fedipod 1.7.0 → 1.10.0

package/lib/gateway/front-core.mjs

@@ -16,7 +16,7 @@
 // HTTPS box is another. UN-DEPLOYED — nothing in FediPod runs it.
 
 import crypto from 'node:crypto';
-import { handleDelivery } from './gateway-core.mjs';
+import { handleDelivery, handleOwnerPost } from './gateway-core.mjs';
 import { readCapped, safeFetch, isLoopbackHost } from '../shared/safefetch.mjs';
 import * as podRoot from '../pod/root.mjs';
 import * as podPolicy from '../pod/policy.mjs';
@@ -26,11 +26,17 @@ import { podBaseOfWebId } from '../pod/urls.mjs';
 // wire.mjs: wire drags the agent's whole HTML pipeline (sanitize-html and
 // friends), which a serverless front must never carry — it crashed the
 // deployed function before it answered its first request.
-const jrd = ({ handle, host, actor, aliases = [] }) => ({
+const jrd = ({ handle, host, actor, aliases = [], page = null }) => ({
   subject: `acct:${handle}@${host}`,
   ...(aliases.length ? { aliases } : {}),
-  links: [{ rel: 'self', type: 'application/activity+json', href: actor }],
+  links: [
+    { rel: 'self', type: 'application/activity+json', href: actor },
+    ...(page ? [{ rel: 'http://webfinger.net/rel/profile-page', type: 'text/html', href: page }] : []),
+  ],
 });
+// The public profile page of any account the front answers for lives on
+// its pod, whether the address is the front's or the pod's own.
+const profilePageOf = (rec) => (rec?.podHome ? rec.podHome + 'ap/profile.html' : null);
 
 const AP_CT = 'application/activity+json';
 
@@ -41,10 +47,13 @@ async function verifyPodToken(request, pathname, verifier) {
   const authz = request.headers.get('authorization');
   if (!authz) return null;
   try {
-    const v = verifier || (await import('@solid/access-token-verifier')).createSolidTokenVerifier();
     const dpop = request.headers.get('dpop');
+    // Solid-OIDC binds the token to a key the client proves on every request;
+    // a token shown without the proof is one anyone who saw it could show.
+    if (!dpop) { console.log(`front: pod token without a DPoP proof refused on ${pathname}`); return null; }
+    const v = verifier || (await import('@solid/access-token-verifier')).createSolidTokenVerifier();
     const url = request.url;
-    const { webid } = await v(authz, dpop ? { header: dpop, method: request.method, url } : undefined);
+    const { webid } = await v(authz, { header: dpop, method: request.method, url });
     return webid || null;
   } catch (e) {
     // Said aloud: a token the front will not take is otherwise a bare 401 to
@@ -597,8 +606,27 @@ async function route(request, ctx) {
     // is the alias, so a client signing in by the fronted address can find
     // the pod (and its login) without a lookup only the host could answer.
     const podActor = rec.inboxOnly ? [] : [rec.podHome + 'ap/actor'];
-    return j(200, jrd({ handle: m[1], host: ctx.host, actor: rec.actorUrl, aliases: podActor }),
+    const out = j(200, jrd({ handle: m[1], host: ctx.host, actor: rec.actorUrl, aliases: podActor, page: profilePageOf(rec) }),
       'application/jrd+json');
+    // RFC 7033: a JRD is read from any origin.
+    out.headers['access-control-allow-origin'] = '*';
+    return out;
+  }
+
+  // The short address a person types: https://<host>/@handle opens the
+  // profile page, the way most Fediverse servers spell it. /@handle@pod-host
+  // is the same for an account whose address is its pod's, which the front
+  // holds under that full address — the form other servers use for a
+  // profile that lives elsewhere.
+  const at = /^\/@([^/@]+)(?:@([^/@]+))?$/u.exec(pathname);
+  if (at) {
+    const handle = decodeURIComponent(at[1]).toLowerCase();
+    const host = at[2] ? decodeURIComponent(at[2]).toLowerCase() : null;
+    const key = host && host !== String(ctx.host).toLowerCase() ? `${handle}@${host}` : handle;
+    const rec = await ctx.lookup(key);
+    const page = rec && profilePageOf(rec);
+    if (!page) return notFound();
+    return { status: 302, headers: { location: page, 'cache-control': 'no-store' }, body: '' };
   }
 
   const up = parseUserPath(pathname);
@@ -619,6 +647,48 @@ async function route(request, ctx) {
     return { status, headers: {}, body: '' };
   }
 
