@oxy.so/federation 2.7.0 → 2.9.0

package/dist/esm/node/webfingerRouter.js

@@ -87,8 +87,13 @@ export function createWebfingerRouter(config) {
                 return res.json(cached);
             }
             const user = await config.resolveUser(username);
-            if (!user)
+            if (!user) {
+                if (config.isActorGone && (await config.isActorGone(username))) {
+                    res.set('Cache-Control', httpCacheControl);
+                    return res.status(410).json({ error: 'User deleted' });
+                }
                 return res.status(404).json({ error: 'User not found' });
+            }
             // Sharing OFF must be indistinguishable from a nonexistent user — same 404
             // body, no separate error code. UNLIKE the other user-scoped surfaces,
             // webfinger does a SECOND, uncached consent read here rather than reusing

package/dist/types/groupCollections.d.ts

@@ -0,0 +1,42 @@
+/**
+ * How a local `Group` (an Oxy community) publishes its outbox and followers:
+ * the shapes Lemmy itself serves and reads back, not the paged
+ * `OrderedCollection` + `first` link every other local actor serves.
+ *
+ * Lemmy deserializes a community's collections into fixed structs that know
+ * nothing of paging (`crates/apub/apub/src/protocol/collections/`):
+ *  - outbox → `GroupOutbox { orderedItems: Vec<Announce> }`, `orderedItems`
+ *    REQUIRED inline. A summary with only `first` fails to parse, so a server
+ *    discovering the community backfills nothing. PieFed reads the same inline
+ *    `orderedItems` and nothing else.
+ *  - followers → `GroupFollowers { type: "Collection", totalItems, items }`,
+ *    read for the subscriber count. Lemmy serves `items: []`, so the follower
+ *    list stays private; this does the same.
+ *
+ * Mastodon reads `totalItems` from either shape, so a `Group` followed from
+ * Mastodon keeps its counts. `Person`, `Organization` and `Service` actors keep
+ * the paged shape Mastodon walks.
+ */
+/** How many of its latest `Announce`s a `Group`'s outbox lists inline (Lemmy's own size). */
+export declare const GROUP_OUTBOX_SIZE = 50;
+/**
+ * Whether a local account of this kind is announced as a `Group`
+ * ({@link LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND}) and so serves the Group
+ * collections: moderators, and the outbox and followers in the shapes above.
+ */
+export declare function isGroupActorKind(kind: unknown): boolean;
+/**
+ * A `Group`'s outbox: one unpaged `OrderedCollection` of its latest
+ * `Announce { Create }` activities, newest first. Each item's own `@context` is
+ * dropped; the collection's covers it.
+ */
+export declare function groupOutboxCollection(params: {
+    id: string;
+    totalItems: number;
+    orderedItems: readonly Record<string, unknown>[];
+}): Record<string, unknown>;
+/** A `Group`'s followers: the count, and an empty `items` list. */
+export declare function groupFollowersCollection(params: {
+    id: string;
+    totalItems: number;
+}): Record<string, unknown>;

package/dist/types/index.d.ts

@@ -63,6 +63,11 @@ export { canonicalFederationHost, isSameFederationHost, extractActorUriFromActiv
  * follows the Oxy account kind ({@link LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND}).
  */
 export { createLocalActorBuilder, normalizeAlsoKnownAs, localActorTypeForAccountKind, accountKindForActor, type ActorKindSignals, isApActorType, AP_ACTOR_TYPES, LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND, type ApActorType, type LocalActorType, type LocalActorBuilder, type LocalActorBuilderConfig, type BuildLocalActorParams, type ActorMediaResolver, } from './actorObject';
+/**
+ * A local `Group`'s outbox and followers, in the shapes Lemmy serves and reads
+ * back; every other actor keeps the paged collections.
+ */
+export { GROUP_OUTBOX_SIZE, isGroupActorKind, groupOutboxCollection, groupFollowersCollection, } from './groupCollections';
 /**
  * Supported external networks, keyed by the transport a connector speaks.
  * `instagram-graph` is Meta's Graph API Business Discovery: a read-only

