fedipod-server 0.28.1 → 0.30.0

package/web/app/fediacct-browser.mjs

@@ -1,146 +0,0 @@
-// fediacct-browser.mjs — connections to fediverse accounts the owner holds on
-// OTHER servers, in the browser.
-//
-// Same FediAccounts client the Node agent uses (lib/fediacct.mjs): the same
-// OAuth dance and authenticated calls. What the browser adds is the owner's
-// per-connection storage choice, the same one Bluesky has:
-//
-//  - "browser": the credential lives in IndexedDB on this device (default).
-//  - "pod": it lives in the owner-only pod state, so it follows the owner to
-//    any browser they sign in from.
-//
-// A record carries which backend it lives in; list() merges both, and moving a
-// connection is a re-write to the other backend. App registrations and the
-// short-lived OAuth "pending" state stay in IndexedDB (per browser), and the
-// pending state is persisted so a connection survives the worker being
-// idle-killed between the redirect out and the code coming back.
-import { FediAccounts } from '../../lib/connections/fediacct.mjs';
-import { kvAll, kvPut, kvDel } from './idb-kv.mjs';
-
-const POD_DOC = 'fediaccts.json';   // { id: record } for pod-stored connections
-const PEND_TTL_MS = 10 * 60_000;
-
-export class BrowserFediAccounts extends FediAccounts {
-  constructor({ store, actorId = null, log = console.log } = {}) {
-    super({ localDir: '/fediaccts', actorId, log });   // localDir unused; storage below
-    this.store = store;
-    this._recs = new Map();     // browser (IndexedDB) records, id → record
-    this._apps = new Map();     // host → app registration
-  }
-
-  async load() {
-    const all = await kvAll().catch(() => ({}));
-    for (const [k, v] of Object.entries(all)) {
-      if (k.startsWith('rec:')) this._recs.set(k.slice(4), v);
-      else if (k.startsWith('app:')) this._apps.set(k.slice(4), v);
-      else if (k.startsWith('pend:')) this.pending.set(k.slice(5), v);
-    }
-    const now = Date.now();
-    for (const [s, p] of this.pending) if (now - p.at > PEND_TTL_MS) { this.pending.delete(s); kvDel('pend:' + s).catch(() => {}); }
-    return this;
-  }
-
-  _podMap() { return this.store.read(POD_DOC, {}) || {}; }
-
-  // ---- records, across both backends ----
-  ids() { return [...new Set([...this._recs.keys(), ...Object.keys(this._podMap())])]; }
-
-  read(id) {
-    let rec = null; let where = null;
-    if (this._recs.has(id)) { rec = this._recs.get(id); where = 'browser'; }
-    else { const p = this._podMap()[id]; if (p) { rec = p; where = 'pod'; } }
-    if (!rec) return null;
-    if (rec.mintedFor && this.actorId && rec.mintedFor !== this.actorId) {
-      this.log(`fediaccts/${id} belongs to ${rec.mintedFor} — not reusing it for ${this.actorId}`);
-      return null;
-    }
-    return { ...rec, storage: where };
-  }
-
-  write(rec) {
-    const where = rec.storage || 'browser';
-    const clean = { ...rec, storage: where };
-    if (where === 'pod') {
-      const map = { ...this._podMap(), [clean.id]: clean };
-      this.store.write(POD_DOC, map); this.store.flush?.().catch(() => {});
-      this._recs.delete(clean.id); kvDel('rec:' + clean.id).catch(() => {});
-    } else {
-      this._recs.set(clean.id, clean); kvPut('rec:' + clean.id, clean).catch((e) => this.log(`fediacct persist: ${e.message}`));
-      const map = this._podMap();
-      if (clean.id in map) { delete map[clean.id]; this.store.write(POD_DOC, map); this.store.flush?.().catch(() => {}); }
-    }
-  }
-
-  // Best-effort: tell the server to revoke our token (RFC 7009), so a
-  // disconnect actually invalidates it there — not just locally. Mirrors
-  // atproto's deleteSession. Called before remove(); a failure never blocks the
-  // local removal. For a pod-stored connection this is what lets one device
-  // revoke a token another device (a stolen phone) is holding.
