fedipod 1.36.6 → 1.40.0

package/lib/core/wire.mjs

@@ -83,7 +83,8 @@ export const assertionKeyId = (urls) => urls.actor + '#ed25519-key';
 
 export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null, movedTo = null, kind = 'person',
   approveJoins = false, summary = null, icon = null, image = null, fields = [],
-  webId = null, aliases = [], moderators = null, pendingFollowers = null, pendingFollowing = null,
+  webId = null, aliases = [], moderators = null, pendingFollowers = null, pendingFollowing = null, liked = null,
+  ownerOutbox = null,
   blocked = null, inbox = null, outbox = null, oauthAuthorize = null, oauthToken = null,
   postingRestrictedToMods = null }) {
   // manuallyApprovesFollowers is NOT in the base AS2 context, so it is declared
@@ -119,6 +120,12 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
       blocked: { '@id': 'bl:blocked', '@type': '@id' },
     });
   }
+  if (ownerOutbox) {
+    context.push({
+      fedipod: 'https://fedipod.net/ns#',
+      ownerOutbox: { '@id': 'fedipod:ownerOutbox', '@type': '@id' },
+    });
+  }
   // The actor's other identities: the account's WebID, plus any aliases —
   // old accounts elsewhere whose servers check for their own URL here before
   // they will send a Move. Declared inline exactly as Mastodon declares it.
@@ -193,6 +200,12 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
     featured: urls.featured,
     followers: urls.followers,
     following: urls.following,
+    // What this actor has liked (§5.5). Its owner's to read, like the pending
+    // lists below.
+    ...(liked ? { liked } : {}),
+    // Every message this actor produced, as its owner reads it (§5.1), at an
+    // address the owner's own credential reaches.
+    ...(ownerOutbox ? { ownerOutbox } : {}),
     // FEP-1b12: attributedTo names the moderators collection; recipients
     // validate a group's announced moderation against it.
     ...(moderators ? { attributedTo: moderators } : {}),
@@ -252,12 +265,12 @@ export function tombstoneDoc(urls, deletedAt, kind = 'person') {
 // A deleted note is left as a Tombstone at its own URL — kept fetchable — so a
 // peer that dereferences it learns the post was DELETED rather than getting a
 // bare 404 it cannot tell from "never existed" (§7.4).
-export function noteTombstone(noteId, deletedAt) {
+export function noteTombstone(noteId, deletedAt, formerType = 'Note') {
   return {
     '@context': AS_CTX,
     id: noteId,
     type: 'Tombstone',
-    formerType: 'Note',
+    formerType,
     deleted: deletedAt,
   };
 }
@@ -418,25 +431,29 @@ export const FOLLOWERS_PAGE_SIZE = 20;
 export const followersPageId = (id, n) => `${id}-${n}`;
 export const followersPageCount = (total) => Math.max(1, Math.ceil(total / FOLLOWERS_PAGE_SIZE));
 
+// Newest first, as every OrderedCollection is (ActivityPub §5): `first` is the
+// page the newest names were added to and `next` walks back in time, and each
+// page lists its names newest first. The pages themselves are still filled
+// from the oldest end, so a new name rewrites one page.
 export function followersHead(id, total, pageCount = followersPageCount(total)) {
   const pages = Math.max(1, pageCount);
   return {
     '@context': AS_CTX,
     id, type: 'OrderedCollection',
     totalItems: total,
-    first: followersPageId(id, 1),
-    last: followersPageId(id, pages),
+    first: followersPageId(id, pages),
+    last: followersPageId(id, 1),
   };
 }
 
-export function followersPage(id, n, items, pageCount) {
+export function followersPage(id, n, items, pageCount) {    // eslint-disable-line no-unused-vars
   return {
     '@context': AS_CTX,
     id: followersPageId(id, n),
     type: 'OrderedCollectionPage',
     partOf: id,
-    orderedItems: items,
-    ...(n < pageCount ? { next: followersPageId(id, n + 1) } : {}),
+    orderedItems: [...items].reverse(),
+    ...(n > 1 ? { next: followersPageId(id, n - 1) } : {}),
   };
 }
 
