fedipod-server 0.29.0 → 0.31.0

package/web/app/shims/safefetch.mjs

@@ -1,58 +0,0 @@
-// safefetch.mjs — browser stand-in for lib/safefetch.mjs.
-//
-// The Node version pins connections to a validated IP to stop DNS-rebinding and
-// refuses private targets, using undici and node:dns. A browser cannot open raw
-// sockets and is bound by the same-origin policy and CORS, so the rebinding
-// attack this defends against is not reachable from here; the browser agent's
-// only cross-origin writes go through the relay, which runs the Node checks.
-// This keeps the same surface with plain fetch and no top-level await.
-export const HTTP_TIMEOUT_MS = 20_000;
-const MAX_BYTES = 5 * 1024 * 1024;
-
-export function retryAfterMs(res, max = 30 * 60_000) {
-  const h = res?.headers?.get?.('retry-after');
-  if (!h) return null;
-  const secs = /^\d+$/.test(h.trim()) ? Number(h) * 1000 : (Date.parse(h) - Date.now());
-  return Number.isFinite(secs) ? Math.max(0, Math.min(secs, max)) : null;
-}
-export function isPrivateAddress() { return false; }
-export function isLoopbackHost(host) { return /^(localhost|127\.|\[?::1)/.test(String(host)); }
-export function insecureUrlReason(url, what = 'address') {
-  try { const u = new URL(url); if (u.protocol === 'https:' || isLoopbackHost(u.hostname)) return null;
-    if (u.protocol !== 'http:') return `the ${what} must be http(s)`; return null; } catch { return `"${url}" is not a ${what}`; }
-}
-export async function assertPublicUrl() { return null; }     // no socket pinning in a browser
-export async function pinnedFor() { return undefined; }
-// The one thing in this file that is NOT made unnecessary by being in a
-// browser. Pinning and the private-address checks answer DNS rebinding, which
-// a browser closes on its own; a byte budget answers a server that simply
-// keeps sending, which it does not. This used to check `content-length` and
-// then hand back `res.text()` — and a chunked response carries no
-// `content-length` at all, so every caller below dereferences a URL a stranger
-// chose (the note, the actor, the receipt, the Tombstone check, WebFinger)
-// with no bound on what comes back. Stream it and stop at the budget, the way
-// the Node version does. TextDecoder rather than Buffer, and `stream: true` so
-// a UTF-8 sequence split across two chunks still decodes.
-export async function readCapped(res, max = MAX_BYTES) {
-  const len = Number(res.headers?.get?.('content-length') || 0);
-  if (len > max) throw new Error(`response too large (${len} bytes)`);
-  if (!res.body) return res.text();
-  const reader = res.body.getReader();
-  const decoder = new TextDecoder('utf-8');
-  let out = '';
-  let total = 0;
-  for (;;) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    total += value.length;
-    if (total > max) {
-      await reader.cancel();
-      throw new Error(`response exceeded ${max} bytes`);
-    }
-    out += decoder.decode(value, { stream: true });
-  }
-  return out + decoder.decode();
-}
-export async function safeFetch(url, init = {}, fetchImpl = fetch) {
-  return fetchImpl(url, { ...init, signal: init.signal || AbortSignal.timeout(HTTP_TIMEOUT_MS) });
-}

package/web/app/shims/shapes-text.mjs

@@ -1,8 +0,0 @@
-// shapes-text.mjs — the shapes document in the browser agent.
-//
-// Same activitystreams.ttl the Node agent reads; esbuild's text loader turns
-// it into a string at build time, so there is no filesystem here and no second
-// copy of the shapes.
-import ttl from '../../../lib/core/shapes/activitystreams.ttl';
-
-export const SHAPES_TTL = ttl;

package/web/app/shims/web-push.mjs

@@ -1,14 +0,0 @@
-// web-push.mjs — browser stand-in. The facade needs a VAPID public key to put
-// in its instance document; server-sent push while the tab is closed is not
-// part of the browser build, so sendNotification is a no-op. The keypair is a
-// well-formed placeholder (a real one needs a matching private key, which the
-// browser push model does not use this way).
