@oxy.so/federation 2.12.0 → 2.14.0

package/dist/cjs/index.js

@@ -22,7 +22,7 @@
  * knowledge of any app's post shape.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.groupFollowersCollection = exports.groupOutboxCollection = exports.isGroupActorKind = exports.GROUP_OUTBOX_SIZE = exports.LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND = exports.AP_ACTOR_TYPES = exports.isApActorType = exports.accountKindForActor = exports.localActorTypeForAccountKind = exports.normalizeAlsoKnownAs = exports.createLocalActorBuilder = exports.createDomainPolicy = exports.extractActorUriFromActivityId = exports.isSameFederationHost = exports.canonicalFederationHost = exports.AP_CONTEXT = exports.readProxyDeclarations = exports.upstreamHandleFromProxyOf = exports.upstreamHandleFromPreferredUsername = exports.upstreamHandleFromAutomatedActor = exports.upstreamHandleFromAlsoKnownAs = exports.upstreamHandleFromProfileField = exports.federatedUsernameFromUpstreamUrl = exports.parseUpstreamProfileUrl = exports.upstreamProfileUrl = exports.stripBridgeBoilerplate = exports.createBridgeRelabeller = exports.blueskyUsernameFromHandle = exports.BSKY_NETWORK_DOMAIN = exports.FEDERATION_NETWORKS = exports.INSTANCE_ACTOR_USERNAME = exports.normalizeActorUsername = exports.createUrlBuilders = exports.DEFAULT_SIGNED_CONTENT_TYPE = exports.HTTP_SIGNATURE_ALGORITHM = exports.verifyHttpSignature = exports.signRequest = void 0;
+exports.groupFollowersCollection = exports.groupOutboxCollection = exports.isGroupActorKind = exports.GROUP_OUTBOX_SIZE = exports.LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND = exports.AP_ACTOR_TYPES = exports.isApActorType = exports.accountKindForActor = exports.localActorTypeForAccountKind = exports.normalizeAlsoKnownAs = exports.createLocalActorBuilder = exports.createDomainPolicy = exports.extractActorUriFromActivityId = exports.isSameFederationHost = exports.canonicalFederationHost = exports.AP_CONTEXT = exports.readProxyDeclarations = exports.upstreamHandleFromProxyOf = exports.upstreamHandleFromPreferredUsername = exports.upstreamHandleFromAutomatedActor = exports.upstreamHandleFromAlsoKnownAs = exports.upstreamHandleFromProfileField = exports.federatedUsernameFromUpstreamUrl = exports.parseUpstreamProfileUrl = exports.upstreamProfileUrl = exports.stripBridgeBoilerplate = exports.createBridgeRelabeller = exports.atprotoIdentityHandle = exports.isUnresolvedAtprotoHandle = exports.UNRESOLVED_ATPROTO_HANDLE = exports.blueskyHandleFromUsername = exports.blueskyUsernameFromHandle = exports.BSKY_NETWORK_DOMAIN = exports.FEDERATION_NETWORKS = exports.INSTANCE_ACTOR_USERNAME = exports.normalizeActorUsername = exports.createUrlBuilders = exports.DEFAULT_SIGNED_CONTENT_TYPE = exports.HTTP_SIGNATURE_ALGORITHM = exports.verifyHttpSignature = exports.signRequest = void 0;
 /**
  * HTTP Signatures (draft-cavage) — the pure sign/verify crypto every Oxy app's
  * ActivityPub federation shares. Private-key custody is injected; the key never
@@ -55,6 +55,10 @@ var networkIdentity_1 = require("./networkIdentity");
 Object.defineProperty(exports, "FEDERATION_NETWORKS", { enumerable: true, get: function () { return networkIdentity_1.FEDERATION_NETWORKS; } });
 Object.defineProperty(exports, "BSKY_NETWORK_DOMAIN", { enumerable: true, get: function () { return networkIdentity_1.BSKY_NETWORK_DOMAIN; } });
 Object.defineProperty(exports, "blueskyUsernameFromHandle", { enumerable: true, get: function () { return networkIdentity_1.blueskyUsernameFromHandle; } });
+Object.defineProperty(exports, "blueskyHandleFromUsername", { enumerable: true, get: function () { return networkIdentity_1.blueskyHandleFromUsername; } });
+Object.defineProperty(exports, "UNRESOLVED_ATPROTO_HANDLE", { enumerable: true, get: function () { return networkIdentity_1.UNRESOLVED_ATPROTO_HANDLE; } });
+Object.defineProperty(exports, "isUnresolvedAtprotoHandle", { enumerable: true, get: function () { return networkIdentity_1.isUnresolvedAtprotoHandle; } });
+Object.defineProperty(exports, "atprotoIdentityHandle", { enumerable: true, get: function () { return networkIdentity_1.atprotoIdentityHandle; } });
 Object.defineProperty(exports, "createBridgeRelabeller", { enumerable: true, get: function () { return networkIdentity_1.createBridgeRelabeller; } });
 Object.defineProperty(exports, "stripBridgeBoilerplate", { enumerable: true, get: function () { return networkIdentity_1.stripBridgeBoilerplate; } });
 Object.defineProperty(exports, "upstreamProfileUrl", { enumerable: true, get: function () { return networkIdentity_1.upstreamProfileUrl; } });

