@fedify/fedify 2.1.13 → 2.1.14

package/dist/{builder-BII9kySt.mjs → builder-BBifZZ5G.mjs}

@@ -2,8 +2,8 @@ import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as RouterError, t as Router } from "./router-CrMLXoOr.mjs";
-import { n as version, t as name } from "./deno-DsYpa8eE.mjs";
-import { t as InboxListenerSet } from "./inbox-Fz4Sd_YF.mjs";
+import { n as version, t as name } from "./deno-bqnW1QlD.mjs";
+import { t as InboxListenerSet } from "./inbox-7b3VYnec.mjs";
 import { getTypeId } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { getLogger } from "@logtape/logtape";
@@ -43,7 +43,7 @@ var FederationBuilderImpl = class {
 		this.collectionTypeIds = {};
 	}
 	async build(options) {
-		const { FederationImpl } = await import("./middleware-CgSiHODB.mjs");
+		const { FederationImpl } = await import("./middleware-Li_g_vqz.mjs");
 		const f = new FederationImpl(options);
 		const trailingSlashInsensitiveValue = f.router.trailingSlashInsensitive;
 		f.router = this.router.clone();

package/dist/compat/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Ct as ActivityTransformer, n as Context } from "../context-BUEOz39K.cjs";
+import { Ct as ActivityTransformer, n as Context } from "../context-o22vjzS2.cjs";
 import { Activity } from "@fedify/vocab";
 
 //#region src/compat/transformers.d.ts

package/dist/compat/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Ct as ActivityTransformer, n as Context } from "../context-CqlKdpQu.js";
+import { Ct as ActivityTransformer, n as Context } from "../context-_l9t359k.js";
 import { Activity } from "@fedify/vocab";
 
 //#region src/compat/transformers.d.ts

package/dist/compat/transformers.test.mjs

@@ -5,7 +5,7 @@ import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import { t as assertInstanceOf } from "../assert_instance_of-C4Ri6VuN.mjs";
 import { t as assert } from "../assert-ddO5KLpe.mjs";
 import { t as MemoryKvStore } from "../kv-tL2TOE9X.mjs";
-import { _ as autoIdAssigner, g as actorDehydrator, n as FederationImpl } from "../middleware-BwUi2CSK.mjs";
+import { _ as autoIdAssigner, g as actorDehydrator, n as FederationImpl } from "../middleware-DmT9t0BJ.mjs";
 import { test } from "@fedify/fixture";
 import { Follow, Person } from "@fedify/vocab";
 //#region src/compat/transformers.test.ts

