Backed out 13 changesets (bug 1296767) for xpcshell failures a=backout CLOSED TREE
authorWes Kocher <wkocher@mozilla.com>
Thu, 26 Jan 2017 11:16:12 -0800
changeset 467093 9eae58c7414b9830f2353315554c46bc5a9aa213
parent 467092 6ce0f2b0b8e7984f302e43f3dc1be2530d80ef59
child 467094 3219566164175783539ba1976267fbd3517bd70f
child 467198 76bd6b8d073b2c2544f9ff87e0008fa0d61b309a
push id43099
push userbmo:dmu@mozilla.com
push dateFri, 27 Jan 2017 03:55:32 +0000
reviewersbackout
bugs1296767
milestone54.0a1
backs out41ed7778833327295ade26481e8561c68c931a0e
1c0c9289b5327816345531b198e40a2592015319
50294db1d871add29d56833f7dd6db1f093a1d47
26c065f79c549002dd228d11b0dc0cdaf9c27ff1
0362a78d6978da79241c41f7722c8d4ecd2c3d6b
4e71cf94e4eec72a96c1cabdff6c71f0a13c72d3
f6f59447d22ae0ae830639d9905f9b407306e0cb
6c9b792cc296f878a43a2e5cee5e9176c134e318
46a52b10a86829c57f41d2cdbe26889e2bace192
5d70d87d2a8f7cff5a4598f55adcafe714fabb3f
8219686be6a27e549f91219439835ecad0d21282
0a989b0cea67e0ac35c95f27e06941357edbabf9
9f59a0b75c1f6286ef5b038bb25118e4f6645842
Backed out 13 changesets (bug 1296767) for xpcshell failures a=backout CLOSED TREE Backed out changeset 41ed77788333 (bug 1296767) Backed out changeset 1c0c9289b532 (bug 1296767) Backed out changeset 50294db1d871 (bug 1296767) Backed out changeset 26c065f79c54 (bug 1296767) Backed out changeset 0362a78d6978 (bug 1296767) Backed out changeset 4e71cf94e4ee (bug 1296767) Backed out changeset f6f59447d22a (bug 1296767) Backed out changeset 6c9b792cc296 (bug 1296767) Backed out changeset 46a52b10a868 (bug 1296767) Backed out changeset 5d70d87d2a8f (bug 1296767) Backed out changeset 8219686be6a2 (bug 1296767) Backed out changeset 0a989b0cea67 (bug 1296767) Backed out changeset 9f59a0b75c1f (bug 1296767) MozReview-Commit-ID: 2XBNsd8JrZL
b2g/installer/package-manifest.in
browser/base/content/aboutaccounts/aboutaccounts.js
browser/base/content/aboutaccounts/aboutaccounts.xhtml
browser/base/content/browser-fxaccounts.js
browser/base/content/browser-menubar.inc
browser/base/content/browser-syncui.js
browser/base/content/sync/addDevice.js
browser/base/content/sync/addDevice.xul
browser/base/content/sync/customize.css
browser/base/content/sync/customize.js
browser/base/content/sync/customize.xul
browser/base/content/sync/genericChange.js
browser/base/content/sync/genericChange.xul
browser/base/content/sync/key.xhtml
browser/base/content/sync/setup.js
browser/base/content/sync/setup.xul
browser/base/content/sync/utils.js
browser/base/content/test/general/browser.ini
browser/base/content/test/general/browser_fxa_migrate.js
browser/base/content/test/general/browser_fxaccounts.js
browser/base/jar.mn
browser/components/customizableui/content/panelUI.inc.xul
browser/components/preferences/in-content/sync.js
browser/components/preferences/in-content/sync.xul
browser/components/syncedtabs/SyncedTabsDeckComponent.js
browser/components/syncedtabs/test/xpcshell/test_SyncedTabsDeckComponent.js
browser/components/uitour/test/browser.ini
browser/components/uitour/test/browser_fxa.js
browser/installer/package-manifest.in
browser/locales/en-US/chrome/browser/aboutAccounts.dtd
browser/locales/en-US/chrome/browser/accounts.properties
browser/locales/en-US/chrome/browser/preferences/preferences.properties
browser/locales/en-US/chrome/browser/preferences/sync.dtd
browser/locales/en-US/chrome/browser/syncCustomize.dtd
browser/locales/en-US/chrome/browser/syncGenericChange.properties
browser/locales/en-US/chrome/browser/syncKey.dtd
browser/locales/en-US/chrome/browser/syncQuota.dtd
browser/locales/en-US/chrome/browser/syncQuota.properties
browser/locales/en-US/chrome/browser/syncSetup.dtd
browser/locales/en-US/chrome/browser/syncSetup.properties
browser/locales/jar.mn
browser/themes/linux/jar.mn
browser/themes/linux/preferences/preferences.css
browser/themes/linux/syncCommon.css
browser/themes/linux/syncQuota.css
browser/themes/linux/syncSetup.css
browser/themes/osx/jar.mn
browser/themes/osx/preferences/preferences.css
browser/themes/osx/syncCommon.css
browser/themes/osx/syncQuota.css
browser/themes/osx/syncSetup.css
browser/themes/shared/customizableui/panelUI.inc.css
browser/themes/shared/incontentprefs/preferences.inc.css
browser/themes/windows/jar.mn
browser/themes/windows/preferences/preferences.css
browser/themes/windows/syncCommon.css
browser/themes/windows/syncQuota.css
browser/themes/windows/syncSetup.css
mobile/android/installer/package-manifest.in
services/common/tests/unit/head_helpers.js
services/crypto/component/moz.build
services/crypto/component/nsISyncJPAKE.idl
services/crypto/component/nsSyncJPAKE.cpp
services/crypto/component/nsSyncJPAKE.h
services/crypto/component/tests/unit/test_jpake.js
services/crypto/component/tests/unit/xpcshell.ini
services/crypto/moz.build
services/fxaccounts/FxAccountsWebChannel.jsm
services/fxaccounts/tests/xpcshell/head.js
services/fxaccounts/tests/xpcshell/test_accounts.js
services/fxaccounts/tests/xpcshell/test_accounts_device_registration.js
services/fxaccounts/tests/xpcshell/test_loginmgr_storage.js
services/fxaccounts/tests/xpcshell/test_oauth_grant_client.js
services/fxaccounts/tests/xpcshell/test_push_service.js
services/fxaccounts/tests/xpcshell/test_storage_manager.js
services/fxaccounts/tests/xpcshell/test_web_channel.js
services/sync/Weave.js
services/sync/locales/en-US/sync.properties
services/sync/modules-testing/utils.js
services/sync/modules/FxaMigrator.jsm
services/sync/modules/browserid_identity.js
services/sync/modules/constants.js
services/sync/modules/engines.js
services/sync/modules/identity.js
services/sync/modules/jpakeclient.js
services/sync/modules/main.js
services/sync/modules/policies.js
services/sync/modules/rest.js
services/sync/modules/service.js
services/sync/modules/stages/cluster.js
services/sync/modules/status.js
services/sync/modules/userapi.js
services/sync/modules/util.js
services/sync/moz.build
services/sync/services-sync.js
services/sync/tests/unit/head_http_server.js
services/sync/tests/unit/test_bookmark_duping.js
services/sync/tests/unit/test_browserid_identity.js
services/sync/tests/unit/test_clients_engine.js
services/sync/tests/unit/test_collections_recovery.js
services/sync/tests/unit/test_corrupt_keys.js
services/sync/tests/unit/test_errorhandler_1.js
services/sync/tests/unit/test_errorhandler_2.js
services/sync/tests/unit/test_errorhandler_eol.js
services/sync/tests/unit/test_errorhandler_sync_checkServerError.js
services/sync/tests/unit/test_fxa_migration.js
services/sync/tests/unit/test_fxa_startOver.js
services/sync/tests/unit/test_history_engine.js
services/sync/tests/unit/test_hmac_error.js
services/sync/tests/unit/test_identity_manager.js
services/sync/tests/unit/test_interval_triggers.js
services/sync/tests/unit/test_jpakeclient.js
services/sync/tests/unit/test_keys.js
services/sync/tests/unit/test_load_modules.js
services/sync/tests/unit/test_node_reassignment.js
services/sync/tests/unit/test_records_wbo.js
services/sync/tests/unit/test_resource.js
services/sync/tests/unit/test_resource_async.js
services/sync/tests/unit/test_sendcredentials_controller.js
services/sync/tests/unit/test_service_attributes.js
services/sync/tests/unit/test_service_changePassword.js
services/sync/tests/unit/test_service_checkAccount.js
services/sync/tests/unit/test_service_cluster.js
services/sync/tests/unit/test_service_createAccount.js
services/sync/tests/unit/test_service_detect_upgrade.js
services/sync/tests/unit/test_service_getStorageInfo.js
services/sync/tests/unit/test_service_login.js
services/sync/tests/unit/test_service_passwordUTF8.js
services/sync/tests/unit/test_service_persistLogin.js
services/sync/tests/unit/test_service_set_serverURL.js
services/sync/tests/unit/test_service_startOver.js
services/sync/tests/unit/test_service_sync_remoteSetup.js
services/sync/tests/unit/test_service_verifyLogin.js
services/sync/tests/unit/test_service_wipeClient.js
services/sync/tests/unit/test_service_wipeServer.js
services/sync/tests/unit/test_status.js
services/sync/tests/unit/test_status_checkSetup.js
services/sync/tests/unit/test_syncedtabs.js
services/sync/tests/unit/test_syncengine_sync.js
services/sync/tests/unit/test_syncscheduler.js
services/sync/tests/unit/test_syncstoragerequest.js
services/sync/tests/unit/test_tab_engine.js
services/sync/tests/unit/test_telemetry.js
services/sync/tests/unit/test_upgrade_old_sync_key.js
services/sync/tests/unit/test_utils_passphrase.js
services/sync/tests/unit/xpcshell.ini
services/sync/tps/extensions/tps/resource/auth/sync.jsm
services/sync/tps/extensions/tps/resource/tps.jsm
toolkit/components/telemetry/TelemetryEnvironment.jsm
tools/lint/eslint/modules.json
--- a/b2g/installer/package-manifest.in
+++ b/b2g/installer/package-manifest.in
@@ -263,16 +263,17 @@
 #ifdef MOZ_GECKO_PROFILER
 @RESPATH@/components/profiler.xpt
 #endif
 @RESPATH@/components/proxyObject.xpt
 @RESPATH@/components/rdf.xpt
 @RESPATH@/components/satchel.xpt
 @RESPATH@/components/saxparser.xpt
 @RESPATH@/components/sessionstore.xpt
+@RESPATH@/components/services-crypto-component.xpt
 @RESPATH@/components/captivedetect.xpt
 @RESPATH@/components/shellservice.xpt
 @RESPATH@/components/shistory.xpt
 @RESPATH@/components/spellchecker.xpt
 @RESPATH@/components/storage.xpt
 @RESPATH@/components/telemetry.xpt
 @RESPATH@/components/toolkit_asyncshutdown.xpt
 @RESPATH@/components/toolkit_filewatcher.xpt
--- a/browser/base/content/aboutaccounts/aboutaccounts.js
+++ b/browser/base/content/aboutaccounts/aboutaccounts.js
@@ -11,16 +11,17 @@ Cu.import("resource://gre/modules/FxAcco
 
 var fxAccountsCommon = {};
 Cu.import("resource://gre/modules/FxAccountsCommon.js", fxAccountsCommon);
 
 // for master-password utilities
 Cu.import("resource://services-sync/util.js");
 
 const PREF_LAST_FXA_USER = "identity.fxaccounts.lastSignedInUserHash";
+const PREF_SYNC_SHOW_CUSTOMIZATION = "services.sync-setup.ui.showCustomizationDialog";
 
 const ACTION_URL_PARAM = "action";
 
 const OBSERVER_TOPICS = [
   fxAccountsCommon.ONVERIFIED_NOTIFICATION,
   fxAccountsCommon.ONLOGOUT_NOTIFICATION,
 ];
 
@@ -191,18 +192,19 @@ var wrapper = {
    * onLogin handler receives user credentials from the jelly after a
    * sucessful login and stores it in the fxaccounts service
    *
    * @param accountData the user's account data and credentials
    */
   onLogin(accountData) {
     log("Received: 'login'. Data:" + JSON.stringify(accountData));
 
-    // We don't act on customizeSync anymore, it used to open a dialog inside
-    // the browser to selecte the engines to sync but we do it on the web now.
+    if (accountData.customizeSync) {
+      Services.prefs.setBoolPref(PREF_SYNC_SHOW_CUSTOMIZATION, true);
+    }
     delete accountData.customizeSync;
     // sessionTokenContext is erroneously sent by the content server.
     // https://github.com/mozilla/fxa-content-server/issues/2766
     // To avoid having the FxA storage manager not knowing what to do with
     // it we delete it here.
     delete accountData.sessionTokenContext;
 
     // We need to confirm a relink - see shouldAllowRelink for more
@@ -299,16 +301,28 @@ var wrapper = {
       console.log("Failed to inject data", e);
       setErrorPage("configError");
     });
   },
 };
 
 
 // Button onclick handlers
+function handleOldSync() {
+  let chromeWin = window
+    .QueryInterface(Ci.nsIInterfaceRequestor)
+    .getInterface(Ci.nsIWebNavigation)
+    .QueryInterface(Ci.nsIDocShellTreeItem)
+    .rootTreeItem
+    .QueryInterface(Ci.nsIInterfaceRequestor)
+    .getInterface(Ci.nsIDOMWindow)
+    .QueryInterface(Ci.nsIDOMChromeWindow);
+  let url = Services.urlFormatter.formatURLPref("app.support.baseURL") + "old-sync";
+  chromeWin.switchToTabHavingURI(url, true);
+}
 
 function getStarted() {
   show("remote");
 }
 
 function retry() {
   show("remote");
   wrapper.retry();
@@ -486,17 +500,20 @@ function getDefaultProfilePath() {
 document.addEventListener("DOMContentLoaded", function() {
   init();
   var buttonGetStarted = document.getElementById("buttonGetStarted");
   buttonGetStarted.addEventListener("click", getStarted);
 
   var buttonRetry = document.getElementById("buttonRetry");
   buttonRetry.addEventListener("click", retry);
 
-  var buttonOpenPrefs = document.getElementById("buttonOpenPrefs");
+  var oldsync = document.getElementById("oldsync");
+  oldsync.addEventListener("click", handleOldSync);
+
+  var buttonOpenPrefs = document.getElementById("buttonOpenPrefs")
   buttonOpenPrefs.addEventListener("click", openPrefs);
 }, {capture: true, once: true});
 
 function initObservers() {
   function observe(subject, topic, data) {
     log("about:accounts observed " + topic);
     if (topic == fxAccountsCommon.ONLOGOUT_NOTIFICATION) {
       // All about:account windows get changed to action=signin on logout.
--- a/browser/base/content/aboutaccounts/aboutaccounts.xhtml
+++ b/browser/base/content/aboutaccounts/aboutaccounts.xhtml
@@ -58,16 +58,20 @@
         <section>
             <div class="graphic graphic-sync-intro"> </div>
 
             <div class="description">&aboutAccountsConfig.description;</div>
 
             <div class="button-row">
               <button id="buttonGetStarted" class="button" tabindex="1">&aboutAccountsConfig.startButton.label;</button>
             </div>
+
+            <div class="links">
+              <button id="oldsync" tabindex="2">&aboutAccountsConfig.useOldSync.label;</button>
+            </div>
         </section>
       </div>
 
       <div id="networkError">
         <header>
           <h1>&aboutAccounts.noConnection.title;</h1>
         </header>
 
--- a/browser/base/content/browser-fxaccounts.js
+++ b/browser/base/content/browser-fxaccounts.js
@@ -1,14 +1,16 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 var gFxAccounts = {
 
+  SYNC_MIGRATION_NOTIFICATION_TITLE: "fxa-migration",
+
   _initialized: false,
   _inCustomizationMode: false,
 
   get weave() {
     delete this.weave;
     return this.weave = Cc["@mozilla.org/weave/service;1"]
                           .getService(Ci.nsISupports)
                           .wrappedJSObject;
@@ -18,16 +20,17 @@ var gFxAccounts = {
     // Do all this dance to lazy-load FxAccountsCommon.
     delete this.topics;
     return this.topics = [
       "weave:service:ready",
       "weave:service:login:change",
       "weave:service:setup-complete",
       "weave:service:sync:error",
       "weave:ui:login:error",
+      "fxa-migration:state-changed",
       this.FxAccountsCommon.ONLOGIN_NOTIFICATION,
       this.FxAccountsCommon.ONLOGOUT_NOTIFICATION,
       this.FxAccountsCommon.ON_PROFILE_CHANGE_NOTIFICATION,
     ];
   },
 
   get panelUIFooter() {
     delete this.panelUIFooter;
@@ -135,37 +138,100 @@ var gFxAccounts = {
       Services.obs.removeObserver(this, topic);
     }
 
     this._initialized = false;
   },
 
   observe(subject, topic, data) {
     switch (topic) {
+      case "fxa-migration:state-changed":
+        this.onMigrationStateChanged(data, subject);
+        break;
       case this.FxAccountsCommon.ONPROFILE_IMAGE_CHANGE_NOTIFICATION:
         this.updateUI();
         break;
       default:
         this.updateUI();
         break;
     }
   },
 
+  onMigrationStateChanged() {
+    // Since we nuked most of the migration code, this notification will fire
+    // once after legacy Sync has been disconnected (and should never fire
+    // again)
+    let nb = window.document.getElementById("global-notificationbox");
+
+    let msg = this.strings.GetStringFromName("autoDisconnectDescription")
+    let signInLabel = this.strings.GetStringFromName("autoDisconnectSignIn.label");
+    let signInAccessKey = this.strings.GetStringFromName("autoDisconnectSignIn.accessKey");
+    let learnMoreLink = this.fxaMigrator.learnMoreLink;
+
+    let buttons = [
+      {
+        label: signInLabel,
+        accessKey: signInAccessKey,
+        callback: () => {
+          this.openPreferences();
+        }
+      }
+    ];
+
+    let fragment = document.createDocumentFragment();
+    let msgNode = document.createTextNode(msg);
+    fragment.appendChild(msgNode);
+    if (learnMoreLink) {
+      let link = document.createElement("label");
+      link.className = "text-link";
+      link.setAttribute("value", learnMoreLink.text);
+      link.href = learnMoreLink.href;
+      fragment.appendChild(link);
+    }
+
+    nb.appendNotification(fragment,
+                          this.SYNC_MIGRATION_NOTIFICATION_TITLE,
+                          undefined,
+                          nb.PRIORITY_WARNING_LOW,
+                          buttons);
+
+    // ensure the hamburger menu reflects the newly disconnected state.
+    this.updateAppMenuItem();
+  },
+
   handleEvent(event) {
     this._inCustomizationMode = event.type == "customizationstarting";
-    this.updateUI();
+    this.updateAppMenuItem();
   },
 
-  // Note that updateUI() returns a Promise that's only used by tests.
   updateUI() {
+    // It's possible someone signed in to FxA after seeing our notification
+    // about "Legacy Sync migration" (which now is actually "Legacy Sync
+    // auto-disconnect") so kill that notification if it still exists.
+    let nb = window.document.getElementById("global-notificationbox");
+    let n = nb.getNotificationWithValue(this.SYNC_MIGRATION_NOTIFICATION_TITLE);
+    if (n) {
+      nb.removeNotification(n, true);
+    }
+
+    this.updateAppMenuItem();
+  },
+
+  // Note that updateAppMenuItem() returns a Promise that's only used by tests.
+  updateAppMenuItem() {
     let profileInfoEnabled = false;
     try {
       profileInfoEnabled = Services.prefs.getBoolPref("identity.fxaccounts.profile_image.enabled");
     } catch (e) { }
 
+    // Bail out if FxA is disabled.
+    if (!this.weave.fxAccountsEnabled) {
+      return Promise.resolve();
+    }
+
     this.panelUIFooter.hidden = false;
 
     // Make sure the button is disabled in customization mode.
     if (this._inCustomizationMode) {
       this.panelUIStatus.setAttribute("disabled", "true");
       this.panelUILabel.setAttribute("disabled", "true");
       this.panelUIAvatar.setAttribute("disabled", "true");
       this.panelUIIcon.setAttribute("disabled", "true");
@@ -406,10 +472,13 @@ var gFxAccounts = {
     .forEach(id => contextMenu.showItem(id, showSendLink));
   }
 };
 
 XPCOMUtils.defineLazyGetter(gFxAccounts, "FxAccountsCommon", function() {
   return Cu.import("resource://gre/modules/FxAccountsCommon.js", {});
 });
 
+XPCOMUtils.defineLazyModuleGetter(gFxAccounts, "fxaMigrator",
+  "resource://services-sync/FxaMigrator.jsm");
+
 XPCOMUtils.defineLazyModuleGetter(this, "EnsureFxAccountsWebChannel",
   "resource://gre/modules/FxAccountsWebChannel.jsm");
--- a/browser/base/content/browser-menubar.inc
+++ b/browser/base/content/browser-menubar.inc
@@ -491,17 +491,17 @@
                         key="key_openAddons"
                         command="Tools:Addons"/>
 
               <!-- only one of sync-setup, sync-syncnowitem or sync-reauthitem will be showing at once -->
               <menuitem id="sync-setup"
                         label="&syncSignIn.label;"
                         accesskey="&syncSignIn.accesskey;"
                         observes="sync-setup-state"
-                        oncommand="gSyncUI.openPrefs('menubar')"/>
+                        oncommand="gSyncUI.openSetup(null, 'menubar')"/>
               <menuitem id="sync-syncnowitem"
                         label="&syncSyncNowItem.label;"
                         accesskey="&syncSyncNowItem.accesskey;"
                         observes="sync-syncnow-state"
                         oncommand="gSyncUI.doSync(event);"/>
               <menuitem id="sync-reauthitem"
                         label="&syncReAuthItem.label;"
                         accesskey="&syncReAuthItem.accesskey;"
--- a/browser/base/content/browser-syncui.js
+++ b/browser/base/content/browser-syncui.js
@@ -92,32 +92,51 @@ var gSyncUI = {
 
     this.updateUI();
   },
 
 
   // Returns a promise that resolves with true if Sync needs to be configured,
   // false otherwise.
   _needsSetup() {
-    return fxAccounts.getSignedInUser().then(user => {
-      // We want to treat "account needs verification" as "needs setup".
-      return !(user && user.verified);
-    });
+    // If Sync is configured for FxAccounts then we do that promise-dance.
+    if (this.weaveService.fxAccountsEnabled) {
+      return fxAccounts.getSignedInUser().then(user => {
+        // We want to treat "account needs verification" as "needs setup".
+        return !(user && user.verified);
+      });
+    }
+    // We are using legacy sync - check that.
+    let firstSync = "";
+    try {
+      firstSync = Services.prefs.getCharPref("services.sync.firstSync");
+    } catch (e) { }
+
+    return Promise.resolve(Weave.Status.checkSetup() == Weave.CLIENT_NOT_CONFIGURED ||
+                           firstSync == "notReady");
   },
 
   // Returns a promise that resolves with true if the user currently signed in
   // to Sync needs to be verified, false otherwise.
   _needsVerification() {
-    return fxAccounts.getSignedInUser().then(user => {
-      // If there is no user, they can't be in a "needs verification" state.
-      if (!user) {
-        return false;
-      }
-      return !user.verified;
-    });
+    // For callers who care about the distinction between "needs setup" and
+    // "needs verification"
+    if (this.weaveService.fxAccountsEnabled) {
+      return fxAccounts.getSignedInUser().then(user => {
+        // If there is no user, they can't be in a "needs verification" state.
+        if (!user) {
+          return false;
+        }
+        return !user.verified;
+      });
+    }
+
+    // Otherwise we are configured for legacy Sync, which has no verification
+    // concept.
+    return Promise.resolve(false);
   },
 
   // Note that we don't show login errors in a notification bar here, but do
   // still need to track a login-failed state so the "Tools" menu updates
   // with the correct state.
   loginFailed() {
     // If Sync isn't already ready, we don't want to force it to initialize
     // by referencing Weave.Status - and it isn't going to be accurate before
@@ -243,32 +262,66 @@ var gSyncUI = {
   },
 
   // Handle clicking the toolbar button - which either opens the Sync setup
   // pages or forces a sync now. Does *not* return a promise as it is called
   // via the UI.
   handleToolbarButton() {
     this._needsSetup().then(needsSetup => {
       if (needsSetup || this.loginFailed()) {
-        this.openPrefs();
+        this.openSetup();
       } else {
         this.doSync();
       }
     }).catch(err => {
       this.log.error("Failed to handle toolbar button command", err);
     });
   },
 
   /**
-   * Open the Sync preferences.
+   * Invoke the Sync setup wizard.
    *
+   * @param wizardType
+   *        Indicates type of wizard to launch:
+   *          null    -- regular set up wizard
+   *          "pair"  -- pair a device first
+   *          "reset" -- reset sync
    * @param entryPoint
    *        Indicates the entrypoint from where this method was called.
    */
-  openPrefs(entryPoint = "syncbutton") {
+
+  openSetup: function SUI_openSetup(wizardType, entryPoint = "syncbutton") {
+    if (this.weaveService.fxAccountsEnabled) {
+      this.openPrefs(entryPoint);
+    } else {
+      let win = Services.wm.getMostRecentWindow("Weave:AccountSetup");
+      if (win)
+        win.focus();
+      else {
+        window.openDialog("chrome://browser/content/sync/setup.xul",
+                          "weaveSetup", "centerscreen,chrome,resizable=no",
+                          wizardType);
+      }
+    }
+  },
+
+  // Open the legacy-sync device pairing UI. Note used for FxA Sync.
+  openAddDevice() {
+    if (!Weave.Utils.ensureMPUnlocked())
+      return;
+
+    let win = Services.wm.getMostRecentWindow("Sync:AddDevice");
+    if (win)
+      win.focus();
+    else
+      window.openDialog("chrome://browser/content/sync/addDevice.xul",
+                        "syncAddDevice", "centerscreen,chrome,resizable=no");
+  },
+
+  openPrefs(entryPoint) {
     openPreferences("paneSync", { urlParams: { entrypoint: entryPoint } });
   },
 
   openSignInAgainPage(entryPoint = "syncbutton") {
     gFxAccounts.openSignInAgainPage(entryPoint);
   },
 
   openSyncedTabsPanel() {
@@ -316,20 +369,19 @@ var gSyncUI = {
      otherwise the tooltip reflects the fact that Sync needs to be
      (re-)configured.
   */
   _updateSyncButtonsTooltip: Task.async(function* () {
     if (!gBrowser)
       return;
 
     let email;
-    let user = yield fxAccounts.getSignedInUser();
-    if (user) {
-      email = user.email;
-    }
+    try {
+      email = Services.prefs.getCharPref("services.sync.username");
+    } catch (ex) {}
 