-const b64u = (u) => btoa(String.fromCharCode(...u)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-export function generateVAPIDKeys() {
-  const pub = new Uint8Array(65); pub[0] = 0x04; crypto.getRandomValues(pub.subarray(1));
-  const priv = new Uint8Array(32); crypto.getRandomValues(priv);
-  return { publicKey: b64u(pub), privateKey: b64u(priv) };
-}
-export function setVapidDetails() { /* no-op */ }
-export async function sendNotification() { return { statusCode: 201, body: '', headers: {} }; }
-export default { generateVAPIDKeys, setVapidDetails, sendNotification };

package/web/app/signup.mjs

@@ -1,357 +0,0 @@
-// signup.mjs — the setup flow of `fedipod setup`, run in the browser, on the
-// pod session the person already holds. The pod exists before this runs: a
-// new one is made on the provider's own sign-up page, an existing one is
-// signed in to as it is. So there is no account API here, no credential and
-// no password — the session that signed in at the pod is the session that
-// writes to it. Publishing the actor is the agent's first-run job, exactly as
-// `connect()` publishes after `setup` mints — so this module needs nothing
-// from lib beyond the pod helpers.
-//
-// What it writes to the pod: an owner-only state container holding the
-// signing key and the account config; and, with a gateway, the attach.
-
-import { generateKeys, isKeyEnvelope } from './keystore.mjs';
-import { BrowserRemotePod } from './pod-remote.mjs';
-import * as podState from '../../lib/pod/state.mjs';
-import { resourceExists } from '../../lib/pod/root.mjs';
-import { podBaseOfWebId } from '../../lib/pod/urls.mjs';
-import { cacheOpenedKeys } from './keys-browser.mjs';
-import { chosenRoot, findAccount, recordPlace, hasPublicIndex } from '../../lib/core/place.mjs';
-
-// Everything the agent publishes hangs under a container named `fedipod`, in
-// the container its owner chose (lib/core/place.mjs). The root is stored on the
-// config, so the agent reads it rather than guessing, and the place is recorded
-// in the owner's public type index, which is how the account is found again.
-const actorUrlFor = (pod, root) => `${pod}${root}ap/actor`;
-const keysDocFor = (pod, root) => `${pod}${root}ap-state/keys.json`;
-const stateOf = (pod, root) => `${pod}${root}ap-state/`;
-
-/** The account's config as it sits under `root`, read as its owner. */
-const readConfigAt = (remote, pod) => (root) => podState.readConfig(remote, { state: stateOf(pod, root) });
-
-const HANDLE_RE = /^[a-z0-9-]{2,30}$/;
-
-export function handleProblem(handle) {
-  if (!handle) return 'a handle is required';
-  if (!HANDLE_RE.test(handle)) return 'letters, digits and hyphens only, 2–30 characters';
-  if (handle.startsWith('-') || handle.endsWith('-')) return 'cannot start or end with a hyphen';
-  return null;
-}
-
-// Resume across a failed attempt. A run that throws part-way keeps what it
-// already achieved in this page session — the gateway it attached, the key it
-// wrote — so a second attempt (the failure screen's Try again) continues from
-// the first unfinished step instead of restarting. The record lives only in
-// memory here and is dropped the moment the run completes. Keyed by the
-// identity being built, so changing the handle on the form starts a clean
-// attempt.
-const PROGRESS = new Map();
-const progressKey = (webId, a) => [webId, a.handle, a.shape || 'pod', a.container || ''].join('|');
-
-/** A fronted name is one per gateway; a taken one is refused before anything is made. */
-async function assertFrontNameFree(frontOrigin, handle) {
-  const res = await fetch(`${frontOrigin.replace(/\/$/, '')}/api/handle?handle=${encodeURIComponent(handle)}`,
-    { headers: { accept: 'application/json' } }).catch(() => null);
-  const d = res ? await res.json().catch(() => ({})) : null;
-  if (!d) throw new Error(`${new URL(frontOrigin).host} did not answer whether @${handle} is free`);
-  if (!d.available) throw new Error(d.reason || `the name @${handle}@${new URL(frontOrigin).host} is taken — choose another handle`);
-}
-
-/**
- * Run sign-up on a pod session. Steps are reported through onStep(key, state,
- * note) so a page can draw the same tick list the CLI setup shows. Resumable:
- * see PROGRESS above.
- *
- * answers: { handle, shape?: 'pod'|'front', gateway?, container?, createIndex? }
- *   container    the path of the container that holds `fedipod/` (the pod root
- *                when empty)
- *   createIndex  the person's yes to making a public type index when their
- *                profile names none; without it, sign-up stops before writing
- *                anything and says so (error code 'needs-index')
- * session: { webId, issuer, fetch } — the Solid-OIDC session from the pod's
- *          own login (oidc-session.mjs). The pod is where the WebID lives.