package/dist/types/node/actorRouter.d.ts

@@ -8,7 +8,8 @@
  *    signature verification (Phase 2, `trustForwardedHost`) and actor-match, then
  *    202 + async dispatch to the injected inbound dispatcher,
  *  - `GET /users/:username/followers` + `/following` — the OXY follow graph
- *    (local + bridged federated edges) as paginated `OrderedCollection`s,
+ *    (local + bridged federated edges) as paginated `OrderedCollection`s; a
+ *    community `Group`'s followers are only counted (`groupCollections.ts`),
  *  - `GET /users/:username/moderators` — a community `Group`'s moderators.
  *
  * The CONTENT routes (`outbox`, `featured`, per-post dereference) stay in the app,
@@ -23,7 +24,8 @@ import { Router } from 'express';
 import type { AccountKind } from '@oxy.so/contracts';
 import type { User } from '@oxy.so/core';
 import type { UrlBuilders } from '../urls';
-import { type LocalActorBuilder } from '../actorObject';
+import type { LocalActorBuilder } from '../actorObject';
+import { type IsActorGone } from './goneActor';
 /** The resolved-user fields the actor + collection routes read. */
 export interface ActorRouteUser {
     _id?: string | null;
@@ -114,6 +116,13 @@ export interface ActorRouterConfig {
      * the route is not mounted; any account that is not a community 404s.
      */
     fetchModerators?(userId: string): Promise<User[]>;
+    /**
+     * Whether a username that resolved to nobody names a DELETED local actor
+     * (`goneActor.ts`). True ⇒ the actor, its inbox and its collections answer
+     * `410 Gone` (the actor with a `Tombstone`) instead of 404. Omitted ⇒ every
+     * miss is a 404.
+     */
+    isActorGone?: IsActorGone;
     /** Actor HTTP response TTL in whole seconds, 0..86400. Defaults to 1800; 0 sends no-store. */
     httpCacheTtlSeconds?: number;
     /** Diagnostics sink. */

package/dist/types/node/delivery.d.ts

@@ -270,6 +270,15 @@ export interface DeliveryService {
     sendReject(localOxyUserId: string, localUsername: string, followActivityId: string, remoteActorUri: string): Promise<void>;
     /** Rebroadcast the FULL actor document as an Update(Person) to remote followers. */
     federateActorUpdate(actorOxyUserId: string, username: string): Promise<void>;
+    /**
+     * Tell every remote follower the actor is gone: its `Delete` of itself
+     * (`goneActor.ts`), one per (shared) inbox, signed with its own key. Needs the
+     * accepted follower rows, so call it BEFORE deleting them. Asks no consent and
+     * resolves no profile, since the account is already gone at its identity
+     * provider; it needs only the handle and the key the handle addresses. Throws
+     * when it cannot queue, so the caller's job retries.
+     */
+    federateActorDelete(actorOxyUserId: string, username: string): Promise<void>;
 }
 /** Build the outbound delivery + follow-lifecycle service from an app's adapters. */
 export declare function createDeliveryService<TActor extends DeliveryActorFields>(config: DeliveryServiceConfig<TActor>): DeliveryService;

package/dist/types/node/goneActor.d.ts

@@ -0,0 +1,29 @@
+/**
+ * A DELETED local actor, as the fediverse is told about it.
+ *
+ * Two halves, following Mastodon's account deletion:
+ *
+ *  1. Once, the app sends `Delete{actor}`: the actor deletes itself, signed with
+ *     its own key, to every follower's (shared) inbox. That is
+ *     `DeliveryService.federateActorDelete`, built by {@link buildActorDeleteActivity}.
+ *  2. From then on the actor's URLs answer `410 Gone` instead of `404`. That is
+ *     what a server that missed the Delete, or never acts on one, reads as
+ *     permanent: Mastodon deletes its copy of an account whose WebFinger answers
+ *     410, and Lemmy, PieFed and Mbin mark a community or person deleted when a
+ *     refetch answers 410 or a `Tombstone`. A 404 tells all of them nothing, so
+ *     they keep the ghost profile and keep delivering to it.
+ *
+ * The routers ask the app's `isActorGone(username)` only after `resolveUser`
+ * found nobody, so a live account is never answered as gone.
+ */
+/** Does `username` name a local actor that was deleted? Asked only for a username that resolved to nobody. */
+export type IsActorGone = (username: string) => Promise<boolean>;
+/** The body of a `410 Gone` for a deleted object: a bare `Tombstone` naming it. */
+export declare function goneTombstone(id: string): Record<string, unknown>;
+/**
+ * The actor's `Delete` of itself. The id is DETERMINISTIC (no timestamp), the
+ * shape Mastodon sends (`<actor>#delete`), so a retried run re-sends the same
+ * activity and a delivery queue that dedupes on activity id + inbox sends each
+ * inbox one copy.
+ */
+export declare function buildActorDeleteActivity(actorUri: string): Record<string, unknown>;

