@fedify/fedify 2.0.36-dev.2551 → 2.0.36-dev.2637

package/dist/federation/middleware.test.mjs

@@ -9,18 +9,19 @@ import { r as assertFalse, t as assertThrows } from "../assert_throws-D4DNWrux.m
 import { n as assertInstanceOf, t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertNotEquals } from "../assert_not_equals-BkxW5QJI.mjs";
 import { t as assertRejects } from "../assert_rejects-WyYSTDDX.mjs";
-import { c as signRequest, u as verifyRequest } from "../http-DGD9d8-A.mjs";
+import { c as signRequest, u as verifyRequest } from "../http-BWoAqky4.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CCxRJhWa.mjs";
-import { n as getAuthenticatedDocumentLoader } from "../docloader-DpTrZ5sA.mjs";
-import { a as compactJsonLd, f as signJsonLd, m as verifyJsonLd, s as detachSignature } from "../ld-BuuOR_Ms.mjs";
-import { t as doesActorOwnKey } from "../owner-BI33UeIv.mjs";
-import { n as signObject, r as verifyObject } from "../proof-GM73LJjx.mjs";
+import { n as getAuthenticatedDocumentLoader } from "../docloader-BgHM-JLc.mjs";
+import { a as compactJsonLd, f as signJsonLd, i as attachSignature, m as verifyJsonLd, s as detachSignature } from "../ld-DbSNiv8Q.mjs";
+import { t as doesActorOwnKey } from "../owner-BJeJfxnT.mjs";
+import { n as signObject, r as verifyObject } from "../proof-CaMBdk_x.mjs";
 import { t as MemoryKvStore } from "../kv-mI4Ix2EU.mjs";
-import { a as createFederation, i as KvSpecDeterminer, n as FederationImpl, r as InboxContextImpl, t as ContextImpl } from "../middleware-DDM0j-X6.mjs";
+import { a as createFederation, i as KvSpecDeterminer, n as FederationImpl, r as InboxContextImpl, t as ContextImpl } from "../middleware-C849kmHB.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import * as vocab from "@fedify/vocab";
 import { Create, Offer, Person, getTypeId, lookupObject } from "@fedify/vocab";
 import { FetchError, UrlError, getDocumentLoader } from "@fedify/vocab-runtime";
+import { configure, reset } from "@logtape/logtape";
 import dns from "node:dns/promises";
 //#region ../fixture/src/fixtures/example.com/create.json
 var id$2 = "https://example.com/create";
@@ -1575,6 +1576,320 @@ test("FederationImpl.sendActivity()", async (t) => {
 	});
 	esm_default.hardReset();
 });
+const QUEUE_STARTUP_WARNING = "Failed to start queue workers automatically: {error}";
+/**
+* Captures unhandled promise rejections for the duration of a test step.
+*
+* Deno dispatches `unhandledrejection` on `globalThis`, while Node.js and Bun
+* dispatch `unhandledRejection` on `process`.  Bun's test runner currently
+* fires neither, so there the native runner's own unhandled-rejection failure
+* remains the signal; the assertion is harmless otherwise.
