feat(activitypub): emit the actor document's profile-page url

[davidwkeith]

Summary

The actor document never carried a top-level url, so every platform's "open original profile" link (Mastodon, Misskey, Pixelfed, Friendica) fell back to the actor id — the AS2 JSON document itself, not a web page. Surfaced by Anglesite's Fediverse interop conformance pass (Anglesite/Anglesite#1771).

• buildActorDocument gains an ActorDocumentOptions.url seam and emits it as the actor url (AS2 §4.1's human-readable representation, distinct from id), mirroring how the FEP-2c59 webfinger back-link is threaded.
• resolveConfig resolves ResolvedConfig.url to actor.url when set, else the normalized baseUrl root (https://example.com/) — v1 serves one actor per baseUrl, so the site's home page is the profile. ActorProfile.url is the new optional override for a profile that lives elsewhere.
• The handler passes the resolved value to the actor route; every served actor document now links its profile page with no consumer change.

Additive and backward-compatible: existing configs get the baseUrl-root default automatically.

Packages affected

@dwk/activitypub

Checklist

• Read the relevant spec(s) under spec/packages/ and updated them if
  behaviour changed — spec/packages/activitypub.md ▸ "Actor & collections" gains the url bullet
• Added/updated colocated tests (src/*.test.ts) — as2.test.ts (emit/omit), config.test.ts (default, trailing-slash baseUrl, actor.url override), index.test.ts (served document carries url)
• Ran the local CI gate: pnpm lint && pnpm format:check && pnpm typecheck && pnpm build && pnpm test — lint, format, typecheck, build clean; pnpm test --project @dwk/activitypub 376 passed (16 files). The first CI run failed on mastodon-api.test.ts ▸ respondToFollowRequest(actor, 'authorize') … ("expected [] to have a length of 1"), which also failed once locally: the real DO alarm can resolve and drain the queued Accept through the test's 202 fetch stub before the assertion reads the delivery row. The second commit hardens that test and its 'reject' sibling to count the activity wherever the alarm left it — a test-only change, unrelated to the actor document.
• Added a changeset (pnpm changeset) if this touches a publishable
  package — .changeset/actor-profile-url.md, minor (new optional field + new emitted property)
• Updated catalog.json / conformance/status.json if this adds a new
  mountable worker or changes conformance status — not applicable: no new worker, conformance status unchanged

🤖 Generated with Claude Code

[davidwkeith]

Reviewed the diff against CONTRIBUTING.md and the code itself.

CONTRIBUTING.md conformance — all good:

• PR title feat(activitypub): emit the actor document's profile-page url is correct Conventional Commits style (lowercase type, (scope), uncapitalized subject).
• PR body uses the template verbatim (Summary / Packages affected / Checklist headings unchanged).
• Spec updated in the same PR (spec/packages/activitypub.md).
• Colocated tests added in all three touched surfaces (as2.test.ts, config.test.ts, index.test.ts).
• Changeset present and correctly scoped (minor, additive field).
• catalog.json/conformance/status.json checklist item correctly left unchecked with a one-line "not applicable" reason rather than deleted.

Code review — no bugs found, a couple of minor observations:

• resolveConfig's url = config.actor.url ?? \${baseUrl}/`correctly relies onnormalizeBaseUrlhaving already stripped any trailing slash, so it can't double up — verified againstnormalizeBaseUrl` (config.ts:288) and the trailing-slash test case.
• ResolvedConfig.url is a new required (non-optional) field, but since the type is only ever constructed by resolveConfig itself (no other manual ResolvedConfig literals in the package), this can't cause a compile break elsewhere.
• Nit (non-blocking): config.actor.url uses ??, so an explicit empty string would flow through as doc.url = "" instead of falling back to the baseUrl root. Given every other optional string field in ActorProfile (summary, icon, etc.) has the same characteristic, this is consistent with existing conventions rather than a new issue — just flagging in case stricter validation is ever desired.
• Out of scope but worth a follow-up issue: mastodon-api.ts's Account JSON mapping doesn't appear to surface resolved.url anywhere, so Mastodon-API clients reading accounts through that surface won't get the same profile-page fix this PR gives raw AS2 consumers. Not a blocker for this PR, which is explicitly scoped to the actor document.

Nothing here blocks merge — checklist and implementation both look correct and minimal.

---

Generated by Claude Code

[davidwkeith]

Superseded by #514 — identical diff as one commit authored under the account's verified email, so the required_signatures / unattributed-changes rules can evaluate it. This branch's two commits were authored under me@dwk.io, which GitHub could not attribute (verified=false, reason=no_user).