fedipod-server 0.9.0 → 0.11.0

package/web/app/sw-src.mjs

@@ -0,0 +1,205 @@
+// sw-src.mjs — the service worker that hosts the in-browser agent.
+//
+// Phanpy (served static on this origin) calls the Mastodon API on its own
+// origin. This worker answers those calls from the agent running inside it, so
+// there is no server behind the client. The page boots the agent by posting it
+// the sign-up material (credential, config, plaintext keys); the worker holds
+// the agent for the life of the worker and intercepts the facade paths. Static
+// files fall through to the network.
+import { BrowserAgent } from './agent.mjs';
+import { getSession } from './oidc-session.mjs';
+import { ADMIN_PATHS } from './admin-facade.mjs';
+
+let agent = null;
+let booting = null;
+
+const FACADE = /^\/(api\/v[12]\/|oauth\/|nodeinfo\/)/;   // Mastodon paths only — never the front's own /api/handle, /api/attach, /api/relay
+const FACADE_EXACT = new Set(['/.well-known/nodeinfo', '/.well-known/oauth-authorization-server', '/nodeinfo/2.0']);
+const isFacade = (p) => FACADE.test(p) || FACADE_EXACT.has(p);
+// The owner's record/manage data endpoints (see admin-facade.mjs). The web/admin
+// PAGES are static files Netlify serves; only these data calls are ours.
+const isAdmin = (p) => ADMIN_PATHS.has(p);
+
+// ---- who may drive these routes ----
+//
+// Same-origin is the WHOLE trust boundary for this build. The worker answers
+// the owner's admin routes with no password and no token — the only interlock
+// on the destructive ones is `confirm === handle`, and the handle is public —
+// so without this gate any page the owner merely visited could move every
+// follower to an attacker's account, retire the identity, rotate the key,
+// point the inbox at an attacker's gateway, or set a UI password the owner
+// does not know. The Node agent is covered by lib/guard.mjs; nothing from
+// that file is in this bundle, and it could not do the job here anyway —
+// `Sec-Fetch-*` headers are NOT visible inside a service worker's fetch
+// event, and neither is `Origin`. So the gate is built from what a worker
+// CAN see: the request's mode, its referrer, and its headers.
+//
+// The header is what does the work, and it does not need to be a secret to do
+// it. A cross-site FORM cannot set a header at all. A cross-origin fetch()
+// that sets one is a preflighted request, and nothing here ever answers a
+// preflight with CORS headers, so the browser never sends the real one. That
+// leaves a top-level navigation, which also carries no custom headers.
+//
+// (The review suggested making it a per-session secret handed to the page by
+// postMessage. Deliberately not carried: the header already refuses every
+// cross-ORIGIN caller, and a secret would only add something against an
+// attacker already running script on this origin — who could read it straight
+// out of the page. The defence at that layer is the CSP, in the site's
+// _headers.)
+const PAGE_HEADER = 'x-fedipod-page';
+
+// The one route that MUST survive a cross-site navigation: the other server's
+// OAuth redirect lands the browser here, from their origin, by design. Its
+// `state` parameter is what stands in for the header.
+const NAV_ALLOWED = new Set(['/fediacct/callback']);
+
+const sameOriginReferrer = (request) => {
+  const r = request.referrer;
+  // 'about:client' is the browser saying "the context that asked", which for a
+  // request this worker intercepts is a page on this origin.
+  if (!r || r === 'about:client') return r === 'about:client';
+  try { return new URL(r).origin === self.location.origin; } catch { return false; }
+};
+
+// Returns null when the request may proceed, else the reason to refuse with.
+function notAllowed(request, url) {
+  const p = url.pathname;
+
+  // The Mastodon client API is deliberately open, exactly as it is on the Node