@@ -775,12 +792,14 @@ export function followActivity({ urls, targetActor, serial }) {
   };
 }
 
-export function likeActivity({ urls, noteId, serial }) {
+// Addressed to the author of what is liked, the one it is delivered to.
+export function likeActivity({ urls, noteId, serial, to = null }) {
   return {
     '@context': AS_CTX,
     id: urls.actor + '#like-' + serial,
     type: 'Like',
     actor: urls.actor,
+    ...(to ? { to: [to] } : {}),
     object: noteId,
   };
 }
@@ -793,7 +812,7 @@ export function announceActivity({ urls, object, serial, published = new Date().
   audience = null }) {
   return {
     '@context': AS_CTX,
-    id: urls.actor + '#announce-' + serial,
+    id: announceActivityId(urls, serial),
     type: 'Announce',
     actor: urls.actor,
     published,
@@ -831,10 +850,20 @@ export function updateActorActivity({ urls, actor, serial, published = new Date(
 // `serial` names the activity when the note is not being edited — a quote
 // authorization arriving on it changes what the note says about its quote,
 // not what it says.
+// An edit's Update is named by when the edit was made, so whoever made it can
+// say its id before it exists; a restatement that is not an edit has no stamp.
+// Each is a document of its own beside the post, so it can be fetched by its
+// id (§3.1) once it is on the public record; a fragment of another document
+// could not be.
+export const updateActivityId = (noteId, updated) => noteId + '-update-' + String(updated).replace(/[^0-9TZ]/g, '');
+export const deleteActivityId = (noteId) => noteId + '-delete';
+export const announceActivityId = (urls, serial) => urls.notes + 'announce-' + serial;
+export const undoActivityId = (urls, serial) => urls.notes + 'undo-' + serial;
+
 export function updateActivity(note, urls, { serial = null } = {}) {
   return {
     '@context': AS_CTX,
-    id: note.id + '#update-' + (note.updated ? String(note.updated).replace(/[^0-9TZ]/g, '') : 'q' + (serial ?? Date.now())),
+    id: note.updated ? updateActivityId(note.id, note.updated) : note.id + '-update-q' + (serial ?? Date.now()),
     type: 'Update',
     actor: urls.actor,
     to: note.to, cc: note.cc,
@@ -842,23 +871,30 @@ export function updateActivity(note, urls, { serial = null } = {}) {
   };
 }
 
-export function deleteActivity({ urls, noteId }) {
+// Addressed as the post was, so a followers-only or direct post's deletion
+// reaches the people who had it and is not announced to anyone else.
+export function deleteActivity({ urls, noteId, to = [PUBLIC], cc = null }) {
   return {
     '@context': AS_CTX,
-    id: noteId + '#delete',
+    id: deleteActivityId(noteId),
     type: 'Delete',
     actor: urls.actor,
-    to: [PUBLIC],
+    to,
+    ...(cc?.length ? { cc } : {}),
     object: { id: noteId, type: 'Tombstone' },
   };
 }
 
+// Addressed as what it takes back was: an Undo goes to whoever had that.
 export function undoActivity({ urls, activity, serial }) {
+  const to = activity?.to ?? (activity?.type === 'Follow' && typeof activity.object === 'string' ? [activity.object] : null);
   return {
     '@context': AS_CTX,
-    id: urls.actor + '#undo-' + serial,
+    id: undoActivityId(urls, serial),
     type: 'Undo',
     actor: urls.actor,
+    ...(to ? { to } : {}),
+    ...(activity?.cc ? { cc: activity.cc } : {}),
     object: activity,
   };
 }

package/lib/device/admin/routes/lifecycle.mjs

@@ -111,7 +111,7 @@ export async function post(p, body, ctx, req, res) {   // eslint-disable-line no
         // A Move target nobody can resolve is a landing pad nobody lands on.
         if (!webfingerHost(urls.base) && !cfg.gateway?.frontActor) {
           return json(res, 400, {
-            error: 'this pod is a suffix-based host, so WebFinger cannot answer for it '
+            error: 'this pod is suffixed, so WebFinger cannot answer for it '
               + '— other servers could never resolve this account as a Move target',
           });
         }

