@oxy.so/federation 2.7.0 → 2.9.0

package/README.md

@@ -29,3 +29,39 @@ each request. Only whole seconds from 0 through 86400 are accepted. This does
 not change the injected JRD cache: applications must also authorize its reads
 and their user resolver against current policy. It cannot retract documents
 already cached by remote consumers before this setting changes.
+
+## Deleted actors
+
+When a local account is deleted, tell the fediverse once and then answer as
+gone, the way Mastodon handles account deletion:
+
+1. Call `deliveryService.federateActorDelete(oxyUserId, username)` BEFORE
+   deleting the account's accepted follower rows, since they are its
+   recipients. It sends the actor's `Delete` of itself (`<actor>#delete`, a
+   deterministic id, so a retried run does not fan out twice) to each follower
+   shared inbox, signed with the actor's own key. The key must therefore still
+   be signable at send time; Oxy keeps it after the account is gone.
+2. Pass `isActorGone(username)` to `createActorRouter` and
+   `createWebfingerRouter`. It is asked only for a username `resolveUser` found
+   nobody for. True answers `410 Gone` instead of 404 on the actor (with a
+   `Tombstone` body), its inbox, its collections and WebFinger. Mastodon deletes
+   an account whose WebFinger answers 410; Lemmy, PieFed and Mbin mark an actor
+   deleted when a refetch answers 410. A 404 tells none of them anything.
+
+The app's own content routes (outbox, posts) can answer the same way with
+`goneTombstone(id)`.
+
+## Community collections
+
+A local `Group` (an account whose kind is `community`, see
+`isGroupActorKind`) serves its outbox and followers in the shapes Lemmy
+deserializes, because Lemmy and PieFed read neither paging nor `first`:
+
+- **Outbox:** one `OrderedCollection` with its latest `GROUP_OUTBOX_SIZE` (50)
+  `Announce { Create }` activities inline in `orderedItems`. The outbox is an
+  app content route; build it with `groupOutboxCollection`.
+- **Followers:** `createActorRouter` serves a `Collection` with `totalItems` and
+  `items: []`, the count without the list, as Lemmy does
+  (`groupFollowersCollection`).
+
+Every other actor keeps the paged `OrderedCollection` that Mastodon walks.

package/dist/cjs/actorObject.js

@@ -287,11 +287,14 @@ function createLocalActorBuilder(config) {
         // `attributedTo` (Lemmy, PieFed; Mbin reads `moderators`) and says anybody
         // may post into it. PeerTube refuses a `Group` without `attributedTo`, and a
         // `Group` claiming `postingRestrictedToMods` is read as a channel by every
-        // implementation, ours included ({@link accountKindForActor}).
+        // implementation, ours included ({@link accountKindForActor}). `sensitive`
+        // is Lemmy's NSFW flag on a community, sent as Lemmy sends it; an Oxy
+        // community has no NSFW setting.
         if (actorObject.type === exports.LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND.community) {
             actorObject.attributedTo = config.urls.moderators(username);
             actorObject.moderators = config.urls.moderators(username);
             actorObject.postingRestrictedToMods = false;
+            actorObject.sensitive = false;
         }
         const aliases = normalizeAlsoKnownAs(params.alsoKnownAs);
         if (aliases.length > 0) {

