@fedify/fedify 2.0.36-dev.2551 → 2.0.36-dev.2637

package/dist/{middleware-CQRCnFB4.js → middleware-CEufJR5k.js}

@@ -2,10 +2,10 @@ import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./chunk-CRNNMoPX.js";
 import { r as getDefaultActivityTransformers } from "./transformers-BGMIq1cs.js";
-import { c as importJwk, d as name, f as version, i as exportJwk, l as validateCryptoKey, r as verifyRequest, t as doubleKnockScoped } from "./http-BS1CmlZ6.js";
+import { c as importJwk, d as name, f as version, i as exportJwk, l as validateCryptoKey, r as verifyRequest, t as doubleKnockScoped } from "./http-CrEB4I8A.js";
 import { a as MAX_BODY_SIZE, i as BodyTooLargeError, n as getNodeInfo, o as readBoundedText, t as nodeInfoToJson } from "./types-B1_pRFE_.js";
-import { _ as signJsonLd, a as doesActorOwnKey, c as assertSafeJsonLd, f as detachSignature, g as isInvalidUrlTypeError, h as isClearlyMalformedContextReference, m as hasSignature, n as signObject, o as getKeyOwner, p as getNormalizationContextLoader, r as verifyObject, s as InvalidContextReferenceError, u as compactJsonLd, v as verifyCompactJsonLd, x as wrapContextLoaderForJsonLd } from "./proof-BBHUW8ev.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-BARiicPE.js";
+import { _ as signJsonLd, a as doesActorOwnKey, c as assertSafeJsonLd, f as detachSignature, g as isInvalidUrlTypeError, h as isClearlyMalformedContextReference, m as hasSignature, n as signObject, o as getKeyOwner, p as getNormalizationContextLoader, r as verifyObject, s as InvalidContextReferenceError, u as compactJsonLd, v as verifyCompactJsonLd, x as wrapContextLoaderForJsonLd } from "./proof-DwooE8kV.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-CDvE8__9.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
@@ -2869,6 +2869,23 @@ var FederationImpl = class extends FederationBuilderImpl {
 	_getTracer() {
 		return this.tracerProvider.getTracer(name, version);
 	}
+	/**
+	* Starts listening on a queue, converting a synchronous throw into
+	* a rejected promise.
+	*
+	* `MessageQueue.listen()` is documented to never reject, but some
+	* implementations (e.g., `WorkersMessageQueue`) throw synchronously.  Without
+	* this normalization, one such throw aborts {@link _startQueueInternal} while
+	* it is still collecting listener promises, so listeners started earlier are
+	* never awaited and later queues are never started.
+	*/
+	#listenQueue(queue, ctxData, signal) {
+		try {
+			return queue.listen((msg) => this.processQueuedTask(ctxData, msg), { signal });
+		} catch (error) {
+			return Promise.reject(error);
+		}
+	}
 	async _startQueueInternal(ctxData, signal, queue) {
 		if (this.inboxQueue == null && this.outboxQueue == null) return;
 		const logger = getLogger([
@@ -2880,20 +2897,38 @@ var FederationImpl = class extends FederationBuilderImpl {
 		if (this.inboxQueue != null && (queue == null || queue === "inbox") && !this.inboxQueueStarted) {
 			logger.debug("Starting an inbox task worker.");
 			this.inboxQueueStarted = true;
-			promises.push(this.inboxQueue.listen((msg) => this.processQueuedTask(ctxData, msg), { signal }));
+			promises.push(this.#listenQueue(this.inboxQueue, ctxData, signal));
 		}
 		if (this.outboxQueue != null && this.outboxQueue !== this.inboxQueue && (queue == null || queue === "outbox") && !this.outboxQueueStarted) {
 			logger.debug("Starting an outbox task worker.");
 			this.outboxQueueStarted = true;
-			promises.push(this.outboxQueue.listen((msg) => this.processQueuedTask(ctxData, msg), { signal }));
+			promises.push(this.#listenQueue(this.outboxQueue, ctxData, signal));
 		}
 		if (this.fanoutQueue != null && this.fanoutQueue !== this.inboxQueue && this.fanoutQueue !== this.outboxQueue && (queue == null || queue === "fanout") && !this.fanoutQueueStarted) {
 			logger.debug("Starting a fanout task worker.");
 			this.fanoutQueueStarted = true;
-			promises.push(this.fanoutQueue.listen((msg) => this.processQueuedTask(ctxData, msg), { signal }));
+			promises.push(this.#listenQueue(this.fanoutQueue, ctxData, signal));
 		}
 		await Promise.all(promises);
 	}
+	/**
+	* Starts the queue workers automatically, reporting a failure instead of
+	* leaving the returned promise unobserved.