- *
- * `shape` is where the address lives. On the pod, `@handle@yourpod`, with the
- * gateway as a mail door only — the default. At the gateway, `@handle@front`,
- * a fronted identity whose documents still live on the pod. A pod on a path of
- * a suffix-based host cannot answer WebFinger, so it is fronted whatever was asked.
- *
- * returns: { config, actorUrl, address, pod, keys, keysPublic }
- */
-export async function signUp(answers, { session, onStep = () => {}, frontOrigin = null } = {}) {
-  const { handle } = answers;
-  const bad = handleProblem(handle);
-  if (bad) throw new Error(bad);
-  if (!session?.webId || typeof session.fetch !== 'function') throw new Error('sign in at your pod first');
-  const wantsFront = answers.shape === 'front';
-  if (wantsFront && !frontOrigin) throw new Error('an address at the gateway needs a gateway, and this page has none');
-  // A name at the gateway is one per gateway: settle it before making anything.
-  if (wantsFront) await assertFrontNameFree(frontOrigin, handle);
-
-  const webId = session.webId;
-  const pod = podBaseOfWebId(webId);                 // its own host, or a path on a suffix-based one
-  const key = progressKey(webId, answers);
-  const prog = PROGRESS.get(key) || {};
-  PROGRESS.set(key, prog);                                       // resume record for this identity
-
-  const step = (key) => ({
-    running: (note) => onStep(key, 'running', note),
-    ok: (note) => onStep(key, 'ok', note),
-    skip: (note) => onStep(key, 'skipped', note),
-  });
-
-  const place = chosenRoot(pod, answers.container);
-  if (place.problem) throw new Error(`Where to store it: ${place.problem}.`);
-  const root = place.root;
-  const remote = new BrowserRemotePod(session, { webId, role: 'signup', log: () => {} });
-
-  // --- the pod --- (the session came from it; what is checked is that it has no account yet)
-  const podStep = step('pod');
-  if (!prog.pod) {
-    podStep.running('checking your pod');
-    if (await findAccount(remote, pod, readConfigAt(remote, pod))
-      || await resourceExists(session.fetch, actorUrlFor(pod, root))) {
-      throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
-    }
-    if (await resourceExists(session.fetch, `${pod}${root}`)) {
-      throw new Error(`${new URL(pod + root).pathname} is already there and is not a FediPod account — choose another container.`);
-    }
-    // Where the account lives is recorded in the public type index. With none,
-    // the person is asked first; nothing is written before they have said yes.
-    if (!answers.createIndex && !await hasPublicIndex(remote, pod)) {
-      throw Object.assign(new Error('Your profile names no public type index.'), { code: 'needs-index' });
-    }
-    prog.pod = pod;
-    podStep.ok(pod);
-  } else {
-    podStep.ok(prog.pod);                                        // resumed
-  }
-
-  // WebFinger is answered only at a host root. A pod on a path of a shared
-  // host therefore takes its address at the gateway, whatever was asked; a
-  // pod at its own root keeps the choice made on the form.
-  const pathPod = new URL(pod).pathname !== '/';
-  const fronted = pathPod || wantsFront;
-  if (fronted && !frontOrigin) {
-    throw new Error(`${pod} is a suffixed pod, so its address must live at a gateway, and this page has none.`);
-  }
-  if (pathPod && !wantsFront) await assertFrontNameFree(frontOrigin, handle);
-
-  const actorUrl = actorUrlFor(pod, root);                        // where the documents live, always
-  const frontActor = fronted ? `${frontOrigin.replace(/\/$/, '')}/u/${handle}/ap/actor` : null;
-
-  // Connect the gateway (fedipod.net) before the key is made, because a
-  // fronted identity's key is stamped with the gateway actor. Inbox-only: the
-  // actor advertises the door as its inbox and keeps its own ids. Fronted: the
-  // gateway answers WebFinger for @handle@front and serves the actor at its own
-  // address, rewriting reads onto the pod. Either way the door verifies each
-  // delivery and forwards the clean mail to the pod; the agent trusts the
-  // door's receipt. The pod session itself proves the pod to the gateway.
