a62074a · ap-bridge · pear-git-v3

Changed files (9) +477 -104

.pgh-lock.json +95 -100

…	…	@@ -1,9 +1,9 @@
1	1	{
2	2	"name": "ap-bridge",
3		"version": "0.9.90",
	3	"version": "0.9.91",
4	4	"runtime": "bare",
5		"rootTreeHash": "6b2041d78a1d74336fff1aa05b710e533a0ae19a164f61783af79ca5bc421f31",
6		"publishedAt": "2026-09-11T16:48:10.194Z",
	5	"rootTreeHash": "4373422f9b5b8c299b8a34e7104da5dae1e608935ac858b423df236dc2474db4",
	6	"publishedAt": "2026-09-11T22:03:58.277Z",
7	7	"deps": [
8	8	{
9	9	"name": "@hyperswarm/secret-stream",
…	…	@@ -2396,8 +2396,8 @@
2396	2396	{
2397	2397	"name": "favela-peer",
2398	2398	"version": "0.0.56",
2399		"tree": "facecf308fc9567acaf159e03fb313b3b3495ef8ffd8ea1981740d6d156bad78",
2400		"normHash": "774857dc8827b4eb191ee2b03dbf149afa2da9b891f6d50634e6f105b7fde75d",
	2399	"tree": "8ea15d633438bd0f3d4dc69babecd0069ba33c3e7e63de8dd5d428f9530062b7",
	2400	"normHash": "42db39cc01ba6f0424f2302b28fe5a523e082501ae708961cd16f2a025faada2",
2401	2401	"workspace": true
2402	2402	},
2403	2403	{
…	…	@@ -3998,19 +3998,14 @@
3998	3998	"newVersion": "0.0.4",
3999	3999	"newTree": "4622ac9e189974583e9a16be390684676a5add245bd12d1715df940c7f9ea581",
4000	4000	"existing": [
4001		{
4002		"appName": "atproto-bridge",
4003		"version": "0.0.3",
4004		"tree": "a8cce432de1374051f5481059bbfc264b5eec47471a24faf9fbb0241625fa2b5"
4005		},
4006	4001	{
4007	4002	"appName": "favela-web",
4008	4003	"version": "0.0.3",
4009	4004	"tree": "38f44af48b2d59b46f1b5db31b81d02f3ca8b8bad6bc0fb9fffff698241f5e37"
4010	4005	}
4011	4006	],
4012		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4013		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4007	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4008	"acceptedAt": "2026-09-11T22:03:58.310Z"
4014	4009	},
4015	4010	{
4016	4011	"type": "VERSION_CONFLICT",
…	…	@@ -4024,8 +4019,8 @@
4024	4019	"tree": "ee91b6bd77101e3404ca571b2e5adf0f47029d174398a05f50294fc207e39d99"
4025	4020	}
4026	4021	],
4027		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4028		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4022	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4023	"acceptedAt": "2026-09-11T22:03:58.310Z"
4029	4024	},
4030	4025	{
4031	4026	"type": "VERSION_CONFLICT",
…	…	@@ -4039,8 +4034,8 @@
4039	4034	"tree": "3bb78d8f06263a549bd1077f37a7df257b1d557e44608631435af625f05a9c11"
4040	4035	}
4041	4036	],
4042		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4043		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4037	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4038	"acceptedAt": "2026-09-11T22:03:58.310Z"
4044	4039	},
4045	4040	{
4046	4041	"type": "VERSION_CONFLICT",
…	…	@@ -4059,8 +4054,8 @@
4059	4054	"tree": "58c0bf8698af19464d0ee8354a77ed1ac96d3a5fa18aa4e794686cfbbf080e5d"
4060	4055	}
4061	4056	],
4062		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4063		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4057	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4058	"acceptedAt": "2026-09-11T22:03:58.310Z"
4064	4059	},
4065	4060	{
4066	4061	"type": "VERSION_CONFLICT",
…	…	@@ -4074,8 +4069,8 @@
4074	4069	"tree": "da4c6b2654e9d66f10b0faa989311cf182878c24ab51b1c41458cfbf37ad29cd"
4075	4070	}
4076	4071	],
4077		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4078		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4072	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4073	"acceptedAt": "2026-09-11T22:03:58.310Z"
4079	4074	},
4080	4075	{
4081	4076	"type": "VERSION_CONFLICT",
…	…	@@ -4089,8 +4084,8 @@
4089	4084	"tree": "40be8f559a13b54ebf0689e63e6c70f0d218035359e17c497ed7bc8a85c3cc95"
4090	4085	}
4091	4086	],
4092		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4093		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4087	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4088	"acceptedAt": "2026-09-11T22:03:58.310Z"
4094	4089	},
4095	4090	{
4096	4091	"type": "VERSION_CONFLICT",
…	…	@@ -4104,8 +4099,8 @@
4104	4099	"tree": "3eae85efce82299769898c8151b5ed0a94e5a5ebdbcdee2105b815ca733a61cb"
4105	4100	}
4106	4101	],
4107		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4108		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4102	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4103	"acceptedAt": "2026-09-11T22:03:58.310Z"
4109	4104	},
4110	4105	{
4111	4106	"type": "VERSION_CONFLICT",
…	…	@@ -4119,8 +4114,8 @@
4119	4114	"tree": "8d9e01d443a127781773598d2e77c3f372334fad09e20623a819dabe49b22e1a"
4120	4115	}
4121	4116	],
4122		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4123		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4117	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4118	"acceptedAt": "2026-09-11T22:03:58.310Z"
4124	4119	},
4125	4120	{
4126	4121	"type": "VERSION_CONFLICT",
…	…	@@ -4134,8 +4129,8 @@
4134	4129	"tree": "dc1ad6c999fe90d946ba0ef34698ea9af451b639be2ad1c5b61eabb08337a6ca"
4135	4130	}
4136	4131	],
4137		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4138		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4132	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4133	"acceptedAt": "2026-09-11T22:03:58.310Z"
4139	4134	},
4140	4135	{
4141	4136	"type": "VERSION_CONFLICT",
…	…	@@ -4149,8 +4144,8 @@
4149	4144	"tree": "88b4779570e5113aa21b204989ac018d1628b387681f7e53428a7c99114fb701"
4150	4145	}
4151	4146	],
4152		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4153		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4147	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4148	"acceptedAt": "2026-09-11T22:03:58.310Z"
4154	4149	},
4155	4150	{
4156	4151	"type": "VERSION_CONFLICT",
…	…	@@ -4164,8 +4159,8 @@
4164	4159	"tree": "720b867ec4300a3caa2325eb1449499f9940bfb88341ecceb5992fa0fdf5f37d"
4165	4160	}
4166	4161	],
4167		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4168		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4162	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4163	"acceptedAt": "2026-09-11T22:03:58.310Z"
4169	4164	},
4170	4165	{
4171	4166	"type": "VERSION_CONFLICT",
…	…	@@ -4179,8 +4174,8 @@
4179	4174	"tree": "b697fe174482a708b49d0764cd4786291845f0034a31e0699381ca7e7b269d04"
4180	4175	}
4181	4176	],
4182		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4183		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4177	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4178	"acceptedAt": "2026-09-11T22:03:58.310Z"
4184	4179	},
4185	4180	{
4186	4181	"type": "VERSION_CONFLICT",
…	…	@@ -4194,8 +4189,8 @@
4194	4189	"tree": "767f07242277ae80bd395de5a4969fcdbf956c216158ae517fb2b562558ac1a4"
4195	4190	}
4196	4191	],
4197		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4198		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4192	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4193	"acceptedAt": "2026-09-11T22:03:58.310Z"