+*/
+function captureUnhandledRejections() {
+	const reasons = [];
+	const isDeno = "Deno" in globalThis;
+	const onRejectionEvent = (event) => {
+		event.preventDefault();
+		reasons.push(event.reason);
+	};
+	const onProcessRejection = (reason) => {
+		reasons.push(reason);
+	};
+	const globalTarget = globalThis;
+	const proc = globalThis.process;
+	if (isDeno) globalTarget.addEventListener?.("unhandledrejection", onRejectionEvent);
+	else proc?.on?.("unhandledRejection", onProcessRejection);
+	async function settle() {
+		await new Promise((resolve) => setTimeout(resolve, 0));
+		await new Promise((resolve) => setTimeout(resolve, 0));
+	}
+	return {
+		reasons,
+		settle,
+		stop() {
+			if (isDeno) globalTarget.removeEventListener?.("unhandledrejection", onRejectionEvent);
+			else proc?.off?.("unhandledRejection", onProcessRejection);
+		}
+	};
+}
+async function configureQueueStartupWarningCapture(records) {
+	await configure({
+		sinks: { buffer(record) {
+			records.push(record);
+		} },
+		loggers: [{
+			category: "fedify",
+			sinks: ["buffer"],
+			lowestLevel: "warning"
+		}, {
+			category: ["logtape", "meta"],
+			sinks: []
+		}],
+		reset: true
+	});
+}
+function queueStartupWarnings(records, error) {
+	return records.filter((record) => record.level === "warning" && record.category.length === 3 && record.category[0] === "fedify" && record.category[1] === "federation" && record.category[2] === "queue" && record.rawMessage === QUEUE_STARTUP_WARNING && record.properties.error === error);
+}
+test("Federation.fetch() reports automatic queue startup failures", async (t) => {
+	const listenError = /* @__PURE__ */ new TypeError("simulated listen() failure");
+	const queue = {
+		enqueue() {
+			return Promise.resolve();
+		},
+		listen() {
+			throw listenError;
+		}
+	};
+	const capture = captureUnhandledRejections();
+	const records = [];
+	await configureQueueStartupWarningCapture(records);
+	try {
+		const federation = createFederation({
+			kv: new MemoryKvStore(),
+			queue,
+			skipSignatureVerification: true,
+			documentLoaderFactory: () => mockDocumentLoader,
+			contextLoaderFactory: () => mockDocumentLoader
+		});
+		federation.setActorDispatcher("/actors/{identifier}", () => new Person({ id: new URL("https://example.com/actor") }));
+		federation.setInboxListeners("/actors/{identifier}/inbox", "/inbox").on(Create, () => {});
+		const post = (id) => federation.fetch(new Request("https://example.com/inbox", {
+			method: "POST",
+			headers: { "Content-Type": "application/activity+json" },
+			body: JSON.stringify({
+				"@context": "https://www.w3.org/ns/activitystreams",
+				id,
+				type: "Create",
+				actor: "https://example.com/actor"
+			})
+		}), { contextData: void 0 });
+		await t.step("synchronous failure", async () => {
+			assertEquals((await post("https://example.com/activities/queued-1")).status, 202);
+			await capture.settle();
+			assertEquals(queueStartupWarnings(records, listenError).length, 1);
+			assertEquals(capture.reasons, []);
+			assertEquals((await post("https://example.com/activities/queued-2")).status, 202);
+			await capture.settle();
+			assertEquals(queueStartupWarnings(records, listenError).length, 1, "the warning must be logged only once per federation instance");
+			assertEquals(capture.reasons, []);
+		});
+		await t.step("asynchronous failure", async () => {
+			const asyncError = /* @__PURE__ */ new TypeError("simulated async listen() failure");
+			let rejectListen;
+			const asyncFederation = createFederation({
+				kv: new MemoryKvStore(),
+				queue: {
+					enqueue() {
+						return Promise.resolve();
