@oxy.so/federation 2.5.1 → 2.7.0

package/dist/cjs/actorObject.js

@@ -283,6 +283,16 @@ function createLocalActorBuilder(config) {
                 publicKeyPem: publicKey.publicKeyPem,
             },
         };
+        // A community is a FEP-1b12 `Group`: it names its moderators collection in
+        // `attributedTo` (Lemmy, PieFed; Mbin reads `moderators`) and says anybody
+        // may post into it. PeerTube refuses a `Group` without `attributedTo`, and a
+        // `Group` claiming `postingRestrictedToMods` is read as a channel by every
+        // implementation, ours included ({@link accountKindForActor}).
+        if (actorObject.type === exports.LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND.community) {
+            actorObject.attributedTo = config.urls.moderators(username);
+            actorObject.moderators = config.urls.moderators(username);
+            actorObject.postingRestrictedToMods = false;
+        }
         const aliases = normalizeAlsoKnownAs(params.alsoKnownAs);
         if (aliases.length > 0) {
             actorObject.alsoKnownAs = aliases;

package/dist/cjs/node/actorRouter.js

@@ -9,7 +9,8 @@
  *    signature verification (Phase 2, `trustForwardedHost`) and actor-match, then
  *    202 + async dispatch to the injected inbound dispatcher,
  *  - `GET /users/:username/followers` + `/following` — the OXY follow graph
- *    (local + bridged federated edges) as paginated `OrderedCollection`s.
+ *    (local + bridged federated edges) as paginated `OrderedCollection`s,
+ *  - `GET /users/:username/moderators` — a community `Group`'s moderators.
  *
  * The CONTENT routes (`outbox`, `featured`, per-post dereference) stay in the app,
  * mounted on the SAME `/ap/users/:username/*` prefix the actor advertises.
@@ -26,6 +27,7 @@ const apContext_1 = require("../apContext");
 const httpCacheControl_1 = require("./httpCacheControl");
 const httpSignature_1 = require("../httpSignature");
 const urls_1 = require("../urls");
+const actorObject_1 = require("../actorObject");
 /** Page size for the paginated followers/following collections (mirrors the outbox). */
 const FOLLOW_PAGE_SIZE = 20;
 /** Extract the `:username` param safely as a string. */
@@ -314,5 +316,41 @@ function createActorRouter(config) {
     router.get('/users/:username/followers', (req, res) => serveFollowCollection(req, res, 'followers', urls.followers));
     // GET /ap/users/:username/following — Following collection (Oxy graph: local + federated).
     router.get('/users/:username/following', (req, res) => serveFollowCollection(req, res, 'following', urls.following));
+    // GET /ap/users/:username/moderators — a community `Group`'s moderators, the
+    // collection its `attributedTo` names. One unpaged `OrderedCollection`, the
+    // shape Lemmy and PieFed serve and read back.
+    const { fetchModerators } = config;
+    if (fetchModerators) {
+        router.get('/users/:username/moderators', async (req, res) => {
+            if (!config.federationEnabled)
+                return res.status(404).json({ error: 'Federation disabled' });
+            const username = getUsername(req);
+            try {
+                const user = await config.resolveUser(username);
+                if (!user ||
+                    !config.consent.isSharingEnabledFromUser(user) ||
+                    (0, actorObject_1.localActorTypeForAccountKind)(user.kind) !== actorObject_1.LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND.community) {
+                    return res.status(404).json({ error: 'User not found' });
+                }
+                const moderators = await fetchModerators(String(user._id || user.id));
+                const orderedItems = moderators
+                    .map((member) => memberActorUri(member, urls))
+                    .filter((uri) => uri !== null);
+                res.set('Content-Type', apContentType);
+                res.set('Cache-Control', httpCacheControl);
+                return res.json({
+                    '@context': apContext_1.AP_CONTEXT,
+                    id: urls.moderators(username),
+                    type: 'OrderedCollection',
+                    totalItems: orderedItems.length,
+                    orderedItems,
+                });
+            }
+            catch (err) {
+                logger.error('Moderators collection endpoint error:', err);
+                return res.status(500).json({ error: 'Internal server error' });
+            }
+        });
+    }
     return router;
 }

