@fedify/fedify 2.1.12 → 2.1.14

package/dist/{middleware-8P6Z15Wq.cjs → middleware-DUT--Qen.cjs}

@@ -1,4 +1,4 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
-const require_middleware = require("./middleware-DFcgN1cH.cjs");
+const require_middleware = require("./middleware-BcbU5lKS.cjs");
 exports.FederationImpl = require_middleware.FederationImpl;

package/dist/{middleware-DDsnRvFC.mjs → middleware-DmT9t0BJ.mjs}

@@ -2,24 +2,25 @@ import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as RouterError } from "./router-CrMLXoOr.mjs";
-import { n as version, t as name } from "./deno-Ddb3P7G7.mjs";
+import { n as version, t as name } from "./deno-bqnW1QlD.mjs";
 import { t as formatAcceptSignature } from "./accept-Dd__NiUL.mjs";
-import { a as importJwk, o as validateCryptoKey, t as exportJwk } from "./key-WSedbAA-.mjs";
-import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-DRDpStn2.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-CK8tewt1.mjs";
-import { n as kvCache } from "./kv-cache-B01V7s3h.mjs";
-import { a as signJsonLd, i as hasSignature, o as verifyJsonLd, r as detachSignature } from "./ld-OBpaLfHR.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-BceqCVOs.mjs";
-import { n as signObject, r as verifyObject } from "./proof-BojC8L94.mjs";
+import { a as importJwk, o as validateCryptoKey, t as exportJwk } from "./key-B3OBz6A_.mjs";
+import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-DvhFwy2E.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-D-Fu0kBF.mjs";
+import { n as kvCache } from "./kv-cache-FsT1ljhs.mjs";
+import { a as compactJsonLd, c as getNormalizationContextLoader, d as isInvalidUrlTypeError, f as signJsonLd, g as wrapContextLoaderForJsonLd, l as hasSignature, p as verifyCompactJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as isClearlyMalformedContextReference } from "./ld-DTxYKZTT.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-DzcnuWYo.mjs";
+import { n as signObject, r as verifyObject } from "./proof-DmVGi7mI.mjs";
 import { t as getNodeInfo } from "./client-DEpOVgY1.mjs";
 import { t as nodeInfoToJson } from "./types-DCP0WLdt.mjs";
-import { n as routeActivity } from "./inbox-DTuPJEma.mjs";
-import { t as FederationBuilderImpl } from "./builder-D9hlyCx5.mjs";
+import { n as routeActivity } from "./inbox-7b3VYnec.mjs";
+import { t as FederationBuilderImpl } from "./builder-BBifZZ5G.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-BD6-SZ6O.mjs";
 import { t as KvKeyCache } from "./keycache-CCSwkQcY.mjs";
 import { t as acceptsJsonLd } from "./negotiation-DnsfFF8I.mjs";
-import { t as createExponentialBackoffPolicy } from "./retry-B_E3V_Dx.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-Buz5Gy8x.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-CmJkd-25.mjs";
+import { t as createExponentialBackoffPolicy } from "./retry-CJL0poaU.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-5ulOKVCW.mjs";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
 import { lookupWebFinger } from "@fedify/webfinger";
 import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
@@ -154,6 +155,33 @@ function handleNodeInfoJrd(_request, context) {
 }
 //#endregion
 //#region src/federation/handler.ts
+const rawInboxContextFactorySymbol = Symbol("fedify.rawInboxContextFactory");
+function isRemoteContextLoadingFailure$1(error) {
+	return error instanceof Error && typeof error.details === "object" && error.details != null && error.details.code === "loading remote context failed";
+}
+function isPermanentRemoteContextError$1(error) {
+	if (!(error instanceof Error) || error.name !== "jsonld.InvalidUrl") return false;
+	const details = error.details;
+	if (details?.code === "invalid remote context") return true;
+	return isRemoteContextLoadingFailure$1(error) && typeof details?.url === "string" && !URL.canParse(details.url) && isClearlyMalformedContextReference(details.url);
+}
+function isInvalidJsonLdError(error) {
+	if (!(error instanceof Error)) return false;
+	const name = error.name;
+	return name === "UnsafeJsonLdError" || error instanceof InvalidContextReferenceError || isPermanentRemoteContextError$1(error) || name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure$1(error);
+}
+function isValidationTypeError(error) {
+	return error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:)/.test(error.message) || isInvalidUrlTypeError(error));
