@sdxc/activitypub 0.0.0-pre.1

package/dist/lib/inbox-summarize.js

@@ -0,0 +1,97 @@
+/**
+ * Turns a verified reply, mention, like or boost into the same summary a Webmention
+ * receiver stores, so an app keeps one moderation queue and one list of responses for
+ * both protocols, with remote HTML already sanitized for rendering beside its own.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import { HTML } from "@sdxc/html";
+import { isFailure } from "@sdxc/result";
+/**
+ * Summarizes a reply, mention, like or boost of local content. A Like with `content`
+ * (Misskey's emoji reaction) and Pleroma's `EmojiReact` read as `like`.
+ *
+ * @param inbound - What a `create`, `update`, `like` or `announce` handler received.
+ * @returns The summary, or `null` for any other activity or one with nothing local to attach to.
+ * @example
+ * let summary = summarize(inbound);
+ * if (summary) await filter.check({ content: summary.content?.html ?? "", format: "html", author: summary.author });
+ */
+export function summarize(inbound) {
+    let { activity, actor, object, target } = inbound;
+    if (target === null)
+        return null;
+    let author = authorOf(actor);
+    if (activity.type === "Create" || activity.type === "Update") {
+        if (object === null)
+            return null;
+        return {
+            kind: object.inReplyTo === target ? "reply" : "mention",
+            id: object.id,
+            url: object.url ?? object.id,
+            target,
+            author,
+            content: contentOf(object.content, object.id),
+            published: object.published ?? activity.published,
+        };
+    }
+    let kind = reactionKind(activity.type);
+    if (kind === null)
+        return null;
+    return {
+        kind,
+        id: activity.id,
+        url: activity.url ?? activity.id,
+        target,
+        author,
+        content: kind === "like" ? contentOf(activity.content, activity.id) : null,
+        published: activity.published,
+    };
+}
+/**
+ * The kind a reaction reads as.
+ *
+ * @param type - The activity's type.
+ */
+function reactionKind(type) {
+    if (type === "Like" || type === "EmojiReact")
+        return "like";
+    if (type === "Announce")
+        return "repost";
+    return null;
+}
+/**
+ * The byline of an actor.
+ *
+ * @param actor - The sender.
+ */
+function authorOf(actor) {
+    let host = URL.parse(actor.id)?.host ?? "";
+    return {
+        id: actor.id,
+        handle: `@${actor.preferredUsername}@${host}`,
+        name: actor.name,
+        url: actor.url ?? actor.id,
+        photo: actor.icon?.url ?? null,
+    };
+}
+/**
+ * Remote HTML made safe to render, with its relative URLs resolved against the object, and
+ * the text a reader sees in it. `null` when there is no content or no text survives.
+ *
+ * @param html - The remote markup.
+ * @param baseUrl - The object's id.
+ */
+function contentOf(html, baseUrl) {
+    if (html === null || html.trim() === "")
+        return null;
+    let sanitized = HTML.sanitize(html, { baseUrl });
+    if (isFailure(sanitized))
+        return null;
+    let parsed = HTML.parse(sanitized.data);
+    let text = isFailure(parsed) ? "" : parsed.data.text;
+    if (sanitized.data.trim() === "" && text === "")
+        return null;
+    return { html: sanitized.data, text };
+}

package/dist/lib/messages.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The one queue message shape federation work travels in: a verified inbox activity, a
+ * fan-out of a published activity, or one delivery to one inbox, told apart by `kind` so
+ * an app declares a single job and hands every message back to `Federation#process`.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import type { Schema } from "remix/data-schema";
+import type { FanOutInput } from "./delivery-fan-out.js";
+import type { DeliveryInput } from "./delivery-post.js";
+import type { Received } from "./inbox-receive.js";
+/** A verified activity the inbox accepted, processed by the app's handlers. */
+export interface InboxMessage extends Received {
+    kind: "inbox";
+}
+/** A published activity, turned into one delivery per distinct inbox. */
+export interface FanOutMessage extends FanOutInput {
+    kind: "fanOut";
+}
+/**
+ * One activity to one inbox. The activity travels whole, so every inbox receives the same
+ * bytes even after the post it describes changes.