+  // Outbox: the owner's own post, from any client that speaks ActivityPub
+  // client-to-server (dokieli, say). Cross-origin by nature — such a client is
+  // a page on another site — so this route answers a preflight and carries
+  // CORS headers; the owner's pod token is the credential, so any origin may
+  // ask. GET stays a read: the pod's document for a fronted account, sent on
+  // to the pod for a door account whose documents live at their own address.
+  if (up.rest === 'ap/outbox') {
+    const cors = {
+      'access-control-allow-origin': '*',
+      'access-control-allow-methods': 'GET, POST, OPTIONS',
+      'access-control-allow-headers': 'Authorization, DPoP, Content-Type, Slug, Link',
+      'access-control-expose-headers': 'Location, Accept-Post',
+      'access-control-max-age': '86400',
+    };
+    if (request.method === 'OPTIONS') {
+      // Accept-Post names JSON only: a client that reads it (dokieli) sends
+      // JSON-LD when HTML is not offered.
+      // body null, not '': a Response refuses any body on a 204, and the
+      // function adapter hands `body` straight to one.
+      return { status: 204, headers: { ...cors, allow: 'GET, POST, OPTIONS',
+        'accept-post': 'application/ld+json, application/activity+json' }, body: null };
+    }
+    if (request.method === 'POST') {
+      const json = (status, obj, extra = {}) => ({ status,
+        headers: { ...cors, 'content-type': 'application/json', 'cache-control': 'no-store', ...extra },
+        body: JSON.stringify(obj) });
+      const webid = await verifyPodToken(request, pathname, ctx.verifier);
+      if (!webid) return json(401, { error: 'a Solid-OIDC token proving this account\'s owner is required' });
+      const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
+      if (!owner) return json(403, { error: 'this outbox belongs to its owner alone' });
+      const { status, reason, location } = await handleOwnerPost(request, identFor(rec),
+        { podPut: (u, b, ct) => ctx.podPut(up.handle, u, b, ct), ownerWebId: webid });
+      console.log(`door @${up.handle}: owner post → ${status} (${reason})`);
+      if (status !== 202) return json(status, { error: reason });
+      return json(202, { accepted: true, ...(location ? { object: location } : {}),
+        note: 'it goes out when your FediPod agent next runs' }, location ? { location } : {});
+    }
+    if (rec.inboxOnly && (request.method === 'GET' || request.method === 'HEAD')) {
+      return { status: 303, headers: { ...cors, location: rec.podHome + 'ap/outbox', 'cache-control': 'no-store' }, body: '' };
+    }
+  }
+
   // Everything else is a public GET, served by reading the user's pod and
   // rewriting pod ids to the front. The actor also gets its handle and inbox
   // fixed to the front so a consumer cross-checks it consistently.

package/lib/gateway/gateway-core.mjs

@@ -110,4 +110,44 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
   return { status: 202, reason: v.verified ? 'verified' : 'buffered-unverified' };
 }
 
+// The outbox door: the owner's own post, taken on their behalf.
+//
+// A client such as dokieli POSTs an activity — or a bare object — to the
+// outbox address the actor advertises. The door holds no key and mints nothing:
+// it checks that the token proves the account's owner (the caller has already
+// done that and hands in `owner`), writes the bytes into the pod inbox exactly
+// as verified mail is written, and stamps them with a receipt whose method is
+// `c2s` and whose actor is this account. The drain hands such an item to the
+// client-to-server dispatcher, which publishes and delivers it — so the post
+// goes out when the agent next runs, the same way inbound mail is read.
+//
+// `slug` is the name the client asked for its new document. It rides in the
+// receipt so the dispatcher can use it, and it is what lets the door answer a
+// Location before anything exists: the object will live at notesPrefix+slug
+// unless that name is taken, in which case the agent mints another.
+export const SLUG_OK = /^[A-Za-z0-9._-]{1,64}$/u;
+export const safeSlug = (s) => (typeof s === 'string' && SLUG_OK.test(s) && !/^\.+$/u.test(s) ? s : null);
+
+export async function handleOwnerPost(request, ident, { podPut, ownerWebId, maxBytes = DEFAULT_MAX_BYTES } = {}) {
+  if (!ident.hmacSecret) return { status: 409, reason: 'this account has no door secret — attach it again' };
+  let raw;
+  try { raw = await request.text(); } catch { return { status: 400, reason: 'unreadable body' }; }
+  if (Buffer.byteLength(raw) > maxBytes) return { status: 413, reason: 'too large' };
+  let doc;
+  try { doc = JSON.parse(raw); } catch { return { status: 400, reason: 'unparsable JSON' }; }
+  if (!doc || typeof doc !== 'object' || Array.isArray(doc) || !doc.type) {
+    return { status: 400, reason: 'a typed ActivityStreams object is required' };
+  }
+  const slug = safeSlug(request.headers.get('slug'));
+  const receipt = signReceipt({
+    v: 1, verified: true, method: 'c2s', keyId: ownerWebId || null, actor: ident.actorUrl,
+    checks: ['owner-token'], reason: 'owner', gateway: ident.gatewayWebId, ...(slug ? { slug } : {}),
+  }, ident.hmacSecret);
+  const hash = sha256hex(raw);
+  const okA = await inbox.appendVerifiedDelivery(podPut, ident.inboxUrl, hash, raw);
+  if (!okA) return { status: 502, reason: 'pod inbox write failed' };
+  await inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt);
+  return { status: 202, reason: 'accepted', location: slug && ident.notesPrefix ? ident.notesPrefix + slug : null };
+}
+
 export const _internal = { isBlocked, concernsUsAtEdge, httpUrl, sha256hex };