package/dist/cjs/node/delivery.js

@@ -353,27 +353,28 @@ function createDeliveryService(config) {
         }
         return true;
     }
-    async function sendAccept(localOxyUserId, localUsername, followActivityId, remoteActorUri) {
+    /** Answer a remote Follow: `Accept` or `Reject`, one envelope for both. */
+    async function sendFollowResponse(type, localOxyUserId, localUsername, followActivityId, remoteActorUri) {
         const actor = await config.store.findActorByUri(remoteActorUri);
         if (!actor)
             return;
         // `inboxUrl` is schema-optional (atproto actors have none); an AP actor we
-        // are sending Accept(Follow) to always has one. When neither inbox is known the
-        // local follow is already removed — just skip the outbound delivery.
+        // are answering always has one. When neither inbox is known, skip the
+        // outbound delivery.
         const targetInbox = actor.sharedInboxUrl ?? actor.inboxUrl;
         if (!targetInbox) {
-            logger.warn(`[FedSync] cannot send Accept(Follow) to ${remoteActorUri}: actor has no inbox`);
+            logger.warn(`[FedSync] cannot send ${type}(Follow) to ${remoteActorUri}: actor has no inbox`);
             return;
         }
         if (isBlockedUrl(targetInbox) || isBlockedUrl(remoteActorUri)) {
-            logger.warn(`[FedDeliver] refusing Accept(Follow) delivery to blocked origin ${remoteActorUri}`);
+            logger.warn(`[FedDeliver] refusing ${type}(Follow) delivery to blocked origin ${remoteActorUri}`);
             return;
         }
         const localActorUri = urls.actor(localUsername);
         const activity = {
             '@context': apContext_1.AP_CONTEXT,
-            id: `${localActorUri}/accepts/${Date.now()}`,
-            type: 'Accept',
+            id: `${localActorUri}/${type === 'Accept' ? 'accepts' : 'rejects'}/${Date.now()}`,
+            type,
             actor: localActorUri,
             object: {
                 id: followActivityId,
@@ -387,6 +388,12 @@ function createDeliveryService(config) {
             await queueDelivery(activity, targetInbox, localOxyUserId);
         }
     }
+    function sendAccept(localOxyUserId, localUsername, followActivityId, remoteActorUri) {
+        return sendFollowResponse('Accept', localOxyUserId, localUsername, followActivityId, remoteActorUri);
+    }
+    function sendReject(localOxyUserId, localUsername, followActivityId, remoteActorUri) {
+        return sendFollowResponse('Reject', localOxyUserId, localUsername, followActivityId, remoteActorUri);
+    }
     async function federateActorUpdate(actorOxyUserId, username) {
         if (!config.federationEnabled)
             return;
@@ -440,6 +447,7 @@ function createDeliveryService(config) {
         sendFollow,
         sendUndoFollow,
         sendAccept,
+        sendReject,
         federateActorUpdate,
     };
 }

package/dist/cjs/node/inboundDispatch.js

@@ -150,6 +150,14 @@ function createInboundDispatcher(config) {
             logger.debug(`[Federation] ignoring self-follow from ${actorUri} to ${username}`);
             return;
         }
+        if (config.refusesFollower && (await config.refusesFollower(localUserId, followerOxyUserId))) {
+            if (!config.delivery.sendReject) {
+                throw new Error('refusesFollower is wired without delivery.sendReject');
+            }
+            await config.delivery.sendReject(localUserId, username, String(activity.id), actorUri);
+            logger.info(`Rejected follow from ${actorUri} to ${username}`);
+            return;
+        }
         // Create the Oxy follow edge BEFORE sending Accept so a retry never spams
         // Accepts: the bridge is idempotent (safe to re-run), but an Accept delivered
         // before the edge was committed could be re-sent on every retry. On failure

package/dist/cjs/urls.js

@@ -35,6 +35,7 @@ function createUrlBuilders(domain, actorDomain = domain) {
         featured: (username) => `https://${domain}/ap/users/${username}/collections/featured`,
         followers: (username) => `https://${domain}/ap/users/${username}/followers`,
         following: (username) => `https://${domain}/ap/users/${username}/following`,
+        moderators: (username) => `https://${domain}/ap/users/${username}/moderators`,
         sharedInbox: () => `https://${domain}/ap/inbox`,
     };
 }

package/dist/esm/actorObject.js

@@ -275,6 +275,16 @@ export function createLocalActorBuilder(config) {
                 publicKeyPem: publicKey.publicKeyPem,
             },
         };
+        // A community is a FEP-1b12 `Group`: it names its moderators collection in
+        // `attributedTo` (Lemmy, PieFed; Mbin reads `moderators`) and says anybody
+        // may post into it. PeerTube refuses a `Group` without `attributedTo`, and a
+        // `Group` claiming `postingRestrictedToMods` is read as a channel by every
+        // implementation, ours included ({@link accountKindForActor}).
+        if (actorObject.type === LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND.community) {
+            actorObject.attributedTo = config.urls.moderators(username);
+            actorObject.moderators = config.urls.moderators(username);
+            actorObject.postingRestrictedToMods = false;
+        }
         const aliases = normalizeAlsoKnownAs(params.alsoKnownAs);
         if (aliases.length > 0) {
             actorObject.alsoKnownAs = aliases;