+}
+function isPermanentActivityParseError(error) {
+	return isInvalidJsonLdError(error) || isValidationTypeError(error);
+}
+function hasHttpSignatureHeaders(request) {
+	return request.headers.has("Signature") || request.headers.has("Signature-Input");
+}
+function hasObjectIntegrityProof(json) {
+	return typeof json === "object" && json != null && "proof" in json;
+}
 /**
 * Handles an actor request.
 * @template TContextData The context data to pass to the context.
@@ -215,8 +243,8 @@ async function handleObject(request, { values, context, objectDispatcher, author
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$2.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$1.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(name, version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
@@ -258,7 +286,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 			collection = new OrderedCollection({
 				id: baseUri,
 				totalItems: totalItems == null ? null : Number(totalItems),
-				items: filterCollectionItems(itemsOrResponse, name$2, filterPredicate)
+				items: filterCollectionItems(itemsOrResponse, name$1, filterPredicate)
 			});
 		} else {
 			const lastCursor = await collectionCallbacks.lastCursor?.(context, identifier);
@@ -279,7 +307,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 	} else {
 		const uri = new URL(baseUri);
 		uri.searchParams.set("cursor", cursor);
-		const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
+		const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
 			kind: SpanKind.SERVER,
 			attributes: {
 				"activitypub.collection.id": uri.href,
@@ -323,7 +351,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 			id: uri,
 			prev,
 			next,
-			items: filterCollectionItems(items, name$2, filterPredicate),
+			items: filterCollectionItems(items, name$1, filterPredicate),
 			partOf
 		});
 	}
@@ -473,28 +501,104 @@ async function handleInboxInternal(request, parameters, span) {
 		});
 	}
 	const keyCache = new KvKeyCache(kv, kvPrefixes.publicKey, ctx);
-	let ldSigVerified;
-	try {
-		ldSigVerified = await verifyJsonLd(json, {
-			contextLoader: ctx.contextLoader,
-			documentLoader: ctx.documentLoader,
-			keyCache,
-			tracerProvider
+	const jsonWithoutSig = detachSignature(json);
+	const hasLdSignature = hasSignature(json);
+	const canAttemptAlternateAuthAfterLdSignatureFailure = skipSignatureVerification || hasHttpSignatureHeaders(request) || hasObjectIntegrityProof(jsonWithoutSig);
+	let deferredLdSignatureError = void 0;
+	const respondInvalidActivity = async (error) => {
+		logger.error("Failed to parse activity:\n{error}", {
+			recipient,
+			activity: json,
+			error
 		});
-	} catch (error) {
-		if (error instanceof Error && error.name === "jsonld.SyntaxError") {
-			logger.error("Failed to parse JSON-LD:\n{error}", {
+		try {
+			await inboxErrorHandler?.(ctx, error);
+		} catch (error) {
+			logger.error("An unexpected error occurred in inbox error handler:\n{error}", {
+				error,
+				activity: json,
+				recipient
+			});
+		}
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: `Failed to parse activity:\n${error}`
+		});
+		return new Response("Invalid activity.", {
+			status: 400,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	};
+	let compactedJson = json;
+	let compactedJsonWithoutSig = jsonWithoutSig;
+	let ldSigVerified = false;
+	if (hasLdSignature) {
+		try {
+			compactedJson = await compactJsonLd(json, ctx.contextLoader);
+		} catch (error) {
+			if (isInvalidJsonLdError(error)) {
+				logger.error("Failed to parse JSON-LD:\n{error}", {
+					recipient,
+					error
+				});
+				return new Response("Invalid JSON-LD.", {
+					status: 400,
+					headers: { "Content-Type": "text/plain; charset=utf-8" }
+				});
+			}
+			if (!canAttemptAlternateAuthAfterLdSignatureFailure) throw error;
+			if (!skipSignatureVerification) deferredLdSignatureError = error;
+			logger.debug("Failed to normalize JSON-LD for Linked Data Signatures; deferring to another authentication path only if it verifies:\n{error}", {
 				recipient,
 				error
 			});
-			return new Response("Invalid JSON-LD.", {
-				status: 400,
-				headers: { "Content-Type": "text/plain; charset=utf-8" }
-			});
 		}
-		ldSigVerified = false;
+		if (compactedJson !== json) {
