fedipod 1.10.0 → 1.26.1

package/lib/session/fedi-login.mjs

@@ -0,0 +1,123 @@
+// fedi-login.mjs — sign a person in at their own Solid pod from their
+// Fediverse address, and bring them back to where they were.
+//
+//   import { fediLogin } from './fedi-login.mjs';
+//   const login = fediLogin({ dbName: 'my-app-oidc', clientName: 'My app' });
+//
+//   await login.login('@mei@fedipod.net');   // leaves for the pod's login page
+//   await login.resume();                     // on every page load: finishes a
+//                                             // login in progress and returns them
+//   const s = await login.getSession();       // null, or { webId, issuer, fetch, signOut }
+//
+// How an address becomes a login page. WebFinger at the address's host names
+// the actor and its aliases. An origin among those that answers
+// /.well-known/openid-configuration is the login provider, or says which is
+// (a pod host redirects there). Failing that, the WebID — the URL typed, or
+// the ones the actor names as its own — is read as JSON-LD and its
+// solid:oidcIssuer is the provider. A Mastodon address has neither, and the
+// person is told so in words.
+//
+// No imports but the session engine beside it, no Node built-ins, nothing
+// named after the application that uses it.
+import { solidOidcSession } from './oidc-session.mjs';
+
+const OIDC_ISSUER = 'http://www.w3.org/ns/solid/terms#oidcIssuer';
+
+/** `@mei@host`, `mei@host`, or a WebID or actor URL. Null when it is neither. */
+export function parseAddress(input) {
+  const t = String(input || '').trim();
+  if (/^https?:\/\//u.test(t)) { try { return { url: new URL(t).href, host: new URL(t).host }; } catch { return null; } }
+  const m = /^@?([^@\s/]+)@([^@\s/]+)$/u.exec(t);
+  if (!m) return null;
+  const name = m[1]; const host = m[2].toLowerCase();
+  return { name, host, at: `@${name}@${host}` };
+}
+
+export function fediLogin({ dbName, clientName, redirectUri = null, fetch: f = globalThis.fetch?.bind(globalThis) } = {}) {
+  const oidc = solidOidcSession({ dbName, clientName });
+  const get = (url, accept) => f(url, { headers: { accept }, redirect: 'follow' });
+  const json = (url, accept) => get(url, accept).then((r) => (r.ok ? r.json() : null)).catch(() => null);
+  const here = () => (globalThis.location ? location.origin + location.pathname : null);
+
+  const discovery = (base) => json(`${String(base).replace(/\/+$/, '')}/.well-known/openid-configuration`, 'application/json');
+  const isProvider = (cfg) => !!(cfg?.issuer && cfg.authorization_endpoint);
+  const origin = (u) => { try { return new URL(u).origin; } catch { return null; } };
+
+  // The issuer a WebID document names, read as the expanded JSON-LD a pod answers.
+  const issuerOfWebId = async (webId) => {
+    const doc = await json(webId, 'application/ld+json');
+    const nodes = Array.isArray(doc) ? doc : (doc?.['@graph'] || (doc ? [doc] : []));
+    const me = nodes.find((n) => n?.['@id'] === webId && n[OIDC_ISSUER]) || nodes.find((n) => n?.[OIDC_ISSUER]);
+    const v = [].concat(me?.[OIDC_ISSUER] || [])[0];
+    return typeof v === 'string' ? v : (v?.['@id'] || null);
+  };
+
+  /** Where an address signs in: { address, actor, origin, issuer, webId? }.
+   *  Throws, in plain words, when the host does not know the address or
+   *  nothing about it names a login provider. */
+  async function resolve(address) {
+    const a = parseAddress(address);
+    if (!a) throw new Error('an address looks like @you@your.server');
+    let actor = null;
+    const urls = [];
+    if (a.url) urls.push(a.url);
+    else {
+      const r = await get(`https://${a.host}/.well-known/webfinger?resource=${encodeURIComponent(`acct:${a.name}@${a.host}`)}`,
+        'application/jrd+json, application/json').catch(() => null);
+      if (!r?.ok) throw new Error(`${a.host} does not know ${a.at}`);
+      const jrd = await r.json().catch(() => null);
+      const self = (jrd?.links || []).find((l) => l.rel === 'self' && /activity\+json|ld\+json/u.test(l.type || ''));
+      actor = self?.href || null;
+      // The aliases first: at a Gateway they name the actor on the pod itself,
+      // and the pod is where the login is.
+      for (const u of [...(jrd?.aliases || []), ...(actor ? [actor] : [])]) if (typeof u === 'string') urls.push(u);
+      if (!urls.length) throw new Error(`${a.host} did not say where ${a.at} lives`);
+    }
+    const found = (extra) => ({ address: a.at || a.url, actor, ...extra });
+
+    // 1. An origin that is the login provider, or says which is.
+    for (const o of [...new Set(urls.map(origin).filter(Boolean))]) {
+      const cfg = await discovery(o);
+      if (isProvider(cfg)) return found({ origin: o, issuer: cfg.issuer });
+    }
+    // 2. The WebID: the URL typed, or the ones the actor names as its own.
+    const webIds = a.url ? [a.url] : [];
+    if (actor) {
+      const doc = await json(actor, 'application/activity+json');
+      for (const u of [].concat(doc?.alsoKnownAs || [])) if (typeof u === 'string') webIds.push(u);
+    }
+    for (const webId of webIds) {
+      const issuer = await issuerOfWebId(webId);
+      if (issuer && isProvider(await discovery(issuer))) return found({ origin: origin(webId), issuer, webId });
+    }
+    throw new Error(`${a.host} is not a Solid pod, so there is no pod login to send you to`);
+  }
+
+  /** Everything `login` does short of leaving the page: returns the found pod
+   *  and the `authorizationUrl` to send the person to. */
+  async function startLogin(address, { returnTo = globalThis.location?.href || null, redirectUri: ru = redirectUri || here() } = {}) {
+    const found = await resolve(address);
+    const { authorizationUrl } = await oidc.beginLogin({ issuer: found.issuer, redirectUri: ru, returnTo });
+    return { ...found, authorizationUrl, returnTo };
+  }
+
+  /** Send the person to their pod's login page. They come back to `redirectUri`
+   *  (this page, unless set) and `resume` there returns them to `returnTo`
+   *  (where they were, unless set). */
+  async function login(address, opts) {
+    const s = await startLogin(address, opts);
+    location.href = s.authorizationUrl;
+    return s;
+  }
+
+  /** Call on every page load. Finishes a login the person is coming back from
+   *  and returns them to where they were; null when no login is in progress. */
+  async function resume({ currentUrl = globalThis.location?.href, go = (u) => location.replace(u) } = {}) {
+    const session = await oidc.completeLogin({ currentUrl });
+    if (!session) return null;
+    if (session.returnTo && session.returnTo !== currentUrl) go(session.returnTo);
+    return session;
+  }
+
+  return { resolve, startLogin, login, resume, getSession: oidc.getSession, signOut: oidc.signOut };
+}

