@fedify/fedify 2.0.36-dev.2551 → 2.0.36-dev.2637

package/dist/federation/mod.cjs

@@ -2,7 +2,7 @@ const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../chunk-DDcVe30Y.cjs");
-const require_middleware = require("../middleware-DThg01d8.cjs");
+const require_middleware = require("../middleware-C_fDk_dx.cjs");
 let es_toolkit = require("es-toolkit");
 //#region src/federation/kv.ts
 /**

package/dist/federation/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { $ as AuthorizePredicate, A as CreateExponentialBackoffPolicyOptions, B as RespondWithObjectOptions, C as InboxListenerSetters, D as FederationOrigin, E as FederationKvPrefixes, F as createFederationBuilder, G as MessageQueue, H as respondWithObjectIfAcceptable, I as Router, J as ParallelMessageQueue, K as MessageQueueEnqueueOptions, L as RouterError, M as RetryPolicy, N as createExponentialBackoffPolicy, O as FederationQueueOptions, P as Message, Q as ActorKeyPairsDispatcher, R as RouterOptions, S as IdempotencyStrategy, T as Rfc6570Expression, U as InProcessMessageQueue, V as respondWithObject, W as InProcessMessageQueueOptions, X as ActorDispatcher, Y as ActorAliasMapper, Z as ActorHandleMapper, _ as FederationBuilder, _t as PageItems, a as InboxContext, at as CustomCollectionDispatcher, b as FederationStartQueueOptions, c as RouteActivityOptions, ct as NodeInfoDispatcher, d as ActorCallbackSetters, dt as OutboxErrorHandler, et as CollectionCounter, f as CollectionCallbackSetters, ft as OutboxPermanentFailureHandler, g as Federation, gt as SenderKeyPair, h as Federatable, ht as SendActivityError, i as GetSignedKeyOptions, it as CustomCollectionCursor, j as RetryContext, k as createFederation, l as SendActivityOptions, lt as ObjectAuthorizePredicate, m as CustomCollectionCallbackSetters, mt as WebFingerLinksDispatcher, n as Context, nt as CollectionDispatcher, o as ParseUriResult, ot as InboxErrorHandler, p as ConstructorWithTypeId, pt as SharedInboxKeyDispatcher, q as MessageQueueListenOptions, r as ForwardActivityOptions, rt as CustomCollectionCounter, s as RequestContext, st as InboxListener, t as ActorKeyPair, tt as CollectionCursor, u as SendActivityOptionsForCollection, ut as ObjectDispatcher, v as FederationFetchOptions, vt as buildCollectionSynchronizationHeader, w as ObjectCallbackSetters, x as IdempotencyKeyCallback, y as FederationOptions, yt as digest, z as RouterRouteResult } from "../context-CnoWxuoB.cjs";
+import { $ as AuthorizePredicate, A as CreateExponentialBackoffPolicyOptions, B as RespondWithObjectOptions, C as InboxListenerSetters, D as FederationOrigin, E as FederationKvPrefixes, F as createFederationBuilder, G as MessageQueue, H as respondWithObjectIfAcceptable, I as Router, J as ParallelMessageQueue, K as MessageQueueEnqueueOptions, L as RouterError, M as RetryPolicy, N as createExponentialBackoffPolicy, O as FederationQueueOptions, P as Message, Q as ActorKeyPairsDispatcher, R as RouterOptions, S as IdempotencyStrategy, T as Rfc6570Expression, U as InProcessMessageQueue, V as respondWithObject, W as InProcessMessageQueueOptions, X as ActorDispatcher, Y as ActorAliasMapper, Z as ActorHandleMapper, _ as FederationBuilder, _t as PageItems, a as InboxContext, at as CustomCollectionDispatcher, b as FederationStartQueueOptions, c as RouteActivityOptions, ct as NodeInfoDispatcher, d as ActorCallbackSetters, dt as OutboxErrorHandler, et as CollectionCounter, f as CollectionCallbackSetters, ft as OutboxPermanentFailureHandler, g as Federation, gt as SenderKeyPair, h as Federatable, ht as SendActivityError, i as GetSignedKeyOptions, it as CustomCollectionCursor, j as RetryContext, k as createFederation, l as SendActivityOptions, lt as ObjectAuthorizePredicate, m as CustomCollectionCallbackSetters, mt as WebFingerLinksDispatcher, n as Context, nt as CollectionDispatcher, o as ParseUriResult, ot as InboxErrorHandler, p as ConstructorWithTypeId, pt as SharedInboxKeyDispatcher, q as MessageQueueListenOptions, r as ForwardActivityOptions, rt as CustomCollectionCounter, s as RequestContext, st as InboxListener, t as ActorKeyPair, tt as CollectionCursor, u as SendActivityOptionsForCollection, ut as ObjectDispatcher, v as FederationFetchOptions, vt as buildCollectionSynchronizationHeader, w as ObjectCallbackSetters, x as IdempotencyKeyCallback, y as FederationOptions, yt as digest, z as RouterRouteResult } from "../context-ao-qb3eP.cjs";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "../kv-CZKl1IUS.cjs";
-import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-w1oyHseQ.cjs";
+import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-6uJWdCc0.cjs";
 export { ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, Federatable, Federation, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, ForwardActivityOptions, GetSignedKeyOptions, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MemoryKvStore, Message, MessageQueue, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfoDispatcher, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboxErrorHandler, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseUriResult, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, SharedInboxKeyDispatcher, WebFingerHandlerParameters, WebFingerLinksDispatcher, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, digest, handleWebFinger, respondWithObject, respondWithObjectIfAcceptable };