+			compactedJsonWithoutSig = detachSignature(compactedJson);
+			try {
+				ldSigVerified = await verifyCompactJsonLd(compactedJson, {
+					contextLoader: ctx.contextLoader,
+					documentLoader: ctx.documentLoader,
+					keyCache,
+					tracerProvider
+				});
+			} catch (error) {
+				if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
+				if (isInvalidJsonLdError(error)) {
+					logger.error("Failed to parse JSON-LD:\n{error}", {
+						recipient,
+						error
+					});
+					return new Response("Invalid JSON-LD.", {
+						status: 400,
+						headers: { "Content-Type": "text/plain; charset=utf-8" }
+					});
+				}
+				if (!canAttemptAlternateAuthAfterLdSignatureFailure) throw error;
+				if (!skipSignatureVerification) try {
+					await Object$1.fromJsonLd(compactedJson, {
+						contextLoader: getNormalizationContextLoader(ctx.contextLoader),
+						documentLoader: ctx.documentLoader,
+						tracerProvider
+					});
+				} catch (parseError) {
+					if (parseError instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(parseError);
+					if (isInvalidJsonLdError(parseError)) {
+						logger.error("Failed to parse JSON-LD:\n{error}", {
+							recipient,
+							error: parseError
+						});
+						return new Response("Invalid JSON-LD.", {
+							status: 400,
+							headers: { "Content-Type": "text/plain; charset=utf-8" }
+						});
+					}
+					deferredLdSignatureError = parseError;
+				}
+				ldSigVerified = false;
+			}
+		}
 	}
-	const jsonWithoutSig = detachSignature(json);
 	let activity = null;
 	let activityVerified = false;
 	if (ldSigVerified) {
@@ -502,7 +606,16 @@ async function handleInboxInternal(request, parameters, span) {
 			recipient,
 			json
 		});
-		activity = await Activity.fromJsonLd(jsonWithoutSig, ctx);
+		try {
+			activity = await Activity.fromJsonLd(compactedJsonWithoutSig, {
+				...ctx,
+				contextLoader: getNormalizationContextLoader(ctx.contextLoader)
+			});
+		} catch (error) {
+			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
+			if (!isPermanentActivityParseError(error)) throw error;
+			return await respondInvalidActivity(error);
+		}
 		activityVerified = true;
 	} else {
 		logger.debug("Linked Data Signatures are not verified.", {
@@ -511,12 +624,21 @@ async function handleInboxInternal(request, parameters, span) {
 		});
 		try {
 			activity = await verifyObject(Activity, jsonWithoutSig, {
-				contextLoader: ctx.contextLoader,
+				contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader),
 				documentLoader: ctx.documentLoader,
 				keyCache,
 				tracerProvider
 			});
 		} catch (error) {
+			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(jsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
+			if (deferredLdSignatureError != null) {
+				logger.debug("Object Integrity Proof fallback did not supersede a deferred Linked Data Signature failure:\n{error}", {
+					recipient,
+					error
+				});
+				activity = null;
+			}
+			if (!isPermanentActivityParseError(error)) throw error;
 			logger.error("Failed to parse activity:\n{error}", {
 				recipient,
 				activity: json,
@@ -564,6 +686,7 @@ async function handleInboxInternal(request, parameters, span) {
 				tracerProvider
 			});
 			if (verification.verified === false) {
+				if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 				const reason = verification.reason;
 				logger.error("Failed to verify the request's HTTP Signatures.", {
 					recipient,
@@ -639,7 +762,15 @@ async function handleInboxInternal(request, parameters, span) {
 			}
 			httpSigKey = verification.key;
 		}
-		activity = await Activity.fromJsonLd(jsonWithoutSig, ctx);
+		try {
+			activity = await Activity.fromJsonLd(jsonWithoutSig, {
+				...ctx,
+				contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader)
+			});
+		} catch (error) {
+			if (!isPermanentActivityParseError(error)) throw error;
+			return await respondInvalidActivity(error);
+		}
 	}
 	if (activity.id != null) span.setAttribute("activitypub.activity.id", activity.id.href);
 	span.setAttribute("activitypub.activity.type", getTypeId(activity).href);
@@ -651,6 +782,7 @@ async function handleInboxInternal(request, parameters, span) {
 		"http_signatures.key_id": httpSigKey?.id?.href ?? ""
 	});
 	if (httpSigKey != null && !await doesActorOwnKey(activity, httpSigKey, ctx)) {
