fedipod 1.36.6 → 1.40.0

package/lib/pod/type-index.mjs

@@ -0,0 +1,101 @@
+// type-index.mjs — an account's place, recorded in the person's public type
+// index: the list Solid apps read to find what kind of thing lives where.
+//
+// The record is a registration saying there is an instance of `as:Actor` at the
+// account's actor on the pod:
+//
+//   <#actor-…> a solid:TypeRegistration;
+//     solid:forClass as:Actor;
+//     solid:instance <…/ap/actor>.
+//
+// The instance is the actor at the pod, not a gateway's address for it, so the
+// place can be read off it. It is also how the account is found again.
+//
+// Every write goes through the transport's checked writers: valid RDF, to the
+// profile or a document its seeAlso names, or nothing.
+
+const SOLID = 'http://www.w3.org/ns/solid/terms#';
+const RDF_TYPE = 'http://www.w3.org/1999/02/22-rdf-syntax-ns#type';
+const AS_ACTOR = 'https://www.w3.org/ns/activitystreams#Actor';
+const PUBLIC_READ = ['Read'];
+
+/** Where a new public type index goes when a person has none. */
+export const newIndexUrl = (podBase) => `${podBase}settings/publicTypeIndex.ttl`;
+
+/** The person's public type index, or null when their profile names none. */
+export async function findPublicIndex(pod, podBase) {
+  const docs = await pod.profileDocs(podBase);
+  return pod.webIdValues(docs, SOLID + 'publicTypeIndex')[0] || null;
+}
+
+/** Every actor the index registers, as the instances it names. */
+export async function actorsIn(pod, indexUrl) {
+  const g = await pod.readRdf(indexUrl).catch(() => null);
+  if (!g) return [];
+  const out = [];
+  for (const reg of g.each(null, pod.sym(SOLID + 'forClass'), pod.sym(AS_ACTOR))) {
+    for (const inst of g.each(reg, pod.sym(SOLID + 'instance'), null)) out.push(inst.value);
+  }
+  return [...new Set(out)];
+}
+
+// One registration per actor, named by the actor, so registering again finds
+// the same one.
+function regFor(indexUrl, actorUrl) {
+  let h = 0;
+  for (const c of actorUrl) h = (h * 31 + c.charCodeAt(0)) >>> 0;
+  return `${indexUrl}#actor-${h.toString(36)}`;
+}
+
+/** Add the account's registration, unless the index already has one for it. */
+export async function register(pod, indexUrl, actorUrl) {
+  const g = await pod.readRdf(indexUrl);
+  if (!g) throw new Error(`no type index at ${indexUrl}`);
+  if ((await actorsIn(pod, indexUrl)).includes(actorUrl)) return false;
+  const reg = pod.sym(regFor(indexUrl, actorUrl));
+  const status = await pod.writeRdfChecked(indexUrl, g, {
+    inserts: [
+      [reg, pod.sym(RDF_TYPE), pod.sym(SOLID + 'TypeRegistration')],
+      [reg, pod.sym(SOLID + 'forClass'), pod.sym(AS_ACTOR)],
+      [reg, pod.sym(SOLID + 'instance'), pod.sym(actorUrl)],
+    ],
+    mustDescribe: indexUrl,
+  });
+  if (status >= 300) throw new Error(`the type index at ${indexUrl} did not take the registration (${status})`);
+  return true;
+}
+
+/**
+ * Make a public type index and name it from the profile. Only ever called
+ * after the person has said yes. An index already at the usual place is kept,
+ * not overwritten; it is only named.
+ */
+export async function createPublicIndex(pod, podBase) {
+  const url = newIndexUrl(podBase);
+  const doc = pod.sym(url);
+  const existing = await pod.readRdf(url).catch(() => null);
+  if (!existing) {
+    const status = await pod.writeRdfChecked(url, null, {
+      inserts: [[doc, pod.sym(RDF_TYPE), pod.sym(SOLID + 'TypeIndex')],
+        [doc, pod.sym(RDF_TYPE), pod.sym(SOLID + 'ListedDocument')]],
+      mustDescribe: url,
+    });
+    if (status >= 300) throw new Error(`could not make a type index at ${url} (${status})`);
+  }
+  // Public, as the profile is: an app finds your things by reading it.
+  await pod.setAcl(url, PUBLIC_READ);
+  await pod.writeAboutWebId(podBase, {
+    inserts: [[pod.sym(pod.webId), pod.sym(SOLID + 'publicTypeIndex'), doc]],
+  });
+  return url;
+}
+
+/**
+ * The actors this person's index says live in this pod. Empty when there is no
+ * index or nothing registered.
