fedipod 0.9.0 → 0.11.0

package/bin/fedipod.mjs

@@ -1492,12 +1492,44 @@ if (cmd === 'up') {
   console.log('UI password set — /oauth/authorize now shows a login form (restart a running agent to pick it up)');
 } else if (cmd === 'gateway' || cmd === 'front') {
   // Attach this identity to a gateway ('front' kept as an alias). Shapes:
-  //   fedipod gateway <.../ap/inbox/> --secret S --inbox-only   the usual one:
+  //   fedipod gateway --attach <origin> [--name N] [--fronted]  ask the gateway
+  //     itself: the agent proves the pod with its own credential and stores
+  //     the door + secret the gateway answers with.
+  //   fedipod gateway <.../ap/inbox/> --secret S --inbox-only   paste-in form:
   //     identity stays on the pod; only the advertised inbox moves to the
   //     gateway's door. Leaving is one republish with the pod inbox.
   //   fedipod gateway <.../ap/actor> --secret S                 fronted identity
   //   fedipod gateway --detach                                  back to the pod inbox
   requireIdentity();
+  if (has('attach')) {
+    const front = flag('attach');
+    if (!/^https?:\/\/\S+$/.test(String(front || ''))) {
+      console.error('usage: fedipod gateway --attach <https://gateway-origin> [--name yourname] [--fronted]');
+      process.exit(2);
+    }
+    try {
+      const res = await localFetch(HOME, PORT, `/gateway`, {
+        method: 'POST', headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ action: 'attach', front,
+          ...(flag('name') ? { handle: flag('name') } : {}),
+          ...(has('fronted') ? { fronted: true } : {}) }),
+      });
+      const body = await res.json();
+      if (res.status >= 400) { console.error(body.error || `HTTP ${res.status}`); process.exit(1); }
+      if (body.frontActor) {
+        console.log(`attached — this identity now publishes as ${body.address || body.frontActor}`);
+        console.log('The agent is restarting itself to publish under the front.');
+      } else {
+        console.log(`attached — your mail now arrives through ${body.url}, filtered; your name has not moved.`);
+        console.log('Starting in shadow: the door filters, and the agent measures how much');
+        console.log('verifies before it believes any receipt. Move to trust when you are ready.');
+      }
+    } catch (e) {
+      console.error(`agent not reachable on :${PORT} (${e.message}) — start it, then attach`);
+      process.exit(1);
+    }
+    process.exit(0);
+  }
   if (has('detach')) {
     try {
       const res = await localFetch(HOME, PORT, `/gateway`, {

package/cli.md

@@ -38,9 +38,10 @@ several identities, say which you mean. `profiles` does not list identities
 under a custom `AP_HOME`.
 
 Commands that manage a live identity — `alias`, `admit`, `import`, `archive`,
-`bsky`, `describe`, `status`, `rebuild`, `gateway --detach` and the group
-commands — talk to the running agent and say so when it is not there. `keys`,
-`state`, `home` and attaching a gateway want the agent stopped.
+`bsky`, `describe`, `status`, `rebuild`, `gateway --attach`,
+`gateway --detach` and the group commands — talk to the running agent and say
+so when it is not there. `keys`, `state`, `home` and the paste-in gateway form
+(`gateway <url> --secret …`) want the agent stopped.
 
 ## Recovery
 
@@ -189,9 +190,16 @@ are not imported.
 ## The gateway
 
 ```
+fedipod gateway --attach <gateway-origin> [--name N] [--fronted]
 fedipod gateway <door-inbox-url> --secret <hmac> --inbox-only
 fedipod gateway --detach
 ```
+
+`--attach` asks the gateway itself: the agent proves the pod with its own
+credential, and the gateway answers with the door and the receipt secret.
+`--name` defaults to your handle; `--fronted` takes a gateway-based name,
+and the agent restarts itself to publish under it. The admin page's Gateway
+row offers the same action with the name checked as you type.
 Attaching points your actor's advertised inbox at a gateway's door, so
 deliveries are verified and de-junked before they reach your pod; your name,
 key and data stay on your pod. The URL and secret come from the gateway's

package/gui.md

@@ -3,6 +3,8 @@
 Open `https://localhost:8030/` while any agent is running — it forwards you to the agent — then choose `manage account` and select the actor you want from the local actors dropdown.
 Picking an actor marked "(stopped)" starts its agent, then opens its page.
 
+The software row names the version the agent is running. When the copy on the machine is further ahead — after an update, or after pulling a checkout — it says so and asks for a restart, because an agent goes on serving the code it started with until it is restarted.
+
 `Update`, shown on the software row when a newer FediPod exists, pulls the latest version and restarts every agent on the machine — agents installed as services; any started by hand need their own restart. The same row flags an older data layout after an update; the `fedipod upgrade` terminal command lists those moves and the commands that make them.
 
 * **Parking** (the status control) stops the mail and unfollows people you follow, but keeps your handle
@@ -70,12 +72,28 @@ follows the group's own moderation settings; see [Groups](groups.md).
 **new followers** control switches between waiting for your approval and
 accepting automatically.
 
+## The gateway
+
+The **gateway** row on the record (under **software**) attaches this account
+to a mail-filtering gateway (a fedipod.net-style front) and detaches it; when
+attached it names the gateway, and the handle there when you took one. Both
+buttons open a popup. Attaching offers the choice of handle: keep your
+pod-based handle (`@you@your.pod` — you can drop the gateway any time and
+keep everything), or create a handle at the gateway (`@you@the-gateway` —
+your address lives on the gateway's domain, but not your data or key), typed
+straight into the blank of the address with a free/taken check as you type.
+The gateway account is created automatically with either choice, and the
+agent proves the pod with its own credential, so no password is typed
+anywhere. Taking or leaving a gateway handle restarts the agent by itself;
+detaching republishes your actor with your pod's own inbox.
+
 ## Moving here from another server
 
 Open **Transfer an account here** on the action rail and add your old account
 as an alias, set
 **new followers** to *accepted automatically*, then trigger the move on the
-old server; your followers arrive by themselves. Removing an alias asks
+old server (on Mastodon: Preferences → Account → *Move to a different
+account*); your followers arrive by themselves. Removing an alias asks
 twice — servers still processing the move check it while they retry. The CSV
 files from the old server's export are imported with the CLI; see
 [CLI admin](cli.md).

package/lib/admin.mjs

@@ -16,7 +16,7 @@ import os from 'node:os';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { followHandle, followActor, unfollowActor, ejectFollower, retractAnnouncement,
   admitRequest, refuseRequest, resolveHandle, applyModeration, announceModeration } from './social.mjs';
-import { addRemoveActivity, webfingerHost } from './wire.mjs';
+import { addRemoveActivity, webfingerHost , publicHandle } from './wire.mjs';
 import { MastoApi, hashPassword } from './mastoapi.mjs';
 import { C2S } from './c2s.mjs';
 import { makeC2sAuth } from './oidc-auth.mjs';
@@ -32,6 +32,7 @@ import { portFree, freePortFrom } from './ports.mjs';
 import { claimDirectory, yieldDirectory } from './directory.mjs';
 import { localFetch } from './localapi.mjs';
 import { ensureTrustedTls } from './certs.mjs';
+import { localVersion } from './update.mjs';
 