+ */
+export interface DeliverMessage extends DeliveryInput {
+    kind: "deliver";
+}
+/** Every message federation enqueues; each fits a 128 KB queue message. */
+export type Message = InboxMessage | FanOutMessage | DeliverMessage;
+/**
+ * The Standard Schema of every message, so a job declared with it validates what the queue
+ * hands back before `process` reads it.
+ *
+ * @example federation: job({ input: Federation.MESSAGE })
+ */
+export declare const MESSAGE: Schema<unknown, Message>;

package/dist/lib/messages.js

@@ -0,0 +1,35 @@
+import * as s from "remix/data-schema";
+import { url } from "remix/data-schema/checks";
+import { isObject } from "./compact.js";
+import { VERIFICATIONS } from "./inbox-receive.js";
+/** A decoded JSON object, as an inbox message's `activity` carries one. */
+const JSON_OBJECT = s.createSchema((value, context) => isObject(value) ? { value } : s.fail("The activity must be a JSON object.", context.path));
+/**
+ * The Standard Schema of every message, so a job declared with it validates what the queue
+ * hands back before `process` reads it.
+ *
+ * @example federation: job({ input: Federation.MESSAGE })
+ */
+export const MESSAGE = s.variant("kind", {
+    inbox: s.object({
+        kind: s.literal("inbox"),
+        activity: JSON_OBJECT,
+        actor: s.string(),
+        signer: s.string(),
+        keyId: s.string(),
+        origin: s.string(),
+        verification: s.enum_(VERIFICATIONS),
+        receivedAt: s.string(),
+    }),
+    fanOut: s.object({
+        kind: s.literal("fanOut"),
+        actor: s.string().pipe(url()),
+        activity: s.string(),
+    }),
+    deliver: s.object({
+        kind: s.literal("deliver"),
+        actor: s.string().pipe(url()),
+        activity: s.string(),
+        inbox: s.string().pipe(url()),
+    }),
+});

package/dist/lib/parse.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Reads untrusted JSON into the `ActivityPub` vocabulary through `remix/data-schema`,
+ * one schema per document kind, so every inbound activity, actor, object and collection
+ * is validated and normalized before anything reads a member of it.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import type { Result } from "@sdxc/result";
+import { ActivityPubParseError } from "../errors.js";
+import type { ActivityPub } from "./types.js";
+/**
+ * Reads an activity from decoded JSON. It must have an absolute `id`, a `type` and an
+ * `actor`; any type name is accepted, so a handler acknowledges one it does not model.
+ *
+ * @param json - The decoded body, as `JSON.parse` returns it.
+ * @example
+ * let activity = parseActivity(await request.json());
+ * if (isFailure(activity)) return new Response(activity.error.message, { status: 400 });
+ */
+export declare function parseActivity(json: unknown): Result<ActivityPub.Activity, ActivityPubParseError>;
+/**
+ * Reads an actor from decoded JSON. It must be an actor type with an absolute `id`, a
+ * `preferredUsername` and an `inbox`, since Mastodon cannot follow one without them.
+ *
+ * @param json - The decoded actor document.
+ */
+export declare function parseActor(json: unknown): Result<ActivityPub.Actor, ActivityPubParseError>;
+/**
+ * Reads any object from decoded JSON, keeping its `type` whatever it is; a deleted one
+ * reads with `type: "Tombstone"`.
+ *
+ * @param json - The decoded object document.
+ */
+export declare function parseObject(json: unknown): Result<ActivityPub.Object, ActivityPubParseError>;
+/**
+ * Reads a collection or a collection page from decoded JSON, with its `first` page
+ * embedded or as an IRI, and every embedded item read as what it is.
