fedipod-server 0.28.1 → 0.30.0

package/dist/handler.js

@@ -1,77 +1,58 @@
 "use strict";
 // handler.ts — the CSS HttpHandler. Thin by design: claim only the front's
-// routes (canHandle), adapt Node↔WHATWG, and hand off to the same FediPod core
-// the standalone gateway runs (routeFront). All the logic lives elsewhere and
-// tests without CSS; this file is the wiring CSS needs.
+// routes and the identities' (canHandle), and hand each request to the part
+// that answers it: an identity's own surface, the door for a delivery to its
+// inbox, or the Gateway's front. The state every part shares lives here; the
+// parts are mounts.ts (which pod a request belongs to), identities.ts
+// (starting and stopping them), opt-in.ts (what an owner asks), door.ts and
+// front.ts.
 //
 // componentsjs-generator reads FediPodServerArgs to emit one component
 // parameter per field, so the config injects each by name.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FediPodServerHandler = void 0;
-const node_fs_1 = require("node:fs");
-const node_path_1 = require("node:path");
-const node_crypto_1 = require("node:crypto");
 const community_server_1 = require("@solid/community-server");
 const claims_1 = require("./claims");
-const adapt_1 = require("./adapt");
 const store_css_1 = require("./store-css");
-const store_pod_1 = require("./store-pod");
 const directory_1 = require("./directory");
-/** The pod's path as a mount prefix: `''` for a host root, else `/aisha`. */
-function mountOf(podBase) {
-    return new URL(podBase).pathname.replace(/\/+$/u, '');
-}
-/** Whether `a` is `b` or an ancestor path of `b` (both mount-shaped, no trailing slash). */
-function pathContains(a, b) {
-    return a === b || b.startsWith(a + '/') || a === '';
-}
-// The JS front-core is FediPod's own ESM tree, reached at runtime. A real
-// dynamic import() built via Function keeps tsc from downleveling it to
-// require() — which cannot load an ESM module with top-level await under a
-// CommonJS build.
-//
-// Two layouts carry that tree: the published package ships its own copy of
-// lib/ beside dist/ (prepack puts it there), and a repo checkout reaches the
-// repo's lib/ three levels up. Prefer the package's own copy when it exists.
-const LIB_ROOT = (0, node_fs_1.existsSync)((0, node_path_1.join)(__dirname, '../lib/server/embed.mjs')) ? '../lib' : '../../../lib';
-const FRONT_CORE = `${LIB_ROOT}/gateway/front-core.mjs`;
-const EMBED = `${LIB_ROOT}/server/embed.mjs`;
-const esmImport = new Function('s', 'return import(s)');
-// The front's pages and the files they load, carried in the same two layouts
-// as lib/. A missing file is not fatal: the route it feeds answers 404.
-const WEB_ROOT = (0, node_fs_1.existsSync)((0, node_path_1.join)(__dirname, '../web/front/run.html'))
-    ? (0, node_path_1.join)(__dirname, '../web/front') : (0, node_path_1.join)(__dirname, '../../../web/front');
-const webFile = (name) => {
-    try {
-        return (0, node_fs_1.readFileSync)((0, node_path_1.join)(WEB_ROOT, name), 'utf8');
-    }
-    catch {
-        return null;
-    }
-};
-// A pod that will not come up yet is usually a pod still being created by the
-// server that is booting. Keep asking, slower each time, up to a few minutes.
-const START_RETRY_MS = [2_000, 5_000, 15_000, 60_000, 300_000];
-/** The identity's name, from its pod URL. Mirrors handleFor in lib/embed.mjs. */
-function deriveHandle(podBase) {
-    const u = new URL(podBase);
-    const segments = u.pathname.split('/').filter((seg) => seg.length > 0);
-    return segments.length > 0 ? segments[segments.length - 1] : u.hostname.split('.')[0];
-}
-/** The opt-in page's path: leading slash, no trailing one, the default when unset. */
-function normalizeRunPath(raw) {
-    const said = String(raw ?? '').trim().replace(/\/+$/u, '');
-    if (!said)
-        return claims_1.DEFAULT_RUN_PATH;
-    return said.startsWith('/') ? said : `/${said}`;
-}
-/** A door path always has both slashes, so claiming and stripping agree. */
-function normalizeUiPath(raw) {
-    if (raw === '')
-        return '';
-    const path = raw ?? '/fp/';
-    return `/${path.replace(/^\/+|\/+$/gu, '')}/`;
-}
+const mounts_1 = require("./mounts");
+const identities = __importStar(require("./identities"));
+const optIn = __importStar(require("./opt-in"));
+const door_1 = require("./door");
+const front_1 = require("./front");
 class FediPodServerHandler extends community_server_1.HttpHandler {
     args;
     io;
@@ -86,6 +67,7 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
     // request is matched to an identity by host AND mount, never host alone.