package/dist/esm/node/actorRouter.js

@@ -8,7 +8,8 @@
  *    signature verification (Phase 2, `trustForwardedHost`) and actor-match, then
  *    202 + async dispatch to the injected inbound dispatcher,
  *  - `GET /users/:username/followers` + `/following` — the OXY follow graph
- *    (local + bridged federated edges) as paginated `OrderedCollection`s.
+ *    (local + bridged federated edges) as paginated `OrderedCollection`s,
+ *  - `GET /users/:username/moderators` — a community `Group`'s moderators.
  *
  * The CONTENT routes (`outbox`, `featured`, per-post dereference) stay in the app,
  * mounted on the SAME `/ap/users/:username/*` prefix the actor advertises.
@@ -23,6 +24,7 @@ import { AP_CONTEXT } from '../apContext.js';
 import { discoveryCacheControl } from './httpCacheControl.js';
 import { verifyHttpSignature } from '../httpSignature.js';
 import { INSTANCE_ACTOR_USERNAME, normalizeActorUsername } from '../urls.js';
+import { LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND, localActorTypeForAccountKind, } from '../actorObject.js';
 /** Page size for the paginated followers/following collections (mirrors the outbox). */
 const FOLLOW_PAGE_SIZE = 20;
 /** Extract the `:username` param safely as a string. */
@@ -311,5 +313,41 @@ export function createActorRouter(config) {
     router.get('/users/:username/followers', (req, res) => serveFollowCollection(req, res, 'followers', urls.followers));
     // GET /ap/users/:username/following — Following collection (Oxy graph: local + federated).
     router.get('/users/:username/following', (req, res) => serveFollowCollection(req, res, 'following', urls.following));
+    // GET /ap/users/:username/moderators — a community `Group`'s moderators, the
+    // collection its `attributedTo` names. One unpaged `OrderedCollection`, the
+    // shape Lemmy and PieFed serve and read back.
+    const { fetchModerators } = config;
+    if (fetchModerators) {
+        router.get('/users/:username/moderators', async (req, res) => {
+            if (!config.federationEnabled)
+                return res.status(404).json({ error: 'Federation disabled' });
+            const username = getUsername(req);
+            try {
+                const user = await config.resolveUser(username);
+                if (!user ||
+                    !config.consent.isSharingEnabledFromUser(user) ||
+                    localActorTypeForAccountKind(user.kind) !== LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND.community) {
+                    return res.status(404).json({ error: 'User not found' });
+                }
+                const moderators = await fetchModerators(String(user._id || user.id));
+                const orderedItems = moderators
+                    .map((member) => memberActorUri(member, urls))
+                    .filter((uri) => uri !== null);
+                res.set('Content-Type', apContentType);
+                res.set('Cache-Control', httpCacheControl);
+                return res.json({
+                    '@context': AP_CONTEXT,
+                    id: urls.moderators(username),
+                    type: 'OrderedCollection',
+                    totalItems: orderedItems.length,
+                    orderedItems,
+                });
+            }
+            catch (err) {
+                logger.error('Moderators collection endpoint error:', err);
+                return res.status(500).json({ error: 'Internal server error' });
+            }
+        });
+    }
     return router;
 }

package/dist/esm/node/delivery.js

@@ -348,27 +348,28 @@ export function createDeliveryService(config) {
         }
         return true;
     }
-    async function sendAccept(localOxyUserId, localUsername, followActivityId, remoteActorUri) {
+    /** Answer a remote Follow: `Accept` or `Reject`, one envelope for both. */
+    async function sendFollowResponse(type, localOxyUserId, localUsername, followActivityId, remoteActorUri) {
         const actor = await config.store.findActorByUri(remoteActorUri);
         if (!actor)
             return;
         // `inboxUrl` is schema-optional (atproto actors have none); an AP actor we
-        // are sending Accept(Follow) to always has one. When neither inbox is known the
-        // local follow is already removed — just skip the outbound delivery.
+        // are answering always has one. When neither inbox is known, skip the
+        // outbound delivery.
         const targetInbox = actor.sharedInboxUrl ?? actor.inboxUrl;
         if (!targetInbox) {
-            logger.warn(`[FedSync] cannot send Accept(Follow) to ${remoteActorUri}: actor has no inbox`);
+            logger.warn(`[FedSync] cannot send ${type}(Follow) to ${remoteActorUri}: actor has no inbox`);
             return;
         }
         if (isBlockedUrl(targetInbox) || isBlockedUrl(remoteActorUri)) {
-            logger.warn(`[FedDeliver] refusing Accept(Follow) delivery to blocked origin ${remoteActorUri}`);
+            logger.warn(`[FedDeliver] refusing ${type}(Follow) delivery to blocked origin ${remoteActorUri}`);
             return;
         }
         const localActorUri = urls.actor(localUsername);
         const activity = {
             '@context': AP_CONTEXT,
-            id: `${localActorUri}/accepts/${Date.now()}`,
-            type: 'Accept',
+            id: `${localActorUri}/${type === 'Accept' ? 'accepts' : 'rejects'}/${Date.now()}`,
+            type,
             actor: localActorUri,
             object: {
                 id: followActivityId,
@@ -382,6 +383,12 @@ export function createDeliveryService(config) {
             await queueDelivery(activity, targetInbox, localOxyUserId);
         }
     }
+    function sendAccept(localOxyUserId, localUsername, followActivityId, remoteActorUri) {
+        return sendFollowResponse('Accept', localOxyUserId, localUsername, followActivityId, remoteActorUri);
+    }
+    function sendReject(localOxyUserId, localUsername, followActivityId, remoteActorUri) {
+        return sendFollowResponse('Reject', localOxyUserId, localUsername, followActivityId, remoteActorUri);
+    }
     async function federateActorUpdate(actorOxyUserId, username) {
         if (!config.federationEnabled)
             return;
@@ -435,6 +442,7 @@ export function createDeliveryService(config) {
         sendFollow,
         sendUndoFollow,
         sendAccept,
+        sendReject,
         federateActorUpdate,
     };
 }

