fedipod-server 0.9.0 → 0.11.0

package/web/app/keystore.mjs

@@ -0,0 +1,99 @@
+// keystore.mjs — the signing keys, made in the browser and locked under the
+// account password, so the copy that lives on the pod is ciphertext.
+//
+// The Node agent keeps keys.json (RSA + Ed25519 PEMs) on disk, 0600. A browser
+// has no disk it can carry to the next machine, so the durable copy lives on
+// the pod, wrapped here first: the pod's owner-only ACL keeps strangers out,
+// and the password keeps the pod's HOST out — which the ACL cannot do, and
+// which matters more for a key than for any other document, because whoever
+// holds it is you to every server in the fediverse. The shape inside is exactly
+// the agent's keys.json, so once unwrapped it is used unchanged.
+//
+// Each browser opens it once and keeps the opened copy in its own IndexedDB
+// (see keys-browser.mjs). That is what lets the service worker boot itself
+// after an idle kill with nobody present to type anything, and it is why a NEW
+// browser asks for the password and a returning one does not.
+//
+// Until 2026-09-09 the wrap existed here but nothing called it: signup PUT the
+// bare record and the loader read it plain, while this header, web/app/README.md
+// and claude/plans/browser-agent.md all said otherwise. Now they agree.
+
+const PEM = (der, label) => {
+  const b64 = btoa(String.fromCharCode(...new Uint8Array(der)));
+  const lines = b64.match(/.{1,64}/g).join('\n');
+  return `-----BEGIN ${label}-----\n${lines}\n-----END ${label}-----\n`;
+};
+
+/** RSA (what Mastodon verifies) and, where the browser supports it, Ed25519
+ *  (FEP-8b32 proofs). A missing Ed25519 half is not fatal — the agent mints one
+ *  the same way it does for a pre-proofs keys.json, since nothing has published it. */
+export async function generateKeys() {
+  const rsa = await crypto.subtle.generateKey(
+    { name: 'RSASSA-PKCS1-v1_5', modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: 'SHA-256' },
+    true, ['sign', 'verify']);
+  const rec = {
+    rsa: {
+      publicPem: PEM(await crypto.subtle.exportKey('spki', rsa.publicKey), 'PUBLIC KEY'),
+      privatePem: PEM(await crypto.subtle.exportKey('pkcs8', rsa.privateKey), 'PRIVATE KEY'),
+    },
+  };
+  try {
+    const ed = await crypto.subtle.generateKey('Ed25519', true, ['sign', 'verify']);
+    rec.ed25519 = {
+      publicPem: PEM(await crypto.subtle.exportKey('spki', ed.publicKey), 'PUBLIC KEY'),
+      privatePem: PEM(await crypto.subtle.exportKey('pkcs8', ed.privateKey), 'PRIVATE KEY'),
+    };
+  } catch { /* no Ed25519 in this browser — the agent mints it on first run */ }
+  return rec;
+}
+
+const PBKDF2_ITERATIONS = 310_000;   // OWASP 2023 floor for PBKDF2-HMAC-SHA256
+
+async function deriveAesKey(password, salt, iterations) {
+  const base = await crypto.subtle.importKey('raw', new TextEncoder().encode(password), 'PBKDF2', false, ['deriveKey']);
+  return crypto.subtle.deriveKey(
+    { name: 'PBKDF2', salt, iterations, hash: 'SHA-256' },
+    base, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+}
+
+const toB64 = (buf) => btoa(String.fromCharCode(...new Uint8Array(buf)));
+const fromB64 = (s) => Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
+
+/** Whether a document read off the pod is a wrapped envelope rather than a bare
+ *  keys record. Installs made before wrapping have the bare record there, and
+ *  those still have to boot — the shape is what tells them apart. */
+export function isKeyEnvelope(doc) {
+  return !!doc && doc.v === 1 && typeof doc.ct === 'string' && typeof doc.salt === 'string';
+}
+
+/** Thrown when the pod holds a wrapped key and nothing in this browser can open
+ *  it. The page catches it by `code` and asks for the account password; the
+ *  worker cannot ask anyone anything. */
+export class KeyPasswordNeeded extends Error {
+  constructor() { super('this browser needs your account password to unlock the signing key'); }
+  code = 'key-password-needed';
+}
+
+/** Wrap the keys record under the password. The envelope names its own KDF and
