fedipod 1.44.0 → 1.47.0

package/web/app/dist/sw.js

@@ -133,6 +133,9 @@ function apUrls(remotePod, root, { publicBase = null } = {}) {
     // reads them there, with a credential the pod checks.
     ownOutbox: home + "ap/private/outbox",
     liked: home + "ap/private/liked",
+    // The inbox as its owner reads it (§5.2): what the account received,
+    // kept by the drain as a paged collection beside the archive.
+    ownInbox: home + "ap/private/inbox",
     profileHtml: face + "ap/profile.html",
     // Media stays on the pod even when fronted: attachment urls are not
     // identity-checked by remotes, and proxying blobs would be pure cost.
@@ -9762,6 +9765,7 @@ __export(wire_exports, {
   publicHandle: () => publicHandle,
   questionDoc: () => questionDoc,
   quotePolicy: () => quotePolicy,
+  reactionCounts: () => reactionCounts,
   rejectActivity: () => rejectActivity,
   repliesId: () => repliesId,
   sanitizeHtml: () => sanitizeHtml,
@@ -9799,7 +9803,7 @@ function jrd({ handle: handle7, host, actor, aliases = [], page: page2 = null })
   };
 }
 function followsNeedApproval(config = {}) {
-  return !!config.approveJoins || config.kind !== "group" && !config.autoAcceptFollows;
+  return !!config.approveJoins || config.kind !== "group" && config.autoAcceptFollows === false;
 }
 function actorDoc({
   urls,
@@ -10179,6 +10183,12 @@ function quotePolicy(visibility) {
   const open3 = visibility === "public" || visibility === "unlisted";
   return { canQuote: { automaticApproval: open3 ? [PUBLIC] : [], manualApproval: [] } };
 }
+function reactionCounts(likes = 0, shares = 0) {
+  return {
+    likes: { type: "Collection", totalItems: Math.max(0, Number(likes) || 0) },
+    shares: { type: "Collection", totalItems: Math.max(0, Number(shares) || 0) }
+  };
+}
 function noteDoc({
   urls,
   slug,
@@ -10193,7 +10203,9 @@ function noteDoc({
   updated = null,
   container = null,
   also = [],
-  quote = null
+  quote = null,
+  likes = 0,
+  shares = 0
 }) {
   const id = (container || urls.notes) + slug;
   const who = mentions.map((m) => m.actor);
@@ -10210,6 +10222,7 @@ function noteDoc({
     to: addressed.to,
     cc: addressed.cc,
     replies: repliesId(id),
+    ...reactionCounts(likes, shares),
     interactionPolicy: quotePolicy(visibility)
   };
   if (quote?.id) {
@@ -29972,13 +29985,13 @@ var require_jsonld = __commonJS({
         );
       };
       jsonld2.get = async function(url, options) {
-        let load;
+        let load2;
         if (typeof options.documentLoader === "function") {
-          load = options.documentLoader;
+          load2 = options.documentLoader;
         } else {
-          load = jsonld2.documentLoader;
+          load2 = jsonld2.documentLoader;
         }
-        const remoteDoc = await load(url);
+        const remoteDoc = await load2(url);
         try {
           if (!remoteDoc.document) {
             throw new JsonLdError(
@@ -32864,14 +32877,16 @@ function makeSafeLoader({ getActors = null, fetchImpl = fetch } = {}) {
 async function verifyHttpSignature(request, { documentLoader, keyCache, timeWindow } = {}) {
   const hadSig = request.headers.get("signature") != null;
   let result = null;
+  let threw = null;
   try {
     result = await verifyRequestDetailed(request, {
       documentLoader,
       ...keyCache ? { keyCache } : {},
       timeWindow: timeWindow ?? { hours: 1 }
     });
-  } catch {
+  } catch (e) {
     result = null;
+    threw = e?.message || String(e);
   }
   const method = request.headers.has("signature-input") ? "rfc9421" : "draft-cavage";
   if (result?.verified) {
@@ -32912,7 +32927,8 @@ async function verifyHttpSignature(request, { documentLoader, keyCache, timeWind
     keyId: null,
     actor: null,
     reason: "bad-signature",
-    checks: { signature: false }
+    checks: { signature: false },
+    why: threw ? `library threw: ${threw.split("\n")[0].slice(0, 120)}` : kind || "unknown"
   };
 }
 function sortedKeys(v) {
@@ -33266,8 +33282,8 @@ var require_common = __commonJS({
 var require_browser = __commonJS({
   "node_modules/debug/src/browser.js"(exports, module2) {
     exports.formatArgs = formatArgs;
-    exports.save = save;
-    exports.load = load;
+    exports.save = save2;
+    exports.load = load2;
     exports.useColors = useColors;
     exports.storage = localstorage();
     exports.destroy = /* @__PURE__ */ (() => {
@@ -33393,7 +33409,7 @@ var require_browser = __commonJS({
     }
     exports.log = console.debug || console.log || (() => {
     });
-    function save(namespaces) {
+    function save2(namespaces) {
       try {
         if (namespaces) {
           exports.storage.setItem("debug", namespaces);
@@ -33403,7 +33419,7 @@ var require_browser = __commonJS({
       } catch (error2) {
       }
     }
-    function load() {
+    function load2() {
       let r;
       try {
         r = exports.storage.getItem("debug") || exports.storage.getItem("DEBUG");
@@ -46117,13 +46133,13 @@ var PodStore = class {
   _mergeStatus(all, at, s) {
     const row = all[at];
     const known2 = new Set((row.sourceAccts || []).map((v) => v.acct));
-    const fresh = (s.sourceAccts || []).filter((v) => v && !known2.has(v.acct));
+    const fresh2 = (s.sourceAccts || []).filter((v) => v && !known2.has(v.acct));
     const first = (k) => k === "post" || k === "timeline";
     const raise = first(s.kind) && !first(row.kind);
-    if (!fresh.length && !raise) return { added: false, merged: false, status: row };
+    if (!fresh2.length && !raise) return { added: false, merged: false, status: row };
     all[at] = {
       ...row,
-      ...fresh.length ? { sourceAccts: [...row.sourceAccts || [], ...fresh] } : {},
+      ...fresh2.length ? { sourceAccts: [...row.sourceAccts || [], ...fresh2] } : {},
       ...raise ? { kind: s.kind, ...s.slug ? { slug: s.slug } : {} } : {}
     };
     this.write("statuses.json", all);
@@ -46295,11 +46311,27 @@ var PodStore = class {
   }
 };
 
-// stub:node:fs/promises
-var fail = () => {
-  throw new Error("node:fs/promises is not available in the browser agent");
+// lib/core/publisher/index.mjs
+init_node_crypto();
+init_wire();
+
+// web/app/shims/node-fs.mjs
+var PKG = JSON.stringify({ version: "0.18.0", name: "fedipod" });
+var readFileSync = (p) => {
+  if (String(p).endsWith("package.json")) return PKG;
+  throw new Error(`node:fs readFileSync(${p}) is not available in the browser agent`);
+};
+var existsSync = () => false;
+var nope = (name) => () => {
+  throw new Error(`node:fs ${name} is not available in the browser agent`);
 };
-var promises_default = new Proxy({}, { get: () => fail });
+var writeFileSync = nope("writeFileSync");
+var mkdirSync = nope("mkdirSync");
+var readdirSync = () => [];
+var statSync = nope("statSync");
+var unlinkSync = nope("unlinkSync");
+var rmSync = nope("rmSync");
+var node_fs_default = { readFileSync, existsSync, writeFileSync, mkdirSync, readdirSync, statSync, unlinkSync, rmSync };
 
 // web/app/shims/node-path.mjs
 var normalize = (p) => {
@@ -46345,173 +46377,6 @@ var fileURLToPath = (u) => {
 var pathToFileURL = (p) => new URL("file://" + (p.startsWith("/") ? p : "/" + p));
 var node_url_default = { URL: globalThis.URL, URLSearchParams: globalThis.URLSearchParams, fileURLToPath, pathToFileURL };
 
-// lib/core/pod-only.mjs
-var podOnly = (name) => name === "keys.json" || name === "lease.json" || name.startsWith("conn-");
-
-// lib/core/storage.mjs
-var LDP2 = Namespace("http://www.w3.org/ns/ldp#");
-var slash = (u) => u.endsWith("/") ? u : u + "/";
-var HttpStorage = class {
-  constructor(base, fetchImpl) {
-    this.base = slash(base);
-    this.fetchImpl = fetchImpl;
-  }
-  get kind() {
-    return "pod";
-  }
-  // The same jail FileStorage has, and for the same reason: a path here can
-  // carry `..`, encodeURI leaves both `.` and `/` alone, and fetch normalises
-  // the segments away — so a name derived from remote input could name a
-  // resource outside the container entirely. A prefix check is not enough on
-  // its own: a concatenated URL always satisfies one.
