@rmdes/indiekit-endpoint-activitypub 3.13.10 → 3.13.12

package/index.js

@@ -1,171 +1,44 @@
 import express from "express";
 import { waitForReady } from "@rmdes/indiekit-startup-gate";
 import { ACTIVITYPUB_BLOCKS } from "./lib/blocks.js";
+import { resolveOptions } from "./lib/defaults.js";
+import { buildNavigationItems } from "./lib/navigation.js";
 
-import { setupFederation, buildPersonActor } from "./lib/federation-setup.js";
+import { setupFederation } from "./lib/federation-setup.js";
 import { createMastodonRouter } from "./lib/mastodon/router.js";
 import { setLocalIdentity } from "./lib/mastodon/entities/status.js";
 import { initRedisCache } from "./lib/redis-cache.js";
 import { createIndexes } from "./lib/init-indexes.js";
 import { lookupWithSecurity } from "./lib/lookup-helpers.js";
-import {
-  needsDirectFollow,
-  sendDirectFollow,
-  sendDirectUnfollow,
-} from "./lib/direct-follow.js";
 import {
   createFedifyMiddleware,
 } from "./lib/federation-bridge.js";
-import {
-  jf2ToActivityStreams,
-  jf2ToAS2Activity,
-} from "./lib/jf2-to-as2.js";
 import { createSyndicator } from "./lib/syndicator.js";
-import { dashboardController } from "./lib/controllers/dashboard.js";
-import {
-  readerController,
-  notificationsController,
-  markAllNotificationsReadController,
-  clearAllNotificationsController,
-  deleteNotificationController,
-  composeController,
-  submitComposeController,
-  remoteProfileController,
-  followController,
-  unfollowController,
-  postDetailController,
-} from "./lib/controllers/reader.js";
-import {
-  likeController,
-  unlikeController,
-  boostController,
-  unboostController,
-} from "./lib/controllers/interactions.js";
-import {
-  muteController,
-  unmuteController,
-  blockController,
-  unblockController,
-  blockServerController,
-  unblockServerController,
-  moderationController,
-  filterModeController,
-} from "./lib/controllers/moderation.js";
-import { followersController } from "./lib/controllers/followers.js";
-import {
-  approveFollowController,
-  rejectFollowController,
-} from "./lib/controllers/follow-requests.js";
-import { followingController } from "./lib/controllers/following.js";
-import { activitiesController } from "./lib/controllers/activities.js";
-import {
-  migrateGetController,
-  migratePostController,
-  migrateImportController,
-} from "./lib/controllers/migrate.js";
-import {
-  profileGetController,
-  profilePostController,
-} from "./lib/controllers/profile.js";
-import {
-  featuredGetController,
-  featuredPinController,
-  featuredUnpinController,
-} from "./lib/controllers/featured.js";
-import {
-  featuredTagsGetController,
-  featuredTagsAddController,
-  featuredTagsRemoveController,
-} from "./lib/controllers/featured-tags.js";
-import { resolveController } from "./lib/controllers/resolve.js";
-import { tagTimelineController } from "./lib/controllers/tag-timeline.js";
-import { apiTimelineController, countNewController, markReadController } from "./lib/controllers/api-timeline.js";
 import {
-  exploreController,
-  exploreApiController,
-  instanceSearchApiController,
-  instanceCheckApiController,
-  popularAccountsApiController,
-} from "./lib/controllers/explore.js";
-import {
-  followTagController,
-  unfollowTagController,
-  followTagGloballyController,
-  unfollowTagGloballyController,
-} from "./lib/controllers/follow-tag.js";
-import {
-  listTabsController,
-  addTabController,
-  removeTabController,
-  reorderTabsController,
-} from "./lib/controllers/tabs.js";
-import { hashtagExploreApiController } from "./lib/controllers/hashtag-explore.js";
-import { publicProfileController } from "./lib/controllers/public-profile.js";
-import {
-  messagesController,
-  messageComposeController,
-  submitMessageController,
-  markAllMessagesReadController,
-  clearAllMessagesController,
-  deleteMessageController,
-} from "./lib/controllers/messages.js";
-import { authorizeInteractionController } from "./lib/controllers/authorize-interaction.js";
-import { myProfileController } from "./lib/controllers/my-profile.js";
-import {
-  refollowPauseController,
-  refollowResumeController,
-  refollowStatusController,
-} from "./lib/controllers/refollow.js";
+  loadRsaPrivateKey,
+  followActor,
+  unfollowActor,
+  broadcastActorUpdate,
+  broadcastDelete,
+  broadcastPostUpdate,
+  deletePost,
+  updatePost,
+  getActorUrl,
+} from "./lib/endpoint-federation.js";
+import { buildAdminRoutes } from "./lib/routes/admin-routes.js";
+import { buildRoutesPublic, buildContentNegotiationRoutes } from "./lib/routes/public-routes.js";
 import { startBatchRefollow } from "./lib/batch-refollow.js";
-import { logActivity } from "./lib/activity-log.js";
-import { batchBroadcast } from "./lib/batch-broadcast.js";
 import { scheduleCleanup } from "./lib/timeline-cleanup.js";
 import { runSeparateMentionsMigration } from "./lib/migrations/separate-mentions.js";
 import { loadBlockedServersToRedis } from "./lib/storage/server-blocks.js";
 import { scheduleKeyRefresh } from "./lib/key-refresh.js";
 import { startInboxProcessor } from "./lib/inbox-queue.js";
-import { deleteFederationController } from "./lib/controllers/federation-delete.js";
-import {
-  federationMgmtController,
-  rebroadcastController,
-  viewApJsonController,
-  broadcastActorUpdateController,
-  lookupObjectController,
-} from "./lib/controllers/federation-mgmt.js";
-import {
-  settingsGetController,
-  settingsPostController,
-} from "./lib/controllers/settings.js";
-
-const defaults = {
-  mountPath: "/activitypub",
-  actor: {
-    handle: "rick",
-    name: "",
-    summary: "",
-    icon: "",
-  },
-  checked: true,
-  alsoKnownAs: "",
-  activityRetentionDays: 90,
-  storeRawActivities: false,
-  redisUrl: "",
-  parallelWorkers: 5,
-  actorType: "Person",
-  logLevel: "warning",
-  timelineRetention: 1000,
-  notificationRetentionDays: 30,
-  debugDashboard: false,
-  debugPassword: "",
-  defaultVisibility: "public", // "public" | "unlisted" | "followers"
-};
 