package/lib/session/oidc-session.mjs

@@ -0,0 +1,233 @@
+// oidc-session.mjs — Solid-OIDC login for a browser page, with a secure,
+// durable, worker-visible session.
+//
+// The redirect handshake (authorization-code + PKCE) runs in the page. The
+// session it yields — a DPoP keypair whose private half is NON-EXTRACTABLE, plus
+// the refresh token, the token endpoint and the WebID — is kept in IndexedDB.
+// IndexedDB survives a browser restart and is readable by a service worker,
+// and a non-extractable key can sign but never be read out, even by injected
+// script.
+//
+//   import { solidOidcSession } from 'solid-oidc-session/oidc-session.mjs';
+//   const oidc = solidOidcSession({ dbName: 'my-app-oidc', clientName: 'My app' });
+//
+// Page:   const { authorizationUrl } = await oidc.beginLogin({ issuer, redirectUri });
+//         location.href = authorizationUrl;                      // ... redirect ...
+//         await oidc.completeLogin({ currentUrl: location.href });  // on return
+// Anywhere (page or worker, SAME dbName):
+//         const session = await oidc.getSession();  // { webId, issuer, fetch, refresh, signOut } | null
+//
+// No imports, no Node built-ins, nothing named after the application that
+// uses it: IndexedDB, WebCrypto and fetch are all it needs.
+
+const STORE = 'session';
+const b64u = (buf) => btoa(String.fromCharCode(...new Uint8Array(buf))).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+const enc = (o) => b64u(new TextEncoder().encode(JSON.stringify(o)));
+const sha256 = (s) => crypto.subtle.digest('SHA-256', new TextEncoder().encode(s));
+const rand = (n = 32) => b64u(crypto.getRandomValues(new Uint8Array(n)));
+
+async function dpopKey() { return crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign']); }
+async function publicJwk(pair) { const j = await crypto.subtle.exportKey('jwk', pair.publicKey); return { kty: j.kty, crv: j.crv, x: j.x, y: j.y }; }
+async function dpopProof(pair, jwk, htm, htu, ath) {
+  const header = { typ: 'dpop+jwt', alg: 'ES256', jwk };
+  const payload = { htm, htu: htu.split('#')[0], jti: crypto.randomUUID(), iat: Math.floor(Date.now() / 1000), ...(ath ? { ath } : {}) };
+  const data = `${enc(header)}.${enc(payload)}`;
+  const sig = await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, pair.privateKey, new TextEncoder().encode(data));
+  return `${data}.${b64u(sig)}`;
+}
+const jwtPayload = (jwt) => { try { return JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(jwt.split('.')[1].replace(/-/g, '+').replace(/_/g, '/')), (c) => c.charCodeAt(0)))); } catch { return {}; } };
+
+async function discover(issuer) {
+  const res = await fetch(`${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration`, { headers: { accept: 'application/json' } });
+  if (!res.ok) throw new Error(`OIDC discovery failed at ${issuer} (HTTP ${res.status})`);
+  return res.json();
+}
+async function registerClient(cfg, redirectUri, clientName) {
+  const res = await fetch(cfg.registration_endpoint, {
+    method: 'POST', headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ client_name: clientName, redirect_uris: [redirectUri], token_endpoint_auth_method: 'none',
+      grant_types: ['authorization_code', 'refresh_token'], response_types: ['code'], application_type: 'web', scope: 'openid webid offline_access' }),
+  });
+  if (!res.ok) throw new Error(`client registration failed (HTTP ${res.status})`);
+  return (await res.json()).client_id;
+}
+
+/**
+ * One session store. `dbName` is the IndexedDB database the session lives in:
+ * a page and its service worker must pass the same name to see the same
+ * sign-in, and two apps on one origin pass different names to keep theirs
+ * apart. `clientName` is what the pod's login screen shows the person.
+ */
+export function solidOidcSession({ dbName = 'solid-oidc-session', clientName = 'Solid app' } = {}) {
+  function idb() {
+    return new Promise((res, rej) => {
+      const r = indexedDB.open(dbName, 1);
+      r.onupgradeneeded = () => r.result.createObjectStore(STORE);
+      r.onsuccess = () => res(r.result);
+      r.onerror = () => rej(r.error);
+    });
+  }
+  async function idbGet(key) {
+    const db = await idb();
+    return new Promise((res, rej) => { const t = db.transaction(STORE).objectStore(STORE).get(key); t.onsuccess = () => res(t.result); t.onerror = () => rej(t.error); });
+  }
+  async function idbPut(key, val) {
+    const db = await idb();
+    return new Promise((res, rej) => { const t = db.transaction(STORE, 'readwrite').objectStore(STORE).put(val, key); t.onsuccess = () => res(); t.onerror = () => rej(t.error); });
+  }
+  async function idbDel(key) {
+    const db = await idb();
+    return new Promise((res, rej) => { const t = db.transaction(STORE, 'readwrite').objectStore(STORE).delete(key); t.onsuccess = () => res(); t.onerror = () => rej(t.error); });
+  }
+
+  /** Begin login: prepare PKCE + a non-extractable DPoP key, stash the pending
+   *  state, and return the authorization URL for the caller to navigate to. */
+  async function beginLogin({ issuer, redirectUri, clientName: name = clientName, returnTo = null }) {
+    const cfg = await discover(issuer);
+    const client_id = await registerClient(cfg, redirectUri, name);
+    const pair = await dpopKey();
+    const verifier = rand(48);
+    const challenge = b64u(await sha256(verifier));
+    const state = rand(16);
+    await idbPut('pending', { issuer, client_id, redirectUri, verifier, state, pair, returnTo,
+      tokenEndpoint: cfg.token_endpoint, authorizationEndpoint: cfg.authorization_endpoint,
+      revocationEndpoint: cfg.revocation_endpoint || null });
+    const url = new URL(cfg.authorization_endpoint);
+    for (const [k, v] of Object.entries({ client_id, redirect_uri: redirectUri, response_type: 'code',
+      scope: 'openid webid offline_access', code_challenge: challenge, code_challenge_method: 'S256', state, prompt: 'consent' })) url.searchParams.set(k, v);
+    return { authorizationUrl: url.href };
+  }
+
+  /** Complete login from the redirect back. Exchanges the code (DPoP + PKCE),
+   *  stores the durable session, and returns it. Returns null if there is no code. */
+  async function completeLogin({ currentUrl }) {
+    const u = new URL(currentUrl);
+    const code = u.searchParams.get('code');
+    const state = u.searchParams.get('state');
+    if (!code) return null;
+    const p = await idbGet('pending');
+    if (!p || p.state !== state) throw new Error('login state mismatch');
+    const jwk = await publicJwk(p.pair);