+ */
+export async function registeredActors(pod, podBase) {
+  const index = await findPublicIndex(pod, podBase).catch(() => null);
+  if (!index) return [];
+  return (await actorsIn(pod, index)).filter(a => a.startsWith(podBase) && a.endsWith('ap/actor'));
+}

package/lib/pod/urls.mjs

@@ -46,6 +46,12 @@ export function apUrls(remotePod, root, { publicBase = null } = {}) {
     pendingFollowers: face + 'ap/private/pending-followers',
     pendingFollowing: face + 'ap/private/pending-following',
     blocked: face + 'ap/private/blocked',
+    // The outbox as its owner reads it (every message, §5.1) and what the
+    // owner has liked (§5.5): the owner's alone, so they sit here too — and
+    // at the pod's own address even for a fronted identity, because the owner
+    // reads them there, with a credential the pod checks.
+    ownOutbox: home + 'ap/private/outbox',
+    liked: home + 'ap/private/liked',
     profileHtml: face + 'ap/profile.html',
     // Media stays on the pod even when fronted: attachment urls are not
     // identity-checked by remotes, and proxying blobs would be pure cost.

package/lib/server/embed.mjs

@@ -45,10 +45,10 @@ const mintSecret = () => crypto.randomBytes(32).toString('base64');
  * secret is moved into the pod and the host's copy removed, so the owner's
  * existing door link goes on working.
  */
-export async function ensureDoorSecret(session, podBase, { rotate = false, dataDir = null, handle = null, log = () => {} } = {}) {
+export async function ensureDoorSecret(session, podBase, { rotate = false, dataDir = null, handle = null, root = 'fedipod/', log = () => {} } = {}) {
   const base = podBase.endsWith('/') ? podBase : podBase + '/';
-  // Under the identity's own tree (fedipod/), where the gate reads it back.
-  const url = apUrls(base, 'fedipod/').state + 'door-secret.json';
+  // Under the identity's own tree, where the gate reads it back.
+  const url = apUrls(base, root).state + 'door-secret.json';
   const onHost = dataDir && handle ? path.join(dataDir, handle, 'door-secret.json') : null;
 
   if (!rotate) {
@@ -125,7 +125,7 @@ export function handleFor(podBase) {
  * pod does not travel to, so handing the pod over hands over an identity that
  * cannot sign. An identity set up before this gets the mode added.
  */
-function ensureCredential(home, { podBase, webId }) {
+function ensureCredential(home, { podBase, webId, root = 'fedipod/' }) {
   const file = path.join(home, 'credential.json');
   try {
     const rec = JSON.parse(fs.readFileSync(file, 'utf8'));
@@ -138,7 +138,7 @@ function ensureCredential(home, { podBase, webId }) {
     webId,
     remotePod: podBase.endsWith('/') ? podBase : podBase + '/',
     createdAt: new Date().toISOString(),
-    root: 'fedipod/',
+    root,
     keysMode: 'pod',
   };
   writeJsonAtomic(file, rec, { mode: 0o600 });
@@ -269,6 +269,7 @@ export async function deliverToInbox(agent, request, { podPut, gatewayWebId = nu
  */
 export async function startEmbeddedAgent({
   podBase,
+  root = 'fedipod/',
   dataDir,
   session,
   resourceStore = null,
@@ -285,7 +286,7 @@ export async function startEmbeddedAgent({
   fs.mkdirSync(home, { recursive: true, mode: 0o700 });
 
   const webId = base + webIdSuffix.replace(/^\//u, '');
-  const cred = ensureCredential(home, { podBase: base, webId });
+  const cred = ensureCredential(home, { podBase: base, webId, root });
 
   const agent = new Agent({ home, log });
   agent.log = log;

package/lib/session/README.md

@@ -1,4 +1,4 @@
-# fediverse-account
+# fediverse-session
 
 The library lets an app take a Fediverse handle or a WebID and act as that
 account.
@@ -51,23 +51,23 @@ the profile that comes back.
