@fedify/fedify 2.0.36-dev.2551 → 2.0.36-dev.2598

package/dist/{builder-Dndt590h.mjs → builder-B5hI5Xsn.mjs}

@@ -2,8 +2,8 @@ import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as RouterError, t as Router } from "./router-CrMLXoOr.mjs";
-import { n as version, t as name } from "./deno-D_rTMbAD.mjs";
-import { t as InboxListenerSet } from "./inbox-BwpBTbhH.mjs";
+import { n as version, t as name } from "./deno--OYa_lxj.mjs";
+import { t as InboxListenerSet } from "./inbox-huUE3IP8.mjs";
 import { getTypeId } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { getLogger } from "@logtape/logtape";
@@ -43,7 +43,7 @@ var FederationBuilderImpl = class {
 		this.collectionTypeIds = {};
 	}
 	async build(options) {
-		const { FederationImpl } = await import("./middleware-C5Nypx4Z.mjs");
+		const { FederationImpl } = await import("./middleware-CT1Lbohd.mjs");
 		const f = new FederationImpl(options);
 		const trailingSlashInsensitiveValue = f.router.trailingSlashInsensitive;
 		f.router = this.router.clone();

package/dist/compat/transformers.test.mjs

@@ -4,7 +4,7 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import { n as assertInstanceOf, t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as MemoryKvStore } from "../kv-mI4Ix2EU.mjs";
-import { _ as autoIdAssigner, g as actorDehydrator, n as FederationImpl } from "../middleware-DDM0j-X6.mjs";
+import { _ as autoIdAssigner, g as actorDehydrator, n as FederationImpl } from "../middleware-BhYpLGA_.mjs";
 import { test } from "@fedify/fixture";
 import { Follow, Person } from "@fedify/vocab";
 //#region src/compat/transformers.test.ts

package/dist/{deno-D_rTMbAD.mjs → deno--OYa_lxj.mjs}

@@ -3,6 +3,6 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.0.36-dev.2551+8b012df4";
+var version = "2.0.36-dev.2598+90504ae2";
 //#endregion
 export { version as n, name as t };

package/dist/{docloader-DpTrZ5sA.mjs → docloader-BXR2f83H.mjs}

@@ -1,8 +1,8 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { o as validateCryptoKey } from "./key-1Gf85RN1.mjs";
-import { r as doubleKnockScoped } from "./http-DGD9d8-A.mjs";
+import { o as validateCryptoKey } from "./key-D5e9c_yV.mjs";
+import { r as doubleKnockScoped } from "./http-C3d2DXwF.mjs";
 import { curry } from "es-toolkit";
 import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest } from "@fedify/vocab-runtime";
 import { openDirectFetch, openPublicFetch } from "@fedify/vocab-runtime/internal";

package/dist/federation/builder.test.mjs

@@ -5,7 +5,7 @@ import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import { i as assertExists, n as assertStrictEquals } from "../std__assert-DflMZha5.mjs";
 import { t as assertThrows } from "../assert_throws-D4DNWrux.mjs";
 import { t as MemoryKvStore } from "../kv-mI4Ix2EU.mjs";
-import { n as createFederationBuilder } from "../builder-Dndt590h.mjs";
+import { n as createFederationBuilder } from "../builder-B5hI5Xsn.mjs";
 import { test } from "@fedify/fixture";
 import { Activity, Note, Person } from "@fedify/vocab";
 //#region src/federation/builder.test.ts

