fedipod 1.0.0 → 1.2.0

package/run-agent.mjs

@@ -28,28 +28,29 @@ import os from 'node:os';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 
-import { PodStore } from './lib/store.mjs';
-import { apRoot, rootOf, writeJsonAtomic } from './lib/home.mjs';
-import { ensureTrustedTls } from './lib/certs.mjs';
-import { storageFor } from './lib/storage.mjs';
-import { resolveKeys } from './lib/keys.mjs';
-import { RemotePod } from './lib/remote.mjs';
-import { Deliverer } from './lib/deliver.mjs';
-import { Publisher } from './lib/publisher.mjs';
-import { Intake } from './lib/intake.mjs';
-import { TagFeed } from './lib/tagfeed.mjs';
-import { ImportWorker } from './lib/import.mjs';
-import { Atproto } from './lib/atproto.mjs';
-import { FediAccounts } from './lib/fediacct.mjs';
-import { AcctFeed } from './lib/acctfeed.mjs';
-import { BskyFeed } from './lib/bskyfeed.mjs';
-import { BskyGroup } from './lib/bskygroup.mjs';
-import { Lease } from './lib/lease.mjs';
-import { startAdmin } from './lib/admin.mjs';
-import { exposureProblem, hostLabel } from './lib/guard.mjs';
-import { pendingSteps } from './lib/migrate.mjs';
-import { apUrls, assertionKeyId , publicHandle } from './lib/wire.mjs';
-import { followActor, unfollowActor, resolveHandle } from './lib/social.mjs';
+import { PodStore } from './lib/core/store.mjs';
+import { apRoot, rootOf, writeJsonAtomic } from './lib/device/home.mjs';
+import { ensureTrustedTls } from './lib/device/certs.mjs';
+import { storageFor } from './lib/core/storage.mjs';
+import { resolveKeys } from './lib/core/keys.mjs';
+import { RemotePod } from './lib/device/remote.mjs';
+import { Deliverer } from './lib/core/deliver.mjs';
+import { Publisher } from './lib/core/publisher/index.mjs';
+import { Intake } from './lib/core/intake/index.mjs';
+import { TagFeed } from './lib/connections/tagfeed.mjs';
+import { ImportWorker } from './lib/connections/import.mjs';
+import { Atproto } from './lib/connections/atproto.mjs';
+import { FediAccounts } from './lib/connections/fediacct.mjs';
+import { vaultsFor } from './lib/connections/vault.mjs';
+import { AcctFeed } from './lib/connections/acctfeed.mjs';
+import { BskyFeed } from './lib/connections/bskyfeed.mjs';
+import { BskyGroup } from './lib/connections/bskygroup.mjs';
+import { Lease } from './lib/core/lease.mjs';
+import { startAdmin } from './lib/device/admin/index.mjs';
+import { exposureProblem, hostLabel } from './lib/shared/guard.mjs';
+import { pendingSteps } from './lib/device/migrate.mjs';
+import { apUrls, assertionKeyId , publicHandle } from './lib/core/wire.mjs';
+import { followActor, unfollowActor, resolveHandle } from './lib/core/social.mjs';
 
 export class Agent {
   constructor({ home, log }) {
@@ -344,13 +345,20 @@ export class Agent {
     // The CSV-import worker: paced, resumable, armed only while active.
     this.importer?.stop();
     this.importer = new ImportWorker({ agent: this, log: this.log });
+    // Where the credentials for accounts held on OTHER servers are kept.
+    const vaults = vaultsFor({ embedded: this.embedded, home: this.home, store: this.store });
     // The Bluesky connection, when one exists. Stamped to this actor; a
     // credential connected for another identity is treated as absent.
-    this.atproto = new Atproto({ localDir: this.home, actorId: this.urls.actor, log: this.log });
+    this.atproto = new Atproto({
+      localDir: this.home, actorId: this.urls.actor, log: this.log, vault: vaults.bluesky,
+    });
     this.publisher.atproto = this.atproto;
     // Fediverse accounts the owner holds elsewhere. Same custody rules as the
     // Bluesky credential, and the same absence when stamped for someone else.
-    this.fediaccts = new FediAccounts({ localDir: this.home, actorId: this.urls.actor, log: this.log });
+    this.fediaccts = new FediAccounts({
+      localDir: this.home, actorId: this.urls.actor, log: this.log,
+      vault: vaults.fedi, apps: vaults.apps,
+    });
     this.acctfeed?.stop();
     this.acctfeed = null;
     this.bskyfeed?.stop();
@@ -773,7 +781,7 @@ export async function startAgent({
   // Is a newer FediPod published? Once at boot and daily after; the answer
   // rides /status and the record page offers the update.
   const updateTick = async () => {
-    const { checkLatest } = await import('./lib/update.mjs');
+    const { checkLatest } = await import('./lib/device/update.mjs');
     const u = await checkLatest();
     if (u) {
       agent.updateInfo = u;

