@rmdes/indiekit-endpoint-activitypub 3.13.11 → 3.13.13

package/index.js

@@ -4,27 +4,30 @@ import { ACTIVITYPUB_BLOCKS } from "./lib/blocks.js";
 import { resolveOptions } from "./lib/defaults.js";
 import { buildNavigationItems } from "./lib/navigation.js";
 
-import { setupFederation, buildPersonActor } from "./lib/federation-setup.js";
+import { setupFederation } from "./lib/federation-setup.js";
 import { createMastodonRouter } from "./lib/mastodon/router.js";
 import { setLocalIdentity } from "./lib/mastodon/entities/status.js";
 import { initRedisCache } from "./lib/redis-cache.js";
 import { createIndexes } from "./lib/init-indexes.js";
 import { lookupWithSecurity } from "./lib/lookup-helpers.js";
-import {
-  needsDirectFollow,
-  sendDirectFollow,
-  sendDirectUnfollow,
-} from "./lib/direct-follow.js";
 import {
   createFedifyMiddleware,
 } from "./lib/federation-bridge.js";
-import { jf2ToAS2Activity } from "./lib/jf2-to-as2.js";
 import { createSyndicator } from "./lib/syndicator.js";
+import {
+  loadRsaPrivateKey,
+  followActor,
+  unfollowActor,
+  broadcastActorUpdate,
+  broadcastDelete,
+  broadcastPostUpdate,
+  deletePost,
+  updatePost,
+  getActorUrl,
+} from "./lib/endpoint-federation.js";
 import { buildAdminRoutes } from "./lib/routes/admin-routes.js";
 import { buildRoutesPublic, buildContentNegotiationRoutes } from "./lib/routes/public-routes.js";
 import { startBatchRefollow } from "./lib/batch-refollow.js";
-import { logActivity } from "./lib/activity-log.js";
-import { batchBroadcast } from "./lib/batch-broadcast.js";
 import { scheduleCleanup } from "./lib/timeline-cleanup.js";
 import { runSeparateMentionsMigration } from "./lib/migrations/separate-mentions.js";
 import { loadBlockedServersToRedis } from "./lib/storage/server-blocks.js";
@@ -113,141 +116,11 @@ export default class ActivityPubEndpoint {
    * @returns {Promise<CryptoKey|null>}
    */
   async _loadRsaPrivateKey() {
-    try {
-      const keyDoc = await this._collections.ap_keys.findOne({
-        privateKeyPem: { $exists: true },
-      });
-      if (!keyDoc?.privateKeyPem) return null;
-      const pemBody = keyDoc.privateKeyPem
-        .replace(/-----[^-]+-----/g, "")
-        .replace(/\s/g, "");
-      return await crypto.subtle.importKey(
-        "pkcs8",
-        Buffer.from(pemBody, "base64"),
-        { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
-        true,
-        ["sign"],
-      );
-    } catch (error) {
-      console.error("[ActivityPub] Failed to load RSA key:", error.message);
-      return null;
-    }
+    return loadRsaPrivateKey(this);
   }
 