package/dist/federation/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { $ as AuthorizePredicate, A as CreateExponentialBackoffPolicyOptions, B as RespondWithObjectOptions, C as InboxListenerSetters, D as FederationOrigin, E as FederationKvPrefixes, F as createFederationBuilder, G as MessageQueue, H as respondWithObjectIfAcceptable, I as Router, J as ParallelMessageQueue, K as MessageQueueEnqueueOptions, L as RouterError, M as RetryPolicy, N as createExponentialBackoffPolicy, O as FederationQueueOptions, P as Message, Q as ActorKeyPairsDispatcher, R as RouterOptions, S as IdempotencyStrategy, T as Rfc6570Expression, U as InProcessMessageQueue, V as respondWithObject, W as InProcessMessageQueueOptions, X as ActorDispatcher, Y as ActorAliasMapper, Z as ActorHandleMapper, _ as FederationBuilder, _t as PageItems, a as InboxContext, at as CustomCollectionDispatcher, b as FederationStartQueueOptions, c as RouteActivityOptions, ct as NodeInfoDispatcher, d as ActorCallbackSetters, dt as OutboxErrorHandler, et as CollectionCounter, f as CollectionCallbackSetters, ft as OutboxPermanentFailureHandler, g as Federation, gt as SenderKeyPair, h as Federatable, ht as SendActivityError, i as GetSignedKeyOptions, it as CustomCollectionCursor, j as RetryContext, k as createFederation, l as SendActivityOptions, lt as ObjectAuthorizePredicate, m as CustomCollectionCallbackSetters, mt as WebFingerLinksDispatcher, n as Context, nt as CollectionDispatcher, o as ParseUriResult, ot as InboxErrorHandler, p as ConstructorWithTypeId, pt as SharedInboxKeyDispatcher, q as MessageQueueListenOptions, r as ForwardActivityOptions, rt as CustomCollectionCounter, s as RequestContext, st as InboxListener, t as ActorKeyPair, tt as CollectionCursor, u as SendActivityOptionsForCollection, ut as ObjectDispatcher, v as FederationFetchOptions, vt as buildCollectionSynchronizationHeader, w as ObjectCallbackSetters, x as IdempotencyKeyCallback, y as FederationOptions, yt as digest, z as RouterRouteResult } from "../context-lxjaUTAI.js";
+import { $ as AuthorizePredicate, A as CreateExponentialBackoffPolicyOptions, B as RespondWithObjectOptions, C as InboxListenerSetters, D as FederationOrigin, E as FederationKvPrefixes, F as createFederationBuilder, G as MessageQueue, H as respondWithObjectIfAcceptable, I as Router, J as ParallelMessageQueue, K as MessageQueueEnqueueOptions, L as RouterError, M as RetryPolicy, N as createExponentialBackoffPolicy, O as FederationQueueOptions, P as Message, Q as ActorKeyPairsDispatcher, R as RouterOptions, S as IdempotencyStrategy, T as Rfc6570Expression, U as InProcessMessageQueue, V as respondWithObject, W as InProcessMessageQueueOptions, X as ActorDispatcher, Y as ActorAliasMapper, Z as ActorHandleMapper, _ as FederationBuilder, _t as PageItems, a as InboxContext, at as CustomCollectionDispatcher, b as FederationStartQueueOptions, c as RouteActivityOptions, ct as NodeInfoDispatcher, d as ActorCallbackSetters, dt as OutboxErrorHandler, et as CollectionCounter, f as CollectionCallbackSetters, ft as OutboxPermanentFailureHandler, g as Federation, gt as SenderKeyPair, h as Federatable, ht as SendActivityError, i as GetSignedKeyOptions, it as CustomCollectionCursor, j as RetryContext, k as createFederation, l as SendActivityOptions, lt as ObjectAuthorizePredicate, m as CustomCollectionCallbackSetters, mt as WebFingerLinksDispatcher, n as Context, nt as CollectionDispatcher, o as ParseUriResult, ot as InboxErrorHandler, p as ConstructorWithTypeId, pt as SharedInboxKeyDispatcher, q as MessageQueueListenOptions, r as ForwardActivityOptions, rt as CustomCollectionCounter, s as RequestContext, st as InboxListener, t as ActorKeyPair, tt as CollectionCursor, u as SendActivityOptionsForCollection, ut as ObjectDispatcher, v as FederationFetchOptions, vt as buildCollectionSynchronizationHeader, w as ObjectCallbackSetters, x as IdempotencyKeyCallback, y as FederationOptions, yt as digest, z as RouterRouteResult } from "../context-C00pWP8x.js";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "../kv-CxaI4eGo.js";
-import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-I-34OMN3.js";
+import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-DtRh015i.js";
 export { ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, Federatable, Federation, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, ForwardActivityOptions, GetSignedKeyOptions, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MemoryKvStore, Message, MessageQueue, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfoDispatcher, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboxErrorHandler, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseUriResult, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, SharedInboxKeyDispatcher, WebFingerHandlerParameters, WebFingerLinksDispatcher, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, digest, handleWebFinger, respondWithObject, respondWithObjectIfAcceptable };