package/dist/types/node/index.d.ts

@@ -53,4 +53,9 @@ export { createWebfingerRouter, type WebfingerRouterConfig, type WebfingerSharin
  * The ActivityPub actor + inbox + follow-graph router (actor GET incl. the
  * `instance` actor, inbox POST with HTTP-sig verify, followers/following pages).
  */
+/**
+ * A deleted local actor: its `Delete` of itself, and the `Tombstone` its URLs
+ * answer `410 Gone` with afterwards.
+ */
+export { buildActorDeleteActivity, goneTombstone, type IsActorGone } from './goneActor';
 export { createActorRouter, type ActorRouterConfig, type ActorRouteUser, type ActorSharingState, type ActorRouterLogger, type FollowPage, } from './actorRouter';

package/dist/types/node/webfingerRouter.d.ts

@@ -13,6 +13,7 @@
  */
 import { Router } from 'express';
 import type { UrlBuilders } from '../urls';
+import type { IsActorGone } from './goneActor';
 /** The tri-state consent read for a username with no already-resolved user object. */
 export type WebfingerSharingState = 'enabled' | 'disabled' | 'unknown-user' | 'unavailable';
 /** The resolved-user fields the webfinger consent fallback reads. */
@@ -55,6 +56,12 @@ export interface WebfingerRouterConfig {
         get(username: string): Promise<WebfingerJrd | null>;
         set(username: string, jrd: WebfingerJrd): void;
     };
+    /**
+     * Whether a username that resolved to nobody names a DELETED local actor
+     * (`goneActor.ts`). True ⇒ `410 Gone` instead of 404, which is what makes
+     * Mastodon delete its copy of the account. Omitted ⇒ every miss is a 404.
+     */
+    isActorGone?: IsActorGone;
     /** HTTP response TTL in whole seconds, 0..86400. Defaults to 3600; 0 sends no-store. */
     httpCacheTtlSeconds?: number;
     /** Diagnostics sink. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/federation",
-  "version": "2.7.0",
+  "version": "2.9.0",
   "description": "Oxy Federation — the app-agnostic ActivityPub identity + follow engine substrate: the network-connector contract, normalized cross-network DTOs, HTTP signatures, actor resolution, the outbound delivery transport + follow lifecycle, the inbound dispatcher, and the webfinger/actor/inbox Express routers. Domain-parameterized so every Oxy app backend federates under its own domain.",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/__tests__/actorObject.test.ts

@@ -222,6 +222,7 @@ describe('actor type by Oxy account kind', () => {
     expect(community.attributedTo).toBe('https://mention.earth/ap/users/nate/moderators');
     expect(community.moderators).toBe(community.attributedTo);
     expect(community.postingRestrictedToMods).toBe(false);
+    expect(community.sensitive).toBe(false);
     // Read back by the same table: an open Group is a community, not a channel.
     expect(accountKindForActor(community)).toBe('community');
     const person = buildActor(PARAMS);

package/src/__tests__/delivery.test.ts

@@ -471,6 +471,29 @@ describe('federateActorUpdate', () => {
   });
 });
 
+describe('federateActorDelete', () => {
+  it("sends the actor's own Delete, once per shared inbox, with no consent or profile read", async () => {
+    const shared = 'https://shared.example/inbox';
+    const rig = makeRig({
+      sharingEnabled: false,
+      followerActorUris: ['a', 'b'],
+      followerInboxes: { a: { sharedInboxUrl: shared }, b: { sharedInboxUrl: shared } },
+    });
+
+    await rig.service.federateActorDelete('u-alice', 'alice');
+
+    expect(rig.enqueued).toHaveLength(1);
+    expect(rig.enqueued[0].activityJson).toEqual({
+      '@context': AP_CONTEXT,
+      id: `${urls.actor('alice')}#delete`,
+      type: 'Delete',
+      actor: urls.actor('alice'),
+      to: ['https://www.w3.org/ns/activitystreams#Public'],
+      object: urls.actor('alice'),
+    });
+  });
+});
+
 describe('live delivery authorization', () => {
   const activity = {
     type: 'Create',

package/src/__tests__/routers.test.ts

@@ -6,6 +6,8 @@ import { createInboundDispatcher } from '../node/inboundDispatch';
 import { createWebfingerRouter, type WebfingerRouterConfig } from '../node/webfingerRouter';
 import { createActorRouter, type ActorRouterConfig } from '../node/actorRouter';
 import { createUrlBuilders } from '../urls';
+import { AP_CONTEXT } from '../apContext';
+import { groupOutboxCollection } from '../groupCollections';
 import { signRequest, type HttpSignatureSigner } from '../httpSignature';
 