package/scripts/build-app.mjs

@@ -32,6 +32,9 @@ const aliasPlugin = {
     build.onResolve({ filter: /^node:fs$/ }, () => ({ path: shim('node-fs.mjs') }));
     build.onResolve({ filter: /^web-push$/ }, () => ({ path: shim('web-push.mjs') }));
     build.onResolve({ filter: /\/safefetch\.mjs$/ }, () => ({ path: shim('safefetch.mjs') }));
+    // The shapes are one .ttl file for both agents; Node reads it, the browser
+    // gets it through the text loader below.
+    build.onResolve({ filter: /shapes-text\.mjs$/ }, () => ({ path: shim('shapes-text.mjs') }));
     const stub = new RegExp(`^(${STUBBED.map((s) => s.replace('/', '\\/')).join('|')})$`);
     build.onResolve({ filter: stub }, (args) => ({ path: args.path, namespace: 'stub' }));
     build.onLoad({ filter: /.*/, namespace: 'stub' }, (args) => ({
@@ -48,6 +51,7 @@ export async function buildApp({ entry, out, minify = false, format = 'esm' } =
     bundle: true, format, platform: 'browser', target: 'es2022',
     outfile: out, sourcemap: true, minify, logLevel: 'silent', metafile: true,
     plugins: [aliasPlugin],
+    loader: { '.ttl': 'text' },
     define: { 'process.env.NODE_ENV': '"production"' },
     banner: { js: fs.readFileSync(shim('prelude.js'), 'utf8') },
   });

package/scripts/check-pod-calls.mjs

@@ -53,8 +53,14 @@ const podFiles = fs.readdirSync(POD).filter((f) => f.endsWith('.mjs'));
 // The files that run the browser agent and the gateway. Node-only code is
 // deliberately out of scope for this pass and must not fail the check.
 const IN_SCOPE = [
-  'lib/publisher.mjs', 'lib/intake.mjs', 'lib/social.mjs', 'lib/mastoapi.mjs',
-  'lib/gateway-core.mjs', 'lib/front-core.mjs',
+  'lib/core/social.mjs',
+  'lib/client/masto/index.mjs', 'lib/client/masto/accounts.mjs', 'lib/client/masto/media.mjs',
+  'lib/client/masto/statuses.mjs', 'lib/client/masto/timelines.mjs', 'lib/client/masto/render.mjs',
+  'lib/core/publisher/index.mjs', 'lib/core/publisher/collections.mjs', 'lib/core/publisher/restore.mjs',
+  'lib/core/publisher/notes.mjs', 'lib/core/publisher/questions.mjs',
+  'lib/core/intake/index.mjs', 'lib/core/intake/verify.mjs', 'lib/core/intake/notes.mjs',
+  'lib/core/intake/channel.mjs', 'lib/core/intake/group.mjs', 'lib/core/intake/activities.mjs',
+  'lib/gateway/gateway-core.mjs', 'lib/gateway/front-core.mjs',
   'web/app/agent.mjs', 'web/app/signup.mjs', 'web/app/boot.mjs',
   'web/app/admin-facade.mjs', 'web/app/keys-browser.mjs',
 ];