package/dist/{context-CqlKdpQu.d.ts → context-_l9t359k.d.ts}

@@ -706,6 +706,42 @@ interface InboxMessage {
   readonly id: ReturnType<typeof crypto.randomUUID>;
   readonly baseUrl: string;
   readonly activity: unknown;
+  /**
+  * The normalized JSON-LD representation of a signed inbox activity that
+  * Fedify already compacted successfully while accepting the request.  Queue
+  * workers can reuse this producer-side parse cache under stricter loader or
+  * network constraints without changing the raw payload preserved for
+  * forwarding.
+  *
+  * This may exist even when {@link ldSignatureVerified} is `false`, because
+  * fallback-authenticated traffic and already-queued backlog items can still
+  * depend on the cached normalized form to avoid re-fetching remote custom
+  * contexts during worker processing.
+  *
+  * This is optional for backward compatibility with messages that were
+  * queued by older Fedify versions or that were already in a queue before
+  * upgrading.
+  *
+  * Fedify keeps this on the queued message itself instead of an external
+  * sidecar because generic queue backends do not provide reliable lifecycle
+  * guarantees for auxiliary storage across retries and redeliveries.
+  *
+  * @internal
+  */
+  readonly normalizedActivity?: unknown;
+  /**
+  * Whether the producer actually verified the Linked Data Signature before
+  * queueing this message.  This lets workers distinguish verified LDS replay
+  * from other authenticated inbox traffic that merely happened to include a
+  * signature block.  This provenance marker is separate from the optional
+  * normalizedActivity parse cache.
+  *
+  * `undefined` preserves backward compatibility with older queued messages
+  * that predate this marker.
+  *
+  * @internal
+  */
+  readonly ldSignatureVerified?: boolean;
   readonly started: string;
   readonly attempt: number;
   readonly identifier: string | null;
@@ -2356,9 +2392,12 @@ interface InboxContext<TContextData> extends Context<TContextData> {
   * Forwards a received activity to the recipients' inboxes.  The forwarded
   * activity will be signed in HTTP Signatures by the forwarder, but its
   * payload will not be modified, i.e., Linked Data Signatures and Object
-  * Integrity Proofs will not be added.  Therefore, if the activity is not
-  * signed (i.e., it has neither Linked Data Signatures nor Object Integrity
-  * Proofs), the recipient probably will not trust the activity.
+  * Integrity Proofs will not be added.  Even when Fedify internally
+  * normalizes a Linked Data Signature activity for parsing, this method still
+  * forwards the original received payload so the sender's signatures/proofs
+  * are preserved as-is.  Therefore, if the activity is not signed (i.e., it
+  * has neither Linked Data Signatures nor Object Integrity Proofs), the
+  * recipient probably will not trust the activity.
   * @param forwarder The forwarder's identifier or the forwarder's username
   *                  or the forwarder's key pair(s).
   * @param recipients The recipients of the activity.
@@ -2374,9 +2413,12 @@ interface InboxContext<TContextData> extends Context<TContextData> {
   * Forwards a received activity to the recipients' inboxes.  The forwarded
   * activity will be signed in HTTP Signatures by the forwarder, but its
   * payload will not be modified, i.e., Linked Data Signatures and Object
-  * Integrity Proofs will not be added.  Therefore, if the activity is not
-  * signed (i.e., it has neither Linked Data Signatures nor Object Integrity
-  * Proofs), the recipient probably will not trust the activity.
+  * Integrity Proofs will not be added.  Even when Fedify internally
+  * normalizes a Linked Data Signature activity for parsing, this method still
+  * forwards the original received payload so the sender's signatures/proofs
+  * are preserved as-is.  Therefore, if the activity is not signed (i.e., it
+  * has neither Linked Data Signatures nor Object Integrity Proofs), the
+  * recipient probably will not trust the activity.
   * @param forwarder The forwarder's identifier or the forwarder's username.
   * @param recipients In this case, it must be `"followers"`.
   * @param options Options for forwarding the activity.

