fedipod 1.45.0 → 1.48.0

package/web/admin/index.html

@@ -340,16 +340,8 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
     title="   Go back to your pod's own inbox">Detach from gateway</button>
   <!-- Shown only when the agent reports the account's standing at the gateway
        (the browser build does; a DeviceAgent's admin does not). -->
-  <button type="button" id="gateway-pause" class="inline" hidden
-    title="   Stop keeping the posts sent to you until you resume; follows still arrive">Pause my account</button>
-  <button type="button" id="gateway-resume" class="inline" hidden
-    title="   Keep the posts sent to you again">Resume my account</button>
   <button type="button" id="gateway-keep-on" class="inline" hidden
     title="   Let this gateway accept follows, try again what failed to go out and publish scheduled posts while FediPod is closed">Keep my account running while I'm away</button>
-  <button type="button" id="gateway-keep-off" class="inline" hidden
-    title="   Act only while FediPod is open; the rule naming this gateway comes off your pod">Stop keeping it running</button>
-  <button type="button" id="gateway-close" class="inline danger" hidden data-confirm="close-address"
-    title="   Close your address at this gateway for good; nothing on your pod is touched">Close this address</button>
 </span>
 
 <section id="pane-group" hidden>
@@ -545,14 +537,6 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
     <label for="confirm-handle">Type the handle to confirm</label>
     <input type="text" id="confirm-handle" autocomplete="off">
   </div>
-  <div id="warn-close-address" class="warn" hidden>
-    <p><strong>This cannot be undone.</strong> Your address at the gateway is closed for good:
-      mail to it is turned away, other servers drop the account the next time they look, and
-      nobody can take the name. Nothing on your pod is touched — your posts, key and data stay
-      where they are.</p>
-    <label for="confirm-handle-close">Type the handle to confirm</label>
-    <input type="text" id="confirm-handle-close" autocomplete="off">
-  </div>
   <!-- "Move private data" (POST /state-move) had a panel here and no way to
        open it: nothing in this page has ever carried data-confirm="move-state",
        so the panel was only ever hidden. Removed 2026-09-09 rather than left as

package/web/admin/record.js

@@ -94,7 +94,6 @@ function resetConfirm() {
   for (const k of Object.keys(LIFECYCLE)) $(`warn-${k}`)?.hidden !== undefined && ($(`warn-${k}`).hidden = true);
   $('confirm-handle').value = '';
   $('confirm-handle-move').value = '';
-  $('confirm-handle-close').value = '';
   $('move-target').value = '';
 }
 function closePanels(keep = null) {
@@ -325,7 +324,7 @@ function render() {
       dd.textContent = '';
       dd.append(FOLLOWS_CTL);
       FOLLOWS_CTL.hidden = false;
-      FOLLOWS_PICK.value = config.autoAcceptFollows ? 'auto' : 'approve';
+      FOLLOWS_PICK.value = config.autoAcceptFollows !== false ? 'auto' : 'approve';
     }
     if (k === 'gateway') {
       dd.textContent = '';

package/web/admin/upkeep.js

@@ -76,9 +76,6 @@ const LIFECYCLE = {
   retire: { path: '/retire', title: 'Retire this identity', go: 'Retire it', danger: true, done: (r) => `retired ${r.deletedAt}: Delete delivered to ${r.inboxes} inbox(es)` },
   move: { path: '/move', title: 'Transfer this account away', go: 'Transfer it', focus: 'move-target',
     done: (r) => `transferred to ${r.target}: Move delivered to ${r.inboxes} inbox(es), unfollowed ${r.unfollowed}/${r.following}` },
-  // The address at the gateway, not the identity: the pod keeps everything.
-  'close-address': { path: '/gateway/close', title: 'Close this address', go: 'Close it', danger: true, focus: 'confirm-handle-close',
-    done: (r) => (r.closed ? 'closed — this address is gone for good; everything on your pod is untouched' : 'not closed') },
 };
 let pending = null;
 