     claimed = new Map(); // pod base → claim
     agentHandles = new Map(); // handle → pod base
+    roots = new Map(); // pod base → where on it the account lives
     frontHost;
     uiPath;
     identities = new Map();
@@ -117,285 +99,18 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         this.frontHost = args.frontHost || new URL(args.frontOrigin).hostname;
         // One answer for both the claim and the route, so a server cannot answer
         // at one path and refuse at another.
-        this.runPath = normalizeRunPath(args.runPath);
-        this.uiPath = normalizeUiPath(args.agentUiPath);
+        this.runPath = (0, mounts_1.normalizeRunPath)(args.runPath);
+        this.uiPath = (0, mounts_1.normalizeUiPath)(args.agentUiPath);
         this.registry = args.agentRuntimeOptIn
             ? (0, directory_1.makeAgentRegistry)(this.io, absolute(args.agentRegistryContainer ?? '/.internal/fedipod/agents/'))
             : null;
     }
-    /**
-     * Whether this pod may become an identity here, and the claim it earns: a
-     * real URL, a place no other identity already sits, and a handle no other
-     * identity uses — two pods must never share <agentDataDir>/<handle>/.
-     *
-     * A HOST-ROOT or subdomain pod needs an origin of its own, and it may not be
-     * the front's host: the whole surface answers at the origin root, so two of
-     * them, or one sharing the front, would collide. A SUFFIX pod lives on a path
-     * (`server/aisha/`), so it may share its host — with the front and with other
-     * suffix pods — provided no claim already contains or nests under its path.
-     */
-    validateAgentPod(podBase) {
-        let host;
-        let mount;
-        try {
-            const u = new URL(podBase);
-            host = u.host.toLowerCase();
-            mount = mountOf(podBase);
-        }
-        catch {
-            throw new Error(`not a pod URL: ${podBase}`);
-        }
-        if (mount === '') {
-            // A pod at the root of its host: it owns the whole origin, so it cannot
-            // share it with the front or with any other claim.
-            if (host.split(':')[0] === String(this.frontHost).toLowerCase()) {
-                throw new Error(`${podBase} is on the front's own host — give the identity its own origin, or host it on a path`);
-            }
-            for (const c of this.claimed.values()) {
-                if (c.host === host) {
-                    throw new Error(`the host ${host} already carries an identity — a host-root identity needs an origin of its own`);
-                }
-            }
-        }
-        else {
-            // A pod on a path: it owns only its subtree. Refuse anything that already
-            // contains it or that it would contain, so no identity can answer under
-            // another's path (and none straddles the front's own routes underneath).
-            for (const c of this.claimed.values()) {
-                if (c.host !== host)
-                    continue;
-                if (pathContains(c.mount, mount) || pathContains(mount, c.mount)) {
-                    throw new Error(`${podBase} nests with the identity already at ${c.podBase} — a path pod owns only its own subtree`);
-                }
-            }
-        }
-        const handle = deriveHandle(podBase);
-        const holder = this.agentHandles.get(handle);
-        if (holder && holder !== podBase) {
-            throw new Error(`the name ${handle} already belongs to ${holder} — two identities cannot share it`);
-        }
-        return { host, mount, podBase, handle };
-    }
-    /**
-     * The claim a request belongs to, or null. A request matches when its host is
-     * the claim's host and its path is at or under the claim's mount; the deepest
-     * mount wins, so a suffix pod's own routes are never swallowed by a shallower
-     * claim on the same host.
-     */
-    resolveClaim(host, pathname) {
-        let best = null;
-        for (const c of this.claimed.values()) {
-            if (c.host !== host)
-                continue;
-            if (c.mount === '' || pathname === c.mount || pathname.startsWith(c.mount + '/')) {
-                if (!best || c.mount.length > best.mount.length)
-                    best = c;
-            }
-        }
-        return best;
-    }
-    /** A request path relative to a mount: `/aisha/ap/actor` under `/aisha` → `/ap/actor`. */
-    stripMount(pathname, mount) {
-        if (!mount)
-            return pathname;
-        return pathname.slice(mount.length) || '/';
-    }
-    /**
-     * Start an agent for each opted-in pod. Runs before the server listens, so
-     * the identities come up in the background and boot is never held on a pod.
