@oxy.so/federation 1.0.1 → 2.1.0

package/dist/types/actorObject.d.ts

@@ -168,6 +168,16 @@ export interface BuildLocalActorParams {
         publicKeyPem: string;
     };
     createdAt?: string | null;
+    /**
+     * The actor URIs this account is ALSO known as — the ActivityPub
+     * `alsoKnownAs` a Mastodon `Move` checks before it lets followers follow the
+     * account here. Oxy derives it from the user's live, ownership-proven linked
+     * accounts; the builder only publishes it. Omitted from the document when
+     * absent or empty (an empty array is not a claim worth making), de-duplicated,
+     * and restricted to absolute `https:` URIs, because a receiver dereferences
+     * each one.
+     */
+    alsoKnownAs?: readonly string[] | null;
 }
 /**
  * Assembles a LOCAL user's AP actor object (WITHOUT the top-level `@context`).
@@ -175,6 +185,12 @@ export interface BuildLocalActorParams {
  * {@link LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND}.
  */
 export type LocalActorBuilder = (params: BuildLocalActorParams) => Record<string, unknown>;
+/**
+ * The publishable subset of an `alsoKnownAs` input: absolute `https:` URIs,
+ * first occurrence wins, input order kept. Exported so every actor builder
+ * (Oxy's own included) applies the same rule.
+ */
+export declare function normalizeAlsoKnownAs(values: readonly string[] | null | undefined): string[];
 /**
  * Build the per-instance local-actor builder. Bind it once with an app's domain +
  * media resolver; call the returned function per user.

package/dist/types/apContext.d.ts

@@ -10,6 +10,10 @@
  * (FEP-044f / FEP-e232 across Mastodon, Fedibird, Misskey and Pleroma/Akkoma).
  */
 export declare const AP_CONTEXT: (string | {
+    alsoKnownAs: {
+        '@id': string;
+        '@type': string;
+    };
     sensitive: string;
     toot: string;
     votersCount: string;

package/dist/types/index.d.ts

@@ -62,7 +62,7 @@ export { canonicalFederationHost, isSameFederationHost, extractActorUriFromActiv
  * byte-identical across apps, with media resolution injected. The actor `type`
  * follows the Oxy account kind ({@link LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND}).
  */
-export { createLocalActorBuilder, localActorTypeForAccountKind, isApActorType, AP_ACTOR_TYPES, LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND, type ApActorType, type LocalActorType, type LocalActorBuilder, type LocalActorBuilderConfig, type BuildLocalActorParams, type ActorMediaResolver, } from './actorObject';
+export { createLocalActorBuilder, normalizeAlsoKnownAs, localActorTypeForAccountKind, isApActorType, AP_ACTOR_TYPES, LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND, type ApActorType, type LocalActorType, type LocalActorBuilder, type LocalActorBuilderConfig, type BuildLocalActorParams, type ActorMediaResolver, } from './actorObject';
 /** Supported external networks. */
 export type NetworkId = 'activitypub' | 'atproto';
 /**