-  let gateway = answers.gateway || prog.gateway || null;
-  if (frontOrigin && !gateway) {
-    const gw = step('gateway');
-    gw.running(fronted ? `taking your address at ${new URL(frontOrigin).host}` : `connecting your mail door on ${new URL(frontOrigin).host}`);
-    const res = await session.fetch(`${frontOrigin.replace(/\/$/, '')}/api/attach`, {
-      method: 'POST', headers: { 'content-type': 'application/json' },
-      // podHome is the AP CONTAINER, not the pod root: the front builds the
-      // delivery target as `podHome + 'ap/inbox/'` (lib/front-core.mjs), so a
-      // bare pod root sends this identity's mail to <pod>/ap/inbox/ — outside
-      // the container the agent drains, where nothing would ever read it. The
-      // manage surface has always sent `urls.home`; this is the same value.
-      body: JSON.stringify({ handle, podHome: `${pod}${root}`, actorUrl, kind: 'person', fronted }),
-    });
-    const d = await res.json().catch(() => ({}));
-    if (res.status !== 201 || !d.hmacSecret) {
-      throw new Error(`could not connect the gateway (HTTP ${res.status}): ${d.error || ''}`);
-    }
-    gateway = fronted
-      ? { url: `${frontOrigin.replace(/\/$/, '')}/u/${handle}/ap/inbox/`, frontActor: String(d.frontActor || frontActor), hmacSecret: d.hmacSecret, mode: 'trust' }
-      : { url: d.doorInbox, hmacSecret: d.hmacSecret, mode: 'trust' };
-    prog.gateway = gateway;
-    gw.ok();
-  } else if (frontOrigin && gateway) {
-    step('gateway').ok();                                        // resumed
-  }
-
-  // --- keys, in an owner-only container on the pod ---
-  //
-  // The durable copy is on the pod, because a browser has no disk you can carry
-  // to the next machine. It is stored as it is, behind the container's access
-  // rule: the same rule every private document on the pod lives under, so it
-  // is reachable through the pod's own login and by nobody else.
-  //
-  // Two things in that order, deliberately: the ACL BEFORE the key. Writing the
-  // key first leaves a window where a pod whose root is world-readable serves it
-  // to anyone who asks, and a brought pod is exactly the case where that root
-  // may be public.
-  //
-  // The opened copy is kept in this browser (IndexedDB) so the worker can boot
-  // itself after an idle kill with no read. A browser that has no copy reads
-  // the pod's with its session — see keys-browser.mjs.
-  const keysStep = step('keys');
-  let keys;
-  if (!prog.keysStored) {
-    keysStep.running('making your signing key and storing it on your pod');
-    keys = await generateKeys();
-    // One key, one actor (lib/keys.mjs): the actor the world knows, which for
-    // a fronted identity is the gateway's address for it.
-    keys.mintedFor = gateway?.frontActor || actorUrl;
-    // Owner-only, and THEN the key — one operation, so the order cannot be got
-    // wrong here or anywhere else. A pod that refuses the ACL write is not a
-    // pod this key may sit on.
-    try {
-      await podState.provisionKey(remote, {
-        stateUrl: stateOf(pod, root),
-        keysUrl: keysDocFor(pod, root),
-        keys,
-      });
-    } catch (e) {
-      throw new Error(`could not store the signing key on the pod (${e.message}). `
-        + `You are signed in as ${webId} — that WebID must own ${pod} and ${root} in it must be writable by it.`);
-    }
-    // This browser's own opened copy, so the boot that follows needs no read.
-    // Best effort: a browser that refuses IndexedDB (private mode) reads the
-    // pod's copy on the way back in.
-    await cacheOpenedKeys(actorUrl, keys);
-    prog.keys = keys; prog.keysStored = true;
-    keysStep.ok();
-  } else {
-    keys = prog.keys;
-    keysStep.ok();
-  }
-
-  const config = {
-    remotePod: pod, root, handle, name: handle, issuer: String(session.issuer || '').replace(/\/+$/, ''),
-    createdAt: new Date().toISOString(),
-    ...(gateway ? { gateway } : {}),
-  };
-  // Write the config to the pod (owner-only, beside the key) so a returning
-  // sign-in — which arrives with only an OIDC session — can read the account's
-  // config and key from the pod and boot.