package/dist/cjs/groupCollections.js

@@ -0,0 +1,61 @@
+"use strict";
+/**
+ * How a local `Group` (an Oxy community) publishes its outbox and followers:
+ * the shapes Lemmy itself serves and reads back, not the paged
+ * `OrderedCollection` + `first` link every other local actor serves.
+ *
+ * Lemmy deserializes a community's collections into fixed structs that know
+ * nothing of paging (`crates/apub/apub/src/protocol/collections/`):
+ *  - outbox → `GroupOutbox { orderedItems: Vec<Announce> }`, `orderedItems`
+ *    REQUIRED inline. A summary with only `first` fails to parse, so a server
+ *    discovering the community backfills nothing. PieFed reads the same inline
+ *    `orderedItems` and nothing else.
+ *  - followers → `GroupFollowers { type: "Collection", totalItems, items }`,
+ *    read for the subscriber count. Lemmy serves `items: []`, so the follower
+ *    list stays private; this does the same.
+ *
+ * Mastodon reads `totalItems` from either shape, so a `Group` followed from
+ * Mastodon keeps its counts. `Person`, `Organization` and `Service` actors keep
+ * the paged shape Mastodon walks.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GROUP_OUTBOX_SIZE = void 0;
+exports.isGroupActorKind = isGroupActorKind;
+exports.groupOutboxCollection = groupOutboxCollection;
+exports.groupFollowersCollection = groupFollowersCollection;
+const actorObject_1 = require("./actorObject");
+const apContext_1 = require("./apContext");
+/** How many of its latest `Announce`s a `Group`'s outbox lists inline (Lemmy's own size). */
+exports.GROUP_OUTBOX_SIZE = 50;
+/**
+ * Whether a local account of this kind is announced as a `Group`
+ * ({@link LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND}) and so serves the Group
+ * collections: moderators, and the outbox and followers in the shapes above.
+ */
+function isGroupActorKind(kind) {
+    return (0, actorObject_1.localActorTypeForAccountKind)(kind) === actorObject_1.LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND.community;
+}
+/**
+ * A `Group`'s outbox: one unpaged `OrderedCollection` of its latest
+ * `Announce { Create }` activities, newest first. Each item's own `@context` is
+ * dropped; the collection's covers it.
+ */
+function groupOutboxCollection(params) {
+    return {
+        '@context': apContext_1.AP_CONTEXT,
+        id: params.id,
+        type: 'OrderedCollection',
+        totalItems: params.totalItems,
+        orderedItems: params.orderedItems.map(({ '@context': _context, ...item }) => item),
+    };
+}
+/** A `Group`'s followers: the count, and an empty `items` list. */
+function groupFollowersCollection(params) {
+    return {
+        '@context': apContext_1.AP_CONTEXT,
+        id: params.id,
+        type: 'Collection',
+        totalItems: params.totalItems,
+        items: [],
+    };
+}

package/dist/cjs/index.js

@@ -22,7 +22,7 @@
  * knowledge of any app's post shape.