fedipod-server 0.28.1 → 0.30.0

package/dist/handler.jsonld

@@ -273,6 +273,10 @@
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_agentHandles",
           "memberFieldName": "agentHandles"
         },
+        {
+          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_roots",
+          "memberFieldName": "roots"
+        },
         {
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_frontHost",
           "memberFieldName": "frontHost"
@@ -318,16 +322,8 @@
           "memberFieldName": "constructor"
         },
         {
-          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_validateAgentPod",
-          "memberFieldName": "validateAgentPod"
-        },
-        {
-          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_resolveClaim",
-          "memberFieldName": "resolveClaim"
-        },
-        {
-          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_stripMount",
-          "memberFieldName": "stripMount"
+          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_internals",
+          "memberFieldName": "internals"
         },
         {
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_initialize",
@@ -337,26 +333,10 @@
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_finalize",
           "memberFieldName": "finalize"
         },
-        {
-          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_doorSecretFor",
-          "memberFieldName": "doorSecretFor"
-        },
-        {
-          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_startIdentity",
-          "memberFieldName": "startIdentity"
-        },
-        {
-          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_frontIdentity",
-          "memberFieldName": "frontIdentity"
-        },
         {
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_canHandle",
           "memberFieldName": "canHandle"
         },
-        {
-          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_runsIdentities",
-          "memberFieldName": "runsIdentities"
-        },
         {
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_matchIdentity",
           "memberFieldName": "matchIdentity"
@@ -377,10 +357,6 @@
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_optOutPod",
           "memberFieldName": "optOutPod"
         },
-        {
-          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_deliverAtDoor",
-          "memberFieldName": "deliverAtDoor"
-        },
         {
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_handle",
           "memberFieldName": "handle"

package/dist/identities.d.ts

@@ -0,0 +1,62 @@
+import type { FediPodServerHandler } from './handler';
+/** One running identity, and the call that stops it. */
+export interface EmbeddedIdentity {
+    handle: string;
+    host: string;
+    /** Where the identity's own tree begins on its pod, and the actor inside it. */
+    podHome: string;
+    actorUrl: string;
+    surface: {
+        handler: (req: unknown, res: unknown) => Promise<void>;
+        streaming?: unknown;
+    };
+    stop: () => Promise<void>;
+    agent?: {
+        store?: {
+            getConfig?: () => {
+                kind?: string;
+            } | null | undefined;
+        };
+    };
+}
+/**
+ * Whether identities run in this process. They run in one: the lease admits
+ * a single drainer, and the state each one holds is in memory. With workers,
+ * that process is the primary — which serves no requests, so every process
+ * still has to know which hosts belong to an identity even though only one
+ * of them can answer for it.
+ */
+export declare function runsIdentities(h: FediPodServerHandler): boolean;
+/**
+ * Start an agent for each opted-in pod. Runs before the server listens, so
+ * the identities come up in the background and boot is never held on a pod.
+ */
+export declare function initialize(h: FediPodServerHandler): Promise<void>;
+/** Stop every identity: timers cleared, state written, lease let go. */
+export declare function finalize(h: FediPodServerHandler): Promise<void>;
+/**
+ * One identity's door secret, in its own pod's state. `agentDataDir` is
+ * handed in as the place an identity set up before this kept it, so its
+ * owner's existing door link survives the move.
+ */
+export declare function doorSecretFor(h: FediPodServerHandler, podBase: string, session?: {
+    fetch: unknown;
+}, opts?: {
+    rotate?: boolean;
+}): Promise<{
+    secret: string;
+    url: string;
+    rotated: boolean;
+}>;
+export declare function startIdentity(h: FediPodServerHandler, podBase: string): Promise<void>;
+/**
+ * When this server is also the door, give a running identity a
+ * @handle@<frontHost> address: one inbox-only directory row so the
+ * shared-domain handle resolves and the door can take verified delivery for
+ * it. The row names the identity's own tree, which is where its inbox and
+ * its actor are — the door writes deliveries there and the agent watches
+ * that container. A row written by an attach belongs to its owner and is
+ * left alone; one this server wrote itself is corrected. The identity keeps
+ * its own ids on the pod; nothing is moved.
+ */
+export declare function frontIdentity(h: FediPodServerHandler, podBase: string, identity: EmbeddedIdentity): Promise<void>;