+ *  parameters, so unwrap needs only the password and this document. */
+export async function wrapKeys(keysRecord, password) {
+  const salt = crypto.getRandomValues(new Uint8Array(16));
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const aes = await deriveAesKey(password, salt, PBKDF2_ITERATIONS);
+  const plaintext = new TextEncoder().encode(JSON.stringify(keysRecord));
+  const ct = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, aes, plaintext);
+  return { v: 1, kdf: 'PBKDF2-SHA256', iterations: PBKDF2_ITERATIONS,
+    salt: toB64(salt), iv: toB64(iv), ct: toB64(ct) };
+}
+
+/** Unwrap an envelope wrapKeys made. Throws on a wrong password (AES-GCM auth
+ *  failure) — which is how a new browser tells a typo from a real key. */
+export async function unwrapKeys(envelope, password) {
+  if (!envelope || envelope.v !== 1) throw new Error('not a key envelope');
+  const aes = await deriveAesKey(password, fromB64(envelope.salt), envelope.iterations);
+  let plaintext;
+  try {
+    plaintext = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: fromB64(envelope.iv) }, aes, fromB64(envelope.ct));
+  } catch { throw new Error('wrong password'); }
+  return JSON.parse(new TextDecoder().decode(plaintext));
+}

package/web/app/oidc-session.mjs

@@ -0,0 +1,189 @@
+// oidc-session.mjs — Solid-OIDC login for the browser agent, with a secure,
+// durable, worker-visible session.
+//
+// The redirect handshake (authorization-code + PKCE) runs in the page. The
+// session it yields — a DPoP keypair whose private half is NON-EXTRACTABLE, plus
+// the refresh token, the token endpoint and the WebID — is kept in IndexedDB.
+// IndexedDB survives a browser restart and is readable by the service worker
+// where the agent runs, and a non-extractable key can sign but never be read
+// out, even by injected script. That is the security this buys over uvdsl's
+// sessionStorage (which must hold an extractable key as a string, per-tab).
+//
+// Page:   const { authorizationUrl } = await beginLogin({ issuer, redirectUri });
+//         location.href = authorizationUrl;                 // ... redirect ...
+//         await completeLogin({ currentUrl: location.href });  // on return
+// Anywhere (page or worker):
+//         const session = await getSession();  // { webId, fetch, signOut } | null
+
+const DB = 'fedipod-oidc';
+const STORE = 'session';
+const b64u = (buf) => btoa(String.fromCharCode(...new Uint8Array(buf))).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+const enc = (o) => b64u(new TextEncoder().encode(JSON.stringify(o)));
+const sha256 = (s) => crypto.subtle.digest('SHA-256', new TextEncoder().encode(s));
+const rand = (n = 32) => b64u(crypto.getRandomValues(new Uint8Array(n)));
+
+function idb() {
+  return new Promise((res, rej) => {
+    const r = indexedDB.open(DB, 1);
+    r.onupgradeneeded = () => r.result.createObjectStore(STORE);
+    r.onsuccess = () => res(r.result);
+    r.onerror = () => rej(r.error);
+  });
+}
+async function idbGet(key) {
+  const db = await idb();
+  return new Promise((res, rej) => { const t = db.transaction(STORE).objectStore(STORE).get(key); t.onsuccess = () => res(t.result); t.onerror = () => rej(t.error); });
+}
+async function idbPut(key, val) {
+  const db = await idb();
+  return new Promise((res, rej) => { const t = db.transaction(STORE, 'readwrite').objectStore(STORE).put(val, key); t.onsuccess = () => res(); t.onerror = () => rej(t.error); });
+}
+async function idbDel(key) {
+  const db = await idb();
+  return new Promise((res, rej) => { const t = db.transaction(STORE, 'readwrite').objectStore(STORE).delete(key); t.onsuccess = () => res(); t.onerror = () => rej(t.error); });
+}
+
+async function dpopKey() { return crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign']); }
+async function publicJwk(pair) { const j = await crypto.subtle.exportKey('jwk', pair.publicKey); return { kty: j.kty, crv: j.crv, x: j.x, y: j.y }; }
+async function dpopProof(pair, jwk, htm, htu, ath) {