-  _url(p) {
-    const u = new URL(encodeURI(p), this.base);
-    if (!u.href.startsWith(this.base)) throw new Error(`path escapes the container: ${p}`);
-    return u.href;
-  }
-  async list(sub = "", { etag } = {}) {
-    const url = this._url(sub);
-    const res = await this.fetchImpl(url, {
-      headers: { accept: "text/turtle", ...etag ? { "if-none-match": etag } : {} }
-    });
-    if (res.status === 304) return { notModified: true, names: null, etag };
-    if (res.status === 404) return { notModified: false, names: [], etag: null, missing: true };
-    if (res.status >= 400) throw new Error(`container unreadable (HTTP ${res.status})`);
-    const g = graph();
-    parse2(await res.text(), g, url, "text/turtle");
-    const here = namedNode2(url);
-    const names = g.each(here, LDP2("contains"), null, here).map((n) => n.value).filter((u) => u.startsWith(url) && u !== url).map((u) => decodeURIComponent(u.slice(url.length)));
-    return { notModified: false, names, etag: res.headers.get("etag") };
-  }
-  // `accept` is for callers reading something that is RDF but is wanted as it
-  // was written: asking turtle-first for a JSON-LD document gets turtle back,
-  // because the server is entitled to convert between two RDF syntaxes.
-  async read(p, { etag, accept } = {}) {
-    const res = await this.fetchImpl(this._url(p), {
-      headers: {
-        accept: accept || "text/turtle, application/json;q=0.9, */*;q=0.8",
-        ...etag ? { "if-none-match": etag } : {}
-      }
-    });
-    if (res.status === 304) return { ok: true, notModified: true, status: 304, body: null, etag };
-    if (res.status >= 400) return { ok: false, notModified: false, status: res.status, body: null, etag: null };
-    return { ok: true, notModified: false, status: res.status, body: await res.text(), etag: res.headers.get("etag") };
-  }
-  async write(p, body, contentType) {
-    const url = this._url(p);
-    try {
-      const res = await this.fetchImpl(url, {
-        method: "PUT",
-        headers: { "content-type": contentType },
-        body
-      });
-      if (res.status < 400) return { ok: true, retry: false, why: "" };
-      const retry = res.status >= 500 || res.status === 429;
-      const ra = Number(res.headers?.get?.("retry-after"));
-      return {
-        ok: false,
-        retry,
-        why: `HTTP ${res.status}`,
-        retryAfterMs: Number.isFinite(ra) && ra > 0 ? ra * 1e3 : 0
-      };
-    } catch (e) {
-      return { ok: false, retry: true, why: e.message, retryAfterMs: 0 };
-    }
-  }
-  async remove(p) {
-    const url = this._url(p);
-    try {
-      const res = await this.fetchImpl(url, { method: "DELETE" });
-      return res.status < 400 || res.status === 404;
-    } catch {
-      return false;
-    }
-  }
-};
-var StateApiStorage = class {
-  constructor(base, { fetchImpl = globalThis.fetch, token, holder, pod = null, onRefused = null }) {
-    this.base = slash(base);
-    this.fetchImpl = fetchImpl;
-    this.token = token;
-    this.holder = holder;
-    this.pod = pod;
-    this.onRefused = onRefused;
-  }
-  get kind() {
-    return "copy";
-  }
-  _ask(p, init = {}) {
-    return this.fetchImpl(this.base + encodeURIComponent(p), {
-      ...init,
-      headers: { authorization: `Bearer ${this.token}`, ...init.headers || {} }
-    });
-  }
-  async list(sub = "", { etag } = {}) {
-    if (sub) return { notModified: false, names: [], etag: null };
-    const res = await this._ask("", { headers: etag ? { "if-none-match": etag } : {} });
-    if (res.status === 304) return { notModified: true, names: null, etag };
-    if (res.status >= 400) throw new Error(`the account's copy at the gateway is unreadable (HTTP ${res.status})`);
-    const { names } = await res.json();
-    return { notModified: false, names, etag: res.headers.get("etag") };
-  }
-  async read(p, opts = {}) {
-    if (podOnly(p)) return this.pod ? this.pod.read(p, opts) : { ok: false, notModified: false, status: 404, body: null, etag: null };
-    const res = await this._ask(p, { headers: opts.etag ? { "if-none-match": opts.etag } : {} });
-    if (res.status === 304) return { ok: true, notModified: true, status: 304, body: null, etag: opts.etag };
-    if (res.status >= 400) return { ok: false, notModified: false, status: res.status, body: null, etag: null };
-    return { ok: true, notModified: false, status: res.status, body: await res.text(), etag: res.headers.get("etag") };
-  }
-  async write(p, body, contentType = "application/json") {
-    if (podOnly(p)) return this.pod ? this.pod.write(p, body, contentType) : { ok: false, retry: false, why: "no pod for this document" };
-    try {
-      const res = await this._ask(p, { method: "PUT", headers: { "content-type": contentType, "x-fedipod-holder": this.holder }, body });
-      if (res.status < 400) return { ok: true, retry: false, why: "" };
-      if (res.status === 409) {
-        this.onRefused?.();
-        return { ok: false, retry: false, why: "another agent holds this account now", lost: true };
-      }
-      return { ok: false, retry: res.status >= 500 || res.status === 429, why: `HTTP ${res.status}`, retryAfterMs: 0 };
-    } catch (e) {
-      return { ok: false, retry: true, why: e.message, retryAfterMs: 0 };
-    }
-  }
-  async remove(p) {
-    if (podOnly(p)) return this.pod ? this.pod.remove(p) : false;
-    try {
-      const res = await this._ask(p, { method: "DELETE", headers: { "x-fedipod-holder": this.holder } });
-      if (res.status === 409) {
-        this.onRefused?.();
-        return false;
-      }
-      return res.status < 400 || res.status === 404;
-    } catch {
-      return false;
-    }
-  }
-};
-
-// lib/core/publisher/index.mjs
-init_node_crypto();
-init_wire();
-
-// web/app/shims/node-fs.mjs
-var PKG = JSON.stringify({ version: "0.18.0", name: "fedipod" });
-var readFileSync = (p) => {
-  if (String(p).endsWith("package.json")) return PKG;
-  throw new Error(`node:fs readFileSync(${p}) is not available in the browser agent`);
-};
-var existsSync = () => false;
-var nope = (name) => () => {
-  throw new Error(`node:fs ${name} is not available in the browser agent`);
-};
-var writeFileSync = nope("writeFileSync");
-var mkdirSync = nope("mkdirSync");
-var readdirSync = () => [];
-var statSync = nope("statSync");
-var unlinkSync = nope("unlinkSync");
-var rmSync = nope("rmSync");
-var node_fs_default = { readFileSync, existsSync, writeFileSync, mkdirSync, readdirSync, statSync, unlinkSync, rmSync };
-
 // lib/shared/ua.mjs
 var version = "0";
 try {
@@ -46668,6 +46533,27 @@ var writeEmptyReplies = (pod, repliesId2, doc) => pod.putJson(repliesId2, doc);
 var readReplies = (pod, repliesId2) => pod.getJson(repliesId2);
 var writeReplies = (pod, repliesId2, doc) => pod.putJson(repliesId2, doc);
 var read = (pod, noteId) => pod.getJson(noteId);
+async function readVersioned(pod, noteId) {
+  if (typeof pod.fetch !== "function") return { doc: await pod.getJson(noteId), version: null };
+  const res = await pod.fetch(noteId, { headers: { accept: "application/activity+json" } });
+  if (res.status === 404 || res.status === 410) return { doc: null, version: null };
+  if (res.status >= 400) throw new Error(`GET ${noteId} \u2192 ${res.status}`);
+  return { doc: await res.json().catch(() => null), version: res.headers?.get?.("etag") || null };
+}
+async function writeIfUnchanged(pod, noteId, doc, version2) {
+  if (!version2 || typeof pod.fetch !== "function") {
+    await pod.putJson(noteId, doc);
+    return true;
+  }
+  const res = await pod.fetch(noteId, {