-  try {
-    await podState.writeConfig(remote, { state: stateOf(pod, root) }, config);
-  } catch (e) {
-    throw new Error(`could not store the config on the pod (${e.message})`);
-  }
-
-  // --- where it lives, in the public type index ---
-  if (!prog.placed) {
-    const placeStep = step('place');
-    placeStep.running('recording where your account lives');
-    try {
-      await recordPlace(remote, pod, actorUrl, { create: !!answers.createIndex });
-    } catch (e) {
-      throw new Error(`could not record where your account lives in your type index (${e.message})`);
-    }
-    prog.placed = true;
-    placeStep.ok();
-  }
-
-  PROGRESS.delete(key);                                          // finished — nothing left to resume
-
-  const host = gateway?.frontActor ? new URL(gateway.frontActor).host : new URL(pod).host;
-  return {
-    config, actorUrl, pod,
-    address: `@${handle}@${host}`,
-    // The opened keys, for booting the agent in THIS browser session right away.
-    keys,
-    keysPublic: { rsa: keys.rsa.publicPem, ed25519: keys.ed25519?.publicPem || null },
-  };
-}
-
-// ---- an account already on the pod ----
-
-/**
- * What the pod already holds: null when there is no FediPod account on it,
- * else its config, the pod, and where its address lives — `frontHost` is
- * the gateway's host for an address at a gateway, null for one on the pod.
- */
-export async function readAccount(session) {
-  const pod = podBaseOfWebId(session.webId);
-  const remote = new BrowserRemotePod(session, { webId: session.webId, role: 'signup', log: () => {} });
-  // A person account: the browser build is persons only.
-  const found = await findAccount(remote, pod, readConfigAt(remote, pod), (c) => (c.kind || 'person') === 'person');
-  if (!found) return null;
-  const { root, config } = found;
-  const frontActor = config.gateway?.frontActor || null;
-  let frontHost = null;
-  try { frontHost = frontActor ? new URL(frontActor).host : null; } catch { frontHost = null; }
-  let podHost = '';
-  try { podHost = new URL(config.remotePod || pod).host; } catch { podHost = ''; }
-  return { pod, root, config, frontActor, frontHost, address: `@${config.handle}@${frontHost || podHost}` };
-}
-
-/**
- * Move an account whose address lives at another gateway to this one. The
- * pod, its posts, its followers and its key all stay where they are; what
- * changes is the gateway that answers for it. This half does the pod's
- * part: attach here, rewrite the config to name this gateway, restamp the
- * key. The agent's first boot from that config publishes under the new
- * ids, and then tells the old gateway and the followers (gateway-move.mjs).
- *
- * answers: { handle }  — the name here; the old one is the default.
- * returns: { config, address, movedFrom }
- */
-export async function moveIn(answers, { session, onStep = () => {}, frontOrigin = null } = {}) {
-  const { handle } = answers;
-  const bad = handleProblem(handle);
-  if (bad) throw new Error(bad);
-  if (!session?.webId || typeof session.fetch !== 'function') throw new Error('sign in at your pod first');
-  if (!frontOrigin) throw new Error('a move needs a gateway to move to, and this page has none');
-  const origin = frontOrigin.replace(/\/$/, '');
-  const step = (key) => ({ running: (note) => onStep(key, 'running', note), ok: (note) => onStep(key, 'ok', note) });
-
-  // --- the pod: the account that is there, and its key ---
-  const podStep = step('pod');
-  podStep.running('reading your account on your pod');
-  const here = await readAccount(session);
-  if (!here?.frontActor) throw new Error('this pod holds no account at another gateway to move here');
-  if (here.frontHost === new URL(origin).host) throw new Error('this account already lives at this gateway');
-  const { pod, root, config: old } = here;
-  const remote = new BrowserRemotePod(session, { webId: session.webId, role: 'signup', log: () => {} });
-  const urls = { state: stateOf(pod, root) };
-  const keys = await podState.readKeys(remote, urls);
-  if (!keys?.rsa) throw new Error('could not read this account\'s signing key on the pod');
-  if (isKeyEnvelope(keys)) throw new Error(`this account's key is still under a password from an earlier version — sign in once at ${here.frontHost} first, then come back`);
-  podStep.ok(here.address);
-
-  // --- this gateway: the name, then the attach, fronted ---
-  const gw = step('gateway');
-  gw.running(`taking your address at ${new URL(origin).host}`);
-  await assertFrontNameFree(origin, handle);
-  const res = await session.fetch(`${origin}/api/attach`, {
-    method: 'POST', headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ handle, podHome: `${pod}${root}`, actorUrl: actorUrlFor(pod, root), kind: old.kind || 'person', fronted: true }),
-  });
-  const d = await res.json().catch(() => ({}));
-  if (res.status !== 201 || !d.hmacSecret) throw new Error(`could not attach to this gateway (HTTP ${res.status}): ${d.error || ''}`);
-  const gateway = {
-    url: `${origin}/u/${handle}/ap/inbox/`, frontActor: String(d.frontActor || `${origin}/u/${handle}/ap/actor`),
-    hmacSecret: d.hmacSecret, mode: 'trust',
-  };
-  gw.ok();
-
-  // --- the pod again: the config names this gateway, the key is restamped ---
-  //
-  // The old actor becomes an alias, which is what a server checks on the new
-  // actor before it honours a Move. `movedFrom` is the pending half: the
-  // agent completes it after its first boot under the new ids.