 /**
@@ -210,6 +212,16 @@ describe('webfinger router', () => {
     expect(res.body.links[0].href).toBe(urls.actor('alice'));
   });
 
+  it('answers 410 for a deleted actor, and still 404 for an unknown one', async () => {
+    const app = makeWebfingerApp({ isActorGone: async (username) => username === 'gone' });
+    const gone = await request(app).get('/.well-known/webfinger?resource=acct:gone@mention.earth');
+    expect(gone.status).toBe(410);
+    const unknown = await request(app).get(
+      '/.well-known/webfinger?resource=acct:ghost@mention.earth',
+    );
+    expect(unknown.status).toBe(404);
+  });
+
   it('404s a sharing-disabled user indistinguishably', async () => {
     const app = makeWebfingerApp({
       consent: {
@@ -589,6 +601,35 @@ describe('actor router — inbox POST', () => {
   });
 });
 
+describe('actor router — a deleted actor', () => {
+  it('answers 410 with a Tombstone on the actor, its inbox and collections; an unknown user stays 404', async () => {
+    const app = makeActorApp({
+      actorConfig: { isActorGone: async (username) => username === 'gone' },
+    });
+    const actor = await request(app)
+      .get('/ap/users/gone')
+      .set('Accept', 'application/activity+json');
+    expect(actor.status).toBe(410);
+    expect(actor.body).toMatchObject({ id: urls.actor('gone'), type: 'Tombstone' });
+
+    const inbox = await request(app)
+      .post('/ap/users/gone/inbox')
+      .set('Content-Type', 'application/activity+json')
+      .send({ type: 'Follow' });
+    expect(inbox.status).toBe(410);
+
+    const followers = await request(app)
+      .get('/ap/users/gone/followers')
+      .set('Accept', 'application/activity+json');
+    expect(followers.status).toBe(410);
+
+    const unknown = await request(app)
+      .get('/ap/users/ghost')
+      .set('Accept', 'application/activity+json');
+    expect(unknown.status).toBe(404);
+  });
+});
+
 describe('community moderators collection', () => {
   const moderatorsApp = () =>
     makeActorApp({
@@ -629,4 +670,35 @@ describe('community moderators collection', () => {
     const res = await request(moderatorsApp()).get('/ap/users/alice/moderators');
     expect(res.status).toBe(404);
   });
+
+  // Lemmy's `GroupFollowers { type: Collection, totalItems, items }` and
+  // `GroupOutbox { type: OrderedCollection, totalItems, orderedItems }`: no
+  // paging, items inline. A Person keeps the paged shape Mastodon walks.
+  it("serves a Group's followers and outbox in the shapes Lemmy deserializes", async () => {
+    const followers = await request(moderatorsApp()).get('/ap/users/forum/followers?page=true');
+    expect(followers.body).toEqual({
+      '@context': AP_CONTEXT,
+      id: urls.followers('forum'),
+      type: 'Collection',
+      totalItems: 3,
+      items: [],
+    });
+    const announce = { id: `${urls.actor('forum')}/relays/1`, type: 'Announce' };
+    expect(
+      groupOutboxCollection({
+        id: urls.outbox('forum'),
+        totalItems: 1,
+        orderedItems: [{ '@context': AP_CONTEXT, ...announce }],
+      }),
+    ).toEqual({
+      '@context': AP_CONTEXT,
+      id: urls.outbox('forum'),
+      type: 'OrderedCollection',
+      totalItems: 1,
+      orderedItems: [announce],
+    });
+
+    const person = await request(moderatorsApp()).get('/ap/users/alice/followers');
+    expect(person.body).toMatchObject({ type: 'OrderedCollection', first: expect.any(String) });
+  });
 });

