fedipod 1.6.0 → 1.8.0

package/README.md

@@ -9,15 +9,14 @@ one timeline. Your posts, followers and settings stay on your pod.
 The easiest way to run FediPod is to use it in any browser at https://fedipod.net. Nothing to install. A wizard will walk you through getting a pod (you can also bring your own) and creating a Fediverse identity attached to the pod.  
 
 There are also a number of [other ways to run FediPod](#other-ways-to-run-fedipod) which offer a variety of scenarios.  If interested in the code, see also : [architecture overview](architecture.md) and [files overview](files-overview.md).
+Which specs FediPod follows, and where it stops short: [specs-in-use.md](specs-in-use.md).
 
 ## Requirements
 
 - A current browser, on a desktop or a phone.
 - A Solid pod with a host name of its own, such as
   `https://alice.solidcommunity.net/`. Sign-up can create one for you at
-  solidcommunity.net or another provider, or use a pod you already have. A
-  pod that lives on a suffix-based host, like `https://server.example/alice/`,
-  cannot be a Fediverse address.
+  solidcommunity.net or another provider, or use a pod you already have.
   A pod on a suffix-based host, like `https://server.example/alice/`,
   works too. Its address is then `@handle@fedipod.net`, because the shared
   host cannot answer for the handle; your posts, key and data stay on your pod.
@@ -41,6 +40,8 @@ There are also a number of [other ways to run FediPod](#other-ways-to-run-fedipo
 Your account then opens in the client. To use it from another browser, go to
 https://fedipod.net, enter your address, sign in at your pod, and unlock your
 key with your password once on that browser.
+If you have changed your pod password since you signed up, choose "make a new
+signing key" on that screen and use the password you use now.
 
 ## What you can do
 
@@ -70,6 +71,11 @@ hands back stays in your browser unless you choose to keep it on your pod.
 domain blocks import from the manage page. Your old account can be listed as
 an alias, so a Move from it lands here.
 
+**Posting from another app.** Any app that speaks ActivityPub
+client-to-server, dokieli for one, can post as you. It sends to the outbox
+address in your actor document, which your WebID profile also names, signed in
+at your pod. The post goes out the next time you open fedipod.net.
+
 **The manage page.** `manage account` in the bar opens it: your profile,
 aliases, the gateway, key rotation, recovering posts, parking, moving to
 another server, retiring, and clearing a backlog. It is the same interface

