@oxy.so/federation 2.11.0 → 2.13.0

package/dist/cjs/index.js

@@ -22,7 +22,7 @@
  * knowledge of any app's post shape.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.groupFollowersCollection = exports.groupOutboxCollection = exports.isGroupActorKind = exports.GROUP_OUTBOX_SIZE = exports.LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND = exports.AP_ACTOR_TYPES = exports.isApActorType = exports.accountKindForActor = exports.localActorTypeForAccountKind = exports.normalizeAlsoKnownAs = exports.createLocalActorBuilder = exports.createDomainPolicy = exports.extractActorUriFromActivityId = exports.isSameFederationHost = exports.canonicalFederationHost = exports.AP_CONTEXT = exports.readProxyDeclarations = exports.upstreamHandleFromProxyOf = exports.upstreamHandleFromPreferredUsername = exports.upstreamHandleFromAutomatedActor = exports.upstreamHandleFromAlsoKnownAs = exports.upstreamHandleFromProfileField = exports.federatedUsernameFromUpstreamUrl = exports.parseUpstreamProfileUrl = exports.upstreamProfileUrl = exports.stripBridgeBoilerplate = exports.createBridgeRelabeller = exports.blueskyUsernameFromHandle = exports.BSKY_NETWORK_DOMAIN = exports.FEDERATION_NETWORKS = exports.INSTANCE_ACTOR_USERNAME = exports.normalizeActorUsername = exports.createUrlBuilders = exports.DEFAULT_SIGNED_CONTENT_TYPE = exports.HTTP_SIGNATURE_ALGORITHM = exports.verifyHttpSignature = exports.signRequest = void 0;
+exports.groupFollowersCollection = exports.groupOutboxCollection = exports.isGroupActorKind = exports.GROUP_OUTBOX_SIZE = exports.LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND = exports.AP_ACTOR_TYPES = exports.isApActorType = exports.accountKindForActor = exports.localActorTypeForAccountKind = exports.normalizeAlsoKnownAs = exports.createLocalActorBuilder = exports.createDomainPolicy = exports.extractActorUriFromActivityId = exports.isSameFederationHost = exports.canonicalFederationHost = exports.AP_CONTEXT = exports.readProxyDeclarations = exports.upstreamHandleFromProxyOf = exports.upstreamHandleFromPreferredUsername = exports.upstreamHandleFromAutomatedActor = exports.upstreamHandleFromAlsoKnownAs = exports.upstreamHandleFromProfileField = exports.federatedUsernameFromUpstreamUrl = exports.parseUpstreamProfileUrl = exports.upstreamProfileUrl = exports.stripBridgeBoilerplate = exports.createBridgeRelabeller = exports.atprotoIdentityHandle = exports.isUnresolvedAtprotoHandle = exports.UNRESOLVED_ATPROTO_HANDLE = exports.blueskyHandleFromUsername = exports.blueskyUsernameFromHandle = exports.BSKY_NETWORK_DOMAIN = exports.FEDERATION_NETWORKS = exports.INSTANCE_ACTOR_USERNAME = exports.normalizeActorUsername = exports.createUrlBuilders = exports.DEFAULT_SIGNED_CONTENT_TYPE = exports.HTTP_SIGNATURE_ALGORITHM = exports.verifyHttpSignature = exports.signRequest = void 0;
 /**
  * HTTP Signatures (draft-cavage) — the pure sign/verify crypto every Oxy app's
  * ActivityPub federation shares. Private-key custody is injected; the key never
@@ -55,6 +55,10 @@ var networkIdentity_1 = require("./networkIdentity");
 Object.defineProperty(exports, "FEDERATION_NETWORKS", { enumerable: true, get: function () { return networkIdentity_1.FEDERATION_NETWORKS; } });
 Object.defineProperty(exports, "BSKY_NETWORK_DOMAIN", { enumerable: true, get: function () { return networkIdentity_1.BSKY_NETWORK_DOMAIN; } });
 Object.defineProperty(exports, "blueskyUsernameFromHandle", { enumerable: true, get: function () { return networkIdentity_1.blueskyUsernameFromHandle; } });
+Object.defineProperty(exports, "blueskyHandleFromUsername", { enumerable: true, get: function () { return networkIdentity_1.blueskyHandleFromUsername; } });
+Object.defineProperty(exports, "UNRESOLVED_ATPROTO_HANDLE", { enumerable: true, get: function () { return networkIdentity_1.UNRESOLVED_ATPROTO_HANDLE; } });
+Object.defineProperty(exports, "isUnresolvedAtprotoHandle", { enumerable: true, get: function () { return networkIdentity_1.isUnresolvedAtprotoHandle; } });
+Object.defineProperty(exports, "atprotoIdentityHandle", { enumerable: true, get: function () { return networkIdentity_1.atprotoIdentityHandle; } });
 Object.defineProperty(exports, "createBridgeRelabeller", { enumerable: true, get: function () { return networkIdentity_1.createBridgeRelabeller; } });
 Object.defineProperty(exports, "stripBridgeBoilerplate", { enumerable: true, get: function () { return networkIdentity_1.stripBridgeBoilerplate; } });
 Object.defineProperty(exports, "upstreamProfileUrl", { enumerable: true, get: function () { return networkIdentity_1.upstreamProfileUrl; } });

