fedipod 0.9.0 → 0.10.0

package/bin/fedipod.mjs

@@ -1492,12 +1492,44 @@ if (cmd === 'up') {
   console.log('UI password set — /oauth/authorize now shows a login form (restart a running agent to pick it up)');
 } else if (cmd === 'gateway' || cmd === 'front') {
   // Attach this identity to a gateway ('front' kept as an alias). Shapes:
-  //   fedipod gateway <.../ap/inbox/> --secret S --inbox-only   the usual one:
+  //   fedipod gateway --attach <origin> [--name N] [--fronted]  ask the gateway
+  //     itself: the agent proves the pod with its own credential and stores
+  //     the door + secret the gateway answers with.
+  //   fedipod gateway <.../ap/inbox/> --secret S --inbox-only   paste-in form:
   //     identity stays on the pod; only the advertised inbox moves to the
   //     gateway's door. Leaving is one republish with the pod inbox.
   //   fedipod gateway <.../ap/actor> --secret S                 fronted identity
   //   fedipod gateway --detach                                  back to the pod inbox
   requireIdentity();
+  if (has('attach')) {
+    const front = flag('attach');
+    if (!/^https?:\/\/\S+$/.test(String(front || ''))) {
+      console.error('usage: fedipod gateway --attach <https://gateway-origin> [--name yourname] [--fronted]');
+      process.exit(2);
+    }
+    try {
+      const res = await localFetch(HOME, PORT, `/gateway`, {
+        method: 'POST', headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ action: 'attach', front,
+          ...(flag('name') ? { handle: flag('name') } : {}),
+          ...(has('fronted') ? { fronted: true } : {}) }),
+      });
+      const body = await res.json();
+      if (res.status >= 400) { console.error(body.error || `HTTP ${res.status}`); process.exit(1); }
+      if (body.frontActor) {
+        console.log(`attached — this identity now publishes as ${body.address || body.frontActor}`);
+        console.log('Restart the agent (or `fedipod up`) to republish under the front.');
+      } else {
+        console.log(`attached — your mail now arrives through ${body.url}, filtered; your name has not moved.`);
+        console.log('Starting in shadow: the door filters, and the agent measures how much');
+        console.log('verifies before it believes any receipt. Move to trust when you are ready.');
+      }
+    } catch (e) {
+      console.error(`agent not reachable on :${PORT} (${e.message}) — start it, then attach`);
+      process.exit(1);
+    }
+    process.exit(0);
+  }
   if (has('detach')) {
     try {
       const res = await localFetch(HOME, PORT, `/gateway`, {

package/cli.md

@@ -38,9 +38,10 @@ several identities, say which you mean. `profiles` does not list identities
 under a custom `AP_HOME`.
 
 Commands that manage a live identity — `alias`, `admit`, `import`, `archive`,
-`bsky`, `describe`, `status`, `rebuild`, `gateway --detach` and the group
-commands — talk to the running agent and say so when it is not there. `keys`,
-`state`, `home` and attaching a gateway want the agent stopped.
+`bsky`, `describe`, `status`, `rebuild`, `gateway --attach`,
+`gateway --detach` and the group commands — talk to the running agent and say
+so when it is not there. `keys`, `state`, `home` and the paste-in gateway form
+(`gateway <url> --secret …`) want the agent stopped.
 
 ## Recovery
 
@@ -189,9 +190,16 @@ are not imported.
 ## The gateway
 
 ```
+fedipod gateway --attach <gateway-origin> [--name N] [--fronted]
 fedipod gateway <door-inbox-url> --secret <hmac> --inbox-only
 fedipod gateway --detach
 ```
+
+`--attach` asks the gateway itself: the agent proves the pod with its own
+credential, and the gateway answers with the door and the receipt secret.
+`--name` defaults to your handle; `--fronted` takes a gateway-based name,
+published at the next restart. The admin page's Gateway panel is the same
+action with the name checked as you type.
 Attaching points your actor's advertised inbox at a gateway's door, so
 deliveries are verified and de-junked before they reach your pod; your name,
 key and data stay on your pod. The URL and secret come from the gateway's

package/gui.md

@@ -3,6 +3,8 @@
 Open `https://localhost:8030/` while any agent is running — it forwards you to the agent — then choose `manage account` and select the actor you want from the local actors dropdown.
 Picking an actor marked "(stopped)" starts its agent, then opens its page.
 
+The software row names the version the agent is running. When the copy on the machine is further ahead — after an update, or after pulling a checkout — it says so and asks for a restart, because an agent goes on serving the code it started with until it is restarted.
+
 `Update`, shown on the software row when a newer FediPod exists, pulls the latest version and restarts every agent on the machine — agents installed as services; any started by hand need their own restart. The same row flags an older data layout after an update; the `fedipod upgrade` terminal command lists those moves and the commands that make them.
 
 * **Parking** (the status control) stops the mail and unfollows people you follow, but keeps your handle
@@ -70,12 +72,24 @@ follows the group's own moderation settings; see [Groups](groups.md).
 **new followers** control switches between waiting for your approval and
 accepting automatically.
 
+## The gateway
+
+The **Gateway** panel attaches this account to a mail-filtering gateway (a
+fedipod.net-style front), shows what its door has verified, and detaches it.
+Give the gateway's address and the name you want there — the panel checks the
+name is free as you type — and choose a pod-based name (`@you@your.pod`) or a
+gateway-based name (`@you@the-gateway`); the gateway account is created
+automatically either way. Attaching proves the pod with the agent's own
+credential, so no password is typed anywhere. Detaching republishes your
+actor with your pod's own inbox.
+
 ## Moving here from another server
 
 Open **Transfer an account here** on the action rail and add your old account
 as an alias, set
 **new followers** to *accepted automatically*, then trigger the move on the
-old server; your followers arrive by themselves. Removing an alias asks
+old server (on Mastodon: Preferences → Account → *Move to a different
+account*); your followers arrive by themselves. Removing an alias asks
 twice — servers still processing the move check it while they retry. The CSV
 files from the old server's export are imported with the CLI; see
 [CLI admin](cli.md).