4199	4194	},
4200	4195	{
4201	4196	"type": "VERSION_CONFLICT",
…	…	@@ -4209,8 +4204,8 @@
4209	4204	"tree": "de7deed21f587ffc8bde4971abe00fca77bb6c71c4e7effb31ad34ee330815df"
4210	4205	}
4211	4206	],
4212		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4213		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4207	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4208	"acceptedAt": "2026-09-11T22:03:58.310Z"
4214	4209	},
4215	4210	{
4216	4211	"type": "VERSION_CONFLICT",
…	…	@@ -4224,8 +4219,8 @@
4224	4219	"tree": "2df42517ebf73cd9c11f2f652f75e87401fd4ed7b856c0adc15c33baf1d4f1ad"
4225	4220	}
4226	4221	],
4227		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4228		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4222	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4223	"acceptedAt": "2026-09-11T22:03:58.310Z"
4229	4224	},
4230	4225	{
4231	4226	"type": "VERSION_CONFLICT",
…	…	@@ -4239,8 +4234,8 @@
4239	4234	"tree": "325aca171cbff560487177584078c8066133e91176639ca47c98d70e195aa92e"
4240	4235	}
4241	4236	],
4242		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4243		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4237	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4238	"acceptedAt": "2026-09-11T22:03:58.310Z"
4244	4239	},
4245	4240	{
4246	4241	"type": "VERSION_CONFLICT",
…	…	@@ -4269,8 +4264,8 @@
4269	4264	"tree": "89a40400106bf4fef95fb5c44a66ee29aada6f76c7740bfba09d8aeeb841f39c"
4270	4265	}
4271	4266	],
4272		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4273		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4267	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4268	"acceptedAt": "2026-09-11T22:03:58.310Z"
4274	4269	},
4275	4270	{
4276	4271	"type": "VERSION_CONFLICT",
…	…	@@ -4284,8 +4279,8 @@
4284	4279	"tree": "1bd0eb382789c62cd4622d47bffb60984fdd766260c79f73a2fc7a136f3edbe9"
4285	4280	}
4286	4281	],
4287		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4288		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4282	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4283	"acceptedAt": "2026-09-11T22:03:58.310Z"
4289	4284	},
4290	4285	{
4291	4286	"type": "VERSION_CONFLICT",
…	…	@@ -4299,8 +4294,8 @@
4299	4294	"tree": "4526fe9dc5468264c7171ec16e9303726674b7b44ca0b3e09cb8b9a6a1be6169"
4300	4295	}
4301	4296	],
4302		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4303		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4297	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4298	"acceptedAt": "2026-09-11T22:03:58.310Z"
4304	4299	},
4305	4300	{
4306	4301	"type": "VERSION_CONFLICT",
…	…	@@ -4314,8 +4309,8 @@
4314	4309	"tree": "32b291cd756e142da18a6ed01c351e024fcedc3e2b1ecfbfb85f3106ada4419b"
4315	4310	}
4316	4311	],
4317		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4318		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4312	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4313	"acceptedAt": "2026-09-11T22:03:58.310Z"
4319	4314	},
4320	4315	{
4321	4316	"type": "VERSION_CONFLICT",
…	…	@@ -4329,8 +4324,8 @@
4329	4324	"tree": "4a8cd3b0093092b33088617dc0415e8179882d7f2f13b7649962ca20b08beeed"
4330	4325	}
4331	4326	],
4332		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4333		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4327	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4328	"acceptedAt": "2026-09-11T22:03:58.310Z"
4334	4329	},
4335	4330	{
4336	4331	"type": "VERSION_CONFLICT",
…	…	@@ -4344,8 +4339,8 @@
4344	4339	"tree": "4f63f165ee6a581f689b40c4a40df4df01ab6fba17d46bd29e40ef5bbdd9884f"
4345	4340	}
4346	4341	],
4347		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4348		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4342	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4343	"acceptedAt": "2026-09-11T22:03:58.310Z"
4349	4344	},
4350	4345	{
4351	4346	"type": "VERSION_CONFLICT",
…	…	@@ -4359,8 +4354,8 @@
4359	4354	"tree": "735109c736c0bd3413ab47414fd8b6ea9a99c401fe8e6d608459c79293806754"
4360	4355	}
4361	4356	],
4362		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4363		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4357	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4358	"acceptedAt": "2026-09-11T22:03:58.310Z"
4364	4359	},
4365	4360	{
4366	4361	"type": "VERSION_CONFLICT",
…	…	@@ -4374,8 +4369,8 @@
4374	4369	"tree": "b32b75bf1b2acdd18ed0cc370d01d477fba42ba09fd1f2f78af3ebad925e72d5"
4375	4370	}
4376	4371	],
4377		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4378		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4372	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4373	"acceptedAt": "2026-09-11T22:03:58.310Z"
4379	4374	},
4380	4375	{
4381	4376	"type": "VERSION_CONFLICT",
…	…	@@ -4394,8 +4389,8 @@
4394	4389	"tree": "189397178121e9a18430943345dab820691648a324229071ceb980bbb77a7393"
4395	4390	}
4396	4391	],
4397		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4398		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4392	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4393	"acceptedAt": "2026-09-11T22:03:58.310Z"
4399	4394	},
4400	4395	{
4401	4396	"type": "VERSION_CONFLICT",
…	…	@@ -4409,8 +4404,8 @@
4409	4404	"tree": "3bedca5287a9041fc2fd5ec5ace4df1fa86240e6afec0a105ba67398bafc09a5"
4410	4405	}
4411	4406	],
4412		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4413		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4407	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4408	"acceptedAt": "2026-09-11T22:03:58.310Z"
4414	4409	},
4415	4410	{
4416	4411	"type": "VERSION_CONFLICT",
…	…	@@ -4424,8 +4419,8 @@
4424	4419	"tree": "b9ca9b272008bd67672a1b252390e8b527095c46b46cf6b6725a7a187eb038b6"
4425	4420	}
4426	4421	],
4427		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4428		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4422	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4423	"acceptedAt": "2026-09-11T22:03:58.310Z"
4429	4424	},
4430	4425	{
4431	4426	"type": "VERSION_CONFLICT",
…	…	@@ -4439,8 +4434,8 @@
4439	4434	"tree": "7793645d7d4248d6d6533e3cbcd4bf40bed4f38c678b0ca0606c15640ba5e7b9"
4440	4435	}
4441	4436	],
4442		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4443		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4437	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4438	"acceptedAt": "2026-09-11T22:03:58.310Z"
4444	4439	},
4445	4440	{
4446	4441	"type": "VERSION_CONFLICT",
…	…	@@ -4454,8 +4449,8 @@
4454	4449	"tree": "79447513d4ac0357c8d60bdc7b81b3c5143d761b26700340cba266c4d1cb77b0"
4455	4450	}
4456	4451	],
4457		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4458		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4452	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4453	"acceptedAt": "2026-09-11T22:03:58.310Z"
4459	4454	},