 From a CDN, with nothing to install:
 
 ```js
-import { fediAccount } from 'https://cdn.jsdelivr.net/npm/fediverse-account@0.1.0/fedi-account.mjs';
+import { fediAccount } from 'https://cdn.jsdelivr.net/npm/fediverse-session@0.2.1/fedi-account.mjs';
 ```
 
 Or from npm:
 
 ```bash
-npm install fediverse-account
+npm install fediverse-session
 ```
 
 ```js
-import { fediAccount } from 'fediverse-account';
+import { fediAccount } from 'fediverse-session';
 ```
 
 ## Use
 
 ```js
-import { fediAccount } from 'fediverse-account';
+import { fediAccount } from 'fediverse-session';
 const accounts = fediAccount({ dbName: 'my-app', clientName: 'My app' });
 
 await accounts.resume();                                   // on every page load

package/lib/session/demo.html

@@ -39,7 +39,7 @@
     <li><strong>Other Fediverse handle</strong> — <code>@you@mastodon.social</code> — signs in at your server</li>
     <li><strong>A WebID</strong> — <code>https://you.solidcommunity.net/profile/card#me</code> — signs in at your Solid pod</li>
   </ul>
-  <p>This demo is created with the <a href="https://github.com/jeff-zucker/FediPod/tree/main/lib/session">fediverse-account</a> library. Once signed in, the demo shows you your profile. The library itself returns an account session with methods to post, reply, like, etc.</p>
+  <p>This demo is created with the <a href="https://github.com/jeff-zucker/FediPod/tree/main/lib/session">fediverse-session</a> library. Once signed in, the demo shows you your profile. The library itself returns an account session with methods to post, reply, like, etc.</p>
   <form id="form">
     <label>Your address
       <input id="address" name="address" type="text" autocomplete="username" placeholder="@you@your.server" required>

package/lib/session/fedi-account.mjs

@@ -60,6 +60,14 @@ export function fediAccount({
     return body;
   };
 
+  // A collection, or a page of one, may be named by its address or given
+  // whole in place (ActivityPub allows either); the whole one is used as it
+  // is, an address is fetched.
+  const idOf = (v) => (typeof v === 'string' ? v : v?.id || null);
+  const asDoc = async (v) => (v && typeof v === 'object'
+    ? (v.type ? v : await asDoc(v.id))
+    : (typeof v === 'string' ? await json(v, { headers: { accept: 'application/activity+json' } }) : null));
+
   // Only loaded when `outbox({ rdf: true })` is actually called, so nobody
   // pays for a JSON-LD parser just by importing this file. Not in
   // `dependencies` — the app supplies "jsonld" if it wants this flag to work.
@@ -76,15 +84,16 @@ export function fediAccount({
     if (!actorUrl) return null;
     const jsonld = await loadJsonLd();
     const actorDoc = await json(actorUrl, { headers: { accept: 'application/activity+json' } });
-    let pageUrl = actorDoc?.outbox ? (await json(actorDoc.outbox, { headers: { accept: 'application/activity+json' } }))?.first : null;
+    const head = await asDoc(actorDoc?.outbox);
+    let page = head?.first ?? null;
     const quads = []; const seen = new Set(); let collected = 0;
-    while (pageUrl && collected < limit && !seen.has(pageUrl)) {
-      seen.add(pageUrl);
-      const page = await json(pageUrl, { headers: { accept: 'application/activity+json' } });
-      if (!page) break;
-      quads.push(...(await jsonld.toRDF(page)));
-      collected += (page.orderedItems || []).length;
-      pageUrl = page.next || null;
+    while (page && collected < limit && !seen.has(idOf(page) || page)) {
+      seen.add(idOf(page) || page);
+      const doc = await asDoc(page);
+      if (!doc) break;
+      quads.push(...(await jsonld.toRDF(doc)));
+      collected += (doc.orderedItems || []).length;
+      page = doc.next ?? null;
     }
     return quads;
   };
@@ -226,7 +235,7 @@ export function fediAccount({
     let actor = p.actor || pick(me, FOAF_ACCOUNT);
     let door = pick(me, AS_OUTBOX);
     const doc = actor ? await json(actor, { headers: { accept: 'application/activity+json' } }) : null;
-    if (!door && doc?.outbox) door = doc.outbox;
+    if (!door && doc?.outbox) door = idOf(doc.outbox);
     let root = p.root || null;
     if (!root && doc?.preferredUsername && actor) {
       const { aliases } = await webfinger(doc.preferredUsername, new URL(actor).host).catch(() => ({ aliases: [] }));
@@ -340,7 +349,7 @@ export function fediAccount({
       fetch: session.fetch,
       async profile() {
         const doc = facts.actor ? await json(facts.actor, { headers: { accept: 'application/activity+json' } }) : null;