@@ -122,8 +119,7 @@ $('confirm-form').addEventListener('submit', async (ev) => {
   const what = pending;
   const body = what === 'retire' ? { confirm: $('confirm-handle').value.trim() }
     : what === 'move' ? { target: $('move-target').value.trim(), confirm: $('confirm-handle-move').value.trim() }
-      : what === 'close-address' ? { confirm: $('confirm-handle-close').value.trim() }
-        : {};
+      : {};
   if (what === 'move' && !body.target) { say('name the account to transfer to', 'err'); return; }
   $('confirm-go').disabled = true;
   say(`${what} — this talks to the pod and to other servers, so it takes a moment`);

package/web/app/admin-facade.mjs

@@ -120,7 +120,7 @@ export class AdminFacade {
             name: cfg.name || null, summary: cfg.summary || null, icon: cfg.icon || null,
             image: cfg.image || null, fields: cfg.fields || [],
             aliases: cfg.aliases || [],
-            autoAcceptFollows: !!cfg.autoAcceptFollows,
+            autoAcceptFollows: cfg.autoAcceptFollows !== false,
             hasUiPassword: !!cfg.uiPassword,
             quiescedAt: cfg.quiescedAt || null, movedTo: cfg.movedTo || null,
             mode: a.status().mode,

package/web/app/agent.mjs

@@ -13,7 +13,6 @@ import { findAccount } from '../../lib/core/place.mjs';
 import * as containers from '../../lib/pod/containers.mjs';
 import * as podState from '../../lib/pod/state.mjs';
 import { PodStore } from '../../lib/core/store.mjs';
-import { HttpStorage } from '../../lib/core/storage.mjs';
 import { Publisher } from '../../lib/core/publisher/index.mjs';
 import { Intake } from '../../lib/core/intake/index.mjs';
 import { C2S } from '../../lib/client/c2s.mjs';
@@ -34,7 +33,8 @@ import { AcctFeed } from '../../lib/connections/acctfeed.mjs';
 import { followActor, unfollowActor, resolveHandle } from '../../lib/core/social.mjs';
 import { podBaseOfWebId } from '../../lib/pod/urls.mjs';
 import { ImportWorker } from '../../lib/connections/import.mjs';
-import { openCopy, copyStorage, copyLeaseOf, moveIntoCopy, leaveCopy, renewCopyToken, standDown, ensureCopyLease, handOverCopy, forgetFailedOpen } from './copy-mode.mjs';
+import { openCopy, copyStorage, copyLeaseOf, moveIntoCopy, leaveCopy, renewCopyToken, standDown, ensureCopyLease, handOverCopy, forgetFailedOpen,
+  podStorageOf, fencePod, followHold } from './copy-mode.mjs';
 
 // The authorities this identity answers on: exactly one, this origin. The Node
 // agent gets this from lib/guard.mjs, which is not in the browser bundle and
@@ -129,13 +129,19 @@ export class BrowserAgent {
 