package/dist/types/node/actorResolver.d.ts

@@ -78,11 +78,31 @@ export interface FederatedActorUpsert {
      */
     networkAcct?: string;
     remoteCreatedAt?: Date;
-    followersCount: number;
-    followingCount: number;
-    postsCount: number;
+    /**
+     * The remote's own totals for its `followers`, `following` and `outbox`
+     * collections, read from each collection's `totalItems`. Each is a
+     * {@link CollectionCount}, and the three states mean three different writes:
+     *
+     * - a number — the remote reported it; store it. `0` is a real zero.
+     * - `null` — the remote definitively does not disclose it (no collection
+     *   advertised, a hidden collection answering 401/403, a gone one answering
+     *   404/410, or a collection that carries no numeric `totalItems`). Store it
+     *   as UNKNOWN — never as `0`.
+     * - absent (`undefined`) — this refresh could not tell (a timeout, a network
+     *   error, a 429/5xx, an unreadable body). The store must LEAVE the stored
+     *   value in place, and a first insert must record it as unknown.
+     */
+    followersCount?: number | null;
+    followingCount?: number | null;
+    postsCount?: number | null;
     lastFetchedAt: Date;
 }
+/**
+ * A remote collection's size as one refresh observed it: the reported
+ * `totalItems`, `null` when the remote definitively withholds it, or `undefined`
+ * when this attempt could not find out. See {@link FederatedActorUpsert.followersCount}.
+ */
+export type CollectionCount = number | null | undefined;
 /** Bring-your-own-store: the AP actor cache stays in the app DB behind this adapter. */
 export interface FederatedActorStore<TActor extends FederatedActorRecordBase> {
     /** Look up a cached actor by its protocol URI. */
@@ -245,7 +265,22 @@ export declare class ActorResolver<TActor extends FederatedActorRecordBase> {
      * allowed to throw out of the caller. Idempotent.
      */
     tombstoneGoneActor(actorUri: string): Promise<void>;
-    /** Fetch the totalItems count from an ActivityPub collection URL. */
+    /**
+     * Read an ActivityPub collection's `totalItems`.
+     *
+     * Every failure used to come back as `0`, so a follower count the remote HID,
+     * or one a timeout kept us from reading, was stored and shown as a real
+     * "0 followers" — indistinguishable from an account nobody follows. A failure
+     * now says which kind it is (see {@link CollectionCount}):
+     *
+     * - `null` when the answer is definitive: no collection advertised, 401/403
+     *   (the owner hid it), 404/410 (it is gone), or a readable collection with no
+     *   usable `totalItems` (the server does not publish the count).
+     * - `undefined` when this attempt simply failed — a thrown fetch (timeout,
+     *   network, SSRF refusal), any other non-2xx (429, 5xx), or a body that could
+     *   not be read as a JSON object. The next refresh may well succeed, so the
+     *   caller keeps whatever it last knew rather than forgetting it.
+     */
     private fetchCollectionCount;
     /**
      * Get a cached actor or fetch if missing/stale (>24h).

package/dist/types/node/actorRouter.d.ts

@@ -35,6 +35,12 @@ export interface ActorRouteUser {
     createdAt?: string | null;
     /** Account-graph classification — decides the actor `type`. */
     kind?: AccountKind | null;
+    /**
+     * The actor URIs Oxy publishes as this account's aliases
+     * (`GET /profiles/username/:username` → `alsoKnownAs`). Emitted on the actor
+     * only when non-empty.
+     */
+    alsoKnownAs?: readonly string[] | null;
     _count?: {
         followers?: number;
         following?: number;

package/dist/types/node/delivery.d.ts

@@ -164,6 +164,12 @@ export interface DeliveryActorProfile {
      * staleness window).
      */
     kind?: AccountKind | null;
+    /**
+     * The aliases Oxy publishes for the account. Must travel with the `Update`
+     * for the same reason `kind` does: the pushed actor and the fetched actor are
+     * one document, and a follower's instance learns a new alias from this push.
+     */
+    alsoKnownAs?: readonly string[] | null;
 }
 /** Resolve a local username to its Oxy profile (for the `Update(Person)` rebroadcast). */
 export interface DeliveryIdentity {

package/dist/types/node/inboundDispatch.d.ts

@@ -12,6 +12,12 @@
  * post/engagement handlers live. The consent gate + notification side effects are
  * injected so the engine holds no app knowledge.
  *
+ * `Move` (account migration) is handed to {@link InboundDispatcherConfig.onMove}
+ * after a SHAPE check only: the engine proves the activity is the signing actor
+ * moving itself, and the app forwards it to Oxy (`POST /federation/move`), which
+ * owns the identity decision — the alias check and the re-fetch of the old
+ * actor's `movedTo`.
+ *
  * Extracted behaviour-identically from Mention's former `InboxProcessingService`
  * dispatcher + `handleIncomingFollow` / `handleUndo(Follow)` / `handleAccept` /
  * `handleReject`.
@@ -144,9 +150,25 @@ export interface InboundDispatcherConfig {
      * Delete / Update, and a non-follow Undo. The app's post/engagement handlers.
      */
     onContentActivity(activity: Record<string, unknown>, verifiedActorUri: string): Promise<void>;
+    /**
+     * Handle an account `Move` whose shape the engine has verified: signed by
+     * `oldActorUri`, which is both its `actor` and its `object`, naming a
+     * `targetActorUri`. The app forwards it to Oxy (`POST /federation/move`),
+     * which decides. Absent ⇒ a Move is logged and dropped.
+     */
+    onMove?(move: InboundMove): Promise<void>;
     /** Diagnostics sink. */
     logger: InboundDispatcherLogger;
 }
+/** A shape-verified inbound `Move`. Nothing here is trusted beyond the signature. */
+export interface InboundMove {
+    /** The activity `id`, the idempotency key Oxy records. */
+    activityId: string;
+    /** The account that is moving — the verified signer, its `actor` and its `object`. */
+    oldActorUri: string;
+    /** Where it says it moved. Oxy checks this names a local account that aliases the old one. */
+    targetActorUri: string;
+}
 /** The inbound-activity dispatcher. */
 export interface InboundDispatcher {
     /** Process one already-actor-verified inbound activity. */