+    const res = await fetch(p.tokenEndpoint, {
+      method: 'POST',
+      headers: { 'content-type': 'application/x-www-form-urlencoded', dpop: await dpopProof(p.pair, jwk, 'POST', p.tokenEndpoint) },
+      body: new URLSearchParams({ grant_type: 'authorization_code', code, redirect_uri: p.redirectUri, client_id: p.client_id, code_verifier: p.verifier }),
+    });
+    const tok = await res.json().catch(() => ({}));
+    if (!res.ok || !tok.access_token) throw new Error(`token exchange failed (HTTP ${res.status}): ${tok.error || ''}`);
+    const webId = jwtPayload(tok.access_token).webid || jwtPayload(tok.id_token || '').webid || null;
+    const session = { issuer: p.issuer, client_id: p.client_id, tokenEndpoint: p.tokenEndpoint, pair: p.pair,
+      // Where to hand the refresh token back at sign-out. Kept on the session
+      // because discovery is a network round trip and sign-out should not need
+      // one — see signOut().
+      revocationEndpoint: p.revocationEndpoint || null,
+      refreshToken: tok.refresh_token || null, accessToken: tok.access_token,
+      expiresAt: Date.now() + Math.max(30, (tok.expires_in || 300)) * 1000, webId };
+    await idbPut('session', session);
+    await idbDel('pending');
+    // `returnTo` rides only on the handle this call returns: where the person
+    // was when they left for the login page, for the caller to send them back.
+    return Object.assign(sessionHandle(session), p.returnTo ? { returnTo: p.returnTo } : {});
+  }
+
+  /** Restore the session from IndexedDB — works in the page and the worker. */
+  async function getSession() {
+    const s = await idbGet('session');
+    return s ? sessionHandle(s) : null;
+  }
+
+  /**
+   * Sign out, and tell the issuer.
+   *
+   * Dropping the row locally leaves the REFRESH TOKEN alive at the pod for its
+   * full life — signing out of a shared or borrowed browser would clear the
+   * screen and nothing else, and anyone who had copied the token could go on
+   * minting access tokens with it. RFC 7009: hand it back.
+   *
+   * Best effort, and the local teardown happens either way: an issuer that is
+   * unreachable, or that publishes no revocation endpoint, must not be able to
+   * keep somebody signed in.
+   */
+  async function signOut() {
+    const s = await idbGet('session').catch(() => null);
+    if (s?.revocationEndpoint && s.refreshToken) {
+      try {
+        await fetch(s.revocationEndpoint, {
+          method: 'POST',
+          headers: { 'content-type': 'application/x-www-form-urlencoded' },
+          body: new URLSearchParams({
+            token: s.refreshToken, token_type_hint: 'refresh_token', client_id: s.client_id,
+          }),
+        });
+      } catch { /* told if we could; leaving is not conditional on being heard */ }
+    }
+    await idbDel('session');
+    await idbDel('pending');
+  }
+
+  function sessionHandle(s) {
+    let { accessToken, expiresAt, refreshToken } = s;
+    const jwkP = publicJwk(s.pair);
+    const refresh = async () => {
+      if (!refreshToken) throw new Error('session expired and there is no refresh token — sign in again');
+      const jwk = await jwkP;
+      let res;
+      try {
+        res = await fetch(s.tokenEndpoint, {
+          method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded', dpop: await dpopProof(s.pair, jwk, 'POST', s.tokenEndpoint) },
+          body: new URLSearchParams({ grant_type: 'refresh_token', refresh_token: refreshToken, client_id: s.client_id, scope: 'openid webid offline_access' }),
+        });
+      } catch (e) {
+        // A renewal that never reached the server is not a refused one: the
+        // session is still good, and saying "your pod refused the write" about
+        // it sends whoever reads it looking in the wrong place. Under load a
+        // server refuses the token endpoint first, and a refusal with no CORS
+        // headers arrives here as the browser's bare "Failed to fetch".
+        throw new Error(`${e.message} — renewing your sign-in at ${new URL(s.tokenEndpoint).host}`);
+      }
+      const tok = await res.json().catch(() => ({}));
+      if (res.status === 429) {
+        throw new Error(`${new URL(s.tokenEndpoint).host} is asking us to slow down — your sign-in could not be renewed just now`);
+      }
+      if (!res.ok || !tok.access_token) { await idbDel('session'); throw new Error('refresh failed — sign in again'); }
+      accessToken = tok.access_token;
+      expiresAt = Date.now() + Math.max(30, (tok.expires_in || 300)) * 1000;
+      if (tok.refresh_token) refreshToken = tok.refresh_token;
+      // Re-read before writing back. There is ONE 'session' row, and this handle
+      // closed over the session it was made from — so a refresh that was already
+      // in flight when the user signed in as somebody else would put the OLD
+      // identity back, silently, over the new one. Only write if the row is still
+      // the session this handle belongs to.
+      const now = await idbGet('session');
+      if (now && now.webId !== s.webId) {
+        throw new Error('signed in as somebody else while this session was refreshing');
+      }
+      await idbPut('session', { ...s, accessToken, expiresAt, refreshToken });
+    };
+    const send = async (url, init) => {
+      const jwk = await jwkP;
+      const ath = b64u(await sha256(accessToken));
+      const headers = { ...(init.headers || {}), authorization: `DPoP ${accessToken}`, dpop: await dpopProof(s.pair, jwk, (init.method || 'GET'), url, ath) };
+      return fetch(url, { ...init, headers });
+    };
+    const authFetch = async (url, init = {}) => {
+      if (Date.now() > expiresAt - 30_000) await refresh();
+      const res = await send(url, init);
+      // A token the pod REFUSES is not only ever an expired one: a pod that
+      // restarted, a clock that drifted, a token the server stopped recognising
+      // all answer 401 while the clock here still says the token is good — so the
+      // renewal above never fires and every call fails from then on. Renew once
+      // and ask again.
+      if (res.status === 401 && refreshToken) {
+        try { await refresh(); } catch { return res; }
+        return send(url, init);
+      }
+      return res;
+    };
+    // `issuer` so a page that cannot renew can send the person back to the right
+    // login without asking them for their address again.
+    return { webId: s.webId, issuer: s.issuer, fetch: authFetch, refresh, signOut };
+  }
+
+  return { beginLogin, completeLogin, getSession, signOut };
+}