package/dist/cjs/networkIdentity.js

@@ -49,7 +49,7 @@
  *   means neither can be edited into the other by accident.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BSKY_NETWORK_DOMAIN = exports.FEDERATION_NETWORKS = void 0;
+exports.UNRESOLVED_ATPROTO_HANDLE = exports.BSKY_NETWORK_DOMAIN = exports.FEDERATION_NETWORKS = void 0;
 exports.upstreamProfileUrl = upstreamProfileUrl;
 exports.parseUpstreamProfileUrl = parseUpstreamProfileUrl;
 exports.readProxyDeclarations = readProxyDeclarations;
@@ -59,6 +59,9 @@ exports.upstreamHandleFromProxyOf = upstreamHandleFromProxyOf;
 exports.upstreamHandleFromAutomatedActor = upstreamHandleFromAutomatedActor;
 exports.upstreamHandleFromPreferredUsername = upstreamHandleFromPreferredUsername;
 exports.blueskyUsernameFromHandle = blueskyUsernameFromHandle;
+exports.blueskyHandleFromUsername = blueskyHandleFromUsername;
+exports.isUnresolvedAtprotoHandle = isUnresolvedAtprotoHandle;
+exports.atprotoIdentityHandle = atprotoIdentityHandle;
 exports.createBridgeRelabeller = createBridgeRelabeller;
 exports.stripBridgeBoilerplate = stripBridgeBoilerplate;
 exports.federatedUsernameFromUpstreamUrl = federatedUsernameFromUpstreamUrl;
@@ -424,6 +427,44 @@ function blueskyUsernameFromHandle(handle) {
         ? handle.slice(0, -suffix.length)
         : handle;
 }
+/**
+ * The inverse of {@link blueskyUsernameFromHandle}: the atproto handle a stored
+ * Bluesky username names. A username without a dot was a default
+ * `.bsky.social` handle; one with a dot is a custom domain, kept whole.
+ */
+function blueskyHandleFromUsername(username) {
+    return username.includes('.') ? username : `${username}.${exports.FEDERATION_NETWORKS.bluesky.domain}`;
+}
+/**
+ * The literal handle a Bluesky AppView serves when a handle's bidirectional
+ * DNS/DID verification FAILS.
+ *
+ * It is an ERROR STRING, not an identity: every account whose handle cannot be
+ * verified gets the same one, so it is the single value in the atproto namespace
+ * guaranteed NOT to be unique. Keying an account on it collapses every such
+ * account onto one identity. Use {@link atprotoIdentityHandle}.
+ */
+exports.UNRESOLVED_ATPROTO_HANDLE = 'handle.invalid';
+/**
+ * True when a handle is the unresolved-handle sentinel rather than a real one.
+ * Compared case-insensitively on the trimmed value: a handle is a DNS name.
+ */
+function isUnresolvedAtprotoHandle(handle) {
+    return handle.trim().toLowerCase() === exports.UNRESOLVED_ATPROTO_HANDLE;
+}
+/**
+ * The handle an atproto account is IDENTIFIED by: its real handle, or its DID
+ * when the AppView could not verify one ({@link UNRESOLVED_ATPROTO_HANDLE}).
+ *
+ * The DID is the identifier atproto guarantees stable and unique. It contains a
+ * `:`, which no DNS handle may, so the substituted identity never collides with
+ * a real one, and `did:plc:…@bsky.social` splits on its `@` like any other
+ * acct. Nothing is stored under the sentinel, so the next refresh after the
+ * account fixes its DNS re-derives the real handle through the ordinary path.
+ */
+function atprotoIdentityHandle(handle, did) {
+    return isUnresolvedAtprotoHandle(handle) ? did : handle;
+}
 /**
  * Build the readers for a set of reviewed bridge entries.
  *

