fedipod-server 0.28.0 → 0.29.0

package/run-agent.mjs

@@ -53,6 +53,7 @@ import { exposureProblem, hostLabel } from './lib/shared/guard.mjs';
 import { pendingSteps } from './lib/device/migrate.mjs';
 import { apUrls, assertionKeyId , publicHandle } from './lib/core/wire.mjs';
 import { followActor, unfollowActor, resolveHandle } from './lib/core/social.mjs';
+import * as podInbox from './lib/pod/inbox.mjs';
 
 export class Agent {
   constructor({ home, log }) {
@@ -510,6 +511,19 @@ export class Agent {
     return true;
   }
 
+  // The inbox's door must be open to the world (or to the gateway alone, in
+  // locked mode) or nothing anyone sends ever lands. The permission is written
+  // at setup, and a container made again later — a root move, a pod rebuilt —
+  // came back without it: the group's inbox on fp2 refused every delivery for
+  // nine days while its agent ran on, healthy-looking. One write per start,
+  // and it is idempotent.
+  async ensureInboxOpen() {
+    const g = this.store.getConfig()?.gateway;
+    const posture = g?.mode === 'locked' && g.webId ? { gatewayWebId: g.webId } : 'open';
+    await podInbox.setPosture(this.remote, this.urls, posture);
+    return posture;
+  }
+
   // Read-only mode: refresh the state cache periodically, and take over the
   // moment the active agent's lease frees.
   startViewer() {
@@ -538,6 +552,8 @@ export class Agent {
     // Own posts the outbox names and the timeline index lacks come back here,
     // before anything acts on the index.
     await this.publisher.healStatuses().catch(e => this.log(`healing the timeline index: ${e.message}`));
+    // Likes made before the liked list existed become its first entries.
+    try { this.publisher.backfillLiked(); } catch (e) { this.log(`liked list: ${e.message}`); }
     this.lease.onLost = () => this.demote();
     this.lease.startRenewal();
     this.deliverer.startQueue();
@@ -607,6 +623,8 @@ export class Agent {
         .catch(e => this.log(`actor check failed: ${e.message}`));
       this.ensureFeaturedPublished()
         .catch(e => this.log(`featured check failed: ${e.message}`));
+      this.ensureInboxOpen()
+        .catch(e => this.log(`inbox door check failed: ${e.message}`));
       // The human page, rewritten only when what it shows has changed: one
       // local digest compare, and a write the first time after an upgrade.
       this.publisher.publishProfilePage()

package/web/admin/actors.js

@@ -136,6 +136,8 @@ $('new-actor-form').addEventListener('submit', async (ev) => {
   };
   if (answers.mode === 'new') answers.podName = $('new-podname').value.trim() || handle;
   else answers.pod = $('new-pod').value.trim();
+  answers.container = $('new-container').value.trim();
+  answers.createIndex = $('new-createIndex').checked;
   $('new-actor-go').disabled = true;
   say(`setting up ${handle || 'the new actor'} — this takes a while`);
   const r = await write('/new-actor', answers, `setting up ${handle}`);

package/web/admin/index.html

@@ -272,6 +272,15 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
         <label for="new-pod">Pod address</label>
         <input type="url" id="new-pod" autocomplete="url" placeholder="https://you.solidcommunity.net/">
       </div>
+      <label for="new-container">Store your data in a container named fedipod, inside this container</label>
+      <input type="text" id="new-container" autocomplete="off" spellcheck="false" placeholder="/"
+        aria-describedby="new-container-hint">
+      <p class="hint" id="new-container-hint">Leave it empty for your pod's root. This is permanent.</p>
+      <p id="new-typeindex-text">FediPod records where the account lives in your pod's public type index,
+        the list Solid apps use to find your things. A new pod has none; setup stops if yours has none
+        and you have not said yes here. It will be readable by anyone, like your profile.</p>
+      <label class="choice"><input type="checkbox" id="new-createIndex" aria-describedby="new-typeindex-text">
+        If my pod has no public type index, create one</label>
     </fieldset>
 
