@rmdes/indiekit-endpoint-activitypub 3.13.7 → 3.13.9

package/index.js

@@ -1,5 +1,6 @@
 import express from "express";
 import { waitForReady } from "@rmdes/indiekit-startup-gate";
+import { ACTIVITYPUB_BLOCKS } from "./lib/blocks.js";
 
 import { setupFederation, buildPersonActor } from "./lib/federation-setup.js";
 import { createMastodonRouter } from "./lib/mastodon/router.js";
@@ -173,6 +174,10 @@ export default class ActivityPubEndpoint {
     this._fedifyMiddleware = null;
   }
 
+  get blocks() {
+    return ACTIVITYPUB_BLOCKS;
+  }
+
   get navigationItems() {
     return [
       {

package/lib/blocks.js

@@ -0,0 +1,37 @@
+/**
+ * ActivityPub v2 block declaration (Phase 7b — plugin block ownership).
+ *
+ * The `fediverse-follow` sidebar widget was a site-config BUILTIN_BLOCKS seed
+ * (requiresPlugin null, gated only by the theme's legacy widgetPluginRequirements
+ * render-map). Declaring it here makes site-config's scanPlugins stamp
+ * `sourcePlugin` → `requiresPlugin` ("ActivityPub endpoint"), so the block is
+ * properly plugin-gated (theme ENDPOINT_SLUGS maps it to the `activitypub`
+ * loadout slug). scanPlugins precedence is `built-in < plugin blocks`, so this
+ * entry OVERWRITES the builtin seed on sites where the plugin is loaded; the seed
+ * itself is removed from site-config in Phase 7d alongside the legacy-map bridge.
+ *
+ * activitypub is `default_enabled: false` — on a site without it loaded (e.g.
+ * chardonsbleus) the block correctly never appears in that site's catalog once
+ * the builtin seed is removed in 7d. Descriptor is byte-faithful to the
+ * BUILTIN_BLOCKS entry. Bespoke template: the theme owns
+ * `components/widgets/fediverse-follow.njk` (no generic `render.renderer`);
+ * `data.source:"config"` documents that it renders from config, not a runtime feed.
+ *
+ * @module lib/blocks
+ */
+
+/** @type {Array<object>} */
+export const ACTIVITYPUB_BLOCKS = [
+  {
+    id: "fediverse-follow",
+    version: 1,
+    label: "Fediverse Follow",
+    description: "Follow button for fediverse instances",
+    icon: "globe",
+    category: "social",
+    placement: { regions: ["sidebar"], surfaces: ["homepage"] },
+    multiple: false,
+    data: { source: "config" },
+    schema: { type: "object", additionalProperties: false, properties: {} },
+  },
+];

package/lib/jf2-to-as2.js

@@ -540,10 +540,12 @@ function buildPlainTags(properties, publicationUrl, existing) {
   const tags = [...(existing || [])];
   if (properties.category) {
     for (const cat of asArray(properties.category)) {
+      const value = categoryString(cat);
+      if (!value) continue;
       tags.push({
         type: "Hashtag",
-        name: `#${cat.split("/").at(-1).replace(/\s+/g, "")}`,
-        href: `${publicationUrl}categories/${encodeURIComponent(cat)}`,
+        name: `#${value.split("/").at(-1).replace(/\s+/g, "")}`,
+        href: `${publicationUrl}categories/${encodeURIComponent(value)}`,
       });
     }
   }
@@ -562,11 +564,13 @@ function buildFedifyTags(properties, publicationUrl, postType) {
   }
   if (properties.category) {
     for (const cat of asArray(properties.category)) {
+      const value = categoryString(cat);
+      if (!value) continue;
       tags.push(
         new Hashtag({
-          name: `#${cat.split("/").at(-1).replace(/\s+/g, "")}`,
+          name: `#${value.split("/").at(-1).replace(/\s+/g, "")}`,
           href: new URL(
-            `${publicationUrl}categories/${encodeURIComponent(cat)}`,
+            `${publicationUrl}categories/${encodeURIComponent(value)}`,
           ),
         }),
       );
@@ -583,6 +587,24 @@ function asArray(value) {
   return Array.isArray(value) ? value : [value];
 }
 
+/**
+ * Coerce a JF2 `category` entry to a hashtag-safe string, or null if it is not
+ * a plain tag.
+ *
+ * A Microformats/JF2 `category` array can legitimately contain non-strings —
+ * most commonly an IndieWeb person-tag (a nested h-card object), but malformed
+ * data can also yield null/number. Those are NOT hashtags. Returning null lets
+ * the tag builders skip them instead of crashing on `cat.split` (regression
+ * fixed 2026-06-06: "cat.split is not a function" broke ActivityPub syndication
+ * of any post carrying a person-tag).
+ *
+ * @param {unknown} cat
+ * @returns {string|null}
+ */
+function categoryString(cat) {
+  return typeof cat === "string" && cat.trim() !== "" ? cat : null;
+}
+
 function guessMediaType(url) {
   const ext = url.split(".").pop()?.toLowerCase();
   const types = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "3.13.7",
+  "version": "3.13.9",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",
@@ -22,6 +22,9 @@
   "type": "module",
   "main": "index.js",
   "exports": "./index.js",
+  "scripts": {
+    "test": "node --test tests/*.test.js"
+  },
   "files": [
     "assets",
     "lib",