package/scripts/refresh-contexts.mjs

@@ -0,0 +1,39 @@
+// refresh-contexts.mjs — re-copy the JSON-LD contexts from @fedify/vocab-runtime.
+//
+// Fedify keeps that set current against real fediverse traffic; we hold our own
+// copies so nothing in lib/ depends on a transitive package's internals, and so
+// what we serve for a stranger's document is a file in this repo.
+//
+//   node scripts/refresh-contexts.mjs
+//
+// Run it after a fedify upgrade, then check `git diff lib/core/contexts/`.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const src = path.join(root, 'node_modules/@fedify/vocab-runtime/src/contexts');
+const dest = path.join(root, 'lib/core/contexts');
+const module_ = fs.readFileSync(path.join(src, '..', 'contexts.ts'), 'utf8');
+
+const idents = Object.fromEntries(
+  [...module_.matchAll(/import (\w+) from "\.\/contexts\/([^"]+)"/gu)].map((m) => [m[1], m[2]]),
+);
+const map = {};
+for (const m of module_.matchAll(/"([^"]+)":\s*(\w+),/gu)) {
+  if (idents[m[2]]) map[m[1]] = idents[m[2]];
+}
+
+for (const file of Object.values(map)) fs.copyFileSync(path.join(src, file), path.join(dest, file));
+fs.writeFileSync(path.join(dest, 'map.json'), `${JSON.stringify(map, null, 2)}\n`);
+
+const names = Object.fromEntries(Object.keys(map).map((u, i) => [u, `ctx${i}`]));
+const header = fs.readFileSync(path.join(dest, 'index.mjs'), 'utf8').split('\nimport ')[0];
+let out = `${header}\n`;
+for (const [url, file] of Object.entries(map)) out += `import ${names[url]} from './${file}' with { type: 'json' };\n`;
+out += '\n/** URL → the context document itself. Nothing outside this map is ever resolved. */\nexport const CONTEXTS = {\n';
+for (const url of Object.keys(map)) out += `  '${url}': ${names[url]},\n`;
+out += '};\n';
+fs.writeFileSync(path.join(dest, 'index.mjs'), out);
+
+console.log(`refreshed ${Object.keys(map).length} contexts into lib/core/contexts/`);