     <p>

package/web/admin/record.js

@@ -269,6 +269,9 @@ function render() {
     ['Fediverse identity', config.address || `@${config.handle} — no resolvable address`,
       config.accountId && config.address ? { href: `/admin/client/#/a/${config.accountId}` } : null],
     ['Solid identity', config.webId, config.remotePod ? { href: config.remotePod, blank: true } : null],
+    // Where on the pod the account's data lives: the container its owner chose.
+    ['stored at', config.remotePod && config.root ? config.remotePod + config.root : null,
+      config.remotePod && config.root ? { href: config.remotePod + config.root, blank: true } : null],
     ['Other identities', 'ctl'],
     ['local store', config.home],
     // The address you actually open, not the bare number — the named origin when
@@ -362,7 +365,7 @@ function render() {
   if (!config.address) {
     const p = document.createElement('p');
     p.className = 'warn';
-    p.textContent = `${config.remotePod} is not the root of its own host, so this actor cannot be `
+    p.textContent = `${config.remotePod} is a suffixed pod, so this actor cannot be `
       + 'discovered as a handle by other servers. Posting and reading still work.';
     $('pane-identity').appendChild(p);
   }

package/web/admin/setup/index.html

@@ -151,7 +151,7 @@ button:disabled { opacity: .5; cursor: default; }
           <input type="url" id="issuerOther" name="issuerOther" autocomplete="url" placeholder="https://pods.example.org">
         </div>
         <p class="hint" id="issuer-new-hint">The Community Solid Server providers from
-          solidproject.org. A provider that puts pods on paths gives your address at a
+          solidproject.org. A provider that makes suffixed pods gives your address at a
           gateway instead.</p>
       </div>
 
@@ -184,6 +184,22 @@ button:disabled { opacity: .5; cursor: default; }
         <label for="pod">Pod address</label>
         <input type="url" id="pod" name="pod" autocomplete="url" placeholder="https://you.solidcommunity.net/">
       </div>
+
+      <div id="row-container">
+        <label for="container">Store your data in a container named fedipod, inside this container</label>
+        <input type="text" id="container" name="container" autocomplete="off" spellcheck="false"
+          placeholder="/" aria-describedby="container-hint">
+        <p class="hint" id="container-hint">Leave it empty for your pod's root. This is permanent.
+          <span id="place"></span></p>
+      </div>
+
+      <div id="row-typeindex" hidden>
+        <p id="typeindex-text">Your pod has no public type index, the list Solid apps use to find your
+          things. FediPod needs one to record where your account lives. It will be readable by anyone,
+          like your profile.</p>
+        <label class="choice"><input type="checkbox" id="createIndex" name="createIndex"
+          aria-describedby="typeindex-text"> Create a public type index on my pod</label>
+      </div>
     </fieldset>
 
     <p id="row-reenter" class="warn" hidden>Finishing a setup that already has an account credential.

