fedipod 1.36.6 → 1.40.0

package/web/app/dist/boot.js

@@ -16984,7 +16984,7 @@ var require_fromRdf = __commonJS({
       RDF_FIRST,
       RDF_REST,
       RDF_NIL,
-      RDF_TYPE,
+      RDF_TYPE: RDF_TYPE2,
       // RDF_PLAIN_LITERAL,
       // RDF_XML_LITERAL,
       RDF_JSON_LITERAL,
@@ -17043,7 +17043,7 @@ var require_fromRdf = __commonJS({
         if (objectIsNode && !(objectNodeId in nodeMap)) {
           nodeMap[objectNodeId] = { "@id": objectNodeId };
         }
-        if (p === RDF_TYPE && !useRdfType && objectIsNode) {
+        if (p === RDF_TYPE2 && !useRdfType && objectIsNode) {
           _addValue(node, "@type", objectNodeId, { propertyIsArray: true });
           continue;
         }
@@ -17292,7 +17292,7 @@ var require_toRdf = __commonJS({
       RDF_FIRST,
       RDF_REST,
       RDF_NIL,
-      RDF_TYPE,
+      RDF_TYPE: RDF_TYPE2,
       // RDF_PLAIN_LITERAL,
       // RDF_XML_LITERAL,
       RDF_JSON_LITERAL,
@@ -17350,7 +17350,7 @@ var require_toRdf = __commonJS({
         for (let property of properties) {
           const items = node[property];
           if (property === "@type") {
-            property = RDF_TYPE;
+            property = RDF_TYPE2;
           } else if (isKeyword(property)) {
             continue;
           }
@@ -32543,6 +32543,15 @@ var REL = {
   owner: "http://www.w3.org/ns/solid/terms#owner"
 };
 
+// lib/pod/urls.mjs
+function podBaseOfWebId(webId) {
+  const u = new URL(webId);
+  u.hash = "";
+  u.search = "";
+  const dir = u.pathname.replace(/profile\/card$/u, "").replace(/[^/]*$/u, "");
+  return `${u.origin}${dir.endsWith("/") ? dir : dir + "/"}`;
+}
+
 // lib/pod/transport.mjs
 var LDP = Namespace("http://www.w3.org/ns/ldp#");
 var DC = Namespace("http://purl.org/dc/terms/");
@@ -32551,6 +32560,16 @@ var RDF3 = Namespace("http://www.w3.org/1999/02/22-rdf-syntax-ns#");
 var ACL = Namespace("http://www.w3.org/ns/auth/acl#");
 var FOAF = Namespace("http://xmlns.com/foaf/0.1/");
 var AS = Namespace("https://www.w3.org/ns/activitystreams#");
+var RDFS = Namespace("http://www.w3.org/2000/01/rdf-schema#");
+function termProblem(t) {
+  if (t?.termType === "Literal") return null;
+  if (t?.termType !== "NamedNode") return `${t?.value ?? t} is not an IRI or a literal`;
+  try {
+    return /^https?:$/.test(new URL(t.value).protocol) ? null : `${t.value} is not an http(s) IRI`;
+  } catch {
+    return `${t.value} is not an absolute IRI`;
+  }
+}
 var ACP_NS = "http://www.w3.org/ns/solid/acp#";
 var LISTING_MAX_BYTES = 10 * 1024 * 1024;
 var COOLDOWN_DEFAULT_MS = 6e4;
@@ -32616,6 +32635,9 @@ var PodTransport = class {
     this.aclFlavour = null;
     this._listCache = /* @__PURE__ */ new Map();
     this.toPod = null;
+    this.aclOwner = null;
+    this.keepers = [];
+    this.aclIfChanged = false;
   }
   /** Who is talking, and from where — the prefix on every log line and error. */
   get label() {
@@ -32813,9 +32835,10 @@ var PodTransport = class {
     authorize(
       namedNode2(url + "#owner"),
       ACL("agent"),
-      namedNode2(this.webId),
+      namedNode2(this.aclOwner || this.webId),
       ["Read", "Write", "Control"]
     );
+    (this.keepers || []).forEach((webId, i) => authorize(namedNode2(url + `#keeper${i}`), ACL("agent"), namedNode2(webId), ["Read", "Write", "Control"]));
     return serialize(doc, g, url, "text/turtle");
   }
   async setAcl(targetUrl, publicModes, opts = {}) {
@@ -32823,9 +32846,52 @@ var PodTransport = class {
     const url = await this.aclUrlFor(podTarget);
     if (!await this.aclWritable(url)) return null;
     const doc = this.aclDoc(podTarget, publicModes, { ...opts, aclUrl: url });
-    if (opts.ifChanged && await this.aclSame(url, doc)) return { status: 304, unchanged: true };
+    if ((opts.ifChanged || this.aclIfChanged) && await this.aclSame(url, doc)) return { status: 304, unchanged: true };
     return this.put(url, doc, "text/turtle");
   }
+  /**
+   * A rule already on the pod, stated again with this transport's owner and
+   * keepers, keeping what it grants the public (#public), agents who may only
+   * append (#gw…) and agents who may only read (#r…). A resource with no rule
+   * of its own inherits one and is left alone; so is a rule with anything this
+   * file did not write, which it cannot restate faithfully.