package/dist/federation/mod.js

@@ -1,6 +1,6 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { a as createExponentialBackoffPolicy, c as buildCollectionSynchronizationHeader, d as Router, f as RouterError, i as SendActivityError, l as digest, o as respondWithObject, r as handleWebFinger, s as respondWithObjectIfAcceptable, t as createFederation, u as createFederationBuilder } from "../middleware-CQRCnFB4.js";
+import { a as createExponentialBackoffPolicy, c as buildCollectionSynchronizationHeader, d as Router, f as RouterError, i as SendActivityError, l as digest, o as respondWithObject, r as handleWebFinger, s as respondWithObjectIfAcceptable, t as createFederation, u as createFederationBuilder } from "../middleware-CEufJR5k.js";
 import { isEqual } from "es-toolkit";
 //#region src/federation/kv.ts
 /**

package/dist/federation/send.test.mjs

@@ -8,10 +8,10 @@ import { r as assertFalse } from "../assert_throws-D4DNWrux.mjs";
 import { n as assertInstanceOf, t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertNotEquals } from "../assert_not_equals-BkxW5QJI.mjs";
 import { t as assertRejects } from "../assert_rejects-WyYSTDDX.mjs";
-import { u as verifyRequest } from "../http-DGD9d8-A.mjs";
+import { u as verifyRequest } from "../http-BWoAqky4.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CCxRJhWa.mjs";
-import { t as doesActorOwnKey } from "../owner-BI33UeIv.mjs";
-import { i as sendActivity, n as extractInboxes, r as fetchWithValidatedRedirects, t as SendActivityError } from "../send-nImUK91D.mjs";
+import { t as doesActorOwnKey } from "../owner-BJeJfxnT.mjs";
+import { i as sendActivity, n as extractInboxes, r as fetchWithValidatedRedirects, t as SendActivityError } from "../send-CYrAOC1K.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { Activity, Application, Endpoints, Group, Person, Service } from "@fedify/vocab";
 import { FetchError, UrlError } from "@fedify/vocab-runtime";

package/dist/federation/temporal.test.mjs

@@ -4,7 +4,7 @@ globalThis.addEventListener = () => {};
 import "../std__assert-DflMZha5.mjs";
 import { r as assertFalse } from "../assert_throws-D4DNWrux.mjs";
 import { t as assert } from "../assert-BhQd8QHP.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "../temporal-CfNFB7M_.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "../temporal-BJoGKOXy.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/temporal.test.ts
 test("hasMalformedKnownTemporalLiteral() detects expanded proof timestamps", async () => {

package/dist/federation/webfinger.test.mjs

@@ -5,7 +5,7 @@ import { n as createRequestContext } from "../context-Juj6bdHC.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import "../std__assert-DflMZha5.mjs";
 import { t as MemoryKvStore } from "../kv-mI4Ix2EU.mjs";
-import { a as createFederation, o as handleWebFinger } from "../middleware-DDM0j-X6.mjs";
+import { a as createFederation, o as handleWebFinger } from "../middleware-C849kmHB.mjs";
 import { test } from "@fedify/fixture";
 import { Image, Link, Person } from "@fedify/vocab";
 //#region src/federation/webfinger.test.ts

package/dist/{http-DGD9d8-A.mjs → http-BWoAqky4.mjs}

@@ -1,8 +1,8 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-D_rTMbAD.mjs";
-import { o as validateCryptoKey, r as fetchKey } from "./key-1Gf85RN1.mjs";
+import { n as version, t as name } from "./deno-Dv6PIwH_.mjs";
+import { o as validateCryptoKey, r as fetchKey } from "./key-ChKDZfvS.mjs";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";

package/dist/{http-BS1CmlZ6.js → http-CrEB4I8A.js}

@@ -10,7 +10,7 @@ import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 import { Item, decodeDict, encodeItem } from "structured-field-values";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.0.36-dev.2551+8b012df4";
+var version = "2.0.36-dev.2637+cc2cd6fb";
 //#endregion
 //#region src/sig/key.ts
 /** Classifies decoding failures without hiding unexpected loader errors. */

package/dist/{http-DbDnj-Q7.cjs → http-D69BMfAn.cjs}

@@ -11,7 +11,7 @@ let byte_encodings_base64 = require("byte-encodings/base64");
 let structured_field_values = require("structured-field-values");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.0.36-dev.2551+8b012df4";
+var version = "2.0.36-dev.2637+cc2cd6fb";
 //#endregion
 //#region src/sig/key.ts
 /** Classifies decoding failures without hiding unexpected loader errors. */

package/dist/{inbox-BwpBTbhH.mjs → inbox-0Dbv0QVc.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-D_rTMbAD.mjs";
+import { n as version, t as name } from "./deno-Dv6PIwH_.mjs";
 import { Activity, getTypeId } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
 import { getLogger } from "@logtape/logtape";