package/web/admin/setup/setup.js

@@ -108,6 +108,9 @@ function answers() {
   };
   if (mode === 'new') a.podName = f.podName.value.trim() || a.handle;
   else a.pod = f.pod.value.trim();
+  // The container that holds fedipod/, and the yes to a new public type index.
+  a.container = f.container.value.trim();
+  a.createIndex = f.createIndex.checked;
   if (!state.resumable && !state.passwordSupplied) a.password = f.password.value;
   return a;
 }
@@ -116,13 +119,13 @@ function answers() {
 // account?", in the same words, as you type.
 const NOTES = {
   'pod-is-a-path': (a) =>
-    `This pod is a path on ${host(a.pod)}, not the root of its own host. WebFinger is `
-    + 'answered only at a host root, which this pod cannot write to, so other servers '
+    `This pod is suffixed (on ${host(a.pod)}), not subdomained. WebFinger is `
+    + 'answered only for a subdomained pod, so other servers '
     + 'will not find this address. Posting and reading still work; being discovered does not.',
 };
 const REFUSALS = {
   'group-needs-host-root': () =>
-    'A group needs a pod at the root of its own host, or nobody could ever find it. '
+    'A group needs a subdomained pod, or nobody could ever find it. '
     + 'Give the group a pod of its own, or set this up as a person.',
 };
 const host = (u) => { try { return new URL(u).host; } catch { return u; } };
@@ -149,6 +152,11 @@ async function preview() {
   const { json } = await postJson('/setup/check', a);
   if (!json) return;
   $('preview').textContent = json.address || '…';
+  // Where the data will go, and the type index question when the pod has
+  // none (a new pod never does).
+  $('place').textContent = json.placeProblem ? json.placeProblem : (json.place ? `Your data will be at ${json.place}.` : '');
+  $('row-typeindex').hidden = json.typeIndex === true;
+  try { $('container').placeholder = a.mode === 'existing' && a.pod ? new URL(a.pod).pathname : '/'; } catch { /* not a URL yet */ }
   // The address-shape choice: hidden for a group (a group cannot front yet),
   // locked to the gateway for a pod on a suffix-based host, an open choice
   // for a pod at its own host.
@@ -165,7 +173,7 @@ async function preview() {
     if (note) {
       note.hidden = !forced;
       note.textContent = forced
-        ? 'Your pod is on a suffix-based host, so its address lives at the gateway. Your posts, key and data stay on your pod.'
+        ? 'Your pod is suffixed, so its address lives at the gateway. Your posts, key and data stay on your pod.'
         : '';
     }
   }
@@ -188,6 +196,11 @@ async function preview() {
 async function onSubmit(ev) {
   ev.preventDefault();
   $('form-error').textContent = '';
+  // No type index and no yes: stop here, before anything is sent.
+  if (!$('row-typeindex').hidden && !$('createIndex').checked) {
+    $('form-error').textContent = 'Setup stopped. Nothing was written to your pod. FediPod needs a public type index to record where your account lives.';
+    return;
+  }
   $('submit').disabled = true;
   const { status, json } = await postJson('/setup', answers());
   if (status !== 202) {
@@ -300,7 +313,7 @@ function paneDone(result) {
   $('done-address').textContent = result?.address || `@${result?.handle} — no resolvable address`;
   const notes = [];
   if (!result?.resolvable) {
-    notes.push(`${result?.pod} is not the root of its own host, so this address cannot be `
+    notes.push(`${result?.pod} is a suffixed pod, so this address cannot be `
       + 'discovered by other servers. Posting and reading still work.');
   }
   if (result?.unreachable?.length) {

package/web/app/README.md

@@ -77,5 +77,5 @@ See the `MastoApi` options in `agent.mjs`.
 | **Web push** | `shims/web-push.mjs` is a no-op. `vapid` is omitted, and a client that subscribes anyway gets a 422 rather than a subscription nothing will push to. |
 | **Scheduled posts** | nothing runs between now and the scheduled time. A `scheduled_at` is refused with a 422 that says so — accepting one was silent loss. |
 | **Groups** | sign-up makes personal identities only (`signup.mjs`), and the moderation surface is not here. Joining a group works; hosting one needs the DeviceAgent. See `groups.md`. |
-| **Changing where the address lives** | the shape is chosen at sign-up (`signup.mjs`): on the pod, `@you@yourpod` with the gateway as a mail door, or at the gateway, `@you@front` — and a pod on a suffix-based host is always fronted. `admin-facade.mjs` refuses changing it afterwards, because a rename needs a restart a browser does not have. |
+| **Changing where the address lives** | the shape is chosen at sign-up (`signup.mjs`): on the pod, `@you@yourpod` with the gateway as a mail door, or at the gateway, `@you@front` — and a suffixed pod is always fronted. `admin-facade.mjs` refuses changing it afterwards, because a rename needs a restart a browser does not have. |
 | **Moving the private half** | `/state-move` is about filesystem paths and `credential.json`. A browser has neither; its private half is always on the pod. |

package/web/app/admin-facade.mjs

@@ -356,7 +356,7 @@ export class AdminFacade {
         const aliases = [...(cfg.aliases || [])];
         if (body.add) {
           if (!webfingerHost(urls.base) && !cfg.gateway?.frontActor) {
-            return json(400, { error: 'this pod is a suffix-based host, so other servers could never resolve it as a Move target' });
+            return json(400, { error: 'this pod is suffixed, so other servers could never resolve it as a Move target' });
           }
           const id = await this.resolveActor(body.add);
           if (!id) return json(400, { error: `could not fetch the old account (${body.add}) — enter its URL or @user@host, and it must answer` });