package/lib/gateway/httpsig.mjs

@@ -58,10 +58,14 @@ export async function verifyHttpSignature(request, { documentLoader, keyCache, t
   } catch {
     result = null;   // the library itself failed — no more informative than a bad signature
   }
+  // Which signature the sender used: RFC 9421 carries a Signature-Input
+  // header beside Signature; the cavage draft carries Signature alone. The
+  // library picks the verifier by the same header.
+  const method = request.headers.has('signature-input') ? 'rfc9421' : 'draft-cavage';
   if (result?.verified) {
     const key = result.key;
     return {
-      verified: true, method: 'draft-cavage',
+      verified: true, method,
       keyId: key.id?.href ?? null, actor: key.ownerId?.href ?? null, reason: null,
       checks: { signature: true, digest: true, dateSkew: true, keyFetched: true },
     };
@@ -75,12 +79,12 @@ export async function verifyHttpSignature(request, { documentLoader, keyCache, t
   }
   if (kind === 'keyFetchError') {
     return {
-      verified: false, method: 'draft-cavage', keyId: null, actor: null,
+      verified: false, method, keyId: null, actor: null,
       reason: 'key-unfetchable', checks: { signature: false, keyFetched: false },
     };
   }
   return {
-    verified: false, method: 'draft-cavage', keyId: null, actor: null,
+    verified: false, method, keyId: null, actor: null,
     reason: 'bad-signature', checks: { signature: false },
   };
 }

package/lib/pod/actor.mjs

@@ -69,8 +69,8 @@ export async function writeProfilePage(pod, urls, html) {
  * parsed graph does not mention the WebID, and patches exactly the statements
  * involved rather than rewriting a document full of things that are not ours.
  */
-export function linkInWebIdProfile(pod, { actorUrl, accountName, kind = 'person' }) {
-  return pod.linkAccountInProfile({ actorUrl, accountName, kind });
+export function linkInWebIdProfile(pod, { actorUrl, accountName, kind = 'person', outbox = null }) {
+  return pod.linkAccountInProfile({ actorUrl, accountName, kind, outbox });
 }
 
 // ---- anyone at all ----

package/lib/pod/transport.mjs

@@ -407,7 +407,7 @@ export class PodTransport {
    * says all of it. The parsed graph must mention the WebID before anything is
    * written back — an empty or foreign body must never become the new profile.
    */
-  async linkAccountInProfile({ actorUrl, accountName, kind = 'person' }) {
+  async linkAccountInProfile({ actorUrl, accountName, kind = 'person', outbox = null }) {
     const docUrl = this.webId.split('#')[0];
     const res = await this.fetch(docUrl, { headers: { accept: 'text/turtle' } });
     if (res.status >= 400) throw new Error(`[${this.label}] GET ${docUrl} → ${res.status}`);
@@ -424,11 +424,17 @@ export class PodTransport {
       [actor, RDF('type'), FOAF('OnlineAccount')],
       [actor, RDF('type'), kind === 'group' ? AS('Group') : AS('Person')],
       [actor, FOAF('accountName'), $rdf.literal(accountName)],
+      // Where a Solid client posts on this person's behalf (`as:outbox` on the
+      // WebID is what dokieli reads); only where a door exists to take it.
+      ...(outbox ? [[me, AS('outbox'), $rdf.sym(outbox)]] : []),
     ];
     const missing = wanted.filter(([s, p, o]) => !g.holds(s, p, o, doc));
     // A handle change leaves the old accountName behind; ours is replaced.
-    const stale = g.statementsMatching(actor, FOAF('accountName'), null, doc)
-      .filter(st => st.object.value !== accountName);
+    // Likewise an outbox that moved.
+    const stale = [
+      ...g.statementsMatching(actor, FOAF('accountName'), null, doc).filter(st => st.object.value !== accountName),
+      ...(outbox ? g.statementsMatching(me, AS('outbox'), null, doc).filter(st => st.object.value !== outbox) : []),
+    ];
     if (!missing.length && !stale.length) return false;
     // A patch touches these statements and nothing else. Rewriting the whole
     // profile re-serialises statements that are not ours — the OIDC issuer