   async followActor(actorUrl, actorInfo = {}) {
-    if (!this._federation) {
-      return { ok: false, error: "Federation not initialized" };
-    }
-
-    try {
-      const { Follow } = await import("@fedify/fedify/vocab");
-      const handle = this.options.actor.handle;
-      const ctx = this._federation.createContext(
-        new URL(this._publicationUrl),
-        { handle, publicationUrl: this._publicationUrl },
-      );
-
-      // Resolve the remote actor to get their inbox
-      // lookupWithSecurity handles signed→unsigned fallback automatically
-      const documentLoader = await ctx.getDocumentLoader({
-        identifier: handle,
-      });
-      const remoteActor = await lookupWithSecurity(ctx, actorUrl, {
-        documentLoader,
-      });
-      if (!remoteActor) {
-        return { ok: false, error: "Could not resolve remote actor" };
-      }
-
-      // Send Follow activity
-      if (needsDirectFollow(actorUrl)) {
-        // tags.pub rejects Fedify's LD Signature context (identity/v1).
-        // Send a minimal signed Follow directly, bypassing the outbox pipeline.
-        // See: https://github.com/social-web-foundation/tags.pub/issues/10
-        const rsaKey = await this._loadRsaPrivateKey();
-        if (!rsaKey) {
-          return { ok: false, error: "No RSA key available for direct follow" };
-        }
-        const result = await sendDirectFollow({
-          actorUri: ctx.getActorUri(handle).href,
-          targetActorUrl: actorUrl,
-          inboxUrl: remoteActor.inboxId?.href,
-          keyId: `${ctx.getActorUri(handle).href}#main-key`,
-          privateKey: rsaKey,
-        });
-        if (!result.ok) {
-          return { ok: false, error: result.error };
-        }
-      } else {
-        const follow = new Follow({
-          actor: ctx.getActorUri(handle),
-          object: new URL(actorUrl),
-        });
-        await ctx.sendActivity({ identifier: handle }, remoteActor, follow, {
-          orderingKey: actorUrl,
-        });
-      }
-
-      // Store in ap_following
-      const name =
-        actorInfo.name ||
-        remoteActor.name?.toString() ||
-        remoteActor.preferredUsername?.toString() ||
-        actorUrl;
-      const actorHandle =
-        actorInfo.handle ||
-        remoteActor.preferredUsername?.toString() ||
-        "";
-      const avatar =
-        actorInfo.photo ||
-        (remoteActor.icon
-          ? (await remoteActor.icon)?.url?.href || ""
-          : "");
-      const inbox = remoteActor.inboxId?.href || "";
-      const sharedInbox = remoteActor.endpoints?.sharedInbox?.href || "";
-
-      await this._collections.ap_following.updateOne(
-        { actorUrl },
-        {
-          $set: {
-            actorUrl,
-            handle: actorHandle,
-            name,
-            avatar,
-            inbox,
-            sharedInbox,
-            followedAt: new Date().toISOString(),
-            source: "reader",
-          },
-        },
-        { upsert: true },
-      );
-
-      console.info(`[ActivityPub] Sent Follow to ${actorUrl}`);
-
-      await logActivity(this._collections.ap_activities, {
-        direction: "outbound",
-        type: "Follow",
-        actorUrl: this._publicationUrl,
-        objectUrl: actorUrl,
-        actorName: name,
-        summary: `Sent Follow to ${name} (${actorUrl})`,
-      });
-
-      return { ok: true };
-    } catch (error) {
-      console.error(`[ActivityPub] Follow failed for ${actorUrl}:`, error.message);
-
-      await logActivity(this._collections.ap_activities, {
-        direction: "outbound",
-        type: "Follow",
-        actorUrl: this._publicationUrl,
-        objectUrl: actorUrl,
-        summary: `Follow failed for ${actorUrl}: ${error.message}`,
-      }).catch(() => {});
-
-      return { ok: false, error: error.message };
-    }
+    return followActor(this, actorUrl, actorInfo);
   }
 
