fedipod-server 0.29.0 → 0.31.0

package/lib/core/wire.mjs

@@ -1,925 +0,0 @@
-// wire.mjs — builders for the opaque AS2/JSON wire documents the remote pod
-// serves (see claude/plans/ap-pod-mapping.md, "Remote pod layout"). These are
-// protocol documents, not our RDF.
-
-export const AS_CTX = 'https://www.w3.org/ns/activitystreams';
-// Lemmy's own context, held locally (lib/core/contexts/join-lemmy.json). It
-// names the three terms a Lemmy reader looks for on a community and its
-// posts: postingRestrictedToMods, stickied, commentsEnabled.
-export const LEMMY_CTX = 'https://join-lemmy.org/context.json';
-export const SEC_CTX = 'https://w3id.org/security/v1';
-export const PUBLIC = 'https://www.w3.org/ns/activitystreams#Public';
-
-// The pod LAYOUT — which container each document lives in — moved into the pod
-// library (lib/pod/urls.mjs), which knows nothing about FediPod and requires
-// the container root to be stated rather than defaulted. What stays here is
-// FediPod's own answer to "which root", and the handle rule, both of which read
-// this application's config shape.
-import { apUrls as podUrls } from '../pod/urls.mjs';
-
-export { webfingerHost } from '../pod/urls.mjs';
-
-// The container the Node agent has always used. Older than the rename to
-// FediPod and kept because it is what every existing Node-side pod actually
-// contains; the browser build states `fedipod/` on its own configs. A config
-// that names a root is always believed — this is only the answer for one that
-// does not.
-// Every build writes its data into a `fedipod/` container in the pod. This is
-// the answer for a config that names no root; a config that names one is always
-// believed. (`activitypods-js/` was an earlier name, now abandoned.)
-export const DEFAULT_ROOT = 'fedipod/';
-
-// The handle the fediverse sees: a fronted identity's name is the front's.
-export function publicHandle(config) {
-  return config?.gateway?.frontActor?.match(/\/u\/([^/]+)\/ap\/actor\/?$/)?.[1]
-    || config?.handle || null;
-}
-
-/**
- * The AP URLs for an identity, with FediPod's default root applied.
- *
- * The library underneath refuses to guess a root. Every caller here goes
- * through this wrapper so there is exactly ONE answer to "which container",
- * which is the thing that was wrong: the browser agent decided `fedipod/` for
- * its own urls while the publisher, handed a config with no `root`, decided
- * `activitypods-js/` — putting an identity's state in one container and its
- * published documents in another.
- */
-export function apUrls(remotePod, root, opts = {}) {
-  return podUrls(remotePod, root || DEFAULT_ROOT, opts);
-}
-
-// RFC 6415 host-meta: several fediverse implementations discover WebFinger
-// through this LRDD template rather than hitting /.well-known/webfinger
-// directly.
-export function hostMeta(base) {
-  return `<?xml version="1.0" encoding="UTF-8"?>\n<XRD xmlns="http://docs.oasis-open.org/ns/xri/xrd-1.0">\n  <Link rel="lrdd" template="${base}.well-known/webfinger?resource={uri}"/>\n</XRD>\n`;
-}
-
-export function jrd({ handle, host, actor, aliases = [], page = null }) {
-  return {
-    subject: `acct:${handle}@${host}`,
-    ...(aliases.length ? { aliases } : {}),
-    links: [
-      { rel: 'self', type: 'application/activity+json', href: actor },
-      ...(page ? [{ rel: 'http://webfinger.net/rel/profile-page', type: 'text/html', href: page }] : []),
-    ],
-  };
-}
-
-// `kind: 'group'` publishes a Group rather than a Person, which is what makes
-// Mastodon and Lemmy treat the actor as a community you join.
-// Whether a follow will be held for the operator instead of accepted on
-// arrival. A person's follows wait unless `autoAcceptFollows` says otherwise,
-// because a delivery on its own proves nothing about who sent it; a group is
-// open unless its operator asked to see joins. The actor document has to say
-// the same thing, or a remote server shows "Following" for a follow that is
-// in fact still waiting, and nothing ever tells it otherwise.
-export function followsNeedApproval(config = {}) {
-  return !!config.approveJoins || (config.kind !== 'group' && !config.autoAcceptFollows);
-}
-
-export const assertionKeyId = (urls) => urls.actor + '#ed25519-key';
-
-export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null, movedTo = null, kind = 'person',
-  approveJoins = false, summary = null, icon = null, image = null, fields = [],
-  webId = null, aliases = [], moderators = null, pendingFollowers = null, pendingFollowing = null, liked = null,
-  ownerOutbox = null,
-  blocked = null, inbox = null, outbox = null, oauthAuthorize = null, oauthToken = null,
-  postingRestrictedToMods = null }) {
-  // manuallyApprovesFollowers is NOT in the base AS2 context, so it is declared
-  // inline exactly as Mastodon declares it — and only when we actually use it.
-  // It is what makes a client show "Request to follow" rather than "Follow" and
-  // then sit in Requested with no explanation.
-  // PropertyValue is the same case: schema.org's, declared the way Mastodon
-  // declares it, and only when there are fields to carry. `image` (the banner)
-  // and `attachment` are both plain AS2 and need no declaration.
-  const context = [AS_CTX, SEC_CTX];
-  // `featured` is Mastodon's term for the pinned-posts collection, declared
-  // inline exactly as Mastodon declares it.