package/device-agent.md

@@ -0,0 +1,99 @@
+# The DeviceAgent
+
+FediPod can also run as a program on your own machine, in front of the same
+kind of pod. It does everything the browser version at fedipod.net does, plus
+what a browser tab cannot: it keeps running while no tab is open, so scheduled
+posts go out and push notifications reach you; it serves the Mastodon streaming
+API, so clients update live; any Mastodon client, phone app or desktop, can
+connect to it; and it can host a [group](groups.md).
+
+## Requirements
+
+- Node 20 or newer.
+- A Solid pod, either with a host name of its own, such as
+  `https://alice.solidcommunity.net/`, or on a suffix-based host, such as
+  `https://server.example/alice/`. A pod at its own host carries its address on
+  the pod; a pod on a suffix-based host takes its address at a gateway,
+  `@handle@fedipod.net`, with the posts, key and data staying on the pod.
+- Followers-only and direct posts need a pod that enforces WAC access control;
+  on one that does not, the composer refuses those two and says why.
+- While the agent is off, your mail waits on your pod's host. Run it as a
+  service, or attach to a gateway, so it does not pile up there.
+
+## Installing
+
+```
+npm install -g fedipod
+```
+
+## Running
+
+Run `fedipod start`. Add a port to change the local agent's port, for example
+`fedipod start --port 8081`; the default is 8030. Then point any browser at
+`https://localhost:8030`, or the port you chose, and the setup pages take it
+from there.
+
+## Running as a service
+
+```
+fedipod install-service
+```
+
+It registers every identity on this machine, one service each, so all of your
+actors start at boot. An identity running in a terminal is stopped and taken
+over by its service. `fedipod uninstall-service` reverses it.
+
+## Managing
+
+Posts, logs, parking, moving, transferring and the rest are on the
+[admin interface](gui.md); starting, stopping and what a page cannot do are in
+[CLI admin](cli.md). The admin tools also create other actors, groups or
+persons. You may have as many as you want on one machine, each with a pod of
+its own.
+
+Every agent checks once a day whether a newer FediPod is published. When one
+exists, the record page offers **Update**, and `fedipod update` does the same
+from the terminal. `AP_UPDATE_CHECK=0` turns the check off.
+
+## A gateway account
+
+Most of what a Fediverse inbox receives is broadcast noise. A
+[gateway](gateway.md) is a shared, always-on door that verifies each delivery,
+drops the junk, and passes the rest to your pod, while your key and data stay
+on your pod. There is a free one at [fedipod.net](https://fedipod.net/).
+Attaching or detaching is a few wizard-guided clicks from your agent, and it
+takes the mail load off your pod's host.
+
+## Clients
+
+The bundled client is [Phanpy](https://github.com/cheeaun/phanpy) (MIT, by
+Chee Aun), served by the agent itself, and logging in is one click. If you
+ever enter the instance by hand, use the address on the record's **local
+host** row.
+
+- **Other web clients**: drop any static Mastodon client dist into
+  `ui/<name>/` and it is served at `/<name>/`; see `ui/README.md`.
+- **Desktop and phone clients** (Tuba, Whalebird, and the like): add
+  `https://localhost:8030`, or your agent's port, as a custom instance.
+- **Streaming**: the agent serves the Mastodon streaming API at
+  `/api/v1/streaming`, so clients update live instead of polling.
+- **Web push**: notifications reach you while the client is closed.
+- **Scheduled posts** go out at the time you picked.
+
+Polls, content warnings, editing, all four visibility levels, direct
+messages, bookmarks, favourites, lists, keyword filters, pinned posts,
+blocking and muting, and custom emojis work as in the browser version.
+
+## Bluesky, and your other Fediverse accounts
+
+A Bluesky connection lets the agent drive an existing Bluesky, or other
+ATProto, account alongside your Fediverse identity: public posts are
+cross-posted as a mirror, with a toggle to turn it off; Bluesky replies and
+activity flow into your timeline; you can like, boost and reply to Bluesky
+posts. Direct messages to Bluesky are not supported.
+
+An account on Mastodon or any server speaking the Mastodon API can be
+connected from the **Other identities** row of the admin page. Its home
+timeline and notifications join your feed, a post both accounts see appears
+once, and favouriting, boosting and replying act as the account the post came
+through. The token it hands back stays on this machine.

package/gateway.md

@@ -10,6 +10,9 @@ Your name, your signing key and your data stay on your own pod. The gateway is
 **keyless** — it never holds the key you sign with, so it cannot post as you,
 read your private things, or be you anywhere. The worst a broken one can do is
 push items into your inbox, and those still face your agent's own checks.
+With the outbox door below, a gateway can also hand your agent a post marked as
+yours, which your agent then signs and sends. It still holds no key, but what you
+trust it with grows by that much.
 
 A FediPod install works without any gateway at all. Deliveries go straight to
 your pod inbox, which holds them whether your agent is running or not.
@@ -102,6 +105,19 @@ yourself. When you attach to a multi-user gateway, the direction is reversed:
 the gateway mints the secret and answers the attach with it, and your agent
 records it.
 
+## The outbox door
+
+The gateway also takes your own posts from any app that speaks ActivityPub
+client-to-server, dokieli for one. Your actor document names the door as your
+outbox, and your WebID profile names it as `as:outbox`. The app sends the post
+there, signed in at your pod. The door checks that the token is yours, puts the
+post in your inbox marked as yours, and answers with the address the post will
+have. Your agent publishes it and sends it to your followers the next time it
+runs: for a browser account, the next time you open the site.
+
+A post with no audience of its own goes out as a public post. A post that is
+not a note, an annotation say, is kept as the app sent it, under your name.
+
 ## What the gateway can see
 
 It reads only public data to decide what concerns you: your published

package/groups.md

@@ -59,7 +59,7 @@ A followed group's own announced deletion of a post it carried to you is honoure
 ## Inviting people
 