package/dist/identities.js

@@ -0,0 +1,236 @@
+"use strict";
+// identities.ts — the identities this server runs: started when the server
+// boots or an owner opts in, retried while a pod is still being created,
+// stopped together at shutdown, and each given its address at the apex and
+// its door secret in its pod.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runsIdentities = runsIdentities;
+exports.initialize = initialize;
+exports.finalize = finalize;
+exports.doorSecretFor = doorSecretFor;
+exports.startIdentity = startIdentity;
+exports.frontIdentity = frontIdentity;
+const node_crypto_1 = require("node:crypto");
+const store_pod_1 = require("./store-pod");
+const directory_1 = require("./directory");
+const fedipod_1 = require("./fedipod");
+const mounts_1 = require("./mounts");
+// A pod that will not come up yet is usually a pod still being created by the
+// server that is booting. Keep asking, slower each time, up to a few minutes.
+const START_RETRY_MS = [2_000, 5_000, 15_000, 60_000, 300_000];
+/**
+ * Whether identities run in this process. They run in one: the lease admits
+ * a single drainer, and the state each one holds is in memory. With workers,
+ * that process is the primary — which serves no requests, so every process
+ * still has to know which hosts belong to an identity even though only one
+ * of them can answer for it.
+ */
+function runsIdentities(h) {
+    const s = h.internals();
+    const cluster = s.args.clusterManager;
+    return !cluster || cluster.isSingleThreaded() || cluster.isPrimary();
+}
+/**
+ * Start an agent for each opted-in pod. Runs before the server listens, so
+ * the identities come up in the background and boot is never held on a pod.
+ */
+async function initialize(h) {
+    const s = h.internals();
+    if (!s.registry)
+        return;
+    const runs = runsIdentities(h);
+    // The stock CSS CLI installs no signal handlers, so a SIGTERM (systemd
+    // stop, docker stop, Ctrl+C) killed the process with agent state
+    // unflushed and the lease held for its whole TTL. Flush first, bounded,
+    // then re-raise so the process still dies the way it was asked to.
+    if (runs && !s.onSignal) {
+        s.onSignal = (signal) => {
+            const timeout = new Promise((resolve) => { setTimeout(resolve, 5_000).unref?.(); });
+            void Promise.race([finalize(h), timeout]).then(() => {
+                process.kill(process.pid, signal);
+            });
+        };
+        process.once('SIGTERM', s.onSignal);
+        process.once('SIGINT', s.onSignal);
+    }
+    // Identities run in the primary, and requests are answered by the workers,
+    // so with more than one worker an identity federates but cannot be reached:
+    // its client API, its owner pages and its live feed are in a process no
+    // request arrives at. Said once, by the process that has them.
+    if (runs && s.args.clusterManager && !s.args.clusterManager.isSingleThreaded()) {
+        s.logger.warn('FediPod is running in a multi-worker server. Deliveries are picked up by the inbox '
+            + 'sweep rather than as they land, and no identity can answer its client API, its live feed or its '
+            + "owner's pages while requests are served by other processes. Run with --workers 1.");
+    }
+    // Awaited, and BEFORE the server listens: a pod whose owner opted in must
+    // have its routes claimed from the first request after a restart, never
+    // served briefly by LDP. A failed load must not fail the boot — the rows
+    // persist, and the next start recovers them.
+    const pods = [];
+    try {
+        const keys = await s.registry.listKeys();
+        for (const key of keys) {
+            const row = await s.registry.get(key);
+            if (!row)
+                continue;
+            if (s.claimed.has(row.podBase) || s.identities.has(row.podBase))
+                continue; // already claimed
+            let claim;
+            try {
+                claim = (0, mounts_1.validateAgentPod)(h, row.podBase);
+            }
+            catch (e) {
+                s.logger.error(`opted-in pod ${row.podBase} no longer valid: ${e.message}`);
+                continue;
+            }
+            s.claimed.set(row.podBase, claim);
+            s.agentHandles.set(row.handle, row.podBase);
+            s.roots.set(row.podBase, row.root || 'fedipod/');
+            pods.push(row.podBase);
+        }
+    }
+    catch (e) {
+        s.logger.error(`could not read the opt-in registry — opted-in identities are absent this boot: ${e.message}`);
+    }
+    if (pods.length > 0) {
+        s.logger.info(runs
+            ? `FediPod agent enabled for ${pods.length} opted-in pod(s)`
+            : `FediPod claimed the routes of ${pods.length} opted-in pod(s); they are run elsewhere`);
+    }
+    // Claimed everywhere, run in one place. A process that does not run them
+    // must still not let a pod answer for a path that belongs to an identity.
+    if (runs)
+        for (const pod of pods)
+            void startIdentity(h, pod);
+}
+/** Stop every identity: timers cleared, state written, lease let go. */
+async function finalize(h) {
+    const s = h.internals();
+    s.stopping = true;
+    if (s.onSignal) {
+        process.removeListener('SIGTERM', s.onSignal);
+        process.removeListener('SIGINT', s.onSignal);
+        s.onSignal = null;
+    }
+    const running = [...s.identities.values()];
+    s.identities.clear();
+    s.surfaces.clear();
+    s.doorSecrets.clear();
+    s.starting.clear();
+    await Promise.allSettled(running.map(async (identity) => {