+		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		logger.error("The signer ({keyId}) and the actor ({actorId}) do not match.", {
 			activity: json,
 			recipient,
@@ -675,10 +807,14 @@ async function handleInboxInternal(request, parameters, span) {
 	const routeResult = await routeActivity({
 		context: ctx,
 		json,
+		originalJson: json,
+		normalizedActivity: hasLdSignature && compactedJson !== json ? compactedJson : void 0,
+		ldSignatureVerified: hasLdSignature ? ldSigVerified : void 0,
 		activity,
 		recipient,
 		inboxListeners,
 		inboxContextFactory,
+		listenerInboxContextFactory: ldSigVerified ? inboxContextFactory[rawInboxContextFactorySymbol] : void 0,
 		inboxErrorHandler,
 		kv,
 		kvPrefixes,
@@ -796,8 +932,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$1, values, context, callbacks, tracerProvider = trace.getTracerProvider(), Collection, CollectionPage, filterPredicate) {
-		this.name = name$1;
+	constructor(name$2, values, context, callbacks, tracerProvider = trace.getTracerProvider(), Collection, CollectionPage, filterPredicate) {
+		this.name = name$2;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -1339,6 +1475,18 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 }
 //#endregion
 //#region src/federation/middleware.ts
+function isRemoteContextLoadingFailure(error) {
+	return error instanceof Error && typeof error.details === "object" && error.details != null && error.details.code === "loading remote context failed";
+}
+function isPermanentRemoteContextError(error) {
+	if (!(error instanceof Error) || error.name !== "jsonld.InvalidUrl") return false;
+	const details = error.details;
+	if (details?.code === "invalid remote context") return true;
+	return isRemoteContextLoadingFailure(error) && typeof details?.url === "string" && !URL.canParse(details.url) && isClearlyMalformedContextReference(details.url);
+}
+function isPermanentInboxParseError(error) {
+	return error instanceof Error && (error.name === "UnsafeJsonLdError" || error instanceof InvalidContextReferenceError || isPermanentRemoteContextError(error) || error.name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure(error)) || error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:)/.test(error.message) || isInvalidUrlTypeError(error));
+}
 /**
 * Create a new {@link Federation} instance.
 * @param parameters Parameters for initializing the instance.
@@ -1719,7 +1867,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		}
 		logger.info("Successfully sent activity {activityId} to {inbox}.", { ...logData });
 	}
-	async #listenInboxMessage(ctxData, message, span) {
+	async #listenInboxMessage(ctxData, message, _span) {
 		const logger = getLogger([
 			"fedify",
 			"federation",
@@ -1732,60 +1880,28 @@ var FederationImpl = class extends FederationBuilderImpl {
 			const identity = await this.sharedInboxKeyDispatcher(context);
 			if (identity != null) context = this.#createContext(baseUrl, ctxData, { documentLoader: "identifier" in identity || "username" in identity ? await context.getDocumentLoader(identity) : context.getDocumentLoader(identity) });
 		}
-		const activity = await Activity.fromJsonLd(message.activity, context);
-		span.setAttribute("activitypub.activity.type", getTypeId(activity).href);
-		if (activity.id != null) span.setAttribute("activitypub.activity.id", activity.id.href);
-		const cacheKey = activity.id == null ? null : [
-			...this.kvPrefixes.activityIdempotence,
-			context.origin,
-			activity.id.href
-		];
-		if (cacheKey != null) {
-			if (await this.kv.get(cacheKey) === true) {
-				logger.debug("Activity {activityId} has already been processed.", {
-					activityId: activity.id?.href,
-					activity: message.activity,
-					recipient: message.identifier
-				});
-				return;
-			}
-		}
 		await this._getTracer().startActiveSpan("activitypub.dispatch_inbox_listener", { kind: SpanKind.INTERNAL }, async (span) => {
-			const dispatched = this.inboxListeners?.dispatchWithClass(activity);
-			if (dispatched == null) {
-				logger.error("Unsupported activity type:\n{activity}", {
-					activityId: activity.id?.href,
-					activity: message.activity,
-					recipient: message.identifier,
-					trial: message.attempt
-				});
-				span.setStatus({
-					code: SpanStatusCode.ERROR,
-					message: `Unsupported activity type: ${getTypeId(activity).href}`
-				});
-				span.end();