 A group has a page anyone can open, at `ap/profile.html` under its pod's
-app container — `<pod>/activitypods-js/ap/profile.html`. It
+app container — `<pod>/fedipod/ap/profile.html`. It
 carries the group's address and a Follow box that sends a visitor to their
 own server's follow screen, so it is the link to put where people will find
 it. Posts the group carries appear in members' timelines as the group

package/gui.md

@@ -46,7 +46,7 @@ its own port.
 ## Sharing an account
 
 Each identity has a page anyone can open, at `ap/profile.html` under its pod
-— for example `https://your-pod.example/activitypods-js/ap/profile.html`. It
+— for example `https://your-pod.example/fedipod/ap/profile.html`. It
 shows the name, bio and address, and offers a Follow box: a visitor types
 their own server and lands on that server's follow screen. Hand out that
 link, or the `@name@host` address itself, which works in the search box of

package/lib/client/c2s.mjs

@@ -8,6 +8,11 @@
 // GETs on the actor and outbox are redirects: the pod's documents are the
 // canonical ones, and a second renderer here would only drift from them.
 //
+// `dispatch` takes an activity and answers with { status, body, headers }; it
+// touches no request or response. The HTTP handler below is one caller. The
+// other is the inbox drain, handing over an activity the Gateway took at the
+// outbox door on the owner's behalf and stamped as theirs.
+//
 // The inbox is the exception, and has to be. Deliveries land in a container on
 // the pod which the drain empties as it handles each item, so reading that
 // container tells the owner only what has not been dealt with yet. What was
@@ -18,6 +23,7 @@
 import * as social from '../core/social.mjs';
 import * as wire from '../core/wire.mjs';
 import { readLenient } from '../core/as2.mjs';
+import { safeSlug } from '../core/publisher/notes.mjs';
 
 const MAX_BODY = 512 * 1024;          // same ceiling the inbox drain enforces
 
@@ -154,7 +160,10 @@ export class C2S {
   async handle(req, res, pathname, url) {   // eslint-disable-line no-unused-vars
     if (pathname !== '/ap/outbox' && pathname !== '/ap/actor' && pathname !== '/ap/inbox') return false;
     if (req.method === 'OPTIONS') {
-      res.writeHead(204, { allow: pathname === '/ap/inbox' ? 'GET, OPTIONS' : 'GET, POST, OPTIONS' });
+      // Accept-Post is what a client such as dokieli reads to choose a format;
+      // naming JSON only is what makes it send JSON-LD rather than HTML.
+      res.writeHead(204, pathname === '/ap/inbox' ? { allow: 'GET, OPTIONS' }
+        : { allow: 'GET, POST, OPTIONS', 'accept-post': 'application/ld+json, application/activity+json' });
       res.end(); return true;
     }
     if (!this.agent.configured() || !this.urls) {
@@ -196,9 +205,16 @@ export class C2S {
     // takes decisions from it and the publisher builds the document that is
     // actually posted, so nothing a client sent is republished verbatim and a
     // term it aliased still means what it says.
-    let activity;
+    // `raw` is the document as the client wrote it. The graph is what
+    // decisions are taken from; the bytes are what an object that is stored
+    // as sent (publishObject) is stored from — a read against our contexts
+    // rewrites a stranger's terms to full IRIs, which is right for reading and
+    // wrong for keeping.
+    let activity; let raw = null;
     try {
-      const read = await readLenient(await readBody(req));
+      const body = await readBody(req);
+      try { raw = JSON.parse(body); } catch { raw = null; }
+      const read = await readLenient(body);
       activity = read.view ?? read.doc;
     } catch (e) {
       return this.send(res, 400, { error: `unreadable body: ${e.message}` });
@@ -206,34 +222,47 @@ export class C2S {
     if (!activity || typeof activity !== 'object' || Array.isArray(activity) || !activity.type) {
       return this.send(res, 400, { error: 'a typed ActivityStreams object is required' });
     }
-    // A bare object arrives without an activity around it; the server supplies
-    // the Create (§6.2.1), carrying the object's own addressing up onto it.
-    if (!ACTIVITY_TYPES.has(activity.type)) {
-      activity = { type: 'Create', object: activity, to: activity.to, cc: activity.cc };
-    }
-
-    try {
-      return await this.dispatch(res, activity);
-    } catch (e) {
-      this.log(`c2s ${activity.type}: ${e.message}`);
-      return this.send(res, 422, { error: e.message || String(e) });
-    }
+    // The name the client asks for its new document (LDP's Slug), taken when
+    // it is plain and free — it is what lets the client know the address of
+    // what it made before anything answers.
+    const slug = safeSlug(req.headers.slug) || null;
+    const r = await this.dispatch(activity, { slug, raw });
+    return this.send(res, r.status, r.body, r.headers);
   }
 