+					},
+					listen() {
+						return new Promise((_resolve, reject) => {
+							rejectListen = reject;
+						});
+					}
+				},
+				skipSignatureVerification: true,
+				documentLoaderFactory: () => mockDocumentLoader,
+				contextLoaderFactory: () => mockDocumentLoader
+			});
+			asyncFederation.setActorDispatcher("/actors/{identifier}", () => new Person({ id: new URL("https://example.com/actor") }));
+			asyncFederation.setInboxListeners("/actors/{identifier}/inbox", "/inbox").on(Create, () => {});
+			assertEquals((await asyncFederation.fetch(new Request("https://example.com/inbox", {
+				method: "POST",
+				headers: { "Content-Type": "application/activity+json" },
+				body: JSON.stringify({
+					"@context": "https://www.w3.org/ns/activitystreams",
+					id: "https://example.com/activities/queued-async",
+					type: "Create",
+					actor: "https://example.com/actor"
+				})
+			}), { contextData: void 0 })).status, 202);
+			await capture.settle();
+			assertEquals(queueStartupWarnings(records, asyncError).length, 0);
+			assert(rejectListen != null);
+			rejectListen(asyncError);
+			await capture.settle();
+			assertEquals(queueStartupWarnings(records, asyncError).length, 1, "a listener that rejects after startup must still be reported");
+			assertEquals(capture.reasons, []);
+		});
+	} finally {
+		await capture.settle();
+		capture.stop();
+		await reset();
+	}
+});
+test("Federation.startQueue() rejects when a queue cannot listen", async () => {
+	const listenError = /* @__PURE__ */ new TypeError("simulated listen() failure");
+	const federation = createFederation({
+		kv: new MemoryKvStore(),
+		queue: {
+			enqueue() {
+				return Promise.resolve();
+			},
+			listen() {
+				throw listenError;
+			}
+		},
+		manuallyStartQueue: true
+	});
+	assertStrictEquals(await assertRejects(() => federation.startQueue(void 0)), listenError);
+});
+test("Federation.startQueue() keeps other queue workers running", async () => {
+	const outboxError = /* @__PURE__ */ new TypeError("simulated outbox listen() failure");
+	const lateInboxError = /* @__PURE__ */ new TypeError("simulated late inbox failure");
+	let rejectInbox;
+	let fanoutStarted = false;
+	const inbox = {
+		enqueue() {
+			return Promise.resolve();
+		},
+		listen() {
+			return new Promise((_resolve, reject) => {
+				rejectInbox = reject;
+			});
+		}
+	};
+	const outbox = {
+		enqueue() {
+			return Promise.resolve();
+		},
+		listen() {
+			throw outboxError;
+		}
+	};
+	const fanout = {
+		enqueue() {
+			return Promise.resolve();
+		},
+		listen() {
+			fanoutStarted = true;
+			return new Promise(() => {});
+		}
+	};
+	const capture = captureUnhandledRejections();
+	try {
+		const federation = createFederation({
+			kv: new MemoryKvStore(),
+			queue: {
+				inbox,
+				outbox,
+				fanout
+			},
+			manuallyStartQueue: true
+		});
+		assertStrictEquals(await assertRejects(() => federation.startQueue(void 0)), outboxError);
+		assert(fanoutStarted, "a synchronous throw from one queue must not prevent later queues from starting");
+		assert(rejectInbox != null);
+		rejectInbox(lateInboxError);
+		await capture.settle();
+		assertEquals(capture.reasons, [], "an earlier listener rejection must remain handled after startup fails");
+	} finally {
+		await capture.settle();
+		capture.stop();
+	}
+});
+test("ContextImpl.sendActivity() reports automatic queue startup failures", async (t) => {
+	const sender = [{
+		privateKey: ed25519PrivateKey,
+		keyId: ed25519Multikey.id
+	}];
+	const recipient = {
+		id: new URL("https://example.com/recipient"),
+		inboxId: new URL("https://example.com/inbox")