package/web/app/agent.mjs

@@ -6,7 +6,8 @@
 // the relay (deliver-relay). Everything between — wire, the store, the
 // publisher, intake, the Mastodon facade — is lib/, unchanged.
 import { kvGet, kvPut } from './idb-kv.mjs';
-import { apUrls } from '../../lib/core/wire.mjs';
+import { apUrls, DEFAULT_ROOT } from '../../lib/core/wire.mjs';
+import { findAccount } from '../../lib/core/place.mjs';
 import * as containers from '../../lib/pod/containers.mjs';
 import * as podState from '../../lib/pod/state.mjs';
 import { PodStore } from '../../lib/core/store.mjs';
@@ -169,15 +170,19 @@ export class BrowserAgent {
     this.lease.onLost = () => this.demote();
     this.lease.startRenewal();
     try {
-      // Forced, not revalidated. While this device watched, the ACTIVE one was
-      // writing; our cache is however stale the last viewer poll left it, and
-      // the store is write-through — so the first write from here would push a
-      // whole document back over newer state. Read what is actually there
-      // before acting on it.
-      await this.store.load({ force: true }).catch((e) => this.log(`re-reading state: ${e.message}`));
+      // Forced, not revalidated, when this device WATCHED first: the active
+      // one was writing, our cache is however stale the last viewer poll left
+      // it, and the store is write-through — so the first write from here
+      // would push a whole document back over newer state. A device that
+      // booted straight into acting read everything a moment ago; asking
+      // again is one revalidation, not a second download of every document.
+      await this.store.load({ force: !!this._watched }).catch((e) => this.log(`re-reading state: ${e.message}`));
+      this._watched = false;
       // Own posts the outbox names and the timeline index lacks come back
       // here, before anything acts on the index.
       await this.publisher.healStatuses().catch((e) => this.log(`healing the timeline index: ${e.message}`));
+      // Likes made before the liked list existed become its first entries.
+      try { this.publisher.backfillLiked(); } catch (e) { this.log(`liked list: ${e.message}`); }
       await this.publisher.publishProfilePage().catch((e) => this.log(`profile page: ${e.message}`));
       // And start delivering again, since demote() stopped it. startQueue() is
       // idempotent, so a goActive() that was already active costs nothing.
@@ -202,6 +207,7 @@ export class BrowserAgent {
   demote() {
     if (this.viewer) return;
     this.viewer = true;
+    this._watched = true;
     this.log('another device took over — read-only here');
     this.lease.stopRenewal();
     clearInterval(this._openTimer); this._openTimer = null;
@@ -286,8 +292,14 @@ export class BrowserAgent {
     // The pod session's own fetch, for the gateway APIs that take it as
     // proof of the pod (attach, move) — the transport below is for the pod.
     this.sessionFetch = session.fetch;
-    const root = (config && config.root) || 'fedipod/';
     this.remote = new BrowserRemotePod(session, { webId, log: this.log });
+    // Where the account lives: handed in on sign-up, else what its owner's type
+    // index records, else `fedipod/` for an account older than the choice.
+    const root = (config && config.root)
+      || (await findAccount(this.remote, remotePod,
+        (r) => podState.readConfig(this.remote, { state: `${remotePod}${r}ap-state/` }),
+        (c) => (c.kind || 'person') === 'person').catch(() => null))?.root
+      || DEFAULT_ROOT;
     // Pod-native for now: the state store below is read with these, and only
     // the config it holds says whether this identity is fronted.
     this.urls = apUrls(remotePod, root);
@@ -355,8 +367,9 @@ export class BrowserAgent {
     // somebody reads from counting as a quiet one. Only a closed address
     // stops the boot; a gateway that cannot be reached is no reason to
     // refuse a sign-in.
-    this.gatewayApi = null;
-    try { if (config.gateway?.url) this.gatewayApi = `${new URL(config.gateway.url).origin}/api`; } catch { this.gatewayApi = null; }
+    // At the page's own origin, as the relay is: a page on the test alias
+    // asked the real site instead and could not get past its preflight.
+    this.gatewayApi = config.gateway?.url ? `${frontOrigin.replace(/\/$/, '')}/api` : null;
     this.doorKey = doorKeyOf(config.gateway?.url) || config.handle;
     this.gatewayStanding = null;
     const standing = await this.openAtGateway();
@@ -476,6 +489,7 @@ export class BrowserAgent {
       // The lease decides: this device ACTS on the pod, or reads it read-only.
       this.viewer = !(await this.lease.acquire());
       if (this.viewer) {
+        this._watched = true;
         this.log(`read-only viewer: another device is active on @${config.handle}`);
         this.startViewerPoll();       // reload the feed, and promote if the lease frees
         return;