4460	4455	{
4461	4456	"type": "VERSION_CONFLICT",
…	…	@@ -4469,8 +4464,8 @@
4469	4464	"tree": "279d4e0447eb79fd75816864ba7f41f2df03080c9da69ea4603fe2900c8d9e53"
4470	4465	}
4471	4466	],
4472		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4473		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4467	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4468	"acceptedAt": "2026-09-11T22:03:58.310Z"
4474	4469	},
4475	4470	{
4476	4471	"type": "VERSION_CONFLICT",
…	…	@@ -4484,8 +4479,8 @@
4484	4479	"tree": "ed4e0b480417610e195ff0b59e5b9a453abbf2db6d6ce72d7cd522269f835e9a"
4485	4480	}
4486	4481	],
4487		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4488		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4482	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4483	"acceptedAt": "2026-09-11T22:03:58.310Z"
4489	4484	},
4490	4485	{
4491	4486	"type": "VERSION_CONFLICT",
…	…	@@ -4504,8 +4499,8 @@
4504	4499	"tree": "a9e07d54e526c838dfe5e27df33936682aefb218f61a45b6c15289243999f648"
4505	4500	}
4506	4501	],
4507		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4508		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4502	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4503	"acceptedAt": "2026-09-11T22:03:58.310Z"
4509	4504	},
4510	4505	{
4511	4506	"type": "VERSION_CONFLICT",
…	…	@@ -4519,8 +4514,8 @@
4519	4514	"tree": "9d84c86441fe138b227c4fd01d1e948aa83bf8d13cfb1aa957838feea05fbb57"
4520	4515	}
4521	4516	],
4522		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4523		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4517	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4518	"acceptedAt": "2026-09-11T22:03:58.310Z"
4524	4519	},
4525	4520	{
4526	4521	"type": "VERSION_CONFLICT",
…	…	@@ -4534,8 +4529,8 @@
4534	4529	"tree": "4a3afbe2fc7a882e24454eb2e7e7cfe6816811ee5d73ae0f92e8b9ea9cfb8c78"
4535	4530	}
4536	4531	],
4537		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4538		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4532	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4533	"acceptedAt": "2026-09-11T22:03:58.310Z"
4539	4534	},
4540	4535	{
4541	4536	"type": "VERSION_CONFLICT",
…	…	@@ -4549,8 +4544,8 @@
4549	4544	"tree": "1e5c5810d8971a3c27fde7fb0e4d633dcabbe2cf98d8df86b473f8d67eead8b9"
4550	4545	}
4551	4546	],
4552		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4553		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4547	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4548	"acceptedAt": "2026-09-11T22:03:58.310Z"
4554	4549	},
4555	4550	{
4556	4551	"type": "VERSION_CONFLICT",
…	…	@@ -4564,8 +4559,8 @@
4564	4559	"tree": "e3478f50e85ba0ac288efed83e84c992483904897dc39ccf243d20a4ea25d972"
4565	4560	}
4566	4561	],
4567		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4568		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4562	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4563	"acceptedAt": "2026-09-11T22:03:58.310Z"
4569	4564	},
4570	4565	{
4571	4566	"type": "VERSION_CONFLICT",
…	…	@@ -4579,8 +4574,8 @@
4579	4574	"tree": "c05d8bf7eab5024ea98140f78c84d12fb494b4b7b10c7eedeb50b2be842fa519"
4580	4575	}
4581	4576	],
4582		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4583		"acceptedAt": "2026-09-11T16:48:10.217Z"
	4577	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4578	"acceptedAt": "2026-09-11T22:03:58.310Z"
4584	4579	},
4585	4580	{
4586	4581	"type": "VERSION_CONFLICT",
…	…	@@ -4594,8 +4589,8 @@
4594	4589	"tree": "0697bb338bbcec517353cffcdb2345a8232b9b90cc627a549a306f0323576390"
4595	4590	}
4596	4591	],
4597		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4598		"acceptedAt": "2026-09-11T16:48:10.218Z"
	4592	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4593	"acceptedAt": "2026-09-11T22:03:58.310Z"
4599	4594	},
4600	4595	{
4601	4596	"type": "VERSION_CONFLICT",
…	…	@@ -4609,8 +4604,8 @@
4609	4604	"tree": "a366a73e74f8d80f106465058083b62bb70b833c721047124e99c89880e5c706"
4610	4605	}
4611	4606	],
4612		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4613		"acceptedAt": "2026-09-11T16:48:10.218Z"
	4607	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4608	"acceptedAt": "2026-09-11T22:03:58.310Z"
4614	4609	},
4615	4610	{
4616	4611	"type": "VERSION_CONFLICT",
…	…	@@ -4624,8 +4619,8 @@
4624	4619	"tree": "7912e790c9e87e9829a6daa037c5f5da0cc4355214f51d334f96e57678dfddeb"
4625	4620	}
4626	4621	],
4627		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4628		"acceptedAt": "2026-09-11T16:48:10.218Z"
	4622	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4623	"acceptedAt": "2026-09-11T22:03:58.310Z"
4629	4624	},
4630	4625	{
4631	4626	"type": "VERSION_CONFLICT",
…	…	@@ -4639,8 +4634,8 @@
4639	4634	"tree": "003ac841449fcdda1abc3c87fee291a5d9596d245925a7298bd8ef5f8e423eae"
4640	4635	}
4641	4636	],
4642		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4643		"acceptedAt": "2026-09-11T16:48:10.218Z"
	4637	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4638	"acceptedAt": "2026-09-11T22:03:58.310Z"
4644	4639	},
4645	4640	{
4646	4641	"type": "VERSION_CONFLICT",
…	…	@@ -4659,8 +4654,8 @@
4659	4654	"tree": "7b3f314cf92558edbc90295c573885276a6add925318998c829c03d335edc765"
4660	4655	}
4661	4656	],
4662		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4663		"acceptedAt": "2026-09-11T16:48:10.218Z"
	4657	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4658	"acceptedAt": "2026-09-11T22:03:58.310Z"
4664	4659	},
4665	4660	{
4666	4661	"type": "VERSION_CONFLICT",
…	…	@@ -4674,8 +4669,8 @@
4674	4669	"tree": "c486fe73805bf013e9c5de91b5780d1aa5d2b2295306f411f7863757aaa05e60"
4675	4670	}
4676	4671	],
4677		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4678		"acceptedAt": "2026-09-11T16:48:10.218Z"
	4672	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4673	"acceptedAt": "2026-09-11T22:03:58.310Z"
4679	4674	},
4680	4675	{
4681	4676	"type": "VERSION_CONFLICT",
…	…	@@ -4689,8 +4684,8 @@
4689	4684	"tree": "10193a86e2c6f80c2d4377379a0aae4a959f8a40fd9e852b85fee081bfe6675a"
4690	4685	}
4691	4686	],
4692		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4693		"acceptedAt": "2026-09-11T16:48:10.218Z"
	4687	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4688	"acceptedAt": "2026-09-11T22:03:58.310Z"
4694	4689	},
4695	4690	{
4696	4691	"type": "VERSION_CONFLICT",
…	…	@@ -4704,8 +4699,8 @@
4704	4699	"tree": "20b1ecd2937f3e35102892288234b86a8ec6deb3711016d96ff3509474ac465b"
4705	4700	}
4706	4701	],
4707		"reason": "version-splits only, 0 code-differs; favela-identity 0.0.3 is new in this release and no already-published app uses the bridge verbs",
4708		"acceptedAt": "2026-09-11T16:48:10.218Z"
	4702	"reason": "ap-bridge 0.9.91 — holder re-claim is admitted; a pending claim names the acct",
	4703	"acceptedAt": "2026-09-11T22:03:58.310Z"
4709	4704	}
4710	4705	]
4711	4706	}