     let needsSetup = yield this._needsSetup();
     let needsVerification = yield this._needsVerification();
     let loginFailed = this.loginFailed();
     // This is a little messy as the Sync buttons are 1/2 Sync related and
     // 1/2 FxA related - so for some strings we use Sync strings, but for
     // others we reach into gFxAccounts for strings.
     let tooltiptext;
new file mode 100644
--- /dev/null
+++ b/browser/base/content/sync/addDevice.js
@@ -0,0 +1,157 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+var Ci = Components.interfaces;
+var Cc = Components.classes;
+var Cu = Components.utils;
+
+Cu.import("resource://services-sync/main.js");
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+
+const PIN_PART_LENGTH = 4;
+
+const ADD_DEVICE_PAGE       = 0;
+const SYNC_KEY_PAGE         = 1;
+const DEVICE_CONNECTED_PAGE = 2;
+
+var gSyncAddDevice = {
+
+  init: function init() {
+    this.pin1.setAttribute("maxlength", PIN_PART_LENGTH);
+    this.pin2.setAttribute("maxlength", PIN_PART_LENGTH);
+    this.pin3.setAttribute("maxlength", PIN_PART_LENGTH);
+
+    this.nextFocusEl = {pin1: this.pin2,
+                        pin2: this.pin3,
+                        pin3: this.wizard.getButton("next")};
+
+    this.throbber = document.getElementById("pairDeviceThrobber");
+    this.errorRow = document.getElementById("errorRow");
+
+    // Kick off a sync. That way the server will have the most recent data from
+    // this computer and it will show up immediately on the new device.
+    Weave.Service.scheduler.scheduleNextSync(0);
+  },
+
+  onPageShow: function onPageShow() {
+    this.wizard.getButton("back").hidden = true;
+
+    switch (this.wizard.pageIndex) {
+      case ADD_DEVICE_PAGE:
+        this.onTextBoxInput();
+        this.wizard.canRewind = false;
+        this.wizard.getButton("next").hidden = false;
+        this.pin1.focus();
+        break;
+      case SYNC_KEY_PAGE:
+        this.wizard.canAdvance = false;
+        this.wizard.canRewind = true;
+        this.wizard.getButton("back").hidden = false;
+        this.wizard.getButton("next").hidden = true;
+        document.getElementById("weavePassphrase").value =
+          Weave.Utils.hyphenatePassphrase(Weave.Service.identity.syncKey);
+        break;
+      case DEVICE_CONNECTED_PAGE:
+        this.wizard.canAdvance = true;
+        this.wizard.canRewind = false;
+        this.wizard.getButton("cancel").hidden = true;
+        break;
+    }
+  },
+
+  onWizardAdvance: function onWizardAdvance() {
+    switch (this.wizard.pageIndex) {
+      case ADD_DEVICE_PAGE:
+        this.startTransfer();
+        return false;
+      case DEVICE_CONNECTED_PAGE:
+        window.close();
+        return false;
+    }
+    return true;
+  },
+
+  startTransfer: function startTransfer() {
+    this.errorRow.hidden = true;
+    // When onAbort is called, Weave may already be gone.
+    const JPAKE_ERROR_USERABORT = Weave.JPAKE_ERROR_USERABORT;
+
+    let self = this;
+    let jpakeclient = this._jpakeclient = new Weave.JPAKEClient({
+      onPaired: function onPaired() {
+        let credentials = {account:   Weave.Service.identity.account,
+                           password:  Weave.Service.identity.basicPassword,
+                           synckey:   Weave.Service.identity.syncKey,
+                           serverURL: Weave.Service.serverURL};
+        jpakeclient.sendAndComplete(credentials);
+      },
+      onComplete: function onComplete() {
+        delete self._jpakeclient;
+        self.wizard.pageIndex = DEVICE_CONNECTED_PAGE;
+
+        // Schedule a Sync for soonish to fetch the data uploaded by the
+        // device with which we just paired.
+        Weave.Service.scheduler.scheduleNextSync(Weave.Service.scheduler.activeInterval);
+      },
+      onAbort: function onAbort(error) {
+        delete self._jpakeclient;
+
+        // Aborted by user, ignore.
+        if (error == JPAKE_ERROR_USERABORT) {
+          return;
+        }
+
+        self.errorRow.hidden = false;
+        self.throbber.hidden = true;
+        self.pin1.value = self.pin2.value = self.pin3.value = "";
+        self.pin1.disabled = self.pin2.disabled = self.pin3.disabled = false;
+        self.pin1.focus();
+      }
+    });
+    this.throbber.hidden = false;
+    this.pin1.disabled = this.pin2.disabled = this.pin3.disabled = true;
+    this.wizard.canAdvance = false;
+
+    let pin = this.pin1.value + this.pin2.value + this.pin3.value;
+    let expectDelay = false;
+    jpakeclient.pairWithPIN(pin, expectDelay);
+  },
+
+  onWizardBack: function onWizardBack() {
+    if (this.wizard.pageIndex != SYNC_KEY_PAGE)
+      return true;
+
+    this.wizard.pageIndex = ADD_DEVICE_PAGE;
+    return false;
+  },
+
+  onWizardCancel: function onWizardCancel() {
+    if (this._jpakeclient) {
+      this._jpakeclient.abort();
+      delete this._jpakeclient;
+    }
+    return true;
+  },
+
+  onTextBoxInput: function onTextBoxInput(textbox) {
+    if (textbox && textbox.value.length == PIN_PART_LENGTH)
+      this.nextFocusEl[textbox.id].focus();
+
+    this.wizard.canAdvance = (this.pin1.value.length == PIN_PART_LENGTH
+                              && this.pin2.value.length == PIN_PART_LENGTH
+                              && this.pin3.value.length == PIN_PART_LENGTH);
+  },
+
+  goToSyncKeyPage: function goToSyncKeyPage() {
+    this.wizard.pageIndex = SYNC_KEY_PAGE;
+  }
+
+};
+// onWizardAdvance() and onPageShow() are run before init() so we'll set
+// these up as lazy getters.
+["wizard", "pin1", "pin2", "pin3"].forEach(function(id) {
+  XPCOMUtils.defineLazyGetter(gSyncAddDevice, id, function() {
+    return document.getElementById(id);
+  });
+});
new file mode 100644
--- /dev/null
+++ b/browser/base/content/sync/addDevice.xul
@@ -0,0 +1,129 @@
+<?xml version="1.0"?>
+
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<?xml-stylesheet href="chrome://browser/skin/syncSetup.css" type="text/css"?>
+<?xml-stylesheet href="chrome://browser/skin/syncCommon.css" type="text/css"?>
+
+<!DOCTYPE window [
+<!ENTITY % brandDTD SYSTEM "chrome://branding/locale/brand.dtd">
+<!ENTITY % syncBrandDTD SYSTEM "chrome://browser/locale/syncBrand.dtd">
+<!ENTITY % syncSetupDTD SYSTEM "chrome://browser/locale/syncSetup.dtd">
+%brandDTD;
+%syncBrandDTD;
+%syncSetupDTD;
+]>
+<wizard xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        xmlns:html="http://www.w3.org/1999/xhtml"
+        id="wizard"
+        title="&pairDevice.title.label;"
+        windowtype="Sync:AddDevice"
+        persist="screenX screenY"
+        onwizardnext="return gSyncAddDevice.onWizardAdvance();"
+        onwizardback="return gSyncAddDevice.onWizardBack();"
+        onwizardcancel="gSyncAddDevice.onWizardCancel();"
+        onload="gSyncAddDevice.init();">
+
+  <script type="application/javascript"
+          src="chrome://browser/content/sync/addDevice.js"/>
+  <script type="application/javascript"
+          src="chrome://browser/content/sync/utils.js"/>
+  <script type="application/javascript"
+          src="chrome://browser/content/utilityOverlay.js"/>
+  <script type="application/javascript"
+          src="chrome://global/content/printUtils.js"/>
+
+  <wizardpage id="addDevicePage"
+              label="&pairDevice.title.label;"
+              onpageshow="gSyncAddDevice.onPageShow();">
+    <description>
+      &pairDevice.dialog.description.label;
+      <label class="text-link"
+             value="&addDevice.showMeHow.label;"
+             href="https://services.mozilla.com/sync/help/add-device"/>
+    </description>
+    <separator class="groove-thin"/>
+    <description>
+      &addDevice.dialog.enterCode.label;
+    </description>
+    <separator class="groove-thin"/>
+    <vbox align="center">
+      <textbox id="pin1"
+               class="pin"
+               oninput="gSyncAddDevice.onTextBoxInput(this);"
+               onfocus="this.select();"
+               />
+      <textbox id="pin2"
+               class="pin"
+               oninput="gSyncAddDevice.onTextBoxInput(this);"
+               onfocus="this.select();"
+               />
+      <textbox id="pin3"
+               class="pin"
+               oninput="gSyncAddDevice.onTextBoxInput(this);"
+               onfocus="this.select();" 
+              />
+    </vbox>
+    <separator class="groove-thin"/>
+    <vbox id="pairDeviceThrobber" align="center" hidden="true">
+      <image/>
+    </vbox>
+    <hbox id="errorRow" pack="center" hidden="true">
+      <image class="statusIcon" status="error"/>
+      <label class="status"
+             value="&addDevice.dialog.tryAgain.label;"/>
+    </hbox>
+    <spacer flex="3"/>
+    <label class="text-link"
+           value="&addDevice.dontHaveDevice.label;"
+           onclick="gSyncAddDevice.goToSyncKeyPage();"/>
+  </wizardpage>
+
+  <!-- Need a non-empty label here, otherwise we get a default label on Mac -->
+  <wizardpage id="syncKeyPage"
+              label=" "
+              onpageshow="gSyncAddDevice.onPageShow();">
+    <description>
+      &addDevice.dialog.recoveryKey.label;
+    </description>
+    <spacer/>
+
+    <groupbox>
+      <label value="&recoveryKeyEntry.label;"
+             accesskey="&recoveryKeyEntry.accesskey;"
+             control="weavePassphrase"/>
+      <textbox id="weavePassphrase"
+               readonly="true"/>
+    </groupbox>
+
+    <groupbox align="center">
+      <description>&recoveryKeyBackup.description;</description>
+      <hbox>
+        <button id="printSyncKeyButton"
+                label="&button.syncKeyBackup.print.label;"
+                accesskey="&button.syncKeyBackup.print.accesskey;"
+                oncommand="gSyncUtils.passphrasePrint('weavePassphrase');"/>
+        <button id="saveSyncKeyButton"
+                label="&button.syncKeyBackup.save.label;"
+                accesskey="&button.syncKeyBackup.save.accesskey;"
+                oncommand="gSyncUtils.passphraseSave('weavePassphrase');"/>
+      </hbox>
+    </groupbox>
+  </wizardpage>
+
+  <wizardpage id="deviceConnectedPage"
+              label="&addDevice.dialog.connected.label;"
+              onpageshow="gSyncAddDevice.onPageShow();">
+    <vbox align="center">
+      <image id="successPageIcon"/>
+    </vbox>
+    <separator/>
+    <description class="normal">
+      &addDevice.dialog.successful.label;
+    </description>
+  </wizardpage>
+
+</wizard>
new file mode 100644
--- /dev/null
+++ b/browser/base/content/sync/customize.css
@@ -0,0 +1,28 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+:root {
+  font-size: 80%;
+}
+
+#sync-customize-pane {
+  padding-inline-start: 74px;
+  background: top left url(chrome://browser/skin/sync-128.png) no-repeat;
+  background-size: 64px;
+}
+
+#sync-customize-title {
+  margin-inline-start: 0;
+  padding-bottom: 0.5em;
+  font-weight: bold;
+}
+
+#sync-customize-subtitle {
+  font-size: 90%;
+}
+
+checkbox {
+  margin: 0;
+  padding: 0.5em 0 0;
+}
new file mode 100644
--- /dev/null
+++ b/browser/base/content/sync/customize.js
@@ -0,0 +1,25 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+Components.utils.import("resource://gre/modules/Services.jsm");
+
+addEventListener("dialogaccept", function() {
+  let pane = document.getElementById("sync-customize-pane");
+  // First determine what the preference for the "global" sync enabled pref
+  // should be based on the engines selected.
+  let prefElts = pane.querySelectorAll("preferences > preference");
+  let syncEnabled = false;
+  for (let elt of prefElts) {
+    if (elt.name.startsWith("services.sync.") && elt.value) {
+      syncEnabled = true;
+      break;
+    }
+  }
+  Services.prefs.setBoolPref("services.sync.enabled", syncEnabled);
+  // and write the individual prefs.
+  pane.writePreferences(true);
+  window.arguments[0].accepted = true;
+});
new file mode 100644
--- /dev/null
+++ b/browser/base/content/sync/customize.xul
@@ -0,0 +1,67 @@
+<?xml version="1.0"?>
+
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<?xml-stylesheet href="chrome://browser/content/sync/customize.css" type="text/css"?>
+
+<!DOCTYPE dialog [
+<!ENTITY % syncCustomizeDTD SYSTEM "chrome://browser/locale/syncCustomize.dtd">
+%syncCustomizeDTD;
+]>
+<dialog id="sync-customize"
+        windowtype="Sync:Customize"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        xmlns:html="http://www.w3.org/1999/xhtml"
+        title="&syncCustomize.dialog.title;"
+        buttonlabelaccept="&syncCustomize.acceptButton.label;"
+        buttons="accept">
+
+  <prefpane id="sync-customize-pane">
+    <preferences>
+      <preference id="engine.bookmarks" name="services.sync.engine.bookmarks" type="bool"/>
+      <preference id="engine.history"   name="services.sync.engine.history"   type="bool"/>
+      <preference id="engine.tabs"      name="services.sync.engine.tabs"      type="bool"/>
+      <preference id="engine.passwords" name="services.sync.engine.passwords" type="bool"/>
+      <preference id="engine.addons"    name="services.sync.engine.addons"    type="bool"/>
+      <preference id="engine.prefs"     name="services.sync.engine.prefs"     type="bool"/>
+    </preferences>
+
+    <label id="sync-customize-title" value="&syncCustomize.title;"/>
+    <description id="sync-customize-subtitle"
+#ifdef XP_UNIX
+                 value="&syncCustomizeUnix.description;"
+#else
+                 value="&syncCustomize.description;"
+#endif
+                 />
+
+  <vbox align="start">
+      <checkbox label="&engine.tabs.label2;"
+                accesskey="&engine.tabs.accesskey;"
+                preference="engine.tabs"/>
+      <checkbox label="&engine.bookmarks.label;"
+                accesskey="&engine.bookmarks.accesskey;"
+                preference="engine.bookmarks"/>
+      <checkbox label="&engine.passwords.label;"
+                accesskey="&engine.passwords.accesskey;"
+                preference="engine.passwords"/>
+      <checkbox label="&engine.history.label;"
+                accesskey="&engine.history.accesskey;"
+                preference="engine.history"/>
+      <checkbox label="&engine.addons.label;"
+                accesskey="&engine.addons.accesskey;"
+                preference="engine.addons"/>
+      <checkbox label="&engine.prefs.label;"
+                accesskey="&engine.prefs.accesskey;"
+                preference="engine.prefs"/>
+  </vbox>
+
+  </prefpane>
+
+  <script type="application/javascript"
+          src="chrome://browser/content/sync/customize.js" />
+
+</dialog>
new file mode 100644
--- /dev/null
+++ b/browser/base/content/sync/genericChange.js
@@ -0,0 +1,226 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+var Ci = Components.interfaces;
+var Cc = Components.classes;
+
+Components.utils.import("resource://services-sync/main.js");
+Components.utils.import("resource://gre/modules/Services.jsm");
+
+var Change = {
+  _dialog: null,
+  _dialogType: null,
+  _status: null,
+  _statusIcon: null,
+  _firstBox: null,
+  _secondBox: null,
+
+  get _passphraseBox() {
+    delete this._passphraseBox;
+    return this._passphraseBox = document.getElementById("passphraseBox");
+  },
+
+  get _currentPasswordInvalid() {
+    return Weave.Status.login == Weave.LOGIN_FAILED_LOGIN_REJECTED;
+  },
+
+  get _updatingPassphrase() {
+    return this._dialogType == "UpdatePassphrase";
+  },
+
+  onLoad: function Change_onLoad() {
+    /* Load labels */
+    let introText = document.getElementById("introText");
+    let warningText = document.getElementById("warningText");
+
+    // load some other elements & info from the window
+    this._dialog = document.getElementById("change-dialog");
+    this._dialogType = window.arguments[0];
+    this._duringSetup = window.arguments[1];
+    this._status = document.getElementById("status");
+    this._statusIcon = document.getElementById("statusIcon");
+    this._statusRow = document.getElementById("statusRow");
+    this._firstBox = document.getElementById("textBox1");
+    this._secondBox = document.getElementById("textBox2");
+
+    this._dialog.getButton("finish").disabled = true;
+    this._dialog.getButton("back").hidden = true;
+
+    this._stringBundle =
+      Services.strings.createBundle("chrome://browser/locale/syncGenericChange.properties");
+
+    switch (this._dialogType) {
+      case "UpdatePassphrase":
+      case "ResetPassphrase":
+        document.getElementById("textBox1Row").hidden = true;
+        document.getElementById("textBox2Row").hidden = true;
+        document.getElementById("passphraseLabel").value
+          = this._str("new.recoverykey.label");
+        document.getElementById("passphraseSpacer").hidden = false;
+
+        if (this._updatingPassphrase) {
+          document.getElementById("passphraseHelpBox").hidden = false;
+          document.title = this._str("new.recoverykey.title");
+          introText.textContent = this._str("new.recoverykey.introText");
+          this._dialog.getButton("finish").label
+            = this._str("new.recoverykey.acceptButton");
+        } else {
+          document.getElementById("generatePassphraseButton").hidden = false;
+          document.getElementById("passphraseBackupButtons").hidden = false;
+          this._passphraseBox.setAttribute("readonly", "true");
+          let pp = Weave.Service.identity.syncKey;
+          if (Weave.Utils.isPassphrase(pp))
+             pp = Weave.Utils.hyphenatePassphrase(pp);
+          this._passphraseBox.value = pp;
+          this._passphraseBox.focus();
+          document.title = this._str("change.recoverykey.title");
+          introText.textContent = this._str("change.synckey.introText2");
+          warningText.textContent = this._str("change.recoverykey.warningText");
+          this._dialog.getButton("finish").label
+            = this._str("change.recoverykey.acceptButton");
+          if (this._duringSetup) {
+            this._dialog.getButton("finish").disabled = false;
+          }
+        }
+        break;
+      case "ChangePassword":
+        document.getElementById("passphraseRow").hidden = true;
+        let box1label = document.getElementById("textBox1Label");
+        let box2label = document.getElementById("textBox2Label");
+        box1label.value = this._str("new.password.label");
+
+        if (this._currentPasswordInvalid) {
+          document.title = this._str("new.password.title");
+          introText.textContent = this._str("new.password.introText");
+          this._dialog.getButton("finish").label
+            = this._str("new.password.acceptButton");
+          document.getElementById("textBox2Row").hidden = true;
+        } else {
+          document.title = this._str("change.password.title");
+          box2label.value = this._str("new.password.confirm");
+          introText.textContent = this._str("change.password3.introText");
+          warningText.textContent = this._str("change.password.warningText");
+          this._dialog.getButton("finish").label
+            = this._str("change.password.acceptButton");
+        }
+        break;
+    }
+    document.getElementById("change-page")
+            .setAttribute("label", document.title);
+  },
+
+  _clearStatus: function _clearStatus() {
+    this._status.value = "";
+    this._statusIcon.removeAttribute("status");
+  },
+
+  _updateStatus: function Change__updateStatus(str, state) {
+     this._updateStatusWithString(this._str(str), state);
+  },
+
+  _updateStatusWithString: function Change__updateStatusWithString(string, state) {
+    this._statusRow.hidden = false;
+    this._status.value = string;
+    this._statusIcon.setAttribute("status", state);
+
+    let error = state == "error";
+    this._dialog.getButton("cancel").disabled = !error;
+    this._dialog.getButton("finish").disabled = !error;
+    document.getElementById("printSyncKeyButton").disabled = !error;
+    document.getElementById("saveSyncKeyButton").disabled = !error;
+
+    if (state == "success")
+      window.setTimeout(window.close, 1500);
+  },
+
+  onDialogAccept() {
+    switch (this._dialogType) {
+      case "UpdatePassphrase":
+      case "ResetPassphrase":
+        return this.doChangePassphrase();
+      case "ChangePassword":
+        return this.doChangePassword();
+    }
+    return undefined;
+  },
+
+  doGeneratePassphrase() {
+    let passphrase = Weave.Utils.generatePassphrase();
+    this._passphraseBox.value = Weave.Utils.hyphenatePassphrase(passphrase);
+    this._dialog.getButton("finish").disabled = false;
+  },
+
+  doChangePassphrase: function Change_doChangePassphrase() {
+    let pp = Weave.Utils.normalizePassphrase(this._passphraseBox.value);
+    if (this._updatingPassphrase) {
+      Weave.Service.identity.syncKey = pp;
+      if (Weave.Service.login()) {
+        this._updateStatus("change.recoverykey.success", "success");
+        Weave.Service.persistLogin();
+        Weave.Service.scheduler.delayedAutoConnect(0);
+      } else {
+        this._updateStatus("new.passphrase.status.incorrect", "error");
+      }
+    } else {
+      this._updateStatus("change.recoverykey.label", "active");
+
+      if (Weave.Service.changePassphrase(pp))
+        this._updateStatus("change.recoverykey.success", "success");
+      else
+        this._updateStatus("change.recoverykey.error", "error");
+    }
+
+    return false;
+  },
+
+  doChangePassword: function Change_doChangePassword() {
+    if (this._currentPasswordInvalid) {
+      Weave.Service.identity.basicPassword = this._firstBox.value;
+      if (Weave.Service.login()) {
+        this._updateStatus("change.password.status.success", "success");
+        Weave.Service.persistLogin();
+      } else {
+        this._updateStatus("new.password.status.incorrect", "error");
+      }
+    } else {
+      this._updateStatus("change.password.status.active", "active");
+
+      if (Weave.Service.changePassword(this._firstBox.value))
+        this._updateStatus("change.password.status.success", "success");
+      else
+        this._updateStatus("change.password.status.error", "error");
+    }
+
+    return false;
+  },
+
+  validate(event) {
+    let valid = false;
+    let errorString = "";
+
+    if (this._dialogType == "ChangePassword") {
+      if (this._currentPasswordInvalid)
+        [valid, errorString] = gSyncUtils.validatePassword(this._firstBox);
+      else
+        [valid, errorString] = gSyncUtils.validatePassword(this._firstBox, this._secondBox);
+    } else {
+      if (!this._updatingPassphrase)
+        return;
+
+      valid = this._passphraseBox.value != "";
+    }
+
+    if (errorString == "")
+      this._clearStatus();
+    else
+      this._updateStatusWithString(errorString, "error");
+
+    this._statusRow.hidden = valid;
+    this._dialog.getButton("finish").disabled = !valid;
+  },
+
+  _str: function Change__string(str) {
+    return this._stringBundle.GetStringFromName(str);
+  }
+};
new file mode 100644
--- /dev/null
+++ b/browser/base/content/sync/genericChange.xul
@@ -0,0 +1,123 @@
+<?xml version="1.0"?>
+
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<?xml-stylesheet href="chrome://browser/skin/syncSetup.css" type="text/css"?>
+<?xml-stylesheet href="chrome://browser/skin/syncCommon.css" type="text/css"?>
+
+<!DOCTYPE window [
+<!ENTITY % brandDTD SYSTEM "chrome://branding/locale/brand.dtd">
+<!ENTITY % syncBrandDTD SYSTEM "chrome://browser/locale/syncBrand.dtd">
+<!ENTITY % syncSetupDTD SYSTEM "chrome://browser/locale/syncSetup.dtd">
+%brandDTD;
+%syncBrandDTD;
+%syncSetupDTD;
+]>
+<wizard xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        xmlns:html="http://www.w3.org/1999/xhtml"
+        id="change-dialog"
+        windowtype="Weave:ChangeSomething"
+        persist="screenX screenY"
+        onwizardnext="Change.onLoad()"
+        onwizardfinish="return Change.onDialogAccept();">
+
+  <script type="application/javascript"
+          src="chrome://browser/content/sync/genericChange.js"/>
+  <script type="application/javascript"
+          src="chrome://browser/content/sync/utils.js"/>
+  <script type="application/javascript"
+          src="chrome://global/content/printUtils.js"/>
+
+  <wizardpage id="change-page"
+              label="">
+
+    <description id="introText">
+    </description>
+
+    <separator class="thin"/>
+
+    <groupbox>
+      <grid>
+        <columns>
+          <column align="right"/>
+          <column flex="3"/>
+          <column flex="1"/>
+        </columns>
+        <rows>
+          <row id="textBox1Row" align="center">
+            <label id="textBox1Label" control="textBox1"/>
+            <textbox id="textBox1" type="password" oninput="Change.validate()"/>
+            <spacer/>
+          </row>
+          <row id="textBox2Row" align="center">
+            <label id="textBox2Label" control="textBox2"/>
+            <textbox id="textBox2" type="password" oninput="Change.validate()"/>
+            <spacer/>
+          </row>
+        </rows>
+      </grid>
+
+      <vbox id="passphraseRow">
+        <hbox flex="1">
+          <label id="passphraseLabel" control="passphraseBox"/>
+          <spacer flex="1"/>
+          <label id="generatePassphraseButton"
+                 hidden="true"
+                 value="&syncGenerateNewKey.label;"
+                 class="text-link"
+                 onclick="event.stopPropagation();
+                          Change.doGeneratePassphrase();"/>
+        </hbox>
+        <textbox id="passphraseBox"
+                 flex="1"
+                 onfocus="this.select()"
+                 oninput="Change.validate()"/>
+      </vbox>
+
+      <vbox id="feedback" pack="center">
+        <hbox id="statusRow" align="center">
+          <image id="statusIcon" class="statusIcon"/>
+          <label id="status" class="status" value=" "/>
+        </hbox>
+      </vbox>
+    </groupbox>
+
+    <separator class="thin"/>
+
+    <hbox id="passphraseBackupButtons"
+          hidden="true"
+          pack="center">
+      <button id="printSyncKeyButton"
+              label="&button.syncKeyBackup.print.label;"
+              accesskey="&button.syncKeyBackup.print.accesskey;"
+              oncommand="gSyncUtils.passphrasePrint('passphraseBox');"/>
+      <button id="saveSyncKeyButton"
+              label="&button.syncKeyBackup.save.label;"
+              accesskey="&button.syncKeyBackup.save.accesskey;"
+              oncommand="gSyncUtils.passphraseSave('passphraseBox');"/>
+    </hbox>
+
+    <vbox id="passphraseHelpBox"
+          hidden="true">
+      <description>
+        &existingRecoveryKey.description;
+        <label class="text-link"
+               href="https://services.mozilla.com/sync/help/manual-setup">
+          &addDevice.showMeHow.label;
+        </label>
+      </description>
+    </vbox>
+
+    <spacer id="passphraseSpacer"
+            flex="1"
+            hidden="true"/>
+
+    <description id="warningText" class="data">
+    </description>
+
+    <spacer flex="1"/>
+  </wizardpage>
+</wizard>
new file mode 100644
--- /dev/null
+++ b/browser/base/content/sync/key.xhtml
@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<!DOCTYPE html [
+  <!ENTITY % htmlDTD PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "DTD/xhtml1-strict.dtd">
+  %htmlDTD;
+  <!ENTITY % syncBrandDTD SYSTEM "chrome://browser/locale/syncBrand.dtd">
+  %syncBrandDTD;
+  <!ENTITY % syncKeyDTD SYSTEM "chrome://browser/locale/syncKey.dtd">
+  %syncKeyDTD;
+  <!ENTITY % globalDTD SYSTEM "chrome://global/locale/global.dtd" >
+  %globalDTD;
+]>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+  <title>&syncKey.page.title;</title>
+  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
+  <meta name="robots" content="noindex"/>
+  <style type="text/css">
+    #synckey { font-size: 150% }
+    footer { font-size: 70% }
+    /* Bug 575675: Need to have an a:visited rule in a chrome document. */
+    a:visited { color: purple; }
+  </style>
+</head>
+
+<body dir="&locale.dir;">
+<h1>&syncKey.page.title;</h1>
+
+<p id="synckey" dir="ltr">SYNCKEY</p>
+
+<p>&syncKey.page.description2;</p>
+
+<div id="column1">
+  <h2>&syncKey.keepItSecret.heading;</h2>
+  <p>&syncKey.keepItSecret.description;</p>
+</div>
+
+<div id="column2">
+  <h2>&syncKey.keepItSafe.heading;</h2>
+  <p><em>&syncKey.keepItSafe1.description;</em>&syncKey.keepItSafe2.description;<em>&syncKey.keepItSafe3.description;</em>&syncKey.keepItSafe4a.description;</p>
+</div>
+
+<p>&syncKey.findOutMore1.label;<a href="https://services.mozilla.com">https://services.mozilla.com</a>&syncKey.findOutMore2.label;</p>
+
+<footer>
+ &syncKey.footer1.label;<a id="tosLink" href="termsURL">termsURL</a>&syncKey.footer2.label;<a id="ppLink" href="privacyURL">privacyURL</a>&syncKey.footer3.label;
+</footer>
+
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/browser/base/content/sync/setup.js
@@ -0,0 +1,1057 @@
+// -*- indent-tabs-mode: nil; js-indent-level: 2 -*-
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+var Ci = Components.interfaces;
+var Cc = Components.classes;
+var Cr = Components.results;
+var Cu = Components.utils;
+
+// page consts
+
+const PAIR_PAGE                     = 0;
+const INTRO_PAGE                    = 1;
+const NEW_ACCOUNT_START_PAGE        = 2;
+const EXISTING_ACCOUNT_CONNECT_PAGE = 3;
+const EXISTING_ACCOUNT_LOGIN_PAGE   = 4;
+const OPTIONS_PAGE                  = 5;
+const OPTIONS_CONFIRM_PAGE          = 6;
+
+// Broader than we'd like, but after this changed from api-secure.recaptcha.net
+// we had no choice. At least we only do this for the duration of setup.
+// See discussion in Bugs 508112 and 653307.
+const RECAPTCHA_DOMAIN = "https://www.google.com";
+
+const PIN_PART_LENGTH = 4;
+
+Cu.import("resource://services-sync/main.js");
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/PlacesUtils.jsm");
+Cu.import("resource://gre/modules/PluralForm.jsm");
+
+
+function setVisibility(element, visible) {
+  element.style.visibility = visible ? "visible" : "hidden";
+}
+
+var gSyncSetup = {
+  QueryInterface: XPCOMUtils.generateQI([Ci.nsISupports,
+                                         Ci.nsIWebProgressListener,
+                                         Ci.nsISupportsWeakReference]),
+
+  captchaBrowser: null,
+  wizard: null,
+  _disabledSites: [],
+
+  status: {
+    password: false,
+    email: false,
+    server: false
+  },
+
+  get _remoteSites() {
+    return [Weave.Service.serverURL, RECAPTCHA_DOMAIN];
+  },
+
+  get _usingMainServers() {
+    if (this._settingUpNew)
+      return document.getElementById("server").selectedIndex == 0;
+    return document.getElementById("existingServer").selectedIndex == 0;
+  },
+
+  init() {
+    let obs = [
+      ["weave:service:change-passphrase", "onResetPassphrase"],
+      ["weave:service:login:start",       "onLoginStart"],
+      ["weave:service:login:error",       "onLoginEnd"],
+      ["weave:service:login:finish",      "onLoginEnd"]];
+
+    // Add the observers now and remove them on unload
+    let self = this;
+    let addRem = function(add) {
+      obs.forEach(function([topic, func]) {
+        // XXXzpao This should use Services.obs.* but Weave's Obs does nice handling
+        //        of `this`. Fix in a followup. (bug 583347)
+        if (add)
+          Weave.Svc.Obs.add(topic, self[func], self);
+        else
+          Weave.Svc.Obs.remove(topic, self[func], self);
+      });
+    };
+    addRem(true);
+    window.addEventListener("unload", () => addRem(false));
+
+    window.setTimeout(function() {
+      // Force Service to be loaded so that engines are registered.
+      // See Bug 670082.
+      Weave.Service;
+    }, 0);
+
+    this.captchaBrowser = document.getElementById("captcha");
+
+    this.wizardType = null;
+    if (window.arguments && window.arguments[0]) {
+      this.wizardType = window.arguments[0];
+    }
+    switch (this.wizardType) {
+      case null:
+        this.wizard.pageIndex = INTRO_PAGE;
+        // Fall through!
+      case "pair":
+        this.captchaBrowser.addProgressListener(this);
+        Weave.Svc.Prefs.set("firstSync", "notReady");
+        break;
+      case "reset":
+        this._resettingSync = true;
+        this.wizard.pageIndex = OPTIONS_PAGE;
+        break;
+    }
+
+    this.wizard.getButton("extra1").label =
+      this._stringBundle.GetStringFromName("button.syncOptions.label");
+
+    // Remember these values because the options pages change them temporarily.
+    this._nextButtonLabel = this.wizard.getButton("next").label;
+    this._nextButtonAccesskey = this.wizard.getButton("next")
+                                           .getAttribute("accesskey");
+    this._backButtonLabel = this.wizard.getButton("back").label;
+    this._backButtonAccesskey = this.wizard.getButton("back")
+                                           .getAttribute("accesskey");
+  },
+
+  startNewAccountSetup() {
+    if (!Weave.Utils.ensureMPUnlocked())
+      return;
+    this._settingUpNew = true;
+    this.wizard.pageIndex = NEW_ACCOUNT_START_PAGE;
+  },
+
+  useExistingAccount() {
+    if (!Weave.Utils.ensureMPUnlocked())
+      return;
+    this._settingUpNew = false;
+    if (this.wizardType == "pair") {
+      // We're already pairing, so there's no point in pairing again.
+      // Go straight to the manual login page.
+      this.wizard.pageIndex = EXISTING_ACCOUNT_LOGIN_PAGE;
+    } else {
+      this.wizard.pageIndex = EXISTING_ACCOUNT_CONNECT_PAGE;
+    }
+  },
+
+  resetPassphrase: function resetPassphrase() {
+    // Apply the existing form fields so that
+    // Weave.Service.changePassphrase() has the necessary credentials.
+    Weave.Service.identity.account = document.getElementById("existingAccountName").value;
+    Weave.Service.identity.basicPassword = document.getElementById("existingPassword").value;
+
+    // Generate a new passphrase so that Weave.Service.login() will
+    // actually do something.
+    let passphrase = Weave.Utils.generatePassphrase();
+    Weave.Service.identity.syncKey = passphrase;
+
+    // Only open the dialog if username + password are actually correct.
+    Weave.Service.login();
+    if ([Weave.LOGIN_FAILED_INVALID_PASSPHRASE,
+         Weave.LOGIN_FAILED_NO_PASSPHRASE,
+         Weave.LOGIN_SUCCEEDED].indexOf(Weave.Status.login) == -1) {
+      return;
+    }
+
+    // Hide any errors about the passphrase, we know it's not right.
+    let feedback = document.getElementById("existingPassphraseFeedbackRow");
+    feedback.hidden = true;
+    let el = document.getElementById("existingPassphrase");
+    el.value = Weave.Utils.hyphenatePassphrase(passphrase);
+
+    // changePassphrase() will sync, make sure we set the "firstSync" pref
+    // according to the user's pref.
+    Weave.Svc.Prefs.reset("firstSync");
+    this.setupInitialSync();
+    gSyncUtils.resetPassphrase(true);
+  },
+
+  onResetPassphrase() {
+    document.getElementById("existingPassphrase").value =
+      Weave.Utils.hyphenatePassphrase(Weave.Service.identity.syncKey);
+    this.checkFields();
+    this.wizard.advance();
+  },
+
+  onLoginStart() {
+    this.toggleLoginFeedback(false);
+  },
+
+  onLoginEnd() {
+    this.toggleLoginFeedback(true);
+  },
+
+  sendCredentialsAfterSync() {
+    let send = function() {
+      Services.obs.removeObserver("weave:service:sync:finish", send);
+      Services.obs.removeObserver("weave:service:sync:error", send);
+      let credentials = {account:   Weave.Service.identity.account,
+                         password:  Weave.Service.identity.basicPassword,
+                         synckey:   Weave.Service.identity.syncKey,
+                         serverURL: Weave.Service.serverURL};
+      this._jpakeclient.sendAndComplete(credentials);
+    }.bind(this);
+    Services.obs.addObserver("weave:service:sync:finish", send, false);
+    Services.obs.addObserver("weave:service:sync:error", send, false);
+  },
+
+  toggleLoginFeedback(stop) {
+    document.getElementById("login-throbber").hidden = stop;
+    let password = document.getElementById("existingPasswordFeedbackRow");
+    let server = document.getElementById("existingServerFeedbackRow");
+    let passphrase = document.getElementById("existingPassphraseFeedbackRow");
+
+    if (!stop || (Weave.Status.login == Weave.LOGIN_SUCCEEDED)) {
+      password.hidden = server.hidden = passphrase.hidden = true;
+      return;
+    }
+
+    let feedback;
+    switch (Weave.Status.login) {
+      case Weave.LOGIN_FAILED_NETWORK_ERROR:
+      case Weave.LOGIN_FAILED_SERVER_ERROR:
+        feedback = server;
+        break;
+      case Weave.LOGIN_FAILED_LOGIN_REJECTED:
+      case Weave.LOGIN_FAILED_NO_USERNAME:
+      case Weave.LOGIN_FAILED_NO_PASSWORD:
+        feedback = password;
+        break;
+      case Weave.LOGIN_FAILED_INVALID_PASSPHRASE:
+        feedback = passphrase;
+        break;
+    }
+    this._setFeedbackMessage(feedback, false, Weave.Status.login);
+  },
+
+  setupInitialSync() {
+    let action = document.getElementById("mergeChoiceRadio").selectedItem.id;
+    switch (action) {
+      case "resetClient":
+        // if we're not resetting sync, we don't need to explicitly
+        // call resetClient
+        if (!this._resettingSync)
+          return;
+        // otherwise, fall through
+      case "wipeClient":
+      case "wipeRemote":
+        Weave.Svc.Prefs.set("firstSync", action);
+        break;
+    }
+  },
+
+  // fun with validation!
+  checkFields() {
+    this.wizard.canAdvance = this.readyToAdvance();
+  },
+
+  readyToAdvance() {
+    switch (this.wizard.pageIndex) {
+      case INTRO_PAGE:
+        return false;
+      case NEW_ACCOUNT_START_PAGE:
+        for (let i in this.status) {
+          if (!this.status[i])
+            return false;
+        }
+        if (this._usingMainServers)
+          return document.getElementById("tos").checked;
+
+        return true;
+      case EXISTING_ACCOUNT_LOGIN_PAGE:
+        let hasUser = document.getElementById("existingAccountName").value != "";
+        let hasPass = document.getElementById("existingPassword").value != "";
+        let hasKey = document.getElementById("existingPassphrase").value != "";
+
+        if (hasUser && hasPass && hasKey) {
+          if (this._usingMainServers)
+            return true;
+
+          if (this._validateServer(document.getElementById("existingServer"))) {
+            return true;
+          }
+        }
+        return false;
+    }
+    // Default, e.g. wizard's special page -1 etc.
+    return true;
+  },
+
+  onPINInput: function onPINInput(textbox) {
+    if (textbox && textbox.value.length == PIN_PART_LENGTH) {
+      this.nextFocusEl[textbox.id].focus();
+    }
+    this.wizard.canAdvance = (this.pin1.value.length == PIN_PART_LENGTH &&
+                              this.pin2.value.length == PIN_PART_LENGTH &&
+                              this.pin3.value.length == PIN_PART_LENGTH);
+  },
+
+  onEmailInput() {
+    // Check account validity when the user stops typing for 1 second.
+    if (this._checkAccountTimer)
+      window.clearTimeout(this._checkAccountTimer);
+    this._checkAccountTimer = window.setTimeout(function() {
+      gSyncSetup.checkAccount();
+    }, 1000);
+  },
+
+  checkAccount() {
+    delete this._checkAccountTimer;
+    let value = Weave.Utils.normalizeAccount(
+      document.getElementById("weaveEmail").value);
+    if (!value) {
+      this.status.email = false;
+      this.checkFields();
+      return;
+    }
+
+    let re = /^(([^<>()[\]\\.,;:\s@\"]+(\.[^<>()[\]\\.,;:\s@\"]+)*)|(\".+\"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/;
+    let feedback = document.getElementById("emailFeedbackRow");
+    let valid = re.test(value);
+
+    let str = "";
+    if (!valid) {
+      str = "invalidEmail.label";
+    } else {
+      let availCheck = Weave.Service.checkAccount(value);
+      valid = availCheck == "available";
+      if (!valid) {
+        if (availCheck == "notAvailable")
+          str = "usernameNotAvailable.label";
+        else
+          str = availCheck;
+      }
+    }
+
+    this._setFeedbackMessage(feedback, valid, str);
+    this.status.email = valid;
+    if (valid)
+      Weave.Service.identity.account = value;
+    this.checkFields();
+  },
+
+  onPasswordChange() {
+    let password = document.getElementById("weavePassword");
+    let pwconfirm = document.getElementById("weavePasswordConfirm");
+    let [valid, errorString] = gSyncUtils.validatePassword(password, pwconfirm);
+
+    let feedback = document.getElementById("passwordFeedbackRow");
+    this._setFeedback(feedback, valid, errorString);
+
+    this.status.password = valid;
+    this.checkFields();
+  },
+
+  onPageShow() {
+    switch (this.wizard.pageIndex) {
+      case PAIR_PAGE:
+        this.wizard.getButton("back").hidden = true;
+        this.wizard.getButton("extra1").hidden = true;
+        this.onPINInput();
+        this.pin1.focus();
+        break;
+      case INTRO_PAGE:
+        // We may not need the captcha in the Existing Account branch of the
+        // wizard. However, we want to preload it to avoid any flickering while
+        // the Create Account page is shown.
+        this.loadCaptcha();
+        this.wizard.getButton("next").hidden = true;
+        this.wizard.getButton("back").hidden = true;
+        this.wizard.getButton("extra1").hidden = true;
+        this.checkFields();
+        break;
+      case NEW_ACCOUNT_START_PAGE:
+        this.wizard.getButton("extra1").hidden = false;
+        this.wizard.getButton("next").hidden = false;
+        this.wizard.getButton("back").hidden = false;
+        this.onServerCommand();
+        this.wizard.canRewind = true;
+        this.checkFields();
+        break;
+      case EXISTING_ACCOUNT_CONNECT_PAGE:
+        Weave.Svc.Prefs.set("firstSync", "existingAccount");
+        this.wizard.getButton("next").hidden = false;
+        this.wizard.getButton("back").hidden = false;
+        this.wizard.getButton("extra1").hidden = false;
+        this.wizard.canAdvance = false;
+        this.wizard.canRewind = true;
+        this.startEasySetup();
+        break;
+      case EXISTING_ACCOUNT_LOGIN_PAGE:
+        this.wizard.getButton("next").hidden = false;
+        this.wizard.getButton("back").hidden = false;
+        this.wizard.getButton("extra1").hidden = false;
+        this.wizard.canRewind = true;
+        this.checkFields();
+        break;
+      case OPTIONS_PAGE:
+        this.wizard.canRewind = false;
+        this.wizard.canAdvance = true;
+        if (!this._resettingSync) {
+          this.wizard.getButton("next").label =
+            this._stringBundle.GetStringFromName("button.syncOptionsDone.label");
+          this.wizard.getButton("next").removeAttribute("accesskey");
+        }
+        this.wizard.getButton("next").hidden = false;
+        this.wizard.getButton("back").hidden = true;
+        this.wizard.getButton("cancel").hidden = !this._resettingSync;
+        this.wizard.getButton("extra1").hidden = true;
+        document.getElementById("syncComputerName").value = Weave.Service.clientsEngine.localName;
+        document.getElementById("syncOptions").collapsed = this._resettingSync;
+        document.getElementById("mergeOptions").collapsed = this._settingUpNew;
+        break;
+      case OPTIONS_CONFIRM_PAGE:
+        this.wizard.canRewind = true;
+        this.wizard.canAdvance = true;
+        this.wizard.getButton("back").label =
+          this._stringBundle.GetStringFromName("button.syncOptionsCancel.label");
+        this.wizard.getButton("back").removeAttribute("accesskey");
+        this.wizard.getButton("back").hidden = this._resettingSync;
+        this.wizard.getButton("next").hidden = false;
+        this.wizard.getButton("finish").hidden = true;
+        break;
+    }
+  },
+
+  onWizardAdvance() {
+    // Check pageIndex so we don't prompt before the Sync setup wizard appears.
+    // This is a fallback in case the Master Password gets locked mid-wizard.
+    if ((this.wizard.pageIndex >= 0) &&
+        !Weave.Utils.ensureMPUnlocked()) {
+      return false;
+    }
+
+    switch (this.wizard.pageIndex) {
+      case PAIR_PAGE:
+        this.startPairing();
+        return false;
+      case NEW_ACCOUNT_START_PAGE:
+        // If the user selects Next (e.g. by hitting enter) when we haven't
+        // executed the delayed checks yet, execute them immediately.
+        if (this._checkAccountTimer) {
+          this.checkAccount();
+        }
+        if (this._checkServerTimer) {
+          this.checkServer();
+        }
+        if (!this.wizard.canAdvance) {
+          return false;
+        }
+
+        let doc = this.captchaBrowser.contentDocument;
+        let getField = function getField(field) {
+          let node = doc.getElementById("recaptcha_" + field + "_field");
+          return node && node.value;
+        };
+
+        // Display throbber
+        let feedback = document.getElementById("captchaFeedback");
+        let image = feedback.firstChild;
+        let label = image.nextSibling;
+        image.setAttribute("status", "active");
+        label.value = this._stringBundle.GetStringFromName("verifying.label");
+        setVisibility(feedback, true);
+
+        let password = document.getElementById("weavePassword").value;
+        let email = Weave.Utils.normalizeAccount(
+          document.getElementById("weaveEmail").value);
+        let challenge = getField("challenge");
+        let response = getField("response");
+
+        let error = Weave.Service.createAccount(email, password,
+                                                challenge, response);
+
+        if (error == null) {
+          Weave.Service.identity.account = email;
+          Weave.Service.identity.basicPassword = password;
+          Weave.Service.identity.syncKey = Weave.Utils.generatePassphrase();
+          this._handleNoScript(false);
+          Weave.Svc.Prefs.set("firstSync", "newAccount");
+          this.wizardFinish();
+          return false;
+        }
+
+        image.setAttribute("status", "error");
+        label.value = Weave.Utils.getErrorString(error);
+        return false;
+      case EXISTING_ACCOUNT_LOGIN_PAGE:
+        Weave.Service.identity.account = Weave.Utils.normalizeAccount(
+          document.getElementById("existingAccountName").value);
+        Weave.Service.identity.basicPassword =
+          document.getElementById("existingPassword").value;
+        let pp = document.getElementById("existingPassphrase").value;
+        Weave.Service.identity.syncKey = Weave.Utils.normalizePassphrase(pp);
+        if (Weave.Service.login()) {
+          this.wizardFinish();
+        }
+        return false;
+      case OPTIONS_PAGE:
+        let desc = document.getElementById("mergeChoiceRadio").selectedIndex;
+        // No confirmation needed on new account setup or merge option
+        // with existing account.
+        if (this._settingUpNew || (!this._resettingSync && desc == 0))
+          return this.returnFromOptions();
+        return this._handleChoice();
+      case OPTIONS_CONFIRM_PAGE:
+        if (this._resettingSync) {
+          this.wizardFinish();
+          return false;
+        }
+        return this.returnFromOptions();
+    }
+    return true;
+  },
+
+  onWizardBack() {
+    switch (this.wizard.pageIndex) {
