Index: src/services/ActivityPubService.js
===================================================================
--- src/services/ActivityPubService.js	(revision dd568e79b476d730bac4264e3e6d0bab5cfb9753)
+++ src/services/ActivityPubService.js	(revision 4407c67257b1d061f0376ef1ea63ea597c308e4b)
@@ -542,5 +542,8 @@
 }
 
-export function buildFollowers(base, site, count) {
+// Public callers get a count-only collection (privacy). The authenticated
+// account owner (a C2S bearer scoped to this site) gets the real actor URIs via
+// `items`, so their own client can build a friends list.
+export function buildFollowers(base, site, count, items = null) {
   const id = `${actorId(base, site.slug)}/followers`;
   return {
@@ -548,6 +551,6 @@
     id,
     type: 'OrderedCollection',
-    totalItems: count || 0,
-    orderedItems: [], // hidden for privacy; count only
+    totalItems: items ? items.length : (count || 0),
+    orderedItems: items || [], // count-only for the public; full for the owner
   };
 }
@@ -555,5 +558,5 @@
 // The accounts this site follows — count only, mirroring buildFollowers. The spec lists
 // `following` as a standard actor property; Hubzilla/Friendica + crawlers expect it.
-export function buildFollowing(base, site, count) {
+export function buildFollowing(base, site, count, items = null) {
   const id = `${actorId(base, site.slug)}/following`;
   return {
@@ -561,6 +564,6 @@
     id,
     type: 'OrderedCollection',
-    totalItems: count || 0,
-    orderedItems: [], // count only
+    totalItems: items ? items.length : (count || 0),
+    orderedItems: items || [], // count-only for the public; full for the owner
   };
 }