-  async revoke(id) {
-    const rec = this.read(id);
-    const app = this._apps.get(rec?.host);
-    if (!rec?.token || !app?.clientId) return;
-    try {
-      await this._fetch(rec.host, `https://${rec.host}/oauth/revoke`, {
-        method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' },
-        body: new URLSearchParams({ client_id: app.clientId, client_secret: app.clientSecret, token: rec.token }).toString(),
-      });
-      this.log(`revoked our token at ${rec.host}`);
-    } catch (e) { this.log(`revoke at ${rec.host} failed (removing locally anyway): ${e.message}`); }
-  }
-
-  remove(id) {
-    const had = this._recs.has(id) || (id in this._podMap());
-    if (!had) return false;
-    this._recs.delete(id); kvDel('rec:' + id).catch(() => {});
-    const map = this._podMap();
-    if (id in map) { delete map[id]; this.store.write(POD_DOC, map); this.store.flush?.().catch(() => {}); }
-    this.log(`Fediverse account disconnected: ${id}`);
-    return true;
-  }
-
-  // Carry the storage location out to the record page.
-  roster() { return this.list().map(r => ({ id: r.id, handle: r.handle, host: r.host, addedAt: r.addedAt || null, enabled: r.enabled !== false, storage: r.storage })); }
-  status() {
-    return this.list().map(r => ({
-      id: r.id, handle: r.handle, host: r.host, enabled: r.enabled !== false,
-      needsReconnect: !!r.needsReconnect, storage: r.storage,
-      cooldownFor: Math.max(0, Math.round(((this.pausedUntil.get(r.host) || 0) - Date.now()) / 1000)),
-    }));
-  }
-
-  // Move a connection between backends (the Options menu's Storage control).
-  setStorage(id, where) { const rec = this.read(id); if (rec && (where === 'pod' || where === 'browser')) { this.write({ ...rec, storage: where }); return this.roster().find(r => r.id === id) || null; } return null; }
-
-  // One app registration per host, remembered — over IndexedDB.
-  async appFor(host, redirectUri) {
-    const cached = this._apps.get(host);
-    if (cached && cached.redirectUri === redirectUri && cached.clientId && cached.clientSecret) return cached;
-    const res = await this._fetch(host, `https://${host}/api/v1/apps`, {
-      method: 'POST', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ client_name: 'FediPod', redirect_uris: redirectUri, scopes: 'read write', website: 'https://github.com/jeff-zucker/FediPod' }),
-    });
-    const body = await this._json(res, host);
-    if (!body.client_id || !body.client_secret) throw new Error(`${host} registered no client`);
-    const app = { host, redirectUri, clientId: body.client_id, clientSecret: body.client_secret };
-    this._apps.set(host, app); await kvPut('app:' + host, app).catch(() => {});
-    return app;
-  }
-
-  // Persist the pending state across the redirect (the worker may be idle-killed).
-  async begin(opts) {
-    const r = await super.begin(opts);
-    await kvPut('pend:' + r.state, this.pending.get(r.state)).catch(() => {});
-    return r;
-  }
-
-  async complete({ state, code }) {
-    if (!this.pending.has(state)) {
-      const p = await kvAll().then((a) => a['pend:' + state]).catch(() => null);
-      if (p) this.pending.set(state, p);
-    }
-    const row = await super.complete({ state, code });
-    await kvDel('pend:' + state).catch(() => {});
-    return row;
-  }
-}

package/web/app/gateway-move.mjs

@@ -1,60 +0,0 @@
-// gateway-move.mjs — the second half of moving an address from one gateway
-// to another (signup.mjs moveIn is the first). It runs on the agent's first
-// active boot under the new ids, once the new actor is published with the
-// old one as an alias, and it is safe to run again: nothing here is done
-// twice with the same result changed.
-//
-//   1. The old gateway is told the address moved (POST /api/move, proved
-//      with the pod session as attach was). It serves the old actor as a
-//      moved stub from then on — same key, old id, `movedTo` the new one.
-//   2. A Move goes to every follower, FROM the old actor, signed under the
-//      old key id, through the old gateway's relay: that is the only
-//      signature a follower's server can verify against the old actor.
-//
-// The followers' servers fetch the old actor, find `movedTo`, fetch the new
-// one, find the old among its `alsoKnownAs`, and move the follow.
