@oxy.so/federation 1.0.1 → 2.1.0

package/dist/esm/actorObject.js

@@ -171,6 +171,31 @@ function buildActorImage(config, banner) {
     }
     return apImageObject(resolved);
 }
+/**
+ * The publishable subset of an `alsoKnownAs` input: absolute `https:` URIs,
+ * first occurrence wins, input order kept. Exported so every actor builder
+ * (Oxy's own included) applies the same rule.
+ */
+export function normalizeAlsoKnownAs(values) {
+    if (!values)
+        return [];
+    const seen = new Set();
+    const result = [];
+    for (const value of values) {
+        if (typeof value !== 'string' || seen.has(value))
+            continue;
+        try {
+            if (new URL(value).protocol !== 'https:')
+                continue;
+        }
+        catch {
+            continue;
+        }
+        seen.add(value);
+        result.push(value);
+    }
+    return result;
+}
 /**
  * Build the per-instance local-actor builder. Bind it once with an app's domain +
  * media resolver; call the returned function per user.
@@ -201,6 +226,10 @@ export function createLocalActorBuilder(config) {
                 publicKeyPem: publicKey.publicKeyPem,
             },
         };
+        const aliases = normalizeAlsoKnownAs(params.alsoKnownAs);
+        if (aliases.length > 0) {
+            actorObject.alsoKnownAs = aliases;
+        }
         // `published` (account creation date) is advertised when the API provides it.
         if (createdAt) {
             actorObject.published = new Date(createdAt).toISOString();

package/dist/esm/apContext.js

@@ -30,7 +30,12 @@ export const AP_CONTEXT = [
     // is typed `@id` (an IRI, not a literal); the `misskey`/`fedibird` namespaces
     // and the AS2 `Link` type back the FEP-e232 `Link` quote tag. Without these
     // declarations a strict JSON-LD consumer DROPS the quote fields.
+    //
+    // `alsoKnownAs` is the account-alias term a Mastodon `Move` verifies. It is
+    // `as:alsoKnownAs` typed `@id`, exactly as Mastodon declares it; without the
+    // declaration a strict consumer drops the aliases and the move is refused.
     {
+        alsoKnownAs: { '@id': 'as:alsoKnownAs', '@type': '@id' },
         sensitive: 'as:sensitive',
         toot: 'http://joinmastodon.org/ns#',
         votersCount: 'toot:votersCount',

package/dist/esm/index.js

@@ -62,4 +62,4 @@ export { canonicalFederationHost, isSameFederationHost, extractActorUriFromActiv
  * byte-identical across apps, with media resolution injected. The actor `type`
  * follows the Oxy account kind ({@link LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND}).
  */
-export { createLocalActorBuilder, localActorTypeForAccountKind, isApActorType, AP_ACTOR_TYPES, LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND, } from './actorObject.js';
+export { createLocalActorBuilder, normalizeAlsoKnownAs, localActorTypeForAccountKind, isApActorType, AP_ACTOR_TYPES, LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND, } from './actorObject.js';

package/dist/esm/node/actorResolver.js

@@ -32,6 +32,12 @@ const AP_CONTENT_TYPE = 'application/activity+json';
 /** Maximum decompressed response sizes accepted from untrusted federation hosts. */
 const ACTOR_BODY_MAX_BYTES = 1024 * 1024;
 const COLLECTION_BODY_MAX_BYTES = 64 * 1024;
+/**
+ * Collection responses that DEFINITIVELY withhold the count: the owner hid the
+ * collection (401/403) or it no longer exists (404/410). Anything else non-2xx
+ * is a failed attempt, not an answer.
+ */
+const COLLECTION_WITHHELD_STATUSES = new Set([401, 403, 404, 410]);
 const ERROR_BODY_MAX_BYTES = 4 * 1024;
 async function readBoundedResponseBody(res, maxBytes) {
     const contentLength = res.headers.get('content-length');
@@ -389,9 +395,11 @@ export class ActorResolver {
                 alsoKnownAs,
                 networkAcct: networkIdentity?.federatedUsername,
                 remoteCreatedAt: typeof actor.published === 'string' ? new Date(actor.published) : undefined,
-                followersCount,
-                followingCount,
-                postsCount,
+                // Omitted, not written as `undefined`, when this refresh could not tell:
+                // an absent key is what tells the store to keep the value it has.
+                ...(followersCount !== undefined && { followersCount }),
+                ...(followingCount !== undefined && { followingCount }),
+                ...(postsCount !== undefined && { postsCount }),
                 lastFetchedAt: new Date(),
             };
             const fedActor = await this.config.store.upsertActor(actorId, update);
@@ -423,9 +431,11 @@ export class ActorResolver {
                         // string away made both of those unrepresentable, so the stale text
                         // survived every later refresh with nothing in the logs.
                         bio: identityBio,
-                        followersCount,
-                        followingCount,
-                        postsCount,
+                        // The identity bridge takes a number or nothing; an unknown count is
+                        // sent as nothing rather than as a zero it would store.
+                        followersCount: followersCount ?? undefined,
+                        followingCount: followingCount ?? undefined,
+                        postsCount: postsCount ?? undefined,
                         oxyUserId: fedActor.oxyUserId ?? undefined,
                     };
                     const oxyId = await this.config.identity.resolveExternalUser(normalized, { forceAvatarRefresh });
@@ -503,19 +513,36 @@ export class ActorResolver {
             this.config.logger.warn(`[FedSync] failed to tombstone gone actor ${actorUri}:`, err);
         }
     }
-    /** Fetch the totalItems count from an ActivityPub collection URL. */
+    /**
+     * Read an ActivityPub collection's `totalItems`.
+     *
+     * Every failure used to come back as `0`, so a follower count the remote HID,
+     * or one a timeout kept us from reading, was stored and shown as a real
+     * "0 followers" — indistinguishable from an account nobody follows. A failure
+     * now says which kind it is (see {@link CollectionCount}):
+     *
+     * - `null` when the answer is definitive: no collection advertised, 401/403
+     *   (the owner hid it), 404/410 (it is gone), or a readable collection with no
+     *   usable `totalItems` (the server does not publish the count).
+     * - `undefined` when this attempt simply failed — a thrown fetch (timeout,
+     *   network, SSRF refusal), any other non-2xx (429, 5xx), or a body that could
+     *   not be read as a JSON object. The next refresh may well succeed, so the
+     *   caller keeps whatever it last knew rather than forgetting it.
+     */
     async fetchCollectionCount(url) {
         if (!url)
-            return 0;
+            return null;
         try {
             const res = await this.config.signedFetch(url, AP_CONTENT_TYPE);
-            if (!res.ok)
-                return 0;
+            if (!res.ok) {
+                return COLLECTION_WITHHELD_STATUSES.has(res.status) ? null : undefined;
+            }
             const col = await readBoundedJson(res, COLLECTION_BODY_MAX_BYTES);
-            return typeof col.totalItems === 'number' ? col.totalItems : 0;
+            const total = col.totalItems;
+            return typeof total === 'number' && Number.isSafeInteger(total) && total >= 0 ? total : null;
         }
         catch {
-            return 0;
+            return undefined;
         }
     }
     /**