+   */
+  async restateAcl(targetUrl) {
+    const podTarget = this.toPod ? this.toPod(targetUrl) : targetUrl;
+    const url = await this.aclUrlFor(podTarget);
+    if (!await this.aclWritable(url)) return null;
+    const res = await this.fetch(url, { headers: { accept: "text/turtle" } });
+    if (res.status !== 200) return null;
+    const g = graph();
+    try {
+      parse2(await res.text(), g, url, "text/turtle");
+    } catch {
+      return null;
+    }
+    const modes = (auth) => g.each(auth, ACL("mode"), null).map((m) => m.value.slice(ACL("").value.length));
+    let publicModes = [];
+    const appendAgents = [];
+    const readAgents = [];
+    for (const auth of g.each(null, RDF3("type"), ACL("Authorization"))) {
+      const frag = auth.value.includes("#") ? auth.value.slice(auth.value.lastIndexOf("#") + 1) : "";
+      if (frag === "owner" || /^keeper\d+$/u.test(frag)) continue;
+      if (frag === "public") {
+        publicModes = modes(auth);
+        continue;
+      }
+      const agent = g.any(auth, ACL("agent"), null)?.value;
+      if (/^gw\d+$/u.test(frag) && agent) {
+        appendAgents.push(agent);
+        continue;
+      }
+      if (/^r\d+$/u.test(frag) && agent) {
+        readAgents.push(agent);
+        continue;
+      }
+      return null;
+    }
+    return this.setAcl(targetUrl, publicModes, { appendAgents, readAgents, ifChanged: true });
+  }
   // Whether the pod's rule at `aclUrl` states exactly what `doc` states.
   // Compared as graphs, not bytes: the pod serialises what it holds its own
   // way. Every rule this file writes names its subjects, so triple sets are
@@ -32903,16 +32969,10 @@ var PodTransport = class {
    * written back — an empty or foreign body must never become the new profile.
    */
   async linkAccountInProfile({ actorUrl, accountName, kind = "person", outbox = null }) {
-    const docUrl = this.webId.split("#")[0];
-    const res = await this.fetch(docUrl, { headers: { accept: "text/turtle" } });
-    if (res.status >= 400) throw new Error(`[${this.label}] GET ${docUrl} \u2192 ${res.status}`);
-    const g = graph();
-    parse2(await res.text(), g, docUrl, "text/turtle");
-    const doc = namedNode2(docUrl);
     const me = namedNode2(this.webId);
-    if (!g.statementsMatching(me, null, null, doc).length) {
-      throw new Error(`profile at ${docUrl} does not mention ${this.webId} \u2014 not rewriting it`);
-    }
+    const podBase = podBaseOfWebId(this.webId);
+    const docs = await this.profileDocs(podBase);
+    const says = (s, p, o) => docs.some(({ g }) => g?.holds(s, p, o));
     const actor = namedNode2(actorUrl);
     const wanted = [
       [me, FOAF("account"), actor],
@@ -32923,17 +32983,20 @@ var PodTransport = class {
       // WebID is what dokieli reads); only where a door exists to take it.
       ...outbox ? [[me, AS("outbox"), namedNode2(outbox)]] : []
     ];
-    const missing = wanted.filter(([s, p, o]) => !g.holds(s, p, o, doc));
-    const stale = [
-      ...g.statementsMatching(actor, FOAF("accountName"), null, doc).filter((st2) => st2.object.value !== accountName),
-      ...outbox ? g.statementsMatching(me, AS("outbox"), null, doc).filter((st2) => st2.object.value !== outbox) : []
-    ];
+    const missing = wanted.filter(([s, p, o]) => !says(s, p, o));
+    const stale = [];
+    for (const { g } of docs) {
+      for (const st2 of g?.statementsMatching(actor, FOAF("accountName"), null) || []) {
+        if (st2.object.value !== accountName) stale.push([st2.subject, st2.predicate, st2.object]);
+      }
+      if (outbox) {
+        for (const st2 of g?.statementsMatching(me, AS("outbox"), null) || []) {
+          if (st2.object.value !== outbox) stale.push([st2.subject, st2.predicate, st2.object]);
+        }
+      }
+    }
     if (!missing.length && !stale.length) return false;
-    const deletes = stale.map((st2) => [st2.subject, st2.predicate, st2.object]);
-    if (await this.patchDocument(docUrl, missing, deletes)) return true;
-    for (const st2 of stale) g.remove(st2);
-    for (const [s, p, o] of missing) g.add(s, p, o, doc);
-    await this.put(docUrl, serialize(doc, g, docUrl, "text/turtle"), "text/turtle");
+    await this.writeAboutWebId(podBase, { inserts: missing, deletes: stale });
     return true;
   }
   /**
@@ -32972,6 +33035,151 @@ ${clauses.join(";\n")}.
     if (res.status === 405 || res.status === 415 || res.status === 501) return false;
     throw new Error(`[${this.label}] PATCH ${docUrl} \u2192 ${res.status}`);
   }
+  // ---- writing a profile or a type index: valid RDF, or nothing ----
+  //
+  // Two rules. A change is written only if the document it leaves behind is
+  // valid RDF: the graph as it would be afterwards is serialised and parsed
+  // back, and the subject that must stay described still is. And a profile
+  // that will not take a write is not the end: the statements go to the first
+  // document its rdfs:seeAlso names, inside the same pod, that takes them —
+  // under the same check. A profile is what every Solid app signs in through;
+  // one left broken breaks them all. Reading follows the same links.
+  /** An IRI or a literal as a term, for the operations that pass plain values. */
+  sym(iri) {
+    try {
+      return namedNode2(iri);
+    } catch {
+      throw new Error(`not written: ${iri} is not an absolute IRI`);
+    }
+  }
+  literal(value) {
+    return literal2(value);
+  }
+  /** A document as a graph, or null when it is not there. */
+  async readRdf(docUrl) {
+    const res = await this.fetch(docUrl, { headers: { accept: "text/turtle" } });
+    if (res.status === 404 || res.status === 410) return null;
+    if (res.status >= 400) throw new Error(`[${this.label}] GET ${docUrl} \u2192 ${res.status}`);
+    const g = graph();
+    parse2(await res.text(), g, docUrl, "text/turtle");
+    return g;
+  }
+  /**
+   * The document as it would be after the change, checked. Returns the Turtle
+   * to write, or throws saying why nothing may be written.