package/dist/{key-1Gf85RN1.mjs → key-ChKDZfvS.mjs}

@@ -1,7 +1,7 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-D_rTMbAD.mjs";
+import { n as version, t as name } from "./deno-Dv6PIwH_.mjs";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError, UrlError, getDocumentLoader } from "@fedify/vocab-runtime";

package/dist/{kv-cache-BdA7HpfF.cjs → kv-cache-B0JZ30EF.cjs}

@@ -1,7 +1,7 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 require("./chunk-DDcVe30Y.cjs");
-const require_http = require("./http-DbDnj-Q7.cjs");
+const require_http = require("./http-D69BMfAn.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let es_toolkit = require("es-toolkit");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");

package/dist/{kv-cache-BARiicPE.js → kv-cache-CDvE8__9.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { l as validateCryptoKey, t as doubleKnockScoped } from "./http-BS1CmlZ6.js";
+import { l as validateCryptoKey, t as doubleKnockScoped } from "./http-CrEB4I8A.js";
 import { getLogger } from "@logtape/logtape";
 import { curry } from "es-toolkit";
 import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts } from "@fedify/vocab-runtime";

package/dist/{ld-BuuOR_Ms.mjs → ld-DbSNiv8Q.mjs}

@@ -1,11 +1,11 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-D_rTMbAD.mjs";
-import { o as validateCryptoKey, r as fetchKey } from "./key-1Gf85RN1.mjs";
+import { n as version, t as name } from "./deno-Dv6PIwH_.mjs";
+import { o as validateCryptoKey, r as fetchKey } from "./key-ChKDZfvS.mjs";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
-import { getDocumentLoader } from "@fedify/vocab-runtime";
+import { getDocumentLoader, preloadedContexts } from "@fedify/vocab-runtime";
 import { getLogger } from "@logtape/logtape";
 import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 import { encodeHex } from "byte-encodings/hex";
@@ -298,24 +298,110 @@ function assertSafeJsonLd(jsonLd) {
 		}
 	}
 }
+const signatureTermDefinition = { "signature": "https://w3id.org/security#signature" };
+const signatureDefiningContexts = new Set(["https://w3id.org/identity/v1", "https://w3id.org/security/v1"]);
+const signatureFreeContexts = getSignatureFreeContexts();
+function getSignatureFreeContexts() {
+	const urls = /* @__PURE__ */ new Set();
+	for (const [url, document] of globalThis.Object.entries(preloadedContexts)) {
+		if (typeof document !== "object" || document == null) continue;
+		const context = document["@context"];
+		if (typeof context !== "object" || context == null || Array.isArray(context)) continue;
+		const record = context;
+		if (!globalThis.Object.prototype.hasOwnProperty.call(record, "signature")) urls.add(url);
+	}
+	return urls;
+}
+function getContextEntryEffect(entry) {
+	if (entry == null) return "resets";
+	if (typeof entry === "string") {
+		if (signatureDefiningContexts.has(entry)) return "defines";
+		if (signatureFreeContexts.has(entry)) return "absent";
+		return "unknown";
+	}
+	if (typeof entry !== "object") return "absent";
+	const record = entry;
+	if (globalThis.Object.prototype.hasOwnProperty.call(record, "signature")) {
+		const definition = record["signature"];
+		const contextProtected = record["@protected"] === true;
+		const imported = globalThis.Object.prototype.hasOwnProperty.call(record, "@import");
+		if (definition == null) {
+			if (contextProtected) return "defines";
+			return imported ? "unknown" : "resets";
+		}
+		if (typeof definition === "object" && !Array.isArray(definition)) {
+			const term = definition;
+			const protectedTerm = contextProtected || term["@protected"] === true;
+			if (globalThis.Object.prototype.hasOwnProperty.call(term, "@id") && term["@id"] == null) {
+				if (protectedTerm) return "defines";
+				return imported ? "unknown" : "resets";
+			}
+		}
+		return "defines";
+	}
+	if (globalThis.Object.prototype.hasOwnProperty.call(record, "@import")) return "unknown";
+	return "absent";
+}
+function getSignatureTermState(context) {
+	if (context == null) return "absent";
+	if (!Array.isArray(context)) {
+		const effect = getContextEntryEffect(context);