package/dist/federation/handler.test.mjs

@@ -6,14 +6,14 @@ import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import "../std__assert-DflMZha5.mjs";
 import { t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertRejects } from "../assert_rejects-WyYSTDDX.mjs";
-import { i as generateCryptoKeyPair } from "../key-1Gf85RN1.mjs";
-import { c as signRequest } from "../http-DGD9d8-A.mjs";
+import { i as generateCryptoKeyPair } from "../key-D5e9c_yV.mjs";
+import { c as signRequest } from "../http-C3d2DXwF.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CCxRJhWa.mjs";
-import { a as compactJsonLd, f as signJsonLd } from "../ld-BuuOR_Ms.mjs";
-import { n as signObject } from "../proof-GM73LJjx.mjs";
+import { a as compactJsonLd, f as signJsonLd } from "../ld-9qfz9rP_.mjs";
+import { n as signObject } from "../proof-CiBs9Q4l.mjs";
 import { t as MemoryKvStore } from "../kv-mI4Ix2EU.mjs";
-import { a as createFederation, c as handleCollection, d as handleObject, f as respondWithObject, l as handleCustomCollection, p as respondWithObjectIfAcceptable, s as handleActor, u as handleInbox } from "../middleware-DDM0j-X6.mjs";
-import { t as InboxListenerSet } from "../inbox-BwpBTbhH.mjs";
+import { a as createFederation, c as handleCollection, d as handleObject, f as respondWithObject, l as handleCustomCollection, p as respondWithObjectIfAcceptable, s as handleActor, u as handleInbox } from "../middleware-BhYpLGA_.mjs";
+import { t as InboxListenerSet } from "../inbox-huUE3IP8.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { Create, CryptographicKey, Multikey, Note, Person } from "@fedify/vocab";
 //#region src/federation/handler.test.ts
@@ -531,8 +531,8 @@ test("handleCollection()", async () => {
 	assertEquals(response.status, 200);
 	assertEquals(response.headers.get("Content-Type"), "application/activity+json");
 	const createCtx = [
-		"https://w3id.org/identity/v1",
 		"https://www.w3.org/ns/activitystreams",
+		"https://w3id.org/security/v1",
 		"https://w3id.org/security/data-integrity/v1",
 		{
 			toot: "http://joinmastodon.org/ns#",
@@ -2821,8 +2821,8 @@ test("handleCustomCollection()", async () => {
 	assertEquals(response.status, 200);
 	assertEquals(response.headers.get("Content-Type"), "application/activity+json");
 	const createCtx = [
-		"https://w3id.org/identity/v1",
 		"https://www.w3.org/ns/activitystreams",
+		"https://w3id.org/security/v1",
 		"https://w3id.org/security/data-integrity/v1",
 		{
 			toot: "http://joinmastodon.org/ns#",

package/dist/federation/idempotency.test.mjs

@@ -4,9 +4,9 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import "../std__assert-DflMZha5.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey, t as ed25519Multikey } from "../keys-CCxRJhWa.mjs";
-import { n as signObject } from "../proof-GM73LJjx.mjs";
+import { n as signObject } from "../proof-CiBs9Q4l.mjs";
 import { t as MemoryKvStore } from "../kv-mI4Ix2EU.mjs";
-import { a as createFederation } from "../middleware-DDM0j-X6.mjs";
+import { a as createFederation } from "../middleware-BhYpLGA_.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { Create, Follow, Person } from "@fedify/vocab";
 //#region src/federation/idempotency.test.ts

package/dist/federation/inbox.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import { r as assertFalse, t as assertThrows } from "../assert_throws-D4DNWrux.mjs";
-import { n as actorsHaveSameOrigin, t as InboxListenerSet } from "../inbox-BwpBTbhH.mjs";
+import { n as actorsHaveSameOrigin, t as InboxListenerSet } from "../inbox-huUE3IP8.mjs";
 import { test } from "@fedify/fixture";
 import { Activity, Create, Invite, Offer, Update } from "@fedify/vocab";
 //#region src/federation/inbox.test.ts

