@oxy.so/federation 2.5.0 → 2.6.0

package/dist/cjs/actorObject.js

@@ -283,6 +283,16 @@ function createLocalActorBuilder(config) {
                 publicKeyPem: publicKey.publicKeyPem,
             },
         };
+        // A community is a FEP-1b12 `Group`: it names its moderators collection in
+        // `attributedTo` (Lemmy, PieFed; Mbin reads `moderators`) and says anybody
+        // may post into it. PeerTube refuses a `Group` without `attributedTo`, and a
+        // `Group` claiming `postingRestrictedToMods` is read as a channel by every
+        // implementation, ours included ({@link accountKindForActor}).
+        if (actorObject.type === exports.LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND.community) {
+            actorObject.attributedTo = config.urls.moderators(username);
+            actorObject.moderators = config.urls.moderators(username);
+            actorObject.postingRestrictedToMods = false;
+        }
         const aliases = normalizeAlsoKnownAs(params.alsoKnownAs);
         if (aliases.length > 0) {
             actorObject.alsoKnownAs = aliases;

package/dist/cjs/node/actorResolver.js

@@ -24,6 +24,7 @@ exports.ActorResolver = void 0;
 exports.createActorResolver = createActorResolver;
 const apUri_1 = require("../apUri");
 const networkIdentity_1 = require("../networkIdentity");
+const boundedBody_1 = require("./boundedBody");
 /**
  * Minimum interval between background actor refreshes for the same actor.
  * Prevents refresh storms when a profile is viewed repeatedly in a short window.
@@ -43,38 +44,26 @@ const COLLECTION_BODY_MAX_BYTES = 64 * 1024;
  */
 const COLLECTION_WITHHELD_STATUSES = new Set([401, 403, 404, 410]);
 const ERROR_BODY_MAX_BYTES = 4 * 1024;
+/**
+ * Deadline for reading a whole actor/collection/error body once its headers
+ * arrived. `signedFetch`'s timeout ends at the headers, so without this a remote
+ * that stalls mid-body would hold the resolver open.
+ */
+const BODY_TIMEOUT_MS = 10000;
 async function readBoundedResponseBody(res, maxBytes) {
     const contentLength = res.headers.get('content-length');
     if (contentLength) {
         const declaredBytes = Number(contentLength);
         if (Number.isFinite(declaredBytes) && declaredBytes > maxBytes) {
             await res.body?.cancel().catch(() => { });
-            throw new Error(`Remote response exceeds ${maxBytes} byte limit`);
+            throw new boundedBody_1.ResponseBodyTooLargeError(maxBytes);
         }
     }
     if (!res.body)
         return '';
     const reader = res.body.getReader();
-    const decoder = new TextDecoder('utf-8', { fatal: true });
-    let bytesRead = 0;
-    let text = '';
-    try {
-        while (true) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            bytesRead += value.byteLength;
-            if (bytesRead > maxBytes) {
-                await reader.cancel().catch(() => { });
-                throw new Error(`Remote response exceeds ${maxBytes} byte limit`);
-            }
-            text += decoder.decode(value, { stream: true });
-        }
-        return text + decoder.decode();
-    }
-    finally {
-        reader.releaseLock();
-    }
+    const body = await (0, boundedBody_1.readBodyChunks)({ read: () => reader.read(), cancel: () => void reader.cancel().catch(() => { }) }, { maxBytes, timeoutMs: BODY_TIMEOUT_MS });
+    return new TextDecoder('utf-8', { fatal: true }).decode(body);
 }
 async function readBoundedJson(res, maxBytes) {
     const body = await readBoundedResponseBody(res, maxBytes);

package/dist/cjs/node/actorRouter.js

@@ -9,7 +9,8 @@
  *    signature verification (Phase 2, `trustForwardedHost`) and actor-match, then
  *    202 + async dispatch to the injected inbound dispatcher,
  *  - `GET /users/:username/followers` + `/following` — the OXY follow graph
- *    (local + bridged federated edges) as paginated `OrderedCollection`s.
+ *    (local + bridged federated edges) as paginated `OrderedCollection`s,
+ *  - `GET /users/:username/moderators` — a community `Group`'s moderators.
  *
  * The CONTENT routes (`outbox`, `featured`, per-post dereference) stay in the app,
  * mounted on the SAME `/ap/users/:username/*` prefix the actor advertises.
@@ -26,6 +27,7 @@ const apContext_1 = require("../apContext");
 const httpCacheControl_1 = require("./httpCacheControl");
 const httpSignature_1 = require("../httpSignature");
 const urls_1 = require("../urls");
+const actorObject_1 = require("../actorObject");
 /** Page size for the paginated followers/following collections (mirrors the outbox). */
 const FOLLOW_PAGE_SIZE = 20;
 /** Extract the `:username` param safely as a string. */
@@ -314,5 +316,41 @@ function createActorRouter(config) {
     router.get('/users/:username/followers', (req, res) => serveFollowCollection(req, res, 'followers', urls.followers));
     // GET /ap/users/:username/following — Following collection (Oxy graph: local + federated).
     router.get('/users/:username/following', (req, res) => serveFollowCollection(req, res, 'following', urls.following));
+    // GET /ap/users/:username/moderators — a community `Group`'s moderators, the
+    // collection its `attributedTo` names. One unpaged `OrderedCollection`, the
+    // shape Lemmy and PieFed serve and read back.
+    const { fetchModerators } = config;
+    if (fetchModerators) {
+        router.get('/users/:username/moderators', async (req, res) => {
+            if (!config.federationEnabled)
+                return res.status(404).json({ error: 'Federation disabled' });
+            const username = getUsername(req);
+            try {
+                const user = await config.resolveUser(username);
+                if (!user ||
+                    !config.consent.isSharingEnabledFromUser(user) ||
+                    (0, actorObject_1.localActorTypeForAccountKind)(user.kind) !== actorObject_1.LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND.community) {
+                    return res.status(404).json({ error: 'User not found' });
+                }
+                const moderators = await fetchModerators(String(user._id || user.id));
+                const orderedItems = moderators
+                    .map((member) => memberActorUri(member, urls))
+                    .filter((uri) => uri !== null);
+                res.set('Content-Type', apContentType);
+                res.set('Cache-Control', httpCacheControl);
+                return res.json({
+                    '@context': apContext_1.AP_CONTEXT,
+                    id: urls.moderators(username),
+                    type: 'OrderedCollection',
+                    totalItems: orderedItems.length,
+                    orderedItems,
+                });
+            }
+            catch (err) {
+                logger.error('Moderators collection endpoint error:', err);
+                return res.status(500).json({ error: 'Internal server error' });
+            }
+        });
+    }
     return router;
 }