+ *
+ * @param json - The decoded collection document.
+ */
+export declare function parseCollection(json: unknown): Result<ActivityPub.AnyCollection, ActivityPubParseError>;

package/dist/lib/parse.js

@@ -0,0 +1,348 @@
+import { failure, success } from "@sdxc/result";
+import { createSchema, fail, object, parseSafe } from "remix/data-schema";
+import { lazy } from "remix/data-schema/lazy";
+import { ActivityPubParseError } from "../errors.js";
+import { absoluteIri, attachments, optionalAbsoluteIri, count, date, documentType, endpoints, flag, htmlUrl, image, iri, iris, isObject, languageMap, multikeys, proofs, publicKey, runAt, tags, text, withMapFallback, } from "./compact.js";
+import { ACTIVITY_TYPES, ACTOR_TYPES } from "./constants.js";
+/** Actor types, for telling an embedded actor from any other embedded object. */
+const ACTOR_TYPE_SET = new Set(ACTOR_TYPES);
+/** The collection types, each read by its own schema. */
+const COLLECTION_TYPES = new Set([
+    "Collection",
+    "CollectionPage",
+    "OrderedCollection",
+    "OrderedCollectionPage",
+]);
+/**
+ * Types preferred when a sender lists several, so `["Note", "x:Custom"]` reads as `Note`
+ * whatever order the sender chose.
+ */
+const KNOWN_TYPES = new Set([
+    ...ACTIVITY_TYPES,
+    ...ACTOR_TYPES,
+    ...COLLECTION_TYPES,
+    "Article",
+    "Audio",
+    "Document",
+    "Event",
+    "Image",
+    "Note",
+    "Page",
+    "Place",
+    "Profile",
+    "Relationship",
+    "Tombstone",
+    "Video",
+]);
+/** The members every object shares, under their wire names. */
+const OBJECT_SHAPE = {
+    id: absoluteIri("id"),
+    type: documentType(KNOWN_TYPES),
+    attributedTo: iris(),
+    to: iris({ addressing: true }),
+    cc: iris({ addressing: true }),
+    bto: iris({ addressing: true }),
+    bcc: iris({ addressing: true }),
+    name: text(),
+    nameMap: languageMap(),
+    summary: text(),
+    summaryMap: languageMap(),
+    content: text(),
+    contentMap: languageMap(),
+    url: htmlUrl(),
+    inReplyTo: iri(),
+    quote: iri(),
+    quoteUrl: iri(),
+    quoteUri: iri(),
+    _misskey_quote: iri(),
+    published: date(),
+    updated: date(),
+    sensitive: flag(),
+    tag: tags(),
+    attachment: attachments(),
+    proof: proofs(),
+};
+/**
+ * Folds the wire variations into the API shape: plain text from a language map when
+ * only the map was sent, and one `quote` from whichever of its four names arrived.
+ *
+ * @param wire - The validated members.
+ */
+function toObject(wire) {
+    return {
+        id: wire.id,
+        type: wire.type,
+        attributedTo: wire.attributedTo,
+        to: wire.to,
+        cc: wire.cc,
+        bto: wire.bto,
+        bcc: wire.bcc,
+        name: withMapFallback(wire.name, wire.nameMap),
+        nameMap: wire.nameMap,
+        summary: withMapFallback(wire.summary, wire.summaryMap),
+        summaryMap: wire.summaryMap,
+        content: withMapFallback(wire.content, wire.contentMap),
+        contentMap: wire.contentMap,
+        url: wire.url,
+        inReplyTo: wire.inReplyTo,
+        quote: wire.quote ?? wire.quoteUrl ?? wire.quoteUri ?? wire._misskey_quote,
+        published: wire.published,
+        updated: wire.updated,
+        sensitive: wire.sensitive,
+        tag: wire.tag,
+        attachment: wire.attachment,
+        proof: wire.proof,
+    };
+}
+/** Any object, its type kept whatever it is. */
+const OBJECT_SCHEMA = object(OBJECT_SHAPE).transform(toObject);
+/**
+ * An embedded entry (an activity's `object`, a collection item) read as what it is: an
+ * IRI, an activity when it names an `actor`, an actor when its type is one, else an object.