index.js +27 -1

…	…	@@ -10,6 +10,7 @@ import fs from 'bare-fs'
10	10	import process from 'bare-process'
11	11	import { join } from 'bare-path'
12	12	import { loadConfig, assertUsable } from './lib/config.js'
	13	import http from 'bare-http1'
13	14	import { createServer } from './lib/server.js'
14	15	import { actorDocFor } from './lib/router.js'
15	16	import { FollowerStore } from './lib/followers.js'
…	…	@@ -55,7 +56,9 @@ async function main () {
55	56	const followers = new FollowerStore(join(dataDir, 'followers.json'))
56	57	// What the fediverse sends us — replies, mentions, likes, boosts. Until now these were verified,
57	58	// acked with 202 and discarded, so ap-bridge could be replied to and never knew.
58		const inbound = new InboundStore({ file: join(dataDir, 'inbound.json') })
	59	// ⛔ THE CAP IS THE OPERATOR'S. It was fixed at 500 here, and for the fediverse an eviction is not a
	60	// cache miss — there is no backlink index to re-ask, so it can be the only copy. See config.js.
	61	const inbound = new InboundStore({ file: join(dataDir, 'inbound.json'), cap: config.inboundCap })
59	62	const resolver = new RemoteKeyResolver()
60	63
61	64	// ⛔ CUSTODY IS NAMED HERE, not implied by passing a key around. This is the primary actor and it
…	…	@@ -481,6 +484,29 @@ async function main () {
481	484	server.listen(config.port, config.bind, resolve)
482	485	})
483	486
	487	// ⛔ THE OPERATOR SURFACE IS A SECOND LISTENER, ALWAYS LOOPBACK, AND OFF UNLESS ASKED FOR. It must
	488	// not share the public port: that one is proxied to the internet, and this one has NO authentication
	489	// in front of it — reach it over SSH. The same decision favela-surface states for itself: "exposing
	490	// it must be a decision, never a default." It mints nothing; every action on it is a flow that
	491	// already exists (invite, list, release).
	492	if (config.adminPort) {
	493	const { adminRoutes } = await import('./lib/admin.js')
	494	const { parseForm } = await import('./lib/admin-serve.js')
	495	const adminServer = http.createServer((req, res) => {
	496	parseForm(req).then((form) => adminRoutes({ method: req.method, path: (req.url \|\| '/').split('?')[0], form },
	497	{ registrations, inbound, config }))
	498	.then((out) => { res.writeHead(out.status, out.headers); res.end(out.body) })
	499	.catch((err) => { res.writeHead(500, { 'content-type': 'text/plain' }); res.end(String((err && err.message) \|\| err)) })
	500	})
	501	await new Promise((resolve, reject) => {
	502	adminServer.on('error', reject)
	503	// ⛔ 127.0.0.1 HARDCODED, not config.bind. An operator who set AP_BIND to something routable for
	504	// the public listener must not thereby publish the admin surface.
	505	adminServer.listen(config.adminPort, '127.0.0.1', resolve)
	506	})
	507	log({ msg: 'admin surface (loopback only, no auth — reach it over SSH)', url: 'http://127.0.0.1:' + config.adminPort + '/admin' })
	508	}
	509
484	510	// ★ The first pass picks up whatever the last run left owed — which is the entire point of the
485	511	// queue being durable. Started after listen so a backlog drain never delays the port opening.
486	512	outbound.start()