+      case NEW_ACCOUNT_START_PAGE:
+        this.wizard.pageIndex = INTRO_PAGE;
+        return false;
+      case EXISTING_ACCOUNT_CONNECT_PAGE:
+        this.abortEasySetup();
+        this.wizard.pageIndex = INTRO_PAGE;
+        return false;
+      case EXISTING_ACCOUNT_LOGIN_PAGE:
+        // If we were already pairing on entry, we went straight to the manual
+        // login page. If subsequently we go back, return to the page that lets
+        // us choose whether we already have an account.
+        if (this.wizardType == "pair") {
+          this.wizard.pageIndex = INTRO_PAGE;
+          return false;
+        }
+        return true;
+      case OPTIONS_CONFIRM_PAGE:
+        // Backing up from the confirmation page = resetting first sync to merge.
+        document.getElementById("mergeChoiceRadio").selectedIndex = 0;
+        return this.returnFromOptions();
+    }
+    return true;
+  },
+
+  wizardFinish() {
+    this.setupInitialSync();
+
+    if (this.wizardType == "pair") {
+      this.completePairing();
+    }
+
+    if (!this._resettingSync) {
+      function isChecked(element) {
+        return document.getElementById(element).hasAttribute("checked");
+      }
+
+      let prefs = ["engine.bookmarks", "engine.passwords", "engine.history",
+                   "engine.tabs", "engine.prefs", "engine.addons"];
+      for (let i = 0;i < prefs.length;i++) {
+        Weave.Svc.Prefs.set(prefs[i], isChecked(prefs[i]));
+      }
+      this._handleNoScript(false);
+      if (Weave.Svc.Prefs.get("firstSync", "") == "notReady")
+        Weave.Svc.Prefs.reset("firstSync");
+
+      Weave.Service.persistLogin();
+      Weave.Svc.Obs.notify("weave:service:setup-complete");
+    }
+    Weave.Utils.nextTick(Weave.Service.sync, Weave.Service);
+    window.close();
+  },
+
+  onWizardCancel() {
+    if (this._resettingSync)
+      return;
+
+    this.abortEasySetup();
+    this._handleNoScript(false);
+    Weave.Service.startOver();
+  },
+
+  onSyncOptions() {
+    this._beforeOptionsPage = this.wizard.pageIndex;
+    this.wizard.pageIndex = OPTIONS_PAGE;
+  },
+
+  returnFromOptions() {
+    this.wizard.getButton("next").label = this._nextButtonLabel;
+    this.wizard.getButton("next").setAttribute("accesskey",
+                                               this._nextButtonAccesskey);
+    this.wizard.getButton("back").label = this._backButtonLabel;
+    this.wizard.getButton("back").setAttribute("accesskey",
+                                               this._backButtonAccesskey);
+    this.wizard.getButton("cancel").hidden = false;
+    this.wizard.getButton("extra1").hidden = false;
+    this.wizard.pageIndex = this._beforeOptionsPage;
+    return false;
+  },
+
+  startPairing: function startPairing() {
+    this.pairDeviceErrorRow.hidden = true;
+    // When onAbort is called, Weave may already be gone.
+    const JPAKE_ERROR_USERABORT = Weave.JPAKE_ERROR_USERABORT;
+
+    let self = this;
+    let jpakeclient = this._jpakeclient = new Weave.JPAKEClient({
+      onPaired: function onPaired() {
+        self.wizard.pageIndex = INTRO_PAGE;
+      },
+      onComplete: function onComplete() {
+        // This method will never be called since SendCredentialsController
+        // will take over after the wizard completes.
+      },
+      onAbort: function onAbort(error) {
+        delete self._jpakeclient;
+
+        // Aborted by user, ignore. The window is almost certainly going to close
+        // or is already closed.
+        if (error == JPAKE_ERROR_USERABORT) {
+          return;
+        }
+
+        self.pairDeviceErrorRow.hidden = false;
+        self.pairDeviceThrobber.hidden = true;
+        self.pin1.value = self.pin2.value = self.pin3.value = "";
+        self.pin1.disabled = self.pin2.disabled = self.pin3.disabled = false;
+        if (self.wizard.pageIndex == PAIR_PAGE) {
+          self.pin1.focus();
+        }
+      }
+    });
+    this.pairDeviceThrobber.hidden = false;
+    this.pin1.disabled = this.pin2.disabled = this.pin3.disabled = true;
+    this.wizard.canAdvance = false;
+
+    let pin = this.pin1.value + this.pin2.value + this.pin3.value;
+    let expectDelay = true;
+    jpakeclient.pairWithPIN(pin, expectDelay);
+  },
+
+  completePairing: function completePairing() {
+    if (!this._jpakeclient) {
+      // The channel was aborted while we were setting up the account
+      // locally. XXX TODO should we do anything here, e.g. tell
+      // the user on the last wizard page that it's ok, they just
+      // have to pair again?
+      return;
+    }
+    let controller = new Weave.SendCredentialsController(this._jpakeclient,
+                                                         Weave.Service);
+    this._jpakeclient.controller = controller;
+  },
+
+  startEasySetup() {
+    // Don't do anything if we have a client already (e.g. we went to
+    // Sync Options and just came back).
+    if (this._jpakeclient)
+      return;
+
+    // When onAbort is called, Weave may already be gone
+    const JPAKE_ERROR_USERABORT = Weave.JPAKE_ERROR_USERABORT;
+
+    let self = this;
+    this._jpakeclient = new Weave.JPAKEClient({
+      displayPIN: function displayPIN(pin) {
+        document.getElementById("easySetupPIN1").value = pin.slice(0, 4);
+        document.getElementById("easySetupPIN2").value = pin.slice(4, 8);
+        document.getElementById("easySetupPIN3").value = pin.slice(8);
+      },
+
+      onPairingStart: function onPairingStart() {},
+
+      onComplete: function onComplete(credentials) {
+        Weave.Service.identity.account = credentials.account;
+        Weave.Service.identity.basicPassword = credentials.password;
+        Weave.Service.identity.syncKey = credentials.synckey;
+        Weave.Service.serverURL = credentials.serverURL;
+        gSyncSetup.wizardFinish();
+      },
+
+      onAbort: function onAbort(error) {
+        delete self._jpakeclient;
+
+        // Ignore if wizard is aborted.
+        if (error == JPAKE_ERROR_USERABORT)
+          return;
+
+        // Automatically go to manual setup if we couldn't acquire a channel.
+        if (error == Weave.JPAKE_ERROR_CHANNEL) {
+          self.wizard.pageIndex = EXISTING_ACCOUNT_LOGIN_PAGE;
+          return;
+        }
+
+        // Restart on all other errors.
+        self.startEasySetup();
+      }
+    });
+    this._jpakeclient.receiveNoPIN();
+  },
+
+  abortEasySetup() {
+    document.getElementById("easySetupPIN1").value = "";
+    document.getElementById("easySetupPIN2").value = "";
+    document.getElementById("easySetupPIN3").value = "";
+    if (!this._jpakeclient)
+      return;
+
+    this._jpakeclient.abort();
+    delete this._jpakeclient;
+  },
+
+  manualSetup() {
+    this.abortEasySetup();
+    this.wizard.pageIndex = EXISTING_ACCOUNT_LOGIN_PAGE;
+  },
+
+  // _handleNoScript is needed because it blocks the captcha. So we temporarily
+  // allow the necessary sites so that we can verify the user is in fact a human.
+  // This was done with the help of Giorgio (NoScript author). See bug 508112.
+  _handleNoScript(addExceptions) {
+    // if NoScript isn't installed, or is disabled, bail out.
+    let ns = Cc["@maone.net/noscript-service;1"];
+    if (ns == null)
+      return;
+
+    ns = ns.getService().wrappedJSObject;
+    if (addExceptions) {
+      this._remoteSites.forEach(function(site) {
+        site = ns.getSite(site);
+        if (!ns.isJSEnabled(site)) {
+          this._disabledSites.push(site); // save status
+          ns.setJSEnabled(site, true); // allow site
+        }
+      }, this);
+    } else {
+      this._disabledSites.forEach(function(site) {
+        ns.setJSEnabled(site, false);
+      });
+      this._disabledSites = [];
+    }
+  },
+
+  onExistingServerCommand() {
+    let control = document.getElementById("existingServer");
+    if (control.selectedIndex == 0) {
+      control.removeAttribute("editable");
+      Weave.Svc.Prefs.reset("serverURL");
+    } else {
+      control.setAttribute("editable", "true");
+      // Force a style flush to ensure that the binding is attached.
+      control.clientTop;
+      control.value = "";
+      control.inputField.focus();
+    }
+    document.getElementById("existingServerFeedbackRow").hidden = true;
+    this.checkFields();
+  },
+
+  onExistingServerInput() {
+    // Check custom server validity when the user stops typing for 1 second.
+    if (this._existingServerTimer)
+      window.clearTimeout(this._existingServerTimer);
+    this._existingServerTimer = window.setTimeout(function() {
+      gSyncSetup.checkFields();
+    }, 1000);
+  },
+
+  onServerCommand() {
+    setVisibility(document.getElementById("TOSRow"), this._usingMainServers);
+    let control = document.getElementById("server");
+    if (!this._usingMainServers) {
+      control.setAttribute("editable", "true");
+      // Force a style flush to ensure that the binding is attached.
+      control.clientTop;
+      control.value = "";
+      control.inputField.focus();
+      // checkServer() will call checkAccount() and checkFields().
+      this.checkServer();
+      return;
+    }
+    control.removeAttribute("editable");
+    Weave.Svc.Prefs.reset("serverURL");
+    if (this._settingUpNew) {
+      this.loadCaptcha();
+    }
+    this.checkAccount();
+    this.status.server = true;
+    document.getElementById("serverFeedbackRow").hidden = true;
+    this.checkFields();
+  },
+
+  onServerInput() {
+    // Check custom server validity when the user stops typing for 1 second.
+    if (this._checkServerTimer)
+      window.clearTimeout(this._checkServerTimer);
+    this._checkServerTimer = window.setTimeout(function() {
+      gSyncSetup.checkServer();
+    }, 1000);
+  },
+
+  checkServer() {
+    delete this._checkServerTimer;
+    let el = document.getElementById("server");
+    let valid = false;
+    let feedback = document.getElementById("serverFeedbackRow");
+    if (el.value) {
+      valid = this._validateServer(el);
+      let str = valid ? "" : "serverInvalid.label";
+      this._setFeedbackMessage(feedback, valid, str);
+    } else
+      this._setFeedbackMessage(feedback, true);
+
+    // Recheck account against the new server.
+    if (valid)
+      this.checkAccount();
+
+    this.status.server = valid;
+    this.checkFields();
+  },
+
+  _validateServer(element) {
+    let valid = false;
+    let val = element.value;
+    if (!val)
+      return false;
+
+    let uri = Weave.Utils.makeURI(val);
+
+    if (!uri)
+      uri = Weave.Utils.makeURI("https://" + val);
+
+    if (uri && this._settingUpNew) {
+      function isValid(validUri) {
+        Weave.Service.serverURL = validUri.spec;
+        let check = Weave.Service.checkAccount("a");
+        return (check == "available" || check == "notAvailable");
+      }
+
+      if (uri.schemeIs("http")) {
+        uri.scheme = "https";
+        if (isValid(uri))
+          valid = true;
+        else
+          // setting the scheme back to http
+          uri.scheme = "http";
+      }
+      if (!valid)
+        valid = isValid(uri);
+
+      if (valid) {
+        this.loadCaptcha();
+      }
+    } else if (uri) {
+      valid = true;
+      Weave.Service.serverURL = uri.spec;
+    }
+
+    if (valid)
+      element.value = Weave.Service.serverURL;
+    else
+      Weave.Svc.Prefs.reset("serverURL");
+
+    return valid;
+  },
+
+  _handleChoice() {
+    let desc = document.getElementById("mergeChoiceRadio").selectedIndex;
+    document.getElementById("chosenActionDeck").selectedIndex = desc;
+    switch (desc) {
+      case 1:
+        if (this._case1Setup)
+          break;
+
+        let places_db = PlacesUtils.history
+                                   .QueryInterface(Ci.nsPIPlacesDatabase)
+                                   .DBConnection;
+        if (Weave.Service.engineManager.get("history").enabled) {
+          let daysOfHistory = 0;
+          let stm = places_db.createStatement(
+            "SELECT ROUND(( " +
+              "strftime('%s','now','localtime','utc') - " +
+              "( " +
+                "SELECT visit_date FROM moz_historyvisits " +
+                "ORDER BY visit_date ASC LIMIT 1 " +
+                ")/1000000 " +
+              ")/86400) AS daysOfHistory ");
+
+          if (stm.step())
+            daysOfHistory = stm.getInt32(0);
+          // Support %S for historical reasons (see bug 600141)
+          document.getElementById("historyCount").value =
+            PluralForm.get(daysOfHistory,
+                           this._stringBundle.GetStringFromName("historyDaysCount.label"))
+                      .replace("%S", daysOfHistory)
+                      .replace("#1", daysOfHistory);
+        } else {
+          document.getElementById("historyCount").hidden = true;
+        }
+
+        if (Weave.Service.engineManager.get("bookmarks").enabled) {
+          let bookmarks = 0;
+          let stm = places_db.createStatement(
+            "SELECT count(*) AS bookmarks " +
+            "FROM moz_bookmarks b " +
+            "LEFT JOIN moz_bookmarks t ON " +
+            "b.parent = t.id WHERE b.type = 1 AND t.parent <> :tag");
+          stm.params.tag = PlacesUtils.tagsFolderId;
+          if (stm.executeStep())
+            bookmarks = stm.row.bookmarks;
+          // Support %S for historical reasons (see bug 600141)
+          document.getElementById("bookmarkCount").value =
+            PluralForm.get(bookmarks,
+                           this._stringBundle.GetStringFromName("bookmarksCount.label"))
+                      .replace("%S", bookmarks)
+                      .replace("#1", bookmarks);
+        } else {
+          document.getElementById("bookmarkCount").hidden = true;
+        }
+
+        if (Weave.Service.engineManager.get("passwords").enabled) {
+          let logins = Services.logins.getAllLogins({});
+          // Support %S for historical reasons (see bug 600141)
+          document.getElementById("passwordCount").value =
+            PluralForm.get(logins.length,
+                           this._stringBundle.GetStringFromName("passwordsCount.label"))
+                      .replace("%S", logins.length)
+                      .replace("#1", logins.length);
+        } else {
+          document.getElementById("passwordCount").hidden = true;
+        }
+
+        if (!Weave.Service.engineManager.get("prefs").enabled) {
+          document.getElementById("prefsWipe").hidden = true;
+        }
+
+        let addonsEngine = Weave.Service.engineManager.get("addons");
+        if (addonsEngine.enabled) {
+          let ids = addonsEngine._store.getAllIDs();
+          let blessedcount = Object.keys(ids).filter(id => ids[id]).length;
+          // bug 600141 does not apply, as this does not have to support existing strings
+          document.getElementById("addonCount").value =
+            PluralForm.get(blessedcount,
+                           this._stringBundle.GetStringFromName("addonsCount.label"))
+                      .replace("#1", blessedcount);
+        } else {
+          document.getElementById("addonCount").hidden = true;
+        }
+
+        this._case1Setup = true;
+        break;
+      case 2:
+        if (this._case2Setup)
+          break;
+        let count = 0;
+        function appendNode(label) {
+          let box = document.getElementById("clientList");
+          let node = document.createElement("label");
+          node.setAttribute("value", label);
+          node.setAttribute("class", "data indent");
+          box.appendChild(node);
+        }
+
+        for (let name of Weave.Service.clientsEngine.stats.names) {
+          // Don't list the current client
+          if (name == Weave.Service.clientsEngine.localName)
+            continue;
+
+          // Only show the first several client names
+          if (++count <= 5)
+            appendNode(name);
+        }
+        if (count > 5) {
+          // Support %S for historical reasons (see bug 600141)
+          let label =
+            PluralForm.get(count - 5,
+                           this._stringBundle.GetStringFromName("additionalClientCount.label"))
+                      .replace("%S", count - 5)
+                      .replace("#1", count - 5);
+          appendNode(label);
+        }
+        this._case2Setup = true;
+        break;
+    }
+
+    return true;
+  },
+
+  // sets class and string on a feedback element
+  // if no property string is passed in, we clear label/style
+  _setFeedback(element, success, string) {
+    element.hidden = success || !string;
+    let classname = success ? "success" : "error";
+    let image = element.getElementsByAttribute("class", "statusIcon")[0];
+    image.setAttribute("status", classname);
+    let label = element.getElementsByAttribute("class", "status")[0];
+    label.value = string;
+  },
+
+  // shim
+  _setFeedbackMessage(element, success, string) {
+    let str = "";
+    if (string) {
+      try {
+        str = this._stringBundle.GetStringFromName(string);
+      } catch (e) {}
+
+      if (!str)
+        str = Weave.Utils.getErrorString(string);
+    }
+    this._setFeedback(element, success, str);
+  },
+
+  loadCaptcha: function loadCaptcha() {
+    let captchaURI = Weave.Service.miscAPI + "captcha_html";
+    // First check for NoScript and whitelist the right sites.
+    this._handleNoScript(true);
+    if (this.captchaBrowser.currentURI.spec != captchaURI) {
+      this.captchaBrowser.loadURI(captchaURI);
+    }
+  },
+
+  onStateChange(webProgress, request, stateFlags, status) {
+    // We're only looking for the end of the frame load
+    if ((stateFlags & Ci.nsIWebProgressListener.STATE_STOP) == 0)
+      return;
+    if ((stateFlags & Ci.nsIWebProgressListener.STATE_IS_NETWORK) == 0)
+      return;
+    if ((stateFlags & Ci.nsIWebProgressListener.STATE_IS_WINDOW) == 0)
+      return;
+
+    // If we didn't find a captcha, assume it's not needed and don't show it.
+    let responseStatus = request.QueryInterface(Ci.nsIHttpChannel).responseStatus;
+    setVisibility(this.captchaBrowser, responseStatus != 404);
+    // XXX TODO we should really log any responseStatus other than 200
+  },
+  onProgressChange() {},
+  onStatusChange() {},
+  onSecurityChange() {},
+  onLocationChange() {}
+};
+
+// Define lazy getters for various XUL elements.
+//
+// onWizardAdvance() and onPageShow() are run before init(), so we'll even
+// define things that will almost certainly be used (like 'wizard') as a lazy
+// getter here.
+["wizard",
+ "pin1",
+ "pin2",
+ "pin3",
+ "pairDeviceErrorRow",
+ "pairDeviceThrobber"].forEach(function(id) {
+  XPCOMUtils.defineLazyGetter(gSyncSetup, id, function() {
+    return document.getElementById(id);
+  });
+});
+XPCOMUtils.defineLazyGetter(gSyncSetup, "nextFocusEl", function() {
+  return {pin1: this.pin2,
+          pin2: this.pin3,
+          pin3: this.wizard.getButton("next")};
+});
+XPCOMUtils.defineLazyGetter(gSyncSetup, "_stringBundle", function() {
+  return Services.strings.createBundle("chrome://browser/locale/syncSetup.properties");
+});
new file mode 100644
--- /dev/null
+++ b/browser/base/content/sync/setup.xul
@@ -0,0 +1,490 @@
+<?xml version="1.0"?>
+
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<?xml-stylesheet href="chrome://browser/skin/syncSetup.css" type="text/css"?>
+<?xml-stylesheet href="chrome://browser/skin/syncCommon.css" type="text/css"?>
+
+<!DOCTYPE window [
+<!ENTITY % brandDTD SYSTEM "chrome://branding/locale/brand.dtd">
+<!ENTITY % syncBrandDTD SYSTEM "chrome://browser/locale/syncBrand.dtd">
+<!ENTITY % syncSetupDTD SYSTEM "chrome://browser/locale/syncSetup.dtd">
+%brandDTD;
+%syncBrandDTD;
+%syncSetupDTD;
+]>
+<wizard id="wizard"
+        title="&accountSetupTitle.label;"
+        windowtype="Weave:AccountSetup"
+        persist="screenX screenY"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        xmlns:html="http://www.w3.org/1999/xhtml"
+        onwizardnext="return gSyncSetup.onWizardAdvance()"
+        onwizardback="return gSyncSetup.onWizardBack()"
+        onwizardcancel="gSyncSetup.onWizardCancel()"
+        onload="gSyncSetup.init()">
+
+  <script type="application/javascript"
+          src="chrome://browser/content/sync/setup.js"/>
+  <script type="application/javascript"
+          src="chrome://browser/content/sync/utils.js"/>
+  <script type="application/javascript"
+          src="chrome://browser/content/utilityOverlay.js"/>
+  <script type="application/javascript"
+          src="chrome://global/content/printUtils.js"/>
+
+  <wizardpage id="addDevicePage"
+              label="&pairDevice.title.label;"
+              onpageshow="gSyncSetup.onPageShow()">
+    <description>
+      &pairDevice.dialog.description.label;
+      <label class="text-link"
+             value="&addDevice.showMeHow.label;"
+             href="https://services.mozilla.com/sync/help/add-device"/>
+    </description>
+    <separator class="groove-thin"/>
+    <description>
+      &addDevice.dialog.enterCode.label;
+    </description>
+    <separator class="groove-thin"/>
+    <vbox align="center">
+      <textbox id="pin1"
+               class="pin"
+               oninput="gSyncSetup.onPINInput(this);"
+               onfocus="this.select();"
+               />
+      <textbox id="pin2"
+               class="pin"
+               oninput="gSyncSetup.onPINInput(this);"
+               onfocus="this.select();"
+               />
+      <textbox id="pin3"
+               class="pin"
+               oninput="gSyncSetup.onPINInput(this);"
+               onfocus="this.select();" 
+               />
+    </vbox>
+    <separator class="groove-thin"/>
+    <vbox id="pairDeviceThrobber" align="center" hidden="true">
+      <image/>
+    </vbox>
+    <hbox id="pairDeviceErrorRow" pack="center" hidden="true">
+      <image class="statusIcon" status="error"/>
+      <label class="status"
+             value="&addDevice.dialog.tryAgain.label;"/>
+    </hbox>
+  </wizardpage>
+
+  <wizardpage id="pickSetupType"
+              label="&syncBrand.fullName.label;"
+              onpageshow="gSyncSetup.onPageShow()">
+    <vbox align="center" flex="1">
+      <description style="padding: 0 7em;">
+        &setup.pickSetupType.description2;
+      </description>
+      <spacer flex="3"/>
+      <button id="newAccount"
+              class="accountChoiceButton"
+              label="&button.createNewAccount.label;"
+              oncommand="gSyncSetup.startNewAccountSetup()"
+              align="center"/>
+      <spacer flex="1"/>
+    </vbox>
+    <separator class="groove"/>
+    <vbox align="center" flex="1">
+      <spacer flex="1"/>
+      <button id="existingAccount"
+              class="accountChoiceButton"
+              label="&button.haveAccount.label;"
+              oncommand="gSyncSetup.useExistingAccount()"/>
+      <spacer flex="3"/>
+    </vbox>
+  </wizardpage>
+
+  <wizardpage label="&setup.newAccountDetailsPage.title.label;"
+              id="newAccountStart"
+              onextra1="gSyncSetup.onSyncOptions()"
+              onpageshow="gSyncSetup.onPageShow();">
+    <grid>
+      <columns>
+        <column/>
+        <column class="inputColumn" flex="1"/>
+      </columns>
+      <rows>
+        <row id="emailRow" align="center">
+          <label value="&setup.emailAddress.label;"
+                 accesskey="&setup.emailAddress.accesskey;"
+                 control="weaveEmail"/>
+          <textbox id="weaveEmail"
+                   oninput="gSyncSetup.onEmailInput()"/>
+        </row>
+        <row id="emailFeedbackRow" align="center" hidden="true">
+          <spacer/>
+          <hbox>
+            <image class="statusIcon"/>
+            <label class="status" value=" "/>
+          </hbox>
+        </row>
+        <row id="passwordRow" align="center">
+          <label value="&setup.choosePassword.label;"
+                 accesskey="&setup.choosePassword.accesskey;"
+                 control="weavePassword"/>
+          <textbox id="weavePassword"
+                   type="password"
+                   onchange="gSyncSetup.onPasswordChange()"/>
+        </row>
+        <row id="confirmRow" align="center">
+          <label value="&setup.confirmPassword.label;"
+                 accesskey="&setup.confirmPassword.accesskey;"
+                 control="weavePasswordConfirm"/>
+          <textbox id="weavePasswordConfirm"
+                   type="password"
+                   onchange="gSyncSetup.onPasswordChange()"/>
+        </row>
+        <row id="passwordFeedbackRow" align="center" hidden="true">
+          <spacer/>
+          <hbox>
+            <image class="statusIcon"/>
+            <label class="status" value=" "/>
+          </hbox>
+        </row>
+        <row align="center">
+          <label control="server"
+                 value="&server.label;"/>
+          <menulist id="server"
+                    oncommand="gSyncSetup.onServerCommand()"
+                    oninput="gSyncSetup.onServerInput()">
+            <menupopup>
+              <menuitem label="&serverType.default.label;"
+                        value="main"/>
+              <menuitem label="&serverType.custom2.label;"
+                        value="custom"/>
+            </menupopup>
+          </menulist>
+        </row>
+        <row id="serverFeedbackRow" align="center" hidden="true">
+          <spacer/>
+          <hbox>
+            <image class="statusIcon"/>
+            <label class="status" value=" "/>
+          </hbox>
+        </row>
+        <row id="TOSRow" align="center">
+          <spacer/>
+          <hbox align="center">
+            <checkbox id="tos"
+                      accesskey="&setup.tosAgree1.accesskey;"
+                      oncommand="this.focus(); gSyncSetup.checkFields();"/>
+            <description id="tosDesc"
+                         flex="1"
+                         onclick="document.getElementById('tos').focus();
+                                  document.getElementById('tos').click()">
+              &setup.tosAgree1.label;
+              <label class="text-link"
+                     onclick="event.stopPropagation();gSyncUtils.openToS();">
+                &setup.tosLink.label;
+              </label>
+              &setup.tosAgree2.label;
+              <label class="text-link"
+                     onclick="event.stopPropagation();gSyncUtils.openPrivacyPolicy();">
+                &setup.ppLink.label;
+              </label>
+              &setup.tosAgree3.label;
+            </description>
+          </hbox>
+        </row>
+      </rows>
+    </grid>
+    <spacer flex="1"/>
+    <vbox flex="1" align="center">
+      <browser height="150"
+               width="500"
+               id="captcha"
+               type="content"
+               disablehistory="true"/>
+      <spacer flex="1"/>
+      <hbox id="captchaFeedback">
+        <image class="statusIcon"/>
+        <label class="status" value=" "/>
+      </hbox>
+    </vbox>
+  </wizardpage>
+
+  <wizardpage id="addDevice"
+              label="&pairDevice.title.label;"
+              onextra1="gSyncSetup.onSyncOptions()"
+              onpageshow="gSyncSetup.onPageShow()">
+    <description>
+      &pairDevice.setup.description.label;
+      <label class="text-link"
+             value="&addDevice.showMeHow.label;"
+             href="https://services.mozilla.com/sync/help/easy-setup"/>
+    </description>
+    <label value="&addDevice.setup.enterCode.label;"
+           control="easySetupPIN1"/>
+    <spacer flex="1"/>
+    <vbox align="center" flex="1">
+      <textbox id="easySetupPIN1"
+               class="pin"
+               value=""
+               readonly="true"
+               />
+      <textbox id="easySetupPIN2"
+               class="pin"
+               value=""
+               readonly="true"
+               />
+      <textbox id="easySetupPIN3"
+               class="pin"
+               value=""
+               readonly="true"
+               />
+    </vbox>
+    <spacer flex="3"/>
+    <label class="text-link"
+           value="&addDevice.dontHaveDevice.label;"
+           onclick="gSyncSetup.manualSetup();"/>
+  </wizardpage>
+
+  <wizardpage id="existingAccount"
+              label="&setup.signInPage.title.label;"
+              onextra1="gSyncSetup.onSyncOptions()"
+              onpageshow="gSyncSetup.onPageShow()">
+      <grid>
+        <columns>
+          <column/>
+          <column class="inputColumn" flex="1"/>
+        </columns>
+        <rows>
+          <row id="existingAccountRow" align="center">
+            <label id="existingAccountLabel"
+                   value="&signIn.account2.label;"
+                   accesskey="&signIn.account2.accesskey;"
+                   control="existingAccount"/>
+            <textbox id="existingAccountName"
+                     oninput="gSyncSetup.checkFields(event)"
+                     onchange="gSyncSetup.checkFields(event)"/>
+          </row>
+          <row id="existingPasswordRow" align="center">
+            <label id="existingPasswordLabel"
+                   value="&signIn.password.label;"
+                   accesskey="&signIn.password.accesskey;"
+                   control="existingPassword"/>
+            <textbox id="existingPassword"
+                     type="password"
+                     onkeyup="gSyncSetup.checkFields(event)"
+                     onchange="gSyncSetup.checkFields(event)"/>
+          </row>
+          <row id="existingPasswordFeedbackRow" align="center" hidden="true">
+            <spacer/>
+            <hbox>
+              <image class="statusIcon"/>
+              <label class="status" value=" "/>
+            </hbox>
+          </row>
+          <row align="center">
+            <spacer/>
+            <label class="text-link"
+                   value="&resetPassword.label;"
+                   onclick="gSyncUtils.resetPassword(); return false;"/>
+          </row>
+          <row align="center">
+            <label control="existingServer"
+                   value="&server.label;"/>
+            <menulist id="existingServer"
+                      oncommand="gSyncSetup.onExistingServerCommand()"
+                      oninput="gSyncSetup.onExistingServerInput()">
+              <menupopup>
+                <menuitem label="&serverType.default.label;"
+                          value="main"/>
+                <menuitem label="&serverType.custom2.label;"
+                          value="custom"/>
+              </menupopup>
+            </menulist>
+          </row>
+          <row id="existingServerFeedbackRow" align="center" hidden="true">
+            <spacer/>
+            <hbox>
+              <image class="statusIcon"/>
+              <vbox>
+                <label class="status" value=" "/>
+              </vbox>
+            </hbox>
+          </row>
+        </rows>
+      </grid>
+
+    <groupbox>
+      <label id="existingPassphraseLabel"
+             value="&signIn.recoveryKey.label;"
+             accesskey="&signIn.recoveryKey.accesskey;"
+             control="existingPassphrase"/>
+      <textbox id="existingPassphrase"
+               oninput="gSyncSetup.checkFields()"/>
+      <hbox id="login-throbber" hidden="true">
+        <image/>
+        <label value="&verifying.label;"/>
+      </hbox>
+      <vbox align="left" id="existingPassphraseFeedbackRow" hidden="true">
+        <hbox>
+          <image class="statusIcon"/>
+          <label class="status" value=" "/>
+        </hbox>
+      </vbox>
+    </groupbox>
+
+    <vbox id="passphraseHelpBox">
+      <description>
+        &existingRecoveryKey.description;
+        <label class="text-link"
+               href="https://services.mozilla.com/sync/help/manual-setup">
+          &addDevice.showMeHow.label;
+        </label>
+        <spacer id="passphraseHelpSpacer"/>
+        <label class="text-link"
+               onclick="gSyncSetup.resetPassphrase(); return false;">
+          &resetSyncKey.label;
+        </label>
+      </description>
+    </vbox>
+  </wizardpage>
+
+  <wizardpage id="syncOptionsPage"
+              label="&setup.optionsPage.title;"
+              onpageshow="gSyncSetup.onPageShow()">
+    <groupbox id="syncOptions">
+    <grid>
+      <columns>
+        <column/>
+        <column flex="1" style="margin-inline-end: 2px"/>
+      </columns>
+      <rows>
+        <row align="center">
+          <label value="&syncDeviceName.label;"
+                 accesskey="&syncDeviceName.accesskey;"
+                 control="syncComputerName"/>
+          <textbox id="syncComputerName" flex="1"
+                   onchange="gSyncUtils.changeName(this)"/>
+        </row>
+        <row>
+          <label value="&syncMy.label;" />
+          <vbox>
+            <checkbox label="&engine.addons.label;"
+                      accesskey="&engine.addons.accesskey;"
+                      id="engine.addons"
+                      checked="true"/>
+            <checkbox label="&engine.bookmarks.label;"
+                      accesskey="&engine.bookmarks.accesskey;"
+                      id="engine.bookmarks"
+                      checked="true"/>
+            <checkbox label="&engine.passwords.label;"
+                      accesskey="&engine.passwords.accesskey;"
+                      id="engine.passwords"
+                      checked="true"/>
+            <checkbox label="&engine.prefs.label;"
+                      accesskey="&engine.prefs.accesskey;"
+                      id="engine.prefs"
+                      checked="true"/>
+            <checkbox label="&engine.history.label;"
+                      accesskey="&engine.history.accesskey;"
+                      id="engine.history"
+                      checked="true"/>
+            <checkbox label="&engine.tabs.label2;"
+                      accesskey="&engine.tabs.accesskey;"
+                      id="engine.tabs"
+                      checked="true"/>
+          </vbox>
+        </row>
+      </rows>
+    </grid>
+    </groupbox>
+
+    <groupbox id="mergeOptions">
+      <radiogroup id="mergeChoiceRadio" pack="start">
+        <grid>
+          <columns>
+            <column/>
+            <column flex="1"/>
+          </columns>
+          <rows flex="1">
+            <row align="center">
+              <radio id="resetClient"
+                     class="mergeChoiceButton"
+                     aria-labelledby="resetClientLabel"/>
+              <label id="resetClientLabel" control="resetClient">
+                <html:strong>&choice2.merge.recommended.label;</html:strong>
+                &choice2a.merge.main.label;
+              </label>
+            </row>
+            <row align="center">
+              <radio id="wipeClient"
+                     class="mergeChoiceButton"
+                     aria-labelledby="wipeClientLabel"/>
+              <label id="wipeClientLabel"
+                     control="wipeClient">
+                &choice2a.client.main.label;
+              </label>
+            </row>
+            <row align="center">
+              <radio id="wipeRemote"
+                     class="mergeChoiceButton"
+                     aria-labelledby="wipeRemoteLabel"/>
+              <label id="wipeRemoteLabel"
+                     control="wipeRemote">
+                &choice2a.server.main.label;
+              </label>
+            </row>
+          </rows>
+        </grid>
+      </radiogroup>
+    </groupbox>
+  </wizardpage>
+
+  <wizardpage id="syncOptionsConfirm"
+              label="&setup.optionsConfirmPage.title;"
+              onpageshow="gSyncSetup.onPageShow()">
+      <deck id="chosenActionDeck">
+        <vbox id="chosenActionMerge" class="confirm">
+          <description class="normal">
+            &confirm.merge2.label;
+          </description>
+        </vbox>
+        <vbox id="chosenActionWipeClient" class="confirm">
+          <description class="normal">
+            &confirm.client3.label;
+          </description>
+          <separator class="thin"/>
+          <vbox id="dataList">
+            <label class="data indent" id="bookmarkCount"/>
+            <label class="data indent" id="historyCount"/>
+            <label class="data indent" id="passwordCount"/>
+            <label class="data indent" id="addonCount"/>
+            <label class="data indent" id="prefsWipe"
+                   value="&engine.prefs.label;"/>
+          </vbox>
+          <separator class="thin"/>
+          <description class="normal">
+            &confirm.client2.moreinfo.label;
+          </description>
+        </vbox>
+        <vbox id="chosenActionWipeServer" class="confirm">
+          <description class="normal">
+            &confirm.server2.label;
+          </description>
+          <separator class="thin"/>
+          <vbox id="clientList">
+          </vbox>
+        </vbox>
+      </deck>
+  </wizardpage>
+  <!-- In terms of the wizard flow shown to the user, the 'syncOptionsConfirm'
+       page above is not the last wizard page. To prevent the wizard binding from
+       assuming that it is, we're inserting this dummy page here. This also means
+      that the wizard needs to always be closed manually via wizardFinish(). -->
+  <wizardpage>
+  </wizardpage>
+</wizard>
+
new file mode 100644
--- /dev/null
+++ b/browser/base/content/sync/utils.js
@@ -0,0 +1,229 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+// Equivalent to 0o600 permissions; used for saved Sync Recovery Key.
+// This constant can be replaced when the equivalent values are available to
+// chrome JS; see Bug 433295 and Bug 757351.
+const PERMISSIONS_RWUSR = 0x180;
+
+// Weave should always exist before before this file gets included.
+var gSyncUtils = {
+  get bundle() {
+    delete this.bundle;
+    return this.bundle = Services.strings.createBundle("chrome://browser/locale/syncSetup.properties");
+  },
+
+  get fxAccountsEnabled() {
+    let service = Components.classes["@mozilla.org/weave/service;1"]
+                            .getService(Components.interfaces.nsISupports)
+                            .wrappedJSObject;
+    return service.fxAccountsEnabled;
+  },
+
+  // opens in a new window if we're in a modal prefwindow world, in a new tab otherwise
+  _openLink(url) {
+    let thisDocEl = document.documentElement,
+        openerDocEl = window.opener && window.opener.document.documentElement;
+    if (thisDocEl.id == "accountSetup" && window.opener &&
+        openerDocEl.id == "BrowserPreferences" && !openerDocEl.instantApply)
+      openUILinkIn(url, "window");
+    else if (thisDocEl.id == "BrowserPreferences" && !thisDocEl.instantApply)
+      openUILinkIn(url, "window");
+    else if (document.documentElement.id == "change-dialog")
+      Services.wm.getMostRecentWindow("navigator:browser")
+              .openUILinkIn(url, "tab");
+    else
+      openUILinkIn(url, "tab");
+  },
+
+  changeName: function changeName(input) {
+    // Make sure to update to a modified name, e.g., empty-string -> default
+    Weave.Service.clientsEngine.localName = input.value;
+    input.value = Weave.Service.clientsEngine.localName;
+  },
+
+  openChange: function openChange(type, duringSetup) {
+    // Just re-show the dialog if it's already open
+    let openedDialog = Services.wm.getMostRecentWindow("Sync:" + type);
+    if (openedDialog != null) {
+      openedDialog.focus();
+      return;
+    }
+
+    // Open up the change dialog
+    let changeXUL = "chrome://browser/content/sync/genericChange.xul";
+    let changeOpt = "centerscreen,chrome,resizable=no";
+    Services.ww.activeWindow.openDialog(changeXUL, "", changeOpt,
+                                        type, duringSetup);
+  },
+
+  changePassword() {
+    if (Weave.Utils.ensureMPUnlocked())
+      this.openChange("ChangePassword");
+  },
+
+  resetPassphrase(duringSetup) {
+    if (Weave.Utils.ensureMPUnlocked())
+      this.openChange("ResetPassphrase", duringSetup);
+  },
+
+  updatePassphrase() {
+    if (Weave.Utils.ensureMPUnlocked())
+      this.openChange("UpdatePassphrase");
+  },
+
+  resetPassword() {
+    this._openLink(Weave.Service.pwResetURL);
+  },
+
+  get tosURL() {
+    let root = this.fxAccountsEnabled ? "fxa." : "";
+    return Weave.Svc.Prefs.get(root + "termsURL");
+  },
+
+  openToS() {
+    this._openLink(this.tosURL);
+  },
+
+  get privacyPolicyURL() {
+    let root = this.fxAccountsEnabled ? "fxa." : "";
+    return Weave.Svc.Prefs.get(root + "privacyURL");
+  },
+
+  openPrivacyPolicy() {
+    this._openLink(this.privacyPolicyURL);
+  },
+
+  /**
+   * Prepare an invisible iframe with the passphrase backup document.
+   * Used by both the print and saving methods.
+   *
+   * @param elid : ID of the form element containing the passphrase.
+   * @param callback : Function called once the iframe has loaded.
+   */
+  _preparePPiframe(elid, callback) {
+    let pp = document.getElementById(elid).value;
+
+    // Create an invisible iframe whose contents we can print.
+    let iframe = document.createElement("iframe");
+    iframe.setAttribute("src", "chrome://browser/content/sync/key.xhtml");
+    iframe.collapsed = true;
+    document.documentElement.appendChild(iframe);
+    iframe.contentWindow.addEventListener("load", function() {
+      // Insert the Sync Key into the page.
+      let el = iframe.contentDocument.getElementById("synckey");
+      el.firstChild.nodeValue = pp;
+
+      // Insert the TOS and Privacy Policy URLs into the page.
+      let termsURL = Weave.Svc.Prefs.get("termsURL");
+      el = iframe.contentDocument.getElementById("tosLink");
+      el.setAttribute("href", termsURL);
+      el.firstChild.nodeValue = termsURL;
+
+      let privacyURL = Weave.Svc.Prefs.get("privacyURL");
+      el = iframe.contentDocument.getElementById("ppLink");
+      el.setAttribute("href", privacyURL);
+      el.firstChild.nodeValue = privacyURL;
+
+      callback(iframe);
+    }, {once: true});
+  },
+
+  /**
+   * Print passphrase backup document.
+   *
+   * @param elid : ID of the form element containing the passphrase.
+   */
+  passphrasePrint(elid) {
+    this._preparePPiframe(elid, function(iframe) {
+      let webBrowserPrint = iframe.contentWindow
+                                  .QueryInterface(Ci.nsIInterfaceRequestor)
+                                  .getInterface(Ci.nsIWebBrowserPrint);
+      let printSettings = PrintUtils.getPrintSettings();
+
+      // Display no header/footer decoration except for the date.
+      printSettings.headerStrLeft
+        = printSettings.headerStrCenter
+        = printSettings.headerStrRight
+        = printSettings.footerStrLeft
+        = printSettings.footerStrCenter = "";
+      printSettings.footerStrRight = "&D";
+
+      try {
+        webBrowserPrint.print(printSettings, null);
+      } catch (ex) {
+        // print()'s return codes are expressed as exceptions. Ignore.
+      }
+    });
+  },
+
+  /**
+   * Save passphrase backup document to disk as HTML file.
+   *
+   * @param elid : ID of the form element containing the passphrase.
+   */
+  passphraseSave(elid) {
+    let dialogTitle = this.bundle.GetStringFromName("save.recoverykey.title");
+    let defaultSaveName = this.bundle.GetStringFromName("save.recoverykey.defaultfilename");
+    this._preparePPiframe(elid, function(iframe) {
+      let fp = Cc["@mozilla.org/filepicker;1"].createInstance(Ci.nsIFilePicker);
+      let fpCallback = function fpCallback_done(aResult) {
+        if (aResult == Ci.nsIFilePicker.returnOK ||
+            aResult == Ci.nsIFilePicker.returnReplace) {
+          let stream = Cc["@mozilla.org/network/file-output-stream;1"].
+                       createInstance(Ci.nsIFileOutputStream);
+          stream.init(fp.file, -1, PERMISSIONS_RWUSR, 0);
+
+          let serializer = new XMLSerializer();
+          let output = serializer.serializeToString(iframe.contentDocument);
+          output = output.replace(/<!DOCTYPE (.|\n)*?]>/,
+            '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" ' +
+            '"DTD/xhtml1-strict.dtd">');
+          output = Weave.Utils.encodeUTF8(output);
+          stream.write(output, output.length);
+        }
+      };
+
+      fp.init(window, dialogTitle, Ci.nsIFilePicker.modeSave);
+      fp.appendFilters(Ci.nsIFilePicker.filterHTML);
+      fp.defaultString = defaultSaveName;
+      fp.open(fpCallback);
+      return false;
+    });
+  },
+
+  /**
+   * validatePassword
+   *
+   * @param el1 : the first textbox element in the form
+   * @param el2 : the second textbox element, if omitted it's an update form
+   *
+   * returns [valid, errorString]
+   */
+  validatePassword(el1, el2) {
+    let valid = false;
+    let val1 = el1.value;
+    let val2 = el2 ? el2.value : "";
+    let error = "";
+
+    if (!el2)
+      valid = val1.length >= Weave.MIN_PASS_LENGTH;
+    else if (val1 && val1 == Weave.Service.identity.username)
+      error = "change.password.pwSameAsUsername";
+    else if (val1 && val1 == Weave.Service.identity.account)
+      error = "change.password.pwSameAsEmail";
+    else if (val1 && val1 == Weave.Service.identity.basicPassword)
+      error = "change.password.pwSameAsPassword";
+    else if (val1 && val2) {
+      if (val1 == val2 && val1.length >= Weave.MIN_PASS_LENGTH)
+        valid = true;
+      else if (val1.length < Weave.MIN_PASS_LENGTH)
+        error = "change.password.tooShort";
+      else if (val1 != val2)
+        error = "change.password.mismatch";
+    }
+    let errorString = error ? Weave.Utils.getErrorString(error) : "";
+    return [valid, errorString];
+  }
+};
--- a/browser/base/content/test/general/browser.ini
+++ b/browser/base/content/test/general/browser.ini
@@ -313,16 +313,17 @@ skip-if = true # browser_drag.js is disa
 [browser_favicon_change_not_in_document.js]
 [browser_findbarClose.js]
 [browser_focusonkeydown.js]
 [browser_fullscreen-window-open.js]
 tags = fullscreen
 skip-if = os == "linux" # Linux: Intermittent failures - bug 941575.
 [browser_fxaccounts.js]
 support-files = fxa_profile_handler.sjs
+[browser_fxa_migrate.js]
 [browser_fxa_web_channel.js]
 [browser_gestureSupport.js]
 skip-if = e10s # Bug 863514 - no gesture support.
 [browser_getshortcutoruri.js]
 [browser_hide_removing.js]
 [browser_homeDrop.js]
 [browser_identity_UI.js]
 [browser_insecureLoginForms.js]
new file mode 100644
--- /dev/null
+++ b/browser/base/content/test/general/browser_fxa_migrate.js
@@ -0,0 +1,18 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+const STATE_CHANGED_TOPIC = "fxa-migration:state-changed";
+const NOTIFICATION_TITLE = "fxa-migration";
+
+var imports = {};
+Cu.import("resource://services-sync/FxaMigrator.jsm", imports);
+
+add_task(function* test() {
+  // Fake the state where we saw an EOL notification.
+  Services.obs.notifyObservers(null, STATE_CHANGED_TOPIC, null);
+
+  let notificationBox = document.getElementById("global-notificationbox");
+  Assert.ok(notificationBox.allNotifications.some(n => {
+    return n.getAttribute("value") == NOTIFICATION_TITLE;
+  }), "Disconnect notification should be present");
+});
--- a/browser/base/content/test/general/browser_fxaccounts.js
+++ b/browser/base/content/test/general/browser_fxaccounts.js
@@ -11,19 +11,19 @@ const TEST_ROOT = "http://example.com/br
 