+	*
+	* Automatic startup is best-effort: call sites cannot await it, so a failing
+	* listener (e.g., `WorkersMessageQueue`, whose `listen()` throws) must not
+	* become an unhandled rejection.  {@link startQueue} keeps rejecting for
+	* callers that start workers deliberately.
+	*/
+	_startQueueAutomatically(ctxData) {
+		this._startQueueInternal(ctxData).catch((error) => {
+			getLogger([
+				"fedify",
+				"federation",
+				"queue"
+			]).warn("Failed to start queue workers automatically: {error}", { error });
+		});
+	}
 	processQueuedTask(contextData, message) {
 		const tracer = this._getTracer();
 		const extractedContext = propagation.extract(context.active(), message.traceContext);
@@ -3002,7 +3037,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 		await this.sendActivity(keys, message.inboxes, activity, {
 			collectionSync: message.collectionSync,
 			orderingKey: message.orderingKey,
-			context
+			context,
+			activityJsonLd: hasTopLevelProof(message.activity) ? message.activity : void 0
 		});
 	}
 	async #listenOutboxMessage(_, message, span) {
@@ -3409,7 +3445,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				proofCreated = true;
 			}
 		}
-		let jsonLd = await activity.toJsonLd({
+		let jsonLd = options.activityJsonLd != null ? detachSignature(options.activityJsonLd) : await activity.toJsonLd({
 			format: "compact",
 			contextLoader
 		});
@@ -3476,7 +3512,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				privateKey: privateKeyJwk
 			});
 		}
-		if (!this.manuallyStartQueue) this._startQueueInternal(ctx.data);
+		if (!this.manuallyStartQueue) this._startQueueAutomatically(ctx.data);
 		const carrier = {};
 		propagation.inject(context.active(), carrier);
 		const messages = [];
@@ -3688,7 +3724,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 					const identity = await this.sharedInboxKeyDispatcher(context);
 					if (identity != null) context = this.#createContext(request, contextData, { documentLoader: "identifier" in identity || "username" in identity ? await context.getDocumentLoader(identity) : context.getDocumentLoader(identity) });
 				}
-				if (!this.manuallyStartQueue) this._startQueueInternal(contextData);
+				if (!this.manuallyStartQueue) this._startQueueAutomatically(contextData);
 				const inboxContextFactory = context.toInboxContext.bind(context);
 				inboxContextFactory[rawInboxContextFactorySymbol] = context.toInboxContext.bind(context);
 				return await handleInbox(request, {
@@ -4126,7 +4162,17 @@ var ContextImpl = class ContextImpl {
 			allowPrivateAddress: this.federation.allowPrivateAddress
 		});
 	}
-	sendActivity(sender, recipients, activity, options = {}) {
+	async sendActivity(sender, recipients, activity, options = {}) {
+		let activityJsonLd = void 0;
+		let hasProof = activity.proofIds.length > 0;
+		if (!hasProof) for await (const _ of activity.getProofs({ contextLoader: this.contextLoader })) {
+			hasProof = true;
+			break;
+		}
+		if (hasProof) {
+			activityJsonLd = await activity.toJsonLd({ contextLoader: this.contextLoader });
+			if (!hasTopLevelProof(activityJsonLd)) activityJsonLd = void 0;
+		}
 		return this.tracerProvider.getTracer(name, version).startActiveSpan(this.federation.outboxQueue == null || options.immediate ? "activitypub.outbox" : "activitypub.fanout", {
 			kind: this.federation.outboxQueue == null || options.immediate ? SpanKind.CLIENT : SpanKind.PRODUCER,
 			attributes: {
@@ -4139,7 +4185,7 @@ var ContextImpl = class ContextImpl {
 		}, async (span) => {
 			try {
 				if (activity.id != null) span.setAttribute("activitypub.activity.id", activity.id.href);