package/dist/cjs/node/actorResolver.js

@@ -344,6 +344,9 @@ class ActorResolver {
             const alsoKnownAs = Array.isArray(actor.alsoKnownAs)
                 ? actor.alsoKnownAs.filter((v) => typeof v === 'string')
                 : undefined;
+            // A move target is an actor URL; anything else is not one.
+            const movedToValue = asString(actor.movedTo);
+            const movedTo = movedToValue && /^https?:\/\//.test(movedToValue) ? movedToValue : undefined;
             // The IDENTITY the actor is stored under in Oxy, which is not necessarily the
             // host it was fetched from — see `DeriveNetworkIdentity`. Everything below
             // that addresses the actor over the PROTOCOL (`acct`, `uri`, `domain`) is
@@ -391,12 +394,14 @@ class ActorResolver {
                 type: asString(actor.type) || 'Person',
                 manuallyApprovesFollowers: actor.manuallyApprovesFollowers === true,
                 discoverable: actor.discoverable !== false,
+                ...(typeof actor.indexable === 'boolean' && { indexable: actor.indexable }),
                 memorial: actor.memorial === true,
                 suspended: actor.suspended === true,
                 fields,
                 featuredUrl: asString(actor.featured) || undefined,
                 featuredTagsUrl: asString(actor.featuredTags) || undefined,
                 alsoKnownAs,
+                ...(movedTo && { movedTo }),
                 networkAcct: networkIdentity?.federatedUsername,
                 remoteCreatedAt: typeof actor.published === 'string' ? new Date(actor.published) : undefined,
                 // Omitted, not written as `undefined`, when this refresh could not tell:

package/dist/esm/index.js

@@ -41,7 +41,7 @@ export { createUrlBuilders, normalizeActorUsername, INSTANCE_ACTOR_USERNAME, } f
  * app commits and answers for — `createBridgeRelabeller` takes them as a
  * parameter so no app inherits another's.
  */
-export { FEDERATION_NETWORKS, BSKY_NETWORK_DOMAIN, blueskyUsernameFromHandle, createBridgeRelabeller, stripBridgeBoilerplate, upstreamProfileUrl, parseUpstreamProfileUrl, federatedUsernameFromUpstreamUrl, upstreamHandleFromProfileField, upstreamHandleFromAlsoKnownAs, upstreamHandleFromAutomatedActor, upstreamHandleFromPreferredUsername, upstreamHandleFromProxyOf, readProxyDeclarations, } from './networkIdentity.js';
+export { FEDERATION_NETWORKS, BSKY_NETWORK_DOMAIN, blueskyUsernameFromHandle, blueskyHandleFromUsername, UNRESOLVED_ATPROTO_HANDLE, isUnresolvedAtprotoHandle, atprotoIdentityHandle, createBridgeRelabeller, stripBridgeBoilerplate, upstreamProfileUrl, parseUpstreamProfileUrl, federatedUsernameFromUpstreamUrl, upstreamHandleFromProfileField, upstreamHandleFromAlsoKnownAs, upstreamHandleFromAutomatedActor, upstreamHandleFromPreferredUsername, upstreamHandleFromProxyOf, readProxyDeclarations, } from './networkIdentity.js';
 /**
  * The shared JSON-LD `@context` (load-bearing term declarations) and the
  * ActivityPub URI helpers (actor-uri extraction + the per-instance domain policy:

package/dist/esm/networkIdentity.js

@@ -409,6 +409,44 @@ export function blueskyUsernameFromHandle(handle) {
         ? handle.slice(0, -suffix.length)
         : handle;
 }
+/**
+ * The inverse of {@link blueskyUsernameFromHandle}: the atproto handle a stored
+ * Bluesky username names. A username without a dot was a default
+ * `.bsky.social` handle; one with a dot is a custom domain, kept whole.
+ */
+export function blueskyHandleFromUsername(username) {
+    return username.includes('.') ? username : `${username}.${FEDERATION_NETWORKS.bluesky.domain}`;
+}
+/**
+ * The literal handle a Bluesky AppView serves when a handle's bidirectional
+ * DNS/DID verification FAILS.
+ *
+ * It is an ERROR STRING, not an identity: every account whose handle cannot be
+ * verified gets the same one, so it is the single value in the atproto namespace
+ * guaranteed NOT to be unique. Keying an account on it collapses every such
+ * account onto one identity. Use {@link atprotoIdentityHandle}.
+ */
+export const UNRESOLVED_ATPROTO_HANDLE = 'handle.invalid';
+/**
+ * True when a handle is the unresolved-handle sentinel rather than a real one.
+ * Compared case-insensitively on the trimmed value: a handle is a DNS name.
+ */
+export function isUnresolvedAtprotoHandle(handle) {
+    return handle.trim().toLowerCase() === UNRESOLVED_ATPROTO_HANDLE;
+}
+/**
+ * The handle an atproto account is IDENTIFIED by: its real handle, or its DID
+ * when the AppView could not verify one ({@link UNRESOLVED_ATPROTO_HANDLE}).
+ *
+ * The DID is the identifier atproto guarantees stable and unique. It contains a
+ * `:`, which no DNS handle may, so the substituted identity never collides with
+ * a real one, and `did:plc:…@bsky.social` splits on its `@` like any other
+ * acct. Nothing is stored under the sentinel, so the next refresh after the
+ * account fixes its DNS re-derives the real handle through the ordinary path.
+ */
+export function atprotoIdentityHandle(handle, did) {
+    return isUnresolvedAtprotoHandle(handle) ? did : handle;
+}
 /**
  * Build the readers for a set of reviewed bridge entries.
  *

package/dist/esm/node/actorResolver.js

@@ -340,6 +340,9 @@ export class ActorResolver {
             const alsoKnownAs = Array.isArray(actor.alsoKnownAs)
                 ? actor.alsoKnownAs.filter((v) => typeof v === 'string')
                 : undefined;
+            // A move target is an actor URL; anything else is not one.
+            const movedToValue = asString(actor.movedTo);
+            const movedTo = movedToValue && /^https?:\/\//.test(movedToValue) ? movedToValue : undefined;
             // The IDENTITY the actor is stored under in Oxy, which is not necessarily the
             // host it was fetched from — see `DeriveNetworkIdentity`. Everything below
             // that addresses the actor over the PROTOCOL (`acct`, `uri`, `domain`) is
@@ -387,12 +390,14 @@ export class ActorResolver {
                 type: asString(actor.type) || 'Person',
                 manuallyApprovesFollowers: actor.manuallyApprovesFollowers === true,
                 discoverable: actor.discoverable !== false,
+                ...(typeof actor.indexable === 'boolean' && { indexable: actor.indexable }),
                 memorial: actor.memorial === true,
                 suspended: actor.suspended === true,
                 fields,
                 featuredUrl: asString(actor.featured) || undefined,
                 featuredTagsUrl: asString(actor.featuredTags) || undefined,
                 alsoKnownAs,
+                ...(movedTo && { movedTo }),
                 networkAcct: networkIdentity?.federatedUsername,
                 remoteCreatedAt: typeof actor.published === 'string' ? new Date(actor.published) : undefined,
                 // Omitted, not written as `undefined`, when this refresh could not tell:

package/dist/types/index.d.ts

@@ -41,7 +41,7 @@ export { createUrlBuilders, normalizeActorUsername, INSTANCE_ACTOR_USERNAME, typ
  * app commits and answers for — `createBridgeRelabeller` takes them as a
  * parameter so no app inherits another's.
  */
-export { FEDERATION_NETWORKS, BSKY_NETWORK_DOMAIN, blueskyUsernameFromHandle, createBridgeRelabeller, stripBridgeBoilerplate, upstreamProfileUrl, parseUpstreamProfileUrl, federatedUsernameFromUpstreamUrl, upstreamHandleFromProfileField, upstreamHandleFromAlsoKnownAs, upstreamHandleFromAutomatedActor, upstreamHandleFromPreferredUsername, upstreamHandleFromProxyOf, readProxyDeclarations, type FederationNetwork, type FederationBridgeEntry, type BridgeRelabeller, type BridgeConsentModel, type BridgeDerivation, type BridgedActorField, type DeriveNetworkIdentity, type NetworkIdentity, type NetworkIdentityCandidate, type ProxyDeclaration, } from './networkIdentity';
+export { FEDERATION_NETWORKS, BSKY_NETWORK_DOMAIN, blueskyUsernameFromHandle, blueskyHandleFromUsername, UNRESOLVED_ATPROTO_HANDLE, isUnresolvedAtprotoHandle, atprotoIdentityHandle, createBridgeRelabeller, stripBridgeBoilerplate, upstreamProfileUrl, parseUpstreamProfileUrl, federatedUsernameFromUpstreamUrl, upstreamHandleFromProfileField, upstreamHandleFromAlsoKnownAs, upstreamHandleFromAutomatedActor, upstreamHandleFromPreferredUsername, upstreamHandleFromProxyOf, readProxyDeclarations, type FederationNetwork, type FederationBridgeEntry, type BridgeRelabeller, type BridgeConsentModel, type BridgeDerivation, type BridgedActorField, type DeriveNetworkIdentity, type NetworkIdentity, type NetworkIdentityCandidate, type ProxyDeclaration, } from './networkIdentity';
 /**
  * The shared JSON-LD `@context` (load-bearing term declarations) and the
  * ActivityPub URI helpers (actor-uri extraction + the per-instance domain policy:

package/dist/types/networkIdentity.d.ts

@@ -464,6 +464,38 @@ export declare function upstreamHandleFromPreferredUsername(markers: readonly Re
  * whole handle is kept.
  */
 export declare function blueskyUsernameFromHandle(handle: string): string;
+/**
+ * The inverse of {@link blueskyUsernameFromHandle}: the atproto handle a stored
+ * Bluesky username names. A username without a dot was a default
+ * `.bsky.social` handle; one with a dot is a custom domain, kept whole.
+ */
+export declare function blueskyHandleFromUsername(username: string): string;
+/**
+ * The literal handle a Bluesky AppView serves when a handle's bidirectional
+ * DNS/DID verification FAILS.
+ *
+ * It is an ERROR STRING, not an identity: every account whose handle cannot be
+ * verified gets the same one, so it is the single value in the atproto namespace
+ * guaranteed NOT to be unique. Keying an account on it collapses every such
+ * account onto one identity. Use {@link atprotoIdentityHandle}.
+ */
+export declare const UNRESOLVED_ATPROTO_HANDLE = "handle.invalid";
+/**
+ * True when a handle is the unresolved-handle sentinel rather than a real one.
+ * Compared case-insensitively on the trimmed value: a handle is a DNS name.
+ */
+export declare function isUnresolvedAtprotoHandle(handle: string): boolean;
+/**
+ * The handle an atproto account is IDENTIFIED by: its real handle, or its DID
+ * when the AppView could not verify one ({@link UNRESOLVED_ATPROTO_HANDLE}).
+ *
+ * The DID is the identifier atproto guarantees stable and unique. It contains a
+ * `:`, which no DNS handle may, so the substituted identity never collides with
+ * a real one, and `did:plc:…@bsky.social` splits on its `@` like any other
+ * acct. Nothing is stored under the sentinel, so the next refresh after the
+ * account fixes its DNS re-derives the real handle through the ordinary path.
+ */
+export declare function atprotoIdentityHandle(handle: string, did: string): string;
 /** A reviewed bridge registry, and the readers an app drives it with. */
 export interface BridgeRelabeller {
     /** The reviewed entry for a host, or `undefined` — most hosts are not bridges. */

package/dist/types/node/actorResolver.d.ts

@@ -60,12 +60,19 @@ export interface FederatedActorUpsert {
     type: string;
     manuallyApprovesFollowers: boolean;
     discoverable: boolean;
+    /**
+     * Mastodon's opt-in to search engines and full-text search (`indexable`).
+     * Absent when the actor does not say, which Mastodon reads as "no".
+     */
+    indexable?: boolean;
     memorial: boolean;
     suspended: boolean;
     fields: FederatedActorField[];
     featuredUrl?: string;
     featuredTagsUrl?: string;
     alsoKnownAs?: string[];
+    /** The account this actor moved to (`movedTo`), when it advertises one. */
+    movedTo?: string;
     /**
      * The `<handle>@<network-domain>` identity this actor was re-labelled onto, when
      * it came from a bridge; absent for the ordinary actor whose identity is simply

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/federation",
-  "version": "2.11.0",
+  "version": "2.13.0",
   "description": "Oxy Federation — the app-agnostic ActivityPub identity + follow engine substrate: the network-connector contract, normalized cross-network DTOs, HTTP signatures, actor resolution, the outbound delivery transport + follow lifecycle, the inbound dispatcher, and the webfinger/actor/inbox Express routers. Domain-parameterized so every Oxy app backend federates under its own domain.",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -75,12 +75,11 @@
     "clean": "rm -rf dist",
     "typescript": "tsc --noEmit",
     "test": "jest --passWithNoTests",
-    "lint": "biome lint --error-on-warnings ./src",
-    "prepublishOnly": "node ../../scripts/assert-bun-publish.mjs && bun run clean && bun run build"
+    "lint": "biome lint --error-on-warnings ./src"
   },
   "dependencies": {
-    "@oxy.so/contracts": "^1.0.0 || ^2.0.0 || ^3.0.0 || ^4.0.0 || ^5.0.0 || 4.11.0-oxy-one.0",
-    "@oxy.so/core": "^6.14.0"
+    "@oxy.so/contracts": "^1.0.0 || ^2.0.0 || ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || 4.11.0-oxy-one.0",
+    "@oxy.so/core": "^6.14.0 || ^7.0.0"
   },
   "peerDependencies": {
     "express": "^4.18.0 || ^5.0.0"
@@ -91,13 +90,13 @@
     }
   },
   "devDependencies": {
-    "@types/express": "^4.17.25",
+    "@types/express": "^5.0.6",
     "@types/jest": "^30.0.0",
-    "@types/node": "^22.20.1",
-    "express": "^4.22.2",
-    "jest": "^30.5.1",
-    "supertest": "^7.0.0",
-    "ts-jest": "^29.4.12",
-    "typescript": "^5.9.2"
+    "@types/node": "^26.6.6",
+    "express": "^5.3.0",
+    "jest": "^30.5.2",
+    "supertest": "^7.3.1",
+    "ts-jest": "^29.4.15",
+    "typescript": "~6.0.3"
   }
 }

package/src/__tests__/actorCollectionCounts.test.ts

@@ -102,6 +102,22 @@ async function resolveWith(replies: {
   return { upserts, bridged };
 }
 