 // instrument gFxAccounts to send observer notifications when it's done
 // what it does.
 (function() {
   let unstubs = {}; // The original functions we stub out.
 
   // The stub functions.
   let stubs = {
-    updateUI() {
-      return unstubs["updateUI"].call(gFxAccounts).then(() => {
-        Services.obs.notifyObservers(null, "test:browser_fxaccounts:updateUI", null);
+    updateAppMenuItem() {
+      return unstubs["updateAppMenuItem"].call(gFxAccounts).then(() => {
+        Services.obs.notifyObservers(null, "test:browser_fxaccounts:updateAppMenuItem", null);
       });
     },
     // Opening preferences is trickier than it should be as leaks are reported
     // due to the promises it fires off at load time  and there's no clear way to
     // know when they are done.
     // So just ensure openPreferences is called rather than whether it opens.
     openPreferences() {
       Services.obs.notifyObservers(null, "test:browser_fxaccounts:openPreferences", null);
@@ -67,17 +67,17 @@ add_task(function* initialize() {
 var panelUILabel = document.getElementById("PanelUI-fxa-label");
 var panelUIStatus = document.getElementById("PanelUI-fxa-status");
 var panelUIFooter = document.getElementById("PanelUI-footer-fxa");
 
 // The tests
 add_task(function* test_nouser() {
   let user = yield fxAccounts.getSignedInUser();
   Assert.strictEqual(user, null, "start with no user signed in");
-  let promiseUpdateDone = promiseObserver("test:browser_fxaccounts:updateUI");
+  let promiseUpdateDone = promiseObserver("test:browser_fxaccounts:updateAppMenuItem");
   Services.obs.notifyObservers(null, this.FxAccountsCommon.ONLOGOUT_NOTIFICATION, null);
   yield promiseUpdateDone;
 
   // Check the world - the FxA footer area is visible as it is offering a signin.
   Assert.ok(isFooterVisible())
 
   Assert.equal(panelUILabel.getAttribute("label"), panelUIStatus.getAttribute("defaultlabel"));
   Assert.equal(panelUIStatus.getAttribute("tooltiptext"), panelUIStatus.getAttribute("signedinTooltiptext"));
@@ -88,17 +88,17 @@ add_task(function* test_nouser() {
   panelUIStatus.click();
   yield promisePreferencesOpened;
 });
 
 /*
 XXX - Bug 1191162 - need a better hawk mock story or this will leak in debug builds.
 
 add_task(function* test_unverifiedUser() {
-  let promiseUpdateDone = promiseObserver("test:browser_fxaccounts:updateUI");
+  let promiseUpdateDone = promiseObserver("test:browser_fxaccounts:updateAppMenuItem");
   yield setSignedInUser(false); // this will fire the observer that does the update.
   yield promiseUpdateDone;
 
   // Check the world.
   Assert.ok(isFooterVisible())
 
   Assert.equal(panelUILabel.getAttribute("label"), "foo@example.com");
   Assert.equal(panelUIStatus.getAttribute("tooltiptext"),
@@ -107,20 +107,20 @@ add_task(function* test_unverifiedUser()
   let promisePreferencesOpened = promiseObserver("test:browser_fxaccounts:openPreferences");
   panelUIStatus.click();
   yield promisePreferencesOpened
   yield signOut();
 });
 */
 
 add_task(function* test_verifiedUserEmptyProfile() {
-  // We see 2 updateUI() calls - one for the signedInUser and one after
+  // We see 2 updateAppMenuItem() calls - one for the signedInUser and one after
   // we first fetch the profile. We want them both to fire or we aren't testing
   // the state we think we are testing.
-  let promiseUpdateDone = promiseObserver("test:browser_fxaccounts:updateUI", 2);
+  let promiseUpdateDone = promiseObserver("test:browser_fxaccounts:updateAppMenuItem", 2);
   configureProfileURL({}); // successful but empty profile.
   yield setSignedInUser(true); // this will fire the observer that does the update.
   yield promiseUpdateDone;
 
   // Check the world.
   Assert.ok(isFooterVisible())
   Assert.equal(panelUILabel.getAttribute("label"), "foo@example.com");
   Assert.equal(panelUIStatus.getAttribute("tooltiptext"),
@@ -129,32 +129,32 @@ add_task(function* test_verifiedUserEmpt
 
   let promisePreferencesOpened = promiseObserver("test:browser_fxaccounts:openPreferences");
   panelUIStatus.click();
   yield promisePreferencesOpened;
   yield signOut();
 });
 
 add_task(function* test_verifiedUserDisplayName() {
-  let promiseUpdateDone = promiseObserver("test:browser_fxaccounts:updateUI", 2);
+  let promiseUpdateDone = promiseObserver("test:browser_fxaccounts:updateAppMenuItem", 2);
   configureProfileURL({ displayName: "Test User Display Name" });
   yield setSignedInUser(true); // this will fire the observer that does the update.
   yield promiseUpdateDone;
 
   Assert.ok(isFooterVisible())
   Assert.equal(panelUILabel.getAttribute("label"), "Test User Display Name");
   Assert.equal(panelUIStatus.getAttribute("tooltiptext"),
                panelUIStatus.getAttribute("signedinTooltiptext"));
   Assert.equal(panelUIFooter.getAttribute("fxastatus"), "signedin");
   yield signOut();
 });
 
 add_task(function* test_verifiedUserProfileFailure() {
   // profile failure means only one observer fires.
-  let promiseUpdateDone = promiseObserver("test:browser_fxaccounts:updateUI", 1);
+  let promiseUpdateDone = promiseObserver("test:browser_fxaccounts:updateAppMenuItem", 1);
   configureProfileURL(null, 500);
   yield setSignedInUser(true); // this will fire the observer that does the update.
   yield promiseUpdateDone;
 
   Assert.ok(isFooterVisible())
   Assert.equal(panelUILabel.getAttribute("label"), "foo@example.com");
   Assert.equal(panelUIStatus.getAttribute("tooltiptext"),
                panelUIStatus.getAttribute("signedinTooltiptext"));
@@ -245,13 +245,13 @@ function setSignedInUser(verified) {
   }
   return fxAccounts.setSignedInUser(data);
 }
 
 var signOut = Task.async(function* () {
   // This test needs to make sure that any updates for the logout have
   // completed before starting the next test, or we see the observer
   // notifications get out of sync.
-  let promiseUpdateDone = promiseObserver("test:browser_fxaccounts:updateUI");
+  let promiseUpdateDone = promiseObserver("test:browser_fxaccounts:updateAppMenuItem");
   // we always want a "localOnly" signout here...
   yield fxAccounts.signOut(true);
   yield promiseUpdateDone;
 });
--- a/browser/base/jar.mn
+++ b/browser/base/jar.mn
@@ -134,16 +134,27 @@ browser.jar:
         content/browser/pageinfo/feeds.js             (content/pageinfo/feeds.js)
         content/browser/pageinfo/feeds.xml            (content/pageinfo/feeds.xml)
         content/browser/pageinfo/permissions.js       (content/pageinfo/permissions.js)
         content/browser/pageinfo/security.js          (content/pageinfo/security.js)
         content/browser/sync/aboutSyncTabs.xul        (content/sync/aboutSyncTabs.xul)
         content/browser/sync/aboutSyncTabs.js         (content/sync/aboutSyncTabs.js)
         content/browser/sync/aboutSyncTabs.css        (content/sync/aboutSyncTabs.css)
         content/browser/sync/aboutSyncTabs-bindings.xml  (content/sync/aboutSyncTabs-bindings.xml)
+        content/browser/sync/setup.xul                (content/sync/setup.xul)
+        content/browser/sync/addDevice.js             (content/sync/addDevice.js)
+        content/browser/sync/addDevice.xul            (content/sync/addDevice.xul)
+        content/browser/sync/setup.js                 (content/sync/setup.js)
+        content/browser/sync/genericChange.xul        (content/sync/genericChange.xul)
+        content/browser/sync/genericChange.js         (content/sync/genericChange.js)
+        content/browser/sync/key.xhtml                (content/sync/key.xhtml)
+        content/browser/sync/utils.js                 (content/sync/utils.js)
+*       content/browser/sync/customize.xul            (content/sync/customize.xul)
+        content/browser/sync/customize.js             (content/sync/customize.js)
+        content/browser/sync/customize.css            (content/sync/customize.css)
         content/browser/safeMode.css                  (content/safeMode.css)
         content/browser/safeMode.js                   (content/safeMode.js)
         content/browser/safeMode.xul                  (content/safeMode.xul)
         content/browser/sanitize.js                   (content/sanitize.js)
 *       content/browser/sanitize.xul                  (content/sanitize.xul)
 *       content/browser/sanitizeDialog.js             (content/sanitizeDialog.js)
         content/browser/sanitizeDialog.css            (content/sanitizeDialog.css)
         content/browser/contentSearchUI.js            (content/contentSearchUI.js)
--- a/browser/components/customizableui/content/panelUI.inc.xul
+++ b/browser/components/customizableui/content/panelUI.inc.xul
@@ -133,17 +133,17 @@
               <vbox class="PanelUI-remotetabs-instruction-box">
                 <hbox pack="center">
                   <image class="fxaSyncIllustration" alt=""/>
                 </hbox>
                 <label class="PanelUI-remotetabs-instruction-label">&appMenuRemoteTabs.tabsnotsyncing.label;</label>
                 <hbox pack="center">
                   <toolbarbutton class="PanelUI-remotetabs-prefs-button"
                                  label="&appMenuRemoteTabs.openprefs.label;"
-                                 oncommand="gSyncUI.openPrefs('synced-tabs');"/>
+                                 oncommand="gSyncUI.openSetup(null, 'synced-tabs');"/>
                 </hbox>
               </vbox>
             </hbox>
             <!-- Sync is ready to Sync but we are still fetching the tabs to show -->
             <vbox id="PanelUI-remotetabs-fetching">
               <!-- Show intentionally blank panel, see bug 1239845 -->
             </vbox>
             <!-- Sync has only 1 (ie, this) device connected -->
@@ -167,31 +167,31 @@
                 flex="1"
                 align="center"
                 class="PanelUI-remotetabs-instruction-box"
                 observes="sync-setup-state">
             <image class="fxaSyncIllustration" alt=""/>
             <label class="PanelUI-remotetabs-instruction-label">&appMenuRemoteTabs.notsignedin.label;</label>
             <toolbarbutton class="PanelUI-remotetabs-prefs-button"
                            label="&appMenuRemoteTabs.signin.label;"
-                           oncommand="gSyncUI.openPrefs('synced-tabs');"/>
+                           oncommand="gSyncUI.openSetup(null, 'synced-tabs');"/>
           </vbox>
           <!-- When Sync needs re-authentication. This uses the exact same messaging
                as "Sync is not configured" but remains a separate box so we get
                the goodness of observing broadcasters to manage the hidden states -->
           <vbox id="PanelUI-remotetabs-reauthsync"
                 flex="1"
                 align="center"
                 class="PanelUI-remotetabs-instruction-box"
                 observes="sync-reauth-state">
             <image class="fxaSyncIllustration" alt=""/>
             <label class="PanelUI-remotetabs-instruction-label">&appMenuRemoteTabs.notsignedin.label;</label>
             <toolbarbutton class="PanelUI-remotetabs-prefs-button"
                            label="&appMenuRemoteTabs.signin.label;"
-                           oncommand="gSyncUI.openPrefs('synced-tabs');"/>
+                           oncommand="gSyncUI.openSetup(null, 'synced-tabs');"/>
           </vbox>
         </hbox>
       </vbox>
     </panelview>
 
     <panelview id="PanelUI-bookmarks" flex="1" class="PanelUI-subView">
       <label value="&bookmarksMenu.label;" class="panel-subview-header"/>
       <vbox class="panel-subview-body">
--- a/browser/components/preferences/in-content/sync.js
+++ b/browser/components/preferences/in-content/sync.js
@@ -7,18 +7,21 @@ Components.utils.import("resource://gre/
 
 XPCOMUtils.defineLazyGetter(this, "FxAccountsCommon", function() {
   return Components.utils.import("resource://gre/modules/FxAccountsCommon.js", {});
 });
 
 XPCOMUtils.defineLazyModuleGetter(this, "fxAccounts",
   "resource://gre/modules/FxAccounts.jsm");
 
-const FXA_PAGE_LOGGED_OUT = 0;
-const FXA_PAGE_LOGGED_IN = 1;
+const PAGE_NO_ACCOUNT = 0;
+const PAGE_HAS_ACCOUNT = 1;
+const PAGE_NEEDS_UPDATE = 2;
+const FXA_PAGE_LOGGED_OUT = 3;
+const FXA_PAGE_LOGGED_IN = 4;
 
 // Indexes into the "login status" deck.
 // We are in a successful verified state - everything should work!
 const FXA_LOGIN_VERIFIED = 0;
 // We have logged in to an unverified account.
 const FXA_LOGIN_UNVERIFIED = 1;
 // We are logged in locally, but the server rejected our credentials.
 const FXA_LOGIN_FAILED = 2;
@@ -30,16 +33,27 @@ var gSyncPane = {
   get page() {
     return document.getElementById("weavePrefsDeck").selectedIndex;
   },
 
   set page(val) {
     document.getElementById("weavePrefsDeck").selectedIndex = val;
   },
 
+  get _usingCustomServer() {
+    return Weave.Svc.Prefs.isSet("serverURL");
+  },
+
+  needsUpdate() {
+    this.page = PAGE_NEEDS_UPDATE;
+    let label = document.getElementById("loginError");
+    label.textContent = Weave.Utils.getErrorString(Weave.Status.login);
+    label.className = "error";
+  },
+
   init() {
     this._setupEventListeners();
 
     // If the Service hasn't finished initializing, wait for it.
     let xps = Components.classes["@mozilla.org/weave/service;1"]
                                 .getService(Components.interfaces.nsISupports)
                                 .wrappedJSObject;
 
@@ -73,29 +87,30 @@ var gSyncPane = {
 
   _showLoadPage(xps) {
     let username;
     try {
       username = Services.prefs.getCharPref("services.sync.username");
     } catch (e) {}
     if (!username) {
       this.page = FXA_PAGE_LOGGED_OUT;
-      return;
+    } else if (xps.fxAccountsEnabled) {
+      // Use cached values while we wait for the up-to-date values
+      let cachedComputerName;
+      try {
+        cachedComputerName = Services.prefs.getCharPref("services.sync.client.name");
+      } catch (e) {
+        cachedComputerName = "";
+      }
+      document.getElementById("fxaEmailAddress1").textContent = username;
+      this._populateComputerName(cachedComputerName);
+      this.page = FXA_PAGE_LOGGED_IN;
+    } else { // Old Sync
+      this.page = PAGE_HAS_ACCOUNT;
     }
-
-    // Use cached values while we wait for the up-to-date values
-    let cachedComputerName;
-    try {
-      cachedComputerName = Services.prefs.getCharPref("services.sync.client.name");
-    } catch (e) {
-      cachedComputerName = "";
-    }
-    document.getElementById("fxaEmailAddress1").textContent = username;
-    this._populateComputerName(cachedComputerName);
-    this.page = FXA_PAGE_LOGGED_IN;
   },
 
   _init() {
     let topics = ["weave:service:login:error",
                   "weave:service:login:finish",
                   "weave:service:start-over:finish",
                   "weave:service:setup-complete",
                   "weave:service:logout:finish",
@@ -111,29 +126,35 @@ var gSyncPane = {
     }, this);
 
     window.addEventListener("unload", function() {
       topics.forEach(function(topic) {
         Weave.Svc.Obs.remove(topic, this.updateWeavePrefs, this);
       }, gSyncPane);
     });
 
+    XPCOMUtils.defineLazyGetter(this, "_stringBundle", () => {
+      return Services.strings.createBundle("chrome://browser/locale/preferences/preferences.properties");
+    });
+
     XPCOMUtils.defineLazyGetter(this, "_accountsStringBundle", () => {
       return Services.strings.createBundle("chrome://browser/locale/accounts.properties");
     });
 
     let url = Services.prefs.getCharPref("identity.mobilepromo.android") + "sync-preferences";
     document.getElementById("fxaMobilePromo-android").setAttribute("href", url);
     document.getElementById("fxaMobilePromo-android-hasFxaAccount").setAttribute("href", url);
     url = Services.prefs.getCharPref("identity.mobilepromo.ios") + "sync-preferences";
     document.getElementById("fxaMobilePromo-ios").setAttribute("href", url);
     document.getElementById("fxaMobilePromo-ios-hasFxaAccount").setAttribute("href", url);
 
-    document.getElementById("tosPP-small-ToS").setAttribute("href", Weave.Svc.Prefs.get("fxa.termsURL"));
-    document.getElementById("tosPP-small-PP").setAttribute("href", Weave.Svc.Prefs.get("fxa.privacyURL"));
+    document.getElementById("tosPP-small-ToS").setAttribute("href", gSyncUtils.tosURL);
+    document.getElementById("tosPP-normal-ToS").setAttribute("href", gSyncUtils.tosURL);
+    document.getElementById("tosPP-small-PP").setAttribute("href", gSyncUtils.privacyPolicyURL);
+    document.getElementById("tosPP-normal-PP").setAttribute("href", gSyncUtils.privacyPolicyURL);
 
     fxAccounts.promiseAccountsManageURI(this._getEntryPoint()).then(accountsManageURI => {
       document.getElementById("verifiedManage").setAttribute("href", accountsManageURI);
     });
 
     this.updateWeavePrefs();
 
     this._initProfileImageUI();
@@ -174,16 +195,40 @@ var gSyncPane = {
   },
 
   _setupEventListeners() {
     function setEventListener(aId, aEventType, aCallback) {
       document.getElementById(aId)
               .addEventListener(aEventType, aCallback.bind(gSyncPane));
     }
 
+    setEventListener("noAccountSetup", "click", function(aEvent) {
+      aEvent.stopPropagation();
+      gSyncPane.openSetup(null);
+    });
+    setEventListener("noAccountPair", "click", function(aEvent) {
+      aEvent.stopPropagation();
+      gSyncPane.openSetup("pair");
+    });
+    setEventListener("syncChangePassword", "command",
+      () => gSyncUtils.changePassword());
+    setEventListener("syncResetPassphrase", "command",
+      () => gSyncUtils.resetPassphrase());
+    setEventListener("syncReset", "command", gSyncPane.resetSync);
+    setEventListener("syncAddDeviceLabel", "click", function() {
+      gSyncPane.openAddDevice();
+      return false;
+    });
+    setEventListener("syncEnginesList", "select", function() {
+      if (this.selectedCount)
+        this.clearSelection();
+    });
+    setEventListener("syncComputerName", "change", function(e) {
+      gSyncUtils.changeName(e.target);
+    });
     setEventListener("fxaChangeDeviceName", "command", function() {
       this._toggleComputerNameControls(true);
       this._focusComputerNameTextbox();
     });
     setEventListener("fxaCancelChangeDeviceName", "command", function() {
       // We explicitly blur the textbox because of bug 75324, then after
       // changing the state of the buttons, force focus to whatever the focus
       // manager thinks should be next (which on the mac, depends on an OSX
@@ -195,16 +240,32 @@ var gSyncPane = {
     });
     setEventListener("fxaSaveChangeDeviceName", "command", function() {
       // Work around bug 75324 - see above.
       this._blurComputerNameTextbox();
       this._toggleComputerNameControls(false);
       this._updateComputerNameValue(true);
       this._focusAfterComputerNameTextbox();
     });
+    setEventListener("unlinkDevice", "click", function() {
+      gSyncPane.startOver(true);
+      return false;
+    });
+    setEventListener("loginErrorUpdatePass", "click", function() {
+      gSyncPane.updatePass();
+      return false;
+    });
+    setEventListener("loginErrorResetPass", "click", function() {
+      gSyncPane.resetPass();
+      return false;
+    });
+    setEventListener("loginErrorStartOver", "click", function() {
+      gSyncPane.startOver(true);
+      return false;
+    });
     setEventListener("noFxaSignUp", "command", function() {
       gSyncPane.signUp();
       return false;
     });
     setEventListener("noFxaSignIn", "command", function() {
       gSyncPane.signIn();
       return false;
     });
@@ -238,114 +299,171 @@ var gSyncPane = {
       }
     } catch (e) { }
   },
 
   updateWeavePrefs() {
     let service = Components.classes["@mozilla.org/weave/service;1"]
                   .getService(Components.interfaces.nsISupports)
                   .wrappedJSObject;
-
-    let displayNameLabel = document.getElementById("fxaDisplayName");
-    let fxaEmailAddress1Label = document.getElementById("fxaEmailAddress1");
-    fxaEmailAddress1Label.hidden = false;
-    displayNameLabel.hidden = true;
+    // service.fxAccountsEnabled is false iff sync is already configured for
+    // the legacy provider.
+    if (service.fxAccountsEnabled) {
+      let displayNameLabel = document.getElementById("fxaDisplayName");
+      let fxaEmailAddress1Label = document.getElementById("fxaEmailAddress1");
+      fxaEmailAddress1Label.hidden = false;
+      displayNameLabel.hidden = true;
 
-    let profileInfoEnabled;
-    try {
-      profileInfoEnabled = Services.prefs.getBoolPref("identity.fxaccounts.profile_image.enabled");
-    } catch (ex) {}
+      let profileInfoEnabled;
+      try {
+        profileInfoEnabled = Services.prefs.getBoolPref("identity.fxaccounts.profile_image.enabled");
+      } catch (ex) {}
 
-    // determine the fxa status...
-    this._showLoadPage(service);
+      // determine the fxa status...
+      this._showLoadPage(service);
 
-    fxAccounts.getSignedInUser().then(data => {
-      if (!data) {
-        this.page = FXA_PAGE_LOGGED_OUT;
-        return false;
-      }
-      this.page = FXA_PAGE_LOGGED_IN;
-      // We are logged in locally, but maybe we are in a state where the
-      // server rejected our credentials (eg, password changed on the server)
-      let fxaLoginStatus = document.getElementById("fxaLoginStatus");
-      let syncReady;
-      // Not Verfied implies login error state, so check that first.
-      if (!data.verified) {
-        fxaLoginStatus.selectedIndex = FXA_LOGIN_UNVERIFIED;
-        syncReady = false;
-      // So we think we are logged in, so login problems are next.
-      // (Although if the Sync identity manager is still initializing, we
-      // ignore login errors and assume all will eventually be good.)
-      // LOGIN_FAILED_LOGIN_REJECTED explicitly means "you must log back in".
-      // All other login failures are assumed to be transient and should go
-      // away by themselves, so aren't reflected here.
-      } else if (Weave.Status.login == Weave.LOGIN_FAILED_LOGIN_REJECTED) {
-        fxaLoginStatus.selectedIndex = FXA_LOGIN_FAILED;
-        syncReady = false;
-      // Else we must be golden (or in an error state we expect to magically
-      // resolve itself)
-      } else {
-        fxaLoginStatus.selectedIndex = FXA_LOGIN_VERIFIED;
-        syncReady = true;
-      }
-      fxaEmailAddress1Label.textContent = data.email;
-      document.getElementById("fxaEmailAddress2").textContent = data.email;
-      document.getElementById("fxaEmailAddress3").textContent = data.email;
-      this._populateComputerName(Weave.Service.clientsEngine.localName);
-      let engines = document.getElementById("fxaSyncEngines")
-      for (let checkbox of engines.querySelectorAll("checkbox")) {
-        checkbox.disabled = !syncReady;
-      }
-      document.getElementById("fxaChangeDeviceName").disabled = !syncReady;
+      fxAccounts.getSignedInUser().then(data => {
+        if (!data) {
+          this.page = FXA_PAGE_LOGGED_OUT;
+          return false;
+        }
+        this.page = FXA_PAGE_LOGGED_IN;
+        // We are logged in locally, but maybe we are in a state where the
+        // server rejected our credentials (eg, password changed on the server)
+        let fxaLoginStatus = document.getElementById("fxaLoginStatus");
+        let syncReady;
+        // Not Verfied implies login error state, so check that first.
+        if (!data.verified) {
+          fxaLoginStatus.selectedIndex = FXA_LOGIN_UNVERIFIED;
+          syncReady = false;
+        // So we think we are logged in, so login problems are next.
+        // (Although if the Sync identity manager is still initializing, we
+        // ignore login errors and assume all will eventually be good.)
+        // LOGIN_FAILED_LOGIN_REJECTED explicitly means "you must log back in".
+        // All other login failures are assumed to be transient and should go
+        // away by themselves, so aren't reflected here.
+        } else if (Weave.Status.login == Weave.LOGIN_FAILED_LOGIN_REJECTED) {
+          fxaLoginStatus.selectedIndex = FXA_LOGIN_FAILED;
+          syncReady = false;
+        // Else we must be golden (or in an error state we expect to magically
+        // resolve itself)
+        } else {
+          fxaLoginStatus.selectedIndex = FXA_LOGIN_VERIFIED;
+          syncReady = true;
+        }
+        fxaEmailAddress1Label.textContent = data.email;
+        document.getElementById("fxaEmailAddress2").textContent = data.email;
+        document.getElementById("fxaEmailAddress3").textContent = data.email;
+        this._populateComputerName(Weave.Service.clientsEngine.localName);
+        let engines = document.getElementById("fxaSyncEngines")
+        for (let checkbox of engines.querySelectorAll("checkbox")) {
+          checkbox.disabled = !syncReady;
+        }
+        document.getElementById("fxaChangeDeviceName").disabled = !syncReady;
 
-      // Clear the profile image (if any) of the previously logged in account.
-      document.getElementById("fxaProfileImage").style.removeProperty("list-style-image");
+        // Clear the profile image (if any) of the previously logged in account.
+        document.getElementById("fxaProfileImage").style.removeProperty("list-style-image");
 
-      // If the account is verified the next promise in the chain will
-      // fetch profile data.
-      return data.verified;
-    }).then(isVerified => {
-      if (isVerified) {
-        return fxAccounts.getSignedInUserProfile();
-      }
-      return null;
-    }).then(data => {
-      let fxaLoginStatus = document.getElementById("fxaLoginStatus");
-      if (data && profileInfoEnabled) {
-        if (data.displayName) {
-          fxaLoginStatus.setAttribute("hasName", true);
-          displayNameLabel.hidden = false;
-          displayNameLabel.textContent = data.displayName;
+        // If the account is verified the next promise in the chain will
+        // fetch profile data.
+        return data.verified;
+      }).then(isVerified => {
+        if (isVerified) {
+          return fxAccounts.getSignedInUserProfile();
+        }
+        return null;
+      }).then(data => {
+        let fxaLoginStatus = document.getElementById("fxaLoginStatus");
+        if (data && profileInfoEnabled) {
+          if (data.displayName) {
+            fxaLoginStatus.setAttribute("hasName", true);
+            displayNameLabel.hidden = false;
+            displayNameLabel.textContent = data.displayName;
+          } else {
+            fxaLoginStatus.removeAttribute("hasName");
+          }
+          if (data.avatar) {
+            let bgImage = "url(\"" + data.avatar + "\")";
+            let profileImageElement = document.getElementById("fxaProfileImage");
+            profileImageElement.style.listStyleImage = bgImage;
+
+            let img = new Image();
+            img.onerror = () => {
+              // Clear the image if it has trouble loading. Since this callback is asynchronous
+              // we check to make sure the image is still the same before we clear it.
+              if (profileImageElement.style.listStyleImage === bgImage) {
+                profileImageElement.style.removeProperty("list-style-image");
+              }
+            };
+            img.src = data.avatar;
+          }
         } else {
           fxaLoginStatus.removeAttribute("hasName");
         }
-        if (data.avatar) {
-          let bgImage = "url(\"" + data.avatar + "\")";
-          let profileImageElement = document.getElementById("fxaProfileImage");
-          profileImageElement.style.listStyleImage = bgImage;
+      }, err => {
+        FxAccountsCommon.log.error(err);
+      }).catch(err => {
+        // If we get here something's really busted
+        Cu.reportError(String(err));
+      });
+
+    // If fxAccountEnabled is false and we are in a "not configured" state,
+    // then fxAccounts is probably fully disabled rather than just unconfigured,
+    // so handle this case.  This block can be removed once we remove support
+    // for fxAccounts being disabled.
+    } else if (Weave.Status.service == Weave.CLIENT_NOT_CONFIGURED ||
+               Weave.Svc.Prefs.get("firstSync", "") == "notReady") {
+      this.page = PAGE_NO_ACCOUNT;
+    // else: sync was previously configured for the legacy provider, so we
+    // make the "old" panels available.
+    } else if (Weave.Status.login == Weave.LOGIN_FAILED_INVALID_PASSPHRASE ||
+               Weave.Status.login == Weave.LOGIN_FAILED_LOGIN_REJECTED) {
+      this.needsUpdate();
+    } else {
+      this.page = PAGE_HAS_ACCOUNT;
+      document.getElementById("accountName").textContent = Weave.Service.identity.account;
+      document.getElementById("syncComputerName").value = Weave.Service.clientsEngine.localName;
+      document.getElementById("tosPP-normal").hidden = this._usingCustomServer;
+    }
+  },
 
-          let img = new Image();
-          img.onerror = () => {
-            // Clear the image if it has trouble loading. Since this callback is asynchronous
-            // we check to make sure the image is still the same before we clear it.
-            if (profileImageElement.style.listStyleImage === bgImage) {
-              profileImageElement.style.removeProperty("list-style-image");
-            }
-          };
-          img.src = data.avatar;
-        }
-      } else {
-        fxaLoginStatus.removeAttribute("hasName");
-      }
-    }, err => {
-      FxAccountsCommon.log.error(err);
-    }).catch(err => {
-      // If we get here something's really busted
-      Cu.reportError(String(err));
-    });
+  startOver(showDialog) {
+    if (showDialog) {
+      let flags = Services.prompt.BUTTON_POS_0 * Services.prompt.BUTTON_TITLE_IS_STRING +
+                  Services.prompt.BUTTON_POS_1 * Services.prompt.BUTTON_TITLE_CANCEL +
+                  Services.prompt.BUTTON_POS_1_DEFAULT;
+      let buttonChoice =
+        Services.prompt.confirmEx(window,
+                                  this._stringBundle.GetStringFromName("syncUnlink.title"),
+                                  this._stringBundle.GetStringFromName("syncUnlink.label"),
+                                  flags,
+                                  this._stringBundle.GetStringFromName("syncUnlinkConfirm.label"),
+                                  null, null, null, {});
+
+      // If the user selects cancel, just bail
+      if (buttonChoice == 1)
+        return;
+    }
+
+    Weave.Service.startOver();
+    this.updateWeavePrefs();
+  },
+
+  updatePass() {
+    if (Weave.Status.login == Weave.LOGIN_FAILED_LOGIN_REJECTED)
+      gSyncUtils.changePassword();
+    else
+      gSyncUtils.updatePassphrase();
+  },
+
+  resetPass() {
+    if (Weave.Status.login == Weave.LOGIN_FAILED_LOGIN_REJECTED)
+      gSyncUtils.resetPassword();
+    else
+      gSyncUtils.resetPassphrase();
   },
 
   _getEntryPoint() {
     let params = new URLSearchParams(document.URL.split("#")[0].split("?")[1] || "");
     return params.get("entrypoint") || "preferences";
   },
 
   _openAboutAccounts(action) {
@@ -354,20 +472,51 @@ var gSyncPane = {
     if (action) {
       params.set("action", action);
     }
     params.set("entrypoint", entryPoint);
 
     this.replaceTabWithUrl("about:accounts?" + params);
   },
 
+  /**
+   * Invoke the Sync setup wizard.
+   *
+   * @param wizardType
+   *        Indicates type of wizard to launch:
+   *          null    -- regular set up wizard
+   *          "pair"  -- pair a device first
+   *          "reset" -- reset sync
+   */
+  openSetup(wizardType) {
+    let service = Components.classes["@mozilla.org/weave/service;1"]
+                  .getService(Components.interfaces.nsISupports)
+                  .wrappedJSObject;
+
+    if (service.fxAccountsEnabled) {
+      this._openAboutAccounts();
+    } else {
+      let win = Services.wm.getMostRecentWindow("Weave:AccountSetup");
+      if (win)
+        win.focus();
+      else {
+        window.openDialog("chrome://browser/content/sync/setup.xul",
+                          "weaveSetup", "centerscreen,chrome,resizable=no",
+                          wizardType);
+      }
+    }
+  },
+
   openContentInBrowser(url, options) {
     let win = Services.wm.getMostRecentWindow("navigator:browser");
     if (!win) {
-      openUILinkIn(url, "tab");
+      // no window to use, so use _openLink to create a new one.  We don't
+      // always use that as it prefers to open a new window rather than use
+      // an existing one.
+      gSyncUtils._openLink(url);
       return;
     }
     win.switchToTabHavingURI(url, true, options);
   },
 
   // Replace the current tab with the specified URL.
   replaceTabWithUrl(url) {
     // Get the <browser> element hosting us.
@@ -453,16 +602,21 @@ var gSyncPane = {
       }
     };
 
     fxAccounts.resendVerificationEmail()
       .then(fxAccounts.getSignedInUser, onError)
       .then(onSuccess, onError);
   },
 
+  openOldSyncSupportPage() {
+    let url = Services.urlFormatter.formatURLPref("app.support.baseURL") + "old-sync";
+    this.openContentInBrowser(url);
+  },
+
   unlinkFirefoxAccount(confirm) {
     if (confirm) {
       // We use a string bundle shared with aboutAccounts.
       let sb = Services.strings.createBundle("chrome://browser/locale/syncSetup.properties");
       let disconnectLabel = sb.GetStringFromName("disconnect.label");
       let title = sb.GetStringFromName("disconnect.verify.title");
       let body = sb.GetStringFromName("disconnect.verify.bodyHeading") +
                  "\n\n" +
@@ -485,16 +639,32 @@ var gSyncPane = {
         return;
       }
     }
     fxAccounts.signOut().then(() => {
       this.updateWeavePrefs();
     });
   },
 
+  openAddDevice() {
+    if (!Weave.Utils.ensureMPUnlocked())
+      return;
+
+    let win = Services.wm.getMostRecentWindow("Sync:AddDevice");
+    if (win)
+      win.focus();
+    else
+      window.openDialog("chrome://browser/content/sync/addDevice.xul",
+                        "syncAddDevice", "centerscreen,chrome,resizable=no");
+  },
+
+  resetSync() {
+    this.openSetup("reset");
+  },
+
   _populateComputerName(value) {
     let textbox = document.getElementById("fxaSyncComputerName");
     if (!textbox.hasAttribute("placeholder")) {
       textbox.setAttribute("placeholder",
                            Weave.Utils.getDefaultDeviceName());
     }
     textbox.value = value;
   },
--- a/browser/components/preferences/in-content/sync.xul
+++ b/browser/components/preferences/in-content/sync.xul
@@ -22,26 +22,160 @@
               type="bool"/>
   <preference id="engine.passwords"
               name="services.sync.engine.passwords"
               type="bool"/>
 </preferences>
 
 <script type="application/javascript"
         src="chrome://browser/content/preferences/in-content/sync.js"/>
+<script type="application/javascript"
+        src="chrome://browser/content/sync/utils.js"/>
 
 <hbox id="header-sync"
       class="header"
       hidden="true"
       data-category="paneSync">
   <label class="header-name" flex="1">&paneSync.title;</label>
   <html:a class="help-button text-link" target="_blank" aria-label="&helpButton.label;"></html:a>
 </hbox>
 
 <deck id="weavePrefsDeck" data-category="paneSync" hidden="true">
+  <!-- These panels are for the "legacy" sync provider -->
+  <vbox id="noAccount" align="center">
+    <spacer flex="1"/>
+    <description id="syncDesc">
+      &weaveDesc.label;
+    </description>
+    <separator/>
+    <label id="noAccountSetup" class="text-link">
+      &setupButton.label;
+    </label>
+    <vbox id="pairDevice">
+      <separator/>
+      <label id="noAccountPair" class="text-link">
+        &pairDevice.label;
+      </label>
+    </vbox>
+    <spacer flex="3"/>
+  </vbox>
+
+  <vbox id="hasAccount">
+    <groupbox class="syncGroupBox">
+      <!-- label is set to account name -->
+      <caption id="accountCaption" align="center">
+        <image id="accountCaptionImage"/>
+        <label id="accountName"/>
+      </caption>
+
+      <hbox>
+        <button type="menu"
+                label="&manageAccount.label;"
+                accesskey="&manageAccount.accesskey;">
+          <menupopup>
+            <menuitem id="syncChangePassword" label="&changePassword2.label;"/>
+            <menuitem id="syncResetPassphrase" label="&myRecoveryKey.label;"/>
+            <menuseparator/>
+            <menuitem id="syncReset" label="&resetSync2.label;"/>
+          </menupopup>
+        </button>
+      </hbox>
+
+      <hbox>
+        <label id="syncAddDeviceLabel"
+               class="text-link">
+          &pairDevice.label;
+        </label>
+      </hbox>
+
+      <vbox>
+        <label>&syncMy.label;</label>
+        <richlistbox id="syncEnginesList"
+                     orient="vertical">
+          <richlistitem>
+            <checkbox label="&engine.addons.label;"
+                      accesskey="&engine.addons.accesskey;"
+                      preference="engine.addons"/>
+          </richlistitem>
+          <richlistitem>
+            <checkbox label="&engine.bookmarks.label;"
+                      accesskey="&engine.bookmarks.accesskey;"
+                      preference="engine.bookmarks"/>
+          </richlistitem>
+          <richlistitem>
+            <checkbox label="&engine.passwords.label;"
+                      accesskey="&engine.passwords.accesskey;"
+                      preference="engine.passwords"/>
+          </richlistitem>
+          <richlistitem>
+            <checkbox label="&engine.prefs.label;"
+                      accesskey="&engine.prefs.accesskey;"
+                      preference="engine.prefs"/>
+          </richlistitem>
+          <richlistitem>
+            <checkbox label="&engine.history.label;"
+                      accesskey="&engine.history.accesskey;"
+                      preference="engine.history"/>
+          </richlistitem>
+          <richlistitem>
+            <checkbox label="&engine.tabs.label2;"
+                      accesskey="&engine.tabs.accesskey;"
+                      preference="engine.tabs"/>
+          </richlistitem>
+        </richlistbox>
+      </vbox>
+    </groupbox>
+
+    <groupbox class="syncGroupBox">
+      <grid>
+        <columns>
+          <column/>
+          <column flex="1"/>
+        </columns>
+        <rows>
+          <row align="center">
+            <label control="syncComputerName">
+              &syncDeviceName.label;
+            </label>
+            <textbox id="syncComputerName"/>
+          </row>
+        </rows>
+      </grid>
+      <hbox>
+        <label id="unlinkDevice" class="text-link">
+          &unlinkDevice.label;
+        </label>
+      </hbox>
+    </groupbox>
+    <vbox id="tosPP-normal">
+      <label id="tosPP-normal-ToS" class="text-link">
+        &prefs.tosLink.label;
+      </label>
+      <label id="tosPP-normal-PP" class="text-link">
+        &prefs.ppLink.label;
+      </label>
+    </vbox>
+  </vbox>
+
+  <vbox id="needsUpdate" align="center" pack="center">
+    <hbox>
+      <label id="loginError"/>
+      <label id="loginErrorUpdatePass" class="text-link">
+        &updatePass.label;
+      </label>
+      <label id="loginErrorResetPass" class="text-link">
+        &resetPass.label;
+      </label>
+    </hbox>
+    <label id="loginErrorStartOver" class="text-link">
+      &unlinkDevice.label;
+    </label>
+  </vbox>
+
+  <!-- These panels are for the Firefox Accounts identity provider -->
   <vbox id="noFxaAccount">
     <hbox>
       <vbox id="fxaContentWrapper">
         <groupbox id="noFxaGroup">
           <vbox>
             <label id="noFxaCaption">&signedOut.caption;</label>
             <description id="noFxaDescription" flex="1">&signedOut.description;</description>
             <hbox class="fxaAccountBox">
--- a/browser/components/syncedtabs/SyncedTabsDeckComponent.js
+++ b/browser/components/syncedtabs/SyncedTabsDeckComponent.js
@@ -161,12 +161,12 @@ SyncedTabsDeckComponent.prototype = {
     this._openUrl(href, event);
   },
 
   _openUrl(url, event) {
     this._window.openUILink(url, event);
   },
 
   openSyncPrefs() {
-    this._getChromeWindow(this._window).gSyncUI.openPrefs("tabs-sidebar");
+    this._getChromeWindow(this._window).gSyncUI.openSetup(null, "tabs-sidebar");
   }
 };
 
--- a/browser/components/syncedtabs/test/xpcshell/test_SyncedTabsDeckComponent.js
+++ b/browser/components/syncedtabs/test/xpcshell/test_SyncedTabsDeckComponent.js
@@ -207,21 +207,21 @@ add_task(function* testPanelStatus() {
 });
 
 add_task(function* testActions() {
   let windowMock = {
     openUILink() {},
   };
   let chromeWindowMock = {
     gSyncUI: {
-      openPrefs() {}
+      openSetup() {}
     }
   };
   sinon.spy(windowMock, "openUILink");
-  sinon.spy(chromeWindowMock.gSyncUI, "openPrefs");
+  sinon.spy(chromeWindowMock.gSyncUI, "openSetup");
 
   let getChromeWindowMock = sinon.stub();
   getChromeWindowMock.returns(chromeWindowMock);
 
   let component = new SyncedTabsDeckComponent({
     window: windowMock,
     getChromeWindowMock
   });
@@ -231,10 +231,10 @@ add_task(function* testActions() {
   Assert.ok(windowMock.openUILink.calledWith(href, "mock-event"));
 
   href = Services.prefs.getCharPref("identity.mobilepromo.ios") + "synced-tabs-sidebar";
   component.openiOSLink("mock-event");
   Assert.ok(windowMock.openUILink.calledWith(href, "mock-event"));
 
   component.openSyncPrefs();
   Assert.ok(getChromeWindowMock.calledWith(windowMock));
-  Assert.ok(chromeWindowMock.gSyncUI.openPrefs.called);
+  Assert.ok(chromeWindowMock.gSyncUI.openSetup.called);
 });
--- a/browser/components/uitour/test/browser.ini
+++ b/browser/components/uitour/test/browser.ini
@@ -3,17 +3,17 @@ support-files =
   head.js
   image.png
   uitour.html
   ../UITour-lib.js
 
 [browser_backgroundTab.js]
 [browser_closeTab.js]
 [browser_fxa.js]
-skip-if = debug || asan # updateUI leaks
+skip-if = debug || asan # updateAppMenuItem leaks
 [browser_no_tabs.js]
 [browser_openPreferences.js]
 [browser_openSearchPanel.js]
 skip-if = true # Bug 1113038 - Intermittent "Popup was opened"
 [browser_trackingProtection.js]
 skip-if = os == "linux" # Intermittent NS_ERROR_NOT_AVAILABLE [nsIUrlClassifierDBService.beginUpdate]
 tag = trackingprotection
 support-files =
--- a/browser/components/uitour/test/browser_fxa.js
+++ b/browser/components/uitour/test/browser_fxa.js
@@ -13,34 +13,34 @@ var gContentAPI;
 var gContentWindow;
 
 function test() {
   UITourTest();
 }
 
 registerCleanupFunction(function*() {
   yield signOut();
-  gFxAccounts.updateUI();
+  gFxAccounts.updateAppMenuItem();
 });
 
 var tests = [
   taskify(function* test_highlight_accountStatus_loggedOut() {
     let userData = yield fxAccounts.getSignedInUser();
     is(userData, null, "Not logged in initially");
     yield showMenuPromise("appMenu");
     yield showHighlightPromise("accountStatus");
     let highlight = document.getElementById("UITourHighlightContainer");
     is(highlight.getAttribute("targetName"), "accountStatus", "Correct highlight target");
   }),
 
   taskify(function* test_highlight_accountStatus_loggedIn() {
     yield setSignedInUser();
     let userData = yield fxAccounts.getSignedInUser();
     isnot(userData, null, "Logged in now");
-    gFxAccounts.updateUI(); // Causes a leak (see bug 1332985)
+    gFxAccounts.updateAppMenuItem(); // Causes a leak
     yield showMenuPromise("appMenu");
     yield showHighlightPromise("accountStatus");
     let highlight = document.getElementById("UITourHighlightContainer");
     is(highlight.popupBoxObject.anchorNode.id, "PanelUI-fxa-avatar", "Anchored on avatar");
     is(highlight.getAttribute("targetName"), "accountStatus", "Correct highlight target");
   }),
 ];
 
--- a/browser/installer/package-manifest.in
+++ b/browser/installer/package-manifest.in
@@ -294,16 +294,17 @@
 @RESPATH@/components/prefetch.xpt
 #ifdef MOZ_GECKO_PROFILER
 @RESPATH@/components/profiler.xpt
 #endif
 @RESPATH@/components/rdf.xpt
 @RESPATH@/components/satchel.xpt
 @RESPATH@/components/saxparser.xpt
 @RESPATH@/browser/components/sessionstore.xpt
+@RESPATH@/components/services-crypto-component.xpt
 @RESPATH@/components/captivedetect.xpt
 @RESPATH@/browser/components/shellservice.xpt
 @RESPATH@/components/shistory.xpt
 @RESPATH@/components/spellchecker.xpt
 @RESPATH@/components/storage.xpt
 @RESPATH@/components/toolkit_asyncshutdown.xpt
 @RESPATH@/components/toolkit_filewatcher.xpt
 @RESPATH@/components/toolkit_finalizationwitness.xpt
--- a/browser/locales/en-US/chrome/browser/aboutAccounts.dtd
+++ b/browser/locales/en-US/chrome/browser/aboutAccounts.dtd
@@ -1,14 +1,15 @@
 <!-- This Source Code Form is subject to the terms of the Mozilla Public
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
 <!ENTITY aboutAccounts.welcome "Welcome to &syncBrand.shortName.label;">
 