package/dist/federation/middleware.test.mjs

@@ -9,14 +9,14 @@ import { r as assertFalse, t as assertThrows } from "../assert_throws-D4DNWrux.m
 import { n as assertInstanceOf, t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertNotEquals } from "../assert_not_equals-BkxW5QJI.mjs";
 import { t as assertRejects } from "../assert_rejects-WyYSTDDX.mjs";
-import { c as signRequest, u as verifyRequest } from "../http-DGD9d8-A.mjs";
+import { c as signRequest, u as verifyRequest } from "../http-C3d2DXwF.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CCxRJhWa.mjs";
-import { n as getAuthenticatedDocumentLoader } from "../docloader-DpTrZ5sA.mjs";
-import { a as compactJsonLd, f as signJsonLd, m as verifyJsonLd, s as detachSignature } from "../ld-BuuOR_Ms.mjs";
-import { t as doesActorOwnKey } from "../owner-BI33UeIv.mjs";
-import { n as signObject, r as verifyObject } from "../proof-GM73LJjx.mjs";
+import { n as getAuthenticatedDocumentLoader } from "../docloader-BXR2f83H.mjs";
+import { a as compactJsonLd, f as signJsonLd, i as attachSignature, m as verifyJsonLd, s as detachSignature } from "../ld-9qfz9rP_.mjs";
+import { t as doesActorOwnKey } from "../owner-R4ffU9Ht.mjs";
+import { n as signObject, r as verifyObject } from "../proof-CiBs9Q4l.mjs";
 import { t as MemoryKvStore } from "../kv-mI4Ix2EU.mjs";
-import { a as createFederation, i as KvSpecDeterminer, n as FederationImpl, r as InboxContextImpl, t as ContextImpl } from "../middleware-DDM0j-X6.mjs";
+import { a as createFederation, i as KvSpecDeterminer, n as FederationImpl, r as InboxContextImpl, t as ContextImpl } from "../middleware-BhYpLGA_.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import * as vocab from "@fedify/vocab";
 import { Create, Offer, Person, getTypeId, lookupObject } from "@fedify/vocab";
@@ -3594,15 +3594,19 @@ test("ContextImpl.sendActivity()", async (t) => {
 		queue
 	});
 	federation2.setActorDispatcher("/{identifier}", async (ctx, identifier) => {
-		if (identifier !== "john") return null;
+		if (identifier !== "john" && identifier !== "rsa-only") return null;
 		const keys = await ctx.getActorKeyPairs(identifier);
 		return new vocab.Person({
 			id: ctx.getActorUri(identifier),
-			preferredUsername: "john",
+			preferredUsername: identifier,
 			publicKey: keys[0].cryptographicKey,
 			assertionMethods: keys.map((k) => k.multikey)
 		});
 	}).setKeyPairsDispatcher((_ctx, identifier) => {
+		if (identifier === "rsa-only") return [{
+			privateKey: rsaPrivateKey2,
+			publicKey: rsaPublicKey2.publicKey
+		}];
 		if (identifier !== "john") return [];
 		return [{
 			privateKey: rsaPrivateKey2,
@@ -3651,6 +3655,375 @@ test("ContextImpl.sendActivity()", async (t) => {
 			proofCount++;
 		}
 		assertEquals(proofCount, 1);
+		const oldContext = [
+			"https://w3id.org/identity/v1",
+			"https://www.w3.org/ns/activitystreams",
+			"https://w3id.org/security/data-integrity/v1"
+		];
+		const oldJson = await (await signObject(new vocab.Create({
+			id: new URL("https://example.com/activity/1"),
+			actor: new URL("https://example.com/john")
+		}), ed25519PrivateKey, ed25519Multikey.id, {
+			contextLoader: documentLoader,
+			context: oldContext
+		})).toJsonLd({
+			format: "compact",
+			contextLoader: documentLoader,
+			context: oldContext
+		});
+		queue.clear();
+		await federation2.processQueuedTask(void 0, {
+			...fanoutMsg,
+			id: crypto.randomUUID(),