-     */
-    async initialize() {
-        if (!this.registry)
-            return;
-        const runs = this.runsIdentities();
-        // The stock CSS CLI installs no signal handlers, so a SIGTERM (systemd
-        // stop, docker stop, Ctrl+C) killed the process with agent state
-        // unflushed and the lease held for its whole TTL. Flush first, bounded,
-        // then re-raise so the process still dies the way it was asked to.
-        if (runs && !this.onSignal) {
-            this.onSignal = (signal) => {
-                const timeout = new Promise((resolve) => { setTimeout(resolve, 5_000).unref?.(); });
-                void Promise.race([this.finalize(), timeout]).then(() => {
-                    process.kill(process.pid, signal);
-                });
-            };
-            process.once('SIGTERM', this.onSignal);
-            process.once('SIGINT', this.onSignal);
-        }
-        // Identities run in the primary, and requests are answered by the workers,
-        // so with more than one worker an identity federates but cannot be reached:
-        // its client API, its owner pages and its live feed are in a process no
-        // request arrives at. Said once, by the process that has them.
-        if (runs && this.args.clusterManager && !this.args.clusterManager.isSingleThreaded()) {
-            this.logger.warn('FediPod is running in a multi-worker server. Deliveries are picked up by the inbox '
-                + 'sweep rather than as they land, and no identity can answer its client API, its live feed or its '
-                + "owner's pages while requests are served by other processes. Run with --workers 1.");
-        }
-        // Awaited, and BEFORE the server listens: a pod whose owner opted in must
-        // have its routes claimed from the first request after a restart, never
-        // served briefly by LDP. A failed load must not fail the boot — the rows
-        // persist, and the next start recovers them.
-        const pods = [];
-        try {
-            const keys = await this.registry.listKeys();
-            for (const key of keys) {
-                const row = await this.registry.get(key);
-                if (!row)
-                    continue;
-                if (this.claimed.has(row.podBase) || this.identities.has(row.podBase))
-                    continue; // already claimed
-                let claim;
-                try {
-                    claim = this.validateAgentPod(row.podBase);
-                }
-                catch (e) {
-                    this.logger.error(`opted-in pod ${row.podBase} no longer valid: ${e.message}`);
-                    continue;
-                }
-                this.claimed.set(row.podBase, claim);
-                this.agentHandles.set(row.handle, row.podBase);
-                pods.push(row.podBase);
-            }
-        }
-        catch (e) {
-            this.logger.error(`could not read the opt-in registry — opted-in identities are absent this boot: ${e.message}`);
-        }
-        if (pods.length > 0) {
-            this.logger.info(runs
-                ? `FediPod agent enabled for ${pods.length} opted-in pod(s)`
-                : `FediPod claimed the routes of ${pods.length} opted-in pod(s); they are run elsewhere`);
-        }
-        // Claimed everywhere, run in one place. A process that does not run them
-        // must still not let a pod answer for a path that belongs to an identity.
-        if (runs)
-            for (const pod of pods)
-                void this.startIdentity(pod);
-    }
+    /** The shared state, for the parts beside this file. */
+    internals() { return this; }
+    /** Start an agent for each opted-in pod, before the server listens. */
+    initialize() { return identities.initialize(this); }
     /** Stop every identity: timers cleared, state written, lease let go. */
-    async finalize() {
-        this.stopping = true;
-        if (this.onSignal) {
-            process.removeListener('SIGTERM', this.onSignal);
-            process.removeListener('SIGINT', this.onSignal);
-            this.onSignal = null;
-        }
-        const running = [...this.identities.values()];
-        this.identities.clear();
-        this.surfaces.clear();
-        this.doorSecrets.clear();
-        this.starting.clear();
-        await Promise.allSettled(running.map(async (identity) => {
-            await identity.stop();
-            this.logger.info(`FediPod agent @${identity.handle} stopped`);
-        }));
-    }
-    /**
-     * One identity's door secret, in its own pod's state. `agentDataDir` is
-     * handed in as the place an identity set up before this kept it, so its
-     * owner's existing door link survives the move.