lib/admin-serve.js +37 -0

…	…	@@ -0,0 +1,37 @@
	1	// The transport half of the admin surface — kept apart from admin.js so that file stays pure.
	2	//
	3	// ⛔ SMALL ON PURPOSE. An operator page posts two fields; pulling in a form parser (or reusing the
	4	// multipart one favela-surface needs for pictures) would be more moving parts than the thing it serves.
	5	// Bodies are bounded because a listener that buffers whatever it is handed is a memory bug with a form
	6	// in front of it, even on loopback.
	7
	8	const MAX_BODY = 64 * 1024
	9
	10	export function parseForm (req) {
	11	return new Promise((resolve) => {
	12	if (req.method !== 'POST') return resolve({})
	13	let size = 0
	14	const chunks = []
	15	req.on('data', (c) => {
	16	size += c.length
	17	// ⚠ Stop COLLECTING but keep draining: destroying the stream mid-body makes the browser show a
	18	// transport error instead of the page, for a form that was merely too big.
	19	if (size <= MAX_BODY) chunks.push(c)
	20	})
	21	req.on('end', () => {
	22	const body = Buffer.concat(chunks).toString('utf8')
	23	const out = {}
	24	for (const pair of body.split('&')) {
	25	if (!pair) continue
	26	const i = pair.indexOf('=')
	27	const k = i === -1 ? pair : pair.slice(0, i)
	28	const v = i === -1 ? '' : pair.slice(i + 1)
	29	try { out[decodeURIComponent(k.replace(/\+/g, ' '))] = decodeURIComponent(v.replace(/\+/g, ' ')) } catch { /* skip a malformed pair */ }
	30	}
	31	resolve(out)
	32	})
	33	req.on('error', () => resolve({}))
	34	})
	35	}
	36
	37	export default { parseForm }