+    method: "PUT",
+    headers: { "content-type": "application/activity+json", "if-match": version2 },
+    body: JSON.stringify(doc)
+  });
+  if (res.status === 412) return false;
+  if (res.status >= 400) throw new Error(`PUT ${noteId} \u2192 ${res.status}`);
+  return true;
+}
 async function writeTombstone2(pod, noteId, doc) {
   await pod.putJson(noteId, doc);
   await pod.setAcl(noteId, PUBLIC_READ5);
@@ -57364,6 +57250,114 @@ async function readLenient(raw) {
 init_node_crypto();
 init_wire();
 init_wire_quotes();
+
+// lib/core/intake/counts.mjs
+init_wire();
+var MAX_NAMED = 1e3;
+var MAX_POSTS = 2e3;
+var REWRITES_PER_SWEEP = 20;
+var COUNTS = "counts.json";
+var KIND = { Like: "likes", Announce: "shares" };
+var MORE = { likes: "moreLikes", shares: "moreShares" };
+var load = (store) => {
+  const st2 = typeof store?.read === "function" ? store.read(COUNTS, null) : null;
+  return st2 && typeof st2 === "object" && st2.posts && typeof st2.posts === "object" ? { posts: st2.posts, dirty: Array.isArray(st2.dirty) ? st2.dirty : [] } : { posts: {}, dirty: [] };
+};
+var totals = (p) => ({
+  likes: (p?.likes?.length || 0) + (p?.moreLikes || 0),
+  shares: (p?.shares?.length || 0) + (p?.moreShares || 0)
+});
+function totalsFor(store, noteId) {
+  const st2 = store?.cache?.get?.(COUNTS) ?? store?.read?.(COUNTS, null);
+  return totals(st2?.posts?.[noteId]);
+}
+function save(store, st2, noteId) {
+  if (typeof store?.write !== "function") return;
+  if (noteId && !st2.dirty.includes(noteId)) st2.dirty.push(noteId);
+  const ids = Object.keys(st2.posts);
+  if (ids.length > MAX_POSTS) {
+    ids.sort((a, b) => String(st2.posts[a].at || "").localeCompare(String(st2.posts[b].at || "")));
+    for (const id of ids.slice(0, ids.length - MAX_POSTS)) delete st2.posts[id];
+    st2.dirty = st2.dirty.filter((id) => st2.posts[id]);
+  }
+  store.write(COUNTS, st2);
+}
+function recordReaction(store, type, noteId, actor) {
+  const kind = KIND[type];
+  if (!kind || !noteId || !actor) return false;
+  const st2 = load(store);
+  const p = st2.posts[noteId] || { likes: [], shares: [] };
+  const named = p[kind] || [];
+  if (named.includes(actor)) return false;
+  if (named.length >= MAX_NAMED) p[MORE[kind]] = (p[MORE[kind]] || 0) + 1;
+  else p[kind] = [...named, actor];
+  p.at = (/* @__PURE__ */ new Date()).toISOString();
+  st2.posts[noteId] = p;
+  save(store, st2, noteId);
+  return true;
+}
+function withdrawReaction(store, type, noteId, actor) {
+  const kind = KIND[type];
+  if (!kind || !noteId || !actor) return false;
+  const st2 = load(store);
+  const p = st2.posts[noteId];
+  if (!p) return false;
+  const named = p[kind] || [];
+  if (named.includes(actor)) p[kind] = named.filter((a) => a !== actor);
+  else if (p[MORE[kind]] > 0) p[MORE[kind]] -= 1;
+  else return false;
+  p.at = (/* @__PURE__ */ new Date()).toISOString();
+  save(store, st2, noteId);
+  return true;
+}
+function forgetCounts(store, noteId) {
+  const st2 = load(store);
+  if (!st2.posts[noteId] && !st2.dirty.includes(noteId)) return;
+  delete st2.posts[noteId];
+  st2.dirty = st2.dirty.filter((id) => id !== noteId);
+  save(store, st2, null);
+}
+function seed(intake) {
+  const { store } = intake;
+  if (typeof store?.read !== "function" || store.read(COUNTS, null)) return;
+  const notes = intake.urls?.notes;
+  const all = typeof store.getNotifications === "function" ? store.getNotifications() : [];
+  for (const n of [...all].reverse()) {
+    if (!notes || !String(n?.noteId || "").startsWith(notes)) continue;
+    if (n.type === "favourite") recordReaction(store, "Like", n.noteId, n.actor);
+    else if (n.type === "reblog") recordReaction(store, "Announce", n.noteId, n.actor);
+  }
+  if (!store.read(COUNTS, null)) store.write(COUNTS, { posts: {}, dirty: [] });
+}
+async function publishCounts(intake) {
+  seed(intake);
+  const st2 = load(intake.store);
+  if (!st2.dirty.length) return 0;
+  const left = [];
+  let wrote = 0;
+  for (const noteId of st2.dirty.slice(0, REWRITES_PER_SWEEP)) {
+    try {
+      const { doc, version: version2 } = await readVersioned(intake.remote, noteId);
+      if (!doc || typeof doc !== "object" || !doc.id || doc.type === "Tombstone") {
+        delete st2.posts[noteId];
+        continue;
+      }
+      const t = totals(st2.posts[noteId]);
+      const next = { ...doc, ...reactionCounts(t.likes, t.shares) };
+      if (JSON.stringify([next.likes, next.shares]) === JSON.stringify([doc.likes, doc.shares])) continue;
+      if (await writeIfUnchanged(intake.remote, doc.id, next, version2)) wrote++;
+      else left.push(noteId);
+    } catch (e) {
+      intake.log?.(`like and boost totals for ${noteId}: ${e.message}`);
+      left.push(noteId);
+    }
+  }
+  st2.dirty = [...left, ...st2.dirty.slice(REWRITES_PER_SWEEP)].filter((id) => st2.posts[id]);
+  intake.store.write(COUNTS, st2);
+  return wrote;
+}
+
+// lib/core/publisher/notes.mjs
 async function ensureMediaContainer(publisher) {
   if (publisher._mediaReady) return;
   if (await exists(publisher.remote, publisher.urls.media)) {
@@ -57505,7 +57499,9 @@ var FIXED = /* @__PURE__ */ new Set([
   "endTime",
   "closed",
   "votersCount",
-  "replies"
+  "replies",
+  "likes",
+  "shares"
 ]);
 async function updateObject(publisher, s, patch, { updated = (/* @__PURE__ */ new Date()).toISOString() } = {}) {
   const { urls } = publisher;
@@ -57798,7 +57794,8 @@ async function updateNote(publisher, s, { content, spoilerText = null, sensitive
     updated,
     container,
     also: [.../* @__PURE__ */ new Set([...s.named || [], ...reply ? [reply.actor] : []])],
-    quote: rowQuote(s)
+    quote: rowQuote(s),
+    ...totalsFor(publisher.store, s.noteId)
   });
   await write4(publisher.remote, note.id, note);
   await writeCreate(publisher.remote, createActivityId(note.id), createActivity(note, urls));
@@ -57851,7 +57848,8 @@ async function restateNote(publisher, s, { quote }) {
     updated: s.editedAt || null,
     container,
     also: [...reply ? [reply.actor] : [], ...s.quoteRequest?.actor ? [s.quoteRequest.actor] : []],
-    quote
+    quote,
+    ...totalsFor(publisher.store, s.noteId)
   });
   await write4(publisher.remote, note.id, note);
   await writeCreate(publisher.remote, createActivityId(note.id), createActivity(note, urls));
@@ -59464,14 +59462,18 @@ async function amplify(intake, noteId, { approved = false, activity = null } = {
     serial: intake.serial++,
     audience: intake.urls.actor
   });
+  if (intake.onCarry) {
+    const placed = await intake.onCarry({ noteId, actor: s.actor, activity: act, sent: activity });
+    if (placed === false) {
+      intake.log(`not amplified \u2014 ${noteId} has no place here`);
+      return;
+    }
+  }
   await intake.deliverer.deliverToAll(inboxes, act);
   intake.store.updateStatus(noteId, { announcedAt: (/* @__PURE__ */ new Date()).toISOString(), announceActivity: act });
   if (!intake.config.private) await intake.publisher.recordOutbox(act);
   intake.store.setPending(intake.store.getPending().filter((p) => p.noteId !== noteId));
   intake.log(`amplified ${noteId} \u2192 ${inboxes.length} inbox(es)`);
-  if (intake.onCarried) {
-    await intake.onCarried({ noteId, actor: s.actor, activity: act, sent: activity }).catch((e) => intake.log(`after the carry of ${noteId}: ${e.message}`));
-  }
   await intake.bskyGroup?.mirrorCarry(s).catch((e) => intake.log(`bluesky mirror of the carry failed: ${e.message}`));
 }
 async function isCoMember(intake, actor) {
@@ -59479,11 +59481,11 @@ async function isCoMember(intake, actor) {