package/lib/session/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "fediverse-account",
+  "version": "0.1.0",
+  "description": "Type a Fediverse handle or a WebID and get back an account you can act with: post, read its timeline, follow, reply, favourite, boost. Works out whether the account lives on a Mastodon-family server or on a Solid pod through FediPod, sends the person to sign in there, brings them back to where they were, and speaks to whichever it is.",
+  "type": "module",
+  "license": "MIT",
+  "author": "Jeff Zucker",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jeff-zucker/FediPod.git",
+    "directory": "lib/session"
+  },
+  "homepage": "https://github.com/jeff-zucker/FediPod/tree/main/lib/session#readme",
+  "keywords": [
+    "fediverse",
+    "activitypub",
+    "mastodon",
+    "solid",
+    "solid-oidc",
+    "webid",
+    "login",
+    "oauth",
+    "fedipod"
+  ],
+  "files": [
+    "fedi-account.mjs",
+    "fedi-login.mjs",
+    "oidc-session.mjs",
+    "README.md"
+  ],
+  "exports": {
+    ".": "./fedi-account.mjs",
+    "./fedi-account.mjs": "./fedi-account.mjs",
+    "./fedi-login.mjs": "./fedi-login.mjs",
+    "./oidc-session.mjs": "./oidc-session.mjs"
+  },
+  "scripts": {
+    "prepublishOnly": "node ../../scripts/check-pod-calls.mjs"
+  },
+  "dependencies": {}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.10.0",
+  "version": "1.26.1",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",
@@ -21,6 +21,7 @@
     "ui",
     "vendor",
     "phanpy/dist",
+    "sengi/dist",
     "run-agent.mjs",
     "scripts",
     "gui.md",
@@ -37,7 +38,7 @@
     "install-service": "node bin/fedipod.mjs install-service",
     "uninstall-service": "node bin/fedipod.mjs uninstall-service",
     "prepublishOnly": "npm test",
-    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs",
+    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node --test packages/fedipod-bb/test/*.test.mjs && node scripts/check-sizes.mjs",
     "verify-ui": "node scripts/verify-ui.mjs",
     "build:sw": "node scripts/build-app.mjs --entry web/app/sw-src.mjs --out web/app/dist/sw.js",
     "build:boot": "node scripts/build-app.mjs --entry web/app/boot.mjs --out web/app/dist/boot.js",