   configured() { return !!this.store?.getConfig(); }
 
+  // Whether the gateway acts on this account's state too: its copy there, or
+  // with the gateway's hold off, its pod (copy-mode.mjs). An action here then
+  // makes sure of the lease first (requestTakeover).
+  get sharesState() { return !!(this.copy || this._fenced); }
+
   // Asked by every write / destructive path before it acts. If we already hold
   // the lease, proceed. If we are a viewer, the owner acting HERE outranks the
   // idle active device: claim the lease outright and become active.
   async requestTakeover() {
-    // Working from the copy, an app at the gateway may have taken the lease
-    // since this browser last looked: asked now, before acting (copy-mode.mjs).
-    if (!this.viewer && this.copy) await ensureCopyLease(this);
+    // Working from the copy, or on the pod with the hold off, an app at the
+    // gateway may have taken the lease since this browser last looked: asked
+    // now, before acting (copy-mode.mjs).
+    if (!this.viewer && this.sharesState) await ensureCopyLease(this);
     if (!this.viewer) return true;
     if (!(await this.lease.takeover())) return false;
     clearTimeout(this._viewerTimer); this._viewerTimer = null;
@@ -182,6 +188,7 @@ export class BrowserAgent {
       const said = await this.tellGateway('keeper', { handle: this.doorKey, on: false });
       if (said?.status !== 200) return said || { status: 502 };
       this._keeper.kept = false;
+      fencePod(this);
       if (this.masto) this.masto.scheduling = false;
     }
     this.remote.keepers = on ? [webId] : [];
@@ -194,6 +201,7 @@ export class BrowserAgent {
       // A copy that could not be had while the account was not kept may be now.
       await forgetFailedOpen(this, this.frontOrigin);
       this._keeper.kept = true;
+      fencePod(this);
       if (this.masto) this.masto.scheduling = true;
       this.log('the gateway keeps this account running while the app is closed');
     }
@@ -211,6 +219,10 @@ export class BrowserAgent {
   async hereAtGateway() {
     const said = await this.tellGateway('here', { handle: this.doorKey, nextAt: this.store ? nextDue(this.store) : null });
     if (said?.status === 200) saveMeta(this.webId, { hereAt: Date.now() }).catch(() => {});
+    // The gateway's admin may have turned the hold off or on (copy-mode.mjs).
+    if (said?.status === 200 && typeof said.hold === 'boolean') {
+      await followHold(this, this.frontOrigin, said.hold).catch((e) => this.log(`the gateway's hold: ${e.message}`));
+    }
     return said;
   }
 
@@ -244,9 +256,10 @@ export class BrowserAgent {
     // Reading here is being here: the gateway hears so once an hour.
     clearInterval(this._openTimer);
     this._openTimer = setInterval(() => { this.checkInAtGateway(); }, BrowserAgent.OPEN_EVERY_MS);
-    // Working from the copy, an app at the gateway takes the lease only while
-    // it acts, and this browser takes it back (copy-mode.mjs).
-    this.lease.onLost = () => (this.copy ? standDown(this) : this.demote());
+    // Working from the copy, or on the pod with the hold off, an app at the
+    // gateway takes the lease only while it acts, and this browser takes it
+    // back (copy-mode.mjs).
+    this.lease.onLost = () => (this.sharesState ? standDown(this) : this.demote());
     this.lease.startRenewal();
     try {
       // Forced, not revalidated, when this device WATCHED first: the active
@@ -441,7 +454,8 @@ export class BrowserAgent {
     // the deletion deny-list that every other write on this agent observes.
     // The Node agent has always passed remote.fetch here.
     const podFetch = (u, i) => this.remote.fetch(u, i);
-    const podStateStorage = new HttpStorage(this.urls.state, podFetch);
+    // Fenced once the gateway is known to act on the pod too (fencePod below).
+    const podStateStorage = podStorageOf(this);
     this.store = new PodStore({ storage: this.copy ? copyStorage(this, podStateStorage) : podStateStorage, log: this.log });
     keepInStep(this.store, webId, this.log);
     // Single-active-agent lease (lib/lease.mjs): the inbox drain is a
@@ -545,8 +559,11 @@ export class BrowserAgent {
     // The gateway's own pod identity, when it can act for this account while
     // the app is closed (lib/gateway/keeper.mjs). Unless the owner turned that
     // off, every rule this agent writes names it beside the owner.
-    this._keeper = standing?.keeper ? { webId: standing.keeper, kept: !!standing.kept, keptBy: standing.keptBy || null } : null;
+    // `hold`: whether it keeps a copy of the account at all (copy-mode.mjs).
+    this._keeper = standing?.keeper
+      ? { webId: standing.keeper, kept: !!standing.kept, keptBy: standing.keptBy || null, hold: standing.hold !== false } : null;
     if (this._keeper && !this.store.getConfig()?.keeperOff) this.remote.keepers = [this._keeper.webId];
+    fencePod(this);
 
     this.publisher = new Publisher({
       config: this.store.getConfig(), remote: this.remote, store: this.store,