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND = exports.AP_ACTOR_TYPES = exports.isApActorType = exports.accountKindForActor = exports.localActorTypeForAccountKind = exports.normalizeAlsoKnownAs = exports.createLocalActorBuilder = exports.createDomainPolicy = exports.extractActorUriFromActivityId = exports.isSameFederationHost = exports.canonicalFederationHost = exports.AP_CONTEXT = exports.readProxyDeclarations = exports.upstreamHandleFromProxyOf = exports.upstreamHandleFromPreferredUsername = exports.upstreamHandleFromAutomatedActor = exports.upstreamHandleFromAlsoKnownAs = exports.upstreamHandleFromProfileField = exports.federatedUsernameFromUpstreamUrl = exports.parseUpstreamProfileUrl = exports.upstreamProfileUrl = exports.stripBridgeBoilerplate = exports.createBridgeRelabeller = exports.blueskyUsernameFromHandle = exports.BSKY_NETWORK_DOMAIN = exports.FEDERATION_NETWORKS = exports.INSTANCE_ACTOR_USERNAME = exports.normalizeActorUsername = exports.createUrlBuilders = exports.DEFAULT_SIGNED_CONTENT_TYPE = exports.HTTP_SIGNATURE_ALGORITHM = exports.verifyHttpSignature = exports.signRequest = void 0;
+exports.groupFollowersCollection = exports.groupOutboxCollection = exports.isGroupActorKind = exports.GROUP_OUTBOX_SIZE = exports.LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND = exports.AP_ACTOR_TYPES = exports.isApActorType = exports.accountKindForActor = exports.localActorTypeForAccountKind = exports.normalizeAlsoKnownAs = exports.createLocalActorBuilder = exports.createDomainPolicy = exports.extractActorUriFromActivityId = exports.isSameFederationHost = exports.canonicalFederationHost = exports.AP_CONTEXT = exports.readProxyDeclarations = exports.upstreamHandleFromProxyOf = exports.upstreamHandleFromPreferredUsername = exports.upstreamHandleFromAutomatedActor = exports.upstreamHandleFromAlsoKnownAs = exports.upstreamHandleFromProfileField = exports.federatedUsernameFromUpstreamUrl = exports.parseUpstreamProfileUrl = exports.upstreamProfileUrl = exports.stripBridgeBoilerplate = exports.createBridgeRelabeller = exports.blueskyUsernameFromHandle = exports.BSKY_NETWORK_DOMAIN = exports.FEDERATION_NETWORKS = exports.INSTANCE_ACTOR_USERNAME = exports.normalizeActorUsername = exports.createUrlBuilders = exports.DEFAULT_SIGNED_CONTENT_TYPE = exports.HTTP_SIGNATURE_ALGORITHM = exports.verifyHttpSignature = exports.signRequest = void 0;
 /**
  * HTTP Signatures (draft-cavage) — the pure sign/verify crypto every Oxy app's
  * ActivityPub federation shares. Private-key custody is injected; the key never
@@ -99,3 +99,12 @@ Object.defineProperty(exports, "accountKindForActor", { enumerable: true, get: f
 Object.defineProperty(exports, "isApActorType", { enumerable: true, get: function () { return actorObject_1.isApActorType; } });
 Object.defineProperty(exports, "AP_ACTOR_TYPES", { enumerable: true, get: function () { return actorObject_1.AP_ACTOR_TYPES; } });
 Object.defineProperty(exports, "LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND", { enumerable: true, get: function () { return actorObject_1.LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND; } });
+/**
+ * A local `Group`'s outbox and followers, in the shapes Lemmy serves and reads
+ * back; every other actor keeps the paged collections.
+ */
+var groupCollections_1 = require("./groupCollections");
+Object.defineProperty(exports, "GROUP_OUTBOX_SIZE", { enumerable: true, get: function () { return groupCollections_1.GROUP_OUTBOX_SIZE; } });
+Object.defineProperty(exports, "isGroupActorKind", { enumerable: true, get: function () { return groupCollections_1.isGroupActorKind; } });
+Object.defineProperty(exports, "groupOutboxCollection", { enumerable: true, get: function () { return groupCollections_1.groupOutboxCollection; } });
+Object.defineProperty(exports, "groupFollowersCollection", { enumerable: true, get: function () { return groupCollections_1.groupFollowersCollection; } });