package/dist/cjs/networkIdentity.js

@@ -49,7 +49,7 @@
  *   means neither can be edited into the other by accident.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BSKY_NETWORK_DOMAIN = exports.FEDERATION_NETWORKS = void 0;
+exports.UNRESOLVED_ATPROTO_HANDLE = exports.BSKY_NETWORK_DOMAIN = exports.FEDERATION_NETWORKS = void 0;
 exports.upstreamProfileUrl = upstreamProfileUrl;
 exports.parseUpstreamProfileUrl = parseUpstreamProfileUrl;
 exports.readProxyDeclarations = readProxyDeclarations;
@@ -59,6 +59,9 @@ exports.upstreamHandleFromProxyOf = upstreamHandleFromProxyOf;
 exports.upstreamHandleFromAutomatedActor = upstreamHandleFromAutomatedActor;
 exports.upstreamHandleFromPreferredUsername = upstreamHandleFromPreferredUsername;
 exports.blueskyUsernameFromHandle = blueskyUsernameFromHandle;
+exports.blueskyHandleFromUsername = blueskyHandleFromUsername;
+exports.isUnresolvedAtprotoHandle = isUnresolvedAtprotoHandle;
+exports.atprotoIdentityHandle = atprotoIdentityHandle;
 exports.createBridgeRelabeller = createBridgeRelabeller;
 exports.stripBridgeBoilerplate = stripBridgeBoilerplate;
 exports.federatedUsernameFromUpstreamUrl = federatedUsernameFromUpstreamUrl;
@@ -424,6 +427,44 @@ function blueskyUsernameFromHandle(handle) {
         ? handle.slice(0, -suffix.length)
         : handle;
 }
+/**
+ * The inverse of {@link blueskyUsernameFromHandle}: the atproto handle a stored
+ * Bluesky username names. A username without a dot was a default
+ * `.bsky.social` handle; one with a dot is a custom domain, kept whole.
+ */
+function blueskyHandleFromUsername(username) {
+    return username.includes('.') ? username : `${username}.${exports.FEDERATION_NETWORKS.bluesky.domain}`;
+}
+/**
+ * The literal handle a Bluesky AppView serves when a handle's bidirectional
+ * DNS/DID verification FAILS.
+ *
+ * It is an ERROR STRING, not an identity: every account whose handle cannot be
+ * verified gets the same one, so it is the single value in the atproto namespace
+ * guaranteed NOT to be unique. Keying an account on it collapses every such
+ * account onto one identity. Use {@link atprotoIdentityHandle}.
+ */
+exports.UNRESOLVED_ATPROTO_HANDLE = 'handle.invalid';
+/**
+ * True when a handle is the unresolved-handle sentinel rather than a real one.
+ * Compared case-insensitively on the trimmed value: a handle is a DNS name.
+ */
+function isUnresolvedAtprotoHandle(handle) {
+    return handle.trim().toLowerCase() === exports.UNRESOLVED_ATPROTO_HANDLE;
+}
+/**
+ * The handle an atproto account is IDENTIFIED by: its real handle, or its DID
+ * when the AppView could not verify one ({@link UNRESOLVED_ATPROTO_HANDLE}).
+ *
+ * The DID is the identifier atproto guarantees stable and unique. It contains a
+ * `:`, which no DNS handle may, so the substituted identity never collides with
+ * a real one, and `did:plc:…@bsky.social` splits on its `@` like any other
+ * acct. Nothing is stored under the sentinel, so the next refresh after the
+ * account fixes its DNS re-derives the real handle through the ordinary path.
+ */
+function atprotoIdentityHandle(handle, did) {
+    return isUnresolvedAtprotoHandle(handle) ? did : handle;
+}
 /**
  * Build the readers for a set of reviewed bridge entries.
  *

package/dist/cjs/node/actorResolver.js

@@ -344,6 +344,9 @@ class ActorResolver {
             const alsoKnownAs = Array.isArray(actor.alsoKnownAs)
                 ? actor.alsoKnownAs.filter((v) => typeof v === 'string')
                 : undefined;
+            // A move target is an actor URL; anything else is not one.
+            const movedToValue = asString(actor.movedTo);
+            const movedTo = movedToValue && /^https?:\/\//.test(movedToValue) ? movedToValue : undefined;
             // The IDENTITY the actor is stored under in Oxy, which is not necessarily the
             // host it was fetched from — see `DeriveNetworkIdentity`. Everything below
             // that addresses the actor over the PROTOCOL (`acct`, `uri`, `domain`) is
@@ -391,12 +394,14 @@ class ActorResolver {
                 type: asString(actor.type) || 'Person',
                 manuallyApprovesFollowers: actor.manuallyApprovesFollowers === true,
                 discoverable: actor.discoverable !== false,
+                ...(typeof actor.indexable === 'boolean' && { indexable: actor.indexable }),
                 memorial: actor.memorial === true,
                 suspended: actor.suspended === true,
                 fields,
                 featuredUrl: asString(actor.featured) || undefined,
                 featuredTagsUrl: asString(actor.featuredTags) || undefined,
                 alsoKnownAs,
+                ...(movedTo && { movedTo }),
                 networkAcct: networkIdentity?.federatedUsername,
                 remoteCreatedAt: typeof actor.published === 'string' ? new Date(actor.published) : undefined,
                 // Omitted, not written as `undefined`, when this refresh could not tell:

package/dist/cjs/node/inboundDispatch.js

@@ -7,8 +7,8 @@
  * because those are identical across every Oxy app: they bridge a federated follow
  * edge into the Oxy graph (via the identity adapter), record the AP-side follow
  * row (via the store adapter), and send the Accept back (via the delivery
- * service). Every CONTENT verb (Create / Announce / Like / Delete / Update, and a
- * non-follow Undo) is handed to the app-registered
+ * service). Every CONTENT verb (Create / Announce / Like / Delete / Update /
+ * Add / Remove, and a non-follow Undo) is handed to the app-registered
  * {@link InboundDispatcherConfig.onContentActivity} callback, where the app's own
  * post/engagement handlers live. The consent gate + notification side effects are
  * injected so the engine holds no app knowledge.
@@ -299,12 +299,15 @@ function createInboundDispatcher(config) {
             case 'Reject':
                 await handleReject(activity, verifiedActorUri);
                 break;
-            // Content verbs — the app owns these (posts, engagement, actor profile edits).
+            // Content verbs — the app owns these (posts, engagement, actor profile
+            // edits, and collection changes such as pinned posts).
             case 'Create':
             case 'Delete':
             case 'Like':
             case 'Announce':
             case 'Update':
+            case 'Add':
+            case 'Remove':
                 await config.onContentActivity(activity, verifiedActorUri);
                 break;
             case 'Move': {

package/dist/cjs/node/index.js

@@ -54,7 +54,7 @@ Object.defineProperty(exports, "DeliveryAuthorizationDeniedError", { enumerable:
  * Inbound ActivityPub dispatch — the untrusted-activity validator + switch, the
  * follow-protocol handlers (Follow / Accept / Undo(Follow) / Reject) over the
  * identity + store adapters, and the `onContentActivity` seam every content verb
- * (Create / Announce / Like / Delete / Update, non-follow Undo) is handed to.
+ * (Create / Announce / Like / Delete / Update / Add / Remove, non-follow Undo) is handed to.
  */
 var inboundDispatch_1 = require("./inboundDispatch");
 Object.defineProperty(exports, "createInboundDispatcher", { enumerable: true, get: function () { return inboundDispatch_1.createInboundDispatcher; } });

package/dist/esm/index.js

@@ -41,7 +41,7 @@ export { createUrlBuilders, normalizeActorUsername, INSTANCE_ACTOR_USERNAME, } f
  * app commits and answers for — `createBridgeRelabeller` takes them as a
  * parameter so no app inherits another's.
  */
-export { FEDERATION_NETWORKS, BSKY_NETWORK_DOMAIN, blueskyUsernameFromHandle, createBridgeRelabeller, stripBridgeBoilerplate, upstreamProfileUrl, parseUpstreamProfileUrl, federatedUsernameFromUpstreamUrl, upstreamHandleFromProfileField, upstreamHandleFromAlsoKnownAs, upstreamHandleFromAutomatedActor, upstreamHandleFromPreferredUsername, upstreamHandleFromProxyOf, readProxyDeclarations, } from './networkIdentity.js';
+export { FEDERATION_NETWORKS, BSKY_NETWORK_DOMAIN, blueskyUsernameFromHandle, blueskyHandleFromUsername, UNRESOLVED_ATPROTO_HANDLE, isUnresolvedAtprotoHandle, atprotoIdentityHandle, createBridgeRelabeller, stripBridgeBoilerplate, upstreamProfileUrl, parseUpstreamProfileUrl, federatedUsernameFromUpstreamUrl, upstreamHandleFromProfileField, upstreamHandleFromAlsoKnownAs, upstreamHandleFromAutomatedActor, upstreamHandleFromPreferredUsername, upstreamHandleFromProxyOf, readProxyDeclarations, } from './networkIdentity.js';
 /**
  * The shared JSON-LD `@context` (load-bearing term declarations) and the
  * ActivityPub URI helpers (actor-uri extraction + the per-instance domain policy:

package/dist/esm/networkIdentity.js

@@ -409,6 +409,44 @@ export function blueskyUsernameFromHandle(handle) {
         ? handle.slice(0, -suffix.length)
         : handle;
 }
+/**
+ * The inverse of {@link blueskyUsernameFromHandle}: the atproto handle a stored
+ * Bluesky username names. A username without a dot was a default
+ * `.bsky.social` handle; one with a dot is a custom domain, kept whole.
+ */
+export function blueskyHandleFromUsername(username) {
+    return username.includes('.') ? username : `${username}.${FEDERATION_NETWORKS.bluesky.domain}`;
+}
+/**
+ * The literal handle a Bluesky AppView serves when a handle's bidirectional
+ * DNS/DID verification FAILS.
+ *
+ * It is an ERROR STRING, not an identity: every account whose handle cannot be
+ * verified gets the same one, so it is the single value in the atproto namespace
+ * guaranteed NOT to be unique. Keying an account on it collapses every such
+ * account onto one identity. Use {@link atprotoIdentityHandle}.
+ */
+export const UNRESOLVED_ATPROTO_HANDLE = 'handle.invalid';
+/**
+ * True when a handle is the unresolved-handle sentinel rather than a real one.
+ * Compared case-insensitively on the trimmed value: a handle is a DNS name.
+ */
+export function isUnresolvedAtprotoHandle(handle) {
+    return handle.trim().toLowerCase() === UNRESOLVED_ATPROTO_HANDLE;
+}
+/**
+ * The handle an atproto account is IDENTIFIED by: its real handle, or its DID
+ * when the AppView could not verify one ({@link UNRESOLVED_ATPROTO_HANDLE}).
+ *
+ * The DID is the identifier atproto guarantees stable and unique. It contains a
+ * `:`, which no DNS handle may, so the substituted identity never collides with
+ * a real one, and `did:plc:…@bsky.social` splits on its `@` like any other
+ * acct. Nothing is stored under the sentinel, so the next refresh after the
+ * account fixes its DNS re-derives the real handle through the ordinary path.
+ */
+export function atprotoIdentityHandle(handle, did) {
+    return isUnresolvedAtprotoHandle(handle) ? did : handle;
+}
 /**
  * Build the readers for a set of reviewed bridge entries.
  *

package/dist/esm/node/actorResolver.js

@@ -340,6 +340,9 @@ export class ActorResolver {
             const alsoKnownAs = Array.isArray(actor.alsoKnownAs)
                 ? actor.alsoKnownAs.filter((v) => typeof v === 'string')
                 : undefined;
+            // A move target is an actor URL; anything else is not one.
+            const movedToValue = asString(actor.movedTo);
+            const movedTo = movedToValue && /^https?:\/\//.test(movedToValue) ? movedToValue : undefined;
             // The IDENTITY the actor is stored under in Oxy, which is not necessarily the
             // host it was fetched from — see `DeriveNetworkIdentity`. Everything below
             // that addresses the actor over the PROTOCOL (`acct`, `uri`, `domain`) is
@@ -387,12 +390,14 @@ export class ActorResolver {
                 type: asString(actor.type) || 'Person',
                 manuallyApprovesFollowers: actor.manuallyApprovesFollowers === true,
                 discoverable: actor.discoverable !== false,
+                ...(typeof actor.indexable === 'boolean' && { indexable: actor.indexable }),
                 memorial: actor.memorial === true,
                 suspended: actor.suspended === true,
                 fields,
                 featuredUrl: asString(actor.featured) || undefined,
                 featuredTagsUrl: asString(actor.featuredTags) || undefined,
                 alsoKnownAs,
+                ...(movedTo && { movedTo }),
                 networkAcct: networkIdentity?.federatedUsername,
                 remoteCreatedAt: typeof actor.published === 'string' ? new Date(actor.published) : undefined,
                 // Omitted, not written as `undefined`, when this refresh could not tell:

package/dist/esm/node/inboundDispatch.js

@@ -6,8 +6,8 @@
  * because those are identical across every Oxy app: they bridge a federated follow
  * edge into the Oxy graph (via the identity adapter), record the AP-side follow
  * row (via the store adapter), and send the Accept back (via the delivery
- * service). Every CONTENT verb (Create / Announce / Like / Delete / Update, and a
- * non-follow Undo) is handed to the app-registered
+ * service). Every CONTENT verb (Create / Announce / Like / Delete / Update /
+ * Add / Remove, and a non-follow Undo) is handed to the app-registered
  * {@link InboundDispatcherConfig.onContentActivity} callback, where the app's own
  * post/engagement handlers live. The consent gate + notification side effects are
  * injected so the engine holds no app knowledge.
@@ -294,12 +294,15 @@ export function createInboundDispatcher(config) {
             case 'Reject':
                 await handleReject(activity, verifiedActorUri);
                 break;
-            // Content verbs — the app owns these (posts, engagement, actor profile edits).
+            // Content verbs — the app owns these (posts, engagement, actor profile
+            // edits, and collection changes such as pinned posts).
             case 'Create':
             case 'Delete':
             case 'Like':
             case 'Announce':
             case 'Update':
+            case 'Add':
+            case 'Remove':
                 await config.onContentActivity(activity, verifiedActorUri);
                 break;
             case 'Move': {

package/dist/esm/node/index.js

@@ -44,7 +44,7 @@ export { createDeliveryService, DeliveryAuthorizationDeniedError, } from './deli
  * Inbound ActivityPub dispatch — the untrusted-activity validator + switch, the
  * follow-protocol handlers (Follow / Accept / Undo(Follow) / Reject) over the
  * identity + store adapters, and the `onContentActivity` seam every content verb
- * (Create / Announce / Like / Delete / Update, non-follow Undo) is handed to.
+ * (Create / Announce / Like / Delete / Update / Add / Remove, non-follow Undo) is handed to.
  */
 export { createInboundDispatcher, ActorResolutionPendingError, } from './inboundDispatch.js';
 /** The WebFinger + host-meta discovery router (domain-parameterized, consent-gated). */