+   */
+  checkedRdf(g, docUrl, { inserts = [], deletes = [], mustDescribe = null }) {
+    const doc = namedNode2(docUrl);
+    for (const [s, p, o] of inserts) {
+      const bad = termProblem(s) || termProblem(p) || termProblem(o) || (s?.termType === "Literal" || p?.termType !== "NamedNode" ? "a literal subject or predicate" : null);
+      if (bad) throw new Error(`not written: ${bad}`);
+    }
+    const after = graph();
+    for (const st2 of g.statementsMatching(null, null, null, doc)) after.add(st2.subject, st2.predicate, st2.object, doc);
+    for (const [s, p, o] of deletes) for (const st2 of after.statementsMatching(s, p, o, doc)) after.remove(st2);
+    for (const [s, p, o] of inserts) if (!after.holds(s, p, o, doc)) after.add(s, p, o, doc);
+    let text;
+    try {
+      text = serialize(doc, after, docUrl, "text/turtle");
+    } catch (e) {
+      throw new Error(`not written: ${docUrl} would not serialise (${e.message})`);
+    }
+    const back = graph();
+    try {
+      parse2(text, back, docUrl, "text/turtle");
+    } catch (e) {
+      throw new Error(`not written: ${docUrl} would not parse back (${e.message})`);
+    }
+    if (back.statementsMatching(null, null, null, doc).length !== after.statementsMatching(null, null, null, doc).length) {
+      throw new Error(`not written: ${docUrl} would not read back as written`);
+    }
+    if (mustDescribe && !back.statementsMatching(namedNode2(mustDescribe), null, null, doc).length) {
+      throw new Error(`not written: ${docUrl} would no longer describe ${mustDescribe}`);
+    }
+    return text;
+  }
+  /**
+   * Change one document, or refuse. `g` is the document as read (null for a
+   * new one). A PATCH carries only these statements; where the pod cannot
+   * patch, the whole checked document is written. Returns the write's status.
+   */
+  async writeRdfChecked(docUrl, g, { inserts = [], deletes = [], mustDescribe = null }) {
+    const current = g || graph();
+    const doc = namedNode2(docUrl);
+    const todo = inserts.filter(([s, p, o]) => !current.holds(s, p, o, doc));
+    const gone = deletes.filter(([s, p, o]) => current.holds(s, p, o, doc));
+    if (!todo.length && !gone.length) return 200;
+    const text = this.checkedRdf(current, docUrl, { inserts: todo, deletes: gone, mustDescribe });
+    if (g) {
+      let res = null;
+      try {
+        res = await this.fetch(docUrl, {
+          method: "PATCH",
+          headers: { "content-type": "text/n3" },
+          body: this.n3Patch(docUrl, todo, gone)
+        });
+      } catch {
+        res = null;
+      }
+      if (res && res.status < 300) return res.status;
+      if (res && ![405, 415, 501].includes(res.status)) return res.status;
+    }
+    const put = await this.fetch(docUrl, { method: "PUT", headers: { "content-type": "text/turtle" }, body: text });
+    return put.status;
+  }
+  /**
+   * The profile and the documents its rdfs:seeAlso names inside this pod,
+   * each with its graph, the profile first. What any of them says about the
+   * WebID is what the profile says.
+   */
+  async profileDocs(podBase) {
+    const profileUrl = this.webId.split("#")[0];
+    const g = await this.readRdf(profileUrl);
+    if (!g) throw new Error(`no profile at ${profileUrl}`);
+    const out = [{ url: profileUrl, g, profile: true }];
+    const seen = /* @__PURE__ */ new Set([profileUrl]);
+    for (const st2 of g.statementsMatching(null, RDFS("seeAlso"), null)) {
+      const url = st2.object.value.split("#")[0];
+      if (seen.has(url) || !url.startsWith(podBase)) continue;
+      seen.add(url);
+      out.push({ url, g: await this.readRdf(url).catch(() => null), profile: false });
+    }
+    return out;
+  }
+  /** Every value the WebID has for `predicate`, across the profile and its seeAlso documents. */
+  webIdValues(docs, predicate) {
+    const me = namedNode2(this.webId);
+    const p = namedNode2(predicate);
+    const out = [];
+    for (const { g } of docs) for (const st2 of g?.statementsMatching(me, p, null) || []) out.push(st2.object.value);
+    return [...new Set(out)];
+  }
+  /**
+   * Write statements about the WebID: to the profile, or — if the profile will
+   * not take them — to the first of its seeAlso documents that will. Every
+   * write checked. Returns the document written to, or null when nothing
+   * needed writing; throws when none would take it.