package/dist/esm/node/inboundDispatch.js

@@ -145,6 +145,14 @@ export function createInboundDispatcher(config) {
             logger.debug(`[Federation] ignoring self-follow from ${actorUri} to ${username}`);
             return;
         }
+        if (config.refusesFollower && (await config.refusesFollower(localUserId, followerOxyUserId))) {
+            if (!config.delivery.sendReject) {
+                throw new Error('refusesFollower is wired without delivery.sendReject');
+            }
+            await config.delivery.sendReject(localUserId, username, String(activity.id), actorUri);
+            logger.info(`Rejected follow from ${actorUri} to ${username}`);
+            return;
+        }
         // Create the Oxy follow edge BEFORE sending Accept so a retry never spams
         // Accepts: the bridge is idempotent (safe to re-run), but an Accept delivered
         // before the edge was committed could be re-sent on every retry. On failure

package/dist/esm/urls.js

@@ -30,6 +30,7 @@ export function createUrlBuilders(domain, actorDomain = domain) {
         featured: (username) => `https://${domain}/ap/users/${username}/collections/featured`,
         followers: (username) => `https://${domain}/ap/users/${username}/followers`,
         following: (username) => `https://${domain}/ap/users/${username}/following`,
+        moderators: (username) => `https://${domain}/ap/users/${username}/moderators`,
         sharedInbox: () => `https://${domain}/ap/inbox`,
     };
 }

package/dist/types/index.d.ts

@@ -226,6 +226,12 @@ export interface LocalBoostEventPayload {
  */
 export interface LocalDeleteEventPayload {
     _id: unknown;
+    /**
+     * The community (Oxy account id) the post was written in, captured with the
+     * id before the row is gone, so a community that relayed the post (FEP-1b12)
+     * can relay its deletion to the same followers. Absent for an ordinary post.
+     */
+    communityOxyUserId?: string | null;
 }
 /**
  * The shape a `post.like` / `post.unlike` event carries to outbound delivery.

package/dist/types/node/actorRouter.d.ts

@@ -8,7 +8,8 @@
  *    signature verification (Phase 2, `trustForwardedHost`) and actor-match, then
  *    202 + async dispatch to the injected inbound dispatcher,
  *  - `GET /users/:username/followers` + `/following` — the OXY follow graph
- *    (local + bridged federated edges) as paginated `OrderedCollection`s.
+ *    (local + bridged federated edges) as paginated `OrderedCollection`s,
+ *  - `GET /users/:username/moderators` — a community `Group`'s moderators.
  *
  * The CONTENT routes (`outbox`, `featured`, per-post dereference) stay in the app,
  * mounted on the SAME `/ap/users/:username/*` prefix the actor advertises.
@@ -22,7 +23,7 @@ import { Router } from 'express';
 import type { AccountKind } from '@oxy.so/contracts';
 import type { User } from '@oxy.so/core';
 import type { UrlBuilders } from '../urls';
-import type { LocalActorBuilder } from '../actorObject';
+import { type LocalActorBuilder } from '../actorObject';
 /** The resolved-user fields the actor + collection routes read. */
 export interface ActorRouteUser {
     _id?: string | null;
@@ -107,6 +108,12 @@ export interface ActorRouterConfig {
     };
     /** Fetch one page of a user's Oxy follow graph (followers OR following). */
     fetchFollowPage(userId: string, direction: 'followers' | 'following', offset: number, limit: number): Promise<FollowPage>;
+    /**
+     * A community's moderators (Oxy: its active members), served as the `Group`'s
+     * `attributedTo` collection at `GET /users/:username/moderators`. Omitted ⇒
+     * the route is not mounted; any account that is not a community 404s.
+     */
+    fetchModerators?(userId: string): Promise<User[]>;
     /** Actor HTTP response TTL in whole seconds, 0..86400. Defaults to 1800; 0 sends no-store. */
     httpCacheTtlSeconds?: number;
     /** Diagnostics sink. */

package/dist/types/node/delivery.d.ts

@@ -266,6 +266,8 @@ export interface DeliveryService {
     sendUndoFollow(localOxyUserId: string, localUsername: string, remoteActorUri: string): Promise<boolean>;
     /** Send an Accept(Follow) back to a remote actor. */
     sendAccept(localOxyUserId: string, localUsername: string, followActivityId: string, remoteActorUri: string): Promise<void>;
+    /** Send a Reject(Follow) back to a remote actor — the same envelope as the Accept. */
+    sendReject(localOxyUserId: string, localUsername: string, followActivityId: string, remoteActorUri: string): Promise<void>;
     /** Rebroadcast the FULL actor document as an Update(Person) to remote followers. */
     federateActorUpdate(actorOxyUserId: string, username: string): Promise<void>;
 }