package/dist/types/index.d.ts

@@ -41,7 +41,7 @@ export { createUrlBuilders, normalizeActorUsername, INSTANCE_ACTOR_USERNAME, typ
  * app commits and answers for — `createBridgeRelabeller` takes them as a
  * parameter so no app inherits another's.
  */
-export { FEDERATION_NETWORKS, BSKY_NETWORK_DOMAIN, blueskyUsernameFromHandle, createBridgeRelabeller, stripBridgeBoilerplate, upstreamProfileUrl, parseUpstreamProfileUrl, federatedUsernameFromUpstreamUrl, upstreamHandleFromProfileField, upstreamHandleFromAlsoKnownAs, upstreamHandleFromAutomatedActor, upstreamHandleFromPreferredUsername, upstreamHandleFromProxyOf, readProxyDeclarations, type FederationNetwork, type FederationBridgeEntry, type BridgeRelabeller, type BridgeConsentModel, type BridgeDerivation, type BridgedActorField, type DeriveNetworkIdentity, type NetworkIdentity, type NetworkIdentityCandidate, type ProxyDeclaration, } from './networkIdentity';
+export { FEDERATION_NETWORKS, BSKY_NETWORK_DOMAIN, blueskyUsernameFromHandle, blueskyHandleFromUsername, UNRESOLVED_ATPROTO_HANDLE, isUnresolvedAtprotoHandle, atprotoIdentityHandle, createBridgeRelabeller, stripBridgeBoilerplate, upstreamProfileUrl, parseUpstreamProfileUrl, federatedUsernameFromUpstreamUrl, upstreamHandleFromProfileField, upstreamHandleFromAlsoKnownAs, upstreamHandleFromAutomatedActor, upstreamHandleFromPreferredUsername, upstreamHandleFromProxyOf, readProxyDeclarations, type FederationNetwork, type FederationBridgeEntry, type BridgeRelabeller, type BridgeConsentModel, type BridgeDerivation, type BridgedActorField, type DeriveNetworkIdentity, type NetworkIdentity, type NetworkIdentityCandidate, type ProxyDeclaration, } from './networkIdentity';
 /**
  * The shared JSON-LD `@context` (load-bearing term declarations) and the
  * ActivityPub URI helpers (actor-uri extraction + the per-instance domain policy:

package/dist/types/networkIdentity.d.ts

@@ -464,6 +464,38 @@ export declare function upstreamHandleFromPreferredUsername(markers: readonly Re
  * whole handle is kept.
  */
 export declare function blueskyUsernameFromHandle(handle: string): string;
+/**
+ * The inverse of {@link blueskyUsernameFromHandle}: the atproto handle a stored
+ * Bluesky username names. A username without a dot was a default
+ * `.bsky.social` handle; one with a dot is a custom domain, kept whole.
+ */
+export declare function blueskyHandleFromUsername(username: string): string;
+/**
+ * The literal handle a Bluesky AppView serves when a handle's bidirectional
+ * DNS/DID verification FAILS.
+ *
+ * It is an ERROR STRING, not an identity: every account whose handle cannot be
+ * verified gets the same one, so it is the single value in the atproto namespace
+ * guaranteed NOT to be unique. Keying an account on it collapses every such
+ * account onto one identity. Use {@link atprotoIdentityHandle}.
+ */
+export declare const UNRESOLVED_ATPROTO_HANDLE = "handle.invalid";
+/**
+ * True when a handle is the unresolved-handle sentinel rather than a real one.
+ * Compared case-insensitively on the trimmed value: a handle is a DNS name.
+ */
+export declare function isUnresolvedAtprotoHandle(handle: string): boolean;
+/**
+ * The handle an atproto account is IDENTIFIED by: its real handle, or its DID
+ * when the AppView could not verify one ({@link UNRESOLVED_ATPROTO_HANDLE}).
+ *
+ * The DID is the identifier atproto guarantees stable and unique. It contains a
+ * `:`, which no DNS handle may, so the substituted identity never collides with
+ * a real one, and `did:plc:…@bsky.social` splits on its `@` like any other
+ * acct. Nothing is stored under the sentinel, so the next refresh after the
+ * account fixes its DNS re-derives the real handle through the ordinary path.
+ */
+export declare function atprotoIdentityHandle(handle: string, did: string): string;
 /** A reviewed bridge registry, and the readers an app drives it with. */
 export interface BridgeRelabeller {
     /** The reviewed entry for a host, or `undefined` — most hosts are not bridges. */

package/dist/types/node/actorResolver.d.ts

@@ -60,12 +60,19 @@ export interface FederatedActorUpsert {
     type: string;
     manuallyApprovesFollowers: boolean;
     discoverable: boolean;
+    /**
+     * Mastodon's opt-in to search engines and full-text search (`indexable`).
+     * Absent when the actor does not say, which Mastodon reads as "no".
+     */
+    indexable?: boolean;
     memorial: boolean;
     suspended: boolean;
     fields: FederatedActorField[];
     featuredUrl?: string;
     featuredTagsUrl?: string;
     alsoKnownAs?: string[];
+    /** The account this actor moved to (`movedTo`), when it advertises one. */
+    movedTo?: string;
     /**
      * The `<handle>@<network-domain>` identity this actor was re-labelled onto, when
      * it came from a bridge; absent for the ordinary actor whose identity is simply