 const require = createRequire(import.meta.url);
 const projectRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -325,7 +326,8 @@ function sendFile(res, baseDir, rel, auth) {
 // guards the operator's door (basePath) instead of the whole surface.
 export function buildAdminSurface({ agent, gate, allowed, log = console.log,
   port = null, handle = null, embedded = false, basePath = '/',
-  publicOrigin = null, scheme = null }) {
+  publicOrigin = null, scheme = null,
+  versionOnDisk = () => localVersion(projectRoot) }) {
   const json = (res, status, obj) => sendJson(res, status, obj, allowed);
   const masto = new MastoApi({ agent, log, allowed, scheme, embedded });
   // The spec's own write API (§6), beside the facade. Its bearer fallback is
@@ -488,7 +490,10 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
           // the handle, and the pod host its actor URL sits on.
           let address = null;
           if (live?.handle && live?.actor) {
-            try { address = `${live.handle}@${new URL(live.actor).host}`; } catch { /* not a URL yet */ }
+            try {
+              const front = live.actor.match(/\/u\/([^/]+)\/ap\/actor\/?$/)?.[1];
+              address = `${front || live.handle}@${new URL(live.actor).host}`;
+            } catch { /* not a URL yet */ }
           }
           return {
             name, port, current,
@@ -566,6 +571,11 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
         if (!cfg) return json(res, 409, { error: 'agent not configured — set it up at /admin/setup/' });
         const urls = agent.urls || agent.publisher?.urls || null;
         const wfHost = urls ? new URL(urls.base).host : null;
+        // A fronted identity's address is its name AT THE FRONT — the front
+        // serves the actor under that name, whatever this pod calls it.
+        const address = cfg.gateway?.frontActor
+          ? `@${publicHandle(cfg)}@${new URL(cfg.gateway.frontActor).host}`
+          : (wfHost ? `@${cfg.handle}@${wfHost}` : null);
         return json(res, 200, {
           // permanent
           handle: cfg.handle, remotePod: cfg.remotePod, issuer: cfg.issuer,
@@ -576,7 +586,7 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
           // same way every other id is — computed here rather than in the page,
           // which has no business knowing how they are made.
           accountId: urls?.actor ? agent.store.idFor(urls.actor) : null,
-          address: wfHost ? `@${cfg.handle}@${wfHost}` : null,
+          address,
           // editable
           name: cfg.name || null, summary: cfg.summary || null, icon: cfg.icon || null,
           image: cfg.image || null, fields: cfg.fields || [],
@@ -592,6 +602,10 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
           privateRoot: agent.readCredential?.()?.privateRoot || null,
           mode: agent.status?.().mode || null, port, home: tildify(agent.home) || null,
           update: agent.updateInfo || null,
+          // What this process is running, against what a restart would run:
+          // the checkout can move while an agent stays up.
+          version: AGENT_VERSION,
+          versionOnDisk: versionOnDisk(),
           pendingUpgrade: agent.pendingUpgrade || [],
           // The connected Bluesky account, non-secret half. `connected` is the
           // credential's word, so a config entry orphaned by a deleted
@@ -1423,12 +1437,47 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
           const cfg = { ...agent.store.getConfig() };
           const g = { ...(cfg.gateway || {}) };
           const inboxUrl = agent.publisher?.urls?.inbox;
+          // Availability is a read: answered before the lease takeover below,
+          // which every real gateway change does want.
+          if (body.action === 'check') {
+            const front = String(body.front || '').replace(/\/+$/, '');
+            try { new URL(front); } catch { return json(res, 400, { error: 'front must be a gateway origin URL' }); }
+            const chk = await fetch(`${front}/api/handle?handle=${encodeURIComponent(String(body.handle || '').toLowerCase())}`,
+              { headers: { accept: 'application/json' } }).then((r) => r.json()).catch(() => null);
+            if (!chk) return json(res, 502, { error: `${front} did not answer its handle check` });
+            return json(res, 200, { available: !!chk.available, reason: chk.reason || null });
+          }
           await agent.requestTakeover?.();
           const persist = async () => {
             cfg.gateway = g; agent.store.setConfig(cfg);
             if (agent.publisher) agent.publisher.config.gateway = g;
             await agent.store.flush();
           };
+          // Fronting renames the actor's ids; the signing key is the same
+          // identity's and moves with it, wherever the key record lives.
+          const restampKeys = async (actorId) => {
+            try {
+              const kp = path.join(agent.home, 'keys.json');
+              const rec = JSON.parse(fs.readFileSync(kp, 'utf8'));
+              if (rec.mintedFor) { rec.mintedFor = actorId; fs.writeFileSync(kp, JSON.stringify(rec)); return; }
+            } catch { /* not local — try pod state */ }
+            const podRec = agent.store.read('keys.json', null);
+            if (podRec?.mintedFor) { podRec.mintedFor = actorId; agent.store.write('keys.json', podRec); await agent.store.flush(); }
+          };
+          const podActorId = () => {
+            const base = cfg.remotePod.endsWith('/') ? cfg.remotePod : `${cfg.remotePod}/`;
+            const root = cfg.root ? (cfg.root.endsWith('/') ? cfg.root : `${cfg.root}/`) : 'activitypods-js/';
+            return `${base}${root}ap/actor`;
+          };
+          // The reply first, the restart a beat later — same shape as /update.
+          const selfRestart = (why) => setTimeout(() => {
+            log(why);
+            if (process.env.INVOCATION_ID) { process.exit(1); return; }   // systemd: Restart=on-failure respawns
+            const child = spawn(process.execPath, process.argv.slice(1),
+              { detached: true, stdio: 'ignore', env: process.env });
+            child.unref();
+            setTimeout(() => process.exit(0), 300);
+          }, 200);
           if (body.action === 'configure') {
             if (!/^https:\/\/\S+$/.test(String(body.url || ''))) return json(res, 400, { error: 'gateway url must be https' });
             if (!/^https?:\/\/\S+$/.test(String(body.webId || ''))) return json(res, 400, { error: 'gateway webId must be a URL' });
@@ -1478,16 +1527,91 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
             else if (target !== 'off') await agent.publisher?.publishGatewayPolicy().catch(() => {});
             return json(res, 200, { ok: true, mode: g.mode });
           }
+          // Attach through a multi-user front (fedipod.net and kin): the agent
+          // proves the pod with its own credential — no browser, no password —
+          // and the front answers with the door and the receipt secret.
+          if (body.action === 'attach') {
+            const front = String(body.front || '').replace(/\/+$/, '');
+            let fu;
+            try { fu = new URL(front); } catch { return json(res, 400, { error: 'front must be the gateway origin, like https://fedipod.net' }); }
+            if (fu.protocol !== 'https:' && !/^(localhost|127\.0\.0\.1)$|\.localhost$/.test(fu.hostname)) {
+              return json(res, 400, { error: 'front must be https' });
+            }
+            if (agent.embedded) {
+              return json(res, 400, { error: 'this identity runs inside its pod server and has no portable credential — attach from a standalone agent' });
+            }
+            const named = !!String(body.handle || '').trim();
+            let handle = String(body.handle || cfg.handle || '').toLowerCase().trim();
+            if (!handle) return json(res, 400, { error: 'a name at the gateway is required' });
+            const fronted = body.fronted === true;
+            // Availability first, for a clean answer before anything is created.
+            const avail = async (h) => fetch(`${front}/api/handle?handle=${encodeURIComponent(h)}`,
+              { headers: { accept: 'application/json' } }).then((r) => r.json()).catch(() => null);
+            let chk = await avail(handle);
+            if (!chk) return json(res, 502, { error: `${front} did not answer its handle check` });
+            // An unnamed door name is plumbing nobody reads: walk to a free
+            // variant instead of failing over a label the user never chose.
+            if (!chk.available && !named) {
+              for (let i = 2; i <= 9 && !chk.available; i++) {
+                const cand = `${handle}${i}`;
+                const c = await avail(cand);
+                if (c?.available) { handle = cand; chk = c; }
+              }
+            }
+            if (!chk.available) return json(res, 409, { error: chk.reason || `the name ${handle} is taken at ${front}` });
+            const frontActor = `${front}/u/${handle}/ap/actor`;
+            if (g.frontActor && (!fronted || g.frontActor !== frontActor)) {
+              return json(res, 400, { error: `this identity already fronts through ${g.frontActor} — changing a published front renames every id; detach first if you mean it` });
+            }
+            const attach = await agent.remote.session.fetch(`${front}/api/attach`, {
+              method: 'POST', headers: { 'content-type': 'application/json' },
+              body: JSON.stringify({ handle, podHome: agent.urls.home, kind: cfg.kind || 'person', fronted }),
+            }).catch(() => null);
+            if (!attach) return json(res, 502, { error: `${front} did not answer the attach` });
+            const d = await attach.json().catch(() => ({}));
+            if (attach.status !== 201) {
+              return json(res, attach.status >= 400 && attach.status < 500 ? attach.status : 502,
+                { error: d.error || `attach failed (HTTP ${attach.status})` });
+            }
+            g.url = String(d.doorInbox || `${front}/u/${handle}/ap/inbox/`);
+            if (d.hmacSecret) g.hmacSecret = String(d.hmacSecret);
+            if (fronted) g.frontActor = String(d.frontActor || frontActor);
+            if (!g.mode || g.mode === 'off') g.mode = 'shadow';
+            await persist();
+            // Inbox-only applies live: the actor republishes advertising the
+            // door. A front carries new ids, which are wired at startup — so a
+            // fronted attach restarts this agent itself, the reply going out
+            // first so it is not taken down with the process.
+            if (!fronted) {
+              await agent.publisher?.publishProfile();
+              await agent.publisher?.publishGatewayPolicy?.().catch(() => {});
+              return json(res, 200, { ok: true, mode: g.mode, url: g.url });
+            }
+            await restampKeys(g.frontActor);
+            json(res, 200, { ok: true, mode: g.mode, url: g.url,
+              frontActor: g.frontActor, address: d.address || null, restarting: true });
+            selfRestart('restarting to publish under the front');
+            return;
+          }
           if (body.action === 'forget') {
             const wasLocked = g.mode === 'locked';
+            const wasFronted = !!g.frontActor;
             delete cfg.gateway; agent.store.setConfig(cfg);
             if (agent.publisher) agent.publisher.config.gateway = undefined;
             await agent.store.flush();
             if (wasLocked && inboxUrl) await agent.remote.setAcl(inboxUrl, ['Append']).catch(() => {});
+            if (wasFronted) {
+              // Going home renames every id back to the pod: key and process
+              // follow, the same way attach came.
+              await restampKeys(podActorId());
+              json(res, 200, { ok: true, mode: 'off', forgotten: true, restarting: true });
+              selfRestart('restarting under the pod\'s own ids');
+              return;
+            }
             await agent.publisher?.publishProfile();   // re-advertise the pod inbox
             return json(res, 200, { ok: true, mode: 'off', forgotten: true });
           }
-          return json(res, 400, { error: 'action must be configure, mode or forget' });
+          return json(res, 400, { error: 'action must be configure, mode, check, attach or forget' });
         }
         // Symmetrical with /block, and open for the same reason: a block made
         // by mistake is worth undoing before federation is even configured.
@@ -1534,14 +1658,17 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
   return { handler, masto, c2s, streaming };
 }
 