+  const header = { typ: 'dpop+jwt', alg: 'ES256', jwk };
+  const payload = { htm, htu: htu.split('#')[0], jti: crypto.randomUUID(), iat: Math.floor(Date.now() / 1000), ...(ath ? { ath } : {}) };
+  const data = `${enc(header)}.${enc(payload)}`;
+  const sig = await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, pair.privateKey, new TextEncoder().encode(data));
+  return `${data}.${b64u(sig)}`;
+}
+const jwtPayload = (jwt) => { try { return JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(jwt.split('.')[1].replace(/-/g, '+').replace(/_/g, '/')), (c) => c.charCodeAt(0)))); } catch { return {}; } };
+
+async function discover(issuer) {
+  const res = await fetch(`${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration`, { headers: { accept: 'application/json' } });
+  if (!res.ok) throw new Error(`OIDC discovery failed at ${issuer} (HTTP ${res.status})`);
+  return res.json();
+}
+async function registerClient(cfg, redirectUri, clientName) {
+  const res = await fetch(cfg.registration_endpoint, {
+    method: 'POST', headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ client_name: clientName, redirect_uris: [redirectUri], token_endpoint_auth_method: 'none',
+      grant_types: ['authorization_code', 'refresh_token'], response_types: ['code'], application_type: 'web', scope: 'openid webid offline_access' }),
+  });
+  if (!res.ok) throw new Error(`client registration failed (HTTP ${res.status})`);
+  return (await res.json()).client_id;
+}
+
+/** Begin login: prepare PKCE + a non-extractable DPoP key, stash the pending
+ *  state, and return the authorization URL for the caller to navigate to. */
+export async function beginLogin({ issuer, redirectUri, clientName = 'FediPod' }) {
+  const cfg = await discover(issuer);
+  const client_id = await registerClient(cfg, redirectUri, clientName);
+  const pair = await dpopKey();
+  const verifier = rand(48);
+  const challenge = b64u(await sha256(verifier));
+  const state = rand(16);
+  await idbPut('pending', { issuer, client_id, redirectUri, verifier, state, pair,
+    tokenEndpoint: cfg.token_endpoint, authorizationEndpoint: cfg.authorization_endpoint,
+    revocationEndpoint: cfg.revocation_endpoint || null });
+  const url = new URL(cfg.authorization_endpoint);
+  for (const [k, v] of Object.entries({ client_id, redirect_uri: redirectUri, response_type: 'code',
+    scope: 'openid webid offline_access', code_challenge: challenge, code_challenge_method: 'S256', state, prompt: 'consent' })) url.searchParams.set(k, v);
+  return { authorizationUrl: url.href };
+}
+
+/** Complete login from the redirect back. Exchanges the code (DPoP + PKCE),
+ *  stores the durable session, and returns it. Returns null if there is no code. */
+export async function completeLogin({ currentUrl }) {
+  const u = new URL(currentUrl);
+  const code = u.searchParams.get('code');
+  const state = u.searchParams.get('state');
+  if (!code) return null;
+  const p = await idbGet('pending');
+  if (!p || p.state !== state) throw new Error('login state mismatch');
+  const jwk = await publicJwk(p.pair);
+  const res = await fetch(p.tokenEndpoint, {
+    method: 'POST',
+    headers: { 'content-type': 'application/x-www-form-urlencoded', dpop: await dpopProof(p.pair, jwk, 'POST', p.tokenEndpoint) },
+    body: new URLSearchParams({ grant_type: 'authorization_code', code, redirect_uri: p.redirectUri, client_id: p.client_id, code_verifier: p.verifier }),
+  });
+  const tok = await res.json().catch(() => ({}));
+  if (!res.ok || !tok.access_token) throw new Error(`token exchange failed (HTTP ${res.status}): ${tok.error || ''}`);
+  const webId = jwtPayload(tok.access_token).webid || jwtPayload(tok.id_token || '').webid || null;
+  const session = { issuer: p.issuer, client_id: p.client_id, tokenEndpoint: p.tokenEndpoint, pair: p.pair,
+    // Where to hand the refresh token back at sign-out. Kept on the session
+    // because discovery is a network round trip and sign-out should not need
+    // one — see signOut().