package/lib/device/admin/routes/setup.mjs

@@ -13,6 +13,7 @@ import { copyPrivateHalf, isCurrent, CURRENT_LAYOUT } from '../../migrate.mjs';
 import { insecureUrlReason } from '../../../shared/safefetch.mjs';
 import { newRun, preflight, runSetup, setupInputError, hasCredential, credentialPath } from '../../setup.mjs';
 import { podLayout } from '../../../pod/root.mjs';
+import { chosenRoot, publicIndexKnown } from '../../../core/place.mjs';
 import { portFree, freePortFrom } from '../../ports.mjs';
 import { yieldDirectory } from '../../../gateway/directory.mjs';
 import { localFetch } from '../../../client/localapi.mjs';
@@ -115,7 +116,7 @@ export async function post(p, body, ctx, req, res) {   // eslint-disable-line no
     }
     // ---- setup, driven by the page at /admin/setup/ ----
     case '/setup/check': {
-      const pre = preflight(body);
+      const pre = { ...preflight(body), ...await placeCheck(body) };
       // For a new pod, ask the provider where it puts pods, so the page can
       // show the Gateway address before the pod exists. A provider on paths
       // means the address must live at the Gateway; the run decides for real.
@@ -410,3 +411,18 @@ export async function post(p, body, ctx, req, res) {   // eslint-disable-line no
     default: return false;
   }
 }
+
+// Where the data will go and whether the type index question has to be asked:
+// a pod you bring is read as a stranger would (its profile is public); a new
+// pod has no index, so the question is always asked for one.
+async function placeCheck(body) {
+  if (body.mode === 'new') return { typeIndex: false };
+  let base;
+  try { base = new URL(String(body.pod || '')).href; } catch { return {}; }
+  if (!base.endsWith('/')) base += '/';
+  const place = chosenRoot(base, body.container);
+  return {
+    typeIndex: await publicIndexKnown(fetch, base),
+    ...(place.problem ? { placeProblem: place.problem } : { place: base + place.root }),
+  };
+}