+		return effect === "defines" ? "defined" : effect === "unknown" ? "unknown" : "absent";
+	}
+	let state = "absent";
+	for (const entry of context) {
+		const effect = getContextEntryEffect(entry);
+		if (effect === "defines") state = "defined";
+		else if (effect === "resets") state = "absent";
+		else if (effect === "unknown" && state !== "defined") state = "unknown";
+	}
+	return state;
+}
+function prepareSignatureDocument(jsonLd) {
+	if (typeof jsonLd !== "object" || jsonLd == null || Array.isArray(jsonLd)) return jsonLd;
+	const document = jsonLd;
+	if (document["proof"] != null) return { ...document };
+	const context = document["@context"];
+	if (getSignatureTermState(context) !== "absent") return { ...document };
+	const definition = { ...signatureTermDefinition };
+	return {
+		...document,
+		"@context": context == null ? [definition] : Array.isArray(context) ? [...context, definition] : [context, definition]
+	};
+}
 /**
 * Attaches a LD signature to the given JSON-LD document.
+*
+* When the document's context does not already define the `signature`
+* property, the returned document adds a minimal inline context for it.
+* Without that definition, expanding the attached signature would produce a
+* blank node predicate, which is not valid RDF.  Documents that already carry
+* a `proof` are left unchanged, since a new context definition would invalidate
+* the proof.  Documents whose context includes an unrecognized remote context
+* are also left unchanged, since that context may already define `signature`.
 * @param jsonLd The JSON-LD document to attach the signature to.  It is not
 *               modified.
 * @param signature The signature to attach.
 * @returns The JSON-LD document with the attached signature.
 * @throws {TypeError} If the input document is not a valid JSON-LD document.
+*                    Top-level arrays are rejected, since a Linked Data
+*                    Signature is attached to a single node.
 * @since 1.0.0
 */
 function attachSignature(jsonLd, signature) {
-	if (typeof jsonLd !== "object" || jsonLd == null) throw new TypeError("Failed to attach signature; invalid JSON-LD document.");
-	return {
-		...jsonLd,
-		signature
-	};
+	if (typeof jsonLd !== "object" || jsonLd == null || Array.isArray(jsonLd)) throw new TypeError("Failed to attach signature; invalid JSON-LD document.");
+	const output = prepareSignatureDocument(jsonLd);
+	output.signature = signature;
+	return output;
 }
 /**
 * Creates a LD signature for the given JSON-LD document.
+*
+* If the document's context does not define the `signature` property, the
+* signature is computed over the document with a minimal inline definition
+* added.  Use {@link attachSignature} to attach the signature to that exact
+* document.  Documents that already carry a `proof`, or whose context includes
+* an unrecognized remote context, are hashed unchanged.
 * @param jsonLd The JSON-LD document to sign.
 * @param privateKey The private key to sign the document.
 * @param keyId The ID of the public key that corresponds to the private key.
@@ -329,14 +415,17 @@ async function createSignature(jsonLd, privateKey, keyId, { contextLoader, creat
 	validateCryptoKey(privateKey, "private");
 	if (privateKey.algorithm.name !== "RSASSA-PKCS1-v1_5") throw new TypeError("Unsupported algorithm: " + privateKey.algorithm.name);
 	const options = {
-		"@context": "https://w3id.org/identity/v1",
 		creator: keyId.href,
 		created: created?.toString() ?? (/* @__PURE__ */ new Date()).toISOString()
 	};
-	const message = await hashJsonLd(options, contextLoader) + await hashJsonLd(jsonLd, contextLoader);
+	const message = await hashJsonLd({
+		"@context": "https://w3id.org/identity/v1",
+		...options
+	}, contextLoader) + await hashJsonLd(prepareSignatureDocument(jsonLd), contextLoader);
 	const messageBytes = new TextEncoder().encode(message);
 	const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", privateKey, messageBytes);
 	return {
+		"@context": "https://w3id.org/security/v1",
 		...options,
 		type: "RsaSignature2017",
 		signatureValue: encodeBase64(signature)