-				await this.sendActivityInternal(sender, recipients, activity, options, span);
+				await this.sendActivityInternal(sender, recipients, activity, options, span, activityJsonLd);
 			} catch (e) {
 				span.setStatus({
 					code: SpanStatusCode.ERROR,
@@ -4151,7 +4197,7 @@ var ContextImpl = class ContextImpl {
 			}
 		});
 	}
-	async sendActivityInternal(sender, recipients, activity, options, span) {
+	async sendActivityInternal(sender, recipients, activity, options, span, activityJsonLd) {
 		const logger = getLogger([
 			"fedify",
 			"federation",
@@ -4198,14 +4244,23 @@ var ContextImpl = class ContextImpl {
 				if (!(error instanceof RouterError)) throw error;
 			}
 		} else expandedRecipients = [recipients];
-		const opts = {
-			context: this,
-			orderingKey: options.orderingKey,
-			collectionSync,
-			immediate: options.immediate
-		};
 		span.setAttribute("activitypub.inboxes", expandedRecipients.length);
 		for (const activityTransformer of this.federation.activityTransformers) activity = activityTransformer(activity, this);
+		let contextMatches = false;
+		if (activityJsonLd != null) {
+			const capturedJsonLd = activityJsonLd;
+			const transformedJsonLd = await activity.toJsonLd({
+				format: "compact",
+				contextLoader: this.contextLoader
+			});
+			const contentChanged = getContentFields(transformedJsonLd) !== getContentFields(capturedJsonLd);
+			contextMatches = getContextFields(transformedJsonLd) === getContextFields(capturedJsonLd);
+			const proofsChanged = getProofFields(transformedJsonLd) !== getProofFields(capturedJsonLd);
+			if (contentChanged || !contextMatches && proofsChanged) {
+				activity = activity.clone({ proofs: await getUncapturedProofs(activity, capturedJsonLd, this.contextLoader) });
+				activityJsonLd = void 0;
+			} else if (proofsChanged) activityJsonLd = void 0;
+		}
 		span?.setAttribute("activitypub.activity.id", activity?.id?.href ?? "");
 		if (activity.actorId == null) {
 			logger.error("Activity {activityId} to send does not have an actor.", {
@@ -4216,14 +4271,27 @@ var ContextImpl = class ContextImpl {
 		}
 		if (actorKeyPairs != null) {
 			const contextLoader = this.contextLoader;
+			if (actorKeyPairs.some((kp) => kp.privateKey.algorithm.name === "Ed25519" && kp.multikey.id != null)) {
+				if (activityJsonLd != null && !contextMatches) activity = activity.clone({ proofs: [] });
+			}
+			let proofAdded = false;
 			for (const kp of actorKeyPairs) {
 				if (kp.privateKey.algorithm.name !== "Ed25519" || kp.multikey.id == null) continue;
 				activity = await signObject(activity, kp.privateKey, kp.multikey.id, {
 					contextLoader,
 					tracerProvider: this.tracerProvider
 				});
+				proofAdded = true;
 			}
+			if (proofAdded) activityJsonLd = void 0;
 		}
+		const opts = {
+			context: this,
+			orderingKey: options.orderingKey,
+			collectionSync,
+			immediate: options.immediate,
+			activityJsonLd
+		};
 		const inboxes = extractInboxes({
 			recipients: expandedRecipients,
 			preferSharedInbox: options.preferSharedInbox,
@@ -4253,7 +4321,7 @@ var ContextImpl = class ContextImpl {
 				actorIds: [...actorIds],
 				sharedInbox
 			}])),
-			activity: await activity.toJsonLd({
+			activity: activityJsonLd != null ? detachSignature(activityJsonLd) : await activity.toJsonLd({
 				format: "compact",
 				contextLoader: this.contextLoader
 			}),
@@ -4263,7 +4331,7 @@ var ContextImpl = class ContextImpl {
 			orderingKey: options.orderingKey,
 			traceContext: carrier
 		};
-		if (!this.federation.manuallyStartQueue) this.federation._startQueueInternal(this.data);