package/src/actorObject.ts

@@ -400,11 +400,14 @@ export function createLocalActorBuilder(config: LocalActorBuilderConfig): LocalA
     // `attributedTo` (Lemmy, PieFed; Mbin reads `moderators`) and says anybody
     // may post into it. PeerTube refuses a `Group` without `attributedTo`, and a
     // `Group` claiming `postingRestrictedToMods` is read as a channel by every
-    // implementation, ours included ({@link accountKindForActor}).
+    // implementation, ours included ({@link accountKindForActor}). `sensitive`
+    // is Lemmy's NSFW flag on a community, sent as Lemmy sends it; an Oxy
+    // community has no NSFW setting.
     if (actorObject.type === LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND.community) {
       actorObject.attributedTo = config.urls.moderators(username);
       actorObject.moderators = config.urls.moderators(username);
       actorObject.postingRestrictedToMods = false;
+      actorObject.sensitive = false;
     }
 
     const aliases = normalizeAlsoKnownAs(params.alsoKnownAs);

package/src/groupCollections.ts

@@ -0,0 +1,67 @@
+/**
+ * How a local `Group` (an Oxy community) publishes its outbox and followers:
+ * the shapes Lemmy itself serves and reads back, not the paged
+ * `OrderedCollection` + `first` link every other local actor serves.
+ *
+ * Lemmy deserializes a community's collections into fixed structs that know
+ * nothing of paging (`crates/apub/apub/src/protocol/collections/`):
+ *  - outbox → `GroupOutbox { orderedItems: Vec<Announce> }`, `orderedItems`
+ *    REQUIRED inline. A summary with only `first` fails to parse, so a server
+ *    discovering the community backfills nothing. PieFed reads the same inline
+ *    `orderedItems` and nothing else.
+ *  - followers → `GroupFollowers { type: "Collection", totalItems, items }`,
+ *    read for the subscriber count. Lemmy serves `items: []`, so the follower
+ *    list stays private; this does the same.
+ *
+ * Mastodon reads `totalItems` from either shape, so a `Group` followed from
+ * Mastodon keeps its counts. `Person`, `Organization` and `Service` actors keep
+ * the paged shape Mastodon walks.
+ */
+
+import { LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND, localActorTypeForAccountKind } from './actorObject';
+import { AP_CONTEXT } from './apContext';
+
+/** How many of its latest `Announce`s a `Group`'s outbox lists inline (Lemmy's own size). */
+export const GROUP_OUTBOX_SIZE = 50;
+
+/**
+ * Whether a local account of this kind is announced as a `Group`
+ * ({@link LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND}) and so serves the Group
+ * collections: moderators, and the outbox and followers in the shapes above.
+ */
+export function isGroupActorKind(kind: unknown): boolean {
+  return localActorTypeForAccountKind(kind) === LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND.community;
+}
+
+/**
+ * A `Group`'s outbox: one unpaged `OrderedCollection` of its latest
+ * `Announce { Create }` activities, newest first. Each item's own `@context` is
+ * dropped; the collection's covers it.
+ */
+export function groupOutboxCollection(params: {
+  id: string;
+  totalItems: number;
+  orderedItems: readonly Record<string, unknown>[];
+}): Record<string, unknown> {
+  return {
+    '@context': AP_CONTEXT,
+    id: params.id,
+    type: 'OrderedCollection',
+    totalItems: params.totalItems,
+    orderedItems: params.orderedItems.map(({ '@context': _context, ...item }) => item),
+  };
+}
+
+/** A `Group`'s followers: the count, and an empty `items` list. */
+export function groupFollowersCollection(params: {
+  id: string;
+  totalItems: number;
+}): Record<string, unknown> {
+  return {
+    '@context': AP_CONTEXT,
+    id: params.id,
+    type: 'Collection',
+    totalItems: params.totalItems,
+    items: [],
+  };
+}

package/src/index.ts

@@ -132,6 +132,17 @@ export {
   type ActorMediaResolver,
 } from './actorObject';
 