package/dist/types/node/inboundDispatch.d.ts

@@ -6,8 +6,8 @@
  * because those are identical across every Oxy app: they bridge a federated follow
  * edge into the Oxy graph (via the identity adapter), record the AP-side follow
  * row (via the store adapter), and send the Accept back (via the delivery
- * service). Every CONTENT verb (Create / Announce / Like / Delete / Update, and a
- * non-follow Undo) is handed to the app-registered
+ * service). Every CONTENT verb (Create / Announce / Like / Delete / Update /
+ * Add / Remove, and a non-follow Undo) is handed to the app-registered
  * {@link InboundDispatcherConfig.onContentActivity} callback, where the app's own
  * post/engagement handlers live. The consent gate + notification side effects are
  * injected so the engine holds no app knowledge.
@@ -157,7 +157,9 @@ export interface InboundDispatcherConfig {
     onOutboundFollowAccepted?(actorUri: string): Promise<void>;
     /**
      * Handle a CONTENT activity the engine does not own — Create / Announce / Like /
-     * Delete / Update, and a non-follow Undo. The app's post/engagement handlers.
+     * Delete / Update / Add / Remove, and a non-follow Undo. The app's
+     * post/engagement handlers; `Add`/`Remove` carry collection changes such as a
+     * Mastodon pin (the status added to or removed from the actor's `featured`).
      */
     onContentActivity(activity: Record<string, unknown>, verifiedActorUri: string): Promise<void>;
     /**

package/dist/types/node/index.d.ts

@@ -44,7 +44,7 @@ export { createDeliveryService, DeliveryAuthorizationDeniedError, type DeliveryA
  * Inbound ActivityPub dispatch — the untrusted-activity validator + switch, the
  * follow-protocol handlers (Follow / Accept / Undo(Follow) / Reject) over the
  * identity + store adapters, and the `onContentActivity` seam every content verb
- * (Create / Announce / Like / Delete / Update, non-follow Undo) is handed to.
+ * (Create / Announce / Like / Delete / Update / Add / Remove, non-follow Undo) is handed to.
  */
 export { createInboundDispatcher, ActorResolutionPendingError, type InboundMove, type InboundDispatcher, type InboundDispatcherConfig, type InboundDispatcherLogger, type InboundActivityValidation, type InboundLocalUser, type InboundIdentity, type InboundConsent, type InboundActorResolver, type InboundFollowStore, type InboundDelivery, } from './inboundDispatch';
 /** The WebFinger + host-meta discovery router (domain-parameterized, consent-gated). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/federation",
-  "version": "2.12.0",
+  "version": "2.14.0",
   "description": "Oxy Federation — the app-agnostic ActivityPub identity + follow engine substrate: the network-connector contract, normalized cross-network DTOs, HTTP signatures, actor resolution, the outbound delivery transport + follow lifecycle, the inbound dispatcher, and the webfinger/actor/inbox Express routers. Domain-parameterized so every Oxy app backend federates under its own domain.",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -90,13 +90,13 @@
     }
   },
   "devDependencies": {
-    "@types/express": "^4.17.25",
+    "@types/express": "^5.0.6",
     "@types/jest": "^30.0.0",
-    "@types/node": "^22.20.1",
-    "express": "^4.22.2",
-    "jest": "^30.5.1",
-    "supertest": "^7.0.0",
-    "ts-jest": "^29.4.12",
-    "typescript": "^5.9.2"
+    "@types/node": "^26.6.6",
+    "express": "^5.3.0",
+    "jest": "^30.5.2",
+    "supertest": "^7.3.1",
+    "ts-jest": "^29.4.15",
+    "typescript": "~6.0.3"
   }
 }

package/src/__tests__/actorCollectionCounts.test.ts

@@ -102,6 +102,22 @@ async function resolveWith(replies: {
   return { upserts, bridged };
 }
 
+describe('fetchRemoteActor — search opt-in and moves', () => {
+  it('stores indexable and movedTo when the actor states them, and omits them when not', async () => {
+    const moved = await resolveWith({
+      actor: actorDocument({ indexable: true, movedTo: 'https://new.example/users/bob' }),
+    });
+    expect(moved.upserts[0]).toMatchObject({
+      indexable: true,
+      movedTo: 'https://new.example/users/bob',
+    });
+
+    const silent = await resolveWith({ actor: actorDocument({ movedTo: 'not a url' }) });
+    expect(silent.upserts[0]).not.toHaveProperty('indexable');
+    expect(silent.upserts[0]).not.toHaveProperty('movedTo');
+  });
+});
+
 describe('fetchRemoteActor — remote collection counts', () => {
   it('stores reported totals, and a real 0 stays 0', async () => {
     const { upserts } = await resolveWith({

package/src/__tests__/inboundDispatch.test.ts

@@ -375,7 +375,7 @@ describe('Move → onMove', () => {
 });
 
 describe('content verbs → onContentActivity', () => {
-  it.each(['Create', 'Announce', 'Like', 'Delete', 'Update'])(
+  it.each(['Create', 'Announce', 'Like', 'Delete', 'Update', 'Add', 'Remove'])(
     'routes %s to the app',
     async (type) => {
       const rig = makeRig();
@@ -404,7 +404,7 @@ describe('content verbs → onContentActivity', () => {
 describe('blocked-origin domain policy', () => {
   const BLOCKED_ACTOR = 'https://spam.example/users/mallory';
 