-  context.push({ toot: 'http://joinmastodon.org/ns#', featured: { '@id': 'toot:featured', '@type': '@id' } });
-  if (approveJoins) context.push({ manuallyApprovesFollowers: 'as:manuallyApprovesFollowers' });
-  // FEP-8b32. The Multikey is a SECOND key beside publicKey/#main-key, not a
-  // replacement: HTTP signatures stay RSA, and only the proof is Ed25519.
-  // `assertionMethod` comes from the DID context and the key's own terms from
-  // the Multikey one; the proof's terms travel with the proof, not here.
-  if (assertionKey) context.push('https://www.w3.org/ns/did/v1',
-    'https://w3id.org/security/multikey/v1');
-  // FEP-4ccd and FEP-c648 terms, declared exactly as those FEPs declare them,
-  // and only when the collections are actually published.
-  if (pendingFollowers || pendingFollowing) {
-    context.push({
-      pdg: 'https://purl.archive.org/socialweb/pending#',
-      pendingFollowers: { '@id': 'pdg:pendingFollowers', '@type': '@id' },
-      pendingFollowing: { '@id': 'pdg:pendingFollowing', '@type': '@id' },
-    });
-  }
-  if (blocked) {
-    context.push({
-      bl: 'https://purl.archive.org/socialweb/blocked#',
-      blocked: { '@id': 'bl:blocked', '@type': '@id' },
-    });
-  }
-  if (ownerOutbox) {
-    context.push({
-      fedipod: 'https://fedipod.net/ns#',
-      ownerOutbox: { '@id': 'fedipod:ownerOutbox', '@type': '@id' },
-    });
-  }
-  // The actor's other identities: the account's WebID, plus any aliases —
-  // old accounts elsewhere whose servers check for their own URL here before
-  // they will send a Move. Declared inline exactly as Mastodon declares it.
-  if (webId || aliases.length) context.push({ alsoKnownAs: { '@id': 'as:alsoKnownAs', '@type': '@id' } });
-  // A community says whether only its moderators may open posts in it, in
-  // Lemmy's term, declared through Lemmy's context. Groups only.
-  if (kind === 'group' && postingRestrictedToMods !== null) context.push(LEMMY_CTX);
-  if (fields.length) {
-    context.push({ schema: 'http://schema.org#', PropertyValue: 'schema:PropertyValue', value: 'schema:value' });
-  }
-  return {
-    '@context': context,
-    id: urls.actor,
-    // A group is a community; an application is a service that speaks for a
-    // site rather than a person — the actor a forum publishes for itself.
-    type: kind === 'group' ? 'Group' : kind === 'application' ? 'Application' : 'Person',
-    ...(approveJoins ? { manuallyApprovesFollowers: true } : {}),
-    ...(assertionKey ? { assertionMethod: [{
-      id: assertionKeyId(urls), type: 'Multikey', controller: urls.actor,
-      publicKeyMultibase: assertionKey,
-    }] } : {}),
-    ...(movedTo ? { movedTo } : {}),
-    ...(webId || aliases.length ? { alsoKnownAs: [...(webId ? [webId] : []), ...aliases] } : {}),
-    ...(kind === 'group' && postingRestrictedToMods !== null ? { postingRestrictedToMods: !!postingRestrictedToMods } : {}),
-    preferredUsername: handle,
-    name: name || handle,
-    // The bio, and the avatar. For a group, `summary` is where what the group
-    // is for goes — there is nowhere else for it.
-    ...(summary ? { summary: contentHtml(summary) } : {}),
-    ...(icon ? { icon: { type: 'Image', url: icon } } : {}),
-    // The banner behind the avatar, and the labelled rows a client shows under
-    // the bio — what Mastodon's profile editor calls Header picture and Extra
-    // fields. Both are what every other server publishes for the same thing.
-    ...(image ? { image: { type: 'Image', url: image } } : {}),
-    // Escaped, not run through contentHtml: a field value is one inline row,
-    // and wrapping it in <p> renders as a paragraph inside a table cell.
-    ...(fields.length ? {
-      attachment: fields.map(f => ({
-        type: 'PropertyValue',
-        name: String(f.name).replace(/[&<>]/g, c => HTML_ESCAPES[c]),
-        value: String(f.value).replace(/[&<>]/g, c => HTML_ESCAPES[c]),
-      })),
-    } : {}),
-    // The human page. Remote servers send profile clicks here, so it must be
-    // something a person can read — the pod root is not.
-    url: urls.profileHtml,
-    // Normally the pod inbox (which buffers with nothing running). When an
-    // inbox gateway is advertised, deliveries go to it instead — it verifies
-    // and forwards into this same pod inbox for the drain.
-    inbox: inbox || urls.inbox,
-    // Every Mastodon actor publishes one. With a single actor per pod ours is
-    // just the inbox, but its absence is the non-standard thing.
-    //
-    // The two OAuth entries are how a client-to-server client finds its way in
-    // without being told anything by hand (ActivityPub 4.1). They appear only
-    // where this identity's client surface answers on an address a stranger
-    // can reach, which is why the caller supplies them rather than this
-    // building them from the pod URL.
-    endpoints: {
-      sharedInbox: inbox || urls.inbox,
-      ...(oauthAuthorize ? { oauthAuthorizationEndpoint: oauthAuthorize } : {}),
-      ...(oauthToken ? { oauthTokenEndpoint: oauthToken } : {}),
-    },
-    // Where a client sends what this actor writes, which the protocol says is
-    // this same address. The pod holds the collection and answers reads of it;
-    // a client-to-server write has to reach the agent, and the pod cannot take
-    // one. So where the agent is reachable it is named here, and a read of it
-    // is sent straight on to the pod's own document.