   // Addressing → the facade's four visibilities, inverting the table the
-  // composer writes (wire.noteDoc). Addressing is required: a post whose
-  // audience the client never stated is not guessed at in either direction.
+  // composer writes (wire.addressing). Nothing stated is a public post — what
+  // every client means by a post with no audience chosen, and what a client
+  // that never addresses (dokieli's annotations) needs.
   visibilityOf(activity, object) {
     const to = arr(activity.to ?? object?.to).map(idOf);
     const cc = arr(activity.cc ?? object?.cc).map(idOf);
-    if (!to.length && !cc.length) return null;
+    if (!to.length && !cc.length) return 'public';
     if (to.includes(wire.PUBLIC)) return 'public';
     if (cc.includes(wire.PUBLIC)) return 'unlisted';
     if (to.includes(this.urls.followers)) return 'private';
     return 'direct';
   }
 
-  async dispatch(res, activity) {
+  async dispatch(activity, { slug = null, raw = null } = {}) {
+    const reply = (status, body, headers = {}) => ({ status, body, headers });
+    if (!activity || typeof activity !== 'object' || Array.isArray(activity) || !activity.type) {
+      return reply(400, { error: 'a typed ActivityStreams object is required' });
+    }
+    // A bare object arrives without an activity around it; the server supplies
+    // the Create (§6.2.1), carrying the object's own addressing up onto it.
+    if (!ACTIVITY_TYPES.has(activity.type)) {
+      activity = { type: 'Create', object: activity, to: activity.to, cc: activity.cc };
+    }
+    try {
+      return await this._dispatch(activity, { slug, raw, reply });
+    } catch (e) {
+      this.log(`c2s ${activity?.type}: ${e.message}`);
+      return reply(422, { error: e.message || String(e) });
+    }
+  }
+
+  async _dispatch(activity, { slug, raw, reply }) {
     const agent = this.agent;
     const object = typeof activity.object === 'object' && activity.object !== null
       ? activity.object : null;
@@ -242,18 +271,22 @@ export class C2S {
     switch (activity.type) {
       case 'Create': {
         const makes = object?.type || 'Note';
-        if (!object || (makes !== 'Note' && makes !== 'Question')) {
-          return this.send(res, 422, { error: 'only a Note or a Question (or a bare Note) can be created here' });
-        }
+        if (!object) return reply(422, { error: 'a Create carries the object it creates' });
         const visibility = this.visibilityOf(activity, object);
-        if (!visibility) {
-          return this.send(res, 400, { error: 'state the audience: to/cc must address someone (as:Public, your followers collection, or actors)' });
+        // Not a Note and not a poll: stored as sent, under this actor, and
+        // the Create around it delivered — a Web Annotation, for one.
+        if (makes !== 'Note' && makes !== 'Question') {
+          const asSent = raw && typeof raw === 'object' && !Array.isArray(raw)
+            ? (ACTIVITY_TYPES.has(raw.type) ? (raw.object && typeof raw.object === 'object' ? raw.object : null) : raw)
+            : null;
+          const made = await agent.publisher.publishObject(asSent || object, { visibility, slug });
+          return reply(201, { id: made.createId, object: made.id }, { location: made.createId });
         }
         // `source.content` is the client's plain text when it sends one; bare
         // `content` is TREATED as plain text and escaped — markup survives as
         // visible characters rather than as markup. Documented v1 limit.
         const text = String(object.source?.content ?? object.content ?? '');
-        if (!text.trim()) return this.send(res, 422, { error: 'the note has no content' });
+        if (!text.trim()) return reply(422, { error: 'the note has no content' });
 
         // A Question is a poll: the choices are in oneOf (pick one) or anyOf
         // (pick several), each naming itself, and endTime is when it shuts.
@@ -270,11 +303,11 @@ export class C2S {
               visibility,
               spoilerText: object.summary || null,
             });
-            return this.send(res, 201,
+            return reply(201,
               { id: wire.createActivityId(question.id), object: question.id },
               { location: wire.createActivityId(question.id) });
           } catch (e) {
-            return this.send(res, 422, { error: e.message });
+            return reply(422, { error: e.message });
           }
         }
 