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.7.0",
+  "version": "1.10.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",

package/run-agent.mjs

@@ -37,6 +37,7 @@ import { RemotePod } from './lib/device/remote.mjs';
 import { Deliverer } from './lib/core/deliver.mjs';
 import { Publisher } from './lib/core/publisher/index.mjs';
 import { Intake } from './lib/core/intake/index.mjs';
+import { C2S } from './lib/client/c2s.mjs';
 import { TagFeed } from './lib/connections/tagfeed.mjs';
 import { ImportWorker } from './lib/connections/import.mjs';
 import { Atproto } from './lib/connections/atproto.mjs';
@@ -122,6 +123,7 @@ export class Agent {
       update: this.updateInfo || null,
       inboxCooldownFor: this.intake?.drainCooldownUntil
         ? Math.max(0, Math.round((this.intake.drainCooldownUntil - Date.now()) / 1000)) : 0,
+      stateSkipped: this.store.lastSkipped || [],
     };
   }
 
@@ -323,12 +325,14 @@ export class Agent {
       actorId: this.urls.actor, edPrivate: keys.edPrivate,
       proofKeyId: assertionKeyId(this.urls),
       log: this.log, passive: this.viewer,
+      onGone: () => this.publisher.publishCollections({ followers: true }),
     });
     this.publisher = new Publisher({
       config, remote: this.remote, store: this.store,
       deliverer: this.deliverer, publicKeyPem: keys.rsaPublicPem,
       assertionKey: keys.edPublicMultibase, log: this.log,
       resolveMention: (h) => resolveHandle(this, h),
+      resolveActor: (u) => this.intake.fetchAP(u),
       // Inside a pod server the client surface answers on the pod's own
       // origin, so it can be advertised. Standalone it is on loopback, and
       // naming it in a world-readable actor would send clients nowhere.
@@ -336,11 +340,15 @@ export class Agent {
     });
     // Intake is constructed even for viewers — its signed fetchAP powers
     // search/deref; start() (draining) is active-only.
+    // The dispatcher the admin surface also builds; this one is for what the
+    // Gateway's outbox door took on the owner's behalf and the drain finds.
+    this.c2s = new C2S({ agent: this, log: this.log });
     this.intake = new Intake({
       config, urls: this.urls, remote: this.remote, store: this.store,
       deliverer: this.deliverer, publisher: this.publisher, log: this.log, lease: this.lease,
       archive: this.privateStorage(cred, 'archive'),
       push: !this.embedded, pollSeconds: this.pollSeconds || null,
+      ownerPost: (a, o) => this.c2s.dispatch(a, o),
     });
     // The CSV-import worker: paced, resumable, armed only while active.
     this.importer?.stop();
@@ -514,6 +522,9 @@ export class Agent {
     this.viewer = false;
     clearInterval(this.refreshTimer);
     if (promoted) await this.refreshBeforeActing();
+    // Own posts the outbox names and the timeline index lacks come back here,
+    // before anything acts on the index.
+    await this.publisher.healStatuses().catch(e => this.log(`healing the timeline index: ${e.message}`));
     this.lease.onLost = () => this.demote();
     this.lease.startRenewal();
     this.deliverer.startQueue();

package/scripts/refresh-contexts.mjs

@@ -24,13 +24,18 @@ for (const m of module_.matchAll(/"([^"]+)":\s*(\w+),/gu)) {
   if (idents[m[2]]) map[m[1]] = idents[m[2]];
 }
 