+  // agent and on any real instance: a bearer is its credential, and a client
+  // has to be able to call it. It mints nothing without one.
+  if (!isAdmin(p) && !p.startsWith('/oauth/')) return null;
+
+  if (request.mode === 'navigate') {
+    if (NAV_ALLOWED.has(p)) return null;
+    // The bundled client signs in by navigating its frame to /oauth/authorize
+    // from a page on this origin. A navigation from anywhere else — or from
+    // nowhere, which is what a page that suppressed its referrer looks like —
+    // is not that, and /oauth/authorize is where a 90-day bearer is minted.
+    if (p.startsWith('/oauth/') && sameOriginReferrer(request)) return null;
+    return 'a navigation may not drive this route';
+  }
+
+  // /oauth/* is not open the way /api/* is: the only client here is the one
+  // served from this origin, so a call from another origin is never legitimate.
+  if (p.startsWith('/oauth/')) {
+    return sameOriginReferrer(request) ? null : 'this route answers this origin only';
+  }
+
+  if (request.headers.get(PAGE_HEADER) !== '1') return `missing ${PAGE_HEADER}`;
+  // Belt and braces on top of the header: the facade parses a body as JSON
+  // whatever its content type, and `text/plain` is the one a cross-site form
+  // can send. Nothing that got past the header sends anything else anyway.
+  if (request.method !== 'GET' && request.method !== 'HEAD') {
+    const ct = (request.headers.get('content-type') || '').split(';')[0].trim().toLowerCase();
+    if (ct && ct !== 'application/json') return `unexpected content type "${ct}"`;
+  }
+  return null;
+}
+
+self.addEventListener('install', () => self.skipWaiting());
+self.addEventListener('activate', (e) => e.waitUntil(self.clients.claim()));
+
+// Boot the agent from the stored Solid-OIDC session. The sign-in page posts a
+// 'boot' to prime it, but the worker ALSO boots itself on demand (see serve):
+// browsers kill an idle service worker and restart it fresh, and the client at
+// /app/ never posts 'boot' — so without on-demand boot every request after a
+// restart 503s. On a boot failure `booting` is cleared so the next request retries.
+async function bootFromSession(frontOrigin) {
+  const oidc = await getSession();
+  if (!oidc) throw new Error('no session — sign in first');
+  const a = new BrowserAgent({ log: (m) => console.log('[sw-agent]', m) });
+  await a.boot({ oidc, frontOrigin: frontOrigin || self.location.origin });
+  agent = a;
+  return a;
+}
+function ensureBooting(frontOrigin) {
+  if (agent) return Promise.resolve(agent);
+  if (!booting) booting = bootFromSession(frontOrigin).catch((err) => { booting = null; throw err; });
+  return booting;
+}
+
+self.addEventListener('message', (e) => {
+  // Drop the identity this worker is holding. A worker outlives a page, so
+  // signing in as somebody else left the FIRST account's agent live and serving
+  // — the new session sat in IndexedDB while every request was still answered
+  // by the old actor, with the old key. The page posts this before it boots the
+  // new one; the next request boots from whatever session is stored now.
+  if (e.data?.type === 'reset') {
+    const had = !!agent;
+    agent = null; booting = null;
+    e.source?.postMessage({ type: 'reset-done', had });
+    return;
+  }
+  if (e.data?.type !== 'boot') return;
+  ensureBooting(e.data.frontOrigin)
+    .then(() => e.source?.postMessage({ type: 'booted' }))
+    // `code` matters: a boot that failed only because this browser has never
+    // opened the signing key is not a failure the page should show as one — it
+    // is a question the page can answer (boot.mjs). Everything else is shown.
+    .catch((err) => e.source?.postMessage({ type: 'boot-error', error: err.message,
+      code: err.code || null, stack: String(err.stack || '') }));
+});
+
+self.addEventListener('fetch', (e) => {