package/lib/admin.mjs

@@ -32,6 +32,7 @@ import { portFree, freePortFrom } from './ports.mjs';
 import { claimDirectory, yieldDirectory } from './directory.mjs';
 import { localFetch } from './localapi.mjs';
 import { ensureTrustedTls } from './certs.mjs';
+import { localVersion } from './update.mjs';
 
 const require = createRequire(import.meta.url);
 const projectRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -325,7 +326,8 @@ function sendFile(res, baseDir, rel, auth) {
 // guards the operator's door (basePath) instead of the whole surface.
 export function buildAdminSurface({ agent, gate, allowed, log = console.log,
   port = null, handle = null, embedded = false, basePath = '/',
-  publicOrigin = null, scheme = null }) {
+  publicOrigin = null, scheme = null,
+  versionOnDisk = () => localVersion(projectRoot) }) {
   const json = (res, status, obj) => sendJson(res, status, obj, allowed);
   const masto = new MastoApi({ agent, log, allowed, scheme, embedded });
   // The spec's own write API (§6), beside the facade. Its bearer fallback is
@@ -592,6 +594,10 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
           privateRoot: agent.readCredential?.()?.privateRoot || null,
           mode: agent.status?.().mode || null, port, home: tildify(agent.home) || null,
           update: agent.updateInfo || null,
+          // What this process is running, against what a restart would run:
+          // the checkout can move while an agent stays up.
+          version: AGENT_VERSION,
+          versionOnDisk: versionOnDisk(),
           pendingUpgrade: agent.pendingUpgrade || [],
           // The connected Bluesky account, non-secret half. `connected` is the
           // credential's word, so a config entry orphaned by a deleted
@@ -1423,6 +1429,16 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
           const cfg = { ...agent.store.getConfig() };
           const g = { ...(cfg.gateway || {}) };
           const inboxUrl = agent.publisher?.urls?.inbox;
+          // Availability is a read: answered before the lease takeover below,
+          // which every real gateway change does want.
+          if (body.action === 'check') {
+            const front = String(body.front || '').replace(/\/+$/, '');
+            try { new URL(front); } catch { return json(res, 400, { error: 'front must be a gateway origin URL' }); }
+            const chk = await fetch(`${front}/api/handle?handle=${encodeURIComponent(String(body.handle || '').toLowerCase())}`,
+              { headers: { accept: 'application/json' } }).then((r) => r.json()).catch(() => null);
+            if (!chk) return json(res, 502, { error: `${front} did not answer its handle check` });
+            return json(res, 200, { available: !!chk.available, reason: chk.reason || null });
+          }
           await agent.requestTakeover?.();
           const persist = async () => {
             cfg.gateway = g; agent.store.setConfig(cfg);
@@ -1478,6 +1494,56 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
             else if (target !== 'off') await agent.publisher?.publishGatewayPolicy().catch(() => {});
             return json(res, 200, { ok: true, mode: g.mode });
           }
+          // Attach through a multi-user front (fedipod.net and kin): the agent
+          // proves the pod with its own credential — no browser, no password —
+          // and the front answers with the door and the receipt secret.
+          if (body.action === 'attach') {
+            const front = String(body.front || '').replace(/\/+$/, '');
+            let fu;
+            try { fu = new URL(front); } catch { return json(res, 400, { error: 'front must be the gateway origin, like https://fedipod.net' }); }
+            if (fu.protocol !== 'https:' && !/^(localhost|127\.0\.0\.1)$|\.localhost$/.test(fu.hostname)) {
+              return json(res, 400, { error: 'front must be https' });
+            }
+            if (agent.embedded) {
+              return json(res, 400, { error: 'this identity runs inside its pod server and has no portable credential — attach from a standalone agent' });
+            }
+            const handle = String(body.handle || cfg.handle || '').toLowerCase().trim();
+            if (!handle) return json(res, 400, { error: 'a name at the gateway is required' });
+            const fronted = body.fronted === true;
+            const frontActor = `${front}/u/${handle}/ap/actor`;
+            if (g.frontActor && (!fronted || g.frontActor !== frontActor)) {
+              return json(res, 400, { error: `this identity already fronts through ${g.frontActor} — changing a published front renames every id; detach first if you mean it` });
+            }
+            // Availability first, for a clean answer before anything is created.
+            const chk = await fetch(`${front}/api/handle?handle=${encodeURIComponent(handle)}`,
+              { headers: { accept: 'application/json' } }).then((r) => r.json()).catch(() => null);
+            if (!chk) return json(res, 502, { error: `${front} did not answer its handle check` });
+            if (!chk.available) return json(res, 409, { error: chk.reason || `the name ${handle} is taken at ${front}` });
+            const attach = await agent.remote.session.fetch(`${front}/api/attach`, {
+              method: 'POST', headers: { 'content-type': 'application/json' },
+              body: JSON.stringify({ handle, podHome: agent.urls.home, kind: cfg.kind || 'person', fronted }),
+            }).catch(() => null);
+            if (!attach) return json(res, 502, { error: `${front} did not answer the attach` });
+            const d = await attach.json().catch(() => ({}));
+            if (attach.status !== 201) {
+              return json(res, attach.status >= 400 && attach.status < 500 ? attach.status : 502,
+                { error: d.error || `attach failed (HTTP ${attach.status})` });
+            }
+            g.url = String(d.doorInbox || `${front}/u/${handle}/ap/inbox/`);
+            if (d.hmacSecret) g.hmacSecret = String(d.hmacSecret);
+            if (fronted) g.frontActor = String(d.frontActor || frontActor);
+            if (!g.mode || g.mode === 'off') g.mode = 'shadow';
+            await persist();
+            // Inbox-only applies live: the actor republishes advertising the
+            // door. A front carries new ids, which are wired at startup — that
+            // attach persists and owes a restart.
+            if (!fronted) {
+              await agent.publisher?.publishProfile();
+              await agent.publisher?.publishGatewayPolicy?.().catch(() => {});
+            }
+            return json(res, 200, { ok: true, mode: g.mode, url: g.url,
+              ...(fronted ? { frontActor: g.frontActor, address: d.address || null, restart: true } : {}) });
+          }
           if (body.action === 'forget') {
             const wasLocked = g.mode === 'locked';
             delete cfg.gateway; agent.store.setConfig(cfg);
@@ -1487,7 +1553,7 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
             await agent.publisher?.publishProfile();   // re-advertise the pod inbox
             return json(res, 200, { ok: true, mode: 'off', forgotten: true });
           }
-          return json(res, 400, { error: 'action must be configure, mode or forget' });
+          return json(res, 400, { error: 'action must be configure, mode, check, attach or forget' });
         }
         // Symmetrical with /block, and open for the same reason: a block made
         // by mistake is worth undoing before federation is even configured.
@@ -1534,14 +1600,17 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
   return { handler, masto, c2s, streaming };
 }
 