-export function startAdmin({ port, gateToken, agent, log = console.log, handle = null, tls = null }) {
+export function startAdmin({ port, gateToken, agent, log = console.log, handle = null, tls = null,
+  // Injectable, so a test can put a checkout ahead of the running process
+  // without editing the package.json of the machine running the test.
+  versionOnDisk = () => localVersion(projectRoot) }) {
   const gate = makeGate(gateToken);
   // Live, so the named origin appears the moment connect() reads the handle
   // out of pod state — including for the OAuth redirect check in MastoApi.
   // The https listener's port joins the authority set: same names, second port.
   const allowed = new Authorities(port, handle);
   agent.authorities = allowed;
-  const { handler, streaming } = buildAdminSurface({ agent, gate, allowed, log, port, handle });
+  const { handler, streaming } = buildAdminSurface({ agent, gate, allowed, log, port, handle, versionOnDisk });
 
   // Loopback both ways: the canonical URL is https://localhost:<port>/, and
   // "localhost" resolves to ::1 on many systems before falling back to IPv4 —

package/lib/lease.mjs

@@ -29,6 +29,7 @@ export class Lease {
     this.stopped = false;
     this.timer = null;
     this.heldUntil = 0;   // wall-clock end of the lease we last wrote
+    this.denied = null;   // why the last acquire() said no: 'unreadable' | 'held'
   }
 
   // null means the lease document is NOT THERE — nobody holds it. UNREADABLE
@@ -74,16 +75,21 @@ export class Lease {
     const cur = await this.readFresh();
     // Cannot read it: stay a viewer. A viewer that should have been active is
     // an inconvenience; two agents both draining is the destructive one.
-    if (cur === UNREADABLE) { this.log('lease unreadable — staying a viewer'); return false; }
-    if (cur && cur.holder !== this.id && Date.now() < cur.expiresAt) return false;
+    if (cur === UNREADABLE) {
+      this.denied = 'unreadable';
+      this.log('lease unreadable — staying a viewer'); return false;
+    }
+    if (cur && cur.holder !== this.id && Date.now() < cur.expiresAt) { this.denied = 'held'; return false; }
     const doc = { holder: this.id, expiresAt: Date.now() + TTL_MS };
-    if (!await this.write(doc)) return false;
+    if (!await this.write(doc)) { this.denied = 'held'; return false; }
     const confirm = await this.readFresh();
-    if (confirm === UNREADABLE || confirm?.holder !== this.id) return false;
+    if (confirm === UNREADABLE) { this.denied = 'unreadable'; return false; }
+    if (confirm?.holder !== this.id) { this.denied = 'held'; return false; }
     // From the document we WROTE, and only once the confirm agrees. Recomputing
     // it here would claim a lease that outlives what the pod's copy grants, by
     // however long the PUT and the confirming GET took.
     this.heldUntil = doc.expiresAt;
+    this.denied = null;
     return true;
   }
 

package/lib/mastoapi.mjs

@@ -12,7 +12,7 @@
 
 import crypto from 'node:crypto';
 import * as social from './social.mjs';
-import { sanitizeHtml, followsNeedApproval } from './wire.mjs';
+import { sanitizeHtml, followsNeedApproval, publicHandle } from './wire.mjs';
 import { authorOf } from './intake.mjs';
 import { profileUrl, postUrl } from './bskyfeed.mjs';
 import { Push } from './webpush.mjs';
@@ -201,7 +201,7 @@ export class MastoApi {
     // No fallback handle. `account()` already reads config for self, so a
     // literal here only ever supplies a name that is not this actor's — and it
     // was a real person's, so every install with no handle called itself jeff.
-    return this.account(this.urls.actor, { selfAcct: this.store.getConfig()?.handle || null });
+    return this.account(this.urls.actor, { selfAcct: publicHandle(this.store.getConfig()) });
   }
 
   account(actorUrl, { selfAcct } = {}) {
@@ -209,7 +209,7 @@ export class MastoApi {
     let host = '', user = cached.preferredUsername || '';
     try { host = new URL(actorUrl).host; if (!user) user = new URL(actorUrl).pathname.split('/').pop(); } catch {}
     const self = actorUrl === this.urls?.actor;
-    if (self) user = selfAcct || this.store.getConfig()?.handle || user;
+    if (self) user = selfAcct || publicHandle(this.store.getConfig()) || user;
     return {
       id: this.store.idFor(actorUrl),
       username: user,

package/lib/publisher.mjs

@@ -75,7 +75,7 @@ export class Publisher {
     const gw = this.config.gateway;
     const gwActive = gw && gw.url && gw.mode && gw.mode !== 'off';
     const actorDoc = wire.actorDoc({
-      urls, handle: this.config.handle, name: this.config.name, publicKeyPem: this.publicKeyPem,
+      urls, handle: wire.publicHandle(this.config), name: this.config.name, publicKeyPem: this.publicKeyPem,
       movedTo: this.config.movedTo || null, kind: this.config.kind,
       approveJoins: wire.followsNeedApproval(this.config),
       assertionKey: this.assertionKey,
@@ -173,7 +173,7 @@ export class Publisher {
     await this.remote.setAcl(urls.notes, ['Read']);
 
     await this.publishCollections({ ...ALL_COLLECTIONS, force });
-    const updated = await this.announceProfileChange(actor);
+    const updated = await this.announceProfileChange(actor, { force });
     await this.local.writeSettings({ handle: this.config.handle, actorUrl: urls.actor });
     await this.ensurePrivateAcls();
     const unreachable = await this.verifyPublicSurface();
@@ -188,9 +188,13 @@ export class Publisher {
       this.store.write('published.json',
         { ...this.store.read('published.json', {}), surfaceDigest: surface });
     }
-    this.log(wire.webfingerHost(urls.base)
-      ? `profile published: @${this.config.handle}@${host} → ${urls.actor}`
-      : `profile published → ${urls.actor} — NOT discoverable as @${this.config.handle}@${host}: `
+    // Named as the fediverse sees it: a fronted actor's name and host are the
+    // front's, not the pod's.
+    const pubName = wire.publicHandle(this.config);
+    const pubHost = this.config.gateway?.frontActor ? new URL(this.config.gateway.frontActor).host : host;
+    this.log(this.config.gateway?.frontActor || wire.webfingerHost(urls.base)
+      ? `profile published: @${pubName}@${pubHost} → ${urls.actor}`
+      : `profile published → ${urls.actor} — NOT discoverable as @${pubName}@${pubHost}: `
         + 'this pod is a path on a shared host, and WebFinger is only answered at a host root');
     return { unreachable, updated };
   }
@@ -208,10 +212,12 @@ export class Publisher {
   // A silent first publish was considered and is WRONG here: it would spend a
   // real edit doing nothing but recording a digest, and that edit is exactly the
   // one whose invisibility this fixes.
-  async announceProfileChange(actor) {
+  async announceProfileChange(actor, { force = false } = {}) {
     const digest = crypto.createHash('sha256').update(JSON.stringify(actor)).digest('hex').slice(0, 32);
     const seen = this.store.read('published.json', {});
-    if (seen.actorDigest === digest) return 0;
+    // A forced republish is the operator saying TELL THE WORLD — the digest
+    // gate is for silent no-op saves, not for that.
+    if (seen.actorDigest === digest && !force) return 0;
     this.store.write('published.json', { ...seen, actorDigest: digest, at: new Date().toISOString() });
     const inboxes = [...new Set(this.store.getContacts().followers
       .map(f => f.sharedInbox || f.inbox).filter(Boolean))];
@@ -350,7 +356,7 @@ export class Publisher {
     this.config.movedTo = target;                       // so the republish below carries it
     this.store.setConfig({ ...this.store.getConfig(), movedTo: target, movedAt: at });
     await this.remote.putJson(urls.actor, wire.actorDoc({
-      urls, handle: this.config.handle, name: this.config.name,
+      urls, handle: wire.publicHandle(this.config), name: this.config.name,
       publicKeyPem: this.publicKeyPem, movedTo: target, kind: this.config.kind,
       approveJoins: wire.followsNeedApproval(this.config),
       assertionKey: this.assertionKey,