package/lib/device/cli/commands/setup.mjs

@@ -18,7 +18,10 @@ export async function setup() {
   if (process.stdin.isTTY && !has('cli') && !IDENTITY_FLAGS.some(f => args.includes('--' + f))) {
     return runBrowserSetup();
   }
-const root = flag('root') || 'fedipod/';   // new installs default to the fedipod/ container
+// Where on the pod: --root names it outright (scripts); otherwise the person
+// names the container that holds `fedipod/`, asked below once the pod is known.
+let root = flag('root') || null;
+const place = await import(new URL('../../../../lib/core/place.mjs', import.meta.url));
 const kind = has('group') ? 'group' : 'person';
 const approveJoins = has('group') && has('approve-joins');
 const summary = flag('summary');
@@ -48,10 +51,20 @@ if (!newAccount && !pod) {
   }
 }
 if (!newAccount && !pod) { console.error('no pod given'); process.exit(2); }
+const CONTAINER_Q = 'Store your data in a container named fedipod, inside this container';
+let container = flag('in');
 if (!newAccount) {
+  const podBase = pod.endsWith('/') ? pod : pod + '/';
+  if (!root) {
+    if (container == null) container = interactive ? await ask(`${CONTAINER_Q} (empty: ${new URL(podBase).pathname})`, '') : '';
+    const chosen = place.chosenRoot(podBase, container);
+    if (chosen.problem) { console.error(`Where to store it: ${chosen.problem}.`); process.exit(2); }
+    root = chosen.root;
+  }
   const { resourceExists } = await import(new URL('../../../../lib/pod/root.mjs', import.meta.url));
   const { apUrls, DEFAULT_ROOT: DR } = await import(new URL('../../../../lib/core/wire.mjs', import.meta.url));
-  if (await resourceExists(fetch, apUrls(pod, DR).actor)) {
+  // An account at the chosen place, or an older one where accounts used to go.
+  if (await resourceExists(fetch, apUrls(pod, root).actor) || await resourceExists(fetch, apUrls(pod, DR).actor)) {
     if (String(flag('address') || 'pod').toLowerCase() !== 'front') {
       console.error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
       console.error('To move an account whose address is at another gateway to this one, add --address front.');
@@ -115,8 +128,8 @@ if (fronted && kind === 'group') {
 // warning is their call to accept. Nobody could ever find this group, and the
 // people it would fail are not the operator reading the warning.
 if (kind === 'group' && !newAccount && !wfHost) {
-  console.error(`${pod} is a path on ${new URL(pod).host}, not the root of its own host.`);
-  console.error('WebFinger is answered only at a host root, so nobody could find this group.');
+  console.error(`${pod} is a suffixed pod, not a subdomained one.`);
+  console.error('WebFinger is answered only for a subdomained pod, so nobody could find this group.');
   console.error('Give the group a pod of its own:  fedipod setup --group --new-account');
   process.exit(2);
 }
@@ -133,6 +146,26 @@ if (fronted) {
   console.log(`pods at ${issuerHost}/${podName}/ instead cannot answer WebFinger for an address,`);
   console.log(`so setup takes an address at ${gatewayHost} for you and says so.\n`);
 }
+// Where the account lives is recorded in the pod's public type index. A new
+// pod has none; a pod you bring is asked. With none, only a yes goes on.
+let createIndex = has('create-type-index');
+if (!createIndex) {
+  const known = newAccount ? false : await place.publicIndexKnown(fetch, pod.endsWith('/') ? pod : pod + '/');
+  if (known !== true) {
+    const why = newAccount ? 'A new pod has no public type index' : 'Your pod has no public type index';
+    if (!interactive) {
+      console.error(`${why}. FediPod records where your account lives in one; add --create-type-index to make it.`);
+      process.exit(2);
+    }
+    const yes = await ask(`${why}, the list Solid apps use to find your things. FediPod needs one to record `
+      + 'where your account lives. Create it? It will be readable by anyone, like your profile. (y/n)', 'n');
+    if (!/^y/i.test(yes)) { console.log('Setup stopped. Nothing was written to your pod.'); process.exit(0); }
+    createIndex = true;
+  }
+}
+if (newAccount && !root && container == null) {
+  container = await ask(`${CONTAINER_Q} (empty: the new pod's root)`, '');
+}
 console.log('The display name can be changed later; the handle and pod cannot.');
 const go = await ask(newAccount
   ? (kind === 'group' ? 'create pod and group? (y/n)' : 'create pod and Fediverse account? (y/n)')
@@ -147,16 +180,21 @@ if (newAccount) {
   const made = await createAccountWithPod({ issuer, email, password, podName });
   pod = made.pod;
   console.log(`account + pod created: ${pod}`);
+  if (!root) {
+    const chosen = place.chosenRootInNewPod(pod.endsWith('/') ? pod : pod + '/', container);
+    if (chosen.problem) { console.error(`Where to store it: ${chosen.problem}. The pod was made; nothing else was.`); process.exit(2); }
+    root = chosen.root;
+  }
   if (!webfingerHost(pod)) {
     if (kind === 'group') {
-      console.log(`\n${issuerHost} created the pod at ${pod} — a suffix-based host.`);
-      console.log('WebFinger is answered only at a host root, so nobody could find this group.');
+      console.log(`\n${issuerHost} created the pod at ${pod} — a suffixed pod.`);
+      console.log('WebFinger is answered only for a subdomained pod, so nobody could find this group.');
       console.log('The pod exists; no actor was published.');
       process.exit(0);
     }
     // A path pod's address lives at the gateway; nothing to warn about.
     fronted = true;
-    console.log(`${issuerHost} puts pods on paths, so your address will be @${handle}@${gatewayHost}.`);
+    console.log(`${issuerHost} makes suffixed pods, so your address will be @${handle}@${gatewayHost}.`);
   }
 }
 
