Implement experimental file-based encrypted private chat

Add fixed-suite Rust/WASI identity files, signed challenge authentication, ciphertext-only SQLite storage, a minimal LibreJS-compatible interface, and consistent backup snapshots. Keep production unchanged and document the local workflow, limits, source distribution, and browser recovery tests.

1 files changed, 82 insertions, 0 deletions

diff --git a/crates/chat-server/web/index.html b/crates/chat-server/web/index.html
new file mode 100644
index 0000000..9783789
--- /dev/null
+++ b/crates/chat-server/web/index.html
@@ -0,0 +1,82 @@
+<!--
+Copyright (C) 2026 Doan Luu Duc Tai <doan@luuduct.ai>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <https://www.gnu.org/licenses/>.
+-->
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Message Me | Doan Luu Duc Tai</title>
+<link rel="stylesheet" href="/style.css">
+<script src="/app.js" defer></script>
+</head>
+<body>
+<main>
+<header><a href="https://doan.luuduct.ai/">~doan</a> / message me <span class="status">EXPERIMENTAL / LOCAL TEST</span></header>
+<h1>[ private chat ]</h1>
+<p>Text only. A dedicated identity file. Encrypted for you and Doan.</p>
+<p class="notice">This is an experimental application, not an audited messenger. <a href="/LIMITATIONS.txt">Read its limitations</a> before use. Keep your file and password safe: there is no account recovery.</p>
+<p id="status" role="status" aria-live="polite">Loading cryptographic module...</p>
+<section id="entry" hidden>
+<button id="create-choice">CREATE NEW CHAT</button>
+<button id="open-choice">OPEN CHAT FILE</button>
+</section>
+<section id="create" hidden>
+<h2 id="create-title">Create a new chat</h2>
+<form id="create-form" autocomplete="off">
+<label>Display name <input id="name" maxlength="80" required autocomplete="off"></label>
+<label>Password <input id="new-password" type="password" minlength="12" maxlength="1024" required autocomplete="off"></label>
+<label>Confirm password <input id="confirm-password" type="password" minlength="12" required autocomplete="off"></label>
+<label id="setup-label" hidden>Owner setup token from the root .env <input id="setup-token" type="password" autocomplete="off"></label>
+<p>Use a strong, unique passphrase. This identity is solely for this chat; do not reuse it elsewhere.</p>
+<button type="submit">GENERATE AND DOWNLOAD IDENTITY FILE</button>
+</form>
+</section>
+<section id="unlock" hidden>
+<h2>Open your saved identity file</h2>
+<p id="reopen-note">Your file is opened locally. The file and password are never uploaded.</p>
+<form id="unlock-form" autocomplete="off">
+<label>Identity file <input id="file" type="file" required></label>
+<label>Password <input id="password" type="password" required autocomplete="off"></label>
+<button type="submit">UNLOCK CHAT</button>
+</form>
+</section>
+<section id="chat" hidden>
+<div class="chat-heading"><h2 id="who"></h2><button id="lock">LOCK / FORGET</button></div>
+<p id="fingerprint"></p>
+<section id="inbox" hidden><h3>Conversations</h3><button id="refresh-inbox">REFRESH INBOX</button><div id="conversations"></div></section>
+<section id="thread" hidden>
+<h3 id="thread-name"></h3>
+<p id="conversation-fingerprint"></p>
+<p id="counts"></p>
+<form id="history-form"><label>Latest messages to load (0–50) <input id="history-count" type="number" min="0" max="50" step="1" value="0" required></label><button type="submit">LOAD HISTORY</button></form>
+<button id="older" hidden>LOAD OLDER</button>
+<ol id="messages" aria-label="Messages"></ol>
+<form id="send-form" autocomplete="off"><label>Plain text message (up to 8192 UTF-8 bytes) <textarea id="text" rows="5" required maxlength="8192" autocomplete="off"></textarea></label><button type="submit">ENCRYPT AND SEND</button></form>
+<button id="retry" hidden>RETRY THE SAME ENCRYPTED MESSAGE</button>
+</section>
+</section>
+<noscript>This chat requires free JavaScript and WebAssembly for local cryptography. The main website remains JavaScript-free.</noscript>
+<footer>
+<p><a class="badge" href="https://www.gnu.org/software/librejs/" aria-describedby="js-warning">GNU LibreJS-compliant</a><span id="js-warning" role="tooltip">LibreJS compliance concerns software freedom, not a guarantee of privacy or security. Review the source code, dependencies, and scripts delivered to your browser. Server-delivered code can change between visits; free software can still track users or behave maliciously.</span></p>
+<a href="https://www.gnu.org/licenses/agpl-3.0.html">LICENSE</a>
+<a href="/THIRD-PARTY-LICENSES.html">THIRD PARTY LICENSES</a>
+<a href="/SOURCE.tar.gz">CORRESPONDING SOURCE CODE</a>
+<a href="/javascript.html" rel="jslicense">JAVASCRIPT LICENSES / RAW SOURCE</a>
+</footer>
+</main>
+</body>
+</html>