-export function startAdmin({ port, gateToken, agent, log = console.log, handle = null, tls = null }) {
+export function startAdmin({ port, gateToken, agent, log = console.log, handle = null, tls = null,
+  // Injectable, so a test can put a checkout ahead of the running process
+  // without editing the package.json of the machine running the test.
+  versionOnDisk = () => localVersion(projectRoot) }) {
   const gate = makeGate(gateToken);
   // Live, so the named origin appears the moment connect() reads the handle
   // out of pod state — including for the OAuth redirect check in MastoApi.
   // The https listener's port joins the authority set: same names, second port.
   const allowed = new Authorities(port, handle);
   agent.authorities = allowed;
-  const { handler, streaming } = buildAdminSurface({ agent, gate, allowed, log, port, handle });
+  const { handler, streaming } = buildAdminSurface({ agent, gate, allowed, log, port, handle, versionOnDisk });
 
   // Loopback both ways: the canonical URL is https://localhost:<port>/, and
   // "localhost" resolves to ::1 on many systems before falling back to IPv4 —

package/lib/lease.mjs

@@ -29,6 +29,7 @@ export class Lease {
     this.stopped = false;
     this.timer = null;
     this.heldUntil = 0;   // wall-clock end of the lease we last wrote
+    this.denied = null;   // why the last acquire() said no: 'unreadable' | 'held'
   }
 
   // null means the lease document is NOT THERE — nobody holds it. UNREADABLE
@@ -74,16 +75,21 @@ export class Lease {
     const cur = await this.readFresh();
     // Cannot read it: stay a viewer. A viewer that should have been active is
     // an inconvenience; two agents both draining is the destructive one.
-    if (cur === UNREADABLE) { this.log('lease unreadable — staying a viewer'); return false; }
-    if (cur && cur.holder !== this.id && Date.now() < cur.expiresAt) return false;
+    if (cur === UNREADABLE) {
+      this.denied = 'unreadable';
+      this.log('lease unreadable — staying a viewer'); return false;
+    }
+    if (cur && cur.holder !== this.id && Date.now() < cur.expiresAt) { this.denied = 'held'; return false; }
     const doc = { holder: this.id, expiresAt: Date.now() + TTL_MS };
-    if (!await this.write(doc)) return false;
+    if (!await this.write(doc)) { this.denied = 'held'; return false; }
     const confirm = await this.readFresh();
-    if (confirm === UNREADABLE || confirm?.holder !== this.id) return false;
+    if (confirm === UNREADABLE) { this.denied = 'unreadable'; return false; }
+    if (confirm?.holder !== this.id) { this.denied = 'held'; return false; }
     // From the document we WROTE, and only once the confirm agrees. Recomputing
     // it here would claim a lease that outlives what the pod's copy grants, by
     // however long the PUT and the confirming GET took.
     this.heldUntil = doc.expiresAt;
+    this.denied = null;
     return true;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",

package/run-agent.mjs

@@ -358,7 +358,9 @@ export class Agent {
     this.intake.bskyGroup = null;
     if (this.viewer) {
       this.startViewer();
-      this.log(`another agent is active for this pod — viewing as @${config.handle} (read-only)`);
+      this.log(this.lease.denied === 'unreadable'
+        ? `the pod cannot be read, so the lease is unknown — viewing as @${config.handle} (read-only)`
+        : `another agent is active for this pod — viewing as @${config.handle} (read-only)`);
       return true;
     }
     await this.startActive({ repair });

package/web/admin/admin.js

@@ -141,7 +141,7 @@ function render() {
     ['local host', (origins.named || origins.loopback || `http://localhost:${config.port}`)
       .replace(/\/$/, '')],
   ];
-  if (config.update || config.pendingUpgrade?.length) rows.push(['software', 'ctl']);
+  if (config.version || config.update || config.pendingUpgrade?.length) rows.push(['software', 'ctl']);
   if (config.quiescedAt) rows.push(['parked since', config.quiescedAt]);
   if (config.movedTo) rows.push(['moved to', config.movedTo]);
   // A person gates followers here; a group's gate is the joins control on its
@@ -190,8 +190,13 @@ function render() {
       dd.append(UPDATE_CTL);
       UPDATE_CTL.hidden = false;
       const u = config.update;
+      // The version this agent is running, never the one sitting in the
+      // checkout — saying otherwise would name a version nobody is serving.
+      const running = config.version || u?.current || null;
       const words = [];
-      if (u) words.push(u.available ? `FediPod ${u.current} — ${u.latest} available` : `FediPod ${u.current}`);
+      if (running) words.push(u?.available ? `FediPod ${running} — ${u.latest} available` : `FediPod ${running}`);
+      if (config.versionOnDisk && running && config.versionOnDisk !== running)
+        words.push(`${config.versionOnDisk} is on disk — restart to run it`);
       if (config.pendingUpgrade?.length) words.push('older data layout — run `fedipod upgrade` in a terminal');
       UPDATE_WORD.textContent = words.join('; ');
       UPDATE_GO.hidden = !u?.available;
@@ -232,6 +237,7 @@ function render() {
   renderAliases();
   renderOthers();
   renderInbox();
+  renderGateway();
   if (config.kind === 'group') {
     // Its lists have no bound, so this page scrolls — see body.group in the CSS.
     document.body.classList.add('group');
@@ -931,9 +937,62 @@ async function renderInbox() {
   panel.hidden = false;
 }
 