-import { RelayDeliverer } from './deliver-relay.mjs';
-import { moveActivity } from '../../lib/core/wire.mjs';
-
-export async function completeGatewayMove(agent) {
-  const cfg = agent.store.getConfig();
-  const mv = cfg?.movedFrom;
-  if (!mv || mv.completedAt) return null;
-  const log = agent.log;
-  const newActor = agent.urls.actor;
-
-  // 1. the old gateway
-  let told;
-  try {
-    told = await agent.sessionFetch(`${mv.gateway}/api/move`, {
-      method: 'POST', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ handle: mv.handle, movedTo: newActor }),
-    });
-  } catch (e) { told = { status: 0, statusText: e.message }; }
-  if (told.status !== 200) {
-    // Left pending: the next active boot tries again. Followers are not told
-    // until the old actor can vouch for the Move.
-    log(`gateway move: ${mv.gateway} did not mark @${mv.handle} as moved (${told.status || told.statusText}) — will retry`);
-    return { told: false };
-  }
-
-  // 2. the Move, from the old address
-  const contacts = agent.store.getContacts();
-  const inboxes = [...new Set(contacts.followers.map((f) => f.sharedInbox || f.inbox).filter(Boolean))];
-  const activity = moveActivity({ actor: mv.actor }, newActor, Date.now());
-  const sender = new RelayDeliverer({
-    passive: true, store: agent.store, rsaPrivate: agent.deliverer.rsaPrivate,
-    keyId: `${mv.actor}#main-key`, actorId: mv.actor, log,
-    relayUrl: `${mv.gateway}/api/relay`, handle: mv.handle, sessionFetch: agent.sessionFetch,
-  });
-  let sent = 0; let failed = 0;
-  for (const inbox of inboxes) {
-    try { await sender.deliverNow(inbox, activity); sent++; }
-    catch (e) { failed++; log(`gateway move: Move to ${inbox} failed: ${e.message}`); }
-  }
-  const done = { ...mv, completedAt: new Date().toISOString(), moveSent: sent, moveFailed: failed };
-  agent.store.setConfig({ ...agent.store.getConfig(), movedFrom: done });
-  await agent.store.flush?.();
-  log(`moved from ${mv.actor} to ${newActor}: Move sent to ${sent} inbox(es)${failed ? `, ${failed} failed` : ''}`);
-  return done;
-}

package/web/app/idb-kv.mjs

@@ -1,35 +0,0 @@
-// idb-kv.mjs — a tiny per-origin key/value store on IndexedDB, for the browser
-// agent's "on this device, never the pod" storage: a connected account's
-// credential when the owner chooses to keep it in this browser rather than let
-// it follow them to their pod. Shared by atproto-browser and fediacct-browser.
-const DB = 'fedipod-accounts';
-
-function open() {
-  return new Promise((res, rej) => {
-    const r = indexedDB.open(DB, 1);
-    r.onupgradeneeded = () => { const db = r.result; if (!db.objectStoreNames.contains('kv')) db.createObjectStore('kv'); };
-    r.onsuccess = () => res(r.result);
-    r.onerror = () => rej(r.error);
-  });
-}
-
-export async function kvGet(key) {
-  const db = await open();
-  return new Promise((res, rej) => { const rq = db.transaction('kv', 'readonly').objectStore('kv').get(key); rq.onsuccess = () => res(rq.result ?? null); rq.onerror = () => rej(rq.error); });
-}
-export async function kvAll() {
-  const db = await open();
-  return new Promise((res, rej) => {
-    const out = {}; const cur = db.transaction('kv', 'readonly').objectStore('kv').openCursor();
-    cur.onsuccess = () => { const c = cur.result; if (c) { out[c.key] = c.value; c.continue(); } else res(out); };
-    cur.onerror = () => rej(cur.error);
-  });
-}
-export async function kvPut(key, val) {
-  const db = await open();
-  return new Promise((res, rej) => { const tx = db.transaction('kv', 'readwrite'); tx.objectStore('kv').put(val, key); tx.oncomplete = () => res(); tx.onerror = () => rej(tx.error); });
-}
-export async function kvDel(key) {
-  const db = await open();
-  return new Promise((res, rej) => { const tx = db.transaction('kv', 'readwrite'); tx.objectStore('kv').delete(key); tx.oncomplete = () => res(); tx.onerror = () => rej(tx.error); });
-}

package/web/app/index.html

@@ -1,242 +0,0 @@
-<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https:; form-action 'self'; base-uri 'none'">
-<title>FediPod</title>
-<link rel="icon" href="/icons/local.svg" type="image/svg+xml">
-<style>
-:root {
-  color-scheme: light dark;