package/web/app/copy-mode.mjs

@@ -4,9 +4,16 @@
 //
 // The state documents are read and written at the gateway instead of on the
 // pod, and the lease that says which agent acts is the copy's. What stays on
-// the pod (the key, connected-account passwords) is still read there. The
-// gateway writes the copy to the pod every fifteen minutes.
-import { HttpStorage, StateApiStorage, podOnly } from '../../lib/core/storage.mjs';
+// the pod (the key, connected-account passwords) is still read there. Every
+// fifteen minutes the gateway writes the copy to the pod and deletes it, and
+// makes it again from the pod when this browser next reads or writes (the
+// hold); the copy's lease stays, so nothing here notices.
+//
+// With the hold off, the gateway keeps no copy, and this browser works on the
+// pod while the gateway acts there too for an app. The pod's lease decides
+// which acts, and every write first checks this browser still holds it
+// (fencePod), as the copy checks every write.
+import { HttpStorage, StateApiStorage, FencedStorage, podOnly } from '../../lib/core/storage.mjs';
 import { Lease } from '../../lib/core/lease.mjs';
 import { kvGet, kvPut, kvDel } from './idb-kv.mjs';
 
@@ -76,6 +83,8 @@ export function copyStorage(agent, podState) {
     // Refused: another agent (an app at the gateway, another browser) took
     // the lease. This one stops acting at once rather than at its next renewal.
     onRefused: () => standDown(agent),
+    // No copy any more, and none to be made: the hold turned off.
+    onGone: () => { backToPod(agent).catch((e) => agent.log(`back to the pod: ${e.message}`)); },
   });
   Object.defineProperty(s, 'token', { get: () => agent.copy.token, set() {} });
   return s;
@@ -85,12 +94,44 @@ export function copyLeaseOf(agent) {
   return new Lease({ url: `${agent.copy.base}lease.json`, fetchImpl: tokenFetch(agent), log: agent.log, id: agent.holderId });
 }
 
+const podFetchOf = (agent) => (u, i) => agent.remote.fetch(u, i);
+
+/** The account's state on the pod, fenced when the gateway may act there too. */
+export function podStorageOf(agent) {
+  const s = new FencedStorage(new HttpStorage(agent.urls.state, podFetchOf(agent)), { onRefused: () => standDown(agent) });
+  if (agent._fenced) s.fence = () => stillMine(agent);
+  return s;
+}
+
+// Whether this browser still holds the pod's lease, asked before a write.
+// Unreadable is a yes: the write goes, as it would have without the check.
+async function stillMine(agent) {
+  const cur = await agent.lease.readFresh().catch(() => null);
+  if (!cur || typeof cur !== 'object') return true;
+  return cur.holder === agent.lease.id && Date.now() < cur.expiresAt;
+}
+
+/**
+ * Whether this browser's writes to the pod are fenced: the account kept, with
+ * the hold off, and no copy. Set on the store's storage as it is now.
+ */
+export function fencePod(agent) {
+  agent._fenced = !!(agent._keeper?.kept && agent._keeper.hold === false && !agent.copy && !agent.store?.getConfig()?.keeperOff);
+  const s = agent.store?.storage;
+  if (s instanceof FencedStorage) s.fence = agent._fenced ? () => stillMine(agent) : null;
+}
+
+// A lease held by the gateway, which gives it back when its piece of work is
+// done: the copy's ('gateway', copy.mjs), or with the hold off the pod's
+// (lib/gateway/account-agent.mjs: keeper:<its WebID>).
+const byGateway = (holder) => holder === 'gateway' || String(holder || '').startsWith('keeper:');
+
 // Swap the lease the agent and its drain go by.
 function useLease(agent, lease) {
   agent.lease.stopRenewal();
   agent.lease = lease;
   if (agent.intake) agent.intake.lease = lease;
-  lease.onLost = () => agent.demote();
+  lease.onLost = () => (agent.copy || agent._fenced ? standDown(agent) : agent.demote());
 }
 
