@oxy.so/federation 2.13.0 → 2.14.0

package/dist/cjs/node/inboundDispatch.js

@@ -7,8 +7,8 @@
  * because those are identical across every Oxy app: they bridge a federated follow
  * edge into the Oxy graph (via the identity adapter), record the AP-side follow
  * row (via the store adapter), and send the Accept back (via the delivery
- * service). Every CONTENT verb (Create / Announce / Like / Delete / Update, and a
- * non-follow Undo) is handed to the app-registered
+ * service). Every CONTENT verb (Create / Announce / Like / Delete / Update /
+ * Add / Remove, and a non-follow Undo) is handed to the app-registered
  * {@link InboundDispatcherConfig.onContentActivity} callback, where the app's own
  * post/engagement handlers live. The consent gate + notification side effects are
  * injected so the engine holds no app knowledge.
@@ -299,12 +299,15 @@ function createInboundDispatcher(config) {
             case 'Reject':
                 await handleReject(activity, verifiedActorUri);
                 break;
-            // Content verbs — the app owns these (posts, engagement, actor profile edits).
+            // Content verbs — the app owns these (posts, engagement, actor profile
+            // edits, and collection changes such as pinned posts).
             case 'Create':
             case 'Delete':
             case 'Like':
             case 'Announce':
             case 'Update':
+            case 'Add':
+            case 'Remove':
                 await config.onContentActivity(activity, verifiedActorUri);
                 break;
             case 'Move': {

package/dist/cjs/node/index.js

@@ -54,7 +54,7 @@ Object.defineProperty(exports, "DeliveryAuthorizationDeniedError", { enumerable:
  * Inbound ActivityPub dispatch — the untrusted-activity validator + switch, the
  * follow-protocol handlers (Follow / Accept / Undo(Follow) / Reject) over the
  * identity + store adapters, and the `onContentActivity` seam every content verb
- * (Create / Announce / Like / Delete / Update, non-follow Undo) is handed to.
+ * (Create / Announce / Like / Delete / Update / Add / Remove, non-follow Undo) is handed to.
  */
 var inboundDispatch_1 = require("./inboundDispatch");
 Object.defineProperty(exports, "createInboundDispatcher", { enumerable: true, get: function () { return inboundDispatch_1.createInboundDispatcher; } });

package/dist/esm/node/inboundDispatch.js

@@ -6,8 +6,8 @@
  * because those are identical across every Oxy app: they bridge a federated follow
  * edge into the Oxy graph (via the identity adapter), record the AP-side follow
  * row (via the store adapter), and send the Accept back (via the delivery
- * service). Every CONTENT verb (Create / Announce / Like / Delete / Update, and a
- * non-follow Undo) is handed to the app-registered
+ * service). Every CONTENT verb (Create / Announce / Like / Delete / Update /
+ * Add / Remove, and a non-follow Undo) is handed to the app-registered
  * {@link InboundDispatcherConfig.onContentActivity} callback, where the app's own
  * post/engagement handlers live. The consent gate + notification side effects are
  * injected so the engine holds no app knowledge.
@@ -294,12 +294,15 @@ export function createInboundDispatcher(config) {
             case 'Reject':
                 await handleReject(activity, verifiedActorUri);
                 break;
-            // Content verbs — the app owns these (posts, engagement, actor profile edits).
+            // Content verbs — the app owns these (posts, engagement, actor profile
+            // edits, and collection changes such as pinned posts).
             case 'Create':
             case 'Delete':
             case 'Like':
             case 'Announce':
             case 'Update':
+            case 'Add':
+            case 'Remove':
                 await config.onContentActivity(activity, verifiedActorUri);
                 break;
             case 'Move': {

package/dist/esm/node/index.js

@@ -44,7 +44,7 @@ export { createDeliveryService, DeliveryAuthorizationDeniedError, } from './deli
  * Inbound ActivityPub dispatch — the untrusted-activity validator + switch, the
  * follow-protocol handlers (Follow / Accept / Undo(Follow) / Reject) over the
  * identity + store adapters, and the `onContentActivity` seam every content verb
- * (Create / Announce / Like / Delete / Update, non-follow Undo) is handed to.
+ * (Create / Announce / Like / Delete / Update / Add / Remove, non-follow Undo) is handed to.
  */
 export { createInboundDispatcher, ActorResolutionPendingError, } from './inboundDispatch.js';
 /** The WebFinger + host-meta discovery router (domain-parameterized, consent-gated). */

package/dist/types/node/inboundDispatch.d.ts

@@ -6,8 +6,8 @@
  * because those are identical across every Oxy app: they bridge a federated follow
  * edge into the Oxy graph (via the identity adapter), record the AP-side follow
  * row (via the store adapter), and send the Accept back (via the delivery
- * service). Every CONTENT verb (Create / Announce / Like / Delete / Update, and a
- * non-follow Undo) is handed to the app-registered
+ * service). Every CONTENT verb (Create / Announce / Like / Delete / Update /
+ * Add / Remove, and a non-follow Undo) is handed to the app-registered
  * {@link InboundDispatcherConfig.onContentActivity} callback, where the app's own
  * post/engagement handlers live. The consent gate + notification side effects are
  * injected so the engine holds no app knowledge.
@@ -157,7 +157,9 @@ export interface InboundDispatcherConfig {
     onOutboundFollowAccepted?(actorUri: string): Promise<void>;
     /**
      * Handle a CONTENT activity the engine does not own — Create / Announce / Like /
-     * Delete / Update, and a non-follow Undo. The app's post/engagement handlers.
+     * Delete / Update / Add / Remove, and a non-follow Undo. The app's
+     * post/engagement handlers; `Add`/`Remove` carry collection changes such as a
+     * Mastodon pin (the status added to or removed from the actor's `featured`).
      */
     onContentActivity(activity: Record<string, unknown>, verifiedActorUri: string): Promise<void>;
     /**