package/dist/cjs/node/boundedBody.js

@@ -0,0 +1,77 @@
+"use strict";
+/**
+ * The one bounded, deadlined body read behind every federation response body
+ * (an actor or collection `Response`, a failed delivery's preview).
+ *
+ * The transports bound a request up to its response headers; from there the
+ * reader owns the stream, and a remote that sends headers and then stalls (or
+ * trickles) the body would hold a plain read loop forever. This caps the bytes
+ * AND gives the whole body one deadline, cancelling the source on every early
+ * exit. It reads through a {@link BodyChunkSource} so a WHATWG reader and a
+ * Node async iterator share it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResponseBodyTimeoutError = exports.ResponseBodyTooLargeError = void 0;
+exports.readBodyChunks = readBodyChunks;
+/** Thrown when a body exceeds its byte cap under `overflow: 'reject'`. */
+class ResponseBodyTooLargeError extends Error {
+    constructor(maxBytes) {
+        super(`Remote response exceeds ${maxBytes} byte limit`);
+        this.maxBytes = maxBytes;
+        this.name = 'ResponseBodyTooLargeError';
+    }
+}
+exports.ResponseBodyTooLargeError = ResponseBodyTooLargeError;
+/** Thrown when a body does not end within its deadline; this attempt failed, a retry may not. */
+class ResponseBodyTimeoutError extends Error {
+    constructor(timeoutMs) {
+        super(`Remote response body did not end within ${timeoutMs} ms`);
+        this.timeoutMs = timeoutMs;
+        this.name = 'ResponseBodyTimeoutError';
+    }
+}
+exports.ResponseBodyTimeoutError = ResponseBodyTimeoutError;
+/**
+ * Read `source` into one Buffer, at most `maxBytes` and within `timeoutMs`.
+ * The deadline timer is cleared on every path; the source is cancelled on a
+ * cap, a deadline, a read error, or a truncated preview.
+ */
+async function readBodyChunks(source, limits) {
+    const { maxBytes, timeoutMs, overflow = 'reject' } = limits;
+    const chunks = [];
+    let total = 0;
+    let timer;
+    const deadline = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new ResponseBodyTimeoutError(timeoutMs)), timeoutMs);
+    });
+    try {
+        for (;;) {
+            // `Promise.race` subscribes to both, so neither the deadline nor a read
+            // that rejects once the source is cancelled goes unhandled.
+            const { done, value } = await Promise.race([source.read(), deadline]);
+            if (done || !value)
+                break;
+            const buffer = Buffer.isBuffer(value)
+                ? value
+                : Buffer.from(value.buffer, value.byteOffset, value.byteLength);
+            if (total + buffer.length > maxBytes) {
+                if (overflow === 'reject')
+                    throw new ResponseBodyTooLargeError(maxBytes);
+                chunks.push(buffer.subarray(0, maxBytes - total));
+                total = maxBytes;
+                source.cancel();
+                break;
+            }
+            total += buffer.length;
+            chunks.push(buffer);
+        }
+    }
+    catch (err) {
+        source.cancel();
+        throw err;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    return Buffer.concat(chunks, total);
+}

package/dist/cjs/node/delivery.js

@@ -28,11 +28,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DeliveryAuthorizationDeniedError = void 0;
 exports.createDeliveryService = createDeliveryService;
 const apContext_1 = require("../apContext");
+const boundedBody_1 = require("./boundedBody");
 const httpSignature_1 = require("../httpSignature");
 /** Total time budget for a single delivery POST (connect + response headers). */
 const DELIVER_ACTIVITY_TIMEOUT_MS = 15000;
 /** How many bytes of a failed-delivery response body are read for the debug log. */
 const DELIVERY_RESPONSE_PREVIEW_MAX_BYTES = 1024;
+/** Deadline for reading that preview once the response headers arrived. */
+const DELIVERY_RESPONSE_PREVIEW_TIMEOUT_MS = 5000;
 /** The ActivityStreams public collection — the `to` addressee of a public activity. */
 const AP_PUBLIC = 'https://www.w3.org/ns/activitystreams#Public';
 /** A definitive refusal: workers must discard, not retry or count a delivery. */
@@ -44,18 +47,20 @@ class DeliveryAuthorizationDeniedError extends Error {
     }
 }
 exports.DeliveryAuthorizationDeniedError = DeliveryAuthorizationDeniedError;
-/** Read a bounded prefix of a failed-delivery response body for the debug log. */
+/**
+ * Read a bounded prefix of a failed-delivery response body for the debug log,
+ * within {@link DELIVERY_RESPONSE_PREVIEW_TIMEOUT_MS}: an inbox that stalls its
+ * body after the headers costs the worker that long, not forever.
+ */
 async function readResponsePreview(response) {
-    const chunks = [];
-    let totalBytes = 0;
+    const iterator = response[Symbol.asyncIterator]();
     try {
-        for await (const chunk of response) {
-            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-            totalBytes += buffer.byteLength;
-            chunks.push(buffer);
-            if (totalBytes >= DELIVERY_RESPONSE_PREVIEW_MAX_BYTES)
-                break;
-        }
+        const preview = await (0, boundedBody_1.readBodyChunks)({ read: () => iterator.next(), cancel: () => response.destroy() }, {
+            maxBytes: DELIVERY_RESPONSE_PREVIEW_MAX_BYTES,
+            timeoutMs: DELIVERY_RESPONSE_PREVIEW_TIMEOUT_MS,
+            overflow: 'truncate',
+        });
+        return preview.toString('utf8');
     }
     catch {
         return '';
@@ -63,7 +68,6 @@ async function readResponsePreview(response) {
     finally {
         response.destroy();
     }
-    return Buffer.concat(chunks).toString('utf8', 0, DELIVERY_RESPONSE_PREVIEW_MAX_BYTES);
 }
 /** Build the outbound delivery + follow-lifecycle service from an app's adapters. */
 function createDeliveryService(config) {

package/dist/cjs/urls.js

@@ -35,6 +35,7 @@ function createUrlBuilders(domain, actorDomain = domain) {
         featured: (username) => `https://${domain}/ap/users/${username}/collections/featured`,
         followers: (username) => `https://${domain}/ap/users/${username}/followers`,
         following: (username) => `https://${domain}/ap/users/${username}/following`,
+        moderators: (username) => `https://${domain}/ap/users/${username}/moderators`,
         sharedInbox: () => `https://${domain}/ap/inbox`,
     };
 }