 /**
@@ -137,8 +178,8 @@ export function standDown(agent) {
         await new Promise((r) => setTimeout(r, wait));
         if (!agent.viewer) return;
         const cur = await agent.lease.readFresh().catch(() => null);
-        // Held by anyone but the gateway (copy.mjs: GATEWAY_HOLDER) is another browser's.
-        if (cur && typeof cur === 'object' && cur.holder !== 'gateway' && Date.now() < cur.expiresAt) return;
+        // Held by anyone but the gateway is another browser's.
+        if (cur && typeof cur === 'object' && !byGateway(cur.holder) && Date.now() < cur.expiresAt) return;
         if (await agent.lease.acquire()) {
           clearTimeout(agent._viewerTimer); agent._viewerTimer = null;
           // Read what the app wrote, then carry on as a restart moments later
@@ -195,16 +236,39 @@ export async function leaveCopy(agent) {
     return { ok: false, why: `the gateway could not write the copy to the pod (${res.status || res.e?.message})` };
   }
   agent.copy = null;
-  const podFetch = (u, i) => agent.remote.fetch(u, i);
-  const lease = new Lease({ url: `${agent.urls.state}lease.json`, fetchImpl: podFetch, log: agent.log, id: agent.holderId });
-  agent.store.attach(new HttpStorage(agent.urls.state, podFetch));
-  await agent.store.load({ force: true });
+  const lease = new Lease({ url: `${agent.urls.state}lease.json`, fetchImpl: podFetchOf(agent), log: agent.log, id: agent.holderId });
+  agent.store.attach(podStorageOf(agent));
   useLease(agent, lease);
+  fencePod(agent);
+  await agent.store.load({ force: true });
   if (await lease.acquire()) lease.startRenewal(); else agent.demote();
   agent.log('working from the pod again');
   return { ok: true };
 }
 
+/**
+ * The gateway keeps no copy of this account any more and will make none (its
+ * admin turned the hold off): back to the pod, where the gateway wrote the
+ * copy. Writes not yet sent are dropped, as when another agent acts, and the
+ * state is read afresh from the pod.
+ */
+export async function backToPod(agent) {
+  if (!agent.copy || agent._backToPod) return;
+  agent._backToPod = true;
+  try {
+    await agent.store.discardPending();
+    agent.lease.stopRenewal();
+    agent.copy = null;
+    const lease = new Lease({ url: `${agent.urls.state}lease.json`, fetchImpl: podFetchOf(agent), log: agent.log, id: agent.holderId });
+    agent.store.attach(podStorageOf(agent));
+    useLease(agent, lease);
+    fencePod(agent);
+    await agent.store.load({ force: true });
+    if (await lease.acquire()) lease.startRenewal(); else agent.demote();
+    agent.log('the gateway keeps no copy of this account now: working from the pod');
+  } finally { agent._backToPod = false; }
+}
+
 /**
  * The gateway has a new identity, and this account's copy was kept under the
  * old one, which the new one cannot write back for (the owner's rules name the
@@ -218,8 +282,8 @@ export async function leaveCopy(agent) {
 export async function handOverCopy(agent) {
   if (!agent.copy) return { ok: true };
   await agent.store.commit();
-  const podFetch = (u, i) => agent.remote.fetch(u, i);
-  const pod = new HttpStorage(agent.urls.state, podFetch);
+  const podFetch = podFetchOf(agent);
+  const pod = podStorageOf(agent);
   const docs = agent.store.names().filter((n) => !podOnly(n)).map((n) => [n, agent.store.read(n, null)]).filter(([, v]) => v !== null);
   for (const [name, value] of docs) {
     const w = await pod.write(name, JSON.stringify(value, null, 2) + '\n', 'application/json');
@@ -232,13 +296,34 @@ export async function handOverCopy(agent) {
   if (res.status !== 200) return { ok: false, why: `the gateway would not let the copy go (${res.status || res.e?.message})` };
   agent.copy = null;
   agent.store.attach(pod);
-  await agent.store.load({ force: true });
   useLease(agent, podLease);
+  fencePod(agent);
+  await agent.store.load({ force: true });
   podLease.startRenewal();
   agent.log(`handed the account's copy over: ${docs.length} documents written to the pod`);
   return { ok: true };
 }
 