package/dist/types/node/inboundDispatch.d.ts

@@ -108,6 +108,8 @@ export interface InboundFollowStore {
 /** The delivery subset the inbound Follow uses (send the Accept back). */
 export interface InboundDelivery {
     sendAccept(localOxyUserId: string, localUsername: string, followActivityId: string, remoteActorUri: string): Promise<void>;
+    /** Send a Reject(Follow) back — required when {@link InboundDispatcherConfig.refusesFollower} is wired. */
+    sendReject?(localOxyUserId: string, localUsername: string, followActivityId: string, remoteActorUri: string): Promise<void>;
 }
 /** Adapters + hooks an {@link InboundDispatcher} is built from. */
 export interface InboundDispatcherConfig {
@@ -132,8 +134,16 @@ export interface InboundDispatcherConfig {
     actorResolver: InboundActorResolver;
     /** The AP follow-record store. */
     follows: InboundFollowStore;
-    /** The delivery service (send the Accept). */
+    /** The delivery service (send the Accept, or the Reject). */
     delivery: InboundDelivery;
+    /**
+     * Whether the local account REFUSES this follower — a community that banned
+     * them. A refused Follow is answered with a `Reject` (the account exists and is
+     * public, so saying no reveals nothing), and no edge or follow row is written.
+     * Asked after the follower resolves, so the app answers by Oxy id. Absent ⇒
+     * every Follow is accepted, as before.
+     */
+    refusesFollower?(localUserId: string, followerOxyUserId: string): Promise<boolean>;
     /**
      * Best-effort: notify the local user of a newly-accepted inbound follow.
      * NEVER throws (it handles its own errors); a failure must not fail (and thus

package/dist/types/urls.d.ts

@@ -30,6 +30,11 @@ export interface UrlBuilders {
     followers(username: string): string;
     /** The actor's following collection. */
     following(username: string): string;
+    /**
+     * A community `Group`'s moderators collection — what its `attributedTo` names
+     * (Lemmy, PieFed and Mbin read the moderators from it).
+     */
+    moderators(username: string): string;
     /** The instance-wide shared inbox. */
     sharedInbox(): string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/federation",
-  "version": "2.5.1",
+  "version": "2.7.0",
   "description": "Oxy Federation — the app-agnostic ActivityPub identity + follow engine substrate: the network-connector contract, normalized cross-network DTOs, HTTP signatures, actor resolution, the outbound delivery transport + follow lifecycle, the inbound dispatcher, and the webfinger/actor/inbox Express routers. Domain-parameterized so every Oxy app backend federates under its own domain.",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/__tests__/actorObject.test.ts

@@ -216,6 +216,19 @@ describe('actor type by Oxy account kind', () => {
     ]);
   });
 
+  it('describes a community as an open FEP-1b12 Group naming its moderators', () => {
+    const community = buildActor({ ...PARAMS, kind: 'community' });
+    expect(community.type).toBe('Group');
+    expect(community.attributedTo).toBe('https://mention.earth/ap/users/nate/moderators');
+    expect(community.moderators).toBe(community.attributedTo);
+    expect(community.postingRestrictedToMods).toBe(false);
+    // Read back by the same table: an open Group is a community, not a channel.
+    expect(accountKindForActor(community)).toBe('community');
+    const person = buildActor(PARAMS);
+    expect(person).not.toHaveProperty('attributedTo');
+    expect(person).not.toHaveProperty('postingRestrictedToMods');
+  });
+
   it('covers every account kind contracts defines, with more than one answer', () => {
     // Coverage: driven by the upstream vocabulary, so a new kind fails here.
     expect(Object.keys(LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND).sort()).toEqual([...ACCOUNT_KINDS].sort());

package/src/__tests__/inboundDispatch.test.ts

@@ -31,11 +31,13 @@ function makeRig(
     validate?: (activity: Record<string, unknown>) => InboundActivityValidation;
     blockedHosts?: string[];
     withMoveHandler?: boolean;
+    refusedFollowers?: string[];
   } = {},
 ) {
   const moves: Array<{ activityId: string; oldActorUri: string; targetActorUri: string }> = [];
   const bridgeFollowCalls: Array<[string, string]> = [];
   const bridgeUnfollowCalls: Array<[string, string]> = [];
+  const rejectsSent: string[] = [];
   const acceptsSent: Array<{
     localOxyUserId: string;
     localUsername: string;
@@ -109,7 +111,16 @@ function makeRig(
       sendAccept: async (localOxyUserId, localUsername, followActivityId, remoteActorUri) => {
         acceptsSent.push({ localOxyUserId, localUsername, followActivityId, remoteActorUri });
       },
+      sendReject: async (_localOxyUserId, _localUsername, followActivityId) => {
+        rejectsSent.push(followActivityId);
+      },
     },
+    ...(overrides.refusedFollowers
+      ? {
+          refusesFollower: async (_localUserId: string, followerOxyUserId: string) =>
+            overrides.refusedFollowers?.includes(followerOxyUserId) ?? false,
+        }
+      : {}),
     onInboundFollowAccepted: async (localUserId, followerOxyUserId, actorUri) => {
       onInboundFollowAcceptedCalls.push([localUserId, followerOxyUserId, actorUri]);
     },
@@ -140,6 +151,7 @@ function makeRig(
     bridgeFollowCalls,
     bridgeUnfollowCalls,
     acceptsSent,
+    rejectsSent,
     inboundAcceptedUpserts,
     deletedFollowIds,
     contentActivities,
@@ -174,6 +186,18 @@ describe('inbound Follow', () => {
     expect(rig.onInboundFollowAcceptedCalls).toEqual([['u-alice', 'u-bob', REMOTE_ACTOR]]);
   });
 