   /**
@@ -256,277 +129,31 @@ export default class ActivityPubEndpoint {
    * @returns {Promise<{ok: boolean, error?: string}>}
    */
   async unfollowActor(actorUrl) {
-    if (!this._federation) {
-      return { ok: false, error: "Federation not initialized" };
-    }
-
-    try {
-      const { Follow, Undo } = await import("@fedify/fedify/vocab");
-      const handle = this.options.actor.handle;
-      const ctx = this._federation.createContext(
-        new URL(this._publicationUrl),
-        { handle, publicationUrl: this._publicationUrl },
-      );
-
-      // Use authenticated document loader for servers requiring Authorized Fetch
-      const documentLoader = await ctx.getDocumentLoader({
-        identifier: handle,
-      });
-      const remoteActor = await lookupWithSecurity(ctx,actorUrl, {
-        documentLoader,
-      });
-      if (!remoteActor) {
-        // Even if we can't resolve, remove locally
-        await this._collections.ap_following.deleteOne({ actorUrl });
-
-        await logActivity(this._collections.ap_activities, {
-          direction: "outbound",
-          type: "Undo(Follow)",
-          actorUrl: this._publicationUrl,
-          objectUrl: actorUrl,
-          summary: `Removed ${actorUrl} locally (could not resolve remote actor)`,
-        }).catch(() => {});
-
-        return { ok: true };
-      }
-
-      if (needsDirectFollow(actorUrl)) {
-        // tags.pub rejects Fedify's LD Signature context (identity/v1).
-        // See: https://github.com/social-web-foundation/tags.pub/issues/10
-        const rsaKey = await this._loadRsaPrivateKey();
-        if (rsaKey) {
-          const result = await sendDirectUnfollow({
-            actorUri: ctx.getActorUri(handle).href,
-            targetActorUrl: actorUrl,
-            inboxUrl: remoteActor.inboxId?.href,
-            keyId: `${ctx.getActorUri(handle).href}#main-key`,
-            privateKey: rsaKey,
-          });
-          if (!result.ok) {
-            console.warn(`[ActivityPub] Direct unfollow failed for ${actorUrl}: ${result.error}`);
-          }
-        }
-      } else {
-        const follow = new Follow({
-          actor: ctx.getActorUri(handle),
-          object: new URL(actorUrl),
-        });
-        const undo = new Undo({
-          actor: ctx.getActorUri(handle),
-          object: follow,
-        });
-        await ctx.sendActivity({ identifier: handle }, remoteActor, undo, {
-          orderingKey: actorUrl,
-        });
-      }
-      await this._collections.ap_following.deleteOne({ actorUrl });
-
-      console.info(`[ActivityPub] Sent Undo(Follow) to ${actorUrl}`);
-
-      await logActivity(this._collections.ap_activities, {
-        direction: "outbound",
-        type: "Undo(Follow)",
-        actorUrl: this._publicationUrl,
-        objectUrl: actorUrl,
-        summary: `Sent Undo(Follow) to ${actorUrl}`,
-      });
-
-      return { ok: true };
-    } catch (error) {
-      console.error(`[ActivityPub] Unfollow failed for ${actorUrl}:`, error.message);
-
-      await logActivity(this._collections.ap_activities, {
-        direction: "outbound",
-        type: "Undo(Follow)",
-        actorUrl: this._publicationUrl,
-        objectUrl: actorUrl,
-        summary: `Unfollow failed for ${actorUrl}: ${error.message}`,
-      }).catch(() => {});
-
-      // Remove locally even if remote delivery fails
-      await this._collections.ap_following.deleteOne({ actorUrl }).catch(() => {});
-      return { ok: false, error: error.message };
-    }
+    return unfollowActor(this, actorUrl);
   }
 
-  /**
-   * Send an Update(Person) activity to all followers so remote servers
-   * re-fetch the actor object (picking up profile changes, new featured
-   * collections, attachments, etc.).
-   *
-   * Delivery is batched to avoid a thundering herd: hundreds of remote
-   * servers simultaneously re-fetching the actor, featured posts, and
-   * featured tags after receiving the Update all at once.
-   */
   async broadcastActorUpdate() {
-    if (!this._federation) return;
-
-    try {
-      const { Update } = await import("@fedify/fedify/vocab");
-      const handle = this.options.actor.handle;
-      const ctx = this._federation.createContext(
-        new URL(this._publicationUrl),
-        { handle, publicationUrl: this._publicationUrl },
-      );
-
-      const actor = await buildPersonActor(
-        ctx,
-        handle,
-        this._collections,
-        this.options.actorType,
-      );
-      if (!actor) {
-        console.warn("[ActivityPub] broadcastActorUpdate: could not build actor");
-        return;
-      }
-
-      const update = new Update({
-        actor: ctx.getActorUri(handle),
-        object: actor,
-      });
-
-      await batchBroadcast({
-        federation: this._federation,
-        collections: this._collections,
-        publicationUrl: this._publicationUrl,
-        handle,
-        activity: update,
-        label: "Update(Person)",
-        objectUrl: this._getActorUrl(),
-      });
-    } catch (error) {
-      console.error("[ActivityPub] broadcastActorUpdate failed:", error.message);
-    }
+    return broadcastActorUpdate(this);
   }
 