+/**
+ * A local `Group`'s outbox and followers, in the shapes Lemmy serves and reads
+ * back; every other actor keeps the paged collections.
+ */
+export {
+  GROUP_OUTBOX_SIZE,
+  isGroupActorKind,
+  groupOutboxCollection,
+  groupFollowersCollection,
+} from './groupCollections';
+
 /**
  * Supported external networks, keyed by the transport a connector speaks.
  * `instagram-graph` is Meta's Graph API Business Discovery: a read-only

package/src/node/actorRouter.ts

@@ -8,7 +8,8 @@
  *    signature verification (Phase 2, `trustForwardedHost`) and actor-match, then
  *    202 + async dispatch to the injected inbound dispatcher,
  *  - `GET /users/:username/followers` + `/following` — the OXY follow graph
- *    (local + bridged federated edges) as paginated `OrderedCollection`s,
+ *    (local + bridged federated edges) as paginated `OrderedCollection`s; a
+ *    community `Group`'s followers are only counted (`groupCollections.ts`),
  *  - `GET /users/:username/moderators` — a community `Group`'s moderators.
  *
  * The CONTENT routes (`outbox`, `featured`, per-post dereference) stay in the app,
@@ -28,11 +29,9 @@ import { discoveryCacheControl } from './httpCacheControl';
 import { verifyHttpSignature } from '../httpSignature';
 import type { UrlBuilders } from '../urls';
 import { INSTANCE_ACTOR_USERNAME, normalizeActorUsername } from '../urls';
-import {
-  LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND,
-  localActorTypeForAccountKind,
-  type LocalActorBuilder,
-} from '../actorObject';
+import type { LocalActorBuilder } from '../actorObject';
+import { groupFollowersCollection, isGroupActorKind } from '../groupCollections';
+import { goneTombstone, type IsActorGone } from './goneActor';
 
 /** Page size for the paginated followers/following collections (mirrors the outbox). */
 const FOLLOW_PAGE_SIZE = 20;
@@ -133,6 +132,13 @@ export interface ActorRouterConfig {
    * the route is not mounted; any account that is not a community 404s.
    */
   fetchModerators?(userId: string): Promise<User[]>;
+  /**
+   * Whether a username that resolved to nobody names a DELETED local actor
+   * (`goneActor.ts`). True ⇒ the actor, its inbox and its collections answer
+   * `410 Gone` (the actor with a `Tombstone`) instead of 404. Omitted ⇒ every
+   * miss is a 404.
+   */
+  isActorGone?: IsActorGone;
   /** Actor HTTP response TTL in whole seconds, 0..86400. Defaults to 1800; 0 sends no-store. */
   httpCacheTtlSeconds?: number;
   /** Diagnostics sink. */
@@ -178,6 +184,19 @@ export function createActorRouter(config: ActorRouterConfig): Router {
     return config.wantsActivityPub(req.headers.accept);
   }
 
+  /**
+   * The answer for a username nobody resolved to: 410 with the actor's
+   * `Tombstone` when it is a deleted actor, else the usual 404.
+   */
+  async function userMissing(res: Response, username: string): Promise<Response> {
+    if (config.isActorGone && (await config.isActorGone(username))) {
+      res.set('Content-Type', apContentType);
+      res.set('Cache-Control', httpCacheControl);
+      return res.status(410).json(goneTombstone(urls.actor(username)));
+    }
+    return res.status(404).json({ error: 'User not found' });
+  }
+
   /** Common inbox handler with HTTP signature verification. */
   async function handleInbox(req: InboxRequest, res: Response): Promise<Response> {
     try {
@@ -249,7 +268,8 @@ export function createActorRouter(config: ActorRouterConfig): Router {
 
   /**
    * Serve a user's followers OR following as a paginated `OrderedCollection` over
-   * the authoritative Oxy follow graph (local + bridged federated edges).
+   * the authoritative Oxy follow graph (local + bridged federated edges). A
+   * `Group`'s followers are the unpaged, itemless `Collection` Lemmy reads.
    */
   async function serveFollowCollection(
     req: Request,
@@ -264,7 +284,7 @@ export function createActorRouter(config: ActorRouterConfig): Router {
 
     try {
       const user = await config.resolveUser(username);
-      if (!user) return res.status(404).json({ error: 'User not found' });
+      if (!user) return userMissing(res, username);
 
       if (!config.consent.isSharingEnabledFromUser(user)) {
         return res.status(404).json({ error: 'User not found' });
@@ -276,7 +296,8 @@ export function createActorRouter(config: ActorRouterConfig): Router {
         direction === 'followers' ? user._count?.followers : user._count?.following;
       const profileTotal = typeof rawCount === 'number' ? rawCount : undefined;
 