+        await identity.stop();
+        s.logger.info(`FediPod agent @${identity.handle} stopped`);
+    }));
+}
+/**
+ * One identity's door secret, in its own pod's state. `agentDataDir` is
+ * handed in as the place an identity set up before this kept it, so its
+ * owner's existing door link survives the move.
+ */
+async function doorSecretFor(h, podBase, session, opts = {}) {
+    const s = h.internals();
+    const { ensureDoorSecret } = await (0, fedipod_1.esmImport)(fedipod_1.EMBED);
+    return ensureDoorSecret(session ?? (0, store_pod_1.makeStoreSession)(s.args.resourceStore, podBase), podBase, {
+        ...opts,
+        root: s.roots.get(podBase) ?? 'fedipod/',
+        dataDir: s.args.agentDataDir,
+        handle: (0, mounts_1.deriveHandle)(podBase),
+        log: (message) => { s.logger.info(`@${(0, mounts_1.deriveHandle)(podBase)}: ${message}`); },
+    });
+}
+async function startIdentity(h, podBase) {
+    const s = h.internals();
+    if (s.starting.has(podBase) || s.identities.has(podBase))
+        return;
+    s.starting.add(podBase);
+    s.startCancelled.delete(podBase);
+    const session = (0, store_pod_1.makeStoreSession)(s.args.resourceStore, podBase);
+    try {
+        for (let attempt = 0; !s.stopping && !s.startCancelled.has(podBase); attempt++) {
+            try {
+                const { startEmbeddedAgent } = await (0, fedipod_1.esmImport)(fedipod_1.EMBED);
+                // The secret is in the map BEFORE the surface can exist, so the
+                // gate's resolver never comes up empty — empty would mean gate-off.
+                if (!s.doorSecrets.has(podBase)) {
+                    const door = await doorSecretFor(h, podBase, session);
+                    s.doorSecrets.set(podBase, door.secret);
+                    s.logger.info(`door secret for @${(0, mounts_1.deriveHandle)(podBase)} is in its pod at ${door.url}`);
+                }
+                const identity = await startEmbeddedAgent({
+                    podBase,
+                    root: s.roots.get(podBase) ?? 'fedipod/',
+                    dataDir: s.args.agentDataDir,
+                    session,
+                    resourceStore: s.args.resourceStore,
+                    webIdSuffix: s.args.agentWebIdSuffix ?? 'profile/card#me',
+                    pollSeconds: s.args.agentPollSeconds ?? null,
+                    autoAcceptFollows: s.args.agentAutoAcceptFollows !== false,
+                    gateToken: () => s.doorSecrets.get(podBase),
+                    uiPath: s.uiPath,
+                    log: (message) => {
+                        s.logger.info(message);
+                    },
+                });
+                // Stopped, or opted out, while this one was still coming up.
+                if (s.stopping || s.startCancelled.has(podBase)) {
+                    await identity.stop();
+                    return;
+                }
+                s.identities.set(podBase, identity);
+                s.surfaces.set(podBase, identity);
+                s.logger.info(`FediPod agent @${identity.handle} running on ${podBase}`);
+                // A suffix pod cannot answer WebFinger for itself — its host root is
+                // the front's — so it is followable ONLY through the door's apex
+                // dispatch. Front it whether or not auto-front is on: the row is the
+                // whole of what makes @handle@host resolve to it.
+                if (s.args.agentAutoFront || s.claimed.get(podBase)?.mount) {
+                    await frontIdentity(h, podBase, identity);
+                }
+                return;
+            }
+            catch (e) {
+                const wait = START_RETRY_MS[Math.min(attempt, START_RETRY_MS.length - 1)];
+                s.logger.warn(`FediPod agent for ${podBase} did not start: ${e.message} — retrying in ${Math.round(wait / 1000)}s`);
+                await new Promise((resolve) => {
+                    setTimeout(resolve, wait).unref?.();
+                });
+            }
+        }
+    }
+    finally {
+        s.starting.delete(podBase);
+    }
+}
+/**
+ * When this server is also the door, give a running identity a
+ * @handle@<frontHost> address: one inbox-only directory row so the
+ * shared-domain handle resolves and the door can take verified delivery for
+ * it. The row names the identity's own tree, which is where its inbox and
+ * its actor are — the door writes deliveries there and the agent watches
+ * that container. A row written by an attach belongs to its owner and is
+ * left alone; one this server wrote itself is corrected. The identity keeps
+ * its own ids on the pod; nothing is moved.
+ */
+async function frontIdentity(h, podBase, identity) {
+    const s = h.internals();
+    const { handle, podHome, actorUrl } = identity;
+    try {
+        const existing = await h.dir.lookup(handle);
+        const row = (0, directory_1.frontRow)(existing, {
+            handle, podHome, actorUrl,
+            kind: identity.agent?.store?.getConfig?.()?.kind === 'group' ? 'group' : 'person',
+            gatewayWebId: s.args.gatewayWebId ?? null,
+            hmacSecret: (0, node_crypto_1.randomBytes)(32).toString('base64'),
+            inboxOnly: true,
+        }, podBase);
+        if (!row)
+            return;
+        await h.dir.putDirectory(handle, row);
+        s.logger.info(existing
+            ? `FediPod: the door's record of @${handle} now names ${podHome}`
+            : `FediPod: @${handle}@${s.frontHost} now resolves to ${podBase}`);
+    }
+    catch (e) {
+        s.logger.warn(`FediPod: could not front @${handle}: ${e.message}`);
+    }
+}