package/dist/esm/actorObject.js

@@ -275,6 +275,16 @@ export function createLocalActorBuilder(config) {
                 publicKeyPem: publicKey.publicKeyPem,
             },
         };
+        // A community is a FEP-1b12 `Group`: it names its moderators collection in
+        // `attributedTo` (Lemmy, PieFed; Mbin reads `moderators`) and says anybody
+        // may post into it. PeerTube refuses a `Group` without `attributedTo`, and a
+        // `Group` claiming `postingRestrictedToMods` is read as a channel by every
+        // implementation, ours included ({@link accountKindForActor}).
+        if (actorObject.type === LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND.community) {
+            actorObject.attributedTo = config.urls.moderators(username);
+            actorObject.moderators = config.urls.moderators(username);
+            actorObject.postingRestrictedToMods = false;
+        }
         const aliases = normalizeAlsoKnownAs(params.alsoKnownAs);
         if (aliases.length > 0) {
             actorObject.alsoKnownAs = aliases;

package/dist/esm/node/actorResolver.js

@@ -20,6 +20,7 @@
  */
 import { isSameFederationHost } from '../apUri.js';
 import { readProxyDeclarations, } from '../networkIdentity.js';
+import { readBodyChunks, ResponseBodyTooLargeError } from './boundedBody.js';
 /**
  * Minimum interval between background actor refreshes for the same actor.
  * Prevents refresh storms when a profile is viewed repeatedly in a short window.
@@ -39,38 +40,26 @@ const COLLECTION_BODY_MAX_BYTES = 64 * 1024;
  */
 const COLLECTION_WITHHELD_STATUSES = new Set([401, 403, 404, 410]);
 const ERROR_BODY_MAX_BYTES = 4 * 1024;
+/**
+ * Deadline for reading a whole actor/collection/error body once its headers
+ * arrived. `signedFetch`'s timeout ends at the headers, so without this a remote
+ * that stalls mid-body would hold the resolver open.
+ */
+const BODY_TIMEOUT_MS = 10000;
 async function readBoundedResponseBody(res, maxBytes) {
     const contentLength = res.headers.get('content-length');
     if (contentLength) {
         const declaredBytes = Number(contentLength);
         if (Number.isFinite(declaredBytes) && declaredBytes > maxBytes) {
             await res.body?.cancel().catch(() => { });
-            throw new Error(`Remote response exceeds ${maxBytes} byte limit`);
+            throw new ResponseBodyTooLargeError(maxBytes);
         }
     }
     if (!res.body)
         return '';
     const reader = res.body.getReader();
-    const decoder = new TextDecoder('utf-8', { fatal: true });
-    let bytesRead = 0;
-    let text = '';
-    try {
-        while (true) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            bytesRead += value.byteLength;
-            if (bytesRead > maxBytes) {
-                await reader.cancel().catch(() => { });
-                throw new Error(`Remote response exceeds ${maxBytes} byte limit`);
-            }
-            text += decoder.decode(value, { stream: true });
-        }
-        return text + decoder.decode();
-    }
-    finally {
-        reader.releaseLock();
-    }
+    const body = await readBodyChunks({ read: () => reader.read(), cancel: () => void reader.cancel().catch(() => { }) }, { maxBytes, timeoutMs: BODY_TIMEOUT_MS });
+    return new TextDecoder('utf-8', { fatal: true }).decode(body);
 }
 async function readBoundedJson(res, maxBytes) {
     const body = await readBoundedResponseBody(res, maxBytes);

package/dist/esm/node/actorRouter.js

@@ -8,7 +8,8 @@
  *    signature verification (Phase 2, `trustForwardedHost`) and actor-match, then
  *    202 + async dispatch to the injected inbound dispatcher,
  *  - `GET /users/:username/followers` + `/following` — the OXY follow graph
- *    (local + bridged federated edges) as paginated `OrderedCollection`s.
+ *    (local + bridged federated edges) as paginated `OrderedCollection`s,
+ *  - `GET /users/:username/moderators` — a community `Group`'s moderators.
  *
  * The CONTENT routes (`outbox`, `featured`, per-post dereference) stay in the app,
  * mounted on the SAME `/ap/users/:username/*` prefix the actor advertises.
@@ -23,6 +24,7 @@ import { AP_CONTEXT } from '../apContext.js';
 import { discoveryCacheControl } from './httpCacheControl.js';
 import { verifyHttpSignature } from '../httpSignature.js';
 import { INSTANCE_ACTOR_USERNAME, normalizeActorUsername } from '../urls.js';
+import { LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND, localActorTypeForAccountKind, } from '../actorObject.js';
 /** Page size for the paginated followers/following collections (mirrors the outbox). */
 const FOLLOW_PAGE_SIZE = 20;
 /** Extract the `:username` param safely as a string. */
@@ -311,5 +313,41 @@ export function createActorRouter(config) {
     router.get('/users/:username/followers', (req, res) => serveFollowCollection(req, res, 'followers', urls.followers));
     // GET /ap/users/:username/following — Following collection (Oxy graph: local + federated).
     router.get('/users/:username/following', (req, res) => serveFollowCollection(req, res, 'following', urls.following));
+    // GET /ap/users/:username/moderators — a community `Group`'s moderators, the
+    // collection its `attributedTo` names. One unpaged `OrderedCollection`, the
+    // shape Lemmy and PieFed serve and read back.
+    const { fetchModerators } = config;
+    if (fetchModerators) {
+        router.get('/users/:username/moderators', async (req, res) => {
+            if (!config.federationEnabled)
+                return res.status(404).json({ error: 'Federation disabled' });
+            const username = getUsername(req);
+            try {
+                const user = await config.resolveUser(username);
+                if (!user ||
+                    !config.consent.isSharingEnabledFromUser(user) ||
+                    localActorTypeForAccountKind(user.kind) !== LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND.community) {
+                    return res.status(404).json({ error: 'User not found' });
+                }
+                const moderators = await fetchModerators(String(user._id || user.id));
+                const orderedItems = moderators
+                    .map((member) => memberActorUri(member, urls))
+                    .filter((uri) => uri !== null);
+                res.set('Content-Type', apContentType);
+                res.set('Cache-Control', httpCacheControl);
+                return res.json({
+                    '@context': AP_CONTEXT,
+                    id: urls.moderators(username),
+                    type: 'OrderedCollection',
+                    totalItems: orderedItems.length,
+                    orderedItems,
+                });
+            }
+            catch (err) {
+                logger.error('Moderators collection endpoint error:', err);
+                return res.status(500).json({ error: 'Internal server error' });
+            }
+        });
+    }
     return router;
 }