+  it('answers a refused follower with Reject, writing nothing', async () => {
+    const rig = makeRig({ refusedFollowers: ['u-bob'] });
+    await rig.dispatcher.processInboxActivity(
+      { type: 'Follow', id: 'f9', actor: REMOTE_ACTOR, object: LOCAL_ACTOR },
+      REMOTE_ACTOR,
+    );
+    expect(rig.rejectsSent).toEqual(['f9']);
+    expect(rig.acceptsSent).toEqual([]);
+    expect(rig.bridgeFollowCalls).toEqual([]);
+    expect(rig.inboundAcceptedUpserts).toEqual([]);
+  });
+
   it('drops the Follow (no bridge/accept) when the target has sharing OFF', async () => {
     const rig = makeRig({ sharingEnabled: false });
     await rig.dispatcher.processInboxActivity(

package/src/__tests__/routers.test.ts

@@ -588,3 +588,45 @@ describe('actor router — inbox POST', () => {
     expect(res.status).toBe(404);
   });
 });
+
+describe('community moderators collection', () => {
+  const moderatorsApp = () =>
+    makeActorApp({
+      actorConfig: {
+        resolveUser: async (username) =>
+          username === 'forum'
+            ? { _id: 'u-forum', kind: 'community' }
+            : username === 'alice'
+              ? { _id: 'u-alice' }
+              : null,
+        fetchModerators: async (userId) =>
+          userId === 'u-forum'
+            ? [
+                { id: 'u-alice', username: 'alice' },
+                {
+                  id: 'u-bob',
+                  username: 'bob',
+                  type: 'federated',
+                  federation: { actorUri: REMOTE_ACTOR },
+                },
+              ]
+            : [],
+      },
+    });
+
+  it('serves a community Group its moderators as actor ids', async () => {
+    const res = await request(moderatorsApp()).get('/ap/users/forum/moderators');
+    expect(res.status).toBe(200);
+    expect(res.body).toMatchObject({
+      id: urls.moderators('forum'),
+      type: 'OrderedCollection',
+      totalItems: 2,
+      orderedItems: [urls.actor('alice'), REMOTE_ACTOR],
+    });
+  });
+
+  it('404s an account that is not a community', async () => {
+    const res = await request(moderatorsApp()).get('/ap/users/alice/moderators');
+    expect(res.status).toBe(404);
+  });
+});

package/src/actorObject.ts

@@ -396,6 +396,17 @@ export function createLocalActorBuilder(config: LocalActorBuilderConfig): LocalA
       },
     };
 
+    // A community is a FEP-1b12 `Group`: it names its moderators collection in
+    // `attributedTo` (Lemmy, PieFed; Mbin reads `moderators`) and says anybody
+    // may post into it. PeerTube refuses a `Group` without `attributedTo`, and a
+    // `Group` claiming `postingRestrictedToMods` is read as a channel by every
+    // implementation, ours included ({@link accountKindForActor}).
+    if (actorObject.type === LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND.community) {
+      actorObject.attributedTo = config.urls.moderators(username);
+      actorObject.moderators = config.urls.moderators(username);
+      actorObject.postingRestrictedToMods = false;
+    }
+
     const aliases = normalizeAlsoKnownAs(params.alsoKnownAs);
     if (aliases.length > 0) {
       actorObject.alsoKnownAs = aliases;

package/src/index.ts

@@ -303,6 +303,12 @@ export interface LocalBoostEventPayload {
  */
 export interface LocalDeleteEventPayload {
   _id: unknown;
+  /**
+   * The community (Oxy account id) the post was written in, captured with the
+   * id before the row is gone, so a community that relayed the post (FEP-1b12)
+   * can relay its deletion to the same followers. Absent for an ordinary post.
+   */
+  communityOxyUserId?: string | null;
 }
 
 /**

package/src/node/actorRouter.ts

@@ -8,7 +8,8 @@
  *    signature verification (Phase 2, `trustForwardedHost`) and actor-match, then
  *    202 + async dispatch to the injected inbound dispatcher,
  *  - `GET /users/:username/followers` + `/following` — the OXY follow graph
- *    (local + bridged federated edges) as paginated `OrderedCollection`s.
+ *    (local + bridged federated edges) as paginated `OrderedCollection`s,
+ *  - `GET /users/:username/moderators` — a community `Group`'s moderators.
  *
  * The CONTENT routes (`outbox`, `featured`, per-post dereference) stay in the app,
  * mounted on the SAME `/ap/users/:username/*` prefix the actor advertises.
@@ -27,7 +28,11 @@ import { discoveryCacheControl } from './httpCacheControl';
 import { verifyHttpSignature } from '../httpSignature';
 import type { UrlBuilders } from '../urls';
 import { INSTANCE_ACTOR_USERNAME, normalizeActorUsername } from '../urls';
-import type { LocalActorBuilder } from '../actorObject';
+import {
+  LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND,
+  localActorTypeForAccountKind,
+  type LocalActorBuilder,
+} from '../actorObject';
 