+    revocationEndpoint: p.revocationEndpoint || null,
+    refreshToken: tok.refresh_token || null, accessToken: tok.access_token,
+    expiresAt: Date.now() + Math.max(30, (tok.expires_in || 300)) * 1000, webId };
+  await idbPut('session', session);
+  await idbDel('pending');
+  return sessionHandle(session);
+}
+
+/** Restore the session from IndexedDB — works in the page and the worker. */
+export async function getSession() {
+  const s = await idbGet('session');
+  return s ? sessionHandle(s) : null;
+}
+
+/**
+ * Sign out, and tell the issuer.
+ *
+ * Dropping the row locally left the REFRESH TOKEN alive at the pod for its full
+ * life — signing out of a shared or borrowed browser cleared the screen and
+ * nothing else, and anyone who had copied the token could go on minting access
+ * tokens with it. RFC 7009: hand it back.
+ *
+ * Best effort, and the local teardown happens either way: an issuer that is
+ * unreachable, or that publishes no revocation endpoint, must not be able to
+ * keep somebody signed in.
+ */
+export async function signOut() {
+  const s = await idbGet('session').catch(() => null);
+  if (s?.revocationEndpoint && s.refreshToken) {
+    try {
+      await fetch(s.revocationEndpoint, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          token: s.refreshToken, token_type_hint: 'refresh_token', client_id: s.client_id,
+        }),
+      });
+    } catch { /* told if we could; leaving is not conditional on being heard */ }
+  }
+  await idbDel('session');
+  await idbDel('pending');
+}
+
+function sessionHandle(s) {
+  let { accessToken, expiresAt, refreshToken } = s;
+  const jwkP = publicJwk(s.pair);
+  const refresh = async () => {
+    if (!refreshToken) throw new Error('session expired and there is no refresh token — sign in again');
+    const jwk = await jwkP;
+    const res = await fetch(s.tokenEndpoint, {
+      method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded', dpop: await dpopProof(s.pair, jwk, 'POST', s.tokenEndpoint) },
+      body: new URLSearchParams({ grant_type: 'refresh_token', refresh_token: refreshToken, client_id: s.client_id, scope: 'openid webid offline_access' }),
+    });
+    const tok = await res.json().catch(() => ({}));
+    if (!res.ok || !tok.access_token) { await idbDel('session'); throw new Error('refresh failed — sign in again'); }
+    accessToken = tok.access_token;
+    expiresAt = Date.now() + Math.max(30, (tok.expires_in || 300)) * 1000;
+    if (tok.refresh_token) refreshToken = tok.refresh_token;
+    // Re-read before writing back. There is ONE 'session' row, and this handle
+    // closed over the session it was made from — so a refresh that was already
+    // in flight when the user signed in as somebody else would put the OLD
+    // identity back, silently, over the new one. Only write if the row is still
+    // the session this handle belongs to.
+    const now = await idbGet('session');
+    if (now && now.webId !== s.webId) {
+      throw new Error('signed in as somebody else while this session was refreshing');
+    }
+    await idbPut('session', { ...s, accessToken, expiresAt, refreshToken });
+  };
+  const authFetch = async (url, init = {}) => {
+    if (Date.now() > expiresAt - 30_000) await refresh();
+    const jwk = await jwkP;
+    const ath = b64u(await sha256(accessToken));
+    const headers = { ...(init.headers || {}), authorization: `DPoP ${accessToken}`, dpop: await dpopProof(s.pair, jwk, (init.method || 'GET'), url, ath) };
+    return fetch(url, { ...init, headers });
+  };
+  return { webId: s.webId, fetch: authFetch, refresh, signOut };
+}

package/web/app/pod-auth.mjs

@@ -0,0 +1,248 @@
+// pod-auth.mjs — the pod side of sign-in, done in the browser with no server
+// in between. It is the browser-native twin of lib/account.mjs and
+// vendor/idp-grant.cjs: create a Community Solid Server account and pod, mint a
+// client credential, and turn that credential into a DPoP-bound session whose
+// fetch writes to the pod. Everything a Node agent did against a CSS account
+// API, a page does here — proven cross-origin against solidcommunity.net on
+// 2026-09-06 (claude/validation/scn-cross-origin-spike.html).