-// The inbox-gateway / multi-user-front operator panel is parked: not shown in
-// the UI yet. The backend routes (GET/POST /gateway) still exist and work, so
-// this can be re-added when the feature is ready to expose.
+// The gateway panel: attach through a multi-user front with this agent's own
+// credential, see what the door has verified, detach back to the pod inbox.
+let gwTimer = null;
+async function renderGateway() {
+  const { status, json: g } = await api('/gateway');
+  if (status !== 200 || !g) return;              // no answer, no surface
+  $('pane-gateway').hidden = false;
+  if (g.configured) {
+    const host = (() => { try { return new URL(g.url).host; } catch { return g.url; } })();
+    const st = g.stats || {};
+    $('gateway-summary').textContent = `Attached to ${host} (mode ${g.mode})`
+      + (g.frontActor ? `, publishing as ${g.frontActor}` : '')
+      + ` — ${st.verified || 0} deliveries verified, ${st.unverified || 0} unverified.`;
+    $('gateway-attach-form').hidden = true;
+    $('gateway-attached').hidden = false;
+  } else {
+    $('gateway-summary').textContent = 'Mail arrives directly at your pod\'s own inbox.';
+    $('gateway-attach-form').hidden = false;
+    $('gateway-attached').hidden = true;
+    if (!$('gw-name').value && config?.handle) $('gw-name').value = config.handle;
+  }
+}
+// Live availability, asked through the agent (the front answers it without CORS).
+function gwCheck() {
+  clearTimeout(gwTimer);
+  const front = $('gw-front').value.trim().replace(/\/+$/, '');
+  const name = $('gw-name').value.trim().toLowerCase();
+  $('gw-name-msg').textContent = ''; $('gw-name-msg').className = 'hint';
+  if (!front || !name) return;
+  gwTimer = setTimeout(async () => {
+    const { status, json } = await postJson('/gateway', { action: 'check', front, handle: name });
+    if (status !== 200 || !json) return;
+    $('gw-name-msg').textContent = json.available
+      ? `${name} is free at ${front.replace(/^https?:\/\//, '')}`
+      : (json.reason || 'that name is taken');
+    $('gw-name-msg').className = json.available ? 'hint' : 'warn';
+  }, 300);
+}
+$('gw-front').addEventListener('input', gwCheck);
+$('gw-name').addEventListener('input', gwCheck);
+$('gw-attach').onclick = async () => {
+  const front = $('gw-front').value.trim().replace(/\/+$/, '');
+  const fronted = $('gw-shape').value === 'front';
+  $('gw-attach').disabled = true;
+  const r = await write('/gateway',
+    { action: 'attach', front, handle: $('gw-name').value.trim().toLowerCase(), fronted },
+    fronted ? 'attached — restart the agent to publish under the gateway name'
+      : 'attached — your mail now arrives through the gateway, filtered');
+  $('gw-attach').disabled = false;
+  if (r) renderGateway();
+};
+$('gw-detach').onclick = async () => {
+  const r = await write('/gateway', { action: 'forget' },
+    'detached — the actor was republished advertising your pod\'s own inbox');
+  if (r) renderGateway();
+};
 
 $('inbox-keep').addEventListener('click', () => {
   dismissed = true;

package/web/admin/index.html

@@ -314,9 +314,36 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
   </span>
 </section>
 
-<!-- The inbox-gateway / multi-user-front controls are deliberately not shown
-     in the UI yet. The backend routes (GET/POST /gateway) exist and work; the
-     operator surface is parked until the feature is ready to expose. -->
+<!-- The inbox gateway: a mail filter for an account that stays yours. -->
+<section id="pane-gateway" hidden>
+  <h2><span class="hlabel">Gateway</span></h2>
+  <p id="gateway-summary"></p>
+  <div id="gateway-attach-form" hidden>
+    <p class="hint">A gateway filters your fediverse mail before it reaches your pod: your
+      actor advertises the gateway's door as its inbox, each delivery is verified there,
+      spam is dropped, and the rest lands in your pod as before. Attaching proves the pod
+      with this agent's own credential — no password leaves this machine.</p>
+    <p>
+      <label for="gw-front">Gateway</label>
+      <input type="url" id="gw-front" placeholder="https://fedipod.net" autocomplete="off">
+      <label for="gw-name">Your name there</label>
+      <input type="text" id="gw-name" autocomplete="off" autocapitalize="off" spellcheck="false">
+    </p>
+    <p id="gw-name-msg" class="hint"></p>
+    <p>
+      <select id="gw-shape" aria-label="Name shape" title="   Which address the fediverse sees — the pod-based name keeps everything on your pod; a gateway-based name survives changing pods">
+        <option value="pod">keep my pod-based name</option>
+        <option value="front">use a gateway-based name</option>
+      </select>
+      <button id="gw-attach" class="primary" title="   Create the gateway account and point your mail through its door">Attach</button>
+    </p>
+  </div>
+  <div id="gateway-attached" hidden>
+    <p>
+      <button id="gw-detach" class="inline danger" title="   Republish the actor with your pod's own inbox and forget the gateway">Detach</button>
+    </p>
+  </div>
+</section>
 
 <section id="pane-group" hidden>
   <!-- Both queues are consequences of a moderation setting: with the setting off