+			activity: oldJson
+		});
+		const replayed = queue.messages.at(-1);
+		assert(replayed != null && replayed.type === "outbox");
+		assertEquals(detachSignature(replayed.activity), oldJson);
+		const proofless = { ...oldJson };
+		delete proofless.proof;
+		queue.clear();
+		await federation2.processQueuedTask(void 0, {
+			...fanoutMsg,
+			id: crypto.randomUUID(),
+			activity: proofless
+		});
+		const signedReplay = queue.messages.at(-1);
+		assert(signedReplay != null && signedReplay.type === "outbox");
+		assert(typeof signedReplay.activity === "object" && signedReplay.activity != null && "proof" in signedReplay.activity);
+		const edKey = (await ctx2.getActorKeyPairs("john")).find((key) => key.privateKey.algorithm.name === "Ed25519");
+		assert(edKey != null && edKey.multikey.id != null);
+		const restoredJson = await (await signObject(new vocab.Create({
+			id: new URL("https://example.com/activity/old"),
+			actor: ctx2.getActorUri("john")
+		}), edKey.privateKey, edKey.multikey.id, {
+			contextLoader: documentLoader,
+			context: oldContext
+		})).toJsonLd({
+			format: "compact",
+			contextLoader: documentLoader,
+			context: oldContext
+		});
+		const restored = await vocab.Create.fromJsonLd(restoredJson, {
+			contextLoader: documentLoader,
+			documentLoader
+		});
+		queue.clear();
+		await ctx2.sendActivity([{
+			privateKey: rsaPrivateKey2,
+			keyId: rsaPublicKey2.id
+		}], {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, restored);
+		const resent = queue.messages.at(-1);
+		assert(resent != null && resent.type === "outbox");
+		assertEquals(detachSignature(resent.activity), restoredJson);
+		queue.clear();
+		await ctx2.sendActivity([{
+			privateKey: rsaPrivateKey2,
+			keyId: rsaPublicKey2.id
+		}], {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, restored, { fanout: "force" });
+		const queuedFanout = queue.messages.at(-1);
+		assert(queuedFanout != null && queuedFanout.type === "fanout");
+		assertEquals(queuedFanout.activity, restoredJson);
+		const restoredWithSignature = await vocab.Create.fromJsonLd(attachSignature(restoredJson, {
+			"@context": "https://w3id.org/identity/v1",
+			type: "RsaSignature2017",
+			creator: "https://example.com/person2#key4",
+			created: "2026-01-01T00:00:00Z",
+			signatureValue: "abc"
+		}), {
+			contextLoader: documentLoader,
+			documentLoader
+		});
+		queue.clear();
+		await ctx2.sendActivity([{
+			privateKey: rsaPrivateKey2,
+			keyId: rsaPublicKey2.id
+		}], {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, restoredWithSignature);
+		const resigned = queue.messages.at(-1);
+		assert(resigned != null && resigned.type === "outbox");
+		assertEquals(detachSignature(resigned.activity), restoredJson);
+		const rsaOnlyJson = await (await signObject(new vocab.Create({
+			id: new URL("https://example.com/activity/rsa-only"),
+			actor: new URL("https://example.com/rsa-only")
+		}), ed25519PrivateKey, ed25519Multikey.id, {
+			contextLoader: documentLoader,
+			context: oldContext
+		})).toJsonLd({
+			format: "compact",
+			contextLoader: documentLoader,
+			context: oldContext
+		});
+		const rsaOnlyRestored = await vocab.Create.fromJsonLd(rsaOnlyJson, {
+			contextLoader: documentLoader,
+			documentLoader
+		});
+		queue.clear();
+		await ctx2.sendActivity({ identifier: "rsa-only" }, {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, rsaOnlyRestored, { fanout: "force" });