@@ -287,22 +320,23 @@ export class C2S {
           attachments,
           visibility,
           spoilerText: object.summary || null,
+          slug,
         });
-        return this.send(res, 201, { id: wire.createActivityId(note.id), object: note.id },
+        return reply(201, { id: wire.createActivityId(note.id), object: note.id },
           { location: wire.createActivityId(note.id) });
       }
 
       case 'Update': {
         if (objectId === this.urls.actor) {
-          return this.send(res, 422, { error: 'edit the profile on the admin surface; actor updates are not taken here' });
+          return reply(422, { error: 'edit the profile on the admin surface; actor updates are not taken here' });
         }
         const s = this.byIri(objectId);
-        if (!s) return this.send(res, 404, { error: 'no such note here' });
+        if (!s) return reply(404, { error: 'no such note here' });
         if (s.actor !== this.urls.actor || s.kind !== 'post') {
-          return this.send(res, 403, { error: 'not your note' });
+          return reply(403, { error: 'not your note' });
         }
         const text = String(object?.source?.content ?? object?.content ?? '');
-        if (!text.trim()) return this.send(res, 422, { error: 'the edit has no content' });
+        if (!text.trim()) return reply(422, { error: 'the edit has no content' });
         const attachments = object?.attachment !== undefined
           ? arr(object.attachment).map((a) => ({
             url: a?.url, mediaType: a?.mediaType,
@@ -312,52 +346,52 @@ export class C2S {
         await agent.publisher.updateNote(s, {
           content: text, spoilerText: object?.summary || null, attachments,
         });
-        return this.send(res, 200, { ok: true, object: s.noteId });
+        return reply(200, { ok: true, object: s.noteId });
       }
 
       case 'Delete': {
         if (objectId === this.urls.actor) {
-          return this.send(res, 422, { error: 'retiring the actor is done on the admin surface, where it asks twice' });
+          return reply(422, { error: 'retiring the actor is done on the admin surface, where it asks twice' });
         }
         const s = this.byIri(objectId);
-        if (!s) return this.send(res, 404, { error: 'no such note here' });
+        if (!s) return reply(404, { error: 'no such note here' });
         if (s.actor !== this.urls.actor || s.kind !== 'post') {
-          return this.send(res, 403, { error: 'not your note' });
+          return reply(403, { error: 'not your note' });
         }
         const r = await social.deleteNote(agent, s);
-        if (!r.ok) return this.send(res, 502, { error: r.error, stillPublished: r.stillPublished });
-        return this.send(res, 200, { ok: true });
+        if (!r.ok) return reply(502, { error: r.error, stillPublished: r.stillPublished });
+        return reply(200, { ok: true });
       }
 
       case 'Follow': {
-        if (!objectId) return this.send(res, 400, { error: 'whom? object must name an actor' });
+        if (!objectId) return reply(400, { error: 'whom? object must name an actor' });
         // An acct: form or bare handle resolves through WebFinger; an https
         // IRI is fetched directly.
         if (/^acct:|^@|^[^/@]+@[^/@]+$/.test(objectId) && !/^https?:/.test(objectId)) {
           const r = await social.followHandle(agent, objectId.replace(/^acct:/, ''));
           const rec = this.store.getContacts().following.find((f) => f.actor === r.actor);
-          return this.send(res, 201, { id: rec?.followActivity?.id, object: r.actor },
+          return reply(201, { id: rec?.followActivity?.id, object: r.actor },
             rec?.followActivity?.id ? { location: rec.followActivity.id } : {});
         }
         const doc = await social.followActor(agent, objectId);
         const rec = this.store.getContacts().following.find((f) => f.actor === doc.id);
-        return this.send(res, 201, { id: rec?.followActivity?.id, object: doc.id },
+        return reply(201, { id: rec?.followActivity?.id, object: doc.id },
           rec?.followActivity?.id ? { location: rec.followActivity.id } : {});
       }
 