+/**
+ * The gateway's admin turned the hold off or on since this browser last
+ * heard (agent.mjs: hereAtGateway): off, the copy goes back to the pod and
+ * writes there are fenced; on, the account moves onto a copy again.
+ */
+export async function followHold(agent, frontOrigin, hold) {
+  if (!agent._keeper) return;
+  const was = agent._keeper.hold;
+  agent._keeper.hold = hold;
+  // Asked again at every check-in until the copy has gone.
+  if (!hold && agent.copy) {
+    const left = await leaveCopy(agent);
+    if (!left.ok) agent.log(`the gateway keeps no copies now; leaving this one: ${left.why}`);
+  } else if (hold && was === false && !agent.copy && agent._keeper.kept && !agent.viewer && !agent.store.getConfig()?.keeperOff) {
+    await forgetFailedOpen(agent, frontOrigin);
+    await moveIntoCopy(agent, frontOrigin);
+  }
+  fencePod(agent);
+}
+
 /** A token near its end, renewed; the hourly check-in asks. */
 export async function renewCopyToken(agent, frontOrigin) {
   if (!agent.copy || agent.copy.expiresAt - Date.now() > RENEW_BEFORE_MS) return;

package/web/app/dist/boot.js

@@ -32544,52 +32544,6 @@ var REL = {
 };
 
 // lib/pod/urls.mjs
-function apUrls(remotePod, root, { publicBase = null } = {}) {
-  if (!root) throw new Error("apUrls: a container root is required \u2014 the caller states it, this library does not guess");
-  const base = remotePod.endsWith("/") ? remotePod : remotePod + "/";
-  const home = base + (root.endsWith("/") ? root : root + "/");
-  const face = publicBase ? publicBase.endsWith("/") ? publicBase : publicBase + "/" : home;
-  const urls = {
-    base,
-    home,
-    webfinger: base + ".well-known/webfinger",
-    actor: face + "ap/actor",
-    inbox: face + "ap/inbox/",
-    outbox: face + "ap/outbox",
-    followers: face + "ap/followers",
-    following: face + "ap/following",
-    notes: face + "ap/notes/",
-    privateNotes: face + "ap/private/",
-    featured: face + "ap/featured",
-    // FEP-1b12: the moderator roster a recipient validates announced
-    // moderation against. Published only when moderators are configured.
-    moderators: face + "ap/moderators",
-    // FEP-4ccd and FEP-c648: follows in limbo and the block list, as
-    // collections. They live in the private container so the owner-only ACL
-    // is inherited, not re-stated per document.
-    pendingFollowers: face + "ap/private/pending-followers",
-    pendingFollowing: face + "ap/private/pending-following",
-    blocked: face + "ap/private/blocked",
-    // The outbox as its owner reads it (every message, §5.1) and what the
-    // owner has liked (§5.5): the owner's alone, so they sit here too — and
-    // at the pod's own address even for a fronted identity, because the owner
-    // reads them there, with a credential the pod checks.
-    ownOutbox: home + "ap/private/outbox",
-    liked: home + "ap/private/liked",
-    profileHtml: face + "ap/profile.html",
-    // Media stays on the pod even when fronted: attachment urls are not
-    // identity-checked by remotes, and proxying blobs would be pure cost.
-    media: home + "ap/media/",
-    state: home + "ap-state/"
-  };
-  if (publicBase) {
-    urls.podHome = home;
-    urls.publicHome = face;
-    urls.toPod = (u) => typeof u === "string" && u.startsWith(face) ? home + u.slice(face.length) : u;
-    urls.toPublic = (u) => typeof u === "string" && u.startsWith(home) ? face + u.slice(home.length) : u;
-  }
-  return urls;
-}
 function podBaseOfWebId(webId) {
   const u = new URL(webId);
   u.hash = "";
@@ -33724,7 +33678,7 @@ async function moveIn(answers, { session, onStep = () => {
   return { config, address: `@${handle}@${new URL(origin).host}`, movedFrom: config.movedFrom };
 }
 