+ */
+const ITEM_SCHEMA = createSchema((value, context) => {
+    if (typeof value === "string")
+        return { value };
+    if (!isObject(value)) {
+        return fail("An entry must be an IRI or an embedded object.", context.path);
+    }
+    return schemaFor(value)["~run"](value, context);
+});
+/** An activity's `object`: the first entry when an array was sent, `null` when absent. */
+const ACTIVITY_OBJECT_SCHEMA = createSchema((value, context) => {
+    if (value === undefined || value === null)
+        return { value: null };
+    if (!Array.isArray(value))
+        return ITEM_SCHEMA["~run"](value, context);
+    if (value.length === 0)
+        return { value: null };
+    return runAt(ITEM_SCHEMA, value[0], context, 0);
+});
+/** An activity. Its type may be any name, so an app can acknowledge one it does not handle. */
+const ACTIVITY_SCHEMA = object({
+    ...OBJECT_SHAPE,
+    actor: iri({ required: true, label: "actor" }),
+    object: lazy(() => ACTIVITY_OBJECT_SCHEMA),
+    target: iri(),
+    _misskey_reaction: text(),
+}).transform(({ actor, object, target, _misskey_reaction, ...wire }) => {
+    let base = toObject(wire);
+    return { ...base, content: base.content ?? _misskey_reaction, actor, object, target };
+});
+/** An actor, whose `inbox` and `preferredUsername` Mastodon requires to follow it. */
+const ACTOR_SCHEMA = object({
+    ...OBJECT_SHAPE,
+    type: documentType(KNOWN_TYPES).refine((type) => ACTOR_TYPE_SET.has(type), `"type" must be one of ${ACTOR_TYPES.join(", ")}.`),
+    preferredUsername: createSchema((value, context) => typeof value === "string" && value !== ""
+        ? { value }
+        : fail('"preferredUsername" is required.', context.path)),
+    inbox: absoluteIri("inbox"),
+    outbox: iri(),
+    followers: iri(),
+    following: iri(),
+    featured: iri(),
+    endpoints: endpoints(),
+    publicKey: publicKey(),
+    assertionMethod: multikeys(),
+    alsoKnownAs: iris(),
+    movedTo: iri(),
+    manuallyApprovesFollowers: flag(),
+    discoverable: flag(),
+    indexable: flag(),
+    icon: image(),
+    image: image(),
+}).transform(({ type, preferredUsername, inbox, outbox, followers, following, featured, endpoints, publicKey, assertionMethod, alsoKnownAs, movedTo, manuallyApprovesFollowers, discoverable, indexable, icon, image, ...wire }) => ({
+    ...toObject({ ...wire, type }),
+    type: type,
+    preferredUsername,
+    inbox,
+    outbox,
+    followers,
+    following,
+    featured,
+    endpoints,
+    publicKey,
+    assertionMethod,
+    alsoKnownAs,
+    movedTo,
+    manuallyApprovesFollowers,
+    discoverable,
+    indexable,
+    icon,
+    image,
+}));
+/**
+ * The schema an embedded object is read with. An actor type without an `inbox` reads
+ * as a plain object, since some servers embed a partial actor in an activity.
+ *
+ * @param value - The embedded object.