+	};
+	const createActivity = () => new Create({
+		id: new URL("https://example.com/activities/queue-startup-send"),
+		actor: new URL("https://example.com/actor")
+	});
+	await t.step("outbox", async () => {
+		const listenError = /* @__PURE__ */ new TypeError("simulated outbox listen() failure");
+		const messages = [];
+		const queue = {
+			enqueue(message) {
+				messages.push(message);
+				return Promise.resolve();
+			},
+			listen() {
+				throw listenError;
+			}
+		};
+		const capture = captureUnhandledRejections();
+		const records = [];
+		await configureQueueStartupWarningCapture(records);
+		try {
+			await new ContextImpl({
+				data: void 0,
+				federation: new FederationImpl({
+					kv: new MemoryKvStore(),
+					queue: { outbox: queue },
+					documentLoaderFactory: () => mockDocumentLoader,
+					contextLoaderFactory: () => mockDocumentLoader
+				}),
+				url: new URL("https://example.com/"),
+				documentLoader: mockDocumentLoader,
+				contextLoader: mockDocumentLoader
+			}).sendActivity(sender, recipient, createActivity());
+			assertEquals(messages.map((message) => message.type), ["outbox"]);
+			await capture.settle();
+			assertEquals(queueStartupWarnings(records, listenError).length, 1);
+			assertEquals(capture.reasons, []);
+		} finally {
+			await capture.settle();
+			capture.stop();
+			await reset();
+		}
+	});
+	await t.step("fanout", async () => {
+		const listenError = /* @__PURE__ */ new TypeError("simulated fanout listen() failure");
+		const messages = [];
+		const outbox = {
+			enqueue() {
+				return Promise.resolve();
+			},
+			listen() {
+				return Promise.resolve();
+			}
+		};
+		const fanout = {
+			enqueue(message) {
+				messages.push(message);
+				return Promise.resolve();
+			},
+			listen() {
+				throw listenError;
+			}
+		};
+		const capture = captureUnhandledRejections();
+		const records = [];
+		await configureQueueStartupWarningCapture(records);
+		try {
+			await new ContextImpl({
+				data: void 0,
+				federation: new FederationImpl({
+					kv: new MemoryKvStore(),
+					queue: {
+						outbox,
+						fanout
+					},
+					documentLoaderFactory: () => mockDocumentLoader,
+					contextLoaderFactory: () => mockDocumentLoader
+				}),
+				url: new URL("https://example.com/"),
+				documentLoader: mockDocumentLoader,
+				contextLoader: mockDocumentLoader
+			}).sendActivity(sender, recipient, createActivity(), { fanout: "force" });
+			assertEquals(messages.map((message) => message.type), ["fanout"]);
+			await capture.settle();
+			assertEquals(queueStartupWarnings(records, listenError).length, 1);
+			assertEquals(capture.reasons, []);
+		} finally {
+			await capture.settle();
+			capture.stop();
+			await reset();
+		}
+	});
+});
 test("FederationImpl.processQueuedTask()", async (t) => {
 	await t.step("with MessageQueue having nativeRetrial", async () => {
 		const kv = new MemoryKvStore();
@@ -3594,15 +3909,19 @@ test("ContextImpl.sendActivity()", async (t) => {
 		queue
 	});
 	federation2.setActorDispatcher("/{identifier}", async (ctx, identifier) => {
-		if (identifier !== "john") return null;
+		if (identifier !== "john" && identifier !== "rsa-only") return null;
 		const keys = await ctx.getActorKeyPairs(identifier);
 		return new vocab.Person({
 			id: ctx.getActorUri(identifier),
-			preferredUsername: "john",
+			preferredUsername: identifier,
 			publicKey: keys[0].cryptographicKey,
 			assertionMethods: keys.map((k) => k.multikey)
 		});
 	}).setKeyPairsDispatcher((_ctx, identifier) => {
+		if (identifier === "rsa-only") return [{
+			privateKey: rsaPrivateKey2,
+			publicKey: rsaPublicKey2.publicKey