+// Held beside fedify's set, not from it: fetched once by hand and kept.
+const EXTRA = { 'http://www.w3.org/ns/anno.jsonld': 'anno.json' };
+
 for (const file of Object.values(map)) fs.copyFileSync(path.join(src, file), path.join(dest, file));
+Object.assign(map, EXTRA);
 fs.writeFileSync(path.join(dest, 'map.json'), `${JSON.stringify(map, null, 2)}\n`);
 
 const names = Object.fromEntries(Object.keys(map).map((u, i) => [u, `ctx${i}`]));
 const header = fs.readFileSync(path.join(dest, 'index.mjs'), 'utf8').split('\nimport ')[0];
 let out = `${header}\n`;
 for (const [url, file] of Object.entries(map)) out += `import ${names[url]} from './${file}' with { type: 'json' };\n`;
+// (EXTRA entries ride along in `map` above, so index.mjs and map.json keep them.)
 out += '\n/** URL → the context document itself. Nothing outside this map is ever resolved. */\nexport const CONTEXTS = {\n';
 for (const url of Object.keys(map)) out += `  '${url}': ${names[url]},\n`;
 out += '};\n';

package/scripts/stage-site.mjs

@@ -94,6 +94,7 @@ fs.writeFileSync(path.join(site, '_redirects'), [
   '/api/agent              /.netlify/functions/front  200',
   '/u/*                    /.netlify/functions/front  200',
   '/.well-known/*          /.netlify/functions/front  200',
+  '/@*                     /.netlify/functions/front  200',
   '/install                /.netlify/functions/front  200',
   '/run                    /.netlify/functions/front  200',
   '/roster                 /.netlify/functions/front  200',

package/web/admin/index.html

@@ -275,6 +275,8 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
 
 <section id="pane-identity" hidden>
   <dl id="facts"></dl>
+  <!-- State documents the agent could not read on its last load, if any. -->
+  <p class="err" id="state-skipped" role="alert" hidden></p>
   <!-- Declared here, and render() puts these on the kind row — the row they
        belong to is generated, so this is the only place they can be written
        down. Each reads as the setting it would change, so what it shows IS the

package/web/admin/upkeep.js

@@ -145,8 +145,16 @@ const INBOX_PROMPT_AT = 500;
 let dismissed = false;
 
 async function renderInbox() {
-  if (dismissed) return;
   const { json: st } = await api('/status');
+  // A state document the last load could not read is a timeline or a contact
+  // list quietly missing; the page says which, under the facts.
+  const skipped = st?.stateSkipped || [];
+  const line = $('state-skipped');
+  line.hidden = !skipped.length;
+  line.textContent = skipped.length
+    ? `${skipped.length} state document${skipped.length === 1 ? '' : 's'} could not be read on the last load: ${skipped.join(', ')}.`
+    : '';
+  if (dismissed) return;
   const box = st?.inbox;
   const panel = $('pane-inbox');
   if (!box || box.count < INBOX_PROMPT_AT) { panel.hidden = true; return; }

package/web/app/README.md

@@ -7,7 +7,7 @@ See `claude/plans/browser-agent.md` for the whole design and status.
 |---|---|
 | `pod-auth.mjs` | The pod side of sign-in, browser-native: create a CSS account + pod, mint a client credential, and a DPoP-bound `fetch` that writes to the pod. The twin of `lib/device/account.mjs` + `vendor/idp-grant.cjs`. |
 | `keystore.mjs` | WebCrypto RSA/Ed25519 key generation, and wrapping the keys under the account password (PBKDF2-SHA256 + AES-GCM-256). The pod holds only the wrapped form, so the pod's host cannot sign as you. |
-| `keys-browser.mjs` | Importing a keys record for signing, and finding one: this browser's opened copy in IndexedDB first, else the pod's. A wrapped one the browser has not opened yet raises `KeyPasswordNeeded`, which `boot.mjs` answers with the unlock pane — once per browser. |
+| `keys-browser.mjs` | Importing a keys record for signing, and finding one: this browser's opened copy in IndexedDB first, else the pod's. A wrapped one the browser has not opened yet raises `KeyPasswordNeeded`, which `boot.mjs` answers with the unlock pane — once per browser. The same pane offers a new key wrapped under the password used now, for someone who no longer has the sign-up password. |
 | `signup.mjs` | The `fedipod setup` flow, in the browser, up to publish: account, pod, credential, keys locked on the pod (owner-only ACL written *before* the key). Produces the credential/keys/config shapes the agent already reads. |
 | `shims/fedify-sig.mjs` | Browser stand-in for `@fedify/fedify/sig` (which will not bundle for a browser). `sign()` returns signed headers as data for the relay; `signRequest()` wraps it Fedify-shaped. Proven byte-identical to Fedify. |
 | `shims/node-crypto.mjs` | Browser stand-in for `node:crypto` — the small synchronous slice the agent uses, via crypto-browserify, plus native WebCrypto. |