+		if (!this.federation.manuallyStartQueue) this.federation._startQueueAutomatically(this.data);
 		await this.federation.fanoutQueue.enqueue(message, { orderingKey: options.orderingKey });
 	}
 	async *getFollowers(identifier) {
@@ -4739,6 +4807,69 @@ var KvSpecDeterminer = class {
 function notFound(_request) {
 	return new Response("Not Found", { status: 404 });
 }
+function hasTopLevelProof(value) {
+	return typeof value === "object" && value != null && !Array.isArray(value) && globalThis.Object.prototype.hasOwnProperty.call(value, "proof");
+}
+function getContentFields(value) {
+	if (typeof value !== "object" || value == null || Array.isArray(value)) return JSON.stringify(sortJsonKeys(value));
+	const record = { ...value };
+	delete record["@context"];
+	delete record.proof;
+	delete record.signature;
+	return JSON.stringify(sortJsonKeys(record));
+}
+function getContextFields(value) {
+	if (typeof value !== "object" || value == null || Array.isArray(value)) return JSON.stringify(sortJsonKeys(value));
+	const context = value["@context"];
+	return JSON.stringify(sortJsonKeys(context ?? null));
+}
+function getProofEntries(value) {
+	if (typeof value !== "object" || value == null || Array.isArray(value)) return [];
+	const proof = value.proof;
+	if (proof == null) return [];
+	return Array.isArray(proof) ? proof : [proof];
+}
+function normalizeProofEntry(proof) {
+	const stripped = stripContexts(proof);
+	if (typeof stripped !== "object" || stripped == null || Array.isArray(stripped)) return stripped;
+	const record = { ...stripped };
+	if (typeof record.created === "string") try {
+		record.created = Temporal.Instant.from(record.created).toString();
+	} catch {}
+	return record;
+}
+function getProofEntryFields(proof) {
+	return JSON.stringify(sortJsonKeys(normalizeProofEntry(proof)));
+}
+function getProofFields(value) {
+	return JSON.stringify(getProofEntries(value).map(getProofEntryFields).sort());
+}
+async function getUncapturedProofs(activity, capturedJsonLd, contextLoader) {
+	const capturedProofs = new Set(getProofEntries(capturedJsonLd).map(getProofEntryFields));
+	const retainedProofs = [];
+	for await (const proof of activity.getProofs({ contextLoader })) {
+		const proofJsonLd = await proof.toJsonLd({
+			format: "compact",
+			contextLoader
+		});
+		if (!capturedProofs.has(getProofEntryFields(proofJsonLd))) retainedProofs.push(proof);
+	}
+	return retainedProofs;
+}
+function stripContexts(value) {
+	if (Array.isArray(value)) return value.map(stripContexts);
+	if (typeof value !== "object" || value == null) return value;
+	const record = { ...value };
+	delete record["@context"];
+	delete record.signature;
+	for (const key of globalThis.Object.keys(record)) record[key] = stripContexts(record[key]);
+	return record;
+}
+function sortJsonKeys(value) {
+	if (Array.isArray(value)) return value.map(sortJsonKeys);
+	if (typeof value !== "object" || value == null) return value;
+	return globalThis.Object.fromEntries(globalThis.Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, item]) => [key, sortJsonKeys(item)]));
+}
 function notAcceptable(_request) {
 	return new Response("Not Acceptable", {
 		status: 406,

package/dist/{middleware-DThg01d8.cjs → middleware-C_fDk_dx.cjs}

@@ -2,10 +2,10 @@ const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 const require_chunk = require("./chunk-DDcVe30Y.cjs");
 const require_transformers = require("./transformers-NeAONrAq.cjs");
-const require_http = require("./http-DbDnj-Q7.cjs");
+const require_http = require("./http-D69BMfAn.cjs");