+  const url = new URL(e.request.url);
+  if (url.origin !== self.location.origin || !(isFacade(url.pathname) || isAdmin(url.pathname))) return;   // static → network
+  e.respondWith(serve(e.request, url));
+});
+
+async function serve(request, url) {
+  // Before anything is booted or read: is this caller allowed to be here at all?
+  const refuse = notAllowed(request, url);
+  if (refuse) {
+    console.warn(`[sw-agent] refused ${request.method} ${url.pathname}: ${refuse}`);
+    return json(403, { error: `refused: ${refuse}` });
+  }
+  // Boot on demand from the stored session, so the client works even when the
+  // worker was restarted (idle-killed) and nobody posted 'boot' this time.
+  if (!agent) { try { await ensureBooting(); } catch { /* no session → 503 below */ } }
+  if (!agent) return json(503, { error: 'the agent is not booted yet — open the app from the sign-in page' });
+  // Bytes, not text. A multipart upload is binary — read as text it comes back
+  // through a UTF-8 round trip that replaces every byte that is not valid UTF-8,
+  // which is most of a JPEG, so the boundary search found nothing and every
+  // media and avatar upload answered "422 file required". readBody() does
+  // `data += chunk`, which decodes a Buffer the same way it always did, so the
+  // JSON and form paths are unchanged.
+  const bodyBytes = (request.method === 'GET' || request.method === 'HEAD')
+    ? null : Buffer.from(new Uint8Array(await request.arrayBuffer()));
+  // The admin facade is JSON-only (the gate above enforces the content type),
+  // and takes its body already decoded.
+  const bodyText = bodyBytes ? new TextDecoder().decode(bodyBytes) : '';
+  const reqHeaders = {}; for (const [k, v] of request.headers) reqHeaders[k.toLowerCase()] = v;
+  // `host` is a forbidden header name, so a fetch Request never carries one and
+  // the loop above cannot produce it — but it is a header every real request
+  // arrives with, and the agent reads it to say where it lives. Without it the
+  // notifications `Link` header named `https://undefined/`, so a client that
+  // paged by following it (which is how a client is meant to page) walked off
+  // the origin and saw nothing past the first screen.
+  reqHeaders.host = url.host;
+  const listeners = {};
+  const req = { method: request.method, url: url.pathname + url.search, headers: reqHeaders,
+    // notAllowed() above let this through, so it came from this origin. Said
+    // out loud rather than left implicit: MastoApi asks (through the
+    // authorities object in agent.mjs) whether a request is the owner's own,
+    // and in a browser that question means exactly this.
+    sameOrigin: true,
+    socket: { encrypted: url.protocol === 'https:' }, on(ev, cb) { (listeners[ev] ||= []).push(cb); return req; }, destroy() {} };
+  queueMicrotask(() => { if (bodyBytes?.length) (listeners.data || []).forEach((cb) => cb(bodyBytes)); (listeners.end || []).forEach((cb) => cb()); });
+  let status = 200; const outHeaders = {}; const chunks = [];
+  const res = {
+    writeHead(s, h) { status = s; if (h) Object.assign(outHeaders, h); return res; },
+    setHeader(k, v) { outHeaders[k] = v; }, getHeader(k) { return outHeaders[k]; },
+    write(c) { chunks.push(c); }, end(c) { if (c) chunks.push(c); },
+  };
+  try {
+    const handled = isAdmin(url.pathname)
+      ? await agent.admin.handle(req, res, url.pathname, url, bodyText)
+      : await agent.masto.handle(req, res, url.pathname, url);
+    if (!handled) return fetch(request);
+    return new Response(chunks.join(''), { status, headers: { 'content-type': 'application/json', ...outHeaders } });
+  } catch (err) {
+    return json(500, { error: err.message });
+  }
+}
+const json = (status, obj) => new Response(JSON.stringify(obj), { status, headers: { 'content-type': 'application/json' } });