-  /**
-   * Send Delete activity to all followers for a removed post.
-   * Mirrors broadcastActorUpdate() pattern: batch delivery with shared inbox dedup.
-   * @param {string} postUrl - Full URL of the deleted post
-   */
   async broadcastDelete(postUrl) {
-    if (!this._federation) return;
-
-    try {
-      const { Delete } = await import("@fedify/fedify/vocab");
-      const handle = this.options.actor.handle;
-      const ctx = this._federation.createContext(
-        new URL(this._publicationUrl),
-        { handle, publicationUrl: this._publicationUrl },
-      );
-
-      const del = new Delete({
-        actor: ctx.getActorUri(handle),
-        object: new URL(postUrl),
-      });
-
-      await batchBroadcast({
-        federation: this._federation,
-        collections: this._collections,
-        publicationUrl: this._publicationUrl,
-        handle,
-        activity: del,
-        label: "Delete",
-        objectUrl: postUrl,
-      });
-    } catch (error) {
-      console.warn("[ActivityPub] broadcastDelete failed:", error.message);
-    }
+    return broadcastDelete(this, postUrl);
   }
 
-  /**
-   * Called by post-content.js when a Micropub delete succeeds.
-   * Broadcasts an ActivityPub Delete activity to all followers.
-   * @param {string} url - Full URL of the deleted post
-   */
   async delete(url) {
-    // Record tombstone for FEP-4f05
-    try {
-      const { addTombstone } = await import("./lib/storage/tombstones.js");
-      const postsCol = this._collections.posts;
-      const post = postsCol ? await postsCol.findOne({ "properties.url": url }) : null;
-      await addTombstone(this._collections, {
-        url,
-        formerType: post?.properties?.["post-type"] === "article" ? "Article" : "Note",
-        published: post?.properties?.published || null,
-        deleted: new Date().toISOString(),
-      });
-    } catch (error) {
-      console.warn(`[ActivityPub] Tombstone creation failed for ${url}: ${error.message}`);
-    }
-
-    await this.broadcastDelete(url).catch((err) =>
-      console.warn(`[ActivityPub] broadcastDelete failed for ${url}: ${err.message}`)
-    );
+    return deletePost(this, url);
   }
 
-  /**
-   * Called by post-content.js when a Micropub update succeeds.
-   * Broadcasts an ActivityPub Update activity for the post to all followers.
-   * @param {object} properties - JF2 post properties (must include url)
-   */
   async update(properties) {
-    await this.broadcastPostUpdate(properties).catch((err) =>
-      console.warn(`[ActivityPub] broadcastPostUpdate failed for ${properties?.url}: ${err.message}`)
-    );
+    return updatePost(this, properties);
   }
 
-  /**
-   * Send an Update activity to all followers for a modified post.
-   * Mirrors broadcastDelete() pattern: batch delivery with shared inbox dedup.
-   * @param {object} properties - JF2 post properties
-   */
   async broadcastPostUpdate(properties) {
-    if (!this._federation) return;
-
-    try {
-      const { Update } = await import("@fedify/fedify/vocab");
-      const actorUrl = this._getActorUrl();
-      const handle = this.options.actor.handle;
-      const ctx = this._federation.createContext(
-        new URL(this._publicationUrl),
-        { handle, publicationUrl: this._publicationUrl },
-      );
-
-      const createActivity = jf2ToAS2Activity(
-        properties,
-        actorUrl,
-        this._publicationUrl,
-        { visibility: this.options.defaultVisibility },
-      );
-
-      if (!createActivity) {
-        console.warn(`[ActivityPub] broadcastPostUpdate: could not convert post to AS2 for ${properties?.url}`);
-        return;
-      }
-
-      const noteObject = await createActivity.getObject();
-      const activity = new Update({
-        actor: ctx.getActorUri(handle),
-        object: noteObject,
-      });
-
-      await batchBroadcast({
-        federation: this._federation,
-        collections: this._collections,
-        publicationUrl: this._publicationUrl,
-        handle,
-        activity,
-        label: "Update(Note)",
-        objectUrl: properties.url,
-      });
-    } catch (error) {
-      console.warn("[ActivityPub] broadcastPostUpdate failed:", error.message);
-    }
+    return broadcastPostUpdate(this, properties);
   }
 
