@evanp/activitypub-bot 0.41.3 → 0.43.0

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,129 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+mailto:contact@socialwebfoundation.org.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series
+of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or
+permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior,  harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within
+the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.0, available at
+[https://www.contributor-covenant.org/version/2/0/code_of_conduct.html](https://www.contributor-covenant.org/version/2/0/code_of_conduct.html).
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct
+enforcement ladder](https://github.com/mozilla/diversity).
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see the FAQ at
+[https://www.contributor-covenant.org/faq](https://www.contributor-covenant.org/faq).
+Translations are available at
+[https://www.contributor-covenant.org/translations](https://www.contributor-covenant.org/translations).

package/README.md

@@ -64,6 +64,9 @@ Options:
   --intake <number>          Number of background intake workers
   --index-file <path>        HTML page to show at root path
   --profile-file <path>      HTML page to show for bot profiles
+  --allow-private            flag to allow private network requests
+  --redis-url <url>          Redis connection URL for rate limiting
+  --trust-proxy <value>      Express 'trust proxy' setting (e.g. "1", "loopback", "true")
   -h, --help                 Show this help
 ```
 
@@ -139,6 +142,24 @@ Path to the HTML file to show for bot profile pages. Like `--index-file`, any ex
 
 Falls back to the `PROFILE_FILE` environment variable. The default profile file is in `web/profile.html`.
 
+#### --allow-private
+
+Boolean flag. When set, the server will make outbound HTTP requests to private IP addresses (loopback, link-local, private, unique-local). By default these are blocked by `SafeAgent` to protect against SSRF. Enable this only when you need to reach ActivityPub peers on your local network or container network — for example, during development or integration testing.
+
+Falls back to the `ALLOW_PRIVATE` environment variable. Default is `false`.
+
+#### --redis-url
+
+Redis connection URL used to back the rate-limit store. If unset, rate-limit counters live in memory, which is fine for a single-process deployment but loses state on restart and doesn't coordinate across multiple instances. Provide a Redis URL to share limits across processes.
+
+Falls back to the `REDIS_URL` environment variable. Default is unset (in-memory limiter).
+
+#### --trust-proxy
+
+Express [`trust proxy`](https://expressjs.com/en/guide/behind-proxies.html) setting. Needed when the server runs behind a reverse proxy or load balancer so that `req.ip`, rate limiting, and logged client IPs reflect the real client rather than the proxy. Numeric values are parsed as a hop count (`1` means trust one hop), boolean-like values (`true`, `false`) toggle trust on or off, and any other value is passed through as a string (e.g. `"loopback"`, or a specific IP or CIDR range).
+
+Falls back to the `TRUST_PROXY` environment variable. Default is unset (Express default, no proxy trust).
+
 ### Config file
 
 The config file defines the bots provided by this server.
@@ -188,13 +209,21 @@ A *DoNothingBot* instance will only do default stuff, like accepting follows.
 A *FollowBackBot* will follow back anyone who follows it. Useful for collecting
 public information.
 
-#### RelayClientBot
+#### MastodonRelayClientBot
+
+A *MastodonRelayClientBot* can be the client of a Mastodon relay.
 
-A *RelayClientBot* can be the client of a Mastodon or Pleroma relay.
+#### MastodonRelayServerBot
 
-#### RelayServerBot
+A *MastodonRelayServerBot* will act as a relay server for remote Mastodon servers.
 
-A *RelayServerBot* will act as a relay server for remote servers.
+#### LitePubRelayClientBot
+
+A *LitePubRelayClientBot* can be the client of a LitePub (Pleroma) relay.
+
+#### LitePubRelayServerBot
+
+A *LitePubRelayServerBot* will act as a relay server for remote Pleroma servers and other LitePub-relay-compliant servers.
 
 ## API
 
@@ -246,6 +275,11 @@ A [getter](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Fun
 
 A [getter](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Functions/get) for the username of the bot. Should match the constructor argument.
 
+#### get type ()
+
+A getter for the type of the bot. This should be an Activity Streams 2.0 object type;
+the default is `Service`.
+
 #### get _context ()
 
 A protected [getter](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Functions/get) for the context of the bot. (The default implementation stashes the context in a private variable, so this protected
@@ -277,11 +311,11 @@ Called when the server receives a public activity to its shared inbox. This can
 
 Called when one of the bot's objects is shared by another actor. The first argument is the object, and the second is the `Announce` activity itself. This method is called after the activity has been added to the `shares` collection.