-     */
-    async doorSecretFor(podBase, session, opts = {}) {
-        const { ensureDoorSecret } = await esmImport(EMBED);
-        return ensureDoorSecret(session ?? (0, store_pod_1.makeStoreSession)(this.args.resourceStore, podBase), podBase, {
-            ...opts,
-            dataDir: this.args.agentDataDir,
-            handle: deriveHandle(podBase),
-            log: (message) => { this.logger.info(`@${deriveHandle(podBase)}: ${message}`); },
-        });
-    }
-    async startIdentity(podBase) {
-        if (this.starting.has(podBase) || this.identities.has(podBase))
-            return;
-        this.starting.add(podBase);
-        this.startCancelled.delete(podBase);
-        const session = (0, store_pod_1.makeStoreSession)(this.args.resourceStore, podBase);
-        try {
-            for (let attempt = 0; !this.stopping && !this.startCancelled.has(podBase); attempt++) {
-                try {
-                    const { startEmbeddedAgent } = await esmImport(EMBED);
-                    // The secret is in the map BEFORE the surface can exist, so the
-                    // gate's resolver never comes up empty — empty would mean gate-off.
-                    if (!this.doorSecrets.has(podBase)) {
-                        const door = await this.doorSecretFor(podBase, session);
-                        this.doorSecrets.set(podBase, door.secret);
-                        this.logger.info(`door secret for @${deriveHandle(podBase)} is in its pod at ${door.url}`);
-                    }
-                    const identity = await startEmbeddedAgent({
-                        podBase,
-                        dataDir: this.args.agentDataDir,
-                        session,
-                        resourceStore: this.args.resourceStore,
-                        webIdSuffix: this.args.agentWebIdSuffix ?? 'profile/card#me',
-                        pollSeconds: this.args.agentPollSeconds ?? null,
-                        autoAcceptFollows: this.args.agentAutoAcceptFollows !== false,
-                        gateToken: () => this.doorSecrets.get(podBase),
-                        uiPath: this.uiPath,
-                        log: (message) => {
-                            this.logger.info(message);
-                        },
-                    });
-                    // Stopped, or opted out, while this one was still coming up.
-                    if (this.stopping || this.startCancelled.has(podBase)) {
-                        await identity.stop();
-                        return;
-                    }
-                    this.identities.set(podBase, identity);
-                    this.surfaces.set(podBase, identity);
-                    this.logger.info(`FediPod agent @${identity.handle} running on ${podBase}`);
-                    // A suffix pod cannot answer WebFinger for itself — its host root is
-                    // the front's — so it is followable ONLY through the door's apex
-                    // dispatch. Front it whether or not auto-front is on: the row is the
-                    // whole of what makes @handle@host resolve to it.
-                    if (this.args.agentAutoFront || this.claimed.get(podBase)?.mount) {
-                        await this.frontIdentity(podBase, identity);
-                    }
-                    return;
-                }
-                catch (e) {
-                    const wait = START_RETRY_MS[Math.min(attempt, START_RETRY_MS.length - 1)];
-                    this.logger.warn(`FediPod agent for ${podBase} did not start: ${e.message} — retrying in ${Math.round(wait / 1000)}s`);
-                    await new Promise((resolve) => {
-                        setTimeout(resolve, wait).unref?.();
-                    });
-                }
-            }
-        }
-        finally {
-            this.starting.delete(podBase);
-        }
-    }
-    /**
-     * When this server is also the door, give a running identity a
-     * @handle@<frontHost> address: one inbox-only directory row so the
-     * shared-domain handle resolves and the door can take verified delivery for
-     * it. The row names the identity's own tree, which is where its inbox and
-     * its actor are — the door writes deliveries there and the agent watches
-     * that container. A row written by an attach belongs to its owner and is
-     * left alone; one this server wrote itself is corrected. The identity keeps
-     * its own ids on the pod; nothing is moved.