-    outbox: outbox || urls.outbox,
-    // The pinned posts, as the collection other servers read when they show
-    // this profile. Mastodon's term, declared the way Mastodon declares it.
-    featured: urls.featured,
-    followers: urls.followers,
-    following: urls.following,
-    // What this actor has liked (§5.5). Its owner's to read, like the pending
-    // lists below.
-    ...(liked ? { liked } : {}),
-    // Every message this actor produced, as its owner reads it (§5.1), at an
-    // address the owner's own credential reaches.
-    ...(ownerOutbox ? { ownerOutbox } : {}),
-    // FEP-1b12: attributedTo names the moderators collection; recipients
-    // validate a group's announced moderation against it.
-    ...(moderators ? { attributedTo: moderators } : {}),
-    ...(pendingFollowers ? { pendingFollowers } : {}),
-    ...(pendingFollowing ? { pendingFollowing } : {}),
-    ...(blocked ? { blocked } : {}),
-    publicKey: { id: urls.actor + '#main-key', owner: urls.actor, publicKeyPem },
-  };
-}
-
-// The human half of the actor: a page a browser can open, published beside
-// the actor document. It says who this is and how to follow — the handle to
-// paste, and the remote-follow control that hands the visitor to their own
-// server's follow screen.
-export { profilePageHtml } from './profile-page.mjs';
-
-// Retirement. An abandoned pod keeps accepting deliveries into a container
-// nobody will ever drain, and no remote server has any way to learn that. A
-// Delete of the actor is the signal to drop us; the Tombstone left in its place
-// answers anyone who dereferences the actor afterwards.
-export function deleteActorActivity(urls, stamp) {
-  return {
-    '@context': AS_CTX,
-    id: `${urls.actor}#delete-${stamp}`,
-    type: 'Delete',
-    actor: urls.actor,
-    object: urls.actor,
-    to: ['https://www.w3.org/ns/activitystreams#Public'],
-  };
-}
-
-// Move is the fediverse's "this account lives elsewhere now": remote servers
-// stop delivering here and migrate their followers to the target, while the old
-// handle keeps resolving. movedTo on the actor is the durable half of it.
-export function moveActivity(urls, target, stamp) {
-  return {
-    '@context': AS_CTX,
-    id: `${urls.actor}#move-${stamp}`,
-    type: 'Move',
-    actor: urls.actor,
-    object: urls.actor,
-    target,
-    to: ['https://www.w3.org/ns/activitystreams#Public'],
-  };
-}
-
-export function tombstoneDoc(urls, deletedAt, kind = 'person') {
-  return {
-    '@context': AS_CTX,
-    id: urls.actor,
-    type: 'Tombstone',
-    formerType: kind === 'group' ? 'Group' : 'Person',
-    deleted: deletedAt,
-  };
-}
-
-// A deleted note is left as a Tombstone at its own URL — kept fetchable — so a
-// peer that dereferences it learns the post was DELETED rather than getting a
-// bare 404 it cannot tell from "never existed" (§7.4).
-export function noteTombstone(noteId, deletedAt, formerType = 'Note') {
-  return {
-    '@context': AS_CTX,
-    id: noteId,
-    type: 'Tombstone',
-    formerType,
-    deleted: deletedAt,
-  };
-}
-
-// A note's replies live in a document of their own, so a server that was never
-// delivered a reply can still discover it by dereferencing this.
-export function repliesId(noteId) { return noteId + '-replies'; }
-
-export function collection(id, items) {
-  return {
-    '@context': AS_CTX,
-    id, type: 'Collection',
-    totalItems: items.length,
-    items,
-  };
-}
-
-export function orderedCollection(id, items) {
-  return {
-    '@context': AS_CTX,
-    id, type: 'OrderedCollection',
-    totalItems: items.length,
-    orderedItems: items,
-  };
-}
-
-// A PAGED outbox, the shape Mastodon serves.
-//
-// One document holding every activity ever posted has to be rewritten whole on
-// every post, so the cost of saying something grows with everything you have
-// already said. Pages fix that without dropping anything: a new post rewrites
-// the newest page and a head that is four lines long, and every sealed page is
-// written once and never touched again.
-//
-// Pages are numbered from the OLDEST end, and that is the load-bearing part.
-// Number them from the newest and every page boundary shifts each time you
-// post, which is the problem again with more requests.
-export const OUTBOX_PAGE_SIZE = 20;
-export const outboxPageId = (outboxId, n) => `${outboxId}-${n}`;
-
-// How many pages `total` activities occupy. Always at least one, so an empty
-// outbox still has somewhere to point and a reader always has a `first`.
-export const outboxPageCount = (total) => Math.max(1, Math.ceil(total / OUTBOX_PAGE_SIZE));
-
-// `first` is the NEWEST page and `next` walks backwards in time, which is what
-// a client following an outbox expects.
-// `pageCount` is passed by anyone using outboxPaging, because once a page can
-// be SHORT the count is no longer ceil(total/20) — deriving it there would put
-// `first` below the newest page and hide everything above it.
-export function outboxHead(id, total, pageCount = outboxPageCount(total)) {
-  const pages = Math.max(1, pageCount);
-  return {
-    '@context': AS_CTX,
-    id, type: 'OrderedCollection',
-    totalItems: total,
-    first: outboxPageId(id, pages),
-    last: outboxPageId(id, 1),
-  };
-}
-
-// `items` is this page's slice, newest-first within the page. `next` points at
-// the older page; a sealed page never needs rewriting, so it carries no `prev`
-// — that would have to be written when the page AFTER it is created.