package/dist/mounts.d.ts

@@ -0,0 +1,43 @@
+import type { FediPodServerHandler } from './handler';
+/**
+ * A pod this server claims the routes of, whether or not its identity has
+ * finished starting. A request belongs to this claim when its host matches
+ * and its path is at or under the mount.
+ */
+export interface AgentClaim {
+    host: string;
+    mount: string;
+    podBase: string;
+    handle: string;
+}
+/** The pod's path as a mount prefix: `''` for a host root, else `/aisha`. */
+export declare function mountOf(podBase: string): string;
+/** Whether `a` is `b` or an ancestor path of `b` (both mount-shaped, no trailing slash). */
+export declare function pathContains(a: string, b: string): boolean;
+/** The identity's name, from its pod URL. Mirrors handleFor in fedipod/embed. */
+export declare function deriveHandle(podBase: string): string;
+/** The opt-in page's path: leading slash, no trailing one, the default when unset. */
+export declare function normalizeRunPath(raw?: string): string;
+/** A door path always has both slashes, so claiming and stripping agree. */
+export declare function normalizeUiPath(raw?: string): string;
+/**
+ * Whether this pod may become an identity here, and the claim it earns: a
+ * real URL, a place no other identity already sits, and a handle no other
+ * identity uses — two pods must never share <agentDataDir>/<handle>/.
+ *
+ * A HOST-ROOT or subdomain pod needs an origin of its own, and it may not be
+ * the front's host: the whole surface answers at the origin root, so two of
+ * them, or one sharing the front, would collide. A SUFFIX pod lives on a path
+ * (`server/aisha/`), so it may share its host — with the front and with other
+ * suffix pods — provided no claim already contains or nests under its path.
+ */
+export declare function validateAgentPod(h: FediPodServerHandler, podBase: string): AgentClaim;
+/**
+ * The claim a request belongs to, or null. A request matches when its host is
+ * the claim's host and its path is at or under the claim's mount; the deepest
+ * mount wins, so a suffix pod's own routes are never swallowed by a shallower
+ * claim on the same host.
+ */
+export declare function resolveClaim(h: FediPodServerHandler, host: string, pathname: string): AgentClaim | null;
+/** A request path relative to a mount: `/aisha/ap/actor` under `/aisha` → `/ap/actor`. */
+export declare function stripMount(pathname: string, mount: string): string;