package/dist/cjs/node/actorRouter.js

@@ -9,7 +9,8 @@
  *    signature verification (Phase 2, `trustForwardedHost`) and actor-match, then
  *    202 + async dispatch to the injected inbound dispatcher,
  *  - `GET /users/:username/followers` + `/following` — the OXY follow graph
- *    (local + bridged federated edges) as paginated `OrderedCollection`s,
+ *    (local + bridged federated edges) as paginated `OrderedCollection`s; a
+ *    community `Group`'s followers are only counted (`groupCollections.ts`),
  *  - `GET /users/:username/moderators` — a community `Group`'s moderators.
  *
  * The CONTENT routes (`outbox`, `featured`, per-post dereference) stay in the app,
@@ -27,7 +28,8 @@ const apContext_1 = require("../apContext");
 const httpCacheControl_1 = require("./httpCacheControl");
 const httpSignature_1 = require("../httpSignature");
 const urls_1 = require("../urls");
-const actorObject_1 = require("../actorObject");
+const groupCollections_1 = require("../groupCollections");
+const goneActor_1 = require("./goneActor");
 /** Page size for the paginated followers/following collections (mirrors the outbox). */
 const FOLLOW_PAGE_SIZE = 20;
 /** Extract the `:username` param safely as a string. */
@@ -64,6 +66,18 @@ function createActorRouter(config) {
     function wantsActivityPub(req) {
         return config.wantsActivityPub(req.headers.accept);
     }
+    /**
+     * The answer for a username nobody resolved to: 410 with the actor's
+     * `Tombstone` when it is a deleted actor, else the usual 404.
+     */
+    async function userMissing(res, username) {
+        if (config.isActorGone && (await config.isActorGone(username))) {
+            res.set('Content-Type', apContentType);
+            res.set('Cache-Control', httpCacheControl);
+            return res.status(410).json((0, goneActor_1.goneTombstone)(urls.actor(username)));
+        }
+        return res.status(404).json({ error: 'User not found' });
+    }
     /** Common inbox handler with HTTP signature verification. */
     async function handleInbox(req, res) {
         try {
@@ -121,7 +135,8 @@ function createActorRouter(config) {
     }
     /**
      * Serve a user's followers OR following as a paginated `OrderedCollection` over
-     * the authoritative Oxy follow graph (local + bridged federated edges).
+     * the authoritative Oxy follow graph (local + bridged federated edges). A
+     * `Group`'s followers are the unpaged, itemless `Collection` Lemmy reads.
      */
     async function serveFollowCollection(req, res, direction, collectionUrl) {
         if (!config.federationEnabled)
@@ -131,14 +146,15 @@ function createActorRouter(config) {
         try {
             const user = await config.resolveUser(username);
             if (!user)
-                return res.status(404).json({ error: 'User not found' });
+                return userMissing(res, username);
             if (!config.consent.isSharingEnabledFromUser(user)) {
                 return res.status(404).json({ error: 'User not found' });
             }
             const userId = String(user._id || user.id);
             const rawCount = direction === 'followers' ? user._count?.followers : user._count?.following;
             const profileTotal = typeof rawCount === 'number' ? rawCount : undefined;
-            if (!page) {
+            const groupFollowers = direction === 'followers' && (0, groupCollections_1.isGroupActorKind)(user.kind);
+            if (!page || groupFollowers) {
                 // Prefer the profile `_count`; only when absent (the rare search fallback)
                 // fetch the authoritative total from a minimal graph list call. Fail-soft
                 // to 0 — never 500 the summary.
@@ -156,6 +172,9 @@ function createActorRouter(config) {
                     }
                 }
                 res.set('Content-Type', apContentType);
+                if (groupFollowers) {
+                    return res.json((0, groupCollections_1.groupFollowersCollection)({ id: collectionUrl(username), totalItems }));
+                }
                 return res.json({
                     '@context': apContext_1.AP_CONTEXT,
                     id: collectionUrl(username),
@@ -251,7 +270,7 @@ function createActorRouter(config) {
             }
             const user = await config.resolveUser(username);
             if (!user)
-                return res.status(404).json({ error: 'User not found' });
+                return userMissing(res, username);
             // Sharing OFF must be indistinguishable from a nonexistent user — same 404
             // body, no separate error code. Derived from the already-resolved user.
             if (!config.consent.isSharingEnabledFromUser(user)) {
@@ -299,9 +318,13 @@ function createActorRouter(config) {
         // server drop it permanently rather than retry, so availability wins over
         // gating freshness — the activity is processed and any consent decision is
         // re-checked downstream by the id-based (fail-open) gates.
+        // A DELETED actor's inbox refuses delivery with 410, so the sender stops
+        // rather than treating it as a transient miss.
         const username = getUsername(req);
         const sharingState = await config.consent.getSharingStateByUsername(username);
-        if (sharingState === 'disabled' || sharingState === 'unknown-user') {
+        if (sharingState === 'unknown-user')
+            return userMissing(res, username);
+        if (sharingState === 'disabled') {
             return res.status(404).json({ error: 'User not found' });
         }
         return handleInbox(req, res);
@@ -327,9 +350,9 @@ function createActorRouter(config) {
             const username = getUsername(req);
             try {
                 const user = await config.resolveUser(username);
-                if (!user ||
-                    !config.consent.isSharingEnabledFromUser(user) ||
-                    (0, actorObject_1.localActorTypeForAccountKind)(user.kind) !== actorObject_1.LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND.community) {
+                if (!user)
+                    return userMissing(res, username);
+                if (!config.consent.isSharingEnabledFromUser(user) || !(0, groupCollections_1.isGroupActorKind)(user.kind)) {
                     return res.status(404).json({ error: 'User not found' });
                 }
                 const moderators = await fetchModerators(String(user._id || user.id));