 const require_types = require("./types-DOvyymM4.cjs");
-const require_proof = require("./proof-vVwkNRv4.cjs");
-const require_kv_cache = require("./kv-cache-BdA7HpfF.cjs");
+const require_proof = require("./proof-DNgQwz9E.cjs");
+const require_kv_cache = require("./kv-cache-B0JZ30EF.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
@@ -351,7 +351,7 @@ var FederationBuilderImpl = class {
 		this.collectionTypeIds = {};
 	}
 	async build(options) {
-		const { FederationImpl } = await Promise.resolve().then(() => require("./middleware-D9TWYyT_.cjs"));
+		const { FederationImpl } = await Promise.resolve().then(() => require("./middleware-DCtCNota.cjs"));
 		const f = new FederationImpl(options);
 		const trailingSlashInsensitiveValue = f.router.trailingSlashInsensitive;
 		f.router = this.router.clone();
@@ -2863,6 +2863,23 @@ var FederationImpl = class extends FederationBuilderImpl {
 	_getTracer() {
 		return this.tracerProvider.getTracer(require_http.name, require_http.version);
 	}
+	/**
+	* Starts listening on a queue, converting a synchronous throw into
+	* a rejected promise.
+	*
+	* `MessageQueue.listen()` is documented to never reject, but some
+	* implementations (e.g., `WorkersMessageQueue`) throw synchronously.  Without
+	* this normalization, one such throw aborts {@link _startQueueInternal} while
+	* it is still collecting listener promises, so listeners started earlier are
+	* never awaited and later queues are never started.
+	*/
+	#listenQueue(queue, ctxData, signal) {
+		try {
+			return queue.listen((msg) => this.processQueuedTask(ctxData, msg), { signal });
+		} catch (error) {
+			return Promise.reject(error);
+		}
+	}
 	async _startQueueInternal(ctxData, signal, queue) {
 		if (this.inboxQueue == null && this.outboxQueue == null) return;
 		const logger = (0, _logtape_logtape.getLogger)([
@@ -2874,20 +2891,38 @@ var FederationImpl = class extends FederationBuilderImpl {
 		if (this.inboxQueue != null && (queue == null || queue === "inbox") && !this.inboxQueueStarted) {
 			logger.debug("Starting an inbox task worker.");
 			this.inboxQueueStarted = true;
-			promises.push(this.inboxQueue.listen((msg) => this.processQueuedTask(ctxData, msg), { signal }));
+			promises.push(this.#listenQueue(this.inboxQueue, ctxData, signal));
 		}
 		if (this.outboxQueue != null && this.outboxQueue !== this.inboxQueue && (queue == null || queue === "outbox") && !this.outboxQueueStarted) {
 			logger.debug("Starting an outbox task worker.");
 			this.outboxQueueStarted = true;
-			promises.push(this.outboxQueue.listen((msg) => this.processQueuedTask(ctxData, msg), { signal }));
+			promises.push(this.#listenQueue(this.outboxQueue, ctxData, signal));
 		}
 		if (this.fanoutQueue != null && this.fanoutQueue !== this.inboxQueue && this.fanoutQueue !== this.outboxQueue && (queue == null || queue === "fanout") && !this.fanoutQueueStarted) {
 			logger.debug("Starting a fanout task worker.");
 			this.fanoutQueueStarted = true;
-			promises.push(this.fanoutQueue.listen((msg) => this.processQueuedTask(ctxData, msg), { signal }));
+			promises.push(this.#listenQueue(this.fanoutQueue, ctxData, signal));
 		}
 		await Promise.all(promises);
 	}
+	/**
+	* Starts the queue workers automatically, reporting a failure instead of
+	* leaving the returned promise unobserved.
+	*
+	* Automatic startup is best-effort: call sites cannot await it, so a failing
+	* listener (e.g., `WorkersMessageQueue`, whose `listen()` throws) must not
+	* become an unhandled rejection.  {@link startQueue} keeps rejecting for
+	* callers that start workers deliberately.