-  it.each(['Create', 'Announce', 'Like', 'Delete', 'Update'])(
+  it.each(['Create', 'Announce', 'Like', 'Delete', 'Update', 'Add', 'Remove'])(
     'drops %s from a blocked origin without reaching the app',
     async (type) => {
       const rig = makeRig({ blockedHosts: ['spam.example'] });

package/src/__tests__/networkIdentity.test.ts

@@ -10,6 +10,8 @@
 
 import {
   FEDERATION_NETWORKS,
+  atprotoIdentityHandle,
+  blueskyHandleFromUsername,
   blueskyUsernameFromHandle,
   createBridgeRelabeller,
   parseUpstreamProfileUrl,
@@ -390,6 +392,16 @@ describe('bsky.social is one network, whichever protocol an account arrives by',
     expect(blueskyUsernameFromHandle('jay.bsky.team')).toBe('jay.bsky.team');
     expect(blueskyUsernameFromHandle('bsky.social')).toBe('bsky.social');
   });
+
+  it('maps a stored username back to its handle', () => {
+    for (const handle of ['skylee1.bsky.social', 'gothamist.com', 'bsky.social'])
+      expect(blueskyHandleFromUsername(blueskyUsernameFromHandle(handle))).toBe(handle);
+  });
+
+  it("identifies an account whose handle does not verify by its DID, never Bluesky's sentinel", () => {
+    expect(atprotoIdentityHandle('alice.example', 'did:plc:abc')).toBe('alice.example');
+    expect(atprotoIdentityHandle(' Handle.Invalid ', 'did:plc:abc')).toBe('did:plc:abc');
+  });
 });
 
 describe('federatedUsernameFromUpstreamUrl — the search direction', () => {

package/src/index.ts

@@ -65,6 +65,10 @@ export {
   FEDERATION_NETWORKS,
   BSKY_NETWORK_DOMAIN,
   blueskyUsernameFromHandle,
+  blueskyHandleFromUsername,
+  UNRESOLVED_ATPROTO_HANDLE,
+  isUnresolvedAtprotoHandle,
+  atprotoIdentityHandle,
   createBridgeRelabeller,
   stripBridgeBoilerplate,
   upstreamProfileUrl,

package/src/networkIdentity.ts

@@ -646,6 +646,48 @@ export function blueskyUsernameFromHandle(handle: string): string {
     : handle;
 }
 
+/**
+ * The inverse of {@link blueskyUsernameFromHandle}: the atproto handle a stored
+ * Bluesky username names. A username without a dot was a default
+ * `.bsky.social` handle; one with a dot is a custom domain, kept whole.
+ */
+export function blueskyHandleFromUsername(username: string): string {
+  return username.includes('.') ? username : `${username}.${FEDERATION_NETWORKS.bluesky.domain}`;
+}
+
+/**
+ * The literal handle a Bluesky AppView serves when a handle's bidirectional
+ * DNS/DID verification FAILS.
+ *
+ * It is an ERROR STRING, not an identity: every account whose handle cannot be
+ * verified gets the same one, so it is the single value in the atproto namespace
+ * guaranteed NOT to be unique. Keying an account on it collapses every such
+ * account onto one identity. Use {@link atprotoIdentityHandle}.
+ */
+export const UNRESOLVED_ATPROTO_HANDLE = 'handle.invalid';
+
+/**
+ * True when a handle is the unresolved-handle sentinel rather than a real one.
+ * Compared case-insensitively on the trimmed value: a handle is a DNS name.
+ */
+export function isUnresolvedAtprotoHandle(handle: string): boolean {
+  return handle.trim().toLowerCase() === UNRESOLVED_ATPROTO_HANDLE;
+}
+
+/**
+ * The handle an atproto account is IDENTIFIED by: its real handle, or its DID
+ * when the AppView could not verify one ({@link UNRESOLVED_ATPROTO_HANDLE}).
+ *
+ * The DID is the identifier atproto guarantees stable and unique. It contains a
+ * `:`, which no DNS handle may, so the substituted identity never collides with
+ * a real one, and `did:plc:…@bsky.social` splits on its `@` like any other
+ * acct. Nothing is stored under the sentinel, so the next refresh after the
+ * account fixes its DNS re-derives the real handle through the ordinary path.
+ */
+export function atprotoIdentityHandle(handle: string, did: string): string {
+  return isUnresolvedAtprotoHandle(handle) ? did : handle;
+}
+
 /** A reviewed bridge registry, and the readers an app drives it with. */
 export interface BridgeRelabeller {
   /** The reviewed entry for a host, or `undefined` — most hosts are not bridges. */