package/dist/esm/node/boundedBody.js

@@ -0,0 +1,71 @@
+/**
+ * The one bounded, deadlined body read behind every federation response body
+ * (an actor or collection `Response`, a failed delivery's preview).
+ *
+ * The transports bound a request up to its response headers; from there the
+ * reader owns the stream, and a remote that sends headers and then stalls (or
+ * trickles) the body would hold a plain read loop forever. This caps the bytes
+ * AND gives the whole body one deadline, cancelling the source on every early
+ * exit. It reads through a {@link BodyChunkSource} so a WHATWG reader and a
+ * Node async iterator share it.
+ */
+/** Thrown when a body exceeds its byte cap under `overflow: 'reject'`. */
+export class ResponseBodyTooLargeError extends Error {
+    constructor(maxBytes) {
+        super(`Remote response exceeds ${maxBytes} byte limit`);
+        this.maxBytes = maxBytes;
+        this.name = 'ResponseBodyTooLargeError';
+    }
+}
+/** Thrown when a body does not end within its deadline; this attempt failed, a retry may not. */
+export class ResponseBodyTimeoutError extends Error {
+    constructor(timeoutMs) {
+        super(`Remote response body did not end within ${timeoutMs} ms`);
+        this.timeoutMs = timeoutMs;
+        this.name = 'ResponseBodyTimeoutError';
+    }
+}
+/**
+ * Read `source` into one Buffer, at most `maxBytes` and within `timeoutMs`.
+ * The deadline timer is cleared on every path; the source is cancelled on a
+ * cap, a deadline, a read error, or a truncated preview.
+ */
+export async function readBodyChunks(source, limits) {
+    const { maxBytes, timeoutMs, overflow = 'reject' } = limits;
+    const chunks = [];
+    let total = 0;
+    let timer;
+    const deadline = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new ResponseBodyTimeoutError(timeoutMs)), timeoutMs);
+    });
+    try {
+        for (;;) {
+            // `Promise.race` subscribes to both, so neither the deadline nor a read
+            // that rejects once the source is cancelled goes unhandled.
+            const { done, value } = await Promise.race([source.read(), deadline]);
+            if (done || !value)
+                break;
+            const buffer = Buffer.isBuffer(value)
+                ? value
+                : Buffer.from(value.buffer, value.byteOffset, value.byteLength);
+            if (total + buffer.length > maxBytes) {
+                if (overflow === 'reject')
+                    throw new ResponseBodyTooLargeError(maxBytes);
+                chunks.push(buffer.subarray(0, maxBytes - total));
+                total = maxBytes;
+                source.cancel();
+                break;
+            }
+            total += buffer.length;
+            chunks.push(buffer);
+        }
+    }
+    catch (err) {
+        source.cancel();
+        throw err;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    return Buffer.concat(chunks, total);
+}

package/dist/esm/node/delivery.js

@@ -24,11 +24,14 @@
  * call `deliverToFollowers` / `deliverActivity` / `queueDelivery` here.
  */
 import { AP_CONTEXT } from '../apContext.js';
+import { readBodyChunks } from './boundedBody.js';
 import { signRequest } from '../httpSignature.js';
 /** Total time budget for a single delivery POST (connect + response headers). */
 const DELIVER_ACTIVITY_TIMEOUT_MS = 15000;
 /** How many bytes of a failed-delivery response body are read for the debug log. */
 const DELIVERY_RESPONSE_PREVIEW_MAX_BYTES = 1024;
+/** Deadline for reading that preview once the response headers arrived. */
+const DELIVERY_RESPONSE_PREVIEW_TIMEOUT_MS = 5000;
 /** The ActivityStreams public collection — the `to` addressee of a public activity. */
 const AP_PUBLIC = 'https://www.w3.org/ns/activitystreams#Public';
 /** A definitive refusal: workers must discard, not retry or count a delivery. */
@@ -39,18 +42,20 @@ export class DeliveryAuthorizationDeniedError extends Error {
         this.name = 'DeliveryAuthorizationDeniedError';
     }
 }
-/** Read a bounded prefix of a failed-delivery response body for the debug log. */
+/**
+ * Read a bounded prefix of a failed-delivery response body for the debug log,
+ * within {@link DELIVERY_RESPONSE_PREVIEW_TIMEOUT_MS}: an inbox that stalls its
+ * body after the headers costs the worker that long, not forever.
+ */
 async function readResponsePreview(response) {
-    const chunks = [];
-    let totalBytes = 0;
+    const iterator = response[Symbol.asyncIterator]();
     try {
-        for await (const chunk of response) {
-            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-            totalBytes += buffer.byteLength;
-            chunks.push(buffer);
-            if (totalBytes >= DELIVERY_RESPONSE_PREVIEW_MAX_BYTES)
-                break;
-        }
+        const preview = await readBodyChunks({ read: () => iterator.next(), cancel: () => response.destroy() }, {
+            maxBytes: DELIVERY_RESPONSE_PREVIEW_MAX_BYTES,
+            timeoutMs: DELIVERY_RESPONSE_PREVIEW_TIMEOUT_MS,
+            overflow: 'truncate',
+        });
+        return preview.toString('utf8');
     }
     catch {
         return '';
@@ -58,7 +63,6 @@ async function readResponsePreview(response) {
     finally {
         response.destroy();
     }
-    return Buffer.concat(chunks).toString('utf8', 0, DELIVERY_RESPONSE_PREVIEW_MAX_BYTES);
 }
 /** Build the outbound delivery + follow-lifecycle service from an app's adapters. */
 export function createDeliveryService(config) {

package/dist/esm/urls.js

@@ -30,6 +30,7 @@ export function createUrlBuilders(domain, actorDomain = domain) {
         featured: (username) => `https://${domain}/ap/users/${username}/collections/featured`,
         followers: (username) => `https://${domain}/ap/users/${username}/followers`,
         following: (username) => `https://${domain}/ap/users/${username}/following`,
+        moderators: (username) => `https://${domain}/ap/users/${username}/moderators`,
         sharedInbox: () => `https://${domain}/ap/inbox`,
     };
 }

package/dist/types/index.d.ts

@@ -226,6 +226,12 @@ export interface LocalBoostEventPayload {
  */
 export interface LocalDeleteEventPayload {
     _id: unknown;
+    /**
+     * The community (Oxy account id) the post was written in, captured with the
+     * id before the row is gone, so a community that relayed the post (FEP-1b12)
+     * can relay its deletion to the same followers. Absent for an ordinary post.
+     */
+    communityOxyUserId?: string | null;
 }
 /**
  * The shape a `post.like` / `post.unlike` event carries to outbound delivery.