package/run-agent.mjs

@@ -588,6 +588,10 @@ export class Agent {
     if (repair) {
       this.ensureActorPublished()
         .catch(e => this.log(`actor check failed: ${e.message}`));
+      // The human page, rewritten only when what it shows has changed: one
+      // local digest compare, and a write the first time after an upgrade.
+      this.publisher.publishProfilePage()
+        .catch(e => this.log(`profile page: ${e.message}`));
     }
     this.seedFollowNotifications().catch(e => this.log(`notification seeding failed: ${e.message}`));
   }
@@ -726,6 +730,15 @@ export async function startAgent({
   handle = null,
 } = {}) {
   fs.mkdirSync(home, { recursive: true, mode: 0o700 });
+  // A home can hold a FORUM rather than a person or a group: same profiles
+  // directory, same unit, same startup — a different thing to run. Its
+  // credential says so, and running the agent over it would publish a person
+  // where a forum lives.
+  const { isForumHome, runForum } = await import('./packages/fedipod-bb/src/run.mjs');
+  if (isForumHome(home)) {
+    console.log(`[bb:${port}] this home holds a forum — running it`);
+    return runForum({ home, port, log: (...a) => console.log(`[bb:${port}]`, ...a) });
+  }
   // connect() sets this from pod state a moment later, but the browser may
   // already be opening — seed it from what setup recorded so the named origin
   // works from the first request.

package/scripts/check-pod-calls.mjs

@@ -179,5 +179,117 @@ if (!failures) pass('every in-scope caller reaches the pod through a named opera
   pass('the library imports and runs against a stub with nothing but rdflib on the path');
 }
 