package/src/node/actorResolver.ts

@@ -148,12 +148,19 @@ export interface FederatedActorUpsert {
   type: string;
   manuallyApprovesFollowers: boolean;
   discoverable: boolean;
+  /**
+   * Mastodon's opt-in to search engines and full-text search (`indexable`).
+   * Absent when the actor does not say, which Mastodon reads as "no".
+   */
+  indexable?: boolean;
   memorial: boolean;
   suspended: boolean;
   fields: FederatedActorField[];
   featuredUrl?: string;
   featuredTagsUrl?: string;
   alsoKnownAs?: string[];
+  /** The account this actor moved to (`movedTo`), when it advertises one. */
+  movedTo?: string;
   /**
    * The `<handle>@<network-domain>` identity this actor was re-labelled onto, when
    * it came from a bridge; absent for the ordinary actor whose identity is simply
@@ -598,6 +605,9 @@ export class ActorResolver<TActor extends FederatedActorRecordBase> {
       const alsoKnownAs = Array.isArray(actor.alsoKnownAs)
         ? actor.alsoKnownAs.filter((v): v is string => typeof v === 'string')
         : undefined;
+      // A move target is an actor URL; anything else is not one.
+      const movedToValue = asString(actor.movedTo);
+      const movedTo = movedToValue && /^https?:\/\//.test(movedToValue) ? movedToValue : undefined;
 
       // The IDENTITY the actor is stored under in Oxy, which is not necessarily the
       // host it was fetched from — see `DeriveNetworkIdentity`. Everything below
@@ -647,12 +657,14 @@ export class ActorResolver<TActor extends FederatedActorRecordBase> {
         type: asString(actor.type) || 'Person',
         manuallyApprovesFollowers: actor.manuallyApprovesFollowers === true,
         discoverable: actor.discoverable !== false,
+        ...(typeof actor.indexable === 'boolean' && { indexable: actor.indexable }),
         memorial: actor.memorial === true,
         suspended: actor.suspended === true,
         fields,
         featuredUrl: asString(actor.featured) || undefined,
         featuredTagsUrl: asString(actor.featuredTags) || undefined,
         alsoKnownAs,
+        ...(movedTo && { movedTo }),
         networkAcct: networkIdentity?.federatedUsername,
         remoteCreatedAt:
           typeof actor.published === 'string' ? new Date(actor.published) : undefined,

package/src/node/inboundDispatch.ts

@@ -6,8 +6,8 @@
  * because those are identical across every Oxy app: they bridge a federated follow
  * edge into the Oxy graph (via the identity adapter), record the AP-side follow
  * row (via the store adapter), and send the Accept back (via the delivery
- * service). Every CONTENT verb (Create / Announce / Like / Delete / Update, and a
- * non-follow Undo) is handed to the app-registered
+ * service). Every CONTENT verb (Create / Announce / Like / Delete / Update /
+ * Add / Remove, and a non-follow Undo) is handed to the app-registered
  * {@link InboundDispatcherConfig.onContentActivity} callback, where the app's own
  * post/engagement handlers live. The consent gate + notification side effects are
  * injected so the engine holds no app knowledge.
@@ -186,7 +186,9 @@ export interface InboundDispatcherConfig {
   onOutboundFollowAccepted?(actorUri: string): Promise<void>;
   /**
    * Handle a CONTENT activity the engine does not own — Create / Announce / Like /
-   * Delete / Update, and a non-follow Undo. The app's post/engagement handlers.
+   * Delete / Update / Add / Remove, and a non-follow Undo. The app's
+   * post/engagement handlers; `Add`/`Remove` carry collection changes such as a
+   * Mastodon pin (the status added to or removed from the actor's `featured`).
    */
   onContentActivity(activity: Record<string, unknown>, verifiedActorUri: string): Promise<void>;
   /**
@@ -499,12 +501,15 @@ export function createInboundDispatcher(config: InboundDispatcherConfig): Inboun
       case 'Reject':
         await handleReject(activity, verifiedActorUri);
         break;
-      // Content verbs — the app owns these (posts, engagement, actor profile edits).
+      // Content verbs — the app owns these (posts, engagement, actor profile
+      // edits, and collection changes such as pinned posts).
       case 'Create':
       case 'Delete':
       case 'Like':
       case 'Announce':
       case 'Update':
+      case 'Add':
+      case 'Remove':
         await config.onContentActivity(activity, verifiedActorUri);
         break;
       case 'Move': {

package/src/node/index.ts

@@ -109,7 +109,7 @@ export {
  * Inbound ActivityPub dispatch — the untrusted-activity validator + switch, the
  * follow-protocol handlers (Follow / Accept / Undo(Follow) / Reject) over the
  * identity + store adapters, and the `onContentActivity` seam every content verb
- * (Create / Announce / Like / Delete / Update, non-follow Undo) is handed to.
+ * (Create / Announce / Like / Delete / Update / Add / Remove, non-follow Undo) is handed to.
  */
 export {
   createInboundDispatcher,