 
-#### async actorOK (actor, activity)
+#### async actorOK (actorId, activity)
 
 Lets the bot override the default check for matching the actor who sent an activity with the
 actor who did the activity. Usually, these need to be the same, but for some sub-protocols, like
-relays, it can be different. Returns a boolean saying whether the actor is OK.
+relays, it can be different. `actorId` is the id of the actor who delivered the activity. Returns a boolean saying whether the actor is OK.
 
 #### async handleActivity (activity)
 
@@ -309,7 +343,7 @@ When a public activity is received at the shared inbox of the server, this metho
 
 This is the bot's control panel for working with the rest of the server.
 
-#### get botID ()
+#### get botId ()
 
 Returns the username of the bot this context was created for.
 
@@ -333,6 +367,10 @@ Deletes the data stored for this key. There's no backup; it's just gone.
 
 Checks to see if any data has been previously stored with this key; returns a boolean.
 
+#### async duplicate (username)
+
+Returns a new `BotContext` identical to this one but scoped to the given `username`. Used by `BotFactory` implementations to produce a per-bot context from a shared template without re-wiring the underlying storage, client, and formatter.
+
 #### async getObject (id)
 
 Given an [ActivityPub object identifier](https://www.w3.org/TR/activitypub/#obj-id), returns an [activitystrea.ms](#activitystreams) object.
@@ -355,6 +393,14 @@ The optional additional parameters are strings used for ActivityPub properties o
 
 A shortcut for sending a reply with `content` to the `object`. Extracts and configures the right addressing properties and threading properties from `object`, and passes them to `sendNote()`.
 
+#### async updateNote (note, content)
+
+Updates a previously-sent `Note` with new `content`. Re-runs the microtext transformation, stores the updated object, and sends an `Update` activity to the original addressees.
+
+#### async deleteNote (note)
+
+Deletes a previously-sent `Note`. Replaces the stored object with a `Tombstone` and sends a `Delete` activity to the original addressees.
+
 #### async likeObject (obj)
 
 Sends a `Like` activity for the passed-in object in [activitystrea.ms](#activitystreams) form.
@@ -363,9 +409,9 @@ Sends a `Like` activity for the passed-in object in [activitystrea.ms](#activity
 
 Sends an `Undo`/`Like` activity for the passed-in object in [activitystrea.ms](#activitystreams) form which was previously liked.
 
-#### async announceObject (obj)
+#### async announceObject (obj, actors = null)
 
-Sends an `Announce` activity for the passed-in object in [activitystrea.ms](#activitystreams) form to followers.
+Sends an `Announce` activity for the passed-in object in [activitystrea.ms](#activitystreams) form. If `actors` is `null` (the default), the `Announce` is addressed to the bot's followers. Otherwise, pass an array of actor IDs (or actor objects) to address the `Announce` to a specific set of recipients — useful for relay-style re-Announce.
 
 #### async unannounceObject (obj)
 
@@ -401,6 +447,38 @@ Gets the `id` of the [ActivityPub Actor](https://www.w3.org/TR/activitypub/#acto
 
 Gets the [WebFinger](https://en.wikipedia.org/wiki/WebFinger) identity of the [ActivityPub Actor](https://www.w3.org/TR/activitypub/#actors) with the given `id`.
 
+#### getFollowersId ()
+
+Returns the URL of this bot's `followers` collection. Synchronous.
+
+#### async isFollower (obj)
+
+Returns `true` if `obj` (an actor object in [activitystrea.ms](#activitystreams) form, or anything with an `id`) is in this bot's `followers` collection.
+
+#### async isFollowing (obj)
+
+Returns `true` if `obj` is in this bot's `following` collection.
+
+#### async isPendingFollowing (obj)
+
+Returns `true` if this bot has sent a `Follow` to `obj` that has not yet been accepted or rejected.
+
+#### async \* followers ()
+
+Async generator that yields each actor in this bot's `followers` collection, one at a time, across collection pages.
+
+#### async \* following ()
+
+Async generator that yields each actor in this bot's `following` collection, one at a time, across collection pages.
+
+#### isLocal (url)
+
+Returns `true` if `url` is served by this activitypub-bot instance (i.e. its origin matches the configured `--origin`). Synchronous.