package/dist/cjs/node/delivery.js

@@ -30,6 +30,7 @@ exports.createDeliveryService = createDeliveryService;
 const apContext_1 = require("../apContext");
 const boundedBody_1 = require("./boundedBody");
 const httpSignature_1 = require("../httpSignature");
+const goneActor_1 = require("./goneActor");
 /** Total time budget for a single delivery POST (connect + response headers). */
 const DELIVER_ACTIVITY_TIMEOUT_MS = 15000;
 /** How many bytes of a failed-delivery response body are read for the debug log. */
@@ -439,6 +440,11 @@ function createDeliveryService(config) {
             logger.error('Failed to federate actor update:', err);
         }
     }
+    async function federateActorDelete(actorOxyUserId, username) {
+        if (!config.federationEnabled)
+            return;
+        await deliverToFollowers((0, goneActor_1.buildActorDeleteActivity)(urls.actor(username)), actorOxyUserId, username);
+    }
     return {
         deliverActivity,
         queueDelivery,
@@ -449,5 +455,6 @@ function createDeliveryService(config) {
         sendAccept,
         sendReject,
         federateActorUpdate,
+        federateActorDelete,
     };
 }

package/dist/cjs/node/goneActor.js

@@ -0,0 +1,43 @@
+"use strict";
+/**
+ * A DELETED local actor, as the fediverse is told about it.
+ *
+ * Two halves, following Mastodon's account deletion:
+ *
+ *  1. Once, the app sends `Delete{actor}`: the actor deletes itself, signed with
+ *     its own key, to every follower's (shared) inbox. That is
+ *     `DeliveryService.federateActorDelete`, built by {@link buildActorDeleteActivity}.
+ *  2. From then on the actor's URLs answer `410 Gone` instead of `404`. That is
+ *     what a server that missed the Delete, or never acts on one, reads as
+ *     permanent: Mastodon deletes its copy of an account whose WebFinger answers
+ *     410, and Lemmy, PieFed and Mbin mark a community or person deleted when a
+ *     refetch answers 410 or a `Tombstone`. A 404 tells all of them nothing, so
+ *     they keep the ghost profile and keep delivering to it.
+ *
+ * The routers ask the app's `isActorGone(username)` only after `resolveUser`
+ * found nobody, so a live account is never answered as gone.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.goneTombstone = goneTombstone;
+exports.buildActorDeleteActivity = buildActorDeleteActivity;
+const apContext_1 = require("../apContext");
+/** The body of a `410 Gone` for a deleted object: a bare `Tombstone` naming it. */
+function goneTombstone(id) {
+    return { '@context': apContext_1.AP_CONTEXT, id, type: 'Tombstone' };
+}
+/**
+ * The actor's `Delete` of itself. The id is DETERMINISTIC (no timestamp), the
+ * shape Mastodon sends (`<actor>#delete`), so a retried run re-sends the same
+ * activity and a delivery queue that dedupes on activity id + inbox sends each
+ * inbox one copy.
+ */
+function buildActorDeleteActivity(actorUri) {
+    return {
+        '@context': apContext_1.AP_CONTEXT,
+        id: `${actorUri}#delete`,
+        type: 'Delete',
+        actor: actorUri,
+        to: ['https://www.w3.org/ns/activitystreams#Public'],
+        object: actorUri,
+    };
+}

package/dist/cjs/node/index.js

@@ -18,7 +18,7 @@
  * actor + inbox + follow-graph Express routers.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createActorRouter = exports.createWebfingerRouter = exports.ActorResolutionPendingError = exports.createInboundDispatcher = exports.DeliveryAuthorizationDeniedError = exports.createDeliveryService = exports.ActorResolver = exports.createActorResolver = exports.createIdentityBridge = exports.createTcoLinkExpander = exports.createSignedFetch = void 0;
+exports.createActorRouter = exports.goneTombstone = exports.buildActorDeleteActivity = exports.createWebfingerRouter = exports.ActorResolutionPendingError = exports.createInboundDispatcher = exports.DeliveryAuthorizationDeniedError = exports.createDeliveryService = exports.ActorResolver = exports.createActorResolver = exports.createIdentityBridge = exports.createTcoLinkExpander = exports.createSignedFetch = void 0;
 var signedFetch_1 = require("./signedFetch");
 Object.defineProperty(exports, "createSignedFetch", { enumerable: true, get: function () { return signedFetch_1.createSignedFetch; } });
 /**
@@ -66,5 +66,12 @@ Object.defineProperty(exports, "createWebfingerRouter", { enumerable: true, get:
  * The ActivityPub actor + inbox + follow-graph router (actor GET incl. the
  * `instance` actor, inbox POST with HTTP-sig verify, followers/following pages).
  */
+/**
+ * A deleted local actor: its `Delete` of itself, and the `Tombstone` its URLs
+ * answer `410 Gone` with afterwards.
+ */
+var goneActor_1 = require("./goneActor");
+Object.defineProperty(exports, "buildActorDeleteActivity", { enumerable: true, get: function () { return goneActor_1.buildActorDeleteActivity; } });
+Object.defineProperty(exports, "goneTombstone", { enumerable: true, get: function () { return goneActor_1.goneTombstone; } });
 var actorRouter_1 = require("./actorRouter");
 Object.defineProperty(exports, "createActorRouter", { enumerable: true, get: function () { return actorRouter_1.createActorRouter; } });

package/dist/cjs/node/webfingerRouter.js

@@ -90,8 +90,13 @@ function createWebfingerRouter(config) {
                 return res.json(cached);
             }
             const user = await config.resolveUser(username);
-            if (!user)
+            if (!user) {
+                if (config.isActorGone && (await config.isActorGone(username))) {
+                    res.set('Cache-Control', httpCacheControl);
+                    return res.status(410).json({ error: 'User deleted' });
+                }
                 return res.status(404).json({ error: 'User not found' });
+            }
             // Sharing OFF must be indistinguishable from a nonexistent user — same 404
             // body, no separate error code. UNLIKE the other user-scoped surfaces,
             // webfinger does a SECOND, uncached consent read here rather than reusing