package/lib/wire.mjs

@@ -21,6 +21,12 @@ export const PUBLIC = 'https://www.w3.org/ns/activitystreams#Public';
 // passing advertised ids and the writes still land on the pod. With no
 // `publicBase` the returned object is byte-identical to before — the invariant
 // the smoke suite pins.
+// The handle the fediverse sees: a fronted identity's name is the front's.
+export function publicHandle(config) {
+  return config?.gateway?.frontActor?.match(/\/u\/([^/]+)\/ap\/actor\/?$/)?.[1]
+    || config?.handle || null;
+}
+
 export function apUrls(remotePod, root = 'activitypods-js/', { publicBase = null } = {}) {
   const base = remotePod.endsWith('/') ? remotePod : remotePod + '/';
   const home = base + (!root || root.endsWith('/') ? root : root + '/');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",

package/run-agent.mjs

@@ -47,7 +47,7 @@ import { Lease } from './lib/lease.mjs';
 import { startAdmin } from './lib/admin.mjs';
 import { exposureProblem, hostLabel } from './lib/guard.mjs';
 import { pendingSteps } from './lib/migrate.mjs';
-import { apUrls, assertionKeyId } from './lib/wire.mjs';
+import { apUrls, assertionKeyId , publicHandle } from './lib/wire.mjs';
 import { followActor, unfollowActor, resolveHandle } from './lib/social.mjs';
 
 export class Agent {
@@ -358,7 +358,9 @@ export class Agent {
     this.intake.bskyGroup = null;
     if (this.viewer) {
       this.startViewer();
-      this.log(`another agent is active for this pod — viewing as @${config.handle} (read-only)`);
+      this.log(this.lease.denied === 'unreadable'
+        ? `the pod cannot be read, so the lease is unknown — viewing as @${config.handle} (read-only)`
+        : `another agent is active for this pod — viewing as @${config.handle} (read-only)`);
       return true;
     }
     await this.startActive({ repair });
@@ -537,7 +539,9 @@ export class Agent {
     this.schedTimer.unref();
     // A CSV import interrupted by a restart or a handoff picks back up here.
     this.importer?.resume();
-    this.log(`federating as @${this.store.getConfig()?.handle}@${new URL(this.urls.base).host}`);
+    // The identity the fediverse actually sees: a fronted actor's name and
+    // host are the front's, not the pod's.
+    this.log(`federating as @${publicHandle(this.store.getConfig())}@${new URL(this.urls.actor).host}`);
     if (this.renamed) {
       // The display name lives in the actor document, so a rename only
       // reaches other servers once that is republished.

package/web/admin/admin.js

@@ -141,7 +141,8 @@ function render() {
     ['local host', (origins.named || origins.loopback || `http://localhost:${config.port}`)
       .replace(/\/$/, '')],
   ];
-  if (config.update || config.pendingUpgrade?.length) rows.push(['software', 'ctl']);
+  if (config.version || config.update || config.pendingUpgrade?.length) rows.push(['software', 'ctl']);
+  rows.push(['gateway', 'ctl']);
   if (config.quiescedAt) rows.push(['parked since', config.quiescedAt]);
   if (config.movedTo) rows.push(['moved to', config.movedTo]);
   // A person gates followers here; a group's gate is the joins control on its
@@ -185,13 +186,23 @@ function render() {
       FOLLOWS_CTL.hidden = false;
       FOLLOWS_PICK.value = config.autoAcceptFollows ? 'auto' : 'approve';
     }
+    if (k === 'gateway') {
+      dd.textContent = '';
+      dd.append(GATEWAY_CTL);
+      refreshGateway();
+    }
     if (k === 'software') {
       dd.textContent = '';
       dd.append(UPDATE_CTL);
       UPDATE_CTL.hidden = false;
       const u = config.update;
+      // The version this agent is running, never the one sitting in the
+      // checkout — saying otherwise would name a version nobody is serving.
+      const running = config.version || u?.current || null;
       const words = [];
-      if (u) words.push(u.available ? `FediPod ${u.current} — ${u.latest} available` : `FediPod ${u.current}`);
+      if (running) words.push(u?.available ? `FediPod ${running} — ${u.latest} available` : `FediPod ${running}`);
+      if (config.versionOnDisk && running && config.versionOnDisk !== running)
+        words.push(`${config.versionOnDisk} is on disk — restart to run it`);
       if (config.pendingUpgrade?.length) words.push('older data layout — run `fedipod upgrade` in a terminal');
       UPDATE_WORD.textContent = words.join('; ');
       UPDATE_GO.hidden = !u?.available;
@@ -931,9 +942,95 @@ async function renderInbox() {
   panel.hidden = false;
 }
 
-// The inbox-gateway / multi-user-front operator panel is parked: not shown in
-// the UI yet. The backend routes (GET/POST /gateway) still exist and work, so
-// this can be re-added when the feature is ready to expose.
+// The gateway, as a facts row under software: attach through a multi-user
+// front with this agent's own credential, detach back to the pod inbox. The
+// forms live in the floating window, like every other disclosure.
+const GATEWAY_CTL = $('gateway-ctl');           // held: it rides into a generated row
+const GATEWAY_WORD = $('gateway-word');
+const GW_OPEN_ATTACH = $('gateway-open-attach');
+const GW_OPEN_DETACH = $('gateway-open-detach');
+let gwState = null;
+async function refreshGateway() {
+  const { status, json: g } = await api('/gateway');
+  if (status !== 200 || !g) return;
+  gwState = g;
+  GATEWAY_CTL.hidden = false;
+  if (g.configured) {
+    let host = g.url;
+    try { host = new URL(g.url).host; } catch { /* show it as-is */ }
+    const frontName = g.frontActor?.match(/\/u\/([^/]+)\/ap\/actor\/?$/)?.[1];
+    GATEWAY_WORD.textContent = frontName ? `${host} — publishing as @${frontName}@${host}` : host;
+    GW_OPEN_ATTACH.hidden = true;
+    GW_OPEN_DETACH.hidden = false;
+  } else {
+    GATEWAY_WORD.textContent = '';
+    GW_OPEN_ATTACH.hidden = false;
+    GW_OPEN_DETACH.hidden = true;
+  }
+}
+const gwShape = () => document.querySelector('input[name=gwShape]:checked')?.value || 'pod';
+function gwPreviews() {
+  $('gw-pod-preview').textContent = config?.address || `@${config?.handle || 'you'}@your.pod`;
+  try { $('gw-front-host').textContent = new URL($('gw-front').value.trim()).host; }
+  catch { /* not a URL yet — the placeholder host stands */ }
+}
+function gwShapeChanged() { gwPreviews(); gwCheck(); }
+for (const r of document.querySelectorAll('input[name=gwShape]')) r.addEventListener('change', gwShapeChanged);
+// Typing in the blank IS choosing that shape.
+$('gw-name').addEventListener('focus', () => {
+  const r = document.querySelector('input[name=gwShape][value=front]');
+  if (!r.checked) { r.checked = true; gwShapeChanged(); }
+});
+GW_OPEN_ATTACH.addEventListener('click', () => {
+  gwShapeChanged();
+  solWindow.show('gateway-attach-form', 'Attach to a gateway');
+});
+GW_OPEN_DETACH.addEventListener('click', () => {
+  $('gw-detach-fronted').hidden = !gwState?.frontActor;
+  $('gw-detach-plain').hidden = !!gwState?.frontActor;
+  solWindow.show('gateway-detach-form', 'Detach from gateway');
+});
+// Live availability, asked through the agent (the front answers it without CORS).
+let gwTimer = null;
+function gwCheck() {
+  clearTimeout(gwTimer);
+  const front = $('gw-front').value.trim().replace(/\/+$/, '');
+  const name = $('gw-name').value.trim().toLowerCase();
+  $('gw-name-msg').textContent = ''; $('gw-name-msg').className = 'hint';
+  if (gwShape() !== 'front' || !front || !name) return;
+  gwTimer = setTimeout(async () => {
+    const { status, json } = await postJson('/gateway', { action: 'check', front, handle: name });
+    if (status !== 200 || !json) return;
+    $('gw-name-msg').textContent = json.available
+      ? `${name} is free at ${front.replace(/^https?:\/\//, '')}`
+      : (json.reason || 'that name is taken');
+    $('gw-name-msg').className = json.available ? 'hint' : 'warn';
+  }, 300);
+}
+$('gw-front').addEventListener('input', () => { gwPreviews(); gwCheck(); });
+$('gw-name').addEventListener('input', () => { gwPreviews(); gwCheck(); });
+$('gw-attach').addEventListener('click', async () => {
+  const front = $('gw-front').value.trim().replace(/\/+$/, '');
+  const fronted = gwShape() === 'front';
+  const name = $('gw-name').value.trim().toLowerCase();
+  if (fronted && !name) { say('give the handle you want at the gateway', 'err'); return; }
+  $('gw-attach').disabled = true;
+  // Pod-based sends no name: the door's label is the agent's business, not
+  // the user's, and the agent picks a free variant by itself.
+  const r = await write('/gateway',
+    { action: 'attach', front, ...(fronted ? { handle: name, fronted: true } : {}) },
+    fronted ? 'attached — the agent is restarting to publish under the gateway handle; reload in a moment'
+      : 'attached — your mail now arrives through the gateway, filtered');
+  $('gw-attach').disabled = false;
+  if (r) { closePanels(); refreshGateway(); }
+});
+$('gw-detach').addEventListener('click', async () => {
+  const fronted = !!gwState?.frontActor;
+  const r = await write('/gateway', { action: 'forget' },
+    fronted ? 'detached — the agent is restarting under your pod\'s own name; reload in a moment'
+      : 'detached — the actor was republished advertising your pod\'s own inbox');
+  if (r) { closePanels(); refreshGateway(); }
+});
 