-export function outboxPage(outboxId, n, items) {
-  return {
-    '@context': AS_CTX,
-    id: outboxPageId(outboxId, n),
-    type: 'OrderedCollectionPage',
-    partOf: outboxId,
-    orderedItems: items.map(outboxWireItem),
-    ...(n > 1 ? { next: outboxPageId(outboxId, n - 1) } : {}),
-  };
-}
-
-// The slices, oldest page first. `outbox` arrives newest-first (recordOutbox
-// unshifts), and paging has to be anchored at the oldest end or appending one
-// activity moves every boundary.
-//
-// Anchoring at the oldest end is right for appends and wrong for REMOVALS,
-// which is why nothing calls this to publish any more — see outboxPaging.
-export function outboxPages(outbox) {
-  const chron = [...outbox].reverse();
-  const out = [];
-  for (let i = 0; i < Math.max(chron.length, 1); i += OUTBOX_PAGE_SIZE) {
-    out.push(chron.slice(i, i + OUTBOX_PAGE_SIZE).reverse());   // newest-first within the page
-  }
-  return out;
-}
-
-export const outboxItemId = (i) => (typeof i === 'string' ? i : i?.id || null);
-
-// The outbox lists activities. A post is recorded by its object id, which is
-// what every local reader keys on, and published as the Create beside it — a
-// document of its own. An Announce is recorded and published whole.
-export const outboxWireItem = (i) => (typeof i === 'string' ? createActivityId(i) : i);
-export const outboxLocalItem = (i) =>
-  (typeof i === 'string' && i.endsWith('-create') ? i.slice(0, -'-create'.length) : i);
-
-// Assign entries to pages, and KEEP the assignment.
-//
-// Deriving the pages from position — which is what outboxPages does — makes an
-// append cheap, because only the newest page moves. It makes a REMOVAL cost the
-// whole history: every entry after the hole shifts back one, so every page from
-// there to the newest gets different contents, a different digest and a PUT.
-// Taking one old post down rewrote all of them, and an inbound Delete{actor}
-// paid that once per post the actor had.
-//
-// Holding the assignment instead means a removal touches the single page that
-// held it and leaves that page one item short. A short sealed page is legal
-// AS2 — the newest page is already partial — and `totalItems` on the head is
-// still the true count.
-//
-// `index` is the assignment we last published, oldest page first, ids only.
-// Ids it no longer contains have been removed; ids it does not know are new and
-// extend the newest page, spilling into fresh ones. An absent index (a first
-// publish, or a machine that lost its state) re-derives the same boundaries
-// outboxPages would have given, so upgrading rewrites nothing.
-// The stable-paging core, shared by the outbox and the followers collection.
-// `order` is the ids to place, in the order new ones should fill pages; `byId`
-// maps each id back to its item. Ids the `index` no longer contains are dropped
-// (a removal leaves that page one short); ids not in the index are appended to
-// the newest page. A middle hole stays a hole — never a re-slice.
-export function pageItems({ order, byId, index = [], pageSize }) {
-  const next = (Array.isArray(index) ? index : [])
-    .map(ids => (Array.isArray(ids) ? ids.filter(id => byId.has(id)) : []));
-  const placed = new Set(next.flat());
-  for (const id of order) {
-    if (id == null || placed.has(id)) continue;
-    placed.add(id);
-    const last = next[next.length - 1];
-    if (!last || last.length >= pageSize) next.push([id]);
-    else last.push(id);
-  }
-  // A trailing empty page would leave `first`/`last` pointing at nothing; a
-  // middle hole is the short page this exists to keep.
-  while (next.length > 1 && !next[next.length - 1].length) next.pop();
-  if (!next.length) next.push([]);
-  return { index: next, pages: next.map(ids => ids.map(id => byId.get(id))) };
-}
-
-export function outboxPaging(outbox, index = []) {
-  const byId = new Map();
-  for (const it of outbox) {
-    const id = outboxItemId(it);
-    if (id && !byId.has(id)) byId.set(id, it);
-  }
-  // Fill pages oldest-first (outbox.json is newest-first), then reverse each
-  // page back to newest-first for display.
-  const order = [...outbox].reverse().map(outboxItemId);
-  const { index: idx, pages } = pageItems({ order, byId, index, pageSize: OUTBOX_PAGE_SIZE });
-  return { index: idx, pages: pages.map(p => [...p].reverse()) };
-}
-
-// ── followers, paged the same way ────────────────────────────────────────
-// A followers collection is a set of actor IRIs. Each IRI is its own id, so
-// there is nothing to dereference to page it, and no within-page order to keep.
-export const FOLLOWERS_PAGE_SIZE = 20;
-export const followersPageId = (id, n) => `${id}-${n}`;
-export const followersPageCount = (total) => Math.max(1, Math.ceil(total / FOLLOWERS_PAGE_SIZE));
-
-// Newest first, as every OrderedCollection is (ActivityPub §5): `first` is the
-// page the newest names were added to and `next` walks back in time, and each
-// page lists its names newest first. The pages themselves are still filled
-// from the oldest end, so a new name rewrites one page.