+	*/
+	_startQueueAutomatically(ctxData) {
+		this._startQueueInternal(ctxData).catch((error) => {
+			(0, _logtape_logtape.getLogger)([
+				"fedify",
+				"federation",
+				"queue"
+			]).warn("Failed to start queue workers automatically: {error}", { error });
+		});
+	}
 	processQueuedTask(contextData, message) {
 		const tracer = this._getTracer();
 		const extractedContext = _opentelemetry_api.propagation.extract(_opentelemetry_api.context.active(), message.traceContext);
@@ -2996,7 +3031,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 		await this.sendActivity(keys, message.inboxes, activity, {
 			collectionSync: message.collectionSync,
 			orderingKey: message.orderingKey,
-			context
+			context,
+			activityJsonLd: hasTopLevelProof(message.activity) ? message.activity : void 0
 		});
 	}
 	async #listenOutboxMessage(_, message, span) {
@@ -3403,7 +3439,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				proofCreated = true;
 			}
 		}
-		let jsonLd = await activity.toJsonLd({
+		let jsonLd = options.activityJsonLd != null ? require_proof.detachSignature(options.activityJsonLd) : await activity.toJsonLd({
 			format: "compact",
 			contextLoader
 		});
@@ -3470,7 +3506,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				privateKey: privateKeyJwk
 			});
 		}
-		if (!this.manuallyStartQueue) this._startQueueInternal(ctx.data);
+		if (!this.manuallyStartQueue) this._startQueueAutomatically(ctx.data);
 		const carrier = {};
 		_opentelemetry_api.propagation.inject(_opentelemetry_api.context.active(), carrier);
 		const messages = [];
@@ -3682,7 +3718,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 					const identity = await this.sharedInboxKeyDispatcher(context);
 					if (identity != null) context = this.#createContext(request, contextData, { documentLoader: "identifier" in identity || "username" in identity ? await context.getDocumentLoader(identity) : context.getDocumentLoader(identity) });
 				}
-				if (!this.manuallyStartQueue) this._startQueueInternal(contextData);
+				if (!this.manuallyStartQueue) this._startQueueAutomatically(contextData);
 				const inboxContextFactory = context.toInboxContext.bind(context);
 				inboxContextFactory[rawInboxContextFactorySymbol] = context.toInboxContext.bind(context);
 				return await handleInbox(request, {
@@ -4120,7 +4156,17 @@ var ContextImpl = class ContextImpl {
 			allowPrivateAddress: this.federation.allowPrivateAddress
 		});
 	}
-	sendActivity(sender, recipients, activity, options = {}) {
+	async sendActivity(sender, recipients, activity, options = {}) {
+		let activityJsonLd = void 0;
+		let hasProof = activity.proofIds.length > 0;
+		if (!hasProof) for await (const _ of activity.getProofs({ contextLoader: this.contextLoader })) {
+			hasProof = true;
+			break;
+		}
+		if (hasProof) {
+			activityJsonLd = await activity.toJsonLd({ contextLoader: this.contextLoader });
+			if (!hasTopLevelProof(activityJsonLd)) activityJsonLd = void 0;
+		}
 		return this.tracerProvider.getTracer(require_http.name, require_http.version).startActiveSpan(this.federation.outboxQueue == null || options.immediate ? "activitypub.outbox" : "activitypub.fanout", {
 			kind: this.federation.outboxQueue == null || options.immediate ? _opentelemetry_api.SpanKind.CLIENT : _opentelemetry_api.SpanKind.PRODUCER,
 			attributes: {
@@ -4133,7 +4179,7 @@ var ContextImpl = class ContextImpl {
 		}, async (span) => {
 			try {
 				if (activity.id != null) span.setAttribute("activitypub.activity.id", activity.id.href);
-				await this.sendActivityInternal(sender, recipients, activity, options, span);
+				await this.sendActivityInternal(sender, recipients, activity, options, span, activityJsonLd);
 			} catch (e) {
 				span.setStatus({