-  const keysStep = step('keys');
-  keysStep.running('moving your key and account record to the new address');
-  const aliases = [...new Set([...(old.aliases || []), here.frontActor])];
-  const config = {
-    ...old, handle, gateway, aliases,
-    movedFrom: { actor: here.frontActor, gateway: new URL(here.frontActor).origin, handle: old.handle, at: new Date().toISOString() },
-  };
-  keys.mintedFor = gateway.frontActor;                          // one key, one actor (lib/keys.mjs)
-  try {
-    await podState.writeKeys(remote, urls, keys);
-    await podState.writeConfig(remote, urls, config);
-  } catch (e) {
-    throw new Error(`could not update your account on the pod (${e.message})`);
-  }
-  await cacheOpenedKeys(actorUrlFor(pod, root), keys);
-  keysStep.ok();
-
-  return { config, address: `@${handle}@${new URL(origin).host}`, movedFrom: config.movedFrom };
-}

package/web/app/sw-src.mjs

@@ -1,220 +0,0 @@
-// sw-src.mjs — the service worker that hosts the in-browser agent.
-//
-// Phanpy (served static on this origin) calls the Mastodon API on its own
-// origin. This worker answers those calls from the agent running inside it, so
-// there is no server behind the client. The page boots the agent by posting it
-// the sign-up material (credential, config, plaintext keys); the worker holds
-// the agent for the life of the worker and intercepts the facade paths. Static
-// files fall through to the network.
-import { BrowserAgent } from './agent.mjs';
-import { getSession } from './oidc-session.mjs';
-import { ADMIN_PATHS } from './admin-facade.mjs';
-
-let agent = null;
-let booting = null;
-
-const FACADE = /^\/(api\/v[12]\/|oauth\/|nodeinfo\/)/;   // Mastodon paths only — never the front's own /api/handle, /api/attach, /api/relay
-const FACADE_EXACT = new Set(['/.well-known/nodeinfo', '/.well-known/oauth-authorization-server', '/nodeinfo/2.0']);
-const isFacade = (p) => FACADE.test(p) || FACADE_EXACT.has(p);
-// The owner's record/manage data endpoints (see admin-facade.mjs). The web/admin
-// PAGES are static files Netlify serves; only these data calls are ours.
-const isAdmin = (p) => ADMIN_PATHS.has(p);
-
-// ---- who may drive these routes ----
-//
-// Same-origin is the WHOLE trust boundary for this build. The worker answers
-// the owner's admin routes with no password and no token — the only interlock
-// on the destructive ones is `confirm === handle`, and the handle is public —
-// so without this gate any page the owner merely visited could move every
-// follower to an attacker's account, retire the identity, rotate the key,
-// point the inbox at an attacker's gateway, or set a UI password the owner
-// does not know. The Node agent is covered by lib/guard.mjs; nothing from
-// that file is in this bundle, and it could not do the job here anyway —
-// `Sec-Fetch-*` headers are NOT visible inside a service worker's fetch
-// event, and neither is `Origin`. So the gate is built from what a worker
-// CAN see: the request's mode, its referrer, and its headers.
-//
-// The header is what does the work, and it does not need to be a secret to do
-// it. A cross-site FORM cannot set a header at all. A cross-origin fetch()
-// that sets one is a preflighted request, and nothing here ever answers a
-// preflight with CORS headers, so the browser never sends the real one. That
-// leaves a top-level navigation, which also carries no custom headers.
-//
-// (The review suggested making it a per-session secret handed to the page by
-// postMessage. Deliberately not carried: the header already refuses every
-// cross-ORIGIN caller, and a secret would only add something against an
-// attacker already running script on this origin — who could read it straight
-// out of the page. The defence at that layer is the CSP, in the site's
-// _headers.)
-const PAGE_HEADER = 'x-fedipod-page';
-
-// The one route that MUST survive a cross-site navigation: the other server's
-// OAuth redirect lands the browser here, from their origin, by design. Its
-// `state` parameter is what stands in for the header.