-// packages/fedipod-bb/src/setup.mjs
+// node_modules/fedipod-bb/src/setup.mjs
 var setup_exports = {};
 __export(setup_exports, {
   ROOT: () => ROOT,
@@ -33737,7 +33691,7 @@ __export(setup_exports, {
   writeForumConfig: () => writeForumConfig
 });
 
-// lib/pod/containers.mjs
+// node_modules/fedipod/lib/pod/containers.mjs
 var KEEP = { keep: true };
 var KEEP_CT = "application/json";
 var keepUrl = (base) => `${base}.keep`;
@@ -33983,7 +33937,58 @@ var node_crypto_default = {
   scryptSync
 };
 
-// packages/fedipod-bb/src/urls.mjs
+// node_modules/fedipod/lib/pod/urls.mjs
+function apUrls2(remotePod, root, { publicBase = null } = {}) {
+  if (!root) throw new Error("apUrls: a container root is required \u2014 the caller states it, this library does not guess");
+  const base = remotePod.endsWith("/") ? remotePod : remotePod + "/";
+  const home = base + (root.endsWith("/") ? root : root + "/");
+  const face = publicBase ? publicBase.endsWith("/") ? publicBase : publicBase + "/" : home;
+  const urls = {
+    base,
+    home,
+    webfinger: base + ".well-known/webfinger",
+    actor: face + "ap/actor",
+    inbox: face + "ap/inbox/",
+    outbox: face + "ap/outbox",
+    followers: face + "ap/followers",
+    following: face + "ap/following",
+    notes: face + "ap/notes/",
+    privateNotes: face + "ap/private/",
+    featured: face + "ap/featured",
+    // FEP-1b12: the moderator roster a recipient validates announced
+    // moderation against. Published only when moderators are configured.
+    moderators: face + "ap/moderators",
+    // FEP-4ccd and FEP-c648: follows in limbo and the block list, as
+    // collections. They live in the private container so the owner-only ACL
+    // is inherited, not re-stated per document.
+    pendingFollowers: face + "ap/private/pending-followers",
+    pendingFollowing: face + "ap/private/pending-following",
+    blocked: face + "ap/private/blocked",
+    // The outbox as its owner reads it (every message, §5.1) and what the
+    // owner has liked (§5.5): the owner's alone, so they sit here too — and
+    // at the pod's own address even for a fronted identity, because the owner
+    // reads them there, with a credential the pod checks.
+    ownOutbox: home + "ap/private/outbox",
+    liked: home + "ap/private/liked",
+    // The inbox as its owner reads it (§5.2): what the account received,
+    // kept by the drain as a paged collection beside the archive.
+    ownInbox: home + "ap/private/inbox",
+    profileHtml: face + "ap/profile.html",
+    // Media stays on the pod even when fronted: attachment urls are not
+    // identity-checked by remotes, and proxying blobs would be pure cost.
+    media: home + "ap/media/",
+    state: home + "ap-state/"
+  };
+  if (publicBase) {
+    urls.podHome = home;
+    urls.publicHome = face;
+    urls.toPod = (u) => typeof u === "string" && u.startsWith(face) ? home + u.slice(face.length) : u;
+    urls.toPublic = (u) => typeof u === "string" && u.startsWith(home) ? face + u.slice(home.length) : u;
+  }
+  return urls;
+}
+
+// node_modules/fedipod-bb/src/urls.mjs
 var ROOT = "fedipod-bb/";
 var SLUG = /^[a-z0-9][a-z0-9-]{0,62}$/u;
 var isSlug = (s) => typeof s === "string" && SLUG.test(s);
@@ -33993,7 +33998,7 @@ var cacheKey = (postId) => node_crypto_default.createHash("sha256").update(Strin
 function forumUrls(remotePod, root = ROOT, { publicBase = null, front = null, handle = null } = {}) {
   const origin = front ? String(front).replace(/\/$/u, "") : null;
   if (origin && !handle) throw new Error("forumUrls: a fronted forum needs its handle");
-  const site = apUrls(remotePod, root, { publicBase: publicBase || (origin ? `${origin}/u/${handle}/` : null) });
+  const site = apUrls2(remotePod, root, { publicBase: publicBase || (origin ? `${origin}/u/${handle}/` : null) });
   const face = site.actor.slice(0, -"ap/actor".length);
   site.front = origin;
   site.categories = face + "ap/categories";
@@ -34012,7 +34017,7 @@ function forumUrls(remotePod, root = ROOT, { publicBase = null, front = null, ha
   return site;
 }
 function categoryUrls(remotePod, root, { publicBase = null, forumInbox = null } = {}) {
-  const urls = apUrls(remotePod, root, { publicBase });
+  const urls = apUrls2(remotePod, root, { publicBase });
   const face = urls.actor.slice(0, -"ap/actor".length);
   urls.forumInbox = forumInbox || urls.inbox;
   urls.topics = face + "ap/topics";
@@ -34031,7 +34036,7 @@ function categoryUrls(remotePod, root, { publicBase = null, forumInbox = null }
   return urls;
 }
 