 $('inbox-keep').addEventListener('click', () => {
   dismissed = true;

package/web/admin/index.html

@@ -15,14 +15,14 @@
 :root { color-scheme: light dark; font-size: 112.5%;
   --bar-col: 1280px;                 /* the bar centres on the same column */
   --link: #1a4f8a; --heading: #5b3a8e;
-  --ink: #1b1c1e; --muted: #5f6368;
+  --ink: #1b1c1e; --muted: #4a4e53;
   --btn-bg: #f4efe6; --btn-bg-hover: #ece3d2; --btn-bg-active: #e2d5bd; --btn-edge: #8a7a61;
   --field-bg: #ffffff; --field-bg-hover: #f7f4ee; --field-edge: #767676;
   --danger: #b00020; --ring: var(--link);
   --chevron: url("data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' width='10' height='6'><path d='M1 1l4 4 4-4' fill='none' stroke='%23444444' stroke-width='1.6' stroke-linecap='round'/></svg>"); }
 @media (prefers-color-scheme: dark) {
   :root { --link: #7fb3e8; --heading: #b9a3e3;
-    --ink: #e8eaed; --muted: #a5a9ad;
+    --ink: #e8eaed; --muted: #b9bdc2;
     --btn-bg: #35302a; --btn-bg-hover: #423b31; --btn-bg-active: #4d4436; --btn-edge: #9a8d7a;
     --field-bg: #383d44; --field-bg-hover: #40464e; --field-edge: #9aa0a6;
     --danger: #ff8a8a;
@@ -98,7 +98,8 @@ p { margin: .5rem 0; }
 fieldset { border: 1px solid #bbb; border-radius: .4rem; margin: 1rem 0; padding: .75rem 1rem 1rem; }
 legend { padding: 0 .3rem; font-weight: 600; color: var(--heading); }
 label { display: block; margin: .75rem 0 .2rem; }
-.hint { color: var(--muted); font-size: .9rem; margin: .15rem 0 0; }
+.hint { color: var(--muted); font-size: 1rem; margin: .15rem 0 0; }
+.choice input[type=text] { width: 9ch; display: inline-block; padding: .15rem .3rem; }
 /* SETTINGS: light wells, unmistakably fields, in both schemes. */
 input[type=text], input[type=email], input[type=url], input[type=password], textarea {
   font: inherit; width: 100%; padding: .5rem; box-sizing: border-box;
@@ -314,9 +315,13 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
   </span>
 </section>
 
-<!-- The inbox-gateway / multi-user-front controls are deliberately not shown
-     in the UI yet. The backend routes (GET/POST /gateway) exist and work; the
-     operator surface is parked until the feature is ready to expose. -->
+<span id="gateway-ctl" hidden>
+  <span id="gateway-word"></span>
+  <button type="button" id="gateway-open-attach" class="inline" hidden
+    title="   Attach this account to a mail-filtering gateway">Attach to a gateway</button>
+  <button type="button" id="gateway-open-detach" class="inline danger" hidden
+    title="   Go back to your pod's own inbox">Detach from gateway</button>
+</span>
 
 <section id="pane-group" hidden>
   <!-- Both queues are consequences of a moderation setting: with the setting off
@@ -421,6 +426,45 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
 <!-- Every consequence is written here rather than assembled in script: the
      page asking "are you sure" has to say what it is sure about, and this is
      the only record of it. Script picks which block to show, nothing else. -->
+<!-- The gateway popups: attach proves the pod with this agent's own credential;
+     detach republishes the pod's own inbox. -->
+<form id="gateway-attach-form" hidden>
+  <p class="hint">A gateway filters your fediverse mail before it reaches your pod: each
+    delivery is verified at its door, spam is dropped, and the rest lands in your pod as
+    before. Attaching proves the pod with this agent's own credential — no password
+    leaves this machine.</p>
+  <label for="gw-front">gateway</label>
+  <input type="url" id="gw-front" placeholder="https://fedipod.net" autocomplete="off">
+  <fieldset>
+    <legend>Your fediverse handle</legend>
+    <label class="choice"><input type="radio" name="gwShape" value="pod" checked>
+      Keep my pod-based handle: <strong id="gw-pod-preview"></strong><br>
+      <span class="hint">Your address stays tied to your own pod — you can drop the
+        gateway any time and keep everything.</span></label>
+    <label class="choice"><input type="radio" name="gwShape" value="front">
+      Create a handle at the gateway:
+      @<input type="text" id="gw-name" placeholder="name" autocomplete="off"
+        autocapitalize="off" spellcheck="false">@<span id="gw-front-host">fedipod.net</span><br>
+      <span class="hint">Your address lives on the gateway's domain, but not your data
+        or key; you can change pods later and keep the handle.</span>
+      <span id="gw-name-msg" class="hint"></span></label>
+  </fieldset>
+  <p>
+    <button id="gw-attach" type="button" class="primary"
+      title="   Create the gateway account and point your mail through its door">Attach</button>
+  </p>
+</form>
+<form id="gateway-detach-form" hidden>
+  <p class="hint" id="gw-detach-plain">Deliveries go back to your pod's own inbox — the
+    actor is republished advertising it. Your name and data never moved.</p>
+  <p class="warn" id="gw-detach-fronted" hidden>This identity publishes under the gateway's
+    name. Detaching moves every published id back to the pod — a rename other servers
+    see, not just a mail change.</p>
+  <p>
+    <button id="gw-detach" type="button" class="primary"
+      title="   Forget the gateway and republish the actor with the pod inbox">Detach</button>
+  </p>
+</form>
 <form id="confirm-form" hidden>
   <div id="warn-rotate-key" class="warn" hidden>
     <p>A new keypair replaces the one in this home and the actor is republished so other