+describe('fetchRemoteActor — search opt-in and moves', () => {
+  it('stores indexable and movedTo when the actor states them, and omits them when not', async () => {
+    const moved = await resolveWith({
+      actor: actorDocument({ indexable: true, movedTo: 'https://new.example/users/bob' }),
+    });
+    expect(moved.upserts[0]).toMatchObject({
+      indexable: true,
+      movedTo: 'https://new.example/users/bob',
+    });
+
+    const silent = await resolveWith({ actor: actorDocument({ movedTo: 'not a url' }) });
+    expect(silent.upserts[0]).not.toHaveProperty('indexable');
+    expect(silent.upserts[0]).not.toHaveProperty('movedTo');
+  });
+});
+
 describe('fetchRemoteActor — remote collection counts', () => {
   it('stores reported totals, and a real 0 stays 0', async () => {
     const { upserts } = await resolveWith({

package/src/__tests__/networkIdentity.test.ts

@@ -10,6 +10,8 @@
 
 import {
   FEDERATION_NETWORKS,
+  atprotoIdentityHandle,
+  blueskyHandleFromUsername,
   blueskyUsernameFromHandle,
   createBridgeRelabeller,
   parseUpstreamProfileUrl,
@@ -390,6 +392,16 @@ describe('bsky.social is one network, whichever protocol an account arrives by',
     expect(blueskyUsernameFromHandle('jay.bsky.team')).toBe('jay.bsky.team');
     expect(blueskyUsernameFromHandle('bsky.social')).toBe('bsky.social');
   });
+
+  it('maps a stored username back to its handle', () => {
+    for (const handle of ['skylee1.bsky.social', 'gothamist.com', 'bsky.social'])
+      expect(blueskyHandleFromUsername(blueskyUsernameFromHandle(handle))).toBe(handle);
+  });
+
+  it("identifies an account whose handle does not verify by its DID, never Bluesky's sentinel", () => {
+    expect(atprotoIdentityHandle('alice.example', 'did:plc:abc')).toBe('alice.example');
+    expect(atprotoIdentityHandle(' Handle.Invalid ', 'did:plc:abc')).toBe('did:plc:abc');
+  });
 });
 
 describe('federatedUsernameFromUpstreamUrl — the search direction', () => {

package/src/index.ts

@@ -65,6 +65,10 @@ export {
   FEDERATION_NETWORKS,
   BSKY_NETWORK_DOMAIN,
   blueskyUsernameFromHandle,
+  blueskyHandleFromUsername,
+  UNRESOLVED_ATPROTO_HANDLE,
+  isUnresolvedAtprotoHandle,
+  atprotoIdentityHandle,
   createBridgeRelabeller,
   stripBridgeBoilerplate,
   upstreamProfileUrl,

package/src/networkIdentity.ts

@@ -646,6 +646,48 @@ export function blueskyUsernameFromHandle(handle: string): string {
     : handle;
 }
 