package/web/admin/actors.js

@@ -0,0 +1,145 @@
+// actors.js — the other actors on this machine: the picker, going to one,
+// starting a stopped one, and the form for a new one.
+
+// Somewhere to go, and nothing else. A stopped actor is left out — the link
+// would land on nothing. The one you are on keeps its place in the row but
+// offers only `app`, because its admin page is the page you are reading.
+
+let actors = [];
+
+async function renderOthers() {
+  const { json } = await api('/profiles');
+  actors = json?.identities || [];
+  const sel = $('actor-pick');
+  sel.textContent = '';
+  // The fediverse address, which is what the actor IS to everyone else, and the
+  // only form that stays distinct: two identities can share a local handle, but
+  // never a handle AND a pod. A stopped one has no address to report — nothing
+  // answered — so it falls back to the name it is filed under.
+  const label = (r) => (r.address || r.handle || r.name)
+    + (r.mode && r.mode !== 'active' ? ` (${r.mode})` : '') + (r.mode ? '' : ' (stopped)');
+  const seen = {};
+  for (const r of actors) seen[label(r)] = (seen[label(r)] || 0) + 1;
+
+  for (const [i, r] of actors.entries()) {
+    const o = document.createElement('option');
+    o.value = String(i);
+    o.selected = !!r.current;      // it opens showing where you already are
+    o.textContent = label(r) + (seen[label(r)] > 1 && r.port ? ` :${r.port}` : '');
+    sel.appendChild(o);
+  }
+  // The way to a NEW actor rides the same dropdown as the existing ones.
+  const add = document.createElement('option');
+  add.value = '__add';
+  add.textContent = '+ add a new account…';
+  sel.appendChild(add);
+}
+
+// Going to an actor commits a navigation and, for a stopped one, a POST that
+// boots its pod — so it must run once per choice. Pressing Enter on the select
+// fires BOTH a keydown (handled below) and a native `change`, so without a
+// guard a keyboard commit would start the actor twice.
+let goingToActor = false;
+const goToActor = async () => {
+  if (goingToActor) return;
+  if ($('actor-pick').value === '__add') { renderOthers(); openNewActor(); return; }
+  const r = actors[Number($('actor-pick').value)];
+  if (!r || r.current) return;
+  goingToActor = true;
+  try {
+    if (r.mode) { location.href = r.admin; return; }
+    $('actor-pick').disabled = true;
+    say(`starting ${r.name}`);
+    const started = await write('/start-actor', { name: r.name }, `${r.name} is up`);
+    $('actor-pick').disabled = false;
+    if (started?.url) location.href = `${started.url}admin/`;
+    else renderOthers();            // put the picker back on the current actor
+  } finally {
+    goingToActor = false;
+  }
+};
+// Choosing one goes to its record, as it always has.
+//
+// Arrowing is the one case that must not: on a closed select every Arrow
+// keypress fires `change`, so a keyboard user browsing the list would be
+// carried off to the first actor they passed — and for a stopped one that
+// boots its pod. An arrow key arms a flag and the change it causes is ignored;
+// Enter commits. A mouse never sets the flag, so clicking behaves as before.
+let arrowing = false;