+   */
+  async writeAboutWebId(podBase, { inserts = [], deletes = [] }) {
+    const docs = await this.profileDocs(podBase);
+    const holds = ([s, p, o]) => docs.some(({ g }) => g?.holds(s, p, o));
+    const todo = inserts.filter((t) => !holds(t));
+    const gone = deletes.filter(holds);
+    if (!todo.length && !gone.length) return null;
+    const refusals = [];
+    for (const d of docs) {
+      const here = gone.filter(([s, p, o]) => d.g?.holds(s, p, o));
+      const status = await this.writeRdfChecked(d.url, d.g, {
+        inserts: todo,
+        deletes: here,
+        mustDescribe: d.profile ? this.webId : null
+      });
+      if (status < 300) return d.url;
+      refusals.push(`${d.url} \u2192 ${status}`);
+      if (status !== 401 && status !== 403) break;
+    }
+    throw new Error(`not written: neither the profile nor a document it names would take it (${refusals.join("; ")})`);
+  }
 };
 
 // web/app/pod-remote.mjs
@@ -33057,15 +33265,6 @@ async function resourceExists(fetchImpl, url, { timeoutMs = OWNER_LOOKUP_MS } =
   }
 }
 
-// lib/pod/urls.mjs
-function podBaseOfWebId(webId) {
-  const u = new URL(webId);
-  u.hash = "";
-  u.search = "";
-  const dir = u.pathname.replace(/profile\/card$/u, "").replace(/[^/]*$/u, "");
-  return `${u.origin}${dir.endsWith("/") ? dir : dir + "/"}`;
-}
-
 // web/app/idb-kv.mjs
 var DB = "fedipod-accounts";
 function open() {
@@ -33112,10 +33311,139 @@ async function cacheOpenedKeys(actorUrl, keysRecord) {
 }
 var keyCacheKey = (actorUrl) => `signing-keys:${actorUrl}`;
 
+// lib/pod/type-index.mjs
+var SOLID = "http://www.w3.org/ns/solid/terms#";
+var RDF_TYPE = "http://www.w3.org/1999/02/22-rdf-syntax-ns#type";
+var AS_ACTOR = "https://www.w3.org/ns/activitystreams#Actor";
+var PUBLIC_READ = ["Read"];
+var newIndexUrl = (podBase) => `${podBase}settings/publicTypeIndex.ttl`;
+async function findPublicIndex(pod, podBase) {
+  const docs = await pod.profileDocs(podBase);
+  return pod.webIdValues(docs, SOLID + "publicTypeIndex")[0] || null;
+}
+async function actorsIn(pod, indexUrl) {
+  const g = await pod.readRdf(indexUrl).catch(() => null);
+  if (!g) return [];
+  const out = [];
+  for (const reg of g.each(null, pod.sym(SOLID + "forClass"), pod.sym(AS_ACTOR))) {
+    for (const inst of g.each(reg, pod.sym(SOLID + "instance"), null)) out.push(inst.value);
+  }
+  return [...new Set(out)];
+}
+function regFor(indexUrl, actorUrl) {
+  let h = 0;
+  for (const c of actorUrl) h = h * 31 + c.charCodeAt(0) >>> 0;
+  return `${indexUrl}#actor-${h.toString(36)}`;
+}
+async function register(pod, indexUrl, actorUrl) {
+  const g = await pod.readRdf(indexUrl);
+  if (!g) throw new Error(`no type index at ${indexUrl}`);
+  if ((await actorsIn(pod, indexUrl)).includes(actorUrl)) return false;
+  const reg = pod.sym(regFor(indexUrl, actorUrl));
+  const status = await pod.writeRdfChecked(indexUrl, g, {
+    inserts: [
+      [reg, pod.sym(RDF_TYPE), pod.sym(SOLID + "TypeRegistration")],
+      [reg, pod.sym(SOLID + "forClass"), pod.sym(AS_ACTOR)],
+      [reg, pod.sym(SOLID + "instance"), pod.sym(actorUrl)]
+    ],
+    mustDescribe: indexUrl
+  });
+  if (status >= 300) throw new Error(`the type index at ${indexUrl} did not take the registration (${status})`);
+  return true;
+}
+async function createPublicIndex(pod, podBase) {
+  const url = newIndexUrl(podBase);
+  const doc = pod.sym(url);
+  const existing = await pod.readRdf(url).catch(() => null);
+  if (!existing) {
+    const status = await pod.writeRdfChecked(url, null, {
+      inserts: [
+        [doc, pod.sym(RDF_TYPE), pod.sym(SOLID + "TypeIndex")],
+        [doc, pod.sym(RDF_TYPE), pod.sym(SOLID + "ListedDocument")]
+      ],
+      mustDescribe: url
+    });
+    if (status >= 300) throw new Error(`could not make a type index at ${url} (${status})`);
+  }
+  await pod.setAcl(url, PUBLIC_READ);
+  await pod.writeAboutWebId(podBase, {
+    inserts: [[pod.sym(pod.webId), pod.sym(SOLID + "publicTypeIndex"), doc]]
+  });
+  return url;
+}
+async function registeredActors(pod, podBase) {
+  const index = await findPublicIndex(pod, podBase).catch(() => null);
+  if (!index) return [];
+  return (await actorsIn(pod, index)).filter((a) => a.startsWith(podBase) && a.endsWith("ap/actor"));
+}
+
+// lib/pod/location.mjs
+var RESERVED = /* @__PURE__ */ new Set(["profile", "settings", ".well-known"]);
+var SEGMENT = /^[A-Za-z0-9._-]+$/u;
+function podRootPath(podBase) {
+  return new URL(podBase).pathname;
+}
+function rootFromContainer(podBase, typed, name) {
+  const base = new URL(podBase);
+  let path = String(typed ?? "").trim() || base.pathname;
+  if (!path.startsWith("/")) path = "/" + path;
+  if (!path.endsWith("/")) path += "/";
+  if (!path.startsWith(base.pathname)) {
+    return { problem: `that is not in your pod \u2014 your pod starts at ${base.pathname}` };
+  }
+  const inside = path.slice(base.pathname.length);
+  const segments = inside.split("/").filter(Boolean);
+  if (segments.some((s) => s === "." || s === "..")) return { problem: "a container path cannot go up with .." };
+  if (segments.some((s) => !SEGMENT.test(s))) {
+    return { problem: "container names are letters, digits, dots, dashes and underscores" };
+  }
+  if (segments.length && RESERVED.has(segments[0])) {