package/dist/mounts.js

@@ -0,0 +1,123 @@
+"use strict";
+// mounts.ts — which pod a request belongs to. A claim is a pod whose routes
+// this server answers for, matched by host and by mount: the pod's own path,
+// `''` for a host-root or subdomain pod, `/aisha` for a suffix pod on
+// `https://host/aisha/`. claims.ts says which PATHS are an identity's; this
+// says which POD.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mountOf = mountOf;
+exports.pathContains = pathContains;
+exports.deriveHandle = deriveHandle;
+exports.normalizeRunPath = normalizeRunPath;
+exports.normalizeUiPath = normalizeUiPath;
+exports.validateAgentPod = validateAgentPod;
+exports.resolveClaim = resolveClaim;
+exports.stripMount = stripMount;
+const claims_1 = require("./claims");
+/** The pod's path as a mount prefix: `''` for a host root, else `/aisha`. */
+function mountOf(podBase) {
+    return new URL(podBase).pathname.replace(/\/+$/u, '');
+}
+/** Whether `a` is `b` or an ancestor path of `b` (both mount-shaped, no trailing slash). */
+function pathContains(a, b) {
+    return a === b || b.startsWith(a + '/') || a === '';
+}
+/** The identity's name, from its pod URL. Mirrors handleFor in fedipod/embed. */
+function deriveHandle(podBase) {
+    const u = new URL(podBase);
+    const segments = u.pathname.split('/').filter((seg) => seg.length > 0);
+    return segments.length > 0 ? segments[segments.length - 1] : u.hostname.split('.')[0];
+}
+/** The opt-in page's path: leading slash, no trailing one, the default when unset. */
+function normalizeRunPath(raw) {
+    const said = String(raw ?? '').trim().replace(/\/+$/u, '');
+    if (!said)
+        return claims_1.DEFAULT_RUN_PATH;
+    return said.startsWith('/') ? said : `/${said}`;
+}
+/** A door path always has both slashes, so claiming and stripping agree. */
+function normalizeUiPath(raw) {
+    if (raw === '')
+        return '';
+    const path = raw ?? '/fp/';
+    return `/${path.replace(/^\/+|\/+$/gu, '')}/`;
+}
+/**
+ * Whether this pod may become an identity here, and the claim it earns: a
+ * real URL, a place no other identity already sits, and a handle no other
+ * identity uses — two pods must never share <agentDataDir>/<handle>/.
+ *
+ * A HOST-ROOT or subdomain pod needs an origin of its own, and it may not be
+ * the front's host: the whole surface answers at the origin root, so two of
+ * them, or one sharing the front, would collide. A SUFFIX pod lives on a path
+ * (`server/aisha/`), so it may share its host — with the front and with other
+ * suffix pods — provided no claim already contains or nests under its path.
+ */
+function validateAgentPod(h, podBase) {
+    const s = h.internals();
+    let host;
+    let mount;
+    try {
+        const u = new URL(podBase);
+        host = u.host.toLowerCase();
+        mount = mountOf(podBase);
+    }
+    catch {
+        throw new Error(`not a pod URL: ${podBase}`);
+    }
+    if (mount === '') {
+        // A pod at the root of its host: it owns the whole origin, so it cannot
+        // share it with the front or with any other claim.
+        if (host.split(':')[0] === String(s.frontHost).toLowerCase()) {
+            throw new Error(`${podBase} is on the front's own host — give the identity its own origin, or host it on a path`);
+        }
+        for (const c of s.claimed.values()) {
+            if (c.host === host) {
+                throw new Error(`the host ${host} already carries an identity — a host-root identity needs an origin of its own`);
+            }
+        }
+    }
+    else {
+        // A pod on a path: it owns only its subtree. Refuse anything that already
+        // contains it or that it would contain, so no identity can answer under
+        // another's path (and none straddles the front's own routes underneath).
+        for (const c of s.claimed.values()) {
+            if (c.host !== host)
+                continue;
+            if (pathContains(c.mount, mount) || pathContains(mount, c.mount)) {
+                throw new Error(`${podBase} nests with the identity already at ${c.podBase} — a suffixed pod owns only its own subtree`);
+            }
+        }
+    }
+    const handle = deriveHandle(podBase);
+    const holder = s.agentHandles.get(handle);
+    if (holder && holder !== podBase) {
+        throw new Error(`the name ${handle} already belongs to ${holder} — two identities cannot share it`);
+    }
+    return { host, mount, podBase, handle };
+}
+/**
+ * The claim a request belongs to, or null. A request matches when its host is
+ * the claim's host and its path is at or under the claim's mount; the deepest
+ * mount wins, so a suffix pod's own routes are never swallowed by a shallower
+ * claim on the same host.
+ */
+function resolveClaim(h, host, pathname) {
+    const s = h.internals();
+    let best = null;
+    for (const c of s.claimed.values()) {
+        if (c.host !== host)
+            continue;
+        if (c.mount === '' || pathname === c.mount || pathname.startsWith(c.mount + '/')) {
+            if (!best || c.mount.length > best.mount.length)
+                best = c;
+        }
+    }
+    return best;
+}
+/** A request path relative to a mount: `/aisha/ap/actor` under `/aisha` → `/ap/actor`. */
+function stripMount(pathname, mount) {
+    if (!mount)
+        return pathname;
+    return pathname.slice(mount.length) || '/';
+}