 <!ENTITY aboutAccountsConfig.description "Sign in to sync your tabs, bookmarks, passwords &amp; more.">
 <!ENTITY aboutAccountsConfig.startButton.label "Get started">
+<!ENTITY aboutAccountsConfig.useOldSync.label "Using an older version of Sync?">
 <!ENTITY aboutAccountsConfig.syncPreferences.label "Sync preferences">
 <!ENTITY aboutAccounts.noConnection.title "No connection">
 <!ENTITY aboutAccounts.noConnection.description "You must be connected to the Internet to sign in.">
 <!ENTITY aboutAccounts.noConnection.retry "Try again">
 <!ENTITY aboutAccounts.badConfig.title "Bad configuration">
 <!ENTITY aboutAccounts.badConfig.description "Unable to determine your Firefox Account server configuration. Please try again later.">
--- a/browser/locales/en-US/chrome/browser/accounts.properties
+++ b/browser/locales/en-US/chrome/browser/accounts.properties
@@ -1,12 +1,20 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+# autoDisconnectDescription is shown in an info bar when we detect an old
+# Sync is being used.
+autoDisconnectDescription = We’ve rebuilt Sync to make it easier for everyone.
+
+# autoDisconnectSignIn.label and .accessKey are for buttons when we auto-disconnect
+autoDisconnectSignIn.label = Sign in to Sync
+autoDisconnectSignIn.accessKey = S
+
 # LOCALIZATION NOTE (reconnectDescription) - %S = Email address of user's Firefox Account
 reconnectDescription = Reconnect %S
 
 # LOCALIZATION NOTE (verifyDescription) - %S = Email address of user's Firefox Account
 verifyDescription = Verify %S
 
 # These strings are shown in a desktop notification after the
 # user requests we resend a verification email.
--- a/browser/locales/en-US/chrome/browser/preferences/preferences.properties
+++ b/browser/locales/en-US/chrome/browser/preferences/preferences.properties
@@ -172,16 +172,20 @@ actualAppCacheSize=Your application cach
 totalSiteDataSize=Your stored site data is currently using %1$S %2$S of disk space
 clearSiteDataPromptTitle=Clear all cookies and site data
 clearSiteDataPromptText=Selecting ‘Clear Now’ will clear all cookies and site data stored by Firefox. This may sign you out of websites and remove offline web content.
 clearSiteDataNow=Clear Now
 important=Important
 default=Default
 siteUsage=%1$S %2$S
 
+syncUnlink.title=Do you want to unlink your device?
+syncUnlink.label=This device will no longer be associated with your Sync account. All of your personal data, both on this device and in your Sync account, will remain intact.
+syncUnlinkConfirm.label=Unlink
+
 # LOCALIZATION NOTE (featureEnableRequiresRestart, featureDisableRequiresRestart, restartTitle): %S = brandShortName
 featureEnableRequiresRestart=%S must restart to enable this feature.
 featureDisableRequiresRestart=%S must restart to disable this feature.
 shouldRestartTitle=Restart %S
 okToRestartButton=Restart %S now
 revertNoRestartButton=Revert
 
 restartNow=Restart Now
--- a/browser/locales/en-US/chrome/browser/preferences/sync.dtd
+++ b/browser/locales/en-US/chrome/browser/preferences/sync.dtd
@@ -1,39 +1,64 @@
 <!-- This Source Code Form is subject to the terms of the Mozilla Public
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
+<!-- The page shown when not logged in... -->
+<!ENTITY setupButton.label          "Set Up &syncBrand.fullName.label;">
+<!ENTITY setupButton.accesskey      "S">
+<!ENTITY weaveDesc.label            "&syncBrand.fullName.label; lets you access your history, bookmarks, passwords and open tabs across all your devices.">
+
 <!-- The page shown when logged in... -->
 
+<!-- Login error feedback -->
+<!ENTITY updatePass.label             "Update">
+<!ENTITY resetPass.label              "Reset">
+
+<!-- Manage Account -->
+<!ENTITY manageAccount.label          "Manage Account">
+<!ENTITY manageAccount.accesskey      "n">
+<!ENTITY changePassword2.label        "Change Password…">
+<!ENTITY myRecoveryKey.label          "My Recovery Key">
+<!ENTITY resetSync2.label             "Reset Sync…">
+
+<!ENTITY pairDevice.label             "Pair a Device">
+
+<!ENTITY syncMy.label               "Sync My">
 <!ENTITY engine.bookmarks.label     "Bookmarks">
 <!ENTITY engine.bookmarks.accesskey "m">
 <!ENTITY engine.tabs.label2         "Open Tabs">
 <!ENTITY engine.tabs.accesskey      "T">
 <!ENTITY engine.history.label       "History">
 <!ENTITY engine.history.accesskey   "r">
 <!ENTITY engine.passwords.label     "Passwords">
 <!ENTITY engine.passwords.accesskey "P">
 <!ENTITY engine.prefs.label         "Preferences">
 <!ENTITY engine.prefs.accesskey     "S">
 <!ENTITY engine.addons.label        "Add-ons">
 <!ENTITY engine.addons.accesskey    "A">
 
 <!-- Device Settings -->
+<!ENTITY syncDeviceName.label       "Device Name:">
 <!ENTITY fxaSyncDeviceName.label       "Device Name">
 <!ENTITY changeSyncDeviceName.label "Change Device Name…">
 <!ENTITY changeSyncDeviceName.accesskey "h">
 <!ENTITY cancelChangeSyncDeviceName.label "Cancel">
 <!ENTITY cancelChangeSyncDeviceName.accesskey "n">
 <!ENTITY saveChangeSyncDeviceName.label "Save">
 <!ENTITY saveChangeSyncDeviceName.accesskey "v">
+<!ENTITY unlinkDevice.label           "Unlink This Device">
 
 <!-- Footer stuff -->
 <!ENTITY prefs.tosLink.label        "Terms of Service">
+<!ENTITY prefs.ppLink.label         "Privacy Policy">
+
+<!-- Firefox Accounts stuff -->
 <!ENTITY fxaPrivacyNotice.link.label "Privacy Notice">
+<!ENTITY determiningAcctStatus.label     "Determining your account status…">
 
 <!-- LOCALIZATION NOTE (signedInUnverified.beforename.label,
 signedInUnverified.aftername.label): these two string are used respectively
 before and after the account email address. Localizers can use one of them, or
 both, to better adapt this sentence to their language.
 -->
 <!ENTITY signedInUnverified.beforename.label "">
 <!ENTITY signedInUnverified.aftername.label "is not verified.">
@@ -54,16 +79,22 @@ both, to better adapt this sentence to t
 <!ENTITY verifiedManage.accesskey    "o">
 <!ENTITY disconnect.label            "Disconnect…">
 <!ENTITY disconnect.accesskey        "D">
 <!ENTITY verify.label                "Verify Email">
 <!ENTITY verify.accesskey            "V">
 <!ENTITY forget.label                "Forget this Email">
 <!ENTITY forget.accesskey            "F">
 
+<!ENTITY welcome.description "Access your tabs, bookmarks, passwords and more wherever you use &brandShortName;.">
+<!ENTITY welcome.signIn.label "Sign In">
+<!ENTITY welcome.createAccount.label "Create Account">
+
+<!ENTITY welcome.useOldSync.label "Using an older version of Sync?">
+
 <!ENTITY signedOut.caption            "Take your Web with you">
 <!ENTITY signedOut.description        "Synchronize your bookmarks, history, tabs, passwords, add-ons, and preferences across all your devices.">
 <!ENTITY signedOut.accountBox.title   "Connect with a &syncBrand.fxAccount.label;">
 <!ENTITY signedOut.accountBox.create  "Create Account">
 <!ENTITY signedOut.accountBox.create.accesskey  "C">
 <!ENTITY signedOut.accountBox.signin  "Sign In">
 <!ENTITY signedOut.accountBox.signin.accesskey  "I">
 
new file mode 100644
--- /dev/null
+++ b/browser/locales/en-US/chrome/browser/syncCustomize.dtd
@@ -0,0 +1,27 @@
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<!ENTITY syncCustomize.dialog.title       "Sync Selection">
+<!ENTITY syncCustomize.acceptButton.label "Start">
+
+<!ENTITY syncCustomize.title              "What would you like to sync?">
+<!ENTITY syncCustomize.description        "You can change this selection in Options.">
+<!ENTITY syncCustomizeUnix.description    "You can change this selection in Preferences.">
+
+<!--
+  These engine names are the same as in browser/preferences/sync.dtd except
+  for the last two that are marked as being specific to Desktop browsers.
+-->
+<!ENTITY engine.bookmarks.label           "Bookmarks">
+<!ENTITY engine.bookmarks.accesskey       "m">
+<!ENTITY engine.history.label             "History">
+<!ENTITY engine.history.accesskey         "r">
+<!ENTITY engine.tabs.label2               "Open Tabs">
+<!ENTITY engine.tabs.accesskey            "T">
+<!ENTITY engine.passwords.label           "Passwords">
+<!ENTITY engine.passwords.accesskey       "P">
+<!ENTITY engine.addons.label              "Desktop Add-ons">
+<!ENTITY engine.addons.accesskey          "A">
+<!ENTITY engine.prefs.label               "Desktop Preferences">
+<!ENTITY engine.prefs.accesskey           "S">
new file mode 100644
--- /dev/null
+++ b/browser/locales/en-US/chrome/browser/syncGenericChange.properties
@@ -0,0 +1,37 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#LOCALIZATION NOTE (change.password.title): This (and associated change.password/passphrase) are used when the user elects to change their password.
+change.password.title = Change your Password
+change.password.acceptButton = Change Password
+change.password.status.active = Changing your password…
+change.password.status.success = Your password has been changed.
+change.password.status.error = There was an error changing your password.
+
+change.password3.introText = Your password must be at least 8 characters long.  It cannot be the same as either your user name or your Recovery Key.
+change.password.warningText = Note: All of your other devices will be unable to connect to your account once you change this password.
+
+change.recoverykey.title = My Recovery Key
+change.recoverykey.acceptButton = Change Recovery Key
+change.recoverykey.label = Changing Recovery Key and uploading local data, please wait…
+change.recoverykey.error = There was an error while changing your Recovery Key!
+change.recoverykey.success = Your Recovery Key was successfully changed!
+
+change.synckey.introText2 = To ensure your total privacy, all of your data is encrypted prior to being uploaded. The key to decrypt your data is not uploaded.
+# LOCALIZATION NOTE (change.recoverykey.warningText) "Sync" should match &syncBrand.shortName.label; from syncBrand.dtd
+change.recoverykey.warningText = Note: Changing this will erase all data stored on the Sync server and upload new data secured by this Recovery Key. Your other devices will not sync until the new Recovery Key is entered for that device.
+
+new.recoverykey.label = Your Recovery Key
+
+# LOCALIZATION NOTE (new.password.title): This (and associated new.password/passphrase) are used on a second computer when it detects that your password or passphrase has been changed on a different device.
+new.password.title            = Update Password
+new.password.introText        = Your password was rejected by the server, please update your password.
+new.password.label            = Enter your new password
+new.password.confirm          = Confirm your new password
+new.password.acceptButton     = Update Password
+new.password.status.incorrect = Password incorrect, please try again.
+
+new.recoverykey.title          = Update Recovery Key
+new.recoverykey.introText      = Your Recovery Key was changed using another device, please enter your updated Recovery Key.
+new.recoverykey.acceptButton     = Update Recovery Key
new file mode 100644
--- /dev/null
+++ b/browser/locales/en-US/chrome/browser/syncKey.dtd
@@ -0,0 +1,18 @@
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<!ENTITY syncKey.page.title               "Your &syncBrand.fullName.label; Key">
+<!ENTITY syncKey.page.description2        "This key is used to decode the data in your &syncBrand.fullName.label; account. You will need to enter the key each time you configure &syncBrand.fullName.label; on a new device.">
+<!ENTITY syncKey.keepItSecret.heading     "Keep it secret">
+<!ENTITY syncKey.keepItSecret.description "Your &syncBrand.fullName.label; account is encrypted to protect your privacy. Without this key, it would take years for anyone to decode your personal information. You are the only person who holds this key. This means you’re the only one who can access your &syncBrand.fullName.label; data.">
+<!ENTITY syncKey.keepItSafe.heading       "Keep it safe">
+<!ENTITY syncKey.keepItSafe1.description  "Do not lose this key.">
+<!ENTITY syncKey.keepItSafe2.description  " We don’t keep a copy of your key (that wouldn’t be keeping it secret!) so ">
+<!ENTITY syncKey.keepItSafe3.description  "we can’t help you recover it">
+<!ENTITY syncKey.keepItSafe4a.description " if it’s lost. You’ll need to use this key any time you connect a new device to &syncBrand.fullName.label;.">
+<!ENTITY syncKey.findOutMore1.label       "Find out more about &syncBrand.fullName.label; and your privacy at ">
+<!ENTITY syncKey.findOutMore2.label       ".">
+<!ENTITY syncKey.footer1.label            "&syncBrand.fullName.label; Terms of Service are available at ">
+<!ENTITY syncKey.footer2.label            ". The Privacy Policy is available at ">
+<!ENTITY syncKey.footer3.label            ".">
new file mode 100644
--- /dev/null
+++ b/browser/locales/en-US/chrome/browser/syncQuota.dtd
@@ -0,0 +1,8 @@
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<!ENTITY quota.dialogTitle.label    "Server Quota">
+<!ENTITY quota.retrievingInfo.label "Retrieving quota information…">
+<!ENTITY quota.typeColumn.label     "Type">
+<!ENTITY quota.sizeColumn.label     "Size">
new file mode 100644
--- /dev/null
+++ b/browser/locales/en-US/chrome/browser/syncQuota.properties
@@ -0,0 +1,42 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+collection.addons.label    = Add-ons
+collection.bookmarks.label = Bookmarks
+collection.history.label   = History
+collection.passwords.label = Passwords
+collection.prefs.label     = Preferences
+collection.tabs.label      = Tabs
+
+# LOCALIZATION NOTE (quota.usageNoQuota.label): %1$S and %2$S are numeric value
+# and unit (as defined in the download manager) of the amount of space occupied
+# on the server
+quota.usageNoQuota.label    = You are currently using %1$S %2$S.
+# LOCALIZATION NOTE (quota.usagePercentage.label):
+# %1$S is the percentage of space used,
+# %2$S and %3$S numeric value and unit (as defined in the download manager)
+# of the amount of space used,
+# %3$S and %4$S numeric value and unit (as defined in the download manager)
+# of the total space available.
+quota.usagePercentage.label = You are using %1$S%% (%2$S %3$S) of your allowed %4$S %5$S.
+quota.usageError.label      = Could not retrieve quota information.
+quota.retrieving.label      = Retrieving…
+# LOCALIZATION NOTE (quota.sizeValueUnit.label): %1$S is the amount of space
+# occupied by the engine, %2$K the corresponding unit (e.g. kB) as defined in
+# the download manager.
+quota.sizeValueUnit.label   = %1$S %2$S
+quota.remove.label          = Remove
+quota.treeCaption.label     = Uncheck items to stop syncing them and free up space on the server.
+# LOCALIZATION NOTE (quota.removal.label): %S is a list of engines that will be
+# disabled and whose data will be removed once the user confirms.
+quota.removal.label         = Firefox Sync will remove the following data: %S.
+# LOCALIZATION NOTE (quota.list.separator): This is the separator string used
+# for the list of engines (incl. spaces where appropriate)
+quota.list.separator        = ,\u0020
+# LOCALIZATION NOTE (quota.freeup.label): %1$S and %2$S are numeric value
+# and unit (as defined in the download manager) of the amount of space freed
+# up by disabling the unchecked engines.  If displayed this string is
+# concatenated directly to quota.removal.label and may need to start off with
+# whitespace.
+quota.freeup.label          = \u0020This will free up %1$S %2$S.
new file mode 100644
--- /dev/null
+++ b/browser/locales/en-US/chrome/browser/syncSetup.dtd
@@ -0,0 +1,114 @@
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<!ENTITY accountSetupTitle.label    "&syncBrand.fullName.label; Setup">
+
+<!-- First page of the wizard -->
+
+<!ENTITY setup.pickSetupType.description2 "Welcome! If you’ve never used &syncBrand.fullName.label; before, you will need to create a new account.">
+<!ENTITY button.createNewAccount.label "Create a New Account">
+<!ENTITY button.haveAccount.label      "I Have an Account">
+
+<!ENTITY setup.choicePage.title.label     "Have you used &syncBrand.fullName.label; before?">
+<!ENTITY setup.choicePage.new.label       "I’ve never used &syncBrand.shortName.label; before">
+<!ENTITY setup.choicePage.existing2.label "I’m already using &syncBrand.shortName.label; on another device">
+
+<!-- New Account AND Existing Account -->
+<!ENTITY server.label               "Server">
+<!ENTITY serverType.default.label      "Default: Mozilla &syncBrand.fullName.label; server">
+<!ENTITY serverType.custom2.label   "Use a custom server…">
+<!ENTITY signIn.account2.label      "Account">
+<!ENTITY signIn.account2.accesskey  "A">
+<!ENTITY signIn.password.label      "Password">
+<!ENTITY signIn.password.accesskey  "P">
+<!ENTITY signIn.recoveryKey.label       "Recovery Key">
+<!ENTITY signIn.recoveryKey.accesskey   "K">
+
+<!-- New Account Page 1: Basic Account Info -->
+<!ENTITY setup.newAccountDetailsPage.title.label "Account Details">
+<!ENTITY setup.emailAddress.label     "Email Address">
+<!ENTITY setup.emailAddress.accesskey "E">
+<!ENTITY setup.choosePassword.label      "Choose a Password">
+<!ENTITY setup.choosePassword.accesskey  "P">
+<!ENTITY setup.confirmPassword.label     "Confirm Password">
+<!ENTITY setup.confirmPassword.accesskey "m">
+
+<!-- LOCALIZATION NOTE: tosAgree1, tosLink, tosAgree2, ppLink, tosAgree3 are
+     joined with implicit white space, so spaces in the strings aren't necessary -->
+<!ENTITY setup.tosAgree1.label      "I agree to the">
+<!ENTITY setup.tosAgree1.accesskey  "a">
+<!ENTITY setup.tosLink.label        "Terms of Service">
+<!ENTITY setup.tosAgree2.label      "and the">
+<!ENTITY setup.ppLink.label         "Privacy Policy">
+<!ENTITY setup.tosAgree3.label      "">
+<!ENTITY setup.tosAgree2.accesskey  "">
+
+<!-- My Recovery Key dialog -->
+<!ENTITY setup.newRecoveryKeyPage.title.label "&brandShortName; Cares About Your Privacy">
+<!ENTITY setup.newRecoveryKeyPage.description.label "To ensure your total privacy, all of your data is encrypted prior to being uploaded. The Recovery Key which is necessary to decrypt your data is not uploaded.">
+<!ENTITY recoveryKeyEntry.label        "Your Recovery Key">
+<!ENTITY recoveryKeyEntry.accesskey    "K">
+<!ENTITY syncGenerateNewKey.label  "Generate a new key">
+<!ENTITY recoveryKeyBackup.description "Your Recovery Key is required to access &syncBrand.fullName.label; on other machines. Please create a backup copy. We cannot help you recover your Recovery Key.">
+
+<!ENTITY button.syncKeyBackup.print.label     "Print…">
+<!ENTITY button.syncKeyBackup.print.accesskey "P">
+<!ENTITY button.syncKeyBackup.save.label      "Save…">
+<!ENTITY button.syncKeyBackup.save.accesskey  "S">
+
+<!-- Existing Account Page 1: Pair a Device (incl. Pair a Device dialog strings) -->
+<!ENTITY pairDevice.title.label             "Pair a Device">
+<!ENTITY addDevice.showMeHow.label          "Show me how.">
+<!ENTITY addDevice.dontHaveDevice.label     "I don’t have the device with me">
+<!ENTITY pairDevice.setup.description.label  "To activate, select &#x0022;Pair a Device&#x0022; on your other device.">
+<!ENTITY addDevice.setup.enterCode.label    "Then, enter this code:">
+<!ENTITY pairDevice.dialog.description.label "To activate your new device, select &#x0022;Set Up Sync&#x0022; on the device.">
+<!ENTITY addDevice.dialog.enterCode.label   "Enter the code that the device provides:">
+<!ENTITY addDevice.dialog.tryAgain.label    "Please try again.">
+<!ENTITY addDevice.dialog.successful.label  "The device has been successfully added. The initial synchronization can take several minutes and will finish in the background.">
+<!ENTITY addDevice.dialog.recoveryKey.label     "To activate your device you will need to enter your Recovery Key. Please print or save this key and take it with you.">
+<!ENTITY addDevice.dialog.connected.label   "Device Connected">
+
+<!-- Existing Account Page 2: Manual Login -->
+<!ENTITY setup.signInPage.title.label "Sign In">
+<!ENTITY existingRecoveryKey.description "You can get a copy of your Recovery Key by going to &syncBrand.shortName.label; Options on your other device, and selecting  &#x0022;My Recovery Key&#x0022; under &#x0022;Manage Account&#x0022;.">
+<!ENTITY verifying.label              "Verifying…">
+<!ENTITY resetPassword.label          "Reset Password">
+<!ENTITY resetSyncKey.label           "I have lost my other device.">
+
+<!-- Sync Options -->
+<!ENTITY setup.optionsPage.title      "Sync Options">
+<!ENTITY syncDeviceName.label       "Device Name:">
+<!ENTITY syncDeviceName.accesskey   "c">
+
+<!ENTITY syncMy.label               "Sync My">
+<!ENTITY engine.bookmarks.label     "Bookmarks">
+<!ENTITY engine.bookmarks.accesskey "m">
+<!ENTITY engine.tabs.label2         "Open Tabs">
+<!ENTITY engine.tabs.accesskey      "T">
+<!ENTITY engine.history.label       "History">
+<!ENTITY engine.history.accesskey   "r">
+<!ENTITY engine.passwords.label     "Passwords">
+<!ENTITY engine.passwords.accesskey "P">
+<!ENTITY engine.prefs.label         "Preferences">
+<!ENTITY engine.prefs.accesskey     "S">
+<!ENTITY engine.addons.label        "Add-ons">
+<!ENTITY engine.addons.accesskey    "A">
+
+<!ENTITY choice2a.merge.main.label       "Merge this device’s data with my &syncBrand.shortName.label; data">
+<!ENTITY choice2.merge.recommended.label "Recommended:">
+<!ENTITY choice2a.client.main.label      "Replace all data on this device with my &syncBrand.shortName.label; data">
+<!ENTITY choice2a.server.main.label      "Replace all other devices with this device’s data">
+
+<!-- Confirm Merge Options -->
+<!ENTITY setup.optionsConfirmPage.title "Confirm">
+<!ENTITY confirm.merge2.label    "&syncBrand.fullName.label; will now merge all this device’s browser data into your Sync account.">
+<!ENTITY confirm.client3.label         "Warning: The following &brandShortName; data on this device  will be deleted:">
+<!ENTITY confirm.client2.moreinfo.label "&brandShortName; will then copy your &syncBrand.fullName.label; data to this device.">
+<!ENTITY confirm.server2.label         "Warning: The following devices will be overwritten with your local data:">
+
+<!-- New & Existing Account: Setup Complete -->
+<!ENTITY setup.successPage.title "Setup Complete">
+<!ENTITY changeOptions.label "You can change this preference by selecting Sync Options below.">
+<!ENTITY continueUsing.label "You may now continue using &brandShortName;.">
--- a/browser/locales/en-US/chrome/browser/syncSetup.properties
+++ b/browser/locales/en-US/chrome/browser/syncSetup.properties
@@ -1,12 +1,57 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+button.syncOptions.label       = Sync Options
+button.syncOptionsDone.label   = Done
+button.syncOptionsCancel.label = Cancel
+
+invalidEmail.label          = Invalid email address
+serverInvalid.label         = Please enter a valid server URL
+usernameNotAvailable.label  = Already in use
+
+verifying.label = Verifying…
+
+# LOCALIZATION NOTE (additionalClientCount.label):
+# Semicolon-separated list of plural forms. See:
+# http://developer.mozilla.org/en/docs/Localization_and_Plurals
+# #1 is the number of additional clients (was %S for a short while, use #1 instead, even if both work)
+additionalClientCount.label = and #1 additional device;and #1 additional devices
+# LOCALIZATION NOTE (bookmarksCount.label):
+# Semicolon-separated list of plural forms. See:
+# http://developer.mozilla.org/en/docs/Localization_and_Plurals
+# #1 is the number of bookmarks (was %S for a short while, use #1 instead, even if both work)
+bookmarksCount.label        = #1 bookmark;#1 bookmarks
+# LOCALIZATION NOTE (historyDaysCount.label):
+# Semicolon-separated list of plural forms. See:
+# http://developer.mozilla.org/en/docs/Localization_and_Plurals
+# #1 is the number of days (was %S for a short while, use #1 instead, even if both work)
+historyDaysCount.label      = #1 day of history;#1 days of history
+# LOCALIZATION NOTE (passwordsCount.label):
+# Semicolon-separated list of plural forms. See:
+# http://developer.mozilla.org/en/docs/Localization_and_Plurals
+# #1 is the number of passwords (was %S for a short while, use #1 instead, even if both work)
+passwordsCount.label        = #1 password;#1 passwords
+# LOCALIZATION NOTE (addonsCount.label): Semicolon-separated list of plural forms.
+# See: http://developer.mozilla.org/en/docs/Localization_and_Plurals
+# #1 is the number of add-ons, see the link above for forms
+addonsCount.label        = #1 add-on;#1 add-ons
+
+save.recoverykey.title = Save Recovery Key
+save.recoverykey.defaultfilename = Firefox Recovery Key.html
+
+newAccount.action.label = Firefox Sync is now set up to automatically sync all of your browser data.
+newAccount.change.label = You can choose exactly what to sync by selecting Sync Options below.
+resetClient.change2.label = Firefox Sync will now merge all this device’s browser data into your Sync account.
+wipeClient.change2.label = Firefox Sync will now replace all of the browser data on this device with the data in your Sync account.
+wipeRemote.change2.label = Firefox Sync will now replace all of the browser data in your Sync account with the data on this device.
+existingAccount.change.label = You can change this preference by selecting Sync Options below.
+
 # Several other strings are used (via Weave.Status.login), but they come from
 #  /services/sync
 
 # Firefox Accounts based setup.
 continue.label = Continue
 
 # LOCALIZATION NOTE (disconnect.label, disconnect.verify.title, disconnect.verify.bodyHeading, disconnect.verify.bodyText):
 # These strings are used in the confirmation dialog shown when the user hits the disconnect button
--- a/browser/locales/jar.mn
+++ b/browser/locales/jar.mn
@@ -15,16 +15,17 @@
     locale/browser/aboutHome.dtd                   (%chrome/browser/aboutHome.dtd)
     locale/browser/accounts.properties             (%chrome/browser/accounts.properties)
 #ifdef MOZ_SERVICES_HEALTHREPORT
     locale/browser/aboutHealthReport.dtd           (%chrome/browser/aboutHealthReport.dtd)
 #endif
     locale/browser/aboutSearchReset.dtd            (%chrome/browser/aboutSearchReset.dtd)
     locale/browser/aboutSessionRestore.dtd         (%chrome/browser/aboutSessionRestore.dtd)
     locale/browser/aboutTabCrashed.dtd             (%chrome/browser/aboutTabCrashed.dtd)
+    locale/browser/syncCustomize.dtd               (%chrome/browser/syncCustomize.dtd)
     locale/browser/aboutSyncTabs.dtd               (%chrome/browser/aboutSyncTabs.dtd)
     locale/browser/browser.dtd                     (%chrome/browser/browser.dtd)
     locale/browser/baseMenuOverlay.dtd             (%chrome/browser/baseMenuOverlay.dtd)
     locale/browser/browser.properties              (%chrome/browser/browser.properties)
     locale/browser/customizableui/customizableWidgets.properties (%chrome/browser/customizableui/customizableWidgets.properties)
     locale/browser/lightweightThemes.properties    (%chrome/browser/lightweightThemes.properties)
     locale/browser/newTab.dtd                      (%chrome/browser/newTab.dtd)
     locale/browser/newTab.properties               (%chrome/browser/newTab.properties)
@@ -79,17 +80,22 @@
     locale/browser/preferences/security.dtd           (%chrome/browser/preferences/security.dtd)
     locale/browser/preferences/containers.dtd         (%chrome/browser/preferences/containers.dtd)
     locale/browser/preferences/sync.dtd               (%chrome/browser/preferences/sync.dtd)
     locale/browser/preferences/tabs.dtd               (%chrome/browser/preferences/tabs.dtd)
     locale/browser/preferences/search.dtd             (%chrome/browser/preferences/search.dtd)
     locale/browser/preferences/siteDataSettings.dtd   (%chrome/browser/preferences/siteDataSettings.dtd)
     locale/browser/preferences/translation.dtd        (%chrome/browser/preferences/translation.dtd)
     locale/browser/syncBrand.dtd                (%chrome/browser/syncBrand.dtd)
+    locale/browser/syncSetup.dtd                (%chrome/browser/syncSetup.dtd)
     locale/browser/syncSetup.properties         (%chrome/browser/syncSetup.properties)
+    locale/browser/syncGenericChange.properties         (%chrome/browser/syncGenericChange.properties)
+    locale/browser/syncKey.dtd                  (%chrome/browser/syncKey.dtd)
+    locale/browser/syncQuota.dtd                (%chrome/browser/syncQuota.dtd)
+    locale/browser/syncQuota.properties         (%chrome/browser/syncQuota.properties)
 % resource search-plugins chrome://browser/locale/searchplugins/
 #if BUILD_FASTER
     locale/browser/searchplugins/               (searchplugins/*.xml)
     locale/browser/searchplugins/list.json      (search/list.json)
 #else
     locale/browser/searchplugins/               (.deps/generated_@AB_CD@/*.xml)
     locale/browser/searchplugins/list.json      (.deps/generated_@AB_CD@/list.json)
 #endif
--- a/browser/themes/linux/jar.mn
+++ b/browser/themes/linux/jar.mn
@@ -109,16 +109,19 @@ browser.jar:
   skin/classic/browser/sync-32.png
   skin/classic/browser/sync-bg.png
   skin/classic/browser/sync-128.png
   skin/classic/browser/sync-desktopIcon.svg  (../shared/sync-desktopIcon.svg)
   skin/classic/browser/sync-horizontalbar.png
   skin/classic/browser/sync-horizontalbar@2x.png
   skin/classic/browser/sync-mobileIcon.svg  (../shared/sync-mobileIcon.svg)
   skin/classic/browser/sync-notification-24.png
+  skin/classic/browser/syncSetup.css
+  skin/classic/browser/syncCommon.css
+  skin/classic/browser/syncQuota.css
   skin/classic/browser/syncProgress-horizontalbar.png
   skin/classic/browser/syncProgress-horizontalbar@2x.png
 #ifdef E10S_TESTING_ONLY
   skin/classic/browser/e10s-64@2x.png (../shared/e10s-64@2x.png)
 #endif
 
 [extensions/{972ce4c6-7e08-4474-a285-3208198ce6fd}] chrome.jar:
 % override chrome://browser/skin/feeds/audioFeedIcon.png              chrome://browser/skin/feeds/feedIcon.png
--- a/browser/themes/linux/preferences/preferences.css
+++ b/browser/themes/linux/preferences/preferences.css
@@ -78,15 +78,28 @@
  * Clear Private Data
  */
 #SanitizeDialogPane > groupbox {
   margin-top: 0;
 }
 
 /* Sync Pane */
 
+#syncDesc {
+  padding: 0 8em;
+}
+
+#accountCaptionImage {
+  list-style-image: url("chrome://mozapps/skin/profile/profileicon.png");
+}
+
+#syncAddDeviceLabel {
+  margin-top: 1em;
+  margin-bottom: 1em;
+}
+
 #noFxaAccount {
   line-height: 1.2em;
 }
 
 #noFxaAccount > label:first-child {
   margin-bottom: 0.6em;
 }
new file mode 100644
--- /dev/null
+++ b/browser/themes/linux/syncCommon.css
@@ -0,0 +1,49 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* The following are used by both sync/setup.xul and sync/genericChange.xul */
+.status {
+  color: -moz-dialogtext;
+}
+
+.statusIcon {
+  margin-inline-start: 4px;
+  max-height: 16px;
+  max-width: 16px;
+}
+
+.statusIcon[status="active"] {
+  list-style-image: url("chrome://global/skin/icons/loading.png");
+}
+
+.statusIcon[status="error"] {
+  list-style-image: url("moz-icon://stock/gtk-dialog-error?size=menu");
+}
+
+.statusIcon[status="success"] {
+  list-style-image: url("moz-icon://stock/gtk-dialog-info?size=menu");
+}
+
+/* .data is only used by sync/genericChange.xul, but it seems unnecessary to have
+   a separate stylesheet for it. */
+.data {
+  font-size: 90%;
+  font-weight: bold;
+}
+
+dialog#change-dialog {
+  width: 40em;
+}
+
+image#syncIcon {
+  list-style-image: url("chrome://browser/skin/sync-32.png");
+}
+
+#introText {
+  margin-top: 2px;
+}
+
+#feedback {
+  height: 2em;
+}
new file mode 100644
--- /dev/null
+++ b/browser/themes/linux/syncQuota.css
@@ -0,0 +1,26 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#quotaDialog {
+  width: 33em;
+  height: 25em;
+}
+
+treechildren::-moz-tree-checkbox {
+  list-style-image: none;
+}
+treechildren::-moz-tree-checkbox(checked) {
+  list-style-image: url("chrome://global/skin/checkbox/cbox-check.gif");
+}
+treechildren::-moz-tree-checkbox(disabled) {
+  list-style-image: url("chrome://global/skin/checkbox/cbox-check-dis.gif");
+}
+
+#treeCaption {
+  height: 4em;
+}
+
+.captionWarning {
+  font-weight: bold;
+}
new file mode 100644
--- /dev/null
+++ b/browser/themes/linux/syncSetup.css
@@ -0,0 +1,133 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+wizard {
+  -moz-appearance: none;
+  width: 55em;
+  height: 45em;
+  padding: 0;
+  background-color: Window;
+}
+
+.wizard-page-box {
+  -moz-appearance: none;
+  padding-left: 0;
+  padding-right: 0;
+  margin: 0;
+}
+
+wizardpage {
+  -moz-box-pack: center;
+  -moz-box-align: center;
+  margin: 0;
+  padding: 0 6em;
+  background-color: Window;
+}
+
+.wizard-header {
+  -moz-appearance: none;
+  border: none;
+  padding: 2em 0 1em 0;
+  text-align: center;
+}
+.wizard-header-label {
+  font-size: 24pt;
+  font-weight: normal;
+}
+
+.wizard-buttons {
+  background-color: rgba(0,0,0,0.1);
+  padding: 1em;
+}
+
+.wizard-buttons-separator {
+  visibility: collapse;
+}
+
+.wizard-header-icon {
+  visibility: collapse;
+}
+
+.accountChoiceButton {
+  font: menu;
+}
+
+.confirm {
+  border: 1px solid black;
+  padding: 1em;
+  border-radius: 5px;
+}
+
+/* Override the text-link style from global.css */
+description > .text-link,
+description > .text-link:focus {
+  margin: 0px;
+  padding: 0px;
+  border: 0px;
+}
+
+
+.success,
+.error {
+  padding: 2px;
+  border-radius: 2px;
+}
+
+.error {
+  background-color: #FF0000 !important;
+  color: #FFFFFF !important;
+}
+
+.success {
+  background-color: #00FF00 !important;
+}
+
+.warning {
+  font-weight: bold;
+  font-size: 100%;
+  color: red;
+}
+
+.mainDesc {
+  font-weight: bold;
+  font-size: 100%;
+}
+
+.normal {
+  font-size: 100%;
+}
+
+.inputColumn {
+  margin-inline-end: 2px
+}
+
+.pin {
+  font-size: 18pt;
+  width: 4em;
+  text-align: center; 
+}
+
+#passphraseHelpSpacer {
+  width: 0.5em;
+}
+
+#pairDeviceThrobber,
+#login-throbber {
+  -moz-box-align: center;
+}
+
+#pairDeviceThrobber > image,
+#login-throbber > image {
+  width: 16px;
+  list-style-image: url("chrome://global/skin/icons/loading.png");
+}
+
+#captchaFeedback {
+  visibility: hidden;
+}
+
+#successPageIcon {
+  /* TODO replace this with a 128px version (bug 591122) */
+  list-style-image: url("chrome://browser/skin/sync-32.png");
+}
--- a/browser/themes/osx/jar.mn
+++ b/browser/themes/osx/jar.mn
@@ -158,16 +158,19 @@ browser.jar:
   skin/classic/browser/sync-32.png
   skin/classic/browser/sync-bg.png
   skin/classic/browser/sync-128.png
   skin/classic/browser/sync-desktopIcon.svg  (../shared/sync-desktopIcon.svg)
   skin/classic/browser/sync-horizontalbar.png
   skin/classic/browser/sync-horizontalbar@2x.png
   skin/classic/browser/sync-mobileIcon.svg  (../shared/sync-mobileIcon.svg)
   skin/classic/browser/sync-notification-24.png
+  skin/classic/browser/syncSetup.css
+  skin/classic/browser/syncCommon.css
+  skin/classic/browser/syncQuota.css
   skin/classic/browser/syncProgress-horizontalbar.png
   skin/classic/browser/syncProgress-horizontalbar@2x.png
   skin/classic/browser/Toolbar-background-noise.png         (Toolbar-background-noise.png)
   skin/classic/browser/lion/toolbarbutton-dropmarker.png    (toolbarbutton-dropmarker-lion.png)
   skin/classic/browser/toolbarbutton-dropmarker@2x.png      (toolbarbutton-dropmarker-lion@2x.png)
   skin/classic/browser/lion/tabbrowser/alltabs-box-bkgnd-icon.png      (tabbrowser/alltabs-box-bkgnd-icon-lion.png)
   skin/classic/browser/tabbrowser/alltabs-box-bkgnd-icon@2x.png        (tabbrowser/alltabs-box-bkgnd-icon-lion@2x.png)
   skin/classic/browser/lion/places/toolbar.png                         (places/toolbar-lion.png)
--- a/browser/themes/osx/preferences/preferences.css
+++ b/browser/themes/osx/preferences/preferences.css
@@ -103,15 +103,28 @@ caption {
  */
 #SanitizeDialogPane > groupbox {
   margin-top: 0;
 }
 
 
 /* ----- SYNC PANE ----- */
 
+#syncDesc {
+  padding: 0 8em;
+}
+
+#accountCaptionImage {
+  list-style-image: url("chrome://mozapps/skin/profile/profileicon.png");
+}
+
+#syncAddDeviceLabel {
+  margin-top: 1em;
+  margin-bottom: 1em;
+}
+
 #noFxaAccount {
   line-height: 1.2em;
 }
 