+		const rsaOnlyMessage = queue.messages.at(-1);
+		assert(rsaOnlyMessage != null && rsaOnlyMessage.type === "fanout");
+		assertEquals(rsaOnlyMessage.activity, rsaOnlyJson);
+		queue.clear();
+		await ctx2.sendActivity({ username: "john" }, {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, restored, { fanout: "force" });
+		const namedFanout = queue.messages.at(-1);
+		assert(namedFanout != null && namedFanout.type === "fanout");
+		const namedJson = detachSignature(namedFanout.activity);
+		assertEquals((Array.isArray(namedJson.proof) ? namedJson.proof : [namedJson.proof]).length, 1);
+		assert(namedJson["@context"].includes("https://w3id.org/security/v1"));
+		const noIdJson = await (await signObject(new vocab.Create({ actor: ctx2.getActorUri("john") }), edKey.privateKey, edKey.multikey.id, {
+			contextLoader: documentLoader,
+			context: oldContext
+		})).toJsonLd({
+			format: "compact",
+			contextLoader: documentLoader,
+			context: oldContext
+		});
+		const noIdRestored = await vocab.Create.fromJsonLd(noIdJson, {
+			contextLoader: documentLoader,
+			documentLoader
+		});
+		queue.clear();
+		await ctx2.sendActivity([{
+			privateKey: rsaPrivateKey2,
+			keyId: rsaPublicKey2.id
+		}], {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, noIdRestored);
+		const noIdQueued = queue.messages.at(-1);
+		assert(noIdQueued != null && noIdQueued.type === "outbox");
+		assert(typeof detachSignature(noIdQueued.activity).id === "string");
+		const currentJson = await (await signObject(new vocab.Create({
+			id: new URL("https://example.com/activity/current"),
+			actor: ctx2.getActorUri("john")
+		}), edKey.privateKey, edKey.multikey.id, { contextLoader: documentLoader })).toJsonLd({
+			format: "compact",
+			contextLoader: documentLoader
+		});
+		const currentRestored = await vocab.Create.fromJsonLd(currentJson, {
+			contextLoader: documentLoader,
+			documentLoader
+		});
+		queue.clear();
+		await ctx2.sendActivity({ username: "john" }, {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, currentRestored, { fanout: "force" });
+		const currentFanout = queue.messages.at(-1);
+		assert(currentFanout != null && currentFanout.type === "fanout");
+		const currentQueued = detachSignature(currentFanout.activity);
+		assertEquals((Array.isArray(currentQueued.proof) ? currentQueued.proof : [currentQueued.proof]).length, 2);
+	});
+	queue.clear();
+	await t.step("activity transformers preserve proofs", async () => {
+		const originalProof = new vocab.DataIntegrityProof({
+			cryptosuite: "eddsa-jcs-2022",
+			verificationMethod: new URL("https://example.com/rsa-only#multikey-2"),
+			proofPurpose: "assertionMethod",
+			proofValue: new Uint8Array([
+				1,
+				2,
+				3,
+				4
+			]),
+			created: Temporal.Instant.from("2026-01-01T00:00:00Z")
+		});
+		const addedProof = new vocab.DataIntegrityProof({
+			cryptosuite: "eddsa-jcs-2022",
+			verificationMethod: new URL("https://example.com/rsa-only#multikey-2"),
+			proofPurpose: "assertionMethod",
+			proofValue: new Uint8Array([
+				5,
+				6,
+				7,
+				8
+			]),
+			created: Temporal.Instant.from("2026-01-02T00:00:00Z")
+		});
+		const replacementProof = new vocab.DataIntegrityProof({
+			cryptosuite: "eddsa-jcs-2022",
+			verificationMethod: new URL("https://example.com/rsa-only#multikey-2"),
+			proofPurpose: "assertionMethod",
+			proofValue: new Uint8Array([
+				9,