+$('actor-pick').addEventListener('keydown', (ev) => {
+  if (['ArrowUp', 'ArrowDown', 'Home', 'End', 'PageUp', 'PageDown'].includes(ev.key)) arrowing = true;
+  if (ev.key === 'Enter') { arrowing = false; goToActor(); }
+});
+$('actor-pick').addEventListener('pointerdown', () => { arrowing = false; });
+$('actor-pick').addEventListener('change', () => {
+  if (!arrowing) goToActor();
+  arrowing = false;
+});
+
+// Setting up a new actor asks for exactly what this page cannot already tell
+// it: the pod and the account behind it, and its permanent name. Display name,
+// bio and pictures are the client's job now — Phanpy's profile editor writes
+// them through /api/v1/accounts/update_credentials. Where the private data goes
+// is not a question either: it lands beside the credential, and `state --to`
+// moves it afterwards.
+
+const picked = (name) => document.querySelector(`input[name=${name}]:checked`)?.value;
+
+function newActorRows() {
+  const mode = picked('newMode');
+  $('new-row-podname').hidden = mode !== 'new';
+  $('new-row-pod').hidden = mode !== 'existing';
+}
+for (const el of document.querySelectorAll('input[name=newMode]')) {
+  el.addEventListener('change', newActorRows);
+}
+
+// While the form is up the page IS the new actor's setup — so the record of
+// the actor you came from goes away, list included. Which panes were showing
+// is remembered rather than recomputed: whether Group and Inbox belong is a
+// decision render() already made.
+const RECORD_PANES = ['pane-identity', 'pane-group', 'pane-inbox', 'rail'];
+let putBack = [];
+
+function showNewActor(on) {
+  if (on) closePanels();              // nothing of the old actor left open behind it
+  document.body.classList.toggle('adding', on);   // see body.adding in the CSS
+  $('new-actor-form').hidden = !on;
+  if (on) {
+    putBack = RECORD_PANES.filter(id => !$(id).hidden);
+    for (const id of putBack) $(id).hidden = true;
+  } else {
+    for (const id of putBack) $(id).hidden = false;
+    putBack = [];
+  }
+}
+
+// `add a new account` is the last item of the Local Actors dropdown; choosing
+// it opens the form in place. Arriving with ?new does the same.
+function openNewActor() {
+  showNewActor(true);
+  newActorRows();
+  $('new-handle').focus();
+}
+$('new-actor-cancel').addEventListener('click', () => { showNewActor(false); say('nothing changed'); });
+
+$('new-actor-form').addEventListener('submit', async (ev) => {
+  ev.preventDefault();
+  const handle = $('new-handle').value.trim();
+  const answers = {
+    handle,
+    kind: picked('newKind'),
+    mode: picked('newMode'),
+    issuer: $('new-issuer').value.trim(),
+    email: $('new-email').value.trim(),
+    password: $('new-password').value,
+  };
+  if (answers.mode === 'new') answers.podName = $('new-podname').value.trim() || handle;
+  else answers.pod = $('new-pod').value.trim();
+  $('new-actor-go').disabled = true;
+  say(`setting up ${handle || 'the new actor'} — this takes a while`);
+  const r = await write('/new-actor', answers, `setting up ${handle}`);
+  $('new-actor-go').disabled = false;
+  if (r?.url) location.href = r.url;      // its own page, where the progress is
+});
+