package/web/app/agent.mjs

@@ -12,6 +12,7 @@ import { PodStore } from '../../lib/core/store.mjs';
 import { HttpStorage } from '../../lib/core/storage.mjs';
 import { Publisher } from '../../lib/core/publisher/index.mjs';
 import { Intake } from '../../lib/core/intake/index.mjs';
+import { C2S } from '../../lib/client/c2s.mjs';
 import { Lease } from '../../lib/core/lease.mjs';
 import { MastoApi } from '../../lib/client/masto/index.mjs';
 import { TagFeed } from '../../lib/connections/tagfeed.mjs';
@@ -84,6 +85,9 @@ export class BrowserAgent {
       // whole document back over newer state. Read what is actually there
       // before acting on it.
       await this.store.load({ force: true }).catch((e) => this.log(`re-reading state: ${e.message}`));
+      // Own posts the outbox names and the timeline index lacks come back
+      // here, before anything acts on the index.
+      await this.publisher.healStatuses().catch((e) => this.log(`healing the timeline index: ${e.message}`));
       // And start delivering again, since demote() stopped it. startQueue() is
       // idempotent, so a goActive() that was already active costs nothing.
       this.deliverer?.startQueue?.();
@@ -219,6 +223,7 @@ export class BrowserAgent {
       // The relay finds the account by the front's own key for it, which for a
       // mail-door account is the full address, not the bare handle.
       handle: doorKeyOf(config.gateway?.url) || config.handle, sessionFetch: session.fetch,
+      onGone: () => this.publisher.publishCollections({ followers: true }),
     });
 
     this.publisher = new Publisher({
@@ -228,6 +233,7 @@ export class BrowserAgent {
       // gives its publisher. Without it no mention from the browser ever
       // resolved: a direct message went to nobody, a mention notified no one.
       resolveMention: (h) => resolveHandle(this, h),
+      resolveActor: (u) => this.intake.fetchAP(u),
     });
 
     // The Bluesky connection, stamped to this actor. The same client the Node
@@ -257,9 +263,14 @@ export class BrowserAgent {
     // read-only until the owner acts on it and it takes over. Written with fresh
     // fetches, never the cached store. Passed into Intake so the drain checks it.
     this.lease = new Lease({ url: this.urls.state + 'lease.json', fetchImpl: podFetch, log: this.log });
+    // The client-to-server dispatcher, here only for what the Gateway's
+    // outbox door takes on the owner's behalf: the browser answers no
+    // /ap/outbox of its own.
+    this.c2s = new C2S({ agent: this, log: this.log });
     this.intake = new Intake({
       config: this.store.getConfig(), urls: this.urls, remote: this.remote,
       store: this.store, deliverer: this.deliverer, publisher: this.publisher, log: this.log, push: true, lease: this.lease,
+      ownerPost: (a, o) => this.c2s.dispatch(a, o),
     });
     // The Mastodon facade the service worker serves.
     //
@@ -356,6 +367,7 @@ export class BrowserAgent {
       podRequests: this.remote?.stats?.() || null,
       update: null,
       inboxCooldownFor: 0,
+      stateSkipped: this.store?.lastSkipped || [],
     };
   }
 

package/web/app/boot.mjs

@@ -16,7 +16,7 @@ import { podBaseOfWebId } from '../../lib/pod/urls.mjs';
 import { podLayout } from '../../lib/pod/root.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
 import { beginLogin, completeLogin, getSession, signOut } from './oidc-session.mjs';
-import { unwrapKeys, isKeyEnvelope } from './keystore.mjs';
+import { generateKeys, wrapKeys, unwrapKeys, isKeyEnvelope } from './keystore.mjs';
 import { cacheOpenedKeys } from './keys-browser.mjs';
 