 #noFxaAccount > label:first-child {
   margin-bottom: 0.6em;
 }
new file mode 100644
--- /dev/null
+++ b/browser/themes/osx/syncCommon.css
@@ -0,0 +1,55 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* The following are used by both sync/setup.xul and sync/genericChange.xul */
+.status {
+  color: -moz-dialogtext;
+}
+
+.statusIcon {
+  margin-inline-start: 4px;
+  max-height: 16px;
+  max-width: 16px;
+}
+
+.statusIcon[status="active"] {
+  list-style-image: url("chrome://global/skin/icons/loading.png");
+}
+
+@media (min-resolution: 2dppx) {
+  .statusIcon[status="active"] {
+    list-style-image: url("chrome://global/skin/icons/loading@2x.png");
+  }
+}
+
+.statusIcon[status="error"] {
+  list-style-image: url("chrome://global/skin/icons/error-16.png");
+}
+
+.statusIcon[status="success"] {
+  list-style-image: url("chrome://global/skin/icons/information-16.png");
+}
+
+/* .data is only used by sync/genericChange.xul, but it seems unnecessary to have
+   a separate stylesheet for it. */
+.data {
+  font-size: 90%;
+  font-weight: bold;
+}
+
+dialog#change-dialog {
+  width: 40em;
+}
+
+image#syncIcon {
+  list-style-image: url("chrome://browser/skin/sync-32.png");
+}
+
+#introText {
+  margin-top: 2px;
+}
+
+#feedback {
+  height: 2em;
+}
new file mode 100644
--- /dev/null
+++ b/browser/themes/osx/syncQuota.css
@@ -0,0 +1,26 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#quotaDialog {
+  width: 33em;
+  height: 25em;
+}
+
+treechildren::-moz-tree-checkbox {
+  list-style-image: none;
+}
+treechildren::-moz-tree-checkbox(checked) {
+  list-style-image: url("chrome://global/skin/checkbox/cbox-check.gif");
+}
+treechildren::-moz-tree-checkbox(disabled) {
+  list-style-image: url("chrome://global/skin/checkbox/cbox-check-dis.gif");
+}
+
+#treeCaption {
+  height: 4em;
+}
+
+.captionWarning {
+  font-weight: bold;
+}
new file mode 100644
--- /dev/null
+++ b/browser/themes/osx/syncSetup.css
@@ -0,0 +1,139 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+wizard {
+  -moz-appearance: none;
+  width: 55em;
+  height: 45em;
+  padding: 0;
+  background-color: Window;
+}
+
+.wizard-page-box {
+  -moz-appearance: none;
+  padding-left: 0;
+  padding-right: 0;
+  margin: 0;
+}
+
+wizardpage {
+  -moz-box-pack: center;
+  -moz-box-align: center;
+  margin: 0;
+  padding: 0 6em;
+  background-color: Window;
+}
+
+.wizard-header {
+  -moz-appearance: none;
+  border: none;
+  padding: 2em 0 1em 0;
+  text-align: center;
+}
+.wizard-header-label {
+  font-size: 24pt;
+  font-weight: normal;
+}
+
+.wizard-buttons {
+  background-color: rgba(0,0,0,0.1);
+  padding: 1em;
+}
+
+.wizard-buttons-separator {
+  visibility: collapse;
+}
+
+.wizard-header-icon {
+  visibility: collapse;
+}
+
+.accountChoiceButton {
+  font: menu;
+}
+
+.confirm {
+  border: 1px solid black;
+  padding: 1em;
+  border-radius: 5px;
+}
+
+/* Override the text-link style from global.css */
+description > .text-link,
+description > .text-link:focus {
+  margin: 0px;
+  padding: 0px;
+  border: 0px;
+}
+
+.success,
+.error {
+  padding: 2px;
+  border-radius: 2px;
+}
+
+.error {
+  background-color: #FF0000 !important;
+  color: #FFFFFF !important;
+}
+
+.success {
+  background-color: #00FF00 !important;
+}
+
+.warning {
+  font-weight: bold;
+  font-size: 100%;
+  color: red;
+}
+
+.mainDesc {
+  font-weight: bold;
+  font-size: 100%;
+}
+
+.normal {
+  font-size: 100%;
+}
+
+.inputColumn {
+  margin-inline-end: 2px
+}
+
+.pin {
+  font-size: 18pt;
+  width: 4em;
+  text-align: center; 
+}
+
+#passphraseHelpSpacer {
+  width: 0.5em;
+}
+
+#pairDeviceThrobber,
+#login-throbber {
+  -moz-box-align: center;
+}
+
+#pairDeviceThrobber > image,
+#login-throbber > image {
+  width: 16px;
+  list-style-image: url("chrome://global/skin/icons/loading.png");
+}
+
+@media (min-resolution: 2dppx) {
+  #pairDeviceThrobber > image,
+  #login-throbber > image {
+    list-style-image: url("chrome://global/skin/icons/loading@2x.png");
+  }
+}
+
+#captchaFeedback {
+  visibility: hidden;
+}
+
+#successPageIcon {
+  /* TODO replace this with a 128px version (bug 591122) */
+  list-style-image: url("chrome://browser/skin/sync-32.png");
+}
--- a/browser/themes/shared/customizableui/panelUI.inc.css
+++ b/browser/themes/shared/customizableui/panelUI.inc.css
@@ -837,16 +837,22 @@ toolbarpaletteitem[place="palette"] > to
 #PanelUI-remotetabs-main[devices-status="single"] > #PanelUI-remotetabs-buttons {
   display: none;
 }
 
 #PanelUI-fxa-icon[syncstatus="active"]:not([disabled]) {
   list-style-image: url(chrome://browser/skin/syncProgress-horizontalbar.png);
 }
 
+#PanelUI-footer-fxa[fxastatus="migrate-signup"] > #PanelUI-fxa-status > #PanelUI-fxa-label,
+#PanelUI-footer-fxa[fxastatus="migrate-verify"] > #PanelUI-fxa-status > #PanelUI-fxa-label {
+  list-style-image: url(chrome://browser/skin/warning.svg);
+  -moz-image-region: auto;
+}
+
 #PanelUI-customize {
   list-style-image: url(chrome://browser/skin/menuPanel-customize.png);
 }
 
 #customization-panelHolder #PanelUI-customize {
   list-style-image: url(chrome://browser/skin/customizableui/menuPanel-customizeFinish.png);
 }
 
--- a/browser/themes/shared/incontentprefs/preferences.inc.css
+++ b/browser/themes/shared/incontentprefs/preferences.inc.css
@@ -243,33 +243,38 @@ treecol {
   font-size: 1em !important;
   margin-left: 0;
 }
 
 /* Collapse the non-active vboxes in decks to use only the height the
    active vbox needs */
 #historyPane:not([selectedIndex="1"]) > #historyDontRememberPane,
 #historyPane:not([selectedIndex="2"]) > #historyCustomPane,
-#weavePrefsDeck:not([selectedIndex="1"]) > #hasFxaAccount,
+#weavePrefsDeck:not([selectedIndex="1"]) > #hasAccount,
+#weavePrefsDeck:not([selectedIndex="2"]) > #needsUpdate,
+#weavePrefsDeck:not([selectedIndex="3"]) > #noFxaAccount,
+#weavePrefsDeck:not([selectedIndex="4"]) > #hasFxaAccount,
 #fxaLoginStatus:not([selectedIndex="1"]) > #fxaLoginUnverified,
 #fxaLoginStatus:not([selectedIndex="2"]) > #fxaLoginRejected {
   visibility: collapse;
 }
 
 /* XXX This style is for bug 740213 and should be removed once that
    bug has a solution. */
 description > html|a {
   cursor: pointer;
 }
 
 #weavePrefsDeck > vbox > label,
 #weavePrefsDeck > vbox > groupbox,
 #weavePrefsDeck > vbox > description,
+#weavePrefsDeck > vbox > #pairDevice > label,
+#weavePrefsDeck > #needsUpdate > hbox > #loginError,
 #weavePrefsDeck > #hasFxaAccount > vbox > label,
-#weavePrefsDeck > #hasFxaAccount > hbox > label {
+#weavePrefsDeck > #hasFxaAccount > hbox:not(#tosPP-normal) > label {
   /* no margin-inline-start for elements at the beginning of a line */
   margin-inline-start: 0;
 }
 
 #tabsElement {
   margin-inline-end: 4px; /* add the 4px end-margin of other elements */
 }
 
--- a/browser/themes/windows/jar.mn
+++ b/browser/themes/windows/jar.mn
@@ -141,16 +141,19 @@ browser.jar:
   skin/classic/browser/sync-bg.png
   skin/classic/browser/sync-desktopIcon.svg  (../shared/sync-desktopIcon.svg)
   skin/classic/browser/sync-horizontalbar.png
   skin/classic/browser/sync-horizontalbar@2x.png
   skin/classic/browser/sync-horizontalbar-win7.png
   skin/classic/browser/sync-horizontalbar-win7@2x.png
   skin/classic/browser/sync-mobileIcon.svg  (../shared/sync-mobileIcon.svg)
   skin/classic/browser/sync-notification-24.png
+  skin/classic/browser/syncSetup.css
+  skin/classic/browser/syncCommon.css
+  skin/classic/browser/syncQuota.css
   skin/classic/browser/syncProgress-horizontalbar.png
   skin/classic/browser/syncProgress-horizontalbar@2x.png
   skin/classic/browser/syncProgress-horizontalbar-win7.png
   skin/classic/browser/syncProgress-horizontalbar-win7@2x.png
 
 #ifdef E10S_TESTING_ONLY
   skin/classic/browser/e10s-64@2x.png (../shared/e10s-64@2x.png)
 #endif
--- a/browser/themes/windows/preferences/preferences.css
+++ b/browser/themes/windows/preferences/preferences.css
@@ -65,15 +65,32 @@
 /* bottom-most box containing a groupbox in a prefpane. Prevents the bottom
    of the groupbox from being cutoff */
 .bottomBox {
   padding-bottom: 4px;
 }
 
 /* Sync Pane */
 
+#syncDesc {
+  padding: 0 8em;
+}
+
+.syncGroupBox {
+  padding: 10px;
+}
+
+#accountCaptionImage {
+  list-style-image: url("chrome://mozapps/skin/profile/profileicon.png");
+}
+
+#syncAddDeviceLabel {
+  margin-top: 1em;
+  margin-bottom: 1em;
+}
+
 #noFxaAccount {
   line-height: 1.2em;
 }
 
 #noFxaAccount > label:first-child {
   margin-bottom: 0.6em;
 }
new file mode 100644
--- /dev/null
+++ b/browser/themes/windows/syncCommon.css
@@ -0,0 +1,55 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* The following are used by both sync/setup.xul and sync/genericChange.xul */
+.status {
+  color: -moz-dialogtext;
+}
+
+.statusIcon {
+  margin-inline-start: 4px;
+  max-height: 16px;
+  max-width: 16px;
+}
+
+.statusIcon[status="active"] {
+  list-style-image: url("chrome://global/skin/icons/loading.png");
+}
+
+@media (min-resolution: 1.1dppx) {
+  .statusIcon[status="active"] {
+    list-style-image: url("chrome://global/skin/icons/loading@2x.png");
+  }
+}
+
+.statusIcon[status="error"] {
+  list-style-image: url("chrome://global/skin/icons/error-16.png");
+}
+
+.statusIcon[status="success"] {
+  list-style-image: url("chrome://global/skin/icons/information-16.png");
+}
+
+/* .data is only used by sync/genericChange.xul, but it seems unnecessary to have
+   a separate stylesheet for it. */
+.data {
+  font-size: 90%;
+  font-weight: bold;
+}
+
+dialog#change-dialog {
+  width: 40em;
+}
+
+image#syncIcon {
+  list-style-image: url("chrome://browser/skin/sync-32.png");
+}
+
+#introText {
+  margin-top: 2px;
+}
+
+#feedback {
+  height: 2em;
+}
new file mode 100644
--- /dev/null
+++ b/browser/themes/windows/syncQuota.css
@@ -0,0 +1,26 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#quotaDialog {
+  width: 33em;
+  height: 25em;
+}
+
+treechildren::-moz-tree-checkbox {
+  list-style-image: none;
+}
+treechildren::-moz-tree-checkbox(checked) {
+  list-style-image: url("chrome://global/skin/checkbox/cbox-check.gif");
+}
+treechildren::-moz-tree-checkbox(disabled) {
+  list-style-image: url("chrome://global/skin/checkbox/cbox-check-dis.gif");
+}
+
+#treeCaption {
+  height: 4em;
+}
+
+.captionWarning {
+  font-weight: bold;
+}
new file mode 100644
--- /dev/null
+++ b/browser/themes/windows/syncSetup.css
@@ -0,0 +1,145 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+wizard {
+  -moz-appearance: none;
+  width: 55em;
+  height: 45em;
+  padding: 0;
+  background-color: Window;
+}
+
+.wizard-page-box {
+  -moz-appearance: none;
+  padding-left: 0;
+  padding-right: 0;
+  margin: 0;
+}
+
+wizardpage {
+  -moz-box-pack: center;
+  -moz-box-align: center;
+  margin: 0;
+  padding: 0 6em;
+  background-color: Window;
+}
+
+.wizard-header {
+  -moz-appearance: none;
+  border: none;
+  padding: 2em 0 1em 0;
+  text-align: center;
+}
+.wizard-header-label {
+  font-size: 24pt;
+  font-weight: normal;
+}
+
+.wizard-buttons {
+  background-color: rgba(0,0,0,0.1);
+  padding: 1em;
+}
+
+.wizard-buttons-separator {
+  visibility: collapse;
+}
+
+.wizard-header-icon {
+  visibility: collapse;
+}
+
+.accountChoiceButton {
+  font: menu;
+}
+
+.confirm {
+  border: 1px solid black;
+  padding: 1em;
+  border-radius: 5px;
+}
+
+/* Override the text-link style from global.css */
+description > .text-link,
+description > .text-link:focus {
+  margin: 0px;
+  padding: 0px;
+  border: 0px;
+}
+
+
+.success,
+.error {
+  padding: 2px;
+  border-radius: 2px;
+}
+
+.error {
+  background-color: #FF0000 !important;
+  color: #FFFFFF !important;
+}
+
+.success {
+  background-color: #00FF00 !important;
+}
+
+.warning {
+  font-weight: bold;
+  font-size: 100%;
+  color: red;
+}
+
+.mainDesc {
+  font-weight: bold;
+  font-size: 100%;
+}
+
+.normal {
+  font-size: 100%;
+}
+
+.inputColumn {
+  margin-inline-end: 2px
+}
+
+.pin {
+  font-size: 18pt;
+  width: 4em;
+  text-align: center; 
+}
+
+#passphraseHelpSpacer {
+  width: 0.5em;
+}
+
+#pairDeviceThrobber,
+#login-throbber {
+  -moz-box-align: center;
+}
+
+#pairDeviceThrobber > image,
+#login-throbber > image {
+  width: 16px;
+  list-style-image: url("chrome://global/skin/icons/loading.png");
+}
+
+@media (min-resolution: 1.1dppx) {
+  #pairDeviceThrobber > image,
+  #login-throbber > image {
+    list-style-image: url("chrome://global/skin/icons/loading@2x.png");
+  }
+}
+
+#captchaFeedback {
+  visibility: hidden;
+}
+
+#successPageIcon {
+  /* TODO replace this with a 128px version (bug 591122) */
+  list-style-image: url("chrome://browser/skin/sync-32.png");
+}
+
+#tosDesc {
+  margin-left: -7px;
+  margin-bottom: 3px;
+}
\ No newline at end of file
--- a/mobile/android/installer/package-manifest.in
+++ b/mobile/android/installer/package-manifest.in
@@ -208,16 +208,17 @@
 @BINPATH@/components/pref.xpt
 @BINPATH@/components/prefetch.xpt
 #ifdef MOZ_GECKO_PROFILER
 @BINPATH@/components/profiler.xpt
 #endif
 @BINPATH@/components/rdf.xpt
 @BINPATH@/components/satchel.xpt
 @BINPATH@/components/saxparser.xpt
+@BINPATH@/components/services-crypto-component.xpt
 @BINPATH@/components/captivedetect.xpt
 @BINPATH@/components/shistory.xpt
 @BINPATH@/components/spellchecker.xpt
 @BINPATH@/components/storage.xpt
 @BINPATH@/components/telemetry.xpt
 @BINPATH@/components/toolkit_asyncshutdown.xpt
 @BINPATH@/components/toolkit_filewatcher.xpt
 @BINPATH@/components/toolkit_finalizationwitness.xpt
--- a/services/common/tests/unit/head_helpers.js
+++ b/services/common/tests/unit/head_helpers.js
@@ -152,8 +152,21 @@ function installFakePAC() {
   fakePACCID = MockRegistrar.register("@mozilla.org/system-proxy-settings;1",
                                       PACSystemSettings);
 }
 
 function uninstallFakePAC() {
   _("Uninstalling fake PAC.");
   MockRegistrar.unregister(fakePACCID);
 }
+
+// Many tests do service.startOver() and don't expect the provider type to
+// change (whereas by default, a startOver will do exactly that so FxA is
+// subsequently used). The tests that know how to deal with
+// the Firefox Accounts identity hack things to ensure that still works.
+function ensureStartOverKeepsIdentity() {
+  Cu.import("resource://gre/modules/Services.jsm");
+  Services.prefs.setBoolPref("services.sync-testing.startOverKeepIdentity", true);
+  do_register_cleanup(function() {
+    Services.prefs.clearUserPref("services.sync-testing.startOverKeepIdentity");
+  });
+}
+ensureStartOverKeepsIdentity();
new file mode 100644
--- /dev/null
+++ b/services/crypto/component/moz.build
@@ -0,0 +1,21 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+XPCSHELL_TESTS_MANIFESTS += ['tests/unit/xpcshell.ini']
+
+XPIDL_SOURCES += [
+    'nsIIdentityCryptoService.idl',
+    'nsISyncJPAKE.idl',
+]
+
+XPIDL_MODULE = 'services-crypto-component'
+
+SOURCES += [
+    'IdentityCryptoService.cpp',
+    'nsSyncJPAKE.cpp',
+]
+
+FINAL_LIBRARY = 'xul'
new file mode 100644
--- /dev/null
+++ b/services/crypto/component/nsISyncJPAKE.idl
@@ -0,0 +1,103 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+[scriptable, uuid(5ab02a98-5122-4b90-93cd-f259c4b42e3a)]
+interface nsISyncJPAKE : nsISupports
+{
+  /**
+   * Perform first round of the JPAKE exchange.
+   *
+   * @param aSignerID
+   *        String identifying the signer.
+   * @param aGX1
+   *        Schnorr signature value g^x1, in hex representation.
+   * @param aGV1
+   *        Schnorr signature value g^v1 (v1 is a random value), in hex
+   *        representation.
+   * @param aR1
+   *        Schnorr signature value r1 = v1 - x1 * h, in hex representation.
+   * @param aGX2
+   *        Schnorr signature value g^x2, in hex representation.
+   * @param aGV2
+   *        Schnorr signature value g^v2 (v2 is a random value), in hex
+   *        representation.
+   * @param aR2
+   *        Schnorr signature value r2 = v2 - x2 * h, in hex representation.
+   */
+  void round1(in ACString aSignerID,
+              out ACString aGX1,
+              out ACString aGV1,
+              out ACString aR1,
+              out ACString aGX2,
+              out ACString aGV2,
+              out ACString aR2);
+
+  /**
+   * Perform second round of the JPAKE exchange.
+   *
+   * @param aPeerID
+   *        String identifying the peer.
+   * @param aPIN
+   *        String containing the weak secret (PIN).
+   * @param aGX3
+   *        Schnorr signature value g^x3, in hex representation.
+   * @param aGV3
+   *        Schnorr signature value g^v3 (v3 is a random value), in hex
+   *        representation.
+   * @param aR3
+   *        Schnorr signature value r3 = v3 - x3 * h, in hex representation.
+   * @param aGX4
+   *        Schnorr signature value g^x4, in hex representation.
+   * @param aGV4
+   *        Schnorr signature value g^v4 (v4 is a random value), in hex
+   *        representation.
+   * @param aR4
+   *        Schnorr signature value r4 = v4 - x4 * h, in hex representation.
+   * @param aA
+   *        Schnorr signature value A, in hex representation.
+   * @param aGVA
+   *        Schnorr signature value g^va (va is a random value), in hex
+   *        representation.
+   * @param aRA
+   *        Schnorr signature value ra = va - xa * h, in hex representation.
+   */
+  void round2(in ACString aPeerID,
+              in ACString aPIN,
+              in ACString aGX3,
+              in ACString aGV3,
+              in ACString aR3,
+              in ACString aGX4,
+              in ACString aGV4,
+              in ACString aR4,
+              out ACString aA,
+              out ACString aGVA,
+              out ACString aRA);
+
+  /**
+   * Perform the final step of the JPAKE exchange. This will compute
+   * the key and expand the key to two keys, an AES256 encryption key
+   * and a 256 bit HMAC key. It returns a key confirmation value
+   * (SHA256d of the key) and the encryption and HMAC keys.
+   *
+   * @param aB
+   *        Schnorr signature value B, in hex representation.
+   * @param aGVB
+   *        Schnorr signature value g^vb (vb is a random value), in hex
+   *        representation.
+   * @param aRB
+   *        Schnorr signature value rb = vb - xb * h, in hex representation.
+   * @param aAES256Key
+   *        The AES 256 encryption key, in base64 representation.
+   * @param aHMAC256Key
+   *        The 256 bit HMAC key, in base64 representation.
+   */
+  void final(in ACString aB,
+             in ACString aGVB,
+             in ACString aRB,
+             in ACString aHkdfInfo,
+             out ACString aAES256Key,
+             out ACString aHMAC256Key);
+};
new file mode 100644
--- /dev/null
+++ b/services/crypto/component/nsSyncJPAKE.cpp
@@ -0,0 +1,484 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsSyncJPAKE.h"
+
+#include "base64.h"
+#include "keyhi.h"
+#include "mozilla/ModuleUtils.h"
+#include "mozilla/Move.h"
+#include "nsDebug.h"
+#include "nsError.h"
+#include "nsString.h"
+#include "nscore.h"
+#include "pk11pub.h"
+#include "pkcs11.h"
+#include "secerr.h"
+#include "secmodt.h"
+#include "secport.h"
+
+using mozilla::fallible;
+
+static bool
+hex_from_2char(const unsigned char *c2, unsigned char *byteval)
+{
+  int i;
+  unsigned char offset;
+  *byteval = 0;
+  for (i=0; i<2; i++) {
+    if (c2[i] >= '0' && c2[i] <= '9') {
+      offset = c2[i] - '0';
+      *byteval |= offset << 4*(1-i);
+    } else if (c2[i] >= 'a' && c2[i] <= 'f') {
+      offset = c2[i] - 'a';
+      *byteval |= (offset + 10) << 4*(1-i);
+    } else if (c2[i] >= 'A' && c2[i] <= 'F') {
+      offset = c2[i] - 'A';
+      *byteval |= (offset + 10) << 4*(1-i);
+    } else {
+      return false;
+    }
+  }
+  return true;
+}
+
+static bool
+fromHex(const char * str, unsigned char * p, size_t sLen)
+{
+  size_t i;
+  if (sLen & 1)
+    return false;
+
+  for (i = 0; i < sLen / 2; ++i) {
+    if (!hex_from_2char((const unsigned char *) str + (2*i),
+                        (unsigned char *) p + i)) {
+      return false;
+    }
+  }
+  return true;
+}
+
+static nsresult
+fromHexString(const nsACString & str, unsigned char * p, size_t pMaxLen)
+{
+  char * strData = (char *) str.Data();
+  unsigned len = str.Length();
+  NS_ENSURE_ARG(len / 2 <= pMaxLen);
+  if (!fromHex(strData, p, len)) {
+    return NS_ERROR_INVALID_ARG;
+  }
+  return NS_OK;
+}
+
+static bool
+toHexString(const unsigned char * str, unsigned len, nsACString & out)
+{
+  static const char digits[] = "0123456789ABCDEF";
+  if (!out.SetCapacity(2 * len, fallible))
+    return false;
+  out.SetLength(0);
+  for (unsigned i = 0; i < len; ++i) {
+    out.Append(digits[str[i] >> 4]);
+    out.Append(digits[str[i] & 0x0f]);
+  }
+  return true;
+}
+
+static nsresult
+mapErrno()
+{
+  int err = PORT_GetError();
+  switch (err) {
+    case SEC_ERROR_NO_MEMORY:   return NS_ERROR_OUT_OF_MEMORY;
+    default:                    return NS_ERROR_UNEXPECTED;
+  }
+}
+
+#define NUM_ELEM(x) (sizeof(x) / sizeof (x)[0])
+
+static const char p[] = 
+  "90066455B5CFC38F9CAA4A48B4281F292C260FEEF01FD61037E56258A7795A1C"
+  "7AD46076982CE6BB956936C6AB4DCFE05E6784586940CA544B9B2140E1EB523F"
+  "009D20A7E7880E4E5BFA690F1B9004A27811CD9904AF70420EEFD6EA11EF7DA1"
+  "29F58835FF56B89FAA637BC9AC2EFAAB903402229F491D8D3485261CD068699B"
+  "6BA58A1DDBBEF6DB51E8FE34E8A78E542D7BA351C21EA8D8F1D29F5D5D159394"
+  "87E27F4416B0CA632C59EFD1B1EB66511A5A0FBF615B766C5862D0BD8A3FE7A0"
+  "E0DA0FB2FE1FCB19E8F9996A8EA0FCCDE538175238FC8B0EE6F29AF7F642773E"
+  "BE8CD5402415A01451A840476B2FCEB0E388D30D4B376C37FE401C2A2C2F941D"
+  "AD179C540C1C8CE030D460C4D983BE9AB0B20F69144C1AE13F9383EA1C08504F"
+  "B0BF321503EFE43488310DD8DC77EC5B8349B8BFE97C2C560EA878DE87C11E3D"
+  "597F1FEA742D73EEC7F37BE43949EF1A0D15C3F3E3FC0A8335617055AC91328E"
+  "C22B50FC15B941D3D1624CD88BC25F3E941FDDC6200689581BFEC416B4B2CB73";
+static const char q[] =
+  "CFA0478A54717B08CE64805B76E5B14249A77A4838469DF7F7DC987EFCCFB11D";
+static const char g[] = 
+  "5E5CBA992E0A680D885EB903AEA78E4A45A469103D448EDE3B7ACCC54D521E37"
+  "F84A4BDD5B06B0970CC2D2BBB715F7B82846F9A0C393914C792E6A923E2117AB"
+  "805276A975AADB5261D91673EA9AAFFEECBFA6183DFCB5D3B7332AA19275AFA1"
+  "F8EC0B60FB6F66CC23AE4870791D5982AAD1AA9485FD8F4A60126FEB2CF05DB8"
+  "A7F0F09B3397F3937F2E90B9E5B9C9B6EFEF642BC48351C46FB171B9BFA9EF17"
+  "A961CE96C7E7A7CC3D3D03DFAD1078BA21DA425198F07D2481622BCE45969D9C"
+  "4D6063D72AB7A0F08B2F49A7CC6AF335E08C4720E31476B67299E231F8BD90B3"
+  "9AC3AE3BE0C6B6CACEF8289A2E2873D58E51E029CAFBD55E6841489AB66B5B4B"
+  "9BA6E2F784660896AFF387D92844CCB8B69475496DE19DA2E58259B090489AC8"
+  "E62363CDF82CFD8EF2A427ABCD65750B506F56DDE3B988567A88126B914D7828"
+  "E2B63A6D7ED0747EC59E0E0A23CE7D8A74C1D2C2A7AFB6A29799620F00E11C33"
+  "787F7DED3B30E1A22D09F1FBDA1ABBBFBF25CAE05A13F812E34563F99410E73B";
+
+NS_IMETHODIMP nsSyncJPAKE::Round1(const nsACString & aSignerID,
+                                  nsACString & aGX1,
+                                  nsACString & aGV1,
+                                  nsACString & aR1,
+                                  nsACString & aGX2,
+                                  nsACString & aGV2,
+                                  nsACString & aR2)
+{
+  nsNSSShutDownPreventionLock locker;
+  if (isAlreadyShutDown()) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
+  NS_ENSURE_STATE(round == JPAKENotStarted);
+  NS_ENSURE_STATE(key == nullptr);
+
+  static CK_MECHANISM_TYPE mechanisms[] = {
+    CKM_NSS_JPAKE_ROUND1_SHA256,
+    CKM_NSS_JPAKE_ROUND2_SHA256,
+    CKM_NSS_JPAKE_FINAL_SHA256
+  };
+
+  UniquePK11SlotInfo slot(PK11_GetBestSlotMultiple(mechanisms,
+                                                   NUM_ELEM(mechanisms),
+                                                   nullptr));
+  NS_ENSURE_STATE(slot != nullptr);
+    
+  CK_BYTE pBuf[(NUM_ELEM(p) - 1) / 2];
+  CK_BYTE qBuf[(NUM_ELEM(q) - 1) / 2];
+  CK_BYTE gBuf[(NUM_ELEM(g) - 1) / 2];
+    
+  CK_KEY_TYPE keyType = CKK_NSS_JPAKE_ROUND1;
+  NS_ENSURE_STATE(fromHex(p, pBuf, (NUM_ELEM(p) - 1)));
+  NS_ENSURE_STATE(fromHex(q, qBuf, (NUM_ELEM(q) - 1)));
+  NS_ENSURE_STATE(fromHex(g, gBuf, (NUM_ELEM(g) - 1)));
+  CK_ATTRIBUTE keyTemplate[] = {
+    { CKA_NSS_JPAKE_SIGNERID, (CK_BYTE *) aSignerID.Data(),
+                              aSignerID.Length() },
+    { CKA_KEY_TYPE, &keyType, sizeof keyType },
+    { CKA_PRIME,    pBuf,     sizeof pBuf },
+    { CKA_SUBPRIME, qBuf,     sizeof qBuf },
+    { CKA_BASE,     gBuf,     sizeof gBuf }
+  };
+
+  CK_BYTE gx1Buf[NUM_ELEM(p) / 2];
+  CK_BYTE gv1Buf[NUM_ELEM(p) / 2];
+  CK_BYTE r1Buf [NUM_ELEM(p) / 2];
+  CK_BYTE gx2Buf[NUM_ELEM(p) / 2];
+  CK_BYTE gv2Buf[NUM_ELEM(p) / 2];
+  CK_BYTE r2Buf [NUM_ELEM(p) / 2];
+  CK_NSS_JPAKERound1Params rp = {
+      { gx1Buf, sizeof gx1Buf, gv1Buf, sizeof gv1Buf, r1Buf, sizeof r1Buf },
+      { gx2Buf, sizeof gx2Buf, gv2Buf, sizeof gv2Buf, r2Buf, sizeof r2Buf }
+  };
+  SECItem paramsItem;
+  paramsItem.data = (unsigned char *) &rp;
+  paramsItem.len = sizeof rp;
+  key = UniquePK11SymKey(
+    PK11_KeyGenWithTemplate(slot.get(), CKM_NSS_JPAKE_ROUND1_SHA256,
+                            CKM_NSS_JPAKE_ROUND1_SHA256, &paramsItem,
+                            keyTemplate, NUM_ELEM(keyTemplate), nullptr));
+  nsresult rv = key != nullptr
+              ? NS_OK
+              : mapErrno();
+  if (rv == NS_OK) {
+    NS_ENSURE_TRUE(toHexString(rp.gx1.pGX, rp.gx1.ulGXLen, aGX1) &&
+                   toHexString(rp.gx1.pGV, rp.gx1.ulGVLen, aGV1) &&
+                   toHexString(rp.gx1.pR,  rp.gx1.ulRLen,  aR1)  &&
+                   toHexString(rp.gx2.pGX, rp.gx2.ulGXLen, aGX2) &&
+                   toHexString(rp.gx2.pGV, rp.gx2.ulGVLen, aGV2) &&
+                   toHexString(rp.gx2.pR,  rp.gx2.ulRLen,  aR2),
+                   NS_ERROR_OUT_OF_MEMORY);
+    round = JPAKEBeforeRound2;
+  }
+  return rv;
+}
+
+NS_IMETHODIMP nsSyncJPAKE::Round2(const nsACString & aPeerID,
+                                  const nsACString & aPIN,
+                                  const nsACString & aGX3,
+                                  const nsACString & aGV3,
+                                  const nsACString & aR3,
+                                  const nsACString & aGX4,
+                                  const nsACString & aGV4,
+                                  const nsACString & aR4,
+                                  nsACString & aA,
+                                  nsACString & aGVA,
+                                  nsACString & aRA)
+{
+  nsNSSShutDownPreventionLock locker;
+  if (isAlreadyShutDown()) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
+  NS_ENSURE_STATE(round == JPAKEBeforeRound2);
+  NS_ENSURE_STATE(key != nullptr);
+  NS_ENSURE_ARG(!aPeerID.IsEmpty());
+
+  /* PIN cannot be equal to zero when converted to a bignum. NSS 3.12.9 J-PAKE
+     assumes that the caller has already done this check. Future versions of 
+     NSS J-PAKE will do this check internally. See Bug 609068 Comment 4 */
+  bool foundNonZero = false;
+  for (size_t i = 0; i < aPIN.Length(); ++i) {
+    if (aPIN[i] != 0) {
+      foundNonZero = true;
+      break;
+    }
+  }
+  NS_ENSURE_ARG(foundNonZero);
+
+  CK_BYTE gx3Buf[NUM_ELEM(p)/2], gv3Buf[NUM_ELEM(p)/2], r3Buf [NUM_ELEM(p)/2];
+  CK_BYTE gx4Buf[NUM_ELEM(p)/2], gv4Buf[NUM_ELEM(p)/2], r4Buf [NUM_ELEM(p)/2];
+  CK_BYTE gxABuf[NUM_ELEM(p)/2], gvABuf[NUM_ELEM(p)/2], rABuf [NUM_ELEM(p)/2];
+  nsresult         rv = fromHexString(aGX3, gx3Buf, sizeof gx3Buf);
+  if (rv == NS_OK) rv = fromHexString(aGV3, gv3Buf, sizeof gv3Buf);
+  if (rv == NS_OK) rv = fromHexString(aR3,  r3Buf,  sizeof r3Buf);
+  if (rv == NS_OK) rv = fromHexString(aGX4, gx4Buf, sizeof gx4Buf);
+  if (rv == NS_OK) rv = fromHexString(aGV4, gv4Buf, sizeof gv4Buf);
+  if (rv == NS_OK) rv = fromHexString(aR4,  r4Buf,  sizeof r4Buf);
+  if (rv != NS_OK)
+    return rv;
+
+  CK_NSS_JPAKERound2Params rp;
+  rp.pSharedKey = (CK_BYTE *) aPIN.Data();
+  rp.ulSharedKeyLen = aPIN.Length();
+  rp.gx3.pGX = gx3Buf; rp.gx3.ulGXLen = aGX3.Length() / 2;
+  rp.gx3.pGV = gv3Buf; rp.gx3.ulGVLen = aGV3.Length() / 2;
+  rp.gx3.pR  = r3Buf;  rp.gx3.ulRLen  = aR3 .Length() / 2;
+  rp.gx4.pGX = gx4Buf; rp.gx4.ulGXLen = aGX4.Length() / 2;
+  rp.gx4.pGV = gv4Buf; rp.gx4.ulGVLen = aGV4.Length() / 2;
+  rp.gx4.pR  = r4Buf;  rp.gx4.ulRLen  = aR4 .Length() / 2;
+  rp.A.pGX   = gxABuf; rp.A  .ulGXLen = sizeof gxABuf;
+  rp.A.pGV   = gvABuf; rp.A  .ulGVLen = sizeof gxABuf;
+  rp.A.pR    = rABuf;  rp.A  .ulRLen  = sizeof gxABuf;
+
+  // Bug 629090: NSS 3.12.9 J-PAKE fails to check that gx^4 != 1, so check here.
+  bool gx4Good = false;
+  for (unsigned i = 0; i < rp.gx4.ulGXLen; ++i) {
+    if (rp.gx4.pGX[i] > 1 || (rp.gx4.pGX[i] != 0 && i < rp.gx4.ulGXLen - 1)) {
+      gx4Good = true;
+      break;
+    }
+  }
+  NS_ENSURE_ARG(gx4Good);
+
+  SECItem paramsItem;
+  paramsItem.data = (unsigned char *) &rp;
+  paramsItem.len = sizeof rp;
+  CK_KEY_TYPE keyType = CKK_NSS_JPAKE_ROUND2;
+  CK_ATTRIBUTE keyTemplate[] = {
+    { CKA_NSS_JPAKE_PEERID, (CK_BYTE *) aPeerID.Data(), aPeerID.Length(), },
+    { CKA_KEY_TYPE, &keyType, sizeof keyType }
+  };
+  UniquePK11SymKey newKey(PK11_DeriveWithTemplate(key.get(),
+                                                  CKM_NSS_JPAKE_ROUND2_SHA256,
+                                                  &paramsItem,
+                                                  CKM_NSS_JPAKE_FINAL_SHA256,
+                                                  CKA_DERIVE, 0,
+                                                  keyTemplate,
+                                                  NUM_ELEM(keyTemplate),
+                                                  false));
+  if (newKey != nullptr) {
+    if (toHexString(rp.A.pGX, rp.A.ulGXLen, aA) &&
+        toHexString(rp.A.pGV, rp.A.ulGVLen, aGVA) &&
+        toHexString(rp.A.pR, rp.A.ulRLen, aRA)) {
+      round = JPAKEAfterRound2;
+      key = Move(newKey);
+      return NS_OK;
+    } else {
+      rv = NS_ERROR_OUT_OF_MEMORY;
+    }
+  } else {
+    rv = mapErrno();
+  }
+
+  return rv;
+}
+
+static nsresult
+setBase64(const unsigned char * data, unsigned len, nsACString & out)
+{
+  nsresult rv = NS_OK;
+  const char * base64 = BTOA_DataToAscii(data, len);
+  
+  if (base64 != nullptr) {
+    size_t len = PORT_Strlen(base64);
+    if (out.SetCapacity(len, fallible)) {
+      out.SetLength(0);
+      out.Append(base64, len);
+    } else {
+      rv = NS_ERROR_OUT_OF_MEMORY;
+    }
+    PORT_Free((void*) base64);
+  } else {
+    rv = NS_ERROR_OUT_OF_MEMORY;
+  }
+  return rv;
+}
+
+static nsresult
+base64KeyValue(PK11SymKey * key, nsACString & keyString)
+{
+  nsresult rv = NS_OK;
+  if (PK11_ExtractKeyValue(key) == SECSuccess) {
+    const SECItem * value = PK11_GetKeyData(key);
+    rv = value != nullptr && value->data != nullptr && value->len > 0
+       ? setBase64(value->data, value->len, keyString)
+       : NS_ERROR_UNEXPECTED;
+  } else {
+    rv = mapErrno();
+  }
+  return rv;
+}
+
+static nsresult
+extractBase64KeyValue(UniquePK11SymKey & keyBlock, CK_ULONG bitPosition,
+                      CK_MECHANISM_TYPE destMech, int keySize,
+                      nsACString & keyString)
+{
+  SECItem paramsItem;
+  paramsItem.data = (CK_BYTE *) &bitPosition;
+  paramsItem.len = sizeof bitPosition;
+  PK11SymKey * key = PK11_Derive(keyBlock.get(), CKM_EXTRACT_KEY_FROM_KEY,
+                                 &paramsItem, destMech,
+                                 CKA_SIGN, keySize);
+  if (key == nullptr)
+    return mapErrno();
+  nsresult rv = base64KeyValue(key, keyString);
+  PK11_FreeSymKey(key);
+  return rv;
+}
+
+
+NS_IMETHODIMP nsSyncJPAKE::Final(const nsACString & aB,
+                                 const nsACString & aGVB,
+                                 const nsACString & aRB,
+                                 const nsACString & aHKDFInfo,
+                                 nsACString & aAES256Key,
+                                 nsACString & aHMAC256Key)
+{
+  nsNSSShutDownPreventionLock locker;
+  if (isAlreadyShutDown()) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
+  static const unsigned AES256_KEY_SIZE = 256 / 8;
+  static const unsigned HMAC_SHA256_KEY_SIZE = 256 / 8;
+  CK_EXTRACT_PARAMS aesBitPosition = 0;
+  CK_EXTRACT_PARAMS hmacBitPosition = aesBitPosition + (AES256_KEY_SIZE * 8);
+
+  NS_ENSURE_STATE(round == JPAKEAfterRound2);
+  NS_ENSURE_STATE(key != nullptr);
+
+  CK_BYTE gxBBuf[NUM_ELEM(p)/2], gvBBuf[NUM_ELEM(p)/2], rBBuf [NUM_ELEM(p)/2];
+  nsresult         rv = fromHexString(aB,   gxBBuf, sizeof gxBBuf);
+  if (rv == NS_OK) rv = fromHexString(aGVB, gvBBuf, sizeof gvBBuf);
+  if (rv == NS_OK) rv = fromHexString(aRB,  rBBuf,  sizeof rBBuf);
+  if (rv != NS_OK)
+    return rv;
+
+  CK_NSS_JPAKEFinalParams rp;
+  rp.B.pGX = gxBBuf; rp.B.ulGXLen = aB  .Length() / 2;
+  rp.B.pGV = gvBBuf; rp.B.ulGVLen = aGVB.Length() / 2;
+  rp.B.pR  = rBBuf;  rp.B.ulRLen  = aRB .Length() / 2;
+  SECItem paramsItem;
+  paramsItem.data = (unsigned char *) &rp;
+  paramsItem.len = sizeof rp;
+  UniquePK11SymKey keyMaterial(PK11_Derive(key.get(), CKM_NSS_JPAKE_FINAL_SHA256,
+                                           &paramsItem, CKM_NSS_HKDF_SHA256,
+                                           CKA_DERIVE, 0));
+  UniquePK11SymKey keyBlock;
+
+  if (keyMaterial == nullptr)
+    rv = mapErrno();
+
+  if (rv == NS_OK) {
+    CK_NSS_HKDFParams hkdfParams;
+    hkdfParams.bExtract = CK_TRUE;
+    hkdfParams.pSalt = nullptr;
+    hkdfParams.ulSaltLen = 0;
+    hkdfParams.bExpand = CK_TRUE;
+    hkdfParams.pInfo = (CK_BYTE *) aHKDFInfo.Data();
+    hkdfParams.ulInfoLen = aHKDFInfo.Length();
+    paramsItem.data = (unsigned char *) &hkdfParams;
+    paramsItem.len = sizeof hkdfParams;
+    keyBlock = UniquePK11SymKey(
+      PK11_Derive(keyMaterial.get(), CKM_NSS_HKDF_SHA256, &paramsItem,
+                  CKM_EXTRACT_KEY_FROM_KEY, CKA_DERIVE,
+                  AES256_KEY_SIZE + HMAC_SHA256_KEY_SIZE));
+    if (keyBlock == nullptr)
+      rv = mapErrno();
+  }
+
+  if (rv == NS_OK) {
+    rv = extractBase64KeyValue(keyBlock, aesBitPosition, CKM_AES_CBC,
+                               AES256_KEY_SIZE, aAES256Key);
+  }
+  if (rv == NS_OK) {
+    rv = extractBase64KeyValue(keyBlock, hmacBitPosition, CKM_SHA256_HMAC,
+                               HMAC_SHA256_KEY_SIZE, aHMAC256Key);
+  }
+
+  if (rv == NS_OK) {
+    SECStatus srv = PK11_ExtractKeyValue(keyMaterial.get());
+    NS_ENSURE_TRUE(srv == SECSuccess, NS_ERROR_UNEXPECTED);
+    SECItem * keyMaterialBytes = PK11_GetKeyData(keyMaterial.get());
+    NS_ENSURE_TRUE(keyMaterialBytes != nullptr, NS_ERROR_UNEXPECTED);
+  }
+
+  return rv;
+}
+
+NS_GENERIC_FACTORY_CONSTRUCTOR(nsSyncJPAKE)
+NS_DEFINE_NAMED_CID(NS_SYNCJPAKE_CID);
+
+nsSyncJPAKE::nsSyncJPAKE() : round(JPAKENotStarted), key(nullptr) { }
+
+nsSyncJPAKE::~nsSyncJPAKE()
+{
+  nsNSSShutDownPreventionLock locker;
+  if (isAlreadyShutDown()) {
+    return;
+  }
+  destructorSafeDestroyNSSReference();
+  shutdown(ShutdownCalledFrom::Object);
+}
+
+void
+nsSyncJPAKE::virtualDestroyNSSReference()
+{
+  destructorSafeDestroyNSSReference();
+}
+
+void
+nsSyncJPAKE::destructorSafeDestroyNSSReference()
+{
+  key = nullptr;
+}
+
+static const mozilla::Module::CIDEntry kServicesCryptoCIDs[] = {
+  { &kNS_SYNCJPAKE_CID, false, nullptr, nsSyncJPAKEConstructor },
+  { nullptr }
+};
+
+static const mozilla::Module::ContractIDEntry kServicesCryptoContracts[] = {
+  { NS_SYNCJPAKE_CONTRACTID, &kNS_SYNCJPAKE_CID },
+  { nullptr }
+};
+
+static const mozilla::Module kServicesCryptoModule = {
+  mozilla::Module::kVersion,
+  kServicesCryptoCIDs,
+  kServicesCryptoContracts
+};
+
+NSMODULE_DEFN(nsServicesCryptoModule) = &kServicesCryptoModule;
new file mode 100644
--- /dev/null
+++ b/services/crypto/component/nsSyncJPAKE.h
@@ -0,0 +1,38 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef nsSyncJPAKE_h__
+#define nsSyncJPAKE_h__
+
+#include "ScopedNSSTypes.h"
+#include "nsISyncJPAKE.h"
+#include "nsNSSShutDown.h"
+
+#define NS_SYNCJPAKE_CONTRACTID \
+  "@mozilla.org/services-crypto/sync-jpake;1"
+
+#define NS_SYNCJPAKE_CID \
+  {0x0b9721c0, 0x1805, 0x47c3, {0x86, 0xce, 0x68, 0x13, 0x79, 0x5a, 0x78, 0x3f}}
+
+using namespace mozilla;
+
+class nsSyncJPAKE : public nsISyncJPAKE
+                  , public nsNSSShutDownObject
+{
+public:
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSISYNCJPAKE
+  nsSyncJPAKE();
+protected:
+  virtual ~nsSyncJPAKE();
+private:
+  virtual void virtualDestroyNSSReference() override;
+  void destructorSafeDestroyNSSReference();
+
+  enum { JPAKENotStarted, JPAKEBeforeRound2, JPAKEAfterRound2 } round;
+  UniquePK11SymKey key;
+};
+
+NS_IMPL_ISUPPORTS(nsSyncJPAKE, nsISyncJPAKE)
+
+#endif // nsSyncJPAKE_h__
new file mode 100644
--- /dev/null
+++ b/services/crypto/component/tests/unit/test_jpake.js
@@ -0,0 +1,289 @@
+var Cc = Components.classes;
+var Ci = Components.interfaces;
+
+// Ensure PSM is initialized.
+Cc["@mozilla.org/psm;1"].getService(Ci.nsISupports);
+
+function do_check_throws(func) {
+  let have_error = false;
+  try {
+    func();
+  } catch (ex) {
+    dump("Was expecting an exception. Caught: " + ex + "\n");
+    have_error = true;
+  }
+  do_check_true(have_error);
+}
+
+function test_success() {
+  let a = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+            .createInstance(Ci.nsISyncJPAKE);
+  let b = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+            .createInstance(Ci.nsISyncJPAKE);
+
+  let a_gx1 = {};
+  let a_gv1 = {};
+  let a_r1 = {};
+  let a_gx2 = {};
+  let a_gv2 = {};
+  let a_r2 = {};
+
+  let b_gx1 = {};
+  let b_gv1 = {};
+  let b_r1 = {};
+  let b_gx2 = {};
+  let b_gv2 = {};
+  let b_r2 = {};
+
+  a.round1("alice", a_gx1, a_gv1, a_r1, a_gx2, a_gv2, a_r2);
+  b.round1("bob", b_gx1, b_gv1, b_r1, b_gx2, b_gv2, b_r2);
+
+  let a_A = {};
+  let a_gva = {};
+  let a_ra = {};
+
+  let b_A = {};
+  let b_gva = {};
+  let b_ra = {};
+
+  a.round2("bob", "sekrit", b_gx1.value, b_gv1.value, b_r1.value,
+           b_gx2.value, b_gv2.value, b_r2.value, a_A, a_gva, a_ra);
+  b.round2("alice", "sekrit", a_gx1.value, a_gv1.value, a_r1.value,
+           a_gx2.value, a_gv2.value, a_r2.value, b_A, b_gva, b_ra);
+
+  let a_aes = {};
+  let a_hmac = {};
+  let b_aes = {};
+  let b_hmac = {};
+
+  a.final(b_A.value, b_gva.value, b_ra.value, "ohai", a_aes, a_hmac);
+  b.final(a_A.value, a_gva.value, a_ra.value, "ohai", b_aes, b_hmac);
+
+  do_check_eq(a_aes.value, b_aes.value);
+  do_check_eq(a_hmac.value, b_hmac.value);
+}
+
+function test_failure(modlen) {
+  let a = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+            .createInstance(Ci.nsISyncJPAKE);
+  let b = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+            .createInstance(Ci.nsISyncJPAKE);
+
+  let a_gx1 = {};
+  let a_gv1 = {};
+  let a_r1 = {};
+  let a_gx2 = {};
+  let a_gv2 = {};
+  let a_r2 = {};
+
+  let b_gx1 = {};
+  let b_gv1 = {};
+  let b_r1 = {};
+  let b_gx2 = {};
+  let b_gv2 = {};
+  let b_r2 = {};
+
+  a.round1("alice", a_gx1, a_gv1, a_r1, a_gx2, a_gv2, a_r2);
+  b.round1("bob", b_gx1, b_gv1, b_r1, b_gx2, b_gv2, b_r2);
+
+  let a_A = {};
+  let a_gva = {};
+  let a_ra = {};
+
+  let b_A = {};
+  let b_gva = {};
+  let b_ra = {};
+
+  // Note how the PINs are different (secret vs. sekrit)
+  a.round2("bob", "secret", b_gx1.value, b_gv1.value, b_r1.value,
+           b_gx2.value, b_gv2.value, b_r2.value, a_A, a_gva, a_ra);
+  b.round2("alice", "sekrit", a_gx1.value, a_gv1.value, a_r1.value,
+           a_gx2.value, a_gv2.value, a_r2.value, b_A, b_gva, b_ra);
+
+  let a_aes = {};
+  let a_hmac = {};
+  let b_aes = {};
+  let b_hmac = {};
+
+  a.final(b_A.value, b_gva.value, b_ra.value, "ohai", a_aes, a_hmac);
+  b.final(a_A.value, a_gva.value, a_ra.value, "ohai", b_aes, b_hmac);
+
+  do_check_neq(a_aes.value, b_aes.value);
+  do_check_neq(a_hmac.value, b_hmac.value);
+}
+
+function test_same_signerids() {
+  let a = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+            .createInstance(Ci.nsISyncJPAKE);
+  let b = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+            .createInstance(Ci.nsISyncJPAKE);
+
+  let gx1 = {};
+  let gv1 = {};
+  let r1 = {};
+  let gx2 = {};
+  let gv2 = {};
+  let r2 = {};
+
+  a.round1("alice", {}, {}, {}, {}, {}, {});
+  b.round1("alice", gx1, gv1, r1, gx2, gv2, r2);
+  do_check_throws(function() {
+    a.round2("alice", "sekrit", gx1.value, gv1.value, r1.value,
+             gx2.value, gv2.value, r2.value, {}, {}, {});
+  });
+}
+
+function test_bad_zkp() {
+  let a = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+            .createInstance(Ci.nsISyncJPAKE);
+  let b = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+            .createInstance(Ci.nsISyncJPAKE);
+
+  let gx1 = {};
+  let gv1 = {};
+  let r1 = {};
+  let gx2 = {};
+  let gv2 = {};
+  let r2 = {};
+
+  a.round1("alice", {}, {}, {}, {}, {}, {});
+  b.round1("bob", gx1, gv1, r1, gx2, gv2, r2);
+  do_check_throws(function() {
+    a.round2("invalid", "sekrit", gx1.value, gv1.value, r1.value,
+             gx2.value, gv2.value, r2.value, {}, {}, {});
+  });
+}
+
+function test_x4_zero() {
+  // The PKCS#11 API for J-PAKE does not allow us to choose any of the nonces.
+  // In order to test the defence against x4 (mod p) == 1, we had to generate
+  // our own signed nonces using a the FreeBL JPAKE_Sign function directly.
+  // To verify the signatures are accurate, pass the given value of R as the
+  // "testRandom" parameter to FreeBL's JPAKE_Sign, along with the given values
+  // for X and GX, using signerID "alice". Then verify that each GV returned
+  // from JPAKE_Sign matches the value specified here.
+  let test = function(badGX, badX_GV, badX_R) {
+    let a = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+            .createInstance(Ci.nsISyncJPAKE);
+    let b = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+            .createInstance(Ci.nsISyncJPAKE);
+
+    let a_gx1 = {};
+    let a_gv1 = {};
+    let a_r1 = {};
+    let a_gx2 = {};
+    let a_gv2 = {};
+    let a_r2 = {};
+
+    let b_gx1 = {};
+    let b_gv1 = {};
+    let b_r1 = {};
+    let b_gx2 = {};
+    let b_gv2 = {};
+    let b_r2 = {};
+
+    a.round1("alice", a_gx1, a_gv1, a_r1, a_gx2, a_gv2, a_r2);
+    b.round1("bob", b_gx1, b_gv1, b_r1, b_gx2, b_gv2, b_r2);
+
+    // Replace the g^x2 generated by A with the given illegal value.
+    a_gx2.value = badGX;
+    a_gv2.value = badX_GV;
+    a_r2.value = badX_R;
+
+    let b_A = {};
+    let b_gva = {};
+    let b_ra = {};
+
+    do_check_throws(function() {
+        b.round2("alice", "secret", a_gx1.value, a_gv1.value, a_r1.value,
+                    a_gx2.value, a_gv2.value, a_r2.value, b_A, b_gva, b_ra);
+    });
+  };
+
+  // g^x is NIST 3072's p + 1, (p + 1) mod p == 1, x == 0
+  test("90066455B5CFC38F9CAA4A48B4281F292C260FEEF01FD61037E56258A7795A1C"
+         + "7AD46076982CE6BB956936C6AB4DCFE05E6784586940CA544B9B2140E1EB523F"
+         + "009D20A7E7880E4E5BFA690F1B9004A27811CD9904AF70420EEFD6EA11EF7DA1"
+         + "29F58835FF56B89FAA637BC9AC2EFAAB903402229F491D8D3485261CD068699B"
+         + "6BA58A1DDBBEF6DB51E8FE34E8A78E542D7BA351C21EA8D8F1D29F5D5D159394"
+         + "87E27F4416B0CA632C59EFD1B1EB66511A5A0FBF615B766C5862D0BD8A3FE7A0"
+         + "E0DA0FB2FE1FCB19E8F9996A8EA0FCCDE538175238FC8B0EE6F29AF7F642773E"
+         + "BE8CD5402415A01451A840476B2FCEB0E388D30D4B376C37FE401C2A2C2F941D"
+         + "AD179C540C1C8CE030D460C4D983BE9AB0B20F69144C1AE13F9383EA1C08504F"
+         + "B0BF321503EFE43488310DD8DC77EC5B8349B8BFE97C2C560EA878DE87C11E3D"
+         + "597F1FEA742D73EEC7F37BE43949EF1A0D15C3F3E3FC0A8335617055AC91328E"
+         + "C22B50FC15B941D3D1624CD88BC25F3E941FDDC6200689581BFEC416B4B2CB74",
+       "5386107A0DD4A96ECF8D9BCF864BDE23AAEF13351F5550D777A32C1FEC165ED67AE51"
+         + "66C3876AABC1FED1A0993754F3AEE256530F529548F8FE010BC0D070175569845"
+         + "CF009AD24BC897A9CA1F18E1A9CE421DD54FD93AB528BC2594B47791713165276"
+         + "7B76903190C3DCD2076FEC1E61FFFC32D1B07273B06EA2889E66FCBFD41FE8984"
+         + "5FCE36056B09D1F20E58BB6BAA07A32796F11998BEF0AB3D387E2FB4FE3073FEB"
+         + "634BA91709010A70DA29C06F8F92D638C4F158680EAFEB5E0E323BD7DACB671C0"
+         + "BA3EDEEAB5CAA243CABAB28E7205AC9A0AAEAFE132635DAC7FE001C19F880A96E"
+         + "395C42536D694F81B4F44DC66D7D6FBE933C56ABF585837291D8751C18EB1F3FB"
+         + "620582E6A7B795D699E38C270863A289583CB9D07651E6BA3B82BC656B49BD09B"
+         + "6B8C27F370120C7CB89D0829BE51D56356EA836012E9204FF4D1CA8B1B7F9C768"
+         + "4BB2B0F226FD4042EEBAD931FDBD4F81F8425B305752F5E37FFA2B73BB5A034EC"
+         + "7EEF5AAC92EA212897E3A2B8961D2147710ECCE127B942AB2",
+       "05CC4DF005FE006C11111624E14806E4A904A4D1D6A53E795AC7867A960CD4FD");
+
+  // x == 0 implies g^x == 1
+  test("01",
+       "488759644532FA7C53E5239F2A365D4B9189582BDD2967A1852FE56568382B65"
+         + "C66BDFCD9B581EAEF4BB497CAF1290ECDFA47A1D1658DC5DC9248D9A4135"
+         + "DC70B6A8497CDF117236841FA18500DC696A92EEF5000ABE68E9C75B37BC"
+         + "6A722126BE728163AA90A6B03D5585994D3403557EEF08E819C72D143BBC"
+         + "CDF74559645066CB3607E1B0430365356389FC8FB3D66FD2B6E2E834EC23"
+         + "0B0234956752D07F983C918488C8E5A124B062D50B44C5E6FB36BCB03E39"
+         + "0385B17CF8062B6688371E6AF5915C2B1AAA31C9294943CC6DC1B994FC09"
+         + "49CA31828B83F3D6DFB081B26045DFD9F10092588B63F1D6E68881A06522"
+         + "5A417CA9555B036DE89D349AC794A43EB28FE320F9A321F06A9364C88B54"
+         + "99EEF4816375B119824ACC9AA56D1340B6A49D05F855DE699B351012028C"
+         + "CA43001F708CC61E71CA3849935BEEBABC0D268CD41B8D2B8DCA705FDFF8"
+         + "1DAA772DA96EDEA0B291FD5C0C1B8EFE5318D37EBC1BFF53A9DDEC4171A6"
+         + "479E341438970058E25C8F2BCDA6166C8BF1B065C174",
+       "8B2BACE575179D762F6F2FFDBFF00B497C07766AB3EED9961447CF6F43D06A97");
+}
+
+function test_invalid_input_round2() {
+  let a = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+            .createInstance(Ci.nsISyncJPAKE);
+
+  a.round1("alice", {}, {}, {}, {}, {}, {});
+  do_check_throws(function() {
+    a.round2("invalid", "sekrit", "some", "real", "garbage",
+             "even", "more", "garbage", {}, {}, {});
+  });
+}
+
+function test_invalid_input_final() {
+  let a = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+            .createInstance(Ci.nsISyncJPAKE);
+  let b = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+            .createInstance(Ci.nsISyncJPAKE);
+
+  let gx1 = {};
+  let gv1 = {};
+  let r1 = {};
+  let gx2 = {};
+  let gv2 = {};
+  let r2 = {};
+
+  a.round1("alice", {}, {}, {}, {}, {}, {});
+  b.round1("bob", gx1, gv1, r1, gx2, gv2, r2);
+  a.round2("bob", "sekrit", gx1.value, gv1.value, r1.value,
+           gx2.value, gv2.value, r2.value, {}, {}, {});
+  do_check_throws(function() {
+    a.final("some", "garbage", "alright", "foobar-info", {}, {});
+  });
+}
+
+function run_test() {
+  test_x4_zero();
+  test_success();
+  test_failure();
+  test_same_signerids();
+  test_bad_zkp();
+  test_invalid_input_round2();
+  test_invalid_input_final();
+}
new file mode 100644
--- /dev/null
+++ b/services/crypto/component/tests/unit/xpcshell.ini
@@ -0,0 +1,5 @@
+[DEFAULT]
+head = 
+firefox-appdir = browser
+
+[test_jpake.js]
--- a/services/crypto/moz.build
+++ b/services/crypto/moz.build
@@ -2,16 +2,18 @@
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files('**'):
     BUG_COMPONENT = ('Mozilla Services', 'Firefox Sync: Crypto')
 