+    return { problem: `${base.pathname}${segments[0]}/ belongs to your pod itself \u2014 choose another container` };
+  }
+  if (segments.length > 8) return { problem: "that is nested too deep \u2014 eight containers at most" };
+  return { root: (segments.length ? segments.join("/") + "/" : "") + name };
+}
+function rootOfActor(podBase, actorUrl) {
+  const a = String(actorUrl || "");
+  if (!a.startsWith(podBase) || !a.endsWith("ap/actor")) return null;
+  const root = a.slice(podBase.length, -"ap/actor".length);
+  return root.endsWith("/") ? root : null;
+}
+
+// lib/core/wire.mjs
+var DEFAULT_ROOT = "fedipod/";
+
+// lib/core/place.mjs
+var chosenRoot = (podBase, typed) => rootFromContainer(podBase, typed, DEFAULT_ROOT);
+async function candidateRoots(pod, podBase) {
+  const recorded = await registeredActors(pod, podBase).catch(() => []);
+  const roots = recorded.map((a) => rootOfActor(podBase, a)).filter(Boolean);
+  return [.../* @__PURE__ */ new Set([...roots, DEFAULT_ROOT])];
+}
+async function findAccount(pod, podBase, read, accept = () => true) {
+  for (const root of await candidateRoots(pod, podBase)) {
+    const config = await read(root).catch(() => null);
+    if (config && accept(config)) return { root, config };
+  }
+  return null;
+}
+async function recordPlace(pod, podBase, actorAtPod, { create = false } = {}) {
+  let index = await findPublicIndex(pod, podBase);
+  if (!index) {
+    if (!create) return "no-index";
+    index = await createPublicIndex(pod, podBase);
+  }
+  return await register(pod, index, actorAtPod) ? "registered" : "already";
+}
+async function hasPublicIndex(pod, podBase) {
+  return !!await findPublicIndex(pod, podBase).catch(() => null);
+}
+
 // web/app/signup.mjs
-var AP_ROOT = "fedipod/";
-var actorUrlFor = (pod) => `${pod}${AP_ROOT}ap/actor`;
-var keysDocFor = (pod) => `${pod}${AP_ROOT}ap-state/keys.json`;
+var actorUrlFor = (pod, root) => `${pod}${root}ap/actor`;
+var keysDocFor = (pod, root) => `${pod}${root}ap-state/keys.json`;
+var stateOf = (pod, root) => `${pod}${root}ap-state/`;
+var readConfigAt = (remote, pod) => (root) => readConfig(remote, { state: stateOf(pod, root) });
 var HANDLE_RE = /^[a-z0-9-]{2,30}$/;
 function handleProblem(handle) {
   if (!handle) return "a handle is required";
@@ -33124,7 +33452,7 @@ function handleProblem(handle) {
   return null;
 }
 var PROGRESS = /* @__PURE__ */ new Map();
-var progressKey = (webId, a) => [webId, a.handle, a.shape || "pod"].join("|");
+var progressKey = (webId, a) => [webId, a.handle, a.shape || "pod", a.container || ""].join("|");
 async function assertFrontNameFree(frontOrigin, handle) {
   const res = await fetch(
     `${frontOrigin.replace(/\/$/, "")}/api/handle?handle=${encodeURIComponent(handle)}`,
@@ -33153,10 +33481,23 @@ async function signUp(answers, { session, onStep = () => {
     ok: (note) => onStep(key2, "ok", note),
     skip: (note) => onStep(key2, "skipped", note)
   });
+  const place = chosenRoot(pod, answers.container);
+  if (place.problem) throw new Error(`Where to store it: ${place.problem}.`);
+  const root = place.root;
+  const remote = new BrowserRemotePod(session, { webId, role: "signup", log: () => {
+  } });
   const podStep = step("pod");
   if (!prog.pod) {
     podStep.running("checking your pod");
-    if (await resourceExists(session.fetch, actorUrlFor(pod))) throw new Error("The pod already hosts a FediPod account. If you want a second account, put it on a different pod.");
+    if (await findAccount(remote, pod, readConfigAt(remote, pod)) || await resourceExists(session.fetch, actorUrlFor(pod, root))) {
+      throw new Error("The pod already hosts a FediPod account. If you want a second account, put it on a different pod.");
+    }
+    if (await resourceExists(session.fetch, `${pod}${root}`)) {
+      throw new Error(`${new URL(pod + root).pathname} is already there and is not a FediPod account \u2014 choose another container.`);
+    }
+    if (!answers.createIndex && !await hasPublicIndex(remote, pod)) {
+      throw Object.assign(new Error("Your profile names no public type index."), { code: "needs-index" });
+    }
     prog.pod = pod;
     podStep.ok(pod);
   } else {
@@ -33165,10 +33506,10 @@ async function signUp(answers, { session, onStep = () => {
   const pathPod = new URL(pod).pathname !== "/";
   const fronted = pathPod || wantsFront;
   if (fronted && !frontOrigin) {
-    throw new Error(`${pod} is a suffix-based host, so its address must live at a gateway, and this page has none.`);
+    throw new Error(`${pod} is a suffixed pod, so its address must live at a gateway, and this page has none.`);
   }
   if (pathPod && !wantsFront) await assertFrontNameFree(frontOrigin, handle);
-  const actorUrl = actorUrlFor(pod);
+  const actorUrl = actorUrlFor(pod, root);
   const frontActor = fronted ? `${frontOrigin.replace(/\/$/, "")}/u/${handle}/ap/actor` : null;
   let gateway = answers.gateway || prog.gateway || null;
   if (frontOrigin && !gateway) {
@@ -33182,7 +33523,7 @@ async function signUp(answers, { session, onStep = () => {
       // bare pod root sends this identity's mail to <pod>/ap/inbox/ — outside
       // the container the agent drains, where nothing would ever read it. The
       // manage surface has always sent `urls.home`; this is the same value.