-  font-size: 125%;                      /* 20px default (125% of 16) */
-  --bg: #ffffff; --fg: #1a1a1a;
-  --heading: #2c4a35; --sub: #565656; --line: #b0b0b0; --accent: #12467e;
-  --btn: #3a5f43; --btn-hover: #30503a; --btn-text: #ffffff;
-  --field-bg: #ececec; --field-text: #141414; --field-border: #6f6f6f;
-  --select-bg: #dce7f3; --select-border: #12467e;
-  --err: #b00020; --warn: #8a4b00; --focus: #12467e;
-}
-@media (prefers-color-scheme: dark) {
-  :root {
-    --bg: #191919; --fg: #f3f3f3;
-    --heading: #a7d4b5; --sub: #d2d2d2; --line: #6d6d6d; --accent: #8fc2f2;
-    --field-bg: #474747; --field-text: #f5f5f5; --field-border: #9aa0a6;
-    --select-bg: #2f4a66; --select-border: #8fc2f2;
-    --btn: #4a7a54; --btn-hover: #3f6a49;
-    --err: #ff9b9b; --warn: #ffb366; --focus: #8fc2f2;
-  }
-}
-body { font: 1rem/1.55 Arial, Helvetica, sans-serif; margin: 0; background: var(--bg); color: var(--fg); }
-#page { max-width: 42rem; margin: 0 auto; padding: 1.75rem 1rem 4rem; box-sizing: border-box; }
-h1, h2, h3 { color: var(--heading); }
-h1 { font-size: 1.6rem; margin: 0 0 .5rem; }
-#brand { margin: 0 0 1.25rem; }
-h2 { font-size: 1.2rem; margin: 2rem 0 .5rem; }
-p { margin: .6rem 0; }
-code { background: rgba(120,120,120,.18); padding: .05em .35em; border-radius: 4px; }
-.sub { color: var(--sub); margin-top: 0; }
-.hint { color: var(--sub); font-size: .95rem; margin: .15rem 0 0; }    /* ~17px, never under 16 */
-.grouplabel { display: block; margin: .75rem 0 .2rem; font-weight: 600; }
-fieldset { border: 1px solid var(--line); border-radius: .4rem; margin: 1rem 0; padding: .75rem 1rem 1rem; }
-legend { padding: 0 .3rem; font-weight: 600; }
-label { display: block; margin: .75rem 0 .2rem; }
-input[type=text], input[type=email], input[type=url], input[type=password], select {
-  font: inherit; font-size: 1rem; width: 100%; padding: .55rem; box-sizing: border-box;
-  border: 1px solid var(--field-border); border-radius: .3rem;
-  background: var(--field-bg); color: var(--field-text); }
-/* A list to pick from looks different from a box to type in: its own tint,
-   the accent border, and the same on its options. */
-select { background: var(--select-bg); border-color: var(--select-border); }
-select option { background: var(--select-bg); color: var(--field-text); }
-::placeholder { color: var(--sub); opacity: 1; }
-.choice { display: block; margin: .4rem 0; font-weight: normal; }
-.choice input { margin-right: .5rem; width: auto; }
-button { font: inherit; font-size: 1rem; padding: .6rem 1.3rem; border-radius: .4rem;
-  border: 1px solid var(--btn); background: var(--btn); color: var(--btn-text);
-  font-weight: 600; cursor: pointer; }
-button:hover { background: var(--btn-hover); border-color: var(--btn-hover); }
-button.primary { font-weight: 700; }
-button:disabled { opacity: .55; cursor: default; }
-#create { margin-bottom: 2rem; }
-:focus-visible { outline: 3px solid var(--focus); outline-offset: 2px; }
-.row { display: flex; gap: .5rem; align-items: center; }
-.row input { flex: 1; }
-.row button { white-space: nowrap; }
-.address { font-size: 1.25rem; font-weight: 700; word-break: break-all; color: var(--fg); }
-.warn { border-left: .25rem solid var(--warn); padding-left: .75rem; color: var(--warn); }
-.err { border-left: .25rem solid var(--err); padding-left: .75rem; color: var(--err); }
-.err:empty { display: none; }
-.steps { list-style: none; padding: 0; }
-.steps li { padding: .3rem 0; }
-a { color: var(--accent); }
-[hidden] { display: none !important; }
-</style>
-</head>
-<body>
-<main id="page">
-
-<!-- The marketing hero: shown on the landing, hidden once a form is up. -->
-<header id="hero">
-  <h1>FediPod - join the Fediverse from a Solid pod.</h1>
-  <p>Welcome to <b>fedipod.net</b>! By creating an account here, you can get a free Solid pod
-  and Fediverse identity or link to your existing pod/identity. Your fedipod.net
-  account provides you a portal to the Fediverse and filters unverified mail.</p>
-
-  <p>There is nothing to install, once you've setup an account, just point any browser at
-  <code>https://fedipod.net</code> and sign in.</p>
-</header>
-
-<!-- The short brand: shown only when a form is up, so the form stands alone. -->