+ */
+function schemaFor(value) {
+    if (value.actor !== undefined)
+        return ACTIVITY_SCHEMA;
+    let types = Array.isArray(value.type) ? value.type : [value.type];
+    if (types.some((type) => ACTOR_TYPE_SET.has(String(type))) && value.inbox !== undefined) {
+        return ACTOR_SCHEMA;
+    }
+    return OBJECT_SCHEMA;
+}
+/** Collection entries, sent as one entry or an array; each must read. */
+const ITEMS_SCHEMA = createSchema((value, context) => {
+    if (value === undefined || value === null)
+        return { value: [] };
+    if (!Array.isArray(value)) {
+        let single = ITEM_SCHEMA["~run"](value, context);
+        return single.issues ? single : { value: [single.value] };
+    }
+    let items = [];
+    let issues = [];
+    for (let [index, entry] of value.entries()) {
+        let result = runAt(ITEM_SCHEMA, entry, context, index);
+        if (result.issues)
+            issues.push(...result.issues);
+        else
+            items.push(result.value);
+    }
+    return issues.length > 0 ? { issues } : { value: items };
+});
+/** The members a page of either kind has besides its items. */
+const PAGE_SHAPE = {
+    id: optionalAbsoluteIri("id"),
+    partOf: iri(),
+    next: iri(),
+    prev: iri(),
+    totalItems: count(),
+};
+/** A collection's `first`: an IRI, or the first page embedded, as Mastodon does for replies. */
+const FIRST_PAGE_SCHEMA = createSchema((value, context) => {
+    if (value === undefined || value === null)
+        return { value: null };
+    if (typeof value === "string")
+        return { value };
+    return PAGE_SCHEMA["~run"](value, context);
+});
+/** Either page shape, chosen by `type`. */
+const PAGE_SCHEMA = createSchema((value, context) => {
+    if (!isObject(value))
+        return fail("A page must be an object.", context.path);
+    let type = Array.isArray(value.type) ? value.type : [value.type];
+    if (type.includes("OrderedCollectionPage")) {
+        return ORDERED_PAGE_SCHEMA["~run"](value, context);
+    }
+    if (type.includes("CollectionPage"))
+        return UNORDERED_PAGE_SCHEMA["~run"](value, context);
+    return fail('"type" must be CollectionPage or OrderedCollectionPage.', [
+        ...context.path,
+        "type",
+    ]);
+});
+/** An unordered page. */
+const UNORDERED_PAGE_SCHEMA = object({
+    ...PAGE_SHAPE,
+    items: ITEMS_SCHEMA,
+}).transform((page) => ({ ...page, type: "CollectionPage" }));
+/** An ordered page. */
+const ORDERED_PAGE_SCHEMA = object({
+    ...PAGE_SHAPE,
+    orderedItems: ITEMS_SCHEMA,
+}).transform((page) => ({ ...page, type: "OrderedCollectionPage" }));
+/** The members a collection of either kind has besides its items. */
+const COLLECTION_SHAPE = {
+    id: absoluteIri("id"),
+    totalItems: count(),
+    first: FIRST_PAGE_SCHEMA,
+    last: iri(),
+};
+/** An unordered collection. */
+const UNORDERED_COLLECTION_SCHEMA = object({
+    ...COLLECTION_SHAPE,
+    items: ITEMS_SCHEMA,
+}).transform((collection) => ({ ...collection, type: "Collection" }));
+/** An ordered collection. */
+const ORDERED_COLLECTION_SCHEMA = object({
+    ...COLLECTION_SHAPE,
+    orderedItems: ITEMS_SCHEMA,
+}).transform((collection) => ({ ...collection, type: "OrderedCollection" }));
+/** Any of the four collection shapes, chosen by `type`. */
+const COLLECTION_SCHEMA = createSchema((value, context) => {
+    if (!isObject(value))
+        return fail("A collection must be an object.", context.path);
+    let types = Array.isArray(value.type) ? value.type : [value.type];
+    if (types.includes("OrderedCollection")) {
+        return ORDERED_COLLECTION_SCHEMA["~run"](value, context);
+    }
+    if (types.includes("Collection"))
+        return UNORDERED_COLLECTION_SCHEMA["~run"](value, context);
+    if (types.includes("OrderedCollectionPage") || types.includes("CollectionPage")) {
+        return PAGE_SCHEMA["~run"](value, context);
+    }
+    return fail('"type" must be a collection or collection page type.', [...context.path, "type"]);
+});
+/**
+ * A JSON Pointer (RFC 6901) from a data-schema issue path, escaping `~` and `/` so a
+ * member name holding either still points at itself.