package/dist/esm/actorObject.js

@@ -279,11 +279,14 @@ export function createLocalActorBuilder(config) {
         // `attributedTo` (Lemmy, PieFed; Mbin reads `moderators`) and says anybody
         // may post into it. PeerTube refuses a `Group` without `attributedTo`, and a
         // `Group` claiming `postingRestrictedToMods` is read as a channel by every
-        // implementation, ours included ({@link accountKindForActor}).
+        // implementation, ours included ({@link accountKindForActor}). `sensitive`
+        // is Lemmy's NSFW flag on a community, sent as Lemmy sends it; an Oxy
+        // community has no NSFW setting.
         if (actorObject.type === LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND.community) {
             actorObject.attributedTo = config.urls.moderators(username);
             actorObject.moderators = config.urls.moderators(username);
             actorObject.postingRestrictedToMods = false;
+            actorObject.sensitive = false;
         }
         const aliases = normalizeAlsoKnownAs(params.alsoKnownAs);
         if (aliases.length > 0) {

package/dist/esm/groupCollections.js

@@ -0,0 +1,55 @@
+/**
+ * How a local `Group` (an Oxy community) publishes its outbox and followers:
+ * the shapes Lemmy itself serves and reads back, not the paged
+ * `OrderedCollection` + `first` link every other local actor serves.
+ *
+ * Lemmy deserializes a community's collections into fixed structs that know
+ * nothing of paging (`crates/apub/apub/src/protocol/collections/`):
+ *  - outbox → `GroupOutbox { orderedItems: Vec<Announce> }`, `orderedItems`
+ *    REQUIRED inline. A summary with only `first` fails to parse, so a server
+ *    discovering the community backfills nothing. PieFed reads the same inline
+ *    `orderedItems` and nothing else.
+ *  - followers → `GroupFollowers { type: "Collection", totalItems, items }`,
+ *    read for the subscriber count. Lemmy serves `items: []`, so the follower
+ *    list stays private; this does the same.
+ *
+ * Mastodon reads `totalItems` from either shape, so a `Group` followed from
+ * Mastodon keeps its counts. `Person`, `Organization` and `Service` actors keep
+ * the paged shape Mastodon walks.
+ */
+import { LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND, localActorTypeForAccountKind } from './actorObject.js';
+import { AP_CONTEXT } from './apContext.js';
+/** How many of its latest `Announce`s a `Group`'s outbox lists inline (Lemmy's own size). */
+export const GROUP_OUTBOX_SIZE = 50;
+/**
+ * Whether a local account of this kind is announced as a `Group`
+ * ({@link LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND}) and so serves the Group
+ * collections: moderators, and the outbox and followers in the shapes above.
+ */
+export function isGroupActorKind(kind) {
+    return localActorTypeForAccountKind(kind) === LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND.community;
+}
+/**
+ * A `Group`'s outbox: one unpaged `OrderedCollection` of its latest
+ * `Announce { Create }` activities, newest first. Each item's own `@context` is
+ * dropped; the collection's covers it.
+ */
+export function groupOutboxCollection(params) {
+    return {
+        '@context': AP_CONTEXT,
+        id: params.id,
+        type: 'OrderedCollection',
+        totalItems: params.totalItems,
+        orderedItems: params.orderedItems.map(({ '@context': _context, ...item }) => item),
+    };
+}
+/** A `Group`'s followers: the count, and an empty `items` list. */
+export function groupFollowersCollection(params) {
+    return {
+        '@context': AP_CONTEXT,
+        id: params.id,
+        type: 'Collection',
+        totalItems: params.totalItems,
+        items: [],
+    };
+}

package/dist/esm/index.js

@@ -63,3 +63,8 @@ export { canonicalFederationHost, isSameFederationHost, extractActorUriFromActiv
  * follows the Oxy account kind ({@link LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND}).
  */
 export { createLocalActorBuilder, normalizeAlsoKnownAs, localActorTypeForAccountKind, accountKindForActor, isApActorType, AP_ACTOR_TYPES, LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND, } from './actorObject.js';
+/**
+ * A local `Group`'s outbox and followers, in the shapes Lemmy serves and reads
+ * back; every other actor keeps the paged collections.
+ */
+export { GROUP_OUTBOX_SIZE, isGroupActorKind, groupOutboxCollection, groupFollowersCollection, } from './groupCollections.js';