package/dist/types/node/index.d.ts

@@ -44,7 +44,7 @@ export { createDeliveryService, DeliveryAuthorizationDeniedError, type DeliveryA
  * Inbound ActivityPub dispatch — the untrusted-activity validator + switch, the
  * follow-protocol handlers (Follow / Accept / Undo(Follow) / Reject) over the
  * identity + store adapters, and the `onContentActivity` seam every content verb
- * (Create / Announce / Like / Delete / Update, non-follow Undo) is handed to.
+ * (Create / Announce / Like / Delete / Update / Add / Remove, non-follow Undo) is handed to.
  */
 export { createInboundDispatcher, ActorResolutionPendingError, type InboundMove, type InboundDispatcher, type InboundDispatcherConfig, type InboundDispatcherLogger, type InboundActivityValidation, type InboundLocalUser, type InboundIdentity, type InboundConsent, type InboundActorResolver, type InboundFollowStore, type InboundDelivery, } from './inboundDispatch';
 /** The WebFinger + host-meta discovery router (domain-parameterized, consent-gated). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/federation",
-  "version": "2.13.0",
+  "version": "2.14.0",
   "description": "Oxy Federation — the app-agnostic ActivityPub identity + follow engine substrate: the network-connector contract, normalized cross-network DTOs, HTTP signatures, actor resolution, the outbound delivery transport + follow lifecycle, the inbound dispatcher, and the webfinger/actor/inbox Express routers. Domain-parameterized so every Oxy app backend federates under its own domain.",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/__tests__/inboundDispatch.test.ts

@@ -375,7 +375,7 @@ describe('Move → onMove', () => {
 });
 
 describe('content verbs → onContentActivity', () => {
-  it.each(['Create', 'Announce', 'Like', 'Delete', 'Update'])(
+  it.each(['Create', 'Announce', 'Like', 'Delete', 'Update', 'Add', 'Remove'])(
     'routes %s to the app',
     async (type) => {
       const rig = makeRig();
@@ -404,7 +404,7 @@ describe('content verbs → onContentActivity', () => {
 describe('blocked-origin domain policy', () => {
   const BLOCKED_ACTOR = 'https://spam.example/users/mallory';
 
-  it.each(['Create', 'Announce', 'Like', 'Delete', 'Update'])(
+  it.each(['Create', 'Announce', 'Like', 'Delete', 'Update', 'Add', 'Remove'])(
     'drops %s from a blocked origin without reaching the app',
     async (type) => {
       const rig = makeRig({ blockedHosts: ['spam.example'] });

package/src/node/inboundDispatch.ts

@@ -6,8 +6,8 @@
  * because those are identical across every Oxy app: they bridge a federated follow
  * edge into the Oxy graph (via the identity adapter), record the AP-side follow
  * row (via the store adapter), and send the Accept back (via the delivery
- * service). Every CONTENT verb (Create / Announce / Like / Delete / Update, and a
- * non-follow Undo) is handed to the app-registered
+ * service). Every CONTENT verb (Create / Announce / Like / Delete / Update /
+ * Add / Remove, and a non-follow Undo) is handed to the app-registered
  * {@link InboundDispatcherConfig.onContentActivity} callback, where the app's own
  * post/engagement handlers live. The consent gate + notification side effects are
  * injected so the engine holds no app knowledge.
@@ -186,7 +186,9 @@ export interface InboundDispatcherConfig {
   onOutboundFollowAccepted?(actorUri: string): Promise<void>;
   /**
    * Handle a CONTENT activity the engine does not own — Create / Announce / Like /
-   * Delete / Update, and a non-follow Undo. The app's post/engagement handlers.
+   * Delete / Update / Add / Remove, and a non-follow Undo. The app's
+   * post/engagement handlers; `Add`/`Remove` carry collection changes such as a
+   * Mastodon pin (the status added to or removed from the actor's `featured`).
    */
   onContentActivity(activity: Record<string, unknown>, verifiedActorUri: string): Promise<void>;
   /**
@@ -499,12 +501,15 @@ export function createInboundDispatcher(config: InboundDispatcherConfig): Inboun
       case 'Reject':
         await handleReject(activity, verifiedActorUri);
         break;
-      // Content verbs — the app owns these (posts, engagement, actor profile edits).
+      // Content verbs — the app owns these (posts, engagement, actor profile
+      // edits, and collection changes such as pinned posts).
       case 'Create':
       case 'Delete':
       case 'Like':
       case 'Announce':
       case 'Update':
+      case 'Add':
+      case 'Remove':
         await config.onContentActivity(activity, verifiedActorUri);
         break;
       case 'Move': {

package/src/node/index.ts

@@ -109,7 +109,7 @@ export {
  * Inbound ActivityPub dispatch — the untrusted-activity validator + switch, the
  * follow-protocol handlers (Follow / Accept / Undo(Follow) / Reject) over the
  * identity + store adapters, and the `onContentActivity` seam every content verb
- * (Create / Announce / Like / Delete / Update, non-follow Undo) is handed to.
+ * (Create / Announce / Like / Delete / Update / Add / Remove, non-follow Undo) is handed to.
  */
 export {
   createInboundDispatcher,