+DIRS += ['component']
+
 XPCSHELL_TESTS_MANIFESTS += ['tests/unit/xpcshell.ini']
 
 EXTRA_JS_MODULES['services-crypto'] += [
     'modules/jwcrypto.jsm',
     'modules/LogUtils.jsm',
     'modules/utils.js',
     'modules/WeaveCrypto.js',
 ]
--- a/services/fxaccounts/FxAccountsWebChannel.jsm
+++ b/services/fxaccounts/FxAccountsWebChannel.jsm
@@ -31,16 +31,17 @@ const COMMAND_PROFILE_CHANGE       = "pr
 const COMMAND_CAN_LINK_ACCOUNT     = "fxaccounts:can_link_account";
 const COMMAND_LOGIN                = "fxaccounts:login";
 const COMMAND_LOGOUT               = "fxaccounts:logout";
 const COMMAND_DELETE               = "fxaccounts:delete";
 const COMMAND_SYNC_PREFERENCES     = "fxaccounts:sync_preferences";
 const COMMAND_CHANGE_PASSWORD      = "fxaccounts:change_password";
 
 const PREF_LAST_FXA_USER           = "identity.fxaccounts.lastSignedInUserHash";
+const PREF_SYNC_SHOW_CUSTOMIZATION = "services.sync-setup.ui.showCustomizationDialog";
 
 /**
  * A helper function that extracts the message and stack from an error object.
  * Returns a `{ message, stack }` tuple. `stack` will be null if the error
  * doesn't have a stack trace.
  */
 function getErrorDetails(error) {
   let details = { message: String(error), stack: null };
@@ -246,33 +247,52 @@ this.FxAccountsWebChannelHelpers.prototy
   // but it's a little more seamless to do here, and sync is currently the
   // only fxa consumer, so...
   shouldAllowRelink(acctName) {
     return !this._needRelinkWarning(acctName) ||
             this._promptForRelink(acctName);
   },
 
   /**
+   * New users are asked in the content server whether they want to
+   * customize which data should be synced. The user is only shown
+   * the dialog listing the possible data types upon verification.
+   *
+   * Save a bit into prefs that is read on verification to see whether
+   * to show the list of data types that can be saved.
+   */
+  setShowCustomizeSyncPref(showCustomizeSyncPref) {
+    Services.prefs.setBoolPref(PREF_SYNC_SHOW_CUSTOMIZATION, showCustomizeSyncPref);
+  },
+
+  getShowCustomizeSyncPref() {
+    return Services.prefs.getBoolPref(PREF_SYNC_SHOW_CUSTOMIZATION);
+  },
+
+  /**
    * stores sync login info it in the fxaccounts service
    *
    * @param accountData the user's account data and credentials
    */
   login(accountData) {
-
-    // We don't act on customizeSync anymore, it used to open a dialog inside
-    // the browser to selecte the engines to sync but we do it on the web now.
-    delete accountData.customizeSync;
+    if (accountData.customizeSync) {
+      this.setShowCustomizeSyncPref(true);
+      delete accountData.customizeSync;
+    }
 
     if (accountData.declinedSyncEngines) {
       let declinedSyncEngines = accountData.declinedSyncEngines;
       log.debug("Received declined engines", declinedSyncEngines);
       Weave.Service.engineManager.setDeclined(declinedSyncEngines);
       declinedSyncEngines.forEach(engine => {
         Services.prefs.setBoolPref("services.sync.engine." + engine, false);
       });
+
+      // if we got declinedSyncEngines that means we do not need to show the customize screen.
+      this.setShowCustomizeSyncPref(false);
       delete accountData.declinedSyncEngines;
     }
 
     // the user has already been shown the "can link account"
     // screen. No need to keep this data around.
     delete accountData.verifiedCanLinkAccount;
 
     // Remember who it was so we can log out next time.
--- a/services/fxaccounts/tests/xpcshell/head.js
+++ b/services/fxaccounts/tests/xpcshell/head.js
@@ -1,16 +1,15 @@
 /* Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
 var {classes: Cc, interfaces: Ci, results: Cr, utils: Cu} = Components;
 
 "use strict";
 
-Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 
 (function initFxAccountsTestingInfrastructure() {
   do_get_profile();
 
   let ns = {};
   Cu.import("resource://testing-common/services/common/logging.js", ns);
 
--- a/services/fxaccounts/tests/xpcshell/test_accounts.js
+++ b/services/fxaccounts/tests/xpcshell/test_accounts.js
@@ -1,14 +1,15 @@
 /* Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
 "use strict";
 
 Cu.import("resource://services-common/utils.js");
+Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/FxAccounts.jsm");
 Cu.import("resource://gre/modules/FxAccountsClient.jsm");
 Cu.import("resource://gre/modules/FxAccountsCommon.js");
 Cu.import("resource://gre/modules/FxAccountsOAuthGrantClient.jsm");
 Cu.import("resource://gre/modules/Promise.jsm");
 Cu.import("resource://gre/modules/Log.jsm");
 
 // We grab some additional stuff via backstage passes.
--- a/services/fxaccounts/tests/xpcshell/test_accounts_device_registration.js
+++ b/services/fxaccounts/tests/xpcshell/test_accounts_device_registration.js
@@ -1,14 +1,15 @@
 /* Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
 "use strict";
 
 Cu.import("resource://services-common/utils.js");
+Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/FxAccounts.jsm");
 Cu.import("resource://gre/modules/FxAccountsClient.jsm");
 Cu.import("resource://gre/modules/FxAccountsCommon.js");
 Cu.import("resource://gre/modules/Promise.jsm");
 Cu.import("resource://gre/modules/Log.jsm");
 
 initTestLogging("Trace");
 
--- a/services/fxaccounts/tests/xpcshell/test_loginmgr_storage.js
+++ b/services/fxaccounts/tests/xpcshell/test_loginmgr_storage.js
@@ -5,16 +5,17 @@
 
 // Tests for FxAccounts, storage and the master password.
 
 // Stop us hitting the real auth server.
 Services.prefs.setCharPref("identity.fxaccounts.auth.uri", "http://localhost");
 // See verbose logging from FxAccounts.jsm
 Services.prefs.setCharPref("identity.fxaccounts.loglevel", "Trace");
 
+Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/FxAccounts.jsm");
 Cu.import("resource://gre/modules/FxAccountsClient.jsm");
 Cu.import("resource://gre/modules/FxAccountsCommon.js");
 Cu.import("resource://gre/modules/osfile.jsm");
 Cu.import("resource://services-common/utils.js");
 Cu.import("resource://gre/modules/FxAccountsCommon.js");
 
 // Use a backstage pass to get at our LoginManagerStorage object, so we can
--- a/services/fxaccounts/tests/xpcshell/test_oauth_grant_client.js
+++ b/services/fxaccounts/tests/xpcshell/test_oauth_grant_client.js
@@ -1,15 +1,16 @@
 /* Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
 "use strict";
 
 Cu.import("resource://gre/modules/FxAccountsCommon.js");
 Cu.import("resource://gre/modules/FxAccountsOAuthGrantClient.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
 
 const CLIENT_OPTIONS = {
   serverURL: "http://127.0.0.1:9010/v1",
   client_id: "abc123"
 };
 
 const STATUS_SUCCESS = 200;
 
--- a/services/fxaccounts/tests/xpcshell/test_push_service.js
+++ b/services/fxaccounts/tests/xpcshell/test_push_service.js
@@ -1,16 +1,17 @@
 /* Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
 "use strict";
 
 // Tests for the FxA push service.
 
 Cu.import("resource://gre/modules/Task.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/Promise.jsm");
 Cu.import("resource://gre/modules/FxAccountsCommon.js");
 Cu.import("resource://gre/modules/Log.jsm");
 
 let scope = {};
 Services.scriptloader.loadSubScript("resource://gre/components/FxAccountsPush.js", scope);
 const FxAccountsPushService = scope.FxAccountsPushService;
 
--- a/services/fxaccounts/tests/xpcshell/test_storage_manager.js
+++ b/services/fxaccounts/tests/xpcshell/test_storage_manager.js
@@ -1,16 +1,17 @@
 /* Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
 "use strict";
 
 // Tests for the FxA storage manager.
 
 Cu.import("resource://gre/modules/Task.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/FxAccountsStorage.jsm");
 Cu.import("resource://gre/modules/FxAccountsCommon.js");
 Cu.import("resource://gre/modules/Log.jsm");
 
 initTestLogging("Trace");
 log.level = Log.Level.Trace;
 
 const DEVICE_REGISTRATION_VERSION = 42;
--- a/services/fxaccounts/tests/xpcshell/test_web_channel.js
+++ b/services/fxaccounts/tests/xpcshell/test_web_channel.js
@@ -282,25 +282,31 @@ add_task(function* test_helpers_login_wi
       setSignedInUser(accountData) {
         return new Promise(resolve => {
           // ensure fxAccounts is informed of the new user being signed in.
           do_check_eq(accountData.email, "testuser@testuser.com");
 
           // verifiedCanLinkAccount should be stripped in the data.
           do_check_false("verifiedCanLinkAccount" in accountData);
 
+          // the customizeSync pref should not update
+          do_check_false(helpers.getShowCustomizeSyncPref());
+
           // previously signed in user preference is updated.
           do_check_eq(helpers.getPreviousAccountNameHashPref(), helpers.sha256("testuser@testuser.com"));
 
           resolve();
         });
       }
     }
   });
 
+  // the show customize sync pref should stay the same
+  helpers.setShowCustomizeSyncPref(false);
+
   // ensure the previous account pref is overwritten.
   helpers.setPreviousAccountNameHashPref("lastuser@testuser.com");
 
   yield helpers.login({
     email: "testuser@testuser.com",
     verifiedCanLinkAccount: true,
     customizeSync: false
   });
@@ -312,22 +318,28 @@ add_task(function* test_helpers_login_wi
       setSignedInUser(accountData) {
         return new Promise(resolve => {
           // ensure fxAccounts is informed of the new user being signed in.
           do_check_eq(accountData.email, "testuser@testuser.com");
 
           // customizeSync should be stripped in the data.
           do_check_false("customizeSync" in accountData);
 
+          // the customizeSync pref should not update
+          do_check_true(helpers.getShowCustomizeSyncPref());
+
           resolve();
         });
       }
     }
   });
 
+  // the customize sync pref should be overwritten
+  helpers.setShowCustomizeSyncPref(false);
+
   yield helpers.login({
     email: "testuser@testuser.com",
     verifiedCanLinkAccount: true,
     customizeSync: true
   });
 });
 
 add_task(function* test_helpers_login_with_customize_sync_and_declined_engines() {
@@ -343,22 +355,28 @@ add_task(function* test_helpers_login_wi
           do_check_false("declinedSyncEngines" in accountData);
           do_check_eq(Services.prefs.getBoolPref("services.sync.engine.addons"), false);
           do_check_eq(Services.prefs.getBoolPref("services.sync.engine.bookmarks"), true);
           do_check_eq(Services.prefs.getBoolPref("services.sync.engine.history"), true);
           do_check_eq(Services.prefs.getBoolPref("services.sync.engine.passwords"), true);
           do_check_eq(Services.prefs.getBoolPref("services.sync.engine.prefs"), false);
           do_check_eq(Services.prefs.getBoolPref("services.sync.engine.tabs"), true);
 
+          // the customizeSync pref should be disabled
+          do_check_false(helpers.getShowCustomizeSyncPref());
+
           resolve();
         });
       }
     }
   });
 
+  // the customize sync pref should be overwritten
+  helpers.setShowCustomizeSyncPref(true);
+
   do_check_eq(Services.prefs.getBoolPref("services.sync.engine.addons"), true);
   do_check_eq(Services.prefs.getBoolPref("services.sync.engine.bookmarks"), true);
   do_check_eq(Services.prefs.getBoolPref("services.sync.engine.history"), true);
   do_check_eq(Services.prefs.getBoolPref("services.sync.engine.passwords"), true);
   do_check_eq(Services.prefs.getBoolPref("services.sync.engine.prefs"), true);
   do_check_eq(Services.prefs.getBoolPref("services.sync.engine.tabs"), true);
   yield helpers.login({
     email: "testuser@testuser.com",
--- a/services/sync/Weave.js
+++ b/services/sync/Weave.js
@@ -67,16 +67,21 @@ function WeaveService() {
 }
 WeaveService.prototype = {
   classID: Components.ID("{74b89fb0-f200-4ae8-a3ec-dd164117f6de}"),
 
   QueryInterface: XPCOMUtils.generateQI([Ci.nsIObserver,
                                          Ci.nsISupportsWeakReference]),
 
   ensureLoaded() {
+    // If we are loaded and not using FxA, load the migration module.
+    if (!this.fxAccountsEnabled) {
+      Cu.import("resource://services-sync/FxaMigrator.jsm");
+    }
+
     Components.utils.import("resource://services-sync/main.js");
 
     // Side-effect of accessing the service is that it is instantiated.
     Weave.Service;
   },
 
   whenLoaded() {
     if (this.ready) {
@@ -88,19 +93,36 @@ WeaveService.prototype = {
       Services.obs.removeObserver(onReady, "weave:service:ready");
       deferred.resolve();
     }, "weave:service:ready", false);
     this.ensureLoaded();
     return deferred.promise;
   },
 
   /**
+   * Whether Firefox Accounts is enabled.
+   *
+   * @return bool
+   */
+  get fxAccountsEnabled() {
+    try {
+      // Old sync guarantees '@' will never appear in the username while FxA
+      // uses the FxA email address - so '@' is the flag we use.
+      let username = Services.prefs.getCharPref(SYNC_PREFS_BRANCH + "username");
+      return !username || username.includes("@");
+    } catch (_) {
+      return true; // No username == only allow FxA to be configured.
+    }
+  },
+
+  /**
    * Whether Sync appears to be enabled.
    *
-   * This returns true if we have an associated FxA account
+   * This returns true if all the Sync preferences for storing account
+   * and server configuration are populated.
    *
    * It does *not* perform a robust check to see if the client is working.
    * For that, you'll want to check Weave.Status.checkSetup().
    */
   get enabled() {
     let prefs = Services.prefs.getBranch(SYNC_PREFS_BRANCH);
     return prefs.prefHasUserValue("username");
   },
@@ -115,19 +137,20 @@ WeaveService.prototype = {
 
     case "final-ui-startup":
       // Force Weave service to load if it hasn't triggered from overlays
       this.timer = Cc["@mozilla.org/timer;1"].createInstance(Ci.nsITimer);
       this.timer.initWithCallback({
         notify: function() {
           let isConfigured = false;
           // We only load more if it looks like Sync is configured.
-          if (this.enabled) {
-            // We have an associated FxAccount. So, do a more thorough check.
-            // This will import a number of modules and thus increase memory
+          let prefs = Services.prefs.getBranch(SYNC_PREFS_BRANCH);
+          if (prefs.prefHasUserValue("username")) {
+            // We have a username. So, do a more thorough check. This will
+            // import a number of modules and thus increase memory
             // accordingly. We could potentially copy code performed by
             // this check into this file if our above code is yielding too
             // many false positives.
             Components.utils.import("resource://services-sync/main.js");
             isConfigured = Weave.Status.checkSetup() != Weave.CLIENT_NOT_CONFIGURED;
           }
           let getHistogramById = Services.telemetry.getHistogramById;
           getHistogramById("WEAVE_CONFIGURED").add(isConfigured);
--- a/services/sync/locales/en-US/sync.properties
+++ b/services/sync/locales/en-US/sync.properties
@@ -7,10 +7,21 @@ client.name2 = %1$S’s %2$S on %3$S
 
 # %S is the date and time at which the last sync successfully completed
 lastSync2.label = Last sync: %S
 
 # signInToSync.description is the tooltip for the Sync buttons when Sync is
 # not configured.
 signInToSync.description = Sign In To Sync
 
+error.sync.title = Error While Syncing
+error.sync.description = Sync encountered an error while syncing: %1$S.  Sync will automatically retry this action.
+warning.sync.eol.label = Service Shutting Down
+# %1: the app name (Firefox)
+warning.sync.eol.description = Your Firefox Sync service is shutting down soon. Upgrade %1$S to keep syncing.
+error.sync.eol.label = Service Unavailable
+# %1: the app name (Firefox)
+error.sync.eol.description = Your Firefox Sync service is no longer available. You need to upgrade %1$S to keep syncing.
+sync.eol.learnMore.label = Learn more
+sync.eol.learnMore.accesskey = L
+
 syncnow.label = Sync Now
 syncing2.label = Syncing…
--- a/services/sync/modules-testing/utils.js
+++ b/services/sync/modules-testing/utils.js
@@ -2,32 +2,37 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 "use strict";
 
 this.EXPORTED_SYMBOLS = [
   "btoa", // It comes from a module import.
   "encryptPayload",
+  "isConfiguredWithLegacyIdentity",
+  "ensureLegacyIdentityManager",
+  "setBasicCredentials",
   "makeIdentityConfig",
   "makeFxAccountsInternalMock",
   "configureFxAccountIdentity",
   "configureIdentity",
   "SyncTestingInfrastructure",
   "waitForZeroTimer",
   "promiseZeroTimer",
   "promiseNamedTimer",
+  "add_identity_test",
   "MockFxaStorageManager",
   "AccountState", // from a module import
   "sumHistogram",
 ];
 
 var {utils: Cu} = Components;
 
 Cu.import("resource://services-sync/status.js");
+Cu.import("resource://services-sync/identity.js");
 Cu.import("resource://services-common/utils.js");
 Cu.import("resource://services-crypto/utils.js");
 Cu.import("resource://services-sync/util.js");
 Cu.import("resource://services-sync/browserid_identity.js");
 Cu.import("resource://testing-common/services/common/logging.js");
 Cu.import("resource://testing-common/services/sync/fakeservices.js");
 Cu.import("resource://gre/modules/FxAccounts.jsm");
 Cu.import("resource://gre/modules/FxAccountsClient.jsm");
@@ -98,16 +103,50 @@ this.promiseZeroTimer = function() {
 }
 
 this.promiseNamedTimer = function(wait, thisObj, name) {
   return new Promise(resolve => {
     Utils.namedTimer(resolve, wait, thisObj, name);
   });
 }
 
+/**
+ * Return true if Sync is configured with the "legacy" identity provider.
+ */
+this.isConfiguredWithLegacyIdentity = function() {
+  let ns = {};
+  Cu.import("resource://services-sync/service.js", ns);
+
+  // We can't use instanceof as BrowserIDManager (the "other" identity) inherits
+  // from IdentityManager so that would return true - so check the prototype.
+  return Object.getPrototypeOf(ns.Service.identity) === IdentityManager.prototype;
+}
+
+/**
+  * Ensure Sync is configured with the "legacy" identity provider.
+  */
+this.ensureLegacyIdentityManager = function() {
+  let ns = {};
+  Cu.import("resource://services-sync/service.js", ns);
+
+  Status.__authManager = ns.Service.identity = new IdentityManager();
+  ns.Service._clusterManager = ns.Service.identity.createClusterManager(ns.Service);
+}
+
+this.setBasicCredentials =
+ function setBasicCredentials(username, password, syncKey) {
+  let ns = {};
+  Cu.import("resource://services-sync/service.js", ns);
+
+  let auth = ns.Service.identity;
+  auth.username = username;
+  auth.basicPassword = password;
+  auth.syncKey = syncKey;
+}
+
 // Return an identity configuration suitable for testing with our identity
 // providers.  |overrides| can specify overrides for any default values.
 // |server| is optional, but if specified, will be used to form the cluster
 // URL for the FxA identity.
 this.makeIdentityConfig = function(overrides) {
   // first setup the defaults.
   let result = {
     // Username used in both fxaccount and sync identity configs.
@@ -126,24 +165,33 @@ this.makeIdentityConfig = function(overr
       token: {
         endpoint: null,
         duration: 300,
         id: "id",
         key: "key",
         hashed_fxa_uid: "f".repeat(32), // used during telemetry validation
         // uid will be set to the username.
       }
+    },
+    sync: {
+      // username will come from the top-level username
+      password: "whatever",
+      syncKey: "abcdeabcdeabcdeabcdeabcdea",
     }
   };
 
   // Now handle any specified overrides.
   if (overrides) {
     if (overrides.username) {
       result.username = overrides.username;
     }
+    if (overrides.sync) {
+      // TODO: allow just some attributes to be specified
+      result.sync = overrides.sync;
+    }
     if (overrides.fxaccount) {
       // TODO: allow just some attributes to be specified
       result.fxaccount = overrides.fxaccount;
     }
   }
   return result;
 }
 
@@ -203,40 +251,58 @@ this.configureFxAccountIdentity = functi
   authService._account = config.fxaccount.user.email;
 }
 
 this.configureIdentity = async function(identityOverrides, server) {
   let config = makeIdentityConfig(identityOverrides, server);
   let ns = {};
   Cu.import("resource://services-sync/service.js", ns);
 
-  // If a server was specified, ensure FxA has a correct cluster URL available.
-  if (server && !config.fxaccount.token.endpoint) {
-    let ep = server.baseURI;
-    if (!ep.endsWith("/")) {
-      ep += "/";
-    }
-    ep += "1.1/" + config.username + "/";
-    config.fxaccount.token.endpoint = ep;
+  if (server) {
+    ns.Service.serverURL = server.baseURI;
   }
 
-  configureFxAccountIdentity(ns.Service.identity, config);
-  await ns.Service.identity.initializeWithCurrentIdentity();
-  // and cheat to avoid requiring each test do an explicit login - give it
-  // a cluster URL.
-  if (config.fxaccount.token.endpoint) {
-    ns.Service.clusterURL = config.fxaccount.token.endpoint;
+  ns.Service._clusterManager = ns.Service.identity.createClusterManager(ns.Service);
+
+  if (ns.Service.identity instanceof BrowserIDManager) {
+    // do the FxAccounts thang...
+
+    // If a server was specified, ensure FxA has a correct cluster URL available.
+    if (server && !config.fxaccount.token.endpoint) {
+      let ep = server.baseURI;
+      if (!ep.endsWith("/")) {
+        ep += "/";
+      }
+      ep += "1.1/" + config.username + "/";
+      config.fxaccount.token.endpoint = ep;
+    }
+
+    configureFxAccountIdentity(ns.Service.identity, config);
+    await ns.Service.identity.initializeWithCurrentIdentity();
+    // and cheat to avoid requiring each test do an explicit login - give it
+    // a cluster URL.
+    if (config.fxaccount.token.endpoint) {
+      ns.Service.clusterURL = config.fxaccount.token.endpoint;
+    }
+    return;
   }
+  // old style identity provider.
+  if (server) {
+    ns.Service.clusterURL = server.baseURI + "/";
+  }
+  ns.Service.identity.username = config.username;
+  ns.Service._updateCachedURLs();
+  setBasicCredentials(config.username, config.sync.password, config.sync.syncKey);
 }
 
-this.SyncTestingInfrastructure = async function(server, username) {
+this.SyncTestingInfrastructure = async function(server, username, password) {
   let ns = {};
   Cu.import("resource://services-sync/service.js", ns);
 
-  let config = makeIdentityConfig({ username });
+  let config = makeIdentityConfig({ username, password });
   await configureIdentity(config, server);
   return {
     logStats: initTestLogging(),
     fakeFilesystem: new FakeFilesystemService({}),
     fakeGUIDService: new FakeGUIDService(),
     fakeCryptoService: new FakeCryptoService(),
   }
 }
@@ -251,16 +317,51 @@ this.encryptPayload = function encryptPa
 
   return {
     ciphertext: cleartext, // ciphertext == cleartext with fake crypto
     IV: "irrelevant",
     hmac: fakeSHA256HMAC(cleartext, CryptoUtils.makeHMACKey("")),
   };
 }
 
