@evanp/activitypub-bot 0.51.4 → 0.52.0

package/CHANGELOG.md

@@ -9,6 +9,25 @@ and this project adheres to
 
 ## [Unreleased]
 
+## [0.52.0] - 2026-10-05
+
+### Added
+
+- `GET /js/ap-components.min.js` to serve the installed ap-components bundle
+  locally, with cache revalidation.
+- Regression tests for local component serving, injected fetch usage, reverse
+  WebFinger metadata, and discovery failures.
+
+### Changed
+
+- Serve ap-components from the installed npm dependency at
+  `/js/ap-components.min.js` instead of loading it from a CDN on profile pages.
+- Use activitypub-webfinger for actor ID discovery, mention resolution, and
+  reverse WebFinger lookup, with SafeFetcher.fetch bound once per instance.
+- Reverse WebFinger lookups now fetch directly through SafeFetcher instead of
+  the cached, signed ActivityPub client.
+- Return `null` on failed WebFinger discovery in `BotContext.toActorId()`.
+
 ## [0.51.4] 2026-09-29
 
 ### Updated
@@ -1663,7 +1682,8 @@ Hot patch on the `stable` branch.
 - Docker multi-platform build workflow.
 - Dependabot configuration.
 
-[Unreleased]: https://github.com/evanp/activitypub-bot/compare/v0.51.4...HEAD
+[Unreleased]: https://github.com/evanp/activitypub-bot/compare/v0.52.0...HEAD
+[0.52.0]: https://github.com/evanp/activitypub-bot/compare/v0.51.4...v0.52.0
 [0.51.4]: https://github.com/evanp/activitypub-bot/compare/v0.51.3...v0.51.4
 [0.51.3]: https://github.com/evanp/activitypub-bot/compare/v0.51.2...v0.51.3
 [0.51.2]: https://github.com/evanp/activitypub-bot/compare/v0.51.1...v0.51.2

package/lib/app.js

@@ -37,6 +37,7 @@ import proxyRouter from './routes/proxy.js'
 import nodeinfoRouter from './routes/nodeinfo.js'
 import robotsTxtRouter from './routes/robotstxt.js'
 import faviconRouter from './routes/favicon.js'
+import staticRouter from './routes/static.js'
 import { BotContext } from './botcontext.js'
 import { Transformer } from './microsyntax.js'
 import { HTTPSignatureAuthenticator } from './httpsignatureauthenticator.js'
@@ -331,6 +332,7 @@ export async function makeApp ({ databaseUrl, origin, bots, logLevel = 'silent',
 
   // These should not check HTTP Signature even if provided
 
+  app.use('/', staticRouter)
   app.use('/', healthRouter)
   app.use('/', serverRouter)
   app.use('/', profileRouter)

package/lib/botcontext.js

@@ -1,18 +1,12 @@
 import assert from 'node:assert'
 
 import { nanoid } from 'nanoid'
+import { actorIdOf, webfingerOf } from 'activitypub-webfinger'
 
 import as2 from './activitystreams.js'
 
-const AS2_TYPES = [
-  'application/activity+json',
-  'application/ld+json; profile="https://www.w3.org/ns/activitystreams"'
-]
-
 const AS2_NS = 'https://www.w3.org/ns/activitystreams#'
 
-const WF_NS = 'https://purl.archive.org/socialweb/webfinger#'
-
 const THREAD_PROP = 'https://purl.archive.org/socialweb/thread#thread'
 const CONVERSATION_PROP = 'http://ostatus.org/schema/1.0/conversation'
 
@@ -28,6 +22,7 @@ export class BotContext {
   #logger = null
   #bots
   #fetcher
+  #fetch
 
   constructor (
     botId,
@@ -64,6 +59,7 @@ export class BotContext {
     this.#bots = bots
     this.#logger = logger.child({ class: 'BotContext', botId })
     this.#fetcher = fetcher
+    this.#fetch = fetcher.fetch.bind(fetcher)
   }
 
   get botId () {
@@ -400,34 +396,11 @@ export class BotContext {
     if (domain.toLowerCase() === this.#formatter.hostname) {
       return this.#formatter.format({ username })
     }
-    const url = `https://${domain}/.well-known/webfinger` +
-      `?resource=acct:${webfinger}`
-    const res = await this.#fetcher.fetch(url)
-    if (res.status !== 200) {
-      throw new Error(`Status ${res.status} fetching ${url}`)
-    }
-    const json = await res.json()
-    const link = json?.links?.find(
-      (l) => l.rel === 'self' && AS2_TYPES.includes(l.type)
-    )
-    return link ? link.href : null
+    return await actorIdOf(webfinger, { fetch: this.#fetch })
   }
 