   const groups = intake.store.getContacts().following.filter((f) => f.accepted && intake.store.getActors()[f.actor]?.type === "Group").map((f) => f.actor);
   if (!groups.length) return false;
   const cache = intake.store.read("comembers.json", {});
-  const fresh = Date.now() - CO_MEMBER_TTL_MS;
+  const fresh2 = Date.now() - CO_MEMBER_TTL_MS;
   let changed = false;
   for (const g of groups) {
     const held = cache[g];
-    if (held && Date.parse(held.at || 0) > fresh) continue;
+    if (held && Date.parse(held.at || 0) > fresh2) continue;
     const doc = await intake.fetchAP(g).catch(() => null);
     const list3 = doc?.followers ? await intake.collectionMembers(doc.followers) : null;
     if (!list3) continue;
@@ -59518,6 +59520,56 @@ function announceTargets(intake, author) {
   return [...byTarget].filter(([, who]) => !(who.size === 1 && who.has(author))).map(([t]) => t);
 }
 
+// lib/core/intake/received.mjs
+init_wire();
+var PAGE_SIZE = FOLLOWERS_PAGE_SIZE;
+var SEEN_MAX = 500;
+var ITEM_MAX_CHARS = 32 * 1024;
+var HELD_MAX = PAGE_SIZE * 5;
+var RECEIVED = "received.json";
+var fresh = () => ({ sealed: 0, open: [], total: 0, seen: [] });
+var keeps = (intake) => !!intake.archive && !!intake.urls?.ownInbox && intake.store.getConfig?.()?.archiveInbox !== false;
+function recordReceived(intake, activity) {
+  if (!keeps(intake) || !activity || typeof activity !== "object") return false;
+  const st2 = { ...fresh(), ...intake.store.read(RECEIVED, {}) };
+  const id = typeof activity.id === "string" ? activity.id : null;
+  if (id && st2.seen.includes(id)) return false;
+  st2.open.push(id && JSON.stringify(activity).length > ITEM_MAX_CHARS ? id : activity);
+  if (st2.open.length > HELD_MAX) st2.open.splice(0, st2.open.length - HELD_MAX);
+  st2.total += 1;
+  if (id) {
+    st2.seen.push(id);
+    if (st2.seen.length > SEEN_MAX) st2.seen.splice(0, st2.seen.length - SEEN_MAX);
+  }
+  intake.store.write(RECEIVED, st2);
+  intake._receivedDirty = true;
+  return true;
+}
+async function publishReceived(intake) {
+  if (!intake._receivedDirty || !keeps(intake)) return;
+  const ready = intake.publisher?.privateReady;
+  if (typeof ready === "function" && await ready.call(intake.publisher) !== true) return;
+  const { remote, urls } = intake;
+  const st2 = { ...fresh(), ...intake.store.read(RECEIVED, {}) };
+  do {
+    const n = st2.sealed + 1;
+    const items = st2.open.slice(0, PAGE_SIZE);
+    await writePage(
+      remote,
+      followersPageId(urls.ownInbox, n),
+      followersPage(urls.ownInbox, n, items, n)
+    );
+    if (items.length < PAGE_SIZE) break;
+    st2.sealed = n;
+    st2.open = st2.open.slice(PAGE_SIZE);
+    intake.store.write(RECEIVED, st2);
+  } while (st2.open.length);
+  const pages = Math.max(1, st2.sealed + (st2.open.length ? 1 : 0));
+  await writeHead(remote, urls.ownInbox, followersHead(urls.ownInbox, st2.total, pages));
+  intake.store.write(RECEIVED, st2);
+  intake._receivedDirty = false;
+}
+
 // lib/core/intake/activities.mjs
 var REACCEPT_MS = 60 * 60 * 1e3;
 var idOf = (v) => typeof v === "string" ? v : v?.id;
@@ -59534,7 +59586,7 @@ async function onFollow(intake, activity, actor, { trusted = false } = {}) {
   if (!doc.inbox) return `actor has no inbox (${actor})`;
   const contacts = intake.store.getContacts();
   const existing = contacts.followers.find((f) => f.actor === actor);
-  const unverifiedNeedsOk = intake.config.kind !== "group" && !intake.config.autoAcceptFollows && !trusted;
+  const unverifiedNeedsOk = intake.config.kind !== "group" && intake.config.autoAcceptFollows === false && !trusted;
   const mustApprove = intake.config.approveJoins || unverifiedNeedsOk;
   if (mustApprove && !existing) {
     const reqs = intake.store.getRequests();
@@ -59702,6 +59754,7 @@ async function onUndoReaction(intake, inner, actor, { trusted = false } = {}) {
     const type = inner.type === "Like" ? "favourite" : "reblog";
     const gone = intake.store.removeNotifications((n) => n.type === type && n.actor === actor && n.noteId === objectId);
     if (gone) intake.log(`${inner.type} withdrawn by ${actor} on ${objectId}`);
+    withdrawReaction(intake.store, inner.type, objectId, actor);
     return;
   }
   if (inner.type !== "Announce") return;
@@ -65369,6 +65422,7 @@ var Intake = class {
     this._draining = this._drainOnce().finally(async () => {
       this._inSweep = false;
       await this._publishPending();
+      await publishCounts(this).catch((e) => this.log(`like and boost totals: ${e.message}`));
       this.store.release?.();
       this._draining = null;
       if (this._drainAgain) {
@@ -65610,6 +65664,7 @@ var Intake = class {
       if (pending.length >= DELETE_BATCH && !await flush()) return;
     }
     if (!await this._finishSweep(flush)) return;
+    await publishReceived(this).catch((e) => this.log(`inbox collection: ${e.message}`));
     for (const stray of orphanReceipts(this.remote, this.urls).slice(0, ORPHAN_RECEIPTS_PER_SWEEP)) {
       if (!await dropStrayReceipt(this.remote, stray)) break;
       await new Promise((r) => setTimeout(r, DELETE_GAP_MS));
@@ -65640,7 +65695,10 @@ var Intake = class {
     if (activity && this.gatewaySecret()) this._bumpGatewayStat(!!receipt?.verified);
     const owned = activity && this.isOwnerPost(receipt);
     const rejection = !activity ? "unparsable JSON" : owned ? await this.ownerPostFrom(activity, raw, receipt) : await this.handle(activity, receipt);
-    if (!rejection && raw && !owned) await this._archive(url, raw, activity);
+    if (!rejection && raw && !owned) {
+      await this._archive(url, raw, activity);
+      recordReceived(this, activity);
+    }
     if (!rejection && !owned) await this._maybeForward(activity);
     if (rejection) {
       this.store.addDeadLetter({
@@ -65837,6 +65895,7 @@ var Intake = class {
             noteId: objectId,
             ...this.known(actor) ? {} : { unverified: true }
           });
+          recordReaction(this.store, activity.type, objectId, actor);
           return;
         }
         if (activity.type === "Announce") return this.onAnnounce(activity, actor, objectId);
@@ -66388,6 +66447,7 @@ async function deleteNote(agent2, s) {
     };
   }
   await dropReplies(agent2.remote, repliesId(s.noteId));
+  forgetCounts(agent2.store, s.noteId);
   if (s.atproto?.uri && agent2.atproto?.connected()) {
     await agent2.atproto.deleteCrossPost(s.atproto.uri).then(() => agent2.log?.(`bluesky mirror deleted: ${s.atproto.uri}`)).catch((e) => agent2.log?.(`bluesky mirror not deleted (${e.message}): ${s.atproto.uri}`));
   }
@@ -66495,7 +66555,6 @@ async function pinStatus(agent2, s, pinned) {
 // lib/client/c2s.mjs
 init_wire();
 var MAX_BODY = 512 * 1024;
-var MAX_INBOX_PAGE = 500;
 var MAX_OUTBOX_PAGE = 50;
 var ACTIVITY_TYPES = /* @__PURE__ */ new Set([
   "Create",
@@ -66563,72 +66622,33 @@ var C2S = class {
   byIri(iri) {
     return iri ? this.store.getStatuses().find((s) => s.noteId === iri) : null;
   }
-  /** The months the archive holds, newest first. One container listing. */
-  async archiveMonths() {
-    const archive = this.agent.intake?.archive;
-    if (!archive) return [];
-    const { names } = await archive.list("");
-    return (names || []).map((n) => n.replace(/\/$/u, "")).filter((n) => /^\d{4}-\d{2}$/u.test(n)).sort().reverse();
-  }
   /**
-   * The owner's own inbox, §5.2. Paged by month because that is how the
-   * archive is stored, so a page costs one listing and a read per item and no
-   * page is dearer for another month being large.