-const NAV_ALLOWED = new Set(['/fediacct/callback']);
-
-const sameOriginReferrer = (request) => {
-  const r = request.referrer;
-  // 'about:client' is the browser saying "the context that asked", which for a
-  // request this worker intercepts is a page on this origin.
-  if (!r || r === 'about:client') return r === 'about:client';
-  try { return new URL(r).origin === self.location.origin; } catch { return false; }
-};
-
-// Returns null when the request may proceed, else the reason to refuse with.
-function notAllowed(request, url) {
-  const p = url.pathname;
-
-  // The Mastodon client API is deliberately open, exactly as it is on the Node
-  // agent and on any real instance: a bearer is its credential, and a client
-  // has to be able to call it. It mints nothing without one.
-  if (!isAdmin(p) && !p.startsWith('/oauth/')) return null;
-
-  if (request.mode === 'navigate') {
-    if (NAV_ALLOWED.has(p)) return null;
-    // The bundled client signs in by navigating its frame to /oauth/authorize
-    // from a page on this origin. A navigation from anywhere else — or from
-    // nowhere, which is what a page that suppressed its referrer looks like —
-    // is not that, and /oauth/authorize is where a 90-day bearer is minted.
-    if (p.startsWith('/oauth/') && sameOriginReferrer(request)) return null;
-    return 'a navigation may not drive this route';
-  }
-
-  // /oauth/* is not open the way /api/* is: the only client here is the one
-  // served from this origin, so a call from another origin is never legitimate.
-  if (p.startsWith('/oauth/')) {
-    return sameOriginReferrer(request) ? null : 'this route answers this origin only';
-  }
-
-  if (request.headers.get(PAGE_HEADER) !== '1') return `missing ${PAGE_HEADER}`;
-  // Belt and braces on top of the header: the facade parses a body as JSON
-  // whatever its content type, and `text/plain` is the one a cross-site form
-  // can send. Nothing that got past the header sends anything else anyway.
-  if (request.method !== 'GET' && request.method !== 'HEAD') {
-    const ct = (request.headers.get('content-type') || '').split(';')[0].trim().toLowerCase();
-    if (ct && ct !== 'application/json') return `unexpected content type "${ct}"`;
-  }
-  return null;
-}
-
-self.addEventListener('install', () => self.skipWaiting());
-self.addEventListener('activate', (e) => e.waitUntil(self.clients.claim()));
-
-// Boot the agent from the stored Solid-OIDC session. The sign-in page posts a
-// 'boot' to prime it, but the worker ALSO boots itself on demand (see serve):
-// browsers kill an idle service worker and restart it fresh, and the client at
-// /app/ never posts 'boot' — so without on-demand boot every request after a
-// restart 503s. On a boot failure `booting` is cleared so the next request retries.
-async function bootFromSession(frontOrigin) {
-  const oidc = await getSession();
-  if (!oidc) throw new Error('no session — sign in first');
-  const a = new BrowserAgent({ log: (m) => console.log('[sw-agent]', m) });
-  await a.boot({ oidc, frontOrigin: frontOrigin || self.location.origin });
-  agent = a;
-  return a;
-}
-function ensureBooting(frontOrigin) {
-  if (agent) return Promise.resolve(agent);
-  if (!booting) booting = bootFromSession(frontOrigin).catch((err) => { booting = null; throw err; });
-  return booting;
-}
-
-self.addEventListener('message', (e) => {
-  // Drop the identity this worker is holding. A worker outlives a page, so
-  // signing in as somebody else left the FIRST account's agent live and serving
-  // — the new session sat in IndexedDB while every request was still answered
-  // by the old actor, with the old key. The page posts this before it boots the
-  // new one; the next request boots from whatever session is stored now.
-  if (e.data?.type === 'reset') {
-    const had = !!agent;
-    agent = null; booting = null;
-    e.source?.postMessage({ type: 'reset-done', had });
-    return;
-  }
-  if (e.data?.type !== 'boot') return;
-  ensureBooting(e.data.frontOrigin)
-    .then(() => e.source?.postMessage({ type: 'booted' }))
-    // `code` matters: a boot that failed only because this browser has never
-    // opened the signing key is not a failure the page should show as one — it
-    // is a question the page can answer (boot.mjs). Everything else is shown.