lib/admin.js +134 -0

…	…	@@ -0,0 +1,134 @@
	1	// admin.js — the operator's read-out of this bridge, over loopback.
	2	//
	3	// ⛔ WHAT IT DOES NOT DO: mint anything. This bridge is keyless for atproto and holds only its own AP
	4	// signing key; an admin screen that created identities would make it a key holder for other people and
	5	// reverse the whole peer/bridge split. Everything here is a flow that ALREADY EXISTS — issue an invite,
	6	// see who is registered, release a name an operator owns the namespace for. No new authority.
	7	//
	8	// ⛔ LOOPBACK, ON ITS OWN LISTENER, AND OFF UNLESS CONFIGURED. The public listener serves the fediverse;
	9	// this serves the operator. They must not be the same port, because the public one is proxied. There is
	10	// NO authentication in front of this — reach it over SSH — which is exactly what favela-surface says of
	11	// its own surface: "exposing it must be a decision, never a default."
	12	//
	13	// ⚠ Pure of transport, like router.js: every handler returns `{ status, headers, body }` so the whole
	14	// surface is testable with no port bound.
	15
	16	const esc = (s) => String(s == null ? '' : s)
	17	.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>').replace(/"/g, '"')
	18
	19	const html = (status, body) => ({ status, headers: { 'content-type': 'text/html; charset=utf-8' }, body })
	20	const redirect = (to) => ({ status: 303, headers: { location: to }, body: '' })
	21
	22	const STYLE = `body{font:14px/1.5 system-ui,sans-serif;margin:0;padding:24px;max-width:1000px;color:#111}
	23	h1{font-size:20px}h2{font-size:15px;margin-top:28px;border-bottom:1px solid #ddd;padding-bottom:4px}
	24	table{border-collapse:collapse;width:100%;margin:8px 0}td,th{text-align:left;padding:5px 8px;border-bottom:1px solid #eee;vertical-align:top}
	25	th{font-weight:600;color:#555;font-size:12px;text-transform:uppercase;letter-spacing:.04em}
	26	code{font:12px ui-monospace,monospace;background:#f5f5f5;padding:1px 4px;border-radius:3px;word-break:break-all}
	27	.who{color:#666;font-size:13px}.warn{color:#a00}.none{color:#999;font-style:italic}
	28	button{font:inherit;padding:4px 10px}form{display:inline}`
	29
	30	const page = (title, body) =>
	31	`<!doctype html><meta charset="utf-8"><title>${esc(title)}</title><style>${STYLE}</style>` +
	32	`<h1>${esc(title)}</h1>${body}`
	33
	34	const when = (ms) => {
	35	if (!ms) return '—'
	36	const d = new Date(Number(ms))
	37	return Number.isNaN(d.getTime()) ? '—' : d.toISOString().replace('T', ' ').slice(0, 19) + 'Z'
	38	}
	39
	40	/** The registered names, the burned ones, and what the fediverse has sent us. */
	41	export function renderOverview ({ host, registrations = [], burned = [], inbound = [], cap = null, policy = null }) {
	42	const names = registrations.length
	43	? '<table><tr><th>name</th><th>identity root</th><th>feed</th><th>gen</th><th>registered</th><th></th></tr>' +
	44	registrations.map((r) =>
	45	'<tr><td><code>' + esc(r.username) + '@' + esc(host) + '</code></td>' +
	46	'<td><code>' + esc(String(r.root \|\| '').slice(0, 16)) + '…</code></td>' +
	47	'<td><code>' + esc(String(r.feedKey \|\| '—').slice(0, 16)) + '…</code></td>' +
	48	'<td>' + esc(r.generation) + '</td><td>' + esc(when(r.registeredAt)) + '</td>' +
	49	'<td><form method="post" action="/admin/release"><input type="hidden" name="username" value="' +
	50	esc(r.username) + '"><button>release</button></form></td></tr>').join('') +
	51	'</table>'
	52	: '<p class="none">Nobody has registered a name on this bridge.</p>'
	53
	54	// ⛔ SHOWN, NOT HIDDEN. A burned name is not a free name — the generation counter makes a reused one
	55	// a DIFFERENT actor so it can never inherit the previous holder's audience. An operator seeing only
	56	// the live list would read a burned name as simply absent and wonder why re-registering behaves oddly.
	57	const dead = burned.length
	58	? '<table><tr><th>name</th><th>gen</th><th>released</th><th>by</th></tr>' +
	59	burned.map((b) => '<tr><td><code>' + esc(b.username) + '</code></td><td>' + esc(b.generation) +
	60	'</td><td>' + esc(when(b.releasedAt)) + '</td><td>' + esc(b.by \|\| '—') + '</td></tr>').join('') +
	61	'</table>'
	62	: '<p class="none">No names have been released.</p>'
	63
	64	const feed = inbound.length
	65	? '<table><tr><th>type</th><th>from</th><th>at</th></tr>' +
	66	inbound.slice(0, 50).map((i) => '<tr><td>' + esc(i.type \|\| '?') + '</td><td><code>' +
	67	esc(i.actor \|\| i.actorUri \|\| '—') + '</code></td><td>' + esc(when(i.receivedAt)) + '</td></tr>').join('') +
	68	'</table>'
	69	: '<p class="none">Nothing has arrived from the fediverse yet.</p>'
	70
	71	// ⛔ THE CAP IS SAID OUT LOUD, because for this network an eviction is not a cache miss. atproto
	72	// inbound can be rebuilt from Constellation, a backlink index over the whole network; ActivityPub is
	73	// push-only and no such index exists, so what is evicted here may be the only copy there ever was.
	74	const capNote = cap
	75	? '<p class="who">Keeping the newest <strong>' + esc(cap) + '</strong>. This is a buffer for a peer ' +
	76	'that is offline, not the system\'s memory — the peer holds the durable copy. ' +
	77	'<span class="warn">The fediverse has no backlink index, so an eviction here cannot be backfilled.</span></p>'
	78	: ''
	79
	80	return page('bridge · ' + host,
	81	'<p class="who">Registration policy: <strong>' + esc(policy \|\| 'off') + '</strong></p>' +
	82	'<h2>Registered names</h2>' + names +
	83	'<h2>Invites</h2><form method="post" action="/admin/invite"><button>issue an invite</button></form>' +
	84	'<p class="who">Only meaningful on an invite-only bridge. An invite is single-use and is consumed ' +
	85	'before the claim can fail on anything else.</p>' +
	86	'<h2>Released names</h2>' + dead +
	87	'<h2>Inbound from the fediverse</h2>' + capNote + feed)
	88	}
	89
	90	export function renderInvite (token, host) {
	91	return page('invite issued',
	92	'<p>Give this to one person. It is single-use.</p><p><code>' + esc(token) + '</code></p>' +
	93	'<p class="who">They enter it when claiming a name on <code>' + esc(host) + '</code>.</p>' +
	94	'<p><a href="/admin">back</a></p>')
	95	}
	96
	97	/**
	98	* The whole admin surface as one function.
	99	*
	100	* ⚠ `release` is the OPERATOR authority, which is a different act from a holder releasing their own
	101	* name: the names live on this operator's domain, and a bridge with no arbiter has permanent squatters.
	102	* It still BURNS the name — see registrations.js — so it is not a way to hand a name to someone else.
	103	*/
	104	export async function adminRoutes (req, { registrations, inbound, config }) {
	105	const path = req.path \|\| '/'
	106	if (!registrations) return html(404, page('not found', '<p>Registration is not configured on this bridge.</p>'))
	107
	108	if (req.method === 'GET' && (path === '/admin' \|\| path === '/admin/' \|\| path === '/')) {
	109	return html(200, renderOverview({
	110	host: config.host,
	111	policy: config.registration \|\| null,
	112	cap: config.inboundCap,
	113	registrations: await registrations.list(),
	114	burned: typeof registrations.listBurned === 'function' ? await registrations.listBurned() : [],
	115	inbound: inbound ? await inbound.list({ limit: 50 }) : []
	116	}))
	117	}
	118
	119	if (req.method === 'POST' && path === '/admin/invite') {
	120	const token = await registrations.invite()
	121	return html(200, renderInvite(typeof token === 'string' ? token : (token && token.invite) \|\| String(token), config.host))
	122	}
	123
	124	if (req.method === 'POST' && path === '/admin/release') {
	125	const username = String((req.form && req.form.username) \|\| '').trim()
	126	if (!username) return redirect('/admin')
	127	await registrations.release(username, { operator: true })
	128	return redirect('/admin')
	129	}
	130
	131	return html(404, page('not found', '<p><a href="/admin">admin</a></p>'))
	132	}
	133
	134	export default { adminRoutes, renderOverview, renderInvite }