+		}];
 		if (identifier !== "john") return [];
 		return [{
 			privateKey: rsaPrivateKey2,
@@ -3651,6 +3970,375 @@ test("ContextImpl.sendActivity()", async (t) => {
 			proofCount++;
 		}
 		assertEquals(proofCount, 1);
+		const oldContext = [
+			"https://w3id.org/identity/v1",
+			"https://www.w3.org/ns/activitystreams",
+			"https://w3id.org/security/data-integrity/v1"
+		];
+		const oldJson = await (await signObject(new vocab.Create({
+			id: new URL("https://example.com/activity/1"),
+			actor: new URL("https://example.com/john")
+		}), ed25519PrivateKey, ed25519Multikey.id, {
+			contextLoader: documentLoader,
+			context: oldContext
+		})).toJsonLd({
+			format: "compact",
+			contextLoader: documentLoader,
+			context: oldContext
+		});
+		queue.clear();
+		await federation2.processQueuedTask(void 0, {
+			...fanoutMsg,
+			id: crypto.randomUUID(),
+			activity: oldJson
+		});
+		const replayed = queue.messages.at(-1);
+		assert(replayed != null && replayed.type === "outbox");
+		assertEquals(detachSignature(replayed.activity), oldJson);
+		const proofless = { ...oldJson };
+		delete proofless.proof;
+		queue.clear();
+		await federation2.processQueuedTask(void 0, {
+			...fanoutMsg,
+			id: crypto.randomUUID(),
+			activity: proofless
+		});
+		const signedReplay = queue.messages.at(-1);
+		assert(signedReplay != null && signedReplay.type === "outbox");
+		assert(typeof signedReplay.activity === "object" && signedReplay.activity != null && "proof" in signedReplay.activity);
+		const edKey = (await ctx2.getActorKeyPairs("john")).find((key) => key.privateKey.algorithm.name === "Ed25519");
+		assert(edKey != null && edKey.multikey.id != null);
+		const restoredJson = await (await signObject(new vocab.Create({
+			id: new URL("https://example.com/activity/old"),
+			actor: ctx2.getActorUri("john")
+		}), edKey.privateKey, edKey.multikey.id, {
+			contextLoader: documentLoader,
+			context: oldContext
+		})).toJsonLd({
+			format: "compact",
+			contextLoader: documentLoader,
+			context: oldContext
+		});
+		const restored = await vocab.Create.fromJsonLd(restoredJson, {
+			contextLoader: documentLoader,
+			documentLoader
+		});
+		queue.clear();
+		await ctx2.sendActivity([{
+			privateKey: rsaPrivateKey2,
+			keyId: rsaPublicKey2.id
+		}], {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, restored);
+		const resent = queue.messages.at(-1);
+		assert(resent != null && resent.type === "outbox");
+		assertEquals(detachSignature(resent.activity), restoredJson);
+		queue.clear();
+		await ctx2.sendActivity([{
+			privateKey: rsaPrivateKey2,
+			keyId: rsaPublicKey2.id
+		}], {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, restored, { fanout: "force" });
+		const queuedFanout = queue.messages.at(-1);
+		assert(queuedFanout != null && queuedFanout.type === "fanout");
+		assertEquals(queuedFanout.activity, restoredJson);
+		const restoredWithSignature = await vocab.Create.fromJsonLd(attachSignature(restoredJson, {
+			"@context": "https://w3id.org/identity/v1",
+			type: "RsaSignature2017",
+			creator: "https://example.com/person2#key4",
+			created: "2026-01-01T00:00:00Z",
+			signatureValue: "abc"
+		}), {
+			contextLoader: documentLoader,
+			documentLoader
+		});
+		queue.clear();
+		await ctx2.sendActivity([{
+			privateKey: rsaPrivateKey2,
+			keyId: rsaPublicKey2.id
+		}], {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, restoredWithSignature);
+		const resigned = queue.messages.at(-1);
+		assert(resigned != null && resigned.type === "outbox");
+		assertEquals(detachSignature(resigned.activity), restoredJson);