package/dist/types/node/actorRouter.d.ts

@@ -8,7 +8,8 @@
  *    signature verification (Phase 2, `trustForwardedHost`) and actor-match, then
  *    202 + async dispatch to the injected inbound dispatcher,
  *  - `GET /users/:username/followers` + `/following` — the OXY follow graph
- *    (local + bridged federated edges) as paginated `OrderedCollection`s.
+ *    (local + bridged federated edges) as paginated `OrderedCollection`s,
+ *  - `GET /users/:username/moderators` — a community `Group`'s moderators.
  *
  * The CONTENT routes (`outbox`, `featured`, per-post dereference) stay in the app,
  * mounted on the SAME `/ap/users/:username/*` prefix the actor advertises.
@@ -22,7 +23,7 @@ import { Router } from 'express';
 import type { AccountKind } from '@oxy.so/contracts';
 import type { User } from '@oxy.so/core';
 import type { UrlBuilders } from '../urls';
-import type { LocalActorBuilder } from '../actorObject';
+import { type LocalActorBuilder } from '../actorObject';
 /** The resolved-user fields the actor + collection routes read. */
 export interface ActorRouteUser {
     _id?: string | null;
@@ -107,6 +108,12 @@ export interface ActorRouterConfig {
     };
     /** Fetch one page of a user's Oxy follow graph (followers OR following). */
     fetchFollowPage(userId: string, direction: 'followers' | 'following', offset: number, limit: number): Promise<FollowPage>;
+    /**
+     * A community's moderators (Oxy: its active members), served as the `Group`'s
+     * `attributedTo` collection at `GET /users/:username/moderators`. Omitted ⇒
+     * the route is not mounted; any account that is not a community 404s.
+     */
+    fetchModerators?(userId: string): Promise<User[]>;
     /** Actor HTTP response TTL in whole seconds, 0..86400. Defaults to 1800; 0 sends no-store. */
     httpCacheTtlSeconds?: number;
     /** Diagnostics sink. */

package/dist/types/node/boundedBody.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The one bounded, deadlined body read behind every federation response body
+ * (an actor or collection `Response`, a failed delivery's preview).
+ *
+ * The transports bound a request up to its response headers; from there the
+ * reader owns the stream, and a remote that sends headers and then stalls (or
+ * trickles) the body would hold a plain read loop forever. This caps the bytes
+ * AND gives the whole body one deadline, cancelling the source on every early
+ * exit. It reads through a {@link BodyChunkSource} so a WHATWG reader and a
+ * Node async iterator share it.
+ */
+/** One `read()` step: a WHATWG `ReadableStreamDefaultReader` and an async iterator both return it. */
+interface BodyChunk {
+    done?: boolean;
+    value?: Uint8Array;
+}
+/** Where the chunks come from, and how to release the stream when a read ends early. */
+export interface BodyChunkSource {
+    read(): Promise<BodyChunk>;
+    cancel(): void;
+}
+/** Limits for {@link readBodyChunks}. */
+export interface BodyReadLimits {
+    /** Largest body accepted, in bytes. */
+    maxBytes: number;
+    /** Deadline for the WHOLE body, from the call until the source ends, in milliseconds. */
+    timeoutMs: number;
+    /**
+     * `reject` (the default) throws {@link ResponseBodyTooLargeError} past the cap;
+     * `truncate` stops there and returns the first `maxBytes` (a preview).
+     */
+    overflow?: 'reject' | 'truncate';
+}
+/** Thrown when a body exceeds its byte cap under `overflow: 'reject'`. */
+export declare class ResponseBodyTooLargeError extends Error {
+    readonly maxBytes: number;
+    constructor(maxBytes: number);
+}
+/** Thrown when a body does not end within its deadline; this attempt failed, a retry may not. */
+export declare class ResponseBodyTimeoutError extends Error {
+    readonly timeoutMs: number;
+    constructor(timeoutMs: number);
+}
+/**
+ * Read `source` into one Buffer, at most `maxBytes` and within `timeoutMs`.
+ * The deadline timer is cleared on every path; the source is cancelled on a
+ * cap, a deadline, a read error, or a truncated preview.
+ */
+export declare function readBodyChunks(source: BodyChunkSource, limits: BodyReadLimits): Promise<Buffer>;
+export {};

package/dist/types/urls.d.ts

@@ -30,6 +30,11 @@ export interface UrlBuilders {
     followers(username: string): string;
     /** The actor's following collection. */
     following(username: string): string;
+    /**
+     * A community `Group`'s moderators collection — what its `attributedTo` names
+     * (Lemmy, PieFed and Mbin read the moderators from it).
+     */
+    moderators(username: string): string;
     /** The instance-wide shared inbox. */
     sharedInbox(): string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/federation",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "description": "Oxy Federation — the app-agnostic ActivityPub identity + follow engine substrate: the network-connector contract, normalized cross-network DTOs, HTTP signatures, actor resolution, the outbound delivery transport + follow lifecycle, the inbound dispatcher, and the webfinger/actor/inbox Express routers. Domain-parameterized so every Oxy app backend federates under its own domain.",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/__tests__/actorObject.test.ts

@@ -216,6 +216,19 @@ describe('actor type by Oxy account kind', () => {
     ]);
   });
 