+/**
+ * The inverse of {@link blueskyUsernameFromHandle}: the atproto handle a stored
+ * Bluesky username names. A username without a dot was a default
+ * `.bsky.social` handle; one with a dot is a custom domain, kept whole.
+ */
+export function blueskyHandleFromUsername(username: string): string {
+  return username.includes('.') ? username : `${username}.${FEDERATION_NETWORKS.bluesky.domain}`;
+}
+
+/**
+ * The literal handle a Bluesky AppView serves when a handle's bidirectional
+ * DNS/DID verification FAILS.
+ *
+ * It is an ERROR STRING, not an identity: every account whose handle cannot be
+ * verified gets the same one, so it is the single value in the atproto namespace
+ * guaranteed NOT to be unique. Keying an account on it collapses every such
+ * account onto one identity. Use {@link atprotoIdentityHandle}.
+ */
+export const UNRESOLVED_ATPROTO_HANDLE = 'handle.invalid';
+
+/**
+ * True when a handle is the unresolved-handle sentinel rather than a real one.
+ * Compared case-insensitively on the trimmed value: a handle is a DNS name.
+ */
+export function isUnresolvedAtprotoHandle(handle: string): boolean {
+  return handle.trim().toLowerCase() === UNRESOLVED_ATPROTO_HANDLE;
+}
+
+/**
+ * The handle an atproto account is IDENTIFIED by: its real handle, or its DID
+ * when the AppView could not verify one ({@link UNRESOLVED_ATPROTO_HANDLE}).
+ *
+ * The DID is the identifier atproto guarantees stable and unique. It contains a
+ * `:`, which no DNS handle may, so the substituted identity never collides with
+ * a real one, and `did:plc:…@bsky.social` splits on its `@` like any other
+ * acct. Nothing is stored under the sentinel, so the next refresh after the
+ * account fixes its DNS re-derives the real handle through the ordinary path.
+ */
+export function atprotoIdentityHandle(handle: string, did: string): string {
+  return isUnresolvedAtprotoHandle(handle) ? did : handle;
+}
+
 /** A reviewed bridge registry, and the readers an app drives it with. */
 export interface BridgeRelabeller {
   /** The reviewed entry for a host, or `undefined` — most hosts are not bridges. */

package/src/node/actorResolver.ts

@@ -148,12 +148,19 @@ export interface FederatedActorUpsert {
   type: string;
   manuallyApprovesFollowers: boolean;
   discoverable: boolean;
+  /**
+   * Mastodon's opt-in to search engines and full-text search (`indexable`).
+   * Absent when the actor does not say, which Mastodon reads as "no".
+   */
+  indexable?: boolean;
   memorial: boolean;
   suspended: boolean;
   fields: FederatedActorField[];
   featuredUrl?: string;
   featuredTagsUrl?: string;
   alsoKnownAs?: string[];
+  /** The account this actor moved to (`movedTo`), when it advertises one. */
+  movedTo?: string;
   /**
    * The `<handle>@<network-domain>` identity this actor was re-labelled onto, when
    * it came from a bridge; absent for the ordinary actor whose identity is simply
@@ -598,6 +605,9 @@ export class ActorResolver<TActor extends FederatedActorRecordBase> {
       const alsoKnownAs = Array.isArray(actor.alsoKnownAs)
         ? actor.alsoKnownAs.filter((v): v is string => typeof v === 'string')
         : undefined;
+      // A move target is an actor URL; anything else is not one.
+      const movedToValue = asString(actor.movedTo);
+      const movedTo = movedToValue && /^https?:\/\//.test(movedToValue) ? movedToValue : undefined;
 
       // The IDENTITY the actor is stored under in Oxy, which is not necessarily the
       // host it was fetched from — see `DeriveNetworkIdentity`. Everything below
@@ -647,12 +657,14 @@ export class ActorResolver<TActor extends FederatedActorRecordBase> {
         type: asString(actor.type) || 'Person',
         manuallyApprovesFollowers: actor.manuallyApprovesFollowers === true,
         discoverable: actor.discoverable !== false,
+        ...(typeof actor.indexable === 'boolean' && { indexable: actor.indexable }),
         memorial: actor.memorial === true,
         suspended: actor.suspended === true,
         fields,
         featuredUrl: asString(actor.featured) || undefined,
         featuredTagsUrl: asString(actor.featuredTags) || undefined,
         alsoKnownAs,
+        ...(movedTo && { movedTo }),
         networkAcct: networkIdentity?.federatedUsername,
         remoteCreatedAt:
           typeof actor.published === 'string' ? new Date(actor.published) : undefined,