+// ---- 8. lib/session/ is a library on the same terms ----
+{
+  const SESSION = path.join(root, 'lib/session');
+  const files = fs.readdirSync(SESSION).filter((f) => f.endsWith('.mjs'));
+  let bad = 0;
+  for (const f of files) {
+    const src = code(read(path.join(SESSION, f)));
+    for (const m of src.matchAll(/from\s+['"]([^'"]+)['"]/g)) {
+      if (!m[1].startsWith('./')) { fail(`lib/session/${f} imports ${m[1]} — the session library imports nothing but its own files`); bad++; }
+    }
+    if (/fedipod/i.test(src)) { fail(`lib/session/${f} names FediPod in code — the database and client names are the caller's`); bad++; }
+  }
+  const { solidOidcSession } = await import(path.join(SESSION, 'oidc-session.mjs'));
+  const oidc = solidOidcSession({ dbName: 'x', clientName: 'y' });
+  for (const k of ['beginLogin', 'completeLogin', 'getSession', 'signOut']) {
+    if (typeof oidc[k] !== 'function') { fail(`solidOidcSession() returned no ${k}`); bad++; }
+  }
+  // An address at a Gateway resolves to the POD's login, through the alias
+  // WebFinger names; an address on a Mastodon server is refused in words.
+  const { fediLogin, parseAddress } = await import(path.join(SESSION, 'fedi-login.mjs'));
+  const jrd = (host, aliases, self) => ({ ok: true, json: async () => ({ aliases, links: [{ rel: 'self', type: 'application/activity+json', href: self }] }) });
+  const stub = async (url) => {
+    if (url.startsWith('https://front.example/.well-known/webfinger')) return jrd('front.example', ['https://mei.pod.example/anything/ap/actor'], 'https://front.example/u/mei/ap/actor');
+    if (url.startsWith('https://masto.example/.well-known/webfinger')) return jrd('masto.example', ['https://masto.example/@kwame'], 'https://masto.example/users/kwame');
+    if (url === 'https://mei.pod.example/.well-known/openid-configuration') return { ok: true, json: async () => ({ issuer: 'https://pod.example/', authorization_endpoint: 'https://pod.example/.oidc/auth' }) };
+    // A pod whose host answers no discovery: the actor names the WebID, and
+    // the WebID document names the issuer.
+    if (url.startsWith('https://server.example/.well-known/webfinger')) return jrd('server.example', [], 'https://server.example/aisha/anything/ap/actor');
+    if (url === 'https://server.example/aisha/anything/ap/actor') return { ok: true, json: async () => ({ id: url, alsoKnownAs: ['https://server.example/aisha/profile/card#me'] }) };
+    if (url === 'https://server.example/aisha/profile/card#me') return { ok: true, json: async () => ([{ '@id': url, 'http://www.w3.org/ns/solid/terms#oidcIssuer': [{ '@id': 'https://idp.example/' }] }]) };
+    if (url === 'https://idp.example/.well-known/openid-configuration') return { ok: true, json: async () => ({ issuer: 'https://idp.example/', authorization_endpoint: 'https://idp.example/auth' }) };
+    return { ok: false, json: async () => ({}) };
+  };
+  const login = fediLogin({ dbName: 'x', fetch: stub });
+  const found = await login.resolve('@mei@front.example').catch((e) => ({ error: e.message }));
+  if (found.issuer !== 'https://pod.example/' || found.origin !== 'https://mei.pod.example' || found.actor !== 'https://front.example/u/mei/ap/actor') {
+    fail(`a fronted address did not resolve to its pod's login: ${JSON.stringify(found)}`); bad++;
+  }
+  const viaWebId = await login.resolve('@aisha@server.example').catch((e) => ({ error: e.message }));
+  if (viaWebId.issuer !== 'https://idp.example/' || viaWebId.webId !== 'https://server.example/aisha/profile/card#me') {
+    fail(`an address on a host without discovery did not resolve through its WebID: ${JSON.stringify(viaWebId)}`); bad++;
+  }
+  const typedWebId = await login.resolve('https://server.example/aisha/profile/card#me').catch((e) => ({ error: e.message }));
+  if (typedWebId.issuer !== 'https://idp.example/') { fail(`a typed WebID did not resolve: ${JSON.stringify(typedWebId)}`); bad++; }
+  const refused = await login.resolve('kwame@masto.example').then(() => '', (e) => e.message);
+  if (!/masto\.example is not a Solid pod/.test(refused)) { fail(`a Mastodon address was not refused in words: ${refused || 'resolved'}`); bad++; }
+  if (parseAddress('nonsense') !== null || parseAddress('@mei@Front.Example')?.at !== '@mei@front.example') { fail('parseAddress does not read @you@host'); bad++; }
+  // The account library tells a Mastodon address from a pod address and
+  // speaks to each: the Mastodon API for one, the outbox door for the other.
+  const { fediAccount, BROWSER_ACCOUNT_NOTICE } = await import(path.join(SESSION, 'fedi-account.mjs'));
+  const seen = [];
+  const acctStub = async (url, init = {}) => {
+    seen.push(`${init.method || 'GET'} ${url}`);
+    const ok = (body, headers = {}) => ({ ok: true, status: 200, headers: { get: (k) => headers[k] || null }, json: async () => body, text: async () => JSON.stringify(body) });
+    if (url.startsWith('https://masto.example/.well-known/webfinger')) return jrd('masto.example', ['https://masto.example/@kwame'], 'https://masto.example/users/kwame');
+    if (url === 'https://masto.example/api/v1/instance') return ok({ uri: 'masto.example', title: 'Masto' });
+    if (url === 'https://masto.example/api/v1/statuses' && init.method === 'POST') return ok({ id: '77', url: 'https://masto.example/@kwame/77' });
+    if (url.startsWith('https://masto.example/api/v1/timelines/home')) return ok([{ id: '1', url: 'https://masto.example/@aisha/1', created_at: '2026-09-20T10:00:00Z', content: '<p>hi</p>', account: { acct: 'aisha', display_name: 'Aisha', url: 'https://masto.example/@aisha' } }]);
+    if (url.startsWith('https://masto.example/api/v1/accounts/lookup')) return ok({ id: '9' });
+    if (url === 'https://masto.example/api/v1/accounts/9/follow') return ok({ following: true });
