gateway like this one.</p>
-
-        <span id="addr-label" class="grouplabel">Your Fediverse address</span>
-        <p class="address" id="preview" role="status" aria-live="polite" aria-labelledby="addr-label">@…@…</p>
-      </fieldset>
-      <p class="hint">The handle and the pod cannot be changed afterwards. Everything else — display
-        name, bio, pictures — you set later in the client.</p>
-      <p class="err" id="form-error" role="alert"></p>
-      <p>
-        <button type="button" id="back-1">Back</button>
-        <button type="submit" class="primary" id="submit">Create Pod and Fediverse accounts</button>
-      </p>
-    </div>
-
-  </form>
-</section>
-
-<section id="running" hidden>
-  <h2 id="running-title">Setting up…</h2>
-  <ul class="steps" id="steps" aria-live="polite"></ul>
-  <p class="err" id="run-error" role="alert"></p>
-  <p id="run-actions" hidden>
-    <button type="button" id="run-back">Start over</button>
-    <button type="button" class="primary" id="run-retry">Try again</button>
-  </p>
-</section>
-
-</main>
-<script type="module" src="/boot.js"></script>
-</body>
-</html>