package/dist/esm/node/actorRouter.js

@@ -8,7 +8,8 @@
  *    signature verification (Phase 2, `trustForwardedHost`) and actor-match, then
  *    202 + async dispatch to the injected inbound dispatcher,
  *  - `GET /users/:username/followers` + `/following` — the OXY follow graph
- *    (local + bridged federated edges) as paginated `OrderedCollection`s,
+ *    (local + bridged federated edges) as paginated `OrderedCollection`s; a
+ *    community `Group`'s followers are only counted (`groupCollections.ts`),
  *  - `GET /users/:username/moderators` — a community `Group`'s moderators.
  *
  * The CONTENT routes (`outbox`, `featured`, per-post dereference) stay in the app,
@@ -24,7 +25,8 @@ import { AP_CONTEXT } from '../apContext.js';
 import { discoveryCacheControl } from './httpCacheControl.js';
 import { verifyHttpSignature } from '../httpSignature.js';
 import { INSTANCE_ACTOR_USERNAME, normalizeActorUsername } from '../urls.js';
-import { LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND, localActorTypeForAccountKind, } from '../actorObject.js';
+import { groupFollowersCollection, isGroupActorKind } from '../groupCollections.js';
+import { goneTombstone } from './goneActor.js';
 /** Page size for the paginated followers/following collections (mirrors the outbox). */
 const FOLLOW_PAGE_SIZE = 20;
 /** Extract the `:username` param safely as a string. */
@@ -61,6 +63,18 @@ export function createActorRouter(config) {
     function wantsActivityPub(req) {
         return config.wantsActivityPub(req.headers.accept);
     }
+    /**
+     * The answer for a username nobody resolved to: 410 with the actor's
+     * `Tombstone` when it is a deleted actor, else the usual 404.
+     */
+    async function userMissing(res, username) {
+        if (config.isActorGone && (await config.isActorGone(username))) {
+            res.set('Content-Type', apContentType);
+            res.set('Cache-Control', httpCacheControl);
+            return res.status(410).json(goneTombstone(urls.actor(username)));
+        }
+        return res.status(404).json({ error: 'User not found' });
+    }
     /** Common inbox handler with HTTP signature verification. */
     async function handleInbox(req, res) {
         try {
@@ -118,7 +132,8 @@ export function createActorRouter(config) {
     }
     /**
      * Serve a user's followers OR following as a paginated `OrderedCollection` over
-     * the authoritative Oxy follow graph (local + bridged federated edges).
+     * the authoritative Oxy follow graph (local + bridged federated edges). A
+     * `Group`'s followers are the unpaged, itemless `Collection` Lemmy reads.
      */
     async function serveFollowCollection(req, res, direction, collectionUrl) {
         if (!config.federationEnabled)
@@ -128,14 +143,15 @@ export function createActorRouter(config) {
         try {
             const user = await config.resolveUser(username);
             if (!user)
-                return res.status(404).json({ error: 'User not found' });
+                return userMissing(res, username);
             if (!config.consent.isSharingEnabledFromUser(user)) {
                 return res.status(404).json({ error: 'User not found' });
             }
             const userId = String(user._id || user.id);
             const rawCount = direction === 'followers' ? user._count?.followers : user._count?.following;
             const profileTotal = typeof rawCount === 'number' ? rawCount : undefined;
-            if (!page) {
+            const groupFollowers = direction === 'followers' && isGroupActorKind(user.kind);
+            if (!page || groupFollowers) {
                 // Prefer the profile `_count`; only when absent (the rare search fallback)
                 // fetch the authoritative total from a minimal graph list call. Fail-soft
                 // to 0 — never 500 the summary.
@@ -153,6 +169,9 @@ export function createActorRouter(config) {
                     }
                 }
                 res.set('Content-Type', apContentType);
+                if (groupFollowers) {
+                    return res.json(groupFollowersCollection({ id: collectionUrl(username), totalItems }));
+                }
                 return res.json({
                     '@context': AP_CONTEXT,
                     id: collectionUrl(username),
@@ -248,7 +267,7 @@ export function createActorRouter(config) {
             }
             const user = await config.resolveUser(username);
             if (!user)
-                return res.status(404).json({ error: 'User not found' });
+                return userMissing(res, username);
             // Sharing OFF must be indistinguishable from a nonexistent user — same 404
             // body, no separate error code. Derived from the already-resolved user.
             if (!config.consent.isSharingEnabledFromUser(user)) {
@@ -296,9 +315,13 @@ export function createActorRouter(config) {
         // server drop it permanently rather than retry, so availability wins over
         // gating freshness — the activity is processed and any consent decision is
         // re-checked downstream by the id-based (fail-open) gates.
+        // A DELETED actor's inbox refuses delivery with 410, so the sender stops
+        // rather than treating it as a transient miss.
         const username = getUsername(req);
         const sharingState = await config.consent.getSharingStateByUsername(username);
-        if (sharingState === 'disabled' || sharingState === 'unknown-user') {
+        if (sharingState === 'unknown-user')
+            return userMissing(res, username);
+        if (sharingState === 'disabled') {
             return res.status(404).json({ error: 'User not found' });
         }
         return handleInbox(req, res);
@@ -324,9 +347,9 @@ export function createActorRouter(config) {
             const username = getUsername(req);
             try {
                 const user = await config.resolveUser(username);
-                if (!user ||
-                    !config.consent.isSharingEnabledFromUser(user) ||
-                    localActorTypeForAccountKind(user.kind) !== LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND.community) {
+                if (!user)
+                    return userMissing(res, username);
+                if (!config.consent.isSharingEnabledFromUser(user) || !isGroupActorKind(user.kind)) {
                     return res.status(404).json({ error: 'User not found' });
                 }
                 const moderators = await fetchModerators(String(user._id || user.id));