package/web/front/#new-account.html#

@@ -0,0 +1,43 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>FediPod — access the Fediverse and ATProto from a Solid pod</title>
+<style>
+  :root { color-scheme: light dark; --line:#d9d4c7; --dim:#45443d; --accent:#6a8a5a; }
+  @media (prefers-color-scheme: dark) { :root { --dim:#c2c0b4; } }
+  body { font: 19px/1.6 system-ui, sans-serif; max-width: 44rem; margin: 2rem auto; padding: 0 1.1rem; }
+  h1 { font-size: 1.7rem; margin: 0 0 .2rem; }
+  h2 { font-size: 1.2rem; margin: 1.4rem 0 .4rem; }
+  p.lede { color: var(--dim); margin-top: 0; }
+  .hint { color: var(--dim); font-size: .95rem; }
+  code { background: rgba(120,120,120,.12); padding: .05em .35em; border-radius: 4px; }
+  pre { background: rgba(120,120,120,.12); padding: .7rem .9rem; border-radius: 8px; overflow-x: auto; }
+  ol.steps li { margin: .5rem 0; }
+  [hidden] { display: none !important; }
+</style>
+</head>
+<body>
+<h1>FediPod - join the Fediverse from a Solid pod.</h1>
+<p class="lede">Welcome to <b>FediPod</b>! Here, you can get a free pod and Fediverse account or link to your existing pod/account.</p>
+
+<p class="hint" id="current-version" hidden>Current FediPod: <strong id="current-version-num"></strong><br>
+ — install or update an existing install with <code id="current-version-cmd"></code></p>
+
+<p>
+FediPod is experimental and free to use.  See the <a href="https://github.com/jeff-zucker/FediPod">FediPod repository</a> for details.
+</p>
+
+<script>
+  fetch('/api/handle?handle=__probe__').then(r => r.json()).then(d => {
+    if (d.version) {
+      document.getElementById('current-version-num').textContent = d.version;
+      document.getElementById('current-version-cmd').textContent = `curl -fsSL ${location.origin}/install | sh`;
+      document.getElementById('current-version').hidden = false;
+    }
+  }).catch(() => {});
+</script>
+<i style="text-align:right">(cc) 4.0 By, Jeff Zucker, 2026</i>
+</body>
+</html>

package/web/front/admin.html

@@ -47,87 +47,7 @@ accounts that only use it as their gateway. Sign in as the server's admin to see
   <tbody id="roster-rows"></tbody>
 </table>
 
-<script type="module">
-  const $ = (id) => document.getElementById(id);
-  const note = (text) => { const n = $('roster-note'); n.hidden = !text; n.textContent = text || ''; };
-
-  // The Solid-OIDC client for the sign-in round trip. Constructed once; the
-  // redirect state lives in this tab's sessionStorage, so the same session
-  // finishes the login on the way back.
-  let session = null;
-  try {
-    const { SessionCore } = await import('/solid-oidc-client.js');
-    session = new SessionCore({ redirect_uris: [location.origin + '/admin'], client_name: 'FediPod admin' });
-  } catch { /* leave null — the "did not load" note fires */ }
-
-  $('roster-issuer').addEventListener('input', () => {
-    $('roster-signin').disabled = !/^https?:\/\/\S+/.test($('roster-issuer').value.trim());
-  });
-
-  $('roster-form').addEventListener('submit', (ev) => {
-    ev.preventDefault();
-    if (!session) { note('the sign-in library did not load — reload and try again'); return; }
-    session.login($('roster-issuer').value.trim(), location.origin + '/admin')
-      .catch((e) => note('sign-in failed to start: ' + e.message));
-  });
-
-  // Back from the identity provider: read the roster with the proven login.
-  (async () => {
-    if (!session) return;
-    await session.handleRedirectFromLogin().catch(() => {});
-    if (!session.isActive) return;
-    const webId = session.webId;
-
-    // Signed fetches build a DPoP proof from the URL, so it must be absolute.
-    const load = async () => {
-      let res;
-      try { res = await session.authFetch(location.origin + '/api/roster'); }
-      catch (e) { note('the roster request failed: ' + e.message); return; }
-      const d = await res.json().catch(() => ({}));
-      if (res.status === 403) { note('signed in as ' + webId + ', which is not this server’s admin'); return; }
-      if (res.status === 501) { note('this server names no admin — set FEDIPOD_ADMIN_WEBID and redeploy'); return; }
-      if (res.status !== 200) { note('roster unavailable: ' + (d.error || 'HTTP ' + res.status)); return; }
-      const rows = $('roster-rows');
-      rows.textContent = '';
-      for (const a of d.accounts || []) {
-        const tr = document.createElement('tr');
-        const cell = (child) => { const td = document.createElement('td'); td.append(child); tr.append(td); };
-        cell(a.address);
-        cell(a.kind);
-        cell(a.fronted ? 'lives here' : 'gateway only');
-        const pod = document.createElement('a');
-        pod.href = a.podHome; pod.textContent = new URL(a.podHome).host;
-        cell(pod);
-        const rm = document.createElement('button');
-        rm.type = 'button'; rm.textContent = 'Remove';
-        rm.onclick = () => revoke(a);
-        cell(rm);
-        rows.append(tr);
-      }
-      $('roster-table').hidden = false;
-      note((d.accounts || []).length + ' account(s) on ' + d.host);
-    };
-
-    const revoke = async (a) => {
-      if (!confirm('Remove ' + a.address + ' from this server? The name stops resolving here; nothing on their pod is touched.')) return;
-      let res;
-      try {
-        res = await session.authFetch(location.origin + '/api/revoke', {
-          method: 'POST', headers: { 'content-type': 'application/json' },
-          body: JSON.stringify({ handle: a.handle }),
-        });
-      } catch (e) { note('the remove request failed: ' + e.message); return; }
-      const d = await res.json().catch(() => ({}));
-      if (res.status !== 200) { note('remove refused: ' + (d.error || 'HTTP ' + res.status)); return; }
-      if (!d.removed) { note(a.address + ' stays: ' + d.reason); return; }
-      await load();
-      note('removed ' + a.address);
-    };
-
-    note('signed in as ' + webId + ' — reading the roster…');
-    await load();
-  })();
-</script>
+<script type="module" src="/admin.js"></script>
 <i>(cc) 4.0 By, Jeff Zucker, 2026</i>
 </body>
 </html>