package/dist/types/node/index.d.ts

@@ -28,7 +28,7 @@ export { createIdentityBridge, type IdentityBridge, type IdentityBridgeConfig, t
  * 410-Gone tombstone) over a bring-your-own-store adapter, the identity bridge,
  * and injected transports + text normalization.
  */
-export { createActorResolver, ActorResolver, type ActorResolverConfig, type ActorResolverIdentity, type ActorResolverLogger, type ActorTextAdapter, type FederatedActorStore, type FederatedActorRecordBase, type FederatedActorUpsert, type FederatedActorField, type WebFingerFetch, type WebFingerJrd, } from './actorResolver';
+export { createActorResolver, ActorResolver, type ActorResolverConfig, type ActorResolverIdentity, type ActorResolverLogger, type ActorTextAdapter, type FederatedActorStore, type CollectionCount, type FederatedActorRecordBase, type FederatedActorUpsert, type FederatedActorField, type WebFingerFetch, type WebFingerJrd, } from './actorResolver';
 /**
  * Outbound activity delivery + the follow lifecycle (Follow / Undo(Follow) /
  * Accept(Follow)) + the `Update(Person)` actor rebroadcast, over injected key
@@ -41,7 +41,7 @@ export { createDeliveryService, type DeliveryService, type DeliveryServiceConfig
  * identity + store adapters, and the `onContentActivity` seam every content verb
  * (Create / Announce / Like / Delete / Update, non-follow Undo) is handed to.
  */
-export { createInboundDispatcher, ActorResolutionPendingError, type InboundDispatcher, type InboundDispatcherConfig, type InboundDispatcherLogger, type InboundActivityValidation, type InboundLocalUser, type InboundIdentity, type InboundConsent, type InboundActorResolver, type InboundFollowStore, type InboundDelivery, } from './inboundDispatch';
+export { createInboundDispatcher, ActorResolutionPendingError, type InboundMove, type InboundDispatcher, type InboundDispatcherConfig, type InboundDispatcherLogger, type InboundActivityValidation, type InboundLocalUser, type InboundIdentity, type InboundConsent, type InboundActorResolver, type InboundFollowStore, type InboundDelivery, } from './inboundDispatch';
 /** The WebFinger + host-meta discovery router (domain-parameterized, consent-gated). */
 export { createWebfingerRouter, type WebfingerRouterConfig, type WebfingerSharingState, type WebfingerUser, type WebfingerJrd, type WebfingerLogger, } from './webfingerRouter';
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/federation",
-  "version": "1.0.1",
+  "version": "2.1.0",
   "description": "Oxy Federation — the app-agnostic ActivityPub identity + follow engine substrate: the network-connector contract, normalized cross-network DTOs, HTTP signatures, actor resolution, the outbound delivery transport + follow lifecycle, the inbound dispatcher, and the webfinger/actor/inbox Express routers. Domain-parameterized so every Oxy app backend federates under its own domain.",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -61,13 +61,13 @@
     "directory": "packages/federation"
   },
   "author": "OxyHQ",
-  "license": "Apache-2.0",
+  "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://oxy.so",
   "engines": {
     "node": ">=18.0.0"
   },
   "scripts": {
-    "build": "bun run --filter @oxy.so/contracts build && bun run --filter @oxy.so/protocol build && bun run --filter @oxy.so/core build && bun run build:cjs && bun run build:esm && bun run build:types",
+    "build": "node ../core/scripts/build-workspace-deps.mjs @oxy.so/contracts @oxy.so/protocol @oxy.so/core && bun run build:cjs && bun run build:esm && bun run build:types",
     "build:cjs": "tsc -p tsconfig.cjs.json",
     "build:esm": "tsc -p tsconfig.esm.json && node scripts/fix-esm-imports.mjs",
     "build:types": "tsc -p tsconfig.types.json",