+				10,
+				11,
+				12
+			]),
+			created: Temporal.Instant.from("2026-01-03T00:00:00Z")
+		});
+		const restoredProof = new vocab.DataIntegrityProof({
+			cryptosuite: "eddsa-jcs-2022",
+			verificationMethod: new URL("https://example.com/rsa-only#multikey-2"),
+			proofPurpose: "assertionMethod",
+			proofValue: new Uint8Array([
+				13,
+				14,
+				15,
+				16
+			]),
+			created: Temporal.Instant.from("2026-01-04T00:00:00Z")
+		});
+		const restoredProofHolder = {};
+		const federation3 = new FederationImpl({
+			kv,
+			allowPrivateAddress: true,
+			queue,
+			activityTransformers: [(activity) => {
+				if (activity.id?.href === "https://example.com/activity/transformed-proof") return activity.clone({ proofs: [originalProof, addedProof] });
+				if (activity.id?.href === "https://example.com/activity/replaced-proof") return new vocab.Create({
+					id: activity.id,
+					actor: new URL("https://example.com/rsa-only"),
+					object: new URL("https://example.com/note/replaced"),
+					proofs: [replacementProof]
+				});
+				if (activity.id?.href === "https://example.com/activity/restored-proof") return activity.clone({ proofs: [restoredProofHolder.old, restoredProof] });
+				return activity;
+			}]
+		});
+		federation3.setActorDispatcher("/{identifier}", async (ctx, identifier) => {
+			if (identifier !== "rsa-only") return null;
+			const keys = await ctx.getActorKeyPairs(identifier);
+			return new vocab.Person({
+				id: ctx.getActorUri(identifier),
+				preferredUsername: identifier,
+				publicKey: keys[0].cryptographicKey,
+				assertionMethods: keys.map((k) => k.multikey)
+			});
+		}).setKeyPairsDispatcher((_ctx, identifier) => identifier === "rsa-only" ? [{
+			privateKey: rsaPrivateKey2,
+			publicKey: rsaPublicKey2.publicKey
+		}] : []);
+		const ctx3 = new ContextImpl({
+			data: void 0,
+			federation: federation3,
+			url: new URL("https://example.com/"),
+			documentLoader,
+			contextLoader: documentLoader
+		});
+		const activity = new vocab.Create({
+			id: new URL("https://example.com/activity/transformed-proof"),
+			actor: ctx3.getActorUri("rsa-only"),
+			proofs: [originalProof]
+		});
+		await ctx3.sendActivity({ identifier: "rsa-only" }, {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, activity, { fanout: "force" });
+		const fanout = queue.messages.at(-1);
+		assert(fanout != null && fanout.type === "fanout");
+		const fanoutJson = detachSignature(fanout.activity);
+		assertEquals((Array.isArray(fanoutJson.proof) ? fanoutJson.proof : [fanoutJson.proof]).length, 2);
+		const replacedActivity = new vocab.Create({
+			id: new URL("https://example.com/activity/replaced-proof"),
+			actor: ctx3.getActorUri("rsa-only"),
+			proofs: [originalProof]
+		});
+		queue.clear();
+		await ctx3.sendActivity({ identifier: "rsa-only" }, {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, replacedActivity, { fanout: "force" });
+		const replacedFanout = queue.messages.at(-1);
+		assert(replacedFanout != null && replacedFanout.type === "fanout");
+		const replacedJson = detachSignature(replacedFanout.activity);
+		assertEquals(replacedJson.object, "https://example.com/note/replaced");
+		const replacedProofs = Array.isArray(replacedJson.proof) ? replacedJson.proof : [replacedJson.proof];
+		assertEquals(replacedProofs.length, 1);
+		const [keptProof] = replacedProofs;
+		assertEquals(keptProof.created, "2026-01-03T00:00:00Z");