+   * The owner's own inbox, §5.2: the collection the drain keeps on the pod in
+   * the private container (intake/received.mjs), served under this agent's
+   * address so a client holding no pod credential of its own can read it.
+   * Nothing is built per request; a page is the pod's page.
    */
-  async sendInbox(res, url) {
-    const id = `${this.urls.base}ap/inbox`;
+  async sendInbox(res, url, origin) {
+    const id = `${origin}ap/inbox`;
+    const own = this.urls.ownInbox;
     const page2 = url?.searchParams?.get("page") || null;
-    let months;
+    if (page2 !== null && !/^[1-9]\d{0,6}$/u.test(page2)) return this.send(res, 400, { error: "page is a number" });
+    let doc;
     try {
-      months = await this.archiveMonths();
+      doc = await this.agent.remote.getJson(page2 ? `${own}-${page2}` : own);
     } catch (e) {
-      return this.send(res, 502, { error: `the archive could not be read: ${e.message}` });
+      return this.send(res, 502, { error: `the inbox collection could not be read: ${e.message}` });
     }
-    if (!page2) {
-      if (!months.length && this.store.getConfig()?.archiveInbox === false) {
+    if (!doc) {
+      if (page2) return this.send(res, 404, { error: "no such page" });
+      if (this.store.getConfig()?.archiveInbox === false) {
         this.log("inbox read: nothing to show \u2014 this identity does not keep what it receives");
       }
-      return this.send(res, 200, {
-        "@context": AS_CTX,
-        id,
-        type: "OrderedCollection",
-        ...months.length ? { first: `${id}?page=${months[0]}` } : { orderedItems: [] }
-      });
-    }
-    if (!/^\d{4}-\d{2}$/u.test(page2)) {
-      return this.send(res, 400, { error: "page names a month, written 2026-09" });
-    }
-    const archive = this.agent.intake?.archive;
-    let names = [];
-    try {
-      ({ names } = await archive.list(`${page2}/`));
-    } catch (e) {
-      return this.send(res, 502, { error: `the archive could not be read: ${e.message}` });
-    }
-    const files = (names || []).filter((n) => n.endsWith(".json")).sort();
-    if (files.length > MAX_INBOX_PAGE) {
-      this.log(`inbox read: ${page2} holds ${files.length} items; serving the first ${MAX_INBOX_PAGE}`);
-    }
-    const kept = [];
-    for (const file of files.slice(0, MAX_INBOX_PAGE)) {
-      const read2 = await archive.read(`${page2}/${file}`, { accept: "*/*" });
-      if (!read2?.ok || !read2.body) continue;
-      try {
-        const record = JSON.parse(read2.body);
-        kept.push({ at: record.receivedAt || "", activity: JSON.parse(record.raw) });
-      } catch {
-      }
+      return this.send(res, 200, { "@context": AS_CTX, id, type: "OrderedCollection", totalItems: 0, orderedItems: [] });
     }
-    kept.sort((a, b) => String(b.at).localeCompare(String(a.at)));
-    const older = months.filter((m) => m < page2)[0] || null;
-    return this.send(res, 200, {
-      "@context": AS_CTX,
-      id: `${id}?page=${page2}`,
-      type: "OrderedCollectionPage",
-      partOf: id,
-      ...older ? { next: `${id}?page=${older}` } : {},
-      orderedItems: kept.map((k) => k.activity)
-    });
+    const here = (v) => typeof v === "string" && v.startsWith(own) ? v === own ? id : v.replace(`${own}-`, `${id}?page=`) : v;
+    for (const k of ["id", "partOf", "first", "last", "next", "prev"]) if (k in doc) doc[k] = here(doc[k]);
+    return this.send(res, 200, doc);
   }
   // The actor a client-to-server client on this machine reads. The same
   // document the pod holds, but for the fields naming where a write goes —
@@ -66719,7 +66739,7 @@ var C2S = class {
       }
       const reader = await this.auth(req, pathname);
       if (!reader.ok) return this.send(res, reader.status, { error: reader.error }, reader.headers || {});
-      return this.sendInbox(res, url);
+      return this.sendInbox(res, url, this.localOrigin(req) || this.urls.base);
     }
     if (req.method === "GET" || req.method === "HEAD") {
       const owner = pathname === "/ap/outbox" && req.headers.authorization ? (await this.auth(req, pathname)).ok : false;
@@ -66739,7 +66759,7 @@ var C2S = class {
     }
     const who = await this.auth(req, pathname);
     if (!who.ok) return this.send(res, who.status, { error: who.error }, who.headers || {});
-    if (this.agent.viewer) {
+    if (this.agent.viewer || this.agent.sharesState) {
       const took = await this.agent.requestTakeover?.();
       if (!took) return this.send(res, 503, { error: "another agent is active for this pod \u2014 takeover failed, try again" });
     }
@@ -68400,6 +68420,7 @@ function quoteApproval(api, s) {
 }
 function status(api, s, { all, depth = 0 } = {}) {
   const replies = (all || api.store.getStatuses()).filter((x) => x.inReplyTo === s.noteId).length;
+  const counted = totalsFor(api.store, s.noteId);
   return {
     id: api.store.idFor(s.noteId),
     created_at: s.published || (/* @__PURE__ */ new Date()).toISOString(),
@@ -68413,8 +68434,8 @@ function status(api, s, { all, depth = 0 } = {}) {
     uri: s.noteId,
     url: s.link || s.noteId,
     replies_count: replies,
-    reblogs_count: 0,
-    favourites_count: 0,
+    reblogs_count: counted.shares,
+    favourites_count: counted.likes,
     // True when ANY of the owner's accounts holds it. The flag is really
     // what the next tap will do: an empty star on a post one account has
     // already liked invites a second outward like from a second identity.