package/web/front/new-account.html

@@ -3,422 +3,41 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>FediPod — keep your name, lose the noise</title>
+<title>FediPod — access the Fediverse and ATProto from a Solid pod</title>
 <style>
   :root { color-scheme: light dark; --line:#d9d4c7; --dim:#45443d; --accent:#6a8a5a; }
   @media (prefers-color-scheme: dark) { :root { --dim:#c2c0b4; } }
   body { font: 19px/1.6 system-ui, sans-serif; max-width: 44rem; margin: 2rem auto; padding: 0 1.1rem; }
   h1 { font-size: 1.7rem; margin: 0 0 .2rem; }
-  h2 { font-size: 1.2rem; margin: 0 0 .4rem; }
+  h2 { font-size: 1.2rem; margin: 1.4rem 0 .4rem; }
   p.lede { color: var(--dim); margin-top: 0; }
-  fieldset { border: 1px solid var(--line); border-radius: 12px; padding: 1rem 1.1rem; margin: 1rem 0; }
-  legend { font-weight: 600; padding: 0 .4rem; }
-  .choices { display: flex; flex-direction: column; gap: .5rem; }
-  .choices button { padding: .7rem .8rem; border: 1px solid var(--line); border-radius: 10px;
-    background: transparent; font: inherit; cursor: pointer; text-align: left; }
-  .choices button[aria-pressed="true"] { border-color: var(--accent); box-shadow: inset 0 0 0 1px var(--accent); }
-  .choices button b { display: block; }
-  .choices button span { color: var(--dim); font-size: .95rem; }
-  label { display: block; font-weight: 600; margin: .8rem 0 .2rem; }
-  input[type=text], input[type=url] { width: 100%; padding: .5rem .6rem; font: inherit;
-    border: 1px solid var(--line); border-radius: 8px; box-sizing: border-box; }
-  .msg { min-height: 1.3em; font-size: .95rem; margin-top: .3rem; }
-  .msg.ok { color: var(--accent); } .msg.no { color: #a4433a; }
   .hint { color: var(--dim); font-size: .95rem; }
-  .primary { background: var(--accent); color: #fff; border: none; border-radius: 9px;
-    padding: .6rem 1.1rem; font: inherit; cursor: pointer; }
-  .primary[disabled] { opacity: .5; cursor: not-allowed; }
-  [hidden] { display: none !important; }
   code { background: rgba(120,120,120,.12); padding: .05em .35em; border-radius: 4px; }
   pre { background: rgba(120,120,120,.12); padding: .7rem .9rem; border-radius: 8px; overflow-x: auto; }
   ol.steps li { margin: .5rem 0; }
+  [hidden] { display: none !important; }
 </style>
 </head>
 <body>
 <h1>FediPod - join the fediverse from a Solid pod.</h1>
-<p class="lede">Welcome to the <strong>FediPod.net gateway</strong>.  Here, you can get a free pod and fediverse account or link to your existing pod/account. This gateway is a mail filter for accounts that stay yours. Your name, key and data live on your own pod; this box only receives your fediverse mail, verifies each delivery, drops spam and passes the rest to your pod.</p>
+<p class="lede">Welcome to <b>FediPod</b>! Here, you can get a free pod and fediverse account or link to your existing pod/account.</p>
+
+<p class="hint" id="current-version" hidden>Current FediPod: <strong id="current-version-num"></strong><br>
+ — install or update an existing install with <code id="current-version-cmd"></code></p>
 
 <p>
 FediPod is experimental and free to use.  See the <a href="https://github.com/jeff-zucker/FediPod">FediPod repository</a> for details.
 </p>
 
