Publish broker: self-hosted Share to Bluesky via hosted-origin popup

[jpdevries]

Implements track C of #37. Self-hosted origins (LAN IP, Tailscale, plain HTTP) can't complete AT OAuth — the client_id must be a publicly-fetchable HTTPS document and web-client redirect URIs must live on its origin. Instead of moving the session to the self-hosted origin (token hand-off defeats DPoP; server-side relay makes us a credential custodian, which SOVEREIGNTY.md forbids), this moves the publish request to the session:

self-hosted page ──window.open──▶ my.pantryhost.app/publish-broker
     │◀───── ph-broker:ready ─────│   (replays across OAuth redirects)
     │────── ph-broker:request ──▶│   (record + photo Blobs, structured clone)
     │                            │   user reviews + CONFIRMS in the popup
     │                            │──▶ PDS  (browser-side putRecord)
     │◀───── ph-broker:result ────│   (receipts, targetOrigin-locked)

Security invariants (encoded in shared/atproto-broker.ts doc comments)

• Tokens and DPoP keys never leave the broker origin. Only record payloads go in; only receipts come out.
• One request per popup lifetime — the first ph-broker:request wins; later messages are ignored, so the payload can't be swapped after the confirm UI renders. (verified)
• The confirm click happens inside the popup — a real window with a real URL bar (no clickjacking), with the requesting origin displayed prominently.
• Replies use an explicit targetOrigin (the captured requester origin), never '*'. The ready ping carries no data.
• No write without a user gesture in the trusted origin.

Records still travel browser → PDS; Pantry Host infrastructure stores nothing. The honest trade-off: self-hosted publishing gains an availability/trust dependency on the hosted origin — the fully-sovereign paths (own public domain, app passwords) remain #37 tracks A/B.

What's in it

• shared/atproto-broker.ts — protocol + publishViaBroker() (popup opens synchronously on the click tick; the payload may be a Promise so photo-Blob collection finishes while the popup loads; the ready→request handshake replays if the popup bounces through OAuth sign-in), shouldUseBroker() origin detection, collectPhotoBlobs() (photos fetched on the requester origin, where /uploads is same-origin — incidentally sidesteps the external-photo CORS gap for broker publishes when the requester can reach the image).
• web /publish-broker — review UI: origin callout, exact record JSON (same honesty rule as the preview modal), Reuse/Publish child plan for menus, dry-run badge, sign-in via the existing OAuth modal, publish + unpublish, persistent sr-only live region + heading focus (WCAG 4.1.3).
• PublishToBlueskyButton — on broker origins, Share/Re-publish/Unpublish open the popup instead of local modals; returned receipts (including per-child receipts for menu publishes) feed the existing receipt store so the CTA flips and future menus Reuse; the Cross-device publish state: deterministic rkeys + PDS reconcile #36 stale-receipt reconcile now also runs without a local session (recordExists is a public read). Deterministic rkeys (Cross-device publish state: deterministic rkeys + PDS reconcile #36) make broker re-publishes idempotent.

Verified

• Browser-driven protocol test: direct-load explainer, request accepted (origin + title + dry badge + record JSON rendered), payload-swap ignored, cancel replies {ok:false,error:'cancelled'}, live region announces, focus lands on the heading
• Both tiers typecheck at baseline (web 50 / app 119); web vite build passes

Needs a human before merge

• A real signed-in publish through the popup (OAuth session can't be driven headlessly). Suggested test once this deploys to my.pantryhost.app: open the Mini over Tailscale, Share to Bluesky → popup → confirm → check the record and that the Mini's CTA flips to "View on Bluesky".
• iOS Safari popup behavior is the usual wildcard — the popup opens synchronously on the click, but worth a phone test.

Closes the practical gap in #37 for most self-hosters; tracks A (own-domain OAuth) and B (app passwords) stay open there for full sovereignty.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	pantry-host-marketing	4906091	Jul 13 2026, 12:44 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	pantry-host-web	4906091	Commit Preview URL Branch Preview URL	Jul 13 2026, 12:45 AM

[jpdevries]

Pushed a fix caught while walking through manual verification: collectPhotoBlobs now accepts the caller's fetchPhoto resolver, so the web tier's opfs:// photos survive broker publishes instead of being silently dropped (bare fetch() can't read OPFS URLs). Verified: custom resolver collects the Blob; without one the URL is skipped gracefully, never blocking the publish.

[jpdevries]

Rehearsal results — real signed-in publish through the broker ✅

Full dual-origin rehearsal completed (requester localhost:5174 / broker 127.0.0.1:5174, real Bluesky account, real PDS):

• Fresh OAuth sign-in inside the broker popup — survives the round-trip. Rehearsal caught that bsky.social's COOP headers permanently sever window.opener when the broker navigates via signInRedirect; fixed in 2f880fa by switching the broker to signInPopup (nested popup + BroadcastChannel handoff — the broker page never navigates).
• Real publish: record written at the deterministic rkey (local UUID), content + keywords + attribution.adaptedFrom intact, confirmed via public getRecord.
• Idempotent re-publish: same URI, new CID, no duplicate (record count unchanged).
• Unpublish: record 404s; unrelated records untouched.
• Cancel + payload review + origin callout all behaved per the security invariants.

Also fixed along the way:

• 3485e31 — shared Modal panel was transparent on the web tier (.bg-body utilities existed only in the app package).
• de947a5 — leftover dry-run receipts rendered a published CTA in real mode; display state now obeys usableReceipt and stale dry receipts are purged.

Known gap (out of scope, follow-up queued): photos sourced from cdn.bsky.app publish photoless — the CDN sends no access-control-allow-origin, so both requester- and broker-side fetches fail CORS. Fix planned alongside adopt-own-records: derive did/cid from the CDN URL and fetch via the PDS's CORS-enabled com.atproto.sync.getBlob, or reuse the existing blob ref when publishing into the owning repo.

🤖 Generated with Claude Code