@@ -69865,7 +69886,7 @@ var MastoApi = class _MastoApi {
       return send(403, { error: `This action is outside the authorized scopes (needs ${need})` });
     }
     if (!this.agent.configured()) return send(503, { error: "agent not configured" });
-    if ((this.agent.viewer || this.agent.copy) && req.method !== "GET" && req.method !== "HEAD") {
+    if ((this.agent.viewer || this.agent.sharesState) && req.method !== "GET" && req.method !== "HEAD") {
       const took = await this.agent.requestTakeover?.();
       if (!took) return send(503, { error: "another agent is active for this pod \u2014 takeover failed, try again" });
     }
@@ -70432,6 +70453,10 @@ var Deliverer = class {
   // passive: signing-only (viewer-mode agents) — no queue drain timer, so a
   // read-only agent never mutates shared delivery state. startQueue() flips
   // it live when a viewer is promoted to active.
+  // defer: nothing is sent now; every delivery goes on the queue, signed, for
+  // drainQueue() to make. For a process with seconds to answer — a door
+  // placing a post as it lands — which records what to send and leaves the
+  // sending to the run it starts.
   constructor({
     store,
     keyId,
@@ -70441,9 +70466,11 @@ var Deliverer = class {
     proofKeyId = null,
     log: log2 = console.log,
     passive = false,
+    defer = false,
     onGone = null
   }) {
     this.store = store;
+    this.defer = defer;
     this.onGone = onGone;
     this.keyId = keyId;
     this.rsaPrivate = rsaPrivate;
@@ -70564,6 +70591,10 @@ var Deliverer = class {
     this._sent(activity);
     if (this._blockedInbox(inbox)) return;
     const signed = await this.proofed(activity);
+    if (this.defer) {
+      this._enqueue({ inbox, activity: signed, attempts: 0, nextAt: Date.now() });
+      return;
+    }
     if (this._queueIfCooling(inbox, signed)) return;
     const [result] = await this.deliverManyNow([{ inbox, activity: signed }]);
     await this._settle(inbox, signed, result);
@@ -70634,6 +70665,10 @@ var Deliverer = class {
     this._sent(activity);
     const signed = await this.proofed(activity);
     const targets = [...new Set(inboxes)].filter((inbox) => !this._blockedInbox(inbox)).map((inbox) => ({ inbox, activity: signed }));
+    if (this.defer) {
+      for (const t of targets) this._enqueue({ inbox: t.inbox, activity: signed, attempts: 0, nextAt: Date.now() });
+      return;
+    }
     for (let i = 0; i < targets.length; i += this.batchSize) {
       const chunk = targets.slice(i, i + this.batchSize).filter((t) => !this._queueIfCooling(t.inbox, signed));
       if (!chunk.length) continue;
@@ -71063,15 +71098,15 @@ var ImportWorker = class {
       if (next.kind === "follow" && Date.now() - this.lastFollowAt < FOLLOW_GAP_MS) return;
       if (next.kind === "domain") {
         const b = agent2.store.getBlocklist();
-        const fresh = this.state();
-        if (!fresh?.rows) return;
-        for (const r of fresh.rows) {
+        const fresh2 = this.state();
+        if (!fresh2?.rows) return;
+        for (const r of fresh2.rows) {
           if (r.status !== "pending" || r.kind !== "domain") continue;
           if (!b.domains.includes(r.value)) b.domains.push(r.value);
           r.status = "done";
         }
         agent2.store.setBlocklist(b);
-        agent2.store.write(IMPORT_STATE_DOC, fresh);
+        agent2.store.write(IMPORT_STATE_DOC, fresh2);
         return;
       }
       const outcome = await this.applyRow(next);
@@ -71348,7 +71383,7 @@ var AdminFacade = class {
             image: cfg.image || null,
             fields: cfg.fields || [],
             aliases: cfg.aliases || [],
-            autoAcceptFollows: !!cfg.autoAcceptFollows,
+            autoAcceptFollows: cfg.autoAcceptFollows !== false,
             hasUiPassword: !!cfg.uiPassword,
             quiescedAt: cfg.quiescedAt || null,
             movedTo: cfg.movedTo || null,
@@ -71914,10 +71949,10 @@ async function completeGatewayMove(agent2) {
 }
 
 // stub:node:os
-var fail2 = () => {
+var fail = () => {
   throw new Error("node:os is not available in the browser agent");
 };
-var node_os_default = new Proxy({}, { get: () => fail2 });
+var node_os_default = new Proxy({}, { get: () => fail });
 
 // lib/shared/files.mjs
 function writeFileAtomic(file, body, { mode = 384 } = {}) {
@@ -73018,6 +73053,205 @@ var AcctFeed = class {
 // web/app/agent.mjs
 init_urls();
 
+// stub:node:fs/promises
+var fail2 = () => {
+  throw new Error("node:fs/promises is not available in the browser agent");
+};
+var promises_default = new Proxy({}, { get: () => fail2 });
+
+// lib/core/pod-only.mjs
+var podOnly = (name) => name === "keys.json" || name === "lease.json" || name.startsWith("conn-");
+
+// lib/core/storage.mjs
+var LDP2 = Namespace("http://www.w3.org/ns/ldp#");
+var slash = (u) => u.endsWith("/") ? u : u + "/";
+var HttpStorage = class {
+  constructor(base, fetchImpl) {
+    this.base = slash(base);
+    this.fetchImpl = fetchImpl;
+  }
+  get kind() {
+    return "pod";
+  }
+  // The same jail FileStorage has, and for the same reason: a path here can
+  // carry `..`, encodeURI leaves both `.` and `/` alone, and fetch normalises
+  // the segments away — so a name derived from remote input could name a
+  // resource outside the container entirely. A prefix check is not enough on
+  // its own: a concatenated URL always satisfies one.
+  _url(p) {
+    const u = new URL(encodeURI(p), this.base);
+    if (!u.href.startsWith(this.base)) throw new Error(`path escapes the container: ${p}`);
+    return u.href;
+  }
+  async list(sub = "", { etag } = {}) {
+    const url = this._url(sub);
+    const res = await this.fetchImpl(url, {
+      headers: { accept: "text/turtle", ...etag ? { "if-none-match": etag } : {} }
+    });
+    if (res.status === 304) return { notModified: true, names: null, etag };
+    if (res.status === 404) return { notModified: false, names: [], etag: null, missing: true };
+    if (res.status >= 400) throw new Error(`container unreadable (HTTP ${res.status})`);
+    const g = graph();
+    parse2(await res.text(), g, url, "text/turtle");
+    const here = namedNode2(url);
+    const names = g.each(here, LDP2("contains"), null, here).map((n) => n.value).filter((u) => u.startsWith(url) && u !== url).map((u) => decodeURIComponent(u.slice(url.length)));
+    return { notModified: false, names, etag: res.headers.get("etag") };
+  }
+  // `accept` is for callers reading something that is RDF but is wanted as it
+  // was written: asking turtle-first for a JSON-LD document gets turtle back,
+  // because the server is entitled to convert between two RDF syntaxes.