-<h1 id="brand" hidden>FediPod</h1>
-
-<p id="loading" role="status">Loading…</p>
-
-<section id="landing" hidden>
-  <h2>Already have a FediPod account?</h2>
-  <p class="row">
-    <input type="text" id="signin-address" autocomplete="username" autocapitalize="off" spellcheck="false" placeholder="@me@mypod"
-      aria-label="Your FediPod address, in the form @you@yourpod">
-    <button type="button" class="primary" id="signin">sign in</button>
-  </p>
-  <p class="err" id="signin-error" role="alert"></p>
-  <h2>New user?</h2>
-  <p><button type="button" class="primary" id="create">create an account</button></p>
-  <p>Fedipod.net is a FediPod Gateway operated by Jeff Zucker. You can detach from the gateway at any
-  time and transfer your account either to your own FediPod Gateway (easy to set up on a free tier Netlify) 
-  or to any Fediverse server. All of your data lives on your pod and is yours regardless of which
-  gateway you are attached to.</p>
-  <p>For more information, see
-    <a href="https://github.com/jeff-zucker/FediPod">github.com/jeff-zucker/FediPod</a></p>
-</section>
-
-<!-- Shown only for an account made before 2026-09-22, whose signing key on
-     the pod is still under the password given at sign-up. It is opened once
-     and stored as it is from then on. The second block is for someone who no
-     longer has that password: a new key. -->
-<section id="unlock" hidden>
-  <h2>Open your signing key</h2>
-  <p>Your account was made when this site kept your signing key under the
-  password you gave at sign-up. Enter that password once. Your key is then
-  stored on your pod as it is, behind your pod's own login, and no browser
-  asks again.</p>
-  <p class="row">
-    <input type="password" id="unlock-password" autocomplete="current-password"
-      placeholder="The password you gave at sign-up" aria-label="The password you gave at sign-up">
-    <button type="button" class="primary" id="unlock-go">open</button>
-  </p>
-  <p class="err" id="unlock-error" role="alert"></p>
-  <p class="hint">This browser only — it is not sent anywhere.</p>
-  <h2>Lost that password?</h2>
-  <p>Make a new signing key instead. Your account, address, posts and followers
-  stay as they are; other servers learn the new key the next time they hear
-  from you.</p>
-  <p><button type="button" id="unlock-newkey">make a new signing key</button></p>
-  <p id="unlock-newkey-confirm" hidden>This replaces the key on your pod.
-  <button type="button" id="unlock-newkey-go">make the new key</button></p>
-</section>
-
-
-<section id="pane-form" hidden>
-  <form id="form">
-
-    <!-- Screen 1: Your Solid Pod -->
-    <div class="step" id="step-1">
-      <fieldset>
-        <legend>Your Solid Pod</legend>
-
-        <div role="radiogroup" aria-labelledby="podtype-label">
-          <span id="podtype-label" class="grouplabel">Pod type</span>
-          <label class="choice"><input type="radio" name="mode" value="existing"> An existing pod</label>
-          <label class="choice"><input type="radio" name="mode" value="new" checked> A new pod</label>
-        </div>
-
-        <label for="provider">Pod provider</label>
-        <!-- The providers listed at https://solidproject.org/get_a_pod that run Community
-             Solid Server, whose sign-up page "Create your pod" links to. Checked 2026-09-14. -->
-        <select id="provider" name="provider">
-          <option value="https://solidcommunity.net">solidcommunity.net</option>
-          <option value="https://privatedatapod.com">privatedatapod.com</option>
-          <option value="https://solid.redpencil.io">redpencil.io</option>
-          <option value="https://pods.solidcommunity.au">solidcommunity.au</option>
-          <option value="https://solidweb.me">solidweb.me</option>
-          <option value="https://teamid.live">teamid.live</option>
-          <option value="">Other…</option>
-        </select>
-        <div id="provider-other-field" hidden>
-          <label for="providerOther">Provider address</label>
-          <input type="url" id="providerOther" name="providerOther" autocomplete="url" placeholder="https://pods.example.org">
-        </div>
-
-        <div id="newpod-field">
