bump version to v2.6.0

added gcs
Scheduled weekly dependency update for week 43 (#978 )
2025-12-06 22:20:55 +03:00 · 2018-11-06 11:49:27 -08:00 · 2018-11-02 14:24:10 -07:00 · 2018-10-29 14:11:02 -04:00 · 2018-10-28 12:34:28 +00:00 · 2018-10-22 14:35:32 +00:00
229 changed files with 22535 additions and 10137 deletions
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,8 +1,11 @@
 node_modules
 .git
+.tox
 .DS_Store
 firefox
 assets
 docs
 public
 test
+coverage
+.nyc_output
--- a/.eslintignore
+++ b/.eslintignore
@@ -1,3 +1,4 @@
 dist
 assets
 firefox
+coverage
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,8 @@
 node_modules
+coverage
 dist
+.idea
+.DS_Store
+.nyc_output
+.tox
+.pytest_cache
--- a/.nsprc
+++ b/.nsprc
@@ -1,3 +0,0 @@
-{
-  "exceptions": ["https://nodesecurity.io/advisories/534"]
-}
--- a/.prettierignore
+++ b/.prettierignore
@@ -1,2 +1,3 @@
 dist
 assets/*.js
+coverage
--- a/.pyup.yml
+++ b/.pyup.yml
@@ -0,0 +1,7 @@
+# autogenerated pyup.io config file
+# see https://pyup.io/docs/configuration/ for all available options
+
+schedule: every week
+requirements:
+- test/integration/Pipfile
+- test/integration/pipenv.txt
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,98 @@
 ## Change Log

+### v2.5.1 (2018/03/12 19:26 +00:00)
+- [#789](https://github.com/mozilla/send/pull/789) Fixed #775 : Made text not-selectable (@RCMainak)
+
+### v2.5.0 (2018/03/08 19:31 +00:00)
+- [#782](https://github.com/mozilla/send/pull/782) updated docs (@dannycoates)
+- [#781](https://github.com/mozilla/send/pull/781) Don't translate URL-safe chars, b64 is doing it for us (@timvisee)
+- [#779](https://github.com/mozilla/send/pull/779) implemented crypto polyfills for ms edge (@dannycoates)
+
+### v2.4.1 (2018/02/28 17:05 +00:00)
+- [#777](https://github.com/mozilla/send/pull/777) use a separate circle in the progress svg for indefinite progress (@dannycoates)
+
+### v2.4.0 (2018/02/27 01:55 +00:00)
+- [#769](https://github.com/mozilla/send/pull/769) removed unsafe-inline styles via svgo-loader (@dannycoates)
+- [#767](https://github.com/mozilla/send/pull/767) added coverage artifact to circleci (@dannycoates)
+- [#766](https://github.com/mozilla/send/pull/766) Some frontend unit tests [WIP] (@dannycoates)
+- [#761](https://github.com/mozilla/send/pull/761) added maxPasswordLength and passwordError messages (@dannycoates)
+- [#764](https://github.com/mozilla/send/pull/764) added indefinite progress mode (@dannycoates)
+- [#760](https://github.com/mozilla/send/pull/760) refactored css: phase 1 (@dannycoates)
+- [#759](https://github.com/mozilla/send/pull/759) Switch en-US FTL file to new syntax (@flodolo)
+- [#758](https://github.com/mozilla/send/pull/758) refactored server (@dannycoates)
+- [#757](https://github.com/mozilla/send/pull/757) Update to fluent 0.4.3 (@stasm)
+
+### v2.3.0 (2018/02/01 23:27 +00:00)
+- [#536](https://github.com/mozilla/send/pull/536) use redis expire event to delete stored data immediately (@ehuggett)
+- [#744](https://github.com/mozilla/send/pull/744) Gradient experiment (@dannycoates)
+- [#739](https://github.com/mozilla/send/pull/739) added /api/info/:id route (@dannycoates)
+- [#737](https://github.com/mozilla/send/pull/737) big refactor (@dannycoates)
+- [#722](https://github.com/mozilla/send/pull/722) Add localization note to 'Time' and 'Downloads' string (@flodolo)
+- [#721](https://github.com/mozilla/send/pull/721) show download Limits on page; Fixes #661 (@shikhar-scs)
+- [#694](https://github.com/mozilla/send/pull/694) Passwords can now be changed (#687) (@himanish-star)
+- [#702](https://github.com/mozilla/send/pull/702) Restricted the banner from showing on unsupported browsers (@himanish-star)
+- [#701](https://github.com/mozilla/send/pull/701) improved popup for mobile display; Fixes #699 (@shikhar-scs)
+- [#683](https://github.com/mozilla/send/pull/683) API changes to accommodate 3rd party clients (@ehuggett)
+- [#698](https://github.com/mozilla/send/pull/698) Popup for delete button attached (@himanish-star)
+- [#695](https://github.com/mozilla/send/pull/695) Show Warning, Cancel and Redirect on size > 2GB ; fixes #578 (@shikhar-scs)
+- [#684](https://github.com/mozilla/send/pull/684) delete btn popup attached (@himanish-star)
+- [#686](https://github.com/mozilla/send/pull/686) Hide password while Typing and after Entering: Fixes #670 (@shikhar-scs)
+- [#679](https://github.com/mozilla/send/pull/679) changed font to sans sherif: Solves #676 (@shikhar-scs)
+- [#693](https://github.com/mozilla/send/pull/693) README: Fix query link for "good first bugs" (@jspam)
+- [#685](https://github.com/mozilla/send/pull/685) checkbox now has a hover effect: fixes #635 (@himanish-star)
+- [#668](https://github.com/mozilla/send/pull/668) Add possibility to bind to a specific IP address (@TwizzyDizzy)
+- [#682](https://github.com/mozilla/send/pull/682) [Docs] - README.md - minor spelling fixes (@tmm2018)
+- [#672](https://github.com/mozilla/send/pull/672) Use EXPIRE_SECONDS to calculate file ttl for static content (@derektamsen)
+- [#680](https://github.com/mozilla/send/pull/680) adjusted line height of label : fixes #609 (@himanish-star)
+
+### v2.2.2 (2017/12/19 18:06 +00:00)
+- [#667](https://github.com/mozilla/send/pull/667) Make develop the default NODE_ENV (@claudijd)
+
+### v2.2.1 (2017/12/08 18:00 +00:00)
+- [#665](https://github.com/mozilla/send/pull/665) stop drag target from flickering when dragging over children (@ericawright)
+
+### v2.2.0 (2017/12/06 23:57 +00:00)
+- [#654](https://github.com/mozilla/send/pull/654) Multiple download UI (@dannycoates)
+- [#650](https://github.com/mozilla/send/pull/650) #634: overwrite appearance of password submit input (@ovlb)
+- [#649](https://github.com/mozilla/send/pull/649) #609 share interface: align text in input and button (@ovlb)
+
+### v2.1.2 (2017/11/16 19:03 +00:00)
+- [#645](https://github.com/mozilla/send/pull/645) Remove the leak of the password into the console (@laurentj)
+
+### v2.1.0 (2017/11/15 03:07 +00:00)
+- [#641](https://github.com/mozilla/send/pull/641) Added experiment for firefox download promo (@dannycoates)
+- [#640](https://github.com/mozilla/send/pull/640) use fluent-langneg for subtag support (@dannycoates)
+- [#639](https://github.com/mozilla/send/pull/639) wrap number localization in try/catch (@dannycoates)
+
+### v2.0.0 (2017/11/08 05:31 +00:00)
+- [#633](https://github.com/mozilla/send/pull/633) Keyboard navigation/visual feedback regression (@ehuggett)
+- [#632](https://github.com/mozilla/send/pull/632) display the 'add password' button only when the input field isn't empty (@dannycoates)
+- [#626](https://github.com/mozilla/send/pull/626) Partial fix for #623 (@ehuggett)
+- [#624](https://github.com/mozilla/send/pull/624) set a default MIME type in file metadata (@ehuggett)
+- [#612](https://github.com/mozilla/send/pull/612) Password UI nits (@dannycoates, @ericawright)
+- [#617](https://github.com/mozilla/send/pull/617) allow drag and drop if navigating from shared page (@ericawright)
+- [#608](https://github.com/mozilla/send/pull/608) disable copying link when password not completed (@ericawright)
+- [#605](https://github.com/mozilla/send/pull/605) align the "Password" and "Copy to clipboard" fields. (@ericawright)
+- [#582](https://github.com/mozilla/send/pull/582) Add optional password to the download url (@dannycoates)
+
+### v1.2.4 (2017/10/10 17:34 +00:00)
+- [#583](https://github.com/mozilla/send/pull/583) Promote the beefy UI to default (@dannycoates)
+- [#581](https://github.com/mozilla/send/pull/581) introducing ToC to README.md (@tmm2018)
+- [#579](https://github.com/mozilla/send/pull/579) Hide cancel button when upload reaches 100% (@ericawright)
+- [#580](https://github.com/mozilla/send/pull/580) Change Favicon in to look better in a variety of cases (@ericawright)
+- [#571](https://github.com/mozilla/send/pull/571) Centre logo (@ehuggett)
+- [#574](https://github.com/mozilla/send/pull/574) Make upload button focusable (accessibility/tab navigation) (@ehuggett)
+
+### v1.2.0 (2017/09/12 22:42 +00:00)
+- [#559](https://github.com/mozilla/send/pull/559) added first A/B experiment (@dannycoates)
+- [#542](https://github.com/mozilla/send/pull/542) fix docker link typo (@ehuggett)
+- [#541](https://github.com/mozilla/send/pull/541) removed .title and .alt attributes from ftl (@dannycoates)
+- [#537](https://github.com/mozilla/send/pull/537) a few changes to make A/B testing easier (@dannycoates)
+- [#533](https://github.com/mozilla/send/pull/533) minor UI fixes (@youwenliang)
+- [#531](https://github.com/mozilla/send/pull/531) Add CHANGELOG script (@pdehaan)
+- [#535](https://github.com/mozilla/send/pull/535) Fixed minimum NodeJS version in README (@LuFlo)
+- [#528](https://github.com/mozilla/send/pull/528) adding separators to README (@tmm2018)
+
 ### v1.1.1 (2017/08/17 01:29 +00:00)
 - [#516](https://github.com/mozilla/send/pull/516) cache assets (@dannycoates)
 - [#520](https://github.com/mozilla/send/pull/520) fix drag & drop (@dannycoates)
--- a/65
+++ b/65
@@ -1,74 +1,126 @@
+Abdalrahman Hwoij
 Abhinav Adduri
+Adnan Kičin
+Alberto Castro
 Alexander Slovesnik
+Alfredos-Panagiotis Damkalis
 Amin Mahmudian
 Andreas Pettersson
 Arash Mousavi
+Artem Polivanchuk
+Ashikur Rahman
 Balázs Meskó
 Belayet Hossain
+Besnik Bleta
 Bjørn I
 Boopesh Mahendran
+Breana Gonzales
 Chuck Harmston
 Cláudio Esperança
+Cristian Silaghi
 Cynthia Pereira
 Daniel Thorn
 Daniela Arcese
 Danny Coates
+Derek Tamsen
+Edmund Huggett
+Elisa X
 Emin Mastizada
 Enol
 Erica
 Erica Wright
+Filip Hruška
 Fjoerfoks
 Francesco Lodolo
 Francesco Lodolo [:flod]
+Frederick Villaluna
+Gabriela
 Gautam krishna.R
+Georgianizator
+Gonçalo Matos
+Hyeonseok Shin
 Håvar Henriksen
 Jae Hyeon Park
 Jakub Rychlý
 Jamie
 Jim Spentzos
+Jobava
 Johann-S
 John Gruen
 Jon Vadillo
+Jonathan Claudius
+Jordi Cuevas
 Jordi Serratosa
+Juan Esteban Ajsivinac Sián
 Juraj Cigáň
+Kerim Kalamujić
+Khaled Hosny
 Kohei Yoshino
 Lan Glad
+Laurent Jouanneau
+Lobodzets
+LuFlo
+Luiz Carlos de Morais
 Luna Jernberg
 Marcelo Poli
 Marco Aurélio
+Mark Heijl
 Mark Liang
+Marko Andrejić
 Matjaž Horvat
 Maykon Chagas
+Melo46
+Merike Sell
 Michael Köhler
 Michael Wolf
 Michal Stanke
 Michal Vašíček
+Mozilla Pontoon
 Moḥend Belqasem
+Muḥend Belqasem
 Nicholas Skinsacos
+Nihad
+Nihad Suljić
+Oscar
 Peter deHaan
 Pierre Neter
 Pin-guang Chen
+Radu Popescu
 Rhoslyn Prys
+RickieES
 Rizky Ariestiyansyah
 Roberto Alvarado
 Rodrigo
+Rodrigo Guerra
 Rok Žerdin
 Sahithi
 Sairam Raavi
+Sander Lepik
 Sandro
+Sara Todaro
+Sav22999
 Schieck :)
 Selim Şumlu
 Slimane Amiri
+Soumya Himanish Mohapatra
+Staś Małolepszy
+Tema
+Thomas Dalichow
 Théo Chevalier
+Tiago Morais Morgado
 Tomáš Zelina
 Ton
 Tymur Faradzhev
+Uccen Marzuq
 Varghese Thomas
 Victor Bychek
+Vitaliy Krutko
 Weihang Lo
 Wil Clouser
 YFdyh000
 You-Wen Liang (Mark)
+aefgh39622
+albertdcastro
 alex_mayorga
 ariestiyansyah
 avelper
@@ -77,16 +129,29 @@ ehuggett
 eljuno
 erdem cobanoglu
 gautamkrishnar
+gmontagu
 goofy
+hello
 hi
 jesferman1993
+jlG
 josotrix
+jspam
 kenrick95
 manxmensch
+mirzet.omerovic.1992
 ravmn
+rcmainak
 reza.habibi2008
+savemore99.sm
+shikhar-scs
 siparon
 skystar-p
+tiagomoraismorgado
+timvisee
 xcffl
+ybouhamam
 Μιχάλης
 Марко Костић (Marko Kostić)
+صفا الفليج
+వీవెన్
--- a/README.md
+++ b/README.md
@@ -1,9 +1,10 @@
 # Firefox Send

+[![BrowserStack Status](https://www.browserstack.com/automate/badge.svg?badge_key=aFFIMHNEWFcrNHJaMU1LRkJnUDhOQkNHMmh2WHBscjJsZHcwK1h0dkhwdz0tLXRpN1RXcysybUtxTFFTVGRtWjVGeHc9PQ==--c56129be8c75941b115c5b5e5d3ed10b3c7dca6b)](https://www.browserstack.com/automate/public-build/aFFIMHNEWFcrNHJaMU1LRkJnUDhOQkNHMmh2WHBscjJsZHcwK1h0dkhwdz0tLXRpN1RXcysybUtxTFFTVGRtWjVGeHc9PQ==--c56129be8c75941b115c5b5e5d3ed10b3c7dca6b)
 [![CircleCI](https://img.shields.io/circleci/project/github/mozilla/send.svg)](https://circleci.com/gh/mozilla/send)
 [![Available on Test Pilot](https://img.shields.io/badge/available_on-Test_Pilot-0996F8.svg)](https://testpilot.firefox.com/experiments/send)

-**Docs:** [Docker](docs/docker.md), [Metrics](docs/metrics.md)
+**Docs:** [FAQ](docs/faq.md), [Encryption](docs/encryption.md), [Build](docs/build.md), [Docker](docs/docker.md), [Metrics](docs/metrics.md), [More](docs/)

 ---

@@ -69,13 +70,15 @@ The server is configured with environment variables. See [server/config.js](serv

 ## Localization

-Firefox Send localization is managed via [Pontoon](https://pontoon.mozilla.org/projects/test-pilot-firefox-send/), not direct pull requests to the repository. If you want to fix a typo, add a new language, or simply know more about localization, please get in touch with the [existing localization team](https://pontoon.mozilla.org/teams/) for your language, or Mozilla’s [l10n-drivers](https://wiki.mozilla.org/L10n:Mozilla_Team#Mozilla_Corporation) for guidance.
+Firefox Send localization is managed via [Pontoon](https://pontoon.mozilla.org/projects/test-pilot-firefox-send/), not direct pull requests to the repository. If you want to fix a typo, add a new language, or simply know more about localization, please get in touch with the [existing localization team](https://pontoon.mozilla.org/teams/) for your language or Mozilla’s [l10n-drivers](https://wiki.mozilla.org/L10n:Mozilla_Team#Mozilla_Corporation) for guidance.
+
+see also [docs/localization.md](docs/localization.md)

 ---

 ## Contributing

-Pull requests are always welcome! Feel free to check out the list of ["good first bugs"](https://github.com/mozilla/send/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+bug%22).
+Pull requests are always welcome! Feel free to check out the list of ["good first issues"](https://github.com/mozilla/send/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22).

 ---

--- a/app/api.js
+++ b/app/api.js
@@ -0,0 +1,201 @@
+import { arrayToB64, b64ToArray } from './utils';
+
+function post(obj) {
+  return {
+    method: 'POST',
+    headers: new Headers({
+      'Content-Type': 'application/json'
+    }),
+    body: JSON.stringify(obj)
+  };
+}
+
+function parseNonce(header) {
+  header = header || '';
+  return header.split(' ')[1];
+}
+
+async function fetchWithAuth(url, params, keychain) {
+  const result = {};
+  params = params || {};
+  const h = await keychain.authHeader();
+  params.headers = new Headers({ Authorization: h });
+  const response = await fetch(url, params);
+  result.response = response;
+  result.ok = response.ok;
+  const nonce = parseNonce(response.headers.get('WWW-Authenticate'));
+  result.shouldRetry = response.status === 401 && nonce !== keychain.nonce;
+  keychain.nonce = nonce;
+  return result;
+}
+
+async function fetchWithAuthAndRetry(url, params, keychain) {
+  const result = await fetchWithAuth(url, params, keychain);
+  if (result.shouldRetry) {
+    return fetchWithAuth(url, params, keychain);
+  }
+  return result;
+}
+
+export async function del(id, owner_token) {
+  const response = await fetch(`/api/delete/${id}`, post({ owner_token }));
+  return response.ok;
+}
+
+export async function setParams(id, owner_token, params) {
+  const response = await fetch(
+    `/api/params/${id}`,
+    post({
+      owner_token,
+      dlimit: params.dlimit
+    })
+  );
+  return response.ok;
+}
+
+export async function fileInfo(id, owner_token) {
+  const response = await fetch(`/api/info/${id}`, post({ owner_token }));
+  if (response.ok) {
+    const obj = await response.json();
+    return obj;
+  }
+  throw new Error(response.status);
+}
+
+export async function metadata(id, keychain) {
+  const result = await fetchWithAuthAndRetry(
+    `/api/metadata/${id}`,
+    { method: 'GET' },
+    keychain
+  );
+  if (result.ok) {
+    const data = await result.response.json();
+    const meta = await keychain.decryptMetadata(b64ToArray(data.metadata));
+    return {
+      size: data.size,
+      ttl: data.ttl,
+      iv: meta.iv,
+      name: meta.name,
+      type: meta.type
+    };
+  }
+  throw new Error(result.response.status);
+}
+
+export async function setPassword(id, owner_token, keychain) {
+  const auth = await keychain.authKeyB64();
+  const response = await fetch(
+    `/api/password/${id}`,
+    post({ owner_token, auth })
+  );
+  return response.ok;
+}
+
+export function uploadFile(
+  encrypted,
+  metadata,
+  verifierB64,
+  keychain,
+  onprogress
+) {
+  const xhr = new XMLHttpRequest();
+  const upload = {
+    cancel: function() {
+      xhr.abort();
+    },
+    result: new Promise(function(resolve, reject) {
+      xhr.addEventListener('loadend', function() {
+        const authHeader = xhr.getResponseHeader('WWW-Authenticate');
+        if (authHeader) {
+          keychain.nonce = parseNonce(authHeader);
+        }
+        if (xhr.status === 200) {
+          const responseObj = JSON.parse(xhr.responseText);
+          return resolve({
+            url: responseObj.url,
+            id: responseObj.id,
+            ownerToken: responseObj.owner
+          });
+        }
+        reject(new Error(xhr.status));
+      });
+    })
+  };
+  const dataView = new DataView(encrypted);
+  const blob = new Blob([dataView], { type: 'application/octet-stream' });
+  const fd = new FormData();
+  fd.append('data', blob);
+  xhr.upload.addEventListener('progress', function(event) {
+    if (event.lengthComputable) {
+      onprogress([event.loaded, event.total]);
+    }
+  });
+  xhr.open('post', '/api/upload', true);
+  xhr.setRequestHeader('X-File-Metadata', arrayToB64(new Uint8Array(metadata)));
+  xhr.setRequestHeader('Authorization', `send-v1 ${verifierB64}`);
+  xhr.send(fd);
+  return upload;
+}
+
+function download(id, keychain, onprogress, canceller) {
+  const xhr = new XMLHttpRequest();
+  canceller.oncancel = function() {
+    xhr.abort();
+  };
+  return new Promise(async function(resolve, reject) {
+    xhr.addEventListener('loadend', function() {
+      canceller.oncancel = function() {};
+      const authHeader = xhr.getResponseHeader('WWW-Authenticate');
+      if (authHeader) {
+        keychain.nonce = parseNonce(authHeader);
+      }
+      if (xhr.status !== 200) {
+        return reject(new Error(xhr.status));
+      }
+
+      const blob = new Blob([xhr.response]);
+      const fileReader = new FileReader();
+      fileReader.readAsArrayBuffer(blob);
+      fileReader.onload = function() {
+        resolve(this.result);
+      };
+    });
+
+    xhr.addEventListener('progress', function(event) {
+      if (event.lengthComputable && event.target.status === 200) {
+        onprogress([event.loaded, event.total]);
+      }
+    });
+    const auth = await keychain.authHeader();
+    xhr.open('get', `/api/download/${id}`);
+    xhr.setRequestHeader('Authorization', auth);
+    xhr.responseType = 'blob';
+    xhr.send();
+    onprogress([0, 1]);
+  });
+}
+
+async function tryDownload(id, keychain, onprogress, canceller, tries = 1) {
+  try {
+    const result = await download(id, keychain, onprogress, canceller);
+    return result;
+  } catch (e) {
+    if (e.message === '401' && --tries > 0) {
+      return tryDownload(id, keychain, onprogress, canceller, tries);
+    }
+    throw e;
+  }
+}
+
+export function downloadFile(id, keychain, onprogress) {
+  const canceller = {
+    oncancel: function() {} // download() sets this
+  };
+  function cancel() {
+    canceller.oncancel();
+  }
+  return {
+    cancel,
+    result: tryDownload(id, keychain, onprogress, canceller, 2)
+  };
+}
--- a/app/base.css
+++ b/app/base.css
@@ -0,0 +1,268 @@
+:root {
+  --pageBGColor: #fff;
+  --primaryControlBGColor: #0297f8;
+  --primaryControlFGColor: #fff;
+  --primaryControlHoverColor: #0287e8;
+  --inputTextColor: #737373;
+  --errorColor: #d70022;
+  --linkColor: #0094fb;
+  --textColor: #0c0c0d;
+  --lightTextColor: #737373;
+  --successControlBGColor: #05a700;
+  --successControlFGColor: #fff;
+}
+
+html {
+  background: url('../assets/send_bg.svg');
+  font-family: -apple-system, BlinkMacSystemFont, 'SF Pro Text', 'segoe ui',
+    'helvetica neue', helvetica, ubuntu, roboto, noto, arial, sans-serif;
+  font-weight: 200;
+  background-size: 110%;
+  background-repeat: no-repeat;
+  background-position: center top;
+}
+
+body {
+  font-family: -apple-system, BlinkMacSystemFont, 'SF Pro Text', 'segoe ui',
+    'helvetica neue', helvetica, ubuntu, roboto, noto, arial, sans-serif;
+  display: flex;
+  flex-direction: column;
+  margin: 0;
+  min-height: 100vh;
+}
+
+input,
+select,
+textarea,
+button {
+  font-family: inherit;
+  margin: 0;
+}
+
+a {
+  text-decoration: none;
+}
+
+.main {
+  flex: auto;
+  max-width: 650px;
+  margin: 0 auto;
+  padding: 0 20px;
+  box-sizing: border-box;
+  width: 96%;
+}
+
+.noscript {
+  text-align: center;
+  border: 3px solid var(--errorColor);
+  border-radius: 6px;
+}
+
+.btn {
+  font-size: 15px;
+  font-weight: 500;
+  color: var(--primaryControlFGColor);
+  cursor: pointer;
+  text-align: center;
+  background: var(--primaryControlBGColor);
+  border: 1px solid var(--primaryControlBGColor);
+  border-radius: 5px;
+}
+
+.btn:hover {
+  background-color: var(--primaryControlHoverColor);
+}
+
+.btn--cancel {
+  color: var(--errorColor);
+  background: var(--pageBGColor);
+  font-size: 15px;
+  border: 0;
+  cursor: pointer;
+  text-decoration: underline;
+}
+
+.btn--cancel:disabled {
+  text-decoration: none;
+  cursor: auto;
+}
+
+.btn--cancel:hover {
+  background-color: var(--pageBGColor);
+}
+
+.input {
+  flex: 2 0 auto;
+  border: 1px solid var(--primaryControlBGColor);
+  border-radius: 6px 0 0 6px;
+  font-size: 20px;
+  color: var(--inputTextColor);
+  font-family: 'SF Pro Text', sans-serif;
+  letter-spacing: 0;
+  line-height: 23px;
+  font-weight: 300;
+  height: 46px;
+  padding-left: 10px;
+  padding-right: 10px;
+}
+
+.input--error {
+  border-color: var(--errorColor);
+}
+
+.input--noBtn {
+  border-radius: 6px;
+}
+
+.inputBtn {
+  flex: auto;
+  background: var(--primaryControlBGColor);
+  border-radius: 0 6px 6px 0;
+  border: 1px solid var(--primaryControlBGColor);
+  color: var(--primaryControlFGColor);
+  cursor: pointer;
+
+  /* Force flat button look */
+  /* stylelint-disable-next-line plugin/no-unsupported-browser-features */
+  appearance: none;
+  font-size: 15px;
+  padding-bottom: 3px;
+  padding-left: 10px;
+  padding-right: 10px;
+  white-space: nowrap;
+}
+
+.inputBtn:disabled {
+  cursor: auto;
+}
+
+.inputBtn:hover {
+  background-color: var(--primaryControlHoverColor);
+}
+
+.inputBtn--hidden {
+  display: none;
+}
+
+.cursor--pointer {
+  cursor: pointer;
+}
+
+.link {
+  color: var(--linkColor);
+  text-decoration: none;
+}
+
+.link:focus,
+.link:active,
+.link:hover {
+  color: var(--primaryControlHoverColor);
+}
+
+.link--action {
+  text-decoration: underline;
+  text-align: center;
+}
+
+.page {
+  margin: 0 auto 30px;
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  flex-direction: column;
+  text-align: center;
+}
+
+.progressSection {
+  margin: 0 auto;
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  flex-direction: column;
+  text-align: center;
+  font-size: 15px;
+}
+
+.progressSection__text {
+  color: var(--lightTextColor);
+  letter-spacing: -0.4px;
+  margin-top: 24px;
+  margin-bottom: 74px;
+}
+
+.effect--fadeOut {
+  opacity: 0;
+  animation: fadeout 200ms linear;
+}
+
+@keyframes fadeout {
+  0% {
+    opacity: 1;
+  }
+
+  100% {
+    opacity: 0;
+  }
+}
+
+.effect--fadeIn {
+  opacity: 1;
+  animation: fadein 200ms linear;
+}
+
+@keyframes fadein {
+  0% {
+    opacity: 0;
+  }
+
+  100% {
+    opacity: 1;
+  }
+}
+
+.error {
+  color: var(--errorColor);
+}
+
+.title {
+  font-size: 33px;
+  line-height: 40px;
+  margin: 20px auto;
+  text-align: center;
+  max-width: 520px;
+  font-family: 'SF Pro Text', sans-serif;
+  word-wrap: break-word;
+}
+
+.description {
+  font-size: 15px;
+  line-height: 23px;
+  max-width: 630px;
+  text-align: center;
+  margin: 0 auto 60px;
+  color: var(--textColor);
+  width: 92%;
+}
+
+@media (max-device-width: 768px), (max-width: 768px) {
+  .description {
+    margin: 0 auto 25px;
+  }
+}
+
+@media (max-device-width: 520px), (max-width: 520px) {
+  .input {
+    font-size: 22px;
+    padding: 10px 10px;
+    border-radius: 6px 6px 0 0;
+  }
+
+  .inputBtn {
+    border-radius: 0 0 6px 6px;
+    flex: 0 1 65px;
+  }
+
+  .input--noBtn {
+    border-radius: 6px;
+  }
+}
--- a/app/dragManager.js
+++ b/app/dragManager.js
@@ -1,3 +1,6 @@
+/* global MAXFILESIZE */
+const { bytes } = require('./utils');
+
 export default function(state, emitter) {
  emitter.on('DOMContentLoaded', () => {
    document.body.addEventListener('dragover', event => {
@@ -6,17 +9,28 @@ export default function(state, emitter) {
      }
    });
    document.body.addEventListener('drop', event => {
-      if (state.route === '/' && !state.transfer) {
+      if (state.route === '/' && !state.uploading) {
        event.preventDefault();
-        document.querySelector('.upload-window').classList.remove('ondrag');
+        document
+          .querySelector('.uploadArea')
+          .classList.remove('uploadArea--dragging');
        const target = event.dataTransfer;
        if (target.files.length === 0) {
          return;
        }
-        if (target.files.length > 1 || target.files[0].size === 0) {
+        if (target.files.length > 1) {
+          // eslint-disable-next-line no-alert
          return alert(state.translate('uploadPageMultipleFilesAlert'));
        }
        const file = target.files[0];
+        if (file.size === 0) {
+          return;
+        }
+        if (file.size > MAXFILESIZE) {
+          // eslint-disable-next-line no-alert
+          alert(state.translate('fileTooBig', { size: bytes(MAXFILESIZE) }));
+          return;
+        }
        emitter.emit('upload', { file, type: 'drop' });
      }
    });
--- a/app/experiments.js
+++ b/app/experiments.js
@@ -1,6 +1,41 @@
 import hash from 'string-hash';