+  async read(p, { etag, accept } = {}) {
+    const res = await this.fetchImpl(this._url(p), {
+      headers: {
+        accept: accept || "text/turtle, application/json;q=0.9, */*;q=0.8",
+        ...etag ? { "if-none-match": etag } : {}
+      }
+    });
+    if (res.status === 304) return { ok: true, notModified: true, status: 304, body: null, etag };
+    if (res.status >= 400) return { ok: false, notModified: false, status: res.status, body: null, etag: null };
+    return { ok: true, notModified: false, status: res.status, body: await res.text(), etag: res.headers.get("etag") };
+  }
+  async write(p, body, contentType) {
+    const url = this._url(p);
+    try {
+      const res = await this.fetchImpl(url, {
+        method: "PUT",
+        headers: { "content-type": contentType },
+        body
+      });
+      if (res.status < 400) return { ok: true, retry: false, why: "" };
+      const retry = res.status >= 500 || res.status === 429;
+      const ra = Number(res.headers?.get?.("retry-after"));
+      return {
+        ok: false,
+        retry,
+        why: `HTTP ${res.status}`,
+        retryAfterMs: Number.isFinite(ra) && ra > 0 ? ra * 1e3 : 0
+      };
+    } catch (e) {
+      return { ok: false, retry: true, why: e.message, retryAfterMs: 0 };
+    }
+  }
+  async remove(p) {
+    const url = this._url(p);
+    try {
+      const res = await this.fetchImpl(url, { method: "DELETE" });
+      return res.status < 400 || res.status === 404;
+    } catch {
+      return false;
+    }
+  }
+};
+var StateApiStorage = class {
+  constructor(base, { fetchImpl = globalThis.fetch, token, holder, pod = null, onRefused = null, onGone = null }) {
+    this.base = slash(base);
+    this.fetchImpl = fetchImpl;
+    this.token = token;
+    this.holder = holder;
+    this.pod = pod;
+    this.onRefused = onRefused;
+    this.onGone = onGone;
+  }
+  get kind() {
+    return "copy";
+  }
+  async _gone(res) {
+    if (res.status !== 404 || !this.onGone) return false;
+    const said = await res.clone().json().catch(() => null);
+    if (!said?.gone) return false;
+    this.onGone();
+    return true;
+  }
+  _ask(p, init = {}) {
+    return this.fetchImpl(this.base + encodeURIComponent(p), {
+      ...init,
+      headers: { authorization: `Bearer ${this.token}`, ...init.headers || {} }
+    });
+  }
+  async list(sub = "", { etag } = {}) {
+    if (sub) return { notModified: false, names: [], etag: null };
+    const res = await this._ask("", { headers: etag ? { "if-none-match": etag } : {} });
+    if (res.status === 304) return { notModified: true, names: null, etag };
+    if (res.status >= 400) {
+      await this._gone(res);
+      throw new Error(`the account's copy at the gateway is unreadable (HTTP ${res.status})`);
+    }
+    const { names } = await res.json();
+    return { notModified: false, names, etag: res.headers.get("etag") };
+  }
+  async read(p, opts = {}) {
+    if (podOnly(p)) return this.pod ? this.pod.read(p, opts) : { ok: false, notModified: false, status: 404, body: null, etag: null };
+    const res = await this._ask(p, { headers: opts.etag ? { "if-none-match": opts.etag } : {} });
+    if (res.status === 304) return { ok: true, notModified: true, status: 304, body: null, etag: opts.etag };
+    if (res.status >= 400) {
+      await this._gone(res);
+      return { ok: false, notModified: false, status: res.status, body: null, etag: null };
+    }
+    return { ok: true, notModified: false, status: res.status, body: await res.text(), etag: res.headers.get("etag") };
+  }
+  async write(p, body, contentType = "application/json") {
+    if (podOnly(p)) return this.pod ? this.pod.write(p, body, contentType) : { ok: false, retry: false, why: "no pod for this document" };
+    try {
+      const res = await this._ask(p, { method: "PUT", headers: { "content-type": contentType, "x-fedipod-holder": this.holder }, body });
+      if (res.status < 400) return { ok: true, retry: false, why: "" };
+      if (res.status === 409) {
+        this.onRefused?.();
+        return { ok: false, retry: false, why: "another agent holds this account now", lost: true };
+      }
+      if (await this._gone(res)) return { ok: false, retry: false, why: "the gateway keeps no copy of this account now", lost: true };
+      return { ok: false, retry: res.status >= 500 || res.status === 429, why: `HTTP ${res.status}`, retryAfterMs: 0 };
+    } catch (e) {
+      return { ok: false, retry: true, why: e.message, retryAfterMs: 0 };
+    }
+  }
+  async remove(p) {
+    if (podOnly(p)) return this.pod ? this.pod.remove(p) : false;
+    try {
+      const res = await this._ask(p, { method: "DELETE", headers: { "x-fedipod-holder": this.holder } });
+      if (res.status === 409) {
+        this.onRefused?.();
+        return false;
+      }
+      if (await this._gone(res)) return false;
+      return res.status < 400 || res.status === 404;
+    } catch {
+      return false;
+    }
+  }
+};
+var FencedStorage = class {
+  constructor(inner, { fence = null, onRefused = null } = {}) {
+    this.inner = inner;
+    this.fence = fence;
+    this.onRefused = onRefused;
+  }
+  get kind() {
+    return this.inner.kind;
+  }
+  get base() {
+    return this.inner.base;
+  }
+  list(sub, opts) {
+    return this.inner.list(sub, opts);
+  }
+  read(p, opts) {
+    return this.inner.read(p, opts);
+  }
+  async _refused() {
+    if (!this.fence || await this.fence().catch(() => true)) return false;
+    this.onRefused?.();
+    return true;
+  }
+  async write(p, body, contentType) {
+    if (await this._refused()) return { ok: false, retry: false, why: "another agent holds this account now", lost: true };
+    return this.inner.write(p, body, contentType);
+  }
+  async remove(p) {
+    if (await this._refused()) return false;
+    return this.inner.remove(p);
+  }
+};
+
 // web/app/copy-mode.mjs
 var RENEW_BEFORE_MS = 2 * 36e5;
 var ASK_AGAIN_MS = 15 * 6e4;
@@ -73069,7 +73303,11 @@ function copyStorage(agent2, podState) {
     pod: podState,
     // Refused: another agent (an app at the gateway, another browser) took
     // the lease. This one stops acting at once rather than at its next renewal.
-    onRefused: () => standDown(agent2)
+    onRefused: () => standDown(agent2),
+    // No copy any more, and none to be made: the hold turned off.
+    onGone: () => {
+      backToPod(agent2).catch((e) => agent2.log(`back to the pod: ${e.message}`));
+    }
   });
   Object.defineProperty(s, "token", { get: () => agent2.copy.token, set() {
   } });
@@ -73078,11 +73316,28 @@ function copyStorage(agent2, podState) {
 function copyLeaseOf(agent2) {
   return new Lease({ url: `${agent2.copy.base}lease.json`, fetchImpl: tokenFetch(agent2), log: agent2.log, id: agent2.holderId });
 }
+var podFetchOf = (agent2) => (u, i) => agent2.remote.fetch(u, i);
+function podStorageOf(agent2) {
+  const s = new FencedStorage(new HttpStorage(agent2.urls.state, podFetchOf(agent2)), { onRefused: () => standDown(agent2) });
+  if (agent2._fenced) s.fence = () => stillMine(agent2);
+  return s;
+}
+async function stillMine(agent2) {
+  const cur = await agent2.lease.readFresh().catch(() => null);
+  if (!cur || typeof cur !== "object") return true;
+  return cur.holder === agent2.lease.id && Date.now() < cur.expiresAt;
+}
+function fencePod(agent2) {
+  agent2._fenced = !!(agent2._keeper?.kept && agent2._keeper.hold === false && !agent2.copy && !agent2.store?.getConfig()?.keeperOff);
+  const s = agent2.store?.storage;
+  if (s instanceof FencedStorage) s.fence = agent2._fenced ? () => stillMine(agent2) : null;
+}
+var byGateway = (holder) => holder === "gateway" || String(holder || "").startsWith("keeper:");
 function useLease(agent2, lease) {
   agent2.lease.stopRenewal();
   agent2.lease = lease;
   if (agent2.intake) agent2.intake.lease = lease;
-  lease.onLost = () => agent2.demote();
+  lease.onLost = () => agent2.copy || agent2._fenced ? standDown(agent2) : agent2.demote();
 }
 async function ensureCopyLease(agent2) {
   const cur = await agent2.lease.readFresh().catch(() => null);
@@ -73117,7 +73372,7 @@ function standDown(agent2) {
         await new Promise((r) => setTimeout(r, wait));