-        const count = async (url) => (url ? (await json(url, { headers: { accept: 'application/activity+json' } }))?.totalItems ?? null : null);
+        const count = async (v) => (await asDoc(v))?.totalItems ?? null;
         return { handle: facts.handle, name: doc?.name || null, url: doc?.url || null, avatar: doc?.icon?.url || (typeof doc?.icon === 'string' ? doc.icon : null), bio: doc?.summary || '',
           followers: await count(doc?.followers), following: await count(doc?.following), posts: await count(doc?.outbox), actor: facts.actor, webId: facts.webId };
       },

package/lib/session/package.json

@@ -1,6 +1,6 @@
 {
-  "name": "fediverse-account",
-  "version": "0.2.0",
+  "name": "fediverse-session",
+  "version": "0.2.1",
   "description": "Type a Fediverse handle or a WebID and get back an account you can act with: post, read its timeline, follow, reply, favourite, boost. Works out whether the account lives on a Mastodon-family server or on a Solid pod through FediPod, sends the person to sign in there, brings them back to where they were, and speaks to whichever it is.",
   "type": "module",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.36.6",
+  "version": "1.40.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",
@@ -38,7 +38,7 @@
     "install-service": "node bin/fedipod.mjs install-service",
     "uninstall-service": "node bin/fedipod.mjs uninstall-service",
     "prepublishOnly": "npm test",
-    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node --test packages/fedipod-bb/test/*.test.mjs && node scripts/check-sizes.mjs",
+    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node --test packages/fedipod-bb/test/*.test.mjs && node scripts/check-sizes.mjs",
     "verify-ui": "node scripts/verify-ui.mjs",
     "build:sw": "node scripts/build-app.mjs --entry web/app/sw-src.mjs --out web/app/dist/sw.js",
     "build:boot": "node scripts/build-app.mjs --entry web/app/boot.mjs --out web/app/dist/boot.js",

package/run-agent.mjs

@@ -48,6 +48,7 @@ import { AcctFeed } from './lib/connections/acctfeed.mjs';
 import { BskyFeed } from './lib/connections/bskyfeed.mjs';
 import { BskyGroup } from './lib/connections/bskygroup.mjs';
 import { Lease } from './lib/core/lease.mjs';
+import { publishDue } from './lib/core/scheduled.mjs';
 import { startAdmin } from './lib/device/admin/index.mjs';
 import { exposureProblem, hostLabel } from './lib/shared/guard.mjs';
 import { pendingSteps } from './lib/device/migrate.mjs';
@@ -552,6 +553,8 @@ export class Agent {
     // Own posts the outbox names and the timeline index lacks come back here,
     // before anything acts on the index.
     await this.publisher.healStatuses().catch(e => this.log(`healing the timeline index: ${e.message}`));
+    // Likes made before the liked list existed become its first entries.
+    try { this.publisher.backfillLiked(); } catch (e) { this.log(`liked list: ${e.message}`); }
     this.lease.onLost = () => this.demote();
     this.lease.startRenewal();
     this.deliverer.startQueue();
@@ -573,24 +576,11 @@ export class Agent {
     this.tagfeed.start();
     this.startBsky();
     this.startAccts();
-    // Scheduled posts: a 30s sweep publishes what has come due. The entry is
-    // removed before publishing, so a slow publish cannot double-post; a
-    // failed one is dropped with its reason in the log.
+    // Scheduled posts and polls whose time is up: a 30s sweep does what has
+    // come due (lib/core/scheduled.mjs).
     clearInterval(this.schedTimer);
     this.schedTimer = setInterval(() => {
-      const due = this.store.getScheduled().filter(e => Date.parse(e.scheduledAt) <= Date.now());
-      for (const e of due) {
-        this.store.setScheduled(this.store.getScheduled().filter(x => x.id !== e.id));
-        this.publisher.publishNote(e.params.status, {
-          inReplyTo: e.params.inReplyTo, attachments: e.params.attachments,
-          visibility: e.params.visibility, spoilerText: e.params.spoilerText,
-        }).then(() => this.log(`scheduled post published (${e.id})`))
-          .catch(err => this.log(`scheduled post ${e.id} failed: ${err.message} — dropped`));
-      }
-      // A poll whose time is up is shut on the same sweep: it stops taking
-      // answers here, and everyone holding it is told once.
-      this.publisher.closeDuePolls()
-        .catch(err => this.log(`closing polls: ${err.message}`));
+      publishDue(this.store, this.publisher, this.log).catch(err => this.log(`scheduled: ${err.message}`));
     }, 30_000);
     this.schedTimer.unref();
     // A CSV import interrupted by a restart or a handoff picks back up here.