package/dist/{middleware-C5Nypx4Z.mjs → middleware-BA9cM-vz.mjs}

@@ -1,5 +1,5 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-DDM0j-X6.mjs";
+import { n as FederationImpl } from "./middleware-C849kmHB.mjs";
 export { FederationImpl };

package/dist/{middleware-DDM0j-X6.mjs → middleware-C849kmHB.mjs}

@@ -2,24 +2,24 @@ import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as RouterError } from "./router-CrMLXoOr.mjs";
-import { n as version, t as name } from "./deno-D_rTMbAD.mjs";
-import { a as importJwk, o as validateCryptoKey, t as exportJwk } from "./key-1Gf85RN1.mjs";
-import { u as verifyRequest } from "./http-DGD9d8-A.mjs";
-import { n as getAuthenticatedDocumentLoader } from "./docloader-DpTrZ5sA.mjs";
+import { n as version, t as name } from "./deno-Dv6PIwH_.mjs";
+import { a as importJwk, o as validateCryptoKey, t as exportJwk } from "./key-ChKDZfvS.mjs";
+import { u as verifyRequest } from "./http-BWoAqky4.mjs";
+import { n as getAuthenticatedDocumentLoader } from "./docloader-BgHM-JLc.mjs";
 import { n as kvCache } from "./kv-cache-BrjuJue8.mjs";
-import { a as compactJsonLd, c as getNormalizationContextLoader, d as isInvalidUrlTypeError, f as signJsonLd, g as wrapContextLoaderForJsonLd, l as hasSignature, p as verifyCompactJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as isClearlyMalformedContextReference } from "./ld-BuuOR_Ms.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-BI33UeIv.mjs";
-import { n as signObject, r as verifyObject } from "./proof-GM73LJjx.mjs";
+import { a as compactJsonLd, c as getNormalizationContextLoader, d as isInvalidUrlTypeError, f as signJsonLd, g as wrapContextLoaderForJsonLd, l as hasSignature, p as verifyCompactJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as isClearlyMalformedContextReference } from "./ld-DbSNiv8Q.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-BJeJfxnT.mjs";
+import { n as signObject, r as verifyObject } from "./proof-CaMBdk_x.mjs";
 import { d as MAX_BODY_SIZE, f as readBoundedText, t as getNodeInfo, u as BodyTooLargeError } from "./client-DGNacEx_.mjs";
 import { t as nodeInfoToJson } from "./types-MNlFfxjv.mjs";
-import { n as actorsHaveSameOrigin, r as routeActivity } from "./inbox-BwpBTbhH.mjs";
-import { t as FederationBuilderImpl } from "./builder-Dndt590h.mjs";
+import { n as actorsHaveSameOrigin, r as routeActivity } from "./inbox-0Dbv0QVc.mjs";
+import { t as FederationBuilderImpl } from "./builder-BC3eRIbe.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-DI6YzYpd.mjs";
 import { t as KvKeyCache } from "./keycache-DBD6fzl1.mjs";
 import { t as acceptsJsonLd } from "./negotiation-TWEs6Cl8.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-CfNFB7M_.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-BJoGKOXy.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-Ddbq3AcK.mjs";
-import { i as sendActivity, n as extractInboxes, t as SendActivityError } from "./send-nImUK91D.mjs";
+import { i as sendActivity, n as extractInboxes, t as SendActivityError } from "./send-CYrAOC1K.mjs";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
 import { lookupWebFinger } from "@fedify/webfinger";
 import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
@@ -1532,6 +1532,23 @@ var FederationImpl = class extends FederationBuilderImpl {
 	_getTracer() {
 		return this.tracerProvider.getTracer(name, version);
 	}
+	/**
+	* Starts listening on a queue, converting a synchronous throw into
+	* a rejected promise.
+	*
+	* `MessageQueue.listen()` is documented to never reject, but some
+	* implementations (e.g., `WorkersMessageQueue`) throw synchronously.  Without
+	* this normalization, one such throw aborts {@link _startQueueInternal} while
+	* it is still collecting listener promises, so listeners started earlier are
+	* never awaited and later queues are never started.
+	*/
+	#listenQueue(queue, ctxData, signal) {
+		try {
+			return queue.listen((msg) => this.processQueuedTask(ctxData, msg), { signal });
+		} catch (error) {
+			return Promise.reject(error);
+		}
+	}
 	async _startQueueInternal(ctxData, signal, queue) {
 		if (this.inboxQueue == null && this.outboxQueue == null) return;
 		const logger = getLogger([
@@ -1543,20 +1560,38 @@ var FederationImpl = class extends FederationBuilderImpl {
 		if (this.inboxQueue != null && (queue == null || queue === "inbox") && !this.inboxQueueStarted) {
 			logger.debug("Starting an inbox task worker.");
 			this.inboxQueueStarted = true;
-			promises.push(this.inboxQueue.listen((msg) => this.processQueuedTask(ctxData, msg), { signal }));
+			promises.push(this.#listenQueue(this.inboxQueue, ctxData, signal));
 		}
 		if (this.outboxQueue != null && this.outboxQueue !== this.inboxQueue && (queue == null || queue === "outbox") && !this.outboxQueueStarted) {
 			logger.debug("Starting an outbox task worker.");
 			this.outboxQueueStarted = true;
-			promises.push(this.outboxQueue.listen((msg) => this.processQueuedTask(ctxData, msg), { signal }));
+			promises.push(this.#listenQueue(this.outboxQueue, ctxData, signal));
 		}
 		if (this.fanoutQueue != null && this.fanoutQueue !== this.inboxQueue && this.fanoutQueue !== this.outboxQueue && (queue == null || queue === "fanout") && !this.fanoutQueueStarted) {
 			logger.debug("Starting a fanout task worker.");
 			this.fanoutQueueStarted = true;