         if (!agent2.viewer) return;
         const cur = await agent2.lease.readFresh().catch(() => null);
-        if (cur && typeof cur === "object" && cur.holder !== "gateway" && Date.now() < cur.expiresAt) return;
+        if (cur && typeof cur === "object" && !byGateway(cur.holder) && Date.now() < cur.expiresAt) return;
         if (await agent2.lease.acquire()) {
           clearTimeout(agent2._viewerTimer);
           agent2._viewerTimer = null;
@@ -73165,21 +73420,40 @@ async function leaveCopy(agent2) {
     return { ok: false, why: `the gateway could not write the copy to the pod (${res.status || res.e?.message})` };
   }
   agent2.copy = null;
-  const podFetch = (u, i) => agent2.remote.fetch(u, i);
-  const lease = new Lease({ url: `${agent2.urls.state}lease.json`, fetchImpl: podFetch, log: agent2.log, id: agent2.holderId });
-  agent2.store.attach(new HttpStorage(agent2.urls.state, podFetch));
-  await agent2.store.load({ force: true });
+  const lease = new Lease({ url: `${agent2.urls.state}lease.json`, fetchImpl: podFetchOf(agent2), log: agent2.log, id: agent2.holderId });
+  agent2.store.attach(podStorageOf(agent2));
   useLease(agent2, lease);
+  fencePod(agent2);
+  await agent2.store.load({ force: true });
   if (await lease.acquire()) lease.startRenewal();
   else agent2.demote();
   agent2.log("working from the pod again");
   return { ok: true };
 }
+async function backToPod(agent2) {
+  if (!agent2.copy || agent2._backToPod) return;
+  agent2._backToPod = true;
+  try {
+    await agent2.store.discardPending();
+    agent2.lease.stopRenewal();
+    agent2.copy = null;
+    const lease = new Lease({ url: `${agent2.urls.state}lease.json`, fetchImpl: podFetchOf(agent2), log: agent2.log, id: agent2.holderId });
+    agent2.store.attach(podStorageOf(agent2));
+    useLease(agent2, lease);
+    fencePod(agent2);
+    await agent2.store.load({ force: true });
+    if (await lease.acquire()) lease.startRenewal();
+    else agent2.demote();
+    agent2.log("the gateway keeps no copy of this account now: working from the pod");
+  } finally {
+    agent2._backToPod = false;
+  }
+}
 async function handOverCopy(agent2) {
   if (!agent2.copy) return { ok: true };
   await agent2.store.commit();
-  const podFetch = (u, i) => agent2.remote.fetch(u, i);
-  const pod = new HttpStorage(agent2.urls.state, podFetch);
+  const podFetch = podFetchOf(agent2);
+  const pod = podStorageOf(agent2);
   const docs = agent2.store.names().filter((n) => !podOnly(n)).map((n) => [n, agent2.store.read(n, null)]).filter(([, v]) => v !== null);
   for (const [name, value] of docs) {
     const w = await pod.write(name, JSON.stringify(value, null, 2) + "\n", "application/json");
@@ -73191,16 +73465,30 @@ async function handOverCopy(agent2) {
   if (res.status !== 200) return { ok: false, why: `the gateway would not let the copy go (${res.status || res.e?.message})` };
   agent2.copy = null;
   agent2.store.attach(pod);
-  await agent2.store.load({ force: true });
   useLease(agent2, podLease);
+  fencePod(agent2);
+  await agent2.store.load({ force: true });
   podLease.startRenewal();
   agent2.log(`handed the account's copy over: ${docs.length} documents written to the pod`);
   return { ok: true };
 }
+async function followHold(agent2, frontOrigin, hold) {
+  if (!agent2._keeper) return;
+  const was = agent2._keeper.hold;
+  agent2._keeper.hold = hold;
+  if (!hold && agent2.copy) {
+    const left = await leaveCopy(agent2);
+    if (!left.ok) agent2.log(`the gateway keeps no copies now; leaving this one: ${left.why}`);
+  } else if (hold && was === false && !agent2.copy && agent2._keeper.kept && !agent2.viewer && !agent2.store.getConfig()?.keeperOff) {
+    await forgetFailedOpen(agent2, frontOrigin);
+    await moveIntoCopy(agent2, frontOrigin);
+  }
+  fencePod(agent2);
+}
 async function renewCopyToken(agent2, frontOrigin) {
   if (!agent2.copy || agent2.copy.expiresAt - Date.now() > RENEW_BEFORE_MS) return;
-  const fresh = await openCopy(agent2, frontOrigin, { handle: agent2.copy.handle });
-  if (fresh) agent2.copy = fresh;
+  const fresh2 = await openCopy(agent2, frontOrigin, { handle: agent2.copy.handle });
+  if (fresh2) agent2.copy = fresh2;
 }
 
 // web/app/agent.mjs
@@ -73273,11 +73561,17 @@ var BrowserAgent = class _BrowserAgent {
   configured() {
     return !!this.store?.getConfig();
   }
+  // Whether the gateway acts on this account's state too: its copy there, or
+  // with the gateway's hold off, its pod (copy-mode.mjs). An action here then
+  // makes sure of the lease first (requestTakeover).
+  get sharesState() {
+    return !!(this.copy || this._fenced);
+  }
   // Asked by every write / destructive path before it acts. If we already hold
   // the lease, proceed. If we are a viewer, the owner acting HERE outranks the
   // idle active device: claim the lease outright and become active.
   async requestTakeover() {
-    if (!this.viewer && this.copy) await ensureCopyLease(this);
+    if (!this.viewer && this.sharesState) await ensureCopyLease(this);
     if (!this.viewer) return true;
     if (!await this.lease.takeover()) return false;
     clearTimeout(this._viewerTimer);
@@ -73333,6 +73627,7 @@ var BrowserAgent = class _BrowserAgent {
       const said2 = await this.tellGateway("keeper", { handle: this.doorKey, on: false });
       if (said2?.status !== 200) return said2 || { status: 502 };
       this._keeper.kept = false;
+      fencePod(this);
       if (this.masto) this.masto.scheduling = false;
     }
     this.remote.keepers = on ? [webId] : [];
@@ -73344,6 +73639,7 @@ var BrowserAgent = class _BrowserAgent {
     if (said?.status === 200) {
       await forgetFailedOpen(this, this.frontOrigin);
       this._keeper.kept = true;
+      fencePod(this);
       if (this.masto) this.masto.scheduling = true;
       this.log("the gateway keeps this account running while the app is closed");
     }
@@ -73363,6 +73659,9 @@ var BrowserAgent = class _BrowserAgent {
     const said = await this.tellGateway("here", { handle: this.doorKey, nextAt: this.store ? nextDue(this.store) : null });
     if (said?.status === 200) saveMeta(this.webId, { hereAt: Date.now() }).catch(() => {
     });
+    if (said?.status === 200 && typeof said.hold === "boolean") {
+      await followHold(this, this.frontOrigin, said.hold).catch((e) => this.log(`the gateway's hold: ${e.message}`));
+    }
     return said;
   }
   // The hourly "still here". A worker the browser killed and restarted is the
@@ -73397,7 +73696,7 @@ var BrowserAgent = class _BrowserAgent {
     this._openTimer = setInterval(() => {
       this.checkInAtGateway();
     }, _BrowserAgent.OPEN_EVERY_MS);
-    this.lease.onLost = () => this.copy ? standDown(this) : this.demote();
+    this.lease.onLost = () => this.sharesState ? standDown(this) : this.demote();
     this.lease.startRenewal();
     try {
       if (!warm) {
@@ -73568,7 +73867,7 @@ var BrowserAgent = class _BrowserAgent {
     ).catch(() => null))?.root || DEFAULT_ROOT;
     this.urls = apUrls2(remotePod, root);
     const podFetch = (u, i) => this.remote.fetch(u, i);
-    const podStateStorage = new HttpStorage(this.urls.state, podFetch);
+    const podStateStorage = podStorageOf(this);
     this.store = new PodStore({ storage: this.copy ? copyStorage(this, podStateStorage) : podStateStorage, log: this.log });
     keepInStep(this.store, webId, this.log);
     this.lease = this.copy ? copyLeaseOf(this) : new Lease({ url: this.urls.state + "lease.json", fetchImpl: podFetch, log: this.log, id: this.holderId });
@@ -73626,8 +73925,9 @@ var BrowserAgent = class _BrowserAgent {
       e.code = "address-closed";
       throw e;
     }
-    this._keeper = standing?.keeper ? { webId: standing.keeper, kept: !!standing.kept, keptBy: standing.keptBy || null } : null;
+    this._keeper = standing?.keeper ? { webId: standing.keeper, kept: !!standing.kept, keptBy: standing.keptBy || null, hold: standing.hold !== false } : null;
     if (this._keeper && !this.store.getConfig()?.keeperOff) this.remote.keepers = [this._keeper.webId];
+    fencePod(this);
     this.publisher = new Publisher({
       config: this.store.getConfig(),
       remote: this.remote,