package/src/__tests__/actorCollectionCounts.test.ts

@@ -0,0 +1,172 @@
+import type { NormalizedExternalActor } from '../index';
+import {
+  createActorResolver,
+  type ActorResolverConfig,
+  type FederatedActorRecordBase,
+  type FederatedActorUpsert,
+} from '../node/actorResolver';
+
+/**
+ * A remote collection count that could not be read is UNKNOWN, not zero.
+ *
+ * `fetchCollectionCount` used to turn every failure — a hidden collection's 403,
+ * a timeout, a body with no `totalItems` — into `0`, so the store recorded and
+ * the profile showed "0 followers" for accounts with thousands. These pin the
+ * three outcomes apart: a reported number (including a real 0), a definitive
+ * `null`, and an ABSENT key for a failed attempt, which is what tells the store
+ * to keep the value it already has.
+ */
+
+interface TestActor extends FederatedActorRecordBase {
+  uri: string;
+}
+
+const ACTOR = 'https://remote.example/users/bob';
+const FOLLOWERS = 'https://remote.example/users/bob/followers';
+const FOLLOWING = 'https://remote.example/users/bob/following';
+const OUTBOX = 'https://remote.example/users/bob/outbox';
+
+type CollectionReply = Response | (() => Promise<Response>);
+
+function actorDocument(overrides: Record<string, unknown> = {}): string {
+  return JSON.stringify({
+    id: ACTOR,
+    type: 'Person',
+    inbox: 'https://remote.example/users/bob/inbox',
+    preferredUsername: 'bob',
+    followers: FOLLOWERS,
+    following: FOLLOWING,
+    outbox: OUTBOX,
+    ...overrides,
+  });
+}
+
+function collection(totalItems: unknown): Response {
+  return new Response(JSON.stringify({ type: 'OrderedCollection', totalItems }));
+}
+
+async function resolveWith(replies: {
+  actor?: string;
+  followers?: CollectionReply;
+  following?: CollectionReply;
+  outbox?: CollectionReply;
+}): Promise<{ upserts: FederatedActorUpsert[]; bridged: NormalizedExternalActor[] }> {
+  const upserts: FederatedActorUpsert[] = [];
+  const bridged: NormalizedExternalActor[] = [];
+  const reply = (r: CollectionReply | undefined): Promise<Response> => {
+    if (!r) return Promise.resolve(collection(7));
+    return typeof r === 'function' ? r() : Promise.resolve(r);
+  };
+
+  const config: ActorResolverConfig<TestActor> = {
+    federationEnabled: true,
+    signedFetch: async (url) => {
+      if (url === ACTOR) return new Response(replies.actor ?? actorDocument());
+      if (url === FOLLOWERS) return reply(replies.followers);
+      if (url === FOLLOWING) return reply(replies.following);
+      if (url === OUTBOX) return reply(replies.outbox);
+      return new Response(null, { status: 404 });
+    },
+    fetchWebFinger: async () => null,
+    isBlockedDomain: () => false,
+    normalizeFederatedAcct: (acct) => acct,
+    domainFromAcct: (acct) => acct.split('@')[1],
+    firstStringUrl: () => undefined,
+    store: {
+      findActorByUri: async () => null,
+      upsertActor: async (uri, update) => {
+        upserts.push(update);
+        return { _id: 'row-1', uri };
+      },
+      findActorByPublicKeyId: async () => null,
+      setActorOxyUserId: async () => {},
+      tombstoneActor: async () => null,
+    },
+    identity: {
+      resolveExternalUser: async (actor) => {