package/web/front/new-account.html

@@ -3,422 +3,41 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>FediPod — keep your name, lose the noise</title>
+<title>FediPod — access the Fediverse and ATProto from a Solid pod</title>
 <style>
   :root { color-scheme: light dark; --line:#d9d4c7; --dim:#45443d; --accent:#6a8a5a; }
   @media (prefers-color-scheme: dark) { :root { --dim:#c2c0b4; } }
   body { font: 19px/1.6 system-ui, sans-serif; max-width: 44rem; margin: 2rem auto; padding: 0 1.1rem; }
   h1 { font-size: 1.7rem; margin: 0 0 .2rem; }
-  h2 { font-size: 1.2rem; margin: 0 0 .4rem; }
+  h2 { font-size: 1.2rem; margin: 1.4rem 0 .4rem; }
   p.lede { color: var(--dim); margin-top: 0; }
-  fieldset { border: 1px solid var(--line); border-radius: 12px; padding: 1rem 1.1rem; margin: 1rem 0; }
-  legend { font-weight: 600; padding: 0 .4rem; }
-  .choices { display: flex; flex-direction: column; gap: .5rem; }
-  .choices button { padding: .7rem .8rem; border: 1px solid var(--line); border-radius: 10px;
-    background: transparent; font: inherit; cursor: pointer; text-align: left; }
-  .choices button[aria-pressed="true"] { border-color: var(--accent); box-shadow: inset 0 0 0 1px var(--accent); }
-  .choices button b { display: block; }
-  .choices button span { color: var(--dim); font-size: .95rem; }
-  label { display: block; font-weight: 600; margin: .8rem 0 .2rem; }
-  input[type=text], input[type=url] { width: 100%; padding: .5rem .6rem; font: inherit;
-    border: 1px solid var(--line); border-radius: 8px; box-sizing: border-box; }
-  .msg { min-height: 1.3em; font-size: .95rem; margin-top: .3rem; }
-  .msg.ok { color: var(--accent); } .msg.no { color: #a4433a; }
   .hint { color: var(--dim); font-size: .95rem; }
-  .primary { background: var(--accent); color: #fff; border: none; border-radius: 9px;
-    padding: .6rem 1.1rem; font: inherit; cursor: pointer; }
-  .primary[disabled] { opacity: .5; cursor: not-allowed; }
-  [hidden] { display: none !important; }
   code { background: rgba(120,120,120,.12); padding: .05em .35em; border-radius: 4px; }
   pre { background: rgba(120,120,120,.12); padding: .7rem .9rem; border-radius: 8px; overflow-x: auto; }
   ol.steps li { margin: .5rem 0; }
+  [hidden] { display: none !important; }
 </style>
 </head>
 <body>
 <h1>FediPod - join the fediverse from a Solid pod.</h1>
-<p class="lede">Welcome to the <strong>FediPod.net gateway</strong>.  Here, you can get a free pod and fediverse account or link to your existing pod/account. This gateway is a mail filter for accounts that stay yours. Your name, key and data live on your own pod; this box only receives your fediverse mail, verifies each delivery, drops spam and passes the rest to your pod.</p>
+<p class="lede">Welcome to <b>FediPod</b>! Here, you can get a free pod and fediverse account or link to your existing pod/account.</p>
+
+<p class="hint" id="current-version" hidden>Current FediPod: <strong id="current-version-num"></strong><br>
+ — install or update an existing install with <code id="current-version-cmd"></code></p>
 
 <p>
 FediPod is experimental and free to use.  See the <a href="https://github.com/jeff-zucker/FediPod">FediPod repository</a> for details.
 </p>
 