+//
+// No dependency on lib/: lib is Node (node:crypto, undici, @fedify). This uses
+// only WebCrypto and fetch, so it runs in a tab and in a service worker.
+
+const b64u = (buf) => btoa(String.fromCharCode(...new Uint8Array(buf)))
+  .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+const enc = (o) => b64u(new TextEncoder().encode(JSON.stringify(o)));
+const sha256 = async (str) => crypto.subtle.digest('SHA-256', new TextEncoder().encode(str));
+
+// A CSS account-API call: JSON in, JSON out, the account token carried the way
+// CSS wants it (a bearer with its own scheme, not a cookie, in v7).
+async function accountFetch(url, { method = 'GET', body, token } = {}) {
+  const headers = { accept: 'application/json' };
+  if (body !== undefined) headers['content-type'] = 'application/json';
+  if (token) headers.authorization = `CSS-Account-Token ${token}`;
+  const res = await fetch(url, { method, headers, body: body === undefined ? undefined : JSON.stringify(body) });
+  let json = null;
+  try { json = await res.json(); } catch { /* non-JSON error bodies exist */ }
+  return { status: res.status, json };
+}
+
+/** Is this origin a CSS v7 account API at all? Cheap pre-flight for the form. */
+export async function accountApiControls(issuer) {
+  const origin = issuer.replace(/\/+$/, '');
+  const { status, json } = await accountFetch(`${origin}/.account/`);
+  if (status >= 400 || !json?.controls) return null;
+  return json.controls;
+}
+
+/**
+ * Create an account and a pod named `podName`. Idempotent on re-run: an
+ * existing account logs in, an existing pod of the same name is reused. Refuses
+ * to make a second pod on an account that already has one, which would give it
+ * a second WebID a single credential could not match. Mirrors
+ * lib/account.mjs's guards exactly, because the failure it prevents (a
+ * credential bound to the wrong WebID that 403s every write) is the same here.
+ */
+export async function createAccountWithPod({ issuer, email, password, podName }) {
+  const origin = issuer.replace(/\/+$/, '');
+  const accountRoot = `${origin}/.account/`;
+
+  let token;
+  const login = await accountFetch(`${accountRoot}login/password/`, { method: 'POST', body: { email, password } });
+  if (login.status < 400 && login.json?.authorization) {
+    token = login.json.authorization;
+  } else {
+    const create = await accountFetch(`${accountRoot}account/`, { method: 'POST' });
+    if (!create.json?.authorization) {
+      throw new Error(`could not create an account at ${origin} (HTTP ${create.status})`
+        + ` — is sign-up open there? ${create.json?.message || ''}`);
+    }
+    token = create.json.authorization;
+    const pwCreate = (await accountFetch(accountRoot, { token })).json?.controls?.password?.create;
+    if (!pwCreate) throw new Error('this server is not a CSS v7 account API (no password control)');
+    const pw = await accountFetch(pwCreate, { method: 'POST', token, body: { email, password } });
+    if (pw.status >= 400) throw new Error(`could not set the password (HTTP ${pw.status}): ${pw.json?.message || ''}`);
+  }
+
+  const podCreate = (await accountFetch(accountRoot, { token })).json?.controls?.account?.pod;
+  if (!podCreate) throw new Error('this server does not offer pod creation through its account API');
+
+  const findOwn = async () => {
+    const pods = (await accountFetch(podCreate, { token })).json?.pods || {};
+    return Object.entries(pods).find(([url]) => {
+      try {
+        const u = new URL(url);
+        return u.hostname === podName || u.hostname.startsWith(`${podName}.`)
+          || u.pathname.split('/').filter(Boolean).includes(podName);
+      } catch { return false; }
+    }) || null;
+  };
+  const owned = Object.keys((await accountFetch(podCreate, { token })).json?.pods || {});
+  if (owned.length && !(await findOwn())) {
+    throw new Error(`${email} already has a pod on ${new URL(origin).host} — one account, one pod.`
+      + ' A second identity needs its own account. Nothing was created.');
+  }
+  const made = await accountFetch(podCreate, { method: 'POST', token, body: { name: podName } });
+  let pod = made.json?.pod || made.json?.podBaseUrl || null;
+  let webId = made.json?.webId || null;
+  if (made.status >= 400 || !pod) {
+    const own = await findOwn();
+    if (own) { pod = own[0]; webId = webId || own[1]?.webId || null; }
+    else if (made.status >= 400) throw new Error(`pod creation failed (HTTP ${made.status}): ${made.json?.message || ''}`);
+  }
+  if (!pod) throw new Error('the server did not report a pod URL');
+  return { pod: pod.endsWith('/') ? pod : pod + '/', webId, accountToken: token };
+}
+
+/**
+ * Mint a client credential against the account. `accountToken` reuses a login
+ * from createAccountWithPod; otherwise email+password logs in. Returns the
+ * credential record the agent expects, minus remotePod (the caller adds it).