 const REDIRECT = `${location.origin}/`;   // the app root doubles as the OIDC callback
@@ -64,30 +64,50 @@ async function bootWorker({ reset = false } = {}) {
 //
 // The unwrap happens HERE, in the page, and not in the worker: the worker boots
 // itself whenever the browser restarts it, with nobody present to type anything.
-window.fedipodUnlock = async (password) => {
-  if (!password) throw new Error('Enter your account password.');
+//
+// Both paths below read the account's config and key the same way: with the
+// session, as the owner, through the transport rather than the bare session —
+// a pod read like any other, with the retry ladder that exists because the pod
+// host throttles bursts.
+async function readAccountState() {
   const session = await getSession();
   if (!session) throw new Error('Sign in first.');
-  // The config on the pod says where this account's state lives; the key sits
-  // beside it. Both are read with the session, as the owner.
   const podFromWebId = podBaseOfWebId(session.webId);   // a suffix-based host, or its own host
   const state = `${podFromWebId}${AP_ROOT}ap-state/`;
-  // Through the transport rather than the bare session: this is a pod read
-  // like any other, and going round it skipped the retry ladder that exists
-  // because the pod host throttles bursts.
   const remote = new BrowserRemotePod(session, { webId: session.webId, role: 'signup', log: () => {} });
   const urls = { state };
   const [cfg, doc] = await Promise.all([
     podState.readConfig(remote, urls), podState.readWrappedKeys(remote, urls),
   ]);
-  if (!cfg || !doc) throw new Error(`could not read this account's config and key under ${state}`);
+  if (!cfg) throw new Error(`could not read this account's config under ${state}`);
+  const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
+  return { remote, urls, cfg, doc, actorUrl };
+}
+
+window.fedipodUnlock = async (password) => {
+  if (!password) throw new Error('Enter your password.');
+  const { doc, actorUrl } = await readAccountState();
+  if (!doc) throw new Error('could not read this account\'s key on the pod');
   if (!isKeyEnvelope(doc)) throw new Error('this account\'s key is not locked — nothing to unlock');
   const rec = await unwrapKeys(doc, password);          // throws 'wrong password'
-  const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
   await cacheOpenedKeys(actorUrl, rec);
   await bootWorker();
 };
 
+// The same pane, for someone who no longer has the sign-up password: a new key,
+// wrapped under the password they use now, written over the pod's copy. Nothing
+// is unwrapped, so the old password is never needed. The boot that follows
+// publishes the new public key (agent.goActive → publishProfile).
+window.fedipodNewKey = async (password) => {
+  if (!password) throw new Error('Enter the password you use for your pod now.');
+  const { remote, urls, cfg, actorUrl } = await readAccountState();
+  const keys = await generateKeys();
+  keys.mintedFor = cfg.gateway?.frontActor || actorUrl;   // one key, one actor (signup.mjs)
+  await podState.writeWrappedKeys(remote, urls, await wrapKeys(keys, password));
+  await cacheOpenedKeys(actorUrl, keys);
+  await bootWorker();
+};
+
 // New account: create the account, pod, key, config and gateway attach (this
 // needs the password once), then redirect to the pod's login to establish the
 // durable session. The agent boots on return, reading config + key from the pod.
@@ -213,6 +233,25 @@ if (typeof document !== 'undefined') (async () => {
   };
   $('unlock-go')?.addEventListener('click', doUnlock);
   $('unlock-password')?.addEventListener('keydown', (e) => { if (e.key === 'Enter') doUnlock(); });
+  // The new-key path: one click reveals the confirmation, the second acts.
+  $('unlock-newkey')?.addEventListener('click', () => {
+    $('unlock-newkey-confirm').hidden = false;
+    $('unlock-password').focus();
+  });
+  const doNewKey = async () => {
+    $('unlock-error').textContent = '';
+    const btn = $('unlock-newkey-go'); btn.disabled = true;
+    try {
+      await window.fedipodNewKey($('unlock-password').value);
+      $('unlock-password').value = '';
+      location.href = '/admin/client/';
+    } catch (err) {
+      $('unlock-error').textContent = err.message || String(err);
+      btn.disabled = false;
+      $('unlock-password').select();
+    }
+  };
+  $('unlock-newkey-go')?.addEventListener('click', doNewKey);
 