       case 'Like': {
         const s = this.byIri(objectId);
-        if (!s) return this.send(res, 422, { error: 'that note is not held here — like what the timeline holds' });
+        if (!s) return reply(422, { error: 'that note is not held here — like what the timeline holds' });
         const updated = await social.favourite(agent, s);
-        return this.send(res, 201, { id: updated.likeActivity?.id, object: s.noteId },
+        return reply(201, { id: updated.likeActivity?.id, object: s.noteId },
           updated.likeActivity?.id ? { location: updated.likeActivity.id } : {});
       }
 
       case 'Announce': {
         const s = this.byIri(objectId);
-        if (!s) return this.send(res, 422, { error: 'that note is not held here — boost what the timeline holds' });
+        if (!s) return reply(422, { error: 'that note is not held here — boost what the timeline holds' });
         const updated = await social.reblog(agent, s);
-        return this.send(res, 201, { id: updated.announceActivity?.id, object: s.noteId },
+        return reply(201, { id: updated.announceActivity?.id, object: s.noteId },
           updated.announceActivity?.id ? { location: updated.announceActivity.id } : {});
       }
 
@@ -368,37 +402,37 @@ export class C2S {
         const innerId = idOf(activity.object);
         if (inner?.type === 'Block') {
           const target = idOf(inner.object);
-          if (!target) return this.send(res, 400, { error: 'unblock whom?' });
+          if (!target) return reply(400, { error: 'unblock whom?' });
           await social.unblockActor(agent, target);
-          return this.send(res, 200, { ok: true, object: target });
+          return reply(200, { ok: true, object: target });
         }
         const statuses = this.store.getStatuses();
         let s = innerId ? statuses.find((x) => x.likeActivity?.id === innerId) : null;
         if (!s && inner?.type === 'Like') s = this.byIri(idOf(inner.object));
         if (s?.favourited) {
           const updated = await social.unfavourite(agent, s);
-          return this.send(res, 200, { ok: true, object: updated.noteId });
+          return reply(200, { ok: true, object: updated.noteId });
         }
         s = innerId ? statuses.find((x) => x.announceActivity?.id === innerId) : null;
         if (!s && inner?.type === 'Announce') s = this.byIri(idOf(inner.object));
         if (s?.reblogged) {
           const updated = await social.unreblog(agent, s);
-          return this.send(res, 200, { ok: true, object: updated.noteId });
+          return reply(200, { ok: true, object: updated.noteId });
         }
         const following = this.store.getContacts().following;
         const rec = following.find((f) => f.followActivity?.id === innerId)
           || (inner?.type === 'Follow' ? following.find((f) => f.actor === idOf(inner.object)) : null);
         if (rec) {
           await social.unfollowActor(agent, rec.actor);
-          return this.send(res, 200, { ok: true, object: rec.actor });
+          return reply(200, { ok: true, object: rec.actor });
         }
-        return this.send(res, 422, { error: 'nothing here matches what that Undo names' });
+        return reply(422, { error: 'nothing here matches what that Undo names' });
       }
 
       case 'Block': {
-        if (!objectId) return this.send(res, 400, { error: 'block whom? object must name an actor' });
+        if (!objectId) return reply(400, { error: 'block whom? object must name an actor' });
         await social.blockActor(agent, objectId);
-        return this.send(res, 200, { ok: true, object: objectId });
+        return reply(200, { ok: true, object: objectId });
       }
 
       case 'Add':
@@ -406,12 +440,12 @@ export class C2S {
         // The one collection a client may edit is the pins (§7.6/§7.9 in the
         // other direction): target must be the featured collection.
         if (idOf(activity.target) !== this.urls.featured) {
-          return this.send(res, 422, { error: 'the featured collection is the one Add/Remove edits here' });
+          return reply(422, { error: 'the featured collection is the one Add/Remove edits here' });
         }
         const s = this.byIri(objectId);
-        if (!s) return this.send(res, 404, { error: 'no such note here' });
+        if (!s) return reply(404, { error: 'no such note here' });
         const updated = await social.pinStatus(agent, s, activity.type === 'Add');
-        return this.send(res, 200, { ok: true, object: updated.noteId, pinned: !!updated.pinned });
+        return reply(200, { ok: true, object: updated.noteId, pinned: !!updated.pinned });
       }
 