+		const rsaOnlyJson = await (await signObject(new vocab.Create({
+			id: new URL("https://example.com/activity/rsa-only"),
+			actor: new URL("https://example.com/rsa-only")
+		}), ed25519PrivateKey, ed25519Multikey.id, {
+			contextLoader: documentLoader,
+			context: oldContext
+		})).toJsonLd({
+			format: "compact",
+			contextLoader: documentLoader,
+			context: oldContext
+		});
+		const rsaOnlyRestored = await vocab.Create.fromJsonLd(rsaOnlyJson, {
+			contextLoader: documentLoader,
+			documentLoader
+		});
+		queue.clear();
+		await ctx2.sendActivity({ identifier: "rsa-only" }, {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, rsaOnlyRestored, { fanout: "force" });
+		const rsaOnlyMessage = queue.messages.at(-1);
+		assert(rsaOnlyMessage != null && rsaOnlyMessage.type === "fanout");
+		assertEquals(rsaOnlyMessage.activity, rsaOnlyJson);
+		queue.clear();
+		await ctx2.sendActivity({ username: "john" }, {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, restored, { fanout: "force" });
+		const namedFanout = queue.messages.at(-1);
+		assert(namedFanout != null && namedFanout.type === "fanout");
+		const namedJson = detachSignature(namedFanout.activity);
+		assertEquals((Array.isArray(namedJson.proof) ? namedJson.proof : [namedJson.proof]).length, 1);
+		assert(namedJson["@context"].includes("https://w3id.org/security/v1"));
+		const noIdJson = await (await signObject(new vocab.Create({ actor: ctx2.getActorUri("john") }), edKey.privateKey, edKey.multikey.id, {
+			contextLoader: documentLoader,
+			context: oldContext
+		})).toJsonLd({
+			format: "compact",
+			contextLoader: documentLoader,
+			context: oldContext
+		});
+		const noIdRestored = await vocab.Create.fromJsonLd(noIdJson, {
+			contextLoader: documentLoader,
+			documentLoader
+		});
+		queue.clear();
+		await ctx2.sendActivity([{
+			privateKey: rsaPrivateKey2,
+			keyId: rsaPublicKey2.id
+		}], {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, noIdRestored);
+		const noIdQueued = queue.messages.at(-1);
+		assert(noIdQueued != null && noIdQueued.type === "outbox");
+		assert(typeof detachSignature(noIdQueued.activity).id === "string");
+		const currentJson = await (await signObject(new vocab.Create({
+			id: new URL("https://example.com/activity/current"),
+			actor: ctx2.getActorUri("john")
+		}), edKey.privateKey, edKey.multikey.id, { contextLoader: documentLoader })).toJsonLd({
+			format: "compact",
+			contextLoader: documentLoader
+		});
+		const currentRestored = await vocab.Create.fromJsonLd(currentJson, {
+			contextLoader: documentLoader,
+			documentLoader
+		});
+		queue.clear();
+		await ctx2.sendActivity({ username: "john" }, {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, currentRestored, { fanout: "force" });
+		const currentFanout = queue.messages.at(-1);
+		assert(currentFanout != null && currentFanout.type === "fanout");
+		const currentQueued = detachSignature(currentFanout.activity);
+		assertEquals((Array.isArray(currentQueued.proof) ? currentQueued.proof : [currentQueued.proof]).length, 2);
+	});
+	queue.clear();
+	await t.step("activity transformers preserve proofs", async () => {
+		const originalProof = new vocab.DataIntegrityProof({
+			cryptosuite: "eddsa-jcs-2022",
+			verificationMethod: new URL("https://example.com/rsa-only#multikey-2"),
+			proofPurpose: "assertionMethod",
+			proofValue: new Uint8Array([
+				1,
+				2,
+				3,
+				4
+			]),
+			created: Temporal.Instant.from("2026-01-01T00:00:00Z")
+		});
+		const addedProof = new vocab.DataIntegrityProof({
+			cryptosuite: "eddsa-jcs-2022",
+			verificationMethod: new URL("https://example.com/rsa-only#multikey-2"),