 					code: _opentelemetry_api.SpanStatusCode.ERROR,
@@ -4145,7 +4191,7 @@ var ContextImpl = class ContextImpl {
 			}
 		});
 	}
-	async sendActivityInternal(sender, recipients, activity, options, span) {
+	async sendActivityInternal(sender, recipients, activity, options, span, activityJsonLd) {
 		const logger = (0, _logtape_logtape.getLogger)([
 			"fedify",
 			"federation",
@@ -4192,14 +4238,23 @@ var ContextImpl = class ContextImpl {
 				if (!(error instanceof RouterError)) throw error;
 			}
 		} else expandedRecipients = [recipients];
-		const opts = {
-			context: this,
-			orderingKey: options.orderingKey,
-			collectionSync,
-			immediate: options.immediate
-		};
 		span.setAttribute("activitypub.inboxes", expandedRecipients.length);
 		for (const activityTransformer of this.federation.activityTransformers) activity = activityTransformer(activity, this);
+		let contextMatches = false;
+		if (activityJsonLd != null) {
+			const capturedJsonLd = activityJsonLd;
+			const transformedJsonLd = await activity.toJsonLd({
+				format: "compact",
+				contextLoader: this.contextLoader
+			});
+			const contentChanged = getContentFields(transformedJsonLd) !== getContentFields(capturedJsonLd);
+			contextMatches = getContextFields(transformedJsonLd) === getContextFields(capturedJsonLd);
+			const proofsChanged = getProofFields(transformedJsonLd) !== getProofFields(capturedJsonLd);
+			if (contentChanged || !contextMatches && proofsChanged) {
+				activity = activity.clone({ proofs: await getUncapturedProofs(activity, capturedJsonLd, this.contextLoader) });
+				activityJsonLd = void 0;
+			} else if (proofsChanged) activityJsonLd = void 0;
+		}
 		span?.setAttribute("activitypub.activity.id", activity?.id?.href ?? "");
 		if (activity.actorId == null) {
 			logger.error("Activity {activityId} to send does not have an actor.", {
@@ -4210,14 +4265,27 @@ var ContextImpl = class ContextImpl {
 		}
 		if (actorKeyPairs != null) {
 			const contextLoader = this.contextLoader;
+			if (actorKeyPairs.some((kp) => kp.privateKey.algorithm.name === "Ed25519" && kp.multikey.id != null)) {
+				if (activityJsonLd != null && !contextMatches) activity = activity.clone({ proofs: [] });
+			}
+			let proofAdded = false;
 			for (const kp of actorKeyPairs) {
 				if (kp.privateKey.algorithm.name !== "Ed25519" || kp.multikey.id == null) continue;
 				activity = await require_proof.signObject(activity, kp.privateKey, kp.multikey.id, {
 					contextLoader,
 					tracerProvider: this.tracerProvider
 				});
+				proofAdded = true;
 			}
+			if (proofAdded) activityJsonLd = void 0;
 		}
+		const opts = {
+			context: this,
+			orderingKey: options.orderingKey,
+			collectionSync,
+			immediate: options.immediate,
+			activityJsonLd
+		};
 		const inboxes = extractInboxes({
 			recipients: expandedRecipients,
 			preferSharedInbox: options.preferSharedInbox,
@@ -4247,7 +4315,7 @@ var ContextImpl = class ContextImpl {
 				actorIds: [...actorIds],
 				sharedInbox
 			}])),
-			activity: await activity.toJsonLd({
+			activity: activityJsonLd != null ? require_proof.detachSignature(activityJsonLd) : await activity.toJsonLd({
 				format: "compact",
 				contextLoader: this.contextLoader
 			}),
@@ -4257,7 +4325,7 @@ var ContextImpl = class ContextImpl {
 			orderingKey: options.orderingKey,
 			traceContext: carrier
 		};
-		if (!this.federation.manuallyStartQueue) this.federation._startQueueInternal(this.data);
+		if (!this.federation.manuallyStartQueue) this.federation._startQueueAutomatically(this.data);
 		await this.federation.fanoutQueue.enqueue(message, { orderingKey: options.orderingKey });
 	}
 	async *getFollowers(identifier) {
@@ -4733,6 +4801,69 @@ var KvSpecDeterminer = class {