+ *
+ * @param path - The issue's path, outermost first.
+ */
+function pointerOf(path) {
+    return (path ?? [])
+        .map((segment) => (typeof segment === "object" ? segment.key : segment))
+        .map((segment) => `/${String(segment).replace(/~/g, "~0").replace(/\//g, "~1")}`)
+        .join("");
+}
+/**
+ * Validates a decoded document, answering every issue with a pointer into it.
+ *
+ * @param schema - The document kind's schema.
+ * @param kind - The document kind, for the error.
+ * @param json - The decoded JSON.
+ * @template Output - What the schema produces.
+ */
+function read(schema, kind, json) {
+    if (!isObject(json)) {
+        return failure(new ActivityPubParseError(kind, [{ at: "", message: "The document is not a JSON object." }]));
+    }
+    let result = parseSafe(schema, json);
+    if (result.success)
+        return success(result.value);
+    return failure(new ActivityPubParseError(kind, result.issues.map((issue) => ({ at: pointerOf(issue.path), message: issue.message }))));
+}
+/**
+ * Reads an activity from decoded JSON. It must have an absolute `id`, a `type` and an
+ * `actor`; any type name is accepted, so a handler acknowledges one it does not model.
+ *
+ * @param json - The decoded body, as `JSON.parse` returns it.
+ * @example
+ * let activity = parseActivity(await request.json());
+ * if (isFailure(activity)) return new Response(activity.error.message, { status: 400 });
+ */
+export function parseActivity(json) {
+    return read(ACTIVITY_SCHEMA, "activity", json);
+}
+/**
+ * Reads an actor from decoded JSON. It must be an actor type with an absolute `id`, a
+ * `preferredUsername` and an `inbox`, since Mastodon cannot follow one without them.
+ *
+ * @param json - The decoded actor document.
+ */
+export function parseActor(json) {
+    return read(ACTOR_SCHEMA, "actor", json);
+}
+/**
+ * Reads any object from decoded JSON, keeping its `type` whatever it is; a deleted one
+ * reads with `type: "Tombstone"`.
+ *
+ * @param json - The decoded object document.
+ */
+export function parseObject(json) {
+    return read(OBJECT_SCHEMA, "object", json);
+}
+/**
+ * Reads a collection or a collection page from decoded JSON, with its `first` page
+ * embedded or as an IRI, and every embedded item read as what it is.
+ *
+ * @param json - The decoded collection document.
+ */
+export function parseCollection(json) {
+    return read(COLLECTION_SCHEMA, "collection", json);
+}

package/dist/lib/response.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Serving ActivityPub documents: telling an AS2 client from a browser on a URL that has
+ * both representations, and answering with the media type, cache headers and status a
+ * remote server expects, including `410` for something deleted.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import type { PolicyOptions } from "@sdxc/http/cache";
+import type { ActivityPub } from "./types.js";
+/** How a document is answered. */
+export interface RespondOptions {
+    /** Enables a 304 when `If-None-Match` still matches, and an empty body for `HEAD`. */
+    request?: Request;
+    /** Adds `Vary: Accept`, which a URL that also serves HTML needs so caches keep both. */
+    vary?: boolean;
+    /** @default { visibility: "public", maxAge: "5 minutes" } */
+    cache?: PolicyOptions;
+    /** Extra headers, applied last so they override the defaults. */
+    headers?: HeadersInit;
+    /** @default 200, or 410 for a Tombstone */
+    status?: number;
+}
+/**
+ * Whether a request asks for the ActivityStreams representation: `true` only when
+ * `application/activity+json` or `application/ld+json` is preferred over `text/html`.