package/web/app/boot.mjs

@@ -14,7 +14,8 @@
 //                 fedipodMoveIn(answers) brings the address here.
 //   Returning:    fedipodSignin({ address }) — redirect to the pod's login.
 //   On every load: fedipodOnLoad() — finish a redirect, or restore, then boot.
-import { signUp, moveIn, readAccount, handleProblem, AP_ROOT } from './signup.mjs';
+import { signUp, moveIn, readAccount, handleProblem } from './signup.mjs';
+import { podRootPath, chosenRoot } from '../../lib/core/place.mjs';
 import * as podActor from '../../lib/pod/actor.mjs';
 import * as podState from '../../lib/pod/state.mjs';
 import { podBaseOfWebId } from '../../lib/pod/urls.mjs';
@@ -76,16 +77,15 @@ async function bootWorker({ reset = false } = {}) {
 async function readAccountState() {
   const session = await getSession();
   if (!session) throw new Error('Sign in first.');
-  const podFromWebId = podBaseOfWebId(session.webId);   // a suffix-based host, or its own host
-  const state = `${podFromWebId}${AP_ROOT}ap-state/`;
+  // Wherever its owner put it: the type index says, or it is an older account
+  // at `fedipod/` (signup.mjs readAccount).
+  const here = await readAccount(session);
+  if (!here) throw new Error(`could not find a FediPod account on ${podBaseOfWebId(session.webId)}`);
   const remote = new BrowserRemotePod(session, { webId: session.webId, role: 'signup', log: () => {} });
-  const urls = { state };
-  const [cfg, doc] = await Promise.all([
-    podState.readConfig(remote, urls), podState.readKeys(remote, urls),
-  ]);
-  if (!cfg) throw new Error(`could not read this account's config under ${state}`);
-  const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
-  return { remote, urls, cfg, doc, actorUrl };
+  const urls = { state: `${here.pod}${here.root}ap-state/` };
+  const doc = await podState.readKeys(remote, urls);
+  const actorUrl = `${here.config.remotePod || here.pod}${here.config.root || here.root}ap/actor`;
+  return { remote, urls, cfg: here.config, doc, actorUrl };
 }
 