 function notFound(_request) {
 	return new Response("Not Found", { status: 404 });
 }
+function hasTopLevelProof(value) {
+	return typeof value === "object" && value != null && !Array.isArray(value) && globalThis.Object.prototype.hasOwnProperty.call(value, "proof");
+}
+function getContentFields(value) {
+	if (typeof value !== "object" || value == null || Array.isArray(value)) return JSON.stringify(sortJsonKeys(value));
+	const record = { ...value };
+	delete record["@context"];
+	delete record.proof;
+	delete record.signature;
+	return JSON.stringify(sortJsonKeys(record));
+}
+function getContextFields(value) {
+	if (typeof value !== "object" || value == null || Array.isArray(value)) return JSON.stringify(sortJsonKeys(value));
+	const context = value["@context"];
+	return JSON.stringify(sortJsonKeys(context ?? null));
+}
+function getProofEntries(value) {
+	if (typeof value !== "object" || value == null || Array.isArray(value)) return [];
+	const proof = value.proof;
+	if (proof == null) return [];
+	return Array.isArray(proof) ? proof : [proof];
+}
+function normalizeProofEntry(proof) {
+	const stripped = stripContexts(proof);
+	if (typeof stripped !== "object" || stripped == null || Array.isArray(stripped)) return stripped;
+	const record = { ...stripped };
+	if (typeof record.created === "string") try {
+		record.created = Temporal.Instant.from(record.created).toString();
+	} catch {}
+	return record;
+}
+function getProofEntryFields(proof) {
+	return JSON.stringify(sortJsonKeys(normalizeProofEntry(proof)));
+}
+function getProofFields(value) {
+	return JSON.stringify(getProofEntries(value).map(getProofEntryFields).sort());
+}
+async function getUncapturedProofs(activity, capturedJsonLd, contextLoader) {
+	const capturedProofs = new Set(getProofEntries(capturedJsonLd).map(getProofEntryFields));
+	const retainedProofs = [];
+	for await (const proof of activity.getProofs({ contextLoader })) {
+		const proofJsonLd = await proof.toJsonLd({
+			format: "compact",
+			contextLoader
+		});
+		if (!capturedProofs.has(getProofEntryFields(proofJsonLd))) retainedProofs.push(proof);
+	}
+	return retainedProofs;
+}
+function stripContexts(value) {
+	if (Array.isArray(value)) return value.map(stripContexts);
+	if (typeof value !== "object" || value == null) return value;
+	const record = { ...value };
+	delete record["@context"];
+	delete record.signature;
+	for (const key of globalThis.Object.keys(record)) record[key] = stripContexts(record[key]);
+	return record;
+}
+function sortJsonKeys(value) {
+	if (Array.isArray(value)) return value.map(sortJsonKeys);
+	if (typeof value !== "object" || value == null) return value;
+	return globalThis.Object.fromEntries(globalThis.Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, item]) => [key, sortJsonKeys(item)]));
+}
 function notAcceptable(_request) {
 	return new Response("Not Acceptable", {
 		status: 406,

package/dist/{middleware-D9TWYyT_.cjs → middleware-DCtCNota.cjs}

@@ -1,4 +1,4 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
-const require_middleware = require("./middleware-DThg01d8.cjs");
+const require_middleware = require("./middleware-C_fDk_dx.cjs");
 exports.FederationImpl = require_middleware.FederationImpl;

package/dist/{mod-w1oyHseQ.d.cts → mod-6uJWdCc0.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { X as ActorDispatcher, Y as ActorAliasMapper, Z as ActorHandleMapper, mt as WebFingerLinksDispatcher, s as RequestContext } from "./context-CnoWxuoB.cjs";
+import { X as ActorDispatcher, Y as ActorAliasMapper, Z as ActorHandleMapper, mt as WebFingerLinksDispatcher, s as RequestContext } from "./context-ao-qb3eP.cjs";
 import { Span, Tracer } from "@opentelemetry/api";
 
 //#region src/federation/webfinger.d.ts