+		const oldContext = [
+			"https://w3id.org/identity/v1",
+			"https://www.w3.org/ns/activitystreams",
+			"https://w3id.org/security/data-integrity/v1"
+		];
+		const restoredJson = await (await signObject(new vocab.Create({
+			id: new URL("https://example.com/activity/restored-proof"),
+			actor: ctx3.getActorUri("rsa-only")
+		}), ed25519PrivateKey, ed25519Multikey.id, {
+			contextLoader: documentLoader,
+			context: oldContext
+		})).toJsonLd({
+			format: "compact",
+			contextLoader: documentLoader,
+			context: oldContext
+		});
+		const restored = await vocab.Create.fromJsonLd(restoredJson, {
+			contextLoader: documentLoader,
+			documentLoader
+		});
+		for await (const proof of restored.getProofs({ contextLoader: documentLoader })) {
+			restoredProofHolder.old = proof;
+			break;
+		}
+		queue.clear();
+		await ctx3.sendActivity({ identifier: "rsa-only" }, {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, restored, { fanout: "force" });
+		const restoredFanout = queue.messages.at(-1);
+		assert(restoredFanout != null && restoredFanout.type === "fanout");
+		const restoredFanoutJson = detachSignature(restoredFanout.activity);
+		const restoredProofs = Array.isArray(restoredFanoutJson.proof) ? restoredFanoutJson.proof : [restoredFanoutJson.proof];
+		assertEquals(restoredProofs.length, 1);
+		const [transformedProof] = restoredProofs;
+		assertEquals(transformedProof.created, "2026-01-04T00:00:00Z");
+		assert(Array.isArray(restoredFanoutJson["@context"]) && restoredFanoutJson["@context"].includes("https://w3id.org/security/v1"));
+		const staleTimestampJson = await (await signObject(new vocab.Create({
+			id: new URL("https://example.com/activity/stale-timestamp"),
+			actor: ctx3.getActorUri("rsa-only")
+		}), ed25519PrivateKey, ed25519Multikey.id, {
+			contextLoader: documentLoader,
+			context: oldContext
+		})).toJsonLd({
+			format: "compact",
+			contextLoader: documentLoader,
+			context: oldContext
+		});
+		const staleTimestampProof = Array.isArray(staleTimestampJson.proof) ? staleTimestampJson.proof[0] : staleTimestampJson.proof;
+		staleTimestampProof.created = "2026-01-01T00:00:00+00:00";
+		const staleTimestamp = await vocab.Create.fromJsonLd(staleTimestampJson, {
+			contextLoader: documentLoader,
+			documentLoader
+		});
+		queue.clear();
+		await ctx3.sendActivity({ identifier: "rsa-only" }, {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, staleTimestamp, { fanout: "force" });
+		const staleTimestampFanout = queue.messages.at(-1);
+		assert(staleTimestampFanout != null && staleTimestampFanout.type === "fanout");
+		assertEquals(detachSignature(staleTimestampFanout.activity), staleTimestampJson);
+		const proofless = new vocab.Create({
+			id: new URL("https://example.com/activity/proofless"),
+			actor: ctx3.getActorUri("rsa-only")
+		});
+		let unformattedSerializations = 0;
+		const originalToJsonLd = proofless.toJsonLd.bind(proofless);
+		Object.defineProperty(proofless, "toJsonLd", { value: async (options) => {
+			if (options?.format == null) unformattedSerializations++;
+			return await originalToJsonLd(options);
+		} });
+		queue.clear();
+		await ctx3.sendActivity({ identifier: "rsa-only" }, {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, proofless, { fanout: "skip" });
+		assertEquals(unformattedSerializations, 0);
 	});
 	queue.clear();
 	await t.step("fanout: \"skip\"", async () => {