-// packages/fedipod-bb/src/provision.mjs
+// node_modules/fedipod-bb/src/provision.mjs
 async function provisionForum(remote, site, { moderatorWebIds = [] } = {}) {
   await provisionPrivate(remote, site);
   await provisionPublic(remote, site.notes);
@@ -34051,7 +34056,7 @@ async function provisionCategory(remote, cat, { memberWebIds = null } = {}) {
   }
 }
 
-// packages/fedipod-bb/src/setup.mjs
+// node_modules/fedipod-bb/src/setup.mjs
 function forumConfig(existing = {}, {
   remotePod,
   root = ROOT,
@@ -34144,12 +34149,13 @@ async function attachRows({ fetch: f, front, config, plain }, { log: log2 = () =
   }
   return { gateway: { front: origin, mode: "trust", secrets }, handles: rows.map((r) => r.handle) };
 }
-async function keepRows({ fetch: f, front, config, on = true }) {
+async function keepRows({ fetch: f, front, config, on = true, between = null }) {
   const origin = String(front).replace(/\/+$/u, "");
   const forumHandle = config.handle;
   const handles = [...(config.categories || []).map((c) => c.slug), forumHandle];
   let keeper = null;
   for (const handle of handles) {
+    if (handle === forumHandle && between) await between(keeper);
     const res = await f(`${origin}/api/keeper`, {
       method: "POST",
       headers: { "content-type": "application/json" },
@@ -34184,8 +34190,13 @@ async function setUpForumAtGateway({ remote, storageFor, fetch: f, front, ownerW
   await writeConfig2(storage, { ...config, gateway, republish: true });
   onStep("attach", "ok");
   onStep("keep", "running");
-  const { keeper } = await keepRows({ fetch: f, front, config, on: true });
-  await nameKeeperInRules(remote, { config, plain, keeper, ownerWebId });
+  const { keeper } = await keepRows({
+    fetch: f,
+    front,
+    config,
+    on: true,
+    between: (k) => nameKeeperInRules(remote, { config, plain, keeper: k, ownerWebId })
+  });
   onStep("keep", "ok");
   return { handle: config.handle, front: gateway.front, handles, keeper };
 }
@@ -34381,7 +34392,7 @@ async function readIssuer(actorUrl, fetchImpl = fetch) {
   }
 }
 
-// lib/session/oidc-session.mjs
+// node_modules/fediverse-session/oidc-session.mjs
 var STORE = "session";
 var b64u = (buf) => btoa(String.fromCharCode(...new Uint8Array(buf))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 var enc = (o) => b64u(new TextEncoder().encode(JSON.stringify(o)));