-  /**
-   * Build the full actor URL from config.
-   * @returns {string}
-   */
   _getActorUrl() {
-    const base = this._publicationUrl.replace(/\/$/, "");
-    return `${base}${this.options.mountPath}/users/${this.options.actor.handle}`;
+    return getActorUrl(this);
   }
 
   init(Indiekit) {

package/lib/endpoint-federation.js

@@ -0,0 +1,407 @@
+/**
+ * Federation send-path actions, extracted from the index.js god-entry
+ * (Phase 2). Each takes `self` (the ActivityPubEndpoint instance); the class
+ * keeps thin delegating methods so the public interface + the init() facade
+ * are preserved. Internal cross-calls go directly to the module functions.
+ */
+import {
+  needsDirectFollow,
+  sendDirectFollow,
+  sendDirectUnfollow,
+} from "./direct-follow.js";
+import { lookupWithSecurity } from "./lookup-helpers.js";
+import { logActivity } from "./activity-log.js";
+import { batchBroadcast } from "./batch-broadcast.js";
+import { buildPersonActor } from "./federation-setup.js";
+import { jf2ToAS2Activity } from "./jf2-to-as2.js";
+
+/**
+ * Load the RSA private key from ap_keys for direct HTTP Signature signing.
+ * @returns {Promise<CryptoKey|null>}
+ */
+export async function loadRsaPrivateKey(self) {
+  try {
+    const keyDoc = await self._collections.ap_keys.findOne({
+      privateKeyPem: { $exists: true },
+    });
+    if (!keyDoc?.privateKeyPem) return null;
+    const pemBody = keyDoc.privateKeyPem
+      .replace(/-----[^-]+-----/g, "")
+      .replace(/\s/g, "");
+    return await crypto.subtle.importKey(
+      "pkcs8",
+      Buffer.from(pemBody, "base64"),
+      { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+      true,
+      ["sign"],
+    );
+  } catch (error) {
+    console.error("[ActivityPub] Failed to load RSA key:", error.message);
+    return null;
+  }
+}
+
+/** Send a Follow activity to a remote actor and store in ap_following. */
+export async function followActor(self, actorUrl, actorInfo = {}) {
+  if (!self._federation) {
+    return { ok: false, error: "Federation not initialized" };
+  }
+
+  try {
+    const { Follow } = await import("@fedify/fedify/vocab");
+    const handle = self.options.actor.handle;
+    const ctx = self._federation.createContext(
+      new URL(self._publicationUrl),
+      { handle, publicationUrl: self._publicationUrl },
+    );
+
+    // Resolve the remote actor to get their inbox
+    // lookupWithSecurity handles signed→unsigned fallback automatically
+    const documentLoader = await ctx.getDocumentLoader({
+      identifier: handle,
+    });
+    const remoteActor = await lookupWithSecurity(ctx, actorUrl, {
+      documentLoader,
+    });
+    if (!remoteActor) {
+      return { ok: false, error: "Could not resolve remote actor" };
+    }
+
+    // Send Follow activity
+    if (needsDirectFollow(actorUrl)) {
+      // tags.pub rejects Fedify's LD Signature context (identity/v1).
+      // Send a minimal signed Follow directly, bypassing the outbox pipeline.
+      // See: https://github.com/social-web-foundation/tags.pub/issues/10
+      const rsaKey = await loadRsaPrivateKey(self);
+      if (!rsaKey) {
+        return { ok: false, error: "No RSA key available for direct follow" };
+      }
+      const result = await sendDirectFollow({
+        actorUri: ctx.getActorUri(handle).href,
+        targetActorUrl: actorUrl,
+        inboxUrl: remoteActor.inboxId?.href,
+        keyId: `${ctx.getActorUri(handle).href}#main-key`,
+        privateKey: rsaKey,
+      });
+      if (!result.ok) {
+        return { ok: false, error: result.error };
+      }
+    } else {
+      const follow = new Follow({
+        actor: ctx.getActorUri(handle),