-<p class="hint" id="current-version" hidden>Current FediPod: <strong id="current-version-num"></strong>
- — update an existing install with <code id="current-version-cmd"></code></p>
-
-<fieldset>
-  <legend>What do you want to do?</legend>
-  <div class="choices" role="group" aria-label="Path">
-    <button type="button" id="pick-solo" aria-pressed="false"><b>Create a new solo account</b><span>a fediverse account for one person, on a pod you own</span></button>
-    <button type="button" id="pick-group" aria-pressed="false"><b>Create a new group account</b><span>an account people join &mdash; it carries members' posts to the whole group</span></button>
-    <button type="button" id="pick-manage" aria-pressed="false"><b>Manage an existing account</b><span>attach it to this gateway, detach it, or transfer in</span></button>
-  </div>
-</fieldset>
-
-<!-- create: the signup itself — prove the pod, take the name, then install -->
-<form id="create-form" hidden>
-  <h2 id="create-title">Create a new solo account</h2>
-  <p class="hint" id="create-group-hint" hidden>A group is an account people join: members post to it, and it
-    carries each member's post to everyone in the group. Mastodon users can join with no pod of their own.
-    A group needs a pod of its own.</p>
-  <p class="hint">Your account lives on a pod you own; this gateway filters its mail.</p>
-
-  <label for="create-pod">Your pod address</label>
-  <input type="url" id="create-pod" autocomplete="off" placeholder="https://you.solidcommunity.net/">
-  <p class="hint">No pod yet? Any Solid pod host that offers <em>https subdomains</em> works, or a Community
-    Solid Server you run yourself. Get the pod, then come back here.</p>
-  <p id="create-pods" class="hint" hidden>This host also offers pods — you can take one instead of bringing
-    your own; it stays exportable, so you can leave with everything.</p>
-
-  <label for="create-issuer">Where you log in (your identity provider)</label>
-  <input type="url" id="create-issuer" autocomplete="off" placeholder="https://solidcommunity.net">
-
-  <label for="create-handle">Your handle (the name in your address; permanent)</label>
-  <input type="text" id="create-handle" autocomplete="off" autocapitalize="off" spellcheck="false"
-    inputmode="latin" placeholder="you" aria-describedby="create-handle-msg">
-  <p class="msg" id="create-handle-msg" aria-live="polite"></p>
-
-  <label>Your fediverse address</label>
-  <div class="choices" role="group" aria-label="Address">
-    <button type="button" id="addr-pod" aria-pressed="false"><b id="addr-pod-name">@you@your.pod</b><span>your handle is tied to your pod &mdash; you can drop the gateway and keep everything</span></button>
-    <button type="button" id="addr-front" aria-pressed="false"><b id="addr-front-name">@you@this.host</b><span>your handle is tied to the gateway &mdash; you can move pods and keep your handle</span></button>
-  </div>
-
-  <p style="margin-top:1.1rem">
-    <button type="button" id="create-continue" class="primary" disabled>Sign in with your pod &amp; create</button>
-  </p>
-  <p class="hint">Signing in proves the pod is yours — no password ever reaches this gateway.</p>
-  <p class="hint" id="create-note" hidden></p>
-</form>
-
-<!-- what a finished signup hands over: the one install command -->
-<section id="create-done" hidden></section>
-
-<!-- manage: the existing-account actions, one panel each -->
-<section id="manage-form" hidden>
-  <div class="choices" role="group" aria-label="Manage">
-    <button type="button" id="pick-attach" aria-pressed="false"><b>Attach to this gateway</b><span>filter your mail through this door &mdash; your address stays yours</span></button>
-    <button type="button" id="pick-detach" aria-pressed="false"><b>Detach from this gateway</b><span>go back to unfiltered delivery</span></button>
-    <button type="button" id="pick-transfer" aria-pressed="false"><b>Transfer a fediverse account to FediPod</b><span>move here from Mastodon and friends</span></button>
-  </div>
-</section>
-
-<!-- attach: an existing FediPod points its inbox here; identity stays put -->
-<form id="attach-form" hidden>
-  <h2>Attach an existing FediPod account</h2>
-  <p class="hint">Your account stays <code>@you@your.pod</code> — other servers keep finding you at your own
-    address. Attaching only changes where your <em>mail</em> arrives: your actor advertises this gateway's door
-    as its inbox, and everything that passes verification lands in your pod as before.</p>
-
-  <label for="pod-url">Your pod address</label>
-  <input type="url" id="pod-url" autocomplete="off" placeholder="https://you.solidcommunity.net/">
-  <p class="hint">If your FediPod uses a custom root, give the full home URL (ending in <code>/</code>);
-    a bare pod address assumes the default <code>activitypods-js/</code>.</p>
-
-  <label for="issuer">Where you log in (your identity provider)</label>
-  <input type="url" id="issuer" autocomplete="off" placeholder="https://solidcommunity.net">
-
-  <label for="slug">Your door's name here</label>
-  <input type="text" id="slug" autocomplete="off" autocapitalize="off" spellcheck="false"
-    inputmode="latin" placeholder="you" aria-describedby="slug-msg">
-  <p class="msg" id="slug-msg" aria-live="polite"></p>
-  <p class="hint">Only the door is named here — it is a routing address for servers, not your handle.</p>
-
-  <p style="margin-top:1.1rem">
-    <button type="button" id="attach-continue" class="primary" disabled>Sign in with your pod &amp; attach</button>
-  </p>
-  <p class="hint">Signing in proves the pod is yours — no password ever reaches this gateway.</p>
-  <p class="hint" id="attach-note" hidden></p>
-</form>
-
-<!-- detach: done on the user's own agent; the gateway cannot reach in -->
-<section id="detach-form" hidden>
-  <h2>Detach an existing FediPod account</h2>
-  <p class="hint">Detaching is yours to do, not this gateway's — your agent republishes your actor with your
-    pod's own inbox, and deliveries go straight there again. On your machine:</p>
-  <pre>node bin/fedipod.mjs gateway --detach</pre>
-  <p class="hint">Your name and data never moved, so nothing else changes. The door you had here goes quiet
-    and its name can be reused.</p>
-</section>
-
-<!-- transfer: the standard fediverse move, aimed at a FediPod -->
-<section id="transfer-form" hidden>
-  <h2>Transfer a fediverse account to FediPod</h2>
-  <p class="hint">The fediverse's standard migration works toward a FediPod: your followers move over
-    automatically, and your old profile redirects. Posts stay on the old server — no fediverse migration
-    carries them.</p>
-  <ol class="steps">
-    <li><strong>Have a FediPod</strong> — create one first (the first option above).</li>
-    <li>On your agent's admin page, set <strong>new followers</strong> to <em>accepted automatically</em>,
-      so the wave of arriving followers doesn't queue.</li>
-    <li>Tell your FediPod about the old account:
-      <pre>node bin/fedipod.mjs alias --add @you@old.server</pre></li>
-    <li>On the old server: Preferences → Account → <em>Move to a different account</em>, naming your
-      FediPod address.</li>
-    <li>Bring the rest over from the old server's CSV export:
-      <pre>node bin/fedipod.mjs import following_accounts.csv blocked_accounts.csv muted_accounts.csv lists.csv</pre></li>
-  </ol>
-</section>
-
-<script src="/solid-client-authn.bundle.js"></script>
 <script>
-  const $ = (id) => document.getElementById(id);
-  let offersPods = false, slugOk = false;
-
   fetch('/api/handle?handle=__probe__').then(r => r.json()).then(d => {
-    offersPods = !!d.offersPods;
-    $('create-pods').hidden = !offersPods;
     if (d.version) {
-      $('current-version-num').textContent = d.version;
-      $('current-version-cmd').textContent = `curl -fsSL ${location.origin}/install | sh`;
-      $('current-version').hidden = false;
+      document.getElementById('current-version-num').textContent = d.version;
+      document.getElementById('current-version-cmd').textContent = `curl -fsSL ${location.origin}/install | sh`;
+      document.getElementById('current-version').hidden = false;
     }
   }).catch(() => {});
-
-  const picks = ['pick-solo', 'pick-group', 'pick-manage'];
-  const panels = { 'pick-solo': 'create-form', 'pick-group': 'create-form',
-    'pick-manage': 'manage-form' };
-  const subPicks = ['pick-attach', 'pick-detach', 'pick-transfer'];
-  const subPanels = { 'pick-attach': 'attach-form', 'pick-detach': 'detach-form',
-    'pick-transfer': 'transfer-form' };
-  let createKind = 'person';
-  function subPick(which) {
-    for (const id of subPicks) {
-      $(id).setAttribute('aria-pressed', String(id === which));
-      $(subPanels[id]).hidden = id !== which;
-    }
-  }
-  function pick(which) {
-    for (const id of picks) $(id).setAttribute('aria-pressed', String(id === which));
-    for (const panel of new Set(Object.values(panels))) $(panel).hidden = panels[which] !== panel;
-    $('create-done').hidden = true;
-    if (which !== 'pick-manage') subPick(null);
-    if (panels[which] === 'create-form') {
-      createKind = which === 'pick-group' ? 'group' : 'person';
-      $('create-title').textContent = createKind === 'group'
-        ? 'Create a new group account' : 'Create a new solo account';
-      $('create-group-hint').hidden = createKind !== 'group';
-    }
-  }
-  for (const id of picks) $(id).onclick = () => pick(id);
-  for (const id of subPicks) $(id).onclick = () => subPick(id);
-
-  // Suggest the door name from the pod's own first label, and the identity
-  // provider from the pod's apex domain — both still editable.
-  $('pod-url').addEventListener('input', () => {
-    try {
-      const u = new URL($('pod-url').value.trim());
-      const label = u.hostname.split('.')[0];
-      if (!$('slug').value && /^[a-z0-9-]{1,63}$/.test(label)) {
-        $('slug').value = label;
-        $('slug').dispatchEvent(new Event('input'));
-      }
-      if (!$('issuer').value) {
-        const parts = u.hostname.split('.');
-        $('issuer').value = 'https://' + (parts.length > 2 ? parts.slice(1).join('.') : u.hostname);
-      }
-    } catch { /* not a URL yet */ }
-    refresh();
-  });
-  $('issuer').addEventListener('input', refresh);
-
-  let t = null;
-  $('slug').addEventListener('input', () => {
-    slugOk = false; $('slug-msg').textContent = ''; $('slug-msg').className = 'msg';
-    clearTimeout(t);
-    const h = $('slug').value.trim().toLowerCase();
-    if (!h) { refresh(); return; }
-    t = setTimeout(async () => {
-      try {
-        const d = await (await fetch('/api/handle?handle=' + encodeURIComponent(h))).json();
-        slugOk = d.available;
-        $('slug-msg').textContent = d.available ? 'this door is free' : (d.reason || 'taken');
-        $('slug-msg').className = 'msg ' + (d.available ? 'ok' : 'no');
-      } catch { $('slug-msg').textContent = 'could not check'; $('slug-msg').className = 'msg no'; }
-      refresh();
-    }, 250);
-  });
-
-  function refresh() {
-    const podOk = /^https:\/\/\S+/.test($('pod-url').value.trim());
-    const issuerOk = /^https:\/\/\S+/.test($('issuer').value.trim());
-    $('attach-continue').disabled = !(podOk && slugOk && issuerOk);
-  }
-
-  // The user's pod home: their agent tree on the pod. A bare pod root gets
-  // the default root; anything with a path is taken as given.
-  function podHomeOf(raw) {
-    const u = new URL(raw.trim());
-    if (u.pathname === '/') u.pathname = '/activitypods-js/';
-    else if (!u.pathname.endsWith('/')) u.pathname += '/';
-    u.search = ''; u.hash = '';
-    return u.href;
-  }
-
-  $('attach-continue').onclick = () => {
-    const auth = window.solidClientAuthentication;
-    const n = $('attach-note');
-    if (!auth) { n.hidden = false; n.textContent = 'the sign-in library did not load — reload and try again'; return; }
-    sessionStorage.setItem('fp-attach', JSON.stringify({
-      slug: $('slug').value.trim().toLowerCase(),
-      podHome: podHomeOf($('pod-url').value),
-      kind: 'person',
-    }));
-    auth.login({
-      oidcIssuer: $('issuer').value.trim(),
-      redirectUrl: location.origin + '/',
-      clientName: 'FediPod gateway',
-    }).catch((e) => { n.hidden = false; n.textContent = 'sign-in failed to start: ' + e.message; });
-  };
-
-  // ---- the create (signup) form ----
-  let createSlugOk = false, addrShape = null;
-  const esc = (s) => String(s).replace(/[&<>"']/g, (c) =>
-    ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
-
-  // The two address previews follow the handle and pod as they are typed.
-  function addrPreview() {
-    const h = $('create-handle').value.trim().toLowerCase() || 'you';
-    let podHost = 'your.pod';
-    try { podHost = new URL($('create-pod').value.trim()).hostname; } catch { /* not a URL yet */ }
-    $('addr-pod-name').textContent = `@${h}@${podHost}`;
-    $('addr-front-name').textContent = `@${h}@${location.host}`;
-  }
-  function createRefresh() {
-    const podOk = /^https:\/\/\S+/.test($('create-pod').value.trim());
-    const issuerOk = /^https:\/\/\S+/.test($('create-issuer').value.trim());
-    $('create-continue').disabled = !(podOk && issuerOk && createSlugOk && addrShape);
-  }
-  $('addr-pod').onclick = () => { addrShape = 'pod';
-    $('addr-pod').setAttribute('aria-pressed', 'true');
-    $('addr-front').setAttribute('aria-pressed', 'false'); createRefresh(); };
-  $('addr-front').onclick = () => { addrShape = 'front';
-    $('addr-front').setAttribute('aria-pressed', 'true');
-    $('addr-pod').setAttribute('aria-pressed', 'false'); createRefresh(); };
-
-  $('create-pod').addEventListener('input', () => {
-    try {
-      const u = new URL($('create-pod').value.trim());
-      const label = u.hostname.split('.')[0];
-      if (!$('create-handle').value && /^[a-z0-9-]{1,63}$/.test(label)) {
-        $('create-handle').value = label;
-        $('create-handle').dispatchEvent(new Event('input'));
-      }
-      if (!$('create-issuer').value) {
-        const parts = u.hostname.split('.');
-        $('create-issuer').value = 'https://' + (parts.length > 2 ? parts.slice(1).join('.') : u.hostname);
-      }
-    } catch { /* not a URL yet */ }
-    addrPreview(); createRefresh();
-  });
-  $('create-issuer').addEventListener('input', createRefresh);
-
-  let ct = null;
-  $('create-handle').addEventListener('input', () => {
-    createSlugOk = false; $('create-handle-msg').textContent = ''; $('create-handle-msg').className = 'msg';
-    addrPreview();
-    clearTimeout(ct);
-    const h = $('create-handle').value.trim().toLowerCase();
-    if (!h) { createRefresh(); return; }
-    ct = setTimeout(async () => {
-      try {
-        const d = await (await fetch('/api/handle?handle=' + encodeURIComponent(h))).json();
-        createSlugOk = d.available;
-        $('create-handle-msg').textContent = d.available ? 'this name is free' : (d.reason || 'taken');
-        $('create-handle-msg').className = 'msg ' + (d.available ? 'ok' : 'no');
-      } catch { $('create-handle-msg').textContent = 'could not check'; $('create-handle-msg').className = 'msg no'; }
-      createRefresh();
-    }, 250);
-  });
-
-  $('create-continue').onclick = () => {
-    const auth = window.solidClientAuthentication;
-    const n = $('create-note');
-    if (!auth) { n.hidden = false; n.textContent = 'the sign-in library did not load — reload and try again'; return; }
-    sessionStorage.setItem('fp-create', JSON.stringify({
-      slug: $('create-handle').value.trim().toLowerCase(),
-      podHome: podHomeOf($('create-pod').value),
-      issuer: $('create-issuer').value.trim(),
-      kind: createKind,
-      fronted: addrShape === 'front',
-    }));
-    auth.login({
-      oidcIssuer: $('create-issuer').value.trim(),
-      redirectUrl: location.origin + '/',
-      clientName: 'FediPod gateway',
-    }).catch((e) => { n.hidden = false; n.textContent = 'sign-in failed to start: ' + e.message; });
-  };
-
-  // Back from the identity provider: finish the signup with the proven login.
-  (async () => {
-    const auth = window.solidClientAuthentication;
-    if (!auth) return;
-    const info = await auth.handleIncomingRedirect().catch(() => null);
-    const pending = sessionStorage.getItem('fp-create');
-    if (!info?.isLoggedIn || !pending) return;
-    sessionStorage.removeItem('fp-create');
-    const p = JSON.parse(pending);
-    pick(p.kind === 'group' ? 'pick-group' : 'pick-solo');
-    const n = $('create-note');
-    n.hidden = false;
-    n.textContent = 'signed in as ' + info.webId + ' — creating…';
-    const res = await auth.fetch('/api/attach', {
-      method: 'POST', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ handle: p.slug, podHome: p.podHome, kind: p.kind, fronted: p.fronted }),
-    }).catch(() => null);
-    const d = res ? await res.json().catch(() => ({})) : {};
-    if (res && res.status === 201) {
-      const address = p.fronted ? d.address : `@${p.slug}@${new URL(p.podHome).hostname}`;
-      const flags = [
-        `--gateway ${d.frontActor || d.doorInbox}`,
-        `--secret ${d.hmacSecret}`,
-        `--pod ${p.podHome}`,
-        `--issuer ${p.issuer}`,
-        `--handle ${p.slug}`,
-        `--kind ${p.kind}`,
-        ...(p.fronted ? ['--fronted'] : []),
-      ];
-      const cmd = `curl -fsSL ${location.origin}/install | sh -s -- \\\n  ` + flags.join(' \\\n  ');
-      $('create-form').hidden = true;
-      const done = $('create-done');
-      done.hidden = false;
-      done.innerHTML = '<h2>' + esc(address) + '</h2>'
-        + '<p>Created. Now install your agent on the machine it will live on — one command, then start it:</p>'
-        + '<pre>' + esc(cmd) + '\n\nfedipod start</pre>'
-        + '<p>Setup opens in your browser with everything already filled in. When it finishes, your '
-        + 'account is live and your mail arrives through this gateway, filtered.</p>';
-    } else {
-      n.textContent = 'signup failed: ' + (d.error || (res ? 'HTTP ' + res.status : 'no response'));
-    }
-  })();
-
-  // Back from the identity provider: finish the attach with the proven login.
-  (async () => {
-    const auth = window.solidClientAuthentication;
-    if (!auth) return;
-    const info = await auth.handleIncomingRedirect().catch(() => null);
-    const pending = sessionStorage.getItem('fp-attach');
-    if (!info?.isLoggedIn || !pending) return;
-    sessionStorage.removeItem('fp-attach');
-    const p = JSON.parse(pending);
-    pick('pick-manage');
-    subPick('pick-attach');
-    const n = $('attach-note');
-    n.hidden = false;
-    n.textContent = 'signed in as ' + info.webId + ' — attaching…';
-    const res = await auth.fetch('/api/attach', {
-      method: 'POST', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ handle: p.slug, podHome: p.podHome, kind: p.kind }),
-    }).catch(() => null);
-    const d = res ? await res.json().catch(() => ({})) : {};
-    if (res && res.status === 201) {
-      n.innerHTML = 'Attached. Run this on the machine your agent lives on, then restart the agent:'
-        + '<pre>' + d.command + '</pre>'
-        + 'Your mail then arrives through <code>' + d.doorInbox + '</code>, filtered. Your name has not moved.';
-    } else {
-      n.textContent = 'attach failed: ' + (d.error || (res ? 'HTTP ' + res.status : 'no response'));
-    }
-  })();
 </script>
-<i>(cc) 4.0 By, Jeff Zucker, 2026</i>
+<i style="text-align:right">(cc) 4.0 By, Jeff Zucker, 2026</i>
 </body>
 </html>