package/web/admin/common.js

@@ -0,0 +1,23 @@
+// common.js — what every admin page starts from: the element lookup, the
+// door the page is served behind, and the two ways it talks to the agent.
+// Loaded first by the record page and by the setup page.
+
+const $ = (id) => document.getElementById(id);
+// The door this page is served behind: nothing when the agent runs on this
+// machine, `/app` when the identity is hosted by its own pod server. Read from
+// the page's own address, so one build serves both.
+const BASE = location.pathname.replace(/\/admin\/.*$/u, '');
+// Every call carries `x-fedipod-page`. On the Node agent it is ignored — the
+// Origin check there already refuses a page on somebody else's site. In the
+// browser build the agent IS this origin's service worker, which cannot see
+// Sec-Fetch-* and answers these routes with no password, so this header is the
+// whole door: a cross-site form cannot set one, and a cross-origin fetch that
+// sets one is stopped at a preflight the worker never grants. See sw-src.mjs.
+const PAGE_HEADER = { 'x-fedipod-page': '1' };
+const api = async (path, init) => {
+  const res = await fetch(BASE + path, { ...init, headers: { ...(init?.headers || {}), ...PAGE_HEADER } });
+  return { status: res.status, json: await res.json().catch(() => null) };
+};
+const postJson = (path, body) => api(path, {
+  method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body || {}),
+});

package/web/admin/connections.js

@@ -0,0 +1,112 @@
+// connections.js — the accounts held elsewhere: the rail, the connect forms
+// for Bluesky and for a fediverse account, and the migration aliases.
+
+// The connect form lives in the floating window, like every other form here.
+// The inbound transfer panel: the aliases live here now, not in the facts.
+$('do-transfer-in').addEventListener('click', () => {
+  solWindow.show('transfer-in-form', 'Transfer an account here');
+});
+
+// The rail: one click hides the actions; on a phone it starts hidden.
+function setRail(closed) {
+  $('rail').classList.toggle('closed', closed);
+  const t = $('rail-toggle');
+  t.setAttribute('aria-expanded', String(!closed));
+  t.querySelector('.rail-arrow').textContent = closed ? '»' : '«';
+  t.title = closed ? '   Show the action panel' : '   Hide the action panel';
+}
+$('rail-toggle').addEventListener('click', () => setRail(!$('rail').classList.contains('closed')));
+if (matchMedia('(max-width: 47rem)').matches) setRail(true);
+
+// One way in for both networks, because from the record they are the same
+// thing: an account elsewhere whose timeline joins the one you read here.
+$('ident-open').addEventListener('click', () => {
+  closePanels();
+  solWindow.show('ident-form', 'Connect an identity');
+});
+$('ident-pick-fedi').addEventListener('click', () => {
+  solWindow.show('fediacct-form', 'Connect a Fediverse account');
+});
+$('ident-pick-bsky').addEventListener('click', () => {
+  solWindow.show('bsky-form', 'Connect a Bluesky account');
+});
+
+let bskyBusy = false;
+$('bsky-form').addEventListener('submit', async (ev) => {
+  ev.preventDefault();
+  if (bskyBusy) return;
+  bskyBusy = true;
+  try {
+    const r = await write('/atproto/connect', {
+      service: $('bsky-service').value.trim(),
+      identifier: $('bsky-identifier').value.trim(),
+      appPassword: $('bsky-password').value,
+    }, 'bluesky account connected');
+    if (r) {
+      $('bsky-password').value = '';
+      closePanels();
+      await load();
+    }
+  } finally { bskyBusy = false; }
+});
+// The sign-in happens at the other server, so this hands the browser over
+// rather than taking a password. What comes back lands on /fediacct/callback,
+// which this machine answers and nowhere else does.
+let fediBusy = false;
+$('fediacct-form').addEventListener('submit', async (ev) => {
+  ev.preventDefault();
+  if (fediBusy) return;
+  fediBusy = true;
+  try {
+    const r = await write('/fediacct/connect', { host: $('fediacct-host').value.trim() }, '');
+    if (r?.authorize) location.href = r.authorize;
+  } finally { fediBusy = false; }
+});
+
+// Disconnecting Bluesky, pausing its feed and choosing its storage all live in
+// the account's Options menu now (see optionsMenu). Connecting is still here.
+// Adding resolves the old account on the agent side, so what lands in
+// alsoKnownAs is its canonical id, not the string typed here.
+// The accounts elsewhere this one may receive a Move from — the chips in the
+// Transfer-an-account-here panel. Each entry is removable, behind a second
+// click: servers still retrying a Move check the list, so removal is not a
+// tidy-up.
+function renderAliases() {
+  const box = $('alias-chips');
+  box.textContent = '';
+  for (const alias of config.aliases || []) {
+    let armed = false;
+    const rm = document.createElement('button');
+    rm.type = 'button';
+    rm.className = 'inline danger';
+    rm.textContent = '✕';
+    rm.title = '   Remove this alias';
+    rm.addEventListener('click', async () => {
+      if (!armed) {
+        armed = true;
+        rm.textContent = 'confirm ✕';
+        rm.title = '   Servers still retrying the Move check this alias — click again to remove it anyway';
+        return;
+      }
+      const r = await write('/alias', { remove: alias, confirm: true }, 'alias removed and the actor republished');
+      if (r) { config.aliases = r.aliases; render(); }
+    });
+    const chip = document.createElement('span');
+    chip.append(alias, ' ', rm);
+    box.append(chip, ' ');
+  }
+}
+
+let aliasBusy = false;
+$('alias-add').addEventListener('click', async () => {
+  if (aliasBusy) return;
+  const v = $('alias-input').value.trim();
+  if (!v) { say('enter the old account first — @you@old.server', 'err'); return; }
+  aliasBusy = true;
+  try {
+    const r = await write('/alias', { add: v }, 'alias added and the actor republished');
+    if (r) { $('alias-input').value = ''; config.aliases = r.aliases; render(); }
+  } finally { aliasBusy = false; }
+});
+
+