+			proofPurpose: "assertionMethod",
+			proofValue: new Uint8Array([
+				5,
+				6,
+				7,
+				8
+			]),
+			created: Temporal.Instant.from("2026-01-02T00:00:00Z")
+		});
+		const replacementProof = new vocab.DataIntegrityProof({
+			cryptosuite: "eddsa-jcs-2022",
+			verificationMethod: new URL("https://example.com/rsa-only#multikey-2"),
+			proofPurpose: "assertionMethod",
+			proofValue: new Uint8Array([
+				9,
+				10,
+				11,
+				12
+			]),
+			created: Temporal.Instant.from("2026-01-03T00:00:00Z")
+		});
+		const restoredProof = new vocab.DataIntegrityProof({
+			cryptosuite: "eddsa-jcs-2022",
+			verificationMethod: new URL("https://example.com/rsa-only#multikey-2"),
+			proofPurpose: "assertionMethod",
+			proofValue: new Uint8Array([
+				13,
+				14,
+				15,
+				16
+			]),
+			created: Temporal.Instant.from("2026-01-04T00:00:00Z")
+		});
+		const restoredProofHolder = {};
+		const federation3 = new FederationImpl({
+			kv,
+			allowPrivateAddress: true,
+			queue,
+			activityTransformers: [(activity) => {
+				if (activity.id?.href === "https://example.com/activity/transformed-proof") return activity.clone({ proofs: [originalProof, addedProof] });
+				if (activity.id?.href === "https://example.com/activity/replaced-proof") return new vocab.Create({
+					id: activity.id,
+					actor: new URL("https://example.com/rsa-only"),
+					object: new URL("https://example.com/note/replaced"),
+					proofs: [replacementProof]
+				});
+				if (activity.id?.href === "https://example.com/activity/restored-proof") return activity.clone({ proofs: [restoredProofHolder.old, restoredProof] });
+				return activity;
+			}]
+		});
+		federation3.setActorDispatcher("/{identifier}", async (ctx, identifier) => {
+			if (identifier !== "rsa-only") return null;
+			const keys = await ctx.getActorKeyPairs(identifier);
+			return new vocab.Person({
+				id: ctx.getActorUri(identifier),
+				preferredUsername: identifier,
+				publicKey: keys[0].cryptographicKey,
+				assertionMethods: keys.map((k) => k.multikey)
+			});
+		}).setKeyPairsDispatcher((_ctx, identifier) => identifier === "rsa-only" ? [{
+			privateKey: rsaPrivateKey2,
+			publicKey: rsaPublicKey2.publicKey
+		}] : []);
+		const ctx3 = new ContextImpl({
+			data: void 0,
+			federation: federation3,
+			url: new URL("https://example.com/"),
+			documentLoader,
+			contextLoader: documentLoader
+		});
+		const activity = new vocab.Create({
+			id: new URL("https://example.com/activity/transformed-proof"),
+			actor: ctx3.getActorUri("rsa-only"),
+			proofs: [originalProof]
+		});
+		await ctx3.sendActivity({ identifier: "rsa-only" }, {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, activity, { fanout: "force" });
+		const fanout = queue.messages.at(-1);
+		assert(fanout != null && fanout.type === "fanout");
+		const fanoutJson = detachSignature(fanout.activity);
+		assertEquals((Array.isArray(fanoutJson.proof) ? fanoutJson.proof : [fanoutJson.proof]).length, 2);
+		const replacedActivity = new vocab.Create({
+			id: new URL("https://example.com/activity/replaced-proof"),
+			actor: ctx3.getActorUri("rsa-only"),
+			proofs: [originalProof]
+		});
+		queue.clear();
+		await ctx3.sendActivity({ identifier: "rsa-only" }, {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, replacedActivity, { fanout: "force" });
+		const replacedFanout = queue.messages.at(-1);
+		assert(replacedFanout != null && replacedFanout.type === "fanout");
+		const replacedJson = detachSignature(replacedFanout.activity);
+		assertEquals(replacedJson.object, "https://example.com/note/replaced");