package/dist/{context-BUEOz39K.d.cts → context-o22vjzS2.d.cts}

@@ -706,6 +706,42 @@ interface InboxMessage {
   readonly id: ReturnType<typeof crypto.randomUUID>;
   readonly baseUrl: string;
   readonly activity: unknown;
+  /**
+  * The normalized JSON-LD representation of a signed inbox activity that
+  * Fedify already compacted successfully while accepting the request.  Queue
+  * workers can reuse this producer-side parse cache under stricter loader or
+  * network constraints without changing the raw payload preserved for
+  * forwarding.
+  *
+  * This may exist even when {@link ldSignatureVerified} is `false`, because
+  * fallback-authenticated traffic and already-queued backlog items can still
+  * depend on the cached normalized form to avoid re-fetching remote custom
+  * contexts during worker processing.
+  *
+  * This is optional for backward compatibility with messages that were
+  * queued by older Fedify versions or that were already in a queue before
+  * upgrading.
+  *
+  * Fedify keeps this on the queued message itself instead of an external
+  * sidecar because generic queue backends do not provide reliable lifecycle
+  * guarantees for auxiliary storage across retries and redeliveries.
+  *
+  * @internal
+  */
+  readonly normalizedActivity?: unknown;
+  /**
+  * Whether the producer actually verified the Linked Data Signature before
+  * queueing this message.  This lets workers distinguish verified LDS replay
+  * from other authenticated inbox traffic that merely happened to include a
+  * signature block.  This provenance marker is separate from the optional
+  * normalizedActivity parse cache.
+  *
+  * `undefined` preserves backward compatibility with older queued messages
+  * that predate this marker.
+  *
+  * @internal
+  */
+  readonly ldSignatureVerified?: boolean;
   readonly started: string;
   readonly attempt: number;
   readonly identifier: string | null;
@@ -2356,9 +2392,12 @@ interface InboxContext<TContextData> extends Context<TContextData> {
   * Forwards a received activity to the recipients' inboxes.  The forwarded
   * activity will be signed in HTTP Signatures by the forwarder, but its
   * payload will not be modified, i.e., Linked Data Signatures and Object
-  * Integrity Proofs will not be added.  Therefore, if the activity is not
-  * signed (i.e., it has neither Linked Data Signatures nor Object Integrity
-  * Proofs), the recipient probably will not trust the activity.
+  * Integrity Proofs will not be added.  Even when Fedify internally
+  * normalizes a Linked Data Signature activity for parsing, this method still
+  * forwards the original received payload so the sender's signatures/proofs
+  * are preserved as-is.  Therefore, if the activity is not signed (i.e., it
+  * has neither Linked Data Signatures nor Object Integrity Proofs), the
+  * recipient probably will not trust the activity.
   * @param forwarder The forwarder's identifier or the forwarder's username
   *                  or the forwarder's key pair(s).
   * @param recipients The recipients of the activity.
@@ -2374,9 +2413,12 @@ interface InboxContext<TContextData> extends Context<TContextData> {
   * Forwards a received activity to the recipients' inboxes.  The forwarded
   * activity will be signed in HTTP Signatures by the forwarder, but its
   * payload will not be modified, i.e., Linked Data Signatures and Object
-  * Integrity Proofs will not be added.  Therefore, if the activity is not
-  * signed (i.e., it has neither Linked Data Signatures nor Object Integrity
-  * Proofs), the recipient probably will not trust the activity.
+  * Integrity Proofs will not be added.  Even when Fedify internally
+  * normalizes a Linked Data Signature activity for parsing, this method still
+  * forwards the original received payload so the sender's signatures/proofs
+  * are preserved as-is.  Therefore, if the activity is not signed (i.e., it
+  * has neither Linked Data Signatures nor Object Integrity Proofs), the
+  * recipient probably will not trust the activity.
   * @param forwarder The forwarder's identifier or the forwarder's username.
   * @param recipients In this case, it must be `"followers"`.
   * @param options Options for forwarding the activity.

package/dist/{deno-DsYpa8eE.mjs → deno-bqnW1QlD.mjs}

@@ -3,6 +3,6 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.1.13";
+var version = "2.1.14";
 //#endregion
 export { version as n, name as t };

package/dist/{docloader-SiTy_uEf.mjs → docloader-D-Fu0kBF.mjs}

@@ -1,8 +1,8 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { o as validateCryptoKey } from "./key-BTwUWGeQ.mjs";
-import { n as doubleKnock } from "./http-sMWapA1W.mjs";
+import { o as validateCryptoKey } from "./key-B3OBz6A_.mjs";
+import { n as doubleKnock } from "./http-DvhFwy2E.mjs";
 import { curry } from "es-toolkit";
 import { UrlError, createActivityPubRequest, getRemoteDocument, logRequest, validatePublicUrl } from "@fedify/vocab-runtime";
 import { getLogger } from "@logtape/logtape";

package/dist/federation/builder.test.mjs

@@ -5,7 +5,7 @@ import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import { a as assertExists } from "../std__assert-Duiq_YC9.mjs";
 import { t as assertThrows } from "../assert_throws-4NwKEy2q.mjs";
 import { t as MemoryKvStore } from "../kv-tL2TOE9X.mjs";
-import { n as createFederationBuilder } from "../builder-BII9kySt.mjs";
+import { n as createFederationBuilder } from "../builder-BBifZZ5G.mjs";
 import { test } from "@fedify/fixture";
 import { Activity, Note, Person } from "@fedify/vocab";
 //#region src/federation/builder.test.ts