+
+#### async onIdle ()
+
+Resolves when the background distribution queue has drained. Intended for test code that needs to wait for outbound activities to finish being delivered before asserting on their effects.
+
 ### activitystrea.ms
 
 Activity Streams 2.0 objects are represented internally as [activitystrea.ms](https://www.npmjs.com/package/activitystrea.ms) library objects.

package/lib/activitydeliverer.js

@@ -24,8 +24,8 @@ const COLLECTION_TYPES = [
 export class ActivityDeliverer {
   static #QUEUE_ID = 'delivery'
   static #INTAKE_QUEUE_ID = 'intake'
-  static #TTL_SEEN_PUBLIC = 3 * 24 * 60 * 60 * 1000 // 3 days
-  static #MAX_SEEN_PUBLIC = 1000000
+  static #TTL_SEEN_PUBLIC = 6 * 60 * 60 * 1000 // 6 hours
+  static #MAX_SEEN_PUBLIC = 100_000
   #actorStorage
   #formatter
   #logger

package/lib/activityhandler.js

@@ -915,7 +915,7 @@ export class ActivityHandler {
       actor: {
         id: this.#botId(bot),
         name: bot.fullname,
-        type: 'Service'
+        type: bot.type
       },
       published: now,
       updated: now
@@ -1027,7 +1027,7 @@ export class ActivityHandler {
     return await as2.import({
       id: this.#formatter.format({ username: bot.username }),
       name: bot.fullname,
-      type: 'Service'
+      type: bot.type
     })
   }
 

package/lib/bot.js

@@ -64,6 +64,10 @@ export default class Bot {
     return this.#context
   }
 
+  get type () {
+    return 'Service'
+  }
+
   async onMention (object, activity) {
     ; // no-op
   }

package/lib/botcontext.js

@@ -438,6 +438,57 @@ export class BotContext {
     return await this.#doActivity(data, distribute)
   }
 
+  getFollowersId () {
+    return this.#formatter.format({
+      username: this.#botId,
+      collection: 'followers'
+    })
+  }
+
+  async isFollower (obj) {
+    assert.ok(obj)
+    assert.equal(typeof obj, 'object')
+    return await this.#isInCollection('followers', obj)
+  }
+
+  async isFollowing (obj) {
+    assert.ok(obj)
+    assert.equal(typeof obj, 'object')
+    return await this.#isInCollection('following', obj)
+  }
+
+  async isPendingFollowing (obj) {
+    assert.ok(obj)
+    assert.equal(typeof obj, 'object')
+    const followId =
+      await this.#actorStorage.getLastActivity(this.#botId, 'Follow', obj)
+    if (!followId) return false
+    const followActivity = await this.#objectStorage.read(followId)
+    return await this.#isInCollection('pendingFollowing', followActivity)
+  }
+
+  isLocal (url) {
+    assert.ok(url)
+    assert.equal(typeof url, 'string')
+    return this.#formatter.isLocal(url)
+  }
+
+  async * followers () {
+    yield * this.#actorStorage.items(this.#botId, 'followers')
+  }
+
+  async * following () {
+    yield * this.#actorStorage.items(this.#botId, 'following')
+  }
+
+  async #isInCollection (name, obj) {
+    assert.ok(name)
+    assert.equal(typeof name, 'string')
+    assert.ok(obj)
+    assert.equal(typeof obj, 'object')
+    return await this.#actorStorage.isInCollection(this.#botId, name, obj)
+  }
+
   async #findInOutbox (type, obj) {
     const full = `https://www.w3.org/ns/activitystreams#${type}`
     let found = null
@@ -490,8 +541,7 @@ export class BotContext {
         nanoid: nanoid()
       }),
       actor: {
-        id: this.#formatter.format({ username: this.#botId }),
-        type: 'Service'
+        id: this.#formatter.format({ username: this.#botId })
       },
       published: now,
       updated: now

package/lib/bots/litepubrelayclient.js

@@ -0,0 +1,86 @@
+import assert from 'node:assert'
+
+import Bot from '../bot.js'
+
+const NS = 'https://www.w3.org/ns/activitystreams#'
+const CREATE = `${NS}Create`
+
+const DEFAULT_NAME = 'LitePubRelayClientBot'
+const DEFAULT_DESCRIPTION = 'A LitePub relay client'
+
+export default class LitePubRelayClientBot extends Bot {
+  #relay
+  #relayForwarding
+
+  constructor (username, options = {}) {
+    if (typeof username !== 'string') {
+      throw new Error('username must be a string')
+    }
+    if (typeof options !== 'object') {