@@ -207,11 +245,15 @@ await agent.bootstrap({ handle, name, root, kind, approveJoins, summary, icon, g
 await agent.connect({ repair: false });   // publishProfile below is the publish
 await agent.publisher.publishProfile();
 await agent.store.flush();
+// Where the account lives, in the pod's public type index — made first on the yes.
+await place.recordPlace(agent.remote, rec.remotePod, `${rec.remotePod}${root}ap/actor`, { create: createIndex })
+  .then(() => console.log('recorded where the account lives in your public type index'))
+  .catch((e) => { console.error(`could not record where the account lives in your type index: ${e.message}`); process.exitCode = 1; });
 const finalHost = gatewayCfg ? gatewayHost : webfingerHost(rec.remotePod);
 const what = kind === 'group' ? 'group' : 'actor';
 console.log(finalHost
   ? `${what} published: @${handle}@${finalHost}`
-  : `${what} published, but not reachable as a handle \u2014 ${rec.remotePod} is not a host root`);
+  : `${what} published, but not reachable as a handle \u2014 ${rec.remotePod} is a suffixed pod`);
 
 // Straight into serving — setup ends with a working client in the browser.
 const { startAdmin } = await import(new URL('../../../../lib/device/admin/index.mjs', import.meta.url));

package/lib/device/cli/context.mjs

@@ -215,7 +215,7 @@ export async function finish(agent, code = 0) {
 // unpack-and-go line depend on that. At a terminal with none of them, setup
 // asks the two things it needs to open a browser and asks the rest there.
 export const IDENTITY_FLAGS = ['new-account', 'pod', 'issuer', 'email', 'name', 'pod-name',
-  'group', 'approve-joins', 'summary', 'icon', 'root', 'keys', 'rotate-key'];
+  'group', 'approve-joins', 'summary', 'icon', 'root', 'in', 'create-type-index', 'keys', 'rotate-key'];
 
 // Refuse before anything is asked, let alone typed: setup used to overwrite
 // credential.json in place, and a minted credential is only shown once — so

package/lib/device/migrate.mjs

@@ -65,7 +65,7 @@ export const MOVED_STATE_DOCS = new Set([
   'config.json', 'queue.json', 'blocklist.json', 'contacts.json', 'muted.json',
   'pending.json', 'requests.json', 'deadletter.json', 'statuses.json',
   'notifications.json', 'media.json', 'actors.json', 'ids.json', 'published.json',
-  'outbox.json', 'outbox-removed.json', 'parked.json', 'tagfeed.json',
+  'outbox.json', 'outbox-removed.json', 'outbox-own.json', 'liked.json', 'c2s-seen.json', 'parked.json', 'tagfeed.json',
   'intake-attempts.json', 'inbox-channel.json', 'masto-tokens.json', 'masto-markers.json',
   'lists.json', 'filters.json', 'scheduled.json', 'webpush.json',
   'import-state.json',

package/lib/device/setup.mjs

@@ -22,6 +22,7 @@ import { insecureUrlReason } from '../shared/safefetch.mjs';
 import { resourceExists } from '../pod/root.mjs';
 import { CURRENT_LAYOUT, isCurrent } from './migrate.mjs';
 import { completeGatewayMove } from './gateway-move.mjs';
+import { chosenRoot, chosenRootInNewPod, publicIndexKnown, recordPlace, needsIndex } from '../core/place.mjs';
 
 const SOLID = $rdf.Namespace('http://www.w3.org/ns/solid/terms#');
 