-          <p>Make your pod on your provider's own page, then come back here.</p>
-          <p><a id="register-link" href="#" target="_blank" rel="noopener">Create your pod at your provider</a></p>
-        </div>
-
-        <p class="hint" id="signin-hint">Your password is typed at your pod only. This site
-          never sees it: you sign in at your pod, and it sends you back here.</p>
-      </fieldset>
-      <p class="err" id="err-1" role="alert"></p>
-      <p>
-        <button type="button" id="cancel">Cancel</button>
-        <button type="button" class="primary" id="to-2">Sign in at your pod</button>
-      </p>
-    </div>
-
-    <!-- Screen 2: Your Fediverse Identity — shown on return from the pod's login -->
-    <div class="step" id="step-2" hidden>
-      <fieldset>
-        <legend>Your Fediverse Identity</legend>
-
-        <span id="signed-pod-label" class="grouplabel">Your pod</span>
-        <p id="signed-pod" role="status" aria-labelledby="signed-pod-label"></p>
-
-        <!-- Shown when the pod's account lives at another gateway: this is a
-             move, not a new account. -->
-        <p id="movein-note" hidden>Moving <strong id="movein-from"></strong> to this site.
-          Your posts, followers and key come with you, and your followers are told the
-          new address. Keep the same handle, or choose a new one here.</p>
-
-        <label for="handle">Fediverse handle</label>
-        <input type="text" id="handle" name="handle" autocomplete="off"
-          placeholder="the handle part of your address: @HANDLE@server" aria-describedby="handle-hint">
-        <p class="hint" id="handle-hint">The name in your Fediverse address. This is permanent.
-          Letters, digits, and hyphens only.</p>
-
-        <div role="radiogroup" aria-labelledby="shape-label" id="shape-group">
-          <span id="shape-label" class="grouplabel">Where your address lives</span>
-          <label class="choice"><input type="radio" name="shape" value="pod" checked> On your pod</label>
-          <label class="choice"><input type="radio" name="shape" value="front"> At this site</label>
-        </div>
-        <p class="hint" id="shape-hint" hidden>Your pod provider uses suffixes, so your only option
-          is to use an account on a gateway like this one.</p>
-
-        <span id="addr-label" class="grouplabel">Your Fediverse address</span>
-        <p class="address" id="preview" role="status" aria-live="polite" aria-labelledby="addr-label">@…@…</p>
-      </fieldset>
-      <p class="hint">The handle and the pod cannot be changed afterwards. Everything else — display
-        name, bio, pictures — you set later in the client.</p>
-      <p class="err" id="form-error" role="alert"></p>
-      <p>
-        <button type="button" id="back-1">Back</button>
-        <button type="submit" class="primary" id="submit">Create your Fediverse account</button>
-      </p>
-    </div>
-
-  </form>
-</section>
-
-<section id="running" hidden>
-  <h2 id="running-title">Setting up…</h2>
-  <ul class="steps" id="steps" aria-live="polite"></ul>
-  <p class="err" id="run-error" role="alert"></p>
-  <p id="run-actions" hidden>
-    <button type="button" id="run-back">Start over</button>
-    <button type="button" class="primary" id="run-retry">Try again</button>
-  </p>
-</section>
-
-</main>
-<script type="module" src="/boot.js"></script>
-</body>
-</html>

package/web/app/keys-browser.mjs

@@ -1,71 +0,0 @@
-// keys-browser.mjs — turn the keys record (from keystore/the pod) into what the
-// agent's deliverer and publisher expect. The Node agent's resolveKeys returns
-// { rsaPrivate (a WebCrypto key), rsaPublicPem, edPrivate, edPublicMultibase };
-// this returns the same, RSA only. FEP-8b32 Ed25519 proofs are optional — the
-// deliverer treats a null edPrivate as "no proof", and an unproved activity
-// still federates — so the browser MVP omits them.
-//
-// The private key is imported NON-extractable, and the copy this browser keeps
-// in IndexedDB is that CryptoKey, not the PEM: it can sign and cannot be read
-// out, so a script that reaches this origin's storage gets nothing it can carry
-// away. The PEM record exists only in memory, between unwrap and import.