package/web/front/new-account.html~

@@ -0,0 +1,50 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>FediPod — access the Fediverse and ATProto from a Solid pod</title>
+<style>
+  :root { color-scheme: light dark; --line:#d9d4c7; --dim:#45443d; --accent:#6a8a5a; }
+  @media (prefers-color-scheme: dark) { :root { --dim:#c2c0b4; } }
+  body { font: 19px/1.6 system-ui, sans-serif; max-width: 44rem; margin: 2rem auto; padding: 0 1.1rem; }
+  h1 { font-size: 1.7rem; margin: 0 0 .2rem; }
+  h2 { font-size: 1.2rem; margin: 1.4rem 0 .4rem; }
+  p.lede { color: var(--dim); margin-top: 0; }
+  .hint { color: var(--dim); font-size: .95rem; }
+  code { background: rgba(120,120,120,.12); padding: .05em .35em; border-radius: 4px; }
+  pre { background: rgba(120,120,120,.12); padding: .7rem .9rem; border-radius: 8px; overflow-x: auto; }
+  ol.steps li { margin: .5rem 0; }
+  [hidden] { display: none !important; }
+</style>
+</head>
+<body>
+<h1>FediPod - join the fediverse from a Solid pod.</h1>
+<p class="lede">Welcome to <b>FediPod</b! Here, you can get a free pod and fediverse account or link to your existing pod/account.</p>
+
+
+<p>
+FediPod is experimental and free to use.  See the <a href="https://github.com/jeff-zucker/FediPod">FediPod repository</a> for details.
+</p>
+
+<p class="hint" id="current-version" hidden>Current FediPod: <strong id="current-version-num"></strong><br>
+ — update an existing install with <code id="current-version-cmd"></code></p>
+
+<script>
+  // Another host deploying this front serves the same page: the command names
+  // that host, not fedipod.net.
+  if (location.origin !== 'https://fedipod.net' && location.protocol.startsWith('http')) {
+    document.getElementById('install-cmd').textContent =
+      `curl -fsSL ${location.origin}/install | sh\n\nfedipod start`;
+  }
+  fetch('/api/handle?handle=__probe__').then(r => r.json()).then(d => {
+    if (d.version) {
+      document.getElementById('current-version-num').textContent = d.version;
+      document.getElementById('current-version-cmd').textContent = `curl -fsSL ${location.origin}/install | sh`;
+      document.getElementById('current-version').hidden = false;
+    }
+  }).catch(() => {});
+</script>
+<i style="text-align:right">(cc) 4.0 By, Jeff Zucker, 2026</i>
+</body>
+</html>