package/scripts/stage-site.mjs

@@ -267,14 +267,19 @@ fs.writeFileSync(path.join(site, '_redirects'), [
 // own /u/<handle>/ or a pod named outright. Its script is a module file of
 // its own, so it is served under the same `script-src 'self'` as the app.
 fs.mkdirSync(path.join(site, 'bb'), { recursive: true });
-for (const f of ['index.html', 'bb.js', 'read.mjs', 'masto.mjs', 'pod.mjs', 'markdown.mjs', 'seen.mjs', 'mine.mjs', 'private.mjs']) cp(`packages/fedipod-bb/site/${f}`, `bb/${f}`);
+for (const f of ['index.html', 'bb.js', 'read.mjs', 'masto.mjs', 'pod.mjs', 'markdown.mjs', 'seen.mjs', 'mine.mjs', 'private.mjs', 'oidc-session.mjs']) cp(`packages/fedipod-bb/site/${f}`, `bb/${f}`);
 cp('web/admin/tokens.css', 'bb/tokens.css');   // the site's shared palette, size and family
-cp('lib/session/oidc-session.mjs', 'bb/solid-oidc-session.mjs');   // signing in to a pod: the library
-cp('web/app/oidc-session.mjs', 'bb/oidc-session.mjs');   // and the browser build's binding of it, same database as the app
+cp('lib/session/oidc-session.mjs', 'bb/solid-oidc-session.mjs');   // signing in to a pod: the library the forum's binding names
 // The account library's demo page, with the library beside it, under /demo/.
 fs.mkdirSync(path.join(site, 'demo'), { recursive: true });
 for (const f of ['fedi-account.mjs', 'fedi-login.mjs', 'oidc-session.mjs']) cp(`lib/session/${f}`, `demo/${f}`);
 cp('web/admin/tokens.css', 'demo/tokens.css');
+// The page a Mastodon app sends its person to (lib/gateway/masto-gateway.mjs),
+// with the pod sign-in library and the palette beside it, as the demo has.
+fs.mkdirSync(path.join(site, 'app-signin'), { recursive: true });
+for (const f of ['index.html', 'app-signin.mjs']) cp(`web/app-signin/${f}`, `app-signin/${f}`);
+for (const f of ['fedi-login.mjs', 'oidc-session.mjs']) cp(`lib/session/${f}`, `app-signin/${f}`);
+cp('web/admin/tokens.css', 'app-signin/tokens.css');
 fs.writeFileSync(path.join(site, 'demo/index.html'),
   fs.readFileSync(path.join(root, 'lib/session/demo.html'), 'utf8').replace('../../web/admin/tokens.css', './tokens.css'));
 // Each file the forum page loads is named with a hash of its content. A
@@ -285,7 +290,7 @@ fs.writeFileSync(path.join(site, 'demo/index.html'),
   const stamp = (n) => createHash('sha256').update(fs.readFileSync(bb(n))).digest('hex').slice(0, 10);
   const sub = (n, pairs) => { let t = fs.readFileSync(bb(n), 'utf8');
     for (const [a, b] of pairs) t = t.split(a).join(b); fs.writeFileSync(bb(n), t); };
-  sub('oidc-session.mjs', [["'../../lib/session/oidc-session.mjs'", `'./solid-oidc-session.mjs?v=${stamp('solid-oidc-session.mjs')}'`]]);
+  sub('oidc-session.mjs', [["'fediverse-session/oidc-session.mjs'", `'./solid-oidc-session.mjs?v=${stamp('solid-oidc-session.mjs')}'`]]);
   sub('pod.mjs', [["'./oidc-session.mjs'", `'./oidc-session.mjs?v=${stamp('oidc-session.mjs')}'`],
     ["'./markdown.mjs'", `'./markdown.mjs?v=${stamp('markdown.mjs')}'`],
     ["'./private.mjs'", `'./private.mjs?v=${stamp('private.mjs')}'`],
@@ -336,6 +341,14 @@ fs.writeFileSync(path.join(site, '_headers'), [
   '  X-Content-Type-Options: nosniff',
   '  Referrer-Policy: same-origin',
   '',
+  // The page a Mastodon app sends its person to signs them in at their pod,
+  // so it reaches the pod's identity provider.
+  '/app-signin/*',
+  '  Cache-Control: no-cache',
+  "  Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https:; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'",
+  '  X-Content-Type-Options: nosniff',
+  '  Referrer-Policy: same-origin',
+  '',
   // The account demo reads pods and Mastodon servers and shows their avatars.