-const experiments = {};
+const experiments = {
+  S9wqVl2SQ4ab2yZtqDI3Dw: {
+    id: 'S9wqVl2SQ4ab2yZtqDI3Dw',
+    run: function(variant, state, emitter) {
+      switch (variant) {
+        case 1:
+          state.promo = 'blue';
+          break;
+        case 2:
+          state.promo = 'pink';
+          break;
+        default:
+          state.promo = 'grey';
+      }
+      emitter.emit('render');
+    },
+    eligible: function() {
+      return (
+        !/firefox|fxios/i.test(navigator.userAgent) &&
+        document.querySelector('html').lang === 'en-US'
+      );
+    },
+    variant: function(state) {
+      const n = this.luckyNumber(state);
+      if (n < 0.33) {
+        return 0;
+      }
+      return n < 0.66 ? 1 : 2;
+    },
+    luckyNumber: function(state) {
+      return luckyNumber(
+        `${this.id}:${state.storage.get('testpilot_ga__cid')}`
+      );
+    }
+  }
+};

 //Returns a number between 0 and 1
 // eslint-disable-next-line no-unused-vars
@@ -32,12 +67,12 @@ export default function initialize(state, emitter) {
      checkExperiments(state, emitter);
    });
  } else {
-    const enrolled = state.storage.enrolled;
-    enrolled.forEach(([id, variant]) => {
+    const enrolled = state.storage.enrolled.filter(([id, variant]) => {
      const xp = experiments[id];
      if (xp) {
        xp.run(variant, state, emitter);
      }
+      return !!xp;
    });
    // single experiment per session for now
    if (enrolled.length === 0) {
--- a/app/fileManager.js
+++ b/app/fileManager.js
@@ -1,57 +1,14 @@
-/* global EXPIRE_SECONDS */
 import FileSender from './fileSender';
 import FileReceiver from './fileReceiver';
-import { copyToClipboard, delay, fadeOut, percent } from './utils';
+import {
+  copyToClipboard,
+  delay,
+  fadeOut,
+  openLinksInNewTab,
+  percent
+} from './utils';
 import * as metrics from './metrics';

-function saveFile(file) {
-  const dataView = new DataView(file.plaintext);
-  const blob = new Blob([dataView], { type: file.type });
-  const downloadUrl = URL.createObjectURL(blob);
-
-  if (window.navigator.msSaveBlob) {
-    return window.navigator.msSaveBlob(blob, file.name);
-  }
-  const a = document.createElement('a');
-  a.href = downloadUrl;
-  a.download = file.name;
-  document.body.appendChild(a);
-  a.click();
-  URL.revokeObjectURL(downloadUrl);
-}
-
-function openLinksInNewTab(links, should = true) {
-  links = links || Array.from(document.querySelectorAll('a:not([target])'));
-  if (should) {
-    links.forEach(l => {
-      l.setAttribute('target', '_blank');
-      l.setAttribute('rel', 'noopener noreferrer');
-    });
-  } else {
-    links.forEach(l => {
-      l.removeAttribute('target');
-      l.removeAttribute('rel');
-    });
-  }
-  return links;
-}
-
-function exists(id) {
-  return new Promise((resolve, reject) => {
-    const xhr = new XMLHttpRequest();
-    xhr.onreadystatechange = () => {
-      if (xhr.readyState === XMLHttpRequest.HEADERS_RECEIVED) {
-        resolve(xhr.status === 200);
-      }
-    };
-    xhr.onerror = () => resolve(false);
-    xhr.ontimeout = () => resolve(false);
-    xhr.open('get', '/api/exists/' + id);
-    xhr.timeout = 2000;
-    xhr.send();
-  });
-}
-
 export default function(state, emitter) {
  let lastRender = 0;
  let updateTitle = false;
@@ -61,13 +18,17 @@ export default function(state, emitter) {
  }

  async function checkFiles() {
-    const files = state.storage.files;
+    const files = state.storage.files.slice();
    let rerender = false;
    for (const file of files) {
-      const ok = await exists(file.id);
-      if (!ok) {
+      const oldLimit = file.dlimit;
+      const oldTotal = file.dtotal;
+      await file.updateDownloadCount();
+      if (file.dtotal === file.dlimit) {
        state.storage.remove(file.id);
        rerender = true;
+      } else if (oldLimit !== file.dlimit || oldTotal !== file.dtotal) {
+        rerender = true;
      }
    }
    if (rerender) {
@@ -97,6 +58,12 @@ export default function(state, emitter) {
    lastRender = Date.now();
  });

+  emitter.on('changeLimit', async ({ file, value }) => {
+    await file.changeLimit(value);
+    state.storage.writeFile(file);
+    metrics.changedDownloadLimit(file);
+  });
+
  emitter.on('delete', async ({ file, location }) => {
    try {
      metrics.deletedUpload({
@@ -108,11 +75,10 @@ export default function(state, emitter) {
        location
      });
      state.storage.remove(file.id);
-      await FileSender.delete(file.id, file.deleteToken);
+      await file.del();
    } catch (e) {
      state.raven.captureException(e);
    }
-    state.fileInfo = null;
  });

  emitter.on('cancel', () => {
@@ -125,77 +91,116 @@ export default function(state, emitter) {
    sender.on('progress', updateProgress);
    sender.on('encrypting', render);
    state.transfer = sender;
+    state.uploading = true;
    render();
+
    const links = openLinksInNewTab();
    await delay(200);
    try {
-      const start = Date.now();
      metrics.startedUpload({ size, type });
-      const info = await sender.upload();
-      const time = Date.now() - start;
-      const speed = size / (time / 1000);
-      metrics.completedUpload({ size, time, speed, type });
-      document.getElementById('cancel-upload').hidden = 'hidden';
-      await delay(1000);
-      await fadeOut('upload-progress');
-      info.name = file.name;
-      info.size = size;
-      info.type = type;
-      info.time = time;
-      info.speed = speed;
-      info.createdAt = Date.now();
-      info.url = `${info.url}#${info.secretKey}`;
-      info.expiresAt = Date.now() + EXPIRE_SECONDS * 1000;
-      state.fileInfo = info;
-      state.storage.addFile(state.fileInfo);
-      openLinksInNewTab(links, false);
-      state.transfer = null;
+      const ownedFile = await sender.upload();
+      ownedFile.type = type;
      state.storage.totalUploads += 1;
-      emitter.emit('pushState', `/share/${info.id}`);
+      metrics.completedUpload(ownedFile);
+
+      state.storage.addFile(ownedFile);
+      const cancelBtn = document.getElementById('cancel-upload');
+      if (cancelBtn) {
+        cancelBtn.hidden = 'hidden';
+      }
+      await delay(1000);
+      await fadeOut('.page');
+      emitter.emit('pushState', `/share/${ownedFile.id}`);
    } catch (err) {
-      state.transfer = null;
      if (err.message === '0') {
        //cancelled. do nothing
        metrics.cancelledUpload({ size, type });
-        return render();
+        render();
+      } else {
+        // eslint-disable-next-line no-console
+        console.error(err);
+        state.raven.captureException(err);
+        metrics.stoppedUpload({ size, type, err });
+        emitter.emit('pushState', '/error');
      }
-      state.raven.captureException(err);
-      metrics.stoppedUpload({ size, type, err });
-      emitter.emit('replaceState', '/error');
+    } finally {
+      openLinksInNewTab(links, false);
+      state.uploading = false;
+      state.transfer = null;
    }
  });

-  emitter.on('download', async file => {
-    const size = file.size;
-    const url = `/api/download/${file.id}`;
-    const receiver = new FileReceiver(url, file.key);
-    receiver.on('progress', updateProgress);
-    receiver.on('decrypting', render);
-    state.transfer = receiver;
-    const links = openLinksInNewTab();
+  emitter.on('password', async ({ password, file }) => {
+    try {
+      state.settingPassword = true;
+      render();
+      await file.setPassword(password);
+      state.storage.writeFile(file);
+      metrics.addedPassword({ size: file.size });
+      await delay(1000);
+    } catch (err) {
+      // eslint-disable-next-line no-console
+      console.error(err);
+      state.passwordSetError = err;
+    } finally {
+      state.settingPassword = false;
+    }
    render();
+  });
+
+  emitter.on('getMetadata', async () => {
+    const file = state.fileInfo;
+    const receiver = new FileReceiver(file);
+    try {
+      await receiver.getMetadata();
+      state.transfer = receiver;
+    } catch (e) {
+      if (e.message === '401') {
+        file.password = null;
+        if (!file.requiresPassword) {
+          return emitter.emit('pushState', '/404');
+        }
+      }
+    }
+    render();
+  });
+
+  emitter.on('download', async file => {
+    state.transfer.on('progress', updateProgress);
+    state.transfer.on('decrypting', render);
+    const links = openLinksInNewTab();
+    const size = file.size;
    try {
      const start = Date.now();
      metrics.startedDownload({ size: file.size, ttl: file.ttl });
-      const f = await receiver.download();
+      const dl = state.transfer.download();
+      render();
+      await dl;
      const time = Date.now() - start;
      const speed = size / (time / 1000);
      await delay(1000);
-      await fadeOut('download-progress');
-      saveFile(f);
+      await fadeOut('.page');
      state.storage.totalDownloads += 1;
+      state.transfer.reset();
      metrics.completedDownload({ size, time, speed });
      emitter.emit('pushState', '/completed');
    } catch (err) {
-      // TODO cancelled download
-      const location = err.message === 'notfound' ? '/404' : '/error';
-      if (location === '/error') {
-        state.raven.captureException(err);
-        metrics.stoppedDownload({ size, err });
+      if (err.message === '0') {
+        // download cancelled
+        state.transfer.reset();
+        render();
+      } else {
+        // eslint-disable-next-line no-console
+        console.error(err);
+        state.transfer = null;
+        const location = err.message === '404' ? '/404' : '/error';
+        if (location === '/error') {
+          state.raven.captureException(err);
+          metrics.stoppedDownload({ size, err });
+        }
+        emitter.emit('pushState', location);
      }
-      emitter.emit('replaceState', location);
    } finally {
-      state.transfer = null;
      openLinksInNewTab(links, false);
    }
  });
@@ -205,6 +210,14 @@ export default function(state, emitter) {
    metrics.copiedLink({ location });
  });

+  setInterval(() => {
+    // poll for updates of the download counts
+    // TODO something for the share page: || state.route === '/share/:id'
+    if (state.route === '/') {
+      checkFiles();
+    }
+  }, 2 * 60 * 1000);
+
  setInterval(() => {
    // poll for rerendering the file list countdown timers
    if (
--- a/app/fileReceiver.js
+++ b/app/fileReceiver.js
@@ -1,32 +1,27 @@
 import Nanobus from 'nanobus';
-import { hexToArray, bytes } from './utils';
+import Keychain from './keychain';
+import { bytes } from './utils';
+import { metadata, downloadFile } from './api';

 export default class FileReceiver extends Nanobus {
-  constructor(url, k) {
+  constructor(fileInfo) {
    super('FileReceiver');
-    this.key = window.crypto.subtle.importKey(
-      'jwk',
-      {
-        k,
-        kty: 'oct',
-        alg: 'A128GCM',
-        ext: true
-      },
-      {
-        name: 'AES-GCM'
-      },
-      false,
-      ['decrypt']
-    );
-    this.url = url;
-    this.msg = 'fileSizeProgress';
-    this.progress = [0, 1];
+    this.keychain = new Keychain(fileInfo.secretKey, fileInfo.nonce);
+    if (fileInfo.requiresPassword) {
+      this.keychain.setPassword(fileInfo.password, fileInfo.url);
+    }
+    this.fileInfo = fileInfo;
+    this.reset();
  }

  get progressRatio() {
    return this.progress[0] / this.progress[1];
  }

+  get progressIndefinite() {
+    return this.state !== 'downloading';
+  }
+
  get sizes() {
    return {
      partialSize: bytes(this.progress[0]),
@@ -35,66 +30,95 @@ export default class FileReceiver extends Nanobus {
  }

  cancel() {
-    // TODO
+    if (this.downloadRequest) {
+      this.downloadRequest.cancel();
+    }
  }

-  downloadFile() {
-    return new Promise((resolve, reject) => {
-      const xhr = new XMLHttpRequest();
-
-      xhr.onprogress = event => {
-        if (event.lengthComputable && event.target.status !== 404) {
-          this.progress = [event.loaded, event.total];
-          this.emit('progress', this.progress);
-        }
-      };
-
-      xhr.onload = function(event) {
-        if (xhr.status === 404) {
-          reject(new Error('notfound'));
-          return;
-        }
-
-        const blob = new Blob([this.response]);
-        const meta = JSON.parse(xhr.getResponseHeader('X-File-Metadata'));
-        const fileReader = new FileReader();
-        fileReader.onload = function() {
-          resolve({
-            data: this.result,
-            name: meta.filename,
-            type: meta.mimeType,
-            iv: meta.id
-          });
-        };
-
-        fileReader.readAsArrayBuffer(blob);
-      };
-
-      xhr.open('get', this.url);
-      xhr.responseType = 'blob';
-      xhr.send();
-    });
+  reset() {
+    this.msg = 'fileSizeProgress';
+    this.state = 'initialized';
+    this.progress = [0, 1];
  }

-  async download() {
-    const key = await this.key;
-    const file = await this.downloadFile();
-    this.msg = 'decryptingFile';
-    this.emit('decrypting');
-    const plaintext = await window.crypto.subtle.decrypt(
-      {
-        name: 'AES-GCM',
-        iv: hexToArray(file.iv),
-        tagLength: 128
-      },
-      key,
-      file.data
+  async getMetadata() {
+    const meta = await metadata(this.fileInfo.id, this.keychain);
+    this.keychain.setIV(meta.iv);
+    this.fileInfo.name = meta.name;
+    this.fileInfo.type = meta.type;
+    this.fileInfo.iv = meta.iv;
+    this.fileInfo.size = meta.size;
+    this.state = 'ready';
+  }
+
+  async download(noSave = false) {
+    this.state = 'downloading';
+    this.downloadRequest = await downloadFile(
+      this.fileInfo.id,
+      this.keychain,
+      p => {
+        this.progress = p;
+        this.emit('progress');
+      }
    );
-    this.msg = 'downloadFinish';
-    return {
-      plaintext,
-      name: decodeURIComponent(file.name),
-      type: file.type
-    };
+    try {
+      const ciphertext = await this.downloadRequest.result;
+      this.downloadRequest = null;
+      this.msg = 'decryptingFile';
+      this.state = 'decrypting';
+      this.emit('decrypting');
+      const plaintext = await this.keychain.decryptFile(ciphertext);
+      if (!noSave) {
+        await saveFile({
+          plaintext,
+          name: decodeURIComponent(this.fileInfo.name),
+          type: this.fileInfo.type
+        });
+      }
+      this.msg = 'downloadFinish';
+      this.state = 'complete';
+    } catch (e) {
+      this.downloadRequest = null;
+      throw e;
+    }
  }
 }
+
+async function saveFile(file) {
+  return new Promise(function(resolve, reject) {
+    const dataView = new DataView(file.plaintext);
+    const blob = new Blob([dataView], { type: file.type });
+
+    if (navigator.msSaveBlob) {
+      navigator.msSaveBlob(blob, file.name);
+      return resolve();
+    } else if (/iPhone|fxios/i.test(navigator.userAgent)) {
+      // This method is much slower but createObjectURL
+      // is buggy on iOS
+      const reader = new FileReader();
+      reader.addEventListener('loadend', function() {
+        if (reader.error) {
+          return reject(reader.error);
+        }
+        if (reader.result) {
+          const a = document.createElement('a');
+          a.href = reader.result;
+          a.download = file.name;
+          document.body.appendChild(a);
+          a.click();
+        }
+        resolve();
+      });
+      reader.readAsDataURL(blob);
+    } else {
+      const downloadUrl = URL.createObjectURL(blob);
+      const a = document.createElement('a');
+      a.href = downloadUrl;
+      a.download = file.name;
+      document.body.appendChild(a);
+      a.click();
+      URL.revokeObjectURL(downloadUrl);
+      setTimeout(resolve, 100);
+    }
+  });
+}
--- a/app/fileSender.js
+++ b/app/fileSender.js
@@ -1,48 +1,26 @@
+/* global EXPIRE_SECONDS */
 import Nanobus from 'nanobus';
-import { arrayToHex, bytes } from './utils';
+import OwnedFile from './ownedFile';
+import Keychain from './keychain';
+import { arrayToB64, bytes } from './utils';
+import { uploadFile } from './api';

 export default class FileSender extends Nanobus {
  constructor(file) {
    super('FileSender');
    this.file = file;
-    this.msg = 'importingFile';
-    this.progress = [0, 1];
-    this.cancelled = false;
-    this.iv = window.crypto.getRandomValues(new Uint8Array(12));
-    this.uploadXHR = new XMLHttpRequest();
-    this.key = window.crypto.subtle.generateKey(
-      {
-        name: 'AES-GCM',
-        length: 128
-      },
-      true,
-      ['encrypt']
-    );
-  }
-
-  static delete(id, token) {
-    return new Promise((resolve, reject) => {
-      if (!id || !token) {
-        return reject();
-      }
-      const xhr = new XMLHttpRequest();
-      xhr.open('POST', `/api/delete/${id}`);
-      xhr.setRequestHeader('Content-Type', 'application/json');
-
-      xhr.onreadystatechange = () => {
-        if (xhr.readyState === XMLHttpRequest.DONE) {
-          resolve();
-        }
-      };
-
-      xhr.send(JSON.stringify({ delete_token: token }));
-    });
+    this.keychain = new Keychain();
+    this.reset();
  }

  get progressRatio() {
    return this.progress[0] / this.progress[1];
  }

+  get progressIndefinite() {
+    return ['fileSizeProgress', 'notifyUploadDone'].indexOf(this.msg) === -1;
+  }
+
  get sizes() {
    return {
      partialSize: bytes(this.progress[0]),
@@ -50,10 +28,17 @@ export default class FileSender extends Nanobus {
    };
  }

+  reset() {
+    this.uploadRequest = null;
+    this.msg = 'importingFile';
+    this.progress = [0, 1];
+    this.cancelled = false;
+  }
+
  cancel() {
    this.cancelled = true;
-    if (this.msg === 'fileSizeProgress') {
-      this.uploadXHR.abort();
+    if (this.uploadRequest) {
+      this.uploadRequest.cancel();
    }
  }

@@ -61,6 +46,7 @@ export default class FileSender extends Nanobus {
    return new Promise((resolve, reject) => {
      const reader = new FileReader();
      reader.readAsArrayBuffer(this.file);
+      // TODO: progress?
      reader.onload = function(event) {
        const plaintext = new Uint8Array(this.result);
        resolve(plaintext);
@@ -71,76 +57,57 @@ export default class FileSender extends Nanobus {
    });
  }