-      body: JSON.stringify({ handle, podHome: `${pod}${AP_ROOT}`, actorUrl, kind: "person", fronted })
+      body: JSON.stringify({ handle, podHome: `${pod}${root}`, actorUrl, kind: "person", fronted })
     });
     const d = await res.json().catch(() => ({}));
     if (res.status !== 201 || !d.hmacSecret) {
@@ -33194,8 +33535,6 @@ async function signUp(answers, { session, onStep = () => {
   } else if (frontOrigin && gateway) {
     step("gateway").ok();
   }
-  const remote = new BrowserRemotePod(session, { webId, role: "signup", log: () => {
-  } });
   const keysStep = step("keys");
   let keys;
   if (!prog.keysStored) {
@@ -33204,12 +33543,12 @@ async function signUp(answers, { session, onStep = () => {
     keys.mintedFor = gateway?.frontActor || actorUrl;
     try {
       await provisionKey(remote, {
-        stateUrl: `${pod}${AP_ROOT}ap-state/`,
-        keysUrl: keysDocFor(pod),
+        stateUrl: stateOf(pod, root),
+        keysUrl: keysDocFor(pod, root),
         keys
       });
     } catch (e) {
-      throw new Error(`could not store the signing key on the pod (${e.message}). You are signed in as ${webId} \u2014 that WebID must own ${pod} and its ${AP_ROOT} must be writable by it.`);
+      throw new Error(`could not store the signing key on the pod (${e.message}). You are signed in as ${webId} \u2014 that WebID must own ${pod} and ${root} in it must be writable by it.`);
     }
     await cacheOpenedKeys(actorUrl, keys);
     prog.keys = keys;
@@ -33221,7 +33560,7 @@ async function signUp(answers, { session, onStep = () => {
   }
   const config = {
     remotePod: pod,
-    root: AP_ROOT,
+    root,
     handle,
     name: handle,
     issuer: String(session.issuer || "").replace(/\/+$/, ""),
@@ -33229,10 +33568,21 @@ async function signUp(answers, { session, onStep = () => {
     ...gateway ? { gateway } : {}
   };
   try {
-    await writeConfig(remote, { state: `${pod}${AP_ROOT}ap-state/` }, config);
+    await writeConfig(remote, { state: stateOf(pod, root) }, config);
   } catch (e) {
     throw new Error(`could not store the config on the pod (${e.message})`);
   }
+  if (!prog.placed) {
+    const placeStep = step("place");
+    placeStep.running("recording where your account lives");
+    try {
+      await recordPlace(remote, pod, actorUrl, { create: !!answers.createIndex });
+    } catch (e) {
+      throw new Error(`could not record where your account lives in your type index (${e.message})`);
+    }
+    prog.placed = true;
+    placeStep.ok();
+  }
   PROGRESS.delete(key);
   const host = gateway?.frontActor ? new URL(gateway.frontActor).host : new URL(pod).host;
   return {
@@ -33249,8 +33599,9 @@ async function readAccount(session) {
   const pod = podBaseOfWebId(session.webId);
   const remote = new BrowserRemotePod(session, { webId: session.webId, role: "signup", log: () => {
   } });
-  const config = await readConfig(remote, { state: `${pod}${AP_ROOT}ap-state/` }).catch(() => null);
-  if (!config) return null;
+  const found = await findAccount(remote, pod, readConfigAt(remote, pod), (c) => (c.kind || "person") === "person");
+  if (!found) return null;
+  const { root, config } = found;
   const frontActor = config.gateway?.frontActor || null;
   let frontHost = null;
   try {
@@ -33264,7 +33615,7 @@ async function readAccount(session) {
   } catch {
     podHost = "";
   }
-  return { pod, config, frontActor, frontHost, address: `@${config.handle}@${frontHost || podHost}` };
+  return { pod, root, config, frontActor, frontHost, address: `@${config.handle}@${frontHost || podHost}` };
 }
 async function moveIn(answers, { session, onStep = () => {
 }, frontOrigin = null } = {}) {
@@ -33280,10 +33631,10 @@ async function moveIn(answers, { session, onStep = () => {
   const here = await readAccount(session);
   if (!here?.frontActor) throw new Error("this pod holds no account at another gateway to move here");
   if (here.frontHost === new URL(origin).host) throw new Error("this account already lives at this gateway");
-  const { pod, config: old } = here;
+  const { pod, root, config: old } = here;
   const remote = new BrowserRemotePod(session, { webId: session.webId, role: "signup", log: () => {
   } });
-  const urls = { state: `${pod}${AP_ROOT}ap-state/` };
+  const urls = { state: stateOf(pod, root) };
   const keys = await readKeys(remote, urls);
   if (!keys?.rsa) throw new Error("could not read this account's signing key on the pod");
   if (isKeyEnvelope(keys)) throw new Error(`this account's key is still under a password from an earlier version \u2014 sign in once at ${here.frontHost} first, then come back`);
@@ -33294,7 +33645,7 @@ async function moveIn(answers, { session, onStep = () => {
   const res = await session.fetch(`${origin}/api/attach`, {
     method: "POST",
     headers: { "content-type": "application/json" },
-    body: JSON.stringify({ handle, podHome: `${pod}${AP_ROOT}`, actorUrl: actorUrlFor(pod), kind: old.kind || "person", fronted: true })