+        object: new URL(actorUrl),
+      });
+      await ctx.sendActivity({ identifier: handle }, remoteActor, follow, {
+        orderingKey: actorUrl,
+      });
+    }
+
+    // Store in ap_following
+    const name =
+      actorInfo.name ||
+      remoteActor.name?.toString() ||
+      remoteActor.preferredUsername?.toString() ||
+      actorUrl;
+    const actorHandle =
+      actorInfo.handle ||
+      remoteActor.preferredUsername?.toString() ||
+      "";
+    const avatar =
+      actorInfo.photo ||
+      (remoteActor.icon
+        ? (await remoteActor.icon)?.url?.href || ""
+        : "");
+    const inbox = remoteActor.inboxId?.href || "";
+    const sharedInbox = remoteActor.endpoints?.sharedInbox?.href || "";
+
+    await self._collections.ap_following.updateOne(
+      { actorUrl },
+      {
+        $set: {
+          actorUrl,
+          handle: actorHandle,
+          name,
+          avatar,
+          inbox,
+          sharedInbox,
+          followedAt: new Date().toISOString(),
+          source: "reader",
+        },
+      },
+      { upsert: true },
+    );
+
+    console.info(`[ActivityPub] Sent Follow to ${actorUrl}`);
+
+    await logActivity(self._collections.ap_activities, {
+      direction: "outbound",
+      type: "Follow",
+      actorUrl: self._publicationUrl,
+      objectUrl: actorUrl,
+      actorName: name,
+      summary: `Sent Follow to ${name} (${actorUrl})`,
+    });
+
+    return { ok: true };
+  } catch (error) {
+    console.error(`[ActivityPub] Follow failed for ${actorUrl}:`, error.message);
+
+    await logActivity(self._collections.ap_activities, {
+      direction: "outbound",
+      type: "Follow",
+      actorUrl: self._publicationUrl,
+      objectUrl: actorUrl,
+      summary: `Follow failed for ${actorUrl}: ${error.message}`,
+    }).catch(() => {});
+
+    return { ok: false, error: error.message };
+  }
+}
+
+/** Send an Undo(Follow) activity and remove from ap_following. */
+export async function unfollowActor(self, actorUrl) {
+  if (!self._federation) {
+    return { ok: false, error: "Federation not initialized" };
+  }
+
+  try {
+    const { Follow, Undo } = await import("@fedify/fedify/vocab");
+    const handle = self.options.actor.handle;
+    const ctx = self._federation.createContext(
+      new URL(self._publicationUrl),
+      { handle, publicationUrl: self._publicationUrl },
+    );
+
+    // Use authenticated document loader for servers requiring Authorized Fetch
+    const documentLoader = await ctx.getDocumentLoader({
+      identifier: handle,
+    });
+    const remoteActor = await lookupWithSecurity(ctx, actorUrl, {
+      documentLoader,
+    });
+    if (!remoteActor) {
+      // Even if we can't resolve, remove locally
+      await self._collections.ap_following.deleteOne({ actorUrl });
+
+      await logActivity(self._collections.ap_activities, {
+        direction: "outbound",
+        type: "Undo(Follow)",
+        actorUrl: self._publicationUrl,
+        objectUrl: actorUrl,
+        summary: `Removed ${actorUrl} locally (could not resolve remote actor)`,
+      }).catch(() => {});
+
+      return { ok: true };
+    }
+
+    if (needsDirectFollow(actorUrl)) {
+      // tags.pub rejects Fedify's LD Signature context (identity/v1).
+      // See: https://github.com/social-web-foundation/tags.pub/issues/10
+      const rsaKey = await loadRsaPrivateKey(self);
+      if (rsaKey) {
+        const result = await sendDirectUnfollow({
+          actorUri: ctx.getActorUri(handle).href,
+          targetActorUrl: actorUrl,
+          inboxUrl: remoteActor.inboxId?.href,
+          keyId: `${ctx.getActorUri(handle).href}#main-key`,