-      if (!page) {
+      const groupFollowers = direction === 'followers' && isGroupActorKind(user.kind);
+      if (!page || groupFollowers) {
         // Prefer the profile `_count`; only when absent (the rare search fallback)
         // fetch the authoritative total from a minimal graph list call. Fail-soft
         // to 0 — never 500 the summary.
@@ -294,6 +315,9 @@ export function createActorRouter(config: ActorRouterConfig): Router {
         }
 
         res.set('Content-Type', apContentType);
+        if (groupFollowers) {
+          return res.json(groupFollowersCollection({ id: collectionUrl(username), totalItems }));
+        }
         return res.json({
           '@context': AP_CONTEXT,
           id: collectionUrl(username),
@@ -403,7 +427,7 @@ export function createActorRouter(config: ActorRouterConfig): Router {
       }
 
       const user = await config.resolveUser(username);
-      if (!user) return res.status(404).json({ error: 'User not found' });
+      if (!user) return userMissing(res, username);
 
       // Sharing OFF must be indistinguishable from a nonexistent user — same 404
       // body, no separate error code. Derived from the already-resolved user.
@@ -457,9 +481,12 @@ export function createActorRouter(config: ActorRouterConfig): Router {
     // server drop it permanently rather than retry, so availability wins over
     // gating freshness — the activity is processed and any consent decision is
     // re-checked downstream by the id-based (fail-open) gates.
+    // A DELETED actor's inbox refuses delivery with 410, so the sender stops
+    // rather than treating it as a transient miss.
     const username = getUsername(req);
     const sharingState = await config.consent.getSharingStateByUsername(username);
-    if (sharingState === 'disabled' || sharingState === 'unknown-user') {
+    if (sharingState === 'unknown-user') return userMissing(res, username);
+    if (sharingState === 'disabled') {
       return res.status(404).json({ error: 'User not found' });
     }
 
@@ -492,11 +519,8 @@ export function createActorRouter(config: ActorRouterConfig): Router {
       const username = getUsername(req);
       try {
         const user = await config.resolveUser(username);
-        if (
-          !user ||
-          !config.consent.isSharingEnabledFromUser(user) ||
-          localActorTypeForAccountKind(user.kind) !== LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND.community
-        ) {
+        if (!user) return userMissing(res, username);
+        if (!config.consent.isSharingEnabledFromUser(user) || !isGroupActorKind(user.kind)) {
           return res.status(404).json({ error: 'User not found' });
         }
         const moderators = await fetchModerators(String(user._id || user.id));

package/src/node/delivery.ts

@@ -30,6 +30,7 @@ import { readBodyChunks } from './boundedBody';
 import { signRequest, type HttpSignatureSigner } from '../httpSignature';
 import type { UrlBuilders } from '../urls';
 import type { LocalActorBuilder } from '../actorObject';
+import { buildActorDeleteActivity } from './goneActor';
 
 /** Total time budget for a single delivery POST (connect + response headers). */
 const DELIVER_ACTIVITY_TIMEOUT_MS = 15000;
@@ -360,6 +361,15 @@ export interface DeliveryService {
   ): Promise<void>;
   /** Rebroadcast the FULL actor document as an Update(Person) to remote followers. */
   federateActorUpdate(actorOxyUserId: string, username: string): Promise<void>;
+  /**
+   * Tell every remote follower the actor is gone: its `Delete` of itself
+   * (`goneActor.ts`), one per (shared) inbox, signed with its own key. Needs the
+   * accepted follower rows, so call it BEFORE deleting them. Asks no consent and
+   * resolves no profile, since the account is already gone at its identity
+   * provider; it needs only the handle and the key the handle addresses. Throws
+   * when it cannot queue, so the caller's job retries.
+   */
+  federateActorDelete(actorOxyUserId: string, username: string): Promise<void>;
 }
 
 /** Build the outbound delivery + follow-lifecycle service from an app's adapters. */
@@ -850,6 +860,15 @@ export function createDeliveryService<TActor extends DeliveryActorFields>(
     }
   }
 
+  async function federateActorDelete(actorOxyUserId: string, username: string): Promise<void> {
+    if (!config.federationEnabled) return;
+    await deliverToFollowers(
+      buildActorDeleteActivity(urls.actor(username)),
+      actorOxyUserId,
+      username,
+    );
+  }
+
   return {
     deliverActivity,
     queueDelivery,
@@ -860,5 +879,6 @@ export function createDeliveryService<TActor extends DeliveryActorFields>(
     sendAccept,
     sendReject,
     federateActorUpdate,
+    federateActorDelete,
   };
 }