-export function followersHead(id, total, pageCount = followersPageCount(total)) {
-  const pages = Math.max(1, pageCount);
-  return {
-    '@context': AS_CTX,
-    id, type: 'OrderedCollection',
-    totalItems: total,
-    first: followersPageId(id, pages),
-    last: followersPageId(id, 1),
-  };
-}
-
-export function followersPage(id, n, items, pageCount) {    // eslint-disable-line no-unused-vars
-  return {
-    '@context': AS_CTX,
-    id: followersPageId(id, n),
-    type: 'OrderedCollectionPage',
-    partOf: id,
-    orderedItems: [...items].reverse(),
-    ...(n > 1 ? { next: followersPageId(id, n - 1) } : {}),
-  };
-}
-
-export function followersPaging(actors, index = []) {
-  const list = actors.filter(a => typeof a === 'string');
-  const byId = new Map();
-  for (const a of list) if (!byId.has(a)) byId.set(a, a);
-  return pageItems({ order: list, byId, index, pageSize: FOLLOWERS_PAGE_SIZE });
-}
-
-// NodeInfo (the fediverse's server self-description): a root .well-known
-// pointer plus the document it points at. Both are static, so the pod can
-// serve them exactly like webfinger.
-export function nodeinfoPointer(docHref) {
-  return {
-    links: [{ rel: 'http://nodeinfo.diaspora.software/ns/schema/2.0', href: docHref }],
-  };
-}
-
-export function nodeinfoDoc({ version, localPosts = 0 }) {
-  return {
-    version: '2.0',
-    // "hometown", not "fedipod": clients built on megalodon (Whalebird,
-    // Fedistar) refuse any software name outside their list, and hometown —
-    // a small Mastodon fork — is the least false of the accepted names for
-    // what this API serves.
-    software: { name: 'hometown', version },
-    protocols: ['activitypub'],
-    services: { inbound: [], outbound: [] },
-    openRegistrations: false,
-    usage: { users: { total: 1, activeMonth: 1, activeHalfyear: 1 }, localPosts },
-    metadata: {},
-  };
-}
-
-// Federated post bodies are attacker-controlled HTML that clients render —
-// and Mastodon clients (Phanpy included) trust the server's content and
-// innerHTML it, because Mastodon sanitizes server-side. That makes THIS the
-// only line of defence, so it runs on a real HTML parser (sanitize-html →
-// htmlparser2) rather than pattern-matching: allowlisted tags and
-// attributes, safe URL schemes, and script/style dropped with their text.
-import sanitize from 'sanitize-html';
-
-const ALLOWED_TAGS = ['p', 'br', 'a', 'span', 'em', 'strong', 'b', 'i', 'u', 'del',
-  'code', 'pre', 'blockquote', 'ul', 'ol', 'li', 'h1', 'h2', 'h3', 'h4'];
-const ALLOWED_ATTRS = ['href', 'rel', 'class', 'lang', 'title'];
-
-export function sanitizeHtml(html) {
-  if (!html) return '';
-  return sanitize(String(html), {
-    allowedTags: ALLOWED_TAGS,
-    allowedAttributes: { '*': ALLOWED_ATTRS },
-    allowedSchemes: ['http', 'https', 'mailto'],
-    allowedSchemesAppliedToAttributes: ['href'],
-    allowProtocolRelative: false,
-    disallowedTagsMode: 'discard',
-    nonTextTags: ['script', 'style', 'textarea', 'noscript'],   // drop their text too
-    transformTags: {
-      a: sanitize.simpleTransform('a', { rel: 'nofollow noopener noreferrer' }),
-    },
-  });
-}
-
-// A Lemmy post, a blog article, a PeerTube video and a Bookwyrm review each
-// carry their headline in `name` and their body in `content`. Reading content
-// alone loses the headline, and a link post is often nothing else — so keep it
-// as the first line, unless the body already opens with it.
-export function titledContent(note) {
-  const html = sanitizeHtml(note?.content);
-  const types = Array.isArray(note?.type) ? note.type : [note?.type];
-  const title = typeof note?.name === 'string' ? note.name.trim() : '';
-  if (!title || types.includes('Note')) return html;
-  const opening = html.replace(/<[^>]*>/g, ' ').replace(/\s+/g, ' ').trim().toLowerCase();
-  if (opening.startsWith(title.toLowerCase())) return html;
-  const esc = String(title).replace(/[&<>]/g, c => HTML_ESCAPES[c]);
-  return `<p><strong>${esc}</strong></p>${html}`;
-}
-
-// Normalize a wire Note's attachment list to { url, mediaType, description }.
-// Capped: this list comes from somebody else's document and lands in a
-// statuses.json row, which is rewritten whole on every change. Twenty is more
-// than any client shows and more than any real post carries.
-const MAX_ATTACHMENTS = 20;
-const MAX_ATTACHMENT_URL = 2048;
-// http(s) only: an attachment URL becomes a client's <img src> or <video src>,
-// and the store has guarded avatars this way all along (safeUrl).
-const attachmentUrl = (u) => {
-  if (!u) return null;
-  const s = String(u).slice(0, MAX_ATTACHMENT_URL);
-  try {
-    const p = new URL(s);
-    return (p.protocol === 'https:' || p.protocol === 'http:') ? s : null;
-  } catch { return null; }
-};
-
-export function attachmentsOf(note) {
-  const list = Array.isArray(note?.attachment) ? note.attachment : note?.attachment ? [note.attachment] : [];
-  // A bare Link carries `href` and no `url` — Lemmy's link posts arrive that
-  // way, and reading only `url` dropped the link the post was about.