 export default class ActivityPubEndpoint {
   name = "ActivityPub endpoint";
 
   constructor(options = {}) {
-    this.options = { ...defaults, ...options };
-    this.options.actor = { ...defaults.actor, ...options.actor };
+    this.options = resolveOptions(options);
     this.mountPath = this.options.mountPath;
 
     this._publicationUrl = "";
@@ -179,48 +52,7 @@ export default class ActivityPubEndpoint {
   }
 
   get navigationItems() {
-    return [
-      {
-        href: this.options.mountPath,
-        text: "activitypub.title",
-        requiresDatabase: true,
-      },
-      {
-        href: `${this.options.mountPath}/admin/reader`,
-        text: "activitypub.reader.title",
-        requiresDatabase: true,
-      },
-      {
-        href: `${this.options.mountPath}/admin/reader/notifications`,
-        text: "activitypub.notifications.title",
-        requiresDatabase: true,
-      },
-      {
-        href: `${this.options.mountPath}/admin/reader/messages`,
-        text: "activitypub.messages.title",
-        requiresDatabase: true,
-      },
-      {
-        href: `${this.options.mountPath}/admin/reader/moderation`,
-        text: "activitypub.moderation.title",
-        requiresDatabase: true,
-      },
-      {
-        href: `${this.options.mountPath}/admin/my-profile`,
-        text: "activitypub.myProfile.title",
-        requiresDatabase: true,
-      },
-      {
-        href: `${this.options.mountPath}/admin/federation`,
-        text: "activitypub.federationMgmt.title",
-        requiresDatabase: true,
-      },
-      {
-        href: `${this.options.mountPath}/admin/settings`,
-        text: "activitypub.settings.title",
-        requiresDatabase: true,
-      },
-    ];
+    return buildNavigationItems(this.options.mountPath);
   }
 