package/dist/opt-in.d.ts

@@ -0,0 +1,46 @@
+import type { FediPodServerHandler } from './handler';
+/**
+ * The WebIDs behind the account session in the request, or none. The server
+ * keeps that session in a `css-account` cookie; its own account API is what
+ * says which WebIDs the session owns, and it takes the same cookie. Nothing
+ * here trusts the cookie's presence — the account API does the deciding, and
+ * the caller picks the WebID that owns the pod being claimed.
+ */
+export declare function webIdsFromSession(h: FediPodServerHandler, request: {
+    headers: {
+        get(name: string): string | null;
+    };
+}): Promise<string[]>;
+/**
+ * A pod owner, already proven to control podBase, asks this server to run
+ * their identity. Returns { httpStatus, ...body }; the secret appears in the
+ * reply and nowhere else. Re-opting-in rotates the secret — that is how a
+ * lost one is recovered.
+ */
+export declare function optInPod(h: FediPodServerHandler, { podBase, webId, container, createIndex }: {
+    podBase: string;
+    webId: string;
+    container?: string;
+    createIndex?: boolean;
+}): Promise<Record<string, unknown> & {
+    httpStatus: number;
+}>;
+/**
+ * What a pod would be as an identity here, without changing anything: its
+ * handle, the host its address carries, and whether it runs here already.
+ */
+export declare function describePod(h: FediPodServerHandler, { podBase }: {
+    podBase: string;
+}): Promise<{
+    handle: string;
+    host: string;
+    address: string;
+    running: boolean;
+    manage: string;
+}>;
+/** The reverse: stop the identity and let the pod be plain LDP again. */
+export declare function optOutPod(h: FediPodServerHandler, { podBase }: {
+    podBase: string;
+}): Promise<Record<string, unknown> & {
+    httpStatus: number;
+}>;