package/web/front/admin.js

@@ -0,0 +1,85 @@
+// admin.js — the roster page's script, in a file of its own.
+//
+// It lived inline in admin.html until 2026-09-09. Out here the page can be
+// served under `script-src 'self'`, which is what stops a stray bit of markup
+// from becoming running code; inline script cannot be told apart from injected
+// script by any policy. Served by the front at /admin.js.
+const $ = (id) => document.getElementById(id);
+const note = (text) => { const n = $('roster-note'); n.hidden = !text; n.textContent = text || ''; };
+
+// The Solid-OIDC client for the sign-in round trip. Constructed once; the
+// redirect state lives in this tab's sessionStorage, so the same session
+// finishes the login on the way back.
+let session = null;
+try {
+  const { SessionCore } = await import('/solid-oidc-client.js');
+  session = new SessionCore({ redirect_uris: [location.origin + '/roster'], client_name: 'FediPod admin' });
+} catch { /* leave null — the "did not load" note fires */ }
+
+$('roster-issuer').addEventListener('input', () => {
+  $('roster-signin').disabled = !/^https?:\/\/\S+/.test($('roster-issuer').value.trim());
+});
+
+$('roster-form').addEventListener('submit', (ev) => {
+  ev.preventDefault();
+  if (!session) { note('the sign-in library did not load — reload and try again'); return; }
+  session.login($('roster-issuer').value.trim(), location.origin + '/roster')
+    .catch((e) => note('sign-in failed to start: ' + e.message));
+});
+
+// Back from the identity provider: read the roster with the proven login.
+(async () => {
+  if (!session) return;
+  await session.handleRedirectFromLogin().catch(() => {});
+  if (!session.isActive) return;
+  const webId = session.webId;
+
+  // Signed fetches build a DPoP proof from the URL, so it must be absolute.
+  const load = async () => {
+    let res;
+    try { res = await session.authFetch(location.origin + '/api/roster'); }
+    catch (e) { note('the roster request failed: ' + e.message); return; }
+    const d = await res.json().catch(() => ({}));
+    if (res.status === 403) { note('signed in as ' + webId + ', which is not this server’s admin'); return; }
+    if (res.status === 501) { note('this server names no admin — set FEDIPOD_ADMIN_WEBID and redeploy'); return; }
+    if (res.status !== 200) { note('roster unavailable: ' + (d.error || 'HTTP ' + res.status)); return; }
+    const rows = $('roster-rows');
+    rows.textContent = '';
+    for (const a of d.accounts || []) {
+      const tr = document.createElement('tr');
+      const cell = (child) => { const td = document.createElement('td'); td.append(child); tr.append(td); };
+      cell(a.address);
+      cell(a.kind);
+      cell(a.fronted ? 'lives here' : 'gateway only');
+      const pod = document.createElement('a');
+      pod.href = a.podHome; pod.textContent = new URL(a.podHome).host;
+      cell(pod);
+      const rm = document.createElement('button');
+      rm.type = 'button'; rm.textContent = 'Remove';
+      rm.onclick = () => revoke(a);
+      cell(rm);
+      rows.append(tr);
+    }
+    $('roster-table').hidden = false;
+    note((d.accounts || []).length + ' account(s) on ' + d.host);
+  };
+
+  const revoke = async (a) => {
+    if (!confirm('Remove ' + a.address + ' from this server? The name stops resolving here; nothing on their pod is touched.')) return;
+    let res;
+    try {
+      res = await session.authFetch(location.origin + '/api/revoke', {
+        method: 'POST', headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ handle: a.handle }),
+      });
+    } catch (e) { note('the remove request failed: ' + e.message); return; }
+    const d = await res.json().catch(() => ({}));
+    if (res.status !== 200) { note('remove refused: ' + (d.error || 'HTTP ' + res.status)); return; }
+    if (!d.removed) { note(a.address + ' stays: ' + d.reason); return; }
+    await load();
+    note('removed ' + a.address);
+  };
+
+  note('signed in as ' + webId + ' — reading the roster…');
+  await load();
+})();