+      throw new Error('options must be an object')
+    }
+    if (typeof options.relay !== 'string' &&
+        !Array.isArray(options.relay)) {
+      throw new Error('relay option must be a string or array')
+    }
+    super(username, {
+      fullname: DEFAULT_NAME,
+      description: DEFAULT_DESCRIPTION,
+      ...options
+    })
+    this.#relay = Array.isArray(options.relay)
+      ? options.relay
+      : [options.relay]
+    this.#relayForwarding = ('relayForwarding' in options)
+      ? options.relayForwarding
+      : true
+  }
+
+  get type () {
+    return 'Application'
+  }
+
+  async initialize (context) {
+    await super.initialize(context)
+    this._context.logger.info(
+      { relay: this.#relay },
+      'Initialising relay client'
+    )
+
+    assert.ok(Array.isArray(this.#relay))
+
+    const toFollow = new Set(this.#relay)
+
+    for await (const actor of this._context.following()) {
+      if (toFollow.has(actor.id)) {
+        toFollow.delete(actor.id)
+      } else {
+        await this._context.unfollowActor(actor)
+      }
+    }
+
+    for (const id of toFollow) {
+      const actor = await this._context.getObject(id)
+      await this._context.followActor(actor)
+    }
+  }
+
+  async onPublic (activity) {
+    if (this.#relayForwarding &&
+      await this.#hasAnyFollower() &&
+      this._context.isLocal(activity.id) &&
+      activity.type === CREATE &&
+      activity.object?.first) {
+      await this._context.announceObject(activity.object.first)
+    }
+  }
+
+  async #hasAnyFollower () {
+    for await (const actor of this._context.followers()) {
+      if (this.#relay.includes(actor.id)) {
+        return true
+      }
+    }
+    return false
+  }
+}

package/lib/bots/litepubrelayserver.js

@@ -0,0 +1,96 @@
+import FollowBackBot from './followback.js'
+
+const DEFAULT_FULLNAME = 'LitePub Relay Server Bot'
+const DEFAULT_DESCRIPTION = 'Implements server side of LitePub relay.'
+
+const NS = 'https://www.w3.org/ns/activitystreams#'
+const ANNOUNCE = `${NS}Announce`
+const APPLICATION = `${NS}Application`
+
+export default class LitePubRelayServer extends FollowBackBot {
+  #relayForwarding
+  constructor (username, options = {}) {
+    super(username, {
+      fullname: DEFAULT_FULLNAME,
+      description: DEFAULT_DESCRIPTION,
+      ...options
+    })
+    this.#relayForwarding = ('relayForwarding' in options)
+      ? options.relayForwarding
+      : true
+  }
+
+  async onFollow (actor, activity) {
+    await super.onFollow(actor, activity)
+    if (!actor.id?.endsWith('/relay')) {
+      this._context.logger.warn(
+        { actor: actor.id },
+        'LitePub relay follower id does not end with /relay'
+      )
+    }
+    try {
+      const actorFull = await this._context.getObject(actor.id)
+      if (!this.#objectType(actorFull, APPLICATION)) {
+        this._context.logger.warn(
+          { actor: actorFull.id, actorType: actorFull.type },
+          'LitePub relay follower is not an Application'
+        )
+      }
+    } catch (err) {
+      this._context.logger.warn(
+        { err, actor: actor.id },
+        'Error loading follower in LitePubRelayServer'
+      )
+    }
+  }
+
+  async handleActivity (activity) {
+    this._context.logger.debug(
+      { class: this.constructor.name, activity: activity.id },
+      'handling activity'
+    )
+    if (this.#objectType(activity, ANNOUNCE) &&
+        activity.actor?.first?.id &&
+        activity.object?.first?.id &&
+        await this._context.isFollower(activity.actor.first) &&
+        this.#addressedToFollowers(activity)) {
+      if (this.#relayForwarding) {
+        this._context.logger.debug(
+          {
+            class: this.constructor.name,
+            activity: activity.id,
+            actor: activity.actor.first.id,
+            object: activity.object.first.id
+          },
+          'sharing object from follower'
+        )
+        await this._context.announceObject(activity.object.first)
+      }
+      return true
+    } else {
+      return false
+    }
+  }
+
+  #objectType (object, type) {