-  uploadFile(encrypted, keydata) {
-    return new Promise((resolve, reject) => {
-      const file = this.file;
-      const id = arrayToHex(this.iv);
-      const dataView = new DataView(encrypted);
-      const blob = new Blob([dataView], { type: file.type });
-      const fd = new FormData();
-      fd.append('data', blob, file.name);
-
-      const xhr = this.uploadXHR;
-
-      xhr.upload.addEventListener('progress', e => {
-        if (e.lengthComputable) {
-          this.progress = [e.loaded, e.total];
-          this.emit('progress', this.progress);
-        }
-      });
-
-      xhr.onreadystatechange = () => {
-        if (xhr.readyState === XMLHttpRequest.DONE) {
-          if (xhr.status === 200) {
-            this.progress = [1, 1];
-            this.msg = 'notifyUploadDone';
-            const responseObj = JSON.parse(xhr.responseText);
-            return resolve({
-              url: responseObj.url,
-              id: responseObj.id,
-              secretKey: keydata.k,
-              deleteToken: responseObj.delete
-            });
-          }
-          this.msg = 'errorPageHeader';
-          reject(new Error(xhr.status));
-        }
-      };
-
-      xhr.open('post', '/api/upload', true);
-      xhr.setRequestHeader(
-        'X-File-Metadata',
-        JSON.stringify({
-          id: id,
-          filename: encodeURIComponent(file.name)
-        })
-      );
-      xhr.send(fd);
-      this.msg = 'fileSizeProgress';
-    });
-  }
-
  async upload() {
-    const key = await this.key;
+    const start = Date.now();
    const plaintext = await this.readFile();
    if (this.cancelled) {
      throw new Error(0);
    }
    this.msg = 'encryptingFile';
    this.emit('encrypting');
-    const encrypted = await window.crypto.subtle.encrypt(
-      {
-        name: 'AES-GCM',
-        iv: this.iv,
-        tagLength: 128
-      },
-      key,
-      plaintext
-    );
+    const encrypted = await this.keychain.encryptFile(plaintext);
+    const metadata = await this.keychain.encryptMetadata(this.file);
+    const authKeyB64 = await this.keychain.authKeyB64();
    if (this.cancelled) {
      throw new Error(0);
    }
-    const keydata = await window.crypto.subtle.exportKey('jwk', key);
-    return this.uploadFile(encrypted, keydata);
+    this.uploadRequest = uploadFile(
+      encrypted,
+      metadata,
+      authKeyB64,
+      this.keychain,
+      p => {
+        this.progress = p;
+        this.emit('progress');
+      }
+    );
+    this.msg = 'fileSizeProgress';
+    this.emit('progress'); // HACK to kick MS Edge
+    try {
+      const result = await this.uploadRequest.result;
+      const time = Date.now() - start;
+      this.msg = 'notifyUploadDone';
+      this.uploadRequest = null;
+      this.progress = [1, 1];
+      const secretKey = arrayToB64(this.keychain.rawSecret);
+      const ownedFile = new OwnedFile({
+        id: result.id,
+        url: `${result.url}#${secretKey}`,
+        name: this.file.name,
+        size: this.file.size,
+        time: time,
+        speed: this.file.size / (time / 1000),
+        createdAt: Date.now(),
+        expiresAt: Date.now() + EXPIRE_SECONDS * 1000,
+        secretKey: secretKey,
+        nonce: this.keychain.nonce,
+        ownerToken: result.ownerToken
+      });
+      return ownedFile;
+    } catch (e) {
+      this.msg = 'errorPageHeader';
+      this.uploadRequest = null;
+      throw e;
+    }
  }
 }
--- a/app/keychain.js
+++ b/app/keychain.js
@@ -0,0 +1,209 @@
+import { arrayToB64, b64ToArray } from './utils';
+
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+
+export default class Keychain {
+  constructor(secretKeyB64, nonce, ivB64) {
+    this._nonce = nonce || 'yRCdyQ1EMSA3mo4rqSkuNQ==';
+    if (ivB64) {
+      this.iv = b64ToArray(ivB64);
+    } else {
+      this.iv = window.crypto.getRandomValues(new Uint8Array(12));
+    }
+    if (secretKeyB64) {
+      this.rawSecret = b64ToArray(secretKeyB64);
+    } else {
+      this.rawSecret = window.crypto.getRandomValues(new Uint8Array(16));
+    }
+    this.secretKeyPromise = window.crypto.subtle.importKey(
+      'raw',
+      this.rawSecret,
+      'HKDF',
+      false,
+      ['deriveKey']
+    );
+    this.encryptKeyPromise = this.secretKeyPromise.then(function(secretKey) {
+      return window.crypto.subtle.deriveKey(
+        {
+          name: 'HKDF',
+          salt: new Uint8Array(),
+          info: encoder.encode('encryption'),
+          hash: 'SHA-256'
+        },
+        secretKey,
+        {
+          name: 'AES-GCM',
+          length: 128
+        },
+        false,
+        ['encrypt', 'decrypt']
+      );
+    });
+    this.metaKeyPromise = this.secretKeyPromise.then(function(secretKey) {
+      return window.crypto.subtle.deriveKey(
+        {
+          name: 'HKDF',
+          salt: new Uint8Array(),
+          info: encoder.encode('metadata'),
+          hash: 'SHA-256'
+        },
+        secretKey,
+        {
+          name: 'AES-GCM',
+          length: 128
+        },
+        false,
+        ['encrypt', 'decrypt']
+      );
+    });
+    this.authKeyPromise = this.secretKeyPromise.then(function(secretKey) {
+      return window.crypto.subtle.deriveKey(
+        {
+          name: 'HKDF',
+          salt: new Uint8Array(),
+          info: encoder.encode('authentication'),
+          hash: 'SHA-256'
+        },
+        secretKey,
+        {
+          name: 'HMAC',
+          hash: { name: 'SHA-256' }
+        },
+        true,
+        ['sign']
+      );
+    });
+  }
+
+  get nonce() {
+    return this._nonce;
+  }
+
+  set nonce(n) {
+    if (n && n !== this._nonce) {
+      this._nonce = n;
+    }
+  }
+
+  setIV(ivB64) {
+    this.iv = b64ToArray(ivB64);
+  }
+
+  setPassword(password, shareUrl) {
+    this.authKeyPromise = window.crypto.subtle
+      .importKey('raw', encoder.encode(password), { name: 'PBKDF2' }, false, [
+        'deriveKey'
+      ])
+      .then(passwordKey =>
+        window.crypto.subtle.deriveKey(
+          {
+            name: 'PBKDF2',
+            salt: encoder.encode(shareUrl),
+            iterations: 100,
+            hash: 'SHA-256'
+          },
+          passwordKey,
+          {
+            name: 'HMAC',
+            hash: 'SHA-256'
+          },
+          true,
+          ['sign']
+        )
+      );
+  }
+
+  setAuthKey(authKeyB64) {
+    this.authKeyPromise = window.crypto.subtle.importKey(
+      'raw',
+      b64ToArray(authKeyB64),
+      {
+        name: 'HMAC',
+        hash: 'SHA-256'
+      },
+      true,
+      ['sign']
+    );
+  }
+
+  async authKeyB64() {
+    const authKey = await this.authKeyPromise;
+    const rawAuth = await window.crypto.subtle.exportKey('raw', authKey);
+    return arrayToB64(new Uint8Array(rawAuth));
+  }
+
+  async authHeader() {
+    const authKey = await this.authKeyPromise;
+    const sig = await window.crypto.subtle.sign(
+      {
+        name: 'HMAC'
+      },
+      authKey,
+      b64ToArray(this.nonce)
+    );
+    return `send-v1 ${arrayToB64(new Uint8Array(sig))}`;
+  }
+
+  async encryptFile(plaintext) {
+    const encryptKey = await this.encryptKeyPromise;
+    const ciphertext = await window.crypto.subtle.encrypt(
+      {
+        name: 'AES-GCM',
+        iv: this.iv,
+        tagLength: 128
+      },
+      encryptKey,
+      plaintext
+    );
+    return ciphertext;
+  }
+
+  async encryptMetadata(metadata) {
+    const metaKey = await this.metaKeyPromise;
+    const ciphertext = await window.crypto.subtle.encrypt(
+      {
+        name: 'AES-GCM',
+        iv: new Uint8Array(12),
+        tagLength: 128
+      },
+      metaKey,
+      encoder.encode(
+        JSON.stringify({
+          iv: arrayToB64(this.iv),
+          name: metadata.name,
+          type: metadata.type || 'application/octet-stream'
+        })
+      )
+    );
+    return ciphertext;
+  }
+
+  async decryptFile(ciphertext) {
+    const encryptKey = await this.encryptKeyPromise;
+    const plaintext = await window.crypto.subtle.decrypt(
+      {
+        name: 'AES-GCM',
+        iv: this.iv,
+        tagLength: 128
+      },
+      encryptKey,
+      ciphertext
+    );
+    return plaintext;
+  }
+
+  async decryptMetadata(ciphertext) {
+    const metaKey = await this.metaKeyPromise;
+    const plaintext = await window.crypto.subtle.decrypt(
+      {
+        name: 'AES-GCM',
+        iv: new Uint8Array(12),
+        tagLength: 128
+      },
+      metaKey,
+      ciphertext
+    );
+    return JSON.parse(decoder.decode(plaintext));
+  }
+}
--- a/app/main.css
+++ b/app/main.css
@@ -0,0 +1,16 @@
+@import './base.css';
+@import './templates/header/header.css';
+@import './templates/downloadButton/downloadButton.css';
+@import './templates/progress/progress.css';
+@import './templates/passwordInput/passwordInput.css';
+@import './templates/downloadPassword/downloadPassword.css';
+@import './templates/setPasswordSection/setPasswordSection.css';
+@import './templates/footer/footer.css';
+@import './templates/fxPromo/fxPromo.css';
+@import './templates/selectbox/selectbox.css';
+@import './templates/fileList/fileList.css';
+@import './templates/file/file.css';
+@import './templates/popup/popup.css';
+@import './pages/welcome/welcome.css';
+@import './pages/share/share.css';
+@import './pages/unsupported/unsupported.css';
--- a/app/main.js
+++ b/app/main.js
@@ -1,9 +1,11 @@
+import 'fast-text-encoding'; // MS Edge support
+import 'fluent-intl-polyfill';
 import app from './routes';
 import locale from '../common/locales';
 import fileManager from './fileManager';
 import dragManager from './dragManager';
+import pasteManager from './pasteManager';
 import { canHasSend } from './utils';
-import assets from '../common/assets';
 import storage from './storage';
 import metrics from './metrics';
 import experiments from './experiments';
@@ -14,24 +16,31 @@ if (navigator.doNotTrack !== '1' && window.RAVEN_CONFIG) {
 }

 app.use((state, emitter) => {
-  // init state
  state.transfer = null;
  state.fileInfo = null;
  state.translate = locale.getTranslator();
  state.storage = storage;
  state.raven = Raven;
-  emitter.on('DOMContentLoaded', async () => {
+  window.appState = state;
+  emitter.on('DOMContentLoaded', async function checkSupport() {
+    let unsupportedReason = null;
    if (
+      // Firefox < 50
      /firefox/i.test(navigator.userAgent) &&
-      parseInt(navigator.userAgent.match(/firefox\/*([^\n\r]*)\./i)[1], 10) <=
-        49
+      parseInt(navigator.userAgent.match(/firefox\/*([^\n\r]*)\./i)[1], 10) < 50
    ) {
-      return emitter.emit('replaceState', '/unsupported/outdated');
+      unsupportedReason = 'outdated';
    }
-    const ok = await canHasSend(assets.get('cryptofill.js'));
+    const ok = await canHasSend();
    if (!ok) {
-      const reason = /firefox/i.test(navigator.userAgent) ? 'outdated' : 'gcm';
-      emitter.emit('replaceState', `/unsupported/${reason}`);
+      unsupportedReason = /firefox/i.test(navigator.userAgent)
+        ? 'outdated'
+        : 'gcm';
+    }
+    if (unsupportedReason) {
+      setTimeout(() =>
+        emitter.emit('replaceState', `/unsupported/${unsupportedReason}`)
+      );
    }
  });
 });
@@ -40,5 +49,6 @@ app.use(metrics);
 app.use(fileManager);
 app.use(dragManager);
 app.use(experiments);
+app.use(pasteManager);

-app.mount('#page-one');
+app.mount('body');
--- a/app/metrics.js
+++ b/app/metrics.js
@@ -29,6 +29,8 @@ export default function initialize(state, emitter) {
    });
    //TODO restart handlers... somewhere
  });
+  emitter.on('exit', exitEvent);
+  emitter.on('experiment', experimentEvent);
 }

 function category() {
@@ -81,6 +83,8 @@ function urlToMetric(url) {
    case 'https://testpilot.firefox.com/':
    case 'https://testpilot.firefox.com/experiments/send':
      return 'testpilot';
+    case 'https://www.mozilla.org/firefox/new/?utm_campaign=send-acquisition&utm_medium=referral&utm_source=send.firefox.com':
+      return 'promo';
    default:
      return 'other';
  }
@@ -147,6 +151,15 @@ function completedUpload(params) {
  });
 }

+function addedPassword(params) {
+  return sendEvent('sender', 'password-added', {
+    cm1: params.size,
+    cm5: storage.totalUploads,
+    cm6: storage.files.length,
+    cm7: storage.totalDownloads
+  });
+}
+
 function startedDownload(params) {
  return sendEvent('recipient', 'download-started', {
    cm1: params.size,
@@ -191,6 +204,16 @@ function stoppedUpload(params) {
  });
 }

+function changedDownloadLimit(params) {
+  return sendEvent('sender', 'download-limit-changed', {
+    cm1: params.size,
+    cm5: storage.totalUploads,
+    cm6: storage.files.length,
+    cm7: storage.totalDownloads,
+    cm8: params.dlimit
+  });
+}
+
 function completedDownload(params) {
  return sendEvent('recipient', 'download-stopped', {
    cm1: params.size,
@@ -235,6 +258,11 @@ function exitEvent(target) {
  });
 }

+function experimentEvent(params) {
+  return sendEvent(category(), 'experiment', params);
+}
+
+// eslint-disable-next-line no-unused-vars
 function addExitHandlers() {
  const links = Array.from(document.querySelectorAll('a'));
  links.forEach(l => {
@@ -257,11 +285,13 @@ export {
  cancelledUpload,
  stoppedUpload,
  completedUpload,
+  changedDownloadLimit,
  deletedUpload,
  startedDownload,
  cancelledDownload,
  stoppedDownload,
  completedDownload,
+  addedPassword,
  restart,
  unsupported
 };
--- a/app/ownedFile.js
+++ b/app/ownedFile.js
@@ -0,0 +1,84 @@
+import Keychain from './keychain';
+import { arrayToB64 } from './utils';
+import { del, fileInfo, setParams, setPassword } from './api';
+
+export default class OwnedFile {
+  constructor(obj) {
+    this.id = obj.id;
+    this.url = obj.url;
+    this.name = obj.name;
+    this.size = obj.size;
+    this.type = obj.type;
+    this.time = obj.time;
+    this.speed = obj.speed;
+    this.createdAt = obj.createdAt;
+    this.expiresAt = obj.expiresAt;
+    this.ownerToken = obj.ownerToken;
+    this.dlimit = obj.dlimit || 1;
+    this.dtotal = obj.dtotal || 0;
+    this.keychain = new Keychain(obj.secretKey, obj.nonce);
+    this._hasPassword = !!obj.hasPassword;
+  }
+
+  async setPassword(password) {
+    try {
+      this.password = password;
+      this._hasPassword = true;
+      this.keychain.setPassword(password, this.url);
+      const result = await setPassword(this.id, this.ownerToken, this.keychain);
+      return result;
+    } catch (e) {
+      this.password = null;
+      this._hasPassword = false;
+      throw e;
+    }
+  }
+
+  del() {
+    return del(this.id, this.ownerToken);
+  }
+
+  changeLimit(dlimit) {
+    if (this.dlimit !== dlimit) {
+      this.dlimit = dlimit;
+      return setParams(this.id, this.ownerToken, { dlimit });
+    }
+    return Promise.resolve(true);
+  }
+
+  get hasPassword() {
+    return !!this._hasPassword;
+  }
+
+  async updateDownloadCount() {
+    try {
+      const result = await fileInfo(this.id, this.ownerToken);
+      this.dtotal = result.dtotal;
+      this.dlimit = result.dlimit;
+    } catch (e) {
+      if (e.message === '404') {
+        this.dtotal = this.dlimit;
+      }
+      // ignore other errors
+    }
+  }
+
+  toJSON() {
+    return {
+      id: this.id,
+      url: this.url,
+      name: this.name,
+      size: this.size,
+      type: this.type,
+      time: this.time,
+      speed: this.speed,
+      createdAt: this.createdAt,
+      expiresAt: this.expiresAt,
+      secretKey: arrayToB64(this.keychain.rawSecret),
+      ownerToken: this.ownerToken,
+      dlimit: this.dlimit,
+      dtotal: this.dtotal,
+      hasPassword: this.hasPassword
+    };
+  }
+}
--- a/app/pages/blank.js
+++ b/app/pages/blank.js
@@ -0,0 +1,5 @@
+const html = require('choo/html');
+
+module.exports = function() {
+  return html`<div></div>`;
+};
--- a/app/pages/completed/index.js
+++ b/app/pages/completed/index.js
@@ -0,0 +1,26 @@
+const html = require('choo/html');
+const progress = require('../../templates/progress');
+const { fadeOut } = require('../../utils');
+
+module.exports = function(state, emit) {
+  return html`
+    <div class="page effect--fadeIn">
+      <div class="title">
+        ${state.translate('downloadFinish')}
+      </div>
+      <div class="description"></div>
+      ${progress(1)}
+      <div class="progressSection">
+        <div class="progressSection__text"></div>
+      </div>
+      <a class="link link--action"
+        href="/"
+        onclick=${sendNew}>${state.translate('sendYourFilesLink')}</a>
+    </div>`;
+
+  async function sendNew(e) {
+    e.preventDefault();
+    await fadeOut('.page');
+    emit('pushState', '/');
+  }
+};
--- a/app/pages/download/index.js
+++ b/app/pages/download/index.js
@@ -0,0 +1,42 @@
+const html = require('choo/html');
+const progress = require('../../templates/progress');
+const { bytes } = require('../../utils');
+
+module.exports = function(state, emit) {
+  const transfer = state.transfer;
+  const cancelBtn = html`
+  <button
+    id="cancel"
+    class="btn btn--cancel"
+    title="${state.translate('deletePopupCancel')}"
+    onclick=${cancel}>
+    ${state.translate('deletePopupCancel')}
+  </button>`;
+
+  return html`
+    <div class="page effect--fadeIn">
+      <div class="title">
+        ${state.translate('downloadingPageProgress', {
+          filename: state.fileInfo.name,
+          size: bytes(state.fileInfo.size)
+        })}
+      </div>
+      <div class="description">
+        ${state.translate('downloadingPageMessage')}
+      </div>
+      ${progress(transfer.progressRatio, transfer.progressIndefinite)}
+      <div class="progressSection">
+        <div class="progressSection__text">
+          ${state.translate(transfer.msg, transfer.sizes)}
+        </div>
+        ${transfer.state === 'downloading' ? cancelBtn : null}
+      </div>
+    </div>
+  `;
+
+  function cancel() {
+    const btn = document.getElementById('cancel');
+    btn.remove();
+    emit('cancel');
+  }
+};
--- a/app/pages/error/index.js
+++ b/app/pages/error/index.js
@@ -1,10 +1,10 @@
 const html = require('choo/html');
-const assets = require('../../common/assets');
+const assets = require('../../../common/assets');