       case 'Accept':
@@ -419,19 +453,19 @@ export class C2S {
         // Answering a held follow request: the object is the Follow (or the
         // requester). Which request is meant comes from the Follow's actor.
         const requester = object?.actor ? idOf(object.actor) : objectId;
-        if (!requester) return this.send(res, 400, { error: 'whose request? object must name the Follow or its actor' });
+        if (!requester) return reply(400, { error: 'whose request? object must name the Follow or its actor' });
         const r = activity.type === 'Accept'
           ? await social.admitRequest(agent, requester).catch((e) => ({ error: e.message }))
           : await social.refuseRequest(agent, requester).catch((e) => ({ error: e.message }));
-        if (r.error) return this.send(res, 404, { error: r.error });
-        return this.send(res, 200, { ok: true, object: requester });
+        if (r.error) return reply(404, { error: r.error });
+        return reply(200, { ok: true, object: requester });
       }
 
       case 'Move':
-        return this.send(res, 422, { error: 'moving the account is done on the admin surface, where it asks twice' });
+        return reply(422, { error: 'moving the account is done on the admin surface, where it asks twice' });
 
       default:
-        return this.send(res, 422, { error: `no handler for ${activity.type}` });
+        return reply(422, { error: `no handler for ${activity.type}` });
     }
   }
 }

package/lib/client/masto/index.mjs

@@ -32,8 +32,14 @@ export { attachmentType, extensionFor } from './media.mjs';
 
 export class MastoApi {
   constructor({ agent, log = console.log, allowed = null, scheme = null, embedded = false,
-    streaming = true, webPush = true, scheduling = true }) {
+    mount = '', streaming = true, webPush = true, scheduling = true }) {
     this.agent = agent;
+    // The path this identity's surface answers under, when it shares its origin
+    // with others (a suffix pod, e.g. `/aisha`). Empty for a host-root or
+    // subdomain pod. Folded into the self-URLs the client is handed —
+    // pagination links, the OAuth issuer — so they name the address the client
+    // actually reached.
+    this.mount = mount;
     // A server-hosted identity has no CLI of its own, so the advice this gives
     // when it refuses has to name the route that identity really has.
     this.embedded = embedded;

package/lib/client/masto/timelines.mjs

@@ -254,7 +254,7 @@ export async function handle(api, ctx) {
 
     // A client pages by following these rather than by guessing ids.
     if (page.length) {
-      const base = `${api.scheme || (req.socket?.encrypted ? 'https' : 'http')}://${req.headers.host}${pathname}`;
+      const base = `${api.scheme || (req.socket?.encrypted ? 'https' : 'http')}://${req.headers.host}${api.mount || ''}${pathname}`;
       const link = (params) => {
         const u = new URL(base);
         for (const [k, v] of q) if (k !== 'max_id' && k !== 'since_id' && k !== 'min_id') u.searchParams.append(k, v);

package/lib/client/oidc-auth.mjs

@@ -8,7 +8,7 @@
 // The verifier is injected so offline tests stub it, and wrapped so the
 // library (CJS, older jose) can be replaced without touching any caller.
 
-export function makeC2sAuth({ agent, masto = null, verifier = null, log = () => {}, scheme = null }) {
+export function makeC2sAuth({ agent, masto = null, verifier = null, log = () => {}, scheme = null, mount = '' }) {
   let verify = verifier;
   const loadVerifier = async () => {
     if (!verify) {
@@ -31,9 +31,11 @@ export function makeC2sAuth({ agent, masto = null, verifier = null, log = () =>
       // The URL the client signed its proof over. The Host header already
       // passed the Authorities firewall, so whichever alias the client used
       // (localhost, 127.0.0.1, the named origin) is one this agent answers on;
-      // the scheme is whichever listener the request arrived on.
+      // the scheme is whichever listener the request arrived on. `pathname` is
+      // relative to this identity's mount, so a suffix pod folds the mount back
+      // in — the client signed over the full path it actually requested.
       const htu = `${scheme ? scheme.replace(/:$/u, '') : req.socket?.encrypted ? 'https' : 'http'
-      }://${req.headers.host}${pathname}`;
+      }://${req.headers.host}${mount}${pathname}`;
       ({ webid } = await v(
         req.headers.authorization,
         req.headers.dpop ? { header: req.headers.dpop, method: req.method, url: htu } : undefined,