+		const replacedProofs = Array.isArray(replacedJson.proof) ? replacedJson.proof : [replacedJson.proof];
+		assertEquals(replacedProofs.length, 1);
+		const [keptProof] = replacedProofs;
+		assertEquals(keptProof.created, "2026-01-03T00:00:00Z");
+		const oldContext = [
+			"https://w3id.org/identity/v1",
+			"https://www.w3.org/ns/activitystreams",
+			"https://w3id.org/security/data-integrity/v1"
+		];
+		const restoredJson = await (await signObject(new vocab.Create({
+			id: new URL("https://example.com/activity/restored-proof"),
+			actor: ctx3.getActorUri("rsa-only")
+		}), ed25519PrivateKey, ed25519Multikey.id, {
+			contextLoader: documentLoader,
+			context: oldContext
+		})).toJsonLd({
+			format: "compact",
+			contextLoader: documentLoader,
+			context: oldContext
+		});
+		const restored = await vocab.Create.fromJsonLd(restoredJson, {
+			contextLoader: documentLoader,
+			documentLoader
+		});
+		for await (const proof of restored.getProofs({ contextLoader: documentLoader })) {
+			restoredProofHolder.old = proof;
+			break;
+		}
+		queue.clear();
+		await ctx3.sendActivity({ identifier: "rsa-only" }, {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, restored, { fanout: "force" });
+		const restoredFanout = queue.messages.at(-1);
+		assert(restoredFanout != null && restoredFanout.type === "fanout");
+		const restoredFanoutJson = detachSignature(restoredFanout.activity);
+		const restoredProofs = Array.isArray(restoredFanoutJson.proof) ? restoredFanoutJson.proof : [restoredFanoutJson.proof];
+		assertEquals(restoredProofs.length, 1);
+		const [transformedProof] = restoredProofs;
+		assertEquals(transformedProof.created, "2026-01-04T00:00:00Z");
+		assert(Array.isArray(restoredFanoutJson["@context"]) && restoredFanoutJson["@context"].includes("https://w3id.org/security/v1"));
+		const staleTimestampJson = await (await signObject(new vocab.Create({
+			id: new URL("https://example.com/activity/stale-timestamp"),
+			actor: ctx3.getActorUri("rsa-only")
+		}), ed25519PrivateKey, ed25519Multikey.id, {
+			contextLoader: documentLoader,
+			context: oldContext
+		})).toJsonLd({
+			format: "compact",
+			contextLoader: documentLoader,
+			context: oldContext
+		});
+		const staleTimestampProof = Array.isArray(staleTimestampJson.proof) ? staleTimestampJson.proof[0] : staleTimestampJson.proof;
+		staleTimestampProof.created = "2026-01-01T00:00:00+00:00";
+		const staleTimestamp = await vocab.Create.fromJsonLd(staleTimestampJson, {
+			contextLoader: documentLoader,
+			documentLoader
+		});
+		queue.clear();
+		await ctx3.sendActivity({ identifier: "rsa-only" }, {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, staleTimestamp, { fanout: "force" });
+		const staleTimestampFanout = queue.messages.at(-1);
+		assert(staleTimestampFanout != null && staleTimestampFanout.type === "fanout");
+		assertEquals(detachSignature(staleTimestampFanout.activity), staleTimestampJson);
+		const proofless = new vocab.Create({
+			id: new URL("https://example.com/activity/proofless"),
+			actor: ctx3.getActorUri("rsa-only")
+		});
+		let unformattedSerializations = 0;
+		const originalToJsonLd = proofless.toJsonLd.bind(proofless);
+		Object.defineProperty(proofless, "toJsonLd", { value: async (options) => {
+			if (options?.format == null) unformattedSerializations++;
+			return await originalToJsonLd(options);
+		} });
+		queue.clear();
+		await ctx3.sendActivity({ identifier: "rsa-only" }, {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, proofless, { fanout: "skip" });
+		assertEquals(unformattedSerializations, 0);
 	});
 	queue.clear();
 	await t.step("fanout: \"skip\"", async () => {