-  return list.slice(0, MAX_ATTACHMENTS).map(a => ({
-    url: typeof a?.url === 'string' ? a.url : a?.url?.href || (typeof a?.href === 'string' ? a.href : undefined),
-    mediaType: String(a?.mediaType || '').slice(0, 128),
-    ...(a?.name ? { description: String(a.name).slice(0, 1500) } : {}),
-  })).map(a => ({ ...a, url: attachmentUrl(a.url) })).filter(a => a.url);
-}
-
-const HTML_ESCAPES = { '&': '&amp;', '<': '&lt;', '>': '&gt;' };
-// user@host in the text, which is what a Mention tag has to agree with.
-export const MENTION_RE = /@([A-Za-z0-9_.-]+)@([A-Za-z0-9.-]+\.[A-Za-z]{2,}(?::\d+)?)/g;
-
-export function mentionsIn(text) {
-  return [...new Set(String(text).match(MENTION_RE) || [])].map(m => m.slice(1));
-}
-
-// #word in the text: letters, digits and underscores with at least one
-// letter, not glued to a word or a path (so a URL's fragment is not a tag).
-export const HASHTAG_RE = /(^|[^\/\w)])#([\p{L}\p{N}_]*[\p{L}_][\p{L}\p{N}_]*)/gu;
-
-export function hashtagsIn(text) {
-  const seen = new Map();
-  for (const m of String(text).matchAll(HASHTAG_RE)) {
-    const key = m[2].toLowerCase();
-    if (!seen.has(key)) seen.set(key, m[2]);
-  }
-  return [...seen.values()];
-}
-
-// Where a tag's link points: this actor's own page, asked for the tag. A
-// Hashtag's href must be a URL; the name is what servers file it under.
-export function tagHref(urls, name) {
-  return urls.profileHtml + '?tag=' + encodeURIComponent(String(name).toLowerCase());
-}
-
-// Escape first, then linkify: escaping cannot introduce an @handle, and the
-// anchors must survive it. A mention nobody could resolve stays plain text.
-export function contentHtml(text, mentions = [], hashtags = []) {
-  let html = String(text).replace(/[&<>]/g, c => HTML_ESCAPES[c]);
-  if (hashtags.length) {
-    const byName = new Map(hashtags.filter(h => h?.name && h?.href).map(h => [h.name.toLowerCase(), h.href]));
-    html = html.replace(HASHTAG_RE, (all, lead, name) => {
-      const href = byName.get(name.toLowerCase());
-      if (!href) return all;
-      return `${lead}<a href="${String(href).replace(/[&<>"]/g, c => (HTML_ESCAPES[c] || '&quot;'))}" class="mention hashtag" rel="tag">#<span>${name}</span></a>`;
-    });
-  }
-  for (const m of mentions) {
-    if (!m?.handle || !m?.actor) continue;
-    // The anchor is for PEOPLE — the mentioned actor's advertised page when it
-    // has one; a browser landing on a raw actor document reads nothing. The
-    // mention TAG keeps the actor id, which is what servers match on.
-    const href = String(m.page || m.actor).replace(/[&<>"]/g, c => (HTML_ESCAPES[c] || '&quot;'));
-    html = html.split('@' + m.handle).join(
-      `<a href="${href}" class="u-url mention">@${m.handle.split('@')[0]}</a>`);
-  }
-  return '<p>' + html.replace(/\n+/g, '</p><p>') + '</p>';
-}
-
-// Mastodon's four shapes. Public and unlisted are world-readable; private
-// (followers-only) and direct carry no Public address at all and belong in
-// the owner-only container. Mastodon addresses mentions in cc (to, for a
-// direct post) and will not notify anyone it does not find there or in the
-// tags.
-export function addressing(urls, visibility, who = []) {
-  return {
-    public: { to: [PUBLIC], cc: [urls.followers, ...who] },
-    unlisted: { to: [urls.followers], cc: [PUBLIC, ...who] },
-    private: { to: [urls.followers], cc: who },
-    direct: { to: who, cc: [] },
-  }[visibility] || { to: [PUBLIC], cc: [urls.followers, ...who] };
-}
-
-// The quote terms, declared exactly as Mastodon declares them on a post:
-// FEP-044f's `quote` and `quoteAuthorization`, and the two older spellings
-// (Fedibird's quoteUri, Misskey's _misskey_quote) that older servers read.
-export const QUOTE_CTX = {
-  quote: { '@id': 'https://w3id.org/fep/044f#quote', '@type': '@id' },
-  quoteUri: { '@id': 'http://fedibird.com/ns#quoteUri', '@type': '@id' },
-  _misskey_quote: { '@id': 'https://misskey-hub.net/ns#_misskey_quote', '@type': '@id' },
-  quoteAuthorization: { '@id': 'https://w3id.org/fep/044f#quoteAuthorization', '@type': '@id' },
-};
-// The interaction policy terms, GoToSocial's, declared as Mastodon declares them.
-export const POLICY_CTX = {
-  gts: 'https://gotosocial.org/ns#',
-  interactionPolicy: { '@id': 'gts:interactionPolicy', '@type': '@id' },
-  canQuote: { '@id': 'gts:canQuote', '@type': '@id' },
-  automaticApproval: { '@id': 'gts:automaticApproval', '@type': '@id' },
-  manualApproval: { '@id': 'gts:manualApproval', '@type': '@id' },
-};
-
-// Who may quote a post: anyone, for a post the world can read; nobody, for a
-// followers-only or direct one. Said on every note, because a server that
-// finds no policy offers no quote button.