+        bridged.push(actor);
+        return null;
+      },
+      reportActorGone: async () => 'archived',
+    },
+    text: {
+      inlineField: (value) => (typeof value === 'string' ? value : ''),
+      inlineDisplayName: (raw) => raw,
+      sanitizeFieldValue: (html) => html,
+      htmlToPlainText: (html) => html,
+    },
+    logger: { info: () => {}, warn: () => {} },
+  };
+
+  await createActorResolver(config).fetchRemoteActor(ACTOR);
+  return { upserts, bridged };
+}
+
+describe('fetchRemoteActor — remote collection counts', () => {
+  it('stores reported totals, and a real 0 stays 0', async () => {
+    const { upserts } = await resolveWith({
+      followers: collection(1234),
+      following: collection(0),
+      outbox: collection(56),
+    });
+
+    expect(upserts).toHaveLength(1);
+    expect(upserts[0]).toMatchObject({ followersCount: 1234, followingCount: 0, postsCount: 56 });
+  });
+
+  it.each([401, 403, 404, 410])('records a collection that answers %i as unknown (null), not 0', async (status) => {
+    const { upserts } = await resolveWith({
+      followers: new Response(null, { status }),
+      following: collection(3),
+    });
+
+    expect(upserts[0]?.followersCount).toBeNull();
+    expect(upserts[0]?.followingCount).toBe(3);
+  });
+
+  it.each([
+    ['missing', undefined],
+    ['a string', '1234'],
+    ['negative', -1],
+    ['fractional', 1.5],
+  ])('records a collection whose totalItems is %s as unknown (null)', async (_label, totalItems) => {
+    const { upserts } = await resolveWith({ followers: collection(totalItems) });
+
+    expect(upserts[0]?.followersCount).toBeNull();
+  });
+
+  it('records an actor that advertises no collection as unknown (null)', async () => {
+    const { upserts } = await resolveWith({
+      actor: actorDocument({ followers: undefined, following: undefined }),
+    });
+
+    expect(upserts[0]?.followersCount).toBeNull();
+    expect(upserts[0]?.followingCount).toBeNull();
+  });
+
+  it.each([
+    ['a timeout', () => Promise.reject(new Error('The operation was aborted due to timeout'))],
+    ['a 500', () => Promise.resolve(new Response(null, { status: 500 }))],
+    ['a 429', () => Promise.resolve(new Response(null, { status: 429 }))],
+    ['malformed JSON', () => Promise.resolve(new Response('{"totalItems": 12'))],
+    ['an empty body', () => Promise.resolve(new Response(''))],
+  ] as const)('OMITS a count whose fetch failed with %s, so a known value is kept', async (_label, followers) => {
+    const { upserts } = await resolveWith({ followers, following: collection(9) });
+
+    expect(upserts[0]).not.toHaveProperty('followersCount');
+    expect(upserts[0]?.followingCount).toBe(9);
+  });
+
+  it('never hands the identity bridge a zero it did not read', async () => {
+    const { bridged } = await resolveWith({
+      followers: new Response(null, { status: 403 }),
+      following: () => Promise.reject(new Error('timeout')),
+      outbox: collection(0),
+    });
+
+    expect(bridged).toHaveLength(1);
+    expect(bridged[0]?.followersCount).toBeUndefined();
+    expect(bridged[0]?.followingCount).toBeUndefined();
+    expect(bridged[0]?.postsCount).toBe(0);
+  });
+});