 module.exports = function(state) {
  return html`
-  <div id="upload-error">
+  <div class="page">
    <div class="title">${state.translate('errorPageHeader')}</div>
-    <img id="upload-error-img" src="${assets.get('illustration_error.svg')}"/>
+    <img src="${assets.get('illustration_error.svg')}"/>
  </div>`;
 };
--- a/app/pages/legal.js
+++ b/app/pages/legal.js
@@ -0,0 +1,32 @@
+const html = require('choo/html');
+const raw = require('choo/html/raw');
+
+module.exports = function(state) {
+  return html`
+    <div>
+      <div class="title">${state.translate('legalHeader')}</div>
+        ${raw(
+          replaceLinks(state.translate('legalNoticeTestPilot'), [
+            'https://testpilot.firefox.com/terms',
+            'https://testpilot.firefox.com/privacy',
+            'https://testpilot.firefox.com/experiments/send'
+          ])
+        )}
+        ${raw(
+          replaceLinks(state.translate('legalNoticeMozilla'), [
+            'https://www.mozilla.org/privacy/websites/',
+            'https://www.mozilla.org/about/legal/terms/mozilla/'
+          ])
+        )}
+    </div>
+  `;
+};
+
+function replaceLinks(str, urls) {
+  let i = 0;
+  const s = str.replace(
+    /<a>([^<]+)<\/a>/g,
+    (m, v) => `<a href="${urls[i++]}">${v}</a>`
+  );
+  return `<div class="description">${s}</div>`;
+}
--- a/app/pages/notFound/index.js
+++ b/app/pages/notFound/index.js
@@ -0,0 +1,16 @@
+const html = require('choo/html');
+const assets = require('../../../common/assets');
+
+module.exports = function(state) {
+  return html`
+    <div class="page">
+      <div class="title">${state.translate('expiredPageHeader')}</div>
+      <img src="${assets.get('illustration_expired.svg')}" id="expired-img">
+      <div class="description">
+        ${state.translate('uploadPageExplainer')}
+      </div>
+      <a class="link link--action" href="/">
+        ${state.translate('sendYourFilesLink')}
+      </a>
+    </div>`;
+};
--- a/app/pages/preview/index.js
+++ b/app/pages/preview/index.js
@@ -0,0 +1,40 @@
+const html = require('choo/html');
+const assets = require('../../../common/assets');
+const { bytes } = require('../../utils');
+
+module.exports = function(state, pageAction) {
+  const fileInfo = state.fileInfo;
+
+  const size = fileInfo.size
+    ? state.translate('downloadFileSize', { size: bytes(fileInfo.size) })
+    : '';
+
+  const title = fileInfo.name
+    ? state.translate('downloadFileName', { filename: fileInfo.name })
+    : state.translate('downloadFileTitle');
+
+  const info = html`
+    <div id="dl-file"
+      data-nonce="${fileInfo.nonce}"
+      data-requires-password="${fileInfo.requiresPassword}"></div>`;
+  if (!pageAction) {
+    return info;
+  }
+  return html`
+    <div class="page">
+      <div class="title">
+        <span>${title}</span>
+        <span>${' ' + size}</span>
+      </div>
+      <div class="description">${state.translate('downloadMessage')}</div>
+      <img
+        src="${assets.get('illustration_download.svg')}"
+        title="${state.translate('downloadAltText')}"/>
+      ${pageAction}
+      <a class="link link--action" href="/">
+        ${state.translate('sendYourFilesLink')}
+      </a>
+      ${info}
+    </div>
+  `;
+};
--- a/app/pages/share/index.js
+++ b/app/pages/share/index.js
@@ -0,0 +1,112 @@
+/* global EXPIRE_SECONDS */
+const html = require('choo/html');
+const raw = require('choo/html/raw');
+const assets = require('../../../common/assets');
+const notFound = require('../notFound');
+const setPasswordSection = require('../../templates/setPasswordSection');
+const selectbox = require('../../templates/selectbox');
+const deletePopup = require('../../templates/popup');
+const { allowedCopy, delay, fadeOut } = require('../../utils');
+
+module.exports = function(state, emit) {
+  const file = state.storage.getFileById(state.params.id);
+  if (!file) {
+    return notFound(state, emit);
+  }
+
+  return html`
+  <div id="shareWrapper" class="effect--fadeIn">
+    ${expireInfo(file, state.translate, emit)}
+    <div class="sharePage">
+      <div class="sharePage__copyText">
+        ${state.translate('copyUrlFormLabelWithName', { filename: file.name })}
+      </div>
+      <div class="copySection">
+        <input
+          id="fileUrl"
+          class="copySection__url"
+          type="url"
+          value="${file.url}"
+          readonly="true"/>
+        <button id="copyBtn"
+          class="inputBtn inputBtn--copy"
+          title="${state.translate('copyUrlFormButton')}"
+          onclick=${copyLink}>${state.translate('copyUrlFormButton')}</button>
+      </div>
+      ${setPasswordSection(state, emit)}
+      <button
+        class="btn btn--delete"
+        title="${state.translate('deleteFileButton')}"
+        onclick=${showPopup}>${state.translate('deleteFileButton')}
+      </button>
+      <div class="sharePage__deletePopup">
+        ${deletePopup(
+          state.translate('deletePopupText'),
+          state.translate('deletePopupYes'),
+          state.translate('deletePopupCancel'),
+          deleteFile
+        )}
+      </div>
+      <a class="link link--action"
+        href="/"
+        onclick=${sendNew}>${state.translate('sendAnotherFileLink')}</a>
+    </div>
+  </div>
+  `;
+
+  function showPopup() {
+    const popup = document.querySelector('.popup');
+    popup.classList.add('popup--show');
+    popup.focus();
+  }
+
+  async function sendNew(e) {
+    e.preventDefault();
+    await fadeOut('#shareWrapper');
+    emit('pushState', '/');
+  }
+
+  async function copyLink() {
+    if (allowedCopy()) {
+      emit('copy', { url: file.url, location: 'success-screen' });
+      const input = document.getElementById('fileUrl');
+      input.disabled = true;
+      input.classList.add('input--copied');
+      const copyBtn = document.getElementById('copyBtn');
+      copyBtn.disabled = true;
+      copyBtn.classList.add('inputBtn--copied');
+      copyBtn.replaceChild(
+        html`<img src="${assets.get('check-16.svg')}" class="cursor--pointer">`,
+        copyBtn.firstChild
+      );
+      await delay(2000);
+      input.disabled = false;
+      input.classList.remove('input--copied');
+      copyBtn.disabled = false;
+      copyBtn.classList.remove('inputBtn--copied');
+      copyBtn.textContent = state.translate('copyUrlFormButton');
+    }
+  }
+
+  async function deleteFile() {
+    emit('delete', { file, location: 'success-screen' });
+    await fadeOut('#shareWrapper');
+    emit('pushState', '/');
+  }
+};
+
+function expireInfo(file, translate, emit) {
+  const hours = Math.floor(EXPIRE_SECONDS / 60 / 60);
+  const el = html`<div class="title">${raw(
+    translate('expireInfo', {
+      downloadCount: '<select></select>',
+      timespan: translate('timespanHours', { num: hours })
+    })
+  )}</div>`;
+  const select = el.querySelector('select');
+  const options = [1, 2, 3, 4, 5, 20].filter(i => i > (file.dtotal || 0));
+  const t = num => translate('downloadCount', { num });
+  const changed = value => emit('changeLimit', { file, value });
+  el.replaceChild(selectbox(file.dlimit || 1, options, t, changed), select);
+  return el;
+}
--- a/app/pages/share/share.css
+++ b/app/pages/share/share.css
@@ -0,0 +1,112 @@
+.sharePage {
+  margin: 0 auto;
+  display: flex;
+  justify-content: center;
+  flex-direction: column;
+  width: 100%;
+  max-width: 640px;
+}
+
+.sharePage__copyText {
+  align-self: flex-start;
+  margin-top: 60px;
+  margin-bottom: 10px;
+  color: var(--textColor);
+  max-width: 614px;
+  word-wrap: break-word;
+}
+
+.sharePage__deletePopup {
+  position: relative;
+  align-self: center;
+  bottom: 50px;
+}
+
+.copySection {
+  display: flex;
+  flex-wrap: nowrap;
+  width: 100%;
+}
+
+.copySection__url {
+  flex: 1;
+  height: 56px;
+  border: 1px solid var(--primaryControlBGColor);
+  border-radius: 6px 0 0 6px;
+  font-size: 20px;
+  color: var(--inputTextColor);
+  font-family: 'SF Pro Text', sans-serif;
+  letter-spacing: 0;
+  line-height: 23px;
+  font-weight: 300;
+  padding-left: 10px;
+}
+
+.copySection__url:disabled {
+  border: 1px solid var(--successControlBGColor);
+  background: var(--successControlFGColor);
+}
+
+.inputBtn--copy {
+  flex: 0 1 165px;
+  padding-bottom: 4px;
+}
+
+.input--copied {
+  border-color: var(--successControlBGColor);
+}
+
+.inputBtn--copied,
+.inputBtn--copied:hover {
+  background: var(--successControlBGColor);
+  border: 1px solid var(--successControlBGColor);
+  color: var(--successControlFGColor);
+}
+
+.btn--delete {
+  align-self: center;
+  width: 176px;
+  height: 44px;
+  background: #fff;
+  border-color: rgba(12, 12, 13, 0.3);
+  margin-top: 50px;
+  margin-bottom: 12px;
+  color: #313131;
+}
+
+.btn--delete:hover {
+  background: #efeff1;
+}
+
+@media (max-device-width: 768px), (max-width: 768px) {
+  .copySection {
+    width: 100%;
+  }
+
+  .copySection__url {
+    font-size: 18px;
+  }
+}
+
+@media (max-device-width: 520px), (max-width: 520px) {
+  .copySection {
+    width: 100%;
+    flex-direction: column;
+    padding-left: 0;
+  }
+
+  .copySection__url {
+    font-size: 22px;
+    padding: 15px 10px;
+    border-radius: 6px 6px 0 0;
+  }
+
+  .sharePage__copyText {
+    text-align: center;
+  }
+
+  .inputBtn--copy {
+    border-radius: 0 0 6px 6px;
+    flex: 0 1 65px;
+  }
+}
--- a/app/pages/unsupported/index.js
+++ b/app/pages/unsupported/index.js
@@ -0,0 +1,67 @@
+const html = require('choo/html');
+const assets = require('../../../common/assets');
+
+module.exports = function(state) {
+  let strings = {};
+  let why = '';
+  let url = '';
+  let buttonAction = '';
+  if (state.params.reason !== 'outdated') {
+    strings = unsupportedStrings(state);
+    why = html`
+      <div class="description">
+        <a href="https://github.com/mozilla/send/blob/master/docs/faq.md#why-is-my-browser-not-supported">
+          ${state.translate('notSupportedLink')}
+        </a>
+      </div>`;
+    url =
+      'https://www.mozilla.org/firefox/new/?utm_campaign=send-acquisition&utm_medium=referral&utm_source=send.firefox.com';
+    buttonAction = html`
+      <div class="firefoxDownload__action">
+        Firefox<br><span class="firefoxDownload__text">${strings.button}</span>
+      </div>`;
+  } else {
+    strings = outdatedStrings(state);
+    url = 'https://support.mozilla.org/kb/update-firefox-latest-version';
+    buttonAction = html`
+      <div class="firefoxDownload__action">
+        ${strings.button}
+      </div>`;
+  }
+  return html`
+    <div class="unsupportedPage">
+      <div class="title">${strings.title}</div>
+      <div class="description">
+        ${strings.description}
+      </div>
+      ${why}
+      <a href="${url}" class="firefoxDownload">
+        <img
+          src="${assets.get('firefox_logo-only.svg')}"
+          class="firefoxDownload__logo"
+          alt="Firefox"/>
+        ${buttonAction}
+      </a>
+      <div class="unsupportedPage__info">
+        ${strings.explainer}
+      </div>
+    </div>`;
+};
+
+function outdatedStrings(state) {
+  return {
+    title: state.translate('notSupportedHeader'),
+    description: state.translate('notSupportedOutdatedDetail'),
+    button: state.translate('updateFirefox'),
+    explainer: state.translate('uploadPageExplainer')
+  };
+}
+
+function unsupportedStrings(state) {
+  return {
+    title: state.translate('notSupportedHeader'),
+    description: state.translate('notSupportedDetail'),
+    button: state.translate('downloadFirefoxButtonSub'),
+    explainer: state.translate('uploadPageExplainer')
+  };
+}
--- a/app/pages/unsupported/unsupported.css
+++ b/app/pages/unsupported/unsupported.css
@@ -0,0 +1,49 @@
+.unsupportedPage {
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  flex-direction: column;
+}
+
+.unsupportedPage__info {
+  font-size: 13px;
+  line-height: 23px;
+  text-align: center;
+  color: var(--lightTextColor);
+  margin: 0 auto 23px;
+}
+
+.firefoxDownload {
+  margin-bottom: 181px;
+  height: 80px;
+  background: #98e02b;
+  border-radius: 3px;
+  cursor: pointer;
+  border: 0;
+  box-shadow: 0 5px 3px rgb(234, 234, 234);
+  font-family: 'Fira Sans', 'segoe ui', sans-serif;
+  font-weight: 500;
+  color: var(--primaryControlFGColor);
+  font-size: 26px;
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  line-height: 1;
+  padding: 0 25px;
+}
+
+.firefoxDownload__logo {
+  width: 70px;
+}
+
+.firefoxDownload__action {
+  text-align: left;
+  margin-left: 20.4px;
+}
+
+.firefoxDownload__text {
+  font-family: 'Fira Sans', 'segoe ui', sans-serif;
+  font-weight: 300;
+  font-size: 18px;
+  letter-spacing: -0.69px;
+}
--- a/app/pages/upload/index.js
+++ b/app/pages/upload/index.js
@@ -0,0 +1,39 @@
+const html = require('choo/html');
+const progress = require('../../templates/progress');
+const { bytes } = require('../../utils');
+
+module.exports = function(state, emit) {
+  const transfer = state.transfer;
+
+  return html`
+  <div class="page effect--fadeIn">
+    <div class="title">
+      ${state.translate('uploadingPageProgress', {
+        filename: transfer.file.name,
+        size: bytes(transfer.file.size)
+      })}
+    </div>
+    <div class="description"></div>
+    ${progress(transfer.progressRatio, transfer.progressIndefinite)}
+    <div class="progressSection">
+      <div class="progressSection__text">
+        ${state.translate(transfer.msg, transfer.sizes)}
+      </div>
+      <button
+        id="cancel-upload"
+        class="btn btn--cancel"
+        title="${state.translate('uploadingPageCancel')}"
+        onclick=${cancel}>
+        ${state.translate('uploadingPageCancel')}
+      </button>
+    </div>
+  </div>
+  `;
+
+  function cancel() {
+    const btn = document.getElementById('cancel-upload');
+    btn.disabled = true;
+    btn.textContent = state.translate('uploadCancelNotification');
+    emit('cancel');
+  }
+};
--- a/app/pages/welcome/index.js
+++ b/app/pages/welcome/index.js
@@ -0,0 +1,84 @@
+/* global MAXFILESIZE */
+const html = require('choo/html');
+const assets = require('../../../common/assets');
+const fileList = require('../../templates/fileList');
+const { bytes, fadeOut } = require('../../utils');
+
+module.exports = function(state, emit) {
+  // the page flickers if both the server and browser set 'effect--fadeIn'
+  const fade = state.layout ? '' : 'effect--fadeIn';
+  return html`
+  <div id="page-one" class="${fade}">
+    <div class="title">${state.translate('uploadPageHeader')}</div>
+    <div class="description">
+      <div>${state.translate('uploadPageExplainer')}</div>
+      <a
+        href="https://testpilot.firefox.com/experiments/send"
+        class="link">
+        ${state.translate('uploadPageLearnMore')}
+      </a>
+    </div>
+    <div class="uploadArea"
+      ondragover=${dragover}
+      ondragleave=${dragleave}>
+      <img
+        src="${assets.get('upload.svg')}"
+        title="${state.translate('uploadSvgAlt')}"/>
+      <div class="uploadArea__msg">
+        ${state.translate('uploadPageDropMessage')}
+      </div>
+      <span class="uploadArea__sizeMsg">
+        ${state.translate('uploadPageSizeMessage')}
+      </span>
+      <input id="file-upload"
+        class="inputFile"
+        type="file"
+        name="fileUploaded"
+        onfocus=${onfocus}
+        onblur=${onblur}
+        onchange=${upload} />
+      <label for="file-upload"
+        class="btn btn--file"
+        title="${state.translate('uploadPageBrowseButton1')}">
+        ${state.translate('uploadPageBrowseButton1')}
+      </label>
+    </div>
+    ${fileList(state, emit)}
+  </div>
+  `;
+
+  function dragover(event) {
+    const div = document.querySelector('.uploadArea');
+    div.classList.add('uploadArea--dragging');
+  }
+
+  function dragleave(event) {
+    const div = document.querySelector('.uploadArea');
+    div.classList.remove('uploadArea--dragging');
+  }
+
+  function onfocus(event) {
+    event.target.classList.add('inputFile--focused');
+  }
+
+  function onblur(event) {
+    event.target.classList.remove('inputFile--focused');
+  }
+
+  async function upload(event) {
+    event.preventDefault();
+    const target = event.target;
+    const file = target.files[0];
+    if (file.size === 0) {
+      return;
+    }
+    if (file.size > MAXFILESIZE) {
+      // eslint-disable-next-line no-alert
+      alert(state.translate('fileTooBig', { size: bytes(MAXFILESIZE) }));
+      return;
+    }
+
+    await fadeOut('#page-one');
+    emit('upload', { file, type: 'click' });
+  }
+};
--- a/app/pages/welcome/welcome.css
+++ b/app/pages/welcome/welcome.css
@@ -0,0 +1,65 @@
+.uploadArea {
+  border: 3px dashed rgba(0, 148, 251, 0.5);
+  margin: 0 auto 10px;
+  height: 255px;
+  border-radius: 4px;
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  flex-direction: column;
+  text-align: center;
+  transition: transform 150ms;
+  padding: 15px;
+}
+
+.uploadArea__msg {
+  font-size: 22px;
+  color: var(--lightTextColor);
+  margin: 20px 0 10px;
+  font-family: 'SF Pro Text', sans-serif;
+}
+
+.uploadArea__sizeMsg {
+  font-style: italic;
+  font-size: 12px;
+  line-height: 16px;
+  color: var(--lightTextColor);
+  margin-bottom: 22px;
+}
+
+.uploadArea--dragging {
+  border: 5px dashed rgba(0, 148, 251, 0.5);
+  height: 251px;
+  transform: scale(1.04);
+  border-radius: 4.2px;
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  flex-direction: column;
+  text-align: center;
+}
+
+.uploadArea--dragging * {
+  pointer-events: none;
+}
+
+.btn--file {
+  font-size: 20px;
+  min-width: 240px;
+  height: 60px;
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  padding: 0 10px;
+}
+
+.inputFile {
+  opacity: 0;
+  position: absolute;
+}
+
+.inputFile--focused + .btn--file {
+  background-color: var(--primaryControlHoverColor);
+  outline: 1px dotted #000;
+  outline: -webkit-focus-ring-color auto 5px;
+}
--- a/app/pasteManager.js
+++ b/app/pasteManager.js
@@ -0,0 +1,25 @@
+/* global MAXFILESIZE */
+import { bytes } from './utils';
+
+export default function(state, emitter) {
+  window.addEventListener('paste', event => {
+    if (state.route !== '/' || state.uploading) return;
+
+    for (const item of event.clipboardData.items) {
+      if (!item.type.includes('image')) continue;
+
+      const file = item.getAsFile();
+
+      if (!file) continue; // Sometimes null
+
+      if (file.size > MAXFILESIZE) {
+        // eslint-disable-next-line no-alert
+        alert(state.translate('fileTooBig', { size: bytes(MAXFILESIZE) }));
+        continue;
+      }
+
+      emitter.emit('upload', { file, type: 'paste' });
+      return; // return here since only one file is allowed to be uploaded at a time
+    }
+  });
+}
--- a/app/readme.md
+++ b/app/readme.md
@@ -0,0 +1,9 @@
+# Application Code
+
+`app/` contains the browser code that gets bundled into `app.[hash].js`. It's got all the logic, crypto, and UI. All of it gets used in the browser, and some of it by the server for server side rendering.
+
+The main entrypoint for the browser is [main.js](./main.js) and on the server [routes/index.js](./routes/index.js) gets imported by [/server/routes/pages.js](../server/routes/pages.js)
+
+- `pages` contains display logic an markup for pages
+- `routes` contains route definitions and logic
+- `templates` contains ui elements smaller than pages
--- a/app/routes/download.js
+++ b/app/routes/download.js
@@ -1,9 +1,60 @@
-const preview = require('../templates/preview');
-const download = require('../templates/download');
+const preview = require('../pages/preview');
+const download = require('../pages/download');
+const notFound = require('../pages/notFound');
+const downloadPassword = require('../templates/downloadPassword');
+const downloadButton = require('../templates/downloadButton');
+
+function hasFileInfo() {
+  return !!document.getElementById('dl-file');
+}
+
+function getFileInfoFromDOM() {
+  const el = document.getElementById('dl-file');
+  if (!el) {
+    return null;
+  }
+  return {
+    nonce: el.getAttribute('data-nonce'),
+    requiresPassword: !!+el.getAttribute('data-requires-password')
+  };
+}
+
+function createFileInfo(state) {
+  const metadata = getFileInfoFromDOM();
+  return {
+    id: state.params.id,
+    secretKey: state.params.key,
+    nonce: metadata.nonce,
+    requiresPassword: metadata.requiresPassword
+  };
+}

 module.exports = function(state, emit) {
-  if (state.transfer) {
-    return download(state, emit);
+  if (!state.fileInfo) {
+    // This is a fresh page load
+    // We need to parse the file info from the server's html
+    if (!hasFileInfo()) {
+      return notFound(state, emit);
+    }
+    state.fileInfo = createFileInfo(state);
+
+    if (!state.fileInfo.requiresPassword) {
+      emit('getMetadata');
+    }
  }
-  return preview(state, emit);
+
+  let pageAction = null; //default state: we don't have file metadata
+  if (state.transfer) {
+    const s = state.transfer.state;
+    if (['downloading', 'decrypting', 'complete'].indexOf(s) > -1) {
+      // Downloading is in progress
+      return download(state, emit);
+    }
+    // we have file metadata
+    pageAction = downloadButton(state, emit);
+  } else if (state.fileInfo.requiresPassword && !state.fileInfo.password) {
+    // we're waiting on the user for a valid password
+    pageAction = downloadPassword(state, emit);
+  }
+  return preview(state, pageAction);
 };
--- a/app/routes/home.js
+++ b/app/routes/home.js
@@ -1,8 +1,8 @@
-const welcome = require('../templates/welcome');
-const upload = require('../templates/upload');
+const welcome = require('../pages/welcome');
+const upload = require('../pages/upload');

 module.exports = function(state, emit) {
-  if (state.transfer) {
+  if (state.uploading) {
    return upload(state, emit);
  }
  return welcome(state, emit);
--- a/app/routes/index.js
+++ b/app/routes/index.js
@@ -1,17 +1,58 @@
 const choo = require('choo');
+const html = require('choo/html');
+const nanotiming = require('nanotiming');
 const download = require('./download');
+const header = require('../templates/header');
+const footer = require('../templates/footer');
+const fxPromo = require('../templates/fxPromo');

+nanotiming.disabled = true;
 const app = choo();

-app.route('/', require('./home'));
-app.route('/share/:id', require('../templates/share'));
-app.route('/download/:id', download);
-app.route('/download/:id/:key', download);
-app.route('/completed', require('../templates/completed'));
-app.route('/unsupported/:reason', require('../templates/unsupported'));
-app.route('/legal', require('../templates/legal'));
-app.route('/error', require('../templates/error'));
-app.route('/blank', require('../templates/blank'));
-app.route('*', require('../templates/notFound'));
+function banner(state, emit) {
+  if (state.promo && !state.route.startsWith('/unsupported/')) {
+    return fxPromo(state, emit);
+  }
+}
+
+function body(template) {
+  return function(state, emit) {
+    const b = html`<body>
+      ${banner(state, emit)}
+      ${header(state)}
+      <main class="main">
+        <noscript>
+          <div class="noscript">
+            <h2>${state.translate('javascriptRequired')}</h2>
+            <p>
+              <a class="link" href="https://github.com/mozilla/send/blob/master/docs/faq.md#why-does-firefox-send-require-javascript">
+              ${state.translate('whyJavascript')}
+              </a>
+            </p>
+            <p>${state.translate('enableJavascript')}</p>
+          </div>
+        </noscript>
+        ${template(state, emit)}
+      </main>
+      ${footer(state)}
+    </body>`;
+    if (state.layout) {
+      // server side only
+      return state.layout(state, b);
+    }
+    return b;
+  };
+}
+
+app.route('/', body(require('./home')));
+app.route('/share/:id', body(require('../pages/share')));
+app.route('/download/:id', body(download));
+app.route('/download/:id/:key', body(download));
+app.route('/completed', body(require('../pages/completed')));
+app.route('/unsupported/:reason', body(require('../pages/unsupported')));
+app.route('/legal', body(require('../pages/legal')));
+app.route('/error', body(require('../pages/error')));
+app.route('/blank', body(require('../pages/blank')));
+app.route('*', body(require('../pages/notFound')));

 module.exports = app;
--- a/app/storage.js
+++ b/app/storage.js
@@ -1,4 +1,5 @@
 import { isFile } from './utils';
+import OwnedFile from './ownedFile';

 class Mem {
  constructor() {
@@ -42,7 +43,7 @@ class Storage {
      const k = this.engine.key(i);
      if (isFile(k)) {
        try {
-          const f = JSON.parse(this.engine.getItem(k));
+          const f = new OwnedFile(JSON.parse(this.engine.getItem(k)));
          if (!f.id) {
            f.id = f.fileId;
          }
@@ -92,11 +93,7 @@ class Storage {
  }

  getFileById(id) {
-    try {
-      return JSON.parse(this.engine.getItem(id));
-    } catch (e) {
-      return null;
-    }
+    return this._files.find(f => f.id === id);
  }

  get(id) {
@@ -112,8 +109,16 @@ class Storage {

  addFile(file) {
    this._files.push(file);
+    this.writeFile(file);
+  }
+
+  writeFile(file) {
    this.engine.setItem(file.id, JSON.stringify(file));
  }
+
+  writeFiles() {
+    this._files.forEach(f => this.writeFile(f));
+  }
 }