-export function quotePolicy(visibility) {
-  const open = visibility === 'public' || visibility === 'unlisted';
-  return { canQuote: { automaticApproval: open ? [PUBLIC] : [], manualApproval: [] } };
-}
-
-// `also`: actors addressed without being mentioned — the parent's author on
-// a reply. In cc but not in tag, so their server receives the post and does
-// not notify them. A direct post names its audience in the text alone.
-// `quote`: the post this one quotes, `{ id, authorization }` — the
-// authorization is the quoted author's QuoteAuthorization, once granted.
-export function noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions = [],
-  visibility = 'public', summary = null, sensitive = false, updated = null, container = null, also = [],
-  quote = null }) {
-  const id = (container || urls.notes) + slug;
-  const who = mentions.map(m => m.actor);
-  const extra = visibility === 'direct' ? [] : also.filter(a => a && !who.includes(a));
-  const addressed = addressing(urls, visibility, [...who, ...extra]);
-  const hashtags = hashtagsIn(content).map(name => ({ name, href: tagHref(urls, name) }));
-  const note = {
-    '@context': [AS_CTX, { ...POLICY_CTX, ...(quote?.id ? QUOTE_CTX : {}) }],
-    id, type: 'Note',
-    attributedTo: urls.actor,
-    content: contentHtml(content, mentions, hashtags),
-    published,
-    to: addressed.to,
-    cc: addressed.cc,
-    replies: repliesId(id),
-    interactionPolicy: quotePolicy(visibility),
-  };
-  if (quote?.id) {
-    // All three spellings name the same post, as Mastodon writes them.
-    note.quote = quote.id;
-    note.quoteUri = quote.id;
-    note._misskey_quote = quote.id;
-    if (quote.authorization) note.quoteAuthorization = quote.authorization;
-  }
-  if (summary) note.summary = summary;      // the content warning
-  // A content warning is what a receiver hides behind; media marked
-  // sensitive without one is hidden the same way.
-  if (summary || sensitive) note.sensitive = true;
-  if (updated) note.updated = updated;      // an edit's own stamp
-  const tag = [
-    ...mentions.map(m => ({ type: 'Mention', href: m.actor, name: '@' + m.handle })),
-    ...hashtags.map(h => ({ type: 'Hashtag', href: h.href, name: '#' + h.name })),
-  ];
-  if (tag.length) note.tag = tag;
-  if (inReplyTo) note.inReplyTo = inReplyTo;
-  if (attachments?.length) {
-    note.attachment = attachments.map(a => ({
-      type: 'Document', mediaType: a.mediaType, url: a.url,
-      ...(a.description ? { name: a.description } : {}),
-    }));
-  }
-  return note;
-}
-
-// A poll is a note that asks something: the same addressing, the same
-// mentions, the same replies collection, with the choices in `oneOf` (pick
-// one) or `anyOf` (pick several). Each choice carries the count as the
-// totalItems of its own replies collection, which is where every server that
-// shows a poll reads it from.
-//
-// `endTime` is when voting stops and `closed` is the stamp saying it has —
-// both plain AS2. `votersCount` is Mastodon's: PEOPLE rather than answers,
-// which differ only once a poll takes several answers each. It is not in the
-// base context, so it is declared inline exactly as Mastodon declares it, and
-// only when we actually carry it.
-export function questionDoc({ options = [], multiple = false, endTime = null,
-  closed = null, votersCount = null, ...rest }) {
-  const note = noteDoc(rest);
-  const choices = options.map(o => ({
-    type: 'Note',
-    name: String(o.title),
-    replies: { type: 'Collection', totalItems: Number(o.votes) || 0 },
-  }));
-  const question = {
-    ...note,
-    type: 'Question',
-    [multiple ? 'anyOf' : 'oneOf']: choices,
-  };
-  if (endTime) question.endTime = endTime;
-  if (closed) question.closed = closed;
-  if (votersCount !== null && votersCount !== undefined) {
-    question['@context'] = [...[].concat(note['@context']), {
-      toot: 'http://joinmastodon.org/ns#',
-      votersCount: {
-        '@id': 'toot:votersCount',
-        '@type': 'http://www.w3.org/2001/XMLSchema#nonNegativeInteger',
-      },
-    }];
-    question.votersCount = votersCount;
-  }
-  return question;
-}
-
-// The id is a document of its own, not `note.id + '#create'`. A group wraps this
-// whole activity in its Announce (FEP-1b12), and the receiver resolves it by
-// dereferencing this id — a fragment would just serve the Note back under a
-// different id, which Mastodon rejects.
-export function createActivityId(noteId) { return noteId + '-create'; }
-
-export function createActivity(note, urls) {
-  return {
-    '@context': AS_CTX,
-    id: createActivityId(note.id),
-    type: 'Create',
-    actor: urls.actor,
-    published: note.published,
-    to: note.to, cc: note.cc,
-    object: note,
-  };
-}
-
-export function acceptActivity({ urls, followActivity, serial }) {
-  return {
-    '@context': AS_CTX,
-    id: urls.actor + '#accept-' + serial,
-    type: 'Accept',
-    actor: urls.actor,
-    object: followActivity,
-  };
-}
-
-// The other half of Accept: what a group sends to end a following it will no
-// longer carry. Without it an ejected member's server never learns, and keeps
-// receiving everything the group announces.