package/src/__tests__/actorObject.test.ts

@@ -102,6 +102,7 @@ describe('createLocalActorBuilder (golden actor vector)', () => {
       toot: 'http://joinmastodon.org/ns#',
       votersCount: 'toot:votersCount',
       quote: { '@id': 'https://w3id.org/fep/044f#quote', '@type': '@id' },
+      alsoKnownAs: { '@id': 'as:alsoKnownAs', '@type': '@id' },
     });
   });
 
@@ -248,6 +249,32 @@ describe('actor type by Oxy account kind', () => {
   });
 });
 
+describe('createLocalActorBuilder — alsoKnownAs', () => {
+  const alias = 'https://mastodon.social/users/nate';
+
+  it('emits nothing when there are no aliases, so ordinary actors stay byte-identical', () => {
+    for (const alsoKnownAs of [undefined, null, []]) {
+      const actor = buildActor({ ...PARAMS, alsoKnownAs });
+      expect(actor).not.toHaveProperty('alsoKnownAs');
+      expect(JSON.stringify(actor)).toBe(JSON.stringify(EXPECTED_ACTOR));
+    }
+  });
+
+  it('emits the aliases after publicKey, de-duplicated and https-only', () => {
+    const actor = buildActor({
+      ...PARAMS,
+      alsoKnownAs: [alias, 'http://insecure.example/users/nate', 'not a url', alias, 'https://pleroma.example/users/n'],
+    });
+    expect(actor.alsoKnownAs).toEqual([alias, 'https://pleroma.example/users/n']);
+    const keys = Object.keys(actor);
+    expect(keys.indexOf('alsoKnownAs')).toBe(keys.indexOf('publicKey') + 1);
+  });
+
+  it('emits nothing when every alias is unpublishable', () => {
+    expect(buildActor({ ...PARAMS, alsoKnownAs: ['http://x.example/u'] })).not.toHaveProperty('alsoKnownAs');
+  });
+});
+
 describe('createUrlBuilders', () => {
   it('scopes actor() to actorDomain and the rest to domain', () => {
     const urls = createUrlBuilders('mention.earth', 'actors.mention.earth');

package/src/__tests__/inboundDispatch.test.ts

@@ -29,7 +29,9 @@ function makeRig(overrides: {
   actorOxyUserIdForUndo?: string | null;
   validate?: (activity: Record<string, unknown>) => InboundActivityValidation;
   blockedHosts?: string[];
+  withMoveHandler?: boolean;
 } = {}) {
+  const moves: Array<{ activityId: string; oldActorUri: string; targetActorUri: string }> = [];
   const bridgeFollowCalls: Array<[string, string]> = [];
   const bridgeUnfollowCalls: Array<[string, string]> = [];
   const acceptsSent: Array<{ localOxyUserId: string; localUsername: string; followActivityId: string; remoteActorUri: string }> = [];
@@ -106,11 +108,19 @@ function makeRig(overrides: {
     onContentActivity: async (activity, verifiedActorUri) => {
       contentActivities.push({ type: activity.type, verifiedActorUri });
     },
+    ...(overrides.withMoveHandler === false
+      ? {}
+      : {
+          onMove: async (move: { activityId: string; oldActorUri: string; targetActorUri: string }) => {
+            moves.push(move);
+          },
+        }),
     logger: { debug: () => {}, info: () => {}, warn: () => {} },
   };
 
   return {
     dispatcher: createInboundDispatcher(config),
+    moves,
     validatedActivities,
     bridgeFollowCalls,
     bridgeUnfollowCalls,
@@ -249,6 +259,56 @@ describe('inbound Accept / Reject', () => {
   });
 });
 
+describe('Move → onMove', () => {
+  const TARGET = 'https://mention.earth/ap/users/bob';
+  const move = (extra: Record<string, unknown> = {}) => ({
+    id: `${REMOTE_ACTOR}#moves/1`,
+    type: 'Move',
+    actor: REMOTE_ACTOR,
+    object: REMOTE_ACTOR,
+    target: TARGET,
+    ...extra,
+  });
+
+  it('hands a well-formed self-Move to the app', async () => {
+    const rig = makeRig();
+    await rig.dispatcher.processInboxActivity(move(), REMOTE_ACTOR);
+    expect(rig.moves).toEqual([{ activityId: `${REMOTE_ACTOR}#moves/1`, oldActorUri: REMOTE_ACTOR, targetActorUri: TARGET }]);
+    expect(rig.contentActivities).toHaveLength(0);
+  });
+
+  it('accepts embedded object/target references', async () => {
+    const rig = makeRig();
+    await rig.dispatcher.processInboxActivity(move({ object: { id: REMOTE_ACTOR }, target: { id: TARGET } }), REMOTE_ACTOR);
+    expect(rig.moves).toHaveLength(1);
+  });
+
+  it.each([
+    ['a Move of someone else', { object: 'https://remote.example/users/carol' }],
+    ['an actor that is not the signer', { actor: 'https://remote.example/users/carol' }],
+    ['no target', { target: undefined }],
+    ['a non-https target', { target: 'http://mention.earth/ap/users/bob' }],
+    ['a target equal to the mover', { target: REMOTE_ACTOR }],
+    ['no activity id', { id: undefined }],
+  ])('drops %s', async (_label, extra) => {
+    const rig = makeRig();
+    await rig.dispatcher.processInboxActivity(move(extra), REMOTE_ACTOR);
+    expect(rig.moves).toHaveLength(0);
+  });
+
+  it('drops a Move signed by a different actor than it names', async () => {
+    const rig = makeRig();
+    await rig.dispatcher.processInboxActivity(move(), 'https://relay.example/actor');
+    expect(rig.moves).toHaveLength(0);
+  });
+
+  it('drops a Move when the app registered no handler', async () => {
+    const rig = makeRig({ withMoveHandler: false });
+    await expect(rig.dispatcher.processInboxActivity(move(), REMOTE_ACTOR)).resolves.toBeUndefined();
+    expect(rig.contentActivities).toHaveLength(0);
+  });
+});
+
 describe('content verbs → onContentActivity', () => {
   it.each(['Create', 'Announce', 'Like', 'Delete', 'Update'])('routes %s to the app', async (type) => {
     const rig = makeRig();