lib/config.js +22 -2

…	…	@@ -27,7 +27,21 @@ const DEFAULTS = {
27	27	privateKeyPath: null, // PEM on disk; minted once with openssl (see README)
28	28	publicKeyPath: null,
29	29	dataDir: null, // follower state etc.
30		maxSkewSeconds: 300
	30	maxSkewSeconds: 300,
	31	// ⛔ HOW LONG A PEER MAY BE AWAY, not how much history exists. The bridge pushes inbound to the peer
	32	// that proved it holds the name, so the PEER is the durable copy and this is a buffer for peers that
	33	// are offline. It was hardcoded at 500 in inbound-store.js.
	34	//
	35	// ⚠ AND FOR THE FEDIVERSE IT IS A REAL LOSS BOUNDARY, unlike atproto. atproto inbound can be rebuilt
	36	// from Constellation, a backlink INDEX that answers "what links to this subject?" for any point in
	37	// the past. ActivityPub is push-only delivery into an inbox and no such index exists — an evicted
	38	// Like can be recovered only by asking the original object's own collection, which Mastodon serves
	39	// partially or not at all. So evicting here can destroy the only copy, and the cap should be
	40	// generous rather than tight.
	41	inboundCap: 500,
	42	// The loopback admin UI. ABSENT means it is not served at all — an operator surface a bridge starts
	43	// offering because nobody said not to is the same mistake as registration defaulting to open.
	44	adminPort: null
31	45	}
32	46
33	47	function expand (p) {
…	…	@@ -58,7 +72,13 @@ export function loadConfig (env = process.env) {
58	72	// a bridge must not start handing out names on the operator's domain because nobody said not to.
59	73	registration: 'AP_REGISTRATION'
60	74	}),
61		...pickInt(env, { port: 'AP_PORT', maxSkewSeconds: 'AP_MAX_SKEW', backfill: 'AP_BACKFILL' })
	75	...pickInt(env, {
	76	port: 'AP_PORT',
	77	maxSkewSeconds: 'AP_MAX_SKEW',
	78	backfill: 'AP_BACKFILL',
	79	inboundCap: 'AP_INBOUND_CAP',
	80	adminPort: 'AP_ADMIN_PORT'
	81	})
62	82	}
63	83
64	84	// Comma-separated in env; an array in a config file.

lib/registrations.js +9 -0

…	…	@@ -62,6 +62,15 @@ class BaseRegistrations {
62	62
63	63	async list () { return Object.values((await this._read()).names) }
64	64
	65	/**
	66	* Every name that has been RELEASED, with its tombstone.
	67	*
	68	* ⛔ Operators need to see these, because a burned name is not a free name: the generation counter
	69	* makes a reused name a DIFFERENT actor so it cannot inherit the previous holder's audience, and an
	70	* operator looking at only the live list would read a burned name as simply absent.
	71	*/
	72	async listBurned () { return Object.values((await this._read()).burned) }
	73
65	74	/** Mint a single-use invite. The operator's act; only meaningful when the policy is `invite`. */
66	75	async invite () {
67	76	const state = await this._read()

package.json +1 -1

…	…	@@ -1,6 +1,6 @@
1	1	{
2	2	"name": "ap-bridge",
3		"version": "0.9.91",
	3	"version": "0.9.92",
4	4	"description": "ActivityPub membrane — a second projection of the self-custody atproto peer",
5	5	"type": "module",
6	6	"main": "index.js",

test/admin-serve.test.js +70 -0

…	…	@@ -0,0 +1,70 @@
	1	// The admin surface with a real port bound — the half admin.test.js deliberately cannot reach.
	2	//
	3	// ⛔ admin.js is pure and returns `{status, headers, body}`, which makes the ROUTING testable with no
	4	// socket. That leaves the wiring — bare-http1, the form parser, the loopback bind — as the part that
	5	// only fails in production. It is exactly the shape of thing that passes every unit test and then does
	6	// not start, so it gets a bound port here.
	7
	8	import test from 'brittle'
	9	import http from 'bare-http1'
	10	import { adminRoutes } from '../lib/admin.js'
	11	import { parseForm } from '../lib/admin-serve.js'
	12	import { MemoryRegistrations } from '../lib/registrations.js'
	13
	14	const ROOT = 'a'.repeat(64)
	15
	16	async function serve (registrations, config) {
	17	const server = http.createServer((req, res) => {
	18	parseForm(req)
	19	.then((form) => adminRoutes({ method: req.method, path: (req.url \|\| '/').split('?')[0], form },
	20	{ registrations, inbound: null, config }))
	21	.then((out) => { res.writeHead(out.status, out.headers); res.end(out.body) })
	22	.catch((err) => { res.writeHead(500, {}); res.end(String(err && err.message)) })
	23	})
	24	await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve))
	25	return { server, port: server.address().port }
	26	}
	27
	28	const fetchText = (port, path, opts = {}) => new Promise((resolve, reject) => {
	29	const req = http.request({ host: '127.0.0.1', port, path, method: opts.method \|\| 'GET', headers: opts.headers \|\| {} },
	30	(res) => {
	31	let body = ''
	32	res.on('data', (c) => { body += c })
	33	res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body }))
	34	})
	35	req.on('error', reject)
	36	if (opts.body) req.write(opts.body)
	37	req.end()
	38	})
	39
	40	test('★★★ it binds loopback and serves the overview', async (t) => {
	41	const registrations = new MemoryRegistrations({ policy: 'open' })
	42	await registrations.claim({ username: 'fleeky', root: ROOT, feedKey: 'd'.repeat(64) })
	43
	44	const { server, port } = await serve(registrations, { host: 'ap.7rnx.net', registration: 'open', inboundCap: 500 })
	45	t.teardown(() => new Promise((r) => server.close(r)))
	46
	47	const res = await fetchText(port, '/admin')
	48	t.is(res.status, 200)
	49	t.ok(/fleeky@ap\.7rnx\.net/.test(res.body), 'the operator can see who holds a name')
	50	})
	51
	52	test('★★★ a posted form reaches the handler and takes effect', async (t) => {
	53	// ⛔ THE PARSER IS THE POINT. A release that silently parsed no username would 303 back to a page
	54	// that still lists the name, which reads as "the button does nothing" — the failure mode this repo
	55	// has now hit twice on other surfaces.
	56	const registrations = new MemoryRegistrations({ policy: 'open' })
	57	await registrations.claim({ username: 'squatted', root: ROOT })
	58
	59	const { server, port } = await serve(registrations, { host: 'ap.7rnx.net', registration: 'open', inboundCap: 500 })
	60	t.teardown(() => new Promise((r) => server.close(r)))
	61
	62	const body = 'username=squatted'
	63	const res = await fetchText(port, '/admin/release', {
	64	method: 'POST',
	65	headers: { 'content-type': 'application/x-www-form-urlencoded', 'content-length': String(body.length) },
	66	body
	67	})
	68	t.is(res.status, 303, 'redirected back')
	69	t.absent(await registrations.get('squatted'), 'and the name really was released')
	70	})