package/dist/esm/node/delivery.js

@@ -26,6 +26,7 @@
 import { AP_CONTEXT } from '../apContext.js';
 import { readBodyChunks } from './boundedBody.js';
 import { signRequest } from '../httpSignature.js';
+import { buildActorDeleteActivity } from './goneActor.js';
 /** Total time budget for a single delivery POST (connect + response headers). */
 const DELIVER_ACTIVITY_TIMEOUT_MS = 15000;
 /** How many bytes of a failed-delivery response body are read for the debug log. */
@@ -434,6 +435,11 @@ export function createDeliveryService(config) {
             logger.error('Failed to federate actor update:', err);
         }
     }
+    async function federateActorDelete(actorOxyUserId, username) {
+        if (!config.federationEnabled)
+            return;
+        await deliverToFollowers(buildActorDeleteActivity(urls.actor(username)), actorOxyUserId, username);
+    }
     return {
         deliverActivity,
         queueDelivery,
@@ -444,5 +450,6 @@ export function createDeliveryService(config) {
         sendAccept,
         sendReject,
         federateActorUpdate,
+        federateActorDelete,
     };
 }

package/dist/esm/node/goneActor.js

@@ -0,0 +1,39 @@
+/**
+ * A DELETED local actor, as the fediverse is told about it.
+ *
+ * Two halves, following Mastodon's account deletion:
+ *
+ *  1. Once, the app sends `Delete{actor}`: the actor deletes itself, signed with
+ *     its own key, to every follower's (shared) inbox. That is
+ *     `DeliveryService.federateActorDelete`, built by {@link buildActorDeleteActivity}.
+ *  2. From then on the actor's URLs answer `410 Gone` instead of `404`. That is
+ *     what a server that missed the Delete, or never acts on one, reads as
+ *     permanent: Mastodon deletes its copy of an account whose WebFinger answers
+ *     410, and Lemmy, PieFed and Mbin mark a community or person deleted when a
+ *     refetch answers 410 or a `Tombstone`. A 404 tells all of them nothing, so
+ *     they keep the ghost profile and keep delivering to it.
+ *
+ * The routers ask the app's `isActorGone(username)` only after `resolveUser`
+ * found nobody, so a live account is never answered as gone.
+ */
+import { AP_CONTEXT } from '../apContext.js';
+/** The body of a `410 Gone` for a deleted object: a bare `Tombstone` naming it. */
+export function goneTombstone(id) {
+    return { '@context': AP_CONTEXT, id, type: 'Tombstone' };
+}
+/**
+ * The actor's `Delete` of itself. The id is DETERMINISTIC (no timestamp), the
+ * shape Mastodon sends (`<actor>#delete`), so a retried run re-sends the same
+ * activity and a delivery queue that dedupes on activity id + inbox sends each
+ * inbox one copy.
+ */
+export function buildActorDeleteActivity(actorUri) {
+    return {
+        '@context': AP_CONTEXT,
+        id: `${actorUri}#delete`,
+        type: 'Delete',
+        actor: actorUri,
+        to: ['https://www.w3.org/ns/activitystreams#Public'],
+        object: actorUri,
+    };
+}

package/dist/esm/node/index.js

@@ -53,4 +53,9 @@ export { createWebfingerRouter, } from './webfingerRouter.js';
  * The ActivityPub actor + inbox + follow-graph router (actor GET incl. the
  * `instance` actor, inbox POST with HTTP-sig verify, followers/following pages).
  */
+/**
+ * A deleted local actor: its `Delete` of itself, and the `Tombstone` its URLs
+ * answer `410 Gone` with afterwards.
+ */
+export { buildActorDeleteActivity, goneTombstone } from './goneActor.js';
 export { createActorRouter, } from './actorRouter.js';