 export default new Storage();
--- a/app/templates/blank.js
+++ b/app/templates/blank.js
@@ -1,9 +0,0 @@
-const html = require('choo/html');
-
-module.exports = function(state) {
-  const div = html`<div id="page-one"></div>`;
-  if (state.layout) {
-    return state.layout(state, div);
-  }
-  return div;
-};
--- a/app/templates/completed.js
+++ b/app/templates/completed.js
@@ -1,31 +0,0 @@
-const html = require('choo/html');
-const progress = require('./progress');
-const { fadeOut } = require('../utils');
-
-module.exports = function(state, emit) {
-  const div = html`
-  <div id="download" class="fadeIn">
-    <div id="download-progress">
-      <div id="dl-title" class="title">${state.translate(
-        'downloadFinish'
-      )}</div>
-      <div class="description"></div>
-      ${progress(1)}
-      <div class="upload">
-        <div class="progress-text"></div>
-      </div>
-    </div>
-    <a class="send-new" data-state="completed" href="/" onclick=${sendNew}>${state.translate(
-    'sendYourFilesLink'
-  )}</a>
-  </div>
-  `;
-
-  async function sendNew(e) {
-    e.preventDefault();
-    await fadeOut('download');
-    emit('pushState', '/');
-  }
-
-  return div;
-};
--- a/app/templates/download.js
+++ b/app/templates/download.js
@@ -1,28 +0,0 @@
-const html = require('choo/html');
-const progress = require('./progress');
-const { bytes } = require('../utils');
-
-module.exports = function(state) {
-  const transfer = state.transfer;
-  const div = html`
-  <div id="download-progress" class="fadeIn">
-    <div id="dl-title" class="title">${state.translate(
-      'downloadingPageProgress',
-      {
-        filename: state.fileInfo.name,
-        size: bytes(state.fileInfo.size)
-      }
-    )}</div>
-    <div class="description">${state.translate('downloadingPageMessage')}</div>
-    ${progress(transfer.progressRatio)}
-    <div class="upload">
-      <div class="progress-text">${state.translate(
-        transfer.msg,
-        transfer.sizes
-      )}</div>
-    </div>
-  </div>
-  `;
-
-  return div;
-};
--- a/app/templates/downloadButton/downloadButton.css
+++ b/app/templates/downloadButton/downloadButton.css
@@ -0,0 +1,6 @@
+.btn--download {
+  width: 180px;
+  height: 44px;
+  margin-top: 20px;
+  margin-bottom: 30px;
+}
--- a/app/templates/downloadButton/index.js
+++ b/app/templates/downloadButton/index.js
@@ -0,0 +1,13 @@
+const html = require('choo/html');
+
+module.exports = function(state, emit) {
+  return html`
+    <button class="btn btn--download"
+      onclick=${download}>${state.translate('downloadButtonLabel')}
+    </button>`;
+
+  function download(event) {
+    event.preventDefault();
+    emit('download', state.fileInfo);
+  }
+};
--- a/app/templates/downloadPassword/downloadPassword.css
+++ b/app/templates/downloadPassword/downloadPassword.css
@@ -0,0 +1,22 @@
+.passwordSection {
+  text-align: left;
+  padding: 40px 0;
+  width: 80%;
+}
+
+.passwordForm {
+  display: flex;
+  flex-wrap: nowrap;
+  width: 100%;
+  padding: 10px 0;
+}
+
+@media (max-device-width: 520px), (max-width: 520px) {
+  .passwordSection {
+    width: 100%;
+  }
+
+  .passwordForm {
+    flex-direction: column;
+  }
+}
--- a/app/templates/downloadPassword/index.js
+++ b/app/templates/downloadPassword/index.js
@@ -0,0 +1,66 @@
+const html = require('choo/html');
+
+module.exports = function(state, emit) {
+  const fileInfo = state.fileInfo;
+  const invalid = fileInfo.password === null;
+  const label = invalid
+    ? html`
+          <label class="error" for="password-input">
+            ${state.translate('passwordTryAgain')}
+          </label>`
+    : html`
+          <label for="password-input">
+            ${state.translate('unlockInputLabel')}
+          </label>`;
+  const inputClass = invalid
+    ? 'input input--noBtn input--error'
+    : 'input input--noBtn';
+  const div = html`
+    <div class="passwordSection">
+      ${label}
+      <form class="passwordForm" onsubmit=${checkPassword} data-no-csrf>
+        <input id="password-input"
+          class="${inputClass}"
+          maxlength="64"
+          autocomplete="off"
+          placeholder="${state.translate('unlockInputPlaceholder')}"
+          oninput=${inputChanged}
+          type="password" />
+        <input type="submit"
+          id="password-btn"
+          class="inputBtn inputBtn--hidden"
+          value="${state.translate('unlockButtonLabel')}"/>
+      </form>
+    </div>`;
+
+  if (!(div instanceof String)) {
+    setTimeout(() => document.getElementById('password-input').focus());
+  }
+
+  function inputChanged() {
+    const input = document.getElementById('password-input');
+    const btn = document.getElementById('password-btn');
+    input.classList.remove('input--error');
+    if (input.value.length > 0) {
+      btn.classList.remove('inputBtn--hidden');
+      input.classList.remove('input--noBtn');
+    } else {
+      btn.classList.add('inputBtn--hidden');
+      input.classList.add('input--noBtn');
+    }
+  }
+
+  function checkPassword(event) {
+    event.preventDefault();
+    const password = document.getElementById('password-input').value;
+    if (password.length > 0) {
+      document.getElementById('password-btn').disabled = true;
+      state.fileInfo.url = window.location.href;
+      state.fileInfo.password = password;
+      emit('getMetadata');
+    }
+    return false;
+  }
+
+  return div;
+};
--- a/app/templates/file.js
+++ b/app/templates/file.js
@@ -1,84 +0,0 @@
-const html = require('choo/html');
-const assets = require('../../common/assets');
-
-function timeLeft(milliseconds) {
-  const minutes = Math.floor(milliseconds / 1000 / 60);
-  const hours = Math.floor(minutes / 60);
-  const seconds = Math.floor((milliseconds / 1000) % 60);
-  if (hours >= 1) {
-    return `${hours}h ${minutes % 60}m`;
-  } else if (hours === 0) {
-    return `${minutes}m ${seconds}s`;
-  }
-  return null;
-}
-
-module.exports = function(file, state, emit) {
-  const ttl = file.expiresAt - Date.now();
-  const remaining = timeLeft(ttl) || state.translate('linkExpiredAlt');
-  const row = html`
-  <tr id="${file.id}">
-    <td class="overflow-col" title="${file.name}">${file.name}</td>
-    <td class="center-col">
-      <img onclick=${copyClick} src="${assets.get(
-    'copy-16.svg'
-  )}" class="icon-copy" title="${state.translate('copyUrlHover')}">
-      <span class="text-copied" hidden="true">${state.translate(
-        'copiedUrl'
-      )}</span>
-    </td>
-    <td>${remaining}</td>
-    <td class="center-col">
-      <img onclick=${showPopup} src="${assets.get(
-    'close-16.svg'
-  )}" class="icon-delete" title="${state.translate('deleteButtonHover')}">
-      <div class="popup">
-        <div class="popuptext" onblur=${cancel} tabindex="-1">
-          <div class="popup-message">${state.translate('deletePopupText')}</div>
-          <div class="popup-action">
-            <span class="popup-no" onclick=${cancel}>${state.translate(
-    'deletePopupCancel'
-  )}</span>
-            <span class="popup-yes" onclick=${deleteFile}>${state.translate(
-    'deletePopupYes'
-  )}</span>
-          </div>
-        </div>
-      </div>
-    </td>
-  </tr>
-  `;
-
-  function copyClick(e) {
-    emit('copy', { url: file.url, location: 'upload-list' });
-    const icon = e.target;
-    const text = e.target.nextSibling;
-    icon.hidden = true;
-    text.hidden = false;
-    setTimeout(() => {
-      icon.hidden = false;
-      text.hidden = true;
-    }, 500);
-  }
-
-  function showPopup() {
-    const tr = document.getElementById(file.id);
-    const popup = tr.querySelector('.popuptext');
-    popup.classList.add('show');
-    popup.focus();
-  }
-
-  function cancel(e) {
-    e.stopPropagation();
-    const tr = document.getElementById(file.id);
-    const popup = tr.querySelector('.popuptext');
-    popup.classList.remove('show');
-  }
-
-  function deleteFile() {
-    emit('delete', { file, location: 'upload-list' });
-    emit('render');
-  }
-
-  return row;
-};
--- a/app/templates/file/file.css
+++ b/app/templates/file/file.css
@@ -0,0 +1,26 @@
+.fileData {
+  font-size: 15px;
+  vertical-align: top;
+  color: var(--lightTextColor);
+  padding: 17px 19px 0;
+  line-height: 23px;
+  position: relative;
+}
+
+.fileData--overflow {
+  text-overflow: ellipsis;
+  max-width: 0;
+  overflow: hidden;
+  white-space: nowrap;
+}
+
+.fileData--center {
+  text-align: center;
+}
+
+@media (max-device-width: 520px), (max-width: 520px) {
+  .fileData {
+    font-size: 13px;
+    padding: 17px 5px 0;
+  }
+}
--- a/app/templates/file/index.js
+++ b/app/templates/file/index.js
@@ -0,0 +1,89 @@
+const html = require('choo/html');
+const assets = require('../../../common/assets');
+const number = require('../../utils').number;
+const deletePopup = require('../popup');
+
+module.exports = function(file, state, emit) {
+  const ttl = file.expiresAt - Date.now();
+  const remainingTime =
+    timeLeft(ttl, state) || state.translate('linkExpiredAlt');
+  const downloadLimit = file.dlimit || 1;
+  const totalDownloads = file.dtotal || 0;
+  return html`
+  <tr id="${file.id}">
+    <td class="fileData fileData--overflow" title="${file.name}">
+      <a class="link" href="/share/${file.id}">${file.name}</a>
+    </td>
+    <td class="fileData fileData--center">
+      <img
+        onclick=${copyClick}
+        src="${assets.get('copy-16.svg')}"
+        class="cursor--pointer"
+        title="${state.translate('copyUrlHover')}"
+        tabindex="0">
+      <span hidden="true">
+        ${state.translate('copiedUrl')}
+      </span>
+    </td>
+    <td class="fileData fileData--overflow">${remainingTime}</td>
+    <td class="fileData fileData--center">${number(totalDownloads)} / ${number(
+    downloadLimit
+  )}</td>
+    <td class="fileData fileData--center">
+      <img
+        onclick=${showPopup}
+        src="${assets.get('close-16.svg')}"
+        class="cursor--pointer"
+        title="${state.translate('deleteButtonHover')}"
+        tabindex="0">
+      ${deletePopup(
+        state.translate('deletePopupText'),
+        state.translate('deletePopupYes'),
+        state.translate('deletePopupCancel'),
+        deleteFile
+      )}
+    </td>
+  </tr>
+  `;
+
+  function copyClick(e) {
+    emit('copy', { url: file.url, location: 'upload-list' });
+    const icon = e.target;
+    const text = e.target.nextSibling;
+    icon.hidden = true;
+    text.hidden = false;
+    setTimeout(() => {
+      icon.hidden = false;
+      text.hidden = true;
+    }, 500);
+  }
+
+  function showPopup() {
+    const tr = document.getElementById(file.id);
+    const popup = tr.querySelector('.popup');
+    popup.classList.add('popup--show');
+    popup.focus();
+  }
+
+  function deleteFile() {
+    emit('delete', { file, location: 'upload-list' });
+    emit('render');
+  }
+};
+
+function timeLeft(milliseconds, state) {
+  const minutes = Math.floor(milliseconds / 1000 / 60);
+  const hours = Math.floor(minutes / 60);
+  if (hours >= 1) {
+    return state.translate('expiresHoursMinutes', {
+      hours,
+      minutes: minutes % 60
+    });
+  } else if (hours === 0) {
+    if (minutes === 0) {
+      return state.translate('expiresMinutes', { minutes: '< 1' });
+    }
+    return state.translate('expiresMinutes', { minutes });
+  }
+  return null;
+}
--- a/app/templates/fileList.js
+++ b/app/templates/fileList.js
@@ -1,32 +0,0 @@
-const html = require('choo/html');
-const file = require('./file');
-
-module.exports = function(state, emit) {
-  let table = '';
-  if (state.storage.files.length) {
-    table = html`
-    <table id="uploaded-files">
-      <thead>
-        <tr>
-          <th id="uploaded-file">${state.translate('uploadedFile')}</th>
-          <th id="copy-file-list" class="center-col">${state.translate(
-            'copyFileList'
-          )}</th>
-          <th id="expiry-file-list">${state.translate('expiryFileList')}</th>
-          <th id="delete-file-list" class="center-col">${state.translate(
-            'deleteFileList'
-          )}</th>
-        </tr>
-      </thead>
-      <tbody>
-        ${state.storage.files.map(f => file(f, state, emit))}
-      </tbody>
-    </table>
-    `;
-  }
-  return html`
-  <div id="file-list">
-    ${table}
-  </div>
-  `;
-};
--- a/app/templates/fileList/fileList.css
+++ b/app/templates/fileList/fileList.css
@@ -0,0 +1,52 @@
+.fileList {
+  margin: 45.3px auto;
+  table-layout: fixed;
+  border-collapse: collapse;
+  font-family: 'Segoe UI', 'SF Pro Text', sans-serif;
+}
+
+.fileList__header {
+  font-size: 16px;
+  color: var(--lightTextColor);
+  font-weight: lighter;
+  text-align: left;
+  background: rgba(0, 148, 251, 0.05);
+  height: 40px;
+  border-top: 1px solid rgba(0, 148, 251, 0.1);
+  padding: 0 19px;
+  white-space: nowrap;
+}
+
+.fileList__body {
+  word-wrap: break-word;
+  word-break: break-all;
+}
+
+.fileList__nameCol {
+  width: 35%;
+}
+
+.fileList__copyCol {
+  text-align: center;
+  width: 25%;
+}
+
+.fileList__expireCol {
+  width: 25%;
+}
+
+.fileList__dlCol {
+  width: 8%;
+}
+
+.fileList__delCol {
+  text-align: center;
+  width: 7%;
+}
+
+@media (max-device-width: 520px), (max-width: 520px) {
+  .fileList__header {
+    font-size: 14px;
+    padding: 0 5px;
+  }
+}
--- a/app/templates/fileList/index.js
+++ b/app/templates/fileList/index.js
@@ -0,0 +1,33 @@
+const html = require('choo/html');
+const file = require('../file');
+
+module.exports = function(state, emit) {
+  if (state.storage.files.length) {
+    return html`
+    <table class="fileList">
+      <thead>
+        <tr>
+          <th class="fileList__header fileList__nameCol">
+            ${state.translate('uploadedFile')}
+          </th>
+          <th class="fileList__header fileList__copyCol">
+            ${state.translate('copyFileList')}
+          </th>
+          <th class="fileList__header fileList__expireCol" >
+            ${state.translate('timeFileList')}
+          </th>
+          <th class="fileList__header fileList__dlCol" >
+            ${state.translate('downloadsFileList')}
+          </th>
+          <th class="fileList__header fileList__delCol">
+            ${state.translate('deleteFileList')}
+          </th>
+        </tr>
+      </thead>
+      <tbody class="fileList__body">
+        ${state.storage.files.map(f => file(f, state, emit))}
+      </tbody>
+    </table>
+    `;
+  }
+};
--- a/app/templates/footer/footer.css
+++ b/app/templates/footer/footer.css
@@ -0,0 +1,93 @@
+.footer {
+  right: 0;
+  bottom: 0;
+  left: 0;
+  font-size: 13px;
+  display: flex;
+  align-items: flex-end;
+  flex-direction: row;
+  justify-content: space-between;
+  padding: 50px 31px 41px;
+  width: 100%;
+  box-sizing: border-box;
+}
+
+.legalSection {
+  max-width: 81vw;
+  display: flex;
+  align-items: center;
+  flex-direction: row;
+}
+
+.legalSection__link {
+  color: var(--lightTextColor);
+  opacity: 0.9;
+  white-space: nowrap;
+  margin-right: 2vw;
+}
+
+.legalSection__link:hover {
+  opacity: 1;
+}
+
+.legalSection__link:visited {
+  color: var(--lightTextColor);
+}
+
+.legalSection__mozLogo {
+  width: 112px;
+  height: 32px;
+  margin-bottom: -5px;
+}
+
+.socialSection {
+  display: flex;
+  justify-content: space-between;
+  width: 94px;
+}
+
+.socialSection__link {
+  opacity: 0.9;
+}
+
+.socialSection__link:hover {
+  opacity: 1;
+}
+
+.socialSection__icon {
+  width: 32px;
+  height: 32px;
+  margin-bottom: -5px;
+}
+
+@media (max-device-width: 768px), (max-width: 768px) {
+  .footer {
+    flex-direction: column;
+    justify-content: flex-start;
+    align-items: flex-start;
+    max-width: 630px;
+    margin: auto;
+  }
+
+  .legalSection__mozLogo {
+    margin-left: -7px;
+  }
+
+  .legalSection {
+    flex-direction: column;
+    margin: auto;
+    width: 100%;
+    max-width: 100%;
+  }
+
+  .legalSection__link {
+    display: block;
+    padding: 10px 0;
+    align-self: flex-start;
+  }
+
+  .socialSection {
+    margin-top: 20px;
+    align-self: flex-start;
+  }
+}
--- a/app/templates/footer/index.js
+++ b/app/templates/footer/index.js
@@ -0,0 +1,68 @@
+const html = require('choo/html');
+const assets = require('../../../common/assets');
+
+module.exports = function(state) {
+  const footer = html`<footer class="footer">
+    <div class="legalSection">
+      <a
+        href="https://www.mozilla.org"
+        class="legalSection__link">
+        <img
+          class="legalSection__mozLogo"
+          src="${assets.get('mozilla-logo.svg')}"
+          alt="mozilla"/>
+      </a>
+      <a
+        href="https://www.mozilla.org/about/legal"
+        class="legalSection__link">
+        ${state.translate('footerLinkLegal')}
+      </a>
+      <a
+        href="https://testpilot.firefox.com/about"
+        class="legalSection__link">
+        ${state.translate('footerLinkAbout')}
+      </a>
+      <a
+        href="/legal"
+        class="legalSection__link">${state.translate('footerLinkPrivacy')}</a>
+      <a
+        href="/legal"
+        class="legalSection__link">${state.translate('footerLinkTerms')}</a>
+      <a
+        href="https://www.mozilla.org/privacy/websites/#cookies"
+        class="legalSection__link">
+        ${state.translate('footerLinkCookies')}
+      </a>
+      <a
+        href="https://www.mozilla.org/about/legal/report-infringement/"
+        class="legalSection__link">
+        ${state.translate('reportIPInfringement')}
+      </a>
+    </div>
+    <div class="socialSection">
+      <a
+        href="https://github.com/mozilla/send"
+        class="socialSection__link">
+        <img
+          class="socialSection__icon"
+          src="${assets.get('github-icon.svg')}"
+          alt="github"/>
+      </a>
+      <a
+        href="https://twitter.com/FxTestPilot"
+        class="socialSection__link">
+        <img
+          class="socialSection__icon"
+          src="${assets.get('twitter-icon.svg')}"
+          alt="twitter"/>
+      </a>
+    </div>
+  </footer>`;
+  // HACK
+  // We only want to render this once because we
+  // toggle the targets of the links with utils/openLinksInNewTab
+  footer.isSameNode = function(target) {
+    return target && target.nodeName && target.nodeName === 'FOOTER';
+  };
+  return footer;
+};
--- a/app/templates/fxPromo/fxPromo.css
+++ b/app/templates/fxPromo/fxPromo.css
@@ -0,0 +1,56 @@
+.fxPromo {
+  padding: 0 15px;
+  height: 48px;
+  background-color: #efeff1;
+  color: #4a4a4f;
+  font-size: 13px;
+  display: flex;
+  flex-direction: row;
+  align-content: center;
+  align-items: center;
+  justify-content: center;
+}
+
+.fxPromo > div {
+  display: flex;
+  align-items: center;
+  margin: 0 auto;
+}
+
+.fxPromo > div > span {
+  margin-left: 10px;
+}
+
+.fxPromo__logo {
+  width: 24px;
+}
+
+.fxPromo--blue {
+  background: linear-gradient(-180deg, #45a1ff 0%, #00feff 94%);
+  color: #fff;
+}
+
+.fxPromo--pink {
+  background: linear-gradient(-180deg, #ff9400 0%, #ff1ad9 94%);
+  color: #fff;
+}
+
+.fxPromo--blue a {
+  color: #fff;
+  font-weight: bold;
+}
+
+.fxPromo--pink a {
+  color: #fff;
+  font-weight: bold;
+}
+
+.fxPromo--blue a:hover {
+  color: #eee;
+  font-weight: bold;
+}
+
+.fxPromo--pink a:hover {
+  color: #eee;
+  font-weight: bold;
+}
--- a/app/templates/fxPromo/index.js
+++ b/app/templates/fxPromo/index.js
@@ -0,0 +1,34 @@
+const html = require('choo/html');
+const assets = require('../../../common/assets');
+
+module.exports = function(state, emit) {
+  let classes = 'fxPromo';
+  switch (state.promo) {
+    case 'blue':
+      classes = 'fxPromo fxPromo--blue';
+      break;
+    case 'pink':
+      classes = 'fxPromo fxPromo--pink';
+      break;
+  }
+
+  return html`
+    <div class="${classes}">
+      <div>
+        <img
+        src="${assets.get('firefox_logo-only.svg')}"
+        class="fxPromo__logo"
+        alt="Firefox"/>
+        <span>Send is brought to you by the all-new Firefox.
+        <a
+          class="link"
+          href="https://www.mozilla.org/firefox/new/?utm_campaign=send-acquisition&utm_medium=referral&utm_source=send.firefox.com"
+          onclick=${clicked}
+          >Download Firefox now ≫</a></span>
+      </div>
+    </div>`;
+
+  function clicked() {
+    emit('experiment', { cd3: 'promo' });
+  }
+};
--- a/app/templates/header/header.css
+++ b/app/templates/header/header.css
@@ -0,0 +1,104 @@
+.header {
+  align-items: flex-start;
+  box-sizing: border-box;
+  display: flex;
+  justify-content: space-between;
+  padding: 31px;
+  width: 100%;
+}
+
+.logo {
+  display: flex;
+  position: relative;
+  align-items: center;
+}
+
+.logo__link {
+  display: flex;
+  flex-direction: row;
+}
+
+.logo__title {
+  color: #3e3d40;
+  font-size: 32px;
+  font-weight: 500;
+  margin: 0;
+  position: relative;
+  top: -1px;
+  letter-spacing: 1px;
+  margin-left: 8px;
+  transition: color 50ms;
+}
+
+.logo__title:hover {
+  color: var(--primaryControlBGColor);
+}
+
+.logo__subtitle {
+  color: #3e3d40;
+  font-size: 12px;
+  margin: 0 8px;
+}
+
+.logo__subtitle-link {
+  font-weight: bold;
+  color: #3e3d40;
+  transition: color 50ms;
+}
+
+.logo__subtitle-link:hover {
+  color: var(--primaryControlBGColor);
+}
+
+.feedback {
+  background-color: var(--primaryControlBGColor);
+  background-image: url('../assets/feedback.svg');
+  background-position: 2px 4px;
+  background-repeat: no-repeat;
+  background-size: 18px;
+  border-radius: 3px;
+  border: 1px solid var(--primaryControlBGColor);
+  box-shadow: 0 1px 2px rgba(0, 0, 0, 0.1);
+  color: var(--primaryControlFGColor);
+  cursor: pointer;
+  display: block;
+  float: right;
+  font-size: 12px;
+  line-height: 12px;
+  opacity: 0.9;
+  padding: 5px;
+  overflow: hidden;
+  min-width: 12px;
+  max-width: 12px;
+  text-indent: 17px;
+  transition: all 250ms ease-in-out;
+  white-space: nowrap;
+}
+
+.feedback:hover,
+.feedback:focus {
+  min-width: 30px;
+  max-width: 300px;
+  text-indent: 2px;
+  padding: 5px 5px 5px 20px;
+  background-color: var(--primaryControlHoverColor);
+}
+
+.feedback:active {
+  background-color: var(--primaryControlHoverColor);
+}
+
+@media (max-device-width: 520px), (max-width: 520px) {
+  .header {
+    flex-direction: column;
+    justify-content: flex-start;
+  }
+
+  .feedback {
+    margin-top: 10px;
+    min-width: 30px;
+    max-width: 300px;
+    text-indent: 2px;
+    padding: 5px 5px 5px 20px;
+  }
+}
--- a/app/templates/header/index.js
+++ b/app/templates/header/index.js
@@ -0,0 +1,67 @@
+const html = require('choo/html');
+const assets = require('../../../common/assets');
+/*
+  The current weback config uses package.json to generate
+  version.json for /__version__ meaning `require` returns the
+  string 'version.json' in the frontend context but the json
+  on the server.
+
+  We want `version` to be constant at build time so this file
+  has a custom loader (/build/version_loader.js) just to replace
+  string with the value from package.json. 🤢
+*/
+const version = require('../../../package.json').version || 'VERSION';
+const browser = browserName();
+
+module.exports = function(state) {
+  const feedbackUrl = `https://qsurvey.mozilla.com/s3/txp-firefox-send?ver=${version}&browser=${browser}`;
+  const header = html`
+  <header class="header">
+    <div class="logo">
+      <a class="logo__link" href="/">
+        <img
+          src="${assets.get('send_logo.svg')}"
+          alt="Send"/>
+        <h1 class="logo__title">Send</h1>
+      </a>
+      <div class="logo__subtitle">
+        <a class="logo__subtitle-link" href="https://testpilot.firefox.com">Firefox Test Pilot</a>
+        <div>${state.translate('siteSubtitle')}</div>
+      </div>
+    </div>
+    <a href="${feedbackUrl}"
+      rel="noreferrer noopener"
+      class="feedback"
+      target="_blank">${state.translate('siteFeedback')}</a>
+  </header>`;
+  // HACK
+  // We only want to render this once because we
+  // toggle the targets of the links with utils/openLinksInNewTab
+  header.isSameNode = function(target) {
+    return target && target.nodeName && target.nodeName === 'HEADER';
+  };
+  return header;
+};
+
+function browserName() {
+  try {
+    if (/firefox/i.test(navigator.userAgent)) {
+      return 'firefox';
+    }
+    if (/edge/i.test(navigator.userAgent)) {
+      return 'edge';
+    }
+    if (/trident/i.test(navigator.userAgent)) {
+      return 'ie';
+    }
+    if (/chrome/i.test(navigator.userAgent)) {
+      return 'chrome';
+    }
+    if (/safari/i.test(navigator.userAgent)) {
+      return 'safari';
+    }
+    return 'other';
+  } catch (e) {
+    return 'unknown';
+  }
+}
--- a/app/templates/legal.js
+++ b/app/templates/legal.js
@@ -1,38 +0,0 @@
-const html = require('choo/html');
-
-function replaceLinks(str, urls) {
-  let i = -1;
-  const s = str.replace(/<a>([^<]+)<\/a>/g, (m, v) => {
-    i++;
-    return `<a href="${urls[i]}">${v}</a>`;
-  });
-  return [`<div class="description">${s}</div>`];
-}
-
-module.exports = function(state) {
-  const div = html`
-    <div id="page-one">
-      <div id="legal">
-        <div class="title">${state.translate('legalHeader')}</div>
-          ${html(
-            replaceLinks(state.translate('legalNoticeTestPilot'), [
-              'https://testpilot.firefox.com/terms',
-              'https://testpilot.firefox.com/privacy',
-              'https://testpilot.firefox.com/experiments/send'
-            ])
-          )}
-          ${html(
-            replaceLinks(state.translate('legalNoticeMozilla'), [
-              'https://www.mozilla.org/privacy/websites/',
-              'https://www.mozilla.org/about/legal/terms/mozilla/'
-            ])
-          )}
-      </div>
-    </div>
-  `;
-
-  if (state.layout) {
-    return state.layout(state, div);
-  }
-  return div;
-};
--- a/app/templates/notFound.js
+++ b/app/templates/notFound.js
@@ -1,25 +0,0 @@
-const html = require('choo/html');
-const assets = require('../../common/assets');
-
-module.exports = function(state) {
-  const div = html`
-  <div id="page-one">
-    <div id="download">
-      <div class="title">${state.translate('expiredPageHeader')}</div>
-      <div class="share-window">
-        <img src="${assets.get('illustration_expired.svg')}" id="expired-img">
-      </div>