@@ -234,10 +235,14 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
     mode, issuer, email, password, handle, name, podName,
     kind = 'person', approveJoins = false, summary, icon, keys, uiPassword,
     gateway = null, shape = 'pod', gatewayOrigin = 'https://fedipod.net',
+    // The container that holds `fedipod/` (blank: the pod's root), and the
+    // person's yes to a new public type index when their profile names none.
+    container = '', createIndex = false,
   } = answers;
   let { pod, root } = answers;
-  if (!root) root = 'fedipod/';   // new installs default to the fedipod/ container; a
-  // resuming run overwrites this with the credential's own root below.
+  const rootGiven = !!root;
+  if (!root) root = 'fedipod/';   // until the pod is known; a resuming run
+  // overwrites this with the credential's own root below.
   let accountWebId = null;   // what createAccountWithPod reported, when it ran
   // The private half always starts here, beside the credential and the keys —
   // not on the pod. Every activity you receive would otherwise cost the pod
@@ -265,6 +270,9 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       skip('account', 'the credential is already on disk');
     } else if (mode === 'new') {
       begin('account');
+      // A new pod has no public type index: without a yes to making one,
+      // nothing is created at all.
+      if (!createIndex) throw needsIndex('A new pod has no public type index.');
       const made = await createAccount({ issuer, email, password, podName: podName || handle });
       pod = made.pod;
       accountWebId = made.webId || null;
@@ -273,10 +281,15 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       // nobody could ever find this group. A person was warned before we got
       // here and chose to continue; a group cannot.
       if (kind === 'group' && !webfingerHost(pod)) {
-        throw new Error(`${issuer} created the pod at ${pod} — a suffix-based host, `
-          + 'not a host root. WebFinger is only answered at a host root, so nobody '
+        throw new Error(`${issuer} created the pod at ${pod} — a suffixed pod. `
+          + 'WebFinger is only answered for a subdomained pod, so nobody '
           + 'could find this group. The pod exists; no actor was published.');
       }
+      if (!rootGiven) {
+        const place = chosenRootInNewPod(pod.endsWith('/') ? pod : pod + '/', container);
+        if (place.problem) throw new Error(`Where to store it: ${place.problem}.`);
+        root = place.root;
+      }
       done('account', pod);
     } else {
       // A pod you bring must be there and carry a usable WebID before a
@@ -284,7 +297,15 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       // reachable, and no silent 401 later on a pod whose profile is empty.
       const usable = await checkPod(pod);
       if (!usable.ok) throw new Error(usable.error);
-      const held = await (deps.resourceExists || resourceExists)(deps.fetch || fetch, apUrls(pod, root || DEFAULT_ROOT).actor);
+      const podBase = pod.endsWith('/') ? pod : pod + '/';
+      if (!rootGiven) {
+        const place = chosenRoot(podBase, container);
+        if (place.problem) throw new Error(`Where to store it: ${place.problem}.`);
+        root = place.root;
+      }
+      // An account at the chosen place, or an older one where accounts used to go.
+      const exists = (r) => (deps.resourceExists || resourceExists)(deps.fetch || fetch, apUrls(pod, r).actor);
+      const held = await exists(root) || (root !== DEFAULT_ROOT && await exists(DEFAULT_ROOT));
       if (held && !frontedAddress({ pod, shape })) {
         throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod. '
           + 'To move an account whose address is at another gateway to this one, ask for an address at this gateway.');
@@ -292,6 +313,12 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       if (held && kind === 'group') throw new Error('The pod already hosts a FediPod account, and a group cannot move between gateways.');
       movingIn = held;
       if (movingIn) { privateRoot = null; }
+      // Asked before anything is minted: a profile with no public type index
+      // gets one only on its person's yes.
+      if (!movingIn && !createIndex
+        && await (deps.publicIndexKnown || publicIndexKnown)(deps.fetch || fetch, podBase) !== true) {
+        throw needsIndex('Your profile names no public type index.');
+      }
       skip('account', movingIn ? 'the pod already holds the account — its address moves here' : 'using the pod you already have');
     }
 