-import { kvGet, kvPut } from './idb-kv.mjs';
-import * as podState from '../../lib/pod/state.mjs';
-import { isKeyEnvelope, KeyPasswordNeeded } from './keystore.mjs';
-
-const pemToDer = (pem) => Uint8Array.from(
-  atob(pem.replace(/-----[^-]+-----/g, '').replace(/\s+/g, '')), (c) => c.charCodeAt(0));
-
-export async function importSigningKey(keysRecord) {
-  const rsaPrivate = await crypto.subtle.importKey('pkcs8', pemToDer(keysRecord.rsa.privatePem),
-    { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['sign']);
-  return { rsaPrivate, rsaPublicPem: keysRecord.rsa.publicPem, edPrivate: null, edPublicMultibase: null };
-}
-
-/** What the cache holds: the non-extractable key and the public half. */
-const fromCache = (c) => ({ rsaPrivate: c.rsaPrivate, rsaPublicPem: c.rsaPublicPem, edPrivate: null, edPublicMultibase: null });
-const isOpenedKey = (c) => c?.rsaPrivate?.type === 'private' && typeof c.rsaPublicPem === 'string';
-
-/**
- * Keep this browser's opened copy: import the record and store the CryptoKey.
- * Best effort on the store — a browser that refuses IndexedDB (private mode)
- * reads the pod's copy again on the way back in. Returns the imported keys.
- */
-export async function cacheOpenedKeys(actorUrl, keysRecord) {
-  const keys = await importSigningKey(keysRecord);
-  await kvPut(keyCacheKey(actorUrl), { rsaPrivate: keys.rsaPrivate, rsaPublicPem: keys.rsaPublicPem })
-    .catch(() => {});
-  return keys;
-}
-
-// Where this browser keeps its own opened copy of the signing key: a
-// non-extractable CryptoKey that never leaves the origin — the same protection
-// the OIDC session in the next IDB row already relies on. It is what lets the
-// worker boot itself after an idle kill without a network read.
-export const keyCacheKey = (actorUrl) => `signing-keys:${actorUrl}`;
-// The cache is keyed by the POD actor, whatever the identity advertises: a
-// fronted identity's advertised actor is the gateway's, and keying by that
-// would hide the opened copy sign-up stored and read the pod again.
-export const podActorOf = (urls) => (urls.toPod ? urls.toPod(urls.actor) : urls.actor);
-
-// Read the signing key for this actor and import it for signing.
-//
-// Two places hold one: this browser (opened, in IndexedDB) and the pod. The
-// browser's is tried first — no network read. Falling through to the pod covers
-// the browser that has just signed in and has no copy yet: the record is read
-// with the pod session and used as it stands. An envelope from before 1.28.0
-// needs the password and so has to go back to the page.
-export async function loadKeysFromPod(remote, urls) {
-  const podActor = podActorOf(urls);
-  const cached = await kvGet(keyCacheKey(podActor)).catch(() => null);
-  if (isOpenedKey(cached)) return fromCache(cached);
-  // A copy stored as PEM by an earlier build: import it and store the key form
-  // in its place, so the PEM is gone from storage after one boot.
-  if (cached?.rsa?.privatePem) return cacheOpenedKeys(podActor, cached);
-
-  const doc = await podState.readKeys(remote, urls);
-  if (isKeyEnvelope(doc)) throw new KeyPasswordNeeded();
-  if (!doc || !doc.rsa) throw new Error('no signing key on the pod — sign up did not finish');
-  // Cache it so the next boot is no read at all.
-  return cacheOpenedKeys(podActor, doc);
-}

package/web/app/keystore.mjs

@@ -1,82 +0,0 @@
-// keystore.mjs — the signing keys, made in the browser and stored on the pod.
-//
-// The Node agent keeps keys.json (RSA + Ed25519 PEMs) on disk, 0600. A browser
-// has no disk it can carry to the next machine, so the durable copy lives on
-// the pod, in an owner-only container: the same access rule every private
-// document on the pod lives under, reachable through the pod's own login and
-// by nobody else. The shape is exactly the agent's keys.json, so it is used
-// unchanged. A new browser reads it with its pod session and asks for nothing.