package/dist/esm/node/actorRouter.js

@@ -263,6 +263,7 @@ export function createActorRouter(config) {
                 profileHeaderImage,
                 publicKey,
                 createdAt: user.createdAt,
+                alsoKnownAs: user.alsoKnownAs,
             });
             res.set('Content-Type', apContentType);
             res.set('Cache-Control', 'max-age=1800');

package/dist/esm/node/delivery.js

@@ -380,6 +380,7 @@ export function createDeliveryService(config) {
                 profileHeaderImage,
                 publicKey,
                 createdAt: user.createdAt,
+                alsoKnownAs: user.alsoKnownAs,
             });
             const actor = urls.actor(username);
             const now = new Date();

package/dist/esm/node/inboundDispatch.js

@@ -12,6 +12,12 @@
  * post/engagement handlers live. The consent gate + notification side effects are
  * injected so the engine holds no app knowledge.
  *
+ * `Move` (account migration) is handed to {@link InboundDispatcherConfig.onMove}
+ * after a SHAPE check only: the engine proves the activity is the signing actor
+ * moving itself, and the app forwards it to Oxy (`POST /federation/move`), which
+ * owns the identity decision — the alias check and the re-fetch of the old
+ * actor's `movedTo`.
+ *
  * Extracted behaviour-identically from Mention's former `InboxProcessingService`
  * dispatcher + `handleIncomingFollow` / `handleUndo(Follow)` / `handleAccept` /
  * `handleReject`.
@@ -38,6 +44,38 @@ export class ActorResolutionPendingError extends Error {
         this.actorUri = actorUri;
     }
 }
+/**
+ * The shape check for an inbound `Move`.
+ *
+ * A Move is only meaningful as an actor moving ITSELF: `actor` and `object` must
+ * both be the actor whose HTTP signature was verified, so a relay or a third
+ * party cannot move somebody else's followers. `target` must be an absolute
+ * https URI, and differ from the old actor.
+ */
+function parseInboundMove(activity, verifiedActorUri) {
+    const activityId = typeof activity.id === 'string' ? activity.id : undefined;
+    if (!activityId)
+        return { ok: false, reason: 'missing id' };
+    const actor = objectTargetUri(activity.actor);
+    if (actor !== verifiedActorUri)
+        return { ok: false, reason: 'actor is not the signer' };
+    const object = objectTargetUri(activity.object);
+    if (object !== verifiedActorUri)
+        return { ok: false, reason: 'object is not the moving actor' };
+    const target = objectTargetUri(activity.target);
+    if (!target)
+        return { ok: false, reason: 'missing target' };
+    try {
+        if (new URL(target).protocol !== 'https:')
+            return { ok: false, reason: 'target is not https' };
+    }
+    catch {
+        return { ok: false, reason: 'target is not a URL' };
+    }
+    if (target === verifiedActorUri)
+        return { ok: false, reason: 'target is the moving actor' };
+    return { ok: true, move: { activityId, oldActorUri: verifiedActorUri, targetActorUri: target } };
+}
 /**
  * The lowercased host of an actor URI, or null when it is not a parseable absolute
  * URL. Callers treat null as blocked: an origin whose host cannot be determined
@@ -255,6 +293,19 @@ export function createInboundDispatcher(config) {
             case 'Update':
                 await config.onContentActivity(activity, verifiedActorUri);
                 break;
+            case 'Move': {
+                const parsed = parseInboundMove(activity, verifiedActorUri);
+                if (!parsed.ok) {
+                    logger.warn(`[Federation] dropping Move from ${verifiedActorUri}: ${parsed.reason}`);
+                    break;
+                }
+                if (!config.onMove) {
+                    logger.debug(`Unhandled Move from ${verifiedActorUri} (no onMove handler)`);
+                    break;
+                }
+                await config.onMove(parsed.move);
+                break;
+            }
             default:
                 logger.debug(`Unhandled activity type: ${validation.type}`);
         }