-<p class="hint" id="current-version" hidden>Current FediPod: <strong id="current-version-num"></strong>
- — update an existing install with <code id="current-version-cmd"></code></p>
-
-<fieldset>
-  <legend>What do you want to do?</legend>
-  <div class="choices" role="group" aria-label="Path">
-    <button type="button" id="pick-solo" aria-pressed="false"><b>Create a new solo account</b><span>a fediverse account for one person, on a pod you own</span></button>
-    <button type="button" id="pick-group" aria-pressed="false"><b>Create a new group account</b><span>an account people join &mdash; it carries members' posts to the whole group</span></button>
-    <button type="button" id="pick-manage" aria-pressed="false"><b>Manage an existing account</b><span>attach it to this gateway, detach it, or transfer in</span></button>
-  </div>
-</fieldset>
-
-<!-- create: the signup itself — prove the pod, take the name, then install -->
-<form id="create-form" hidden>
-  <h2 id="create-title">Create a new solo account</h2>
-  <p class="hint" id="create-group-hint" hidden>A group is an account people join: members post to it, and it
-    carries each member's post to everyone in the group. Mastodon users can join with no pod of their own.
-    A group needs a pod of its own.</p>
-  <p class="hint">Your account lives on a pod you own; this gateway filters its mail.</p>
-
-  <label for="create-pod">Your pod address</label>
-  <input type="url" id="create-pod" autocomplete="off" placeholder="https://you.solidcommunity.net/">
-  <p class="hint">No pod yet? Any Solid pod host that offers <em>https subdomains</em> works, or a Community
-    Solid Server you run yourself. Get the pod, then come back here.</p>
-  <p id="create-pods" class="hint" hidden>This host also offers pods — you can take one instead of bringing
-    your own; it stays exportable, so you can leave with everything.</p>
-
-  <label for="create-issuer">Where you log in (your identity provider)</label>
-  <input type="url" id="create-issuer" autocomplete="off" placeholder="https://solidcommunity.net">
-
-  <label for="create-handle">Your handle (the name in your address; permanent)</label>
-  <input type="text" id="create-handle" autocomplete="off" autocapitalize="off" spellcheck="false"
-    inputmode="latin" placeholder="you" aria-describedby="create-handle-msg">
-  <p class="msg" id="create-handle-msg" aria-live="polite"></p>
-
-  <label>Your fediverse address</label>
-  <div class="choices" role="group" aria-label="Address">
-    <button type="button" id="addr-pod" aria-pressed="false"><b id="addr-pod-name">@you@your.pod</b><span>your handle is tied to your pod &mdash; you can drop the gateway and keep everything</span></button>
-    <button type="button" id="addr-front" aria-pressed="false"><b id="addr-front-name">@you@this.host</b><span>your handle is tied to the gateway &mdash; you can move pods and keep your handle</span></button>
-  </div>
-
-  <p style="margin-top:1.1rem">
-    <button type="button" id="create-continue" class="primary" disabled>Sign in with your pod &amp; create</button>
-  </p>
-  <p class="hint">Signing in proves the pod is yours — no password ever reaches this gateway.</p>
-  <p class="hint" id="create-note" hidden></p>
-</form>
-
-<!-- what a finished signup hands over: the one install command -->
-<section id="create-done" hidden></section>
-
-<!-- manage: the existing-account actions, one panel each -->
-<section id="manage-form" hidden>
-  <div class="choices" role="group" aria-label="Manage">
-    <button type="button" id="pick-attach" aria-pressed="false"><b>Attach to this gateway</b><span>filter your mail through this door &mdash; your address stays yours</span></button>
-    <button type="button" id="pick-detach" aria-pressed="false"><b>Detach from this gateway</b><span>go back to unfiltered delivery</span></button>
-    <button type="button" id="pick-transfer" aria-pressed="false"><b>Transfer a fediverse account to FediPod</b><span>move here from Mastodon and friends</span></button>
-  </div>
-</section>
-
-<!-- attach: an existing FediPod points its inbox here; identity stays put -->
-<form id="attach-form" hidden>
-  <h2>Attach an existing FediPod account</h2>
-  <p class="hint">Your account stays <code>@you@your.pod</code> — other servers keep finding you at your own
-    address. Attaching only changes where your <em>mail</em> arrives: your actor advertises this gateway's door
-    as its inbox, and everything that passes verification lands in your pod as before.</p>
-
-  <label for="pod-url">Your pod address</label>
-  <input type="url" id="pod-url" autocomplete="off" placeholder="https://you.solidcommunity.net/">
-  <p class="hint">If your FediPod uses a custom root, give the full home URL (ending in <code>/</code>);
-    a bare pod address assumes the default <code>activitypods-js/</code>.</p>
-
-  <label for="issuer">Where you log in (your identity provider)</label>
-  <input type="url" id="issuer" autocomplete="off" placeholder="https://solidcommunity.net">
-
-  <label for="slug">Your door's name here</label>
-  <input type="text" id="slug" autocomplete="off" autocapitalize="off" spellcheck="false"
-    inputmode="latin" placeholder="you" aria-describedby="slug-msg">
-  <p class="msg" id="slug-msg" aria-live="polite"></p>
-  <p class="hint">Only the door is named here — it is a routing address for servers, not your handle.</p>
-
-  <p style="margin-top:1.1rem">
-    <button type="button" id="attach-continue" class="primary" disabled>Sign in with your pod &amp; attach</button>
-  </p>
-  <p class="hint">Signing in proves the pod is yours — no password ever reaches this gateway.</p>
-  <p class="hint" id="attach-note" hidden></p>
-</form>
-
-<!-- detach: done on the user's own agent; the gateway cannot reach in -->
-<section id="detach-form" hidden>
-  <h2>Detach an existing FediPod account</h2>
-  <p class="hint">Detaching is yours to do, not this gateway's — your agent republishes your actor with your
-    pod's own inbox, and deliveries go straight there again. On your machine:</p>
-  <pre>node bin/fedipod.mjs gateway --detach</pre>
-  <p class="hint">Your name and data never moved, so nothing else changes. The door you had here goes quiet
-    and its name can be reused.</p>
-</section>
-
-<!-- transfer: the standard fediverse move, aimed at a FediPod -->
-<section id="transfer-form" hidden>
-  <h2>Transfer a fediverse account to FediPod</h2>
-  <p class="hint">The fediverse's standard migration works toward a FediPod: your followers move over
-    automatically, and your old profile redirects. Posts stay on the old server — no fediverse migration
-    carries them.</p>
-  <ol class="steps">
-    <li><strong>Have a FediPod</strong> — create one first (the first option above).</li>
-    <li>On your agent's admin page, set <strong>new followers</strong> to <em>accepted automatically</em>,
-      so the wave of arriving followers doesn't queue.</li>
-    <li>Tell your FediPod about the old account:
-      <pre>node bin/fedipod.mjs alias --add @you@old.server</pre></li>
-    <li>On the old server: Preferences → Account → <em>Move to a different account</em>, naming your
-      FediPod address.</li>
-    <li>Bring the rest over from the old server's CSV export:
-      <pre>node bin/fedipod.mjs import following_accounts.csv blocked_accounts.csv muted_accounts.csv lists.csv</pre></li>
-  </ol>
-</section>
-
-<script src="/solid-client-authn.bundle.js"></script>
 <script>
-  const $ = (id) => document.getElementById(id);
-  let offersPods = false, slugOk = false;
-
   fetch('/api/handle?handle=__probe__').then(r => r.json()).then(d => {
-    offersPods = !!d.offersPods;
-    $('create-pods').hidden = !offersPods;
     if (d.version) {
-      $('current-version-num').textContent = d.version;
-      $('current-version-cmd').textContent = `curl -fsSL ${location.origin}/install | sh`;
-      $('current-version').hidden = false;
+      document.getElementById('current-version-num').textContent = d.version;
+      document.getElementById('current-version-cmd').textContent = `curl -fsSL ${location.origin}/install | sh`;
+      document.getElementById('current-version').hidden = false;
     }
   }).catch(() => {});
-
-  const picks = ['pick-solo', 'pick-group', 'pick-manage'];
-  const panels = { 'pick-solo': 'create-form', 'pick-group': 'create-form',
-    'pick-manage': 'manage-form' };
-  const subPicks = ['pick-attach', 'pick-detach', 'pick-transfer'];
-  const subPanels = { 'pick-attach': 'attach-form', 'pick-detach': 'detach-form',
-    'pick-transfer': 'transfer-form' };
-  let createKind = 'person';
-  function subPick(which) {
-    for (const id of subPicks) {
-      $(id).setAttribute('aria-pressed', String(id === which));
-      $(subPanels[id]).hidden = id !== which;
-    }
-  }
-  function pick(which) {
-    for (const id of picks) $(id).setAttribute('aria-pressed', String(id === which));
-    for (const panel of new Set(Object.values(panels))) $(panel).hidden = panels[which] !== panel;
-    $('create-done').hidden = true;
-    if (which !== 'pick-manage') subPick(null);
-    if (panels[which] === 'create-form') {
-      createKind = which === 'pick-group' ? 'group' : 'person';
-      $('create-title').textContent = createKind === 'group'
-        ? 'Create a new group account' : 'Create a new solo account';
-      $('create-group-hint').hidden = createKind !== 'group';
-    }
-  }
-  for (const id of picks) $(id).onclick = () => pick(id);
-  for (const id of subPicks) $(id).onclick = () => subPick(id);
-
-  // Suggest the door name from the pod's own first label, and the identity
-  // provider from the pod's apex domain — both still editable.
-  $('pod-url').addEventListener('input', () => {
-    try {