test/admin.test.js +82 -0

…	…	@@ -0,0 +1,82 @@
	1	// The operator's read-out. Loopback, read-mostly, and it mints nothing.
	2	//
	3	// ⛔ WHAT THIS PINS. The bridge is keyless for atproto and holds only its own AP signing key. An admin
	4	// screen that created identities would make it a key holder for other people and reverse the peer/bridge
	5	// split the whole architecture rests on. So every action here is a flow that ALREADY EXISTS — issue an
	6	// invite, list who registered, release a name whose namespace the operator owns.
	7
	8	import test from 'brittle'
	9	import { adminRoutes, renderOverview } from '../lib/admin.js'
	10	import { MemoryRegistrations } from '../lib/registrations.js'
	11
	12	const ROOT_A = 'a'.repeat(64)
	13	const ROOT_B = 'b'.repeat(64)
	14	const config = { host: 'ap.7rnx.net', registration: 'open', inboundCap: 500 }
	15
	16	const get = (path) => ({ method: 'GET', path })
	17	const post = (path, form) => ({ method: 'POST', path, form })
	18
	19	test('★★ the overview lists who holds a name on this bridge', async (t) => {
	20	const registrations = new MemoryRegistrations({ policy: 'open' })
	21	await registrations.claim({ username: 'fleeky', root: ROOT_A, feedKey: 'd'.repeat(64) })
	22	await registrations.claim({ username: 'ashatron', root: ROOT_B })
	23
	24	const res = await adminRoutes(get('/admin'), { registrations, inbound: null, config })
	25	t.is(res.status, 200)
	26	t.ok(/fleeky@ap\.7rnx\.net/.test(res.body), 'the name as a person actually types it')
	27	t.ok(/ashatron@ap\.7rnx\.net/.test(res.body))
	28	t.ok(/Registration policy.*open/s.test(res.body), 'and the policy, which decides who may join')
	29	})
	30
	31	test('★★★ a released name is shown, not hidden', async (t) => {
	32	// ⛔ A burned name is NOT a free name: the generation counter makes a reused one a different actor so
	33	// it cannot inherit the previous holder's audience. An operator seeing only the live list would read
	34	// a burned name as merely absent.
	35	const registrations = new MemoryRegistrations({ policy: 'open' })
	36	await registrations.claim({ username: 'gone', root: ROOT_A })
	37	await registrations.release('gone', { root: ROOT_A })
	38
	39	const res = await adminRoutes(get('/admin'), { registrations, inbound: null, config })
	40	t.ok(/Released names/.test(res.body))
	41	t.ok(/>gone</.test(res.body), 'the tombstone is visible')
	42	})
	43
	44	test('★★★ the operator may release a name, and it burns', async (t) => {
	45	const registrations = new MemoryRegistrations({ policy: 'open' })
	46	await registrations.claim({ username: 'squatted', root: ROOT_A })
	47
	48	const res = await adminRoutes(post('/admin/release', { username: 'squatted' }), { registrations, inbound: null, config })
	49	t.is(res.status, 303, 'back to the overview')
	50	t.absent(await registrations.get('squatted'), 'the name is no longer held')
	51
	52	// ⚠ Burned, not freed — so this is not a way to hand somebody else's name to a third party.
	53	const dead = await registrations.released('squatted')
	54	t.ok(dead, 'a tombstone remains')
	55	t.is(dead.generation, 1)
	56	})
	57
	58	test('★★ issuing an invite is the existing flow, surfaced', async (t) => {
	59	const registrations = new MemoryRegistrations({ policy: 'invite' })
	60	const res = await adminRoutes(post('/admin/invite', {}), { registrations, inbound: null, config })
	61	t.is(res.status, 200)
	62	t.ok(/single-use/.test(res.body), 'and it says what an invite is')
	63	})
	64
	65	test('★★★ the cap is stated, and so is the fact that it cannot be backfilled', (t) => {
	66	// atproto inbound can be rebuilt from Constellation — a backlink index answering "what links to this
	67	// subject?" for any point in the past. ActivityPub is push-only delivery and has no such index, so an
	68	// eviction here may destroy the only copy. An operator choosing a cap has to be told which of the two
	69	// they are choosing.
	70	const body = renderOverview({ host: 'ap.7rnx.net', cap: 500, inbound: [] })
	71	t.ok(/Keeping the newest/.test(body))
	72	t.ok(/no backlink index/.test(body), 'the fediverse asymmetry is said out loud')
	73	t.ok(/peer holds the durable copy/.test(body), 'and that the cap is a buffer, not the memory')
	74	})
	75
	76	test('★★ nothing here mints an identity', async (t) => {
	77	const registrations = new MemoryRegistrations({ policy: 'open' })
	78	const res = await adminRoutes(get('/admin'), { registrations, inbound: null, config })
	79	t.absent(/mint/i.test(res.body), 'no minting offered — the bridge holds no key for anybody else')
	80	const missing = await adminRoutes(post('/admin/mint', {}), { registrations, inbound: null, config })
	81	t.is(missing.status, 404, 'and no such route exists')
	82	})

ap-bridge commits / a62074a

Changed files (9) +477 -104