   '/demo/*',
   '  Cache-Control: no-cache',

package/web/admin/actors.js

@@ -136,6 +136,8 @@ $('new-actor-form').addEventListener('submit', async (ev) => {
   };
   if (answers.mode === 'new') answers.podName = $('new-podname').value.trim() || handle;
   else answers.pod = $('new-pod').value.trim();
+  answers.container = $('new-container').value.trim();
+  answers.createIndex = $('new-createIndex').checked;
   $('new-actor-go').disabled = true;
   say(`setting up ${handle || 'the new actor'} — this takes a while`);
   const r = await write('/new-actor', answers, `setting up ${handle}`);

package/web/admin/gateway.js

@@ -28,11 +28,16 @@ async function refreshGateway() {
     $('gateway-close').hidden = !known || !!st.closed;
     if (known && st.closed) GATEWAY_WORD.textContent += ' — this address is closed';
     else if (known && st.paused) GATEWAY_WORD.textContent += st.pausedBy === 'owner' ? ' — paused by you' : ' — paused';
+    // Whether the gateway keeps the account running while FediPod is closed.
+    const kp = g.keeper;
+    $('gateway-keep-on').hidden = !kp || !known || !!st.closed || kp.on;
+    $('gateway-keep-off').hidden = !kp || !known || !!st.closed || !kp.on;
+    if (kp?.on && known && !st.closed) GATEWAY_WORD.textContent += ' — kept running while you are away';
   } else {
     GATEWAY_WORD.textContent = '';
     GW_OPEN_ATTACH.hidden = false;
     GW_OPEN_DETACH.hidden = true;
-    for (const id of ['gateway-pause', 'gateway-resume', 'gateway-close']) $(id).hidden = true;
+    for (const id of ['gateway-pause', 'gateway-resume', 'gateway-keep-on', 'gateway-keep-off', 'gateway-close']) $(id).hidden = true;
   }
 }
 const setPausedAtGateway = async (paused) => {
@@ -43,6 +48,14 @@ const setPausedAtGateway = async (paused) => {
 };
 $('gateway-pause').addEventListener('click', () => setPausedAtGateway(true));
 $('gateway-resume').addEventListener('click', () => setPausedAtGateway(false));
+const setKept = async (on) => {
+  const r = await write('/gateway/keep', { on },
+    on ? 'kept running — follows, deliveries to try again and scheduled posts are handled while FediPod is closed'
+      : 'stopped — your account acts only while FediPod is open');
+  if (r) refreshGateway();
+};
+$('gateway-keep-on').addEventListener('click', () => setKept(true));
+$('gateway-keep-off').addEventListener('click', () => setKept(false));
 const gwShape = () => document.querySelector('input[name=gwShape]:checked')?.value || 'pod';
 function gwPreviews() {
   $('gw-pod-preview').textContent = config?.address || `@${config?.handle || 'you'}@your.pod`;

package/web/admin/index.html

@@ -272,6 +272,15 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
         <label for="new-pod">Pod address</label>
         <input type="url" id="new-pod" autocomplete="url" placeholder="https://you.solidcommunity.net/">
       </div>
+      <label for="new-container">Store your data in a container named fedipod, inside this container</label>
+      <input type="text" id="new-container" autocomplete="off" spellcheck="false" placeholder="/"
+        aria-describedby="new-container-hint">
+      <p class="hint" id="new-container-hint">Leave it empty for your pod's root. This is permanent.</p>
+      <p id="new-typeindex-text">FediPod records where the account lives in your pod's public type index,
+        the list Solid apps use to find your things. A new pod has none; setup stops if yours has none
+        and you have not said yes here. It will be readable by anyone, like your profile.</p>
+      <label class="choice"><input type="checkbox" id="new-createIndex" aria-describedby="new-typeindex-text">
+        If my pod has no public type index, create one</label>
     </fieldset>
 
     <p>
@@ -335,6 +344,10 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
     title="   Stop keeping the posts sent to you until you resume; follows still arrive">Pause my account</button>
   <button type="button" id="gateway-resume" class="inline" hidden
     title="   Keep the posts sent to you again">Resume my account</button>
+  <button type="button" id="gateway-keep-on" class="inline" hidden
+    title="   Let this gateway accept follows, try again what failed to go out and publish scheduled posts while FediPod is closed">Keep my account running while I'm away</button>
+  <button type="button" id="gateway-keep-off" class="inline" hidden
+    title="   Act only while FediPod is open; the rule naming this gateway comes off your pod">Stop keeping it running</button>
   <button type="button" id="gateway-close" class="inline danger" hidden data-confirm="close-address"
     title="   Close your address at this gateway for good; nothing on your pod is touched">Close this address</button>
 </span>

package/web/admin/oauth-signin.mjs

@@ -1,5 +1,5 @@
 // oauth-signin.mjs — a client asked this account to sign its owner in. The
-// owner signs in at their own pod, with the fediverse-account library, and the
+// owner signs in at their own pod, with the fediverse-session library, and the
 // page proves that sign-in to the account with one signed request; the account
 // then hands the client its code. No password of ours anywhere.