+ */
+export async function mintCredential({ issuer, email, password, webId, podUrl, accountToken, name = 'fedipod' }) {
+  const origin = issuer.replace(/\/+$/, '');
+  const accountRoot = `${origin}/.account/`;
+
+  let token = accountToken;
+  if (!token) {
+    // Sign in with the identifier the form gave (an email). If that account does
+    // not own the target pod — or the sign-in fails outright — fall back to the
+    // pod's subdomain as a username: older solidcommunity.net accounts sign in by
+    // username, not email. Done behind the scenes so the form only asks for an email.
+    const tryLogin = async (id) => {
+      const r = await accountFetch(`${accountRoot}login/password/`, { method: 'POST', body: { email: id, password } });
+      return (r.status < 400 && r.json?.authorization) ? r.json.authorization : null;
+    };
+    const ownsPod = async (tok) => {
+      if (!podUrl) return true;
+      try {
+        const ctl = (await accountFetch(accountRoot, { token: tok })).json?.controls?.account?.webId;
+        const links = ctl ? (await accountFetch(ctl, { token: tok })).json?.webIdLinks : null;
+        return Object.keys(links || {}).some((w) => new URL(w).origin === new URL(podUrl).origin);
+      } catch { return false; }
+    };
+    token = await tryLogin(email);
+    let sub = null; try { sub = podUrl ? new URL(podUrl).host.split('.')[0] : null; } catch { /* podUrl not a URL */ }
+    if (sub && sub !== email && (!token || !(await ownsPod(token)))) {
+      const alt = await tryLogin(sub);
+      if (alt) token = alt;
+    }
+    if (!token) throw new Error('account login failed — check the email or username and the password');
+  }
+
+  const controls = (await accountFetch(accountRoot, { token })).json?.controls;
+  const ccUrl = controls?.account?.clientCredentials;
+  if (!ccUrl) throw new Error('this server is not a CSS account API (no clientCredentials control)');
+
+  let wid = webId;
+  if (!wid) {
+    const linkCtl = controls?.account?.webId;
+    const links = linkCtl ? (await accountFetch(linkCtl, { token })).json?.webIdLinks : null;
+    const all = links ? Object.keys(links) : [];
+    if (!all.length) throw new Error('no WebID is linked to this account');
+    if (podUrl) {
+      // The credential MUST be for a WebID that owns the target pod, or every
+      // write to it is rejected. Never fall back to an unrelated WebID: a
+      // credential bound to the wrong identity 401s/403s on the pod, which is
+      // the opaque "could not store the key" people then see.
+      let origins = [];
+      try { origins = all.filter((w) => new URL(w).origin === new URL(podUrl).origin); } catch { /* podUrl not a URL */ }
+      if (!origins.length) {
+        throw new Error(`the account you signed in with does not own ${new URL(podUrl).origin}. `
+          + `It is linked to ${all.length} WebID${all.length > 1 ? 's' : ''} — on `
+          + `${all.map((w) => new URL(w).host).join(', ')} — none of them this pod. `
+          + 'Sign in with the account that owns this pod, or let FediPod make you a new one.');
+      }
+      wid = origins[0];
+    } else {
+      wid = all[0];
+    }
+  }
+
+  const made = await accountFetch(ccUrl, { method: 'POST', token, body: { name, webId: wid } });
+  if (made.status >= 400 || !made.json?.secret) throw new Error(`mint failed (HTTP ${made.status}): ${made.json?.message || ''}`);
+  const tokenEndpoint = await discoverTokenEndpoint(origin);
+  return { clientId: made.json.id, secret: made.json.secret, webId: wid, tokenEndpoint,
+    resource: made.json.resource, issuerOrigin: origin,
+    // Carried so sign-up can hand it straight back to revokeCredential. It is a
+    // session token for the ACCOUNT — never stored, never written to the pod,
+    // and gone with the tab.