+          privateKey: rsaKey,
+        });
+        if (!result.ok) {
+          console.warn(`[ActivityPub] Direct unfollow failed for ${actorUrl}: ${result.error}`);
+        }
+      }
+    } else {
+      const follow = new Follow({
+        actor: ctx.getActorUri(handle),
+        object: new URL(actorUrl),
+      });
+      const undo = new Undo({
+        actor: ctx.getActorUri(handle),
+        object: follow,
+      });
+      await ctx.sendActivity({ identifier: handle }, remoteActor, undo, {
+        orderingKey: actorUrl,
+      });
+    }
+    await self._collections.ap_following.deleteOne({ actorUrl });
+
+    console.info(`[ActivityPub] Sent Undo(Follow) to ${actorUrl}`);
+
+    await logActivity(self._collections.ap_activities, {
+      direction: "outbound",
+      type: "Undo(Follow)",
+      actorUrl: self._publicationUrl,
+      objectUrl: actorUrl,
+      summary: `Sent Undo(Follow) to ${actorUrl}`,
+    });
+
+    return { ok: true };
+  } catch (error) {
+    console.error(`[ActivityPub] Unfollow failed for ${actorUrl}:`, error.message);
+
+    await logActivity(self._collections.ap_activities, {
+      direction: "outbound",
+      type: "Undo(Follow)",
+      actorUrl: self._publicationUrl,
+      objectUrl: actorUrl,
+      summary: `Unfollow failed for ${actorUrl}: ${error.message}`,
+    }).catch(() => {});
+
+    // Remove locally even if remote delivery fails
+    await self._collections.ap_following.deleteOne({ actorUrl }).catch(() => {});
+    return { ok: false, error: error.message };
+  }
+}
+
+/** Send an Update(Person) to all followers so they re-fetch the actor. */
+export async function broadcastActorUpdate(self) {
+  if (!self._federation) return;
+
+  try {
+    const { Update } = await import("@fedify/fedify/vocab");
+    const handle = self.options.actor.handle;
+    const ctx = self._federation.createContext(
+      new URL(self._publicationUrl),
+      { handle, publicationUrl: self._publicationUrl },
+    );
+
+    const actor = await buildPersonActor(
+      ctx,
+      handle,
+      self._collections,
+      self.options.actorType,
+    );
+    if (!actor) {
+      console.warn("[ActivityPub] broadcastActorUpdate: could not build actor");
+      return;
+    }
+
+    const update = new Update({
+      actor: ctx.getActorUri(handle),
+      object: actor,
+    });
+
+    await batchBroadcast({
+      federation: self._federation,
+      collections: self._collections,
+      publicationUrl: self._publicationUrl,
+      handle,
+      activity: update,
+      label: "Update(Person)",
+      objectUrl: getActorUrl(self),
+    });
+  } catch (error) {
+    console.error("[ActivityPub] broadcastActorUpdate failed:", error.message);
+  }
+}
+
+/** Send a Delete activity to all followers for a removed post. */
+export async function broadcastDelete(self, postUrl) {
+  if (!self._federation) return;
+
+  try {
+    const { Delete } = await import("@fedify/fedify/vocab");
+    const handle = self.options.actor.handle;
+    const ctx = self._federation.createContext(
+      new URL(self._publicationUrl),
+      { handle, publicationUrl: self._publicationUrl },
+    );
+
+    const del = new Delete({
+      actor: ctx.getActorUri(handle),
+      object: new URL(postUrl),
+    });
+
+    await batchBroadcast({
+      federation: self._federation,
+      collections: self._collections,
+      publicationUrl: self._publicationUrl,
+      handle,
+      activity: del,
+      label: "Delete",
+      objectUrl: postUrl,
+    });
+  } catch (error) {
+    console.warn("[ActivityPub] broadcastDelete failed:", error.message);
+  }
+}
+