-    .catch((err) => e.source?.postMessage({ type: 'boot-error', error: err.message,
-      code: err.code || null, stack: String(err.stack || '') }));
-});
-
-self.addEventListener('fetch', (e) => {
-  const url = new URL(e.request.url);
-  if (url.origin !== self.location.origin || !(isFacade(url.pathname) || isAdmin(url.pathname))) return;   // static → network
-  e.respondWith(serve(e.request, url));
-});
-
-async function serve(request, url) {
-  // Before anything is booted or read: is this caller allowed to be here at all?
-  const refuse = notAllowed(request, url);
-  if (refuse) {
-    console.warn(`[sw-agent] refused ${request.method} ${url.pathname}: ${refuse}`);
-    return json(403, { error: `refused: ${refuse}` });
-  }
-  // Boot on demand from the stored session, so the client works even when the
-  // worker was restarted (idle-killed) and nobody posted 'boot' this time.
-  if (!agent) { try { await ensureBooting(); } catch { /* no session → 503 below */ } }
-  if (!agent) return json(503, { error: 'not signed in on this browser — sign in at the front page' });
-  // Bytes, not text. A multipart upload is binary — read as text it comes back
-  // through a UTF-8 round trip that replaces every byte that is not valid UTF-8,
-  // which is most of a JPEG, so the boundary search found nothing and every
-  // media and avatar upload answered "422 file required". readBody() does
-  // `data += chunk`, which decodes a Buffer the same way it always did, so the
-  // JSON and form paths are unchanged.
-  const bodyBytes = (request.method === 'GET' || request.method === 'HEAD')
-    ? null : Buffer.from(new Uint8Array(await request.arrayBuffer()));
-  // The admin facade is JSON-only (the gate above enforces the content type),
-  // and takes its body already decoded.
-  const bodyText = bodyBytes ? new TextDecoder().decode(bodyBytes) : '';
-  const reqHeaders = {}; for (const [k, v] of request.headers) reqHeaders[k.toLowerCase()] = v;
-  // `host` is a forbidden header name, so a fetch Request never carries one and
-  // the loop above cannot produce it — but it is a header every real request
-  // arrives with, and the agent reads it to say where it lives. Without it the
-  // notifications `Link` header named `https://undefined/`, so a client that
-  // paged by following it (which is how a client is meant to page) walked off
-  // the origin and saw nothing past the first screen.
-  reqHeaders.host = url.host;
-  const listeners = {};
-  // The body's events fire on the next microtask. A route that reads the body
-  // may only register for them after an await or two — the facade dispatches
-  // through its area modules first — so a listener that arrives after the
-  // events have fired is given them at once, in the order it asks.
-  let fired = false;
-  const req = { method: request.method, url: url.pathname + url.search, headers: reqHeaders,
-    // notAllowed() above let this through, so it came from this origin. Said
-    // out loud rather than left implicit: MastoApi asks (through the
-    // authorities object in agent.mjs) whether a request is the owner's own,
-    // and in a browser that question means exactly this.
-    sameOrigin: true,
-    socket: { encrypted: url.protocol === 'https:' },
-    on(ev, cb) {
-      (listeners[ev] ||= []).push(cb);
-      if (fired) { if (ev === 'data' && bodyBytes?.length) cb(bodyBytes); else if (ev === 'end') cb(); }
-      return req;
-    },
-    destroy() {} };
-  queueMicrotask(() => {
-    fired = true;
-    if (bodyBytes?.length) (listeners.data || []).forEach((cb) => cb(bodyBytes));
-    (listeners.end || []).forEach((cb) => cb());
-  });
-  let status = 200; const outHeaders = {}; const chunks = [];
-  const res = {
-    writeHead(s, h) { status = s; if (h) Object.assign(outHeaders, h); return res; },
-    setHeader(k, v) { outHeaders[k] = v; }, getHeader(k) { return outHeaders[k]; },
-    write(c) { chunks.push(c); }, end(c) { if (c) chunks.push(c); },
-  };
-  try {
-    const handled = isAdmin(url.pathname)
-      ? await agent.admin.handle(req, res, url.pathname, url, bodyText)
-      : await agent.masto.handle(req, res, url.pathname, url);
-    if (!handled) return fetch(request);
-    return new Response(chunks.join(''), { status, headers: { 'content-type': 'application/json', ...outHeaders } });
-  } catch (err) {
-    return json(500, { error: err.message });
-  }
-}
-const json = (status, obj) => new Response(JSON.stringify(obj), { status, headers: { 'content-type': 'application/json' } });