-      const u = new URL($('pod-url').value.trim());
-      const label = u.hostname.split('.')[0];
-      if (!$('slug').value && /^[a-z0-9-]{1,63}$/.test(label)) {
-        $('slug').value = label;
-        $('slug').dispatchEvent(new Event('input'));
-      }
-      if (!$('issuer').value) {
-        const parts = u.hostname.split('.');
-        $('issuer').value = 'https://' + (parts.length > 2 ? parts.slice(1).join('.') : u.hostname);
-      }
-    } catch { /* not a URL yet */ }
-    refresh();
-  });
-  $('issuer').addEventListener('input', refresh);
-
-  let t = null;
-  $('slug').addEventListener('input', () => {
-    slugOk = false; $('slug-msg').textContent = ''; $('slug-msg').className = 'msg';
-    clearTimeout(t);
-    const h = $('slug').value.trim().toLowerCase();
-    if (!h) { refresh(); return; }
-    t = setTimeout(async () => {
-      try {
-        const d = await (await fetch('/api/handle?handle=' + encodeURIComponent(h))).json();
-        slugOk = d.available;
-        $('slug-msg').textContent = d.available ? 'this door is free' : (d.reason || 'taken');
-        $('slug-msg').className = 'msg ' + (d.available ? 'ok' : 'no');
-      } catch { $('slug-msg').textContent = 'could not check'; $('slug-msg').className = 'msg no'; }
-      refresh();
-    }, 250);
-  });
-
-  function refresh() {
-    const podOk = /^https:\/\/\S+/.test($('pod-url').value.trim());
-    const issuerOk = /^https:\/\/\S+/.test($('issuer').value.trim());
-    $('attach-continue').disabled = !(podOk && slugOk && issuerOk);
-  }
-
-  // The user's pod home: their agent tree on the pod. A bare pod root gets
-  // the default root; anything with a path is taken as given.
-  function podHomeOf(raw) {
-    const u = new URL(raw.trim());
-    if (u.pathname === '/') u.pathname = '/activitypods-js/';
-    else if (!u.pathname.endsWith('/')) u.pathname += '/';
-    u.search = ''; u.hash = '';
-    return u.href;
-  }
-
-  $('attach-continue').onclick = () => {
-    const auth = window.solidClientAuthentication;
-    const n = $('attach-note');
-    if (!auth) { n.hidden = false; n.textContent = 'the sign-in library did not load — reload and try again'; return; }
-    sessionStorage.setItem('fp-attach', JSON.stringify({
-      slug: $('slug').value.trim().toLowerCase(),
-      podHome: podHomeOf($('pod-url').value),
-      kind: 'person',
-    }));
-    auth.login({
-      oidcIssuer: $('issuer').value.trim(),
-      redirectUrl: location.origin + '/',
-      clientName: 'FediPod gateway',
-    }).catch((e) => { n.hidden = false; n.textContent = 'sign-in failed to start: ' + e.message; });
-  };
-
-  // ---- the create (signup) form ----
-  let createSlugOk = false, addrShape = null;
-  const esc = (s) => String(s).replace(/[&<>"']/g, (c) =>
-    ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
-
-  // The two address previews follow the handle and pod as they are typed.
-  function addrPreview() {
-    const h = $('create-handle').value.trim().toLowerCase() || 'you';
-    let podHost = 'your.pod';
-    try { podHost = new URL($('create-pod').value.trim()).hostname; } catch { /* not a URL yet */ }
-    $('addr-pod-name').textContent = `@${h}@${podHost}`;
-    $('addr-front-name').textContent = `@${h}@${location.host}`;
-  }
-  function createRefresh() {
-    const podOk = /^https:\/\/\S+/.test($('create-pod').value.trim());
-    const issuerOk = /^https:\/\/\S+/.test($('create-issuer').value.trim());
-    $('create-continue').disabled = !(podOk && issuerOk && createSlugOk && addrShape);
-  }
-  $('addr-pod').onclick = () => { addrShape = 'pod';
-    $('addr-pod').setAttribute('aria-pressed', 'true');
-    $('addr-front').setAttribute('aria-pressed', 'false'); createRefresh(); };
-  $('addr-front').onclick = () => { addrShape = 'front';
-    $('addr-front').setAttribute('aria-pressed', 'true');
-    $('addr-pod').setAttribute('aria-pressed', 'false'); createRefresh(); };
-
-  $('create-pod').addEventListener('input', () => {
-    try {
-      const u = new URL($('create-pod').value.trim());
-      const label = u.hostname.split('.')[0];
-      if (!$('create-handle').value && /^[a-z0-9-]{1,63}$/.test(label)) {
-        $('create-handle').value = label;
-        $('create-handle').dispatchEvent(new Event('input'));
-      }
-      if (!$('create-issuer').value) {
-        const parts = u.hostname.split('.');
-        $('create-issuer').value = 'https://' + (parts.length > 2 ? parts.slice(1).join('.') : u.hostname);
-      }
-    } catch { /* not a URL yet */ }
-    addrPreview(); createRefresh();
-  });
-  $('create-issuer').addEventListener('input', createRefresh);
-
-  let ct = null;
-  $('create-handle').addEventListener('input', () => {
-    createSlugOk = false; $('create-handle-msg').textContent = ''; $('create-handle-msg').className = 'msg';
-    addrPreview();
-    clearTimeout(ct);
-    const h = $('create-handle').value.trim().toLowerCase();
-    if (!h) { createRefresh(); return; }
-    ct = setTimeout(async () => {
-      try {
-        const d = await (await fetch('/api/handle?handle=' + encodeURIComponent(h))).json();
-        createSlugOk = d.available;
-        $('create-handle-msg').textContent = d.available ? 'this name is free' : (d.reason || 'taken');
-        $('create-handle-msg').className = 'msg ' + (d.available ? 'ok' : 'no');
-      } catch { $('create-handle-msg').textContent = 'could not check'; $('create-handle-msg').className = 'msg no'; }
-      createRefresh();
-    }, 250);
-  });
-
-  $('create-continue').onclick = () => {
-    const auth = window.solidClientAuthentication;
-    const n = $('create-note');
-    if (!auth) { n.hidden = false; n.textContent = 'the sign-in library did not load — reload and try again'; return; }
-    sessionStorage.setItem('fp-create', JSON.stringify({
-      slug: $('create-handle').value.trim().toLowerCase(),
-      podHome: podHomeOf($('create-pod').value),
-      issuer: $('create-issuer').value.trim(),
-      kind: createKind,
-      fronted: addrShape === 'front',
-    }));
-    auth.login({
-      oidcIssuer: $('create-issuer').value.trim(),
-      redirectUrl: location.origin + '/',
-      clientName: 'FediPod gateway',
-    }).catch((e) => { n.hidden = false; n.textContent = 'sign-in failed to start: ' + e.message; });
-  };
-
-  // Back from the identity provider: finish the signup with the proven login.
-  (async () => {
-    const auth = window.solidClientAuthentication;
-    if (!auth) return;
-    const info = await auth.handleIncomingRedirect().catch(() => null);
-    const pending = sessionStorage.getItem('fp-create');
-    if (!info?.isLoggedIn || !pending) return;
-    sessionStorage.removeItem('fp-create');
-    const p = JSON.parse(pending);
-    pick(p.kind === 'group' ? 'pick-group' : 'pick-solo');
-    const n = $('create-note');
-    n.hidden = false;
-    n.textContent = 'signed in as ' + info.webId + ' — creating…';
-    const res = await auth.fetch('/api/attach', {
-      method: 'POST', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ handle: p.slug, podHome: p.podHome, kind: p.kind, fronted: p.fronted }),
-    }).catch(() => null);
-    const d = res ? await res.json().catch(() => ({})) : {};
-    if (res && res.status === 201) {
-      const address = p.fronted ? d.address : `@${p.slug}@${new URL(p.podHome).hostname}`;
-      const flags = [
-        `--gateway ${d.frontActor || d.doorInbox}`,
-        `--secret ${d.hmacSecret}`,
-        `--pod ${p.podHome}`,
-        `--issuer ${p.issuer}`,
-        `--handle ${p.slug}`,
-        `--kind ${p.kind}`,
-        ...(p.fronted ? ['--fronted'] : []),
-      ];
-      const cmd = `curl -fsSL ${location.origin}/install | sh -s -- \\\n  ` + flags.join(' \\\n  ');
-      $('create-form').hidden = true;
-      const done = $('create-done');
-      done.hidden = false;
-      done.innerHTML = '<h2>' + esc(address) + '</h2>'
-        + '<p>Created. Now install your agent on the machine it will live on — one command, then start it:</p>'
-        + '<pre>' + esc(cmd) + '\n\nfedipod start</pre>'
-        + '<p>Setup opens in your browser with everything already filled in. When it finishes, your '
-        + 'account is live and your mail arrives through this gateway, filtered.</p>';
-    } else {
-      n.textContent = 'signup failed: ' + (d.error || (res ? 'HTTP ' + res.status : 'no response'));
-    }
-  })();
-
-  // Back from the identity provider: finish the attach with the proven login.
-  (async () => {
-    const auth = window.solidClientAuthentication;
-    if (!auth) return;
-    const info = await auth.handleIncomingRedirect().catch(() => null);
-    const pending = sessionStorage.getItem('fp-attach');
-    if (!info?.isLoggedIn || !pending) return;
-    sessionStorage.removeItem('fp-attach');
-    const p = JSON.parse(pending);
-    pick('pick-manage');
-    subPick('pick-attach');
-    const n = $('attach-note');
-    n.hidden = false;
-    n.textContent = 'signed in as ' + info.webId + ' — attaching…';
-    const res = await auth.fetch('/api/attach', {
-      method: 'POST', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ handle: p.slug, podHome: p.podHome, kind: p.kind }),
-    }).catch(() => null);
-    const d = res ? await res.json().catch(() => ({})) : {};
-    if (res && res.status === 201) {
-      n.innerHTML = 'Attached. Run this on the machine your agent lives on, then restart the agent:'
-        + '<pre>' + d.command + '</pre>'
-        + 'Your mail then arrives through <code>' + d.doorInbox + '</code>, filtered. Your name has not moved.';
-    } else {
-      n.textContent = 'attach failed: ' + (d.error || (res ? 'HTTP ' + res.status : 'no response'));
-    }
-  })();
 </script>
-<i>(cc) 4.0 By, Jeff Zucker, 2026</i>
+<i style="text-align:right">(cc) 4.0 By, Jeff Zucker, 2026</i>
 </body>
 </html>