package/src/actorObject.ts

@@ -222,6 +222,16 @@ export interface BuildLocalActorParams {
   profileHeaderImage?: string | null;
   publicKey: { keyId: string; publicKeyPem: string };
   createdAt?: string | null;
+  /**
+   * The actor URIs this account is ALSO known as — the ActivityPub
+   * `alsoKnownAs` a Mastodon `Move` checks before it lets followers follow the
+   * account here. Oxy derives it from the user's live, ownership-proven linked
+   * accounts; the builder only publishes it. Omitted from the document when
+   * absent or empty (an empty array is not a claim worth making), de-duplicated,
+   * and restricted to absolute `https:` URIs, because a receiver dereferences
+   * each one.
+   */
+  alsoKnownAs?: readonly string[] | null;
 }
 
 /**
@@ -271,6 +281,28 @@ function buildActorImage(
   return apImageObject(resolved);
 }
 
+/**
+ * The publishable subset of an `alsoKnownAs` input: absolute `https:` URIs,
+ * first occurrence wins, input order kept. Exported so every actor builder
+ * (Oxy's own included) applies the same rule.
+ */
+export function normalizeAlsoKnownAs(values: readonly string[] | null | undefined): string[] {
+  if (!values) return [];
+  const seen = new Set<string>();
+  const result: string[] = [];
+  for (const value of values) {
+    if (typeof value !== 'string' || seen.has(value)) continue;
+    try {
+      if (new URL(value).protocol !== 'https:') continue;
+    } catch {
+      continue;
+    }
+    seen.add(value);
+    result.push(value);
+  }
+  return result;
+}
+
 /**
  * Build the per-instance local-actor builder. Bind it once with an app's domain +
  * media resolver; call the returned function per user.
@@ -303,6 +335,11 @@ export function createLocalActorBuilder(config: LocalActorBuilderConfig): LocalA
       },
     };
 
+    const aliases = normalizeAlsoKnownAs(params.alsoKnownAs);
+    if (aliases.length > 0) {
+      actorObject.alsoKnownAs = aliases;
+    }
+
     // `published` (account creation date) is advertised when the API provides it.
     if (createdAt) {
       actorObject.published = new Date(createdAt).toISOString();

package/src/apContext.ts

@@ -30,7 +30,12 @@ export const AP_CONTEXT = [
   // is typed `@id` (an IRI, not a literal); the `misskey`/`fedibird` namespaces
   // and the AS2 `Link` type back the FEP-e232 `Link` quote tag. Without these
   // declarations a strict JSON-LD consumer DROPS the quote fields.
+  //
+  // `alsoKnownAs` is the account-alias term a Mastodon `Move` verifies. It is
+  // `as:alsoKnownAs` typed `@id`, exactly as Mastodon declares it; without the
+  // declaration a strict consumer drops the aliases and the move is refused.
   {
+    alsoKnownAs: { '@id': 'as:alsoKnownAs', '@type': '@id' },
     sensitive: 'as:sensitive',
     toot: 'http://joinmastodon.org/ns#',
     votersCount: 'toot:votersCount',

package/src/index.ts

@@ -112,6 +112,7 @@ export {
  */
 export {
   createLocalActorBuilder,
+  normalizeAlsoKnownAs,
   localActorTypeForAccountKind,
   isApActorType,
   AP_ACTOR_TYPES,