package/web/admin/gateway.js

@@ -0,0 +1,111 @@
+// gateway.js — the gateway row and its attach and detach forms, the inbox
+// prune actions, and the load that starts the page.
+
+const GATEWAY_CTL = $('gateway-ctl');           // held: it rides into a generated row
+const GATEWAY_WORD = $('gateway-word');
+const GW_OPEN_ATTACH = $('gateway-open-attach');
+const GW_OPEN_DETACH = $('gateway-open-detach');
+let gwState = null;
+async function refreshGateway() {
+  const { status, json: g } = await api('/gateway');
+  if (status !== 200 || !g) return;
+  gwState = g;
+  GATEWAY_CTL.hidden = false;
+  if (g.configured) {
+    let host = g.url;
+    try { host = new URL(g.url).host; } catch { /* show it as-is */ }
+    const frontName = g.frontActor?.match(/\/u\/([^/]+)\/ap\/actor\/?$/)?.[1];
+    GATEWAY_WORD.textContent = frontName ? `${host} — publishing as @${frontName}@${host}` : host;
+    GW_OPEN_ATTACH.hidden = true;
+    GW_OPEN_DETACH.hidden = false;
+  } else {
+    GATEWAY_WORD.textContent = '';
+    GW_OPEN_ATTACH.hidden = false;
+    GW_OPEN_DETACH.hidden = true;
+  }
+}
+const gwShape = () => document.querySelector('input[name=gwShape]:checked')?.value || 'pod';
+function gwPreviews() {
+  $('gw-pod-preview').textContent = config?.address || `@${config?.handle || 'you'}@your.pod`;
+  try { $('gw-front-host').textContent = new URL($('gw-front').value.trim()).host; }
+  catch { /* not a URL yet — the placeholder host stands */ }
+}
+function gwShapeChanged() { gwPreviews(); gwCheck(); }
+for (const r of document.querySelectorAll('input[name=gwShape]')) r.addEventListener('change', gwShapeChanged);
+// Typing in the blank IS choosing that shape.
+$('gw-name').addEventListener('focus', () => {
+  const r = document.querySelector('input[name=gwShape][value=front]');
+  if (!r.checked) { r.checked = true; gwShapeChanged(); }
+});
+GW_OPEN_ATTACH.addEventListener('click', () => {
+  gwShapeChanged();
+  solWindow.show('gateway-attach-form', 'Attach to a gateway');
+});
+GW_OPEN_DETACH.addEventListener('click', () => {
+  $('gw-detach-fronted').hidden = !gwState?.frontActor;
+  $('gw-detach-plain').hidden = !!gwState?.frontActor;
+  solWindow.show('gateway-detach-form', 'Detach from gateway');
+});
+// Live availability, asked through the agent (the front answers it without CORS).
+let gwTimer = null;
+function gwCheck() {
+  clearTimeout(gwTimer);
+  const front = $('gw-front').value.trim().replace(/\/+$/, '');
+  const name = $('gw-name').value.trim().toLowerCase();
+  $('gw-name-msg').textContent = ''; $('gw-name-msg').className = 'hint';
+  if (gwShape() !== 'front' || !front || !name) return;
+  gwTimer = setTimeout(async () => {
+    const { status, json } = await postJson('/gateway', { action: 'check', front, handle: name });
+    if (status !== 200 || !json) return;
+    $('gw-name-msg').textContent = json.available
+      ? `${name} is free at ${front.replace(/^https?:\/\//, '')}`
+      : (json.reason || 'that name is taken');
+    $('gw-name-msg').className = json.available ? 'hint' : 'warn';
+  }, 300);
+}
+$('gw-front').addEventListener('input', () => { gwPreviews(); gwCheck(); });
+$('gw-name').addEventListener('input', () => { gwPreviews(); gwCheck(); });
+$('gw-attach').addEventListener('click', async () => {
+  const front = $('gw-front').value.trim().replace(/\/+$/, '');
+  const fronted = gwShape() === 'front';
+  const name = $('gw-name').value.trim().toLowerCase();
+  if (fronted && !name) { say('give the handle you want at the gateway', 'err'); return; }
+  $('gw-attach').disabled = true;
+  // Pod-based sends no name: the door's label is the agent's business, not
+  // the user's, and the agent picks a free variant by itself.
+  const r = await write('/gateway',
+    { action: 'attach', front, ...(fronted ? { handle: name, fronted: true } : {}) },
+    fronted ? 'attached — the agent is restarting to publish under the gateway handle; reload in a moment'
+      : 'attached — your mail now arrives through the gateway, filtered');
+  $('gw-attach').disabled = false;
+  if (r) { closePanels(); refreshGateway(); }
+});
+$('gw-detach').addEventListener('click', async () => {
+  const fronted = !!gwState?.frontActor;
+  const r = await write('/gateway', { action: 'forget' },
+    fronted ? 'detached — the agent is restarting under your pod\'s own name; reload in a moment'
+      : 'detached — the actor was republished advertising your pod\'s own inbox');
+  if (r) { closePanels(); refreshGateway(); }
+});
+
+$('inbox-keep').addEventListener('click', () => {
+  dismissed = true;
+  $('pane-inbox').hidden = true;
+  say('leaving it to the agent — it drains oldest first');
+});
+
+$('inbox-prune').addEventListener('click', async () => {
+  const days = Number($('inbox-before').value);
+  const before = new Date(Date.now() - days * 86400_000).toISOString();
+  $('inbox-prune').disabled = true;
+  say(`discarding content older than ${days} days — this takes a while`);
+  const r = await write('/inbox/prune', { before }, 'done');
+  $('inbox-prune').disabled = false;
+  if (r) {
+    say(`applied ${r.applied} follow/unfollow/delete, discarded ${r.dropped + r.discarded} posts`
+      + (r.failed ? `, ${r.failed} failed` : ''));
+    renderInbox();
+  }
+});
+
+load();