+    accountToken: token };
+}
+
+/**
+ * Delete a client credential.
+ *
+ * The one sign-up mints is full, permanent access to the pod, and it is needed
+ * only while sign-up is running — the agent itself runs on the Solid-OIDC
+ * session. Leaving it behind meant every account carried an orphaned key that
+ * nothing held and nobody would think to revoke, while the page told the user
+ * it was "stored in this browser", which it never was.
+ *
+ * Best effort by design: a server that will not delete it leaves a credential
+ * the owner can still revoke from their pod's own account page, and saying so
+ * is better than failing a sign-up that otherwise worked.
+ */
+export async function revokeCredential({ resource, accountToken }) {
+  if (!resource || !accountToken) return false;
+  try {
+    const r = await accountFetch(resource, { method: 'DELETE', token: accountToken });
+    return r.status < 400;
+  } catch { return false; }
+}
+
+/** The OIDC token endpoint, from the issuer's discovery document. */
+export async function discoverTokenEndpoint(issuer) {
+  const origin = issuer.replace(/\/+$/, '');
+  try {
+    const res = await fetch(`${origin}/.well-known/openid-configuration`, { headers: { accept: 'application/json' } });
+    if (res.ok) {
+      const doc = await res.json();
+      if (doc.token_endpoint) return doc.token_endpoint;
+    }
+  } catch { /* fall through to the CSS default */ }
+  return `${origin}/.oidc/token`;
+}
+
+/**
+ * A DPoP-bound session: one ES256 proof key, a client-credentials access token
+ * bound to it, and a `fetch` that signs every request. The same key must sign
+ * the token request and every resource request, or the token's binding fails,
+ * so the key is made once and kept.
+ */
+export async function makeDpopSession({ clientId, secret, tokenEndpoint }) {
+  const proofKey = await crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign']);
+  const jwk = await crypto.subtle.exportKey('jwk', proofKey.publicKey);
+  const publicJwk = { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y };
+
+  const proof = async (htm, htu, ath) => {
+    const header = { typ: 'dpop+jwt', alg: 'ES256', jwk: publicJwk };
+    const payload = { htm, htu: htu.split('#')[0], jti: crypto.randomUUID(), iat: Math.floor(Date.now() / 1000), ...(ath ? { ath } : {}) };
+    const data = `${enc(header)}.${enc(payload)}`;
+    const sig = await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, proofKey.privateKey, new TextEncoder().encode(data));
+    return `${data}.${b64u(sig)}`;
+  };
+
+  let token = null; let expiresAt = 0;
+  const refresh = async () => {
+    const basic = btoa(`${encodeURIComponent(clientId)}:${encodeURIComponent(secret)}`);
+    const res = await fetch(tokenEndpoint, {
+      method: 'POST',
+      headers: { authorization: `Basic ${basic}`, 'content-type': 'application/x-www-form-urlencoded', dpop: await proof('POST', tokenEndpoint) },
+      body: 'grant_type=client_credentials&scope=webid',
+    });
+    const tok = await res.json().catch(() => ({}));
+    if (!tok.access_token) throw new Error(`token request failed (HTTP ${res.status}): ${tok.error || ''}`);
+    token = tok.access_token;
+    expiresAt = Date.now() + Math.max(30, (tok.expires_in || 300) - 30) * 1000;
+    return token;
+  };
+
+  const authFetch = async (url, init = {}) => {
+    if (!token || Date.now() > expiresAt) await refresh();
+    const ath = b64u(await sha256(token));
+    const headers = { ...(init.headers || {}), authorization: `DPoP ${token}`, dpop: await proof((init.method || 'GET'), url, ath) };
+    return fetch(url, { ...init, headers });
+  };
+
+  return { fetch: authFetch, refresh };
+}

package/web/app/pod-remote.mjs

@@ -0,0 +1,84 @@
+// pod-remote.mjs — the browser's pod transport, over a DPoP/OIDC session.