-     */
-    async frontIdentity(podBase, identity) {
-        const { handle, podHome, actorUrl } = identity;
-        try {
-            const existing = await this.dir.lookup(handle);
-            const row = (0, directory_1.frontRow)(existing, {
-                handle, podHome, actorUrl,
-                kind: identity.agent?.store?.getConfig?.()?.kind === 'group' ? 'group' : 'person',
-                gatewayWebId: this.args.gatewayWebId ?? null,
-                hmacSecret: (0, node_crypto_1.randomBytes)(32).toString('base64'),
-                inboxOnly: true,
-            }, podBase);
-            if (!row)
-                return;
-            await this.dir.putDirectory(handle, row);
-            this.logger.info(existing
-                ? `FediPod: the door's record of @${handle} now names ${podHome}`
-                : `FediPod: @${handle}@${this.frontHost} now resolves to ${podBase}`);
-        }
-        catch (e) {
-            this.logger.warn(`FediPod: could not front @${handle}: ${e.message}`);
-        }
-    }
+    finalize() { return identities.finalize(this); }
     async canHandle({ request }) {
         const host = String(request.headers.host ?? '').toLowerCase();
         const pathname = new URL(request.url ?? '/', `https://${host}`).pathname;
@@ -409,22 +124,11 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         // starting, and then stop being served once it has. The path is matched
         // relative to the claim's mount, so a suffix pod's `/aisha/ap/actor` is
         // judged as `/ap/actor`.
-        const c = this.resolveClaim(host, pathname);
-        if (c && (0, claims_1.agentClaims)({ pathname: this.stripMount(pathname, c.mount), method: request.method }, this.uiPath))
+        const c = (0, mounts_1.resolveClaim)(this, host, pathname);
+        if (c && (0, claims_1.agentClaims)({ pathname: (0, mounts_1.stripMount)(pathname, c.mount), method: request.method }, this.uiPath))
             return;
         throw new Error('not a gateway route'); // reject → CSS's LDP handler takes it
     }
-    /**
-     * Whether identities run in this process. They run in one: the lease admits
-     * a single drainer, and the state each one holds is in memory. With workers,
-     * that process is the primary — which serves no requests, so every process
-     * still has to know which hosts belong to an identity even though only one
-     * of them can answer for it.
-     */
-    runsIdentities() {
-        const cluster = this.args.clusterManager;
-        return !cluster || cluster.isSingleThreaded() || cluster.isPrimary();
-    }
     /**
      * The identity a request belongs to (matched by host and mount) and the
      * request path relative to that identity's mount, or null. The identity is
@@ -432,172 +136,23 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
      * upgrade, which has only the request to go on.
      */
     matchIdentity(host, pathname = '/') {
-        const c = this.resolveClaim(String(host ?? '').toLowerCase(), pathname);
+        const c = (0, mounts_1.resolveClaim)(this, String(host ?? '').toLowerCase(), pathname);
         if (!c)
             return null;
-        return { identity: this.surfaces.get(c.podBase), rel: this.stripMount(pathname, c.mount) };
+        return { identity: this.surfaces.get(c.podBase), rel: (0, mounts_1.stripMount)(pathname, c.mount) };
     }
-    /**
-     * A pod owner, already proven to control podBase, asks this server to run
-     * their identity. Returns { httpStatus, ...body }; the secret appears in the
-     * reply and nowhere else. Re-opting-in rotates the secret — that is how a
-     * lost one is recovered.
-     */
-    /**
-     * The WebIDs behind the account session in the request, or none. The server
-     * keeps that session in a `css-account` cookie; its own account API is what
-     * says which WebIDs the session owns, and it takes the same cookie. Nothing
-     * here trusts the cookie's presence — the account API does the deciding, and
-     * the caller picks the WebID that owns the pod being claimed.
-     */
-    async webIdsFromSession(request) {
-        const cookie = request.headers.get('cookie');
-        if (!cookie || !/(?:^|;\s*)css-account=/u.test(cookie))
-            return [];
-        const base = this.args.frontOrigin.replace(/\/$/u, '');
-        const asJson = { cookie, accept: 'application/json' };
-        try {
-            const index = await fetch(`${base}/.account/`, { headers: asJson });
-            if (!index.ok)
-                return [];
-            const controls = (await index.json()).controls;
-            const webIdLink = controls?.account?.webId;
-            if (!webIdLink)
-                return [];
-            const linked = await fetch(webIdLink, { headers: asJson });
-            if (!linked.ok)
-                return [];
-            const links = (await linked.json()).webIdLinks ?? {};
-            return Object.keys(links);
-        }
-        catch {
-            return [];
-        }
+    /** What a pod owner asks of this server; see opt-in.ts. */
+    webIdsFromSession(request) {
+        return optIn.webIdsFromSession(this, request);
     }
-    async optInPod({ podBase, webId }) {
-        if (!this.registry)
-            return { httpStatus: 501, error: 'this server does not offer runtime opt-in' };
-        if (this.args.clusterManager && !this.args.clusterManager.isSingleThreaded()) {
-            return { httpStatus: 503, error: 'runtime opt-in needs a single-worker server (--workers 1)' };
-        }
-        const base = podBase.endsWith('/') ? podBase : `${podBase}/`;
-        const handle = deriveHandle(base);
-        // Already running here from an earlier opt-in: proving pod
-        // control again buys a fresh secret, nothing else.