+    body: JSON.stringify({ handle, podHome: `${pod}${root}`, actorUrl: actorUrlFor(pod, root), kind: old.kind || "person", fronted: true })
   });
   const d = await res.json().catch(() => ({}));
   if (res.status !== 201 || !d.hmacSecret) throw new Error(`could not attach to this gateway (HTTP ${res.status}): ${d.error || ""}`);
@@ -33322,7 +33673,7 @@ async function moveIn(answers, { session, onStep = () => {
   } catch (e) {
     throw new Error(`could not update your account on the pod (${e.message})`);
   }
-  await cacheOpenedKeys(actorUrlFor(pod), keys);
+  await cacheOpenedKeys(actorUrlFor(pod, root), keys);
   keysStep.ok();
   return { config, address: `@${handle}@${new URL(origin).host}`, movedFrom: config.movedFrom };
 }
@@ -33571,6 +33922,24 @@ function solidOidcSession({ dbName = "solid-oidc-session", clientName = "Solid a
 // web/app/oidc-session.mjs
 var { beginLogin, completeLogin, getSession, signOut } = solidOidcSession({ dbName: "fedipod-oidc", clientName: "FediPod" });
 
+// web/app/warm-start.mjs
+var DB2 = "fedipod-warm";
+var WARM_GAP_MS = 5 * 6e4;
+var FULL_EVERY_MS = 60 * 6e4;
+var DRAIN_EVERY_MS = 2 * 6e4;
+function deleteWarm() {
+  return new Promise((res) => {
+    let rq;
+    try {
+      rq = indexedDB.deleteDatabase(DB2);
+    } catch {
+      res();
+      return;
+    }
+    rq.onsuccess = rq.onerror = rq.onblocked = () => res();
+  });
+}
+
 // web/app/boot.mjs
 var REDIRECT = `${location.origin}/`;
 async function bootWorker({ reset = false } = {}) {
@@ -33614,18 +33983,14 @@ async function bootWorker({ reset = false } = {}) {
 async function readAccountState() {
   const session = await getSession();
   if (!session) throw new Error("Sign in first.");
-  const podFromWebId = podBaseOfWebId(session.webId);
-  const state = `${podFromWebId}${AP_ROOT}ap-state/`;
+  const here = await readAccount(session);
+  if (!here) throw new Error(`could not find a FediPod account on ${podBaseOfWebId(session.webId)}`);
   const remote = new BrowserRemotePod(session, { webId: session.webId, role: "signup", log: () => {
   } });
-  const urls = { state };
-  const [cfg, doc] = await Promise.all([
-    readConfig(remote, urls),
-    readKeys(remote, urls)
-  ]);
-  if (!cfg) throw new Error(`could not read this account's config under ${state}`);
-  const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
-  return { remote, urls, cfg, doc, actorUrl };
+  const urls = { state: `${here.pod}${here.root}ap-state/` };
+  const doc = await readKeys(remote, urls);
+  const actorUrl = `${here.config.remotePod || here.pod}${here.config.root || here.root}ap/actor`;
+  return { remote, urls, cfg: here.config, doc, actorUrl };
 }
 window.fedipodUnlock = async (password) => {
   if (!password) throw new Error("Enter your password.");
@@ -33679,18 +34044,28 @@ function parseAddress(input) {
   if (!handle || !host || !host.includes(".")) return null;
   return { handle, host };
 }
-async function issuerForPod(pod) {
+async function issuerForActor(actorUrl) {
   try {
-    const authz = await readIssuer(`${pod}${AP_ROOT}ap/actor`);
+    const authz = await readIssuer(actorUrl);
     if (authz) return new URL(authz).origin;
   } catch {
   }
-  const u = new URL(pod);
-  if (u.pathname !== "/") return u.origin;
+  const u = new URL(actorUrl);
+  const own = await fetch(`${u.origin}/.well-known/openid-configuration`, { headers: { accept: "application/json" } }).catch(() => null);
+  if (own?.ok) return u.origin;
   const parent = u.host.split(".").slice(1).join(".");
   return `https://${parent || u.host}`;
 }
-async function podForFrontedAddress(handle) {
+async function actorForPodAddress(handle, host) {
+  const res = await fetch(
+    `https://${host}/.well-known/webfinger?resource=${encodeURIComponent(`acct:${handle}@${host}`)}`,
+    { headers: { accept: "application/jrd+json, application/json" } }
+  ).catch(() => null);
+  const doc = res?.ok ? await res.json().catch(() => ({})) : {};
+  const self2 = (doc.links || []).find((l) => l.rel === "self" && /activity\+json|ld\+json/u.test(l.type || ""));
+  return self2?.href || `https://${host}/fedipod/ap/actor`;
+}
+async function actorForFrontedAddress(handle) {
   const res = await fetch(
     `/.well-known/webfinger?resource=${encodeURIComponent(`acct:${handle}@${location.host}`)}`,
     { headers: { accept: "application/jrd+json, application/json" } }
@@ -33700,17 +34075,15 @@ async function podForFrontedAddress(handle) {
   const doc = await res.json().catch(() => ({}));
   const podActorId = (doc.aliases || []).find((a) => /\/ap\/actor$/u.test(String(a)));
   if (!podActorId) throw new Error(`@${handle}@${location.host} lives here but names no pod to sign in to`);
-  const tail = `${AP_ROOT}ap/actor`;
-  if (!podActorId.endsWith(tail)) throw new Error(`the pod actor ${podActorId} is not where a FediPod pod keeps one`);
-  return podActorId.slice(0, -tail.length);
+  return podActorId;
 }
 window.fedipodSignin = async ({ address }) => {
   const parsed = parseAddress(address);