-      <div class="expired-description">${state.translate(
-        'uploadPageExplainer'
-      )}</div>
-      <a class="send-new" href="/" data-state="notfound">${state.translate(
-        'sendYourFilesLink'
-      )}</a>
-    </div>
-  </div>`;
-
-  if (state.layout) {
-    return state.layout(state, div);
-  }
-  return div;
-};
--- a/app/templates/passwordInput/index.js
+++ b/app/templates/passwordInput/index.js
@@ -0,0 +1,109 @@
+const html = require('choo/html');
+const MAX_LENGTH = 32;
+
+module.exports = function(file, state, emit) {
+  const loading = state.settingPassword;
+  const pwd = file.hasPassword;
+  const sectionClass =
+    pwd || state.passwordSetError
+      ? 'passwordInput'
+      : 'passwordInput passwordInput--hidden';
+  const inputClass = loading || pwd ? 'input' : 'input input--noBtn';
+  let btnClass = 'inputBtn inputBtn--password inputBtn--hidden';
+  if (loading) {
+    btnClass = 'inputBtn inputBtn--password inputBtn--loading';
+  } else if (pwd) {
+    btnClass = 'inputBtn inputBtn--password';
+  }
+  const action = pwd
+    ? state.translate('changePasswordButton')
+    : state.translate('addPasswordButton');
+  return html`
+  <div class="${sectionClass}">
+    <form
+      class="passwordInput__form"
+      onsubmit=${setPassword}
+      data-no-csrf>
+      <input id="password-input"
+        ${loading ? 'disabled' : ''}
+        class="${inputClass}"
+        maxlength="${MAX_LENGTH}"
+        autocomplete="off"
+        type="password"
+        oninput=${inputChanged}
+        onfocus=${focused}
+        placeholder="${
+          pwd && !state.passwordSetError
+            ? passwordPlaceholder(file.password)
+            : state.translate('unlockInputPlaceholder')
+        }">
+      <input type="submit"
+        id="password-btn"
+        ${loading ? 'disabled' : ''}
+        class="${btnClass}"
+        value="${loading ? '' : action}">
+    </form>
+    <label
+      class="passwordInput__msg ${
+        state.passwordSetError ? 'passwordInput__msg--error' : ''
+      }"
+      for="password-input">${message(state, pwd)}</label>
+  </div>`;
+
+  function inputChanged() {
+    state.passwordSetError = null;
+    const resetInput = document.getElementById('password-input');
+    const resetBtn = document.getElementById('password-btn');
+    const pwdmsg = document.querySelector('.passwordInput__msg');
+    const length = resetInput.value.length;
+
+    if (length === MAX_LENGTH) {
+      pwdmsg.textContent = state.translate('maxPasswordLength', {
+        length: MAX_LENGTH
+      });
+    } else {
+      pwdmsg.textContent = '';
+    }
+    if (length > 0) {
+      resetBtn.classList.remove('inputBtn--hidden');
+      resetInput.classList.remove('input--noBtn');
+    } else {
+      resetBtn.classList.add('inputBtn--hidden');
+      resetInput.classList.add('input--noBtn');
+    }
+  }
+
+  function focused(event) {
+    event.preventDefault();
+    const el = document.getElementById('password-input');
+    if (el.placeholder !== state.translate('unlockInputPlaceholder')) {
+      el.placeholder = '';
+    }
+  }
+
+  function setPassword(event) {
+    event.preventDefault();
+    const el = document.getElementById('password-input');
+    const password = el.value;
+    if (password.length > 0) {
+      emit('password', { password, file });
+    } else {
+      el.focus();
+    }
+    return false;
+  }
+};
+
+function passwordPlaceholder(password) {
+  return password ? password.replace(/./g, '●') : '●●●●●●●●●●●●';
+}
+
+function message(state, pwd) {
+  if (state.passwordSetError) {
+    return state.translate('passwordSetError');
+  }
+  if (state.settingPassword || !pwd) {
+    return '';
+  }
+  return state.translate('passwordIsSet');
+}
--- a/app/templates/passwordInput/passwordInput.css
+++ b/app/templates/passwordInput/passwordInput.css
@@ -0,0 +1,41 @@
+.passwordInput {
+  width: 90%;
+  height: 100px;
+  padding: 10px 5px 5px;
+}
+
+.passwordInput--hidden {
+  visibility: hidden;
+}
+
+.passwordInput__form {
+  display: flex;
+  flex-wrap: nowrap;
+  padding-bottom: 5px;
+}
+
+.passwordInput__msg {
+  font-size: 15px;
+  color: var(--lightTextColor);
+}
+
+.passwordInput__msg--error {
+  color: var(--errorColor);
+}
+
+.inputBtn--loading {
+  background-image: url('../assets/spinner.svg');
+  background-position: center;
+  background-size: 30px 30px;
+  background-repeat: no-repeat;
+}
+
+.inputBtn--password {
+  flex: 0 0 200px;
+}
+
+@media (max-device-width: 520px), (max-width: 520px) {
+  .passwordInput__form {
+    flex-direction: column;
+  }
+}
--- a/app/templates/popup/index.js
+++ b/app/templates/popup/index.js
@@ -0,0 +1,26 @@
+const html = require('choo/html');
+
+module.exports = function(msg, confirmText, cancelText, confirmCallback) {
+  return html`
+  <div class="popup__wrapper">
+    <div class="popup" onblur=${hide} tabindex="-1">
+      <div class="popup__message">${msg}</div>
+      <div class="popup__action">
+        <span class="popup__no" onclick=${hide}>
+          ${cancelText}
+        </span>
+        <span class="popup__yes" onclick=${confirmCallback}>
+          ${confirmText}
+        </span>
+      </div>
+    </div>
+  </div>`;
+
+  function hide(e) {
+    e.stopPropagation();
+    const popup = document.querySelector('.popup.popup--show');
+    if (popup) {
+      popup.classList.remove('popup--show');
+    }
+  }
+};
--- a/app/templates/popup/popup.css
+++ b/app/templates/popup/popup.css
@@ -0,0 +1,122 @@
+.popup {
+  visibility: hidden;
+  min-width: 204px;
+  min-height: 105px;
+  background-color: var(--pageBGColor);
+  color: var(--textColor);
+  border: 1px solid #d7d7db;
+  padding: 15px 24px;
+  box-sizing: content-box;
+  text-align: center;
+  border-radius: 5px;
+  position: absolute;
+  z-index: 1;
+  bottom: 20px;
+  left: -40px;
+  transition: opacity 0.5s;
+  opacity: 0;
+  outline: 0;
+  box-shadow: 3px 3px 7px rgba(136, 136, 136, 0.3);
+}
+
+.popup::after {
+  content: '';
+  position: absolute;
+  bottom: -11px;
+  left: 20px;
+  background-color: #fff;
+  display: block;
+  width: 20px;
+  height: 20px;
+  transform: rotate(45deg);
+  border-radius: 0 0 5px;
+  border-right: 1px solid #d7d7db;
+  border-bottom: 1px solid #d7d7db;
+  border-left: 1px solid #fff;
+  border-top: 1px solid #fff;
+}
+
+.popup__wrapper {
+  position: absolute;
+  display: inline-block;
+}
+
+.popup__message {
+  height: 40px;
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  border-bottom: 1px #ebebeb solid;
+  color: var(--textColor);
+  font-size: 15px;
+  font-weight: normal;
+  padding-bottom: 15px;
+  white-space: nowrap;
+  width: calc(100% + 48px);
+  margin-left: -24px;
+}
+
+.popup__action {
+  margin-top: 15px;
+  display: flex;
+  flex-direction: row;
+  align-items: center;
+  justify-content: space-between;
+}
+
+.popup__no {
+  color: #4a4a4a;
+  background-color: #fbfbfb;
+  border: 1px #c1c1c1 solid;
+  border-radius: 5px;
+  padding: 5px 25px;
+  font-weight: normal;
+  min-width: 94px;
+  box-sizing: border-box;
+  cursor: pointer;
+  white-space: nowrap;
+}
+
+.popup__no:hover {
+  background-color: #efeff1;
+}
+
+.popup__yes {
+  color: var(--primaryControlFGColor);
+  background-color: var(--primaryControlBGColor);
+  border-radius: 5px;
+  padding: 5px 25px;
+  font-weight: normal;
+  cursor: pointer;
+  min-width: 94px;
+  box-sizing: border-box;
+  white-space: nowrap;
+  margin-left: 12px;
+}
+
+.popup__yes:hover {
+  background-color: var(--primaryControlHoverColor);
+}
+
+.popup--show {
+  visibility: visible;
+  opacity: 1;
+}
+
+@media (max-device-width: 992px), (max-width: 992px) {
+  .popup {
+    left: auto;
+    right: -40px;
+  }
+
+  .popup::after {
+    left: auto;
+    right: 36px;
+  }
+}
+
+@media (max-device-width: 520px), (max-width: 520px) {
+  .popup::after {
+    left: 125px;
+  }
+}
--- a/app/templates/preview.js
+++ b/app/templates/preview.js
@@ -1,70 +0,0 @@
-const html = require('choo/html');
-const assets = require('../../common/assets');
-const notFound = require('./notFound');
-const { bytes } = require('../utils');
-
-function getFileFromDOM() {
-  const el = document.getElementById('dl-file');
-  if (!el) {
-    return null;
-  }
-  const data = el.dataset;
-  return {
-    name: data.name,
-    size: parseInt(data.size, 10),
-    ttl: parseInt(data.ttl, 10)
-  };
-}
-
-module.exports = function(state, emit) {
-  state.fileInfo = state.fileInfo || getFileFromDOM();
-  if (!state.fileInfo) {
-    return notFound(state, emit);
-  }
-  state.fileInfo.id = state.params.id;
-  state.fileInfo.key = state.params.key;
-  const fileInfo = state.fileInfo;
-  const size = bytes(fileInfo.size);
-  const div = html`
-  <div id="page-one">
-    <div id="download">
-      <div id="download-page-one">
-        <div class="title">
-          <span id="dl-file"
-            data-name="${fileInfo.name}"
-            data-size="${fileInfo.size}"
-            data-ttl="${fileInfo.ttl}">${state.translate('downloadFileName', {
-    filename: fileInfo.name
-  })}</span>
-        <span id="dl-filesize">${' ' +
-          state.translate('downloadFileSize', { size })}</span>
-        </div>
-        <div class="description">${state.translate('downloadMessage')}</div>
-        <img
-          src="${assets.get('illustration_download.svg')}"
-          id="download-img"
-          alt="${state.translate('downloadAltText')}"/>
-        <div>
-          <button
-            id="download-btn"
-            class="btn"
-            title="${state.translate('downloadButtonLabel')}"
-            onclick=${download}>${state.translate(
-    'downloadButtonLabel'
-  )}</button>
-        </div>
-      </div>
-      <a class="send-new" href="/">${state.translate('sendYourFilesLink')}</a>
-    </div>
-  </div>
-  `;
-  function download(event) {
-    event.preventDefault();
-    emit('download', fileInfo);
-  }
-
-  if (state.layout) {
-    return state.layout(state, div);
-  }
-  return div;
-};
--- a/app/templates/progress.js
+++ b/app/templates/progress.js
@@ -1,21 +0,0 @@
-const html = require('choo/html');
-
-const radius = 73;
-const oRadius = radius + 10;
-const oDiameter = oRadius * 2;
-const circumference = 2 * Math.PI * radius;
-
-module.exports = function(progressRatio) {
-  const dashOffset = (1 - progressRatio) * circumference;
-  const percent = Math.floor(progressRatio * 100);
-  const div = html`
-  <div class="progress-bar">
-    <svg id="progress" width="${oDiameter}" height="${oDiameter}" viewPort="0 0 ${oDiameter} ${oDiameter}" version="1.1">
-      <circle r="${radius}" cx="${oRadius}" cy="${oRadius}" fill="transparent"/>
-      <circle id="bar" r="${radius}" cx="${oRadius}" cy="${oRadius}" fill="transparent" transform="rotate(-90 ${oRadius} ${oRadius})" stroke-dasharray="${circumference}" stroke-dashoffset="${dashOffset}"/>
-      <text class="percentage" text-anchor="middle" x="50%" y="98"><tspan class="percent-number">${percent}</tspan><tspan class="percent-sign">%</tspan></text>
-    </svg>
-  </div>
-  `;
-  return div;
-};
--- a/app/templates/progress/index.js
+++ b/app/templates/progress/index.js
@@ -0,0 +1,56 @@
+const html = require('choo/html');
+const percent = require('../../utils').percent;
+
+const radius = 73;
+const oRadius = radius + 10;
+const oDiameter = oRadius * 2;
+const circumference = 2 * Math.PI * radius;
+
+module.exports = function(progressRatio, indefinite = false) {
+  // HACK - never indefinite for MS Edge
+  if (/edge/i.test(navigator.userAgent)) {
+    indefinite = false;
+  }
+  const p = indefinite ? 0.2 : progressRatio;
+  const dashOffset = (1 - p) * circumference;
+  const progressPercent = html`
+    <text class="progress__percent" text-anchor="middle" x="50%" y="98">
+      ${percent(progressRatio)}
+    </text>`;
+
+  return html`
+  <div class="progress">
+    <svg
+      width="${oDiameter}"
+      height="${oDiameter}"
+      viewPort="0 0 ${oDiameter} ${oDiameter}"
+      version="1.1">
+      <circle
+        class="progress__bg"
+        r="${radius}"
+        cx="${oRadius}"
+        cy="${oRadius}"
+        fill="transparent"/>
+      <circle
+        class="progress__indefinite ${indefinite ? '' : 'progress--invisible'}"
+        r="${radius}"
+        cx="${oRadius}"
+        cy="${oRadius}"
+        fill="transparent"
+        transform="rotate(-90 ${oRadius} ${oRadius})"
+        stroke-dasharray="${circumference}"
+        stroke-dashoffset="${dashOffset}"/>
+      <circle
+        class="progress__bar ${indefinite ? 'progress--invisible' : ''}"
+        r="${radius}"
+        cx="${oRadius}"
+        cy="${oRadius}"
+        fill="transparent"
+        transform="rotate(-90 ${oRadius} ${oRadius})"
+        stroke-dasharray="${circumference}"
+        stroke-dashoffset="${dashOffset}"/>
+        ${indefinite ? '' : progressPercent}
+    </svg>
+  </div>
+  `;
+};
--- a/app/templates/progress/progress.css
+++ b/app/templates/progress/progress.css
@@ -0,0 +1,43 @@
+.progress {
+  margin-top: 3px;
+}
+
+.progress__bg {
+  stroke: #eee;
+  stroke-width: 0.75em;
+}
+
+.progress__bar {
+  stroke: #3b9dff;
+  stroke-width: 0.75em;
+  transition: stroke-dashoffset 300ms linear;
+}
+
+.progress__indefinite {
+  stroke: #3b9dff;
+  stroke-width: 0.75em;
+  animation: 1s linear infinite spin;
+  transform-origin: center;
+}
+
+@keyframes spin {
+  from {
+    transform: rotate(0deg);
+  }
+
+  to {
+    transform: rotate(360deg);
+  }
+}
+
+.progress__percent {
+  font-family: 'Segoe UI', 'SF Pro Text', sans-serif;
+  font-size: 43.2px;
+  letter-spacing: -0.78px;
+  line-height: 58px;
+  user-select: none;
+}
+
+.progress--invisible {
+  display: none;
+}
--- a/app/templates/selectbox/index.js
+++ b/app/templates/selectbox/index.js
@@ -0,0 +1,28 @@
+const html = require('choo/html');
+
+module.exports = function(selected, options, translate, changed) {
+  const id = `select-${Math.random()}`;
+  let x = selected;
+
+  return html`
+  <div class="select">
+    <select id="${id}" onchange=${choose}>
+      ${options.map(
+        i =>
+          html`<option value="${i}" ${
+            i === selected ? 'selected' : ''
+          }>${translate(i)}</option>`
+      )}
+    </select>
+  </div>`;
+
+  function choose(event) {
+    const target = event.target;
+    const value = +target.value;
+
+    if (x !== value) {
+      x = value;
+      changed(value);
+    }
+  }
+};
--- a/app/templates/selectbox/selectbox.css
+++ b/app/templates/selectbox/selectbox.css
@@ -0,0 +1,46 @@
+.select {
+  background-color: var(--pageBGColor);
+  overflow: hidden;
+  padding: 4px 2px 4px 2px;
+  border: 1px dotted #0094fb88;
+  border-radius: 4px;
+  display: inline;
+  position: relative;
+}
+
+.select::after {
+  color: #0094fb;
+  content: '\25BC';
+  pointer-events: none;
+  font-size: 20px;
+  margin-left: -30px;
+  padding-right: 10px;
+}
+
+option {
+  padding: 0;
+}
+
+select {
+  appearance: none;
+  outline: 0;
+  box-shadow: none;
+  border: 0;
+  background: #fff;
+  background-image: none;
+  font-size: 1em;
+  font-weight: 200;
+  margin: 0;
+  color: #0094fb;
+  cursor: pointer;
+  padding-right: 40px;
+}
+
+select:active {
+  background-color: var(--pageBGColor);
+  border: 0;
+}
+
+#arrow {
+  position: relative;
+}
--- a/app/templates/setPasswordSection/index.js
+++ b/app/templates/setPasswordSection/index.js
@@ -0,0 +1,37 @@
+const html = require('choo/html');
+const passwordInput = require('../passwordInput');
+
+module.exports = function(state, emit) {
+  const file = state.storage.getFileById(state.params.id);
+
+  return html`
+  <div class="setPasswordSection">
+    <div class="checkbox">
+      <input
+        ${file.hasPassword ? 'disabled' : ''}
+        ${file.hasPassword || state.passwordSetError ? 'checked' : ''}
+        class="checkbox__input"
+        id="add-password"
+        type="checkbox"
+        autocomplete="off"
+        onchange=${togglePasswordInput}/>
+      <label class="checkbox__label" for="add-password">
+        ${state.translate('requirePasswordCheckbox')}
+      </label>
+    </div>
+    ${passwordInput(file, state, emit)}
+  </div>`;
+
+  function togglePasswordInput(e) {
+    const unlockInput = document.getElementById('password-input');
+    const boxChecked = e.target.checked;
+    document
+      .querySelector('.passwordInput')
+      .classList.toggle('passwordInput--hidden', !boxChecked);
+    if (boxChecked) {
+      unlockInput.focus();
+    } else {
+      unlockInput.value = '';
+    }
+  }
+};
--- a/app/templates/setPasswordSection/setPasswordSection.css
+++ b/app/templates/setPasswordSection/setPasswordSection.css
@@ -0,0 +1,69 @@
+.setPasswordSection {
+  padding: 10px 0;
+  max-width: 100%;
+  overflow-wrap: break-word;
+}
+
+.checkbox {
+  min-height: 24px;
+}
+
+.checkbox__input {
+  position: absolute;
+  opacity: 0;
+}
+
+.checkbox__label {
+  line-height: 23px;
+  cursor: pointer;
+  color: var(--lightTextColor);
+  user-select: none;
+}
+
+.checkbox__label::before {
+  content: '';
+  height: 20px;
+  width: 20px;
+  margin-right: 10px;
+  margin-left: 5px;
+  float: left;
+  border: 1px solid rgba(12, 12, 13, 0.3);
+  border-radius: 2px;
+}
+
+.checkbox__input:focus + .checkbox__label::before,
+.checkbox:hover .checkbox__label::before {
+  border: 1px solid var(--primaryControlBGColor);
+}
+
+.checkbox__input:checked + .checkbox__label {
+  color: var(--textColor);
+}
+
+.checkbox__input:checked + .checkbox__label::before {
+  background-image: url('../assets/check-16-blue.svg');
+  background-position: 2px 1px;
+}
+
+.checkbox__input:disabled + .checkbox__label {
+  cursor: auto;
+}
+
+.checkbox__input:disabled + .checkbox__label::before {
+  background-image: url('../assets/check-16-blue.svg');
+  background-repeat: no-repeat;
+  background-size: 26px 26px;
+  border: none;
+  cursor: auto;
+}
+
+@media (max-device-width: 520px), (max-width: 520px) {
+  .setPasswordSection {
+    align-self: center;
+    min-width: 95%;
+  }
+
+  .checkbox__label::before {
+    margin-left: 0;
+  }
+}
--- a/app/templates/share.js
+++ b/app/templates/share.js
@@ -1,64 +0,0 @@
-const html = require('choo/html');
-const assets = require('../../common/assets');
-const notFound = require('./notFound');
-const { allowedCopy, delay, fadeOut } = require('../utils');
-
-module.exports = function(state, emit) {
-  const file = state.storage.getFileById(state.params.id);
-  if (!file) {
-    return notFound(state, emit);
-  }
-  const div = html`
-  <div id="share-link" class="fadeIn">
-    <div class="title">${state.translate('uploadSuccessTimingHeader')}</div>
-    <div id="share-window">
-      <div id="copy-text">${state.translate('copyUrlFormLabelWithName', {
-        filename: file.name
-      })}</div>
-      <div id="copy">
-        <input id="link" type="url" value="${file.url}" readonly="true"/>
-        <button id="copy-btn" class="btn" title="${state.translate(
-          'copyUrlFormButton'
-        )}" onclick=${copyLink}>${state.translate('copyUrlFormButton')}</button>
-      </div>
-      <button id="delete-file" class="btn" title="${state.translate(
-        'deleteFileButton'
-      )}" onclick=${deleteFile}>${state.translate('deleteFileButton')}</button>
-      <a class="send-new" data-state="completed" href="/" onclick=${sendNew}>${state.translate(
-    'sendAnotherFileLink'
-  )}</a>
-    </div>
-  </div>
-  `;
-
-  async function sendNew(e) {
-    e.preventDefault();
-    await fadeOut('share-link');
-    emit('pushState', '/');
-  }
-
-  async function copyLink() {
-    if (allowedCopy()) {
-      emit('copy', { url: file.url, location: 'success-screen' });
-      const input = document.getElementById('link');
-      input.disabled = true;
-      const copyBtn = document.getElementById('copy-btn');
-      copyBtn.disabled = true;
-      copyBtn.replaceChild(
-        html`<img src="${assets.get('check-16.svg')}" class="icon-check">`,
-        copyBtn.firstChild
-      );
-      await delay(2000);
-      input.disabled = false;
-      copyBtn.disabled = false;
-      copyBtn.textContent = state.translate('copyUrlFormButton');
-    }
-  }
-
-  async function deleteFile() {
-    emit('delete', { file, location: 'success-screen' });
-    await fadeOut('share-link');
-    emit('pushState', '/');
-  }
-  return div;
-};
--- a/app/templates/unsupported.js
+++ b/app/templates/unsupported.js
@@ -1,50 +0,0 @@
-const html = require('choo/html');
-const assets = require('../../common/assets');
-
-module.exports = function(state) {
-  const msg =
-    state.params.reason === 'outdated'
-      ? html`
-    <div id="unsupported-browser">
-      <div class="title">${state.translate('notSupportedHeader')}</div>
-      <div class="description">${state.translate(
-        'notSupportedOutdatedDetail'
-      )}</div>
-      <a id="update-firefox" href="https://support.mozilla.org/kb/update-firefox-latest-version">
-        <img src="${assets.get(
-          'firefox_logo-only.svg'
-        )}" class="firefox-logo" alt="Firefox"/>
-        <div class="unsupported-button-text">${state.translate(
-          'updateFirefox'
-        )}</div>
-      </a>
-      <div class="unsupported-description">${state.translate(
-        'uploadPageExplainer'
-      )}</div>
-    </div>`
-      : html`
-    <div id="unsupported-browser">
-      <div class="title">${state.translate('notSupportedHeader')}</div>
-      <div class="description">${state.translate('notSupportedDetail')}</div>
-      <div class="description"><a href="https://github.com/mozilla/send/blob/master/docs/faq.md#why-is-my-browser-not-supported">${state.translate(
-        'notSupportedLink'
-      )}</a></div>
-      <a id="dl-firefox" href="https://www.mozilla.org/firefox/new/?scene=2">
-        <img src="${assets.get(
-          'firefox_logo-only.svg'
-        )}" class="firefox-logo" alt="Firefox"/>
-        <div class="unsupported-button-text">Firefox<br>
-          <span>${state.translate('downloadFirefoxButtonSub')}</span>
-        </div>
-      </a>
-      <div class="unsupported-description">${state.translate(
-        'uploadPageExplainer'
-      )}</div>
-    </div>`;
-  const div = html`<div id="page-one">${msg}</div>`;
-
-  if (state.layout) {
-    return state.layout(state, div);
-  }
-  return div;
-};
--- a/app/templates/upload.js
+++ b/app/templates/upload.js
@@ -1,38 +0,0 @@
-const html = require('choo/html');
-const progress = require('./progress');
-const { bytes } = require('../utils');
-
-module.exports = function(state, emit) {
-  const transfer = state.transfer;
-
-  const div = html`
-  <div id="upload-progress" class="fadeIn">
-    <div class="title" id="upload-filename">${state.translate(
-      'uploadingPageProgress',
-      {
-        filename: transfer.file.name,
-        size: bytes(transfer.file.size)
-      }
-    )}</div>
-    <div class="description"></div>
-    ${progress(transfer.progressRatio)}
-    <div class="upload">
-      <div class="progress-text">${state.translate(
-        transfer.msg,
-        transfer.sizes
-      )}</div>
-      <button id="cancel-upload" title="${state.translate(
-        'uploadingPageCancel'
-      )}" onclick=${cancel}>${state.translate('uploadingPageCancel')}</button>
-    </div>
-  </div>
-  `;
-
-  function cancel() {
-    const btn = document.getElementById('cancel-upload');
-    btn.disabled = true;
-    btn.textContent = state.translate('uploadCancelNotification');
-    emit('cancel');
-  }
-  return div;
-};
--- a/app/templates/welcome.js
+++ b/app/templates/welcome.js
@@ -1,68 +0,0 @@
-const html = require('choo/html');
-const assets = require('../../common/assets');
-const fileList = require('./fileList');
-const { fadeOut } = require('../utils');
-
-module.exports = function(state, emit) {
-  const div = html`
-  <div id="page-one" class="fadeIn">
-    <div class="title">${state.translate('uploadPageHeader')}</div>
-    <div class="description">
-      <div>${state.translate('uploadPageExplainer')}</div>
-      <a href="https://testpilot.firefox.com/experiments/send" class="link">${state.translate(
-        'uploadPageLearnMore'
-      )}</a>
-    </div>
-    <div class="upload-window" ondragover=${dragover} ondragleave=${dragleave}>
-      <div id="upload-img"><img src="${assets.get(
-        'upload.svg'
-      )}" title="${state.translate('uploadSvgAlt')}"/></div>
-      <div id="upload-text">${state.translate('uploadPageDropMessage')}</div>
-      <span id="file-size-msg"><em>${state.translate(
-        'uploadPageSizeMessage'
-      )}</em></span>
-      <form method="post" action="upload" enctype="multipart/form-data">
-        <input id="file-upload" type="file" name="fileUploaded" onchange=${upload} onfocus=${onfocus} onblur=${onblur} />
-        <label for="file-upload" id="browse" class="btn browse" title="${state.translate(
-          'uploadPageBrowseButton1'
-        )}">${state.translate('uploadPageBrowseButton1')}</label>
-      </form>
-    </div>
-    ${fileList(state, emit)}
-  </div>
-  `;
-
-  function dragover(event) {
-    const div = document.querySelector('.upload-window');
-    div.classList.add('ondrag');
-  }
-
-  function dragleave(event) {
-    const div = document.querySelector('.upload-window');
-    div.classList.remove('ondrag');
-  }
-
-  function onfocus(event) {
-    event.target.classList.add('has-focus');
-  }
-
-  function onblur(event) {
-    event.target.classList.remove('has-focus');
-  }
-
-  async function upload(event) {
-    event.preventDefault();
-    const target = event.target;
-    const file = target.files[0];
-    if (file.size === 0) {
-      return;
-    }
-    await fadeOut('page-one');
-    emit('upload', { file, type: 'click' });
-  }
-
-  if (state.layout) {
-    return state.layout(state, div);
-  }
-  return div;
-};
--- a/app/utils.js
+++ b/app/utils.js
@@ -1,38 +1,15 @@
-function arrayToHex(iv) {
-  let hexStr = '';
-  // eslint-disable-next-line prefer-const
-  for (let i in iv) {
-    if (iv[i] < 16) {
-      hexStr += '0' + iv[i].toString(16);
-    } else {
-      hexStr += iv[i].toString(16);
-    }
-  }
-  return hexStr;
+const b64 = require('base64-js');
+
+function arrayToB64(array) {
+  return b64
+    .fromByteArray(array)
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=/g, '');
 }