-//
-// Until 2026-09-22 the pod's copy was encrypted under the pod password, so a
-// new browser had to ask for the password once. That sealed the key against
-// the pod's host, which the access rule cannot do, at the price of fedipod.net
-// asking for a pod password. Jeff decided the host is trusted the way it is
-// for every other document, and the password went. `unwrapKeys`,
-// `isKeyEnvelope` and `KeyPasswordNeeded` remain for accounts made before
-// then: their key is opened once with the password and stored as it is.
-
-const PEM = (der, label) => {
-  const b64 = btoa(String.fromCharCode(...new Uint8Array(der)));
-  const lines = b64.match(/.{1,64}/g).join('\n');
-  return `-----BEGIN ${label}-----\n${lines}\n-----END ${label}-----\n`;
-};
-
-/** RSA (what Mastodon verifies) and, where the browser supports it, Ed25519
- *  (FEP-8b32 proofs). A missing Ed25519 half is not fatal — the agent mints one
- *  the same way it does for a pre-proofs keys.json, since nothing has published it. */
-export async function generateKeys() {
-  const rsa = await crypto.subtle.generateKey(
-    { name: 'RSASSA-PKCS1-v1_5', modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: 'SHA-256' },
-    true, ['sign', 'verify']);
-  const rec = {
-    rsa: {
-      publicPem: PEM(await crypto.subtle.exportKey('spki', rsa.publicKey), 'PUBLIC KEY'),
-      privatePem: PEM(await crypto.subtle.exportKey('pkcs8', rsa.privateKey), 'PRIVATE KEY'),
-    },
-  };
-  try {
-    const ed = await crypto.subtle.generateKey('Ed25519', true, ['sign', 'verify']);
-    rec.ed25519 = {
-      publicPem: PEM(await crypto.subtle.exportKey('spki', ed.publicKey), 'PUBLIC KEY'),
-      privatePem: PEM(await crypto.subtle.exportKey('pkcs8', ed.privateKey), 'PRIVATE KEY'),
-    };
-  } catch { /* no Ed25519 in this browser — the agent mints it on first run */ }
-  return rec;
-}
-
-const PBKDF2_ITERATIONS = 310_000;   // OWASP 2023 floor for PBKDF2-HMAC-SHA256
-
-async function deriveAesKey(password, salt, iterations) {
-  const base = await crypto.subtle.importKey('raw', new TextEncoder().encode(password), 'PBKDF2', false, ['deriveKey']);
-  return crypto.subtle.deriveKey(
-    { name: 'PBKDF2', salt, iterations, hash: 'SHA-256' },
-    base, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
-}
-
-const fromB64 = (s) => Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
-
-/** Whether a document read off the pod is an envelope from before 1.28.0
- *  rather than the keys record. The shape is what tells them apart. */
-export function isKeyEnvelope(doc) {
-  return !!doc && doc.v === 1 && typeof doc.ct === 'string' && typeof doc.salt === 'string';
-}
-
-/** Thrown when the pod holds a key from before 1.28.0, under a password, and
- *  nothing in this browser can open it. The page catches it by `code` and asks
- *  for the password once; the worker cannot ask anyone anything. */
-export class KeyPasswordNeeded extends Error {
-  constructor() { super('this browser needs your account password to unlock the signing key'); }
-  code = 'key-password-needed';
-}
-
-/** Open an envelope from before 1.28.0. Throws on a wrong password (AES-GCM
- *  auth failure) — which is how the page tells a typo from a real problem. */
-export async function unwrapKeys(envelope, password) {
-  if (!envelope || envelope.v !== 1) throw new Error('not a key envelope');
-  const aes = await deriveAesKey(password, fromB64(envelope.salt), envelope.iterations);
-  let plaintext;
-  try {
-    plaintext = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: fromB64(envelope.iv) }, aes, fromB64(envelope.ct));
-  } catch { throw new Error('wrong password'); }
-  return JSON.parse(new TextDecoder().decode(plaintext));
-}

package/web/app/oidc-session.mjs

@@ -1,6 +0,0 @@
-// oidc-session.mjs — FediPod's Solid-OIDC session: the solid-oidc-session
-// library (lib/session/) bound to this app's database and client name. The
-// page and the service worker both import this file, so both read one session.
-import { solidOidcSession } from '../../lib/session/oidc-session.mjs';
-
-export const { beginLogin, completeLogin, getSession, signOut } = solidOidcSession({ dbName: 'fedipod-oidc', clientName: 'FediPod' });