   if (!parsed) throw new Error("Enter your address as @you@yourpod (for example @alice@alice.solidcommunity.net).");
   const bad = handleProblem(parsed.handle);
   if (bad) throw new Error(bad);
-  const pod = parsed.host === location.host.toLowerCase() ? await podForFrontedAddress(parsed.handle) : `https://${parsed.host}/`;
-  const issuer = await issuerForPod(pod);
+  const actor = parsed.host === location.host.toLowerCase() ? await actorForFrontedAddress(parsed.handle) : await actorForPodAddress(parsed.handle, parsed.host);
+  const issuer = await issuerForActor(actor);
   const { authorizationUrl } = await beginLogin({ issuer, redirectUri: REDIRECT });
   location.href = authorizationUrl;
 };
@@ -33754,6 +34127,7 @@ window.fedipodSignOut = async () => {
     }
     req.onsuccess = req.onerror = req.onblocked = () => res();
   });
+  await deleteWarm();
 };
 window.fedipodHandleProblem = handleProblem;
 if (typeof document !== "undefined") (async () => {
@@ -33949,6 +34323,8 @@ ${e.detail}` : "");
     $("brand").hidden = false;
     $("pane-form").hidden = false;
     $("signed-pod").textContent = signedPod;
+    $("container").placeholder = podRootPath(signedPod);
+    $("container-field").hidden = !!moveFrom;
     $("movein-note").hidden = !moveFrom;
     if (moveFrom) {
       $("movein-from").textContent = moveFrom.address;
@@ -33999,7 +34375,12 @@ ${e.detail}` : "");
     }
   };
   const shape = () => pathPod() || moveFrom ? "front" : f().shape.value;
-  const answers = () => ({ handle: f().handle.value.trim().toLowerCase(), shape: shape() });
+  const answers = () => ({ handle: f().handle.value.trim().toLowerCase(), shape: shape(), container: f().container.value.trim() });
+  const previewPlace = () => {
+    if (!signedPod) return;
+    const r = chosenRoot(signedPod, f().container.value);
+    $("place").textContent = r.problem ? "\u2026" : signedPod + r.root;
+  };
   const previewAddr = () => {
     const handle = f().handle.value.trim().toLowerCase();
     let host = "";
@@ -34030,6 +34411,7 @@ ${e.detail}` : "");
     applyMode();
     applyShape();
     previewAddr();
+    previewPlace();
   });
   applyMode();
   const STEP_IDS = ["step-1", "step-2"];
@@ -34043,6 +34425,8 @@ ${e.detail}` : "");
     if (n === 2) {
       applyShape();
       previewAddr();
+      previewPlace();
+      $("index-ask").hidden = true;
     }
     if (FOCUS[n]) $(FOCUS[n]).focus();
   };
@@ -34053,6 +34437,10 @@ ${e.detail}` : "");
   const validateStep2 = () => {
     const hp = window.fedipodHandleProblem(f().handle.value.trim().toLowerCase());
     if (hp) return `Fediverse handle: ${hp}`;
+    if (!moveFrom) {
+      const where = chosenRoot(signedPod, f().container.value).problem;
+      if (where) return `Where to store it: ${where}`;
+    }
     return null;
   };
   $("create").addEventListener("click", showForm);
@@ -34088,18 +34476,15 @@ ${e.detail}` : "");
     showLanding();
     goStep(1);
   });
-  const LABELS = { pod: "Checking your pod", keys: "Making your signing key", gateway: "Connecting your mail door" };
+  const LABELS = {
+    pod: "Checking your pod",
+    keys: "Making your signing key",
+    gateway: "Connecting your mail door",
+    place: "Recording where your account lives"
+  };
   const MOVE_LABELS = { pod: "Reading your account on your pod", gateway: "Taking your address here", keys: "Moving your key and account record" };
-  $("form").addEventListener("submit", async (e) => {
-    e.preventDefault();
-    $("form-error").textContent = "";
-    const e2 = validateStep2();
-    if (e2) {
-      $("form-error").textContent = e2;
-      goStep(2);
-      return;
-    }
-    const a = answers();
+  const run = async (createIndex = false) => {
+    const a = { ...answers(), ...createIndex ? { createIndex: true } : {} };
     $("pane-form").hidden = true;
     $("running").hidden = false;
     $("running-title").textContent = "Setting up\u2026";
@@ -34122,10 +34507,35 @@ ${e.detail}` : "");
       else await window.fedipodSignup({ ...a, onStep });
       location.href = "/admin/client/";
     } catch (err) {
+      if (err?.code === "needs-index") {
+        backToForm();
+        $("index-ask").hidden = false;
+        $("index-yes").focus();
+        return;
+      }
       $("running-title").textContent = "Setup did not finish";
       $("run-error").textContent = err.message || String(err);
       $("run-actions").hidden = false;
     }
+  };
+  $("form").addEventListener("submit", async (e) => {
+    e.preventDefault();
+    $("form-error").textContent = "";
+    const e2 = validateStep2();
+    if (e2) {
+      $("form-error").textContent = e2;
+      goStep(2);
+      return;
+    }
+    await run();
+  });
+  $("index-yes").addEventListener("click", () => {
+    $("index-ask").hidden = true;
+    run(true);
+  });
+  $("index-no").addEventListener("click", () => {
+    $("index-ask").hidden = true;
+    $("form-error").textContent = "Sign-up stopped. Nothing was written to your pod.";
   });
   if (pendingIdentity) await showIdentity();
 })();