@oxy.so/federation 2.0.0 → 2.1.1

package/dist/esm/actorObject.js

@@ -171,6 +171,31 @@ function buildActorImage(config, banner) {
     }
     return apImageObject(resolved);
 }
+/**
+ * The publishable subset of an `alsoKnownAs` input: absolute `https:` URIs,
+ * first occurrence wins, input order kept. Exported so every actor builder
+ * (Oxy's own included) applies the same rule.
+ */
+export function normalizeAlsoKnownAs(values) {
+    if (!values)
+        return [];
+    const seen = new Set();
+    const result = [];
+    for (const value of values) {
+        if (typeof value !== 'string' || seen.has(value))
+            continue;
+        try {
+            if (new URL(value).protocol !== 'https:')
+                continue;
+        }
+        catch {
+            continue;
+        }
+        seen.add(value);
+        result.push(value);
+    }
+    return result;
+}
 /**
  * Build the per-instance local-actor builder. Bind it once with an app's domain +
  * media resolver; call the returned function per user.
@@ -201,6 +226,10 @@ export function createLocalActorBuilder(config) {
                 publicKeyPem: publicKey.publicKeyPem,
             },
         };
+        const aliases = normalizeAlsoKnownAs(params.alsoKnownAs);
+        if (aliases.length > 0) {
+            actorObject.alsoKnownAs = aliases;
+        }
         // `published` (account creation date) is advertised when the API provides it.
         if (createdAt) {
             actorObject.published = new Date(createdAt).toISOString();

package/dist/esm/apContext.js

@@ -30,7 +30,12 @@ export const AP_CONTEXT = [
     // is typed `@id` (an IRI, not a literal); the `misskey`/`fedibird` namespaces
     // and the AS2 `Link` type back the FEP-e232 `Link` quote tag. Without these
     // declarations a strict JSON-LD consumer DROPS the quote fields.
+    //
+    // `alsoKnownAs` is the account-alias term a Mastodon `Move` verifies. It is
+    // `as:alsoKnownAs` typed `@id`, exactly as Mastodon declares it; without the
+    // declaration a strict consumer drops the aliases and the move is refused.
     {
+        alsoKnownAs: { '@id': 'as:alsoKnownAs', '@type': '@id' },
         sensitive: 'as:sensitive',
         toot: 'http://joinmastodon.org/ns#',
         votersCount: 'toot:votersCount',

package/dist/esm/index.js

@@ -62,4 +62,4 @@ export { canonicalFederationHost, isSameFederationHost, extractActorUriFromActiv
  * byte-identical across apps, with media resolution injected. The actor `type`
  * follows the Oxy account kind ({@link LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND}).
  */
-export { createLocalActorBuilder, localActorTypeForAccountKind, isApActorType, AP_ACTOR_TYPES, LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND, } from './actorObject.js';
+export { createLocalActorBuilder, normalizeAlsoKnownAs, localActorTypeForAccountKind, isApActorType, AP_ACTOR_TYPES, LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND, } from './actorObject.js';

package/dist/esm/node/actorRouter.js

@@ -263,6 +263,7 @@ export function createActorRouter(config) {
                 profileHeaderImage,
                 publicKey,
                 createdAt: user.createdAt,
+                alsoKnownAs: user.alsoKnownAs,
             });
             res.set('Content-Type', apContentType);
             res.set('Cache-Control', 'max-age=1800');

package/dist/esm/node/delivery.js

@@ -380,6 +380,7 @@ export function createDeliveryService(config) {
                 profileHeaderImage,
                 publicKey,
                 createdAt: user.createdAt,
+                alsoKnownAs: user.alsoKnownAs,
             });
             const actor = urls.actor(username);
             const now = new Date();

package/dist/esm/node/inboundDispatch.js

@@ -12,6 +12,12 @@
  * post/engagement handlers live. The consent gate + notification side effects are
  * injected so the engine holds no app knowledge.
  *
+ * `Move` (account migration) is handed to {@link InboundDispatcherConfig.onMove}
+ * after a SHAPE check only: the engine proves the activity is the signing actor
+ * moving itself, and the app forwards it to Oxy (`POST /federation/move`), which
+ * owns the identity decision — the alias check and the re-fetch of the old
+ * actor's `movedTo`.
+ *
  * Extracted behaviour-identically from Mention's former `InboxProcessingService`
  * dispatcher + `handleIncomingFollow` / `handleUndo(Follow)` / `handleAccept` /
  * `handleReject`.
@@ -38,6 +44,38 @@ export class ActorResolutionPendingError extends Error {
         this.actorUri = actorUri;
     }
 }
+/**
+ * The shape check for an inbound `Move`.
+ *
+ * A Move is only meaningful as an actor moving ITSELF: `actor` and `object` must
+ * both be the actor whose HTTP signature was verified, so a relay or a third
+ * party cannot move somebody else's followers. `target` must be an absolute
+ * https URI, and differ from the old actor.
+ */
+function parseInboundMove(activity, verifiedActorUri) {
+    const activityId = typeof activity.id === 'string' ? activity.id : undefined;
+    if (!activityId)
+        return { ok: false, reason: 'missing id' };
+    const actor = objectTargetUri(activity.actor);
+    if (actor !== verifiedActorUri)
+        return { ok: false, reason: 'actor is not the signer' };
+    const object = objectTargetUri(activity.object);
+    if (object !== verifiedActorUri)
+        return { ok: false, reason: 'object is not the moving actor' };
+    const target = objectTargetUri(activity.target);
+    if (!target)
+        return { ok: false, reason: 'missing target' };
+    try {
+        if (new URL(target).protocol !== 'https:')
+            return { ok: false, reason: 'target is not https' };
+    }
+    catch {
+        return { ok: false, reason: 'target is not a URL' };
+    }
+    if (target === verifiedActorUri)
+        return { ok: false, reason: 'target is the moving actor' };
+    return { ok: true, move: { activityId, oldActorUri: verifiedActorUri, targetActorUri: target } };
+}
 /**
  * The lowercased host of an actor URI, or null when it is not a parseable absolute
  * URL. Callers treat null as blocked: an origin whose host cannot be determined
@@ -255,6 +293,19 @@ export function createInboundDispatcher(config) {
             case 'Update':
                 await config.onContentActivity(activity, verifiedActorUri);
                 break;
+            case 'Move': {
+                const parsed = parseInboundMove(activity, verifiedActorUri);
+                if (!parsed.ok) {
+                    logger.warn(`[Federation] dropping Move from ${verifiedActorUri}: ${parsed.reason}`);
+                    break;
+                }
+                if (!config.onMove) {
+                    logger.debug(`Unhandled Move from ${verifiedActorUri} (no onMove handler)`);
+                    break;
+                }
+                await config.onMove(parsed.move);
+                break;
+            }
             default:
                 logger.debug(`Unhandled activity type: ${validation.type}`);
         }