 window.fedipodUnlock = async (password) => {
@@ -161,22 +161,33 @@ export function parseAddress(input) {
   if (!handle || !host || !host.includes('.')) return null;
   return { handle, host };
 }
-async function issuerForPod(pod) {
+async function issuerForActor(actorUrl) {
   // The pod's actor says where a client signs in (oauthAuthorizationEndpoint's
-  // origin); failing that, the account provider is the pod host's parent
-  // domain for a subdomain pod, and the host itself for a pod on a path.
+  // origin). Failing that: a host that answers OpenID discovery itself is the
+  // provider (a suffixed pod), and otherwise the provider is
+  // the pod host's parent domain (a subdomain pod).
   try {
-    const authz = await podActor.readIssuer(`${pod}${AP_ROOT}ap/actor`);
+    const authz = await podActor.readIssuer(actorUrl);
     if (authz) return new URL(authz).origin;
   } catch { /* fall through */ }
-  const u = new URL(pod);
-  if (u.pathname !== '/') return u.origin;
+  const u = new URL(actorUrl);
+  const own = await fetch(`${u.origin}/.well-known/openid-configuration`, { headers: { accept: 'application/json' } }).catch(() => null);
+  if (own?.ok) return u.origin;
   const parent = u.host.split('.').slice(1).join('.');
   return `https://${parent || u.host}`;
 }
+// An address on a pod names its actor through the pod host's own WebFinger;
+// an older pod that does not answer is taken to keep it at `fedipod/`.
+async function actorForPodAddress(handle, host) {
+  const res = await fetch(`https://${host}/.well-known/webfinger?resource=${encodeURIComponent(`acct:${handle}@${host}`)}`,
+    { headers: { accept: 'application/jrd+json, application/json' } }).catch(() => null);
+  const doc = res?.ok ? await res.json().catch(() => ({})) : {};
+  const self = (doc.links || []).find((l) => l.rel === 'self' && /activity\+json|ld\+json/u.test(l.type || ''));
+  return self?.href || `https://${host}/fedipod/ap/actor`;
+}
 // An address at this site names a fronted identity. Its documents live on a
 // pod this site's WebFinger names as an alias — the pod's own actor id.
-async function podForFrontedAddress(handle) {
+async function actorForFrontedAddress(handle) {
   const res = await fetch(`/.well-known/webfinger?resource=${encodeURIComponent(`acct:${handle}@${location.host}`)}`,
     { headers: { accept: 'application/jrd+json, application/json' } }).catch(() => null);
   if (res?.status === 410) throw new Error(`@${handle}@${location.host} is closed: nothing on the pod behind it was touched, but the address is gone for good.`);
@@ -184,19 +195,17 @@ async function podForFrontedAddress(handle) {
   const doc = await res.json().catch(() => ({}));
   const podActorId = (doc.aliases || []).find((a) => /\/ap\/actor$/u.test(String(a)));
   if (!podActorId) throw new Error(`@${handle}@${location.host} lives here but names no pod to sign in to`);
-  const tail = `${AP_ROOT}ap/actor`;
-  if (!podActorId.endsWith(tail)) throw new Error(`the pod actor ${podActorId} is not where a FediPod pod keeps one`);
-  return podActorId.slice(0, -tail.length);
+  return podActorId;
 }
 window.fedipodSignin = async ({ address }) => {
   const parsed = parseAddress(address);
   if (!parsed) throw new Error('Enter your address as @you@yourpod (for example @alice@alice.solidcommunity.net).');
   const bad = handleProblem(parsed.handle);
   if (bad) throw new Error(bad);
-  const pod = parsed.host === location.host.toLowerCase()
-    ? await podForFrontedAddress(parsed.handle)
-    : `https://${parsed.host}/`;
-  const issuer = await issuerForPod(pod);
+  const actor = parsed.host === location.host.toLowerCase()
+    ? await actorForFrontedAddress(parsed.handle)
+    : await actorForPodAddress(parsed.handle, parsed.host);
+  const issuer = await issuerForActor(actor);
   const { authorizationUrl } = await beginLogin({ issuer, redirectUri: REDIRECT });
   location.href = authorizationUrl;
 };
@@ -445,6 +454,10 @@ if (typeof document !== 'undefined') (async () => {
     $('loading').hidden = true; $('hero').hidden = true; $('landing').hidden = true; $('running').hidden = true;
     $('brand').hidden = false; $('pane-form').hidden = false;
     $('signed-pod').textContent = signedPod;
+    // The container that holds `fedipod/`: the pod's own root unless they say
+    // otherwise. A move keeps the place the account already has.
+    $('container').placeholder = podRootPath(signedPod);
+    $('container-field').hidden = !!moveFrom;
     $('movein-note').hidden = !moveFrom;
     if (moveFrom) {
       $('movein-from').textContent = moveFrom.address;
@@ -484,7 +497,13 @@ if (typeof document !== 'undefined') (async () => {
   const pathPod = () => { try { return new URL(signedPod).pathname !== '/'; } catch { return false; } };
   // A move between gateways is an address at a gateway: no choice either.
   const shape = () => ((pathPod() || moveFrom) ? 'front' : f().shape.value);
-  const answers = () => ({ handle: f().handle.value.trim().toLowerCase(), shape: shape() });
+  const answers = () => ({ handle: f().handle.value.trim().toLowerCase(), shape: shape(), container: f().container.value.trim() });
+  // Where the data will be, in full, as the person types.
+  const previewPlace = () => {
+    if (!signedPod) return;
+    const r = chosenRoot(signedPod, f().container.value);
+    $('place').textContent = r.problem ? '…' : signedPod + r.root;
+  };
   const previewAddr = () => {
     const handle = f().handle.value.trim().toLowerCase();
     let host = '';
@@ -507,7 +526,7 @@ if (typeof document !== 'undefined') (async () => {
     $('register-link').href = url || '#';
     $('register-link').textContent = providerHost() ? `Create your pod at ${providerHost()}` : 'Create your pod at your provider';
   };
-  for (const el of $('form').elements) for (const evt of ['input', 'change']) el.addEventListener(evt, () => { applyMode(); applyShape(); previewAddr(); });
+  for (const el of $('form').elements) for (const evt of ['input', 'change']) el.addEventListener(evt, () => { applyMode(); applyShape(); previewAddr(); previewPlace(); });
   applyMode();
 