   /**
@@ -244,159 +76,14 @@ export default class ActivityPubEndpoint {
    * Fedify handles actor, inbox, outbox, followers, following.
    */
   get routesPublic() {
-    const router = express.Router(); // eslint-disable-line new-cap
-    const self = this;
-
-    router.use((req, res, next) => {
-      if (!self._fedifyMiddleware) return next();
-      // Skip Fedify for admin UI routes — they're handled by the
-      // authenticated `routes` getter, not the federation layer.
-      if (req.path.startsWith("/admin")) return next();
-
-      // Fedify's acceptsJsonLd() treats Accept: */* as NOT accepting JSON-LD
-      // (it only returns true for explicit application/activity+json etc.).
-      // Remote servers fetching actor URLs for HTTP Signature verification
-      // (e.g. tags.pub) often omit Accept or use */* — they get HTML back
-      // instead of the actor JSON, causing "public key not found" errors.
-      // Fix: for GET requests to actor paths, upgrade ambiguous Accept headers
-      // to application/activity+json so Fedify serves JSON-LD. Explicit
-      // text/html requests (browsers) are unaffected.
-      if (req.method === "GET" && /^\/users\/[^/]+\/?$/.test(req.path)) {
-        const accept = req.get("accept") || "";
-        if (!accept.includes("text/html") && !accept.includes("application/xhtml+xml")) {
-          req.headers["accept"] = "application/activity+json";
-        }
-      }
-
-      return self._fedifyMiddleware(req, res, next);
-    });
-
-    // Authorize interaction — remote follow / subscribe endpoint.
-    // Remote servers redirect users here via the WebFinger subscribe template.
-    router.get("/authorize_interaction", authorizeInteractionController(self));
-
-    // HTML fallback for actor URL — serve a public profile page.
-    // Fedify only serves JSON-LD; browsers get 406 and fall through here.
-    router.get("/users/:identifier", publicProfileController(self));
-
-    // Catch-all for federation paths that Fedify didn't handle (e.g. GET
-    // on inbox). Without this, they fall through to Indiekit's auth
-    // middleware and redirect to the login page.
-    router.all("/users/:identifier/inbox", (req, res) => {
-      res
-        .status(405)
-        .set("Allow", "POST")
-        .type("application/activity+json")
-        .json({
-          error: "Method Not Allowed",
-          message: "The inbox only accepts POST requests",
-        });
-    });
-    router.all("/inbox", (req, res) => {
-      res
-        .status(405)
-        .set("Allow", "POST")
-        .type("application/activity+json")
-        .json({
-          error: "Method Not Allowed",
-          message: "The shared inbox only accepts POST requests",
-        });
-    });
-
-    return router;
+    return buildRoutesPublic(this);
   }
 