-			promises.push(this.fanoutQueue.listen((msg) => this.processQueuedTask(ctxData, msg), { signal }));
+			promises.push(this.#listenQueue(this.fanoutQueue, ctxData, signal));
 		}
 		await Promise.all(promises);
 	}
+	/**
+	* Starts the queue workers automatically, reporting a failure instead of
+	* leaving the returned promise unobserved.
+	*
+	* Automatic startup is best-effort: call sites cannot await it, so a failing
+	* listener (e.g., `WorkersMessageQueue`, whose `listen()` throws) must not
+	* become an unhandled rejection.  {@link startQueue} keeps rejecting for
+	* callers that start workers deliberately.
+	*/
+	_startQueueAutomatically(ctxData) {
+		this._startQueueInternal(ctxData).catch((error) => {
+			getLogger([
+				"fedify",
+				"federation",
+				"queue"
+			]).warn("Failed to start queue workers automatically: {error}", { error });
+		});
+	}
 	processQueuedTask(contextData, message) {
 		const tracer = this._getTracer();
 		const extractedContext = propagation.extract(context.active(), message.traceContext);
@@ -1665,7 +1700,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 		await this.sendActivity(keys, message.inboxes, activity, {
 			collectionSync: message.collectionSync,
 			orderingKey: message.orderingKey,
-			context
+			context,
+			activityJsonLd: hasTopLevelProof(message.activity) ? message.activity : void 0
 		});
 	}
 	async #listenOutboxMessage(_, message, span) {
@@ -2072,7 +2108,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				proofCreated = true;
 			}
 		}
-		let jsonLd = await activity.toJsonLd({
+		let jsonLd = options.activityJsonLd != null ? detachSignature(options.activityJsonLd) : await activity.toJsonLd({
 			format: "compact",
 			contextLoader
 		});
@@ -2139,7 +2175,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				privateKey: privateKeyJwk
 			});
 		}
-		if (!this.manuallyStartQueue) this._startQueueInternal(ctx.data);
+		if (!this.manuallyStartQueue) this._startQueueAutomatically(ctx.data);
 		const carrier = {};
 		propagation.inject(context.active(), carrier);
 		const messages = [];
@@ -2351,7 +2387,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 					const identity = await this.sharedInboxKeyDispatcher(context);
 					if (identity != null) context = this.#createContext(request, contextData, { documentLoader: "identifier" in identity || "username" in identity ? await context.getDocumentLoader(identity) : context.getDocumentLoader(identity) });
 				}
-				if (!this.manuallyStartQueue) this._startQueueInternal(contextData);
+				if (!this.manuallyStartQueue) this._startQueueAutomatically(contextData);
 				const inboxContextFactory = context.toInboxContext.bind(context);
 				inboxContextFactory[rawInboxContextFactorySymbol] = context.toInboxContext.bind(context);
 				return await handleInbox(request, {
@@ -2789,7 +2825,17 @@ var ContextImpl = class ContextImpl {
 			allowPrivateAddress: this.federation.allowPrivateAddress
 		});
 	}
-	sendActivity(sender, recipients, activity, options = {}) {
+	async sendActivity(sender, recipients, activity, options = {}) {
+		let activityJsonLd = void 0;
+		let hasProof = activity.proofIds.length > 0;
+		if (!hasProof) for await (const _ of activity.getProofs({ contextLoader: this.contextLoader })) {
+			hasProof = true;
+			break;
+		}
+		if (hasProof) {
+			activityJsonLd = await activity.toJsonLd({ contextLoader: this.contextLoader });
+			if (!hasTopLevelProof(activityJsonLd)) activityJsonLd = void 0;
+		}
 		return this.tracerProvider.getTracer(name, version).startActiveSpan(this.federation.outboxQueue == null || options.immediate ? "activitypub.outbox" : "activitypub.fanout", {
 			kind: this.federation.outboxQueue == null || options.immediate ? SpanKind.CLIENT : SpanKind.PRODUCER,
 			attributes: {
@@ -2802,7 +2848,7 @@ var ContextImpl = class ContextImpl {
 		}, async (span) => {
 			try {
 				if (activity.id != null) span.setAttribute("activitypub.activity.id", activity.id.href);
-				await this.sendActivityInternal(sender, recipients, activity, options, span);
+				await this.sendActivityInternal(sender, recipients, activity, options, span, activityJsonLd);
 			} catch (e) {
 				span.setStatus({
 					code: SpanStatusCode.ERROR,
@@ -2814,7 +2860,7 @@ var ContextImpl = class ContextImpl {
 			}
 		});
 	}
-	async sendActivityInternal(sender, recipients, activity, options, span) {
+	async sendActivityInternal(sender, recipients, activity, options, span, activityJsonLd) {
 		const logger = getLogger([
 			"fedify",
 			"federation",
@@ -2861,14 +2907,23 @@ var ContextImpl = class ContextImpl {
 				if (!(error instanceof RouterError)) throw error;
 			}
 		} else expandedRecipients = [recipients];
-		const opts = {
-			context: this,
-			orderingKey: options.orderingKey,
-			collectionSync,
-			immediate: options.immediate
-		};
 		span.setAttribute("activitypub.inboxes", expandedRecipients.length);
 		for (const activityTransformer of this.federation.activityTransformers) activity = activityTransformer(activity, this);
+		let contextMatches = false;
+		if (activityJsonLd != null) {
+			const capturedJsonLd = activityJsonLd;
+			const transformedJsonLd = await activity.toJsonLd({
+				format: "compact",
+				contextLoader: this.contextLoader
+			});
+			const contentChanged = getContentFields(transformedJsonLd) !== getContentFields(capturedJsonLd);