   // Step machine: one screen at a time, each gated by its own validation.
@@ -516,7 +535,7 @@ if (typeof document !== 'undefined') (async () => {
   const goStep = (n) => {
     STEP_IDS.forEach((id, i) => { $(id).hidden = i !== n - 1; });
     $('err-1').textContent = ''; $('form-error').textContent = '';
-    if (n === 2) { applyShape(); previewAddr(); }
+    if (n === 2) { applyShape(); previewAddr(); previewPlace(); $('index-ask').hidden = true; }
     if (FOCUS[n]) $(FOCUS[n]).focus();
   };
   const validateStep1 = () => {
@@ -526,6 +545,10 @@ if (typeof document !== 'undefined') (async () => {
   const validateStep2 = () => {
     const hp = window.fedipodHandleProblem(f().handle.value.trim().toLowerCase());
     if (hp) return `Fediverse handle: ${hp}`;
+    if (!moveFrom) {
+      const where = chosenRoot(signedPod, f().container.value).problem;
+      if (where) return `Where to store it: ${where}`;
+    }
     return null;
   };
   $('create').addEventListener('click', showForm);
@@ -549,12 +572,12 @@ if (typeof document !== 'undefined') (async () => {
   $('run-retry').addEventListener('click', () => backToForm($('run-error').textContent));
   $('run-back').addEventListener('click', () => { showLanding(); goStep(1); });
 
-  const LABELS = { pod: 'Checking your pod', keys: 'Making your signing key', gateway: 'Connecting your mail door' };
+  const LABELS = { pod: 'Checking your pod', keys: 'Making your signing key', gateway: 'Connecting your mail door',
+    place: 'Recording where your account lives' };
   const MOVE_LABELS = { pod: 'Reading your account on your pod', gateway: 'Taking your address here', keys: 'Moving your key and account record' };
-  $('form').addEventListener('submit', async (e) => {
-    e.preventDefault(); $('form-error').textContent = '';
-    const e2 = validateStep2(); if (e2) { $('form-error').textContent = e2; goStep(2); return; }
-    const a = answers();
+  // Run the setup. `createIndex` is the person's yes to a new public type index.
+  const run = async (createIndex = false) => {
+    const a = { ...answers(), ...(createIndex ? { createIndex: true } : {}) };
     $('pane-form').hidden = true; $('running').hidden = false;
     $('running-title').textContent = 'Setting up…'; $('run-error').textContent = ''; $('run-actions').hidden = true;
     const steps = $('steps'); steps.textContent = ''; const mark = {};
@@ -566,10 +589,27 @@ if (typeof document !== 'undefined') (async () => {
       location.href = '/admin/client/';
     }
     catch (err) {
+      // No type index: nothing has been written. Ask, on the form.
+      if (err?.code === 'needs-index') {
+        backToForm();
+        $('index-ask').hidden = false;
+        $('index-yes').focus();
+        return;
+      }
       $('running-title').textContent = 'Setup did not finish';
       $('run-error').textContent = err.message || String(err);
       $('run-actions').hidden = false;                // the way out of the failure screen
     }
+  };
+  $('form').addEventListener('submit', async (e) => {
+    e.preventDefault(); $('form-error').textContent = '';
+    const e2 = validateStep2(); if (e2) { $('form-error').textContent = e2; goStep(2); return; }
+    await run();
+  });
+  $('index-yes').addEventListener('click', () => { $('index-ask').hidden = true; run(true); });
+  $('index-no').addEventListener('click', () => {
+    $('index-ask').hidden = true;
+    $('form-error').textContent = 'Sign-up stopped. Nothing was written to your pod.';
   });
 
   if (pendingIdentity) await showIdentity();

package/web/app/deliver-relay.mjs

@@ -10,6 +10,9 @@
 import { Deliverer } from '../../lib/core/deliver.mjs';
 import { sign } from './shims/fedify-sig.mjs';
 
+// What one relay call may carry (lib/gateway/front-core.mjs RELAY_MAX_REQUESTS).
+const RELAY_MAX_REQUESTS = 20;
+
 /**
  * The name the front keys this account's row by, read off its door inbox:
  * `<front>/u/<key>/ap/inbox/`. A mail-door account is keyed by its full
@@ -30,6 +33,7 @@ export class RelayDeliverer extends Deliverer {
     this.relayUrl = opts.relayUrl;       // <front>/api/relay
     this.handle = opts.handle;
     this.sessionFetch = opts.sessionFetch;   // the DPoP session's fetch, to authenticate to the relay
+    this.batchSize = RELAY_MAX_REQUESTS;
   }
 