+  it('describes a community as an open FEP-1b12 Group naming its moderators', () => {
+    const community = buildActor({ ...PARAMS, kind: 'community' });
+    expect(community.type).toBe('Group');
+    expect(community.attributedTo).toBe('https://mention.earth/ap/users/nate/moderators');
+    expect(community.moderators).toBe(community.attributedTo);
+    expect(community.postingRestrictedToMods).toBe(false);
+    // Read back by the same table: an open Group is a community, not a channel.
+    expect(accountKindForActor(community)).toBe('community');
+    const person = buildActor(PARAMS);
+    expect(person).not.toHaveProperty('attributedTo');
+    expect(person).not.toHaveProperty('postingRestrictedToMods');
+  });
+
   it('covers every account kind contracts defines, with more than one answer', () => {
     // Coverage: driven by the upstream vocabulary, so a new kind fails here.
     expect(Object.keys(LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND).sort()).toEqual([...ACCOUNT_KINDS].sort());

package/src/__tests__/boundedBody.test.ts

@@ -0,0 +1,57 @@
+import { PassThrough } from 'node:stream';
+import {
+  type BodyChunkSource,
+  readBodyChunks,
+  ResponseBodyTimeoutError,
+  ResponseBodyTooLargeError,
+} from '../node/boundedBody';
+
+function streamSource(): { stream: PassThrough; source: BodyChunkSource } {
+  const stream = new PassThrough();
+  const iterator = stream[Symbol.asyncIterator]();
+  return { stream, source: { read: () => iterator.next(), cancel: () => stream.destroy() } };
+}
+
+describe('readBodyChunks', () => {
+  it('reads a body that ends within its limits', async () => {
+    const { stream, source } = streamSource();
+    const pending = readBodyChunks(source, { maxBytes: 8, timeoutMs: 1_000 });
+    stream.write('ab');
+    stream.end('cd');
+    expect((await pending).toString()).toBe('abcd');
+  });
+
+  it('rejects one byte past the cap (or truncates a preview) and destroys the stream', async () => {
+    const rejected = streamSource();
+    const pending = readBodyChunks(rejected.source, { maxBytes: 3, timeoutMs: 1_000 });
+    rejected.stream.write('abcd');
+    await expect(pending).rejects.toBeInstanceOf(ResponseBodyTooLargeError);
+    expect(rejected.stream.destroyed).toBe(true);
+
+    const truncated = streamSource();
+    const preview = readBodyChunks(truncated.source, {
+      maxBytes: 3,
+      timeoutMs: 1_000,
+      overflow: 'truncate',
+    });
+    truncated.stream.write('abcd');
+    expect((await preview).toString()).toBe('abc');
+    expect(truncated.stream.destroyed).toBe(true);
+  });
+
+  it('throws ResponseBodyTimeoutError for a body that stalls and destroys the stream', async () => {
+    jest.useFakeTimers();
+    try {
+      const { stream, source } = streamSource();
+      const pending = readBodyChunks(source, { maxBytes: 1_024, timeoutMs: 5_000 });
+      stream.write('{"partial":');
+      const settled = expect(pending).rejects.toBeInstanceOf(ResponseBodyTimeoutError);
+      await jest.advanceTimersByTimeAsync(5_000);
+      await settled;
+      expect(stream.destroyed).toBe(true);
+      expect(jest.getTimerCount()).toBe(0);
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+});

package/src/__tests__/routers.test.ts

@@ -588,3 +588,45 @@ describe('actor router — inbox POST', () => {
     expect(res.status).toBe(404);
   });
 });
+
+describe('community moderators collection', () => {
+  const moderatorsApp = () =>
+    makeActorApp({
+      actorConfig: {
+        resolveUser: async (username) =>
+          username === 'forum'
+            ? { _id: 'u-forum', kind: 'community' }
+            : username === 'alice'
+              ? { _id: 'u-alice' }
+              : null,
+        fetchModerators: async (userId) =>
+          userId === 'u-forum'
+            ? [
+                { id: 'u-alice', username: 'alice' },
+                {
+                  id: 'u-bob',
+                  username: 'bob',
+                  type: 'federated',
+                  federation: { actorUri: REMOTE_ACTOR },
+                },
+              ]
+            : [],
+      },
+    });
+
+  it('serves a community Group its moderators as actor ids', async () => {
+    const res = await request(moderatorsApp()).get('/ap/users/forum/moderators');
+    expect(res.status).toBe(200);
+    expect(res.body).toMatchObject({
+      id: urls.moderators('forum'),
+      type: 'OrderedCollection',
+      totalItems: 2,
+      orderedItems: [urls.actor('alice'), REMOTE_ACTOR],
+    });
+  });
+
+  it('404s an account that is not a community', async () => {
+    const res = await request(moderatorsApp()).get('/ap/users/alice/moderators');
+    expect(res.status).toBe(404);
+  });
+});

package/src/actorObject.ts

@@ -396,6 +396,17 @@ export function createLocalActorBuilder(config: LocalActorBuilderConfig): LocalA
       },
     };
 
+    // A community is a FEP-1b12 `Group`: it names its moderators collection in
+    // `attributedTo` (Lemmy, PieFed; Mbin reads `moderators`) and says anybody
+    // may post into it. PeerTube refuses a `Group` without `attributedTo`, and a
+    // `Group` claiming `postingRestrictedToMods` is read as a channel by every
+    // implementation, ours included ({@link accountKindForActor}).
+    if (actorObject.type === LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND.community) {
+      actorObject.attributedTo = config.urls.moderators(username);
+      actorObject.moderators = config.urls.moderators(username);
+      actorObject.postingRestrictedToMods = false;
+    }
+
     const aliases = normalizeAlsoKnownAs(params.alsoKnownAs);
     if (aliases.length > 0) {
       actorObject.alsoKnownAs = aliases;

package/src/index.ts

@@ -303,6 +303,12 @@ export interface LocalBoostEventPayload {
  */
 export interface LocalDeleteEventPayload {
   _id: unknown;
+  /**
+   * The community (Oxy account id) the post was written in, captured with the
+   * id before the row is gone, so a community that relayed the post (FEP-1b12)
+   * can relay its deletion to the same followers. Absent for an ordinary post.
+   */
+  communityOxyUserId?: string | null;
 }
 
 /**

package/src/node/actorResolver.ts

@@ -27,6 +27,7 @@ import {
   type NetworkIdentityCandidate,
 } from '../networkIdentity';
 import type { NormalizedExternalActor } from '../index';
+import { readBodyChunks, ResponseBodyTooLargeError } from './boundedBody';
 import type { SignedFetch } from './signedFetch';
 import type { ReportActorGoneOutcome } from './identityBridge';
 
@@ -53,37 +54,31 @@ const COLLECTION_BODY_MAX_BYTES = 64 * 1024;
 const COLLECTION_WITHHELD_STATUSES: ReadonlySet<number> = new Set([401, 403, 404, 410]);
 const ERROR_BODY_MAX_BYTES = 4 * 1024;
 