 /** Page size for the paginated followers/following collections (mirrors the outbox). */
 const FOLLOW_PAGE_SIZE = 20;
@@ -122,6 +127,12 @@ export interface ActorRouterConfig {
     offset: number,
     limit: number,
   ): Promise<FollowPage>;
+  /**
+   * A community's moderators (Oxy: its active members), served as the `Group`'s
+   * `attributedTo` collection at `GET /users/:username/moderators`. Omitted ⇒
+   * the route is not mounted; any account that is not a community 404s.
+   */
+  fetchModerators?(userId: string): Promise<User[]>;
   /** Actor HTTP response TTL in whole seconds, 0..86400. Defaults to 1800; 0 sends no-store. */
   httpCacheTtlSeconds?: number;
   /** Diagnostics sink. */
@@ -471,5 +482,42 @@ export function createActorRouter(config: ActorRouterConfig): Router {
     serveFollowCollection(req, res, 'following', urls.following),
   );
 
+  // GET /ap/users/:username/moderators — a community `Group`'s moderators, the
+  // collection its `attributedTo` names. One unpaged `OrderedCollection`, the
+  // shape Lemmy and PieFed serve and read back.
+  const { fetchModerators } = config;
+  if (fetchModerators) {
+    router.get('/users/:username/moderators', async (req: Request, res: Response) => {
+      if (!config.federationEnabled) return res.status(404).json({ error: 'Federation disabled' });
+      const username = getUsername(req);
+      try {
+        const user = await config.resolveUser(username);
+        if (
+          !user ||
+          !config.consent.isSharingEnabledFromUser(user) ||
+          localActorTypeForAccountKind(user.kind) !== LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND.community
+        ) {
+          return res.status(404).json({ error: 'User not found' });
+        }
+        const moderators = await fetchModerators(String(user._id || user.id));
+        const orderedItems = moderators
+          .map((member) => memberActorUri(member, urls))
+          .filter((uri): uri is string => uri !== null);
+        res.set('Content-Type', apContentType);
+        res.set('Cache-Control', httpCacheControl);
+        return res.json({
+          '@context': AP_CONTEXT,
+          id: urls.moderators(username),
+          type: 'OrderedCollection',
+          totalItems: orderedItems.length,
+          orderedItems,
+        });
+      } catch (err) {
+        logger.error('Moderators collection endpoint error:', err);
+        return res.status(500).json({ error: 'Internal server error' });
+      }
+    });
+  }
+
   return router;
 }

package/src/node/delivery.ts

@@ -351,6 +351,13 @@ export interface DeliveryService {
     followActivityId: string,
     remoteActorUri: string,
   ): Promise<void>;
+  /** Send a Reject(Follow) back to a remote actor — the same envelope as the Accept. */
+  sendReject(
+    localOxyUserId: string,
+    localUsername: string,
+    followActivityId: string,
+    remoteActorUri: string,
+  ): Promise<void>;
   /** Rebroadcast the FULL actor document as an Update(Person) to remote followers. */
   federateActorUpdate(actorOxyUserId: string, username: string): Promise<void>;
 }
@@ -716,7 +723,9 @@ export function createDeliveryService<TActor extends DeliveryActorFields>(
     return true;
   }
 
-  async function sendAccept(
+  /** Answer a remote Follow: `Accept` or `Reject`, one envelope for both. */
+  async function sendFollowResponse(
+    type: 'Accept' | 'Reject',
     localOxyUserId: string,
     localUsername: string,
     followActivityId: string,
@@ -725,16 +734,16 @@ export function createDeliveryService<TActor extends DeliveryActorFields>(
     const actor = await config.store.findActorByUri(remoteActorUri);
     if (!actor) return;
     // `inboxUrl` is schema-optional (atproto actors have none); an AP actor we
-    // are sending Accept(Follow) to always has one. When neither inbox is known the
-    // local follow is already removed — just skip the outbound delivery.
+    // are answering always has one. When neither inbox is known, skip the
+    // outbound delivery.
     const targetInbox = actor.sharedInboxUrl ?? actor.inboxUrl;
     if (!targetInbox) {
-      logger.warn(`[FedSync] cannot send Accept(Follow) to ${remoteActorUri}: actor has no inbox`);
+      logger.warn(`[FedSync] cannot send ${type}(Follow) to ${remoteActorUri}: actor has no inbox`);
       return;
     }
     if (isBlockedUrl(targetInbox) || isBlockedUrl(remoteActorUri)) {
       logger.warn(
-        `[FedDeliver] refusing Accept(Follow) delivery to blocked origin ${remoteActorUri}`,
+        `[FedDeliver] refusing ${type}(Follow) delivery to blocked origin ${remoteActorUri}`,
       );
       return;
     }
@@ -743,8 +752,8 @@ export function createDeliveryService<TActor extends DeliveryActorFields>(
 
     const activity: Record<string, unknown> = {
       '@context': AP_CONTEXT,
-      id: `${localActorUri}/accepts/${Date.now()}`,
-      type: 'Accept',
+      id: `${localActorUri}/${type === 'Accept' ? 'accepts' : 'rejects'}/${Date.now()}`,
+      type,
       actor: localActorUri,
       object: {
         id: followActivityId,
@@ -760,6 +769,36 @@ export function createDeliveryService<TActor extends DeliveryActorFields>(
     }
   }
 