-				return;
-			}
-			const { class: cls, listener } = dispatched;
-			span.updateName(`activitypub.dispatch_inbox_listener ${cls.name}`);
-			try {
-				await listener(context.toInboxContext(message.identifier, message.activity, activity.id?.href, getTypeId(activity).href), activity);
-			} catch (error) {
+			let activity = null;
+			let cacheKey = null;
+			const reportInboxError = async (error) => {
 				try {
 					await this.inboxErrorHandler?.(context, error);
 				} catch (error) {
 					logger.error("An unexpected error occurred in inbox error handler:\n{error}", {
 						error,
 						trial: message.attempt,
-						activityId: activity.id?.href,
+						activityId: activity?.id?.href,
 						activity: message.activity,
 						recipient: message.identifier
 					});
 				}
+			};
+			const handleRetriableFailure = async (error) => {
+				await reportInboxError(error);
 				if (this.inboxQueue?.nativeRetrial) {
 					logger.error("Failed to process the incoming activity {activityId}; backend will handle retry:\n{error}", {
 						error,
-						activityId: activity.id?.href,
+						activityId: activity?.id?.href,
 						activity: message.activity,
 						recipient: message.identifier
 					});
@@ -1804,17 +1920,25 @@ var FederationImpl = class extends FederationBuilderImpl {
 					logger.error("Failed to process the incoming activity {activityId} (attempt #{attempt}); retry...:\n{error}", {
 						error,
 						attempt: message.attempt,
-						activityId: activity.id?.href,
+						activityId: activity?.id?.href,
 						activity: message.activity,
 						recipient: message.identifier
 					});
+					if (this.inboxQueue == null) {
+						span.setStatus({
+							code: SpanStatusCode.ERROR,
+							message: String(error)
+						});
+						span.end();
+						throw error;
+					}
 					await this.inboxQueue?.enqueue({
 						...message,
 						attempt: message.attempt + 1
 					}, { delay: Temporal.Duration.compare(delay, { seconds: 0 }) < 0 ? Temporal.Duration.from({ seconds: 0 }) : delay });
 				} else logger.error("Failed to process the incoming activity {activityId} after {trial} attempts; giving up:\n{error}", {
 					error,
-					activityId: activity.id?.href,
+					activityId: activity?.id?.href,
 					activity: message.activity,
 					recipient: message.identifier
 				});
@@ -1823,11 +1947,108 @@ var FederationImpl = class extends FederationBuilderImpl {
 					message: String(error)
 				});
 				span.end();
+			};
+			let dispatched;
+			let parseInput = void 0;
+			let parseContextLoader = context.contextLoader;
+			try {
+				const hasSignatureField = hasSignature(message.activity);
+				const shouldParseFromNormalizedSignedPayload = message.ldSignatureVerified === true || message.normalizedActivity != null || message.ldSignatureVerified == null && hasSignatureField;
+				const parseContext = hasSignatureField ? {
+					...context,
+					contextLoader: getNormalizationContextLoader(context.contextLoader)
+				} : {
+					...context,
+					contextLoader: wrapContextLoaderForJsonLd(context.contextLoader)
+				};
+				parseContextLoader = parseContext.contextLoader;
+				let normalizedActivity;
+				if (shouldParseFromNormalizedSignedPayload) {
+					normalizedActivity = message.normalizedActivity ?? await compactJsonLd(message.activity, context.contextLoader);
+					assertSafeJsonLd(normalizedActivity);
+				}
+				parseInput = shouldParseFromNormalizedSignedPayload ? detachSignature(normalizedActivity) : hasSignatureField ? detachSignature(message.activity) : message.activity;
+				activity = await Activity.fromJsonLd(parseInput, parseContext);
+				span.setAttribute("activitypub.activity.type", getTypeId(activity).href);
+				if (activity.id != null) span.setAttribute("activitypub.activity.id", activity.id.href);
+				cacheKey = activity.id == null ? null : [
+					...this.kvPrefixes.activityIdempotence,
+					context.origin,
+					activity.id.href
+				];
+				if (cacheKey != null) {
+					if (await this.kv.get(cacheKey) === true) {
+						logger.debug("Activity {activityId} has already been processed.", {
+							activityId: activity.id?.href,
+							activity: message.activity,
+							recipient: message.identifier
+						});
+						span.end();
+						return;
+					}
+				}
+				dispatched = this.inboxListeners?.dispatchWithClass(activity);
+			} catch (error) {