   /**
    * Authenticated admin routes — mounted at mountPath, behind IndieAuth.
    */
   get routes() {
-    const router = express.Router(); // eslint-disable-line new-cap
-    const mp = this.options.mountPath;
-
-    router.get("/", dashboardController(mp));
-    router.get("/admin/reader", readerController(mp));
-    router.get("/admin/reader/tag", tagTimelineController(mp));
-    router.get("/admin/reader/api/timeline", apiTimelineController(mp));
-    router.get("/admin/reader/api/timeline/count-new", countNewController());
-    router.post("/admin/reader/api/timeline/mark-read", markReadController());
-    router.get("/admin/reader/explore", exploreController(mp));
-    router.get("/admin/reader/api/explore", exploreApiController(mp));
-    router.get("/admin/reader/api/explore/hashtag", hashtagExploreApiController(mp));
-    router.get("/admin/reader/api/instances", instanceSearchApiController(mp));
-    router.get("/admin/reader/api/instance-check", instanceCheckApiController(mp));
-    router.get("/admin/reader/api/popular-accounts", popularAccountsApiController(mp));
-    router.get("/admin/reader/api/tabs", listTabsController(mp));
-    router.post("/admin/reader/api/tabs", addTabController(mp));
-    router.post("/admin/reader/api/tabs/remove", removeTabController(mp));
-    router.patch("/admin/reader/api/tabs/reorder", reorderTabsController(mp));
-    router.post("/admin/reader/follow-tag", followTagController(mp));
-    router.post("/admin/reader/unfollow-tag", unfollowTagController(mp));
-    router.post("/admin/reader/follow-tag-global", followTagGloballyController(mp, this));
-    router.post("/admin/reader/unfollow-tag-global", unfollowTagGloballyController(mp, this));
-    router.get("/admin/reader/notifications", notificationsController(mp));
-    router.post("/admin/reader/notifications/mark-read", markAllNotificationsReadController(mp));
-    router.post("/admin/reader/notifications/clear", clearAllNotificationsController(mp));
-    router.post("/admin/reader/notifications/delete", deleteNotificationController(mp));
-    router.get("/admin/reader/messages", messagesController(mp));
-    router.get("/admin/reader/messages/compose", messageComposeController(mp, this));
-    router.post("/admin/reader/messages/compose", submitMessageController(mp, this));
-    router.post("/admin/reader/messages/mark-read", markAllMessagesReadController(mp));
-    router.post("/admin/reader/messages/clear", clearAllMessagesController(mp));
-    router.post("/admin/reader/messages/delete", deleteMessageController(mp));
-    router.get("/admin/reader/compose", composeController(mp, this));
-    router.post("/admin/reader/compose", submitComposeController(mp, this));
-    router.post("/admin/reader/like", likeController(mp, this));
-    router.post("/admin/reader/unlike", unlikeController(mp, this));
-    router.post("/admin/reader/boost", boostController(mp, this));
-    router.post("/admin/reader/unboost", unboostController(mp, this));
-    router.get("/admin/reader/resolve", resolveController(mp, this));
-    router.get("/admin/reader/profile", remoteProfileController(mp, this));
-    router.get("/admin/reader/post", postDetailController(mp, this));
-    router.post("/admin/reader/follow", followController(mp, this));
-    router.post("/admin/reader/unfollow", unfollowController(mp, this));
-    router.get("/admin/reader/moderation", moderationController(mp));
-    router.post("/admin/reader/moderation/filter-mode", filterModeController(mp));
-    router.post("/admin/reader/mute", muteController(mp, this));
-    router.post("/admin/reader/unmute", unmuteController(mp, this));
-    router.post("/admin/reader/block", blockController(mp, this));
-    router.post("/admin/reader/unblock", unblockController(mp, this));
-    router.post("/admin/reader/block-server", blockServerController(mp));
-    router.post("/admin/reader/unblock-server", unblockServerController(mp));
-    router.get("/admin/followers", followersController(mp));
-    router.post("/admin/followers/approve", approveFollowController(mp, this));
-    router.post("/admin/followers/reject", rejectFollowController(mp, this));
-    router.get("/admin/following", followingController(mp));
-    router.get("/admin/activities", activitiesController(mp));
-    router.get("/admin/featured", featuredGetController(mp));
-    router.post("/admin/featured/pin", featuredPinController(mp, this));
-    router.post("/admin/featured/unpin", featuredUnpinController(mp, this));
-    router.get("/admin/tags", featuredTagsGetController(mp));
-    router.post("/admin/tags/add", featuredTagsAddController(mp, this));
-    router.post("/admin/tags/remove", featuredTagsRemoveController(mp, this));
-    router.get("/admin/profile", profileGetController(mp));
-    router.post("/admin/profile", profilePostController(mp, this));
-    router.get("/admin/my-profile", myProfileController(this));
-    router.get("/admin/migrate", migrateGetController(mp, this.options));
-    router.post("/admin/migrate", migratePostController(mp, this.options));
-    router.post(
-      "/admin/migrate/import",
-      migrateImportController(mp, this.options),
-    );
-    router.post("/admin/refollow/pause", refollowPauseController(mp, this));
-    router.post("/admin/refollow/resume", refollowResumeController(mp, this));
-    router.get("/admin/refollow/status", refollowStatusController(mp));
-    router.post("/admin/federation/delete", deleteFederationController(mp, this));
-    router.get("/admin/federation", federationMgmtController(mp, this));
-    router.post("/admin/federation/rebroadcast", rebroadcastController(mp, this));
-    router.get("/admin/federation/ap-json", viewApJsonController(mp, this));
-    router.post("/admin/federation/broadcast-actor", broadcastActorUpdateController(mp, this));
-    router.get("/admin/federation/lookup", lookupObjectController(mp, this));
-
-    // Settings
-    router.get("/admin/settings", settingsGetController(mp));
-    router.post("/admin/settings", settingsPostController(mp));
-
-    return router;
+    return buildAdminRoutes(this);
   }
 