package/web/front/new-account.html

@@ -29,15 +29,7 @@
 FediPod is experimental and free to use.  See the <a href="https://github.com/jeff-zucker/FediPod">FediPod repository</a> for details.
 </p>
 
-<script>
-  fetch('/api/handle?handle=__probe__').then(r => r.json()).then(d => {
-    if (d.version) {
-      document.getElementById('current-version-num').textContent = d.version;
-      document.getElementById('current-version-cmd').textContent = `curl -fsSL ${location.origin}/install | sh`;
-      document.getElementById('current-version').hidden = false;
-    }
-  }).catch(() => {});
-</script>
+<script src="/new-account.js"></script>
 <i style="text-align:right">(cc) 4.0 By, Jeff Zucker, 2026</i>
 </body>
 </html>

package/web/front/new-account.js

@@ -0,0 +1,13 @@
+// new-account.js — the sign-up page's script, in a file of its own.
+//
+// It lived inline in new-account.html until 2026-09-09. Out here the page can
+// be served under `script-src 'self'`, which is what stops a stray bit of
+// markup from becoming running code; inline script cannot be told apart from
+// injected script by any policy. Served by the front at /new-account.js.
+fetch('/api/handle?handle=__probe__').then(r => r.json()).then(d => {
+  if (d.version) {
+    document.getElementById('current-version-num').textContent = d.version;
+    document.getElementById('current-version-cmd').textContent = `curl -fsSL ${location.origin}/install | sh`;
+    document.getElementById('current-version').hidden = false;
+  }
+}).catch(() => {});

package/web/front/run.html

@@ -45,98 +45,7 @@ you to keep running. Sign in with your pod to prove it is yours.</p>
   <p class="hint" id="run-note" hidden></p>
 </form>
 