+    return (Array.isArray(object.type) && object.type.includes(type)) ||
+        (typeof object.type === 'string' && object.type === type)
+  }
+
+  #addressedToFollowers (activity) {
+    const recipients = this.#getRecipientIds(activity)
+    const followersId = this._context.getFollowersId()
+    return recipients.includes(followersId)
+  }
+
+  #getRecipientIds (obj) {
+    let r = []
+    for (const prop of ['to', 'cc', 'audience']) {
+      const val = obj.get(prop)
+      if (val) {
+        r = r.concat(Array.from(val))
+      }
+    }
+    return r.map(obj => obj.id)
+  }
+}

package/lib/bots/{relayclient.js → mastodonrelayclient.js}

@@ -4,7 +4,7 @@ const NS = 'https://www.w3.org/ns/activitystreams#'
 const ACCEPT = `${NS}Accept`
 const REJECT = `${NS}Reject`
 
-export default class RelayClientBot extends Bot {
+export default class MastodonRelayClientBot extends Bot {
   #relay
   #unsubscribe
 
@@ -15,7 +15,7 @@ export default class RelayClientBot extends Bot {
   }
 
   get fullname () {
-    return 'Relay Client Bot'
+    return 'Mastodon Relay Client Bot'
   }
 
   get description () {

package/lib/bots/{relayserver.js → mastodonrelayserver.js}

@@ -11,9 +11,9 @@ const PUBLICS = [
 ]
 const CLIENTS = 'relay-clients'
 
-export default class RelayServerBot extends Bot {
+export default class MastodonRelayServerBot extends Bot {
   get fullname () {
-    return 'Relay Server Bot'
+    return 'Mastodon Relay Server Bot'
   }
 
   get description () {

package/lib/index.js

@@ -3,6 +3,8 @@ export { default as Bot } from './bot.js'
 export { default as BotFactory } from './botfactory.js'
 export { default as OKBot } from './bots/ok.js'
 export { default as DoNothingBot } from './bots/donothing.js'
-export { default as RelayClientBot } from './bots/relayclient.js'
-export { default as RelayServerBot } from './bots/relayserver.js'
+export { default as MastodonRelayClientBot, default as RelayClientBot } from './bots/mastodonrelayclient.js'
+export { default as MastodonRelayServerBot, default as RelayServerBot } from './bots/mastodonrelayserver.js'
 export { default as FollowBackBot } from './bots/followback.js'
+export { default as LitePubRelayClientBot } from './bots/litepubrelayclient.js'
+export { default as LitePubRelayServerBot } from './bots/litepubrelayserver.js'

package/lib/routes/user.js

@@ -25,7 +25,7 @@ async function toLink (url, formatter, username, type) {
 
 router.get('/user/:username', async (req, res, next) => {
   const { username } = req.params
-  const { actorStorage, keyStorage, formatter, bots, origin } = req.app.locals
+  const { keyStorage, formatter, bots, origin } = req.app.locals
   const bot = await BotMaker.makeBot(bots, username)
   if (!bot) {
     return next(new ProblemDetailsError(404, `User ${username} not found`))
@@ -33,12 +33,21 @@ router.get('/user/:username', async (req, res, next) => {
   const publicKeyPem = await keyStorage.getPublicKey(username)
   const acct = formatter.acct(username)
   const wf = acct.slice(5)
-  const actor = await actorStorage.getActor(username, {
+  const actor = await as2.import({
     '@context': [
       'https://www.w3.org/ns/activitystreams',
       'https://w3id.org/security/v1',
       'https://purl.archive.org/socialweb/webfinger'
     ],
+    id: formatter.format({ username }),
+    type: bot.type,
+    preferredUsername: username,
+    inbox: formatter.format({ username, collection: 'inbox' }),
+    outbox: formatter.format({ username, collection: 'outbox' }),
+    followers: formatter.format({ username, collection: 'followers' }),
+    following: formatter.format({ username, collection: 'following' }),
+    liked: formatter.format({ username, collection: 'liked' }),
+    to: 'as:Public',
     name: bot.fullname,
     summary: bot.description,
     webfinger: wf,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evanp/activitypub-bot",
-  "version": "0.41.3",
+  "version": "0.43.0",
   "description": "server-side ActivityPub bot framework",
   "type": "module",
   "main": "lib/index.js",