package/dist/federation/mod.cjs

@@ -2,7 +2,7 @@ const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../chunk-DDcVe30Y.cjs");
-const require_middleware = require("../middleware-DThg01d8.cjs");
+const require_middleware = require("../middleware-CXoG7ZAW.cjs");
 let es_toolkit = require("es-toolkit");
 //#region src/federation/kv.ts
 /**

package/dist/federation/mod.js

@@ -1,6 +1,6 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { a as createExponentialBackoffPolicy, c as buildCollectionSynchronizationHeader, d as Router, f as RouterError, i as SendActivityError, l as digest, o as respondWithObject, r as handleWebFinger, s as respondWithObjectIfAcceptable, t as createFederation, u as createFederationBuilder } from "../middleware-CQRCnFB4.js";
+import { a as createExponentialBackoffPolicy, c as buildCollectionSynchronizationHeader, d as Router, f as RouterError, i as SendActivityError, l as digest, o as respondWithObject, r as handleWebFinger, s as respondWithObjectIfAcceptable, t as createFederation, u as createFederationBuilder } from "../middleware-BKs_a9P1.js";
 import { isEqual } from "es-toolkit";
 //#region src/federation/kv.ts
 /**

package/dist/federation/send.test.mjs

@@ -8,10 +8,10 @@ import { r as assertFalse } from "../assert_throws-D4DNWrux.mjs";
 import { n as assertInstanceOf, t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertNotEquals } from "../assert_not_equals-BkxW5QJI.mjs";
 import { t as assertRejects } from "../assert_rejects-WyYSTDDX.mjs";
-import { u as verifyRequest } from "../http-DGD9d8-A.mjs";
+import { u as verifyRequest } from "../http-C3d2DXwF.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CCxRJhWa.mjs";
-import { t as doesActorOwnKey } from "../owner-BI33UeIv.mjs";
-import { i as sendActivity, n as extractInboxes, r as fetchWithValidatedRedirects, t as SendActivityError } from "../send-nImUK91D.mjs";
+import { t as doesActorOwnKey } from "../owner-R4ffU9Ht.mjs";
+import { i as sendActivity, n as extractInboxes, r as fetchWithValidatedRedirects, t as SendActivityError } from "../send-DpvZgVSA.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { Activity, Application, Endpoints, Group, Person, Service } from "@fedify/vocab";
 import { FetchError, UrlError } from "@fedify/vocab-runtime";

package/dist/federation/temporal.test.mjs

@@ -4,7 +4,7 @@ globalThis.addEventListener = () => {};
 import "../std__assert-DflMZha5.mjs";
 import { r as assertFalse } from "../assert_throws-D4DNWrux.mjs";
 import { t as assert } from "../assert-BhQd8QHP.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "../temporal-CfNFB7M_.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "../temporal-Dd-J410Z.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/temporal.test.ts
 test("hasMalformedKnownTemporalLiteral() detects expanded proof timestamps", async () => {

package/dist/federation/webfinger.test.mjs

@@ -5,7 +5,7 @@ import { n as createRequestContext } from "../context-Juj6bdHC.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import "../std__assert-DflMZha5.mjs";
 import { t as MemoryKvStore } from "../kv-mI4Ix2EU.mjs";
-import { a as createFederation, o as handleWebFinger } from "../middleware-DDM0j-X6.mjs";
+import { a as createFederation, o as handleWebFinger } from "../middleware-BhYpLGA_.mjs";
 import { test } from "@fedify/fixture";
 import { Image, Link, Person } from "@fedify/vocab";
 //#region src/federation/webfinger.test.ts

package/dist/{http-DGD9d8-A.mjs → http-C3d2DXwF.mjs}

@@ -1,8 +1,8 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-D_rTMbAD.mjs";
-import { o as validateCryptoKey, r as fetchKey } from "./key-1Gf85RN1.mjs";
+import { n as version, t as name } from "./deno--OYa_lxj.mjs";
+import { o as validateCryptoKey, r as fetchKey } from "./key-D5e9c_yV.mjs";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";

package/dist/{http-DbDnj-Q7.cjs → http-CO_IVq7x.cjs}

@@ -11,7 +11,7 @@ let byte_encodings_base64 = require("byte-encodings/base64");
 let structured_field_values = require("structured-field-values");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.0.36-dev.2551+8b012df4";
+var version = "2.0.36-dev.2598+90504ae2";
 //#endregion
 //#region src/sig/key.ts
 /** Classifies decoding failures without hiding unexpected loader errors. */

package/dist/{http-BS1CmlZ6.js → http-CfyVeGgF.js}

@@ -10,7 +10,7 @@ import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 import { Item, decodeDict, encodeItem } from "structured-field-values";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.0.36-dev.2551+8b012df4";
+var version = "2.0.36-dev.2598+90504ae2";
 //#endregion
 //#region src/sig/key.ts
 /** Classifies decoding failures without hiding unexpected loader errors. */

package/dist/{inbox-BwpBTbhH.mjs → inbox-huUE3IP8.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-D_rTMbAD.mjs";
+import { n as version, t as name } from "./deno--OYa_lxj.mjs";
 import { Activity, getTypeId } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
 import { getLogger } from "@logtape/logtape";

package/dist/{key-1Gf85RN1.mjs → key-D5e9c_yV.mjs}

@@ -1,7 +1,7 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-D_rTMbAD.mjs";
+import { n as version, t as name } from "./deno--OYa_lxj.mjs";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError, UrlError, getDocumentLoader } from "@fedify/vocab-runtime";