@@ -366,8 +393,8 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
     let gatewayCfg = gateway;
     if (!gatewayCfg && frontedAddress({ pod, shape })) {
       if (kind === 'group') {
-        throw new Error(`a group needs a pod at its own host — a Gateway address for a group is not supported yet`
-          + (webfingerHost(pod) ? '' : `; ${pod} is a suffix-based host`) + '.');
+        throw new Error(`a group needs a subdomained pod — a Gateway address for a group is not supported yet`
+          + (webfingerHost(pod) ? '' : `; ${pod} is suffixed`) + '.');
       }
       const urls = apUrls(pod, root || DEFAULT_ROOT);
       const cred = JSON.parse(fs.readFileSync(credPath, 'utf8'));
@@ -414,6 +441,16 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
     }
     const published = await agent.publisher.publishProfile();
     await agent.store.flush();
+    // Where the account lives, in the owner's public type index — made first
+    // if they said yes to one.
+    if (!movingIn) {
+      const urlsAt = apUrls(pod, root);
+      try {
+        await (deps.recordPlace || recordPlace)(agent.publisher?.remote || agent.remote, urlsAt.base, urlsAt.home + 'ap/actor', { create: !!createIndex });
+      } catch (e) {
+        throw new Error(`could not record where the account lives in your type index (${e.message})`);
+      }
+    }
     if (movingIn) {
       // Tell the old gateway and the followers. Not fatal: left pending, it
       // is tried again when the agent next starts acting.
@@ -448,7 +485,7 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
     log(wfHost
       ? `${kind === 'group' ? 'group' : 'actor'} published: @${handle}@${wfHost}`
       : `${kind === 'group' ? 'group' : 'actor'} published, but not reachable as a handle — `
-        + `${pod} is not a host root`);
+        + `${pod} is a suffixed pod`);
   } catch (e) {
     for (const s of run.steps) if (s.state === 'running') s.state = 'error';
     run.error = scrub(e.message);