 
   // The client shell's bar returns here for two things, and neither continues

package/web/app/dist/boot.js

@@ -33075,7 +33075,7 @@ var PodTransport = class {
    * says all of it. The parsed graph must mention the WebID before anything is
    * written back — an empty or foreign body must never become the new profile.
    */
-  async linkAccountInProfile({ actorUrl, accountName, kind = "person" }) {
+  async linkAccountInProfile({ actorUrl, accountName, kind = "person", outbox = null }) {
     const docUrl = this.webId.split("#")[0];
     const res = await this.fetch(docUrl, { headers: { accept: "text/turtle" } });
     if (res.status >= 400) throw new Error(`[${this.label}] GET ${docUrl} \u2192 ${res.status}`);
@@ -33091,10 +33091,16 @@ var PodTransport = class {
       [me, FOAF("account"), actor],
       [actor, RDF3("type"), FOAF("OnlineAccount")],
       [actor, RDF3("type"), kind === "group" ? AS("Group") : AS("Person")],
-      [actor, FOAF("accountName"), literal2(accountName)]
+      [actor, FOAF("accountName"), literal2(accountName)],
+      // Where a Solid client posts on this person's behalf (`as:outbox` on the
+      // WebID is what dokieli reads); only where a door exists to take it.
+      ...outbox ? [[me, AS("outbox"), namedNode2(outbox)]] : []
     ];
     const missing = wanted.filter(([s, p, o]) => !g.holds(s, p, o, doc));
-    const stale = g.statementsMatching(actor, FOAF("accountName"), null, doc).filter((st2) => st2.object.value !== accountName);
+    const stale = [
+      ...g.statementsMatching(actor, FOAF("accountName"), null, doc).filter((st2) => st2.object.value !== accountName),
+      ...outbox ? g.statementsMatching(me, AS("outbox"), null, doc).filter((st2) => st2.object.value !== outbox) : []
+    ];
     if (!missing.length && !stale.length) return false;
     const deletes = stale.map((st2) => [st2.subject, st2.predicate, st2.object]);
     if (await this.patchDocument(docUrl, missing, deletes)) return true;
@@ -33202,6 +33208,7 @@ var BrowserRemotePod = class extends PodTransport {
 // lib/pod/state.mjs
 var readWrappedKeys = (pod, urls) => pod.getJson(urls.state + "keys.json");
 var readConfig = (pod, urls) => pod.getJson(urls.state + "config.json");
+var writeWrappedKeys = (pod, urls, envelope) => pod.putJson(urls.state + "keys.json", envelope, "application/json");
 var writeConfig = (pod, urls, config) => pod.putJson(urls.state + "config.json", config, "application/json");
 async function provisionKey(pod, { stateUrl, keysUrl, envelope }) {
   await pod.setAcl(stateUrl, []);
@@ -33737,8 +33744,7 @@ async function bootWorker({ reset = false } = {}) {
   worker.postMessage({ type: "boot", frontOrigin: location.origin });
   await booted;
 }
-window.fedipodUnlock = async (password) => {
-  if (!password) throw new Error("Enter your account password.");
+async function readAccountState() {
   const session = await getSession();
   if (!session) throw new Error("Sign in first.");
   const podFromWebId = podBaseOfWebId(session.webId);
@@ -33750,13 +33756,28 @@ window.fedipodUnlock = async (password) => {
     readConfig(remote, urls),
     readWrappedKeys(remote, urls)
   ]);
-  if (!cfg || !doc) throw new Error(`could not read this account's config and key under ${state}`);
+  if (!cfg) throw new Error(`could not read this account's config under ${state}`);
+  const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
+  return { remote, urls, cfg, doc, actorUrl };
+}
+window.fedipodUnlock = async (password) => {
+  if (!password) throw new Error("Enter your password.");
+  const { doc, actorUrl } = await readAccountState();
+  if (!doc) throw new Error("could not read this account's key on the pod");
   if (!isKeyEnvelope(doc)) throw new Error("this account's key is not locked \u2014 nothing to unlock");
   const rec = await unwrapKeys(doc, password);
-  const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
   await cacheOpenedKeys(actorUrl, rec);
   await bootWorker();
 };
+window.fedipodNewKey = async (password) => {
+  if (!password) throw new Error("Enter the password you use for your pod now.");
+  const { remote, urls, cfg, actorUrl } = await readAccountState();
+  const keys = await generateKeys();
+  keys.mintedFor = cfg.gateway?.frontActor || actorUrl;
+  await writeWrappedKeys(remote, urls, await wrapKeys(keys, password));
+  await cacheOpenedKeys(actorUrl, keys);
+  await bootWorker();
+};
 window.fedipodSignup = async ({ onStep, ...answers }) => {
   await signUp(answers, { onStep, frontOrigin: location.origin });
   const { authorizationUrl } = await beginLogin({ issuer: answers.issuer, redirectUri: REDIRECT });
@@ -33861,6 +33882,25 @@ if (typeof document !== "undefined") (async () => {
   $("unlock-password")?.addEventListener("keydown", (e) => {
     if (e.key === "Enter") doUnlock();
   });
+  $("unlock-newkey")?.addEventListener("click", () => {
+    $("unlock-newkey-confirm").hidden = false;
+    $("unlock-password").focus();
+  });
+  const doNewKey = async () => {
+    $("unlock-error").textContent = "";
+    const btn = $("unlock-newkey-go");
+    btn.disabled = true;
+    try {
+      await window.fedipodNewKey($("unlock-password").value);
+      $("unlock-password").value = "";
+      location.href = "/admin/client/";
+    } catch (err) {
+      $("unlock-error").textContent = err.message || String(err);
+      btn.disabled = false;
+      $("unlock-password").select();
+    }
+  };
+  $("unlock-newkey-go")?.addEventListener("click", doNewKey);
   if (params.has("signout") || params.has("add")) {
     if (params.has("signout")) {
       try {