+//
+// The conversation with the pod — verbs, ACL documents, the deletion deny-list,
+// the Retry-After cooldown, container listings — is lib/pod/transport.mjs, the
+// same code the Node agent runs. This used to be a hand-kept fork of that file,
+// and the fork had drifted: no cooldown at all for a 429 without a Retry-After
+// header, no byte cap on a listing from a public-Append inbox, a swallowed
+// parse failure, and probes that were neither counted nor held back. Those are
+// gone with the fork.
+//
+// What genuinely differs, and all that is left here: this side retries a
+// dropped connection, and waits a throttle out instead of failing fast.
+
+import { PodTransport } from '../../lib/pod/transport.mjs';
+
+export { protectedFromDeletion } from '../../lib/pod/transport.mjs';
+
+// Retry transient edge throttling (dropped connections, 429/503) with backoff.
+const RETRY_MAX = 5;
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const backoff = (n) => Math.min(5000, 400 * 2 ** n) + Math.floor(Math.random() * 250);
+
+// A tighter ceiling than the Node side's thirty minutes: a tab is a person
+// waiting, and a hostile or confused header must not park them for half an hour.
+const COOLDOWN_MAX_MS = 5 * 60_000;
+
+export class BrowserRemotePod extends PodTransport {
+  constructor(session, { webId, log = () => {}, role = 'agent' } = {}) {
+    super(session, {
+      webId,
+      log,
+      role,
+      runtime: 'browser',
+      // Wait the throttle out rather than refusing: there is a person here, and
+      // an operation that resumes in four seconds beats one that fails and asks
+      // them to try again.
+      cooldownMode: 'wait',
+      maxCooldownMs: COOLDOWN_MAX_MS,
+    });
+  }
+
+  async warmup() { /* the DPoP session refreshes lazily */ }
+
+  /**
+   * solidcommunity.net sits behind an edge (Cloudflare) that throttles a burst
+   * of requests: during first-boot provisioning the agent makes ~15 rapid
+   * calls, and one comes back as a dropped connection ("Failed to fetch") or a
+   * 429/503. A single dropped write used to abort the whole boot. Retry those
+   * with escalating backoff — the throttle window clears in under a few seconds.
+   * Safe to retry: a thrown request never reached the server, and a 429/503 was
+   * refused, not applied.
+   *
+   * This overrides `_send`, not `fetch`, so it cannot skip the url map, the
+   * cooldown accounting or the deletion deny-list — all of which sit in `fetch`
+   * above it. The pod-wide pause is armed there too, so a retry here waits for
+   * the whole pod rather than each call climbing its own ladder.
+   */
+  async _send(url, init) {
+    let attempt = 0;
+    for (;;) {
+      try {
+        const res = await this.session.fetch(url, init);
+        if ((res.status === 429 || res.status === 503) && attempt < RETRY_MAX) {
+          // Arm the pod-wide pause from THIS answer before retrying. The retry
+          // happens inside `fetch`, so waiting for the outer `_observe` would
+          // mean climbing the whole ladder while ignoring the Retry-After the
+          // server just gave us. `_cooldownGate` then sleeps whatever was
+          // armed; when the server named no delay, nothing is armed and the
+          // backoff below paces it instead.
+          this._observe(res);
+          if (this.pausedUntil > Date.now()) await this._cooldownGate();
+          else await sleep(backoff(attempt));
+          attempt++;
+          continue;
+        }
+        return res;
+      } catch (e) {
+        if (attempt >= RETRY_MAX) throw e;
+        this.log(`[${this.label}] ${init?.method || 'GET'} ${url} failed (${e.message}); retry ${attempt + 1}/${RETRY_MAX}`);
+        await sleep(backoff(attempt++));
+      }
+    }
+  }
+}

package/web/app/shims/_globals.mjs

@@ -0,0 +1,2 @@
+export const URL = globalThis.URL;
+export const URLSearchParams = globalThis.URLSearchParams;