   /**
@@ -405,95 +92,7 @@ export default class ActivityPubEndpoint {
    * at /nodeinfo/2.1 (delegated to Fedify).
    */
   get contentNegotiationRoutes() {
-    const router = express.Router(); // eslint-disable-line new-cap
-    const self = this;
-
-    // Let Fedify handle NodeInfo data (/nodeinfo/2.1)
-    // Only pass GET/HEAD requests — POST/PUT/DELETE must not go through
-    // Fedify here, because fromExpressRequest() consumes the body stream,
-    // breaking Express body-parsed routes downstream (e.g. admin forms).
-    router.use((req, res, next) => {
-      if (!self._fedifyMiddleware) return next();
-      if (req.method !== "GET" && req.method !== "HEAD") return next();
-      // Only delegate to Fedify for NodeInfo data endpoint (/nodeinfo/2.1).
-      // All other paths in this root-mounted router are handled by the
-      // content negotiation catch-all below. Passing arbitrary paths like
-      // /notes/... to Fedify causes harmless but noisy 404 warnings.
-      if (!req.path.startsWith("/nodeinfo/")) return next();
-      return self._fedifyMiddleware(req, res, next);
-    });
-
-    // Content negotiation for AP clients on regular URLs
-    router.get("{*path}", async (req, res, next) => {
-      const accept = req.headers.accept || "";
-      const isActivityPub =
-        accept.includes("application/activity+json") ||
-        accept.includes("application/ld+json");
-
-      if (!isActivityPub) {
-        return next();
-      }
-
-      try {
-        // Root URL — redirect to Fedify actor
-        if (req.path === "/") {
-          const actorPath = `${self.options.mountPath}/users/${self.options.actor.handle}`;
-          return res.redirect(actorPath);
-        }
-
-        // Post URLs — look up in database and convert to AS2
-        const { application } = req.app.locals;
-        const postsCollection = application?.collections?.get("posts");
-        if (!postsCollection) {
-          return next();
-        }
-
-        const requestUrl = `${self._publicationUrl}${req.path.slice(1)}`;
-        const post = await postsCollection.findOne({
-          "properties.url": requestUrl,
-        });
-
-        if (!post || post.properties?.deleted) {
-          // FEP-4f05: Serve Tombstone for deleted posts
-          const { getTombstone } = await import("./lib/storage/tombstones.js");
-          const tombstone = await getTombstone(self._collections, requestUrl);
-          if (tombstone) {
-            res.status(410).set("Content-Type", "application/activity+json").json({
-              "@context": "https://www.w3.org/ns/activitystreams",
-              type: "Tombstone",
-              id: requestUrl,
-              formerType: tombstone.formerType,
-              published: tombstone.published || undefined,
-              deleted: tombstone.deleted,
-            });
-            return;
-          }
-          return next();
-        }
-
-        const actorUrl = self._getActorUrl();
-        const activity = jf2ToActivityStreams(
-          post.properties,
-          actorUrl,
-          self._publicationUrl,
-          { visibility: self.options.defaultVisibility },
-        );
-
-        const object = activity.object || activity;
-        res.set("Content-Type", "application/activity+json");
-        return res.json({
-          "@context": [
-            "https://www.w3.org/ns/activitystreams",
-            "https://w3id.org/security/v1",
-          ],
-          ...object,
-        });
-      } catch {
-        return next();
-      }
-    });
-
-    return router;
+    return buildContentNegotiationRoutes(this);
   }
 
   /**
@@ -517,141 +116,11 @@ export default class ActivityPubEndpoint {
    * @returns {Promise<CryptoKey|null>}
    */
   async _loadRsaPrivateKey() {
-    try {
-      const keyDoc = await this._collections.ap_keys.findOne({
-        privateKeyPem: { $exists: true },
-      });
-      if (!keyDoc?.privateKeyPem) return null;
-      const pemBody = keyDoc.privateKeyPem
-        .replace(/-----[^-]+-----/g, "")
-        .replace(/\s/g, "");
-      return await crypto.subtle.importKey(
-        "pkcs8",
-        Buffer.from(pemBody, "base64"),
-        { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
-        true,
-        ["sign"],
-      );
-    } catch (error) {
-      console.error("[ActivityPub] Failed to load RSA key:", error.message);
-      return null;
-    }
+    return loadRsaPrivateKey(this);
   }
 