   async toWebfinger (actorId) {
-    const actor = await this.#getRemoteObject(actorId)
-    if (!actor) {
-      return null
-    }
-    const wf = actor.get(WF_NS + 'webfinger')
-    if (wf) {
-      return wf.value()
-    }
-    const username = actor.get('preferredUsername')?.first
-    if (!username) {
-      return null
-    }
-    const actorUrl = new URL(actor.id)
-    return `${username}@${actorUrl.hostname}`
+    return await webfingerOf(actorId, { fetch: this.#fetch })
   }
 
   async announceObject (obj, actors = null) {

package/lib/microsyntax.js

@@ -1,11 +1,12 @@
 import assert from 'node:assert'
+import { actorIdOf } from 'activitypub-webfinger'
 
 const AS2 = 'https://www.w3.org/ns/activitystreams#'
 
 export class Transformer {
   #tagNamespace = null
   #client = null
-  #fetcher = null
+  #fetch = null
   #formatter = null
 
   constructor (tagNamespace, client, fetcher, formatter) {
@@ -16,12 +17,12 @@ export class Transformer {
 
     this.#tagNamespace = tagNamespace
     this.#client = client
-    this.#fetcher = fetcher
+    this.#fetch = fetcher.fetch.bind(fetcher)
     this.#formatter = formatter
 
     assert.ok(this.#tagNamespace)
     assert.ok(this.#client)
-    assert.ok(this.#fetcher)
+    assert.ok(this.#fetch)
     assert.ok(this.#formatter)
   }
 
@@ -99,24 +100,7 @@ export class Transformer {
     if (domain.toLowerCase() === this.#formatter.hostname) {
       return this.#formatter.format({ username, type: 'profile' })
     }
-    const url = `https://${domain}/.well-known/webfinger?` +
-      `resource=acct:${username}@${domain}`
-    let json = null
-    try {
-      const response = await this.#fetcher.fetch(url,
-        { headers: { Accept: 'application/jrd+json' } })
-      if (response.status !== 200) return null
-      json = await response.json()
-    } catch (error) {
-      return null
-    }
-    if (!json.links) return null
-    const link = json.links.find(
-      link => link.rel === 'self' &&
-        (link.type === 'application/activity+json' ||
-          link.type === 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"'))
-    if (!link) return null
-    const actorId = link.href
+    const actorId = await actorIdOf(webfinger, { fetch: this.#fetch })
     if (!actorId) return null
     let actor = null
     try {

package/lib/routes/static.js

@@ -0,0 +1,12 @@
+import { Router } from 'express'
+import { fileURLToPath } from 'node:url'
+
+const router = Router()
+
+const COMPONENT_BUNDLE_FILENAME = fileURLToPath(import.meta.resolve('@socialwebfoundation/ap-components/dist/ap-components.min.js'))
+
+router.get('/js/ap-components.min.js', (req, res) => {
+  res.sendFile(COMPONENT_BUNDLE_FILENAME, { maxAge: 0 })
+})
+
+export default router

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evanp/activitypub-bot",
-  "version": "0.51.4",
+  "version": "0.52.0",
   "description": "server-side ActivityPub bot framework",
   "type": "module",
   "main": "lib/index.js",
@@ -31,6 +31,8 @@
   "homepage": "https://github.com/evanp/activitypub-bot#readme",
   "dependencies": {
     "@isaacs/ttlcache": "^2.1.4",
+    "@socialwebfoundation/ap-components": "^1.4.2",
+    "activitypub-webfinger": "^0.2.1",
     "activitystrea.ms": "^4.0.1",
     "csv-parse": "^7.0.0",
     "express": "^5.2.1",

package/web/profile.html

@@ -6,7 +6,6 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <meta name="robots" content="noindex,nofollow">
   <title>activitypub.bot</title>
-  <script type="module" src="https://unpkg.com/@socialwebfoundation/ap-components"></script>
   <style>
     body { max-width: 60ch; margin: 0 auto; padding: 1rem; }
   </style>
@@ -19,7 +18,7 @@
   </main>
 
   <script type="module">
-    import { ActivityPubElement } from "https://unpkg.com/@socialwebfoundation/ap-components";
+    import { ActivityPubElement } from "/js/ap-components.min.js";
 
     const cache = new Map();