 import { fediLogin } from './fedi-login.mjs';

package/web/admin/record.js

@@ -269,6 +269,9 @@ function render() {
     ['Fediverse identity', config.address || `@${config.handle} — no resolvable address`,
       config.accountId && config.address ? { href: `/admin/client/#/a/${config.accountId}` } : null],
     ['Solid identity', config.webId, config.remotePod ? { href: config.remotePod, blank: true } : null],
+    // Where on the pod the account's data lives: the container its owner chose.
+    ['stored at', config.remotePod && config.root ? config.remotePod + config.root : null,
+      config.remotePod && config.root ? { href: config.remotePod + config.root, blank: true } : null],
     ['Other identities', 'ctl'],
     ['local store', config.home],
     // The address you actually open, not the bare number — the named origin when
@@ -362,7 +365,7 @@ function render() {
   if (!config.address) {
     const p = document.createElement('p');
     p.className = 'warn';
-    p.textContent = `${config.remotePod} is not the root of its own host, so this actor cannot be `
+    p.textContent = `${config.remotePod} is a suffixed pod, so this actor cannot be `
       + 'discovered as a handle by other servers. Posting and reading still work.';
     $('pane-identity').appendChild(p);
   }

package/web/admin/setup/index.html

@@ -151,7 +151,7 @@ button:disabled { opacity: .5; cursor: default; }
           <input type="url" id="issuerOther" name="issuerOther" autocomplete="url" placeholder="https://pods.example.org">
         </div>
         <p class="hint" id="issuer-new-hint">The Community Solid Server providers from
-          solidproject.org. A provider that puts pods on paths gives your address at a
+          solidproject.org. A provider that makes suffixed pods gives your address at a
           gateway instead.</p>
       </div>
 
@@ -184,6 +184,22 @@ button:disabled { opacity: .5; cursor: default; }
         <label for="pod">Pod address</label>
         <input type="url" id="pod" name="pod" autocomplete="url" placeholder="https://you.solidcommunity.net/">
       </div>
+
+      <div id="row-container">
+        <label for="container">Store your data in a container named fedipod, inside this container</label>
+        <input type="text" id="container" name="container" autocomplete="off" spellcheck="false"
+          placeholder="/" aria-describedby="container-hint">
+        <p class="hint" id="container-hint">Leave it empty for your pod's root. This is permanent.
+          <span id="place"></span></p>
+      </div>
+
+      <div id="row-typeindex" hidden>
+        <p id="typeindex-text">Your pod has no public type index, the list Solid apps use to find your
+          things. FediPod needs one to record where your account lives. It will be readable by anyone,
+          like your profile.</p>
+        <label class="choice"><input type="checkbox" id="createIndex" name="createIndex"
+          aria-describedby="typeindex-text"> Create a public type index on my pod</label>
+      </div>
     </fieldset>
 
     <p id="row-reenter" class="warn" hidden>Finishing a setup that already has an account credential.

package/web/admin/setup/setup.js

@@ -108,6 +108,9 @@ function answers() {
   };
   if (mode === 'new') a.podName = f.podName.value.trim() || a.handle;
   else a.pod = f.pod.value.trim();
+  // The container that holds fedipod/, and the yes to a new public type index.