+    if (url === 'https://front.example/api/v1/instance' || url === 'https://mei.pod.example/api/v1/instance') return { ok: false, status: 404, json: async () => ({}) };
+    return stub(url, init);
+  };
+  const accounts = fediAccount({ dbName: 'x', fetch: acctStub, storage: undefined });
+  const kwame = await accounts.describe('@kwame@masto.example').catch((e) => ({ error: e.message }));
+  if (kwame.kind !== 'mastodon' || kwame.host !== 'masto.example') { fail(`a Mastodon address was not recognised: ${JSON.stringify(kwame)}`); bad++; }
+  const mei = await accounts.describe('@mei@front.example').catch((e) => ({ error: e.message }));
+  if (mei.kind !== 'pod' || mei.root !== 'https://mei.pod.example/anything/' || mei.issuer !== 'https://pod.example/') { fail(`a pod address was not recognised: ${JSON.stringify(mei)}`); bad++; }
+  // The Mastodon account acts through its server's API.
+  const store = { getItem: (k) => store.m.get(k) ?? null, setItem: (k, v) => store.m.set(k, String(v)), removeItem: (k) => store.m.delete(k), m: new Map() };
+  store.setItem('x:masto:account', JSON.stringify({ host: 'masto.example', token: 't', handle: '@kwame@masto.example', name: 'Kwame', actor: 'https://masto.example/@kwame' }));
+  const me = await fediAccount({ dbName: 'x', fetch: acctStub, storage: store }).current();
+  const posted = await me.post({ text: 'hello' }).catch((e) => ({ error: e.message }));
+  const tl = await me.timeline().catch((e) => ({ error: e.message }));
+  const followed = await me.follow('@aisha@masto.example').catch((e) => ({ error: e.message }));
+  if (me.kind !== 'mastodon' || me.notice !== null || posted.id !== '77' || tl[0]?.author?.handle !== '@aisha@masto.example' || followed.followed !== '@aisha@masto.example') {
+    fail(`the Mastodon account did not act through its API: ${JSON.stringify({ posted, tl, followed })}`); bad++;
+  }
+  // The pod account acts through its outbox door and reads its own records;
+  // a sealed key on the pod marks it browser-based, which sets the notice.
+  const doorSeen = [];
+  const podFetch = async (url, init = {}) => {
+    doorSeen.push(`${init.method || 'GET'} ${url}`);
+    if (url === 'https://front.example/u/mei/ap/outbox') return { ok: true, status: 202, headers: { get: (k) => (k === 'location' ? 'https://front.example/u/mei/ap/notes/n1' : null) }, text: async () => '' };
+    if (url === 'https://mei.pod.example/anything/ap-state/keys.json') return { ok: true, status: 200, json: async () => ({ v: 1, kdf: 'PBKDF2-SHA256', ct: 'x', salt: 'y' }) };
+    if (url === 'https://mei.pod.example/anything/ap-state/statuses.json') return { ok: true, status: 200, json: async () => ([{ noteId: 'https://x.example/n/1', actor: 'https://x.example/u/tamara', content: '<p>one</p>', published: '2026-09-20T09:00:00Z', kind: 'timeline' }, { noteId: 'https://x.example/n/2', actor: 'https://x.example/u/tamara', content: '<p>dm</p>', published: '2026-09-20T09:30:00Z', kind: 'timeline', direct: true }]) };
+    if (url === 'https://mei.pod.example/anything/ap-state/actors.json') return { ok: true, status: 200, json: async () => ({ 'https://x.example/u/tamara': { preferredUsername: 'tamara', name: 'Tamara' } }) };
+    return { ok: false, status: 404, json: async () => ({}), text: async () => '' };
+  };
+  const session = { webId: 'https://mei.pod.example/profile/card#me', fetch: podFetch, signOut: async () => {} };
+  const stubWithCard = async (url, init = {}) => {
+    if (url === 'https://mei.pod.example/profile/card#me') return { ok: true, json: async () => ([{ '@id': url, 'https://www.w3.org/ns/activitystreams#outbox': [{ '@id': 'https://front.example/u/mei/ap/outbox' }], 'http://xmlns.com/foaf/0.1/account': [{ '@id': 'https://front.example/u/mei/ap/actor' }] }]) };
+    if (url === 'https://front.example/u/mei/ap/actor') return { ok: true, json: async () => ({ id: url, preferredUsername: 'mei', name: 'Mei', followers: 'https://front.example/u/mei/ap/followers' }) };
+    return acctStub(url, init);
+  };
+  const podStore = { getItem: (k) => podStore.m.get(k) ?? null, setItem: (k, v) => podStore.m.set(k, String(v)), removeItem: (k) => podStore.m.delete(k), m: new Map() };
+  // Reach the pod account the way resume() would, with the session handed in.
+  const meiAcct = await fediAccount({ dbName: 'x', fetch: stubWithCard, storage: podStore })
+    ._podAccount(session, { handle: '@mei@front.example', actor: 'https://front.example/u/mei/ap/actor', root: 'https://mei.pod.example/anything/' });
+  const p2 = await meiAcct.post({ text: 'hello <b>' }).catch((e) => ({ error: e.message }));
+  const t2 = await meiAcct.timeline().catch((e) => ({ error: e.message }));
+  const f2 = await meiAcct.follow('@tamara@x.example').catch((e) => ({ error: e.message }));
+  const doorBodies = doorSeen.filter((s) => s.startsWith('POST https://front.example/u/mei/ap/outbox')).length;
+  if (meiAcct.kind !== 'pod' || meiAcct.notice !== BROWSER_ACCOUNT_NOTICE || !p2.queued || p2.id !== 'https://front.example/u/mei/ap/notes/n1'
+    || t2.length !== 1 || t2[0].author.handle !== '@tamara@x.example' || !f2.queued || doorBodies !== 2) {
+    fail(`the pod account did not act through its door: ${JSON.stringify({ notice: meiAcct.notice, p2, t2, f2, doorBodies })}`); bad++;
+  }
+  const bound = code(read(path.join(root, 'web/app/oidc-session.mjs')));
+  if (!/dbName:\s*'fedipod-oidc'/.test(bound)) { fail("web/app/oidc-session.mjs must bind dbName 'fedipod-oidc' — every signed-in browser holds its session under that name"); bad++; }
+  if (!bad) pass('lib/session/ imports nothing above itself, names no application, tells a Mastodon address from a pod one and acts through each, and the app binds its own database name');
+}
+
 console.log(failures ? `\n${failures} failure(s)` : '\npod layer intact');
 process.exit(failures ? 1 : 0);