package/lib/gateway/account-agent.mjs

@@ -0,0 +1,111 @@
+// account-agent.mjs — an account's agent, put together at the gateway for as
+// long as one piece of work takes: a keeper run (keeper.mjs), or a request from
+// a Mastodon app (masto-gateway.mjs).
+//
+// It works with the gateway's own pod identity and nothing else, which the
+// owner's app named in the rules on the account's folder. The account's state
+// is its copy at the gateway when there is one (copy.mjs), and the pod when
+// there is not. The signing key is read from the pod when it is needed, never
+// kept, never made.
+import crypto from 'node:crypto';
+import { PodTransport } from '../pod/transport.mjs';
+import { podBaseOfWebId } from '../pod/urls.mjs';
+import { apUrls } from '../core/wire.mjs';
+import { PodStore } from '../core/store.mjs';
+import { HttpStorage } from '../core/storage.mjs';
+import { Lease } from '../core/lease.mjs';
+import { Deliverer } from '../core/deliver.mjs';
+import { Publisher } from '../core/publisher/index.mjs';
+import { Intake } from '../core/intake/index.mjs';
+import { C2S } from '../client/c2s.mjs';
+import { keeperSession } from './keeper-session.mjs';
+import { CopyStorage, copyMeta, copyLease, keptBefore, GATEWAY_HOLDER } from './copy.mjs';
+
+const RSA_ALG = { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' };
+
+// The account's signing key, as its owner's pod holds it. A key the pod does
+// not hold in the open (a sealed one from before 1.28.0) cannot be used here.
+async function podKeys(store) {
+  const rec = store.read('keys.json', null);
+  if (!rec?.rsa?.privatePem || !rec.rsa.publicPem) return null;
+  const der = crypto.createPrivateKey(rec.rsa.privatePem).export({ type: 'pkcs8', format: 'der' });
+  return {
+    rsaPrivate: await crypto.subtle.importKey('pkcs8', der, RSA_ALG, true, ['sign']),
+    rsaPublicPem: rec.rsa.publicPem,
+  };
+}
+
+/**
+ * Where the account is, and a transport to its pod as the gateway. Returns
+ * { remote, podFetch, urls, inCopy } or { skipped } when this gateway cannot
+ * act for it.
+ */
+export async function reachAccount(ctx, handle, rec, { log = console.log, session = null } = {}) {
+  if (!rec?.keeper || !ctx.keeperWebId || !(session || ctx.keeperCredential)) return { skipped: 'not kept' };
+  if (keptBefore(ctx, rec)) return { skipped: 'kept under the gateway\'s former identity; the owner\'s FediPod moves it over on its next start' };
+  if (!rec.webId || !rec.podHome) return { skipped: 'the row names no owner or pod' };
+  const remote = new PodTransport(session || keeperSession(ctx.keeperCredential), {
+    webId: ctx.keeperWebId, log, role: 'keeper', runtime: 'node', cooldownMode: 'refuse',
+  });
+  // Any rule it writes names the owner, and itself beside them.
+  remote.aclOwner = rec.webId;
+  remote.keepers = [ctx.keeperWebId];
+  remote.aclIfChanged = true;
+  const pod = podBaseOfWebId(rec.webId);
+  const root = rec.podHome.startsWith(pod) ? rec.podHome.slice(pod.length) : null;
+  if (root === null) return { skipped: 'the row\'s folder is not on the owner\'s pod' };
+  const inCopy = !!(ctx.copyKv && await copyMeta(ctx.copyKv, handle));
+  return { remote, podFetch: (u, i) => remote.fetch(u, i), pod, root, urls: apUrls(pod, root), inCopy };
+}
+
+/**
+ * The account's state store and lease, as `holder`: over the copy when there
+ * is one, else over the pod.
+ */
+export function stateAndLease(ctx, handle, at, { log = console.log, holder = GATEWAY_HOLDER } = {}) {
+  const podState = new HttpStorage(at.urls.state, at.podFetch);
+  if (at.inCopy) {
+    return {
+      // Of what stays on the pod, only the key: one read per piece of work.
+      store: new PodStore({ storage: new CopyStorage(ctx.copyKv, handle, { holder, pod: podState, podNames: ['keys.json'] }), log }),
+      lease: copyLease(ctx.copyKv, handle, { id: holder, log }),
+    };
+  }
+  return {
+    store: new PodStore({ storage: podState, log }),
+    lease: new Lease({ url: at.urls.state + 'lease.json', fetchImpl: at.podFetch, log, id: `keeper:${ctx.keeperWebId}` }),
+  };
+}
+
+/**
+ * The acting pieces over a loaded store: the same ids the owner's app uses
+ * (a fronted account advertises the gateway's, and every request is mapped
+ * back onto the pod), the key from the pod, a deliverer that sends only when
+ * asked, a publisher, and the intake. Returns the agent, or { skipped }.
+ */
+export async function actingAgent(at, store, lease, { log = console.log, push = false } = {}) {
+  const config = store.getConfig();
+  if (!config) return { skipped: 'no account on the pod' };
+  const publicBase = config.gateway?.frontActor ? config.gateway.frontActor.replace(/ap\/actor\/?$/u, '') : null;
+  const urls = apUrls(at.pod, config.root || at.root, { publicBase });
+  if (urls.toPod) at.remote.setUrlMap(urls.toPod);
+  const keys = await podKeys(store);
+  if (!keys) return { skipped: 'the signing key is not readable on the pod' };
+  const deliverer = new Deliverer({
+    store, rsaPrivate: keys.rsaPrivate, keyId: urls.actor + '#main-key', actorId: urls.actor, log, passive: true,
+  });
+  const publisher = new Publisher({ config, remote: at.remote, store, deliverer, publicKeyPem: keys.rsaPublicPem, log });
+  deliverer.onGone = () => publisher.publishCollections({ followers: true });
+  // What the owner's own posts, taken at the outbox door, need of an agent.
+  const agent = {
+    store, publisher, deliverer, remote: at.remote, urls, config, lease, intake: null, viewer: false,
+    configured: () => true, requestTakeover: async () => true,
+  };
+  const c2s = new C2S({ agent, log });
+  agent.intake = new Intake({
+    config, urls, remote: at.remote, store, deliverer, publisher, log, lease, push,
+    ownerPost: (a, o) => c2s.dispatch(a, o),
+  });
+  publisher.resolveActor = (u) => agent.intake.fetchAP(u);
+  return agent;
+}