+  a.container = f.container.value.trim();
+  a.createIndex = f.createIndex.checked;
   if (!state.resumable && !state.passwordSupplied) a.password = f.password.value;
   return a;
 }
@@ -116,13 +119,13 @@ function answers() {
 // account?", in the same words, as you type.
 const NOTES = {
   'pod-is-a-path': (a) =>
-    `This pod is a path on ${host(a.pod)}, not the root of its own host. WebFinger is `
-    + 'answered only at a host root, which this pod cannot write to, so other servers '
+    `This pod is suffixed (on ${host(a.pod)}), not subdomained. WebFinger is `
+    + 'answered only for a subdomained pod, so other servers '
     + 'will not find this address. Posting and reading still work; being discovered does not.',
 };
 const REFUSALS = {
   'group-needs-host-root': () =>
-    'A group needs a pod at the root of its own host, or nobody could ever find it. '
+    'A group needs a subdomained pod, or nobody could ever find it. '
     + 'Give the group a pod of its own, or set this up as a person.',
 };
 const host = (u) => { try { return new URL(u).host; } catch { return u; } };
@@ -149,6 +152,11 @@ async function preview() {
   const { json } = await postJson('/setup/check', a);
   if (!json) return;
   $('preview').textContent = json.address || '…';
+  // Where the data will go, and the type index question when the pod has
+  // none (a new pod never does).
+  $('place').textContent = json.placeProblem ? json.placeProblem : (json.place ? `Your data will be at ${json.place}.` : '');
+  $('row-typeindex').hidden = json.typeIndex === true;
+  try { $('container').placeholder = a.mode === 'existing' && a.pod ? new URL(a.pod).pathname : '/'; } catch { /* not a URL yet */ }
   // The address-shape choice: hidden for a group (a group cannot front yet),
   // locked to the gateway for a pod on a suffix-based host, an open choice
   // for a pod at its own host.
@@ -165,7 +173,7 @@ async function preview() {
     if (note) {
       note.hidden = !forced;
       note.textContent = forced
-        ? 'Your pod is on a suffix-based host, so its address lives at the gateway. Your posts, key and data stay on your pod.'
+        ? 'Your pod is suffixed, so its address lives at the gateway. Your posts, key and data stay on your pod.'
         : '';
     }
   }
@@ -188,6 +196,11 @@ async function preview() {
 async function onSubmit(ev) {
   ev.preventDefault();
   $('form-error').textContent = '';
+  // No type index and no yes: stop here, before anything is sent.
+  if (!$('row-typeindex').hidden && !$('createIndex').checked) {
+    $('form-error').textContent = 'Setup stopped. Nothing was written to your pod. FediPod needs a public type index to record where your account lives.';
+    return;
+  }
   $('submit').disabled = true;
   const { status, json } = await postJson('/setup', answers());
   if (status !== 202) {
@@ -300,7 +313,7 @@ function paneDone(result) {
   $('done-address').textContent = result?.address || `@${result?.handle} — no resolvable address`;
   const notes = [];
   if (!result?.resolvable) {
-    notes.push(`${result?.pod} is not the root of its own host, so this address cannot be `
+    notes.push(`${result?.pod} is a suffixed pod, so this address cannot be `
       + 'discovered by other servers. Posting and reading still work.');
   }
   if (result?.unreachable?.length) {

package/web/app/README.md

@@ -75,7 +75,7 @@ See the `MastoApi` options in `agent.mjs`.
 |---|---|
 | **Streaming** | a service worker answers fetches, not sockets. No streaming URL is advertised, so clients poll. |
 | **Web push** | `shims/web-push.mjs` is a no-op. `vapid` is omitted, and a client that subscribes anyway gets a 422 rather than a subscription nothing will push to. |
-| **Scheduled posts** | nothing runs between now and the scheduled time. A `scheduled_at` is refused with a 422 that says so — accepting one was silent loss. |
+| **Scheduled posts** | only while the gateway keeps the account running (`setKeeper`), because then something is running when the time comes: the app publishes what falls due while it is open, the gateway's keeper while it is closed. Otherwise a `scheduled_at` is refused with a 422 that says so — accepting one was silent loss. |
 | **Groups** | sign-up makes personal identities only (`signup.mjs`), and the moderation surface is not here. Joining a group works; hosting one needs the DeviceAgent. See `groups.md`. |
-| **Changing where the address lives** | the shape is chosen at sign-up (`signup.mjs`): on the pod, `@you@yourpod` with the gateway as a mail door, or at the gateway, `@you@front` — and a pod on a suffix-based host is always fronted. `admin-facade.mjs` refuses changing it afterwards, because a rename needs a restart a browser does not have. |
+| **Changing where the address lives** | the shape is chosen at sign-up (`signup.mjs`): on the pod, `@you@yourpod` with the gateway as a mail door, or at the gateway, `@you@front` — and a suffixed pod is always fronted. `admin-facade.mjs` refuses changing it afterwards, because a rename needs a restart a browser does not have. |
 | **Moving the private half** | `/state-move` is about filesystem paths and `credential.json`. A browser has neither; its private half is always on the pod. |