package/scripts/check-sizes.mjs

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+// check-sizes.mjs — no runtime source file over 1,000 lines. The split of
+// 2026-09-11 made every module readable one part at a time; this keeps it so.
+// Run by `npm test`. Exits 1 naming the offenders.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LIMIT = 1000;
+const ROOTS = ['lib', 'bin', 'web/app', 'web/front', 'web/admin', 'netlify/functions', 'packages/fedipod-server/src', 'packages/css-nextgraph/src', 'packages/fedipod-bb/src'];
+const FILES = ['run-agent.mjs'];
+const SKIP = /\/(dist|site|node_modules|vendor|client|shims)\//u;
+const EXT = /\.(mjs|js|ts)$/u;
+
+const walk = (dir, out = []) => {
+  for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+    const p = path.join(dir, e.name);
+    if (e.isDirectory()) { if (!SKIP.test(p + '/')) walk(p, out); }
+    else if (EXT.test(e.name) && !SKIP.test(p)) out.push(p);
+  }
+  return out;
+};
+const files = [...FILES.map(f => path.join(root, f)), ...ROOTS.flatMap(r => (fs.existsSync(path.join(root, r)) ? walk(path.join(root, r)) : []))];
+const over = files
+  .map(f => ({ f: path.relative(root, f), n: fs.readFileSync(f, 'utf8').split('\n').length }))
+  .filter(x => x.n > LIMIT)
+  .sort((a, b) => b.n - a.n);
+if (over.length) {
+  console.error(`check-sizes: ${over.length} runtime file(s) over ${LIMIT} lines:`);
+  for (const x of over) console.error(`  ${String(x.n).padStart(6)}  ${x.f}`);
+  process.exit(1);
+}
+console.log(`check-sizes: ${files.length} runtime files, none over ${LIMIT} lines`);

package/scripts/refresh-contexts.mjs

@@ -25,7 +25,13 @@ for (const m of module_.matchAll(/"([^"]+)":\s*(\w+),/gu)) {
 }
 
 // Held beside fedify's set, not from it: fetched once by hand and kept.
-const EXTRA = { 'http://www.w3.org/ns/anno.jsonld': 'anno.json' };
+const EXTRA = {
+  'http://www.w3.org/ns/anno.jsonld': 'anno.json',
+  // The litepub schema Pleroma and Akkoma serve per instance, and the quote
+  // terms Mastodon declares inline; see lib/core/contexts/index.mjs.
+  'http://litepub.social/ns': 'litepub-0.1.json',
+  'https://w3id.org/fep/044f': 'quotes.json',
+};
 
 for (const file of Object.values(map)) fs.copyFileSync(path.join(src, file), path.join(dest, file));
 Object.assign(map, EXTRA);