+ * A browser's wildcard and a request without `Accept` read as HTML.
+ *
+ * @param request - The incoming request.
+ * @example
+ * if (wantsActivity(request)) return respond(article, { request, vary: true });
+ */
+export declare function wantsActivity(request: Request): boolean;
+/**
+ * The document as a `Response`: `application/activity+json; charset=utf-8`, a
+ * `Cache-Control` from `policy()`, an `ETag` over the body, `Vary: Accept` when asked,
+ * and a 304 through `conditional()` when `request` is given. A `Tombstone` answers
+ * `410`, which is how a refetching server learns the object was deleted.
+ *
+ * @param document - Any document, parsed or authored.
+ * @param options - The request, `Vary`, the cache policy, extra headers and the status.
+ * @example
+ * return respond(actor, { request: ctx.request, vary: true });
+ */
+export declare function respond(document: ActivityPub.Draft<ActivityPub.Document>, options?: RespondOptions): Promise<Response>;

package/dist/lib/response.js

@@ -0,0 +1,59 @@
+import { conditional, etag, policy, vary } from "@sdxc/http/cache";
+import { accepts } from "@sdxc/http/negotiate";
+import { ACTIVITY_CONTENT_TYPE, ACTIVITY_JSON, LD_JSON } from "./constants.js";
+import { stringify } from "./stringify.js";
+/**
+ * The cache policy a document gets unless the caller states one: short enough that an
+ * edit reaches a refetching server within minutes.
+ */
+const DEFAULT_CACHE = { visibility: "public", maxAge: "5 minutes" };
+/**
+ * The candidates `wantsActivity` negotiates between. HTML is first, so a wildcard or a
+ * missing `Accept` resolves to the page a browser or crawler expects.
+ */
+const NEGOTIATED_TYPES = ["text/html", ACTIVITY_JSON, LD_JSON];
+/**
+ * Whether a request asks for the ActivityStreams representation: `true` only when
+ * `application/activity+json` or `application/ld+json` is preferred over `text/html`.
+ * A browser's wildcard and a request without `Accept` read as HTML.
+ *
+ * @param request - The incoming request.
+ * @example
+ * if (wantsActivity(request)) return respond(article, { request, vary: true });
+ */
+export function wantsActivity(request) {
+    let preferred = accepts(request).preferred(...NEGOTIATED_TYPES);
+    return preferred === ACTIVITY_JSON || preferred === LD_JSON;
+}
+/**
+ * The document as a `Response`: `application/activity+json; charset=utf-8`, a
+ * `Cache-Control` from `policy()`, an `ETag` over the body, `Vary: Accept` when asked,
+ * and a 304 through `conditional()` when `request` is given. A `Tombstone` answers
+ * `410`, which is how a refetching server learns the object was deleted.
+ *
+ * @param document - Any document, parsed or authored.
+ * @param options - The request, `Vary`, the cache policy, extra headers and the status.
+ * @example
+ * return respond(actor, { request: ctx.request, vary: true });
+ */
+export async function respond(document, options = {}) {
+    let body = stringify(document);
+    let headers = new Headers({
+        "Content-Type": ACTIVITY_CONTENT_TYPE,
+        "Cache-Control": policy(options.cache ?? DEFAULT_CACHE).toString(),
+    });
+    let tag = await etag(body);
+    if (tag.status === "success")
+        headers.set("ETag", tag.data);
+    if (options.vary)
+        vary(headers, "Accept");
+    for (let [name, value] of new Headers(options.headers))
+        headers.set(name, value);
+    let status = options.status ?? (document.type === "Tombstone" ? 410 : 200);
+    let request = options.request;
+    let isHead = request?.method.toUpperCase() === "HEAD";
+    let response = new Response(isHead ? null : body, { status, headers });
+    if (request === undefined)
+        return response;
+    return await conditional(request, response);
+}