-function hexToArray(str) {
-  const iv = new Uint8Array(str.length / 2);
-  for (let i = 0; i < str.length; i += 2) {
-    iv[i / 2] = parseInt(str.charAt(i) + str.charAt(i + 1), 16);
-  }
-
-  return iv;
-}
-
-function notify(str) {
-  return str;
-  /* TODO: enable once we have an opt-in ui element
-  if (!('Notification' in window)) {
-    return;
-  } else if (Notification.permission === 'granted') {
-    new Notification(str);
-  } else if (Notification.permission !== 'denied') {
-    Notification.requestPermission(function(permission) {
-      if (permission === 'granted') new Notification(str);
-    });
-  }
-  */
+function b64ToArray(str) {
+  return b64.toByteArray(str + '==='.slice((str.length + 3) % 4));
 }

 function loadShim(polyfill) {
@@ -45,7 +22,7 @@ function loadShim(polyfill) {
  });
 }

-async function canHasSend(polyfill) {
+async function canHasSend() {
  try {
    const key = await window.crypto.subtle.generateKey(
      {
@@ -55,7 +32,6 @@ async function canHasSend(polyfill) {
      true,
      ['encrypt', 'decrypt']
    );
-
    await window.crypto.subtle.encrypt(
      {
        name: 'AES-GCM',
@@ -65,9 +41,24 @@ async function canHasSend(polyfill) {
      key,
      new ArrayBuffer(8)
    );
+    await window.crypto.subtle.importKey(
+      'raw',
+      window.crypto.getRandomValues(new Uint8Array(16)),
+      'PBKDF2',
+      false,
+      ['deriveKey']
+    );
+    await window.crypto.subtle.importKey(
+      'raw',
+      window.crypto.getRandomValues(new Uint8Array(16)),
+      'HKDF',
+      false,
+      ['deriveKey']
+    );
    return true;
  } catch (err) {
-    return loadShim(polyfill);
+    console.error(err);
+    return false;
  }
 }

@@ -105,21 +96,44 @@ const LOCALIZE_NUMBERS = !!(

 const UNITS = ['B', 'kB', 'MB', 'GB'];
 function bytes(num) {
+  if (num < 1) {
+    return '0B';
+  }
  const exponent = Math.min(Math.floor(Math.log10(num) / 3), UNITS.length - 1);
  const n = Number(num / Math.pow(1000, exponent));
-  const nStr = LOCALIZE_NUMBERS
-    ? n.toLocaleString(navigator.languages, {
+  let nStr = n.toFixed(1);
+  if (LOCALIZE_NUMBERS) {
+    try {
+      const locale = document.querySelector('html').lang;
+      nStr = n.toLocaleString(locale, {
        minimumFractionDigits: 1,
        maximumFractionDigits: 1
-      })
-    : n.toFixed(1);
+      });
+    } catch (e) {
+      // fall through
+    }
+  }
  return `${nStr}${UNITS[exponent]}`;
 }

 function percent(ratio) {
-  return LOCALIZE_NUMBERS
-    ? ratio.toLocaleString(navigator.languages, { style: 'percent' })
-    : `${Math.floor(ratio * 100)}%`;
+  if (LOCALIZE_NUMBERS) {
+    try {
+      const locale = document.querySelector('html').lang;
+      return ratio.toLocaleString(locale, { style: 'percent' });
+    } catch (e) {
+      // fall through
+    }
+  }
+  return `${Math.floor(ratio * 100)}%`;
+}
+
+function number(n) {
+  if (LOCALIZE_NUMBERS) {
+    const locale = document.querySelector('html').lang;
+    return n.toLocaleString(locale);
+  }
+  return n.toString();
 }

 function allowedCopy() {
@@ -131,14 +145,28 @@ function delay(delay = 100) {
  return new Promise(resolve => setTimeout(resolve, delay));
 }

-function fadeOut(id) {
-  const classes = document.getElementById(id).classList;
-  classes.remove('fadeIn');
-  classes.add('fadeOut');
+function fadeOut(selector) {
+  const classes = document.querySelector(selector).classList;
+  classes.remove('effect--fadeIn');
+  classes.add('effect--fadeOut');
  return delay(300);
 }

-const ONE_DAY_IN_MS = 86400000;
+function openLinksInNewTab(links, should = true) {
+  links = links || Array.from(document.querySelectorAll('a:not([target])'));
+  if (should) {
+    links.forEach(l => {
+      l.setAttribute('target', '_blank');
+      l.setAttribute('rel', 'noopener noreferrer');
+    });
+  } else {
+    links.forEach(l => {
+      l.removeAttribute('target');
+      l.removeAttribute('rel');
+    });
+  }
+  return links;
+}

 module.exports = {
  fadeOut,
@@ -146,11 +174,12 @@ module.exports = {
  allowedCopy,
  bytes,
  percent,
+  number,
  copyToClipboard,
-  arrayToHex,
-  hexToArray,
-  notify,
+  arrayToB64,
+  b64ToArray,
+  loadShim,
  canHasSend,
  isFile,
-  ONE_DAY_IN_MS
+  openLinksInNewTab
 };
--- a/assets/check-16-blue.svg
+++ b/assets/check-16-blue.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20"><path fill="#0A84FF " d="M6 14a1 1 0 0 1-.707-.293l-3-3a1 1 0 0 1 1.414-1.414l2.157 2.157 6.316-9.023a1 1 0 0 1 1.639 1.146l-7 10a1 1 0 0 1-.732.427A.863.863 0 0 1 6 14z"/></svg>
--- a/assets/copy-16.svg
+++ b/assets/copy-16.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16"><path class="icon-copy" fill="#0A8DFF" d="M14.707 8.293l-3-3A1 1 0 0 0 11 5h-1V4a1 1 0 0 0-.293-.707l-3-3A1 1 0 0 0 6 0H3a2 2 0 0 0-2 2v7a2 2 0 0 0 2 2h3v3a2 2 0 0 0 2 2h5a2 2 0 0 0 2-2V9a1 1 0 0 0-.293-.707zM12.586 9H11V7.414zm-5-5H6V2.414zM6 7v2H3V2h2v2.5a.5.5 0 0 0 .5.5H8a2 2 0 0 0-2 2zm2 7V7h2v2.5a.5.5 0 0 0 .5.5H13v4z"/></svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16"><path fill="#0A8DFF" d="M14.707 8.293l-3-3A1 1 0 0 0 11 5h-1V4a1 1 0 0 0-.293-.707l-3-3A1 1 0 0 0 6 0H3a2 2 0 0 0-2 2v7a2 2 0 0 0 2 2h3v3a2 2 0 0 0 2 2h5a2 2 0 0 0 2-2V9a1 1 0 0 0-.293-.707zM12.586 9H11V7.414zm-5-5H6V2.414zM6 7v2H3V2h2v2.5a.5.5 0 0 0 .5.5H8a2 2 0 0 0-2 2zm2 7V7h2v2.5a.5.5 0 0 0 .5.5H13v4z"/></svg>
--- a/assets/cryptofill.js
+++ b/assets/cryptofill.js
--- a/assets/firefox_logo-only.svg
+++ b/assets/firefox_logo-only.svg
--- a/assets/main.css
+++ b/assets/main.css
@@ -1,928 +0,0 @@
-/***     index.html     ***/
-html {
-  background: url('./send_bg.svg');
-  font-family: -apple-system, BlinkMacSystemFont, 'SF Pro Text', 'segoe ui',
-    'helvetica neue', helvetica, ubuntu, roboto, noto, arial, sans-serif;
-  font-weight: 200;
-  background-size: 110%;
-  background-repeat: no-repeat;
-  background-position: center top;
-  height: 100%;
-  max-width: 1440px;
-  margin: auto;
-}
-
-body {
-  font-family: -apple-system, BlinkMacSystemFont, 'SF Pro Text', 'segoe ui',
-    'helvetica neue', helvetica, ubuntu, roboto, noto, arial, sans-serif;
-  display: flex;
-  flex-direction: column;
-  margin: 0;
-  min-height: 100vh;
-  position: relative;
-}
-
-#progress circle {
-  stroke: #eee;
-  stroke-width: 0.75em;
-}
-
-#progress #bar {
-  transition: stroke-dashoffset 300ms linear;
-  stroke: #3b9dff;
-}
-
-.header {
-  align-items: flex-start;
-  box-sizing: border-box;
-  display: flex;
-  justify-content: space-between;
-  padding: 31px;
-  width: 100%;
-}
-
-.send-logo {
-  display: flex;
-  position: relative;
-  align-items: center;
-}
-
-.send-logo h1 {
-  transition: color 50ms;
-}
-
-.send-logo h1:hover {
-  color: #0297f8;
-}
-
-.send-logo > a {
-  display: flex;
-  flex-direction: row;
-}
-
-.site-title {
-  color: #3e3d40;
-  font-size: 32px;
-  font-weight: 500;
-  margin: 0;
-  position: relative;
-  top: -1px;
-  letter-spacing: 1px;
-  margin-left: 8px;
-}
-
-.site-subtitle {
-  color: #3e3d40;
-  font-size: 12px;
-  margin: 0 8px;
-}
-
-.site-subtitle a {
-  font-weight: bold;
-  color: #3e3d40;
-  transition: color 50ms;
-}
-
-.site-subtitle a:hover {
-  color: #0297f8;
-}
-
-.feedback {
-  background-color: #0297f8;
-  background-image: url('./feedback.svg');
-  background-position: 2px 4px;
-  background-repeat: no-repeat;
-  background-size: 18px;
-  border-radius: 3px;
-  border: 1px solid #0297f8;
-  box-shadow: 0 1px 2px rgba(0, 0, 0, 0.1);
-  color: #fff;
-  cursor: pointer;
-  display: block;
-  float: right;
-  font-size: 12px;
-  line-height: 12px;
-  opacity: 0.9;
-  padding: 5px;
-  overflow: hidden;
-  min-width: 12px;
-  max-width: 12px;
-  text-indent: 17px;
-  transition: all 250ms ease-in-out;
-  white-space: nowrap;
-}
-
-.feedback:hover,
-.feedback:focus {
-  min-width: 30px;
-  max-width: 300px;
-  text-indent: 2px;
-  padding: 5px 5px 5px 20px;
-  background-color: #0287e8;
-}
-
-.feedback:active {
-  background-color: #0277d8;
-}
-
-.all {
-  flex: 1;
-  display: flex;
-  flex-direction: column;
-  justify-content: flex-start;
-  max-width: 630px;
-  margin: 0 auto;
-  padding: 0 20px;
-  box-sizing: border-box;
-  width: 96%;
-}
-
-input,
-select,
-textarea,
-button {
-  font-family: inherit;
-}
-
-a {
-  text-decoration: none;
-}
-
-.btn {
-  font-weight: 500;
-}
-
-/**   page-one    **/
-
-.fadeOut {
-  opacity: 0;
-  animation: fadeout 200ms linear;
-}
-
-@keyframes fadeout {
-  0% {
-    opacity: 1;
-  }
-
-  100% {
-    opacity: 0;
-  }
-}
-
-.fadeIn {
-  opacity: 1;
-  animation: fadein 200ms linear;
-}
-
-@keyframes fadein {
-  0% {
-    opacity: 0;
-  }
-
-  100% {
-    opacity: 1;
-  }
-}
-
-.title {
-  font-size: 33px;
-  line-height: 40px;
-  margin: 20px auto;
-  text-align: center;
-  max-width: 520px;
-  font-family: 'SF Pro Text', sans-serif;
-  word-wrap: break-word;
-}
-
-.description {
-  font-size: 15px;
-  line-height: 23px;
-  max-width: 630px;
-  text-align: center;
-  margin: 0 auto 60px;
-  color: #0c0c0d;
-  width: 92%;
-}
-
-.upload-window {
-  border: 3px dashed rgba(0, 148, 251, 0.5);
-  margin: 0 auto;
-  height: 255px;
-  border-radius: 4px;
-  display: flex;
-  justify-content: center;
-  align-items: center;
-  flex-direction: column;
-  text-align: center;
-  transition: transform 150ms;
-  padding: 15px;
-}
-
-.upload-window.ondrag {
-  border: 5px dashed rgba(0, 148, 251, 0.5);
-  margin: 0 auto;
-  height: 251px;
-  transform: scale(1.04);
-  border-radius: 4.2px;
-  display: flex;
-  justify-content: center;
-  align-items: center;
-  flex-direction: column;
-  text-align: center;
-}
-
-.link {
-  color: #0094fb;
-  text-decoration: none;
-}
-
-.link:hover {
-  color: #0287e8;
-}
-
-#upload-text {
-  font-size: 22px;
-  color: #737373;
-  margin: 20px 0 10px;
-  font-family: 'SF Pro Text', sans-serif;
-}
-
-.browse {
-  background: #0297f8;
-  border-radius: 5px;
-  font-size: 20px;
-  color: #fff;
-  min-width: 240px;
-  height: 60px;
-  display: flex;
-  justify-content: center;
-  align-items: center;
-  cursor: pointer;
-  padding: 0 10px;
-}
-
-.browse:hover {
-  background-color: #0287e8;
-}
-
-input[type='file'] {
-  opacity: 0;
-  overflow: hidden;
-  position: absolute;
-  z-index: -1;
-}
-
-input[type='file'].has-focus + #browse,
-input[type='file']:focus + #browse {
-  background-color: #0287e8;
-  outline: 1px dotted #000;
-  outline: -webkit-focus-ring-color auto 5px;
-}
-
-#file-size-msg {
-  font-size: 12px;
-  line-height: 16px;
-  color: #737373;
-  margin-bottom: 22px;
-}
-
-/**   file-list   **/
-th {
-  font-size: 16px;
-  color: #858585;
-  font-weight: lighter;
-  text-align: left;
-  background: rgba(0, 148, 251, 0.05);
-  height: 40px;
-  border-top: 1px solid rgba(0, 148, 251, 0.1);
-  padding: 0 19px;
-  white-space: nowrap;
-}
-
-td {
-  font-size: 15px;
-  vertical-align: top;
-  color: #4a4a4a;
-  padding: 17px 19px 0;
-  line-height: 23px;
-  position: relative;
-}
-
-table {
-  border-collapse: collapse;
-  font-family: 'Segoe UI', 'SF Pro Text', sans-serif;
-}
-
-tbody {
-  word-wrap: break-word;
-  word-break: break-all;
-}
-
-#uploaded-files {
-  margin: 45.3px auto;
-  table-layout: fixed;
-}
-
-#uploaded-file {
-  width: 35%;
-}
-
-#copy-file-list {
-  width: 25%;
-}
-
-#expiry-file-list {
-  width: 21%;
-}
-
-#delete-file-list {
-  width: 12%;
-}
-
-.overflow-col {
-  text-overflow: ellipsis;
-  max-width: 0;
-  overflow: hidden;
-  white-space: nowrap;
-}
-
-.center-col {
-  text-align: center;
-}
-
-.icon-delete,
-.icon-copy,
-.icon-check {
-  cursor: pointer;
-}
-
-.icon-copy[disabled='disabled'] {
-  pointer-events: none;
-  opacity: 0.3;
-}
-
-.text-copied {
-  color: #0a8dff;
-}
-
-/* Popup container */
-.popup {
-  position: absolute;
-  display: inline-block;
-}
-
-/* The actual popup (appears on top) */
-.popup .popuptext {
-  visibility: hidden;
-  min-width: 204px;
-  min-height: 105px;
-  background-color: #fff;
-  color: #000;
-  border: 1px solid #d7d7db;
-  padding: 15px 24px;
-  box-sizing: content-box;
-  text-align: center;
-  border-radius: 5px;
-  position: absolute;
-  z-index: 1;
-  bottom: 20px;
-  left: -40px;
-  transition: opacity 0.5s;
-  opacity: 0;
-  outline: 0;
-  box-shadow: 3px 3px 7px rgba(136, 136, 136, 0.3);
-}
-
-/* Popup arrow */
-.popup .popuptext::after {
-  content: '';
-  position: absolute;
-  bottom: -11px;
-  left: 20px;
-  background-color: #fff;
-  display: block;
-  width: 20px;
-  height: 20px;
-  transform: rotate(45deg);
-  border-radius: 0 0 5px;
-  border-right: 1px solid #d7d7db;
-  border-bottom: 1px solid #d7d7db;
-}
-
-.popup .show {
-  visibility: visible;
-  opacity: 1;
-}
-
-.popup-message {
-  height: 40px;
-  display: flex;
-  justify-content: center;
-  align-items: center;
-  border-bottom: 1px #ebebeb solid;
-  color: #0c0c0d;
-  font-size: 15px;
-  font-weight: normal;
-  padding-bottom: 15px;
-  white-space: nowrap;
-  width: calc(100% + 48px);
-  margin-left: -24px;
-}
-
-.popup-action {
-  margin-top: 15px;
-  display: flex;
-  flex-direction: row;
-  align-items: center;
-  justify-content: space-between;
-}
-
-.popup-yes {
-  color: #fff;
-  background-color: #0297f8;
-  border-radius: 5px;
-  padding: 5px 25px;
-  font-weight: normal;
-  cursor: pointer;
-  min-width: 94px;
-  box-sizing: border-box;
-  white-space: nowrap;
-  margin-left: 12px;
-}
-
-.popup-yes:hover {
-  background-color: #0287e8;
-}
-
-.popup-no {
-  color: #4a4a4a;
-  background-color: #fbfbfb;
-  border: 1px #c1c1c1 solid;
-  border-radius: 5px;
-  padding: 5px 25px;
-  font-weight: normal;
-  min-width: 94px;
-  box-sizing: border-box;
-  cursor: pointer;
-  white-space: nowrap;
-}
-
-.popup-no:hover {
-  background-color: #efeff1;
-}
-
-/**   upload-progress   **/
-.progress-bar {
-  margin-top: 3px;
-  display: flex;
-  justify-content: center;
-  align-items: center;
-  text-align: center;
-  position: relative;
-}
-
-.percentage {
-  letter-spacing: -0.78px;
-  font-family: 'Segoe UI', 'SF Pro Text', sans-serif;
-  -moz-user-select: none;
-  -ms-user-select: none;
-  user-select: none;
-}
-
-.percent-number {
-  font-size: 43.2px;
-  line-height: 58px;
-}
-
-.percent-sign {
-  font-size: 28.8px;
-  stroke: none;
-  fill: #686868;
-}
-
-.upload {
-  margin: 0 auto;
-  display: flex;
-  justify-content: center;
-  align-items: center;
-  flex-direction: column;
-  text-align: center;
-  font-size: 15px;
-}
-
-.progress-text {
-  color: rgba(0, 0, 0, 0.5);
-  letter-spacing: -0.4px;
-  margin-top: 24px;
-  margin-bottom: 74px;
-}
-
-#cancel-upload {
-  color: #d70022;
-  background: #fff;
-  font-size: 15px;
-  border: 0;
-  cursor: pointer;
-  text-decoration: underline;
-}
-
-#cancel-upload:disabled {
-  text-decoration: none;
-  cursor: auto;
-}
-
-/**   share-link    **/
-#share-window {
-  margin: 0 auto;
-  display: flex;
-  justify-content: center;
-  align-items: center;
-  flex-direction: column;
-  width: 100%;
-  max-width: 640px;
-}
-
-#share-window-r > div {
-  font-size: 12px;
-  padding-bottom: 10px;
-}
-
-#copy {
-  display: flex;
-  flex-wrap: nowrap;
-  width: 100%;
-}
-
-#copy-text {
-  align-self: flex-start;
-  margin-top: 60px;
-  margin-bottom: 10px;
-  color: #0c0c0d;
-  max-width: 614px;
-  word-wrap: break-word;
-}
-
-#link {
-  flex: 1;
-  height: 56px;
-  border: 1px solid #0297f8;
-  border-radius: 6px 0 0 6px;
-  font-size: 20px;
-  color: #737373;
-  font-family: 'SF Pro Text', sans-serif;
-  letter-spacing: 0;
-  line-height: 23px;
-  font-weight: 300;
-  padding-left: 10px;
-  padding-right: 10px;
-}
-
-#link:disabled {
-  border: 1px solid #05a700;
-  background: #fff;
-}
-
-#copy-btn {
-  flex: 0 1 165px;
-  background: #0297f8;
-  border-radius: 0 6px 6px 0;
-  border: 1px solid #0297f8;
-  color: white;
-  cursor: pointer;
-  font-size: 15px;
-  height: 60px;
-  padding-left: 10px;
-  padding-right: 10px;
-  white-space: nowrap;
-}
-
-#copy-btn:hover {
-  background-color: #0287e8;
-}
-
-#copy-btn:disabled {
-  background: #05a700;
-  border: 1px solid #05a700;
-  cursor: auto;
-}
-
-#delete-file {
-  width: 176px;
-  height: 44px;
-  background: #fff;
-  border: 1px solid rgba(12, 12, 13, 0.3);
-  border-radius: 5px;
-  font-size: 15px;
-  margin-top: 50px;
-  margin-bottom: 12px;
-  cursor: pointer;
-  color: #313131;
-}
-
-#delete-file:hover {
-  background: #efeff1;
-}
-
-.send-new {
-  font-size: 15px;
-  margin: auto;
-  text-align: center;
-  color: #0094fb;
-  cursor: pointer;
-  text-decoration: underline;
-}
-
-.send-new:hover,
-.send-new:focus,
-.send-new:active {
-  color: #0287e8;
-}
-
-/*    upload-error    */
-#upload-error {
-  display: flex;
-  justify-content: center;
-  align-items: center;
-  flex-direction: column;
-  text-align: center;
-}
-
-#upload-error[hidden],
-#unsupported-browser[hidden] {
-  display: none;
-}
-
-#upload-error-img {
-  margin: 51px 0 71px;
-}
-
-/*    unsupported-browser   */
-#unsupported-browser {
-  display: flex;
-  justify-content: center;
-  align-items: center;
-  flex-direction: column;
-}
-
-.unsupported-description {
-  font-size: 13px;
-  line-height: 23px;
-  text-align: center;
-  color: #7d7d7d;
-  margin: 0 auto 23px;
-}
-
-.firefox-logo {
-  width: 70px;
-}
-
-#dl-firefox,
-#update-firefox {
-  margin-bottom: 181px;
-  height: 80px;
-  background: #98e02b;
-  border-radius: 3px;
-  cursor: pointer;
-  border: 0;
-  box-shadow: 0 5px 3px rgb(234, 234, 234);
-  font-family: 'Fira Sans';
-  font-weight: 500;
-  color: #fff;
-  font-size: 26px;
-  display: flex;
-  justify-content: center;
-  align-items: center;
-  line-height: 1;
-  padding: 0 25px;
-}
-
-.unsupported-button-text {
-  text-align: left;
-  margin-left: 20.4px;
-}
-
-.unsupported-button-text > span {
-  font-family: 'Fira Sans';
-  font-weight: 300;
-  font-size: 18px;
-  letter-spacing: -0.69px;
-}
-
-/**   download.html **/
-#download-btn {
-  font-size: 15px;
-  color: white;
-  width: 180px;
-  height: 44px;
-  margin-top: 20px;
-  margin-bottom: 30px;
-  text-align: center;
-  background: #0297f8;
-  border: 1px solid #0297f8;
-  border-radius: 5px;
-  cursor: pointer;
-}
-
-#download-btn:hover {
-  background-color: #0287e8;
-}
-
-#download-btn:disabled {
-  background: #47b04b;
-  cursor: auto;
-}
-
-#download {
-  margin: 0 auto;
-  display: flex;
-  justify-content: center;
-  align-items: center;
-  flex-direction: column;
-  text-align: center;
-}
-
-#expired-img {
-  margin: 51px 0 71px;
-}
-
-.expired-description {
-  font-size: 15px;
-  line-height: 23px;
-  text-align: center;
-  color: #7d7d7d;
-  margin: 0 auto 23px;
-}
-
-#download-progress {
-  width: 590px;
-}
-
-#download-progress[hidden] {
-  display: none;
-}
-
-#download-img {
-  width: 283px;
-  height: 196px;
-}
-
-/*    footer    */
-.footer {
-  right: 0;
-  bottom: 0;
-  left: 0;
-  font-size: 13px;
-  display: flex;
-  align-items: flex-end;
-  flex-direction: row;
-  justify-content: space-between;
-  padding: 50px 31px 41px;
-  width: 100%;
-  box-sizing: border-box;
-}
-
-.mozilla-logo {
-  width: 112px;
-  height: 32px;
-  margin-bottom: -5px;
-}
-
-.legal-links {
-  max-width: 81vw;
-  display: flex;
-  align-items: center;
-  flex-direction: row;
-}
-
-.legal-links > a {
-  color: #858585;
-  opacity: 0.9;
-  white-space: nowrap;
-  margin-right: 2vw;
-}
-
-.legal-links > a:hover {
-  opacity: 1;
-}
-
-.legal-links > a:visited {
-  color: #858585;
-}
-
-.social-links {
-  display: flex;
-  justify-content: space-between;
-  width: 94px;
-}
-
-.social-links > a {
-  opacity: 0.9;
-}
-
-.social-links > a:hover {
-  opacity: 1;
-}
-
-.github,
-.twitter {
-  width: 32px;
-  height: 32px;
-  margin-bottom: -5px;
-}
-
-@media (max-device-width: 992px), (max-width: 992px) {
-  .popup .popuptext {
-    left: auto;
-    right: -40px;
-  }
-
-  .popup .popuptext::after {
-    left: auto;
-    right: 36px;
-  }
-}
-
-@media (max-device-width: 768px), (max-width: 768px) {
-  .description {
-    margin: 0 auto 25px;
-  }
-
-  #copy {
-    width: 100%;
-  }
-
-  #link {
-    font-size: 18px;
-  }
-
-  .footer {
-    flex-direction: column;
-    justify-content: flex-start;
-    align-items: flex-start;
-    max-width: 630px;
-    margin: auto;
-  }
-
-  .mozilla-logo {
-    margin-left: -7px;
-  }
-
-  .legal-links {
-    flex-direction: column;
-    margin: auto;
-    width: 100%;
-    max-width: 100%;
-  }
-
-  .legal-links > * {
-    display: block;
-    padding: 10px 0;
-    align-self: flex-start;
-  }
-
-  .social-links {
-    margin-top: 20px;
-    align-self: flex-start;
-  }
-}
-
-@media (max-device-width: 520px), (max-width: 520px) {
-  .header {
-    flex-direction: column;
-    justify-content: flex-start;
-  }
-
-  .feedback {
-    margin-top: 10px;
-    min-width: 30px;
-    max-width: 300px;
-    text-indent: 2px;
-    padding: 5px 5px 5px 20px;
-  }
-
-  #copy {
-    width: 100%;
-    flex-direction: column;
-  }
-
-  #link {
-    font-size: 22px;
-    padding: 15px 10px;
-    border-radius: 6px 6px 0 0;
-  }
-
-  #copy-btn {
-    border-radius: 0 0 6px 6px;
-    flex: 0 1 65px;
-  }
-
-  th {
-    font-size: 14px;
-    padding: 0 5px;
-  }
-
-  td {
-    font-size: 13px;
-    padding: 17px 5px 0;
-  }
-}
--- a/assets/spinner.svg
+++ b/assets/spinner.svg
@@ -0,0 +1,17 @@
+<!-- By Sam Herbert (@sherb), for everyone. More @ http://goo.gl/7AJzbL -->
+<svg width="38" height="38" viewBox="0 0 38 38" xmlns="http://www.w3.org/2000/svg" stroke="#fff">
+    <g fill="none" fill-rule="evenodd">
+        <g transform="translate(1 1)" stroke-width="2">
+            <circle stroke-opacity=".5" cx="18" cy="18" r="18"/>
+            <path d="M36 18c0-9.94-8.06-18-18-18">
+                <animateTransform
+                    attributeName="transform"
+                    type="rotate"
+                    from="0 18 18"
+                    to="360 18 18"
+                    dur="1s"
+                    repeatCount="indefinite"/>
+            </path>
+        </g>
+    </g>
+</svg>
--- a/4
+++ b/4
@@ -1,5 +1,5 @@
 last 2 chrome versions
 last 2 firefox versions
+last 2 safari versions
+last 2 edge versions
 firefox esr
-ie >= 9
-safari >= 9
--- a/build/fluent_loader.js
+++ b/build/fluent_loader.js
@@ -1,38 +1,63 @@
-const { MessageContext } = require('fluent');
+// TODO: when node supports 'for await' we can remove babel-polyfill
+// and use 'fluent' instead of 'fluent/compat' (also below near line 42)
+require('babel-polyfill');
+const { MessageContext } = require('fluent/compat');
+const fs = require('fs');