+// This helper can be used instead of 'add_test' or 'add_task' to run the
+// specified test function twice - once with the old-style sync identity
+// manager and once with the new-style BrowserID identity manager, to ensure
+// it works in both cases.
+//
+// * The test itself should be passed as 'test' - ie, test code will generally
+//   pass |this|.
+// * The test function is a regular test function - although note that it must
+//   be a generator - async operations should yield them, and run_next_test
+//   mustn't be called.
+this.add_identity_test = function(test, testFunction) {
+  function note(what) {
+    let msg = "running test " + testFunction.name + " with " + what + " identity manager";
+    test.do_print(msg);
+  }
+  let ns = {};
+  Cu.import("resource://services-sync/service.js", ns);
+  // one task for the "old" identity manager.
+  test.add_task(async function() {
+    note("sync");
+    let oldIdentity = Status._authManager;
+    ensureLegacyIdentityManager();
+    await testFunction();
+    Status.__authManager = ns.Service.identity = oldIdentity;
+  });
+  // another task for the FxAccounts identity manager.
+  test.add_task(async function() {
+    note("FxAccounts");
+    let oldIdentity = Status._authManager;
+    Status.__authManager = ns.Service.identity = new BrowserIDManager();
+    await testFunction();
+    Status.__authManager = ns.Service.identity = oldIdentity;
+  });
+}
+
 this.sumHistogram = function(name, options = {}) {
   let histogram = options.key ? Services.telemetry.getKeyedHistogramById(name) :
                   Services.telemetry.getHistogramById(name);
   let snapshot = histogram.snapshot(options.key);
   let sum = -Infinity;
   if (snapshot) {
     sum = snapshot.sum;
   }
new file mode 100644
--- /dev/null
+++ b/services/sync/modules/FxaMigrator.jsm
@@ -0,0 +1,99 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict;"
+
+// Note that this module used to supervise the step-by-step migration from
+// a legacy Sync account to a FxA-based Sync account. In bug 1205928, this
+// changed to automatically disconnect the legacy Sync account.
+
+const {classes: Cc, interfaces: Ci, results: Cr, utils: Cu} = Components;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/Log.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
+
+XPCOMUtils.defineLazyGetter(this, "WeaveService", function() {
+  return Cc["@mozilla.org/weave/service;1"]
+         .getService(Components.interfaces.nsISupports)
+         .wrappedJSObject;
+});
+
+XPCOMUtils.defineLazyModuleGetter(this, "Weave",
+  "resource://services-sync/main.js");
+
+// We send this notification when we perform the disconnection. The browser
+// window will show a one-off notification bar.
+const OBSERVER_STATE_CHANGE_TOPIC = "fxa-migration:state-changed";
+
+const OBSERVER_TOPICS = [
+  "xpcom-shutdown",
+  "weave:eol",
+];
+
+function Migrator() {
+  // Leave the log-level as Debug - Sync will setup log appenders such that
+  // these messages generally will not be seen unless other log related
+  // prefs are set.
+  this.log.level = Log.Level.Debug;
+
+  for (let topic of OBSERVER_TOPICS) {
+    Services.obs.addObserver(this, topic, false);
+  }
+}
+
+Migrator.prototype = {
+  log: Log.repository.getLogger("Sync.SyncMigration"),
+
+  finalize() {
+    for (let topic of OBSERVER_TOPICS) {
+      Services.obs.removeObserver(this, topic);
+    }
+  },
+
+  observe(subject, topic, data) {
+    this.log.debug("observed " + topic);
+    switch (topic) {
+      case "xpcom-shutdown":
+        this.finalize();
+        break;
+
+      default:
+        // this notification when configured with legacy Sync means we want to
+        // disconnect
+        if (!WeaveService.fxAccountsEnabled) {
+          this.log.info("Disconnecting from legacy Sync");
+          // Set up an observer for when the disconnection is complete.
+          let observe;
+          Services.obs.addObserver(observe = () => {
+            this.log.info("observed that startOver is complete");
+            Services.obs.removeObserver(observe, "weave:service:start-over:finish");
+            // Send the notification for the UI.
+            Services.obs.notifyObservers(null, OBSERVER_STATE_CHANGE_TOPIC, null);
+          }, "weave:service:start-over:finish", false);
+
+          // Do the disconnection.
+          Weave.Service.startOver();
+        }
+    }
+  },
+
+  get learnMoreLink() {
+    try {
+      var url = Services.prefs.getCharPref("app.support.baseURL");
+    } catch (err) {
+      return null;
+    }
+    url += "sync-upgrade";
+    let sb = Services.strings.createBundle("chrome://weave/locale/services/sync.properties");
+    return {
+      text: sb.GetStringFromName("sync.eol.learnMore.label"),
+      href: Services.urlFormatter.formatURL(url),
+    };
+  },
+};
+
+// We expose a singleton
+this.EXPORTED_SYMBOLS = ["fxaMigrator"];
+var fxaMigrator = new Migrator();
--- a/services/sync/modules/browserid_identity.js
+++ b/services/sync/modules/browserid_identity.js
@@ -8,21 +8,23 @@ this.EXPORTED_SYMBOLS = ["BrowserIDManag
 
 var {classes: Cc, interfaces: Ci, utils: Cu, results: Cr} = Components;
 
 Cu.import("resource://gre/modules/Log.jsm");
 Cu.import("resource://services-common/async.js");
 Cu.import("resource://services-common/utils.js");
 Cu.import("resource://services-common/tokenserverclient.js");
 Cu.import("resource://services-crypto/utils.js");
+Cu.import("resource://services-sync/identity.js");
 Cu.import("resource://services-sync/util.js");
 Cu.import("resource://services-common/tokenserverclient.js");
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://services-sync/constants.js");
 Cu.import("resource://gre/modules/Promise.jsm");
+Cu.import("resource://services-sync/stages/cluster.js");
 Cu.import("resource://gre/modules/FxAccounts.jsm");
 
 // Lazy imports to prevent unnecessary load on startup.
 XPCOMUtils.defineLazyModuleGetter(this, "Weave",
                                   "resource://services-sync/main.js");
 
 XPCOMUtils.defineLazyModuleGetter(this, "BulkKeyBundle",
                                   "resource://services-sync/keys.js");
@@ -41,16 +43,18 @@ var fxAccountsCommon = {};
 Cu.import("resource://gre/modules/FxAccountsCommon.js", fxAccountsCommon);
 
 const OBSERVER_TOPICS = [
   fxAccountsCommon.ONLOGIN_NOTIFICATION,
   fxAccountsCommon.ONLOGOUT_NOTIFICATION,
   fxAccountsCommon.ON_ACCOUNT_STATE_CHANGE_NOTIFICATION,
 ];
 
+const PREF_SYNC_SHOW_CUSTOMIZATION = "services.sync-setup.ui.showCustomizationDialog";
+
 function deriveKeyBundle(kB) {
   let out = CryptoUtils.hkdf(kB, undefined,
                              "identity.mozilla.com/picl/v1/oldsync", 2 * 32);
   let bundle = new BulkKeyBundle();
   // [encryptionKey, hmacKey]
   bundle.keyPair = [out.slice(0, 32), out.slice(32, 64)];
   return bundle;
 }
@@ -80,31 +84,41 @@ this.BrowserIDManager = function Browser
   this._tokenServerClient = new TokenServerClient();
   this._tokenServerClient.observerPrefix = "weave:service";
   // will be a promise that resolves when we are ready to authenticate
   this.whenReadyToAuthenticate = null;
   this._log = log;
 };
 
 this.BrowserIDManager.prototype = {
+  __proto__: IdentityManager.prototype,
+
   _fxaService: null,
   _tokenServerClient: null,
   // https://docs.services.mozilla.com/token/apis.html
   _token: null,
   _signedInUser: null, // the signedinuser we got from FxAccounts.
 
   // null if no error, otherwise a LOGIN_FAILED_* value that indicates why
   // we failed to authenticate (but note it might not be an actual
   // authentication problem, just a transient network error or similar)
   _authFailureReason: null,
 
   // it takes some time to fetch a sync key bundle, so until this flag is set,
   // we don't consider the lack of a keybundle as a failure state.
   _shouldHaveSyncKeyBundle: false,
 
+  get needsCustomization() {
+    try {
+      return Services.prefs.getBoolPref(PREF_SYNC_SHOW_CUSTOMIZATION);
+    } catch (e) {
+      return false;
+    }
+  },
+
   hashedUID() {
     if (!this._hashedUID) {
       throw new Error("hashedUID: Don't seem to have previously seen a token");
     }
     return this._hashedUID;
   },
 
   // Return a hashed version of a deviceID, suitable for telemetry.
@@ -119,16 +133,29 @@ this.BrowserIDManager.prototype = {
   deviceID() {
     return this._signedInUser && this._signedInUser.deviceId;
   },
 
   initialize() {
     for (let topic of OBSERVER_TOPICS) {
       Services.obs.addObserver(this, topic, false);
     }
+    // and a background fetch of account data just so we can set this.account,
+    // so we have a username available before we've actually done a login.
+    // XXX - this is actually a hack just for tests and really shouldn't be
+    // necessary. Also, you'd think it would be safe to allow this.account to
+    // be set to null when there's no user logged in, but argue with the test
+    // suite, not with me :)
+    this._fxaService.getSignedInUser().then(accountData => {
+      if (accountData) {
+        this.account = accountData.email;
+      }
+    }).catch(err => {
+      // As above, this is only for tests so it is safe to ignore.
+    });
   },
 
   /**
    * Ensure the user is logged in.  Returns a promise that resolves when
    * the user is logged in, or is rejected if the login attempt has failed.
    */
   ensureLoggedIn() {
     if (!this._shouldHaveSyncKeyBundle && this.whenReadyToAuthenticate) {
@@ -158,16 +185,29 @@ this.BrowserIDManager.prototype = {
     // After this is called, we can expect Service.identity != this.
     for (let topic of OBSERVER_TOPICS) {
       Services.obs.removeObserver(this, topic);
     }
     this.resetCredentials();
     this._signedInUser = null;
   },
 
+  offerSyncOptions() {
+    // If the user chose to "Customize sync options" when signing
+    // up with Firefox Accounts, ask them to choose what to sync.
+    const url = "chrome://browser/content/sync/customize.xul";
+    const features = "centerscreen,chrome,modal,dialog,resizable=no";
+    let win = Services.wm.getMostRecentWindow("navigator:browser");
+
+    let data = {accepted: false};
+    win.openDialog(url, "_blank", features, data);
+
+    return data;
+  },
+
   initializeWithCurrentIdentity(isInitialSync = false) {
     // While this function returns a promise that resolves once we've started
     // the auth process, that process is complete when
     // this.whenReadyToAuthenticate.promise resolves.
     this._log.trace("initializeWithCurrentIdentity");
 
     // Reset the world before we do anything async.
     this.whenReadyToAuthenticate = Promise.defer();
@@ -180,32 +220,45 @@ this.BrowserIDManager.prototype = {
     // user completes a force authentication, so we should make
     // sure all credentials are reset before proceeding.
     this.resetCredentials();
     this._authFailureReason = null;
 
     return this._fxaService.getSignedInUser().then(accountData => {
       if (!accountData) {
         this._log.info("initializeWithCurrentIdentity has no user logged in");
+        this.account = null;
         // and we are as ready as we can ever be for auth.
         this._shouldHaveSyncKeyBundle = true;
         this.whenReadyToAuthenticate.reject("no user is logged in");
         return;
       }
 
-      this.username = accountData.email;
+      this.account = accountData.email;
       this._updateSignedInUser(accountData);
       // The user must be verified before we can do anything at all; we kick
       // this and the rest of initialization off in the background (ie, we
       // don't return the promise)
       this._log.info("Waiting for user to be verified.");
       this._fxaService.whenVerified(accountData).then(accountData => {
         this._updateSignedInUser(accountData);
+        this._log.info("Starting fetch for key bundle.");
+        if (this.needsCustomization) {
+          let data = this.offerSyncOptions();
+          if (data.accepted) {
+            Services.prefs.clearUserPref(PREF_SYNC_SHOW_CUSTOMIZATION);
 
-        this._log.info("Starting fetch for key bundle.");
+            // Mark any non-selected engines as declined.
+            Weave.Service.engineManager.declineDisabled();
+          } else {
+            // Log out if the user canceled the dialog.
+            return this._fxaService.signOut();
+          }
+        }
+      }).then(() => {
         return this._fetchTokenForUser();
       }).then(token => {
         this._token = token;
         if (token) {
           // We may not have a token if the master-password is locked - but we
           // still treat this as "success" so we don't prompt for re-authentication.
           this._hashedUID = token.hashed_fxa_uid; // see _ensureValidToken for why we do this...
         }
@@ -307,65 +360,89 @@ this.BrowserIDManager.prototype = {
   _now() {
     return this._fxaService.now()
   },
 
   get _localtimeOffsetMsec() {
     return this._fxaService.localtimeOffsetMsec;
   },
 
-  get syncKeyBundle() {
-    return this._syncKeyBundle;
+  usernameFromAccount(val) {
+    // we don't differentiate between "username" and "account"
+    return val;
   },
 
-  get username() {
-    return Svc.Prefs.get("username", null);
+  /**
+   * Obtains the HTTP Basic auth password.
+   *
+   * Returns a string if set or null if it is not set.
+   */
+  get basicPassword() {
+    this._log.error("basicPassword getter should be not used in BrowserIDManager");
+    return null;
+  },
+
+  /**
+   * Set the HTTP basic password to use.
+   *
+   * Changes will not persist unless persistSyncCredentials() is called.
+   */
+  set basicPassword(value) {
+    throw new Error("basicPassword setter should be not used in BrowserIDManager");
   },
 
   /**
-   * Set the username value.
+   * Obtain the Sync Key.
    *
-   * Changing the username has the side-effect of wiping credentials.
+   * This returns a 26 character "friendly" Base32 encoded string on success or
+   * null if no Sync Key could be found.
+   *
+   * If the Sync Key hasn't been set in this session, this will look in the
+   * password manager for the sync key.
    */
-  set username(value) {
-    if (value) {
-      value = value.toLowerCase();
+  get syncKey() {
+    if (this.syncKeyBundle) {
+      // TODO: This is probably fine because the code shouldn't be
+      // using the sync key directly (it should use the sync key
+      // bundle), but I don't like it. We should probably refactor
+      // code that is inspecting this to not do validation on this
+      // field directly and instead call a isSyncKeyValid() function
+      // that we can override.
+      return "99999999999999999999999999";
+    }
+    return null;
+  },
 
-      if (value == this.username) {
-        return;
-      }
+  set syncKey(value) {
+    throw "syncKey setter should be not used in BrowserIDManager";
+  },
 
-      Svc.Prefs.set("username", value);
-    } else {
-      Svc.Prefs.reset("username");
-    }
-
-    // If we change the username, we interpret this as a major change event
-    // and wipe out the credentials.
-    this._log.info("Username changed. Removing stored credentials.");
-    this.resetCredentials();
+  get syncKeyBundle() {
+    return this._syncKeyBundle;
   },
 
   /**
    * Resets/Drops all credentials we hold for the current user.
    */
   resetCredentials() {
-    this.resetSyncKeyBundle();
+    this.resetSyncKey();
     this._token = null;
     this._hashedUID = null;
     // The cluster URL comes from the token, so resetting it to empty will
     // force Sync to not accidentally use a value from an earlier token.
     Weave.Service.clusterURL = null;
   },
 
   /**
-   * Resets/Drops the sync key bundle we hold for the current user.
+   * Resets/Drops the sync key we hold for the current user.
    */
-  resetSyncKeyBundle() {
+  resetSyncKey() {
+    this._syncKey = null;
     this._syncKeyBundle = null;
+    this._syncKeyUpdated = true;
     this._shouldHaveSyncKeyBundle = false;
   },
 
   /**
    * Pre-fetches any information that might help with migration away from this
    * identity.  Called after every sync and is really just an optimization that
    * allows us to avoid a network request for when we actually need the
    * migration info.
@@ -377,42 +454,29 @@ this.BrowserIDManager.prototype = {
   /**
     * Return credentials hosts for this identity only.
     */
   _getSyncCredentialsHosts() {
     return Utils.getSyncCredentialsHostsFxA();
   },
 
   /**
-   * Deletes Sync credentials from the password manager.
-   */
-  deleteSyncCredentials() {
-    for (let host of this._getSyncCredentialsHosts()) {
-      let logins = Services.logins.findLogins({}, host, "", "");
-      for (let login of logins) {
-        Services.logins.removeLogin(login);
-      }
-    }
-  },
-
-  /**
    * The current state of the auth credentials.
    *
    * This essentially validates that enough credentials are available to use
    * Sync. It doesn't check we have all the keys we need as the master-password
    * may have been locked when we tried to get them - we rely on
    * unlockAndVerifyAuthState to check that for us.
    */
   get currentAuthState() {
     if (this._authFailureReason) {
       this._log.info("currentAuthState returning " + this._authFailureReason +
                      " due to previous failure");
       return this._authFailureReason;
     }
-
     // TODO: need to revisit this. Currently this isn't ready to go until
     // both the username and syncKeyBundle are both configured and having no
     // username seems to make things fail fast so that's good.
     if (!this.username) {
       return LOGIN_FAILED_NO_USERNAME;
     }
 
     return STATUS_OK;
@@ -732,49 +796,21 @@ this.BrowserIDManager.prototype = {
     return LOGIN_FAILED_NETWORK_ERROR;
   },
 };
 
 /* An implementation of the ClusterManager for this identity
  */
 
 function BrowserIDClusterManager(service) {
-  this._log = log;
-  this.service = service;
+  ClusterManager.call(this, service);
 }
 
 BrowserIDClusterManager.prototype = {
-  get identity() {
-    return this.service.identity;
-  },
-
-  /**
-   * Determine the cluster for the current user and update state.
-   */
-  setCluster() {
-    // Make sure we didn't get some unexpected response for the cluster.
-    let cluster = this._findCluster();
-    this._log.debug("Cluster value = " + cluster);
-    if (cluster == null) {
-      return false;
-    }
-
-    // Convert from the funky "String object with additional properties" that
-    // resource.js returns to a plain-old string.
-    cluster = cluster.toString();
-    // Don't update stuff if we already have the right cluster
-    if (cluster == this.service.clusterURL) {
-      return false;
-    }
-
-    this._log.debug("Setting cluster to " + cluster);
-    this.service.clusterURL = cluster;
-
-    return true;
-  },
+  __proto__: ClusterManager.prototype,
 
   _findCluster() {
     let endPointFromIdentityToken = function() {
       // The only reason (in theory ;) that we can end up with a null token
       // is when this.identity._canFetchKeys() returned false.  In turn, this
       // should only happen if the master-password is locked or the credentials
       // storage is screwed, and in those cases we shouldn't have started
       // syncing so shouldn't get here anyway.
--- a/services/sync/modules/constants.js
+++ b/services/sync/modules/constants.js
@@ -6,16 +6,18 @@
 // Process each item in the "constants hash" to add to "global" and give a name
 this.EXPORTED_SYMBOLS = [];
 for (let [key, val] of Object.entries({
 
 WEAVE_VERSION:                         "@weave_version@",
 
 // Sync Server API version that the client supports.
 SYNC_API_VERSION:                      "1.1",
+USER_API_VERSION:                      "1.0",
+MISC_API_VERSION:                      "1.0",
 
 // Version of the data format this client supports. The data format describes
 // how records are packaged; this is separate from the Server API version and
 // the per-engine cleartext formats.
 STORAGE_VERSION:                       5,
 PREFS_BRANCH:                          "services.sync.",
 
 // Host "key" to access Weave Identity in the password manager
@@ -117,16 +119,17 @@ MASTER_PASSWORD_LOCKED:                "
 
 // success states
 LOGIN_SUCCEEDED:                       "success.login",
 SYNC_SUCCEEDED:                        "success.sync",
 ENGINE_SUCCEEDED:                      "success.engine",
 
 // login failure status codes:
 LOGIN_FAILED_NO_USERNAME:              "error.login.reason.no_username",
+LOGIN_FAILED_NO_PASSWORD:              "error.login.reason.no_password2",
 LOGIN_FAILED_NO_PASSPHRASE:            "error.login.reason.no_recoverykey",
 LOGIN_FAILED_NETWORK_ERROR:            "error.login.reason.network",
 LOGIN_FAILED_SERVER_ERROR:             "error.login.reason.server",
 LOGIN_FAILED_INVALID_PASSPHRASE:       "error.login.reason.recoverykey",
 LOGIN_FAILED_LOGIN_REJECTED:           "error.login.reason.account",
 
 // sync failure status codes
 METARECORD_DOWNLOAD_FAIL:              "error.sync.reason.metarecord_download_fail",
@@ -147,16 +150,28 @@ ENGINE_UPLOAD_FAIL:                    "
 ENGINE_DOWNLOAD_FAIL:                  "error.engine.reason.record_download_fail",
 ENGINE_UNKNOWN_FAIL:                   "error.engine.reason.unknown_fail",
 ENGINE_APPLY_FAIL:                     "error.engine.reason.apply_fail",
 ENGINE_METARECORD_DOWNLOAD_FAIL:       "error.engine.reason.metarecord_download_fail",
 ENGINE_METARECORD_UPLOAD_FAIL:         "error.engine.reason.metarecord_upload_fail",
 // an upload failure where the batch was interrupted with a 412
 ENGINE_BATCH_INTERRUPTED:              "error.engine.reason.batch_interrupted",
 
+JPAKE_ERROR_CHANNEL:                   "jpake.error.channel",
+JPAKE_ERROR_NETWORK:                   "jpake.error.network",
+JPAKE_ERROR_SERVER:                    "jpake.error.server",
+JPAKE_ERROR_TIMEOUT:                   "jpake.error.timeout",
+JPAKE_ERROR_INTERNAL:                  "jpake.error.internal",
+JPAKE_ERROR_INVALID:                   "jpake.error.invalid",
+JPAKE_ERROR_NODATA:                    "jpake.error.nodata",
+JPAKE_ERROR_KEYMISMATCH:               "jpake.error.keymismatch",
+JPAKE_ERROR_WRONGMESSAGE:              "jpake.error.wrongmessage",
+JPAKE_ERROR_USERABORT:                 "jpake.error.userabort",
+JPAKE_ERROR_DELAYUNSUPPORTED:          "jpake.error.delayunsupported",
+
 // info types for Service.getStorageInfo
 INFO_COLLECTIONS:                      "collections",
 INFO_COLLECTION_USAGE:                 "collection_usage",
 INFO_COLLECTION_COUNTS:                "collection_counts",
 INFO_QUOTA:                            "quota",
 
 // Ways that a sync can be disabled (messages only to be printed in debug log)
 kSyncMasterPasswordLocked:             "User elected to leave Master Password locked",
--- a/services/sync/modules/engines.js
+++ b/services/sync/modules/engines.js
@@ -14,16 +14,17 @@ this.EXPORTED_SYMBOLS = [
 var {classes: Cc, interfaces: Ci, results: Cr, utils: Cu} = Components;
 
 Cu.import("resource://services-common/async.js");
 Cu.import("resource://gre/modules/JSONFile.jsm");
 Cu.import("resource://gre/modules/Log.jsm");
 Cu.import("resource://gre/modules/osfile.jsm");
 Cu.import("resource://services-common/observers.js");
 Cu.import("resource://services-sync/constants.js");
+Cu.import("resource://services-sync/identity.js");
 Cu.import("resource://services-sync/record.js");
 Cu.import("resource://services-sync/resource.js");
 Cu.import("resource://services-sync/util.js");
 
 XPCOMUtils.defineLazyModuleGetter(this, "fxAccounts",
   "resource://gre/modules/FxAccounts.jsm");
 
 /*
new file mode 100644
--- /dev/null
+++ b/services/sync/modules/identity.js
@@ -0,0 +1,604 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+this.EXPORTED_SYMBOLS = ["IdentityManager"];
+
+var {classes: Cc, interfaces: Ci, utils: Cu, results: Cr} = Components;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/Promise.jsm");
+Cu.import("resource://services-sync/constants.js");
+Cu.import("resource://gre/modules/Log.jsm");
+Cu.import("resource://services-sync/util.js");
+Cu.import("resource://services-common/async.js");
+
+// Lazy import to prevent unnecessary load on startup.
+for (let symbol of ["BulkKeyBundle", "SyncKeyBundle"]) {
+  XPCOMUtils.defineLazyModuleGetter(this, symbol,
+                                    "resource://services-sync/keys.js",
+                                    symbol);
+}
+
+/**
+ * Manages "legacy" identity and authentication for Sync.
+ * See browserid_identity for the Firefox Accounts based identity manager.
+ *
+ * The following entities are managed:
+ *
+ *   account - The main Sync/services account. This is typically an email
+ *     address.
+ *   username - A normalized version of your account. This is what's
+ *     transmitted to the server.
+ *   basic password - UTF-8 password used for authenticating when using HTTP
+ *     basic authentication.
+ *   sync key - The main encryption key used by Sync.
+ *   sync key bundle - A representation of your sync key.
+ *
+ * When changes are made to entities that are stored in the password manager
+ * (basic password, sync key), those changes are merely staged. To commit them
+ * to the password manager, you'll need to call persistCredentials().
+ *
+ * This type also manages authenticating Sync's network requests. Sync's
+ * network code calls into getRESTRequestAuthenticator and
+ * getResourceAuthenticator (depending on the network layer being used). Each
+ * returns a function which can be used to add authentication information to an
+ * outgoing request.
+ *
+ * In theory, this type supports arbitrary identity and authentication
+ * mechanisms. You can add support for them by monkeypatching the global
+ * instance of this type. Specifically, you'll need to redefine the
+ * aforementioned network code functions to do whatever your authentication
+ * mechanism needs them to do. In addition, you may wish to install custom
+ * functions to support your API. Although, that is certainly not required.
+ * If you do monkeypatch, please be advised that Sync expects the core
+ * attributes to have values. You will need to carry at least account and
+ * username forward. If you do not wish to support one of the built-in
+ * authentication mechanisms, you'll probably want to redefine currentAuthState
+ * and any other function that involves the built-in functionality.
+ */
+this.IdentityManager = function IdentityManager() {
+  this._log = Log.repository.getLogger("Sync.Identity");
+  this._log.Level = Log.Level[Svc.Prefs.get("log.logger.identity")];
+
+  this._basicPassword = null;
+  this._basicPasswordAllowLookup = true;
+  this._basicPasswordUpdated = false;
+  this._syncKey = null;
+  this._syncKeyAllowLookup = true;
+  this._syncKeySet = false;
+  this._syncKeyBundle = null;
+}
+IdentityManager.prototype = {
+  _log: null,
+
+  _basicPassword: null,
+  _basicPasswordAllowLookup: true,
+  _basicPasswordUpdated: false,
+
+  _syncKey: null,
+  _syncKeyAllowLookup: true,
+  _syncKeySet: false,
+
+  _syncKeyBundle: null,
+
+  /**
+   * Initialize the identity provider.
+   */
+  initialize() {
+    // Nothing to do for this identity provider.
+  },
+
+  finalize() {
+    // Nothing to do for this identity provider.
+  },
+
+  /**
+   * Called whenever Service.logout() is called.
+   */
+  logout() {
+    // nothing to do for this identity provider.
+  },
+
+  /**
+   * Ensure the user is logged in.  Returns a promise that resolves when
+   * the user is logged in, or is rejected if the login attempt has failed.
+   */
+  ensureLoggedIn() {
+    // nothing to do for this identity provider
+    return Promise.resolve();
+  },
+
+  get account() {
+    return Svc.Prefs.get("account", this.username);
+  },
+
+  /**
+   * Sets the active account name.
+   *
+   * This should almost always be called in favor of setting username, as
+   * username is derived from account.
+   *
+   * Changing the account name has the side-effect of wiping out stored
+   * credentials. Keep in mind that persistCredentials() will need to be called
+   * to flush the changes to disk.
+   *
+   * Set this value to null to clear out identity information.
+   */
+  set account(value) {
+    if (value) {
+      value = value.toLowerCase();
+      Svc.Prefs.set("account", value);
+    } else {
+      Svc.Prefs.reset("account");
+    }
+
+    this.username = this.usernameFromAccount(value);
+  },
+
+  get username() {
+    return Svc.Prefs.get("username", null);
+  },
+
+  /**
+   * Set the username value.
+   *
+   * Changing the username has the side-effect of wiping credentials.
+   */
+  set username(value) {
+    if (value) {
+      value = value.toLowerCase();
+
+      if (value == this.username) {
+        return;
+      }
+
+      Svc.Prefs.set("username", value);
+    } else {
+      Svc.Prefs.reset("username");
+    }
+
+    // If we change the username, we interpret this as a major change event
+    // and wipe out the credentials.
+    this._log.info("Username changed. Removing stored credentials.");
+    this.resetCredentials();
+  },
+
+  /**
+   * Resets/Drops all credentials we hold for the current user.
+   */
+  resetCredentials() {
+    this.basicPassword = null;
+    this.resetSyncKey();
+  },
+
+  /**
+   * Resets/Drops the sync key we hold for the current user.
+   */
+  resetSyncKey() {
+    this.syncKey = null;
+    // syncKeyBundle cleared as a result of setting syncKey.
+  },
+
+  /**
+   * Obtains the HTTP Basic auth password.
+   *
+   * Returns a string if set or null if it is not set.
+   */
+  get basicPassword() {
+    if (this._basicPasswordAllowLookup) {
+      // We need a username to find the credentials.
+      let username = this.username;
+      if (!username) {
+        return null;
+      }
+
+      for (let login of this._getLogins(PWDMGR_PASSWORD_REALM)) {
+        if (login.username.toLowerCase() == username) {
+          // It should already be UTF-8 encoded, but we don't take any chances.
+          this._basicPassword = Utils.encodeUTF8(login.password);
+        }
+      }
+
+      this._basicPasswordAllowLookup = false;
+    }
+
+    return this._basicPassword;
+  },
+
+  /**
+   * Set the HTTP basic password to use.
+   *
+   * Changes will not persist unless persistSyncCredentials() is called.
+   */
+  set basicPassword(value) {
+    // Wiping out value.
+    if (!value) {
+      this._log.info("Basic password has no value. Removing.");
+      this._basicPassword = null;
+      this._basicPasswordUpdated = true;
+      this._basicPasswordAllowLookup = false;
+      return;
+    }
+
+    let username = this.username;
+    if (!username) {
+      throw new Error("basicPassword cannot be set before username.");
+    }
+
+    this._log.info("Basic password being updated.");
+    this._basicPassword = Utils.encodeUTF8(value);
+    this._basicPasswordUpdated = true;
+  },
+
+  /**
+   * Obtain the Sync Key.
+   *
+   * This returns a 26 character "friendly" Base32 encoded string on success or
+   * null if no Sync Key could be found.
+   *
+   * If the Sync Key hasn't been set in this session, this will look in the
+   * password manager for the sync key.
+   */
+  get syncKey() {
+    if (this._syncKeyAllowLookup) {
+      let username = this.username;
+      if (!username) {
+        return null;
+      }
+
+      for (let login of this._getLogins(PWDMGR_PASSPHRASE_REALM)) {
+        if (login.username.toLowerCase() == username) {
+          this._syncKey = login.password;
+        }
+      }
+
+      this._syncKeyAllowLookup = false;
+    }
+
+    return this._syncKey;
+  },
+
+  /**
+   * Set the active Sync Key.
+   *
+   * If being set to null, the Sync Key and its derived SyncKeyBundle are
+   * removed. However, the Sync Key won't be deleted from the password manager
+   * until persistSyncCredentials() is called.
+   *
+   * If a value is provided, it should be a 26 or 32 character "friendly"
+   * Base32 string for which Utils.isPassphrase() returns true.
+   *
+   * A side-effect of setting the Sync Key is that a SyncKeyBundle is
+   * generated. For historical reasons, this will silently error out if the
+   * value is not a proper Sync Key (!Utils.isPassphrase()). This should be
+   * fixed in the future (once service.js is more sane) to throw if the passed
+   * value is not valid.
+   */
+  set syncKey(value) {
+    if (!value) {
+      this._log.info("Sync Key has no value. Deleting.");
+      this._syncKey = null;
+      this._syncKeyBundle = null;
+      this._syncKeyUpdated = true;
+      return;
+    }
+
+    if (!this.username) {
+      throw new Error("syncKey cannot be set before username.");
+    }
+
+    this._log.info("Sync Key being updated.");
+    this._syncKey = value;
+
+    // Clear any cached Sync Key Bundle and regenerate it.
+    this._syncKeyBundle = null;
+
+    this._syncKeyUpdated = true;
+  },
+
+  /**
+   * Obtain the active SyncKeyBundle.
+   *
+   * This returns a SyncKeyBundle representing a key pair derived from the
+   * Sync Key on success. If no Sync Key is present or if the Sync Key is not
+   * valid, this returns null.
+   *
+   * The SyncKeyBundle should be treated as immutable.
+   */
+  get syncKeyBundle() {
+    // We can't obtain a bundle without a username set.
+    if (!this.username) {
+      this._log.warn("Attempted to obtain Sync Key Bundle with no username set!");
+      return null;
+    }
+
+    if (!this.syncKey) {
+      this._log.warn("Attempted to obtain Sync Key Bundle with no Sync Key " +
+                     "set!");
+      return null;
+    }
+
+    if (!this._syncKeyBundle) {
+      try {
+        this._syncKeyBundle = new SyncKeyBundle(this.username, this.syncKey);
+      } catch (ex) {
+        this._log.warn("Failed to create sync bundle", ex);
+        return null;
+      }
+    }
+
+    return this._syncKeyBundle;
+  },
+
+  /**
+   * The current state of the auth credentials.
+   *
+   * This essentially validates that enough credentials are available to use
+   * Sync.
+   */
+  get currentAuthState() {
+    if (!this.username) {
+      return LOGIN_FAILED_NO_USERNAME;
+    }
+
+    if (Utils.mpLocked()) {
+      return STATUS_OK;
+    }
+
+    if (!this.basicPassword) {
+      return LOGIN_FAILED_NO_PASSWORD;
+    }
+
+    if (!this.syncKey) {
+      return LOGIN_FAILED_NO_PASSPHRASE;
+    }
+
+    // If we have a Sync Key but no bundle, bundle creation failed, which
+    // implies a bad Sync Key.
+    if (!this.syncKeyBundle) {
+      return LOGIN_FAILED_INVALID_PASSPHRASE;
+    }
+
+    return STATUS_OK;
+  },
+
+  /**
+   * Verify the current auth state, unlocking the master-password if necessary.
+   *
+   * Returns a promise that resolves with the current auth state after
+   * attempting to unlock.
+   */
+  unlockAndVerifyAuthState() {
+    // Try to fetch the passphrase - this will prompt for MP unlock as a
+    // side-effect...
+    try {
+      this.syncKey;
+    } catch (ex) {
+      this._log.debug("Fetching passphrase threw " + ex +
+                      "; assuming master password locked.");
+      return Promise.resolve(MASTER_PASSWORD_LOCKED);
+    }
+    return Promise.resolve(STATUS_OK);
+  },
+
+  /**
+   * Persist credentials to password store.
+   *
+   * When credentials are updated, they are changed in memory only. This will
+   * need to be called to save them to the underlying password store.
+   *
+   * If the password store is locked (e.g. if the master password hasn't been
+   * entered), this could throw an exception.
+   */
+  persistCredentials: function persistCredentials(force) {
+    if (this._basicPasswordUpdated || force) {
+      if (this._basicPassword) {
+        this._setLogin(PWDMGR_PASSWORD_REALM, this.username,
+                       this._basicPassword);
+      } else {
+        for (let login of this._getLogins(PWDMGR_PASSWORD_REALM)) {
+          Services.logins.removeLogin(login);
+        }
+      }
+
+      this._basicPasswordUpdated = false;
+    }
+
+    if (this._syncKeyUpdated || force) {
+      if (this._syncKey) {
+        this._setLogin(PWDMGR_PASSPHRASE_REALM, this.username, this._syncKey);
+      } else {
+        for (let login of this._getLogins(PWDMGR_PASSPHRASE_REALM)) {
+          Services.logins.removeLogin(login);
+        }
+      }
+
+      this._syncKeyUpdated = false;
+    }
+
+  },
+
+  /**
+   * Deletes the Sync Key from the system.
+   */
+  deleteSyncKey: function deleteSyncKey() {
+    this.syncKey = null;
+    this.persistCredentials();
+  },
+
+  hasBasicCredentials: function hasBasicCredentials() {
+    // Because JavaScript.
+    return this.username && this.basicPassword && true;
+  },
+
+  /**
+   * Pre-fetches any information that might help with migration away from this
+   * identity.  Called after every sync and is really just an optimization that
+   * allows us to avoid a network request for when we actually need the
+   * migration info.
+   */
+  prefetchMigrationSentinel(service) {
+    // Try and fetch the migration sentinel - it will end up in the recordManager
+    // cache.
+    try {
+      service.recordManager.get(service.storageURL + "meta/fxa_credentials");
+    } catch (ex) {
+      if (Async.isShutdownException(ex)) {
+        throw ex;
+      }
+      this._log.warn("Failed to pre-fetch the migration sentinel", ex);
+    }
+  },
+
+  /**
+   * Obtains the array of basic logins from nsiPasswordManager.
+   */
+  _getLogins: function _getLogins(realm) {
+    return Services.logins.findLogins({}, PWDMGR_HOST, null, realm);
+  },
+
+  /**
+   * Set a login in the password manager.
+   *
+   * This has the side-effect of deleting any other logins for the specified
+   * realm.
+   */
+  _setLogin: function _setLogin(realm, username, password) {
+    let exists = false;
+    for (let login of this._getLogins(realm)) {
+      if (login.username == username && login.password == password) {
+        exists = true;
+      } else {
+        this._log.debug("Pruning old login for " + username + " from " + realm);
+        Services.logins.removeLogin(login);
+      }
+    }
+
+    if (exists) {
+      return;
+    }
+
+    this._log.debug("Updating saved password for " + username + " in " +
+                    realm);
+
+    let loginInfo = new Components.Constructor(
+      "@mozilla.org/login-manager/loginInfo;1", Ci.nsILoginInfo, "init");
+    let login = new loginInfo(PWDMGR_HOST, null, realm, username,
+                                password, "", "");
+    Services.logins.addLogin(login);
+  },
+
+  /**
+    * Return credentials hosts for this identity only.
+    */
+  _getSyncCredentialsHosts() {
+    return Utils.getSyncCredentialsHostsLegacy();
+  },
+
+  /**
+   * Deletes Sync credentials from the password manager.
+   */
+  deleteSyncCredentials: function deleteSyncCredentials() {
+    for (let host of this._getSyncCredentialsHosts()) {
+      let logins = Services.logins.findLogins({}, host, "", "");
+      for (let login of logins) {
+        Services.logins.removeLogin(login);
+      }
+    }
+
+    // Wait until after store is updated in case it fails.
+    this._basicPassword = null;
+    this._basicPasswordAllowLookup = true;
+    this._basicPasswordUpdated = false;
+
+    this._syncKey = null;
+    // this._syncKeyBundle is nullified as part of _syncKey setter.
+    this._syncKeyAllowLookup = true;
+    this._syncKeyUpdated = false;
+  },
+
+  usernameFromAccount: function usernameFromAccount(value) {
+    // If we encounter characters not allowed by the API (as found for
+    // instance in an email address), hash the value.
+    if (value && value.match(/[^A-Z0-9._-]/i)) {
+      return Utils.sha1Base32(value.toLowerCase()).toLowerCase();
+    }
+
+    return value ? value.toLowerCase() : value;
+  },
+
+  /**
+   * Obtain a function to be used for adding auth to Resource HTTP requests.
+   */
+  getResourceAuthenticator: function getResourceAuthenticator() {
+    if (this.hasBasicCredentials()) {
+      return this._onResourceRequestBasic.bind(this);
+    }
+
+    return null;
+  },
+
+  /**
+   * Helper method to return an authenticator for basic Resource requests.
+   */
+  getBasicResourceAuthenticator:
+    function getBasicResourceAuthenticator(username, password) {
+
+    return function basicAuthenticator(resource) {
+      let value = "Basic " + btoa(username + ":" + password);
+      return {headers: {authorization: value}};
+    };
+  },
+
+  _onResourceRequestBasic: function _onResourceRequestBasic(resource) {
+    let value = "Basic " + btoa(this.username + ":" + this.basicPassword);
+    return {headers: {authorization: value}};
+  },
+
+  _onResourceRequestMAC: function _onResourceRequestMAC(resource, method) {
+    // TODO Get identifier and key from somewhere.
+    let identifier;
+    let key;
+    let result = Utils.computeHTTPMACSHA1(identifier, key, method, resource.uri);
+
+    return {headers: {authorization: result.header}};
+  },
+
+  /**
+   * Obtain a function to be used for adding auth to RESTRequest instances.
+   */
+  getRESTRequestAuthenticator: function getRESTRequestAuthenticator() {
+    if (this.hasBasicCredentials()) {
+      return this.onRESTRequestBasic.bind(this);
+    }
+
+    return null;
+  },
+
+  onRESTRequestBasic: function onRESTRequestBasic(request) {
+    let up = this.username + ":" + this.basicPassword;
+    request.setHeader("authorization", "Basic " + btoa(up));
+  },
+
+  createClusterManager(service) {
+    Cu.import("resource://services-sync/stages/cluster.js");
+    return new ClusterManager(service);
+  },
+
+  offerSyncOptions() {
+    // Do nothing for Sync 1.1.
+    return {accepted: true};
+  },
+
+  // Tell Sync what the login status should be if it saw a 401 fetching
+  // info/collections as part of login verification (typically immediately
+  // after login.)
+  // In our case it means an authoritative "password is incorrect".
+  loginStatusFromVerification404() {
+    return LOGIN_FAILED_LOGIN_REJECTED;
+  }
+
+};
new file mode 100644
--- /dev/null
+++ b/services/sync/modules/jpakeclient.js
@@ -0,0 +1,773 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+this.EXPORTED_SYMBOLS = ["JPAKEClient", "SendCredentialsController"];
+
+var {classes: Cc, interfaces: Ci, results: Cr, utils: Cu} = Components;
+
+Cu.import("resource://gre/modules/Log.jsm");
+Cu.import("resource://services-common/rest.js");
+Cu.import("resource://services-sync/constants.js");
+Cu.import("resource://services-sync/util.js");
+
+const REQUEST_TIMEOUT         = 60; // 1 minute
+const KEYEXCHANGE_VERSION     = 3;
+
+const JPAKE_SIGNERID_SENDER   = "sender";
+const JPAKE_SIGNERID_RECEIVER = "receiver";
+const JPAKE_LENGTH_SECRET     = 8;
+const JPAKE_LENGTH_CLIENTID   = 256;
+const JPAKE_VERIFY_VALUE      = "0123456789ABCDEF";
+
+
+/**
+ * Client to exchange encrypted data using the