+  function sendAccept(
+    localOxyUserId: string,
+    localUsername: string,
+    followActivityId: string,
+    remoteActorUri: string,
+  ): Promise<void> {
+    return sendFollowResponse(
+      'Accept',
+      localOxyUserId,
+      localUsername,
+      followActivityId,
+      remoteActorUri,
+    );
+  }
+
+  function sendReject(
+    localOxyUserId: string,
+    localUsername: string,
+    followActivityId: string,
+    remoteActorUri: string,
+  ): Promise<void> {
+    return sendFollowResponse(
+      'Reject',
+      localOxyUserId,
+      localUsername,
+      followActivityId,
+      remoteActorUri,
+    );
+  }
+
   async function federateActorUpdate(actorOxyUserId: string, username: string): Promise<void> {
     if (!config.federationEnabled) return;
     if (!(await config.consent.isSharingEnabled(actorOxyUserId))) return;
@@ -819,6 +858,7 @@ export function createDeliveryService<TActor extends DeliveryActorFields>(
     sendFollow,
     sendUndoFollow,
     sendAccept,
+    sendReject,
     federateActorUpdate,
   };
 }

package/src/node/inboundDispatch.ts

@@ -127,6 +127,13 @@ export interface InboundDelivery {
     followActivityId: string,
     remoteActorUri: string,
   ): Promise<void>;
+  /** Send a Reject(Follow) back — required when {@link InboundDispatcherConfig.refusesFollower} is wired. */
+  sendReject?(
+    localOxyUserId: string,
+    localUsername: string,
+    followActivityId: string,
+    remoteActorUri: string,
+  ): Promise<void>;
 }
 
 /** Adapters + hooks an {@link InboundDispatcher} is built from. */
@@ -152,8 +159,16 @@ export interface InboundDispatcherConfig {
   actorResolver: InboundActorResolver;
   /** The AP follow-record store. */
   follows: InboundFollowStore;
-  /** The delivery service (send the Accept). */
+  /** The delivery service (send the Accept, or the Reject). */
   delivery: InboundDelivery;
+  /**
+   * Whether the local account REFUSES this follower — a community that banned
+   * them. A refused Follow is answered with a `Reject` (the account exists and is
+   * public, so saying no reveals nothing), and no edge or follow row is written.
+   * Asked after the follower resolves, so the app answers by Oxy id. Absent ⇒
+   * every Follow is accepted, as before.
+   */
+  refusesFollower?(localUserId: string, followerOxyUserId: string): Promise<boolean>;
   /**
    * Best-effort: notify the local user of a newly-accepted inbound follow.
    * NEVER throws (it handles its own errors); a failure must not fail (and thus
@@ -306,6 +321,15 @@ export function createInboundDispatcher(config: InboundDispatcherConfig): Inboun
       return;
     }
 
+    if (config.refusesFollower && (await config.refusesFollower(localUserId, followerOxyUserId))) {
+      if (!config.delivery.sendReject) {
+        throw new Error('refusesFollower is wired without delivery.sendReject');
+      }
+      await config.delivery.sendReject(localUserId, username, String(activity.id), actorUri);
+      logger.info(`Rejected follow from ${actorUri} to ${username}`);
+      return;
+    }
+
     // Create the Oxy follow edge BEFORE sending Accept so a retry never spams
     // Accepts: the bridge is idempotent (safe to re-run), but an Accept delivered
     // before the edge was committed could be re-sent on every retry. On failure

package/src/urls.ts

@@ -31,6 +31,11 @@ export interface UrlBuilders {
   followers(username: string): string;
   /** The actor's following collection. */
   following(username: string): string;
+  /**
+   * A community `Group`'s moderators collection — what its `attributedTo` names
+   * (Lemmy, PieFed and Mbin read the moderators from it).
+   */
+  moderators(username: string): string;
   /** The instance-wide shared inbox. */
   sharedInbox(): string;
 }
@@ -49,6 +54,7 @@ export function createUrlBuilders(domain: string, actorDomain: string = domain):
     featured: (username) => `https://${domain}/ap/users/${username}/collections/featured`,
     followers: (username) => `https://${domain}/ap/users/${username}/followers`,
     following: (username) => `https://${domain}/ap/users/${username}/following`,
+    moderators: (username) => `https://${domain}/ap/users/${username}/moderators`,
     sharedInbox: () => `https://${domain}/ap/inbox`,
   };
 }