   async followActor(actorUrl, actorInfo = {}) {
-    if (!this._federation) {
-      return { ok: false, error: "Federation not initialized" };
-    }
-
-    try {
-      const { Follow } = await import("@fedify/fedify/vocab");
-      const handle = this.options.actor.handle;
-      const ctx = this._federation.createContext(
-        new URL(this._publicationUrl),
-        { handle, publicationUrl: this._publicationUrl },
-      );
-
-      // Resolve the remote actor to get their inbox
-      // lookupWithSecurity handles signed→unsigned fallback automatically
-      const documentLoader = await ctx.getDocumentLoader({
-        identifier: handle,
-      });
-      const remoteActor = await lookupWithSecurity(ctx, actorUrl, {
-        documentLoader,
-      });
-      if (!remoteActor) {
-        return { ok: false, error: "Could not resolve remote actor" };
-      }
-
-      // Send Follow activity
-      if (needsDirectFollow(actorUrl)) {
-        // tags.pub rejects Fedify's LD Signature context (identity/v1).
-        // Send a minimal signed Follow directly, bypassing the outbox pipeline.
-        // See: https://github.com/social-web-foundation/tags.pub/issues/10
-        const rsaKey = await this._loadRsaPrivateKey();
-        if (!rsaKey) {
-          return { ok: false, error: "No RSA key available for direct follow" };
-        }
-        const result = await sendDirectFollow({
-          actorUri: ctx.getActorUri(handle).href,
-          targetActorUrl: actorUrl,
-          inboxUrl: remoteActor.inboxId?.href,
-          keyId: `${ctx.getActorUri(handle).href}#main-key`,
-          privateKey: rsaKey,
-        });
-        if (!result.ok) {
-          return { ok: false, error: result.error };
-        }
-      } else {
-        const follow = new Follow({
-          actor: ctx.getActorUri(handle),
-          object: new URL(actorUrl),
-        });
-        await ctx.sendActivity({ identifier: handle }, remoteActor, follow, {
-          orderingKey: actorUrl,
-        });
-      }
-
-      // Store in ap_following
-      const name =
-        actorInfo.name ||
-        remoteActor.name?.toString() ||
-        remoteActor.preferredUsername?.toString() ||
-        actorUrl;
-      const actorHandle =
-        actorInfo.handle ||
-        remoteActor.preferredUsername?.toString() ||
-        "";
-      const avatar =
-        actorInfo.photo ||
-        (remoteActor.icon
-          ? (await remoteActor.icon)?.url?.href || ""
-          : "");
-      const inbox = remoteActor.inboxId?.href || "";
-      const sharedInbox = remoteActor.endpoints?.sharedInbox?.href || "";
-
-      await this._collections.ap_following.updateOne(
-        { actorUrl },
-        {
-          $set: {
-            actorUrl,
-            handle: actorHandle,
-            name,
-            avatar,
-            inbox,
-            sharedInbox,
-            followedAt: new Date().toISOString(),
-            source: "reader",
-          },
-        },
-        { upsert: true },
-      );
-
-      console.info(`[ActivityPub] Sent Follow to ${actorUrl}`);
-
-      await logActivity(this._collections.ap_activities, {
-        direction: "outbound",
-        type: "Follow",
-        actorUrl: this._publicationUrl,
-        objectUrl: actorUrl,
-        actorName: name,
-        summary: `Sent Follow to ${name} (${actorUrl})`,
-      });
-
-      return { ok: true };
-    } catch (error) {
-      console.error(`[ActivityPub] Follow failed for ${actorUrl}:`, error.message);
-
-      await logActivity(this._collections.ap_activities, {
-        direction: "outbound",
-        type: "Follow",
-        actorUrl: this._publicationUrl,
-        objectUrl: actorUrl,
-        summary: `Follow failed for ${actorUrl}: ${error.message}`,
-      }).catch(() => {});
-
-      return { ok: false, error: error.message };
-    }
+    return followActor(this, actorUrl, actorInfo);
   }
 