+			contextMatches = getContextFields(transformedJsonLd) === getContextFields(capturedJsonLd);
+			const proofsChanged = getProofFields(transformedJsonLd) !== getProofFields(capturedJsonLd);
+			if (contentChanged || !contextMatches && proofsChanged) {
+				activity = activity.clone({ proofs: await getUncapturedProofs(activity, capturedJsonLd, this.contextLoader) });
+				activityJsonLd = void 0;
+			} else if (proofsChanged) activityJsonLd = void 0;
+		}
 		span?.setAttribute("activitypub.activity.id", activity?.id?.href ?? "");
 		if (activity.actorId == null) {
 			logger.error("Activity {activityId} to send does not have an actor.", {
@@ -2879,14 +2934,27 @@ var ContextImpl = class ContextImpl {
 		}
 		if (actorKeyPairs != null) {
 			const contextLoader = this.contextLoader;
+			if (actorKeyPairs.some((kp) => kp.privateKey.algorithm.name === "Ed25519" && kp.multikey.id != null)) {
+				if (activityJsonLd != null && !contextMatches) activity = activity.clone({ proofs: [] });
+			}
+			let proofAdded = false;
 			for (const kp of actorKeyPairs) {
 				if (kp.privateKey.algorithm.name !== "Ed25519" || kp.multikey.id == null) continue;
 				activity = await signObject(activity, kp.privateKey, kp.multikey.id, {
 					contextLoader,
 					tracerProvider: this.tracerProvider
 				});
+				proofAdded = true;
 			}
+			if (proofAdded) activityJsonLd = void 0;
 		}
+		const opts = {
+			context: this,
+			orderingKey: options.orderingKey,
+			collectionSync,
+			immediate: options.immediate,
+			activityJsonLd
+		};
 		const inboxes = extractInboxes({
 			recipients: expandedRecipients,
 			preferSharedInbox: options.preferSharedInbox,
@@ -2916,7 +2984,7 @@ var ContextImpl = class ContextImpl {
 				actorIds: [...actorIds],
 				sharedInbox
 			}])),
-			activity: await activity.toJsonLd({
+			activity: activityJsonLd != null ? detachSignature(activityJsonLd) : await activity.toJsonLd({
 				format: "compact",
 				contextLoader: this.contextLoader
 			}),
@@ -2926,7 +2994,7 @@ var ContextImpl = class ContextImpl {
 			orderingKey: options.orderingKey,
 			traceContext: carrier
 		};
-		if (!this.federation.manuallyStartQueue) this.federation._startQueueInternal(this.data);
+		if (!this.federation.manuallyStartQueue) this.federation._startQueueAutomatically(this.data);
 		await this.federation.fanoutQueue.enqueue(message, { orderingKey: options.orderingKey });
 	}
 	async *getFollowers(identifier) {
@@ -3402,6 +3470,69 @@ var KvSpecDeterminer = class {
 function notFound(_request) {
 	return new Response("Not Found", { status: 404 });
 }
+function hasTopLevelProof(value) {
+	return typeof value === "object" && value != null && !Array.isArray(value) && globalThis.Object.prototype.hasOwnProperty.call(value, "proof");
+}
+function getContentFields(value) {
+	if (typeof value !== "object" || value == null || Array.isArray(value)) return JSON.stringify(sortJsonKeys(value));
+	const record = { ...value };
+	delete record["@context"];
+	delete record.proof;
+	delete record.signature;
+	return JSON.stringify(sortJsonKeys(record));
+}
+function getContextFields(value) {
+	if (typeof value !== "object" || value == null || Array.isArray(value)) return JSON.stringify(sortJsonKeys(value));
+	const context = value["@context"];
+	return JSON.stringify(sortJsonKeys(context ?? null));
+}
+function getProofEntries(value) {
+	if (typeof value !== "object" || value == null || Array.isArray(value)) return [];
+	const proof = value.proof;
+	if (proof == null) return [];
+	return Array.isArray(proof) ? proof : [proof];
+}
+function normalizeProofEntry(proof) {
+	const stripped = stripContexts(proof);
+	if (typeof stripped !== "object" || stripped == null || Array.isArray(stripped)) return stripped;
+	const record = { ...stripped };
+	if (typeof record.created === "string") try {
+		record.created = Temporal.Instant.from(record.created).toString();
+	} catch {}
+	return record;
+}
+function getProofEntryFields(proof) {
+	return JSON.stringify(sortJsonKeys(normalizeProofEntry(proof)));
+}
+function getProofFields(value) {
+	return JSON.stringify(getProofEntries(value).map(getProofEntryFields).sort());
+}
+async function getUncapturedProofs(activity, capturedJsonLd, contextLoader) {
+	const capturedProofs = new Set(getProofEntries(capturedJsonLd).map(getProofEntryFields));
+	const retainedProofs = [];
+	for await (const proof of activity.getProofs({ contextLoader })) {
+		const proofJsonLd = await proof.toJsonLd({
+			format: "compact",
+			contextLoader
+		});
+		if (!capturedProofs.has(getProofEntryFields(proofJsonLd))) retainedProofs.push(proof);
+	}
+	return retainedProofs;
+}
+function stripContexts(value) {
+	if (Array.isArray(value)) return value.map(stripContexts);
+	if (typeof value !== "object" || value == null) return value;
+	const record = { ...value };
+	delete record["@context"];
+	delete record.signature;
+	for (const key of globalThis.Object.keys(record)) record[key] = stripContexts(record[key]);
+	return record;
+}
+function sortJsonKeys(value) {
+	if (Array.isArray(value)) return value.map(sortJsonKeys);
+	if (typeof value !== "object" || value == null) return value;
+	return globalThis.Object.fromEntries(globalThis.Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, item]) => [key, sortJsonKeys(item)]));
+}
 function notAcceptable(_request) {
 	return new Response("Not Acceptable", {
 		status: 406,