+				if (activity == null && error instanceof RangeError && await hasMalformedKnownTemporalLiteral(parseInput, parseContextLoader)) {
+					await reportInboxError(error);
+					logger.error("Failed to parse the queued incoming activity {activityId}:\n{error}", {
+						error,
+						trial: message.attempt,
+						activityId: null,
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					span.setStatus({
+						code: SpanStatusCode.ERROR,
+						message: String(error)
+					});
+					span.end();
+					return;
+				}
+				if (isPermanentInboxParseError(error)) {
+					await reportInboxError(error);
+					logger.error("Failed to parse the queued incoming activity {activityId}:\n{error}", {
+						error,
+						trial: message.attempt,
+						activityId: activity?.id?.href,
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					span.setStatus({
+						code: SpanStatusCode.ERROR,
+						message: String(error)
+					});
+					span.end();
+					return;
+				}
+				await handleRetriableFailure(error);
+				return;
+			}
+			if (dispatched == null) {
+				logger.error("Unsupported activity type:\n{activity}", {
+					activityId: activity.id?.href,
+					activity: message.activity,
+					recipient: message.identifier,
+					trial: message.attempt
+				});
+				span.setStatus({
+					code: SpanStatusCode.ERROR,
+					message: `Unsupported activity type: ${getTypeId(activity).href}`
+				});
+				span.end();
+				return;
+			}
+			const { class: cls, listener } = dispatched;
+			span.updateName(`activitypub.dispatch_inbox_listener ${cls.name}`);
+			try {
+				await listener(context.toInboxContext(message.identifier, message.activity, activity.id?.href, getTypeId(activity).href), activity);
+			} catch (error) {
+				await handleRetriableFailure(error);
 				return;
 			}
 			if (cacheKey != null) await this.kv.set(cacheKey, true, { ttl: Temporal.Duration.from({ days: 1 }) });
 			logger.info("Activity {activityId} has been processed.", {
-				activityId: activity.id?.href,
+				activityId: activity?.id?.href,
 				activity: message.activity,
 				recipient: message.identifier
 			});
@@ -2173,16 +2394,18 @@ var FederationImpl = class extends FederationBuilderImpl {
 					onNotFound
 				});
 				context = this.#createContext(request, contextData, { documentLoader: await context.getDocumentLoader({ identifier: route.values.identifier }) });
-			case "sharedInbox":
+			case "sharedInbox": {
 				if (routeName !== "inbox" && this.sharedInboxKeyDispatcher != null) {
 					const identity = await this.sharedInboxKeyDispatcher(context);
 					if (identity != null) context = this.#createContext(request, contextData, { documentLoader: "identifier" in identity || "username" in identity ? await context.getDocumentLoader(identity) : context.getDocumentLoader(identity) });
 				}
 				if (!this.manuallyStartQueue) this._startQueueInternal(contextData);
+				const inboxContextFactory = context.toInboxContext.bind(context);
+				inboxContextFactory[rawInboxContextFactorySymbol] = context.toInboxContext.bind(context);
 				return await handleInbox(request, {
 					recipient: route.values.identifier ?? null,
 					context,
-					inboxContextFactory: context.toInboxContext.bind(context),
+					inboxContextFactory,
 					kv: this.kv,
 					kvPrefixes: this.kvPrefixes,
 					queue: this.inboxQueue,
@@ -2197,6 +2420,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 					tracerProvider: this.tracerProvider,
 					idempotencyStrategy: this.idempotencyStrategy
 				});
+			}
 			case "following": return await handleCollection(request, {
 				name: "following",
 				identifier: route.values.identifier,
@@ -2872,6 +3096,7 @@ var ContextImpl = class ContextImpl {
 		const routeResult = await routeActivity({
 			context: this,
 			json,
+			ldSignatureVerified: false,
 			activity,
 			recipient,
 			inboxListeners: this.federation.inboxListeners,
@@ -2986,6 +3211,14 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 };
 var InboxContextImpl = class InboxContextImpl extends ContextImpl {
 	recipient;
+	/**
+	* The original received activity payload.
+	*
+	* Fedify may normalize a Linked Data Signature payload internally for safe
+	* parsing, but forwarding must keep the sender's payload unchanged so
+	* third-party signatures/proofs remain intact.
+	* @internal
+	*/
 	activity;
 	activityId;
 	activityType;