   /**
@@ -660,277 +129,31 @@ export default class ActivityPubEndpoint {
    * @returns {Promise<{ok: boolean, error?: string}>}
    */
   async unfollowActor(actorUrl) {
-    if (!this._federation) {
-      return { ok: false, error: "Federation not initialized" };
-    }
-
-    try {
-      const { Follow, Undo } = await import("@fedify/fedify/vocab");
-      const handle = this.options.actor.handle;
-      const ctx = this._federation.createContext(
-        new URL(this._publicationUrl),
-        { handle, publicationUrl: this._publicationUrl },
-      );
-
-      // Use authenticated document loader for servers requiring Authorized Fetch
-      const documentLoader = await ctx.getDocumentLoader({
-        identifier: handle,
-      });
-      const remoteActor = await lookupWithSecurity(ctx,actorUrl, {
-        documentLoader,
-      });
-      if (!remoteActor) {
-        // Even if we can't resolve, remove locally
-        await this._collections.ap_following.deleteOne({ actorUrl });
-
-        await logActivity(this._collections.ap_activities, {
-          direction: "outbound",
-          type: "Undo(Follow)",
-          actorUrl: this._publicationUrl,
-          objectUrl: actorUrl,
-          summary: `Removed ${actorUrl} locally (could not resolve remote actor)`,
-        }).catch(() => {});
-
-        return { ok: true };
-      }
-
-      if (needsDirectFollow(actorUrl)) {
-        // tags.pub rejects Fedify's LD Signature context (identity/v1).
-        // See: https://github.com/social-web-foundation/tags.pub/issues/10
-        const rsaKey = await this._loadRsaPrivateKey();
-        if (rsaKey) {
-          const result = await sendDirectUnfollow({
-            actorUri: ctx.getActorUri(handle).href,
-            targetActorUrl: actorUrl,
-            inboxUrl: remoteActor.inboxId?.href,
-            keyId: `${ctx.getActorUri(handle).href}#main-key`,
-            privateKey: rsaKey,
-          });
-          if (!result.ok) {
-            console.warn(`[ActivityPub] Direct unfollow failed for ${actorUrl}: ${result.error}`);
-          }
-        }
-      } else {
-        const follow = new Follow({
-          actor: ctx.getActorUri(handle),
-          object: new URL(actorUrl),
-        });
-        const undo = new Undo({
-          actor: ctx.getActorUri(handle),
-          object: follow,
-        });
-        await ctx.sendActivity({ identifier: handle }, remoteActor, undo, {
-          orderingKey: actorUrl,
-        });
-      }
-      await this._collections.ap_following.deleteOne({ actorUrl });
-
-      console.info(`[ActivityPub] Sent Undo(Follow) to ${actorUrl}`);
-
-      await logActivity(this._collections.ap_activities, {
-        direction: "outbound",
-        type: "Undo(Follow)",
-        actorUrl: this._publicationUrl,
-        objectUrl: actorUrl,
-        summary: `Sent Undo(Follow) to ${actorUrl}`,
-      });
-
-      return { ok: true };
-    } catch (error) {
-      console.error(`[ActivityPub] Unfollow failed for ${actorUrl}:`, error.message);
-
-      await logActivity(this._collections.ap_activities, {
-        direction: "outbound",
-        type: "Undo(Follow)",
-        actorUrl: this._publicationUrl,
-        objectUrl: actorUrl,
-        summary: `Unfollow failed for ${actorUrl}: ${error.message}`,
-      }).catch(() => {});
-
-      // Remove locally even if remote delivery fails
-      await this._collections.ap_following.deleteOne({ actorUrl }).catch(() => {});
-      return { ok: false, error: error.message };
-    }
+    return unfollowActor(this, actorUrl);
   }
 
-  /**
-   * Send an Update(Person) activity to all followers so remote servers
-   * re-fetch the actor object (picking up profile changes, new featured
-   * collections, attachments, etc.).
-   *
-   * Delivery is batched to avoid a thundering herd: hundreds of remote
-   * servers simultaneously re-fetching the actor, featured posts, and
-   * featured tags after receiving the Update all at once.
-   */
   async broadcastActorUpdate() {
-    if (!this._federation) return;
-
-    try {
-      const { Update } = await import("@fedify/fedify/vocab");
-      const handle = this.options.actor.handle;
-      const ctx = this._federation.createContext(
-        new URL(this._publicationUrl),
-        { handle, publicationUrl: this._publicationUrl },
-      );
-
-      const actor = await buildPersonActor(
-        ctx,
-        handle,
-        this._collections,
-        this.options.actorType,
-      );
-      if (!actor) {
-        console.warn("[ActivityPub] broadcastActorUpdate: could not build actor");
-        return;
-      }
-
-      const update = new Update({
-        actor: ctx.getActorUri(handle),
-        object: actor,
-      });
-
-      await batchBroadcast({
-        federation: this._federation,
-        collections: this._collections,
-        publicationUrl: this._publicationUrl,
-        handle,
-        activity: update,
-        label: "Update(Person)",
-        objectUrl: this._getActorUrl(),
-      });
-    } catch (error) {
-      console.error("[ActivityPub] broadcastActorUpdate failed:", error.message);
-    }
+    return broadcastActorUpdate(this);
   }
 