-        if (this.agentHandles.get(handle) === base) {
-            const door = await this.doorSecretFor(base, undefined, { rotate: true });
-            this.doorSecrets.set(base, door.secret);
-            return { httpStatus: 201, ok: true, handle, host: new URL(base).host.toLowerCase(),
-                doorSecret: door.secret, doorPath: this.uiPath, status: 'rotated' };
-        }
-        let claim;
-        try {
-            claim = this.validateAgentPod(base);
-        }
-        catch (e) {
-            return { httpStatus: 409, error: e.message };
-        }
-        const { host } = claim;
-        try {
-            await this.registry.add({ podBase: base, handle, host, webId, optedInAt: new Date().toISOString() });
-        }
-        catch (e) {
-            this.logger.error(`opt-in row for ${base} could not be written: ${e.message}`);
-            return { httpStatus: 500, error: 'could not record the opt-in' };
-        }
-        // From this instant the pod's identity routes answer 503 instead of LDP,
-        // until the agent registers its surface.
-        this.claimed.set(base, claim);
-        this.agentHandles.set(handle, base);
-        const door = await this.doorSecretFor(base, undefined, { rotate: true });
-        this.doorSecrets.set(base, door.secret);
-        void this.startIdentity(base);
-        this.logger.info(`runtime opt-in: @${handle} on ${base} (door secret in its pod at ${door.url})`);
-        return { httpStatus: 201, ok: true, handle, host,
-            doorSecret: door.secret, doorPath: this.uiPath, status: 'starting' };
-    }
-    /**
-     * What a pod would be as an identity here, without changing anything: its
-     * handle, the host its address carries, and whether it runs here already.
-     */
-    async describePod({ podBase }) {
-        const base = podBase.endsWith('/') ? podBase : `${podBase}/`;
-        const handle = deriveHandle(base);
-        let host;
-        try {
-            host = this.validateAgentPod(base).host;
-        }
-        catch {
-            host = new URL(base).host.toLowerCase();
-        }
-        const running = this.agentHandles.get(handle) === base;
-        // The management page's door takes its key once in the address and keeps
-        // the browser in with a cookie. Only the owner's own page ever asks for
-        // this description, so the key rides on the link for a running account.
-        // Read from the pod, where the key always is, rather than from what this
-        // process happens to hold: an account still starting has none in memory.
-        let key;
-        if (running) {
-            try {
-                key = (await this.doorSecretFor(base)).secret;
-            }
-            catch {
-                key = this.doorSecrets.get(base);
-            }
-        }
-        const door = base.replace(/\/$/u, '') + this.uiPath;
-        return { handle, host, address: `@${handle}@${host}`, running,
-            manage: key ? `${door}?dk-token=${encodeURIComponent(key)}` : door };
+    optInPod(a) {
+        return optIn.optInPod(this, a);
     }
-    /** The reverse: stop the identity and let the pod be plain LDP again. */
-    async optOutPod({ podBase }) {
-        if (!this.registry)
-            return { httpStatus: 501, error: 'this server does not offer runtime opt-in' };
-        const base = podBase.endsWith('/') ? podBase : `${podBase}/`;
-        const host = new URL(base).host.toLowerCase();
-        const key = (0, directory_1.agentKey)(host, base);
-        const row = await this.registry.get(key);
-        if (!row || row.podBase !== base)
-            return { httpStatus: 404, error: 'this pod has not opted in' };
-        this.claimed.delete(base); // routes fall to LDP now
-        this.startCancelled.add(base); // a pending start stands down
-        const identity = this.identities.get(base);
-        this.identities.delete(base);
-        this.surfaces.delete(base);
-        this.agentHandles.delete(row.handle);
-        this.doorSecrets.delete(base);
-        if (identity)
-            await identity.stop();
-        await this.registry.remove(key);
-        this.logger.info(`runtime opt-out: @${row.handle} on ${base} — the pod serves plain LDP again`);
-        return { httpStatus: 200, ok: true, stopped: Boolean(identity) };
+    describePod(a) {
+        return optIn.describePod(this, a);
     }
-    /**
-     * A delivery to an identity's own inbox, verified here — the server that
-     * stores the inbox is the one the request reached, so the signature is
-     * checked while its headers exist and the receipt is written beside the
-     * activity. The same door code the front runs; nothing is renamed.