+/**
+ * Deadline for reading a whole actor/collection/error body once its headers
+ * arrived. `signedFetch`'s timeout ends at the headers, so without this a remote
+ * that stalls mid-body would hold the resolver open.
+ */
+const BODY_TIMEOUT_MS = 10_000;
+
 async function readBoundedResponseBody(res: Response, maxBytes: number): Promise<string> {
   const contentLength = res.headers.get('content-length');
   if (contentLength) {
     const declaredBytes = Number(contentLength);
     if (Number.isFinite(declaredBytes) && declaredBytes > maxBytes) {
       await res.body?.cancel().catch(() => {});
-      throw new Error(`Remote response exceeds ${maxBytes} byte limit`);
+      throw new ResponseBodyTooLargeError(maxBytes);
     }
   }
 
   if (!res.body) return '';
 
   const reader = res.body.getReader();
-  const decoder = new TextDecoder('utf-8', { fatal: true });
-  let bytesRead = 0;
-  let text = '';
-  try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      bytesRead += value.byteLength;
-      if (bytesRead > maxBytes) {
-        await reader.cancel().catch(() => {});
-        throw new Error(`Remote response exceeds ${maxBytes} byte limit`);
-      }
-      text += decoder.decode(value, { stream: true });
-    }
-    return text + decoder.decode();
-  } finally {
-    reader.releaseLock();
-  }
+  const body = await readBodyChunks(
+    { read: () => reader.read(), cancel: () => void reader.cancel().catch(() => {}) },
+    { maxBytes, timeoutMs: BODY_TIMEOUT_MS },
+  );
+  return new TextDecoder('utf-8', { fatal: true }).decode(body);
 }
 
 async function readBoundedJson(res: Response, maxBytes: number): Promise<Record<string, unknown>> {

package/src/node/actorRouter.ts

@@ -8,7 +8,8 @@
  *    signature verification (Phase 2, `trustForwardedHost`) and actor-match, then
  *    202 + async dispatch to the injected inbound dispatcher,
  *  - `GET /users/:username/followers` + `/following` — the OXY follow graph
- *    (local + bridged federated edges) as paginated `OrderedCollection`s.
+ *    (local + bridged federated edges) as paginated `OrderedCollection`s,
+ *  - `GET /users/:username/moderators` — a community `Group`'s moderators.
  *
  * The CONTENT routes (`outbox`, `featured`, per-post dereference) stay in the app,
  * mounted on the SAME `/ap/users/:username/*` prefix the actor advertises.
@@ -27,7 +28,11 @@ import { discoveryCacheControl } from './httpCacheControl';
 import { verifyHttpSignature } from '../httpSignature';
 import type { UrlBuilders } from '../urls';
 import { INSTANCE_ACTOR_USERNAME, normalizeActorUsername } from '../urls';
-import type { LocalActorBuilder } from '../actorObject';
+import {
+  LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND,
+  localActorTypeForAccountKind,
+  type LocalActorBuilder,
+} from '../actorObject';
 
 /** Page size for the paginated followers/following collections (mirrors the outbox). */
 const FOLLOW_PAGE_SIZE = 20;
@@ -122,6 +127,12 @@ export interface ActorRouterConfig {
     offset: number,
     limit: number,
   ): Promise<FollowPage>;
+  /**
+   * A community's moderators (Oxy: its active members), served as the `Group`'s
+   * `attributedTo` collection at `GET /users/:username/moderators`. Omitted ⇒
+   * the route is not mounted; any account that is not a community 404s.
+   */
+  fetchModerators?(userId: string): Promise<User[]>;
   /** Actor HTTP response TTL in whole seconds, 0..86400. Defaults to 1800; 0 sends no-store. */
   httpCacheTtlSeconds?: number;
   /** Diagnostics sink. */
@@ -471,5 +482,42 @@ export function createActorRouter(config: ActorRouterConfig): Router {
     serveFollowCollection(req, res, 'following', urls.following),
   );
 
+  // GET /ap/users/:username/moderators — a community `Group`'s moderators, the
+  // collection its `attributedTo` names. One unpaged `OrderedCollection`, the
+  // shape Lemmy and PieFed serve and read back.
+  const { fetchModerators } = config;
+  if (fetchModerators) {
+    router.get('/users/:username/moderators', async (req: Request, res: Response) => {
+      if (!config.federationEnabled) return res.status(404).json({ error: 'Federation disabled' });
+      const username = getUsername(req);
+      try {
+        const user = await config.resolveUser(username);
+        if (
+          !user ||
+          !config.consent.isSharingEnabledFromUser(user) ||
+          localActorTypeForAccountKind(user.kind) !== LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND.community
+        ) {
+          return res.status(404).json({ error: 'User not found' });
+        }
+        const moderators = await fetchModerators(String(user._id || user.id));
+        const orderedItems = moderators
+          .map((member) => memberActorUri(member, urls))
+          .filter((uri): uri is string => uri !== null);
+        res.set('Content-Type', apContentType);
+        res.set('Cache-Control', httpCacheControl);
+        return res.json({
+          '@context': AP_CONTEXT,
+          id: urls.moderators(username),
+          type: 'OrderedCollection',
+          totalItems: orderedItems.length,
+          orderedItems,
+        });
+      } catch (err) {
+        logger.error('Moderators collection endpoint error:', err);
+        return res.status(500).json({ error: 'Internal server error' });
+      }
+    });
+  }
+
   return router;
 }