-  /**
-   * Send Delete activity to all followers for a removed post.
-   * Mirrors broadcastActorUpdate() pattern: batch delivery with shared inbox dedup.
-   * @param {string} postUrl - Full URL of the deleted post
-   */
   async broadcastDelete(postUrl) {
-    if (!this._federation) return;
-
-    try {
-      const { Delete } = await import("@fedify/fedify/vocab");
-      const handle = this.options.actor.handle;
-      const ctx = this._federation.createContext(
-        new URL(this._publicationUrl),
-        { handle, publicationUrl: this._publicationUrl },
-      );
-
-      const del = new Delete({
-        actor: ctx.getActorUri(handle),
-        object: new URL(postUrl),
-      });
-
-      await batchBroadcast({
-        federation: this._federation,
-        collections: this._collections,
-        publicationUrl: this._publicationUrl,
-        handle,
-        activity: del,
-        label: "Delete",
-        objectUrl: postUrl,
-      });
-    } catch (error) {
-      console.warn("[ActivityPub] broadcastDelete failed:", error.message);
-    }
+    return broadcastDelete(this, postUrl);
   }
 
-  /**
-   * Called by post-content.js when a Micropub delete succeeds.
-   * Broadcasts an ActivityPub Delete activity to all followers.
-   * @param {string} url - Full URL of the deleted post
-   */
   async delete(url) {
-    // Record tombstone for FEP-4f05
-    try {
-      const { addTombstone } = await import("./lib/storage/tombstones.js");
-      const postsCol = this._collections.posts;
-      const post = postsCol ? await postsCol.findOne({ "properties.url": url }) : null;
-      await addTombstone(this._collections, {
-        url,
-        formerType: post?.properties?.["post-type"] === "article" ? "Article" : "Note",
-        published: post?.properties?.published || null,
-        deleted: new Date().toISOString(),
-      });
-    } catch (error) {
-      console.warn(`[ActivityPub] Tombstone creation failed for ${url}: ${error.message}`);
-    }
-
-    await this.broadcastDelete(url).catch((err) =>
-      console.warn(`[ActivityPub] broadcastDelete failed for ${url}: ${err.message}`)
-    );
+    return deletePost(this, url);
   }
 
-  /**
-   * Called by post-content.js when a Micropub update succeeds.
-   * Broadcasts an ActivityPub Update activity for the post to all followers.
-   * @param {object} properties - JF2 post properties (must include url)
-   */
   async update(properties) {
-    await this.broadcastPostUpdate(properties).catch((err) =>
-      console.warn(`[ActivityPub] broadcastPostUpdate failed for ${properties?.url}: ${err.message}`)
-    );
+    return updatePost(this, properties);
   }
 
-  /**
-   * Send an Update activity to all followers for a modified post.
-   * Mirrors broadcastDelete() pattern: batch delivery with shared inbox dedup.
-   * @param {object} properties - JF2 post properties
-   */
   async broadcastPostUpdate(properties) {
-    if (!this._federation) return;
-
-    try {
-      const { Update } = await import("@fedify/fedify/vocab");
-      const actorUrl = this._getActorUrl();
-      const handle = this.options.actor.handle;
-      const ctx = this._federation.createContext(
-        new URL(this._publicationUrl),
-        { handle, publicationUrl: this._publicationUrl },
-      );
-
-      const createActivity = jf2ToAS2Activity(
-        properties,
-        actorUrl,
-        this._publicationUrl,
-        { visibility: this.options.defaultVisibility },
-      );
-
-      if (!createActivity) {
-        console.warn(`[ActivityPub] broadcastPostUpdate: could not convert post to AS2 for ${properties?.url}`);
-        return;
-      }
-
-      const noteObject = await createActivity.getObject();
-      const activity = new Update({
-        actor: ctx.getActorUri(handle),
-        object: noteObject,
-      });
-
-      await batchBroadcast({
-        federation: this._federation,
-        collections: this._collections,
-        publicationUrl: this._publicationUrl,
-        handle,
-        activity,
-        label: "Update(Note)",
-        objectUrl: properties.url,
-      });
-    } catch (error) {
-      console.warn("[ActivityPub] broadcastPostUpdate failed:", error.message);
-    }
+    return broadcastPostUpdate(this, properties);
   }
 
-  /**
-   * Build the full actor URL from config.
-   * @returns {string}
-   */
   _getActorUrl() {
-    const base = this._publicationUrl.replace(/\/$/, "");
-    return `${base}${this.options.mountPath}/users/${this.options.actor.handle}`;
+    return getActorUrl(this);
   }
 
   init(Indiekit) {