-     */
-    async deliverAtDoor(identity, request, response) {
-        const { deliverToInbox } = await esmImport(EMBED);
-        let whatwg;
-        try {
-            // The pod's own origin: the signature covers the path and the Host header, and both are the pod's.
-            whatwg = await (0, adapt_1.nodeToWhatwg)(request, new URL(identity.podHome).origin);
-        }
-        catch (e) {
-            const status = e.statusCode === 413 ? 413 : 400;
-            response.writeHead(status, { 'content-type': 'application/json' });
-            response.end(JSON.stringify({ error: e.message }));
-            return;
-        }
-        const out = await deliverToInbox(identity.agent, whatwg, {
-            podPut: (url, body, ct) => this.podPut(url, body, ct),
-            gatewayWebId: this.args.gatewayWebId ?? null,
-        });
-        this.logger.info(`FediPod: delivery for @${identity.handle} at the door — ${out.reason} (${out.status})`);
-        response.writeHead(out.status, { 'content-type': 'application/json' });
-        response.end(JSON.stringify({ reason: out.reason }));
+    optOutPod(a) {
+        return optIn.optOutPod(this, a);
     }
     async handle({ request, response }) {
         const host = String(request.headers.host ?? '').toLowerCase();
@@ -605,118 +160,32 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         // The front's own routes win first — its dispatch, WebFinger and API sit at
         // the apex above every suffix pod — so a claim is consulted only where the
         // front does not answer.
-        const claimed = (0, claims_1.claims)({ host, pathname }, this.frontHost, this.runPath) ? null : this.resolveClaim(host, pathname);
-        if (claimed) {
-            const identity = this.surfaces.get(claimed.podBase);
-            if (!identity) {
-                // Claimed, but nothing here can answer for it. Saying which of the two
-                // reasons it is beats letting the pod answer for a route that is not
-                // the pod's, and beats telling a client to try again when trying again
-                // will reach another process just as unable to help.
-                if (!this.runsIdentities()) {
-                    response.writeHead(503, { 'content-type': 'application/json' });
-                    response.end(JSON.stringify({ error: 'this identity is not reachable on a server running more '
-                            + 'than one worker: it runs in the process that serves no requests. Run with --workers 1.' }));
-                    return;
-                }
-                response.writeHead(503, { 'content-type': 'application/json', 'retry-after': '5' });
-                response.end(JSON.stringify({ error: 'this identity is still starting' }));
-                return;
-            }
-            // This identity's own inbox path — <mount>/<root>/ap/inbox/, from its
-            // actor, so it already carries the mount for a suffix pod.
-            const inboxPath = new URL(identity.actorUrl).pathname.replace(/ap\/actor$/u, 'ap/inbox/');
-            if (pathname === inboxPath && String(request.method).toUpperCase() === 'POST') {
-                await this.deliverAtDoor(identity, request, response);
+        const claimed = (0, claims_1.claims)({ host, pathname }, this.frontHost, this.runPath) ? null : (0, mounts_1.resolveClaim)(this, host, pathname);
+        if (!claimed)
+            return (0, front_1.serveFront)(this, request, response);
+        const identity = this.surfaces.get(claimed.podBase);
+        if (!identity) {
+            // Claimed, but nothing here can answer for it. Saying which of the two
+            // reasons it is beats letting the pod answer for a route that is not
+            // the pod's, and beats telling a client to try again when trying again
+            // will reach another process just as unable to help.