package/src/node/boundedBody.ts

@@ -0,0 +1,96 @@
+/**
+ * The one bounded, deadlined body read behind every federation response body
+ * (an actor or collection `Response`, a failed delivery's preview).
+ *
+ * The transports bound a request up to its response headers; from there the
+ * reader owns the stream, and a remote that sends headers and then stalls (or
+ * trickles) the body would hold a plain read loop forever. This caps the bytes
+ * AND gives the whole body one deadline, cancelling the source on every early
+ * exit. It reads through a {@link BodyChunkSource} so a WHATWG reader and a
+ * Node async iterator share it.
+ */
+
+/** One `read()` step: a WHATWG `ReadableStreamDefaultReader` and an async iterator both return it. */
+interface BodyChunk {
+  done?: boolean;
+  value?: Uint8Array;
+}
+
+/** Where the chunks come from, and how to release the stream when a read ends early. */
+export interface BodyChunkSource {
+  read(): Promise<BodyChunk>;
+  cancel(): void;
+}
+
+/** Limits for {@link readBodyChunks}. */
+export interface BodyReadLimits {
+  /** Largest body accepted, in bytes. */
+  maxBytes: number;
+  /** Deadline for the WHOLE body, from the call until the source ends, in milliseconds. */
+  timeoutMs: number;
+  /**
+   * `reject` (the default) throws {@link ResponseBodyTooLargeError} past the cap;
+   * `truncate` stops there and returns the first `maxBytes` (a preview).
+   */
+  overflow?: 'reject' | 'truncate';
+}
+
+/** Thrown when a body exceeds its byte cap under `overflow: 'reject'`. */
+export class ResponseBodyTooLargeError extends Error {
+  constructor(public readonly maxBytes: number) {
+    super(`Remote response exceeds ${maxBytes} byte limit`);
+    this.name = 'ResponseBodyTooLargeError';
+  }
+}
+
+/** Thrown when a body does not end within its deadline; this attempt failed, a retry may not. */
+export class ResponseBodyTimeoutError extends Error {
+  constructor(public readonly timeoutMs: number) {
+    super(`Remote response body did not end within ${timeoutMs} ms`);
+    this.name = 'ResponseBodyTimeoutError';
+  }
+}
+
+/**
+ * Read `source` into one Buffer, at most `maxBytes` and within `timeoutMs`.
+ * The deadline timer is cleared on every path; the source is cancelled on a
+ * cap, a deadline, a read error, or a truncated preview.
+ */
+export async function readBodyChunks(
+  source: BodyChunkSource,
+  limits: BodyReadLimits,
+): Promise<Buffer> {
+  const { maxBytes, timeoutMs, overflow = 'reject' } = limits;
+  const chunks: Buffer[] = [];
+  let total = 0;
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const deadline = new Promise<never>((_, reject) => {
+    timer = setTimeout(() => reject(new ResponseBodyTimeoutError(timeoutMs)), timeoutMs);
+  });
+  try {
+    for (;;) {
+      // `Promise.race` subscribes to both, so neither the deadline nor a read
+      // that rejects once the source is cancelled goes unhandled.
+      const { done, value } = await Promise.race([source.read(), deadline]);
+      if (done || !value) break;
+      const buffer = Buffer.isBuffer(value)
+        ? value
+        : Buffer.from(value.buffer, value.byteOffset, value.byteLength);
+      if (total + buffer.length > maxBytes) {
+        if (overflow === 'reject') throw new ResponseBodyTooLargeError(maxBytes);
+        chunks.push(buffer.subarray(0, maxBytes - total));
+        total = maxBytes;
+        source.cancel();
+        break;
+      }
+      total += buffer.length;
+      chunks.push(buffer);
+    }
+  } catch (err) {
+    source.cancel();
+    throw err;
+  } finally {
+    clearTimeout(timer);
+  }
+  return Buffer.concat(chunks, total);
+}

package/src/node/delivery.ts

@@ -26,6 +26,7 @@
 
 import type { AccountKind } from '@oxy.so/contracts';
 import { AP_CONTEXT } from '../apContext';
+import { readBodyChunks } from './boundedBody';
 import { signRequest, type HttpSignatureSigner } from '../httpSignature';
 import type { UrlBuilders } from '../urls';
 import type { LocalActorBuilder } from '../actorObject';
@@ -34,6 +35,8 @@ import type { LocalActorBuilder } from '../actorObject';
 const DELIVER_ACTIVITY_TIMEOUT_MS = 15000;
 /** How many bytes of a failed-delivery response body are read for the debug log. */
 const DELIVERY_RESPONSE_PREVIEW_MAX_BYTES = 1024;
+/** Deadline for reading that preview once the response headers arrived. */
+const DELIVERY_RESPONSE_PREVIEW_TIMEOUT_MS = 5_000;
 
 /** The ActivityStreams public collection — the `to` addressee of a public activity. */
 const AP_PUBLIC = 'https://www.w3.org/ns/activitystreams#Public';
@@ -278,25 +281,28 @@ export interface DeliveryServiceConfig<TActor extends DeliveryActorFields> {
   isBlockedDomain(host: string): boolean;
 }
 
-/** Read a bounded prefix of a failed-delivery response body for the debug log. */
+/**
+ * Read a bounded prefix of a failed-delivery response body for the debug log,
+ * within {@link DELIVERY_RESPONSE_PREVIEW_TIMEOUT_MS}: an inbox that stalls its
+ * body after the headers costs the worker that long, not forever.
+ */
 async function readResponsePreview(response: DeliveryResponseStream): Promise<string> {
-  const chunks: Buffer[] = [];
-  let totalBytes = 0;
-
+  const iterator = response[Symbol.asyncIterator]();
   try {
-    for await (const chunk of response) {
-      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-      totalBytes += buffer.byteLength;
-      chunks.push(buffer);
-      if (totalBytes >= DELIVERY_RESPONSE_PREVIEW_MAX_BYTES) break;
-    }
+    const preview = await readBodyChunks(
+      { read: () => iterator.next(), cancel: () => response.destroy() },
+      {
+        maxBytes: DELIVERY_RESPONSE_PREVIEW_MAX_BYTES,
+        timeoutMs: DELIVERY_RESPONSE_PREVIEW_TIMEOUT_MS,
+        overflow: 'truncate',
+      },
+    );
+    return preview.toString('utf8');
   } catch {
     return '';
   } finally {
     response.destroy();
   }
-
-  return Buffer.concat(chunks).toString('utf8', 0, DELIVERY_RESPONSE_PREVIEW_MAX_BYTES);
 }
 
 /** The outbound delivery + follow-lifecycle service. */

package/src/urls.ts

@@ -31,6 +31,11 @@ export interface UrlBuilders {
   followers(username: string): string;
   /** The actor's following collection. */
   following(username: string): string;
+  /**
+   * A community `Group`'s moderators collection — what its `attributedTo` names
+   * (Lemmy, PieFed and Mbin read the moderators from it).
+   */
+  moderators(username: string): string;
   /** The instance-wide shared inbox. */
   sharedInbox(): string;
 }
@@ -49,6 +54,7 @@ export function createUrlBuilders(domain: string, actorDomain: string = domain):
     featured: (username) => `https://${domain}/ap/users/${username}/collections/featured`,
     followers: (username) => `https://${domain}/ap/users/${username}/followers`,
     following: (username) => `https://${domain}/ap/users/${username}/following`,
+    moderators: (username) => `https://${domain}/ap/users/${username}/moderators`,
     sharedInbox: () => `https://${domain}/ap/inbox`,
   };
 }