package/dist/{middleware-C2c1rlmE.mjs → middleware-Li_g_vqz.mjs}

@@ -1,5 +1,5 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-DDsnRvFC.mjs";
+import { n as FederationImpl } from "./middleware-DmT9t0BJ.mjs";
 export { FederationImpl };

package/dist/{mod-CnwZoDzx.d.ts → mod-0dF0OeGw.d.cts}

@@ -1,6 +1,5 @@
-import { Temporal } from "@js-temporal/polyfill";
-import { URLPattern } from "urlpattern-polyfill";
-import { Q as ActorHandleMapper, X as ActorAliasMapper, Z as ActorDispatcher, _t as WebFingerLinksDispatcher, s as RequestContext } from "./context-C0fssarc.js";
+/// <reference lib="esnext.temporal" />
+import { Q as ActorHandleMapper, X as ActorAliasMapper, Z as ActorDispatcher, _t as WebFingerLinksDispatcher, s as RequestContext } from "./context-o22vjzS2.cjs";
 import { Span, Tracer } from "@opentelemetry/api";
 
 //#region src/federation/webfinger.d.ts

package/dist/{mod-B505FZBC.d.cts → mod-BTWFtZwa.d.ts}

@@ -1,7 +1,8 @@
-import { n as HttpMessageSignaturesSpecDeterminer } from "./http-CrGuipxe.cjs";
-import { n as KvStore, t as KvKey } from "./kv-CbLNp3zQ.cjs";
-import { DocumentLoader, DocumentLoaderFactoryOptions } from "@fedify/vocab-runtime";
+/// <reference lib="esnext.temporal" />
+import { n as HttpMessageSignaturesSpecDeterminer } from "./http-BDZeS5om.js";
+import { n as KvStore, t as KvKey } from "./kv-D6hNiMTK.js";
 import { TracerProvider } from "@opentelemetry/api";
+import { DocumentLoader, DocumentLoaderFactoryOptions } from "@fedify/vocab-runtime";
 
 //#region src/utils/docloader.d.ts
 /**

package/dist/{mod-Cgpc49fA.d.cts → mod-Bv1elC-b.d.ts}

@@ -1,4 +1,5 @@
-import { Q as ActorHandleMapper, X as ActorAliasMapper, Z as ActorDispatcher, _t as WebFingerLinksDispatcher, s as RequestContext } from "./context-LmrZPwti.cjs";
+/// <reference lib="esnext.temporal" />
+import { Q as ActorHandleMapper, X as ActorAliasMapper, Z as ActorDispatcher, _t as WebFingerLinksDispatcher, s as RequestContext } from "./context-_l9t359k.js";
 import { Span, Tracer } from "@opentelemetry/api";
 
 //#region src/federation/webfinger.d.ts

package/dist/{mod-DoJBjjnO.d.cts → mod-CjiK2zrW.d.ts}

@@ -1,7 +1,8 @@
-import { S as KeyCache } from "./http-CrGuipxe.cjs";
+/// <reference lib="esnext.temporal" />
+import { S as KeyCache } from "./http-BDZeS5om.js";
 import { CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1 } from "@fedify/vocab";
-import { DocumentLoader } from "@fedify/vocab-runtime";
 import { TracerProvider } from "@opentelemetry/api";
+import { DocumentLoader } from "@fedify/vocab-runtime";
 
 //#region src/sig/ld.d.ts
 /**