 function toJSON(map) {
  return JSON.stringify(Array.from(map));
 }

+function merge(m1, m2) {
+  const result = new Map(m1);
+  for (const [k, v] of m2) {
+    result.set(k, v);
+  }
+  return result;
+}
+
 module.exports = function(source) {
  const localeExp = this.options.locale || /([^/]+)\/[^/]+\.ftl$/;
  const result = localeExp.exec(this.resourcePath);
  const locale = result && result[1];
-  // pre-parse the ftl
-  const context = new MessageContext(locale);
-  context.addMessages(source);
  if (!locale) {
    throw new Error(`couldn't find locale in: ${this.resourcePath}`);
  }
+  // load default language and "merge" contexts
+  // TODO: make this configurable
+  const en_ftl = fs.readFileSync(
+    require.resolve('../public/locales/en-US/send.ftl'),
+    'utf8'
+  );
+  const en = new MessageContext('en-US');
+  en.addMessages(en_ftl);
+  // pre-parse the ftl
+  const context = new MessageContext(locale);
+  context.addMessages(source);
+
+  const merged = merge(en._messages, context._messages);
  return `
 module.exports = \`
 if (typeof window === 'undefined') {
-  var fluent = require('fluent');
+  require('babel-polyfill');
+  var fluent = require('fluent/compat');
 }
-var ctx = new fluent.MessageContext('${locale}', {useIsolating: false});
-ctx._messages = new Map(${toJSON(context._messages)});
-function translate(id, data) {
-  var msg = ctx.getMessage(id);
-  if (typeof(msg) !== 'string' && !msg.val && msg.attrs) {
-    msg = msg.attrs.title || msg.attrs.alt
+(function () {
+  var ctx = new fluent.MessageContext('${locale}', {useIsolating: false});
+  ctx._messages = new Map(${toJSON(merged)});
+  function translate(id, data) {
+    var msg = ctx.getMessage(id);
+    if (typeof(msg) !== 'string' && !msg.val && msg.attrs) {
+      msg = msg.attrs.title || msg.attrs.alt
+    }
+    return ctx.format(msg, data);
  }
-  return ctx.format(msg, data);
-}
-if (typeof window === 'undefined') {
-  module.exports = translate;
-}
-else {
-  window.translate = translate;
-}
+  if (typeof window === 'undefined') {
+    module.exports = translate;
+  }
+  else {
+    window.translate = translate;
+  }
+})();
 \``;
 };
--- a/build/generate_asset_map.js
+++ b/build/generate_asset_map.js
@@ -1,3 +1,14 @@
+/*
+  This code is included by both the server and frontend via
+  common/assets.js
+
+  When included from the server the export will be the function.
+
+  When included from the frontend (via webpack) the export will
+  be an object mapping file names to hashed file names. Example:
+  "send_logo.svg": "send_logo.5fcfdf0e.svg"
+*/
+
 const fs = require('fs');
 const path = require('path');

@@ -14,6 +25,6 @@ module.exports = function() {
  return {
    code,
    dependencies: files.map(f => require.resolve('../assets/' + f)),
-    cacheable: false
+    cacheable: true
  };
 };
--- a/build/generate_l10n_map.js
+++ b/build/generate_l10n_map.js
@@ -1,3 +1,14 @@
+/*
+  This code is included by both the server and frontend via
+  common/locales.js
+
+  When included from the server the export will be the function.
+
+  When included from the frontend (via webpack) the export will
+  be an object mapping ftl files to js files. Example:
+  "public/locales/en-US/send.ftl":"public/locales/en-US/send.6b4f8354.js"
+*/
+
 const fs = require('fs');
 const path = require('path');

@@ -17,6 +28,6 @@ module.exports = function() {
    dependencies: dirs.map(d =>
      require.resolve(`../public/locales/${d}/send.ftl`)
    ),
-    cacheable: false
+    cacheable: true
  };
 };
--- a/build/readme.md
+++ b/build/readme.md
@@ -0,0 +1,26 @@
+# Custom Loaders
+
+## Fluent Loader
+
+The fluent loader "compiles" `.ftl` files into `.js` files directly usable by both the frontend and server for localization.
+
+## Generate Asset Map
+
+This loader enumerates all the files in `assets/` so that `common/assets.js` can provide mappings from the source filename to the hashed filename used on the site.
+
+## Generate L10N Map
+
+This loader enumerates all the ftl files in `public/locales` so that the fluent loader can create it's js files.
+
+## Package.json Loader
+
+This loader creates a `version.json` file that gets exposed by the `/__version__` route from the `package.json` file and current git commit hash.
+
+## Version Loader
+
+This loader substitutes the string "VERSION" for the version string specified in `package.json`. This is a workaround because `package.json` already uses the `package_json_loader`. See [app/templates/header/index.js](../app/templates/header/index.js) for more info.
+
+# See Also
+
+- [docs/build.md](../docs/build.md)
+- [webpack.config.js](../webpack.config.js)
--- a/build/version_loader.js
+++ b/build/version_loader.js
@@ -0,0 +1,5 @@
+const version = require('../package.json').version;
+
+module.exports = function(source) {
+  return source.replace('VERSION', version);
+};
--- a/circle.yml
+++ b/circle.yml
@@ -1,35 +1,136 @@
-machine:
-  node:
-    version: 8
-  services:
-    - docker
-    - redis
-  environment:
-    PATH: "/home/ubuntu/send/firefox:$PATH"
-
-dependencies:
-  pre:
-    - npm i -g get-firefox geckodriver nsp
-    - get-firefox --platform linux --extract --target /home/ubuntu/send
-
-deployment:
-  latest:
-    branch: master
-    commands:
-    - docker login -e $DOCKER_EMAIL -u $DOCKER_USER -p $DOCKER_PASS
-    - docker build -t mozilla/send:latest .
-    - docker push mozilla/send:latest
-  tags:
-    tag: /.*/
-    owner: mozilla
-    commands:
-    - docker login -e $DOCKER_EMAIL -u $DOCKER_USER -p $DOCKER_PASS
-    - docker build -t mozilla/send:$CIRCLE_TAG .
-    - docker push mozilla/send:$CIRCLE_TAG
-
-test:
-  override:
-    - npm run build
-    - npm run lint
-    - npm test
-    - nsp check
+version: 2.0
+jobs:
+  build:
+    docker:
+      - image: circleci/node:8
+    steps:
+      - checkout
+      - restore_cache:
+          key: send-{{ checksum "package-lock.json" }}
+      - run: npm install
+      - save_cache:
+          key: send-{{ checksum "package-lock.json" }}
+          paths:
+            - node_modules
+      - run: npm run build
+      - persist_to_workspace:
+          root: .
+          paths:
+            - ./dist
+  test:
+    docker:
+      - image: circleci/node:8-browsers
+    steps:
+      - checkout
+      - restore_cache:
+          key: send-{{ checksum "package-lock.json" }}
+      - run: npm install
+      - save_cache:
+          key: send-{{ checksum "package-lock.json" }}
+          paths:
+            - node_modules
+      - run: npm run check
+      - run: npm run lint
+      - run: npm run test
+      - store_artifacts:
+          path: coverage
+  integration_tests:
+    machine: true
+    steps:
+      - checkout
+      - attach_workspace:
+          at: .
+      - run:
+          name: Install Docker Compose
+          command: |
+            set -x
+            pip install docker-compose>=1.18
+            docker-compose --version
+      - run:
+          command: npm run test-integration
+      - store_artifacts:
+          path: coverage/send-test.html
+  deploy_dev:
+    machine: true
+    steps:
+      - checkout
+      - attach_workspace:
+          at: .
+      - run: docker login -u $DOCKER_USER -p $DOCKER_PASS
+      - run: docker build -t mozilla/send:latest .
+      - run: docker push mozilla/send:latest
+  deploy_stage:
+    machine: true
+    steps:
+      - checkout
+      - attach_workspace:
+          at: .
+      - run: docker login -u $DOCKER_USER -p $DOCKER_PASS
+      - run: docker build -t mozilla/send:$CIRCLE_TAG .
+      - run: docker push mozilla/send:$CIRCLE_TAG
+workflows:
+  version: 2
+  test_pr:
+    jobs:
+      - build:
+          filters:
+            branches:
+              ignore: master
+      - test:
+          filters:
+            branches:
+              ignore: master
+      - integration_tests:
+          filters:
+            branches:
+              ignore: master
+          requires:
+            - build
+  build_and_deploy_dev:
+    jobs:
+      - build:
+          filters:
+            branches:
+              only: master
+            tags:
+              ignore: /^v.*/
+      - deploy_dev:
+          requires:
+            - build
+          filters:
+            branches:
+              only: master
+            tags:
+              ignore: /^v.*/
+  build_and_deploy_stage:
+    jobs:
+      - build:
+          filters:
+            branches:
+              ignore: /.*/
+            tags:
+              only: /^v.*/
+      - test:
+          filters:
+            branches:
+              ignore: /.*/
+            tags:
+              only: /^v.*/
+      - integration_tests:
+          requires:
+            - build
+          filters:
+            branches:
+              ignore: /.*/
+            tags:
+              only: /^v.*/
+      - deploy_stage:
+          requires:
+            - build
+            - test
+            - integration_tests
+          filters:
+            branches:
+              ignore: /.*/
+            tags:
+              only: /^v.*/
--- a/common/locales.js
+++ b/common/locales.js
@@ -4,7 +4,7 @@ const isServer = typeof gen === 'function';
 const prefix = isServer ? '/' : '';
 let manifest = {};
 try {
-  //eslint-disable-next-line node/no-missing-require
+  // eslint-disable-next-line node/no-missing-require
  manifest = require('../dist/manifest.json');
 } catch (e) {
  // use middleware
@@ -17,6 +17,7 @@ function getLocale(name) {
 }

 function serverTranslator(name) {
+  // eslint-disable-next-line security/detect-non-literal-require
  return require(`../dist/${locales[`public/locales/${name}/send.ftl`]}`);
 }

--- a/common/readme.md
+++ b/common/readme.md
@@ -0,0 +1,3 @@
+# Common Code
+
+This directory contains code loaded by both the frontend `app` and backend `server`. The code here can be challenging to understand at first because the contexts for the two (three counting the dev server) environments that include them are quite different, but the purpose of these modules are quite simple, to provide mappings from the source assets (`copy-16.png`) to the concrete production assets (`copy-16.db66e0bf.svg`), similarly for localizations.
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -8,6 +8,19 @@ services:
      - "1443:1443"
    environment:
      - REDIS_HOST=redis
-      - NODE_ENV=production
  redis:
    image: redis:alpine
+  selenium:
+    image: b4handjr/selenium-firefox
+    ports:
+      - "${VNC_PORT:-5900}:5900"
+    shm_size: 2g
+  integration-tests:
+    build: ./test/integration
+    environment:
+      - BASE_URL=${BASE_URL:-http://web:1443}
+    links:
+      - web
+      - selenium
+    volumes:
+      - "./coverage:/coverage"
--- a/docs/build.md
+++ b/docs/build.md
@@ -0,0 +1,22 @@
+Send has two build configurations, development and production. Both can be run via `npm` scripts, `npm start` for development and `npm run build` for production. Webpack is our only build tool and all configuration lives in [webpack.config.js](../webpack.config.js).
+
+# Development
+
+`npm start` launches a `webpack-dev-server` on port 8080 that compiles the assets and watches files for changes. It also serves the backend API and frontend unit tests via the `server/dev.js` entrypoint. The frontend tests can be run in the browser by navigating to http://localhost:8080/test and will rerun automatically as the watched files are saved with changes.
+
+# Production
+
+`npm run build` compiles the assets and writes the files to the `dist/` directory. `npm run prod` launches an Express server on port 1443 that serves the backend API and frontend static assets from `dist/` via the `server/prod.js` entrypoint.
+
+# Notable differences
+
+- Development compiles assets in memory, so no `dist/` directory is generated
+- Development does not enable CSP headers
+- Development frontend source is instrumented for code coverage
+- Only development includes sourcemaps
+- Only development exposes the `/test` route
+- Production sets Cache-Control immutable headers on the hashed static assets
+
+# Custom Loaders
+
+The `build/` directory contains custom webpack loaders specific to Send. See [build/readme.md](../build/readme.md) for details on each loader.
--- a/docs/encryption.md
+++ b/docs/encryption.md
@@ -0,0 +1,46 @@
+# File Encryption
+
+Send use 128-bit AES-GCM encryption via the [Web Crypto API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API) to encrypt files in the browser before uploading them to the server. The code is in [app/keychain.js](../app/keychain.js).
+
+## Steps
+
+### Uploading
+
+1. A new secret key is generated with `crypto.getRandomValues`
+2. The secret key is used to derive 3 more keys via HKDF SHA-256
+    - an encryption key for the file (AES-GCM)
+    - an encryption key for the file metadata (AES-GCM)
+    - a signing key for request authentication (HMAC SHA-256)
+3. The file and metadata are encrypted with their corresponding keys
+4. The encrypted data and signing key are uploaded to the server
+5. An owner token and the share url are returned by the server and stored in local storage
+6. The secret key is appended to the share url as a [#fragment](https://en.wikipedia.org/wiki/Fragment_identifier) and presented to the UI
+
+### Downloading
+
+1. The browser loads the share url page, which includes an authentication nonce
+2. The browser imports the secret key from the url fragment
+3. The same 3 keys as above are derived
+4. The browser signs the nonce with it's signing key and requests the metadata
+5. The encrypted metadata is decrypted and presented on the page
+6. The browser makes another authenticated request to download the encrypted file
+7. The browser downloads and decrypts the file
+8. The file prompts the save dialog or automatically saves depending on the browser settings
+
+### Passwords
+
+A password may optionally be set to authenticate the download request. When a password is set the following steps occur.
+
+#### Sender
+
+1. The original signing key derived from the secret key is discarded
+2. A new signing key is generated via PBKDF2 from the user entered password and the full share url (including secret key fragment)
+3. The new key is sent to the server, authenticated by the owner token
+4. The server stores the new key and marks the record as needing a password
+
+#### Downloader
+
+1. The browser loads the share url page, which includes an authentication nonce and indicator that the file requires a password
+2. The user is prompted for the password and the signing key is derived
+3. The browser requests the metadata using the key to sign the nonce
+4. If the password was correct the metadata is returned, otherwise a 401
--- a/docs/experiments.md
+++ b/docs/experiments.md
@@ -0,0 +1,84 @@
+# A/B experiment testing
+
+We're using Google Analytics Experiments for A/B testing.
+
+## Creating an experiment
+
+Navigate to the Behavior > Experiments section of Google Analytics and click the "Create experiment" button.
+
+The "Objective for this experiment" is the most complicated part. See the "Promo click (Goal ID 4 / Goal Set 1)" for an example.
+
+In step 2 add as many variants as you plan to test. The urls are not important since we aren't using their js library to choose the variants. The name will show up in the report so choose good ones. "Original page" becomes variant 0 and each variant increments by one. We'll use the numbers in our `app/experiments.js` code.
+
+Step 3 contains some script that we'll ignore. The important thing here is the **Experiment ID**. This is the value we need to name our experiment in `app/experiments.js`. Save the changes so far and wait until the code containing the experiment has been deployed to production **before** starting the experiment.
+
+## Experiment code
+
+Code for experiments live in [app/experiments.js](../app/experiments.js). There's an `experiments` object that contains the logic for deciding whether an experiment should run, which variant to use, and what to do. Each object needs to have these functions:
+
+### `eligible` function
+
+This function returns a boolean of whether this experiment should be active for this session. Any data available to the page can be used determine the result.
+
+### `variant` function
+
+This function returns which experimental group this session is placed in. The variant values need to match the values set up in Google Analytics, usually 0 thru N-1. This value is usually picked at random based on what percentage of each variant is desired.
+
+### `run` function
+
+This function gets the `variant` value chosen by the variant function and the `state` and `emitter` objects from the app. This function can do anything needed to change the app based on the experiment. A common pattern is to set or change a value on `state` that will be picked up by other parts of the app, like ui templates, to change how it looks or behaves.
+
+### Example
+
+Here's a full example of the experiment object:
+
+```js
+const experiments = {
+  S9wqVl2SQ4ab2yZtqDI3Dw: { // The Experiment ID from Google Analytics
+    id: 'S9wqVl2SQ4ab2yZtqDI3Dw',
+    run: function(variant, state, emitter) {
+      switch (variant) {
+        case 1:
+          state.promo = 'blue';
+          break;
+        case 2:
+          state.promo = 'pink';
+          break;
+        default:
+          state.promo = 'grey';
+      }
+      emitter.emit('render');
+    },
+    eligible: function() {
+      return (
+        !/firefox|fxios/i.test(navigator.userAgent) &&
+        document.querySelector('html').lang === 'en-US'
+      );
+    },
+    variant: function(state) {
+      const n = this.luckyNumber(state);
+      if (n < 0.33) {
+        return 0;
+      }
+      return n < 0.66 ? 1 : 2;
+    },
+    luckyNumber: function(state) {
+      return luckyNumber(
+        `${this.id}:${state.storage.get('testpilot_ga__cid')}`
+      );
+    }
+  }
+};
+```
+
+## Reporting results
+
+All metrics pings will include the variant and experiment id, but it's usually important to trigger a specific event to be counted as the experiment goal (the "Objective for this experiment" part from setup). Use an 'experiment' event to do this. For example:
+
+```js
+emit('experiment', { cd3: 'promo' });
+```
+
+where `emit` is the app emitter function passed to the [route handler](https://github.com/choojs/choo#approuteroutename-handlerstate-emit)
+
+The second argument can be an object with any additional parameters. It  usually includes a custom dimension that we chose to filter on while creating the experiment in Google Analytics.
--- a/docs/faq.md
+++ b/docs/faq.md
@@ -31,12 +31,11 @@ Since Send is an open source project, you can see all of the cool ways we use Ja
 ## How long are files available for?

 Files are available to be downloaded for 24 hours, after which they are removed
-from the server.  They are also removed immediately after a download completes.
+from the server.  They are also removed immediately once the download limit is reached.

 ## Can a file be downloaded more than once?

-Not currently, but we're considering multiple download support in a future
-release.
+Yes, once a file is submitted to Send you can select the download limit.


 *Disclaimer: Send is an experiment and under active development.  The answers
--- a/docs/localization.md
+++ b/docs/localization.md
@@ -0,0 +1,29 @@
+# Localization
+
+Send is localized in over 50 languages. We use the [fluent](http://projectfluent.org/) library and store our translations in [FTL](http://projectfluent.org/fluent/guide/) files in `public/locales/`. `en-US` is our base language, and other languages are managed by [pontoon](https://pontoon.mozilla.org/projects/test-pilot-firefox-send/).
+
+## Process
+
+Strings are added or removed from [public/locales/en-US/send.ftl] as needed. Strings **MUST NOT** be *changed* after they've been commited and pushed to master. Changing a string requires creating a new ID with a new name (preferably descriptive instead of incremented) and deletion of the obsolete ID. It's often useful to add a comment above the string with info about how and where the string is used.
+
+Once new strings are commited to master they are available for translators in Pontoon. All languages other than `en-US` should be edited via Pontoon. Translations get automatically commited to the github master branch.
+
+### Activation
+
+The development environment includes all locales in `public/locales` via the `L10N_DEV` environment variable. Production uses `package.json` as the list of locales to use. Once a locale has enough string coverage it should be added to `package.json`.
+
+## Code
+
+In `app/` we use the `state.translate()` function to translate strings to the best matching language base on the user's `Accept-Language` header. It's a wrapper around fluent's [MessageContext.format](http://projectfluent.org/fluent.js/fluent/MessageContext.html). It works the same for both server and client side rendering.
+
+### Examples
+
+```js
+// simple string
+const finishedString = state.translate('downloadFinish')
+// with parameters
+const progressString = state.translate('downloadingPageProgress', {
+  filename: state.fileInfo.name,
+  size: bytes(state.fileInfo.size)
+})
+```
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20"><path fill="#0A84FF " d="M6 14a1 1 0 0 1-.707-.293l-3-3a1 1 0 0 1 1.414-1.414l2.157 2.157 6.316-9.023a1 1 0 0 1 1.639 1.146l-7 10a1 1 0 0 1-.732.427A.863.863 0 0 1 6 14z"/></svg>`