-export function rejectActivity({ urls, followActivity, serial }) {
-  return {
-    '@context': AS_CTX,
-    id: urls.actor + '#reject-' + serial,
-    type: 'Reject',
-    actor: urls.actor,
-    object: followActivity,
-  };
-}
-
-export function followActivity({ urls, targetActor, serial }) {
-  return {
-    '@context': AS_CTX,
-    id: urls.actor + '#follow-' + serial,
-    type: 'Follow',
-    actor: urls.actor,
-    object: targetActor,
-  };
-}
-
-// Addressed to the author of what is liked, the one it is delivered to.
-export function likeActivity({ urls, noteId, serial, to = null }) {
-  return {
-    '@context': AS_CTX,
-    id: urls.actor + '#like-' + serial,
-    type: 'Like',
-    actor: urls.actor,
-    ...(to ? { to: [to] } : {}),
-    object: noteId,
-  };
-}
-
-// `object` is a note URL for a personal boost — what Mastodon renders — or the
-// whole received activity when a group carries a member's post, which is what
-// FEP-1b12 requires and what lets a follower see the author's own activity
-// rather than the group's summary of it. Preserved exactly as delivered.
-export function announceActivity({ urls, object, serial, published = new Date().toISOString(),
-  audience = null }) {
-  return {
-    '@context': AS_CTX,
-    id: announceActivityId(urls, serial),
-    type: 'Announce',
-    actor: urls.actor,
-    published,
-    to: [PUBLIC], cc: [urls.followers],
-    // FEP-1b12: a group's carry names the group as the audience.
-    ...(audience ? { audience } : {}),
-    object,
-  };
-}
-
-// Tell followers the actor document changed. Nothing obliges a server to fetch
-// an actor it already holds — Mastodon shows its cached copy, follower count
-// included, until something makes it look again — so a profile edit is
-// invisible to everyone until this goes out.
-//
-// The actor's own @context is hoisted onto the activity and the embedded copy
-// loses its: the document declares `schema:` when it carries PropertyValue
-// attachments, and an object nested under a plainer context would lose them.
-export function updateActorActivity({ urls, actor, serial, published = new Date().toISOString() }) {
-  const { '@context': ctx, ...object } = actor;
-  return {
-    '@context': ctx || AS_CTX,
-    id: urls.actor + '#update-' + serial,
-    type: 'Update',
-    actor: urls.actor,
-    published,
-    to: [PUBLIC], cc: [urls.followers],
-    object,
-  };
-}
-
-// An edit: same Note id, `updated` stamped, so receivers replace their copy
-// and show it as edited. The activity id carries the stamp — each edit is a
-// new activity, and a replay of an old one is already seen.
-// `serial` names the activity when the note is not being edited — a quote
-// authorization arriving on it changes what the note says about its quote,
-// not what it says.
-// An edit's Update is named by when the edit was made, so whoever made it can
-// say its id before it exists; a restatement that is not an edit has no stamp.
-// Each is a document of its own beside the post, so it can be fetched by its
-// id (§3.1) once it is on the public record; a fragment of another document
-// could not be.
-export const updateActivityId = (noteId, updated) => noteId + '-update-' + String(updated).replace(/[^0-9TZ]/g, '');
-export const deleteActivityId = (noteId) => noteId + '-delete';
-export const announceActivityId = (urls, serial) => urls.notes + 'announce-' + serial;
-export const undoActivityId = (urls, serial) => urls.notes + 'undo-' + serial;
-
-export function updateActivity(note, urls, { serial = null } = {}) {
-  return {
-    '@context': AS_CTX,
-    id: note.updated ? updateActivityId(note.id, note.updated) : note.id + '-update-q' + (serial ?? Date.now()),
-    type: 'Update',
-    actor: urls.actor,
-    to: note.to, cc: note.cc,
-    object: note,
-  };
-}
-
-// Addressed as the post was, so a followers-only or direct post's deletion
-// reaches the people who had it and is not announced to anyone else.
-export function deleteActivity({ urls, noteId, to = [PUBLIC], cc = null }) {
-  return {
-    '@context': AS_CTX,
-    id: deleteActivityId(noteId),
-    type: 'Delete',
-    actor: urls.actor,
-    to,
-    ...(cc?.length ? { cc } : {}),
-    object: { id: noteId, type: 'Tombstone' },
-  };
-}
-
-// Addressed as what it takes back was: an Undo goes to whoever had that.
-export function undoActivity({ urls, activity, serial }) {
-  const to = activity?.to ?? (activity?.type === 'Follow' && typeof activity.object === 'string' ? [activity.object] : null);
-  return {
-    '@context': AS_CTX,
-    id: undoActivityId(urls, serial),
-    type: 'Undo',
-    actor: urls.actor,
-    ...(to ? { to } : {}),
-    ...(activity?.cc ? { cc: activity.cc } : {}),
-    object: activity,
-  };
-}
-
-// A group's ban (FEP-1b12 moderation). Only ever announced BY a group —
-// a person's blocks are never put on the wire.
-export function blockActivity({ urls, targetActor, serial }) {
-  return {
-    '@context': AS_CTX,
-    id: urls.actor + '#block-' + serial,
-    type: 'Block',
-    actor: urls.actor,
-    object: targetActor,
-  };
-}
-
-// Add/Remove on one of this actor's own collections — the moderator roster
-// is the one that changes hands (FEP-1b12).
-export function addRemoveActivity({ urls, type, object, target, serial }) {
-  return {
-    '@context': AS_CTX,
-    id: urls.actor + '#' + type.toLowerCase() + '-' + serial,
-    type,
-    actor: urls.actor,
-    object,
-    target,
-  };
-}