package/web/front/new-account.html~

@@ -0,0 +1,50 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>FediPod — access the Fediverse and ATProto from a Solid pod</title>
+<style>
+  :root { color-scheme: light dark; --line:#d9d4c7; --dim:#45443d; --accent:#6a8a5a; }
+  @media (prefers-color-scheme: dark) { :root { --dim:#c2c0b4; } }
+  body { font: 19px/1.6 system-ui, sans-serif; max-width: 44rem; margin: 2rem auto; padding: 0 1.1rem; }
+  h1 { font-size: 1.7rem; margin: 0 0 .2rem; }
+  h2 { font-size: 1.2rem; margin: 1.4rem 0 .4rem; }
+  p.lede { color: var(--dim); margin-top: 0; }
+  .hint { color: var(--dim); font-size: .95rem; }
+  code { background: rgba(120,120,120,.12); padding: .05em .35em; border-radius: 4px; }
+  pre { background: rgba(120,120,120,.12); padding: .7rem .9rem; border-radius: 8px; overflow-x: auto; }
+  ol.steps li { margin: .5rem 0; }
+  [hidden] { display: none !important; }
+</style>
+</head>
+<body>
+<h1>FediPod - join the fediverse from a Solid pod.</h1>
+<p class="lede">Welcome to <b>FediPod</b! Here, you can get a free pod and fediverse account or link to your existing pod/account.</p>
+
+
+<p>
+FediPod is experimental and free to use.  See the <a href="https://github.com/jeff-zucker/FediPod">FediPod repository</a> for details.
+</p>
+
+<p class="hint" id="current-version" hidden>Current FediPod: <strong id="current-version-num"></strong><br>
+ — update an existing install with <code id="current-version-cmd"></code></p>
+
+<script>
+  // Another host deploying this front serves the same page: the command names
+  // that host, not fedipod.net.
+  if (location.origin !== 'https://fedipod.net' && location.protocol.startsWith('http')) {
+    document.getElementById('install-cmd').textContent =
+      `curl -fsSL ${location.origin}/install | sh\n\nfedipod start`;
+  }
+  fetch('/api/handle?handle=__probe__').then(r => r.json()).then(d => {
+    if (d.version) {
+      document.getElementById('current-version-num').textContent = d.version;
+      document.getElementById('current-version-cmd').textContent = `curl -fsSL ${location.origin}/install | sh`;
+      document.getElementById('current-version').hidden = false;
+    }
+  }).catch(() => {});
+</script>
+<i style="text-align:right">(cc) 4.0 By, Jeff Zucker, 2026</i>
+</body>
+</html>