+            if (!identities.runsIdentities(this)) {
+                response.writeHead(503, { 'content-type': 'application/json' });
+                response.end(JSON.stringify({ error: 'this identity is not reachable on a server running more '
+                        + 'than one worker: it runs in the process that serves no requests. Run with --workers 1.' }));
                 return;
             }
-            await identity.surface.handler(request, response);
+            response.writeHead(503, { 'content-type': 'application/json', 'retry-after': '5' });
+            response.end(JSON.stringify({ error: 'this identity is still starting' }));
             return;
         }
-        const { routeFront } = await esmImport(FRONT_CORE);
-        let whatwg;
-        try {
-            whatwg = await (0, adapt_1.nodeToWhatwg)(request, this.args.frontOrigin);
-        }
-        catch (e) {
-            const status = e.statusCode === 413 ? 413 : 400;
-            response.writeHead(status, { 'content-type': 'application/json' });
-            response.end(JSON.stringify({ error: e.message }));
-            return;
+        // This identity's own inbox path — <mount>/<root>/ap/inbox/, from its
+        // actor, so it already carries the mount for a suffix pod.
+        const inboxPath = new URL(identity.actorUrl).pathname.replace(/ap\/actor$/u, 'ap/inbox/');
+        if (pathname === inboxPath && String(request.method).toUpperCase() === 'POST') {
+            return (0, door_1.deliverAtDoor)(this, identity, request, response);
         }
-        const out = await routeFront(whatwg, {
-            host: this.frontHost,
-            frontOrigin: this.args.frontOrigin,
-            // This server issued the session the reader is already using, so it can
-            // read it rather than sending them to an identity provider that has just
-            // told them who they are. Same-origin only; front-core decides that.
-            webIdsFromSession: (req) => this.webIdsFromSession(req),
-            gatewayWebId: this.args.gatewayWebId,
-            offersPods: !!this.args.offersPods,
-            signupPage: this.args.signupPage || webFile('new-account.html'),
-            runPage: this.args.runPage || webFile('run.html'),
-            runPath: this.runPath,
-            adminPage: this.args.adminPage || webFile('admin.html'),
-            // The notices page renders here too, and says the server keeps none:
-            // a notices store is the Netlify front's, not this component's.
-            noticesPage: webFile('notices.html'),
-            // The opt-in and roster pages load the sign-in library, and the installer
-            // command is handed out with it; without these the pages render but
-            // cannot be used.
-            authBundle: webFile('solid-oidc-client.js'),
-            // Each page's own script — inline until 2026-09-09, so that the pages can
-            // be served under `script-src 'self'` (see lib/front-core.mjs).
-            pageScripts: {
-                'new-account.js': webFile('new-account.js'),
-                'run.js': webFile('run.js'),
-                'admin.js': webFile('admin.js'),
-                'notices.js': webFile('notices.js'),
-            },
-            installScript: webFile('install.sh'),
-            lookup: (h) => this.dir.lookup(h),
-            putDirectory: (h, rec) => this.dir.putDirectory(h, rec),
-            podPut: (_handle, url, body, ct) => this.podPut(url, body, ct),
-            // Reads for the public proxy. `this.io.read` goes STRAIGHT into the
-            // resource store, which applies no access control of its own — so this is
-            // the one place that has to say what may be read, and it says: only
-            // inside the pod of the handle being served, and never a server-internal
-            // tree. Without it a row could name any location and this would fetch it
-            // (the directory, with every user's receipt secret, included).
-            //
-            // The front now refuses to attach such a row at all (podHomeProblem in
-            // lib/front-core.mjs); this is the same refusal at the other end, because
-            // a row can also arrive from a seed or an older deploy.
-            podGet: async (url, opts) => {
-                const denied = { status: 403, text: async () => '', headers: { get: () => null } };
-                let target;
-                try {
-                    target = new URL(url);
-                }
-                catch {
-                    return denied;
-                }
-                if (/(^|\/)\.internal(\/|$)/u.test(target.pathname))
-                    return denied;
-                // Which pod asked: routeFront reads `rec.podHome + rest` and passes
-                // that podHome here, so the confinement is a value on the call rather
-                // than state on the handler. No podHome, no read.
-                const home = opts?.podHome;
-                if (!home || !url.startsWith(home))
-                    return denied;
-                const raw = await this.io.read(url);
-                return raw == null
-                    ? { status: 404, text: async () => '', headers: { get: () => null } }
-                    : { status: 200, text: async () => raw, headers: { get: () => null } };
-            },
-            agentControl: this.registry
-                ? {
-                    optIn: (a) => this.optInPod(a),
-                    optOut: (a) => this.optOutPod(a),
-                    describe: (a) => this.describePod(a),
-                }
-                : undefined,
-        });
-        await (0, adapt_1.applyToNode)(response, out);
+        await identity.surface.handler(request, response);
     }
 }
 exports.FediPodServerHandler = FediPodServerHandler;