-<script type="module">
-  const $ = (id) => document.getElementById(id);
-
-  // The Solid-OIDC client for the sign-in round trip. Constructed once; the
-  // redirect state (PKCE, csrf) lives in this tab's sessionStorage, so the same
-  // session finishes the login on the way back.
-  let session = null;
-  try {
-    const { SessionCore } = await import('/solid-oidc-client.js');
-    session = new SessionCore({ redirect_uris: [location.origin + '/run'], client_name: 'FediPod gateway' });
-  } catch { /* leave null — the "did not load" notes below fire */ }
-
-  // Offered only where this server actually runs identities. An
-  // unauthenticated probe tells the two apart: 501 = not offered here,
-  // anything else = offered (a real opt-in still needs the signed-in proof).
-  let offered = true;
-  (async () => {
-    const res = await fetch('/api/agent', { method: 'POST',
-      headers: { 'content-type': 'application/json' }, body: '{}' }).catch(() => null);
-    if (!res || res.status === 501) {
-      offered = false;
-      const n = $('run-note');
-      n.hidden = false;
-      n.textContent = 'This server does not run identities. Your agent stays where it is.';
-      runFormCheck();
-    }
-  })();
-
-  function runFormCheck() {
-    let ok = false;
-    try { ok = /^https?:$/.test(new URL($('run-pod-url').value.trim()).protocol); } catch { /* not yet */ }
-    const issuerOk = /^https?:\/\/\S+/.test($('run-issuer').value.trim());
-    $('run-continue').disabled = !(offered && ok && issuerOk);
-    $('run-leave').disabled = !(offered && ok && issuerOk);
-  }
-  $('run-pod-url').addEventListener('input', () => {
-    runFormCheck();
-    // The identity provider is usually the server itself — still editable.
-    try {
-      const u = new URL($('run-pod-url').value.trim());
-      const apex = u.hostname.split('.').slice(1).join('.');
-      if (!$('run-issuer').value && apex) $('run-issuer').value = `${u.protocol}//${apex}${u.port ? ':' + u.port : ''}`;
-    } catch { /* not a URL yet */ }
-    runFormCheck();
-  });
-  $('run-issuer').addEventListener('input', runFormCheck);
-
-  const runStart = (action) => {
-    const n = $('run-note');
-    if (!session) { n.hidden = false; n.textContent = 'the sign-in library did not load — reload and try again'; return; }
-    const u = new URL($('run-pod-url').value.trim());
-    if (u.pathname === '') u.pathname = '/';
-    if (!u.pathname.endsWith('/')) u.pathname += '/';
-    u.search = ''; u.hash = '';
-    sessionStorage.setItem('fp-run', JSON.stringify({ podBase: u.href, action }));
-    session.login($('run-issuer').value.trim(), location.origin + '/run')
-      .catch((e) => { n.hidden = false; n.textContent = 'sign-in failed to start: ' + e.message; });
-  };
-  $('run-continue').onclick = () => runStart('opt-in');
-  $('run-leave').onclick = () => runStart('opt-out');
-
-  // Back from the identity provider: finish the opt-in with the proven login.
-  (async () => {
-    if (!session) return;
-    await session.handleRedirectFromLogin().catch(() => {});
-    const pending = sessionStorage.getItem('fp-run');
-    if (!session.isActive || !pending) return;
-    sessionStorage.removeItem('fp-run');
-    const p = JSON.parse(pending);
-    const n = $('run-note');
-    n.hidden = false;
-    n.textContent = 'signed in as ' + session.webId + ' — asking the server…';
-    // The signed fetch builds a DPoP proof from the URL, so it must be absolute.
-    const res = await session.authFetch(location.origin + '/api/agent', {
-      method: 'POST', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ action: p.action, podBase: p.podBase }),
-    }).catch(() => null);
-    const d = res ? await res.json().catch(() => ({})) : {};
-    if (res && res.status === 201 && d.doorSecret) {
-      n.innerHTML = 'Your identity runs here now. This is your door secret — <b>save it now</b>, '
-        + 'it is shown only this once. It opens your admin pages at <code>' + p.podBase.replace(/\/$/, '') + d.doorPath + '</code>:'
-        + '<pre>' + d.doorSecret + '</pre>'
-        + 'To check it works:<pre>' + d.command + '</pre>'
-        + 'Lost it? Opt in again — that mints a fresh one and retires this one.';
-    } else if (res && res.status === 200) {
-      n.textContent = 'Done — this server no longer runs that identity. Your pod and its data are untouched.';
-    } else {
-      n.textContent = (p.action === 'opt-in' ? 'opt-in' : 'opt-out') + ' failed: '
-        + (d.error || (res ? 'HTTP ' + res.status : 'no response'));
-    }
-  })();
-</script>
+<script type="module" src="/run.js"></script>
 <i>(cc) 4.0 By, Jeff Zucker, 2026</i>
 </body>
 </html>