   // Same contract as Deliverer.signedFetch, DEFAULT INCLUDED: an init with no
@@ -40,32 +44,68 @@ export class RelayDeliverer extends Deliverer {
   // never saw the document it asked for: a Follow from anyone new was rejected
   // with "actor fetch failed", and nothing needing a lookup could be ingested.
   async signedFetch(url, init = {}) {
+    const req = await this._signedRequest(url, init);
+    const [r0] = await this._relay([req]);
+    return this._outcome(r0, url, init.method || 'GET');
+  }
+
+  // A fan-out in one call: the relay takes a list, so a post to twenty
+  // followers is one call, not twenty (Deliverer.deliverToAll, batchSize).
+  async deliverManyNow(targets) {
+    const reqs = await Promise.all(targets.map((t) => this._signedRequest(t.inbox, {
+      method: 'POST', headers: { 'content-type': 'application/activity+json' }, body: JSON.stringify(t.activity),
+    })));
+    let results;
+    try { results = await this._relay(reqs); } catch (error) { return targets.map(() => ({ error })); }
+    return targets.map((t, i) => {
+      try { this._outcome(results[i] || {}, t.inbox, 'POST'); return { ok: true }; }
+      catch (error) { return { error }; }
+    });
+  }
+
+  // Signed here, sent verbatim by the relay. Every signed header goes along,
+  // `accept` included: the signature covers it, so a relay request missing it
+  // carries an invalid signature — and a read without it gets the HTML page
+  // instead of the document.
+  async _signedRequest(url, init = {}) {
     const body = typeof init.body === 'string' ? init.body : (init.body ? new TextDecoder().decode(init.body) : '');
     const s = await sign({ url, method: init.method || 'GET', headers: init.headers || {}, body }, this.rsaPrivate, this.keyId);
-    // Every signed header goes to the relay, `accept` included: the signature
-    // covers it, so a relay request missing it carries an invalid signature —
-    // and a read without it gets the HTML page instead of the document.
-    const relayReq = {
+    return {
       url: s.url, method: s.method, body,
       headers: {
         date: s.headers.date, digest: s.headers.digest, accept: s.headers.accept,
         'content-type': s.headers['content-type'], signature: s.headers.signature,
       },
     };
+  }
+
+  // One relay call for a list of requests; the results in the same order.
+  // The relay's OWN answer, apart from the recipients': unreachable and a
+  // refusal are hiccups the queue retries. Its 404 is not — it says this
+  // account has no row here, and no retry changes that. It used to be read as
+  // a hiccup too, and a tab whose account the site did not know retried its
+  // deliveries every minute for three days.
+  async _relay(requests) {
     let res;
     try {
       res = await this.sessionFetch(this.relayUrl, {
         method: 'POST', headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ handle: this.handle, requests: [relayReq] }),
+        body: JSON.stringify({ handle: this.handle, requests }),
       });
     } catch (e) { const err = new Error(`relay unreachable: ${e.message}`); err.status = 0; throw err; }
+    if (res.status === 404) { const err = new Error('relay: no such account here'); err.status = 404; throw err; }
     if (res.status >= 400) { const err = new Error(`relay ${res.status}`); err.status = 502; throw err; }
     const out = await res.json().catch(() => ({}));
-    const r0 = (out.results && out.results[0]) || {};
+    return Array.isArray(out.results) ? out.results : [];
+  }
+
+  // What the far server answered, as the Node deliverer would have seen it:
+  // a Response for a read, a thrown error carrying the status for a refusal.
+  _outcome(r0, url, method) {
     const status = r0.status || 0;
     if (status === 0) { const err = new Error(r0.error || 'relay could not send'); err.status = 502; throw err; }
     if (status >= 400) {
-      const err = new Error(`${init.method || 'POST'} ${url} → ${status}`); err.status = status;
+      const err = new Error(`${method} ${url} → ${status}`); err.status = status;
       // The receiving server's own answer to "when should I try again", carried
       // through the relay (lib/front-core.mjs). Spelled `retryAfterMs`, which is
       // what the delivery queue reads (lib/deliver.mjs) — the queue's ladder is