+/** Micropub delete hook: record a tombstone (FEP-4f05) + broadcast Delete. */
+export async function deletePost(self, url) {
+  // Record tombstone for FEP-4f05
+  try {
+    const { addTombstone } = await import("./storage/tombstones.js");
+    const postsCol = self._collections.posts;
+    const post = postsCol ? await postsCol.findOne({ "properties.url": url }) : null;
+    await addTombstone(self._collections, {
+      url,
+      formerType: post?.properties?.["post-type"] === "article" ? "Article" : "Note",
+      published: post?.properties?.published || null,
+      deleted: new Date().toISOString(),
+    });
+  } catch (error) {
+    console.warn(`[ActivityPub] Tombstone creation failed for ${url}: ${error.message}`);
+  }
+
+  await broadcastDelete(self, url).catch((err) =>
+    console.warn(`[ActivityPub] broadcastDelete failed for ${url}: ${err.message}`)
+  );
+}
+
+/** Micropub update hook: broadcast an Update for the modified post. */
+export async function updatePost(self, properties) {
+  await broadcastPostUpdate(self, properties).catch((err) =>
+    console.warn(`[ActivityPub] broadcastPostUpdate failed for ${properties?.url}: ${err.message}`)
+  );
+}
+
+/** Send an Update activity to all followers for a modified post. */
+export async function broadcastPostUpdate(self, properties) {
+  if (!self._federation) return;
+
+  try {
+    const { Update } = await import("@fedify/fedify/vocab");
+    const actorUrl = getActorUrl(self);
+    const handle = self.options.actor.handle;
+    const ctx = self._federation.createContext(
+      new URL(self._publicationUrl),
+      { handle, publicationUrl: self._publicationUrl },
+    );
+
+    const createActivity = jf2ToAS2Activity(
+      properties,
+      actorUrl,
+      self._publicationUrl,
+      { visibility: self.options.defaultVisibility },
+    );
+
+    if (!createActivity) {
+      console.warn(`[ActivityPub] broadcastPostUpdate: could not convert post to AS2 for ${properties?.url}`);
+      return;
+    }
+
+    const noteObject = await createActivity.getObject();
+    const activity = new Update({
+      actor: ctx.getActorUri(handle),
+      object: noteObject,
+    });
+
+    await batchBroadcast({
+      federation: self._federation,
+      collections: self._collections,
+      publicationUrl: self._publicationUrl,
+      handle,
+      activity,
+      label: "Update(Note)",
+      objectUrl: properties.url,
+    });
+  } catch (error) {
+    console.warn("[ActivityPub] broadcastPostUpdate failed:", error.message);
+  }
+}
+
+/** Build the full actor URL from config. */
+export function getActorUrl(self) {
+  const base = self._publicationUrl.replace(/\/$/, "");
+  return `${base}${self.options.mountPath}/users/${self.options.actor.handle}`;
+}

package/lib/routes/public-routes.js

@@ -126,9 +126,13 @@ export function buildContentNegotiationRoutes(self) {
         return next();
       }
 
+      // Match regardless of trailing slash: posts are stored without one, but
+      // AS2 dereference requests (and nginx AS2 proxy passthrough) can arrive
+      // with a trailing slash. Try both so content negotiation stays robust.
       const requestUrl = `${self._publicationUrl}${req.path.slice(1)}`;
+      const requestUrlNoSlash = requestUrl.replace(/\/$/, "");
       const post = await postsCollection.findOne({
-        "properties.url": requestUrl,
+        "properties.url": { $in: [requestUrlNoSlash, `${requestUrlNoSlash}/`] },
       });
 
       if (!post || post.properties?.deleted) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "3.13.11",
+  "version": "3.13.13",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",